Merge remote-tracking branch 'origin/master' into staging-next

2025-06-10 19:55:41 +03:00 · 2025-04-07 09:36:05 +03:00 · 2025-04-07 09:36:05 +03:00 · 74d5b70eb2
commit 74d5b70eb2
parent c7c96c5a63 b32bf1b763
165 changed files with 5036 additions and 3997 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -19534,6 +19534,12 @@
    githubId = 488734;
    name = "Puck Meerburg";
  };
+  PuercoPop = {
+    email = "pirata@gmail.com";
+    github = "PuercoPop";
+    githubId = 387111;
+    name = "Javier Olaechea";
+  };
  puffnfresh = {
    email = "brian@brianmckenna.org";
    github = "puffnfresh";
--- a/nixos/modules/services/desktop-managers/cosmic.nix
+++ b/nixos/modules/services/desktop-managers/cosmic.nix
@ -45,7 +45,7 @@ in
        cosmic-applets
        cosmic-applibrary
        cosmic-bg
-        (cosmic-comp.override { useXWayland = false; })
+        cosmic-comp
        cosmic-edit
        cosmic-files
        config.services.displayManager.cosmic-greeter.package
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -8,7 +8,7 @@

 }:
 # The return value of this function will be an attrset with arbitrary depth and
-# the `anything` returned by callTest at its test leafs.
+# the `anything` returned by callTest at its test leaves.
 # The tests not supported by `system` will be replaced with `{}`, so that
 # `passthru.tests` can contain links to those without breaking on architectures
 # where said tests are unsupported.
@ -655,7 +655,7 @@ in
  jool = import ./jool.nix { inherit pkgs runTest; };
  jotta-cli = handleTest ./jotta-cli.nix { };
  k3s = handleTest ./k3s { };
-  kafka = handleTest ./kafka.nix { };
+  kafka = handleTest ./kafka { };
  kanboard = runTest ./web-apps/kanboard.nix;
  kanidm = handleTest ./kanidm.nix { };
  kanidm-provisioning = handleTest ./kanidm-provisioning.nix { };
--- a/nixos/tests/kafka/base.nix
+++ b/nixos/tests/kafka/base.nix
@ -1,8 +1,4 @@
-{
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../.. { inherit system config; },
-}:
+{ pkgs, ... }:

 with pkgs.lib;

@ -13,7 +9,7 @@ let
      kafkaPackage,
      mode ? "kraft",
    }:
-    (import ./make-test-python.nix ({
+    (import ../make-test-python.nix ({
      inherit name;
      meta = with pkgs.lib.maintainers; {
        maintainers = [ nequissimus ];
@ -71,6 +67,7 @@ let
                9092
                9093
              ];
+              virtualisation.diskSize = 1024;
              # i686 tests: qemu-system-i386 can simulate max 2047MB RAM (not 2048)
              virtualisation.memorySize = 2047;
            };
@ -84,6 +81,7 @@ let
              };

              networking.firewall.allowedTCPPorts = [ 2181 ];
+              virtualisation.diskSize = 1024;
            };
        };

@ -116,7 +114,7 @@ let
            + "--from-beginning --max-messages 1"
        )
      '';
-    }) { inherit system; });
+    }));

 in
 with pkgs;
--- a/nixos/tests/kafka/cluster.nix
+++ b/nixos/tests/kafka/cluster.nix
@ -0,0 +1,199 @@
+import ../make-test-python.nix (
+  { lib, pkgs, ... }:
+
+  let
+    inherit (lib) mkMerge;
+
+    # Generate with `kafka-storage.sh random-uuid`
+    clusterId = "ii5pZE5LRkSeWrnyBhMOYQ";
+
+    kafkaConfig = {
+      networking.firewall.allowedTCPPorts = [
+        9092
+        9093
+      ];
+
+      virtualisation.diskSize = 1024;
+      virtualisation.memorySize = 1024 * 2;
+
+      environment.systemPackages = [ pkgs.apacheKafka ];
+
+      services.apache-kafka = {
+        enable = true;
+
+        clusterId = "${clusterId}";
+
+        formatLogDirs = true;
+
+        settings = {
+          listeners = [
+            "PLAINTEXT://:9092"
+            "CONTROLLER://:9093"
+          ];
+          "listener.security.protocol.map" = [
+            "PLAINTEXT:PLAINTEXT"
+            "CONTROLLER:PLAINTEXT"
+          ];
+          "controller.quorum.voters" = lib.imap1 (i: name: "${toString i}@${name}:9093") (
+            builtins.attrNames kafkaNodes
+          );
+          "controller.listener.names" = [ "CONTROLLER" ];
+
+          "process.roles" = [
+            "broker"
+            "controller"
+          ];
+
+          "log.dirs" = [ "/var/lib/apache-kafka" ];
+          "num.partitions" = 6;
+          "offsets.topic.replication.factor" = 2;
+          "transaction.state.log.replication.factor" = 2;
+          "transaction.state.log.min.isr" = 2;
+        };
+      };
+
+      systemd.services.apache-kafka = {
+        after = [ "network-online.target" ];
+        requires = [ "network-online.target" ];
+        serviceConfig.StateDirectory = "apache-kafka";
+      };
+    };
+
+    extraKafkaConfig = {
+      kafka1 = {
+        services.apache-kafka.settings = {
+          "node.id" = 1;
+          "broker.rack" = 1;
+        };
+      };
+
+      kafka2 = {
+        services.apache-kafka.settings = {
+          "node.id" = 2;
+          "broker.rack" = 2;
+        };
+      };
+
+      kafka3 = {
+        services.apache-kafka.settings = {
+          "node.id" = 3;
+          "broker.rack" = 3;
+        };
+      };
+
+      kafka4 = {
+        services.apache-kafka.settings = {
+          "node.id" = 4;
+          "broker.rack" = 3;
+        };
+      };
+    };
+
+    kafkaNodes = builtins.mapAttrs (
+      _: val:
+      mkMerge [
+        val
+        kafkaConfig
+      ]
+    ) extraKafkaConfig;
+  in
+  {
+    name = "kafka-cluster";
+    meta = with pkgs.lib.maintainers; {
+      maintainers = [ jpds ];
+    };
+
+    nodes = {
+      inherit (kafkaNodes)
+        kafka1
+        kafka2
+        kafka3
+        kafka4
+        ;
+
+      client =
+        { config, ... }:
+        {
+          environment.systemPackages = [ pkgs.apacheKafka ];
+          virtualisation.diskSize = 1024;
+        };
+    };
+
+    testScript = ''
+      import json
+
+      for machine in kafka1, kafka2, kafka3, kafka4:
+        machine.wait_for_unit("apache-kafka")
+
+      for machine in kafka1, kafka2, kafka3, kafka4:
+        machine.wait_for_open_port(9092)
+        machine.wait_for_open_port(9093)
+
+        machine.wait_until_succeeds(
+          "journalctl -o cat -u apache-kafka.service | grep 'Transition from STARTING to STARTED'"
+        )
+
+        machine.wait_until_succeeds(
+          "journalctl -o cat -u apache-kafka.service | grep 'Kafka Server started'"
+        )
+
+        machine.wait_until_succeeds(
+          "journalctl -o cat -u apache-kafka.service | grep 'BrokerLifecycleManager' | grep 'Incarnation [[:graph:]]\+ of broker [[:digit:]] in cluster ${clusterId}'"
+        )
+
+      current_voters_json = kafka1.wait_until_succeeds(
+        "kafka-metadata-quorum.sh --bootstrap-server kafka1:9092,kafka2:9092,kafka3:9092 describe --status | grep CurrentVoters"
+      ).replace("CurrentVoters:", "")
+
+      voters = json.loads(current_voters_json)
+
+      assert len(voters) == 4
+
+      kafka1.wait_until_succeeds(
+        "kafka-topics.sh --bootstrap-server kafka1:9092 --create --topic test-123 --replication-factor 2"
+      )
+
+      for machine in kafka1, kafka2, kafka3, kafka4:
+        machine.wait_until_succeeds(
+          "journalctl -o cat -u apache-kafka.service | grep -E 'Created log for partition test-123-[[:digit:]] in /var/lib/apache-kafka/test-123-[[:digit:]] with properties'"
+        )
+
+      kafka1.wait_until_succeeds(
+        "kafka-topics.sh --bootstrap-server=kafka1:9092 --describe --topic test-123 | "
+        + "grep 'PartitionCount: 6'"
+      )
+
+      # Should never see a replica on both 3 and 4 as they're in the same rack
+      kafka1.fail(
+        "kafka-topics.sh --bootstrap-server=kafka1:9092 --describe --topic test-123 | "
+        + "grep -E 'Replicas: (3,4|4,3)'"
+      )
+
+      client.succeed(
+          "echo 'test 2' | "
+          + "kafka-console-producer.sh "
+          + "--bootstrap-server kafka1:9092 "
+          + "--topic test-123"
+      )
+      assert "test 2" in client.succeed(
+          "kafka-console-consumer.sh "
+          + "--bootstrap-server kafka2:9092 --topic test-123 "
+          + "--group readtest "
+          + "--from-beginning --max-messages 1"
+      )
+
+      client.succeed(
+          "echo 'test 3' | "
+          + "kafka-console-producer.sh "
+          + "--bootstrap-server kafka2:9092 "
+          + "--topic test-123"
+      )
+      assert "test 3" in client.succeed(
+          "kafka-console-consumer.sh "
+          + "--bootstrap-server kafka3:9092 --topic test-123 "
+          + "--group readtest "
+          + "--max-messages 1"
+      )
+    '';
+  }
+)
--- a/nixos/tests/kafka/default.nix
+++ b/nixos/tests/kafka/default.nix
@ -0,0 +1,11 @@
+{
+  system ? builtins.currentSystem,
+  config ? { },
+  pkgs ? import ../../.. { inherit system config; },
+}:
+
+{
+  base = import ./base.nix { inherit system pkgs; };
+  cluster = import ./cluster.nix { inherit system pkgs; };
+  mirrormaker = import ./mirrormaker.nix { inherit system pkgs; };
+}
--- a/nixos/tests/kafka/mirrormaker.nix
+++ b/nixos/tests/kafka/mirrormaker.nix
@ -0,0 +1,240 @@
+import ../make-test-python.nix (
+  { lib, pkgs, ... }:
+
+  let
+    inherit (lib) mkMerge;
+
+    # Generate with `kafka-storage.sh random-uuid`
+    clusterAId = "ihzlrasUQ9O3Yy0ZWYkd6w";
+
+    clusterBId = "Bnu_zrzKRH6-7KcK7t3I5Q";
+
+    kafkaConfig = {
+      networking.firewall.allowedTCPPorts = [
+        9092
+        9093
+      ];
+
+      virtualisation.diskSize = 1024;
+      virtualisation.memorySize = 1024 * 2;
+
+      environment.systemPackages = [ pkgs.apacheKafka ];
+
+      services.apache-kafka = {
+        enable = true;
+
+        formatLogDirs = true;
+
+        settings = {
+          listeners = [
+            "PLAINTEXT://:9092"
+            "CONTROLLER://:9093"
+          ];
+          "listener.security.protocol.map" = [
+            "PLAINTEXT:PLAINTEXT"
+            "CONTROLLER:PLAINTEXT"
+          ];
+          "controller.listener.names" = [ "CONTROLLER" ];
+
+          "process.roles" = [
+            "broker"
+            "controller"
+          ];
+
+          "log.dirs" = [ "/var/lib/apache-kafka" ];
+          "num.partitions" = 1;
+          "offsets.topic.replication.factor" = 1;
+          "transaction.state.log.replication.factor" = 1;
+          "transaction.state.log.min.isr" = 1;
+        };
+      };
+
+      systemd.services.apache-kafka = {
+        after = [ "network-online.target" ];
+        requires = [ "network-online.target" ];
+        serviceConfig.StateDirectory = "apache-kafka";
+      };
+    };
+
+    extraKafkaConfig = {
+      kafkaa1 = {
+        services.apache-kafka = {
+          clusterId = "${clusterAId}";
+
+          settings = {
+            "node.id" = 1;
+            "controller.quorum.voters" = [ "1@kafkaa1:9093" ];
+          };
+        };
+      };
+
+      kafkab1 = {
+        services.apache-kafka = {
+          clusterId = "${clusterBId}";
+
+          settings = {
+            "node.id" = 1;
+            "controller.quorum.voters" = [ "1@kafkab1:9093" ];
+          };
+        };
+      };
+    };
+
+    kafkaNodes = builtins.mapAttrs (
+      _: val:
+      mkMerge [
+        val
+        kafkaConfig
+      ]
+    ) extraKafkaConfig;
+
+    mirrorMakerProperties = pkgs.writeText "mm2.properties" ''
+      name = A->B
+
+      clusters = A, B
+
+      A.bootstrap.servers = kafkaa1:9092
+      B.bootstrap.servers = kafkab1:9092
+
+      A->B.enabled = true
+      A->B.topics = .*
+
+      B->A.enabled = false
+      B->A.topics = .*
+
+      replication.factor=1
+      replication.policy.class=org.apache.kafka.connect.mirror.IdentityReplicationPolicy
+
+      tasks.max = 2
+      refresh.topics.enabled = true
+      refresh.topics.interval.seconds = 5
+      sync.topic.configs.enabled = true
+
+      checkpoints.topic.replication.factor=1
+      heartbeats.topic.replication.factor=1
+      offset-syncs.topic.replication.factor=1
+
+      offset.storage.replication.factor=1
+      status.storage.replication.factor=1
+      config.storage.replication.factor=1
+
+      emit.checkpoints.enabled = true
+      emit.checkpoints.interval.seconds = 5
+    '';
+  in
+  {
+    name = "kafka-mirrormaker";
+    meta = with pkgs.lib.maintainers; {
+      maintainers = [ jpds ];
+    };
+
+    nodes = {
+      inherit (kafkaNodes) kafkaa1 kafkab1;
+
+      mirrormaker =
+        { config, ... }:
+        {
+          virtualisation.diskSize = 1024;
+          virtualisation.memorySize = 1024 * 2;
+
+          # Define a mirrormaker systemd service
+          systemd.services.kafka-connect-mirror-maker = {
+            after = [ "network-online.target" ];
+            requires = [ "network-online.target" ];
+            wantedBy = [ "multi-user.target" ];
+
+            serviceConfig = {
+              ExecStart = ''
+                ${pkgs.apacheKafka}/bin/connect-mirror-maker.sh ${mirrorMakerProperties}
+              '';
+              Restart = "on-failure";
+              RestartSec = "5s";
+            };
+          };
+        };
+    };
+
+    testScript = ''
+      import json
+
+      for machine in kafkaa1, kafkab1:
+        machine.wait_for_unit("apache-kafka")
+
+      for machine in kafkaa1, kafkab1:
+        machine.wait_for_open_port(9092)
+        machine.wait_for_open_port(9093)
+
+        machine.wait_until_succeeds(
+          "journalctl -o cat -u apache-kafka.service | grep 'Transition from STARTING to STARTED'"
+        )
+
+        machine.wait_until_succeeds(
+          "journalctl -o cat -u apache-kafka.service | grep 'Kafka Server started'"
+        )
+
+      for machine in kafkaa1, kafkab1:
+        current_voters_json = machine.wait_until_succeeds(
+          f"kafka-metadata-quorum.sh --bootstrap-server {machine.name}:9092 describe --status | grep CurrentVoters"
+        ).replace("CurrentVoters:", "")
+
+        voters = json.loads(current_voters_json)
+
+        assert len(voters) == 1
+
+      mirrormaker.wait_for_unit("kafka-connect-mirror-maker")
+
+      mirrormaker.wait_until_succeeds(
+        "journalctl -o cat -u kafka-connect-mirror-maker.service | grep 'Kafka MirrorMaker initializing'"
+      )
+      mirrormaker.wait_until_succeeds(
+        "journalctl -o cat -u kafka-connect-mirror-maker.service | grep 'Targeting clusters \[A, B\]'"
+      )
+      mirrormaker.wait_until_succeeds(
+        "journalctl -o cat -u kafka-connect-mirror-maker.service | grep 'INFO \[Worker clientId=A->B, groupId=A-mm2\] Finished starting connectors and tasks'"
+      )
+
+      mirrormaker.wait_until_succeeds(
+        """
+          journalctl -o cat -u kafka-connect-mirror-maker.service | grep 'INFO \[MirrorSourceConnector\|task-0\] \[Producer clientId=A->B\|A->B-0\|offset-syncs-source-producer\] Cluster ID: ${clusterAId}'
+        """
+      )
+
+      kafkaa1.wait_until_succeeds(
+        "journalctl -o cat -u apache-kafka.service | grep 'Stabilized group B-mm2'"
+      )
+
+      kafkab1.wait_until_succeeds(
+        "journalctl -o cat -u apache-kafka.service | grep 'Stabilized group A-mm2'"
+      )
+
+      kafkaa1.wait_until_succeeds(
+        "kafka-topics.sh --bootstrap-server localhost:9092 --create --topic test-mm-1 --partitions 1 --replication-factor 1"
+      )
+
+      for machine in kafkaa1, kafkab1:
+        machine.succeed(
+          "kafka-topics.sh --bootstrap-server localhost:9092 --list | grep 'test-mm-1'"
+        )
+
+      mirrormaker.wait_until_succeeds(
+        "journalctl -o cat -u kafka-connect-mirror-maker.service | grep 'replicating [[:digit:]]\+ topic-partitions A->B: \[test-mm-1-0\]'"
+      )
+
+      mirrormaker.wait_until_succeeds(
+        "journalctl -o cat -u kafka-connect-mirror-maker.service | grep 'Found [[:digit:]]\+ new topic-partitions on A'"
+      )
+
+      kafkaa1.wait_until_succeeds(
+        "kafka-verifiable-producer.sh --bootstrap-server kafkaa1:9092 --throughput 10 --max-messages 100 --topic test-mm-1"
+      )
+
+      mirrormaker.wait_until_succeeds(
+        "journalctl -o cat -u kafka-connect-mirror-maker.service | grep 'Committing offsets for [[:digit:]]\+ acknowledged messages'"
+      )
+
+      kafkab1.wait_until_succeeds(
+        "kafka-verifiable-consumer.sh --bootstrap-server kafkab1:9092 --topic test-mm-1 --group-id testreplication --max-messages 100"
+      )
+    '';
+  }
+)
--- a/pkgs/applications/editors/emacs/elisp-packages/recipes-archive-melpa.json
+++ b/pkgs/applications/editors/emacs/elisp-packages/recipes-archive-melpa.json
@ -61884,8 +61884,8 @@
  "repo": "ushin/hyperdrive.el",
  "unstable": {
   "version": [
-    20250331,
-    427
+    20250406,
+    2225
   ],
   "deps": [
    "compat",
@ -61896,8 +61896,8 @@
    "taxy-magit-section",
    "transient"
   ],
-   "commit": "1784ae20556990d205360463f069aba319c25909",
-   "sha256": "05p9avasp7nx1wx5mvc5rj85j1n28hw1ibwag0gbxrnpxvrbqvzr"
+   "commit": "42048ef8bc7e568f9f1e1fa82c9f70b06a4d574d",
+   "sha256": "07fvdzd93836msaxpw9rk0sdrxpm29fn2zk22ln91v7s9aazjd3w"
  },
  "stable": {
   "version": [
--- a/pkgs/applications/editors/vscode/extensions/language-packs.nix
+++ b/pkgs/applications/editors/vscode/extensions/language-packs.nix
@ -13,7 +13,7 @@ let
  buildVscodeLanguagePack =
    {
      language,
-      version ? "1.98.2025031209",
+      version ? "1.99.2025040209",
      hash,
    }:
    buildVscodeMarketplaceExtension {
@ -25,7 +25,7 @@ let
      passthru.updateScript = lib.optionalAttrs (language == "fr") (
        writeShellScript "vscode-language-packs-update-script" ''
          ${lib.getExe vscode-extensions-update} vscode-extensions.ms-ceintl.vscode-language-pack-fr --override-filename "pkgs/applications/editors/vscode/extensions/language-packs.nix"
-          for lang in cs de es it ja ko pt-br qps-ploc ru tr zh-hans zh-hant; do
+          for lang in cs de es it ja ko pl pt-br qps-ploc ru tr zh-hans zh-hant; do
            ${lib.getExe nix-update} --version "skip" "vscode-extensions.ms-ceintl.vscode-language-pack-$lang" --override-filename "pkgs/applications/editors/vscode/extensions/language-packs.nix"
          done
        ''
@ -41,66 +41,71 @@ in
  # French
  vscode-language-pack-fr = buildVscodeLanguagePack {
    language = "fr";
-    hash = "sha256-ulFnHulIa1T+WdlXa000cYDY/SWGcA9W/uLZrP5l40Q=";
+    hash = "sha256-QQHaNifN6ol6dnmuLZcIv74g8gbAWJgQBX4BPNx1bgM=";
  };
  # Italian
  vscode-language-pack-it = buildVscodeLanguagePack {
    language = "it";
-    hash = "sha256-o9EwOKuFVqB1gJvCh4S5ArwQDN21a3zhLBsCpeztUhU=";
+    hash = "sha256-b8HVmF9Wf4jLpaHMK+9EuCayMLxAKyPRJpohBNTDk7I=";
  };
  # German
  vscode-language-pack-de = buildVscodeLanguagePack {
    language = "de";
-    hash = "sha256-x20EJ6YfMT59bk8o8LYDqQgyOmI1NH/Jq2zjtrUHOt8=";
+    hash = "sha256-e7slPjnns7Y3GwmYDKjvIi7eJBkrBUG6KTnUJFoz0nk=";
  };
  # Spanish
  vscode-language-pack-es = buildVscodeLanguagePack {
    language = "es";
-    hash = "sha256-MerP4/WBKj/TauDnQcWv0YCFh9JA1ce0jHiFAvt5NdI=";
+    hash = "sha256-OtxIM70wTLkgxFN6s4myLGe2fdjVG3p13tYko0MzhUc=";
  };
  # Russian
  vscode-language-pack-ru = buildVscodeLanguagePack {
    language = "ru";
-    hash = "sha256-0Z4jSiP16EDFyHwQAgvFpMh5F8tCu74hUojXH5EK66o=";
+    hash = "sha256-JLcQ2JVR7eFThgKrabQPo0Z27AigWfeHVY+lW2ZY1es=";
  };
  # Chinese (Simplified)
  vscode-language-pack-zh-hans = buildVscodeLanguagePack {
    language = "zh-hans";
-    hash = "sha256-CQtb7FJGR2JVznbEYVN76IywQopwZ6TzWjxE1as7WWE=";
+    hash = "sha256-oUb3nj67HBAavB6b0XLgwpbQO2aZ9HMF42Rdw53Z9B4=";
  };
  # Chinese (Traditional)
  vscode-language-pack-zh-hant = buildVscodeLanguagePack {
    language = "zh-hant";
-    hash = "sha256-LmBcWZlyAVvXoa5sZ4gpWBkBZD+5AKkFZqSs4zXkCwc=";
+    hash = "sha256-1ESY/7woVrPN/PITD2T0/Cm9zFKDyYcGy4x1/oBxZeE=";
  };
  # Japanese
  vscode-language-pack-ja = buildVscodeLanguagePack {
    language = "ja";
-    hash = "sha256-4tj4wTCOnC2KpHWN86EZl5KmNl2QLXb7Co1aYwRZ7uY=";
+    hash = "sha256-nHeWIcipl/nztwPkUTzetO5eGTVEaEp7oW3a31c5Obo=";
  };
  # Korean
  vscode-language-pack-ko = buildVscodeLanguagePack {
    language = "ko";
-    hash = "sha256-NmSSijvWckFiyyQBo+2Lv70YsqOYR/5kHP4iiqaQUZU=";
+    hash = "sha256-R/mbXCUsVTYhRpvCUr44jbDvYWYKqBXF4kr+TRl/MeU=";
  };
  # Czech
  vscode-language-pack-cs = buildVscodeLanguagePack {
    language = "cs";
-    hash = "sha256-Q8jSCYzl/DXasi0n228Kd7Ru0z1Bb/ovTySAYCV42pg=";
+    hash = "sha256-oVpGg7OMZ+8WrO2vGzmwF2mDwTaRGYvM1kOXEtmFvdw=";
  };
  # Portuguese (Brazil)
  vscode-language-pack-pt-br = buildVscodeLanguagePack {
    language = "pt-BR";
-    hash = "sha256-PJPeTn+0g1s+L7t9d6A/hyrBEF0EE/QKshHa3vuQZxU=";
+    hash = "sha256-cY1hGBNeTa3rul8ZtvtZW2PCLp0MZwugufdLTaI7rx0=";
  };
  # Turkish
  vscode-language-pack-tr = buildVscodeLanguagePack {
    language = "tr";
-    hash = "sha256-+M43EdHHsmw1pJopLi0nMIGwcxk6+LeVvZjkxnxUatI=";
+    hash = "sha256-DzPerwuqvHk4G5/AcrXLJh0PINd5HK+TelO9C4EOdVc=";
+  };
+  # Polish
+  vscode-language-pack-pl = buildVscodeLanguagePack {
+    language = "pl";
+    hash = "sha256-9UilVHsAWCZq6N6sqrGpnIEzjCBfalBL9LgCfEGFLvU=";
  };
  # Pseudo Language
  vscode-language-pack-qps-ploc = buildVscodeLanguagePack {
    language = "qps-ploc";
-    hash = "sha256-2ERwup1z7wGVwoGfakV0oCADxXWfWbYxlkQ6iJYgXkc=";
+    hash = "sha256-lYS+uje6eLUr7J7diq2Lkh3xjhPKWdU+ccwVQrOs75g=";
  };
 }
--- a/pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix
@ -15,8 +15,8 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
  mktplcRef = {
    name = "python";
    publisher = "ms-python";
-    version = "2025.3.2025031001";
-    hash = "sha256-uYz0WgFqbLohCEmT8ewYgvlFrVLuZr9OAiKnrbNup7U=";
+    version = "2025.4.0";
+    hash = "sha256-/yQbmZTnkks1gvMItEApRzfk8Lczjq+JC5rnyJxr6fo=";
  };

  buildInputs = [ icu ];
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@ -26,11 +26,11 @@ let

  hash =
    {
-      x86_64-linux = "sha256-qiSCrPScPtfoxVXpjapOUqzIAHlNsXwVAZNYN6CeuQo=";
-      x86_64-darwin = "sha256-2MEBSjiy4Ct4RrlbsD6ZiYO7Fb3hFcQnzZpa1WjMKXY=";
-      aarch64-linux = "sha256-wax6tTFkaGsKsOrkfcXF1yvBsVmUexNwe7Aex04HS/Q=";
-      aarch64-darwin = "sha256-ccHrhEVqxKrgQK5iP4nlOROEQWbLBRWXjXrhnkaRpMQ=";
-      armv7l-linux = "sha256-1+4/QdAi9wLtnZTwutCIpjMwBA3Zzzi4M2746mIu3gE=";
+      x86_64-linux = "sha256-yK7ORsRAWMJ8yrWROS/jSKdyCyuJ2Y+gIdZlqto+/Xo=";
+      x86_64-darwin = "sha256-d+8vt5grnLwD/cIIGgb2ogpgZrZLZs+2bqfBrRzLfJw=";
+      aarch64-linux = "sha256-D93Eh5TPRgd9OxJ4pWsOryS5mOz2amQOHOnO+K99hAg=";
+      aarch64-darwin = "sha256-xKBWAb23jUi8pI7mZpHOP2eF3PZFh0MWj+BM+alKF18=";
+      armv7l-linux = "sha256-EqJNi/qMM08voA/Ltle3/28zbgIz/Ae42IE5oXLxcKU=";
    }
    .${system} or throwSystem;

@ -41,7 +41,7 @@ callPackage ./generic.nix rec {

  # Please backport all compatible updates to the stable release.
  # This is important for the extension ecosystem.
-  version = "1.98.2.25078";
+  version = "1.99.02289";
  pname = "vscodium";

  executableName = "codium";
--- a/pkgs/applications/emulators/wine/base.nix
+++ b/pkgs/applications/emulators/wine/base.nix
@ -265,7 +265,7 @@ stdenv.mkDerivation (
            hidden="$(dirname "$prog")/.$(basename "$prog")"
            mv "$prog" "$hidden"
            makeWrapper "$hidden" "$prog" \
-              --argv0 "" \
+              --inherit-argv0 \
              --set WINELOADER "$hidden" \
              --prefix GST_PLUGIN_SYSTEM_PATH_1_0 ":" "$GST_PLUGIN_SYSTEM_PATH_1_0"
          fi
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@ -1,11 +1,11 @@
 {
-  "packageVersion": "136.0.4-1",
+  "packageVersion": "137.0-3",
  "source": {
-    "rev": "136.0.4-1",
-    "hash": "sha256-ymW9vj4CariMaswrMQRKYEvTofFRjc50gF9EmTuhsRA="
+    "rev": "137.0-3",
+    "hash": "sha256-3E8xjruyAHoOklvSt4sH6DY6cIzcOEFy8v3UhqKSpdI="
  },
  "firefox": {
-    "version": "136.0.4",
-    "hash": "sha512-wiUqpi0BXO1lNMsqwHH2gImZe0ZpAIPMHv9LrTBq5shlQ3Ge0tNfb5c790Rn1qBKukYNMJwG3qQl52xyDjROKA=="
+    "version": "137.0",
+    "hash": "sha512-gaLAzBT/wuSeSTeebCq1bPtuE7ZmZqZPOr/0SkO7Ln3BcnTTJdHCCvBi1Av/gGPXiNSy+TGnpkbbiwcgTKa0gQ=="
  }
 }
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/default.nix
@ -71,7 +71,7 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "vivaldi";
-  version = "7.1.3570.60";
+  version = "7.3.3635.4";

  suffix =
    {
@ -84,8 +84,8 @@ stdenv.mkDerivation rec {
    url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}-1_${suffix}.deb";
    hash =
      {
-        aarch64-linux = "sha256-x7CjbOrEb0+/1eqRoYTxA1RDxQeLJFmziuFcBapYaOU=";
-        x86_64-linux = "sha256-G0y49vUsFJTzxKRw1ZsXQvep7/MtGaO0FAF2nAinysw=";
+        aarch64-linux = "sha256-ddmWP1Tfim8DyP4S+Mq3khu7WU995k8p1Pqx63Z7oRQ=";
+        x86_64-linux = "sha256-sYC3dgwFhS39eOSAifWghCVcm0HliPaI0Xvf4i3KLPY=";
      }
      .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  };
--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@ -1,20 +1,20 @@
 {
  lib,
+  stdenv,
  buildGoModule,
  fetchFromGitHub,
  installShellFiles,
  testers,
-  kubernetes-helm,
 }:

-buildGoModule rec {
+buildGoModule (finalAttrs: {
  pname = "kubernetes-helm";
  version = "3.17.2";

  src = fetchFromGitHub {
    owner = "helm";
    repo = "helm";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
    sha256 = "sha256-EMvKmnf4KfimjPYHoylij2kZVnvClK3Q/+offZvlO1I=";
  };
  vendorHash = "sha256-IX4zZnu8+cb2mJxQHOmZLUVxyqfWvbsRQR3q02Wpx6c=";
@ -23,8 +23,8 @@ buildGoModule rec {
  ldflags = [
    "-w"
    "-s"
-    "-X helm.sh/helm/v3/internal/version.version=v${version}"
-    "-X helm.sh/helm/v3/internal/version.gitCommit=${src.rev}"
+    "-X helm.sh/helm/v3/internal/version.version=v${finalAttrs.version}"
+    "-X helm.sh/helm/v3/internal/version.gitCommit=${finalAttrs.src.rev}"
  ];

  preBuild = ''
@ -57,7 +57,7 @@ buildGoModule rec {
  '';

  nativeBuildInputs = [ installShellFiles ];
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
    $out/bin/helm completion bash > helm.bash
    $out/bin/helm completion zsh > helm.zsh
    $out/bin/helm completion fish > helm.fish
@ -65,9 +65,9 @@ buildGoModule rec {
  '';

  passthru.tests.version = testers.testVersion {
-    package = kubernetes-helm;
+    package = finalAttrs.finalPackage;
    command = "helm version";
-    version = "v${version}";
+    version = "v${finalAttrs.version}";
  };

  meta = with lib; {
@ -84,4 +84,4 @@ buildGoModule rec {
      techknowlogick
    ];
  };
-}
+})
--- a/pkgs/applications/networking/cluster/nixops/default.nix
+++ b/pkgs/applications/networking/cluster/nixops/default.nix
@ -1,5 +1,6 @@
 {
  lib,
+  config,
  python3,
  emptyFile,
 }:
@ -28,23 +29,28 @@ let
    };

    plugins =
-      ps: _super: with ps; rec {
-        nixops-digitalocean = callPackage ./plugins/nixops-digitalocean.nix { };
-        nixops-encrypted-links = callPackage ./plugins/nixops-encrypted-links.nix { };
-        nixops-hercules-ci = callPackage ./plugins/nixops-hercules-ci.nix { };
-        nixops-vbox = callPackage ./plugins/nixops-vbox.nix { };
-        nixos-modules-contrib = callPackage ./plugins/nixos-modules-contrib.nix { };
+      ps: _super:
+      with ps;
+      (
+        rec {
+          nixops-digitalocean = callPackage ./plugins/nixops-digitalocean.nix { };
+          nixops-encrypted-links = callPackage ./plugins/nixops-encrypted-links.nix { };
+          nixops-hercules-ci = callPackage ./plugins/nixops-hercules-ci.nix { };
+          nixops-vbox = callPackage ./plugins/nixops-vbox.nix { };
+          nixos-modules-contrib = callPackage ./plugins/nixos-modules-contrib.nix { };

-        nixops-aws = throw "nixops-aws was broken and was removed from nixpkgs";
-        nixops-gce = throw "nixops-gce was broken and was removed from nixpkgs";
-        nixops-libvirtd = throw "nixops-libvirtd was broken and was removed from nixpkgs";
-        nixops-hetzner = throw "nixops-hetzner was broken and was removed from nixpkgs";
-        nixops-hetznercloud = throw "nixops-hetznercloud was broken and was removed from nixpkgs";
-
-        # aliases for backwards compatibility
-        nixops-virtd = nixops-libvirtd;
-        nixopsvbox = nixops-vbox;
-      };
+          # aliases for backwards compatibility
+          nixopsvbox = nixops-vbox;
+        }
+        // lib.optionalAttrs config.allowAliases rec {
+          nixops-aws = throw "nixops-aws was broken and was removed from nixpkgs";
+          nixops-gce = throw "nixops-gce was broken and was removed from nixpkgs";
+          nixops-libvirtd = throw "nixops-libvirtd was broken and was removed from nixpkgs";
+          nixops-hetzner = throw "nixops-hetzner was broken and was removed from nixpkgs";
+          nixops-hetznercloud = throw "nixops-hetznercloud was broken and was removed from nixpkgs";
+          nixops-virtd = nixops-libvirtd;
+        }
+      );

    # We should not reapply the overlay, but it tends to work out. (It's been this way since poetry2nix was dropped.)
    availablePlugins = this.plugins this.python.pkgs this.python.pkgs;
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -36,13 +36,13 @@
    "vendorHash": "sha256-bviZHOxZajmx++SG6k/mkjHCa4Q7jMY7CaLUele/jgw="
  },
  "akamai": {
-    "hash": "sha256-MZF4yTG4wiFeOi4NLItQmxZ9ZcgHCryFpxpGy2jQYE8=",
+    "hash": "sha256-ivIJvWKfL9oYvLZeoErvYKuCZLEwNaZD7jFrIGPlurI=",
    "homepage": "https://registry.terraform.io/providers/akamai/akamai",
    "owner": "akamai",
    "repo": "terraform-provider-akamai",
-    "rev": "v7.0.0",
+    "rev": "v7.1.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-NO7e8S+UhbbGWeBm4+bzm6HqqA3G3WZwj3wJmug0aSA="
+    "vendorHash": "sha256-Sp65odS8Axdv5UpA5j2SXvbC/rfet4GlIawxk054Cs4="
  },
  "alicloud": {
    "hash": "sha256-Jn4VzU6aPhMv6eMmXQ5gD5SA9IZfpmkRKpTrjRGrNF8=",
@ -90,13 +90,13 @@
    "vendorHash": "sha256-YIn8akPW+DCVF0eYZxsmJxmrJuYhK4QLG/uhmmrXd4c="
  },
  "auth0": {
-    "hash": "sha256-5HiSoU3wxUtu2nsrq7h5cbqIenRMH2MpRfGJNqk8guI=",
+    "hash": "sha256-NBY9f1/VGU6VyPwy7LqgmsulLlzz17Ie8nU7JOirlFo=",
    "homepage": "https://registry.terraform.io/providers/auth0/auth0",
    "owner": "auth0",
    "repo": "terraform-provider-auth0",
-    "rev": "v1.14.0",
+    "rev": "v1.15.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-gD5HWmmy5P5yQH7UfzehDpxjB47aPfiUFDlQSY4BsVM="
+    "vendorHash": "sha256-Tfkk3+PWzlC7nZlhnD7rEYO+6OKps6pXgi+eqfmRSic="
  },
  "avi": {
    "hash": "sha256-e8yzc3nRP0ktcuuKyBXydS9NhoceYZKzJcqCWOfaPL0=",
@ -126,11 +126,11 @@
    "vendorHash": "sha256-zjb8SQ6ALQryN7wE4MKn3nhhqEvoeq8CyZd8PlkZJt4="
  },
  "azuread": {
-    "hash": "sha256-xU6fsJIWl9WNzmZIK8qAB4ih4wcgiICdfYbgnCLNA1Y=",
+    "hash": "sha256-64afLKTgJ58O9GUv3GRTJKw7xgg0cglIv3EvARsxnn0=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/azuread",
    "owner": "hashicorp",
    "repo": "terraform-provider-azuread",
-    "rev": "v3.2.0",
+    "rev": "v3.3.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -660,13 +660,13 @@
    "vendorHash": null
  },
  "incus": {
-    "hash": "sha256-ARxXTh0mGA3VNqqDKgMLBRr8wNZ4D2p75/8dMxFowWU=",
+    "hash": "sha256-zIth+M/70f/uw+CE1r3z5m36VcenCW224x64BG2gkes=",
    "homepage": "https://registry.terraform.io/providers/lxc/incus",
    "owner": "lxc",
    "repo": "terraform-provider-incus",
-    "rev": "v0.3.0",
+    "rev": "v0.3.1",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-BuVUDDwUgGo7FrgWDzhq4qkEudECoyqApftALBnQveE="
+    "vendorHash": "sha256-HcKNrvDNthxPjg3qmUoRa0Ecj0dNJ5okf5wKT5SWGhU="
  },
  "infoblox": {
    "hash": "sha256-iz/Khne3wggjkZFWZOK9DVZsB8HW6nsNBCfEbsBdhzk=",
@ -858,13 +858,13 @@
    "vendorHash": null
  },
  "newrelic": {
-    "hash": "sha256-KQqCckDXsxQrmRptttV9f7tSHBmKWE14aIppcR2dJrQ=",
+    "hash": "sha256-wh/6nkBtmZb+nwwGpk4F/YlSbmSFgCjMprnMmXslWHg=",
    "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
    "owner": "newrelic",
    "repo": "terraform-provider-newrelic",
-    "rev": "v3.59.0",
+    "rev": "v3.60.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-ZZtfVgxp7YXNRXpeUisLzweQhHzgYOuQDAp1MsxAVhg="
+    "vendorHash": "sha256-9E1I7ZgBwFo7XouQjBkQQVxQKvkwE6dhVF1hZxec+WY="
  },
  "nexus": {
    "hash": "sha256-6RPga80ZoqEEFL7I2OVXcrwaxbdhSzZDEV07xL07rZs=",
@ -1210,20 +1210,20 @@
    "vendorHash": "sha256-skswuFKhN4FFpIunbom9rM/FVRJVOFb1WwHeAIaEjn8="
  },
  "sops": {
-    "hash": "sha256-MdsWKV98kWpZpTK5qC7x6vN6cODxeeiVVc+gtlh1s88=",
+    "hash": "sha256-VuQTJFI4KcSnaog9VTV+zBg0XAORvWzuCFYMB0BM6n4=",
    "homepage": "https://registry.terraform.io/providers/carlpett/sops",
    "owner": "carlpett",
    "repo": "terraform-provider-sops",
-    "rev": "v1.1.1",
+    "rev": "v1.2.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-YFV+qXD78eajSeagJPgPu+qIktx1Vh/ZT0fUPOBuZyo="
+    "vendorHash": "sha256-K/44Jio2a1kKYuyI6o/5wwMNRaZvx9zrNEC85v56xdU="
  },
  "spacelift": {
-    "hash": "sha256-ZnUQBVsNuvr0jfuJL5h8uvrqyiahq7CoMeQ7tXU/gTc=",
+    "hash": "sha256-9TYSIIIqRSOFGbGv6mUgGyvcUb+PoMJ3IAHQFeRsSZ8=",
    "homepage": "https://registry.terraform.io/providers/spacelift-io/spacelift",
    "owner": "spacelift-io",
    "repo": "terraform-provider-spacelift",
-    "rev": "v1.20.4",
+    "rev": "v1.21.0",
    "spdx": "MIT",
    "vendorHash": "sha256-oEamCseBGmETqeBLiBHfh81oQNUHWfTrsegkFijvb20="
  },
@ -1300,13 +1300,13 @@
    "vendorHash": "sha256-iEi3zkr4kIZ1FTAft/Fy//v7xtlX/8uSrnbuxgFTDyA="
  },
  "temporalcloud": {
-    "hash": "sha256-qzBgk6FOKiaKXwpUEj61pYW/72a0EpR3GTces5IbjJw=",
+    "hash": "sha256-scM3cz4DVv66+VyLKWSjNbGFRcbUt9uZU4QooWQPioI=",
    "homepage": "https://registry.terraform.io/providers/temporalio/temporalcloud",
    "owner": "temporalio",
    "repo": "terraform-provider-temporalcloud",
-    "rev": "v0.6.1",
+    "rev": "v0.7.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-0B2XRpvUk0mgDu3inz37LLJijwH3aQyoSb8IaHr6was="
+    "vendorHash": "sha256-IKoDnClkmcCDFyt9QqWp10vZjfQpWByoUArY+hkXkVE="
  },
  "tencentcloud": {
    "hash": "sha256-DkktMcHU0T9H/jGOq66N7n1bfBF7aDEWGYmQrzWsqr8=",
--- a/pkgs/applications/networking/netmaker/default.nix
+++ b/pkgs/applications/networking/netmaker/default.nix
@ -13,16 +13,16 @@

 buildGoModule rec {
  pname = "netmaker";
-  version = "0.30.0";
+  version = "0.90.0";

  src = fetchFromGitHub {
    owner = "gravitl";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-Z2omesoEB6lJFy8ph6CFTb6XWsdgsvEG+i49dXmaC0Y=";
+    hash = "sha256-/7tj3SuTa2lSMgN4f2/OutzoPvAN7ARK1RKTLlMw13Y=";
  };

-  vendorHash = "sha256-PYkjJ17hS0E0ncsUdrGWRn+3dEwZxS1nD0UjSDQflQ8=";
+  vendorHash = "sha256-Yd9vwdIwAGinIr/RLGdb4N9hsDeMu9aB2Z1EVnlxxtA=";

  inherit subPackages;

--- a/pkgs/applications/networking/sync/backintime/common.nix
+++ b/pkgs/applications/networking/sync/backintime/common.nix
@ -32,13 +32,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "backintime-common";
-  version = "1.5.3";
+  version = "1.5.4";

  src = fetchFromGitHub {
    owner = "bit-team";
    repo = "backintime";
    rev = "v${version}";
-    sha256 = "sha256-byJyRsjZND0CQAfx45jQa3PNHhqzF2O0cFGSfN4o/QA=";
+    sha256 = "sha256-QTUezD3OdOMqrxOCrdPFI8fB5XDhNVo9XpLgi7Y2aRg=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/radio/qlog/default.nix
+++ b/pkgs/applications/radio/qlog/default.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "qlog";
-  version = "0.42.2";
+  version = "0.43.0";

  src = fetchFromGitHub {
    owner = "foldynl";
    repo = "QLog";
    rev = "v${version}";
-    hash = "sha256-DWUfP0C48JMvUashqCaDfnsn1IxzhtOzmSG5Fh+sL/w=";
+    hash = "sha256-gCXLZ00klyjisLxSvs4wKD0Sg8CFvF0xR+eHpc1D0Jc=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/video/pipe-viewer/default.nix
+++ b/pkgs/applications/video/pipe-viewer/default.nix
@ -43,13 +43,13 @@ let
 in
 buildPerlModule rec {
  pname = "pipe-viewer";
-  version = "0.5.4";
+  version = "0.5.5";

  src = fetchFromGitHub {
    owner = "trizen";
    repo = "pipe-viewer";
    rev = version;
-    hash = "sha256-xChwX6lfwLH1Rv9rnd+ONKJFQTnoPv1aX9fIv7AUDBU=";
+    hash = "sha256-NVUZn02rBhOQyIfBp/BArbL2YY19TuDTwfiQH2pEWzk=";
  };

  nativeBuildInputs = [ makeWrapper ] ++ lib.optionals withGtk3 [ wrapGAppsHook3 ];
--- a/pkgs/applications/virtualization/lima/default.nix
+++ b/pkgs/applications/virtualization/lima/default.nix
@ -14,16 +14,16 @@

 buildGoModule rec {
  pname = "lima";
-  version = "1.0.6";
+  version = "1.0.7";

  src = fetchFromGitHub {
    owner = "lima-vm";
    repo = "lima";
    rev = "v${version}";
-    hash = "sha256-3K2RC4cPoIuDePTOYzY+ejmBFZwgYDvCtoe/ZLX66sc=";
+    hash = "sha256-pwSLQlYPJNzvXuW6KLmQoaafQyf3o6fjVAfKe9RJ3UE=";
  };

-  vendorHash = "sha256-tjogQUD+F/3ALlJwpdDKdXHRcYB+n0EuJ81TB1VKKDY=";
+  vendorHash = "sha256-JxrUX22yNb5/tZIBWDiBaMLOpEnOk+2lZdpzCjjqO4E=";

  nativeBuildInputs = [
    makeWrapper
--- a/pkgs/by-name/an/ansible-doctor/package.nix
+++ b/pkgs/by-name/an/ansible-doctor/package.nix
--- a/pkgs/by-name/an/ansible-later/package.nix
+++ b/pkgs/by-name/an/ansible-later/package.nix
--- a/pkgs/by-name/an/ansible-lint/package.nix
+++ b/pkgs/by-name/an/ansible-lint/package.nix
--- a/pkgs/by-name/ap/apt/package.nix
+++ b/pkgs/by-name/ap/apt/package.nix
@ -34,14 +34,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "apt";
-  version = "2.9.33";
+  version = "2.9.35";

  src = fetchFromGitLab {
    domain = "salsa.debian.org";
    owner = "apt-team";
    repo = "apt";
    rev = finalAttrs.version;
-    hash = "sha256-CniUdpQWUyS0GMRLmdA4zX0iF3geT5dglBfJy1li9O0=";
+    hash = "sha256-B4rFOt4J94/XkFw09sdvfogdY1b5R6QYnNC3HVUV9pc=";
  };

  # cycle detection; lib can't be split
--- a/pkgs/by-name/az/azahar/package.nix
+++ b/pkgs/by-name/az/azahar/package.nix
@ -43,6 +43,7 @@
  cubeb,
  useDiscordRichPresence ? true,
  rapidjson,
+  azahar,
 }:
 let
  inherit (lib)
@ -150,6 +151,7 @@ stdenv.mkDerivation (finalAttrs: {
    (cmakeBool "ENABLE_QT" enableQt)
    (cmakeBool "ENABLE_QT_TRANSLATION" enableQtTranslations)
    (cmakeBool "ENABLE_SDL2" enableSDL2)
+    (cmakeBool "ENABLE_SDL2_FRONTEND" enableSDL2)
    (cmakeBool "ENABLE_CUBEB" enableCubeb)
    (cmakeBool "USE_DISCORD_PRESENCE" useDiscordRichPresence)
  ];
--- a/pkgs/by-name/ca/cargo-deny/package.nix
+++ b/pkgs/by-name/ca/cargo-deny/package.nix
@ -43,7 +43,7 @@ rustPlatform.buildRustPackage rec {
  doCheck = false;

  meta = with lib; {
-    description = "Cargo plugin to generate list of all licenses for a crate";
+    description = "Cargo plugin for linting your dependencies";
    mainProgram = "cargo-deny";
    homepage = "https://github.com/EmbarkStudios/cargo-deny";
    changelog = "https://github.com/EmbarkStudios/cargo-deny/blob/${version}/CHANGELOG.md";
--- a/pkgs/by-name/co/cockpit/package.nix
+++ b/pkgs/by-name/co/cockpit/package.nix
@ -37,13 +37,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cockpit";
-  version = "331";
+  version = "336.2";

  src = fetchFromGitHub {
    owner = "cockpit-project";
    repo = "cockpit";
    tag = finalAttrs.version;
-    hash = "sha256-G0L1ZcvjUCSNkDvYoyConymZ4bsEye03t5K15EyI008=";
+    hash = "sha256-QRtKxrOIGZuAj+NrnXDpnejJQ/lm0hP/JqZyVZn/VL0=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/co/converseen/package.nix
+++ b/pkgs/by-name/co/converseen/package.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "converseen";
-  version = "0.12.2.5";
+  version = "0.13.0.1";

  src = fetchFromGitHub {
    owner = "Faster3ck";
    repo = "Converseen";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Q1MmKPzk7erMM5Z5zYP3hGyazupfPjArkmFOFEhxWg4=";
+    hash = "sha256-EFeOBk/KK7CaX+Da5PxIWsImw8Sgjlvcl29QKO71V+Y=";
  };

  strictDeps = true;
--- a/pkgs/by-name/co/cosmic-comp/package.nix
+++ b/pkgs/by-name/co/cosmic-comp/package.nix
@ -12,10 +12,8 @@
  seatd,
  udev,
  systemd,
-  xwayland,
  nix-update-script,

-  useXWayland ? true,
  useSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
 }:

@ -59,10 +57,6 @@ rustPlatform.buildRustPackage (finalAttrs: {

  dontCargoInstall = true;

-  preFixup = lib.optionalString useXWayland ''
-    libcosmicAppWrapperArgs+=(--prefix PATH : ${lib.makeBinPath [ xwayland ]})
-  '';
-
  passthru.updateScript = nix-update-script {
    extraArgs = [
      "--version"
--- a/pkgs/by-name/cp/cppad/package.nix
+++ b/pkgs/by-name/cp/cppad/package.nix
@ -13,7 +13,7 @@ stdenv.mkDerivation (finalAttrs: {
  src = fetchFromGitHub {
    owner = "coin-or";
    repo = "CppAD";
-    tag = "${finalAttrs.version}";
+    tag = finalAttrs.version;
    hash = "sha256-rAKD/PAjepDchvrJp7iLYw5doNq8Af1oVh61gfMcNYI=";
  };

--- a/pkgs/by-name/cr/cryptomator/package.nix
+++ b/pkgs/by-name/cr/cryptomator/package.nix
@ -17,18 +17,18 @@ let
 in
 maven.buildMavenPackage rec {
  pname = "cryptomator";
-  version = "1.15.1";
+  version = "1.15.2";

  src = fetchFromGitHub {
    owner = "cryptomator";
    repo = "cryptomator";
    tag = version;
-    hash = "sha256-yNCVSaA2GtTFUYoN7IZxEYMxkkQwMiNnfnmSXaruFjM=";
+    hash = "sha256-uhsX4VIA8NNUjxa0dHyB5bhWMxjd2LJfcKJInxROQRY=";
  };

  mvnJdk = jdk;
  mvnParameters = "-Dmaven.test.skip=true -Plinux";
-  mvnHash = "sha256-w0mIeSFRSGl3EorrGcxqnXF6C0SowjWUMYT/NN1erwM=";
+  mvnHash = "sha256-KfQdYsPdmQRQqjx/kpDQR9tYjb54goA31w55x6VX6KM=";

  preBuild = ''
    VERSION=${version}
--- a/pkgs/by-name/dn/dnscrypt-proxy/package.nix
+++ b/pkgs/by-name/dn/dnscrypt-proxy/package.nix
@ -7,7 +7,7 @@

 buildGoModule rec {
  pname = "dnscrypt-proxy";
-  version = "2.1.7";
+  version = "2.1.8";

  vendorHash = null;

@ -17,7 +17,7 @@ buildGoModule rec {
    owner = "DNSCrypt";
    repo = "dnscrypt-proxy";
    rev = version;
-    sha256 = "sha256-s0ooICual87+y/DMppuTQtNzZRRCg/42SQImDrPVRng=";
+    sha256 = "sha256-/D5RE8AbI9i9TVdFQCYW8OLPU4TgIIDRsZfWEyXo92g=";
  };

  passthru.tests = { inherit (nixosTests) dnscrypt-proxy2; };
--- a/pkgs/by-name/do/dolibarr/package.nix
+++ b/pkgs/by-name/do/dolibarr/package.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "dolibarr";
-  version = "21.0.0";
+  version = "21.0.1";

  src = fetchFromGitHub {
    owner = "Dolibarr";
    repo = "dolibarr";
    tag = finalAttrs.version;
-    hash = "sha256-OTYX9CZ1gQlAOsrWIMJwhH8QPDM2J3MM183/Tj18jHg=";
+    hash = "sha256-aOFqfXsT1kmQwIB8clLMQaMeZtsyIYCxCGqaGCjlBRY=";
  };

  dontBuild = true;
--- a/pkgs/by-name/do/dozenal/lua-header.patch
+++ b/pkgs/by-name/do/dozenal/lua-header.patch
@ -1,16 +0,0 @@
-diff -ruN dozenal-12010904/dozenal/dozcal/call_lua.c dozenal-patched/dozenal/dozcal/call_lua.c
--- dozenal-12010904/dozenal/dozcal/call_lua.c	2017-09-04 19:25:01.000000000 +0200
-+++ dozenal-patched/dozenal/dozcal/call_lua.c	2018-06-13 10:19:57.821950327 +0200
-@@ -38,9 +38,9 @@
- #include"utility.h"
- #include"conv.h"
- #include"proc_date.h"
-#include<lua5.2/lua.h>
-#include<lua5.2/lauxlib.h>
-#include<lua5.2/lualib.h>
-+#include<lua.h>
-+#include<lauxlib.h>
-+#include<lualib.h>
- 
- void bail(lua_State *L, int err_code, char *filename);
- int file_prefix(char **s, char *t);
--- a/pkgs/by-name/do/dozenal/package.nix
+++ b/pkgs/by-name/do/dozenal/package.nix
@ -1,80 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  ncurses,
-  hdate,
-  lua5_2,
-}:
-
-stdenv.mkDerivation rec {
-  version = "12010904";
-  pname = "dozenal";
-  src = fetchFromGitHub {
-    owner = "dgoodmaniii";
-    repo = "dozenal";
-    rev = "v${version}";
-    sha256 = "1ic63gpdda762x6ks3al71dwgmsy2isicqyr2935bd245jx8s209";
-  };
-  makeFlags = [
-    # author do not use configure and prefix directly using $prefix
-    "prefix=$(out)"
-    # graphical version of dozdc requires xforms, which is not i nixpkgs so I turned it down
-    "XFORMS_FLAGS=-UXFORMS"
-    "LUALIB=-llua"
-    "bindir=$(prefix)/bin/"
-  ];
-  # some include hardcodes the lua libraries path. This is a patch for that
-  patches = [ ./lua-header.patch ];
-  preBuild = "cd dozenal";
-  buildInputs = [
-    ncurses
-    hdate
-    lua5_2
-  ];
-
-  # Parallel builds fail due to no dependencies between subdirs.
-  # As a result some subdirs are atempted to build twice:
-  #   ../dec/dec.c:39:10: fatal error: conv.h: No such file or directory
-  # Let's disable parallelism until it's fixed upstream:
-  #  https://gitlab.com/dgoodmaniii/dozenal/-/issues/8
-  enableParallelBuilding = false;
-
-  # I remove gdozdc, as I didn't figure all it's dependency yet.
-  postInstall = "rm $out/bin/gdozdc";
-
-  meta = {
-    description = "Complete suite of dozenal (base twelve) programs";
-    longDescription = ''
-      Programs
-
-      doz --- a converter; converts decimal numbers into dozenal. Accepts
-         input in standard or exponential notation (i.e., "1492.2" or "1.4922e3").
-      dec --- a converter; converts dozenal numbers into decimal. Accepts input
-         in standard or exponential notation (i.e., "X44;4" or "X;444e2").
-      dozword --- converts a dozenal number (integers only) into words,
-         according to the Pendlebury system.
-      dozdc --- a full-featured scientific calculator which works in the
-         dozenal base. RPN command line.
-      tgmconv --- a converter for all standard measurements; converts to and
-         from TGM, Imperial, customary, and SI metric.
-      dozpret --- a pretty-printer for dozenal numbers; inserts spacing (or
-         other characters) as desired, and can also transform transdecimal digits
-         from 'X' to 'E' into any character or sequence of characters desired.
-      dozdate --- a more-or-less drop-in replacement for GNU and BSD date, it
-         outputs the date and time in dozenal, as well as containing some TGM
-         extensions.
-      dozstring --- a simple byte converter; absorbs a string either from
-         standard input or a command line argument, leaving it identical but
-         for the numbers, which it converts into dozenal. Options for padding
-         and for not converting specific numbers.
-      doman --- a converter which takes a dozenal integer and
-         emits its equivalent in a non-place-value system, such as
-         Roman numerals.  Arbitrary ranks and symbols may be used.
-         Defaults to dozenal Roman numerals.
-    '';
-    homepage = "https://github.com/dgoodmaniii/dozenal/";
-    maintainers = with lib.maintainers; [ CharlesHD ];
-    license = lib.licenses.gpl3;
-  };
-}
--- a/pkgs/by-name/ek/eksctl/package.nix
+++ b/pkgs/by-name/ek/eksctl/package.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "eksctl";
-  version = "0.206.0";
+  version = "0.207.0";

  src = fetchFromGitHub {
    owner = "weaveworks";
    repo = pname;
    rev = version;
-    hash = "sha256-wJl3PhrTbjgrI5aRNmqHkPr43SYw0m5nLWPtVqazlfg=";
+    hash = "sha256-USWeMzJ1k+sJx2p3FzFhbO48m61WUuCvp7Juwa9jtus=";
  };

-  vendorHash = "sha256-Ipj4Ss9x7HnAAweoQlWsmOUhU+toGyR4aGTRhIHHw/0=";
+  vendorHash = "sha256-TEw5ts51M/nvcljqrCHIkTGk64dhhEamhkP/qS/y1uo=";

  doCheck = false;

--- a/pkgs/by-name/es/espup/package.nix
+++ b/pkgs/by-name/es/espup/package.nix
@ -12,6 +12,7 @@
  darwin,
  testers,
  espup,
+  gitUpdater,
 }:

 rustPlatform.buildRustPackage rec {
@ -67,6 +68,7 @@ rustPlatform.buildRustPackage rec {
      --zsh <($out/bin/espup completions zsh)
  '';

+  passthru.updateScript = gitUpdater { };
  passthru.tests.version = testers.testVersion {
    package = espup;
  };
--- a/pkgs/by-name/ez/eza/package.nix
+++ b/pkgs/by-name/ez/eza/package.nix
@ -13,14 +13,14 @@
  exaAlias ? true,
 }:

-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
  pname = "eza";
  version = "0.21.0";

  src = fetchFromGitHub {
    owner = "eza-community";
    repo = "eza";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-edBFMqY+61kFumLTcVFgnmhE4d+bMVz+udR5h02kDk0=";
  };

@ -46,7 +46,7 @@ rustPlatform.buildRustPackage rec {
  postInstall =
    ''
      for page in eza.1 eza_colors.5 eza_colors-explanation.5; do
-        sed "s/\$version/v${version}/g" "man/$page.md" |
+        sed "s/\$version/v${finalAttrs.version}/g" "man/$page.md" |
          pandoc --standalone -f markdown -t man >"man/$page"
      done
      installManPage man/eza.1 man/eza_colors.5 man/eza_colors-explanation.5
@ -59,7 +59,7 @@ rustPlatform.buildRustPackage rec {
      ln -s eza $out/bin/exa
    '';

-  meta = with lib; {
+  meta = {
    description = "Modern, maintained replacement for ls";
    longDescription = ''
      eza is a modern replacement for ls. It uses colours for information by
@ -70,14 +70,14 @@ rustPlatform.buildRustPackage rec {
      written in Rust, so it’s small, fast, and portable.
    '';
    homepage = "https://github.com/eza-community/eza";
-    changelog = "https://github.com/eza-community/eza/releases/tag/v${version}";
-    license = licenses.eupl12;
+    changelog = "https://github.com/eza-community/eza/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.eupl12;
    mainProgram = "eza";
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
      cafkafk
      _9glenda
      sigmasquadron
    ];
-    platforms = platforms.unix ++ platforms.windows;
+    platforms = with lib.platforms; unix ++ windows;
  };
-}
+})
--- a/pkgs/by-name/fe/fex/package.nix
+++ b/pkgs/by-name/fe/fex/package.nix
@ -8,6 +8,9 @@
  qt5,
  python3,
  nix-update-script,
+  xxHash,
+  fmt,
+  nasm,
 }:

 llvmPackages.stdenv.mkDerivation (finalAttrs: {
@ -18,8 +21,32 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
    owner = "FEX-Emu";
    repo = "FEX";
    tag = "FEX-${finalAttrs.version}";
-    hash = "sha256-tqUJBHYSRlEUaLI4WItzotIHGMUNbdjA7o9NjBYZmHw=";
-    fetchSubmodules = true;
+
+    hash = "sha256-oXducy4uvf/3Ox6AadPWNl9450D9TiPIr53P91/qEvw=";
+
+    leaveDotGit = true;
+    postFetch = ''
+      cd $out
+      git reset
+
+      # Only fetch required submodules
+      git submodule update --init --depth 1 \
+        External/Vulkan-Headers \
+        External/drm-headers \
+        External/jemalloc \
+        External/jemalloc_glibc \
+        External/robin-map \
+        External/vixl \
+        Source/Common/cpp-optparse \
+        External/Catch2
+
+      find . -name .git -print0 | xargs -0 rm -rf
+
+      # Remove some more unnecessary directories
+      rm -r \
+        External/vixl/src/aarch32 \
+        External/vixl/test
+    '';
  };

  nativeBuildInputs = [
@ -37,12 +64,19 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
    ))
  ];

-  buildInputs = with qt5; [
-    qtbase
-    qtdeclarative
-    qtquickcontrols
-    qtquickcontrols2
-  ];
+  nativeCheckInputs = [ nasm ];
+
+  buildInputs =
+    [
+      xxHash
+      fmt
+    ]
+    ++ (with qt5; [
+      qtbase
+      qtdeclarative
+      qtquickcontrols
+      qtquickcontrols2
+    ]);

  cmakeFlags = [
    (lib.cmakeFeature "CMAKE_BUILD_TYPE" "Release")
@ -54,7 +88,18 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
  ];

  strictDeps = true;
-  doCheck = false; # broken on Apple silicon computers
+
+  # Unsupported on non-4K page size kernels (e.g. Apple Silicon)
+  doCheck = true;
+
+  # List not exhaustive, e.g. because they depend on an x86 compiler or some
+  # other difficult-to-build test binaries.
+  checkTarget = lib.concatStringsSep " " [
+    "asm_tests"
+    "api_tests"
+    "fexcore_apitests"
+    "emitter_tests"
+  ];

  # Avoid wrapping anything other than FEXConfig, since the wrapped executables
  # don't seem to work when registered as binfmts.
--- a/pkgs/by-name/fi/figlet/package.nix
+++ b/pkgs/by-name/fi/figlet/package.nix
@ -5,15 +5,14 @@
  fetchpatch,
  fetchzip,
 }:
-
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "figlet";
  version = "2.2.5";

  # some tools can be found here ftp://ftp.figlet.org/pub/figlet/util/
  src = fetchurl {
-    url = "ftp://ftp.figlet.org/pub/figlet/program/unix/figlet-${version}.tar.gz";
-    sha256 = "0za1ax15x7myjl8jz271ybly8ln9kb9zhm1gf6rdlxzhs07w925z";
+    url = "ftp://ftp.figlet.org/pub/figlet/program/unix/figlet-${finalAttrs.version}.tar.gz";
+    sha256 = "sha256-v4jED9Dwd9qycS9U+NOayVLk6fLhiC8Rlb6eXkJXQX0=";
  };

  contributed = fetchzip {
@ -25,12 +24,12 @@ stdenv.mkDerivation rec {
    (fetchpatch {
      url = "https://git.alpinelinux.org/aports/plain/main/figlet/musl-fix-cplusplus-decls.patch?h=3.4-stable&id=71776c73a6f04b6f671430f702bcd40b29d48399";
      name = "musl-fix-cplusplus-decls.patch";
-      sha256 = "1720zgrfk9makznqkbjrnlxm7nnhk6zx7g458fv53337n3g3zn7j";
+      sha256 = "sha256-8tg/3rBnjFG2Q4W807+Z0NpTO7VZrontn6qm6fL7QJw=";
    })
    (fetchpatch {
      url = "https://github.com/cmatsuoka/figlet/commit/9a50c1795bc32e5a698b855131ee87c8d7762c9e.patch";
      name = "unistd-on-darwin.patch";
-      sha256 = "hyfY87N+yuAwjsBIjpgvcdJ1IbzlR4A2yUJQSzShCRI=";
+      sha256 = "sha256-hyfY87N+yuAwjsBIjpgvcdJ1IbzlR4A2yUJQSzShCRI=";
    })
  ];

@ -40,7 +39,7 @@ stdenv.mkDerivation rec {
    "LD:=$(CC)"
  ];

-  postInstall = "cp -ar ${contributed}/* $out/share/figlet/";
+  postInstall = "cp -ar ${finalAttrs.contributed}/* $out/share/figlet/";

  doCheck = true;

@ -50,5 +49,6 @@ stdenv.mkDerivation rec {
    license = lib.licenses.afl21;
    maintainers = with lib.maintainers; [ ehmry ];
    platforms = lib.platforms.unix;
+    mainProgram = "figlet";
  };
-}
+})
--- a/pkgs/by-name/fi/firebase-tools/package.nix
+++ b/pkgs/by-name/fi/firebase-tools/package.nix
@ -9,16 +9,16 @@
 }:
 buildNpmPackage rec {
  pname = "firebase-tools";
-  version = "13.35.1";
+  version = "14.1.0";

  src = fetchFromGitHub {
    owner = "firebase";
    repo = "firebase-tools";
    tag = "v${version}";
-    hash = "sha256-66VG82o+gg+Vt4QR/RkaM6aOv8i3lQ7bUmeqGqj1JGs=";
+    hash = "sha256-7yxDBK3A2Yosp/83JmFpV3cm+YEDxHMLVj5B+rwSIR8=";
  };

-  npmDepsHash = "sha256-/UuQ1bwEFDPahxUgqrxY/xIcHQ+KKxnc2QUMOW+GwHE=";
+  npmDepsHash = "sha256-r6vonG5edL/nTtyj8uXc/4w2xgihRce/Md+umxomTzo=";

  postPatch = ''
    ln -s npm-shrinkwrap.json package-lock.json
--- a/pkgs/by-name/fz/fzf/package.nix
+++ b/pkgs/by-name/fz/fzf/package.nix
@ -12,13 +12,13 @@

 buildGoModule rec {
  pname = "fzf";
-  version = "0.61.0";
+  version = "0.61.1";

  src = fetchFromGitHub {
    owner = "junegunn";
    repo = "fzf";
    rev = "v${version}";
-    hash = "sha256-pqHfHWv8PoaMxEP90AbVM2u88D6VE3px+lxJfoZfMgk=";
+    hash = "sha256-PKfVG2eYsg3J1OixDzXsmxCtsuFhdEGyxuYtwPEdVi8=";
  };

  vendorHash = "sha256-WcrJfvY3GZLDuRr2PZR1ooNPJ6FQ4S3RvUc2+zePw5w=";
--- a/pkgs/by-name/gc/gclient2nix/gclient-unpack-hook.sh
+++ b/pkgs/by-name/gc/gclient2nix/gclient-unpack-hook.sh
@ -0,0 +1,28 @@
+# shellcheck shell=bash
+
+gclientUnpackHook() {
+    echo "Executing gclientUnpackHook"
+
+    runHook preUnpack
+
+    if [ -z "${gclientDeps-}" ]; then
+        echo "gclientDeps missing"
+        exit 1
+    fi
+
+    for dep in $(@jq@ -c "to_entries[]" "$gclientDeps")
+    do
+        local name="$(echo "$dep" | @jq@ -r .key)"
+        echo "copying $name..."
+        local path="$(echo "$dep" | @jq@ -r .value.path)"
+        mkdir -p $(dirname "$name")
+        cp -r "$path/." "$name"
+        chmod u+w -R "$name"
+    done
+
+    runHook postUnpack
+}
+
+if [ -z "${dontGclientUnpack-}" ] && [ -z "${unpackPhase-}" ]; then
+  unpackPhase=(gclientUnpackHook)
+fi
--- a/pkgs/by-name/gc/gclient2nix/gclient2nix.py
+++ b/pkgs/by-name/gc/gclient2nix/gclient2nix.py
@ -0,0 +1,232 @@
+#!/usr/bin/env python3
+import base64
+import json
+import os
+import subprocess
+import re
+import random
+import sys
+import tempfile
+import logging
+import click
+import click_log
+from typing import Optional
+from urllib.request import urlopen
+from joblib import Parallel, delayed, Memory
+from platformdirs import user_cache_dir
+
+sys.path.append("@depot_tools_checkout@")
+import gclient_eval
+import gclient_utils
+
+
+logger = logging.getLogger(__name__)
+click_log.basic_config(logger)
+
+nixpkgs_path = "@nixpkgs_path@"
+
+memory: Memory = Memory(user_cache_dir("gclient2nix"), verbose=0)
+
+def cache(mem, **mem_kwargs):
+    def cache_(f):
+        f.__module__ = "gclient2nix"
+        f.__qualname__ = f.__name__
+        return mem.cache(f, **mem_kwargs)
+    return cache_
+
+@cache(memory)
+def get_repo_hash(fetcher: str, args: dict) -> str:
+    expr = f"(import {nixpkgs_path} {{}}).gclient2nix.fetchers.{fetcher}{{"
+    for key, val in args.items():
+        expr += f'{key}="{val}";'
+    expr += "}"
+    cmd = ["nurl", "-H", "--expr", expr]
+    print(" ".join(cmd), file=sys.stderr)
+    out = subprocess.check_output(cmd)
+    return out.decode("utf-8").strip()
+
+
+class Repo:
+    fetcher: str
+    args: dict
+
+    def __init__(self) -> None:
+        self.deps: dict = {}
+
+    def get_deps(self, repo_vars: dict, path: str) -> None:
+        print(
+            "evaluating " + json.dumps(self, default=vars, sort_keys=True),
+            file=sys.stderr,
+        )
+
+        deps_file = self.get_file("DEPS")
+        evaluated = gclient_eval.Parse(deps_file, vars_override=repo_vars, filename="DEPS")
+
+        repo_vars = dict(evaluated.get("vars", {})) | repo_vars
+
+        prefix = f"{path}/" if evaluated.get("use_relative_paths", False) else ""
+
+        self.deps = {
+            prefix + dep_name: repo_from_dep(dep)
+            for dep_name, dep in evaluated.get("deps", {}).items()
+            if (
+                gclient_eval.EvaluateCondition(dep["condition"], repo_vars)
+                if "condition" in dep
+                else True
+            )
+            and repo_from_dep(dep) != None
+        }
+
+        for key in evaluated.get("recursedeps", []):
+            dep_path = prefix + key
+            if dep_path in self.deps:
+                self.deps[dep_path].get_deps(repo_vars, dep_path)
+
+    def eval(self) -> None:
+        self.get_deps(
+            {
+                **{
+                f"checkout_{platform}": platform == "linux"
+                for platform in ["ios", "chromeos", "android", "mac", "win", "linux"]
+                },
+                **{
+                f"checkout_{arch}": True
+                for arch in ["x64", "arm64", "arm", "x86", "mips", "mips64", "ppc"]
+                },
+            },
+            "",
+        )
+
+    def prefetch(self) -> None:
+        self.hash = get_repo_hash(self.fetcher, self.args)
+
+    def prefetch_all(self) -> int:
+        return sum(
+            [dep.prefetch_all() for [_, dep] in self.deps.items()],
+            [delayed(self.prefetch)()],
+        )
+
+    def flatten_repr(self) -> dict:
+        return {"fetcher": self.fetcher, "attrs": {**({"hash": self.hash} if hasattr(self, "hash") else {}), **self.args}}
+
+    def flatten(self, path: str) -> dict:
+        out = {path: self.flatten_repr()}
+        for dep_path, dep in self.deps.items():
+            out |= dep.flatten(dep_path)
+        return out
+
+    def get_file(self, filepath: str) -> str:
+        raise NotImplementedError
+
+
+class GitRepo(Repo):
+    def __init__(self, url: str, rev: str) -> None:
+        super().__init__()
+        self.fetcher = "fetchgit"
+        self.args = {
+            "url": url,
+            "rev": rev,
+        }
+
+
+class GitHubRepo(Repo):
+    def __init__(self, owner: str, repo: str, rev: str) -> None:
+        super().__init__()
+        self.fetcher = "fetchFromGitHub"
+        self.args = {
+            "owner": owner,
+            "repo": repo,
+            "rev": rev,
+        }
+
+    def get_file(self, filepath: str) -> str:
+        return (
+            urlopen(
+                f"https://raw.githubusercontent.com/{self.args['owner']}/{self.args['repo']}/{self.args['rev']}/{filepath}"
+            )
+            .read()
+            .decode("utf-8")
+        )
+
+
+class GitilesRepo(Repo):
+    def __init__(self, url: str, rev: str) -> None:
+        super().__init__()
+        self.fetcher = "fetchFromGitiles"
+        self.args = {
+            "url": url,
+            "rev": rev,
+        }
+
+        # Quirk: Chromium source code exceeds the Hydra output limit
+        # We prefer deleting test data over recompressing the sources into a
+        # tarball, because the NAR will be compressed after the size check
+        # anyways, so recompressing is more like bypassing the size limit
+        # (making it count the compressed instead of uncompressed size)
+        # rather than complying with it.
+        if url == "https://chromium.googlesource.com/chromium/src.git":
+            self.args["postFetch"] = "rm -r $out/third_party/blink/web_tests; "
+            self.args["postFetch"] += "rm -r $out/content/test/data; "
+            self.args["postFetch"] += "rm -rf $out/courgette/testdata; "
+            self.args["postFetch"] += "rm -r $out/extensions/test/data; "
+            self.args["postFetch"] += "rm -r $out/media/test/data; "
+
+    def get_file(self, filepath: str) -> str:
+        return base64.b64decode(
+            urlopen(
+                f"{self.args['url']}/+/{self.args['rev']}/{filepath}?format=TEXT"
+            ).read()
+        ).decode("utf-8")
+
+
+
+def repo_from_dep(dep: dict) -> Optional[Repo]:
+    if "url" in dep:
+        url, rev = gclient_utils.SplitUrlRevision(dep["url"])
+
+        search_object = re.search(r"https://github.com/(.+)/(.+?)(\.git)?$", url)
+        if search_object:
+            return GitHubRepo(search_object.group(1), search_object.group(2), rev)
+
+        if re.match(r"https://.+\.googlesource.com", url):
+            return GitilesRepo(url, rev)
+
+        return GitRepo(url, rev)
+    else:
+        # Not a git dependency; skip
+        return None
+
+
+@click.group()
+def cli() -> None:
+    """gclient2nix"""
+    pass
+
+
+@cli.command("eval", help="Evaluate and print the dependency tree of a gclient project")
+@click.argument("url", required=True, type=str)
+@click.option("--root", default="src", help="Root path, where the given url is placed", type=str)
+def eval(url: str, root: str) -> None:
+    repo = repo_from_dep({"url": url})
+    repo.eval()
+    print(json.dumps(repo.flatten(root), sort_keys=True, indent=4))
+
+
+@cli.command("generate", help="Generate a dependencies description for a gclient project")
+@click.argument("url", required=True, type=str)
+@click.option("--root", default="src", help="Root path, where the given url is placed", type=str)
+def generate(url: str, root: str) -> None:
+    repo = repo_from_dep({"url": url})
+    repo.eval()
+    tasks = repo.prefetch_all()
+    random.shuffle(tasks)
+    task_results = {
+        n[0]: n[1]
+        for n in Parallel(n_jobs=20, require="sharedmem", return_as="generator")(tasks)
+        if n != None
+    }
+    print(json.dumps(repo.flatten(root), sort_keys=True, indent=4))
+
+
+if __name__ == "__main__":
+    cli()
--- a/pkgs/by-name/gc/gclient2nix/package.nix
+++ b/pkgs/by-name/gc/gclient2nix/package.nix
@ -0,0 +1,86 @@
+{
+  lib,
+  python3,
+  runCommand,
+  makeWrapper,
+  path,
+  fetchgit,
+  nurl,
+  writers,
+  callPackage,
+  fetchFromGitiles,
+  fetchFromGitHub,
+}:
+
+let
+  fetchers = {
+    inherit fetchgit fetchFromGitiles fetchFromGitHub;
+  };
+
+  importGclientDeps =
+    depsAttrsOrFile:
+    let
+      depsAttrs = if lib.isAttrs depsAttrsOrFile then depsAttrsOrFile else lib.importJSON depsAttrsOrFile;
+      fetchdep = dep: fetchers.${dep.fetcher} dep.args;
+      fetchedDeps = lib.mapAttrs (_name: fetchdep) depsAttrs;
+      manifestContents = lib.mapAttrs (_: dep: {
+        path = dep;
+      }) fetchedDeps;
+      manifest = writers.writeJSON "gclient-manifest.json" manifestContents;
+    in
+    manifestContents
+    // {
+      inherit manifest;
+      __toString = _: manifest;
+    };
+
+  gclientUnpackHook = callPackage (
+    {
+      lib,
+      makeSetupHook,
+      jq,
+    }:
+
+    makeSetupHook {
+      name = "gclient-unpack-hook";
+      substitutions = {
+        jq = lib.getExe jq;
+      };
+    } ./gclient-unpack-hook.sh
+  ) { };
+
+  python = python3.withPackages (
+    ps: with ps; [
+      joblib
+      platformdirs
+      click
+      click-log
+    ]
+  );
+
+in
+
+runCommand "gclient2nix"
+  {
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ python ];
+
+    # substitutions
+    nixpkgs_path = if builtins.pathExists (path + "/.git") then lib.cleanSource path else path;
+    depot_tools_checkout = fetchgit {
+      url = "https://chromium.googlesource.com/chromium/tools/depot_tools";
+      rev = "452fe3be37f78fbecefa1b4b0d359531bcd70d0d";
+      hash = "sha256-8IiJOm0FLa/u1Vd96tb33Ruj4IUTCeYgBpTk88znhPw=";
+    };
+
+    passthru = {
+      inherit fetchers importGclientDeps gclientUnpackHook;
+    };
+  }
+  ''
+    mkdir -p $out/bin
+    substituteAll ${./gclient2nix.py} $out/bin/gclient2nix
+    chmod u+x $out/bin/gclient2nix
+    patchShebangs $out/bin/gclient2nix
+    wrapProgram $out/bin/gclient2nix --set PATH "${lib.makeBinPath [ nurl ]}"
+  ''
--- a/pkgs/by-name/ge/gemmi/package.nix
+++ b/pkgs/by-name/ge/gemmi/package.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gemmi";
-  version = "0.7.0";
+  version = "0.7.1";

  src = fetchFromGitHub {
    owner = "project-gemmi";
    repo = "gemmi";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-XOu//yY5CnnzjvGu7IIC5GvecYsnZQV3Y2wvGVTwWzU=";
+    hash = "sha256-1msV/gW6BH90rHm6t7xm0hYqbG/yGBt65GVTbKuwdtg=";
  };

  nativeBuildInputs =
--- a/pkgs/by-name/gi/gitoxide/package.nix
+++ b/pkgs/by-name/gi/gitoxide/package.nix
@ -31,6 +31,8 @@ rustPlatform.buildRustPackage rec {
  cargoHash = "sha256-q35MQGN/tvsK7gg0a/ljoVY6wedy7rwKlSakONgBIgk=";

  patches = [
+    # TODO: remove after next update
+    # https://github.com/GitoxideLabs/gitoxide/pull/1929
    ./fix-cargo-dependencies.patch
  ];

--- a/pkgs/by-name/go/go-ecoflow-exporter/package.nix
+++ b/pkgs/by-name/go/go-ecoflow-exporter/package.nix
@ -12,7 +12,7 @@ buildGoModule (finalAttrs: {
  src = fetchFromGitHub {
    owner = "tess1o";
    repo = "go-ecoflow-exporter";
-    tag = "${finalAttrs.version}";
+    tag = finalAttrs.version;
    hash = "sha256-VCzMItYgnuDXDYdrk/ojzqUE2Fjr7KWGNnLhoQ+ZPYs=";
  };

--- a/pkgs/by-name/gr/graphite-cli/package-lock.json
+++ b/pkgs/by-name/gr/graphite-cli/package-lock.json
@ -1,19 +1,16 @@
 {
  "name": "@withgraphite/graphite-cli",
-  "version": "1.5.3",
+  "version": "1.6.1",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@withgraphite/graphite-cli",
-      "version": "1.5.3",
+      "version": "1.6.1",
      "hasInstallScript": true,
      "license": "None",
      "dependencies": {
-        "chalk": "^4.1.2",
-        "semver": "^7.5.4",
-        "ws": "^8.6.0",
-        "yargs": "^17.5.1"
+        "semver": "^7.5.4"
      },
      "bin": {
        "graphite": "graphite.js",
@ -23,129 +20,6 @@
        "node": ">=16"
      }
    },
-    "node_modules/ansi-regex": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/ansi-styles": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
-      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
-      "license": "MIT",
-      "dependencies": {
-        "color-convert": "^2.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
-      }
-    },
-    "node_modules/chalk": {
-      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^4.1.0",
-        "supports-color": "^7.1.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/chalk?sponsor=1"
-      }
-    },
-    "node_modules/cliui": {
-      "version": "8.0.1",
-      "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz",
-      "integrity": "sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==",
-      "license": "ISC",
-      "dependencies": {
-        "string-width": "^4.2.0",
-        "strip-ansi": "^6.0.1",
-        "wrap-ansi": "^7.0.0"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/color-convert": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
-      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
-      "license": "MIT",
-      "dependencies": {
-        "color-name": "~1.1.4"
-      },
-      "engines": {
-        "node": ">=7.0.0"
-      }
-    },
-    "node_modules/color-name": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
-      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
-      "license": "MIT"
-    },
-    "node_modules/emoji-regex": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
-      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
-      "license": "MIT"
-    },
-    "node_modules/escalade": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz",
-      "integrity": "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/get-caller-file": {
-      "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/get-caller-file/-/get-caller-file-2.0.5.tgz",
-      "integrity": "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==",
-      "license": "ISC",
-      "engines": {
-        "node": "6.* || 8.* || >= 10.*"
-      }
-    },
-    "node_modules/has-flag": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
-      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/is-fullwidth-code-point": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
-      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/require-directory": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/require-directory/-/require-directory-2.1.1.tgz",
-      "integrity": "sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
    "node_modules/semver": {
      "version": "7.7.1",
      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.1.tgz",
@ -157,118 +31,6 @@
      "engines": {
        "node": ">=10"
      }
-    },
-    "node_modules/string-width": {
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
-      "license": "MIT",
-      "dependencies": {
-        "emoji-regex": "^8.0.0",
-        "is-fullwidth-code-point": "^3.0.0",
-        "strip-ansi": "^6.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/strip-ansi": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
-      "license": "MIT",
-      "dependencies": {
-        "ansi-regex": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/supports-color": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
-      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
-      "license": "MIT",
-      "dependencies": {
-        "has-flag": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/wrap-ansi": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
-      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^4.0.0",
-        "string-width": "^4.1.0",
-        "strip-ansi": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
-      }
-    },
-    "node_modules/ws": {
-      "version": "8.18.0",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.18.0.tgz",
-      "integrity": "sha512-8VbfWfHLbbwu3+N6OKsOMpBdT4kXPDDB9cJk2bJ6mh9ucxdlnNvH1e+roYkKmN9Nxw2yjz7VzeO9oOz2zJ04Pw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=10.0.0"
-      },
-      "peerDependencies": {
-        "bufferutil": "^4.0.1",
-        "utf-8-validate": ">=5.0.2"
-      },
-      "peerDependenciesMeta": {
-        "bufferutil": {
-          "optional": true
-        },
-        "utf-8-validate": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/y18n": {
-      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",
-      "integrity": "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==",
-      "license": "ISC",
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/yargs": {
-      "version": "17.7.2",
-      "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.2.tgz",
-      "integrity": "sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==",
-      "license": "MIT",
-      "dependencies": {
-        "cliui": "^8.0.1",
-        "escalade": "^3.1.1",
-        "get-caller-file": "^2.0.5",
-        "require-directory": "^2.1.1",
-        "string-width": "^4.2.3",
-        "y18n": "^5.0.5",
-        "yargs-parser": "^21.1.1"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/yargs-parser": {
-      "version": "21.1.1",
-      "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-21.1.1.tgz",
-      "integrity": "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==",
-      "license": "ISC",
-      "engines": {
-        "node": ">=12"
-      }
    }
  }
 }
--- a/pkgs/by-name/gr/graphite-cli/package.nix
+++ b/pkgs/by-name/gr/graphite-cli/package.nix
@ -8,14 +8,14 @@

 buildNpmPackage rec {
  pname = "graphite-cli";
-  version = "1.5.3";
+  version = "1.6.1";

  src = fetchurl {
    url = "https://registry.npmjs.org/@withgraphite/graphite-cli/-/graphite-cli-${version}.tgz";
-    hash = "sha256-hWr4HOpcNXEpdboeHige5nliVCLY3RukMVh2xRKGIlI=";
+    hash = "sha256-r7tChs0vsg60LXFf9WZjthqMxXGgohNL4ojdjXNZcCo=";
  };

-  npmDepsHash = "sha256-v/zIQvcFGHA4Jr7Hh+hTw8BqwBF7b65X9or230qCsMc=";
+  npmDepsHash = "sha256-DoK3GaGIwei9kumvAwfgaIY9iw+Z6ysFzUm5dMVV2W4=";

  postPatch = ''
    ln -s ${./package-lock.json} package-lock.json
--- a/pkgs/by-name/ht/httpyac/package.nix
+++ b/pkgs/by-name/ht/httpyac/package.nix
@ -8,16 +8,16 @@

 buildNpmPackage rec {
  pname = "httpyac";
-  version = "6.16.6";
+  version = "6.16.7";

  src = fetchFromGitHub {
    owner = "anweber";
    repo = "httpyac";
    tag = version;
-    hash = "sha256-JsrGoUZKo5/qjH+GKm5FBY19NE6KN7NhLpPvM8Cw97U=";
+    hash = "sha256-6qhKOb2AJrDhZLRU6vrDfuW9KED+5TLf4hHH/0iADeA=";
  };

-  npmDepsHash = "sha256-08RJ1lLIaTXi3JHGIFR44GbEqOGez7+VFQGlejZqgAI=";
+  npmDepsHash = "sha256-X3Yz+W7lijOLP+tEuO0JOpeOMOGdUYN6OpxPYHwFQEo=";

  nativeInstallCheckInputs = [
    versionCheckHook
--- a/pkgs/by-name/hy/hyperrogue/package.nix
+++ b/pkgs/by-name/hy/hyperrogue/package.nix
@ -18,13 +18,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "hyperrogue";
-  version = "13.0w";
+  version = "13.0x";

  src = fetchFromGitHub {
    owner = "zenorogue";
    repo = "hyperrogue";
    tag = "v${finalAttrs.version}";
-    sha256 = "sha256-/ERMR4JtlIsZ5mvPKTjcjiUfX5/7DTqT0Zc/LEFdZ+M=";
+    sha256 = "sha256-CwicLUQThNDc8Ig0kRNTnkSwUcoIw+tNQoXVgoWbkIE=";
  };

  env = {
--- a/pkgs/by-name/ir/irpf/package.nix
+++ b/pkgs/by-name/ir/irpf/package.nix
@ -13,7 +13,7 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "irpf";
-  version = "2025-1.0";
+  version = "2025-1.1";

  # https://www.gov.br/receitafederal/pt-br/centrais-de-conteudo/download/pgd/dirpf
  # Para outros sistemas operacionais -> Multi
@ -23,7 +23,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    in
    fetchzip {
      url = "https://downloadirpf.receita.fazenda.gov.br/irpf/${year}/irpf/arquivos/IRPF${finalAttrs.version}.zip";
-      hash = "sha256-gDGDOthUbRmj68CHmHhaYlGs4tiQTNVlEmuyLZ5e0zY=";
+      hash = "sha256-C5Ebit11TGhh3jI0ZKVEPFpuqnHbrDC1JoMt0v21S90=";
    };

  passthru.updateScript = writeScript "update-irpf" ''
--- a/pkgs/by-name/ki/kikit/default.nix
+++ b/pkgs/by-name/ki/kikit/default.nix
@ -26,7 +26,7 @@ let
 in
 buildPythonApplication rec {
  pname = "kikit";
-  version = "1.7.1";
+  version = "1.7.2";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -35,7 +35,13 @@ buildPythonApplication rec {
    owner = "yaqwsx";
    repo = "KiKit";
    tag = "v${version}";
-    hash = "sha256-GG0OXPoTy219QefQ7GwMen4u66lPob5DI8lU9sqwaRQ=";
+    hash = "sha256-HSAQJJqJMVh44wgOQm+0gteShLogklBFuIzWtoVTf9I=";
+    # Upstream uses versioneer, which relies on gitattributes substitution.
+    # This leads to non-reproducible archives on GitHub.
+    # See https://github.com/NixOS/nixpkgs/issues/84312
+    postFetch = ''
+      rm "$out/kikit/_version.py"
+    '';
  };

  build-system = [
@ -75,6 +81,11 @@ buildPythonApplication rec {
    "kikit"
  ];

+  postPatch = ''
+    # Recreate _version.py, deleted at fetch time due to non-reproducibility.
+    echo 'def get_versions(): return {"version": "${version}"}' > kikit/_version.py
+  '';
+
  preCheck = ''
    export PATH=$PATH:$out/bin

--- a/pkgs/by-name/ki/kikit/drop-versioneer.patch
+++ b/pkgs/by-name/ki/kikit/drop-versioneer.patch
@ -0,0 +1,14 @@
+diff --git a/setup.py b/setup.py
+index 9351fc9..75dfb2c 100644
+--- a/setup.py
+++ b/setup.py
+@@ -66,9 +66,6 @@
+         "solidpython>=1.1.2",
+         "commentjson>=0.9"
+     ],
+-    setup_requires=[
+-        "versioneer"
+-    ],
+     extras_require={
+         "dev": ["pytest"],
+     },
--- a/pkgs/by-name/li/libdatovka/package.nix
+++ b/pkgs/by-name/li/libdatovka/package.nix
@ -16,11 +16,11 @@

 stdenv.mkDerivation rec {
  pname = "libdatovka";
-  version = "0.7.0";
+  version = "0.7.1";

  src = fetchurl {
    url = "https://gitlab.nic.cz/datovka/libdatovka/-/archive/v${version}/libdatovka-v${version}.tar.gz";
-    sha256 = "sha256-D/4+ldVnJrPAPrgrV1V4FfgCzgMbw/f/rxWT7Esf8Wk=";
+    sha256 = "sha256-qVbSxPLYe+PjGwRH2U/V2Ku2X1fRPbDOUjFamCsYVgY=";
  };

  patches = [
--- a/pkgs/by-name/li/libdmtx/package.nix
+++ b/pkgs/by-name/li/libdmtx/package.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "libdmtx";
-  version = "0.7.7";
+  version = "0.7.8";

  src = fetchFromGitHub {
    owner = "dmtx";
    repo = "libdmtx";
    rev = "v${version}";
-    sha256 = "sha256-UQy8iFfl8BNT5cBUMVF1tIScFPfHekSofaebtel9JWk=";
+    sha256 = "sha256-/sV+t7RAr5dTwfUsGz0KEZYgm0DzQWRdiwrbbEbC1OY=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/li/liblscp/package.nix
+++ b/pkgs/by-name/li/liblscp/package.nix
@ -8,11 +8,11 @@

 stdenv.mkDerivation rec {
  pname = "liblscp";
-  version = "1.0.0";
+  version = "1.0.1";

  src = fetchurl {
    url = "https://download.linuxsampler.org/packages/${pname}-${version}.tar.gz";
-    sha256 = "sha256-ZaPfB3Veg1YCBHieoK9fFqL0tB4PiNsY81oJmn2rd/I=";
+    sha256 = "sha256-21SjPA5emMRKEQIukhg7r3uXfnByEpNkGhCepNu09sc=";
  };

  postPatch = ''
--- a/pkgs/by-name/ma/magic-vlsi/package.nix
+++ b/pkgs/by-name/ma/magic-vlsi/package.nix
@ -15,11 +15,11 @@

 stdenv.mkDerivation rec {
  pname = "magic-vlsi";
-  version = "8.3.522";
+  version = "8.3.524";

  src = fetchurl {
    url = "http://opencircuitdesign.com/magic/archive/magic-${version}.tgz";
-    sha256 = "sha256-haXmCVnPPAry4n9EpVWS5UclK6PCA8J9OFlw4jPMGw4=";
+    sha256 = "sha256-PmnxTICQlcrdA+Xd0VP9pC66hsOBhxxKRlQUk1NFHcI=";
  };

  nativeBuildInputs = [ python3 ];
--- a/pkgs/by-name/ma/mattermostLatest/package.nix
+++ b/pkgs/by-name/ma/mattermostLatest/package.nix
@ -11,8 +11,8 @@ mattermost.override {
    # and make sure the version regex is up to date here.
    # Ensure you also check ../mattermost/package.nix for ESR releases.
    regex = "^v(10\\.[0-9]+\\.[0-9]+)$";
-    version = "10.6.0";
-    srcHash = "sha256-GnXxhhbOKJezUAyKRBbn5IE22gzsn80mwnPANOT9Qu4=";
+    version = "10.6.1";
+    srcHash = "sha256-xCrjJc6JCZXnCZ5lJ3o1bRbt7sxlEmcWeiw2cKmyWG0=";
    vendorHash = "sha256-wj+bAQNJSs9m2SSfl+Ipm965iAhKQ2v1iMjH7I79qf4=";
    npmDepsHash = "sha256-MdLfjLmizFbLfSqOdAZ+euXomB2ZPjZOqspQYnyHcuk=";
    lockfileOverlay = ''
--- a/pkgs/by-name/ne/nezha/package.nix
+++ b/pkgs/by-name/ne/nezha/package.nix
@ -14,7 +14,7 @@

 let
  pname = "nezha";
-  version = "1.10.4";
+  version = "1.10.8";

  frontendName = lib.removePrefix "nezha-theme-";

@ -58,7 +58,7 @@ buildGo124Module {
    owner = "nezhahq";
    repo = "nezha";
    tag = "v${version}";
-    hash = "sha256-9dw1MT3v7ZCpC/MrlZDJmZ9EdTNVIbE0b45ao3eXO7o=";
+    hash = "sha256-uYZclZPvjiOpCVpxkyU6BjdxBmdryBzoGkTctsRuapY=";
  };

  proxyVendor = true;
--- a/pkgs/by-name/ni/nix-output-monitor/generated-package.nix
+++ b/pkgs/by-name/ni/nix-output-monitor/generated-package.nix
@ -9,21 +9,21 @@
  bytestring,
  cassava,
  containers,
-  data-default,
  directory,
  extra,
  fetchzip,
+  filelock,
  filepath,
  hermes-json,
  HUnit,
  lib,
-  lock-file,
  MemoTrie,
  nix-derivation,
  optics,
  random,
  relude,
  safe,
+  safe-exceptions,
  stm,
  streamly-core,
  strict,
@ -38,10 +38,10 @@
 }:
 mkDerivation {
  pname = "nix-output-monitor";
-  version = "2.1.5";
+  version = "2.1.6";
  src = fetchzip {
-    url = "https://code.maralorn.de/maralorn/nix-output-monitor/archive/v2.1.5.tar.gz";
-    sha256 = "01rsd2x74ainpadmyldxmjypkcc80f3caiysz9dz6vm8q2arcfbd";
+    url = "https://code.maralorn.de/maralorn/nix-output-monitor/archive/v2.1.6.tar.gz";
+    sha256 = "0v291s6lx9rxlw38a3329gc37nyl2x24blyrf9rv8lzxc1q4bz31";
  };
  isLibrary = true;
  isExecutable = true;
@ -53,17 +53,17 @@ mkDerivation {
    bytestring
    cassava
    containers
-    data-default
    directory
    extra
+    filelock
    filepath
    hermes-json
-    lock-file
    MemoTrie
    nix-derivation
    optics
    relude
    safe
+    safe-exceptions
    stm
    streamly-core
    strict
@ -82,17 +82,17 @@ mkDerivation {
    bytestring
    cassava
    containers
-    data-default
    directory
    extra
+    filelock
    filepath
    hermes-json
-    lock-file
    MemoTrie
    nix-derivation
    optics
    relude
    safe
+    safe-exceptions
    stm
    streamly-core
    strict
@ -113,19 +113,19 @@ mkDerivation {
    bytestring
    cassava
    containers
-    data-default
    directory
    extra
+    filelock
    filepath
    hermes-json
    HUnit
-    lock-file
    MemoTrie
    nix-derivation
    optics
    random
    relude
    safe
+    safe-exceptions
    stm
    streamly-core
    strict
--- a/pkgs/by-name/ni/nix-output-monitor/update.sh
+++ b/pkgs/by-name/ni/nix-output-monitor/update.sh
@ -27,4 +27,6 @@ cabal2nix \
  "https://code.maralorn.de/maralorn/nix-output-monitor/archive/${new_version}.tar.gz" \
  >> "$derivation_file"

+nixfmt "$derivation_file"
+
 echo "Finished."
--- a/pkgs/by-name/ni/nixos-facter/package.nix
+++ b/pkgs/by-name/ni/nixos-facter/package.nix
@ -6,8 +6,7 @@
  libusb1,
  gcc,
  pkg-config,
-  util-linux,
-  pciutils,
+  makeWrapper,
  stdenv,
  systemdMinimal,
 }:
@ -24,16 +23,16 @@ let
 in
 buildGoModule rec {
  pname = "nixos-facter";
-  version = "0.3.1";
+  version = "0.3.2";

  src = fetchFromGitHub {
    owner = "numtide";
    repo = "nixos-facter";
    rev = "v${version}";
-    hash = "sha256-HJt6FEQbzwlVMow47p1DtqXdmCxLYA6g3D1EgGnKcUo=";
+    hash = "sha256-QD9b3r91ukGbAg+ZWj9cdBsXb6pl3wlVgEY3zF+tDQI=";
  };

-  vendorHash = "sha256-WCItbRbGgclXGtJyHCkDgaPe3Mobe4mT/4c16AEdF5o=";
+  vendorHash = "sha256-A7ZuY8Gc/a0Y8O6UG2WHWxptHstJOxi4n9F8TY6zqiw=";

  env.CGO_ENABLED = 1;

@ -45,14 +44,14 @@ buildGoModule rec {
  nativeBuildInputs = [
    gcc
    pkg-config
+    makeWrapper
  ];

-  runtimeInputs = [
-    libusb1
-    util-linux
-    pciutils
-    systemdMinimal
-  ];
+  # nixos-facter calls systemd-detect-virt
+  postInstall = ''
+    wrapProgram "$out/bin/nixos-facter" \
+        --prefix PATH : "${lib.makeBinPath [ systemdMinimal ]}"
+  '';

  ldflags = [
    "-s"
--- a/pkgs/by-name/ns/nsq/package.nix
+++ b/pkgs/by-name/ns/nsq/package.nix
@ -29,5 +29,6 @@ buildGoModule rec {
    description = "Realtime distributed messaging platform";
    changelog = "https://github.com/nsqio/nsq/raw/v${version}/ChangeLog.md";
    license = licenses.mit;
+    maintainers = with maintainers; [ blakesmith ];
  };
 }
--- a/pkgs/by-name/oc/oci-seccomp-bpf-hook/package.nix
+++ b/pkgs/by-name/oc/oci-seccomp-bpf-hook/package.nix
@ -11,12 +11,12 @@

 buildGoModule rec {
  pname = "oci-seccomp-bpf-hook";
-  version = "1.2.10";
+  version = "1.2.11";
  src = fetchFromGitHub {
    owner = "containers";
    repo = "oci-seccomp-bpf-hook";
    rev = "v${version}";
-    sha256 = "sha256-bWlm+JYNf7+faKSQfW5fhxoH/D2I8ujjakswH+1r49o=";
+    sha256 = "sha256-1LRwbKOLNBkY/TMTLlWq2lkFzCabXqwdaMRT9HNr6HE=";
  };
  vendorHash = null;

--- a/pkgs/by-name/op/open-webui/package.nix
+++ b/pkgs/by-name/op/open-webui/package.nix
@ -8,13 +8,13 @@
 }:
 let
  pname = "open-webui";
-  version = "0.6.1";
+  version = "0.6.2";

  src = fetchFromGitHub {
    owner = "open-webui";
    repo = "open-webui";
    tag = "v${version}";
-    hash = "sha256-4thzEyXANDKARwWR8NvPsTW9/ZsV26B1NLXR0UsAWyg=";
+    hash = "sha256-E9bZr2HG1TSZQDW4KBd3rV8AoQ3lWH8tfTsCY7XAwy0=";
  };

  frontend = buildNpmPackage rec {
@ -30,7 +30,7 @@ let
      url = "https://github.com/pyodide/pyodide/releases/download/${pyodideVersion}/pyodide-${pyodideVersion}.tar.bz2";
    };

-    npmDepsHash = "sha256-JTOl1qDcERdVq6g1nt5wD+Z9MjJw0MFxq0N2e5Hvo7M=";
+    npmDepsHash = "sha256-PNuZ1PsUtNfwI24zfzvnUzkvBznZQHLUG12E+p1bL68=";

    # Disabling `pyodide:fetch` as it downloads packages during `buildPhase`
    # Until this is solved, running python packages from the browser will not work.
@ -82,6 +82,7 @@ python312.pkgs.buildPythonApplication rec {
  dependencies =
    with python312.pkgs;
    [
+      accelerate
      aiocache
      aiofiles
      aiohttp
--- a/pkgs/by-name/op/opera/package.nix
+++ b/pkgs/by-name/op/opera/package.nix
@ -52,11 +52,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "opera";
-  version = "117.0.5408.93";
+  version = "117.0.5408.197";

  src = fetchurl {
    url = "${mirror}/${version}/linux/${pname}-stable_${version}_amd64.deb";
-    hash = "sha256-1Qi1Suh5gDJXFOnI3sjmLCNrNFDqV9n1sTh3rFrRBro=";
+    hash = "sha256-ZTYdmp8fScBm5SF1cx2LwhMV66MkShEtww7VDJTDATk=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ow/owntone/package.nix
+++ b/pkgs/by-name/ow/owntone/package.nix
@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
  src = fetchFromGitHub {
    owner = "owntone";
    repo = "owntone-server";
-    tag = "${finalAttrs.version}";
+    tag = finalAttrs.version;
    hash = "sha256-Mj3G1+Hwa/zl0AM4SO6TcB4W3WJkpIDzrSPEFx0vaEk=";
  };

--- a/pkgs/by-name/pk/pkgsite/package.nix
+++ b/pkgs/by-name/pk/pkgsite/package.nix
@ -7,13 +7,13 @@

 buildGoModule {
  pname = "pkgsite";
-  version = "0-unstable-2025-03-21";
+  version = "0-unstable-2025-04-01";

  src = fetchFromGitHub {
    owner = "golang";
    repo = "pkgsite";
-    rev = "d037ac96d503b32fcdcb5f5efeefef10447c394e";
-    hash = "sha256-/zcnS3qYmiI5kuOZ4jJB7/3C2U9KELYgte7d9OgaLmo=";
+    rev = "e806f9c8871f0247a0989e5124d82e7d841bce91";
+    hash = "sha256-J8v0P+KIhh07c0G+XN5aWuVp2btaJel2T+U6g/D/2sM=";
  };

  vendorHash = "sha256-M4cbpMZ/ujnMUoGp//KpBM2oEl/RCOfI1IcmoGMw+fw=";
--- a/pkgs/by-name/pl/plan-exporter/package.nix
+++ b/pkgs/by-name/pl/plan-exporter/package.nix
@ -2,18 +2,25 @@
  lib,
  fetchFromGitHub,
  buildGoModule,
+  nix-update-script,
 }:
 buildGoModule rec {
  pname = "plan-exporter";
  version = "0.0.6";
+
  src = fetchFromGitHub {
    owner = "agneum";
    repo = "plan-exporter";
    tag = "v${version}";
    hash = "sha256-Csp57wmkDA8b05hmKbk1+bGtORFgNls7I01A0irTKao=";
  };
+
  vendorHash = null;

+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
  meta = {
    description = "Query plan exporter for psql";
    homepage = "https://github.com/agneum/plan-exporter";
--- a/pkgs/by-name/po/pomerium-cli/package.nix
+++ b/pkgs/by-name/po/pomerium-cli/package.nix
@ -14,16 +14,16 @@ let
 in
 buildGoModule rec {
  pname = "pomerium-cli";
-  version = "0.29.0";
+  version = "0.29.1";

  src = fetchFromGitHub {
    owner = "pomerium";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "sha256-H5wZaZsMgHPcO1qDoaqp/UP+stU7IG070DNFhxC7Ehw=";
+    sha256 = "sha256-CcXreKZ83+WDucV3sr62bwKzSs+S9R3e+z0JD0rR8jw=";
  };

-  vendorHash = "sha256-a5eESlDBxYVvfiafdZFIjUqIxB51LZc67fUJek69qwc=";
+  vendorHash = "sha256-k6HOIpz0cPCkP3TXg62u+tuYd41TF+YAoCWINAcFoB8=";

  subPackages = [
    "cmd/pomerium-cli"
--- a/pkgs/by-name/pr/protonmail-bridge-gui/package.nix
+++ b/pkgs/by-name/pr/protonmail-bridge-gui/package.nix
@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
    find . -type f -name "CMakeLists.txt" -exec sed -i "/BridgeSetup\\.cmake/d" {} \;

    # Use the available ICU version
-    sed -i "s/libicu\(i18n\|uc\|data\)\.so\.56/libicu\1.so/g" bridge-gui/DeployLinux.cmake
+    sed -i "s/libicu\(i18n\|uc\|data\)\.so\.[0-9][0-9]/libicu\1.so/g" bridge-gui/DeployLinux.cmake

    # Create a Desktop Entry that uses a `protonmail-bridge-gui` binary without upstream's launcher
    sed "s/^\(Icon\|Exec\)=.*$/\1=protonmail-bridge-gui/" ../../../dist/proton-bridge.desktop > proton-bridge-gui.desktop
--- a/pkgs/by-name/pr/protonmail-bridge/package.nix
+++ b/pkgs/by-name/pr/protonmail-bridge/package.nix
@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "protonmail-bridge";
-  version = "3.18.0";
+  version = "3.19.0";

  src = fetchFromGitHub {
    owner = "ProtonMail";
    repo = "proton-bridge";
    rev = "v${version}";
-    hash = "sha256-qLxIXAGa1nqLOroz5VYWktznId+vfOPvHpUT/oVPD8M=";
+    hash = "sha256-Jx6yzn3QNOVz/VM8dqmTm4Upzz46aNo9d6lvhjLwdL4=";
  };

  vendorHash = "sha256-S08Vw/dLLVd6zFWmpG8wDVf7LOdSC29qo7pUscYHDyY=";
--- a/pkgs/by-name/rm/rmg/package.nix
+++ b/pkgs/by-name/rm/rmg/package.nix
@ -29,13 +29,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "rmg";
-  version = "0.7.7";
+  version = "0.7.8";

  src = fetchFromGitHub {
    owner = "Rosalie241";
    repo = "RMG";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Jwp3DXCh30TLBALXdnu6IubT4Y/8NGjJoSj7WwPp8Q8=";
+    hash = "sha256-ijoXKZbK4tm1KQ4I7R/g12tCUqrg4wRRRBCPPL03WEk=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
+++ b/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
@ -12,15 +12,15 @@

 rustPlatform.buildRustPackage rec {
  pname = "rust-analyzer-unwrapped";
-  version = "2025-03-24";
+  version = "2025-03-31";
  useFetchCargoVendor = true;
-  cargoHash = "sha256-cLSUCdc0q1P1z8STZ9GhNzT752ruFqyhnnhDzA6nb+o=";
+  cargoHash = "sha256-sOuswCnF5y/L8x586PpcrLQj19+5x8COi9xBE2SRLYY=";

  src = fetchFromGitHub {
    owner = "rust-lang";
    repo = "rust-analyzer";
    rev = version;
-    hash = "sha256-Hs+FeeFB+YTKIW39/b2OKr1/Q+vgDnfMYM1g+sRgFCU=";
+    hash = "sha256-GLefofvDqIcyZ/S8rcF6cuKoSPJOVkm7TSK23MGT3Kk=";
  };

  cargoBuildFlags = [
--- a/pkgs/by-name/ru/rustdesk/package.nix
+++ b/pkgs/by-name/ru/rustdesk/package.nix
@ -42,7 +42,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  src = fetchFromGitHub {
    owner = "rustdesk";
    repo = "rustdesk";
-    tag = "${finalAttrs.version}";
+    tag = finalAttrs.version;
    fetchSubmodules = true;
    hash = "sha256-m1bFljZL8vNaugepVs8u1EWNpDLtxgSSZqKGQmgrmsA=";
  };
--- a/pkgs/by-name/sc/scrot/package.nix
+++ b/pkgs/by-name/sc/scrot/package.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "scrot";
-  version = "1.11.1";
+  version = "1.12.1";

  src = fetchFromGitHub {
    owner = "resurrecting-open-source-projects";
    repo = "scrot";
    rev = version;
-    sha256 = "sha256-MUmvzZMzzKKw5GjOUhpdrMIgKO9/i9RDqDtTsSghd18=";
+    sha256 = "sha256-ExZH+bjpEvdbSYM8OhV+cyn4j+0YrHp5/b+HsHKAHCA=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/si/signal-cli/package.nix
+++ b/pkgs/by-name/si/signal-cli/package.nix
@ -11,12 +11,12 @@

 stdenv.mkDerivation rec {
  pname = "signal-cli";
-  version = "0.13.13";
+  version = "0.13.14";

  # Building from source would be preferred, but is much more involved.
  src = fetchurl {
    url = "https://github.com/AsamK/signal-cli/releases/download/v${version}/signal-cli-${version}.tar.gz";
-    hash = "sha256-nSaf8VkHxuAvedUhFAIeagOxKYNxp3hi0zH6BbomtMQ=";
+    hash = "sha256-TKAUSVIBF9FVbwZYc5R3ZsVecF/RsII1nl7GuITxAoc=";
  };

  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
--- a/pkgs/by-name/si/signal-desktop-source/libsignal-node.nix
+++ b/pkgs/by-name/si/signal-desktop-source/libsignal-node.nix
@ -12,7 +12,6 @@
  fetchFromGitHub,
  python3,
  nodejs,
-
 }:
 let
  # boring-sys expects the static libraries in build/ instead of lib/
@ -25,23 +24,23 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "libsignal-node";
-  version = "0.67.3";
+  version = "0.67.4";

  src = fetchFromGitHub {
    owner = "signalapp";
    repo = "libsignal";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-kZZS3IpmxFFuHMH4O1H+JLyf2zBTSr1RnuV0wrwZeXk=";
+    hash = "sha256-s7vTzAOWKvGCkrWcxDcKptsmxvW5VxrF5X9Vfkjj1jA=";
  };
  useFetchCargoVendor = true;
-  cargoHash = "sha256-ozroDfxDdBtyBEE0d7nf63wUqilBhakT/lxwYV/7V5I=";
+  cargoHash = "sha256-wxBbq4WtqzHbdro+tm2hU6JVwTgC2X/Cx9po+ndgECg=";

  npmRoot = "node";
  npmDeps = fetchNpmDeps {
    name = "${finalAttrs.pname}-npm-deps";
    inherit (finalAttrs) version src;
    sourceRoot = "${finalAttrs.src.name}/${finalAttrs.npmRoot}";
-    hash = "sha256-TpjpRDsKT/RCPxzV7mzfmZHI9QhH+OColGuEMSdVwBA=";
+    hash = "sha256-GJTNuVK1YGDpx89fF6hXXd+/fEqnFMG5FgJUJhp6344=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/si/signal-desktop-source/package.nix
+++ b/pkgs/by-name/si/signal-desktop-source/package.nix
@ -7,11 +7,9 @@
  python3,
  makeWrapper,
  callPackage,
-  libpulseaudio,
  fetchFromGitHub,
  runCommand,
-  fetchzip,
-  autoPatchelfHook,
+  jq,
  makeDesktopItem,
  copyDesktopItems,
  replaceVars,
@ -29,29 +27,9 @@ let
    tar -C $out --strip-components=1 -xvf ${electron.headers}
  '';

-  sqlcipher-signal-extension = callPackage ./sqlcipher-signal-extension.nix { };
  libsignal-node = callPackage ./libsignal-node.nix { inherit nodejs; };

-  ringrtc = stdenv.mkDerivation (finalAttrs: {
-    pname = "ringrtc-bin";
-    version = "2.50.2";
-    src = fetchzip {
-      url = "https://build-artifacts.signal.org/libraries/ringrtc-desktop-build-v${finalAttrs.version}.tar.gz";
-      hash = "sha256-hNlz+gSulyJ//FdbPvY/5OHbtJ4rEUdi9/SHJDX6gZE=";
-    };
-
-    installPhase = ''
-      cp -r . $out
-    '';
-
-    nativeBuildInputs = [ autoPatchelfHook ];
-    buildInputs = [ libpulseaudio ];
-    meta = {
-      homepage = "https://github.com/signalapp/ringrtc";
-      license = lib.licenses.agpl3Only;
-      sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    };
-  });
+  ringrtc-bin = callPackage ./ringrtc-bin.nix { };

  # Noto Color Emoji PNG files for emoji replacement; see below.
  noto-fonts-color-emoji-png = noto-fonts-color-emoji.overrideAttrs (prevAttrs: {
@ -74,16 +52,16 @@ let
    '';
  });

-  version = "7.48.0";
+  version = "7.49.0";

  src = fetchFromGitHub {
    owner = "signalapp";
    repo = "Signal-Desktop";
    tag = "v${version}";
-    hash = "sha256-/jtuGsBOFsSgJZNpRilWZ0daI0iYVziZBaF/vLvQ7NU=";
+    hash = "sha256-URWDSHiPK+DCh8giT8YFW2HNY0tYNokqbAKBpBWZKD0=";
  };

-  stickerCreator = stdenv.mkDerivation (finalAttrs: {
+  sticker-creator = stdenv.mkDerivation (finalAttrs: {
    pname = "signal-desktop-sticker-creator";
    inherit version;
    src = src + "/sticker-creator";
@ -121,6 +99,7 @@ stdenv.mkDerivation (finalAttrs: {
    makeWrapper
    copyDesktopItems
    python3
+    jq
  ];
  buildInputs = (lib.optional (!withAppleEmojis) noto-fonts-color-emoji-png);

@ -139,21 +118,39 @@ stdenv.mkDerivation (finalAttrs: {
      ;
    hash =
      if withAppleEmojis then
-        "sha256-xba5MfIjwnLHDKVM9+2KSpC3gcw6cM4cX3dn3/jqT3o="
+        "sha256-QBlouzA3PhRGiL94sCQS/zRSdsFbKf4VI20x3seMpE4="
      else
-        "sha256-I5UGY9Fz4wCa23snq0pir2uq/P+w+fAGU4Bks+CqEgk=";
+        "sha256-LKSFptmJyfI0ACo1egZ2LAY5pAXexu9UNjIhD79rJ9E=";
  };

  env = {
    ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
    SIGNAL_ENV = "production";
-    SOURCE_DATE_EPOCH = 1743538878;
+    SOURCE_DATE_EPOCH = 1743627521;
  };

  preBuild = ''
-    cp ${sqlcipher-signal-extension}/share/sqlite3.gyp node_modules/@signalapp/better-sqlite3/deps/sqlite3.gyp
+    if [ "`jq -r '.engines.node' < package.json | head -c 2`" != `head -c 2 <<< "${nodejs.version}"` ]
+    then
+      die "nodejs version mismatch"
+    fi

-    cp -r ${ringrtc} node_modules/@signalapp/ringrtc/build
+    if [ "`jq -r '.devDependencies.electron' < package.json | head -c 2`" != `head -c 2 <<< "${electron.version}"` ]
+    then
+      die "electron version mismatch"
+    fi
+
+    if [ "`jq -r '.dependencies."@signalapp/libsignal-client"' < package.json`" != "${libsignal-node.version}" ]
+    then
+      die "libsignal-client version mismatch"
+    fi
+
+    if [ "`jq -r '.dependencies."@signalapp/ringrtc"' < package.json`" != "${ringrtc-bin.version}" ]
+    then
+      die "ringrtc version mismatch"
+    fi
+
+    cp -r ${ringrtc-bin} node_modules/@signalapp/ringrtc/build

    rm -fr node_modules/@signalapp/libsignal-client/prebuilds
    cp -r ${libsignal-node}/lib node_modules/@signalapp/libsignal-client/prebuilds
@ -165,7 +162,7 @@ stdenv.mkDerivation (finalAttrs: {
    export npm_config_nodedir=${electron-headers}
    cp -r ${electron.dist} electron-dist
    chmod -R u+w electron-dist
-    cp -r ${stickerCreator} sticker-creator/dist
+    cp -r ${sticker-creator} sticker-creator/dist

    pnpm run generate
    pnpm exec electron-builder \
@ -219,8 +216,13 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  passthru = {
-    inherit sqlcipher-signal-extension libsignal-node;
+    inherit
+      libsignal-node
+      ringrtc-bin
+      sticker-creator
+      ;
    tests.application-launch = nixosTests.signal-desktop;
+    updateScript.command = [ ./update.sh ];
  };

  meta = {
@ -251,6 +253,7 @@ stdenv.mkDerivation (finalAttrs: {
    sourceProvenance = with lib.sourceTypes; [
      fromSource

+      # @signalapp/sqlcipher
      # ringrtc
      binaryNativeCode
    ];
--- a/pkgs/by-name/si/signal-desktop-source/replace-apple-emoji-with-noto-emoji.patch
+++ b/pkgs/by-name/si/signal-desktop-source/replace-apple-emoji-with-noto-emoji.patch
@ -1,8 +1,8 @@
 diff --git a/ACKNOWLEDGMENTS.md b/ACKNOWLEDGMENTS.md
-index aed1048..e4c1f50 100644
+index 2c963f1..96edd02 100644
 --- a/ACKNOWLEDGMENTS.md
 +++ b/ACKNOWLEDGMENTS.md
-@@ -745,30 +745,6 @@ Signal Desktop makes use of the following open source projects.
+@@ -1636,30 +1636,6 @@ Signal Desktop makes use of the following open source projects.
     OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
     SOFTWARE.
 
@ -46,10 +46,10 @@ index 68dceea..4b35bb1 100644
     getBadgesPath(userDataPath),
     getDraftPath(userDataPath),
 diff --git a/package.json b/package.json
-index 3a6ac26..40cdb25 100644
+index 5755fec..86125ba 100644
 --- a/package.json
 +++ b/package.json
-@@ -130,7 +130,6 @@
+@@ -137,7 +137,6 @@
     "dashdash": "2.0.0",
     "direction": "1.0.4",
     "emoji-datasource": "15.1.2",
@ -57,11 +57,18 @@ index 3a6ac26..40cdb25 100644
     "emoji-regex": "10.4.0",
     "encoding": "0.1.13",
     "fabric": "4.6.0",
+@@ -649,4 +648,4 @@
+       "sticker-creator/dist/**"
+     ]
+   }
+-}
+}
+\ No newline at end of file
 diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
-index ba2f205..705e454 100644
+index f04b2b1..070fa0f 100644
 --- a/pnpm-lock.yaml
 +++ b/pnpm-lock.yaml
-@@ -169,9 +169,6 @@ importers:
+@@ -184,9 +184,6 @@ importers:
       emoji-datasource:
         specifier: 15.1.2
         version: 15.1.2
@ -71,7 +78,7 @@ index ba2f205..705e454 100644
       emoji-regex:
         specifier: 10.4.0
         version: 10.4.0
-@@ -4790,9 +4787,6 @@ packages:
+@@ -4817,9 +4814,6 @@ packages:
     resolution: {integrity: sha512-DeWwawk6r5yR9jFgnDKYt4sLS0LmHJJi3ZOnb5/JdbYwj3nW+FxQnHIjhBKz8YLC7oRNPVM9NQ47I3CVx34eqQ==}
     engines: {node: '>=12'}
 
@ -81,7 +88,7 @@ index ba2f205..705e454 100644
   emoji-datasource@15.1.2:
     resolution: {integrity: sha512-tXAqGsrDVhgCRpFePtaD9P4Z8Ro2SUQSL/4MIJBG0SxqQJaMslEbin8J53OaFwEBu6e7JxFaIF6s4mw9+8acAQ==}
 
-@@ -14929,8 +14923,6 @@ snapshots:
+@@ -14990,8 +14984,6 @@ snapshots:
 
   emittery@0.13.1: {}
 
@ -90,14 +97,42 @@ index ba2f205..705e454 100644
   emoji-datasource@15.1.2: {}
 
   emoji-regex@10.4.0: {}
-diff --git a/ts/components/conversation/Emojify.tsx b/ts/components/conversation/Emojify.tsx
-index f0b1115..7613230 100644
--- a/ts/components/conversation/Emojify.tsx
-+++ b/ts/components/conversation/Emojify.tsx
-@@ -35,8 +35,15 @@ function getImageTag({
-   }
+diff --git a/stylesheets/components/fun/FunEmoji.scss b/stylesheets/components/fun/FunEmoji.scss
+index 78c7563..83d196c 100644
+--- a/stylesheets/components/fun/FunEmoji.scss
+++ b/stylesheets/components/fun/FunEmoji.scss
+@@ -5,19 +5,9 @@
+ $emoji-sprite-sheet-grid-item-count: 62;
 
-   let srcSet: string | undefined;
+ @mixin emoji-sprite($sheet, $margin, $scale) {
+-  $size: calc($sheet * 1px * $scale);
+-  $margin-start: calc($margin * $scale);
+-  $margin-end: calc($margin * $scale);
+-  $size-outer: calc($size + $margin-start + $margin-end);
+-  $image: url('../images/emoji-sheet-#{$sheet}.webp');
+-  background-image: $image;
+-  background-size: calc($size-outer * $emoji-sprite-sheet-grid-item-count);
+-  background-position-x: calc(
+-    var(--fun-emoji-sheet-x) * ($size-outer * -1) + ($margin-start * -1)
+-  );
+-  background-position-y: calc(
+-    var(--fun-emoji-sheet-y) * ($size-outer * -1) + ($margin-start * -1)
+-  );
+  background-image: var(--fun-emoji-jumbo-image);
+  background-size: contain;
+  background-position: center;
+   background-repeat: no-repeat;
+ }
+ 
+diff --git a/ts/components/fun/FunEmoji.tsx b/ts/components/fun/FunEmoji.tsx
+index 08785e8..d25b868 100644
+--- a/ts/components/fun/FunEmoji.tsx
+++ b/ts/components/fun/FunEmoji.tsx
+@@ -10,7 +10,14 @@ export const FUN_STATIC_EMOJI_CLASS = 'FunStaticEmoji';
+ export const FUN_INLINE_EMOJI_CLASS = 'FunInlineEmoji';
+ 
+ function getEmojiJumboUrl(emoji: EmojiVariantData): string {
+-  return `emoji://jumbo?emoji=${encodeURIComponent(emoji.value)}`;
 +  const emojiToNotoName = (emoji: string): string =>
 +    `emoji_u${
 +      [...emoji]
@ -105,25 +140,7 @@ index f0b1115..7613230 100644
 +        .map(c => c.codePointAt(0)?.toString(16).padStart(4, "0"))
 +        .join("_")
 +    }.png`;
-   if (sizeClass != null && JUMBO_SIZES.has(sizeClass)) {
-    srcSet = `emoji://jumbo?emoji=${encodeURIComponent(match)} 2x, ${img}`;
-+    srcSet = `file://@noto-emoji-pngs@/${emojiToNotoName(match)} 2x, ${img}`;
-   }
+  return `file://@noto-emoji-pngs@/${emojiToNotoName(emoji.value)}`;
+ }
 
-   return (
-diff --git a/ts/components/emoji/lib.ts b/ts/components/emoji/lib.ts
-index 9753017..cf51d3d 100644
--- a/ts/components/emoji/lib.ts
-+++ b/ts/components/emoji/lib.ts
-@@ -102,7 +102,10 @@ const ROOT_PATH = get(
- );
- 
- const makeImagePath = (src: string) => {
-  return `${ROOT_PATH}node_modules/emoji-datasource-apple/img/apple/64/${src}`;
-+  const datasourceToNoto = (name: string): string =>
-+    `emoji_u${name.slice(0,-4).split("-").filter(c => c != "fe0f").join("_")}.png`;
-+
-+  return `@noto-emoji-pngs@/${datasourceToNoto(src)}`;
- };
- 
- const imageQueue = new PQueue({
+ export type FunStaticEmojiSize =
--- a/pkgs/by-name/si/signal-desktop-source/ringrtc-bin.nix
+++ b/pkgs/by-name/si/signal-desktop-source/ringrtc-bin.nix
@ -0,0 +1,27 @@
+{
+  stdenv,
+  lib,
+  fetchzip,
+  autoPatchelfHook,
+  libpulseaudio,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ringrtc-bin";
+  version = "2.50.3";
+  src = fetchzip {
+    url = "https://build-artifacts.signal.org/libraries/ringrtc-desktop-build-v${finalAttrs.version}.tar.gz";
+    hash = "sha256-UJqH/UiT9j36r6fr673CP/Z4lGaSPXIzAkf72YZfExo=";
+  };
+
+  installPhase = ''
+    cp -r . $out
+  '';
+
+  nativeBuildInputs = [ autoPatchelfHook ];
+  buildInputs = [ libpulseaudio ];
+  meta = {
+    homepage = "https://github.com/signalapp/ringrtc";
+    license = lib.licenses.agpl3Only;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
--- a/pkgs/by-name/si/signal-desktop-source/sqlcipher-signal-extension.nix
+++ b/pkgs/by-name/si/signal-desktop-source/sqlcipher-signal-extension.nix
@ -1,105 +0,0 @@
-{
-  rustPlatform,
-  lib,
-  fetchFromGitHub,
-  sqlcipher,
-  fetchpatch,
-  stdenv,
-  openssl,
-  tcl,
-  buildEnv,
-  rust-cbindgen,
-}:
-let
-  signal-sqlcipher-extension = rustPlatform.buildRustPackage (finalAttrs: {
-    pname = "signal-sqlcipher-extension";
-    version = "0.2.1";
-
-    src = fetchFromGitHub {
-      owner = "signalapp";
-      repo = "Signal-Sqlcipher-Extension";
-      tag = "v${finalAttrs.version}";
-      hash = "sha256-INSkm7ZuetPASuIqezzzG/bXoEHClUb9XpxWbxLVXRc=";
-    };
-    useFetchCargoVendor = true;
-    cargoHash = "sha256-qT4HM/FRL8qugKKNlMYM/0zgUsC6cDOa9fgd1d4VIrc=";
-
-    meta = {
-      description = "SQLite extension used by Signal Desktop";
-      homepage = "https://github.com/signalapp/Signal-Sqlcipher-Extension";
-      license = lib.licenses.agpl3Only;
-      maintainers = with lib.maintainers; [ marcin-serwin ];
-      platforms = lib.platforms.all;
-    };
-  });
-
-  sqlcipher-amalgamation = stdenv.mkDerivation {
-    pname = "sqlcipher-with-signal-extension";
-
-    inherit (sqlcipher) version src meta;
-
-    patches = [
-      (fetchpatch {
-        # https://github.com/sqlcipher/sqlcipher/pull/529
-        name = "custom-crypto-provider.patch";
-        url = "https://github.com/sqlcipher/sqlcipher/commit/0e3b20c155df8a2943b62a9f3cc0f4d3dba9e152.patch";
-        hash = "sha256-OKh6qCGHBQWZyzXfyEveAs71wrNwlWLuG9jNqDeKNG4=";
-      })
-    ];
-
-    nativeBuildInputs = [ tcl ];
-
-    buildInputs = [ openssl ];
-
-    CFLAGS = [ "-DSQLITE_ENABLE_UPDATE_DELETE_LIMIT=1" ];
-
-    makeFlags = [ "sqlite3.c" ];
-
-    installPhase = ''
-      install -Dm644 sqlite3.c $out/src/sqlite3.c
-      install -Dm644 sqlite3.h $out/include/sqlite3.h
-      install -Dm644 sqlite3ext.h $out/include/sqlite3ext.h
-    '';
-  };
-
-  signal-tokenizer-headers = rustPlatform.buildRustPackage (finalAttrs: {
-    pname = "Signal-FTS5-Extension";
-    version = "0.2.1";
-
-    src = fetchFromGitHub {
-      owner = "signalapp";
-      repo = "Signal-FTS5-Extension";
-      tag = "v${finalAttrs.version}";
-      hash = "sha256-MzgdRuRsfL3yhlVU0RAAUtAaOukMpqSSa42nRYhpmh0=";
-    };
-    useFetchCargoVendor = true;
-    cargoHash = "sha256-0DDX3ciXk5/3MqsHzxV8s4qEhqYmrwGg7cSbrkFRZbw=";
-
-    nativeBuildInputs = [ rust-cbindgen ];
-
-    buildPhase = ''
-      cbindgen --profile release . -o signal-tokenizer.h
-    '';
-    installPhase = ''
-      install -Dm644 signal-tokenizer.h $out/include/signal-tokenizer.h
-    '';
-    doCheck = false;
-  });
-
-in
-buildEnv {
-  name = "sqlcipher-signal";
-
-  paths = [
-    sqlcipher-amalgamation
-    signal-tokenizer-headers
-    signal-sqlcipher-extension
-  ];
-
-  postBuild = ''
-    install -Dm644 ${./sqlite3.gyp} $out/share/sqlite3.gyp
-    substituteInPlace $out/share/sqlite3.gyp \
-      --replace-fail "@extension@" "$out" \
-      --replace-fail "@static_lib_ext@" "${stdenv.hostPlatform.extensions.staticLibrary}"
-  '';
-}
--- a/pkgs/by-name/si/signal-desktop-source/update.sh
+++ b/pkgs/by-name/si/signal-desktop-source/update.sh
@ -0,0 +1,47 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bash nix-update common-updater-scripts curl coreutils jq
+
+set -ex
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
+
+curl_github() {
+  curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} "$@"
+}
+
+releaseInfo="`curl_github \
+  "https://api.github.com/repos/signalapp/Signal-Desktop/releases/latest"`"
+
+releaseTag="`jq -r ".tag_name" <<< $releaseInfo`"
+releaseDate="`jq -r ".created_at" <<< $releaseInfo`"
+releaseEpoch=`date -d $releaseDate +%s`
+
+packageJson="`curl_github "https://raw.githubusercontent.com/signalapp/Signal-Desktop/refs/tags/$releaseTag/package.json"`"
+
+latestVersion="`jq -r '.version' <<< $packageJson`"
+nodeVersion="`jq -r '.engines.node' <<< $packageJson | head -c2`"
+electronVersion="`jq -r '.devDependencies.electron' <<< $packageJson | head -c2`"
+libsignalClientVersion=`jq -r '.dependencies."@signalapp/libsignal-client"' <<< $packageJson`
+ringrtcVersion=`jq -r '.dependencies."@signalapp/ringrtc"' <<< $packageJson`
+
+sed -E -i "s/(nodejs_)../\1$nodeVersion/" $SCRIPT_DIR/package.nix
+sed -E -i "s/(electron_)../\1$electronVersion/" $SCRIPT_DIR/package.nix
+sed -E -i "s/(SOURCE_DATE_EPOCH = )[0-9]+/\1$releaseEpoch/" $SCRIPT_DIR/package.nix
+
+sed -E -i "s/(withAppleEmojis \? )false/\1true/" $SCRIPT_DIR/package.nix
+nix-update signal-desktop-source --subpackage sticker-creator --version="$latestVersion"
+sed -E -i "s/(withAppleEmojis \? )true/\1false/" $SCRIPT_DIR/package.nix
+update-source-version signal-desktop-source \
+  --ignore-same-version \
+  --source-key=pnpmDeps
+
+update-source-version signal-desktop-source.libsignal-node \
+  "$libsignalClientVersion"
+update-source-version signal-desktop-source.libsignal-node \
+  --ignore-same-version \
+  --source-key=cargoDeps.vendorStaging
+update-source-version signal-desktop-source.libsignal-node \
+  --ignore-same-version \
+  --source-key=npmDeps
+
+update-source-version signal-desktop-source.ringrtc-bin "$ringrtcVersion"
--- a/pkgs/by-name/si/signalbackup-tools/package.nix
+++ b/pkgs/by-name/si/signalbackup-tools/package.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "signalbackup-tools";
-  version = "20250331-1";
+  version = "20250406-1";

  src = fetchFromGitHub {
    owner = "bepaald";
    repo = "signalbackup-tools";
    rev = version;
-    hash = "sha256-MrpHGSuV5HhZuwCC8E1konE3DhyK/hv6m6Mt+Wx3JT4=";
+    hash = "sha256-PdbZxDmaM1kdc5IHkWf8RcJcT5cmfRAvUl76VYnqFXc=";
  };

  nativeBuildInputs =
--- a/pkgs/by-name/si/siril/package.nix
+++ b/pkgs/by-name/si/siril/package.nix
@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
  src = fetchFromGitLab {
    owner = "free-astro";
    repo = "siril";
-    tag = "${finalAttrs.version}";
+    tag = finalAttrs.version;
    hash = "sha256-pSJp4Oj8x4pKuwPSaSyGbyGfpnanoWBxAdXtzGTP7uA=";
  };

--- a/pkgs/by-name/su/sudo-rs/package.nix
+++ b/pkgs/by-name/su/sudo-rs/package.nix
@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "sudo-rs";
-  version = "0.2.4";
+  version = "0.2.5";

  src = fetchFromGitHub {
    owner = "trifectatechfoundation";
    repo = "sudo-rs";
    rev = "v${version}";
-    hash = "sha256-jzK/AkBtS2XxxRaSYk5wsaj1IbLlcqyyMk3AqambkKs=";
+    hash = "sha256-apvMcn/1dV9uujyoHikiOxregwWtAFPvrZvYjd3XQwM=";
  };
  useFetchCargoVendor = true;
-  cargoHash = "sha256-0NzHmpf/0YwtgVPkhMpBqxuQQAmKghZ5cZbIr5taM4o=";
+  cargoHash = "sha256-EAfNg7hUsynFZ+EcUqeD9o44BakBYIMgxRXc4vcl8HY=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/by-name/su/sunshine/package.nix
+++ b/pkgs/by-name/su/sunshine/package.nix
@ -47,6 +47,7 @@
  miniupnpc,
  nlohmann_json,
  config,
+  coreutils,
  cudaSupport ? config.cudaSupport,
  cudaPackages ? { },
 }:
@ -200,7 +201,8 @@ stdenv'.mkDerivation rec {

    substituteInPlace packaging/linux/sunshine.service.in \
      --subst-var-by PROJECT_DESCRIPTION 'Self-hosted game stream host for Moonlight' \
-      --subst-var-by SUNSHINE_EXECUTABLE_PATH $out/bin/sunshine
+      --subst-var-by SUNSHINE_EXECUTABLE_PATH $out/bin/sunshine \
+      --replace-fail '/bin/sleep' '${lib.getExe' coreutils "sleep"}'
  '';

  preBuild = ''
--- a/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix
+++ b/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix
@ -1,23 +1,23 @@
 {
-  version = "1.21.0";
+  version = "1.22.0";

  x86_64-linux = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.21.0/linux/amd64/sysdig-cli-scanner";
-    hash = "sha256-QFI6mXrI6TXRVgjYyKhMIT4EAZzKdH4aWvRkURSHN6c=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.22.0/linux/amd64/sysdig-cli-scanner";
+    hash = "sha256-qGbQRiUvoynxUeYSmjrz5r9bunthcmQWDzLtTqPu4IU=";
  };

  aarch64-linux = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.21.0/linux/arm64/sysdig-cli-scanner";
-    hash = "sha256-JsGbIZkwOSTJ3kDg3yxaHMVeH5ZCx49iAvMYkiP0iYI=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.22.0/linux/arm64/sysdig-cli-scanner";
+    hash = "sha256-bfY5FRPU7rEVN0o/nf39q8qFP7zgffoEX1iPXbZ22pw=";
  };

  x86_64-darwin = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.21.0/darwin/amd64/sysdig-cli-scanner";
-    hash = "sha256-CQVmeZK2+Ezba7v6FURh5DPCqDxXYR62O+xw4gAzj6M=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.22.0/darwin/amd64/sysdig-cli-scanner";
+    hash = "sha256-F5br4BJnB9yRWfpqEJgy79csjfYY/St1a/rPGXdvj6A=";
  };

  aarch64-darwin = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.21.0/darwin/arm64/sysdig-cli-scanner";
-    hash = "sha256-F/FBkqsS7RCVktxwHJhiP7uS5XAW53BJjlRsLQ4DWAc=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.22.0/darwin/arm64/sysdig-cli-scanner";
+    hash = "sha256-CsMZ8m9eJNcOxq77IVLuW1COOa2+mABoMGJ+xk/NARI=";
  };
 }
--- a/pkgs/by-name/te/terragrunt/package.nix
+++ b/pkgs/by-name/te/terragrunt/package.nix
@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "terragrunt";
-  version = "0.76.6";
+  version = "0.77.7";

  src = fetchFromGitHub {
    owner = "gruntwork-io";
    repo = pname;
    tag = "v${version}";
-    hash = "sha256-xhJUkjdMkOI8E7HxazBfl05FF0XzwlFsEgW+WEv0EGg=";
+    hash = "sha256-LP6qy0IAO/vD4eDTX6bgUe5mpL3ao+R4wwVNjBsaXhI=";
  };

  nativeBuildInputs = [
@ -26,7 +26,7 @@ buildGoModule rec {
    make generate-mocks
  '';

-  vendorHash = "sha256-sPgA1LMbYMcrlN+4no3DhJ0TVMEnGEgGhQMy+g0nrtg=";
+  vendorHash = "sha256-dxpb3tzVBlsZM6kAEvCVWxXVsuh6fkfxz0GpArtAi7g=";

  doCheck = false;

--- a/pkgs/by-name/th/theforceengine/package.nix
+++ b/pkgs/by-name/th/theforceengine/package.nix
@ -22,13 +22,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "theforceengine";
-  version = "1.22.200";
+  version = "1.22.300";

  src = fetchFromGitHub {
    owner = "luciusDXL";
    repo = "TheForceEngine";
    rev = "v${version}";
-    hash = "sha256-Mvp9VrPk36wNTUwNQT83JPOEO72Xhqmhkn3/KfZhQX4=";
+    hash = "sha256-m/VNlcuvpJkcfTpL97gCUTQtdAWqimVrhU0qLj0Erck=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/tr/trunk/package.nix
+++ b/pkgs/by-name/tr/trunk/package.nix
@ -8,13 +8,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "trunk";
-  version = "0.21.9";
+  version = "0.21.12";

  src = fetchFromGitHub {
    owner = "trunk-rs";
    repo = "trunk";
    rev = "v${version}";
-    hash = "sha256-+HKEaXdGW3F5DCvyvQalr65+BZv+NA2r34MSvPwlhac=";
+    hash = "sha256-GFRNbrfI0sJ/GuvT924/gxmzbnf0s0QNf+Mpv1+5rbc=";
  };

  nativeBuildInputs = [ pkg-config ];
@ -23,7 +23,7 @@ rustPlatform.buildRustPackage rec {
  checkFlags = [ "--skip=tools::tests::download_and_install_binaries" ];

  useFetchCargoVendor = true;
-  cargoHash = "sha256-xaL7gF9gWRn0geKIUwksDovaIHMqfl57O9GvHOjgsic=";
+  cargoHash = "sha256-XQyHGavGUnWCTim2jC+kKKNYaWzwXg0slXxABSrKqJg=";

  meta = with lib; {
    homepage = "https://github.com/trunk-rs/trunk";
--- a/pkgs/by-name/up/upbound/sources-main.json
+++ b/pkgs/by-name/up/upbound/sources-main.json
@ -8,38 +8,38 @@
  "fetchurlAttrSet": {
    "docker-credential-up": {
      "aarch64-darwin": {
-        "hash": "sha256-AYOZmdNaiGZLwvbyl6DaubWyXDqZcSbWP1/jJ3Idx6Q=",
-        "url": "https://cli.upbound.io/main/v0.39.0-0.rc.0.249.g7b07f31c/bundle/docker-credential-up/darwin_arm64.tar.gz"
+        "hash": "sha256-UT2zZNvgRKhntFAYnGFxth3bdpSdeVa1BFVRFlz4KTk=",
+        "url": "https://cli.upbound.io/main/v0.39.0-0.rc.0.301.gaa3d1f39/bundle/docker-credential-up/darwin_arm64.tar.gz"
      },
      "aarch64-linux": {
-        "hash": "sha256-r4chc5wMENvoEHtSIGw1fSys6ixZmg1WqfR+0ovdCDg=",
-        "url": "https://cli.upbound.io/main/v0.39.0-0.rc.0.249.g7b07f31c/bundle/docker-credential-up/linux_arm64.tar.gz"
+        "hash": "sha256-KugJ8I6fpWLovBhfnnGBq+OgwGOi7VbWx+MhuwqEFKU=",
+        "url": "https://cli.upbound.io/main/v0.39.0-0.rc.0.301.gaa3d1f39/bundle/docker-credential-up/linux_arm64.tar.gz"
      },
      "x86_64-darwin": {
-        "hash": "sha256-x4b3j1fyS3P5ouJTDovgJcZVaNzxvqiZn++p5d6WDRI=",
-        "url": "https://cli.upbound.io/main/v0.39.0-0.rc.0.249.g7b07f31c/bundle/docker-credential-up/darwin_amd64.tar.gz"
+        "hash": "sha256-PCd4qBLAktUNlGWtfJyT2P2mzteyhbLODhaharEHyhs=",
+        "url": "https://cli.upbound.io/main/v0.39.0-0.rc.0.301.gaa3d1f39/bundle/docker-credential-up/darwin_amd64.tar.gz"
      },
      "x86_64-linux": {
-        "hash": "sha256-uZPfsXNz3Z0cdBV9hJ4x7HPSXFVDiXqDf/NA1CMBa/M=",
-        "url": "https://cli.upbound.io/main/v0.39.0-0.rc.0.249.g7b07f31c/bundle/docker-credential-up/linux_amd64.tar.gz"
+        "hash": "sha256-lBvQ+37tQqGLwbSihZlY4egzr+4GyoOYfGEyxSnP8cU=",
+        "url": "https://cli.upbound.io/main/v0.39.0-0.rc.0.301.gaa3d1f39/bundle/docker-credential-up/linux_amd64.tar.gz"
      }
    },
    "up": {
      "aarch64-darwin": {
-        "hash": "sha256-CcJi11DZivlcelg6nKYUyWstTUqQ6r9EIt6dhWI3fbQ=",
-        "url": "https://cli.upbound.io/main/v0.39.0-0.rc.0.249.g7b07f31c/bundle/up/darwin_arm64.tar.gz"
+        "hash": "sha256-Fw6ucwazCy3VSTJ4vCFRQthp33dpbznqOfUq2UVBQHE=",
+        "url": "https://cli.upbound.io/main/v0.39.0-0.rc.0.301.gaa3d1f39/bundle/up/darwin_arm64.tar.gz"
      },
      "aarch64-linux": {
-        "hash": "sha256-QKdkDzoVzxbO677nl8tMoJA4/oqV4V8/h72HikOzxTc=",
-        "url": "https://cli.upbound.io/main/v0.39.0-0.rc.0.249.g7b07f31c/bundle/up/linux_arm64.tar.gz"
+        "hash": "sha256-OEo0HvcsOH1hCz/cCMDoEhJO0mYKQd2gmFaHMztSvM8=",
+        "url": "https://cli.upbound.io/main/v0.39.0-0.rc.0.301.gaa3d1f39/bundle/up/linux_arm64.tar.gz"
      },
      "x86_64-darwin": {
-        "hash": "sha256-xfvMty4OkVFG+UkIfOgD6ZOOXILbPGTjApKH0oJKsKY=",
-        "url": "https://cli.upbound.io/main/v0.39.0-0.rc.0.249.g7b07f31c/bundle/up/darwin_amd64.tar.gz"
+        "hash": "sha256-S+hdh01O+lit/1AJz95mbZJugujRxwpxPlOjRpHAzj0=",
+        "url": "https://cli.upbound.io/main/v0.39.0-0.rc.0.301.gaa3d1f39/bundle/up/darwin_amd64.tar.gz"
      },
      "x86_64-linux": {
-        "hash": "sha256-/5/+dPh6V/69RrqPj/0D4bECX2/2pqQJjo/dNgi/EgE=",
-        "url": "https://cli.upbound.io/main/v0.39.0-0.rc.0.249.g7b07f31c/bundle/up/linux_amd64.tar.gz"
+        "hash": "sha256-l4Wz8Frj/3wmCKKwSy+jMklRJrw+Ca/YD6VApE5795k=",
+        "url": "https://cli.upbound.io/main/v0.39.0-0.rc.0.301.gaa3d1f39/bundle/up/linux_amd64.tar.gz"
      }
    }
  },
@ -49,5 +49,5 @@
    "x86_64-darwin",
    "x86_64-linux"
  ],
-  "version": "0.39.0-0.rc.0.249.g7b07f31c"
+  "version": "0.39.0-0.rc.0.301.gaa3d1f39"
 }
--- a/pkgs/by-name/uu/uutils-findutils/package.nix
+++ b/pkgs/by-name/uu/uutils-findutils/package.nix
@ -8,17 +8,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "uutils-findutils";
-  version = "0.7.0";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "uutils";
    repo = "findutils";
    tag = finalAttrs.version;
-    hash = "sha256-EEyrXG9jybtYoBvjiXTCNg6/1WPchEGJcldB6Gqgmdc=";
+    hash = "sha256-i+ryTF2hlZFbyFft/769c800FkzL26E4snUsxU79sKY=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-nZOa7O0S9ykFM9sH6aqlAPtv3hWKF/vAXZYNRnjcOj4=";
+  cargoHash = "sha256-gtaD2jqnGhoJGw9FAJefnU9BSGIODi/RrhTeB3MC69U=";

  postInstall = ''
    rm $out/bin/testing-commandline
--- a/pkgs/by-name/ux/uxn/package.nix
+++ b/pkgs/by-name/ux/uxn/package.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "uxn";
-  version = "1.0-unstable-2025-03-14";
+  version = "1.0-unstable-2025-04-04";

  src = fetchFromSourcehut {
    owner = "~rabbits";
    repo = "uxn";
-    rev = "7bdf99afc4748ed5c1f1b356fdff488164111d1e";
-    hash = "sha256-OZo7e7M7MVkkT+SW13IOmQp6PyN6/LDqQ8fe+oc71i0=";
+    rev = "289a265c4186e84308d817f5b34086853d816fd4";
+    hash = "sha256-ctjZx9IvLPEIgX9o0ZLcOW//wbGDA3YjRxg+lMdaSHs=";
  };

  outputs = [
--- a/pkgs/by-name/vo/voms/package.nix
+++ b/pkgs/by-name/vo/voms/package.nix
@ -21,13 +21,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "voms";
-  version = "2.1.0";
+  version = "2.1.2";

  src = fetchFromGitHub {
    owner = "italiangrid";
    repo = "voms";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-Xz9+NYaSZsVuoIbyuejVWmwEmsPmMVtBAD94/SXP8ag=";
+    hash = "sha256-ipNgx87M/NNvAaeUf30nUDmf4Q9k5zakkgMk4/1N6VM=";
  };

  passthru = {
--- a/pkgs/by-name/ya/yandex-cloud/sources.json
+++ b/pkgs/by-name/ya/yandex-cloud/sources.json
@ -1,25 +1,25 @@
 {
-  "version": "0.145.0",
+  "version": "0.146.1",
  "binaries": {
    "aarch64-darwin": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.145.0/darwin/arm64/yc",
-      "hash": "sha256-TYceYoir13NUvvxwhAdLrVpiJ1DgYCq5bE/GS9eNJTo="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.146.1/darwin/arm64/yc",
+      "hash": "sha256-CB8TjVYK7BvfMxGa/i4/Nx/6CDVEO942yC+FvSGPVdQ="
    },
    "aarch64-linux": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.145.0/linux/arm64/yc",
-      "hash": "sha256-7Y//gt9vLAubd/LPgbMafSEC/Qz9vXK6m3NSMysF1/Q="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.146.1/linux/arm64/yc",
+      "hash": "sha256-Lftf19hdhw/vulo3jwMxfoIWkGrKZIFh8GmslLXzUng="
    },
    "i686-linux": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.145.0/linux/386/yc",
-      "hash": "sha256-ykLtSuAdMpR+c5gu3L5iO9AZlw4NrsV8TPGdkHsDQ/4="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.146.1/linux/386/yc",
+      "hash": "sha256-2RQHVU7uglR7FQDJQQ5KnFkNtVsMeO9RAH1g0OX28vQ="
    },
    "x86_64-darwin": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.145.0/darwin/amd64/yc",
-      "hash": "sha256-TlgK5RK6u94N/IsMEsL1+57cMx9d/MokLJrfXPpMEPk="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.146.1/darwin/amd64/yc",
+      "hash": "sha256-Qvp3HiHlg6ddReTFRSpc2MDQgnwcQohF1ugFhzWR0os="
    },
    "x86_64-linux": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.145.0/linux/amd64/yc",
-      "hash": "sha256-bOY5908sOHjZN0L6aF/YXVHoS8r/W82nRg/2FFtjibI="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.146.1/linux/amd64/yc",
+      "hash": "sha256-yHl67bzX4HKcaaAH2dRNI6+bWfvM90Zkh/qkXC3Cw14="
    }
  }
 }
--- a/Show more
+++ b/Show more