Merge staging-next into staging

2025-07-13 21:50:33 +03:00 · 2025-01-29 18:04:58 +00:00 · 2025-01-29 18:04:58 +00:00 · 354d9c1c97
commit 354d9c1c97
parent f4db72e1e9 fab0e527b1
171 changed files with 1809 additions and 1093 deletions
--- a/ci/eval/compare/default.nix
+++ b/ci/eval/compare/default.nix
@ -69,7 +69,6 @@ let
    groupByPlatform
    extractPackageNames
    getLabels
-    uniqueStrings
    ;

  getAttrs = dir: builtins.fromJSON (builtins.readFile "${dir}/outpaths.json");
@ -81,7 +80,7 @@ let
  # - values: lists of `packagePlatformPath`s
  diffAttrs = diff beforeAttrs afterAttrs;

-  rebuilds = uniqueStrings (diffAttrs.added ++ diffAttrs.changed);
+  rebuilds = diffAttrs.added ++ diffAttrs.changed;
  rebuildsPackagePlatformAttrs = convertToPackagePlatformAttrs rebuilds;

  changed-paths =
@ -110,7 +109,7 @@ let
    );

  maintainers = import ./maintainers.nix {
-    changedattrs = lib.unique (map (a: a.packagePath) rebuildsPackagePlatformAttrs);
+    changedattrs = lib.attrNames (lib.groupBy (a: a.name) rebuildsPackagePlatformAttrs);
    changedpathsjson = touchedFilesJson;
  };
 in
--- a/ci/eval/compare/maintainers.nix
+++ b/ci/eval/compare/maintainers.nix
@ -11,17 +11,13 @@ let
  changedpaths = builtins.fromJSON (builtins.readFile changedpathsjson);

  anyMatchingFile =
-    filename:
-    let
-      matching = builtins.filter (changed: lib.strings.hasSuffix changed filename) changedpaths;
-    in
-    (builtins.length matching) > 0;
+    filename: builtins.any (changed: lib.strings.hasSuffix changed filename) changedpaths;

-  anyMatchingFiles = files: (builtins.length (builtins.filter anyMatchingFile files)) > 0;
+  anyMatchingFiles = files: builtins.any anyMatchingFile files;

-  enrichedAttrs = builtins.map (path: {
-    path = path;
-    name = builtins.concatStringsSep "." path;
+  enrichedAttrs = builtins.map (name: {
+    path = lib.splitString "." name;
+    name = name;
  }) changedattrs;

  validPackageAttributes = builtins.filter (
@ -45,14 +41,6 @@ let
    pkg: pkg // { maintainers = (pkg.package.meta or { }).maintainers or [ ]; }
  ) attrsWithPackages;

-  attrsWeCanPing = builtins.filter (
-    pkg:
-    if (builtins.length pkg.maintainers) > 0 then
-      true
-    else
-      builtins.trace "Package has no maintainers: ${pkg.name}" false
-  ) attrsWithMaintainers;
-
  relevantFilenames =
    drv:
    (lib.lists.unique (
@ -88,33 +76,16 @@ let

  attrsWithModifiedFiles = builtins.filter (pkg: anyMatchingFiles pkg.filenames) attrsWithFilenames;

-  listToPing = lib.lists.flatten (
-    builtins.map (
-      pkg:
-      builtins.map (maintainer: {
-        id = maintainer.githubId;
-        packageName = pkg.name;
-        dueToFiles = pkg.filenames;
-      }) pkg.maintainers
-    ) attrsWithModifiedFiles
-  );
+  listToPing = lib.concatMap (
+    pkg:
+    builtins.map (maintainer: {
+      id = maintainer.githubId;
+      packageName = pkg.name;
+      dueToFiles = pkg.filenames;
+    }) pkg.maintainers
+  ) attrsWithModifiedFiles;

-  byMaintainer = lib.lists.foldr (
-    ping: collector:
-    collector
-    // {
-      "${toString ping.id}" = [
-        { inherit (ping) packageName dueToFiles; }
-      ] ++ (collector."${toString ping.id}" or [ ]);
-    }
-  ) { } listToPing;
-
-  textForPackages =
-    packages: lib.strings.concatStringsSep ", " (builtins.map (pkg: pkg.packageName) packages);
-
-  textPerMaintainer = lib.attrsets.mapAttrs (
-    maintainer: packages: "- @${maintainer} for ${textForPackages packages}"
-  ) byMaintainer;
+  byMaintainer = lib.groupBy (ping: toString ping.id) listToPing;

  packagesPerMaintainer = lib.attrsets.mapAttrs (
    maintainer: packages: builtins.map (pkg: pkg.packageName) packages
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -9532,6 +9532,12 @@
    githubId = 1592375;
    name = "Walter Huf";
  };
+  huggy = {
+    email = "nixpkgs@huggy.moe";
+    github = "makeding";
+    githubId = 6511667;
+    name = "huggy";
+  };
  hughmandalidis = {
    name = "Hugh Mandalidis";
    email = "mandalidis.hugh@gmail.com";
@ -14243,6 +14249,12 @@
    githubId = 585424;
    name = "Massimo Gengarelli";
  };
+  MasterEvarior = {
+    email = "nix-maintainer@giannin.ch";
+    github = "MasterEvarior";
+    githubId = 36074738;
+    name = "MasterEvarior";
+  };
  matdibu = {
    email = "contact@mateidibu.dev";
    github = "matdibu";
@ -15744,6 +15756,13 @@
    githubId = 2176611;
    name = "Marko Poikonen";
  };
+  mtpham99 = {
+    name = "Matthew Pham";
+    email = "mtpham.nixos@protonmail.com";
+    github = "mtpham99";
+    githubId = 72663763;
+    keys = [ { fingerprint = "DB3E A12D B291 594A 79C5 F6B3 10AB 6868 37F6 FA3F"; } ];
+  };
  mtreca = {
    email = "maxime.treca@gmail.com";
    github = "mtreca";
@ -17349,6 +17368,12 @@
    githubId = 108072;
    name = "Slawomir Gonet";
  };
+  oughie = {
+    name = "Oughie";
+    email = "oughery@gmail.com";
+    github = "Oughie";
+    githubId = 123173954;
+  };
  outfoxxed = {
    name = "outfoxxed";
    email = "nixpkgs@outfoxxed.me";
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@ -46,10 +46,11 @@ with lib.maintainers;

  android = {
    members = [
-      numinit
-      hadilq
-      RossComputerGuy
      adrian-gierakowski
+      hadilq
+      johnrtitor
+      numinit
+      RossComputerGuy
    ];
    scope = "Maintain Android-related tooling in nixpkgs.";
    githubTeams = [ "android" ];
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@ -221,6 +221,8 @@
  word-breaking. So you want to write `extraArgs = [ "--prefer" "spaced pat" ]`
  rather than previous `extraArgs = [ "--prefer 'spaced pat'" ]`.

+- `nodePackages."@commitlint/config-conventional"` has been removed, as it is a library, and projects should depend on it instead.
+
 - `nodePackages.vls` has been deprecated, as the upstream consumer of it, vetur, has been deprecated by upstream. Upstream suggests migrating to Volar for Vue LSP tooling instead.

 - `nodePackages.create-react-native-app` has been removed, as it is deprecated. Upstream suggests using a framework for React Native apps instead.
@ -466,6 +468,8 @@

 - `gerbera` now has wavpack support.

+- `ddclient` was updated from 3.11.2 to 4.0.0 [Release notes](https://github.com/ddclient/ddclient/releases/tag/v4.0.0)
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

 ```{=include=} sections
--- a/nixos/modules/installer/tools/tools.nix
+++ b/nixos/modules/installer/tools/tools.nix
@ -4,7 +4,7 @@
 { config, lib, pkgs, ... }:

 let
-  makeProg = args: pkgs.substituteAll (args // {
+  makeProg = args: pkgs.replaceVarsWith (args // {
    dir = "bin";
    isExecutable = true;
    nativeBuildInputs = [
@ -18,28 +18,32 @@ let
  nixos-generate-config = makeProg {
    name = "nixos-generate-config";
    src = ./nixos-generate-config.pl;
-    perl = "${pkgs.perl.withPackages (p: [ p.FileSlurp ])}/bin/perl";
-    hostPlatformSystem = pkgs.stdenv.hostPlatform.system;
-    detectvirt = "${config.systemd.package}/bin/systemd-detect-virt";
-    btrfs = "${pkgs.btrfs-progs}/bin/btrfs";
-    inherit (config.system.nixos-generate-config) configuration desktopConfiguration;
-    xserverEnabled = config.services.xserver.enable;
+    replacements = {
+      perl = "${pkgs.perl.withPackages (p: [ p.FileSlurp ])}/bin/perl";
+      hostPlatformSystem = pkgs.stdenv.hostPlatform.system;
+      detectvirt = "${config.systemd.package}/bin/systemd-detect-virt";
+      btrfs = "${pkgs.btrfs-progs}/bin/btrfs";
+      inherit (config.system.nixos-generate-config) configuration desktopConfiguration;
+      xserverEnabled = config.services.xserver.enable;
+    };
    manPage = ./manpages/nixos-generate-config.8;
  };

  nixos-version = makeProg {
    name = "nixos-version";
    src = ./nixos-version.sh;
-    inherit (pkgs) runtimeShell;
-    inherit (config.system.nixos) version codeName revision;
-    inherit (config.system) configurationRevision;
-    json = builtins.toJSON ({
-      nixosVersion = config.system.nixos.version;
-    } // lib.optionalAttrs (config.system.nixos.revision != null) {
-      nixpkgsRevision = config.system.nixos.revision;
-    } // lib.optionalAttrs (config.system.configurationRevision != null) {
-      configurationRevision = config.system.configurationRevision;
-    });
+    replacements = {
+      inherit (pkgs) runtimeShell;
+      inherit (config.system.nixos) version codeName revision;
+      inherit (config.system) configurationRevision;
+      json = builtins.toJSON ({
+        nixosVersion = config.system.nixos.version;
+      } // lib.optionalAttrs (config.system.nixos.revision != null) {
+        nixpkgsRevision = config.system.nixos.revision;
+      } // lib.optionalAttrs (config.system.configurationRevision != null) {
+        configurationRevision = config.system.configurationRevision;
+      });
+    };
    manPage = ./manpages/nixos-version.8;
  };

--- a/nixos/modules/services/networking/wpa_supplicant.nix
+++ b/nixos/modules/services/networking/wpa_supplicant.nix
@ -94,7 +94,7 @@ let
        ++ optional (pskString != null) "psk=${pskString}"
        ++ optionals (opts.auth != null) (filter (x: x != "") (splitString "\n" opts.auth))
        ++ optional (opts.priority != null) "priority=${toString opts.priority}"
-        ++ optional (opts.extraConfig != "") opts.extraConfig;
+        ++ filter (x: x != "") (splitString "\n" opts.extraConfig);
    in
    ''
      network={
--- a/nixos/modules/services/search/hound.nix
+++ b/nixos/modules/services/search/hound.nix
@ -7,6 +7,13 @@
 let
  cfg = config.services.hound;
  settingsFormat = pkgs.formats.json { };
+  houndConfigFile = pkgs.writeTextFile {
+    name = "hound-config.json";
+    text = builtins.toJSON cfg.settings;
+    checkPhase = ''
+      ${cfg.package}/bin/houndd -check-conf -conf $out
+    '';
+  };
 in
 {
  imports = [
@ -96,13 +103,7 @@ in
      };
    };

-    environment.etc."hound/config.json".source = pkgs.writeTextFile {
-      name = "hound-config";
-      text = builtins.toJSON cfg.settings;
-      checkPhase = ''
-        ${cfg.package}/bin/houndd -check-conf -conf $out
-      '';
-    };
+    environment.etc."hound/config.json".source = houndConfigFile;

    services.hound.settings = {
      dbpath = "${config.services.hound.home}/data";
@ -112,6 +113,7 @@ in
      description = "Hound Code Search";
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
+      restartTriggers = [ houndConfigFile ];
      serviceConfig = {
        User = cfg.user;
        Group = cfg.group;
--- a/nixos/modules/services/security/canaille.nix
+++ b/nixos/modules/services/security/canaille.nix
@ -33,9 +33,12 @@ let
      old.dependencies
      ++ old.optional-dependencies.front
      ++ old.optional-dependencies.oidc
+      ++ old.optional-dependencies.scim
      ++ old.optional-dependencies.ldap
      ++ old.optional-dependencies.sentry
-      ++ old.optional-dependencies.postgresql;
+      ++ old.optional-dependencies.postgresql
+      ++ old.optional-dependencies.otp
+      ++ old.optional-dependencies.sms;
    makeWrapperArgs = (old.makeWrapperArgs or [ ]) ++ [
      "--set CONFIG /etc/canaille/config.toml"
      "--set SECRETS_DIR \"${secretsDir}\""
--- a/nixos/modules/system/boot/loader/grub/install-grub.pl
+++ b/nixos/modules/system/boot/loader/grub/install-grub.pl
@ -527,7 +527,7 @@ sub addGeneration {
    my @links = sort (glob "$path/specialisation/*");

    if ($current != 1 && scalar(@links) != 0) {
-        $conf .= "submenu \"> $name$nameSuffix\" --class submenu {\n";
+        $conf .= "submenu \"$name$nameSuffix\" --class submenu {\n";
    }

    addEntry("$name" . (scalar(@links) == 0 ? "" : " - Default") . $nameSuffix, $path, $options, $current);
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
@ -31,7 +31,7 @@ let

  edk2ShellEspPath = "efi/edk2-uefi-shell/shell.efi";

-  systemdBootBuilder = pkgs.substituteAll rec {
+  systemdBootBuilder = pkgs.replaceVarsWith {
    name = "systemd-boot";

    dir = "bin";
@ -40,68 +40,66 @@ let

    isExecutable = true;

-    inherit (builtins) storeDir;
+    replacements = rec {
+      inherit (builtins) storeDir;

-    inherit (pkgs) python3;
+      inherit (pkgs) python3;

-    systemd = config.systemd.package;
+      systemd = config.systemd.package;

-    bootspecTools = pkgs.bootspec;
+      bootspecTools = pkgs.bootspec;

-    nix = config.nix.package.out;
+      nix = config.nix.package.out;

-    timeout = if config.boot.loader.timeout == null then "menu-force" else config.boot.loader.timeout;
+      timeout = if config.boot.loader.timeout == null then "menu-force" else config.boot.loader.timeout;

-    configurationLimit = if cfg.configurationLimit == null then 0 else cfg.configurationLimit;
+      configurationLimit = if cfg.configurationLimit == null then 0 else cfg.configurationLimit;

-    inherit (cfg)
-      consoleMode
-      graceful
-      editor
-      rebootForBitlocker
-      ;
+      inherit (cfg)
+        consoleMode
+        graceful
+        editor
+        rebootForBitlocker
+        ;

-    inherit (efi) efiSysMountPoint canTouchEfiVariables;
+      inherit (efi) efiSysMountPoint canTouchEfiVariables;

-    bootMountPoint =
-      if cfg.xbootldrMountPoint != null then cfg.xbootldrMountPoint else efi.efiSysMountPoint;
+      bootMountPoint =
+        if cfg.xbootldrMountPoint != null then cfg.xbootldrMountPoint else efi.efiSysMountPoint;

-    nixosDir = "/EFI/nixos";
+      nixosDir = "/EFI/nixos";

-    inherit (config.system.nixos) distroName;
+      inherit (config.system.nixos) distroName;

-    memtest86 = optionalString cfg.memtest86.enable pkgs.memtest86plus;
+      checkMountpoints = pkgs.writeShellScript "check-mountpoints" ''
+        fail() {
+          echo "$1 = '$2' is not a mounted partition. Is the path configured correctly?" >&2
+          exit 1
+        }
+        ${pkgs.util-linuxMinimal}/bin/findmnt ${efiSysMountPoint} > /dev/null || fail efiSysMountPoint ${efiSysMountPoint}
+        ${lib.optionalString (cfg.xbootldrMountPoint != null)
+          "${pkgs.util-linuxMinimal}/bin/findmnt ${cfg.xbootldrMountPoint} > /dev/null || fail xbootldrMountPoint ${cfg.xbootldrMountPoint}"
+        }
+      '';

-    netbootxyz = optionalString cfg.netbootxyz.enable pkgs.netbootxyz-efi;
+      copyExtraFiles = pkgs.writeShellScript "copy-extra-files" ''
+        empty_file=$(${pkgs.coreutils}/bin/mktemp)

-    checkMountpoints = pkgs.writeShellScript "check-mountpoints" ''
-      fail() {
-        echo "$1 = '$2' is not a mounted partition. Is the path configured correctly?" >&2
-        exit 1
-      }
-      ${pkgs.util-linuxMinimal}/bin/findmnt ${efiSysMountPoint} > /dev/null || fail efiSysMountPoint ${efiSysMountPoint}
-      ${lib.optionalString (cfg.xbootldrMountPoint != null)
-        "${pkgs.util-linuxMinimal}/bin/findmnt ${cfg.xbootldrMountPoint} > /dev/null || fail xbootldrMountPoint ${cfg.xbootldrMountPoint}"
-      }
-    '';
+        ${concatStrings (
+          mapAttrsToList (n: v: ''
+            ${pkgs.coreutils}/bin/install -Dp "${v}" "${bootMountPoint}/"${escapeShellArg n}
+            ${pkgs.coreutils}/bin/install -D $empty_file "${bootMountPoint}/${nixosDir}/.extra-files/"${escapeShellArg n}
+          '') cfg.extraFiles
+        )}

-    copyExtraFiles = pkgs.writeShellScript "copy-extra-files" ''
-      empty_file=$(${pkgs.coreutils}/bin/mktemp)
-
-      ${concatStrings (
-        mapAttrsToList (n: v: ''
-          ${pkgs.coreutils}/bin/install -Dp "${v}" "${bootMountPoint}/"${escapeShellArg n}
-          ${pkgs.coreutils}/bin/install -D $empty_file "${bootMountPoint}/${nixosDir}/.extra-files/"${escapeShellArg n}
-        '') cfg.extraFiles
-      )}
-
-      ${concatStrings (
-        mapAttrsToList (n: v: ''
-          ${pkgs.coreutils}/bin/install -Dp "${pkgs.writeText n v}" "${bootMountPoint}/loader/entries/"${escapeShellArg n}
-          ${pkgs.coreutils}/bin/install -D $empty_file "${bootMountPoint}/${nixosDir}/.extra-files/loader/entries/"${escapeShellArg n}
-        '') cfg.extraEntries
-      )}
-    '';
+        ${concatStrings (
+          mapAttrsToList (n: v: ''
+            ${pkgs.coreutils}/bin/install -Dp "${pkgs.writeText n v}" "${bootMountPoint}/loader/entries/"${escapeShellArg n}
+            ${pkgs.coreutils}/bin/install -D $empty_file "${bootMountPoint}/${nixosDir}/.extra-files/loader/entries/"${escapeShellArg n}
+          '') cfg.extraEntries
+        )}
+      '';
+    };
  };

  finalSystemdBootBuilder = pkgs.writeScript "install-systemd-boot.sh" ''
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -975,6 +975,7 @@ in {
  spark = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./spark {};
  spiped = runTest ./spiped.nix;
  sqlite3-to-mysql = handleTest ./sqlite3-to-mysql.nix {};
+  squid = handleTest ./squid.nix {};
  sslh = handleTest ./sslh.nix {};
  ssh-agent-auth = handleTest ./ssh-agent-auth.nix {};
  ssh-audit = handleTest ./ssh-audit.nix {};
--- a/nixos/tests/hound.nix
+++ b/nixos/tests/hound.nix
@ -11,17 +11,15 @@ import ./make-test-python.nix (
      {
        services.hound = {
          enable = true;
-          config = ''
-            {
-              "max-concurrent-indexers": 1,
-              "dbpath": "/var/lib/hound/data",
-              "repos": {
-                "nix": {
-                  "url": "file:///var/lib/hound/my-git"
-                }
-              }
-            }
-          '';
+          settings = {
+            "max-concurrent-indexers" = 1;
+            "dbpath" = "/var/lib/hound/data";
+            "repos" = {
+              "nix" = {
+                "url" = "file:///var/lib/hound/my-git";
+              };
+            };
+          };
        };

        systemd.services.houndseed = {
--- a/nixos/tests/squid.nix
+++ b/nixos/tests/squid.nix
@ -0,0 +1,165 @@
+# This is a distributed test of the Squid as a forward proxy
+# - "external" -- i.e. the internet, where the proxy and server communicate
+# - "internal" -- i.e. an office LAN, where the client and proxy communicat
+
+import ./make-test-python.nix (
+  {
+    pkgs,
+    lib,
+    ...
+  }:
+  # VLANS:
+  # 1 -- simulates the internal network
+  # 2 -- simulates the external network
+  let
+    commonConfig = {
+      # Disable eth0 autoconfiguration
+      networking.useDHCP = false;
+
+      environment.systemPackages = [
+        (pkgs.writeScriptBin "check-connection" ''
+          #!/usr/bin/env bash
+
+          set -e
+
+          if [[ "$2" == "" || "$1" == "--help" || "$1" == "-h" ]];
+          then
+              echo "check-connection <target-address> <[expect-success|expect-failure]>"
+              exit 1
+          fi
+
+          ADDRESS="$1"
+
+          function test_icmp() { timeout 3 ping -c 1 "$ADDRESS"; }
+
+          if [[ "$2" == "expect-success" ]];
+          then
+              test_icmp
+          else
+              ! test_icmp
+          fi
+        '')
+      ];
+    };
+  in
+  {
+    name = "squid";
+    meta = with pkgs.lib.maintainers; {
+      maintainers = [ cobalt ];
+    };
+
+    nodes = {
+      client =
+        { ... }:
+        lib.mkMerge [
+          commonConfig
+          {
+            virtualisation.vlans = [ 1 ];
+            networking.firewall.enable = true;
+          }
+        ];
+
+      proxy =
+        { config, nodes, ... }:
+        let
+          clientIp = (pkgs.lib.head nodes.client.networking.interfaces.eth1.ipv4.addresses).address;
+          serverIp = (pkgs.lib.head nodes.server.networking.interfaces.eth1.ipv4.addresses).address;
+        in
+        lib.mkMerge [
+          commonConfig
+          {
+            virtualisation.vlans = [
+              1
+              2
+            ];
+            networking.firewall.enable = true;
+            networking.firewall.allowedTCPPorts = [ config.services.squid.proxyPort ];
+
+            nixpkgs.config.permittedInsecurePackages = [
+              "squid-6.12"
+            ];
+
+            services.squid = {
+              enable = true;
+
+              extraConfig = ''
+                acl client src ${clientIp}
+                acl server dst ${serverIp}
+                http_access allow client server
+              '';
+            };
+          }
+        ];
+
+      server =
+        { ... }:
+        lib.mkMerge [
+          commonConfig
+          {
+            virtualisation.vlans = [ 2 ];
+            networking.firewall.enable = true;
+            networking.firewall.allowedTCPPorts = [ 80 ];
+
+            services.nginx = {
+              enable = true;
+
+              virtualHosts."server" = {
+                root = "/etc";
+                locations."/".index = "hostname";
+                listen = [
+                  {
+                    addr = "0.0.0.0";
+                    port = 80;
+                  }
+                ];
+              };
+            };
+          }
+        ];
+    };
+
+    testScript =
+      { nodes, ... }:
+      let
+        clientIp = (pkgs.lib.head nodes.client.networking.interfaces.eth1.ipv4.addresses).address;
+        serverIp = (pkgs.lib.head nodes.server.networking.interfaces.eth1.ipv4.addresses).address;
+        proxyExternalIp = (pkgs.lib.head nodes.proxy.networking.interfaces.eth2.ipv4.addresses).address;
+        proxyInternalIp = (pkgs.lib.head nodes.proxy.networking.interfaces.eth1.ipv4.addresses).address;
+      in
+      ''
+        client.start()
+        proxy.start()
+        server.start()
+
+        proxy.wait_for_unit("network.target")
+        proxy.wait_for_unit("squid.service")
+        client.wait_for_unit("network.target")
+        server.wait_for_unit("network.target")
+        server.wait_for_unit("nginx.service")
+
+        # Topology checks.
+        with subtest("proxy connectivity"):
+            ## The proxy should have direct access to the server and client
+            proxy.succeed("check-connection ${serverIp} expect-success")
+            proxy.succeed("check-connection ${clientIp} expect-success")
+
+        with subtest("server connectivity"):
+            ## The server should have direct access to the proxy
+            server.succeed("check-connection ${proxyExternalIp} expect-success")
+            ## ... and not have access to the client
+            server.succeed("check-connection ${clientIp} expect-failure")
+
+        with subtest("client connectivity"):
+            # The client should be also able to connect to the proxy
+            client.succeed("check-connection ${proxyInternalIp} expect-success")
+            # but not the client to the server
+            client.succeed("check-connection ${serverIp} expect-failure")
+
+        with subtest("HTTP"):
+            # the client cannot reach the server directly over HTTP
+            client.fail('[[ `timeout 3 curl http://${serverIp}` ]]')
+            # ... but can with the proxy
+            client.succeed('[[ `timeout 3 curl --proxy http://${proxyInternalIp}:3128 http://${serverIp}` == "server" ]]')
+      '';
+  }
+)
--- a/pkgs/applications/editors/tiled/default.nix
+++ b/pkgs/applications/editors/tiled/default.nix
@ -28,13 +28,13 @@ in

 stdenv.mkDerivation rec {
  pname = "tiled";
-  version = "1.11.1";
+  version = "1.11.2";

  src = fetchFromGitHub {
    owner = "mapeditor";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-9cgGweo0D43U/puS82JCmBrikKe/TclHsrghQ4OZVEo=";
+    sha256 = "sha256-9oUKn51MQcsStgIJrp9XW5YAIpAUcO0kzfGnYA3gz/E=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@ -37,7 +37,7 @@ rec {

  meta = with lib; {
    description = "Most popular clone of the VI editor";
-    homepage = "http://www.vim.org";
+    homepage = "https://www.vim.org";
    license = licenses.vim;
    maintainers = with maintainers; [
      das_j
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -1,5 +1,5 @@
 # GENERATED by ./pkgs/applications/editors/vim/plugins/update.py. Do not edit!
-{ lib, buildVimPlugin, buildNeovimPlugin, fetchFromGitHub, fetchgit }:
+{ lib, buildVimPlugin, buildNeovimPlugin, fetchFromGitHub }:

 final: prev:
 {
@ -1686,17 +1686,6 @@ final: prev:
    meta.homepage = "https://github.com/xavierd/clang_complete/";
  };

-  clangd_extensions-nvim = buildVimPlugin {
-    pname = "clangd_extensions.nvim";
-    version = "2025-01-27";
-    src = fetchgit {
-      url = "https://git.sr.ht/~p00f/clangd_extensions.nvim";
-      rev = "db28f29be928d18cbfb86fbfb9f83f584f658feb";
-      sha256 = "16j27jwr90ixj1r6qcwfc9f90a2jdzd5104vpwwvyrdlqpgkml2x";
-    };
-    meta.homepage = "https://git.sr.ht/~p00f/clangd_extensions.nvim";
-  };
-
  clever-f-vim = buildVimPlugin {
    pname = "clever-f.vim";
    version = "2022-10-15";
@ -1793,17 +1782,6 @@ final: prev:
    meta.homepage = "https://github.com/tzachar/cmp-ai/";
  };

-  cmp-async-path = buildVimPlugin {
-    pname = "cmp-async-path";
-    version = "2024-10-21";
-    src = fetchgit {
-      url = "https://codeberg.org/FelipeLema/cmp-async-path/";
-      rev = "d6d1ffa2075039632a2d71e8fa139818e15ac757";
-      sha256 = "1x10v0kd0i2pdxknzdn3zgqdn4hgbivgnczsj56wc32jzcs6k49i";
-    };
-    meta.homepage = "https://codeberg.org/FelipeLema/cmp-async-path/";
-  };
-
  cmp-beancount = buildVimPlugin {
    pname = "cmp-beancount";
    version = "2024-07-16";
@ -4667,17 +4645,6 @@ final: prev:
    meta.homepage = "https://github.com/vim-scripts/gitignore.vim/";
  };

-  gitlab-vim = buildVimPlugin {
-    pname = "gitlab.vim";
-    version = "2025-01-24";
-    src = fetchgit {
-      url = "https://gitlab.com/gitlab-org/editor-extensions/gitlab.vim";
-      rev = "aa50a927a1d92abed361442b9366f0f1cddac937";
-      sha256 = "0z80wj2qhk55yk4p3gpqnssdz7znq3m8sgcln08ivknw6mlmwvxa";
-    };
-    meta.homepage = "https://gitlab.com/gitlab-org/editor-extensions/gitlab.vim";
-  };
-
  gitlinker-nvim = buildVimPlugin {
    pname = "gitlinker.nvim";
    version = "2023-02-03";
@ -5063,17 +5030,6 @@ final: prev:
    meta.homepage = "https://github.com/m4xshen/hardtime.nvim/";
  };

-  hare-vim = buildVimPlugin {
-    pname = "hare.vim";
-    version = "2025-01-24";
-    src = fetchgit {
-      url = "https://git.sr.ht/~sircmpwn/hare.vim";
-      rev = "1e39bb30c680756dd6b4b85af50571b5afee58cb";
-      sha256 = "0ivkh0dgc6djaqjsnbsc36027w4as9k1dj4d3ja4wzxnqk2ll97p";
-    };
-    meta.homepage = "https://git.sr.ht/~sircmpwn/hare.vim";
-  };
-
  harpoon = buildVimPlugin {
    pname = "harpoon";
    version = "2024-08-29";
@ -6446,17 +6402,6 @@ final: prev:
    meta.homepage = "https://github.com/nvim-lua/lsp_extensions.nvim/";
  };

-  lsp_lines-nvim = buildVimPlugin {
-    pname = "lsp_lines.nvim";
-    version = "2024-12-21";
-    src = fetchgit {
-      url = "https://git.sr.ht/~whynothugo/lsp_lines.nvim";
-      rev = "a92c755f182b89ea91bd8a6a2227208026f27b4d";
-      sha256 = "14ym4d8vgvw2vhsaxik8612wyvszd895q69n9h100yd7x5jqhy4c";
-    };
-    meta.homepage = "https://git.sr.ht/~whynothugo/lsp_lines.nvim";
-  };
-
  lsp_signature-nvim = buildVimPlugin {
    pname = "lsp_signature.nvim";
    version = "2025-01-10";
@ -9390,17 +9335,6 @@ final: prev:
    meta.homepage = "https://github.com/gennaro-tedesco/nvim-jqx/";
  };

-  nvim-julia-autotest = buildVimPlugin {
-    pname = "nvim-julia-autotest";
-    version = "2022-10-31";
-    src = fetchgit {
-      url = "https://gitlab.com/usmcamp0811/nvim-julia-autotest";
-      rev = "b74e2f9c961e604cb56cc23f87188348bfa0f33f";
-      sha256 = "0jd6r5chh4rdj1jyrsqhb67glwqjcygzvk8gyp0v7axr2xn6r8r1";
-    };
-    meta.homepage = "https://gitlab.com/usmcamp0811/nvim-julia-autotest";
-  };
-
  nvim-lastplace = buildVimPlugin {
    pname = "nvim-lastplace";
    version = "2023-07-27";
@ -11157,17 +11091,6 @@ final: prev:
    meta.homepage = "https://github.com/luochen1990/rainbow/";
  };

-  rainbow-delimiters-nvim = buildVimPlugin {
-    pname = "rainbow-delimiters.nvim";
-    version = "2025-01-12";
-    src = fetchgit {
-      url = "https://gitlab.com/HiPhish/rainbow-delimiters.nvim";
-      rev = "85b80abaa09cbbc039e3095b2f515b3cf8cadd11";
-      sha256 = "10sz2qp42rpf341qpr7cvjkwn0r07mmkdr5pbs3a7siczid4y935";
-    };
-    meta.homepage = "https://gitlab.com/HiPhish/rainbow-delimiters.nvim";
-  };
-
  rainbow_parentheses-vim = buildVimPlugin {
    pname = "rainbow_parentheses.vim";
    version = "2013-03-05";
@ -17925,17 +17848,6 @@ final: prev:
    meta.homepage = "https://github.com/dstein64/vim-startuptime/";
  };

-  vim-stationeers-ic10-syntax = buildVimPlugin {
-    pname = "vim-stationeers-ic10-syntax";
-    version = "2025-01-08";
-    src = fetchgit {
-      url = "https://gitlab.com/LittleMorph/vim-ic10";
-      rev = "7c1f13b198cfe122fb52f6abfb8dc95d5ca51013";
-      sha256 = "0pxk1qq6niy9msm369w5xn2jcwpa8a30hpqk6hb1ag1v6244j3g1";
-    };
-    meta.homepage = "https://gitlab.com/LittleMorph/vim-ic10";
-  };
-
  vim-strip-trailing-whitespace = buildVimPlugin {
    pname = "vim-strip-trailing-whitespace";
    version = "2022-02-01";
--- a/pkgs/applications/editors/vim/plugins/non-generated/clangd_extensions-nvim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/clangd_extensions-nvim/default.nix
@ -0,0 +1,26 @@
+{
+  lib,
+  fetchFromSourcehut,
+  nix-update-script,
+  vimUtils,
+}:
+vimUtils.buildVimPlugin {
+  pname = "clangd_extensions.nvim";
+  version = "unstable-2024-10-05";
+
+  src = fetchFromSourcehut {
+    owner = "~p00f";
+    repo = "clangd_extensions.nvim";
+    rev = "8f7b72100883e0e34400d9518d40a03f21e4d0a6";
+    hash = "sha256-N2YPu2Oa5KBkL8GSp9Al+rxhtNgu7YtxtMuy5BIcnOY=";
+  };
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Clangd's off-spec features for neovim's LSP client";
+    homepage = "https://git.sr.ht/~p00f/clangd_extensions.nvim";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+  };
+}
--- a/pkgs/applications/editors/vim/plugins/non-generated/cmp-async-path/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/cmp-async-path/default.nix
@ -0,0 +1,30 @@
+{
+  lib,
+  vimUtils,
+  fetchFromGitea,
+  nix-update-script,
+  vimPlugins,
+}:
+vimUtils.buildVimPlugin {
+  pname = "cmp-async-path";
+  version = "unstable-2024-10-21";
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "FelipeLema";
+    repo = "cmp-async-path";
+    rev = "d6d1ffa2075039632a2d71e8fa139818e15ac757";
+    hash = "sha256-MZFpNPtSDMZNkfoz+3ZcDxLb8PvDtm9nb1dE0CbYIPQ=";
+  };
+
+  checkInputs = [ vimPlugins.nvim-cmp ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Nvim-cmp source for filesystem paths with async processing";
+    homepage = "https://codeberg.org/FelipeLema/cmp-async-path/";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+  };
+}
--- a/pkgs/applications/editors/vim/plugins/non-generated/gitlab-vim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/gitlab-vim/default.nix
@ -0,0 +1,26 @@
+{
+  lib,
+  vimUtils,
+  fetchFromGitLab,
+  nix-update-script,
+}:
+vimUtils.buildVimPlugin {
+  pname = "gitlab.vim";
+  version = "unstable-2025-01-23";
+
+  src = fetchFromGitLab {
+    owner = "gitlab-org/editor-extensions";
+    repo = "gitlab.vim";
+    rev = "62a60341df24ccecb73bc9ae34a198674bb12faf";
+    hash = "sha256-9G5H3MUdE++hR7p8nsoxK5kuA84k8oJBMvOa01PZrsA=";
+  };
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Integrate GitLab Duo with Neovim";
+    homepage = "https://gitlab.com/gitlab-org/editor-extensions/gitlab.vim";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+  };
+}
--- a/pkgs/applications/editors/vim/plugins/non-generated/hare-vim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/hare-vim/default.nix
@ -0,0 +1,26 @@
+{
+  lib,
+  vimUtils,
+  fetchFromSourcehut,
+  nix-update-script,
+}:
+vimUtils.buildVimPlugin {
+  pname = "hare.vim";
+  version = "unstable-2025-01-23";
+
+  src = fetchFromSourcehut {
+    owner = "~sircmpwn";
+    repo = "hare.vim";
+    rev = "1a732aca2931402f3186f52ae626540a770aefe2";
+    hash = "sha256-wBeQvDm7ZTUcw21VIAryyH6tMuBiQCMOJRZX/8ic8B4=";
+  };
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Hare programming in Vim";
+    homepage = "https://git.sr.ht/~sircmpwn/hare.vim";
+    license = lib.licenses.vim;
+    platforms = lib.platforms.all;
+  };
+}
--- a/pkgs/applications/editors/vim/plugins/non-generated/lsp_lines-nvim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/lsp_lines-nvim/default.nix
@ -0,0 +1,26 @@
+{
+  lib,
+  vimUtils,
+  fetchFromSourcehut,
+  nix-update-script,
+}:
+vimUtils.buildVimPlugin {
+  pname = "lsp_lines.nvim";
+  version = "unstable-2024-12-10";
+
+  src = fetchFromSourcehut {
+    owner = "~whynothugo";
+    repo = "lsp_lines.nvim";
+    rev = "a92c755f182b89ea91bd8a6a2227208026f27b4d";
+    hash = "sha256-jHiIZemneQACTDYZXBJqX2/PRTBoxq403ILvt1Ej1ZM=";
+  };
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Neovim diagnostics using virtual lines";
+    homepage = "https://git.sr.ht/~whynothugo/lsp_lines.nvim";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+  };
+}
--- a/pkgs/applications/editors/vim/plugins/non-generated/nvim-julia-autotest/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/nvim-julia-autotest/default.nix
@ -0,0 +1,26 @@
+{
+  lib,
+  vimUtils,
+  fetchFromGitLab,
+  nix-update-script,
+}:
+vimUtils.buildVimPlugin {
+  pname = "nvim-julia-autotest";
+  version = "unstable-2022-10-31";
+
+  src = fetchFromGitLab {
+    owner = "usmcamp0811";
+    repo = "nvim-julia-autotest";
+    rev = "b74e2f9c961e604cb56cc23f87188348bfa0f33f";
+    hash = "sha256-IaNsbBe5q7PB9Q/N/Z9nEnP6jlkQ6+xlkC0TCFnJpkk=";
+  };
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Automatically run Julia tests when you save runtest.jl file";
+    homepage = "https://gitlab.com/usmcamp0811/nvim-julia-autotest";
+    license = lib.licenses.gpl3;
+    platforms = lib.platforms.all;
+  };
+}
--- a/pkgs/applications/editors/vim/plugins/non-generated/rainbow-delimiters-nvim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/rainbow-delimiters-nvim/default.nix
@ -0,0 +1,33 @@
+{
+  lib,
+  vimUtils,
+  fetchFromGitLab,
+  nix-update-script,
+}:
+vimUtils.buildVimPlugin {
+  pname = "rainbow-delimiters.nvim";
+  version = "unstable-2025-01-12";
+
+  src = fetchFromGitLab {
+    owner = "HiPhish";
+    repo = "rainbow-delimiters.nvim";
+    rev = "85b80abaa09cbbc039e3095b2f515b3cf8cadd11";
+    hash = "sha256-zWHXYs3XdnoszqOFY3hA2L5mNn1a44OAeKv3lL3EMEw=";
+  };
+
+  nvimSkipModule = [
+    # rainbow-delimiters.types.lua
+    "rainbow-delimiters.types"
+    # Test that requires an unpackaged dependency
+    "rainbow-delimiters._test.highlight"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Rainbow delimiters for Neovim with Tree-sitter";
+    homepage = "https://gitlab.com/HiPhish/rainbow-delimiters.nvim";
+    license = lib.licenses.gpl3;
+    platforms = lib.platforms.all;
+  };
+}
--- a/pkgs/applications/editors/vim/plugins/non-generated/vim-stationeers-ic10-syntax/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/vim-stationeers-ic10-syntax/default.nix
@ -0,0 +1,26 @@
+{
+  lib,
+  vimUtils,
+  fetchFromGitLab,
+  nix-update-script,
+}:
+vimUtils.buildVimPlugin {
+  pname = "vim-ic10";
+  version = "unstable-2025-01-08";
+
+  src = fetchFromGitLab {
+    owner = "LittleMorph";
+    repo = "vim-ic10";
+    rev = "7c1f13b198cfe122fb52f6abfb8dc95d5ca51013";
+    hash = "sha256-4Q1JiDA7PBUWNBNfCIZC6nImhe2FJzOqrslHazAOs18=";
+  };
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Stationeers IC10 syntax highlighting for Vim";
+    homepage = "https://gitlab.com/LittleMorph/vim-ic10";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+  };
+}
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -315,6 +315,8 @@ in
    ];
  };

+  clangd_extensions-nvim = callPackage ./non-generated/clangd_extensions-nvim { };
+
  clang_complete = super.clang_complete.overrideAttrs {
    # In addition to the arguments you pass to your compiler, you also need to
    # specify the path of the C++ std header (if you are using C++).
@ -366,9 +368,7 @@ in
    ];
  };

-  cmp-async-path = super.cmp-async-path.overrideAttrs {
-    checkInputs = [ self.nvim-cmp ];
-  };
+  cmp-async-path = callPackage ./non-generated/cmp-async-path { };

  cmp-beancount = super.cmp-beancount.overrideAttrs {
    checkInputs = [ self.nvim-cmp ];
@ -1199,6 +1199,8 @@ in
    configurePhase = "cd plugins/nvim";
  };

+  gitlab-vim = callPackage ./non-generated/gitlab-vim { };
+
  gitlinker-nvim = super.gitlinker-nvim.overrideAttrs {
    dependencies = [ self.plenary-nvim ];
  };
@ -1268,6 +1270,8 @@ in
    ];
  };

+  hare-vim = callPackage ./non-generated/hare-vim { };
+
  harpoon = super.harpoon.overrideAttrs {
    dependencies = [ self.plenary-nvim ];
  };
@ -1585,6 +1589,8 @@ in
    luaAttr = luaPackages.lsp-progress-nvim;
  };

+  lsp_lines-nvim = callPackage ./non-generated/lsp_lines-nvim { };
+
  lspecho-nvim = super.lspecho-nvim.overrideAttrs {
    meta.license = lib.licenses.mit;
  };
@ -2297,6 +2303,8 @@ in
    dependencies = [ self.nvim-java-core ];
  };

+  nvim-julia-autotest = callPackage ./non-generated/nvim-julia-autotest { };
+
  nvim-lsp-file-operations = super.nvim-lsp-file-operations.overrideAttrs {
    dependencies = [ self.plenary-nvim ];
  };
@ -2721,14 +2729,7 @@ in
  quicker-nvim = super.quicker-nvim.overrideAttrs {
  };

-  rainbow-delimiters-nvim = super.rainbow-delimiters-nvim.overrideAttrs {
-    nvimSkipModule = [
-      # rainbow-delimiters.types.lua
-      "rainbow-delimiters.types"
-      # Test that requires an unpackaged dependency
-      "rainbow-delimiters._test.highlight"
-    ];
-  };
+  rainbow-delimiters-nvim = callPackage ./non-generated/rainbow-delimiters-nvim { };

  range-highlight-nvim = super.range-highlight-nvim.overrideAttrs {
    dependencies = [ self.cmd-parser-nvim ];
@ -3642,6 +3643,8 @@ in
    dependencies = [ self.vim-repeat ];
  };

+  vim-stationeers-ic10-syntax = callPackage ./non-generated/vim-stationeers-ic10-syntax { };
+
  vim-stylish-haskell = super.vim-stylish-haskell.overrideAttrs (old: {
    postPatch =
      old.postPatch or ""
--- a/pkgs/applications/editors/vim/plugins/update.py
+++ b/pkgs/applications/editors/vim/plugins/update.py
@ -82,7 +82,7 @@ class VimEditor(pluginupdate.Editor):
            f.write(
                textwrap.dedent(
                    """
-                { lib, buildVimPlugin, buildNeovimPlugin, fetchFromGitHub, fetchgit }:
+                { lib, buildVimPlugin, buildNeovimPlugin, fetchFromGitHub }:

                final: prev:
                {
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -138,7 +138,6 @@ https://github.com/declancm/cinnamon.nvim/,HEAD,
 https://github.com/projekt0n/circles.nvim/,,
 https://github.com/zootedb0t/citruszest.nvim/,,
 https://github.com/xavierd/clang_complete/,,
-https://git.sr.ht/~p00f/clangd_extensions.nvim,HEAD,
 https://github.com/rhysd/clever-f.vim/,,
 https://github.com/bbchung/clighter8/,,
 https://github.com/ekickx/clipboard-image.nvim/,,
@ -147,7 +146,6 @@ https://github.com/asheq/close-buffers.vim/,HEAD,
 https://github.com/Civitasv/cmake-tools.nvim/,,
 https://github.com/winston0410/cmd-parser.nvim/,,
 https://github.com/tzachar/cmp-ai/,HEAD,
-https://codeberg.org/FelipeLema/cmp-async-path/,,
 https://github.com/crispgm/cmp-beancount/,HEAD,
 https://github.com/hrsh7th/cmp-buffer/,,
 https://github.com/hrsh7th/cmp-calc/,,
@ -386,7 +384,6 @@ https://github.com/mikesmithgh/git-prompt-string-lualine.nvim/,HEAD,
 https://github.com/ThePrimeagen/git-worktree.nvim/,,
 https://github.com/wintermute-cell/gitignore.nvim/,HEAD,
 https://github.com/vim-scripts/gitignore.vim/,,
-https://gitlab.com/gitlab-org/editor-extensions/gitlab.vim,HEAD,
 https://github.com/ruifm/gitlinker.nvim/,,
 https://github.com/lewis6991/gitsigns.nvim/,,
 https://github.com/gregsexton/gitv/,,
@ -419,7 +416,6 @@ https://github.com/junegunn/gv.vim/,,
 https://github.com/chrishrb/gx.nvim/,HEAD,
 https://github.com/TheSnakeWitcher/hardhat.nvim/,HEAD,
 https://github.com/m4xshen/hardtime.nvim/,HEAD,
-https://git.sr.ht/~sircmpwn/hare.vim,HEAD,
 https://github.com/ThePrimeagen/harpoon/,master,
 https://github.com/ThePrimeagen/harpoon/,harpoon2,harpoon2
 https://github.com/kiyoon/haskell-scope-highlighting.nvim/,HEAD,
@ -534,7 +530,6 @@ https://github.com/ahmedkhalf/lsp-rooter.nvim/,,
 https://github.com/nvim-lua/lsp-status.nvim/,,
 https://github.com/VonHeikemen/lsp-zero.nvim/,v3.x,
 https://github.com/nvim-lua/lsp_extensions.nvim/,,
-https://git.sr.ht/~whynothugo/lsp_lines.nvim,,
 https://github.com/ray-x/lsp_signature.nvim/,,
 https://github.com/lspcontainers/lspcontainers.nvim/,,
 https://github.com/deathbeam/lspecho.nvim/,HEAD,
@ -777,7 +772,6 @@ https://github.com/nvim-java/nvim-java-core/,HEAD,
 https://github.com/nvim-java/nvim-java-dap/,HEAD,
 https://github.com/mfussenegger/nvim-jdtls/,,
 https://github.com/gennaro-tedesco/nvim-jqx/,,
-https://gitlab.com/usmcamp0811/nvim-julia-autotest,HEAD,
 https://github.com/ethanholz/nvim-lastplace/,HEAD,
 https://github.com/kosayoda/nvim-lightbulb/,,
 https://github.com/josa42/nvim-lightline-lsp/,,
@ -924,7 +918,6 @@ https://github.com/stefandtw/quickfix-reflector.vim/,,
 https://github.com/dannyob/quickfixstatus/,,
 https://github.com/jbyuki/quickmath.nvim/,HEAD,
 https://github.com/luochen1990/rainbow/,,
-https://gitlab.com/HiPhish/rainbow-delimiters.nvim,HEAD,
 https://github.com/kien/rainbow_parentheses.vim/,,
 https://github.com/vim-scripts/random.vim/,,
 https://github.com/winston0410/range-highlight.nvim/,,
@ -1487,7 +1480,6 @@ https://github.com/kbenzie/vim-spirv/,,
 https://github.com/yorokobi/vim-splunk/,HEAD,
 https://github.com/mhinz/vim-startify/,,
 https://github.com/dstein64/vim-startuptime/,,
-https://gitlab.com/LittleMorph/vim-ic10,HEAD,vim-stationeers-ic10-syntax
 https://github.com/axelf4/vim-strip-trailing-whitespace/,,
 https://github.com/nbouscal/vim-stylish-haskell/,,
 https://github.com/alx741/vim-stylishask/,,
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -27,13 +27,13 @@
    "vendorHash": "sha256-jK7JuARpoxq7hvq5+vTtUwcYot0YqlOZdtDwq4IqKvk="
  },
  "aiven": {
-    "hash": "sha256-rtqGkVtB69yt98bTb/g2iZtZNtCn7V5Q4uSBDx+/xGQ=",
+    "hash": "sha256-m2T8MNHBQfAyFDL28v4HE0UJzTKZFH1DY5OlfmCp+kE=",
    "homepage": "https://registry.terraform.io/providers/aiven/aiven",
    "owner": "aiven",
    "repo": "terraform-provider-aiven",
-    "rev": "v4.31.1",
+    "rev": "v4.33.0",
    "spdx": "MIT",
-    "vendorHash": "sha256-dIQ5WATs8HOjJpLyVPDgT+WZ8GkkSoNsmavxpCj4jmE="
+    "vendorHash": "sha256-0WLhjCCOMi6uQJ+yEA+W6KHyZaf5L2P5hTFSdyb1ExU="
  },
  "akamai": {
    "hash": "sha256-acGLXJclAfg43AkJRoROReIOjBEnhgSpDRgvO6LumIY=",
@ -153,20 +153,20 @@
    "vendorHash": null
  },
  "baiducloud": {
-    "hash": "sha256-x8h/htGfphrvLNTKcxSnV0lomd/gdBuOn3U1ke6AqzI=",
+    "hash": "sha256-YcQq0FK76XjF80yOjOMhDp+aRoFOewXObVksDAzQSh8=",
    "homepage": "https://registry.terraform.io/providers/baidubce/baiducloud",
    "owner": "baidubce",
    "repo": "terraform-provider-baiducloud",
-    "rev": "v1.21.10",
+    "rev": "v1.21.12",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
  "bigip": {
-    "hash": "sha256-hXQR6JcnZesO3rY/SkSxoff8JRuzK6oeEOorG8evNwg=",
+    "hash": "sha256-qTYHtkwgNlroct+HPfiexny9lBCDXwnlNRKRXmW0tXQ=",
    "homepage": "https://registry.terraform.io/providers/F5Networks/bigip",
    "owner": "F5Networks",
    "repo": "terraform-provider-bigip",
-    "rev": "v1.22.6",
+    "rev": "v1.22.7",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -207,13 +207,13 @@
    "vendorHash": "sha256-A6/YN/iFxdfGjYO8Pum5nWysGmEeLaxgFPe8zaoPfjA="
  },
  "buildkite": {
-    "hash": "sha256-mhiPKnn5cOXMlz1cM0BrJnRVESWakgkiN/R5ZUUEv/M=",
+    "hash": "sha256-xz9gYf13tNU3J7nQscuIRU41CGjYc6qMXnLltAaPQac=",
    "homepage": "https://registry.terraform.io/providers/buildkite/buildkite",
    "owner": "buildkite",
    "repo": "terraform-provider-buildkite",
-    "rev": "v1.15.2",
+    "rev": "v1.15.5",
    "spdx": "MIT",
-    "vendorHash": "sha256-UdJxDq4VU7rWMoiSlXtb861yd+az2nrxGafvEj2K34Y="
+    "vendorHash": "sha256-6Tmxmm/X3MZtFxlNa2H/oXGADlpoZ8oUSvTqKPAr5fA="
  },
  "ccloud": {
    "hash": "sha256-Dpx0eugcHCJV8GNPqjxx4P9ohgJgB10DTnHr+CeN/iQ=",
@ -317,13 +317,13 @@
    "vendorHash": "sha256-ZCMSmOCPEMxCSpl3DjIUGPj1W/KNJgyjtHpmQ19JquA="
  },
  "datadog": {
-    "hash": "sha256-naPINUxSZP12wLanGw1BUYiGkyi1uqliDieR97oD+yI=",
+    "hash": "sha256-/RaKITbDBaTcF4xL+66gTBlEitbwj7z2NhJ60o+Cje0=",
    "homepage": "https://registry.terraform.io/providers/DataDog/datadog",
    "owner": "DataDog",
    "repo": "terraform-provider-datadog",
-    "rev": "v3.50.0",
+    "rev": "v3.52.1",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-LInse2bxYuGRGc28MOaMJJ6WAV0m2JF13mpvkSgyDCk="
+    "vendorHash": "sha256-rbGBGmgOmv+PtkYlj89FXagDscrtVRl7J0ZP3n+lVdU="
  },
  "deno": {
    "hash": "sha256-7IvJrhXMeAmf8e21QBdYNSJyVMEzLpat4Tm4zHWglW8=",
@ -543,11 +543,11 @@
    "vendorHash": "sha256-PEm/5AMATheF/yxEMVlEC/7hsRsMtMcp5wHpqrFBlFA="
  },
  "gridscale": {
-    "hash": "sha256-J4ZLexpjYXxOTaqih0+Nucyf2soYXxGiB38xAeXUJKs=",
+    "hash": "sha256-kgpEPbQLqiu8X0lOs6dCUqWpYTDxQX8fMgWoP0wWtBw=",
    "homepage": "https://registry.terraform.io/providers/gridscale/gridscale",
    "owner": "gridscale",
    "repo": "terraform-provider-gridscale",
-    "rev": "v1.27.0",
+    "rev": "v2.0.2",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -813,13 +813,13 @@
    "vendorHash": "sha256-QxbZv6YMa5/I4bTeQBNdmG3EKtLEmstnH7HMiZzFJrI="
  },
  "migadu": {
-    "hash": "sha256-Pmc09MRNxrJHXlb74EnHkmML90pbKSLCyTrFlI+j3d8=",
+    "hash": "sha256-ZKlxt/qTccHlNSTwTFKroK/JmKLTcQ8MIeCKx+iRJm0=",
    "homepage": "https://registry.terraform.io/providers/metio/migadu",
    "owner": "metio",
    "repo": "terraform-provider-migadu",
-    "rev": "2024.12.26",
+    "rev": "2025.1.16",
    "spdx": "0BSD",
-    "vendorHash": "sha256-YFzYLUfyJglKaJSBksrI1DBHmK6+yoMIg9QlGIEZFkU="
+    "vendorHash": "sha256-03pGB+biwTfJdGADhBSJn1BNhuowTrO8nwQm2eCCpaI="
  },
  "minio": {
    "hash": "sha256-GJU70N/8EocLNxTG/psIsRYVHkg5fALhA9/ewErNML0=",
@ -913,13 +913,13 @@
    "vendorHash": null
  },
  "okta": {
-    "hash": "sha256-ONhXeCCezhMgHQeT/HLFPUHW3No1Yv9vXho006dJoPQ=",
+    "hash": "sha256-LRlSqgcQPs3R/l4DKm5Ij3GjK7/WxRPV+/o4I2ukCFY=",
    "homepage": "https://registry.terraform.io/providers/okta/okta",
    "owner": "okta",
    "repo": "terraform-provider-okta",
-    "rev": "v4.12.0",
+    "rev": "v4.13.1",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-MA0w44ig8sS1+JgJ/TnBSiUlADDn/WP5zCYgcDXGaQk="
+    "vendorHash": "sha256-EPBi417Ue8FFC23vOh9ENS50SHlrvJBAX1TX+oiFMMA="
  },
  "oktaasa": {
    "hash": "sha256-2LhxgowqKvDDDOwdznusL52p2DKP+UiXALHcs9ZQd0U=",
@ -958,13 +958,13 @@
    "vendorHash": "sha256-0Atbzx1DjInPMa1lNxyNKfNMILjN4S814TlIAQeTfdI="
  },
  "opentelekomcloud": {
-    "hash": "sha256-gcELIKjDeXp0rqz+tDp2S9VEzPVoL+7RfvpfNF/qets=",
+    "hash": "sha256-KA0SMkf+Wt/YDa/lPndedD75yCMTcDO/EFX9wrLtIVY=",
    "homepage": "https://registry.terraform.io/providers/opentelekomcloud/opentelekomcloud",
    "owner": "opentelekomcloud",
    "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.36.28",
+    "rev": "v1.36.29",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-KvQNpXn11KdGbGQBWj7FwVypJOcFhLjgOKBfFZOyL7M="
+    "vendorHash": "sha256-/vhalSK/kxbBc3Pq19BPl6H6L0FXhAqkK0/p1MPXckc="
  },
  "opsgenie": {
    "hash": "sha256-+msy9kPAryR0Ll5jKOd47DMjeMxEdSIfKZZKVHohQGY=",
@ -1093,13 +1093,13 @@
    "vendorHash": null
  },
  "scaleway": {
-    "hash": "sha256-8Jk++If2Uu51P/b29xSeUuIRduqm5lB9ob9YuAM0nPI=",
+    "hash": "sha256-8aESalFQaA6Qwod4rDeUzrKe80rbHfVJZIKtLliKUME=",
    "homepage": "https://registry.terraform.io/providers/scaleway/scaleway",
    "owner": "scaleway",
    "repo": "terraform-provider-scaleway",
-    "rev": "v2.48.0",
+    "rev": "v2.49.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-sd5Q/YcK28XgZGuNin6cn5xmwB2TenUuHMT9SRYIRTs="
+    "vendorHash": "sha256-a1xH1NX+8/A4tcPYyxvg3lY9DZPrOAEl4OvngU9+tjE="
  },
  "secret": {
    "hash": "sha256-MmAnA/4SAPqLY/gYcJSTnEttQTsDd2kEdkQjQj6Bb+A=",
@ -1192,13 +1192,13 @@
    "vendorHash": "sha256-c3R/7k7y7XS2Qli00nSj7gh/3Mj88PY4WybBTq/+pPs="
  },
  "spotinst": {
-    "hash": "sha256-ovrWtOJe5AVF1oneb+9It4MMkT8uL3bBdiXJNjahYRY=",
+    "hash": "sha256-zP71u5xaWcb+LBKGU3yFAQcZnK6MlO5WRQwc8Fz9ZJY=",
    "homepage": "https://registry.terraform.io/providers/spotinst/spotinst",
    "owner": "spotinst",
    "repo": "terraform-provider-spotinst",
-    "rev": "v1.207.0",
+    "rev": "v1.208.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-mVZbO2AH+mQeOj3I1FH2poQnQNGJUzxQNGmIv8nOqNw="
+    "vendorHash": "sha256-HNKdEwG+7IJ2YpX97qkvXZbsoJWx+u+rZXRoZzvB1XA="
  },
  "ssh": {
    "hash": "sha256-1UN5QJyjCuxs2vQYlSuz2jsu/HgGTxOoWWRcv4qcwow=",
@ -1228,11 +1228,11 @@
    "vendorHash": "sha256-9M1DsE/FPQK8TG7xCJWbU3HAJCK3p/7lxdzjO1oAfWs="
  },
  "sumologic": {
-    "hash": "sha256-THjaIm6QsHNEGuafwmnU3dUQqNJiDy4qTO+3bEIGR8Q=",
+    "hash": "sha256-T+DQ2uTkbwzTShKx1FOavOc/V/DxwBOxKPE639+mhXg=",
    "homepage": "https://registry.terraform.io/providers/SumoLogic/sumologic",
    "owner": "SumoLogic",
    "repo": "terraform-provider-sumologic",
-    "rev": "v3.0.0",
+    "rev": "v3.0.1",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-YdWs2orKhbwAZSQYC73t4e/vvVxk8LrBPG9ZC38VcZE="
  },
@ -1273,22 +1273,22 @@
    "vendorHash": "sha256-VMEL2dQ1+kMRWjJP6Obc3N1OytpAkRVW/9596WhwkE4="
  },
  "tencentcloud": {
-    "hash": "sha256-8WH87IFcZO5vK3kS9q94AJQ4Vv4jsFSPT0PZ1Cwt6jQ=",
+    "hash": "sha256-g4UQs7GdU5GFkrC9eeFLMYGLR2Wt2UbSSX5yP1CExT0=",
    "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
    "owner": "tencentcloudstack",
    "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.81.152",
+    "rev": "v1.81.164",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
  "tfe": {
-    "hash": "sha256-kF17NEk/faVBNXXq2ipoIqS97ENxmr1UnEJc6m9ScDw=",
+    "hash": "sha256-PnwwIeWktTiOSRHD7Vc9NttTpIBG0D2vWS0ngGRu3Yk=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/tfe",
    "owner": "hashicorp",
    "repo": "terraform-provider-tfe",
-    "rev": "v0.62.0",
+    "rev": "v0.63.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-zDL3MOsOzMFh894xeqt+CIvKlQxDm3JLXsy2IK4ZMlE="
+    "vendorHash": "sha256-6QIaJIlHr6c/pC6T/kQu0835Yf7l5idsTWl1sAcwXoQ="
  },
  "thunder": {
    "hash": "sha256-2i1DSOSt/vbFs0QCPogEBvADhLJFKbrQzwZ20ChCQMk=",
--- a/pkgs/applications/networking/discordo/default.nix
+++ b/pkgs/applications/networking/discordo/default.nix
@ -3,13 +3,13 @@

 buildGoModule rec {
  pname = "discordo";
-  version = "0-unstable-2025-01-12";
+  version = "0-unstable-2025-01-27";

  src = fetchFromGitHub {
    owner = "ayn2op";
    repo = pname;
-    rev = "2f071695146188c65b51f7030a89addfa845469a";
-    hash = "sha256-k2wwFx0Wi60xpdiS7qGoHdS6TfXFlI6yDeXXfOp1ivc=";
+    rev = "1783361d5fb839e54f4562a9c42eb478d9cc8f57";
+    hash = "sha256-AU7gT+q1vF4WWn5o2OCiAjHjub0ig1O7/CjFnuQaN6I=";
  };

  vendorHash = "sha256-FsZRh4k9ucmAruJa1MZ4kVVryrEuHy9StgXHvgBiWSg=";
--- a/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix
@ -24,6 +24,7 @@
  wayland,
  wayland-protocols,
  wayland-scanner,
+  debug ? false,
 }:
 gcc14Stdenv.mkDerivation (finalAttrs: {
  pname = "xdg-desktop-portal-hyprland";
@ -65,6 +66,10 @@ gcc14Stdenv.mkDerivation (finalAttrs: {
    wayland-scanner
  ];

+  cmakeBuildType = if debug then "Debug" else "RelWithDebInfo";
+
+  dontStrip = debug;
+
  dontWrapQtApps = true;

  postInstall = ''
--- a/pkgs/build-support/appimage/default.nix
+++ b/pkgs/build-support/appimage/default.nix
@ -156,7 +156,6 @@ rec {
      libuuid
      libogg
      libvorbis
-      SDL
      SDL2_image
      glew110
      openssl
@ -179,9 +178,6 @@ rec {
      libtiff
      pixman
      speex
-      SDL_image
-      SDL_ttf
-      SDL_mixer
      SDL2_ttf
      SDL2_mixer
      libappindicator-gtk2
--- a/pkgs/by-name/ae/aerc/package.nix
+++ b/pkgs/by-name/ae/aerc/package.nix
@ -15,17 +15,17 @@

 buildGoModule rec {
  pname = "aerc";
-  version = "0.20.0";
+  version = "0.20.1";

  src = fetchFromSourcehut {
    owner = "~rjarry";
    repo = "aerc";
    rev = version;
-    hash = "sha256-0ZSmmmj5PpSORL0s0SSNoZGzct9Ps8j0ILAUCpJOOBw=";
+    hash = "sha256-IBTM3Ersm8yUCgiBLX8ozuvMEbfmY6eW5xvJD20UgRA=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-WowRlAzyrfZi27JzskIDberiYt9PQkuS6H3hKqUP9qo=";
+  vendorHash = "sha256-O1j0J6vCE6rap5/fOTxlUpXAG5mgZf8CfNOB4VOBxms=";

  nativeBuildInputs = [
    scdoc
--- a/pkgs/by-name/an/ansible-navigator/package.nix
+++ b/pkgs/by-name/an/ansible-navigator/package.nix
@ -7,7 +7,7 @@
 }:
 python3Packages.buildPythonApplication rec {
  pname = "ansible-navigator";
-  version = "24.12.0";
+  version = "25.1.0";
  pyproject = true;

  disabled = python3Packages.pythonOlder "3.10";
@ -15,7 +15,7 @@ python3Packages.buildPythonApplication rec {
  src = fetchPypi {
    inherit version;
    pname = "ansible_navigator";
-    hash = "sha256-+DJXSwwTIjF0b/i5NHCrnR9N+nMyl8of+zyEmmTzboQ=";
+    hash = "sha256-WcA14CiUUNXa+yR1IzoyQ7LWBXFI8yzV+xpRj2W8lzQ=";
  };

  build-system = with python3Packages; [
--- a/pkgs/by-name/au/automatic-timezoned/package.nix
+++ b/pkgs/by-name/au/automatic-timezoned/package.nix
@ -5,17 +5,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "automatic-timezoned";
-  version = "2.0.45";
+  version = "2.0.50";

  src = fetchFromGitHub {
    owner = "maxbrunet";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-8fgOhmjFXC0nMs7oTfJWbn1DOmOU9RtTgR+xmV/nZ9g=";
+    sha256 = "sha256-xXTm7/NS9XJRX/MQld7+GVOum9iW0wYfvaEve7K5cIk=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-OimAHyx6UdNB6RIGa+LN5Xy63L7VbTj7lazZyUQXy1s=";
+  cargoHash = "sha256-Zd4LUXPrRhz4r8C/BqnWnJOHYCnbO7uz9sqVi8hVKFI=";

  meta = with lib; {
    description = "Automatically update system timezone based on location";
--- a/pkgs/by-name/c3/c3-lsp/package.nix
+++ b/pkgs/by-name/c3/c3-lsp/package.nix
@ -6,18 +6,18 @@

 buildGoModule rec {
  pname = "c3-lsp";
-  version = "0.3.3";
+  version = "0.4.0";

  src = fetchFromGitHub {
    owner = "pherrymason";
    repo = "c3-lsp";
    rev = "v${version}";
-    hash = "sha256-1EuDXQGzqNM19SRokM9GGzA2ZcD0XaCbywErVSjINIM=";
+    hash = "sha256-MScpFh4J4jVJI5WtW4tfNB18YDpxs+ass1HmXyOO5VM=";
  };

  sourceRoot = "${src.name}/server";

-  vendorHash = "sha256-7g0Z392ksrvV+D9nMw325BykwLd9mvXRS1Zv6RNSs0w=";
+  vendorHash = "sha256-eT+Qirl0R1+di3JvXxggGK/nK9+nqw+8QEur+ldJXSc=";

  postInstall = ''
    mv $out/bin/lsp $out/bin/c3-lsp
--- a/pkgs/by-name/ca/can-utils/package.nix
+++ b/pkgs/by-name/ca/can-utils/package.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "can-utils";
-  version = "2023.03";
+  version = "2025.01";

  src = fetchFromGitHub {
    owner = "linux-can";
    repo = "can-utils";
    rev = "v${version}";
-    hash = "sha256-FaopviBJOmO0lXoJcdKNdtsoaJ8JrFEJGyO1aNBv+Pg=";
+    hash = "sha256-wum0hqPj3rCHHubNsOnj89tvrRQxoXrGQvZFcMKAGME=";
  };

  makeFlags = [ "PREFIX=$(out)" ];
--- a/pkgs/by-name/ca/canaille/package.nix
+++ b/pkgs/by-name/ca/canaille/package.nix
@ -11,7 +11,7 @@ let
 in
 python.pkgs.buildPythonApplication rec {
  pname = "canaille";
-  version = "0.0.56";
+  version = "0.0.57";
  pyproject = true;

  disabled = python.pythonOlder "3.10";
@ -20,7 +20,7 @@ python.pkgs.buildPythonApplication rec {
    owner = "yaal";
    repo = "canaille";
    rev = "refs/tags/${version}";
-    hash = "sha256-cLsLwttUDxMKVqtVDCY5A22m1YY1UezeZQh1j74WzgU=";
+    hash = "sha256-pesN7k5kGHi3dqTMaXWdCsNsnaJxXv/Ku1wVC9N9a3k=";
  };

  build-system = with python.pkgs; [
@ -35,6 +35,7 @@ python.pkgs.buildPythonApplication rec {
      flask
      flask-wtf
      pydantic-settings
+      requests
      wtforms
    ]
    ++ sentry-sdk.optional-dependencies.flask;
@ -51,6 +52,7 @@ python.pkgs.buildPythonApplication rec {
      pytest-lazy-fixtures
      pytest-smtpd
      pytest-xdist
+      scim2-tester
      slapd
      toml
      faker
@ -58,8 +60,11 @@ python.pkgs.buildPythonApplication rec {
    ]
    ++ optional-dependencies.front
    ++ optional-dependencies.oidc
+    ++ optional-dependencies.scim
    ++ optional-dependencies.ldap
-    ++ optional-dependencies.postgresql;
+    ++ optional-dependencies.postgresql
+    ++ optional-dependencies.otp
+    ++ optional-dependencies.sms;

  postInstall = ''
    mkdir -p $out/etc/schema
@ -88,6 +93,10 @@ python.pkgs.buildPythonApplication rec {
      zxcvbn-rs-py
    ];
    oidc = [ authlib ];
+    scim = [
+      scim2-models
+      authlib
+    ];
    ldap = [ python-ldap ];
    sentry = [ sentry-sdk ];
    postgresql = [
@ -95,7 +104,13 @@ python.pkgs.buildPythonApplication rec {
      sqlalchemy
      sqlalchemy-json
      sqlalchemy-utils
-    ] ++ sqlalchemy.optional-dependencies.postgresql;
+    ] ++ sqlalchemy.optional-dependencies.postgresql_psycopg2binary;
+    otp = [
+      otpauth
+      pillow
+      qrcode
+    ];
+    sms = [ smpplib ];
  };

  passthru = {
--- a/pkgs/by-name/ca/cargo-tauri/package.nix
+++ b/pkgs/by-name/ca/cargo-tauri/package.nix
@ -13,17 +13,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "tauri";
-  version = "2.2.3";
+  version = "2.2.7";

  src = fetchFromGitHub {
    owner = "tauri-apps";
    repo = "tauri";
-    tag = "tauri-v${version}";
-    hash = "sha256-VZPMy1UMvELcJxu5DHz4YSVe4wVrxrJjeiJK3ySczCA=";
+    tag = "tauri-cli-v${version}";
+    hash = "sha256-BUZMIrPaeoYgmzzkPNEf83KjeiY9dlObivlC3jO5vIc=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-LcwOKUFiHoZ4WmTlwqsA2A9BZkBLPEINjZSyk6skvbA=";
+  cargoHash = "sha256-OhKp7fZjsVrB/ipvzFAei7kRqYgybrSm6uZRAnijKek=";

  nativeBuildInputs = [ pkg-config ];

@ -48,7 +48,7 @@ rustPlatform.buildRustPackage rec {
    updateScript = nix-update-script {
      extraArgs = [
        "--version-regex"
-        "tauri-v(.*)"
+        "tauri-cli-v(.*)"
      ];
    };
  };
--- a/pkgs/by-name/ca/cargo-tauri/test-app.nix
+++ b/pkgs/by-name/ca/cargo-tauri/test-app.nix
@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
      src
      ;

-    hash = "sha256-deLcw84MsSqoVTUgqEJrcZhzFxACw56WIgsC8iYR4zk=";
+    hash = "sha256-zG4TmZlZ6oPvbDr3a8RlhM6ivtMG+vWox/OJETSUR2A=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ci/cirrus-cli/package.nix
+++ b/pkgs/by-name/ci/cirrus-cli/package.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "cirrus-cli";
-  version = "0.134.0";
+  version = "0.135.0";

  src = fetchFromGitHub {
    owner = "cirruslabs";
    repo = "cirrus-cli";
    rev = "v${version}";
-    hash = "sha256-f7EMIz2MR5LgW2chIkOyUx2BuC/EBJVR8AOl+ufHwu0=";
+    hash = "sha256-s7nJ6fhmVZf/+uuN7rW+lq0Xvlz9p425yQNzoTRxTLo=";
  };

  vendorHash = "sha256-FMUBwrY5PJLsd507340PC+f0f9PzPblFYpnNi6hiNeM=";
--- a/pkgs/by-name/cl/clock-rs/package.nix
+++ b/pkgs/by-name/cl/clock-rs/package.nix
@ -0,0 +1,36 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "clock-rs";
+  version = "0.1.213";
+
+  src = fetchFromGitHub {
+    owner = "Oughie";
+    repo = "clock-rs";
+    tag = "v${version}";
+    sha256 = "06spnadlgy7902bqhhi6019ay5y55qfrarsfidp938icali9q5pi";
+  };
+
+  cargoHash = "sha256-ir/IwhREheMSdElLYqp3/zHE54BMAK5/7f5/wyTd1yc=";
+
+  meta = {
+    description = "Modern, digital clock that effortlessly runs in your terminal";
+    longDescription = ''
+      clock-rs is a terminal-based clock written in Rust, designed to be a new alternative to tty-clock.
+      It supports all major platforms and offers several improvements, which include:
+
+      The use of a single configuration file to manage its settings, with the ability to overwrite them through the command line,
+      Many additional features such as a timer and a stopwatch,
+      And greater flexibility as well as better user experience!
+    '';
+    homepage = "https://github.com/Oughie/clock-rs";
+    license = lib.licenses.asl20;
+    mainProgram = "clock-rs";
+    maintainers = [ lib.maintainers.oughie ];
+    platforms = lib.platforms.all;
+  };
+}
--- a/pkgs/by-name/da/darklua/package.nix
+++ b/pkgs/by-name/da/darklua/package.nix
@ -8,17 +8,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "darklua";
-  version = "0.15.0";
+  version = "0.16.0";

  src = fetchFromGitHub {
    owner = "seaofvoices";
    repo = "darklua";
    rev = "v${version}";
-    hash = "sha256-OLx3J8E9PYXgWbQncWoezyptrbFYcw3xmXzYAn7IUFw=";
+    hash = "sha256-D83cLJ6voLvgZ51qLoCUzBG83VFB3Y7HxuaZHpaiOn4=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-t3uLi4ywqXeLNMxueljCIo4fYdDVB17iVUcyqXsydrY=";
+  cargoHash = "sha256-DQkj4t+l6FJnJQ+g96CXypssbRzHbS6X9AOG0LGDclg=";

  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
    darwin.apple_sdk.frameworks.CoreServices
--- a/pkgs/by-name/dd/ddclient/package.nix
+++ b/pkgs/by-name/dd/ddclient/package.nix
@ -12,7 +12,7 @@ let
 in
 perlPackages.buildPerlPackage rec {
  pname = "ddclient";
-  version = "3.11.2";
+  version = "4.0.0";

  outputs = [ "out" ];

@ -20,7 +20,7 @@ perlPackages.buildPerlPackage rec {
    owner = "ddclient";
    repo = "ddclient";
    rev = "v${version}";
-    sha256 = "sha256-d1G+AM28nBpMWh1QBjm78KKeOL5b5arxERYRCXohwBg=";
+    sha256 = "sha256-RCE24RKcW4EhicOTwgz5UE/gzqLxw+UNNk960vFx5Gs=";
  };

  postPatch = ''
--- a/pkgs/by-name/dd/ddns-go/package.nix
+++ b/pkgs/by-name/dd/ddns-go/package.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "ddns-go";
-  version = "6.8.0";
+  version = "6.8.1";

  src = fetchFromGitHub {
    owner = "jeessy2";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-zVNlsFPSLI8mXBUOo8z7nM4nShNd0ZwG5lZL2VyeGi8=";
+    hash = "sha256-a8torNtFdBq19a4eb0uMgivtF7FUF1DX6g8kyCc4Gxg=";
  };

  vendorHash = "sha256-D66uremGVcTcyBlCA9vrQM5zGPFR96FqVak6tATEdI0=";
--- a/pkgs/by-name/do/dotenv-cli/package.nix
+++ b/pkgs/by-name/do/dotenv-cli/package.nix
@ -10,18 +10,18 @@
 }:
 stdenv.mkDerivation rec {
  pname = "dotenv-cli";
-  version = "7.4.3";
+  version = "8.0.0";

  src = fetchFromGitHub {
    owner = "entropitor";
    repo = "dotenv-cli";
    rev = "v${version}";
-    hash = "sha256-kR9LSHvbvKLuJBGrsmYMeqF3s8SF+/99OeNlKp9azI8=";
+    hash = "sha256-cqJGw6z0m1ImFEmG2jfcYjaKVhrGyM4hbOAHC7xNAFY=";
  };

  yarnOfflineCache = fetchYarnDeps {
    yarnLock = "${src}/yarn.lock";
-    hash = "sha256-Sx5DHUAXquqMqJgvhvHcRPqkfWN49+6icUQIos6OHCg=";
+    hash = "sha256-/w9MZ+hNEwB41VwPSYEY6V0uWmZ4Tsev3h2fa/REm2E=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/el/element-call/package.nix
+++ b/pkgs/by-name/el/element-call/package.nix
@ -37,10 +37,18 @@ stdenv.mkDerivation (finalAttrs: {
  nativeBuildInputs = [
    yarnConfigHook
    yarnBuildHook
-    yarnInstallHook
    nodejs
  ];

+  installPhase = ''
+    runHook preInstall
+
+    mkdir $out
+    cp -r dist/* $out
+
+    runHook postInstall
+  '';
+
  meta = with lib; {
    homepage = "https://github.com/element-hq/element-call";
    description = "Group calls powered by Matrix";
--- a/pkgs/by-name/fl/flarum/package.nix
+++ b/pkgs/by-name/fl/flarum/package.nix
@ -3,20 +3,20 @@
 , fetchFromGitHub
 }:

-php.buildComposerProject (finalAttrs: {
+php.buildComposerProject2 (finalAttrs: {
  pname = "flarum";
  version = "1.8.1";

  src = fetchFromGitHub {
    owner = "flarum";
    repo = "flarum";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-kigUZpiHTM24XSz33VQYdeulG1YI5s/M02V7xue72VM=";
  };

  composerLock = ./composer.lock;
  composerStrictValidation = false;
-  vendorHash = "sha256-m+x/4A/DcMv7mMfQjpH1vsVqXuMHhSHeX3sgI43uJLI=";
+  vendorHash = "sha256-pup+ZfPEnqoA3wEXQNn4pWTYXri6d4XzMfuc8k1SeQk=";

  meta = with lib; {
    changelog = "https://github.com/flarum/framework/blob/main/CHANGELOG.md";
--- a/pkgs/by-name/fl/flex-launcher/package.nix
+++ b/pkgs/by-name/fl/flex-launcher/package.nix
@ -0,0 +1,48 @@
+{
+  stdenv,
+  fetchFromGitHub,
+  SDL2,
+  SDL2_ttf,
+  SDL2_image,
+  cmake,
+  validatePkgConfig,
+  inih,
+  lib,
+  gitUpdater,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "flex-launcher";
+  version = "2.2";
+
+  src = fetchFromGitHub {
+    owner = "complexlogic";
+    repo = "flex-launcher";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-touQMOKvp+D1vIYvyz/nU7aU9g6VXpDN3BPgoK/iYfw=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    validatePkgConfig
+  ];
+
+  buildInputs = [
+    SDL2
+    SDL2_ttf
+    SDL2_image
+    inih
+  ];
+
+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
+
+  meta = {
+    description = "Customizable HTPC application launcher";
+    license = lib.licenses.unlicense;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ MasterEvarior ];
+    homepage = "https://complexlogic.github.io/flex-launcher/";
+    changelog = "https://github.com/complexlogic/flex-launcher/releases/tag/v${finalAttrs.version}";
+    mainProgram = "flex-launcher";
+  };
+})
--- a/pkgs/by-name/fr/frankenphp/package.nix
+++ b/pkgs/by-name/fr/frankenphp/package.nix
@ -31,13 +31,13 @@ let
 in
 buildGoModule rec {
  pname = "frankenphp";
-  version = "1.4.1";
+  version = "1.4.2";

  src = fetchFromGitHub {
    owner = "dunglas";
    repo = "frankenphp";
    tag = "v${version}";
-    hash = "sha256-eXyO+Z/qD15smqb2/S1los/zsBVlxuYq+DAkvksMz/s=";
+    hash = "sha256-lY0nZCaevAlTOLHozOvH1xtLFTLOv093N4mrETt4Lhg=";
  };

  sourceRoot = "${src.name}/caddy";
@ -45,7 +45,7 @@ buildGoModule rec {
  # frankenphp requires C code that would be removed with `go mod tidy`
  # https://github.com/golang/go/issues/26366
  proxyVendor = true;
-  vendorHash = "sha256-KlWRyQz//sR24IJj9RvRtPQG0N0FjVSL6Yrq0Nhgi/A=";
+  vendorHash = "sha256-LqsdX2oivCYhXBGZBKP+V7iNUoZuW6lRFO9kUpeEvL4=";

  buildInputs = [
    phpUnwrapped
--- a/pkgs/by-name/ge/geoserver/extensions.nix
+++ b/pkgs/by-name/ge/geoserver/extensions.nix
@ -42,325 +42,325 @@ in
 {
  app-schema = mkGeoserverExtension {
    name = "app-schema";
-    version = "2.26.1"; # app-schema
-    hash = "sha256-klT03jure+ILuQX5X3jdIfUa7AI/bdzTEig2QDs/P5o="; # app-schema
+    version = "2.26.2"; # app-schema
+    hash = "sha256-pFjKgEuAFiEN6FJkooKqMHzkbZnQWchzzLFPsA9TDH4="; # app-schema
  };

  authkey = mkGeoserverExtension {
    name = "authkey";
-    version = "2.26.1"; # authkey
-    hash = "sha256-jjZtUiSQ8ZzsLrinT8Uw628jIRKnGi6XnGT/5GvCwew="; # authkey
+    version = "2.26.2"; # authkey
+    hash = "sha256-u1/dbTHZPIImVq46YGWpdsO60wg6jWmc4ttAzasKpcU="; # authkey
  };

  cas = mkGeoserverExtension {
    name = "cas";
-    version = "2.26.1"; # cas
-    hash = "sha256-FcUlQ9gSb64wxnEZaU1oJViPDbA32GChcdiZ5uvft7w="; # cas
+    version = "2.26.2"; # cas
+    hash = "sha256-KagmWS+VNsC1wtasa9UwNZsaUzmbZKG/SPBq91pW4R8="; # cas
  };

  charts = mkGeoserverExtension {
    name = "charts";
-    version = "2.26.1"; # charts
-    hash = "sha256-IDGBTMa+VMqZIxOFylL29t0h9AoOXe7GJmj3dKrdGQ0="; # charts
+    version = "2.26.2"; # charts
+    hash = "sha256-TDv+7JFe5N8HtxjNOFYcfdJ9kdCLBKigdvqzb9p3dow="; # charts
  };

  control-flow = mkGeoserverExtension {
    name = "control-flow";
-    version = "2.26.1"; # control-flow
-    hash = "sha256-09EuvTTGeaNRLKshhsyHPvE4p9F5IJPV/ig8cNigQbA="; # control-flow
+    version = "2.26.2"; # control-flow
+    hash = "sha256-QQowtOOUKJCm1C7VkDHWbIscCal3PsxFMTfi5JUZqi8="; # control-flow
  };

  css = mkGeoserverExtension {
    name = "css";
-    version = "2.26.1"; # css
-    hash = "sha256-Qy5AYnXIcsoGxnGCjHRK4XiDflT1jVoVKr6Iq/GMYlg="; # css
+    version = "2.26.2"; # css
+    hash = "sha256-MgAwSWpSVrGJYRxGt1gCiLXj8uXQ8hvCkfI+yGtZU34="; # css
  };

  csw = mkGeoserverExtension {
    name = "csw";
-    version = "2.26.1"; # csw
-    hash = "sha256-mZ7BrWFmLrpzW/oM0YovTC+Zb6BMnj1idMSiemNX6Xc="; # csw
+    version = "2.26.2"; # csw
+    hash = "sha256-i3ObMkSOnCGihZm8CcMj90jG3B8pYRTX9Yd4uuholKY="; # csw
  };

  csw-iso = mkGeoserverExtension {
    name = "csw-iso";
-    version = "2.26.1"; # csw-iso
-    hash = "sha256-FV5GDv+fywFhdNJi5hT5qvvPQVBT3TJpjI0SQnmH5BY="; # csw-iso
+    version = "2.26.2"; # csw-iso
+    hash = "sha256-zEVkldjEsI+sBbMDvvL2b6DciwwUacsufXgvIDfLYX4="; # csw-iso
  };

  db2 = mkGeoserverExtension {
    name = "db2";
-    version = "2.26.1"; # db2
-    hash = "sha256-XlCAFADr8hLFQAbCxrFtrNIBh4S4oEjbezlCwprW8uQ="; # db2
+    version = "2.26.2"; # db2
+    hash = "sha256-g9J/KZ3ET2HSs1fhVFW8cRe409vfZddBaXoXOgVZrcE="; # db2
  };

  # Needs wps extension.
  dxf = mkGeoserverExtension {
    name = "dxf";
-    version = "2.26.1"; # dxf
-    hash = "sha256-WHuhp+nqO5NemYWGiRcuD5/vlBdmMNT+sdm2a+yk9do="; # dxf
+    version = "2.26.2"; # dxf
+    hash = "sha256-Ninuw1npfy3lND0O8Tu87hv/gXPQFC3vU8H1oE8aLdc="; # dxf
  };

  excel = mkGeoserverExtension {
    name = "excel";
-    version = "2.26.1"; # excel
-    hash = "sha256-JRNM+JilMODNb2r4XEBRj2wkIb/zc6e6Q+U+/X8egAY="; # excel
+    version = "2.26.2"; # excel
+    hash = "sha256-Lqkbr6KTtiKUmW5A3Uqem0C81oNnLd6eVzm/MwvnYjg="; # excel
  };

  feature-pregeneralized = mkGeoserverExtension {
    name = "feature-pregeneralized";
-    version = "2.26.1"; # feature-pregeneralized
-    hash = "sha256-I0UzMFkZF9SaIFI+GcfegxdC4IFIUi6+GsutotJ5i1Q="; # feature-pregeneralized
+    version = "2.26.2"; # feature-pregeneralized
+    hash = "sha256-T6NiDBOIpqQKEAm58558seSpHSA84w9K1C9l2Xy/sWQ="; # feature-pregeneralized
  };

  # Note: The extension name ("gdal") clashes with pkgs.gdal.
  gdal = mkGeoserverExtension {
    name = "gdal";
-    version = "2.26.1"; # gdal
+    version = "2.26.2"; # gdal
    buildInputs = [ pkgs.gdal ];
-    hash = "sha256-EoaKKlEhch5/wg4SODx9JV9+M+4Ui9Wcb2HSM1bcgLE="; # gdal
+    hash = "sha256-OgkoB2VY4x+6kfDDbOMKUzyd6/Q1m9YMC6sZU17qRsE="; # gdal
  };

  # Throws "java.io.FileNotFoundException: URL [jar:file:/nix/store/.../WEB-INF/lib/gs-geofence-server-2.24.1.jar!/geofence-default-override.properties] cannot be resolved to absolute file path because it does not reside in the file system: jar:file:/nix/store/.../WEB-INF/lib/gs-geofence-server-2.24.1.jar!/geofence-default-override.properties" but seems to work out of the box.
  #geofence = mkGeoserverExtension {
  #  name = "geofence";
-  #  version = "2.26.1"; # geofence
-  #  hash = "sha256-B2yPPEOsdBDxO/mG3W6MYBqhigjvS6YTZTsvHoUzBAg="; # geofence
+  #  version = "2.26.2"; # geofence
+  #  hash = "sha256-gXJYk64qO78hQhEmmJU98mrSYIKK/DlRPptdS6rFDD0="; # geofence
  #};

  #geofence-server = mkGeoserverExtension {
  #  name = "geofence-server";
-  #  version = "2.26.1"; # geofence-server
-  #  hash = "sha256-pgWWomyBmru2tfQfuGdomQirN0Km3j5W/JG644vNHZQ="; # geofence-server
+  #  version = "2.26.2"; # geofence-server
+  #  hash = "sha256-tyxIjQNmATtLy1X9dmaLugsbMyg7+2+NMx8a5jvVvDU="; # geofence-server
  #};

  #geofence-wps = mkGeoserverExtension {
  #  name = "geofence-wps";
-  #  version = "2.26.1"; # geofence-wps
-  #  hash = "sha256-hQBYJ+jXx3/GOVzqcSS1w/Zc0GKAD2fyIX5lm9kiPmg="; # geofence-wps
+  #  version = "2.26.2"; # geofence-wps
+  #  hash = "sha256-ZU5E5SsYBpOvguYhHXLrm5IJzYtSggcF+iqB76LB05g="; # geofence-wps
  #};

  geopkg-output = mkGeoserverExtension {
    name = "geopkg-output";
-    version = "2.26.1"; # geopkg-output
-    hash = "sha256-9EuI9Hvvxdf1FmJ6AMHmbc5RJr33MlBbGd9NqNwacFo="; # geopkg-output
+    version = "2.26.2"; # geopkg-output
+    hash = "sha256-XzzT6g5G26/NZzdCl4wqtQUbNfMGrc5/lI/HRN+x8BU="; # geopkg-output
  };

  grib = mkGeoserverExtension {
    name = "grib";
-    version = "2.26.1"; # grib
-    hash = "sha256-o87Fyy+remmP8c3m4TZ6TX+lUoPdH//P2yJ1DeV+iBs="; # grib
+    version = "2.26.2"; # grib
+    hash = "sha256-9onvPoSFOLODqedOLW3Bf0IJLE3UtuMSF8l4dGysMDs="; # grib
    buildInputs = [ netcdf ];
  };

  gwc-s3 = mkGeoserverExtension {
    name = "gwc-s3";
-    version = "2.26.1"; # gwc-s3
-    hash = "sha256-7XLrG4sJ1Bvw6d0qzT0ZGLVQ8wr9br9mUEwZGvd9U+s="; # gwc-s3
+    version = "2.26.2"; # gwc-s3
+    hash = "sha256-3z7DfkY/NP9ESfZWI+/ubHwHmBJM0SYyJGNVz7oAuVc="; # gwc-s3
  };

  h2 = mkGeoserverExtension {
    name = "h2";
-    version = "2.26.1"; # h2
-    hash = "sha256-ldqz1tPPJkyJPFBeltDUIDLwZtTu8mpSHRbWGsY3TfY="; # h2
+    version = "2.26.2"; # h2
+    hash = "sha256-7wsbxACFtmtL1ApQy1DT2yYzOF51nfi7CWYlUGfYoKY="; # h2
  };

  iau = mkGeoserverExtension {
    name = "iau";
-    version = "2.26.1"; # iau
-    hash = "sha256-mzkYYPfixrSx7+r0lSrOw9agocpi7BogDnmcqtiJh1M="; # iau
+    version = "2.26.2"; # iau
+    hash = "sha256-j8Z5q0w6iqC++KScWoRTMOf4o7ADPN7IfPccc8A4A1M="; # iau
  };

  importer = mkGeoserverExtension {
    name = "importer";
-    version = "2.26.1"; # importer
-    hash = "sha256-Os7oRg+EM5p7rXyI5Qg0vWzZ2i1/tplw1zHaLJJ0feM="; # importer
+    version = "2.26.2"; # importer
+    hash = "sha256-4BObAg/3BuP8UH4yodClBJsSlTE4S2tyPtqDHqOGRYg="; # importer
  };

  inspire = mkGeoserverExtension {
    name = "inspire";
-    version = "2.26.1"; # inspire
-    hash = "sha256-cYxoBk/oOjKj7gk4mzHUSU1LbWLRxjSbH9B+JiZCxgU="; # inspire
+    version = "2.26.2"; # inspire
+    hash = "sha256-NZ5oMXpakPfdJZg8J9Y3D/8j09H0P9CQgnpeObrGkNE="; # inspire
  };

  # Needs Kakadu plugin from
  # https://github.com/geosolutions-it/imageio-ext
  #jp2k = mkGeoserverExtension {
  #  name = "jp2k";
-  #  version = "2.26.1"; # jp2k
-  #  hash = "sha256-P4UUtfRSlH4GMpDcvy1TjyorolrPLK0P8zCwDJUbFhE="; # jp2k
+  #  version = "2.26.2"; # jp2k
+  #  hash = "sha256-W+nx7PeEksyjA2iuN75qvWqDSdSnF0eNHAPqwce3amA="; # jp2k
  #};

  libjpeg-turbo = mkGeoserverExtension {
    name = "libjpeg-turbo";
-    version = "2.26.1"; # libjpeg-turbo
-    hash = "sha256-pGorlT/BaS605wyIcgNAM5aJxV6I78Dr3m1uADxdebI="; # libjpeg-turbo
+    version = "2.26.2"; # libjpeg-turbo
+    hash = "sha256-EYZQOQ1rAqTbRHh7cewkvJT4l1cmyFxNUwEFW2/8ezQ="; # libjpeg-turbo
    buildInputs = [ libjpeg.out ];
  };

  mapml = mkGeoserverExtension {
    name = "mapml";
-    version = "2.26.1"; # mapml
-    hash = "sha256-r1Z7Gc3c/kH2jm6wD46Oj2ZZTg136k2n9lqnRVkPXfs="; # mapml
+    version = "2.26.2"; # mapml
+    hash = "sha256-RHTPzy0f3DP6ye94Slw/Tz/GIleAgW1DMiMkkneT7kk="; # mapml
  };

  mbstyle = mkGeoserverExtension {
    name = "mbstyle";
-    version = "2.26.1"; # mbstyle
-    hash = "sha256-a5jQDyn/nOS/HbhAzKAKl40g1SDYQ51Xi+LzWtByntA="; # mbstyle
+    version = "2.26.2"; # mbstyle
+    hash = "sha256-vJB9wFiMJtu16JuJ+vESYG07U/Hs7NmMo3kqMkjV0k4="; # mbstyle
  };

  metadata = mkGeoserverExtension {
    name = "metadata";
-    version = "2.26.1"; # metadata
-    hash = "sha256-O9/gBrJBp8/fOYOx7fsqkgcQ0k6wxIoz9DLQDemjJK8="; # metadata
+    version = "2.26.2"; # metadata
+    hash = "sha256-CVp2KVHmqeIXPf031HBnvilcgfEKOpyv9Pc/yNpCFM8="; # metadata
  };

  mongodb = mkGeoserverExtension {
    name = "mongodb";
-    version = "2.26.1"; # mongodb
-    hash = "sha256-j9e2V6UkagW55WKKW2eaCnBBGwKmdDjGQBSvngpAqb8="; # mongodb
+    version = "2.26.2"; # mongodb
+    hash = "sha256-Ndo0/r0maxZ7GcGQFY8ZNgtmxXaDJ1Gtj4oDRN7qzWM="; # mongodb
  };

  monitor = mkGeoserverExtension {
    name = "monitor";
-    version = "2.26.1"; # monitor
-    hash = "sha256-CLTtJHO+/Hq8/JFErm3ieyLc6wIqCelx0CRDpzbPfZ0="; # monitor
+    version = "2.26.2"; # monitor
+    hash = "sha256-1/yqmzFaPbntgxB1zXqJIrKCdKJpPzHm30v+Ww/kgXE="; # monitor
  };

  mysql = mkGeoserverExtension {
    name = "mysql";
-    version = "2.26.1"; # mysql
-    hash = "sha256-TiSkHdp/U9P1acaD5mN0eOA/J/5fnnJH14nDlKNY3+k="; # mysql
+    version = "2.26.2"; # mysql
+    hash = "sha256-QOlAUhXyzpazYk/JJr9IcU1gIVS7iGB6Ly2HgbER8dA="; # mysql
  };

  netcdf = mkGeoserverExtension {
    name = "netcdf";
-    version = "2.26.1"; # netcdf
-    hash = "sha256-k/zDVoh19Pg/jZa4svAqU1c4EqPnPRSIQL9ZTlrohvY="; # netcdf
+    version = "2.26.2"; # netcdf
+    hash = "sha256-cwe518kyk5vMjjBvHhzmTdZ/G0nT0KEDoQK7GbiAnfQ="; # netcdf
    buildInputs = [ netcdf ];
  };

  netcdf-out = mkGeoserverExtension {
    name = "netcdf-out";
-    version = "2.26.1"; # netcdf-out
-    hash = "sha256-maHIpPQshEcB7JZuhTIo1X209o29iv36alUx76LWV2I="; # netcdf-out
+    version = "2.26.2"; # netcdf-out
+    hash = "sha256-/u9cOOT0/FvEt39VXO3l4Vv01Qpiqg9qJnNH4nnUxa0="; # netcdf-out
    buildInputs = [ netcdf ];
  };

  ogr-wfs = mkGeoserverExtension {
    name = "ogr-wfs";
-    version = "2.26.1"; # ogr-wfs
+    version = "2.26.2"; # ogr-wfs
    buildInputs = [ pkgs.gdal ];
-    hash = "sha256-XFEO0JruZCgYj7LWNftIFeI0LoypMbtD2A148LbLg+4="; # ogr-wfs
+    hash = "sha256-4Lp9ffQVgug2zP6ikDyDSITqrq8K5wADjNm3ArpJz1s="; # ogr-wfs
  };

  # Needs ogr-wfs extension.
  ogr-wps = mkGeoserverExtension {
    name = "ogr-wps";
-    version = "2.26.1"; # ogr-wps
+    version = "2.26.2"; # ogr-wps
    # buildInputs = [ pkgs.gdal ];
-    hash = "sha256-qfuU/HlVTHjPIA9DCdc8YURpLyPHSxXKEko0s3tDLpI="; # ogr-wps
+    hash = "sha256-57rQgsdwXI7eQFhbL+ieP8uOlfeOJqUVWibBNZiPb9E="; # ogr-wps
  };

  oracle = mkGeoserverExtension {
    name = "oracle";
-    version = "2.26.1"; # oracle
-    hash = "sha256-dZ6b+hYD1uJDHMJRDChsZc3W9TiQhKfvCBbDIr9xB9E="; # oracle
+    version = "2.26.2"; # oracle
+    hash = "sha256-23/lMh1L3zzwUk3cJCxQhdLdQoghhkK1JAoet9nmN1M="; # oracle
  };

  params-extractor = mkGeoserverExtension {
    name = "params-extractor";
-    version = "2.26.1"; # params-extractor
-    hash = "sha256-7qr+jxo4tzxW76k/t+Zd0h45U6mqzReRjnsJfWFZV8o="; # params-extractor
+    version = "2.26.2"; # params-extractor
+    hash = "sha256-mEKf4riqzSlwra71jY4MO1BM2/fCfikW1CKAB02ntF8="; # params-extractor
  };

  printing = mkGeoserverExtension {
    name = "printing";
-    version = "2.26.1"; # printing
-    hash = "sha256-jXdp0zX5sq4HBs1lF658FtSRjMOm1KXrbVm9dDPDmfk="; # printing
+    version = "2.26.2"; # printing
+    hash = "sha256-/R4MX73aiTGbqDNK+2rthcBUwJesc3j96UDqmpTZpxk="; # printing
  };

  pyramid = mkGeoserverExtension {
    name = "pyramid";
-    version = "2.26.1"; # pyramid
-    hash = "sha256-hRc24f5pY94TRsmttc0SLPjS6S23kzCeiyuE8XbM4pA="; # pyramid
+    version = "2.26.2"; # pyramid
+    hash = "sha256-6FIDk62d45ctmwhaW/XpdHziiPFyhsKm36l5BpZa4/w="; # pyramid
  };

  querylayer = mkGeoserverExtension {
    name = "querylayer";
-    version = "2.26.1"; # querylayer
-    hash = "sha256-7wNSoi6PUZJLHGUO0D48O88xKoU63FBSH4+lfxgbEjA="; # querylayer
+    version = "2.26.2"; # querylayer
+    hash = "sha256-sM9OmWKJwOjxqzuhOEF+6j01r3+lvvZmaOIxBnmsUbo="; # querylayer
  };

  sldservice = mkGeoserverExtension {
    name = "sldservice";
-    version = "2.26.1"; # sldservice
-    hash = "sha256-T2v42w8mhaFH/gcnJUEJdlQZH6gNyx8Y8wpKws0Xsns="; # sldservice
+    version = "2.26.2"; # sldservice
+    hash = "sha256-aKRy0wbx5XRdXPGZFsf+bdxmU0ILAPiMI2Zqg2nu52E="; # sldservice
  };

  sqlserver = mkGeoserverExtension {
    name = "sqlserver";
-    version = "2.26.1"; # sqlserver
-    hash = "sha256-gQrmBMxosWkvAb9+DG9UEgrmG8AKl3NPgYLZ2nG2iM0="; # sqlserver
+    version = "2.26.2"; # sqlserver
+    hash = "sha256-Sacng3WZ+bbljlnYQfP9RWk96kVeiJlGFFgudNheg9g="; # sqlserver
  };

  vectortiles = mkGeoserverExtension {
    name = "vectortiles";
-    version = "2.26.1"; # vectortiles
-    hash = "sha256-/cR7S5dzR8td7dFk05QkLnp0vhSpXuCLO0vmiB2JyRQ="; # vectortiles
+    version = "2.26.2"; # vectortiles
+    hash = "sha256-6hC8YfGbgUC6Mxx5/0qfbKOaO7UmHEhcrY9q1U/Q3Us="; # vectortiles
  };

  wcs2_0-eo = mkGeoserverExtension {
    name = "wcs2_0-eo";
-    version = "2.26.1"; # wcs2_0-eo
-    hash = "sha256-SYUo3G/BuILOHN6t8F9Q/gwGjAzCY9crmvU+f6mDm/U="; # wcs2_0-eo
+    version = "2.26.2"; # wcs2_0-eo
+    hash = "sha256-u433otfuIdCOPON8mGcyDgVoHstXV4tKClRopN+yJHE="; # wcs2_0-eo
  };

  web-resource = mkGeoserverExtension {
    name = "web-resource";
-    version = "2.26.1"; # web-resource
-    hash = "sha256-z2Zm4UvigN7TvIIHnn42xThIg8Xy3F2+1fPzdhDMZ+A="; # web-resource
+    version = "2.26.2"; # web-resource
+    hash = "sha256-C8+8Ri7RLz8UhsMuhINF2p7SriHV6+lU/DBMBo75fUw="; # web-resource
  };

  wmts-multi-dimensional = mkGeoserverExtension {
    name = "wmts-multi-dimensional";
-    version = "2.26.1"; # wmts-multi-dimensional
-    hash = "sha256-Wju8vN4KCN13aJshPqfUEQa8B0WHdeOvFEZ/ZzZOg7E="; # wmts-multi-dimensional
+    version = "2.26.2"; # wmts-multi-dimensional
+    hash = "sha256-6Wnf4im1fZULjoSOu2V3Phn4/6A3UGnCP8BvZDtaKUU="; # wmts-multi-dimensional
  };

  wps = mkGeoserverExtension {
    name = "wps";
-    version = "2.26.1"; # wps
-    hash = "sha256-Yi1MdBWeoNBMco/8JUouVXVpfebmpXkTo6COJPLl0bw="; # wps
+    version = "2.26.2"; # wps
+    hash = "sha256-ocFmcaWsEq7iothnc7/7DIPpbCo5z5WwI3F1tbDX8dA="; # wps
  };

  # Needs hazelcast (https://github.com/hazelcast/hazelcast (?)) which is not
  # available in nixpgs as of 2024/01.
  #wps-cluster-hazelcast = mkGeoserverExtension {
  #  name = "wps-cluster-hazelcast";
-  #  version = "2.26.1"; # wps-cluster-hazelcast
-  #  hash = "sha256-Ed2jV6fmoOUQX7Cs3Qe1TjJ8mki/u1v/nng7MqF+Jqs="; # wps-cluster-hazelcast
+  #  version = "2.26.2"; # wps-cluster-hazelcast
+  #  hash = "sha256-GoSeXKd4wBhYdnGlHgoHiaVxnb4VNEg1TG5IXG0qJzA="; # wps-cluster-hazelcast
  #};

  wps-download = mkGeoserverExtension {
    name = "wps-download";
-    version = "2.26.1"; # wps-download
-    hash = "sha256-HX+RUZHsfyMb/u/I2S57zrW6HKhzSdE9CZT3GjQ0fbM="; # wps-download
+    version = "2.26.2"; # wps-download
+    hash = "sha256-FBVt/B2nuf0PY4o1yuJ997sjWdsWYYxDgC94yOKQH/8="; # wps-download
  };

  # Needs Postrgres configuration or similar.
  # See https://docs.geoserver.org/main/en/user/extensions/wps-jdbc/index.html
  wps-jdbc = mkGeoserverExtension {
    name = "wps-jdbc";
-    version = "2.26.1"; # wps-jdbc
-    hash = "sha256-W6EUZtt8It1u786eFvuw9k7eZ1SLBG+J4amW036PZko="; # wps-jdbc
+    version = "2.26.2"; # wps-jdbc
+    hash = "sha256-w3pzprk4UG4vE6K7tB/41U66OGSpB9uNUafKmKZ5uWY="; # wps-jdbc
  };

  ysld = mkGeoserverExtension {
    name = "ysld";
-    version = "2.26.1"; # ysld
-    hash = "sha256-kwAMkoSNxoraZ20fVg0xCOD3slxAITL+eLOIJCGewXk="; # ysld
+    version = "2.26.2"; # ysld
+    hash = "sha256-guaTT3S0lU6nSaw90gNCHm5Gsdc27jX+XE/92vVfVQI="; # ysld
  };

 }
--- a/pkgs/by-name/ge/geoserver/package.nix
+++ b/pkgs/by-name/ge/geoserver/package.nix
@ -10,11 +10,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: rec {
  pname = "geoserver";
-  version = "2.26.1";
+  version = "2.26.2";

  src = fetchurl {
    url = "mirror://sourceforge/geoserver/GeoServer/${version}/geoserver-${version}-bin.zip";
-    hash = "sha256-qKlXVwzCNS+diuOo43q0nfwPlIMuUPOY1OaoKt9mL+g=";
+    hash = "sha256-K4OeMGnczKXVl+nxyd9unuCdoEpyF7j364Vxe49EOxo=";
  };

  patches = [
--- a/pkgs/by-name/gi/gitkraken/package.nix
+++ b/pkgs/by-name/gi/gitkraken/package.nix
@ -87,9 +87,6 @@ let
    license = licenses.unfree;
    platforms = builtins.attrNames srcs;
    maintainers = with maintainers; [
-      xnwdd
-      evanjs
-      arkivm
      nicolas-goudry
      Rishik-Y
    ];
--- a/pkgs/by-name/gn/gnmic/package.nix
+++ b/pkgs/by-name/gn/gnmic/package.nix
@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "gnmic";
-  version = "0.39.1";
+  version = "0.40.0";

  src = fetchFromGitHub {
    owner = "openconfig";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-bFMgGPGbBWfT7M5rE6k4Q5L9srgy0UyFtAq/xOdZhxw=";
+    hash = "sha256-rdT1gCALEsPiyN+4RKmJ36CUkYmbkIyi56JjVkzzkp8=";
  };

-  vendorHash = "sha256-9A/ZcamCMUpNxG3taHrqI4JChjpSjSuwx0ZUyGAuGXo=";
+  vendorHash = "sha256-n4HBm9n3RkSmAkd29dhDN0tZ/bjVCBzQSihgY8VA1L4=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/gn/gnome-terminal/package.nix
+++ b/pkgs/by-name/gn/gnome-terminal/package.nix
@ -1,13 +1,13 @@
 {
  stdenv,
  lib,
-  fetchFromGitLab,
+  fetchurl,
  meson,
  ninja,
  pkg-config,
  python3,
  libxml2,
-  gitUpdater,
+  gnome,
  nautilus,
  glib,
  gtk4,
@ -30,14 +30,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gnome-terminal";
-  version = "3.54.2";
+  version = "3.54.3";

-  src = fetchFromGitLab {
-    domain = "gitlab.gnome.org";
-    owner = "GNOME";
-    repo = "gnome-terminal";
-    rev = finalAttrs.version;
-    hash = "sha256-81dOdmIwa3OmuUTciTlearqic6bFMfiX1nvoIxJCt/M=";
+  src = fetchurl {
+    url = "mirror://gnome/sources/gnome-terminal/${lib.versions.majorMinor finalAttrs.version}/gnome-terminal-${finalAttrs.version}.tar.xz";
+    hash = "sha256-Oa8AueYadNjN8oFSvq/uUTwyfhIjoHfRMcR5xQT0pHU=";
  };

  nativeBuildInputs = [
@ -78,8 +75,9 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  passthru = {
-    updateScript = gitUpdater {
-      odd-unstable = true;
+    updateScript = gnome.updateScript {
+      packageName = "gnome-terminal";
+      versionPolicy = "odd-unstable";
    };

    tests = {
--- a/pkgs/by-name/go/go-migrate/package.nix
+++ b/pkgs/by-name/go/go-migrate/package.nix
@ -6,17 +6,17 @@

 buildGoModule rec {
  pname = "go-migrate";
-  version = "4.18.1";
+  version = "4.18.2";

  src = fetchFromGitHub {
    owner = "golang-migrate";
    repo = "migrate";
    rev = "v${version}";
-    sha256 = "sha256-ZZeurnoFcObrK75zkIZvz9ycdDP9AM3uX6h/4bMWpGc=";
+    sha256 = "sha256-DRWJ5USabSQtNkyDjz8P7eOS2QBE1KaD8K8XYORBVGo=";
  };

  proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-Zaq88oF5rSCSv736afyKDvTNCSIyrIGTN0kuJWqS7tg=";
+  vendorHash = "sha256-0SbhHA5gKzODW8rHCEuZXWs8vMsVDMqJsRDPs4V1gGc=";

  subPackages = [ "cmd/migrate" ];

--- a/pkgs/by-name/hd/hdrop/package.nix
+++ b/pkgs/by-name/hd/hdrop/package.nix
@ -15,13 +15,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "hdrop";
-  version = "0.7.3";
+  version = "0.7.4";

  src = fetchFromGitHub {
    owner = "Schweber";
    repo = "hdrop";
    rev = "v${version}";
-    hash = "sha256-OX9kjGGdIvsaaGwNq7IbyD5B7AmlH1wHiR6P4uIOdi8=";
+    hash = "sha256-9uhofu4YHlHTLtOikShKlNWSjNslVNtJcSIUKvtWFZc=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/hy/hyprland-qt-support/package.nix
+++ b/pkgs/by-name/hy/hyprland-qt-support/package.nix
@ -0,0 +1,48 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  ninja,
+  qt6,
+  pkg-config,
+  hyprlang,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "hyprland-qt-support";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "hyprwm";
+    repo = "hyprland-qt-support";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-+uZovj+X0a28172y0o0BvgGXyZLpKPbG03sVlCiSrWc=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    pkg-config
+    qt6.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    qt6.qtbase
+    qt6.qtdeclarative
+    qt6.qtsvg
+    qt6.qtwayland
+    hyprlang
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeFeature "INSTALL_QML_PREFIX" qt6.qtbase.qtQmlPrefix)
+  ];
+
+  meta = {
+    description = "A Qt6 QML provider for hypr* apps";
+    homepage = "https://github.com/hyprwm/hyprland-qt-support";
+    license = lib.licenses.bsd3;
+    platforms = lib.platforms.linux;
+    maintainers = lib.teams.hyprland.members;
+  };
+})
--- a/pkgs/by-name/hy/hyprland-qtutils/package.nix
+++ b/pkgs/by-name/hy/hyprland-qtutils/package.nix
@ -5,6 +5,7 @@
  cmake,
  pkg-config,
  hyprutils,
+  hyprland-qt-support,
  pciutils,
  qt6,
 }:
@ -13,13 +14,13 @@ let
 in
 gcc14Stdenv.mkDerivation (finalAttrs: {
  pname = "hyprland-qtutils";
-  version = "0.1.2";
+  version = "0.1.3";

  src = fetchFromGitHub {
    owner = "hyprwm";
    repo = "hyprland-qtutils";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-FxbuGQExtN37ToWYnGmO6weOYN6WPHN/RAqbr7gNPek=";
+    hash = "sha256-9m/Ha7hrxtbBl4UylZTYzTT/8a6Sy5DvTmBJrcQ6FwQ=";
  };

  nativeBuildInputs = [
@ -30,6 +31,7 @@ gcc14Stdenv.mkDerivation (finalAttrs: {

  buildInputs = [
    hyprutils
+    hyprland-qt-support
    qt6.qtbase
    qt6.qtsvg
    qt6.qtwayland
--- a/pkgs/by-name/hy/hyprpolkitagent/package.nix
+++ b/pkgs/by-name/hy/hyprpolkitagent/package.nix
@ -4,6 +4,7 @@
  cmake,
  pkg-config,
  fetchFromGitHub,
+  hyprland-qt-support,
  hyprutils,
  kdePackages,
  polkit,
@ -27,6 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  buildInputs = [
+    hyprland-qt-support
    hyprutils
    kdePackages.kirigami-addons
    kdePackages.polkit-qt-1
--- a/pkgs/by-name/hy/hyprsysteminfo/package.nix
+++ b/pkgs/by-name/hy/hyprsysteminfo/package.nix
@ -0,0 +1,53 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  qt6,
+  pkg-config,
+  hyprutils,
+  pciutils,
+  hyprland-qt-support,
+}:
+let
+  inherit (lib.strings) makeBinPath;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "hyprsysteminfo";
+  version = "0.1.3";
+
+  src = fetchFromGitHub {
+    owner = "hyprwm";
+    repo = "hyprsysteminfo";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-KDxT9B+1SATWiZdUBAQvZu17vk3xmyXcw2Zy56bdWbY=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    qt6.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    qt6.qtbase
+    qt6.qtdeclarative
+    qt6.qtsvg
+    qt6.qtwayland
+    hyprutils
+    hyprland-qt-support
+  ];
+
+  preFixup = ''
+    qtWrapperArgs+=(--prefix PATH : "${makeBinPath [ pciutils ]}")
+  '';
+
+  meta = {
+    description = "A tiny qt6/qml application to display information about the running system";
+    homepage = "https://github.com/hyprwm/hyprsysteminfo";
+    license = lib.licenses.bsd3;
+    maintainers = lib.teams.hyprland.members;
+    mainProgram = "hyprsysteminfo";
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/im/imgproxy/package.nix
+++ b/pkgs/by-name/im/imgproxy/package.nix
@ -11,12 +11,12 @@

 buildGoModule rec {
  pname = "imgproxy";
-  version = "3.27.1";
+  version = "3.27.2";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
-    hash = "sha256-ewfBMHSrt7fBazgswOwOmeqk0uAc3uULPYppQZcLep4=";
+    hash = "sha256-rPdo+gj1nxbrE3qbABB7H+tN6WXAdwhtPUCYCsn6vEk=";
    rev = "v${version}";
  };

--- a/pkgs/by-name/im/immich-public-proxy/package.nix
+++ b/pkgs/by-name/im/immich-public-proxy/package.nix
@ -8,17 +8,17 @@
 }:
 buildNpmPackage rec {
  pname = "immich-public-proxy";
-  version = "1.6.2";
+  version = "1.6.3";
  src = fetchFromGitHub {
    owner = "alangrainger";
    repo = "immich-public-proxy";
    tag = "v${version}";
-    hash = "sha256-R2w11AdOgcV1R1eIzDgt+yexWwystDNJiJ+14MH6WtU=";
+    hash = "sha256-nhVU3CVexXV+WCUP8E1tGvwwjy+PCTL9v3/3KI1tDus=";
  };

  sourceRoot = "${src.name}/app";

-  npmDepsHash = "sha256-VXCJ0VaAKOlz342saRAnb1MLZGgIZwPpy/2oS/Gvsj8=";
+  npmDepsHash = "sha256-NQgxAHNMPp2eDoiMqjqBOZ3364XjW3WtvrK/ciqg1DI=";

  # patch in absolute nix store paths so the process doesn't need to cwd in $out
  postPatch = ''
--- a/pkgs/by-name/ki/kittycad-kcl-lsp/package.nix
+++ b/pkgs/by-name/ki/kittycad-kcl-lsp/package.nix
@ -7,17 +7,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "kittycad-kcl-lsp";
-  version = "0.1.65";
+  version = "0.1.66";

  src = fetchFromGitHub {
    owner = "KittyCAD";
    repo = "kcl-lsp";
    tag = "v${version}";
-    hash = "sha256-3j7xiTrhDPBNTg53y2KyLpk8m4DrJbZWYkdIm5sxEfs=";
+    hash = "sha256-uKsxWNR5syd2+/4I9nxZ+fWBUdHP3rhpUzLVPn4v8Wk=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-Hab3DlLU2PRaZCBA2BM5FlpDkpXIfIFxys6uPCDUrnc=";
+  cargoHash = "sha256-dKNuPg6XRZ6UwZr6+S3+LM3t9xATgGndhX3hrD3Xp0Q=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/by-name/li/libburn/package.nix
+++ b/pkgs/by-name/li/libburn/package.nix
@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitea,
+  fetchpatch,
  autoreconfHook,
  pkg-config,
 }:
@ -18,6 +19,15 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-Xo45X4374FXvlrJ4Q0PahYvuWXO0k3N0ke0mbURYt54=";
  };

+  patches = [
+    # Fix the build against C23 compilers (like gcc-15):
+    (fetchpatch {
+      name = "c23.patch";
+      url = "https://dev.lovelyhq.com/libburnia/libburn/commit/d537f9dd35282df834a311ead5f113af67d223b3.patch";
+      hash = "sha256-aouU/6AchLhzMzvkVvUnFHWfebYTrkEJ6P3fF5pvE9M=";
+    })
+  ];
+
  nativeBuildInputs = [
    autoreconfHook
    pkg-config
--- a/pkgs/by-name/li/libcifpp/package.nix
+++ b/pkgs/by-name/li/libcifpp/package.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libcifpp";
-  version = "7.0.8";
+  version = "7.0.9";

  src = fetchFromGitHub {
    owner = "PDB-REDO";
    repo = "libcifpp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-PD811D/n++PM45H/BatlLiMaIeUEiisLU/bGhiUhPU0=";
+    hash = "sha256-wV4YvQmtpbj+mOiMeSr9gBpZzFPygkAOkj74vv4pA4U=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/li/libmcfp/package.nix
+++ b/pkgs/by-name/li/libmcfp/package.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libmcfp";
-  version = "1.3.4";
+  version = "1.3.5";

  src = fetchFromGitHub {
    owner = "mhekkel";
    repo = "libmcfp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-7Oy7qEXIAJ50NXL4+Mm67WrivpubDz7uLWZ3YVzTFxA=";
+    hash = "sha256-e4scwaCwKU2M5FJ/+UTNDigazopQwGhCIqDatQX7ERw=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/li/libspelling/package.nix
+++ b/pkgs/by-name/li/libspelling/package.nix
@ -1,7 +1,7 @@
 {
  lib,
  stdenv,
-  fetchFromGitLab,
+  fetchurl,
  meson,
  ninja,
  pkg-config,
@ -17,9 +17,9 @@
  gnome,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "libspelling";
-  version = "0.4.5";
+  version = "0.4.6";

  outputs = [
    "out"
@ -27,12 +27,9 @@ stdenv.mkDerivation rec {
    "devdoc"
  ];

-  src = fetchFromGitLab {
-    domain = "gitlab.gnome.org";
-    owner = "GNOME";
-    repo = "libspelling";
-    rev = version;
-    hash = "sha256-+WjhBg98s5RxQfd85FtMNuoVWjw9Hap9yDqnpYNAGgw=";
+  src = fetchurl {
+    url = "mirror://gnome/sources/libspelling/${lib.versions.majorMinor finalAttrs.version}/libspelling-${finalAttrs.version}.tar.xz";
+    hash = "sha256-MkiptTNuovcn0tuRLS8Ag6zMBQXOcHZ5s9m4JmwBAfU=";
  };

  nativeBuildInputs = [
@ -69,4 +66,4 @@ stdenv.mkDerivation rec {
    changelog = "https://gitlab.gnome.org/GNOME/libspelling/-/raw/${version}/NEWS";
    maintainers = with maintainers; [ chuangzhu ] ++ teams.gnome.members;
  };
-}
+})
--- a/pkgs/by-name/li/limbo/package.nix
+++ b/pkgs/by-name/li/limbo/package.nix
@ -7,17 +7,17 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "limbo";
-  version = "0.0.12";
+  version = "0.0.13";

  src = fetchFromGitHub {
    owner = "tursodatabase";
    repo = "limbo";
    tag = "v${version}";
-    hash = "sha256-Lmtvn7hWdrqumtTpiYK0sTsESeKo4Mfao32K0DfHmrc=";
+    hash = "sha256-zIjtuATXlqFh2IoM9cqWysZdRFaVgJTcZFWUsK+NtsQ=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-wmo2ZUtFGylH1z2R+SwMOWSsq0lGn9nkMwtvI9sZn5U=";
+  cargoHash = "sha256-Bb293Amn1S4QARtWrtRkWFHF5FisIcbrfJTsOV6aUQo=";

  cargoBuildFlags = [
    "-p"
--- a/pkgs/by-name/li/lint-staged/package.nix
+++ b/pkgs/by-name/li/lint-staged/package.nix
@ -8,16 +8,16 @@

 buildNpmPackage rec {
  pname = "lint-staged";
-  version = "15.4.0";
+  version = "15.4.3";

  src = fetchFromGitHub {
    owner = "okonet";
    repo = "lint-staged";
    rev = "v${version}";
-    hash = "sha256-upCbaGoP/O2j3PrZzxMneRBNvz/24sUpUOZK8C7R/Bc=";
+    hash = "sha256-TBh0qqe2sHSisBMU86TlGhSVrBFY9rgYs5uGSmSTT4g=";
  };

-  npmDepsHash = "sha256-V/AUZV7Ru0TrD0PIm82ppWlqKwzbeiFm+CZO/PtSI+s=";
+  npmDepsHash = "sha256-p0+Feii4riQ4TtNAQtPZ1bH/yA8q1tjm15IKNi1Ksvk=";

  dontNpmBuild = true;

--- a/pkgs/by-name/lk/lk-jwt-service/package.nix
+++ b/pkgs/by-name/lk/lk-jwt-service/package.nix
@ -6,23 +6,19 @@

 buildGoModule rec {
  pname = "lk-jwt-service";
-  version = "0-unstable-2024-04-27";
+  version = "0.1.1";

  src = fetchFromGitHub {
    owner = "element-hq";
    repo = "lk-jwt-service";
-    rev = "4a295044a4d0bd2af4474bf6a8a14fd0596ecf9e";
-    hash = "sha256-dN4iJ8P0u5dbZ93mp/FumcvByP7EpQhOvR+Oe4COWXQ=";
+    tag = "v${version}";
+    hash = "sha256-RbfJdAhLz2wfTC17i533U25TIUtJEkHTgqJC2R+j1uM=";
  };

-  vendorHash = "sha256-9qOApmmOW+N1L/9hj9tVy0hLIUI36WL2TGWUcM3ajeM=";
-
-  postInstall = ''
-    mv $out/bin/ec-lms $out/bin/lk-jwt-service
-  '';
+  vendorHash = "sha256-7wruthAqC9jVpAhPiIDdqAB51l38fLHEhl2QOaBJiL0=";

  meta = with lib; {
-    description = "Minimal service to provide LiveKit JWTs using Matrix OpenID Connect";
+    description = "Minimal service to issue LiveKit JWTs for MatrixRTC";
    homepage = "https://github.com/element-hq/lk-jwt-service";
    license = licenses.agpl3Plus;
    maintainers = with maintainers; [ kilimnik ];
--- a/pkgs/by-name/ll/lldap-cli/package.nix
+++ b/pkgs/by-name/ll/lldap-cli/package.nix
@ -7,18 +7,21 @@
  gnugrep,
  gnused,
  jq,
+  lldap,
+  unixtools,
  curl,
  makeWrapper,
+  unstableGitUpdater,
 }:
 stdenv.mkDerivation {
  pname = "lldap-cli";
-  version = "0-unstable-2024-02-24";
+  version = "0-unstable-2024-11-11";

  src = fetchFromGitHub {
    owner = "Zepmann";
    repo = "lldap-cli";
-    rev = "d1fe50006c4a3a1796d4fb2d73d8c8dcfc875fd5";
-    hash = "sha256-ZKRTYdgtOfV7TgpaVKLhYrCttYvB/bUexMshmmF8NyY=";
+    rev = "2a80dc47c334c88faf3000b45c631bc2cea09906";
+    hash = "sha256-uk7SOiQmUYtoJnihSnPsu/7Er4wXX4xvPboJaNSMjkM=";
  };

  nativeBuildInputs = [ makeWrapper ];
@ -42,15 +45,19 @@ stdenv.mkDerivation {
      --prefix PATH : ${
        lib.makeBinPath [
          bash
+          unixtools.column
          coreutils
          gnugrep
          gnused
          jq
+          lldap # Needed for lldap_set_password
          curl
        ]
      }
  '';

+  passthru.updateScript = unstableGitUpdater { };
+
  meta = {
    description = "Command line tool for managing LLDAP";
    longDescription = ''
--- a/pkgs/by-name/mi/minijinja/package.nix
+++ b/pkgs/by-name/mi/minijinja/package.nix
@ -6,17 +6,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "minijinja";
-  version = "2.6.0";
+  version = "2.7.0";

  src = fetchFromGitHub {
    owner = "mitsuhiko";
    repo = "minijinja";
    rev = version;
-    hash = "sha256-6jPTbtB7n85oGHYgOqZgBF5QyQGJwyZ3zyY+XLfU9y0=";
+    hash = "sha256-8MKd1sT+zg03tkKppd8/Zu6ZZWoVTMTmQXSrcDKp0xw=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-V+ByJGJZFc1MEsSQkfO7P+08qDaTw0I2ye+4wwYrw4M=";
+  cargoHash = "sha256-cOaHJsgzCTxY1JGpSamajyWfmAc+M+s2OS5xhcvUN8I=";

  # The tests relies on the presence of network connection
  doCheck = false;
--- a/pkgs/by-name/mi/misconfig-mapper/package.nix
+++ b/pkgs/by-name/mi/misconfig-mapper/package.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "misconfig-mapper";
-  version = "1.12.6";
+  version = "1.13.0";

  src = fetchFromGitHub {
    owner = "intigriti";
    repo = "misconfig-mapper";
    tag = "v${version}";
-    hash = "sha256-OdwTY73w/N1NuEeK7GsQWFT9NyOwrKlK0q0llW9Ena0=";
+    hash = "sha256-WheKF6IG4quJpNBPXbOMKGEUkR6wr3cVi97Gtpaz+LA=";
  };

  vendorHash = "sha256-omnWQfriaPqz51xrUKZM5112ZEHJZgAm68hnqUyzR6A=";
--- a/pkgs/by-name/mp/mp4fpsmod/package.nix
+++ b/pkgs/by-name/mp/mp4fpsmod/package.nix
@ -0,0 +1,46 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "mp4fpsmod";
+  version = "0.27-unstable-2023-12-30";
+
+  src = fetchFromGitHub {
+    owner = "nu774";
+    repo = "mp4fpsmod";
+    rev = "e2dd065012f4d2c7e42d4acdefee2ffdc50d3d86";
+    hash = "sha256-54pkjlvLLi4pLlQA/l+v4Mx5HlloR6GiB2GP71A0x/g=";
+  };
+
+  nativeBuildInputs = [ autoreconfHook ];
+
+  enableParallelBuilding = true;
+
+  preConfigure = ''
+    ./bootstrap.sh
+  '';
+
+  meta = with lib; {
+    description = "Tiny mp4 time code editor";
+    longDescription = ''
+      Tiny mp4 time code editor. You can use this for changing fps,
+      delaying audio tracks, executing DTS compression, extracting
+      time codes of mp4.
+    '';
+    inherit (src.meta) homepage;
+    license = with licenses; [
+      # All files are distributed as Public Domain, except for the followings:
+      publicDomain
+      mpl11 # mp4v2
+      boost # Boost
+      bsd2 # FreeBSD CVS
+    ];
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ huggy ];
+    mainProgram = "mp4fpsmod";
+  };
+}
--- a/pkgs/by-name/na/nanobench/package.nix
+++ b/pkgs/by-name/na/nanobench/package.nix
@ -0,0 +1,53 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  cmake,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "nanobench";
+  version = "4.3.11";
+
+  src = fetchFromGitHub {
+    owner = "martinus";
+    repo = "nanobench";
+    tag = "v${version}";
+    hash = "sha256-6OoVU31cNY0pIYpK/PdB9Qej+9IJo7+fHFQCTymBVrk=";
+  };
+
+  patches = [
+    # Missing header from a test file. Required for compiling as of gcc13. Patched in commit from master branch.
+    # Remove on next release.
+    (fetchpatch {
+      url = "https://github.com/martinus/nanobench/commit/e4327893194f06928012eb81cabc606c4e4791ac.patch";
+      hash = "sha256-vmpohg9TbIxT+p4JerWh/QBcZ3/+1gPSNf15sqW6leM=";
+    })
+
+    # Change cmake install directories to conventional locations. Patches from unmerged pull request.
+    # Remove when merged upstream.
+    (fetchpatch {
+      url = "https://github.com/martinus/nanobench/pull/98/commits/92c6995ccaebbda87fed13de8eaf3d135d1af0c0.patch";
+      hash = "sha256-JwCpwSRzV1qnwwcJIGEJWxthT4Vj12TXhAGG0bc8KGM=";
+    })
+    (fetchpatch {
+      url = "https://github.com/martinus/nanobench/pull/98/commits/17a1f0b598a09d399dd492c72bca5b48ad76c794.patch";
+      hash = "sha256-2lOD63qN7gywUQxrdSRVyddpzcQjjeWOrA3hqu7x+CY=";
+    })
+  ];
+
+  nativeBuildInputs = [ cmake ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Simple, fast, accurate single-header microbenchmarking functionality for C++11/14/17/20";
+    homepage = "https://nanobench.ankerl.com/";
+    changelog = "https://github.com/martinus/nanobench/releases/tag/v${version}";
+    platforms = lib.platforms.all;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ mtpham99 ];
+  };
+}
--- a/pkgs/by-name/ne/neovim-unwrapped/package.nix
+++ b/pkgs/by-name/ne/neovim-unwrapped/package.nix
@ -96,7 +96,7 @@ stdenv.mkDerivation (
  in
  {
    pname = "neovim-unwrapped";
-    version = "0.10.3";
+    version = "0.10.4";

    __structuredAttrs = true;

@ -104,7 +104,7 @@ stdenv.mkDerivation (
      owner = "neovim";
      repo = "neovim";
      tag = "v${finalAttrs.version}";
-      hash = "sha256-nmnEyHE/HcrwK+CyJHNoLG0BqjnWleiBy0UYcJL7Ecc=";
+      hash = "sha256-TAuoa5GD50XB4OCHkSwP1oXfedzVrCBRutNxBp/zGLY=";
    };

    patches = [
--- a/pkgs/by-name/ne/nezha-theme-nazhua/package.nix
+++ b/pkgs/by-name/ne/nezha-theme-nazhua/package.nix
@ -12,18 +12,18 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "nezha-theme-nazhua";
-  version = "0.5.1";
+  version = "0.5.6";

  src = fetchFromGitHub {
    owner = "hi2shark";
    repo = "nazhua";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-5XEdfUCwQSa+PWu4SHJCg3rCtblyD5x41lKe0SvFrU8=";
+    hash = "sha256-HqNiXkj3GLw5MlQu2fREwUYpT35txopli9SZcFCM90w=";
  };

  yarnOfflineCache = fetchYarnDeps {
    yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-Wy4xtLjDNkBLeESJCbfq9GhT0mSTAfGBN0A3oHX5BuE=";
+    hash = "sha256-/CQsG3iQdPyKHdApeMzq4w90NsMBdLXUP2lya8vtK5Q=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/no/novelwriter/package.nix
+++ b/pkgs/by-name/no/novelwriter/package.nix
@ -7,7 +7,7 @@
  nix-update-script,
 }:
 let
-  version = "2.5.3";
+  version = "2.6";
 in
 python3.pkgs.buildPythonApplication {
  pname = "novelwriter";
@ -18,7 +18,7 @@ python3.pkgs.buildPythonApplication {
    owner = "vkbo";
    repo = "novelWriter";
    rev = "v${version}";
-    hash = "sha256-OrsDL5zpMDV2spxC0jtpuhaSWBIS6XBEWZuVxHAS/QM=";
+    hash = "sha256-eQ0az+4SEpf07rlCHGvK8Fp8ECimpTblWNlxwANNisE=";
  };

  nativeBuildInputs = [ qt5.wrapQtAppsHook ];
--- a/pkgs/by-name/oa/oauth2c/package.nix
+++ b/pkgs/by-name/oa/oauth2c/package.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "oauth2c";
-  version = "1.17.1";
+  version = "1.17.2";

  src = fetchFromGitHub {
    owner = "cloudentity";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-rrQSQDrdaU3HBTZL0vwHYK07XzcYwUZQp9aG6lwuDsc=";
+    hash = "sha256-axCzPCYPn6T8AGqE92Yf/aVJ78Wl004Ts4YebSWYa6U=";
  };

  vendorHash = "sha256-ZQFIETfiNKyeZuskwNfoTXBy3MSWmG0tDztz0Mm7xJY=";
--- a/pkgs/by-name/oh/oh-my-fish/package.nix
+++ b/pkgs/by-name/oh/oh-my-fish/package.nix
@ -4,7 +4,7 @@
  fetchFromGitHub,
  fish,
  runtimeShell,
-  substituteAll,
+  replaceVars,
 }:

 stdenv.mkDerivation (finalAttrs: {
@ -38,14 +38,16 @@ stdenv.mkDerivation (finalAttrs: {
    cp -vr * $out/share/oh-my-fish

    cp -v ${
-      substituteAll {
-        name = "omf-install";
-        src = ./omf-install;
-        omf = placeholder "out";
+      replaceVars ./omf-install {
        inherit fish runtimeShell;
+        # replaced below
+        omf = null;
      }
    } $out/bin/omf-install

+    substituteInPlace $out/bin/omf-install \
+      --replace-fail '@omf@' "$out"
+
    chmod +x $out/bin/omf-install
    cat $out/bin/omf-install

--- a/pkgs/by-name/op/openvas-scanner/package.nix
+++ b/pkgs/by-name/op/openvas-scanner/package.nix
@ -31,13 +31,13 @@

 stdenv.mkDerivation rec {
  pname = "openvas-scanner";
-  version = "23.15.0";
+  version = "23.15.3";

  src = fetchFromGitHub {
    owner = "greenbone";
    repo = "openvas-scanner";
    tag = "v${version}";
-    hash = "sha256-LjZZYIA0Qkuheb8ZAPBuiy5GgjOgCfJ0D/YM03zTcW0=";
+    hash = "sha256-9TzS/w/FZSawrc505aeaGJlz4m6k4Q4loCVgChzKs30=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ox/oxipng/package.nix
+++ b/pkgs/by-name/ox/oxipng/package.nix
@ -3,6 +3,7 @@
  stdenv,
  fetchFromGitHub,
  rustPlatform,
+  qemu,
 }:

 rustPlatform.buildRustPackage rec {
@ -20,6 +21,9 @@ rustPlatform.buildRustPackage rec {
  useFetchCargoVendor = true;
  cargoHash = "sha256-4c9YcIQRZsbDJvl8P9Pkd3atTVM+RbQ/4BMb7rE84po=";

+  # See https://github.com/shssoichiro/oxipng/blob/14b8b0e93a/.cargo/config.toml#L5
+  nativeCheckInputs = [ qemu ];
+
  meta = {
    homepage = "https://github.com/shssoichiro/oxipng";
    description = "Multithreaded lossless PNG compression optimizer";
--- a/pkgs/by-name/pa/packer/package.nix
+++ b/pkgs/by-name/pa/packer/package.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "packer";
-  version = "1.11.2";
+  version = "1.12.0";

  src = fetchFromGitHub {
    owner = "hashicorp";
    repo = "packer";
    rev = "v${version}";
-    hash = "sha256-xi5CWL+KQd9nZSd0EscdH+lfw+WLtteSxtEos0lCNcA=";
+    hash = "sha256-19eaQs2f4zM3lXuQrWoS2S/tXWe3HdxXesjtVG67LFE=";
  };

-  vendorHash = "sha256-Xmmc30W1ZfMc7YSQswyCjw1KyDA5qi8W+kZ1L7cM3cQ=";
+  vendorHash = "sha256-BsYL0PEpujsXLjhFP05yK8Pr0tc0lrdsQqxzmKso3rw=";

  subPackages = [ "." ];

--- a/pkgs/by-name/pa/pay-respects/package.nix
+++ b/pkgs/by-name/pa/pay-respects/package.nix
@ -8,18 +8,18 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "pay-respects";
-  version = "0.6.11";
+  version = "0.6.12";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "iff";
    repo = "pay-respects";
    rev = "v${version}";
-    hash = "sha256-4m8/sp6r2Xb2SsNcatMv0+mWHBx+XKD0LEzrEwuWIEA=";
+    hash = "sha256-lDIhI9CnWwVVGyAJAS3gDUEkeXShTvPd8JKC1j9/9yU=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-uE3nS5XAn20iB7VQuYpFryIhQ7WMAEFGrD+KHJb1H5I=";
+  cargoHash = "sha256-z0nHq5qiT59bCgOWb7D3h25LcejwJlp64j5zaUx9jb0=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/pd/pdm/package.nix
+++ b/pkgs/by-name/pd/pdm/package.nix
@ -24,7 +24,7 @@ let
 in
 python.pkgs.buildPythonApplication rec {
  pname = "pdm";
-  version = "2.22.2";
+  version = "2.22.3";
  pyproject = true;

  disabled = python.pkgs.pythonOlder "3.8";
@ -33,7 +33,7 @@ python.pkgs.buildPythonApplication rec {
    owner = "pdm-project";
    repo = "pdm";
    tag = version;
-    hash = "sha256-se0Xvziyg4CU6wENO0oYVAI4f2uBv3Ubadiptf/uPgQ=";
+    hash = "sha256-+qUvVQJO/xfBZJuMBezu/LdKhKag1BCQ3To2qFXiOzY=";
  };

  pythonRelaxDeps = [ "hishel" ];
--- a/pkgs/by-name/po/poptracker/package.nix
+++ b/pkgs/by-name/po/poptracker/package.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "poptracker";
-  version = "0.29.0";
+  version = "0.30.1";

  src = fetchFromGitHub {
    owner = "black-sliver";
    repo = "PopTracker";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-rkEaq8YLt0NhspXVgEqZ/9FF7GDlTU5fKgWGXeA6UX4=";
+    hash = "sha256-U1C0vwHcUfjBPGLcmmWFqaKmIMPlV/FumIbFJ6JDBFc=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/py/pylyzer/package.nix
+++ b/pkgs/by-name/py/pylyzer/package.nix
@ -13,17 +13,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "pylyzer";
-  version = "0.0.77";
+  version = "0.0.78";

  src = fetchFromGitHub {
    owner = "mtshiba";
    repo = "pylyzer";
    tag = "v${version}";
-    hash = "sha256-MlDW3dNe9fdOzWp38VkjgoiqOYgBF+ezwTQE0+6SXCc=";
+    hash = "sha256-g8/zhl0dCQOq4aTlivAh3ufgfEMzeMvTtJQxFuHHWB0=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-bkYRPwiB2BN4WNZ0HcOBiDbFyidftbHWyIDvJasnePc=";
+  cargoHash = "sha256-mi4pCYA0dQnv3MIpZxVVY0qLdIts/qvxS4og0Tyxk3w=";

  nativeBuildInputs = [
    git
--- a/pkgs/by-name/re/refine/package.nix
+++ b/pkgs/by-name/re/refine/package.nix
@ -34,7 +34,7 @@ in

 python3Packages.buildPythonApplication rec {
  pname = "refine";
-  version = "0.4.0";
+  version = "0.4.2";
  pyproject = false; # uses meson

  src = fetchFromGitLab {
@ -42,7 +42,7 @@ python3Packages.buildPythonApplication rec {
    owner = "TheEvilSkeleton";
    repo = "Refine";
    tag = version;
-    hash = "sha256-dgp2a/+Du2mEPQ4EPmOPvKsklrWI2zD1rPJnhE7LetQ=";
+    hash = "sha256-5oXLcmj0ZWYaCP93S+tSTqFn+XnrUkE/VwiA3ufvSQ0=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ri/river-bsp-layout/package.nix
+++ b/pkgs/by-name/ri/river-bsp-layout/package.nix
@ -6,17 +6,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "river-bsp-layout";
-  version = "2.1.0";
+  version = "2.1.1";

  src = fetchFromGitHub {
    owner = "areif-dev";
    repo = "river-bsp-layout";
    rev = "v${version}";
-    hash = "sha256-LRVZPAS4V5PtrqyOkKUfrZuwLqPZbLoyjn2DPxCFE2o=";
+    hash = "sha256-/R9v3NGsSG4JJtdk0sJX7ahRolRmJMwMP48JRmLffXc=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-tLMZQb05UPYVHH7b1+qtxalaLRMAWEDJ1Nkm9UqoApg=";
+  cargoHash = "sha256-kfeRGT/qgZRPfXl03JYRF1CVPIIiGPIdxLORiA6QWu4=";

  meta = {
    homepage = "https://github.com/areif-dev/river-bsp-layout";
--- a/pkgs/by-name/sc/scaleway-cli/package.nix
+++ b/pkgs/by-name/sc/scaleway-cli/package.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "scaleway-cli";
-  version = "2.35.0";
+  version = "2.36.0";

  src = fetchFromGitHub {
    owner = "scaleway";
    repo = "scaleway-cli";
    rev = "v${version}";
-    sha256 = "sha256-k+WfloaNr9qJE+y6ANgUvZnMWZjSa5YpZvHcOxk/79Q=";
+    sha256 = "sha256-xHHLOYdJ32Uo2TXdKPtYrbsx8kqGY5oF5zXGdsFTkd4=";
  };

-  vendorHash = "sha256-HMZfka92iT7350tE35Hlo6KMnA21sJZBvaFoclmMsYw=";
+  vendorHash = "sha256-QPRUba3JUUp0wtylL21+FCTWf/BWStbOcmPwoSOeRF8=";

  ldflags = [
    "-w"
--- a/pkgs/by-name/sd/SDL_ttf/package.nix
+++ b/pkgs/by-name/sd/SDL_ttf/package.nix
@ -49,5 +49,8 @@ stdenv.mkDerivation (finalAttrs: {
    license = lib.licenses.zlib;
    maintainers = lib.teams.sdl.members ++ (with lib.maintainers; [ ]);
    inherit (SDL.meta) platforms;
+    knownVulnerabilities = [
+      "CVE-2022-27470"
+    ];
  };
 })
--- a/pkgs/by-name/sd/sdcc/package.nix
+++ b/pkgs/by-name/sd/sdcc/package.nix
@ -32,11 +32,11 @@ assert
  ] excludePorts == [ ];
 stdenv.mkDerivation (finalAttrs: {
  pname = "sdcc";
-  version = "4.4.0";
+  version = "4.5.0";

  src = fetchurl {
    url = "mirror://sourceforge/sdcc/sdcc-src-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-rowSFl6xdoDf9EsyjYh5mWMGtyQe+jqDsuOy0veQanU=";
+    hash = "sha256-1QMEN/tDa7HZOo29v7RrqqYGEzGPT7P1hx1ygV0e7YA=";
  };

  outputs = [
--- a/pkgs/by-name/se/sedutil/package.nix
+++ b/pkgs/by-name/se/sedutil/package.nix
@ -42,5 +42,6 @@ stdenv.mkDerivation rec {
    homepage = "https://www.drivetrust.com";
    license = licenses.gpl3Plus;
    platforms = platforms.linux;
+    mainProgram = "sedutil-cli";
  };
 }
--- a/pkgs/by-name/se/sentry-native/package.nix
+++ b/pkgs/by-name/se/sentry-native/package.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "sentry-native";
-  version = "0.7.18";
+  version = "0.7.19";

  src = fetchFromGitHub {
    owner = "getsentry";
    repo = "sentry-native";
    rev = version;
-    hash = "sha256-V/2SsLxhu/EenF408RnowGCeKkGpkn1i19Ic1l7Z7f8=";
+    hash = "sha256-N9zrXr5KwcShRfh0bFlK904FN+KPdVNmxYnLxoRkWxA=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/sq/sql-formatter/package.nix
+++ b/pkgs/by-name/sq/sql-formatter/package.nix
@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation rec {
  pname = "sql-formatter";
-  version = "15.4.9";
+  version = "15.4.10";

  src = fetchFromGitHub {
    owner = "sql-formatter-org";
    repo = "sql-formatter";
    rev = "v${version}";
-    hash = "sha256-rCM/RDyWGBAobsiODIujkcjkqM4uSFPdRfvPqgIJQaY=";
+    hash = "sha256-KRF4AFBkXzy9wYBTTsc4LvlLNbSohzbdbue+SZjNTJo=";
  };

  yarnOfflineCache = fetchYarnDeps {
--- a/pkgs/by-name/sq/squid/package.nix
+++ b/pkgs/by-name/sq/squid/package.nix
@ -16,6 +16,7 @@
  cppunit,
  esi ? false,
  ipv6 ? true,
+  nixosTests,
 }:

 stdenv.mkDerivation (finalAttrs: {
@ -80,6 +81,8 @@ stdenv.mkDerivation (finalAttrs: {
    done
  '';

+  passthru.tests.squid = nixosTests.squid;
+
  meta = with lib; {
    description = "Caching proxy for the Web supporting HTTP, HTTPS, FTP, and more";
    homepage = "http://www.squid-cache.org";
--- a/pkgs/by-name/st/step-kms-plugin/package.nix
+++ b/pkgs/by-name/st/step-kms-plugin/package.nix
@ -12,13 +12,13 @@

 buildGoModule rec {
  pname = "step-kms-plugin";
-  version = "0.11.8";
+  version = "0.12.0";

  src = fetchFromGitHub {
    owner = "smallstep";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-73l+R0Xrvyckt2ifJs12c3k6zSb9AhHV0F9Zk6qIwAg=";
+    hash = "sha256-zYDKUSYnuYGexWet8F6DI/5nPcGJtvSvB7b6sij6JY8=";
  };

  vendorHash = "sha256-sXwaxMfBb8zZDCP3g8iZgXL540uDyWtu57cUPia9FzA=";
--- a/pkgs/by-name/su/sudo-font/package.nix
+++ b/pkgs/by-name/su/sudo-font/package.nix
@ -6,11 +6,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "sudo-font";
-  version = "2.1";
+  version = "2.2";

  src = fetchzip {
    url = "https://github.com/jenskutilek/sudo-font/releases/download/v${version}/sudo.zip";
-    hash = "sha256-ER+TpODf+Inqo+XWJRNOHumzGRL4Dms5N1E+BU7Tr94=";
+    hash = "sha256-qI43FDDXcJby2EbEow0ZBzPVOQby3+WxvhJKyjrYUp8=";
  };

  installPhase = ''
--- a/pkgs/by-name/sv/svgbob/package.nix
+++ b/pkgs/by-name/sv/svgbob/package.nix
@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "svgbob";
-  version = "0.7.4";
+  version = "0.7.6";

  src = fetchCrate {
    inherit version;
    crateName = "svgbob_cli";
-    hash = "sha256-qSY12WjSPMoWqJHkYnPvhCtZAuI3eq+sA+/Yr9Yssp8=";
+    hash = "sha256-mPF6GcsXl/Bcri9d8SS21+/sjssT4//ktwC620NrEUg=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-nMo8qO0dKwtZJY78+r4kLrR9Cw6Eu5Hq8IPp6ilJqfk=";
+  cargoHash = "sha256-ObUAN+1ZHqYjWLZe/HGwTOgGbOVCdqY27kZ2zTj0Mu0=";

  postInstall = ''
    mv $out/bin/svgbob_cli $out/bin/svgbob
--- a/Show more
+++ b/Show more