Merge eac5f2caf9 into haskell-updates

2025-07-14 06:00:33 +03:00 · 2025-01-22 00:17:53 +00:00 · 2025-01-22 00:17:53 +00:00 · 8ecec07c55
commit 8ecec07c55
parent c6b77e0168 eac5f2caf9
208 changed files with 4338 additions and 7292 deletions
--- a/.git-blame-ignore-revs
+++ b/.git-blame-ignore-revs
@ -1,5 +1,11 @@
 # This file contains a list of commits that are not likely what you
 # are looking for in a blame, such as mass reformatting or renaming.
+#
+# If a commit's line ends with `# !autorebase <command>`,
+# where <command> is an idempotent bash command that reapplies the changes from the commit,
+# the `maintainers/scripts/auto-rebase/run.sh` script can be used to rebase
+# across that commit while automatically resolving merge conflicts caused by the commit.
+#
 # You can set this file as a default ignore file for blame by running
 # the following command.
 #
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -2792,6 +2792,12 @@
    githubId = 29384538;
    keys = [ { fingerprint = "D35E C9CE E631 638F F1D8  B401 6F0E 410D C3EE D02"; } ];
  };
+  bengsparks = {
+    email = "benjamin.sparks@protonmail.com";
+    github = "bengsparks";
+    githubId = 4313548;
+    name = "Ben Sparks";
+  };
  benhiemer = {
    name = "Benedikt Hiemer";
    email = "ben.email@posteo.de";
@ -5821,6 +5827,8 @@
  };
  DimitarNestorov = {
    name = "Dimitar Nestorov";
+    email = "nix@dimitarnestorov.com";
+    matrix = "@dimitarnestorov:matrix.org";
    github = "DimitarNestorov";
    githubId = 8790386;
  };
@ -10792,6 +10800,12 @@
    githubId = 1476865;
    name = "jigglycrumb";
  };
+  jinser = {
+    name = "Jinser Kafka";
+    email = "aimer@purejs.icu";
+    github = "jetjinser";
+    githubId = 46820840;
+  };
  jiriks74 = {
    name = "Jiří Štefka";
    email = "jiri@stefka.eu";
@ -22909,6 +22923,13 @@
    name = "Rouven Seifert";
    keys = [ { fingerprint = "1169 87A8 DD3F 78FF 8601  BF4D B95E 8FE6 B11C 4D09"; } ];
  };
+  theredstonedev = {
+    email = "theredstonedev@devellight.space";
+    matrix = "@theredstonedev_de:matrix.devellight.space";
+    github = "TheRedstoneDEV-DE";
+    githubId = 75328096;
+    name = "Robert Richter";
+  };
  therishidesai = {
    email = "desai.rishi1@gmail.com";
    github = "therishidesai";
--- a/maintainers/scripts/auto-rebase/README.md
+++ b/maintainers/scripts/auto-rebase/README.md
@ -0,0 +1,16 @@
+# Auto rebase script
+
+The [`./run.sh` script](./run.sh) in this directory rebases the current branch onto a target branch,
+while automatically resolving merge conflicts caused by marked commits in [`.git-blame-ignore-revs`](../../../.git-blame-ignore-revs).
+See the header comment of that file to understand how to mark commits.
+
+This is convenient for resolving merge conflicts for pull requests after e.g. treewide reformats.
+
+## Testing
+
+To run the tests in the [test directory](./test):
+```
+$ cd test
+$ nix-shell
+nix-shell> ./run.sh
+```
--- a/maintainers/scripts/auto-rebase/run.sh
+++ b/maintainers/scripts/auto-rebase/run.sh
@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if (( $# < 1 )); then
+    echo "Usage: $0 TARGET_BRANCH"
+    echo ""
+    echo "TARGET_BRANCH: Branch to rebase the current branch onto, e.g. master or release-24.11"
+    exit 1
+fi
+
+targetBranch=$1
+
+# Loop through all autorebase-able commits in .git-blame-ignore-revs on the base branch
+readarray -t autoLines < <(
+  git show "$targetBranch":.git-blame-ignore-revs \
+      | sed -n 's/^\([0-9a-f]\+\).*!autorebase \(.*\)$/\1 \2/p'
+)
+for line in "${autoLines[@]}"; do
+    read -r autoCommit autoCmd <<< "$line"
+
+    if ! git cat-file -e "$autoCommit"; then
+        echo "Not a valid commit: $autoCommit"
+        exit 1
+    elif git merge-base --is-ancestor "$autoCommit" HEAD; then
+        # Skip commits that we have already
+        continue
+    fi
+
+    echo -e "\e[32mAuto-rebasing commit $autoCommit with command '$autoCmd'\e[0m"
+
+    # The commit before the commit
+    parent=$(git rev-parse "$autoCommit"~)
+
+    echo "Rebasing on top of the previous commit, might need to manually resolve conflicts"
+    if ! git rebase --onto "$parent" "$(git merge-base "$targetBranch" HEAD)"; then
+      echo -e "\e[33m\e[1mRestart this script after resolving the merge conflict as described above\e[0m"
+      exit 1
+    fi
+
+    echo "Reapplying the commit on each commit of our branch"
+    # This does two things:
+    # - The parent filter inserts the auto commit between its parent and
+    #   and our first commit. By itself, this causes our first commit to
+    #   effectively "undo" the auto commit, since the tree of our first
+    #   commit is unchanged. This is why the following is also necessary:
+    # - The tree filter runs the command on each of our own commits,
+    #   effectively reapplying it.
+    FILTER_BRANCH_SQUELCH_WARNING=1 git filter-branch \
+        --parent-filter "sed 's/$parent/$autoCommit/'" \
+        --tree-filter "$autoCmd" \
+        "$autoCommit"..HEAD
+
+    # A tempting alternative is something along the lines of
+    #   git rebase --strategy-option=theirs --onto "$rev" "$parent" \
+    #     --exec '$autoCmd && git commit --all --amend --no-edit' \
+    # but this causes problems because merges are not guaranteed to maintain the formatting.
+    # The ./test.sh exercises such a case.
+done
+
+echo "Rebasing on top of the latest target branch commit"
+git rebase --onto "$targetBranch" "$(git merge-base "$targetBranch" HEAD)"
--- a/maintainers/scripts/auto-rebase/test/default.nix
+++ b/maintainers/scripts/auto-rebase/test/default.nix
@ -0,0 +1,46 @@
+let
+  pkgs = import ../../../.. {
+    config = { };
+    overlays = [ ];
+  };
+
+  inherit (pkgs)
+    lib
+    stdenvNoCC
+    gitMinimal
+    treefmt
+    nixfmt-rfc-style
+    ;
+in
+
+stdenvNoCC.mkDerivation {
+  name = "test";
+  src = lib.fileset.toSource {
+    root = ./..;
+    fileset = lib.fileset.unions [
+      ../run.sh
+      ./run.sh
+      ./first.diff
+      ./second.diff
+    ];
+  };
+  nativeBuildInputs = [
+    gitMinimal
+    treefmt
+    nixfmt-rfc-style
+  ];
+  patchPhase = ''
+    patchShebangs .
+  '';
+
+  buildPhase = ''
+    export HOME=$(mktemp -d)
+    export PAGER=true
+    git config --global user.email "Your Name"
+    git config --global user.name "your.name@example.com"
+    ./test/run.sh
+  '';
+  installPhase = ''
+    touch $out
+  '';
+}
--- a/maintainers/scripts/auto-rebase/test/first.diff
+++ b/maintainers/scripts/auto-rebase/test/first.diff
@ -0,0 +1,11 @@
+diff --git a/b.nix b/b.nix
+index 9d18f25..67b0466 100644
+--- a/b.nix
+++ b/b.nix
+@@ -1,5 +1,5 @@
+ {
+   this = "is";
+ 
+-  some = "set";
+  some = "value";
+ }
--- a/maintainers/scripts/auto-rebase/test/run.sh
+++ b/maintainers/scripts/auto-rebase/test/run.sh
@ -0,0 +1,112 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# https://stackoverflow.com/a/246128/6605742
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+
+# Allows using a local directory for temporary files,
+# which can then be inspected after the run
+if (( $# > 0 )); then
+    tmp=$(realpath "$1/tmp")
+    if [[ -e "$tmp" ]]; then
+        rm -rf "$tmp"
+    fi
+    mkdir -p "$tmp"
+else
+    tmp=$(mktemp -d)
+    trap 'rm -rf "$tmp"' exit
+fi
+
+# Tests a scenario where two poorly formatted files were modified on both the
+# main branch and the feature branch, while the main branch also did a treewide
+# format.
+
+git init "$tmp/repo"
+cd "$tmp/repo" || exit
+git branch -m main
+
+# Some initial poorly-formatted files
+cat > a.nix <<EOF
+{ x
+, y
+
+, z
+}:
+null
+EOF
+
+cat > b.nix <<EOF
+{
+  this = "is";
+
+
+  some="set" ;
+ }
+EOF
+
+git add -A
+git commit -m "init"
+
+git switch -c feature
+
+# Some changes
+sed 's/set/value/' -i b.nix
+git commit -a -m "change b"
+sed '/, y/d' -i a.nix
+git commit -a -m "change a"
+
+git switch main
+
+# A change to cause a merge conflict
+sed 's/y/why/' -i a.nix
+git commit -a -m "change a"
+
+cat > treefmt.toml <<EOF
+[formatter.nix]
+command = "nixfmt"
+includes = [ "*.nix" ]
+EOF
+git add -A
+git commit -a -m "introduce treefmt"
+
+# Treewide reformat
+treefmt
+git commit -a -m "format"
+
+echo "$(git rev-parse HEAD) # !autorebase treefmt" > .git-blame-ignore-revs
+git add -A
+git commit -a -m "update ignored revs"
+
+git switch feature
+
+# Setup complete
+
+git log --graph --oneline feature main
+
+# This expectedly fails with a merge conflict that has to be manually resolved
+"$SCRIPT_DIR"/../run.sh main && exit 1
+sed '/<<</,/>>>/d' -i a.nix
+git add a.nix
+GIT_EDITOR=true git rebase --continue
+
+"$SCRIPT_DIR"/../run.sh main
+
+git log --graph --oneline feature main
+
+checkDiff() {
+    local ref=$1
+    local file=$2
+    expectedDiff=$(cat "$file")
+    actualDiff=$(git diff "$ref"~ "$ref")
+    if [[ "$expectedDiff" != "$actualDiff" ]]; then
+        echo -e "Expected this diff:\n$expectedDiff"
+        echo -e "But got this diff:\n$actualDiff"
+        exit 1
+    fi
+}
+
+checkDiff HEAD~ "$SCRIPT_DIR"/first.diff
+checkDiff HEAD "$SCRIPT_DIR"/second.diff
+
+echo "Success!"
--- a/maintainers/scripts/auto-rebase/test/second.diff
+++ b/maintainers/scripts/auto-rebase/test/second.diff
@ -0,0 +1,11 @@
+diff --git a/a.nix b/a.nix
+index 18ba7ce..bcf38bc 100644
+--- a/a.nix
+++ b/a.nix
+@@ -1,6 +1,5 @@
+ {
+   x,
+-  why,
+ 
+   z,
+ }:
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@ -294,6 +294,8 @@

 - `matomo` now defaults to version 5 (previously available as `matomo_5`). Version 4 has been removed as it reached EOL on December 19, 2024.

+- `matomo-beta` has been removed as the version of the `matomo` package can now be easily overriden through `overrideAttrs` (see [PR #374022](https://github.com/NixOS/nixpkgs/pull/374022))
+
 - `docker_24` has been removed, as it was EOL with vulnerabilites since June 08, 2024.

 - `containerd` has been updated to v2, which contains breaking changes. See the [containerd
--- a/nixos/lib/test-driver/src/test_driver/machine.py
+++ b/nixos/lib/test-driver/src/test_driver/machine.py
@ -90,35 +90,79 @@ def make_command(args: list) -> str:
    return " ".join(map(shlex.quote, (map(str, args))))


+def _preprocess_screenshot(screenshot_path: str, negate: bool = False) -> str:
+    magick_args = [
+        "-filter",
+        "Catrom",
+        "-density",
+        "72",
+        "-resample",
+        "300",
+        "-contrast",
+        "-normalize",
+        "-despeckle",
+        "-type",
+        "grayscale",
+        "-sharpen",
+        "1",
+        "-posterize",
+        "3",
+        "-gamma",
+        "100",
+        "-blur",
+        "1x65535",
+    ]
+
+    out_file = screenshot_path
+
+    if negate:
+        magick_args.append("-negate")
+        out_file += ".negative"
+
+    out_file += ".png"
+
+    ret = subprocess.run(
+        ["magick", "convert"] + magick_args + [screenshot_path, out_file],
+        capture_output=True,
+    )
+
+    if ret.returncode != 0:
+        raise Exception(
+            f"Image processing failed with exit code {ret.returncode}, stdout: {ret.stdout.decode()}, stderr: {ret.stderr.decode()}"
+        )
+
+    return out_file
+
+
 def _perform_ocr_on_screenshot(
    screenshot_path: str, model_ids: Iterable[int]
 ) -> list[str]:
    if shutil.which("tesseract") is None:
        raise Exception("OCR requested but enableOCR is false")

-    magick_args = (
-        "-filter Catrom -density 72 -resample 300 "
-        + "-contrast -normalize -despeckle -type grayscale "
-        + "-sharpen 1 -posterize 3 -negate -gamma 100 "
-        + "-blur 1x65535"
-    )
-
-    tess_args = "-c debug_file=/dev/null --psm 11"
-
-    cmd = f"magick convert {magick_args} '{screenshot_path}' '{screenshot_path}.png'"
-    ret = subprocess.run(cmd, shell=True, capture_output=True)
-    if ret.returncode != 0:
-        raise Exception(
-            f"Image processing failed with exit code {ret.returncode}, stdout: {ret.stdout.decode()}, stderr: {ret.stderr.decode()}"
-        )
+    processed_image = _preprocess_screenshot(screenshot_path, negate=False)
+    processed_negative = _preprocess_screenshot(screenshot_path, negate=True)

    model_results = []
-    for model_id in model_ids:
-        cmd = f"tesseract '{screenshot_path}.png' - {tess_args} --oem '{model_id}'"
-        ret = subprocess.run(cmd, shell=True, capture_output=True)
-        if ret.returncode != 0:
-            raise Exception(f"OCR failed with exit code {ret.returncode}")
-        model_results.append(ret.stdout.decode("utf-8"))
+    for image in [screenshot_path, processed_image, processed_negative]:
+        for model_id in model_ids:
+            ret = subprocess.run(
+                [
+                    "tesseract",
+                    image,
+                    "-",
+                    "--oem",
+                    str(model_id),
+                    "-c",
+                    "debug_file=/dev/null",
+                    "--psm",
+                    "11",
+                ],
+                capture_output=True,
+            )
+            if ret.returncode != 0:
+                raise Exception(f"OCR failed with exit code {ret.returncode}")
+            model_results.append(ret.stdout.decode("utf-8"))

    return model_results

--- a/nixos/modules/services/mail/public-inbox.nix
+++ b/nixos/modules/services/mail/public-inbox.nix
@ -81,6 +81,10 @@ let
            "${config.i18n.glibcLocales}"
          ]
          ++ mapAttrsToList (name: inbox: inbox.description) cfg.inboxes
+          ++ filter (x: x != null) [
+            cfg.${proto}.cert or null
+            cfg.${proto}.key or null
+          ]
          ++
            # Without confinement the whole Nix store
            # is made available to the service
--- a/nixos/modules/services/matrix/appservice-irc.nix
+++ b/nixos/modules/services/matrix/appservice-irc.nix
@ -228,7 +228,7 @@ in
          sed -i "s/^hs_token:.*$/$hs_token/g" ${registrationFile}
          sed -i "s/^as_token:.*$/$as_token/g" ${registrationFile}
        fi
-        if ! [ -f "${cfg.settings.ircService.mediaProxy.signingKeyPath}"]; then
+        if ! [ -f "${cfg.settings.ircService.mediaProxy.signingKeyPath}" ]; then
          ${lib.getExe pkgs.nodejs} ${pkg}/lib/generate-signing-key.js > "${cfg.settings.ircService.mediaProxy.signingKeyPath}"
        fi
        # Allow synapse access to the registration
--- a/nixos/modules/services/networking/radicale.nix
+++ b/nixos/modules/services/networking/radicale.nix
@ -205,6 +205,7 @@ in
        RestrictAddressFamilies = [
          "AF_INET"
          "AF_INET6"
+          "AF_UNIX" # To log with systemd
        ];
        RestrictNamespaces = true;
        RestrictRealtime = true;
--- a/nixos/modules/services/web-apps/mediawiki.nix
+++ b/nixos/modules/services/web-apps/mediawiki.nix
@ -623,7 +623,7 @@ in
          tr -dc A-Za-z0-9 </dev/urandom 2>/dev/null | head -c 64 > ${stateDir}/secret.key
        fi

-        echo "exit( wfGetDB( DB_MASTER )->tableExists( 'user' ) ? 1 : 0 );" | \
+        echo "exit( wfGetDB( DB_PRIMARY )->tableExists( 'user' ) ? 1 : 0 );" | \
        ${php}/bin/php ${pkg}/share/mediawiki/maintenance/eval.php --conf ${mediawikiConfig} && \
        ${php}/bin/php ${pkg}/share/mediawiki/maintenance/install.php \
          --confpath /tmp \
--- a/nixos/modules/services/web-apps/stirling-pdf.nix
+++ b/nixos/modules/services/web-apps/stirling-pdf.nix
@ -46,19 +46,27 @@ in
    systemd.services.stirling-pdf = {
      environment = lib.mapAttrs (_: toString) cfg.environment;

-      # following https://github.com/Stirling-Tools/Stirling-PDF#locally
+      # following https://docs.stirlingpdf.com/Installation/Unix%20Installation
      path =
        with pkgs;
        [
+          # `which` is used to test command availability
+          # See https://github.com/Stirling-Tools/Stirling-PDF/blob/main/src/main/java/stirling/software/SPDF/config/ExternalAppDepConfig.java#L42
+          which
          unpaper
          libreoffice
+          qpdf
          ocrmypdf
          poppler_utils
          unoconv
-          opencv
          pngquant
          tesseract
-          python3Packages.weasyprint
+          (python3.withPackages (
+            p: with p; [
+              weasyprint
+              opencv-python-headless
+            ]
+          ))
          ghostscript_headless
        ]
        ++ lib.optional (cfg.environment.INSTALL_BOOK_AND_ADVANCED_HTML_OPS or "false" == "true") calibre;
@ -102,7 +110,7 @@ in
        RestrictRealtime = true;
        SystemCallArchitectures = "native";
        SystemCallFilter = [
-          "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @resources @clock @setuid @chown"
+          "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @clock @setuid @chown"
        ];
        UMask = "0077";
      };
--- a/nixos/modules/services/web-servers/varnish/default.nix
+++ b/nixos/modules/services/web-servers/varnish/default.nix
@ -5,65 +5,80 @@
  ...
 }:

-with lib;
-
 let
  cfg = config.services.varnish;

+  # Varnish has very strong opinions and very complicated code around handling
+  # the stateDir. After a lot of back and forth, we decided that we a)
+  # do not want a configurable option here, as most of the handling depends
+  # on the version and the compile time options. Putting everything into
+  # /var/run (RAM backed) is absolutely recommended by Varnish anyways.
+  # We do need to pay attention to the version-dependend variations, though!
+  stateDir =
+    if
+      (lib.versionOlder cfg.package.version "7")
+    # Remove after Varnish 6.0 is gone. In 6.0 varnishadm always appends the
+    # hostname (by default) and can't be nudged to not use any name. This has
+    # long changed by 7.5 and can be used without the host name.
+    then
+      "/var/run/varnish/${config.networking.hostName}"
+    # Newer varnish uses this:
+    else
+      "/var/run/varnishd";
+
  commandLine =
    "-f ${pkgs.writeText "default.vcl" cfg.config}"
    +
-      optionalString (cfg.extraModules != [ ])
+      lib.optionalString (cfg.extraModules != [ ])
        " -p vmod_path='${
-           makeSearchPathOutput "lib" "lib/varnish/vmods" ([ cfg.package ] ++ cfg.extraModules)
+           lib.makeSearchPathOutput "lib" "lib/varnish/vmods" ([ cfg.package ] ++ cfg.extraModules)
         }' -r vmod_path";
 in
 {
+  imports = [
+    (lib.mkRemovedOptionModule [
+      "services"
+      "varnish"
+      "stateDir"
+    ] "The `stateDir` option never was functional or useful. varnish uses compile-time settings.")
+  ];
+
  options = {
    services.varnish = {
-      enable = mkEnableOption "Varnish Server";
+      enable = lib.mkEnableOption "Varnish Server";

-      enableConfigCheck = mkEnableOption "checking the config during build time" // {
+      enableConfigCheck = lib.mkEnableOption "checking the config during build time" // {
        default = true;
      };

-      package = mkPackageOption pkgs "varnish" { };
+      package = lib.mkPackageOption pkgs "varnish" { };

-      http_address = mkOption {
-        type = types.str;
+      http_address = lib.mkOption {
+        type = lib.types.str;
        default = "*:6081";
        description = ''
          HTTP listen address and port.
        '';
      };

-      config = mkOption {
-        type = types.lines;
+      config = lib.mkOption {
+        type = lib.types.lines;
        description = ''
          Verbatim default.vcl configuration.
        '';
      };

-      stateDir = mkOption {
-        type = types.path;
-        default = "/run/varnish/${config.networking.hostName}";
-        defaultText = literalExpression ''"/run/varnish/''${config.networking.hostName}"'';
-        description = ''
-          Directory holding all state for Varnish to run. Note that this should be a tmpfs in order to avoid performance issues and crashes.
-        '';
-      };
-
-      extraModules = mkOption {
-        type = types.listOf types.package;
+      extraModules = lib.mkOption {
+        type = lib.types.listOf lib.types.package;
        default = [ ];
-        example = literalExpression "[ pkgs.varnishPackages.geoip ]";
+        example = lib.literalExpression "[ pkgs.varnishPackages.geoip ]";
        description = ''
          Varnish modules (except 'std').
        '';
      };

-      extraCommandLine = mkOption {
-        type = types.str;
+      extraCommandLine = lib.mkOption {
+        type = lib.types.str;
        default = "";
        example = "-s malloc,256M";
        description = ''
@ -74,30 +89,20 @@ in

  };

-  config = mkIf cfg.enable {
-
+  config = lib.mkIf cfg.enable {
    systemd.services.varnish = {
      description = "Varnish";
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
-      preStart = mkIf (!(lib.hasPrefix "/run/" cfg.stateDir)) ''
-        mkdir -p ${cfg.stateDir}
-        chown -R varnish:varnish ${cfg.stateDir}
-      '';
-      postStop = mkIf (!(lib.hasPrefix "/run/" cfg.stateDir)) ''
-        rm -rf ${cfg.stateDir}
-      '';
      serviceConfig = {
        Type = "simple";
        PermissionsStartOnly = true;
-        ExecStart = "${cfg.package}/sbin/varnishd -a ${cfg.http_address} -n ${cfg.stateDir} -F ${cfg.extraCommandLine} ${commandLine}";
+        ExecStart = "${cfg.package}/sbin/varnishd -a ${cfg.http_address} -n ${stateDir} -F ${cfg.extraCommandLine} ${commandLine}";
        Restart = "always";
        RestartSec = "5s";
        User = "varnish";
        Group = "varnish";
-        RuntimeDirectory = mkIf (lib.hasPrefix "/run/" cfg.stateDir) (
-          lib.removePrefix "/run/" cfg.stateDir
-        );
+        RuntimeDirectory = lib.removePrefix "/var/run/" stateDir;
        AmbientCapabilities = "cap_net_bind_service";
        NoNewPrivileges = true;
        LimitNOFILE = 131072;
@ -107,7 +112,7 @@ in
    environment.systemPackages = [ cfg.package ];

    # check .vcl syntax at compile time (e.g. before nixops deployment)
-    system.checks = mkIf cfg.enableConfigCheck [
+    system.checks = lib.mkIf cfg.enableConfigCheck [
      (pkgs.runCommand "check-varnish-syntax" { } ''
        ${cfg.package}/bin/varnishd -C ${commandLine} 2> $out || (cat $out; exit 1)
      '')
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -587,7 +587,7 @@ in {
  mate = handleTest ./mate.nix {};
  mate-wayland = handleTest ./mate-wayland.nix {};
  matter-server = handleTest ./matter-server.nix {};
-  matomo = handleTest ./matomo.nix {};
+  matomo = runTest ./matomo.nix;
  matrix-appservice-irc = runTest ./matrix/appservice-irc.nix;
  matrix-conduit = handleTest ./matrix/conduit.nix {};
  matrix-synapse = handleTest ./matrix/synapse.nix {};
@ -1143,6 +1143,7 @@ in {
  v2ray = handleTest ./v2ray.nix {};
  varnish60 = handleTest ./varnish.nix { package = pkgs.varnish60; };
  varnish75 = handleTest ./varnish.nix { package = pkgs.varnish75; };
+  varnish76 = handleTest ./varnish.nix { package = pkgs.varnish76; };
  vault = handleTest ./vault.nix {};
  vault-agent = handleTest ./vault-agent.nix {};
  vault-dev = handleTest ./vault-dev.nix {};
--- a/nixos/tests/matomo.nix
+++ b/nixos/tests/matomo.nix
@ -1,84 +1,58 @@
+{ lib, ... }:
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../.. { inherit system config; },
-}:
+  name = "matomo";

-with import ../lib/testing-python.nix { inherit system pkgs; };
-with pkgs.lib;
-
-let
-  matomoTest =
-    package:
-    makeTest {
-      name = "matomo";
-
-      nodes.machine =
-        { config, pkgs, ... }:
-        {
-          services.matomo = {
-            package = package;
-            enable = true;
-            nginx = {
-              forceSSL = false;
-              enableACME = false;
-            };
-          };
-          services.mysql = {
-            enable = true;
-            package = pkgs.mariadb;
-          };
-          services.nginx.enable = true;
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      services.matomo = {
+        enable = true;
+        nginx = {
+          forceSSL = false;
+          enableACME = false;
        };
-
-      testScript = ''
-        start_all()
-        machine.wait_for_unit("mysql.service")
-        machine.wait_for_unit("phpfpm-matomo.service")
-        machine.wait_for_unit("nginx.service")
-
-        with subtest("matomo.js reachable via HTTP"):
-          machine.succeed("curl -sSfk http://machine/matomo.js")
-
-        with subtest("js/piwik.js reachable via HTTP"):
-          machine.succeed("curl -sSfk http://machine/js/piwik.js")
-
-        with subtest("matomo.php (API) reachable via HTTP"):
-          machine.succeed("curl -sSfk http://machine/matomo.php")
-
-        # without the grep the command does not produce valid utf-8 for some reason
-        with subtest("welcome screen loads"):
-            machine.succeed(
-                "curl -sSfL http://localhost/ | grep '<title>Matomo[^<]*Installation'"
-            )
-
-        with subtest("killing the phpfpm process should trigger an automatic restart"):
-          machine.succeed("systemctl kill -s KILL phpfpm-matomo")
-          machine.sleep(1)
-          machine.wait_for_unit("phpfpm-matomo.service")
-      '';
+      };
+      services.mysql = {
+        enable = true;
+        package = pkgs.mariadb;
+      };
+      services.nginx.enable = true;
    };
-in
-{
-  matomo = matomoTest pkgs.matomo // {
-    name = "matomo";
-    meta.maintainers =
-      with maintainers;
-      [
-        florianjacob
-        mmilata
-        twey
-        boozedog
-      ]
-      ++ lib.teams.flyingcircus.members;
-  };
-  matomo-beta = matomoTest pkgs.matomo-beta // {
-    name = "matomo-beta";
-    meta.maintainers = with maintainers; [
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("mysql.service")
+    machine.wait_for_unit("phpfpm-matomo.service")
+    machine.wait_for_unit("nginx.service")
+
+    with subtest("matomo.js reachable via HTTP"):
+      machine.succeed("curl -sSfk http://machine/matomo.js")
+
+    with subtest("js/piwik.js reachable via HTTP"):
+      machine.succeed("curl -sSfk http://machine/js/piwik.js")
+
+    with subtest("matomo.php (API) reachable via HTTP"):
+      machine.succeed("curl -sSfk http://machine/matomo.php")
+
+    # without the grep the command does not produce valid utf-8 for some reason
+    with subtest("welcome screen loads"):
+      machine.succeed(
+        "curl -sSfL http://localhost/ | grep '<title>Matomo[^<]*Installation'"
+      )
+
+    with subtest("killing the phpfpm process should trigger an automatic restart"):
+      machine.succeed("systemctl kill -s KILL phpfpm-matomo")
+      machine.sleep(1)
+      machine.wait_for_unit("phpfpm-matomo.service")
+  '';
+
+  meta.maintainers =
+    with lib.maintainers;
+    [
      florianjacob
      mmilata
      twey
      boozedog
-    ];
-  };
+    ]
+    ++ lib.teams.flyingcircus.members;
 }
--- a/nixos/tests/miracle-wm.nix
+++ b/nixos/tests/miracle-wm.nix
@ -22,6 +22,8 @@
        user = "alice";
      };

+      programs.ydotool.enable = true;
+
      services.xserver.enable = true;
      services.displayManager.defaultSession = lib.mkForce "miracle-wm";

@ -59,7 +61,7 @@
        ];

        # To help with OCR
-        etc."xdg/foot/foot.ini".text = lib.generators.toINI { } {
+        etc."xdg/foot/foot.ini".source = (pkgs.formats.ini { }).generate "foot.ini" {
          main = {
            font = "inconsolata:size=16";
          };
@ -69,7 +71,7 @@
            regular2 = foreground;
          };
        };
-        etc."xdg/alacritty/alacritty.yml".text = lib.generators.toYAML { } {
+        etc."xdg/alacritty/alacritty.toml".source = (pkgs.formats.toml { }).generate "alacritty.toml" {
          font = rec {
            normal.family = "Inconsolata";
            bold.family = normal.family;
@ -114,7 +116,17 @@
          machine.wait_for_file("/tmp/test-wayland-exit-ok")
          machine.copy_from_vm("/tmp/test-wayland.out")
          machine.screenshot("foot_wayland_info")
+
+          # please actually register that we want to close the window
+          machine.succeed("ydotool mousemove -- 10 10")
+          machine.sleep(3)
+
          machine.send_chars("exit\n")
+
+          # please actually register that we want to close the window
+          machine.succeed("ydotool mousemove -- 10 10")
+          machine.sleep(3)
+
          machine.wait_until_fails("pgrep foot")

      # Test XWayland
@ -125,7 +137,17 @@
          machine.wait_for_file("/tmp/test-x11-exit-ok")
          machine.copy_from_vm("/tmp/test-x11.out")
          machine.screenshot("alacritty_glinfo")
+
+          # please actually register that we want to close the window
+          machine.succeed("ydotool mousemove -- 10 10")
+          machine.sleep(3)
+
          machine.send_chars("exit\n")
+
+          # please actually register that we want to close the window
+          machine.succeed("ydotool mousemove -- 10 10")
+          machine.sleep(3)
+
          machine.wait_until_fails("pgrep alacritty")
    '';
 }
--- a/nixos/tests/miriway.nix
+++ b/nixos/tests/miriway.nix
@ -23,6 +23,8 @@ import ./make-test-python.nix (
          user = "alice";
        };

+        programs.ydotool.enable = true;
+
        services.xserver.enable = true;
        services.displayManager.defaultSession = lib.mkForce "miriway";

@ -55,7 +57,7 @@ import ./make-test-python.nix (
          ];

          # To help with OCR
-          etc."xdg/foot/foot.ini".text = lib.generators.toINI { } {
+          etc."xdg/foot/foot.ini".source = (pkgs.formats.ini { }).generate "foot.ini" {
            main = {
              font = "inconsolata:size=16";
            };
@ -65,7 +67,7 @@ import ./make-test-python.nix (
              regular2 = foreground;
            };
          };
-          etc."xdg/alacritty/alacritty.yml".text = lib.generators.toYAML { } {
+          etc."xdg/alacritty/alacritty.toml".source = (pkgs.formats.toml { }).generate "alacritty.toml" {
            font = rec {
              normal.family = "Inconsolata";
              bold.family = normal.family;
@ -109,10 +111,18 @@ import ./make-test-python.nix (
        machine.wait_for_file("/tmp/test-wayland-exit-ok")
        machine.copy_from_vm("/tmp/test-wayland.out")
        machine.screenshot("foot_wayland_info")
-        # Only succeeds when a mouse is moved inside an interactive session?
-        # machine.send_chars("exit\n")
-        # machine.wait_until_fails("pgrep foot")
-        machine.succeed("pkill foot")
+
+        # please actually register that we want to close the window
+        machine.succeed("ydotool mousemove -- 10 10")
+        machine.sleep(3)
+
+        machine.send_chars("exit\n")
+
+        # please actually register that we want to close the window
+        machine.succeed("ydotool mousemove -- 10 10")
+        machine.sleep(3)
+
+        machine.wait_until_fails("pgrep foot")

        # Test XWayland
        machine.send_key("ctrl-alt-a")
@ -121,10 +131,18 @@ import ./make-test-python.nix (
        machine.wait_for_file("/tmp/test-x11-exit-ok")
        machine.copy_from_vm("/tmp/test-x11.out")
        machine.screenshot("alacritty_glinfo")
-        # Only succeeds when a mouse is moved inside an interactive session?
-        # machine.send_chars("exit\n")
-        # machine.wait_until_fails("pgrep alacritty")
-        machine.succeed("pkill alacritty")
+
+        # please actually register that we want to close the window
+        machine.succeed("ydotool mousemove -- 10 10")
+        machine.sleep(3)
+
+        machine.send_chars("exit\n")
+
+        # please actually register that we want to close the window
+        machine.succeed("ydotool mousemove -- 10 10")
+        machine.sleep(3)
+
+        machine.wait_until_fails("pgrep alacritty")
      '';
  }
 )
--- a/nixos/tests/networking/networkd-and-scripted.nix
+++ b/nixos/tests/networking/networkd-and-scripted.nix
@ -238,6 +238,18 @@ let
                }
              ];
            };
+
+            # virtio-net reports its speed and duplex as "unknown" by default,
+            # which confuses the 802.3ad logic. However, you can just tell it
+            # to pretend to have any link speed with ethtool, so do that.
+            systemd.services.fake-link-settings = {
+              path = [ pkgs.ethtool ];
+              script = ''
+                ethtool -s enp1s0 speed 1000 duplex full
+                ethtool -s enp2s0 speed 1000 duplex full
+              '';
+              wantedBy = [ "network.target" ];
+            };
          };
      in
      {
--- a/nixos/tests/public-inbox.nix
+++ b/nixos/tests/public-inbox.nix
@ -9,6 +9,13 @@ import ./make-test-python.nix (
        -subj '/CN=machine.${domain}'
      install -D -t $out key.pem cert.pem
    '';
+
+    # Git repositories paths in Gitolite.
+    # Here only their baseNameOf is used for configuring public-inbox inboxes.
+    gitRepositories = [
+      "user/repo1"
+      "user/repo2"
+    ];
  in
  {
    name = "public-inbox";
@ -23,13 +30,7 @@ import ./make-test-python.nix (
        ...
      }:
      let
-        inherit (config.services) gitolite public-inbox;
-        # Git repositories paths in Gitolite.
-        # Only their baseNameOf is used for configuring public-inbox.
-        repositories = [
-          "user/repo1"
-          "user/repo2"
-        ];
+        inherit (config.services) public-inbox;
      in
      {
        virtualisation.diskSize = 1 * 1024;
@ -80,7 +81,7 @@ import ./make-test-python.nix (
          };
          inboxes =
            lib.recursiveUpdate
-              (lib.genAttrs (map baseNameOf repositories) (repo: {
+              (lib.genAttrs (map baseNameOf gitRepositories) (repo: {
                address = [
                  # Routed to the "public-inbox:" transport in services.postfix.transport
                  "${repo}@${domain}"
@ -104,24 +105,15 @@ import ./make-test-python.nix (
              };
          settings.coderepo = lib.listToAttrs (
            map (
-              path:
-              lib.nameValuePair (baseNameOf path) {
-                dir = "/var/lib/gitolite/repositories/${path}.git";
-                cgitUrl = "https://git.${domain}/${path}.git";
+              repositoryName:
+              lib.nameValuePair (baseNameOf repositoryName) {
+                dir = "/var/lib/public-inbox/repositories/${repositoryName}.git";
+                cgitUrl = "https://git.${domain}/${repositoryName}.git";
              }
-            ) repositories
+            ) gitRepositories
          );
        };

-        # Use gitolite to store Git repositories listed in coderepo entries
-        services.gitolite = {
-          enable = true;
-          adminPubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJmoTOQnGqX+//us5oye8UuE+tQBx9QEM7PN13jrwgqY root@localhost";
-        };
-        systemd.services.public-inbox-httpd = {
-          serviceConfig.SupplementaryGroups = [ gitolite.group ];
-        };
-
        # Use nginx as a reverse proxy for public-inbox-httpd
        services.nginx = {
          enable = true;
@ -181,6 +173,7 @@ import ./make-test-python.nix (
        };

        environment.systemPackages = [
+          pkgs.gitMinimal
          pkgs.mailutils
          pkgs.openssl
        ];
@ -189,19 +182,22 @@ import ./make-test-python.nix (

    testScript = ''
      start_all()
+
      machine.wait_for_unit("multi-user.target")
      machine.wait_for_unit("public-inbox-init.service")

-      # Very basic check that Gitolite can work;
-      # Gitolite is not needed for the rest of this testScript
-      machine.wait_for_unit("gitolite-init.service")
+      machine.succeed(
+        ${lib.concatMapStrings (repositoryName: ''
+          "sudo -u public-inbox git init --bare -b main /var/lib/public-inbox/repositories/${repositoryName}.git",
+        '') gitRepositories}
+      )

      # List inboxes through public-inbox-httpd
+      machine.wait_for_unit("public-inbox-httpd.socket")
      machine.wait_for_unit("nginx.service")
      machine.succeed("curl -L https://machine.${domain} | grep repo1@${domain}")
      # The repo2 inbox is hidden
      machine.fail("curl -L https://machine.${domain} | grep repo2@${domain}")
-      machine.wait_for_unit("public-inbox-httpd.service")

      # Send a mail and read it through public-inbox-httpd
      # Must work too when using a recipientDelimiter.
@ -220,8 +216,7 @@ import ./make-test-python.nix (
      machine.succeed("curl -L 'https://machine.${domain}/inbox/repo1/repo1@root-1/T/#u' | grep 'This is a testing mail.'")

      # Read a mail through public-inbox-imapd
-      machine.wait_for_open_port(993)
-      machine.wait_for_unit("public-inbox-imapd.service")
+      machine.wait_for_unit("public-inbox-imapd.socket")
      machine.succeed("openssl s_client -ign_eof -crlf -connect machine.${domain}:993 <${pkgs.writeText "imap-commands" ''
        tag login anonymous@${domain} anonymous
        tag SELECT INBOX.comp.${orga}.repo1.0
@ -230,8 +225,7 @@ import ./make-test-python.nix (
      ''} | grep '^Message-ID: <repo1@root-1>'")

      # TODO: Read a mail through public-inbox-nntpd
-      #machine.wait_for_open_port(563)
-      #machine.wait_for_unit("public-inbox-nntpd.service")
+      #machine.wait_for_unit("public-inbox-nntpd.socket")

      # Delete a mail.
      # Note that the use of an extension not listed in the addresses
--- a/nixos/tests/sunshine.nix
+++ b/nixos/tests/sunshine.nix
@ -62,7 +62,7 @@ import ./make-test-python.nix (
      moonlight.wait_for_console_text("Executing request.*pair")

      # respond to pairing request from sunshine
-      sunshine.succeed("curl --fail --insecure -u sunshine:sunshine -d '{\"pin\": \"1234\"}' https://localhost:47990/api/pin")
+      sunshine.succeed("curl --fail --insecure -u sunshine:sunshine -d '{\"pin\":\"1234\",\"name\":\"1234\"}' https://localhost:47990/api/pin")

      # wait until pairing is complete
      moonlight.wait_for_console_text("Executing request.*phrase=pairchallenge")
--- a/nixos/tests/varnish.nix
+++ b/nixos/tests/varnish.nix
@ -56,8 +56,12 @@ import ./make-test-python.nix (

      client.wait_until_succeeds("curl -f http://varnish/nix-cache-info");

-      client.wait_until_succeeds("nix-store -r ${testPath}");
-      client.succeed("${testPath}/bin/hello");
+      client.wait_until_succeeds("nix-store -r ${testPath}")
+      client.succeed("${testPath}/bin/hello")
+
+      output = varnish.succeed("varnishadm status")
+      print(output)
+      assert "Child in state running" in output, "Unexpected varnishadm response"
    '';
  }
 )
--- a/pkgs/applications/audio/csound/default.nix
+++ b/pkgs/applications/audio/csound/default.nix
@ -29,15 +29,15 @@

 stdenv.mkDerivation rec {
  pname = "csound";
-  version = "6.18.1";
+  version = "6.18.1-unstable-2024-07-02";

  hardeningDisable = [ "format" ];

  src = fetchFromGitHub {
    owner = "csound";
    repo = "csound";
-    rev = version;
-    sha256 = "sha256-O7s92N54+zIl07eIdK/puoSve/qJ3O01fTh0TP+VdZA=";
+    rev = "2536da284dd70ec7272040cb0763f70ae57123c4";
+    sha256 = "sha256-NDYltwmjBsX1DWCjy8/4cXMSl3/mK+HaQHSKUmRR9TI=";
  };

  cmakeFlags =
--- a/pkgs/applications/audio/drumkv1/default.nix
+++ b/pkgs/applications/audio/drumkv1/default.nix
@ -1,17 +1,51 @@
-{ mkDerivation, lib, fetchurl, pkg-config, libjack2, alsa-lib, libsndfile, liblo, lv2, qt5 }:
+{
+  stdenv,
+  lib,
+  pkg-config,
+  fetchurl,
+  cmake,
+  libjack2,
+  alsa-lib,
+  libsndfile,
+  liblo,
+  lv2,
+  qt6,
+  xorg,
+}:

-mkDerivation rec {
+stdenv.mkDerivation rec {
  pname = "drumkv1";
-  version = "0.9.23";
+  version = "1.0.0";

  src = fetchurl {
-    url = "mirror://sourceforge/drumkv1/${pname}-${version}.tar.gz";
-    sha256 = "sha256-gNscsqGpEfU1CNJDlBAzum9M0vzJSm6Wx5b/zhOt+sk=";
+    url = "mirror://sourceforge/drumkv1/drumkv1-${version}.tar.gz";
+    hash = "sha256-vi//84boqaVxC/KCg+HF76vB4Opch02LU4RtbVaxaX4=";
  };

-  buildInputs = [ libjack2 alsa-lib libsndfile liblo lv2 qt5.qtbase qt5.qttools ];
+  buildInputs = [
+    libjack2
+    alsa-lib
+    libsndfile
+    liblo
+    lv2
+    xorg.libX11
+    qt6.qtbase
+    qt6.qtwayland
+    qt6.qtsvg
+  ];

-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+    qt6.wrapQtAppsHook
+  ];
+
+  cmakeFlags = [
+    # disable experimental feature "LV2 port change request"
+    "-DCONFIG_LV2_PORT_CHANGE_REQUEST=false"
+    # override libdir -- temporary until upstream fixes CMakeLists.txt
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+  ];

  meta = with lib; {
    description = "Old-school drum-kit sampler synthesizer with stereo fx";
@ -19,6 +53,6 @@ mkDerivation rec {
    homepage = "http://drumkv1.sourceforge.net/";
    license = licenses.gpl2Plus;
    platforms = platforms.linux;
-    maintainers = [ ];
+    maintainers = [ maintainers.theredstonedev ];
  };
 }
--- a/pkgs/applications/audio/snapcast/default.nix
+++ b/pkgs/applications/audio/snapcast/default.nix
@ -20,17 +20,18 @@
  pulseaudioSupport ? false,
  libpulseaudio,
  nixosTests,
+  openssl,
 }:

 stdenv.mkDerivation rec {
  pname = "snapcast";
-  version = "0.29.0";
+  version = "0.30.0";

  src = fetchFromGitHub {
    owner = "badaix";
    repo = "snapcast";
    rev = "v${version}";
-    hash = "sha256-FWOGBXYWLHHZhvC5/BpkDd70ZupzALZ3ks3qTcrtwKQ=";
+    hash = "sha256-EJgpZz4PnXfge0rkVH1F7cah+i9AvDJVSUVqL7qChDM=";
  };

  nativeBuildInputs = [
@ -51,6 +52,7 @@ stdenv.mkDerivation rec {
      aixlog
      popl
      soxr
+      openssl
    ]
    ++ lib.optional pulseaudioSupport libpulseaudio
    ++ lib.optional stdenv.hostPlatform.isLinux alsa-lib
--- a/pkgs/applications/emulators/libretro/cores/vice.nix
+++ b/pkgs/applications/emulators/libretro/cores/vice.nix
@ -0,0 +1,29 @@
+{
+  lib,
+  fetchFromGitHub,
+  mkLibretroCore,
+  type ? "x64",
+}:
+mkLibretroCore {
+  core = "vice-${type}";
+  version = "0-unstable-2025-01-11";
+
+  src = fetchFromGitHub {
+    owner = "libretro";
+    repo = "vice-libretro";
+    rev = "5afa33f347306f168ff0b4c54a7825895dd07b50";
+    hash = "sha256-D0DSKgqZV8EluRry2qSm7qnWnvwwDWz91G66W4nF2Kk=";
+  };
+
+  makefile = "Makefile";
+
+  env = {
+      EMUTYPE = "${type}";
+  };
+
+  meta = {
+    description = "Port of vice to libretro";
+    homepage = "https://github.com/libretro/vice-libretro";
+    license = lib.licenses.gpl2;
+  };
+}
--- a/pkgs/applications/emulators/libretro/default.nix
+++ b/pkgs/applications/emulators/libretro/default.nix
@ -189,6 +189,26 @@ lib.makeScope newScope (self: {

  vecx = self.callPackage ./cores/vecx.nix { };

+  vice-x64 = self.callPackage ./cores/vice.nix { type = "x64"; };
+
+  vice-x128 = self.callPackage ./cores/vice.nix { type = "x128"; };
+
+  vice-x64dtv = self.callPackage ./cores/vice.nix { type = "x64dtv"; };
+
+  vice-x64sc = self.callPackage ./cores/vice.nix { type = "x64sc"; };
+
+  vice-xcbm2 = self.callPackage ./cores/vice.nix { type = "xcbm2"; };
+
+  vice-xcbm5x0 = self.callPackage ./cores/vice.nix { type = "xcbm5x0"; };
+
+  vice-xpet = self.callPackage ./cores/vice.nix { type = "xpet"; };
+
+  vice-xplus4 = self.callPackage ./cores/vice.nix { type = "xplus4"; };
+
+  vice-xscpu64 = self.callPackage ./cores/vice.nix { type = "xscpu64"; };
+
+  vice-xvic = self.callPackage ./cores/vice.nix { type = "xvic"; };
+
  virtualjaguar = self.callPackage ./cores/virtualjaguar.nix { };

  yabause = self.callPackage ./cores/yabause.nix { };
--- a/pkgs/applications/misc/ola/default.nix
+++ b/pkgs/applications/misc/ola/default.nix
@ -15,6 +15,7 @@
  libmicrohttpd,
  perl,
  python3,
+  fetchpatch,
 }:

 stdenv.mkDerivation rec {
@ -27,7 +28,13 @@ stdenv.mkDerivation rec {
    tag = version;
    hash = "sha256-8w8ZT3D/+8Pxl9z2KTXeydVxE5xiPjxZevgmMFgrblU=";
  };
-
+  patches = [
+    # Fix build error with GCC 14 due to stricter C++20 compliance (template-id in constructors)
+    (fetchpatch {
+      url = "https://github.com/OpenLightingProject/ola/commit/d9b9c78645c578adb7c07b692842e841c48310be.patch";
+      hash = "sha256-BplSqQv8ztWMpiX/M3/3wvf6LsPTBglh48gHlUoM6rw=";
+    })
+  ];
  nativeBuildInputs = [
    autoreconfHook
    bison
--- a/pkgs/applications/misc/tandoor-recipes/common.nix
+++ b/pkgs/applications/misc/tandoor-recipes/common.nix
@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "1.5.27";
+  version = "1.5.29";

  src = fetchFromGitHub {
    owner = "TandoorRecipes";
    repo = "recipes";
    rev = version;
-    hash = "sha256-HP4gVk127hvvL337Cb4Wbvvf55RWY7u5RF/FKDCottw=";
+    hash = "sha256-NfU071BLZ/NtpbZe475oNl8LGiVzVix9iekEoCGtcdk=";
  };

  yarnHash = "sha256-lU8QrTkI32XOHefIkj/0fa2UKhuZpQIT1wyweQnzXmQ=";
--- a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox.nix
@ -9,10 +9,10 @@

 buildMozillaMach rec {
  pname = "firefox";
-  version = "134.0.1";
+  version = "134.0.2";
  src = fetchurl {
    url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "3f40ca5a753a66e08af4e8b12d75feab67b0567ecffd34f5cf013f49aeb809ccd458c8011e9456dc902c24eaf626078117874514eb40cee5574eafce93ee772d";
+    sha512 = "74d631ecbdb5607cfcc4de408947b3b129e36b3d1daa501827aebc81f48c878f9bade875875c466c07c651f26b5388ff2d2d2087e66e0613d8914abaa7ddf5ae";
  };

  meta = {
--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@ -9,15 +9,15 @@

 buildGoModule rec {
  pname = "kubernetes-helm";
-  version = "3.16.4";
+  version = "3.17.0";

  src = fetchFromGitHub {
    owner = "helm";
    repo = "helm";
    rev = "v${version}";
-    sha256 = "sha256-1dgBPDl5AtbqSKzfbAnCAzdBL+d6ZeO81LJFosmO7Bg=";
+    sha256 = "sha256-kLiYzZFqJQGkqpjFPTB9BHQf7yWiWRUvWDpF5WkfJEU=";
  };
-  vendorHash = "sha256-pkQ4J4JmEByu7bkUa/rg2bipY9s6t6uvPNiNyTyYkD8=";
+  vendorHash = "sha256-mARUYjnbn5dmR0cKAXiHFJcYNx1ROabLv9Z7KCY9PRM=";

  subPackages = [ "cmd/helm" ];
  ldflags = [
--- a/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/default.nix
@ -21,13 +21,13 @@

 buildGoModule rec {
  pname = "kubernetes";
-  version = "1.32.0";
+  version = "1.32.1";

  src = fetchFromGitHub {
    owner = "kubernetes";
    repo = "kubernetes";
    rev = "v${version}";
-    hash = "sha256-VpinMMWvFYpcqDC9f3q/oEqUHRz7thHMs0bKt6AaNms=";
+    hash = "sha256-6KZlbwSMmFvh6XKJR1W/qa3xU0O3fuQaMW/P5An/AtQ=";
  };

  vendorHash = null;
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -1427,13 +1427,13 @@
    "vendorHash": "sha256-kjS1YYMoE5IBeKWXnxzO3nFp6NpBEwUCaTzO0VSBDLA="
  },
  "vultr": {
-    "hash": "sha256-gQwLGnYmB9bwpGrLNdbw+zY0MlPPrY/37rJPtindT1Q=",
+    "hash": "sha256-vgeTK5fGHYzHCBdxq1JN9agK6+jYGkCkFnAWrkIz/gM=",
    "homepage": "https://registry.terraform.io/providers/vultr/vultr",
    "owner": "vultr",
    "repo": "terraform-provider-vultr",
-    "rev": "v2.21.0",
+    "rev": "v2.23.1",
    "spdx": "MPL-2.0",
-    "vendorHash": null
+    "vendorHash": "sha256-UW9/XEG+yTgMEttWFRMeneni0i/ZEcsrniT5vbhtRf8="
  },
  "wavefront": {
    "hash": "sha256-yNNtOkodzwxKvHQq9GZlUicezGW6u2ih6ry/cOtJQGM=",
--- a/pkgs/applications/radio/gqrx/default.nix
+++ b/pkgs/applications/radio/gqrx/default.nix
@ -17,9 +17,10 @@
  # drivers (optional):
  rtl-sdr,
  hackrf,
-  pulseaudioSupport ? true,
+  stdenv,
+  pulseaudioSupport ? !stdenv.hostPlatform.isDarwin,
  libpulseaudio,
-  portaudioSupport ? false,
+  portaudioSupport ? stdenv.hostPlatform.isDarwin,
  portaudio,
 }:

@ -50,16 +51,18 @@ gnuradioMinimal.pkgs.mkDerivation rec {
      gnuradioMinimal.unwrapped.logLib
      mpir
      fftwFloat
-      alsa-lib
      libjack2
      gnuradioMinimal.unwrapped.boost
      qtbase
      qtsvg
-      qtwayland
      gnuradioMinimal.pkgs.osmosdr
      rtl-sdr
      hackrf
    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      alsa-lib
+      qtwayland
+    ]
    ++ lib.optionals (gnuradioMinimal.hasFeature "gr-ctrlport") [
      thrift
      gnuradioMinimal.unwrapped.python.pkgs.thrift
@ -78,7 +81,7 @@ gnuradioMinimal.pkgs.mkDerivation rec {
          "Gr-audio";
    in
    [
-      "-DLINUX_AUDIO_BACKEND=${audioBackend}"
+      "-D${if stdenv.hostPlatform.isDarwin then "OSX" else "LINUX"}_AUDIO_BACKEND=${audioBackend}"
    ];

  # Prevent double-wrapping, inject wrapper args manually instead.
@ -100,7 +103,7 @@ gnuradioMinimal.pkgs.mkDerivation rec {
    # Some of the code comes from the Cutesdr project, with a BSD license, but
    # it's currently unknown which version of the BSD license that is.
    license = licenses.gpl3Plus;
-    platforms = platforms.linux; # should work on Darwin / macOS too
+    platforms = platforms.linux ++ platforms.darwin;
    maintainers = with maintainers; [
      bjornfor
      fpletz
--- a/pkgs/applications/virtualization/docker/compose.nix
+++ b/pkgs/applications/virtualization/docker/compose.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "docker-compose";
-  version = "2.32.2";
+  version = "2.32.4";

  src = fetchFromGitHub {
    owner = "docker";
    repo = "compose";
    rev = "v${version}";
-    hash = "sha256-i4wpM7Rc4pFUUzPFvoPxUlifIvk4GJzBhCLpUndFnjE=";
+    hash = "sha256-t2XW75PuoZAZ0Nw2CMnP73BwJSpt5BtzGJLAM5zqbrI=";
  };

  postPatch = ''
--- a/pkgs/build-support/rust/default-crate-overrides.nix
+++ b/pkgs/build-support/rust/default-crate-overrides.nix
@ -9,7 +9,6 @@
 , clang
 , cmake
 , curl
-, darwin
 , dbus
 , dbus-glib
 , fontconfig
@ -47,9 +46,6 @@
 , ...
 }:

-let
-  inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
-in
 {
  alsa-sys = attrs: {
    nativeBuildInputs = [ pkg-config ];
@ -71,8 +67,7 @@ in
  };

  cargo = attrs: {
-    buildInputs = [ openssl zlib curl ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [ CoreFoundation Security ];
+    buildInputs = [ openssl zlib curl ];
  };

  libz-sys = attrs: {
@ -280,10 +275,6 @@ in
    crateBin = [{ name = "rink"; path = "src/bin/rink.rs"; }];
  };

-  security-framework-sys = attr: {
-    propagatedBuildInputs = lib.optional stdenv.hostPlatform.isDarwin Security;
-  };
-
  sequoia-openpgp = attrs: {
    buildInputs = [ gmp ];
  };
@ -319,10 +310,6 @@ in
    buildInputs = [ sqlite gmp ];
  };

-  serde_derive = attrs: {
-    buildInputs = lib.optional stdenv.hostPlatform.isDarwin Security;
-  };
-
  servo-fontconfig-sys = attrs: {
    nativeBuildInputs = [ pkg-config ];
    buildInputs = [ freetype fontconfig ];
--- a/pkgs/build-support/testers/default.nix
+++ b/pkgs/build-support/testers/default.nix
@ -31,7 +31,7 @@
        };
      })
      orig.realBuilder or stdenv.shell
-    ] ++ orig.args or ["-e" (orig.builder or ../../stdenv/generic/default-builder.sh)];
+    ] ++ orig.args or ["-e" ../../stdenv/generic/source-stdenv.sh (orig.builder or ../../stdenv/generic/default-builder.sh)];
  });

  # See https://nixos.org/manual/nixpkgs/unstable/#tester-testEqualDerivation
--- a/pkgs/build-support/testers/expect-failure.sh
+++ b/pkgs/build-support/testers/expect-failure.sh
@ -35,7 +35,7 @@ echo "testBuildFailure: Original builder produced exit code: $r"
 # -----------------------------------------
 # Write the build log to the default output

-# Source structured attrs as per nixpkgs/pkgs/stdenv/generic/default-builder.sh
+# Source structured attrs as per nixpkgs/pkgs/stdenv/generic/source-stdenv.sh
 #
 # We need this so that we can read $outputs when `__structuredAttrs` is enabled
 #
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@ -5,7 +5,7 @@
 , img ? pkgs.stdenv.hostPlatform.linux-kernel.target
 , storeDir ? builtins.storeDir
 , rootModules ?
-    [ "virtio_pci" "virtio_mmio" "virtio_blk" "virtio_balloon" "virtio_rng" "ext4" "unix" "virtiofs" "crc32c_generic" ]
+    [ "virtio_pci" "virtio_mmio" "virtio_blk" "virtio_balloon" "virtio_rng" "ext4" "virtiofs" "crc32c_generic" ]
 }:

 let
--- a/pkgs/by-name/ab/abcmidi/package.nix
+++ b/pkgs/by-name/ab/abcmidi/package.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "abcmidi";
-  version = "2024.12.16";
+  version = "2025.01.20";

  src = fetchFromGitHub {
    owner = "sshlien";
    repo = "abcmidi";
    tag = finalAttrs.version;
-    hash = "sha256-8kzgojLwVVFjpWiQ1/0S3GCVU8oEpoFItjtRDByauDg=";
+    hash = "sha256-QFtxiIx5MxzMK7QWqVC9xq4SQ44Ba210WEBP7M+QRxo=";
  };

  meta = {
--- a/pkgs/by-name/ad/adriconf/package.nix
+++ b/pkgs/by-name/ad/adriconf/package.nix
@ -3,6 +3,8 @@
  lib,
  fetchFromGitLab,
  cmake,
+  gettext,
+  glib,
  pkg-config,
  libdrm,
  libGL,
@ -28,6 +30,8 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [
    cmake
+    gettext # msgfmt
+    glib # glib-compile-resources
    pkg-config
  ];
  buildInputs = [
@ -41,6 +45,7 @@ stdenv.mkDerivation rec {
    pciutils
  ];

+  # tries to download googletest
  cmakeFlags = [ "-DENABLE_UNIT_TESTS=off" ];

  postInstall = ''
--- a/pkgs/by-name/an/angular-language-server/package.nix
+++ b/pkgs/by-name/an/angular-language-server/package.nix
@ -15,11 +15,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "angular-language-server";
-  version = "19.0.3";
+  version = "19.0.4";
  src = fetchurl {
    name = "angular-language-server-${finalAttrs.version}.zip";
    url = "https://github.com/angular/vscode-ng-language-service/releases/download/v${finalAttrs.version}/ng-template.vsix";
-    hash = "sha256-QVvXwzSaj5wMYEwMMXGJwRwg7v6HdB0JKLkQiUNR0y4=";
+    hash = "sha256-0vED1AcNIbZ7SmXn4KaBBajxfAptQg+XKL3NtJfnvG8=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ar/ariang/package.nix
+++ b/pkgs/by-name/ar/ariang/package.nix
@ -7,16 +7,16 @@

 buildNpmPackage rec {
  pname = "ariang";
-  version = "1.3.8";
+  version = "1.3.9";

  src = fetchFromGitHub {
    owner = "mayswind";
    repo = "AriaNg";
    rev = version;
-    hash = "sha256-B7gyBVryRn1SwUIqzxc1MYDS8l/mxMfJtE1/ZrBjC1E=";
+    hash = "sha256-c3+iyw8LgdB29552jJQr4q5P2ZW80jC0aN+eaenEYFo=";
  };

-  npmDepsHash = "sha256-DmACToIdXfAqiXe13vevWrpWDY1YgRWVaTfdlk5uhPg=";
+  npmDepsHash = "sha256-N7ZK6wthBYAt8tU8sJE0QChAYxWfJ1HG5P+AjXZfIiw=";

  makeCacheWritable = true;

--- a/pkgs/by-name/ar/arkade/package.nix
+++ b/pkgs/by-name/ar/arkade/package.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "arkade";
-  version = "0.11.31";
+  version = "0.11.32";

  src = fetchFromGitHub {
    owner = "alexellis";
    repo = "arkade";
    rev = version;
-    hash = "sha256-MFce+stC+OzUL0H0ahZZAfMwr9Y+EVJIMmhhRl4JYaU=";
+    hash = "sha256-HbIV5eQES3K2wBEPLW1w41y3BPGh4fbkTxA0MpKh9x0=";
  };

  env.CGO_ENABLED = 0;
--- a/pkgs/by-name/au/auth0-cli/package.nix
+++ b/pkgs/by-name/au/auth0-cli/package.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "auth0-cli";
-  version = "1.7.2";
+  version = "1.8.0";

  src = fetchFromGitHub {
    owner = "auth0";
    repo = "auth0-cli";
    tag = "v${version}";
-    hash = "sha256-9/Jjsg6E8+gkN5eGZsxmTBwVoD/eO7euidY6ds7skpA=";
+    hash = "sha256-D982lmu44JFrxGcn0G1BssGkE3juUoB6qbCHWCTg9kw=";
  };

-  vendorHash = "sha256-XXCmIASYQD21h1h8HOcAl8HK5QUvgfqRpauq93tUNZ8=";
+  vendorHash = "sha256-OEHJTMcoaB4BZ06GjXIFPbCyoMGeumjTzWWFmgqLML8=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/be/betterdisplay/package.nix
+++ b/pkgs/by-name/be/betterdisplay/package.nix
@ -4,15 +4,18 @@
  fetchurl,
  undmg,
  nix-update-script,
+  versionCheckHook,
+  writeShellScript,
+  xcbuild,
 }:

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "betterdisplay";
-  version = "3.2.1";
+  version = "3.3.0";

  src = fetchurl {
    url = "https://github.com/waydabber/BetterDisplay/releases/download/v${finalAttrs.version}/BetterDisplay-v${finalAttrs.version}.dmg";
-    hash = "sha256-UQLVRCeUznTqT6qDR6sZRZ5xMVgs0Th2iRRpnF0pqVI=";
+    hash = "sha256-A0kh3XNdl5kJ32Kxwb0PAgxfGJR+EZEoaP+gspRJEcU=";
  };

  dontPatch = true;
@ -32,6 +35,15 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    runHook postInstall
  '';

+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = writeShellScript "version-check" ''
+    ${xcbuild}/bin/PlistBuddy -c "Print :CFBundleShortVersionString" "$1"
+  '';
+  versionCheckProgramArg = [
+    "${placeholder "out"}/Applications/BetterDisplay.app/Contents/Info.plist"
+  ];
+  doInstallCheck = true;
+
  passthru.updateScript = nix-update-script { };

  meta = {
--- a/pkgs/by-name/bl/bloop/package.nix
+++ b/pkgs/by-name/bl/bloop/package.nix
@ -11,7 +11,7 @@

 stdenv.mkDerivation rec {
  pname = "bloop";
-  version = "2.0.7";
+  version = "2.0.8";

  platform =
    if stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86_64 then
@ -42,11 +42,11 @@ stdenv.mkDerivation rec {
    url = "https://github.com/scalacenter/bloop/releases/download/v${version}/bloop-${platform}";
    sha256 =
      if stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86_64 then
-        "sha256-ztQEzW8bGhTURPpZmYcax8Ms2HJ78XkgEfdFBUQ6rLQ="
+        "sha256-ItPt5qjfRgtPNg6a/Zlc0ASfdvGXMMKV7SqNEOQ9u28="
      else if stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64 then
-        "sha256-t/+TnMSkJCLYM0nqJVBzdpARqPHB3ojRQZ8iPp0EPlM="
+        "sha256-zUSDUwZY1id/WFuC87Wa4eB48X4rmXvVC1/b2v5bhw4="
      else if stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64 then
-        "sha256-qnyZxE/Bt+tXz08N60BQaLn7zzGE5eV/5mJ/BHHE8nU="
+        "sha256-1wsGL1G8/+xMvYNwe7EOyqEuEKDKiwA7yyyjfbGgxJQ="
      else
        throw "unsupported platform";
  };
--- a/pkgs/by-name/bu/buildkite-agent-metrics/package.nix
+++ b/pkgs/by-name/bu/buildkite-agent-metrics/package.nix
@ -5,7 +5,7 @@
 }:
 buildGoModule rec {
  pname = "buildkite-agent-metrics";
-  version = "5.9.12";
+  version = "5.9.13";

  outputs = [
    "out"
@ -16,10 +16,10 @@ buildGoModule rec {
    owner = "buildkite";
    repo = "buildkite-agent-metrics";
    rev = "v${version}";
-    hash = "sha256-5k7njo8J96hb/RUdIRcP4KfwEH5Z2S4AyDyazcFlN0s=";
+    hash = "sha256-AVFQ3GP4YDQ6d9NSeol3Eobxzmoa9bRyCAKTsDbyZyQ=";
  };

-  vendorHash = "sha256-zb+z1neus1mnJWeuI5DSc73cXMGWme0mz/PU2Z/Zam8=";
+  vendorHash = "sha256-RQmxYxTcQn5VEy8Z96EtArYBnODmde1RlV4CA6fhbZA=";

  postInstall = ''
    mkdir -p $lambda/bin
--- a/pkgs/by-name/bu/buildkite-cli/package.nix
+++ b/pkgs/by-name/bu/buildkite-cli/package.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "buildkite-cli";
-  version = "3.4.2";
+  version = "3.5.0";

  src = fetchFromGitHub {
    owner = "buildkite";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "sha256-Tb9Hyhyf+ib/tLUHc+gUccZ7TuXltxxjaIpCfvnoVkA=";
+    sha256 = "sha256-UKpvqjHnkDv6HDpDmXe3ZoFSMGmPE/KLc7TuJKjNJXw=";
  };

-  vendorHash = "sha256-1QXcRykXoNGYCR8+6ut1eU8TVNtx8b2O2MIjmL8rfQk=";
+  vendorHash = "sha256-FV35NCwntmIWakcNH9nu1MTwZArERCc8hN57PmunkX4=";

  doCheck = false;

--- a/pkgs/by-name/ca/cargo-bundle-licenses/package.nix
+++ b/pkgs/by-name/ca/cargo-bundle-licenses/package.nix
@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-bundle-licenses";
-  version = "2.1.1";
+  version = "2.3.0";

  src = fetchFromGitHub {
    owner = "sstadick";
    repo = "cargo-bundle-licenses";
    rev = "v${version}";
-    hash = "sha256-oyb5uWIKXhPSMpb1t6C/IYKK8FMSANIQXs2XdJ/bD2A=";
+    hash = "sha256-Rw5uwfUPTkIbiOQDohBRoAm0momljJRSYP+VmEOOw/k=";
  };

-  cargoHash = "sha256-HxFRHgb0nBF6YGaiynv95fNwej70IAwP4jhVcGvdFok=";
+  cargoHash = "sha256-SfTt49J6D7RESo6iO3b/l0+Vu1dEW+PG0M2RIko2OJ4=";

  meta = with lib; {
    description = "Generate a THIRDPARTY file with all licenses in a cargo project";
--- a/pkgs/by-name/ca/cargo-shuttle/package.nix
+++ b/pkgs/by-name/ca/cargo-shuttle/package.nix
@ -11,17 +11,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-shuttle";
-  version = "0.50.0";
+  version = "0.51.0";

  src = fetchFromGitHub {
    owner = "shuttle-hq";
    repo = "shuttle";
    rev = "v${version}";
-    hash = "sha256-D3o4GdGD/lP4bchjpyj684G1CDWMhnZHke131GAI1es=";
+    hash = "sha256-oKFL/tnMsXz/qic65DgLmnmeyBsrklacs+XeVM6RGSs=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-hlYcDQi4wv43UBYSvnWUMunAKVCFVFA7hvxjaeGA2pA=";
+  cargoHash = "sha256-ocTkpIqXTf8k+onUroaCt/jMnslctzCt7g9wNtkI82g=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/by-name/cf/cf-terraforming/package.nix
+++ b/pkgs/by-name/cf/cf-terraforming/package.nix
@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "cf-terraforming";
-  version = "0.21.0";
+  version = "0.22.0";

  src = fetchFromGitHub {
    owner = "cloudflare";
    repo = "cf-terraforming";
    rev = "v${version}";
-    sha256 = "sha256-fJ3TgdEv9vk5HUUG+0cqYuA4fjXq5Smjf/KAILT9/AU=";
+    sha256 = "sha256-vWsA/VNtQvnrypcBB/5CJbiHEvnYkjuesdkq4soTMVM=";
  };

-  vendorHash = "sha256-NNeJ6QfTV8X3WIFge+Ln38ym9uagLl3IpNWuPqMjeBA=";
+  vendorHash = "sha256-eTc9K9EXlWmj1YAcOOEIUwELq6szLsj1zYj44VTvquw=";
  ldflags = [
    "-X github.com/cloudflare/cf-terraforming/internal/app/cf-terraforming/cmd.versionString=${version}"
  ];
--- a/pkgs/by-name/ck/ckdl/package.nix
+++ b/pkgs/by-name/ck/ckdl/package.nix
@ -0,0 +1,53 @@
+{ pkgs, lib, cmake, ninja, sphinx, python3Packages, ... }:
+
+pkgs.stdenv.mkDerivation {
+  pname = "ckdl";
+  version = "1.0";
+
+  src = pkgs.fetchFromGitHub {
+    owner = "tjol";
+    repo = "ckdl";
+    tag = "1.0";
+    hash = "sha256-qEfRZzoUQZ8umdWgx+N4msjPBbuwDtkN1kNDfZicRjY=";
+  };
+
+  outputs = [ "bin" "dev" "lib" "doc" "out" ];
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    sphinx
+    python3Packages.furo
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_TESTS" true)
+  ];
+
+  postPatch = ''
+    cd doc
+    make singlehtml
+    mkdir -p $doc/share/doc
+    mv _build/singlehtml $doc/share/doc/ckdl
+
+    cd ..
+  '';
+
+  postInstall = ''
+    mkdir -p $bin/bin
+
+    # some tools that are important for debugging.
+    # idk why they are not copied to bin by cmake, but I’m too tired to figure it out
+    install src/utils/ckdl-tokenize $bin/bin
+    install src/utils/ckdl-parse-events $bin/bin
+    install src/utils/ckdl-cat $bin/bin
+    touch $out
+  '';
+
+
+  meta = {
+    description = "ckdl is a C (C11) library that implements reading and writing the KDL Document Language.";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+  };
+}
--- a/pkgs/by-name/cl/clash-verge-rev/0001-enable-format_bytes_speed-for-every-platform.patch
+++ b/pkgs/by-name/cl/clash-verge-rev/0001-enable-format_bytes_speed-for-every-platform.patch
@ -0,0 +1,40 @@
+diff --git a/src/utils/help.rs b/src/utils/help.rs
+index 9b0bc6a7..471b2adc 100644
+--- a/src/utils/help.rs
+++ b/src/utils/help.rs
+@@ -201,16 +201,6 @@ macro_rules! t {
+     };
+ }
+ 
+-/// 将字节数转换为可读的流量字符串
+-/// 支持 B/s、KB/s、MB/s、GB/s 的自动转换
+-///
+-/// # Examples
+-/// ```
+-/// assert_eq!(format_bytes_speed(1000), "1000B/s");
+-/// assert_eq!(format_bytes_speed(1024), "1.0KB/s");
+-/// assert_eq!(format_bytes_speed(1024 * 1024), "1.0MB/s");
+-/// ```
+-#[cfg(target_os = "macos")]
+ pub fn format_bytes_speed(speed: u64) -> String {
+     if speed < 1024 {
+         format!("{}B/s", speed)
+@@ -222,6 +212,15 @@ pub fn format_bytes_speed(speed: u64) -> String {
+         format!("{:.1}GB/s", speed as f64 / 1024.0 / 1024.0 / 1024.0)
+     }
+ }
+/// 将字节数转换为可读的流量字符串
+/// 支持 B/s、KB/s、MB/s、GB/s 的自动转换
+///
+/// # Examples
+/// ```
+/// assert_eq!(format_bytes_speed(1000), "1000B/s");
+/// assert_eq!(format_bytes_speed(1024), "1.0KB/s");
+/// assert_eq!(format_bytes_speed(1024 * 1024), "1.0MB/s");
+/// ```
+ 
+ #[test]
+ fn test_format_bytes_speed() {
+-- 
+2.47.0
+
--- a/pkgs/by-name/cl/clash-verge-rev/package.nix
+++ b/pkgs/by-name/cl/clash-verge-rev/package.nix
@ -14,23 +14,23 @@
 }:
 let
  pname = "clash-verge-rev";
-  version = "2.0.2";
+  version = "2.0.3";

  src = fetchFromGitHub {
    owner = "clash-verge-rev";
    repo = "clash-verge-rev";
    tag = "v${version}";
-    hash = "sha256-QLvJO1JFHPFOsVxNi6SCu2QuJQ9hCsO1+WKOjZL944w=";
+    hash = "sha256-vHXXFHdKETJBlzbf4sU+gZpDz06My9DCx5nWdMpHmyc=";
  };

  src-service = fetchFromGitHub {
    owner = "clash-verge-rev";
    repo = "clash-verge-service";
-    rev = "8b676086f2770e213cffea08ef31b54b886f8f11"; # no meaningful tags in this repo. The only way is updating manully every time.
-    hash = "sha256-vF26Bp52y2kNHwwtBjy3Of75qJpTriqvul29KmudHww=";
+    rev = "7f8ad08c2f716ca50c074ecd37967728e08edf1e"; # no meaningful tags in this repo. The only way is updating manully every time.
+    hash = "sha256-kZf5O3n0xmNUN0G4hAWQDN9Oj9K7PtLpv6jnhh1C5Hg=";
  };

-  service-cargo-hash = "sha256-pMOCifffUyBkcXC8inZFZeZVHeaOt0LAu2jZUGQ7QdM=";
+  service-cargo-hash = "sha256-uo/2QBsZzoTdwRiW0Kr7GGiQCpQH4lW4h5XHqWd5sTU=";

  service = callPackage ./service.nix {
    inherit
@ -52,8 +52,8 @@ let
      ;
  };

-  npm-hash = "sha256-zsgZhLC+XUzlCUKKGAJV5MlSpWsoLmAgMwKkmAkAX9Q=";
-  vendor-hash = "sha256-fk3OdJ1CKNHkeUjquJtJgM7PDyPpQ7tssDnFZHMbQHI=";
+  npm-hash = "sha256-vpa8WyOMOH02g2gxibJmav9yWS3QLhaVcFB0e3cZ8ok=";
+  vendor-hash = "sha256-JAAhcMfRTlkQQ8lBMLMN+whkGQ/4WHjywompirnc/GI=";

  unwrapped = callPackage ./unwrapped.nix {
    inherit
--- a/pkgs/by-name/cl/clash-verge-rev/unwrapped.nix
+++ b/pkgs/by-name/cl/clash-verge-rev/unwrapped.nix
@ -28,23 +28,27 @@ rustPlatform.buildRustPackage {
    OPENSSL_NO_VENDOR = 1;
  };

+  patches = [
+    # https://github.com/clash-verge-rev/clash-verge-rev/pull/2582
+    ./0001-enable-format_bytes_speed-for-every-platform.patch
+  ];
+
  postPatch = ''
-    ls $cargoDepsCopy
-      substituteInPlace $cargoDepsCopy/libappindicator-sys-*/src/lib.rs \
-        --replace-fail "libayatana-appindicator3.so.1" "${libayatana-appindicator}/lib/libayatana-appindicator3.so.1"
+    substituteInPlace $cargoDepsCopy/libappindicator-sys-*/src/lib.rs \
+      --replace-fail "libayatana-appindicator3.so.1" "${libayatana-appindicator}/lib/libayatana-appindicator3.so.1"

-      substituteInPlace $cargoDepsCopy/sysproxy-*/src/linux.rs \
-        --replace-fail '"gsettings"' '"${glib.bin}/bin/gsettings"' \
-        --replace-fail '"kreadconfig5"' '"${libsForQt5.kconfig}/bin/kreadconfig5"' \
-        --replace-fail '"kreadconfig6"' '"${kdePackages.kconfig}/bin/kreadconfig6"' \
-        --replace-fail '"kwriteconfig5"' '"${libsForQt5.kconfig}/bin/kwriteconfig5"' \
-        --replace-fail '"kwriteconfig6"' '"${kdePackages.kconfig}/bin/kwriteconfig6"'
+    substituteInPlace $cargoDepsCopy/sysproxy-*/src/linux.rs \
+      --replace-fail '"gsettings"' '"${glib.bin}/bin/gsettings"' \
+      --replace-fail '"kreadconfig5"' '"${libsForQt5.kconfig}/bin/kreadconfig5"' \
+      --replace-fail '"kreadconfig6"' '"${kdePackages.kconfig}/bin/kreadconfig6"' \
+      --replace-fail '"kwriteconfig5"' '"${libsForQt5.kconfig}/bin/kwriteconfig5"' \
+      --replace-fail '"kwriteconfig6"' '"${kdePackages.kconfig}/bin/kwriteconfig6"'

-      substituteInPlace ./tauri.conf.json \
-        --replace-fail '"frontendDist": "../dist",' '"frontendDist": "${webui}",' \
-        --replace-fail '"beforeBuildCommand": "pnpm run web:build"' '"beforeBuildCommand": ""'
-      sed -i -e '/externalBin/d' -e '/resources/d' tauri.conf.json
-      sed -i -e '/sidecar/d' -e '/resources/d' tauri.linux.conf.json
+    substituteInPlace ./tauri.conf.json \
+      --replace-fail '"frontendDist": "../dist",' '"frontendDist": "${webui}",' \
+      --replace-fail '"beforeBuildCommand": "pnpm run web:build"' '"beforeBuildCommand": ""'
+    sed -i -e '/externalBin/d' -e '/resources/d' tauri.conf.json
+    sed -i -e '/sidecar/d' -e '/resources/d' tauri.linux.conf.json
  '';

  nativeBuildInputs = [
--- a/pkgs/by-name/co/cobang/package.nix
+++ b/pkgs/by-name/co/cobang/package.nix
@ -13,14 +13,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "cobang";
-  version = "0.14.1";
+  version = "0.15.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "hongquan";
    repo = "CoBang";
    tag = "v${version}";
-    hash = "sha256-/8JtDoXFQGlM7tlwKd+WRIKpnKCD6OnMmbvElg7LbzU=";
+    hash = "sha256-ozHmGpRx+Ts6yrDXwm4OHXTArunQbJOlA/7zJvRNQio=";
  };

  postPatch = ''
--- a/pkgs/by-name/co/comrak/package.nix
+++ b/pkgs/by-name/co/comrak/package.nix
@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "comrak";
-  version = "0.33.0";
+  version = "0.34.0";

  src = fetchFromGitHub {
    owner = "kivikakk";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-VN8f5r25kfUqekt9q28oMmkzQUE+Ko8DYhRZjpbbDfM=";
+    sha256 = "sha256-8LBMyCmt4HTYgprChfPSFZm6uQ7yFmJ0+srAUz785MA=";
  };

-  cargoHash = "sha256-Hdjit5dpZXT7ENamUX0ygTy+XAyCkcqq94wAJUPd8DY=";
+  cargoHash = "sha256-Z2LNFlHWS3IdjXlwdIizkjNFaPqTbMf0i6Y6jigKCzg=";

  meta = with lib; {
    description = "CommonMark-compatible GitHub Flavored Markdown parser and formatter";
--- a/pkgs/by-name/co/cosmic-edit/package.nix
+++ b/pkgs/by-name/co/cosmic-edit/package.nix
@ -20,21 +20,21 @@

 rustPlatform.buildRustPackage rec {
  pname = "cosmic-edit";
-  version = "1.0.0-alpha.4";
+  version = "1.0.0-alpha.5.1";

  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-edit";
    rev = "epoch-${version}";
-    hash = "sha256-IAIO5TggPGzZyfET2zBKpde/aePXR4FsSg/Da1y3saA=";
+    hash = "sha256-pxGV7X6FkYAtj4oj+XBWbi9evZ8J7Ng4sX7xbHDIJUg=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-pRp6Bi9CcHg2tMAC86CZybpfGL2BTxzst3G31tXJA5A=";
+  cargoHash = "sha256-6Ik3GhWsMwGADlbP09gf4RD0mT1zi9F+PNR89Co/LkU=";

  # COSMIC applications now uses vergen for the About page
  # Update the COMMIT_DATE to match when the commit was made
-  env.VERGEN_GIT_COMMIT_DATE = "2024-10-31";
+  env.VERGEN_GIT_COMMIT_DATE = "2025-01-14";
  env.VERGEN_GIT_SHA = src.rev;

  postPatch = ''
--- a/pkgs/by-name/co/cosmic-term/package.nix
+++ b/pkgs/by-name/co/cosmic-term/package.nix
@ -19,21 +19,21 @@

 rustPlatform.buildRustPackage rec {
  pname = "cosmic-term";
-  version = "1.0.0-alpha.3";
+  version = "1.0.0-alpha.5.1";

  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-term";
    rev = "epoch-${version}";
-    hash = "sha256-4++wCyRVIodWdlrvK2vMcHGoY4BctnrkopWC6dZvhMk=";
+    hash = "sha256-uPKbh1PA8P51Gcet459ZBRKRe0JmxSWvIFn3AQIG6KY=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-0KXo1wtbbnK3Kk+EGZo7eEecM4PChLpwawWWI0Bp/Yw=";
+  cargoHash = "sha256-clGzp7pH7YHePFzlq2eLYKKx9IiFQKB5FmqPeuSuIVc=";

  # COSMIC applications now uses vergen for the About page
  # Update the COMMIT_DATE to match when the commit was made
-  env.VERGEN_GIT_COMMIT_DATE = "2024-09-24";
+  env.VERGEN_GIT_COMMIT_DATE = "2025-01-14";
  env.VERGEN_GIT_SHA = src.rev;

  postPatch = ''
--- a/pkgs/by-name/do/dotnet-ef/package.nix
+++ b/pkgs/by-name/do/dotnet-ef/package.nix
@ -2,9 +2,9 @@

 buildDotnetGlobalTool {
  pname = "dotnet-ef";
-  version = "9.0.0";
+  version = "9.0.1";

-  nugetHash = "sha256-/Ru/H2WXX/SCqF2s0M1DJkaw+6Nikm+ccrveqiOXggA=";
+  nugetHash = "sha256-b1dxnBDnsn4kWvcy95eQj3qrL4ucAqw/pXvU3aFpPk8=";

  meta = {
    description = "The Entity Framework Core tools help with design-time development tasks.";
--- a/pkgs/by-name/eb/eb-garamond/package.nix
+++ b/pkgs/by-name/eb/eb-garamond/package.nix
@ -1,23 +1,43 @@
 {
  lib,
  stdenvNoCC,
-  fetchzip,
+  fetchFromGitHub,
+  python3,
+  ttfautohint,
 }:
-
 stdenvNoCC.mkDerivation rec {
  pname = "eb-garamond";
  version = "0.016";

-  src = fetchzip {
-    url = "https://bitbucket.org/georgd/eb-garamond/downloads/EBGaramond-${version}.zip";
-    hash = "sha256-P2VCLcqcMBBoTDJyRLP9vlHI+jE0EqPjPziN2MJbgEg=";
+  src = fetchFromGitHub {
+    owner = "georgd";
+    repo = "EB-Garamond";
+    tag = "v${version}";
+    hash = "sha256-ajieKhTeH6yv2qiE2xqnHFoMS65//4ZKiccAlC2PXGQ=";
  };

+  nativeBuildInputs = [
+    (python3.withPackages (p: [ p.fontforge ]))
+    ttfautohint
+  ];
+
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace-fail "@\$(SFNTTOOL) -w \$< \$@"   "@fontforge -lang=ff -c 'Open(\$\$1); Generate(\$\$2)' \$< \$@"
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+    make WEB=build EOT="" all
+    runHook postBuild
+  '';
+
  installPhase = ''
    runHook preInstall

-    install -Dm644 otf/*.otf                                 -t $out/share/fonts/opentype
-    install -Dm644 Changes README.markdown README.xelualatex -t $out/share/doc/${pname}-${version}
+    install -Dm644 build/*.ttf  -t $out/share/fonts/truetype
+    install -Dm644 build/*.otf  -t $out/share/fonts/opentype
+    install -Dm644 build/*.woff -t $out/share/fonts/woff

    runHook postInstall
  '';
@ -26,6 +46,7 @@ stdenvNoCC.mkDerivation rec {
    homepage = "http://www.georgduffner.at/ebgaramond/";
    description = "Digitization of the Garamond shown on the Egenolff-Berner specimen";
    maintainers = with maintainers; [
+      bengsparks
      relrod
      rycee
    ];
--- a/pkgs/by-name/ej/ejsonkms/package.nix
+++ b/pkgs/by-name/ej/ejsonkms/package.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "ejsonkms";
-  version = "0.2.3";
+  version = "0.2.4";

  src = fetchFromGitHub {
    owner = "envato";
    repo = "ejsonkms";
    rev = "v${version}";
-    hash = "sha256-GrereV1IFRTaQEK+wjRHnXSydaKQgQeuxYgSAxEuok0=";
+    hash = "sha256-kk/+EOZ1g6SiIajcKXf6lVnll/NRWgwbFO2j07HERBI=";
  };

-  vendorHash = "sha256-bfR2jz4M5C60Nket9UW2C9GTK8jkbm6FZUar+wwDnbc=";
+  vendorHash = "sha256-ZSoxG532eicpR1pS2oLYnJxtJrsHZZRbjncxU4uyT3c=";

  ldflags = [
    "-X main.version=v${version}"
--- a/pkgs/by-name/ex/exo/package.nix
+++ b/pkgs/by-name/ex/exo/package.nix
@ -7,14 +7,14 @@
 }:
 python3Packages.buildPythonApplication rec {
  pname = "exo";
-  version = "0.0.5-alpha";
+  version = "0.0.10-alpha";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "exo-explore";
    repo = "exo";
    tag = "v${version}";
-    hash = "sha256-bAbKmLoJbDVwGoWTxA3a0CUzVFoso6/Uz6e48MSJDgw=";
+    hash = "sha256-JJGjr9RLiJ23mPpSsx6exs8hXx/ZkL5rl8i6Xg1vFhY=";
  };

  build-system = with python3Packages; [ setuptools ];
@ -30,7 +30,6 @@ python3Packages.buildPythonApplication rec {
    grpcio
    grpcio-tools
    jinja2
-    netifaces
    numpy
    nuitka
    nvidia-ml-py
@ -42,6 +41,7 @@ python3Packages.buildPythonApplication rec {
    pydantic
    requests
    rich
+    scapy
    tenacity
    tqdm
    transformers
@ -74,6 +74,7 @@ python3Packages.buildPythonApplication rec {
  meta = {
    description = "Run your own AI cluster at home with everyday devices";
    homepage = "https://github.com/exo-explore/exo";
+    changelog = "https://github.com/exo-explore/exo/releases/tag/v${version}";
    license = lib.licenses.gpl3Only;
    maintainers = with lib.maintainers; [ GaetanLepage ];
    mainProgram = "exo";
--- a/pkgs/by-name/fr/freeipmi/package.nix
+++ b/pkgs/by-name/fr/freeipmi/package.nix
@ -9,12 +9,12 @@
 }:

 stdenv.mkDerivation rec {
-  version = "1.6.14";
+  version = "1.6.15";
  pname = "freeipmi";

  src = fetchurl {
    url = "mirror://gnu/freeipmi/${pname}-${version}.tar.gz";
-    sha256 = "sha256-Gj2sXHa3zMTU+GqhK475shK673SJvwXombiau34U7bU=";
+    sha256 = "sha256-1pKcNUY59c51tbGJfos2brY2JcI+XEWQp66gNP4rjK8=";
  };

  depsBuildBuild = [ buildPackages.stdenv.cc ];
--- a/pkgs/by-name/fw/fwupd/package.nix
+++ b/pkgs/by-name/fw/fwupd/package.nix
@ -117,7 +117,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "fwupd";
-  version = "2.0.3";
+  version = "2.0.4";

  # libfwupd goes to lib
  # daemon, plug-ins and libfwupdplugin go to out
@ -135,7 +135,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "fwupd";
    repo = "fwupd";
    tag = finalAttrs.version;
-    hash = "sha256-M0FZ5fyufm6h+/IyhajxpcjrGANKkyFzWKmn4EzLxKY=";
+    hash = "sha256-0+2B8/ZuniZCeP1LMzLcJsvE3RzlHuw0jd6rlkoW6zY=";
  };

  patches = [
--- a/pkgs/by-name/ge/geteduroam-cli/package.nix
+++ b/pkgs/by-name/ge/geteduroam-cli/package.nix
@ -0,0 +1,45 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+buildGoModule rec {
+  pname = "geteduroam-cli";
+  version = "0.4";
+
+  src = fetchFromGitHub {
+    owner = "geteduroam";
+    repo = "linux-app";
+    tag = version;
+    hash = "sha256-9+IjrHg536/6ulj94CBhYWY0S3aNA7Ne4JQynMmsLxE=";
+  };
+
+  vendorHash = "sha256-9SNjOC59wcEkxJqBXsgYClHKGH7OFWk3t/wMPLANAy0=";
+
+  subPackages = [
+    "cmd/geteduroam-cli"
+  ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgram = "${placeholder "out"}/bin/geteduroam-cli";
+  versionCheckProgramArg = [ "--version" ];
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "CLI client to configure eduroam";
+    mainProgram = "geteduroam-cli";
+    homepage = "https://github.com/geteduroam/linux-app";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ viperML ];
+    platforms = lib.platforms.linux;
+    changelog = "https://github.com/geteduroam/linux-app/releases/tag/${version}";
+  };
+}
--- a/pkgs/by-name/gh/ghostunnel/package.nix
+++ b/pkgs/by-name/gh/ghostunnel/package.nix
@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "ghostunnel";
-  version = "1.8.3";
+  version = "1.8.4";

  src = fetchFromGitHub {
    owner = "ghostunnel";
    repo = "ghostunnel";
    rev = "v${version}";
-    hash = "sha256-WO7dyz+S8dBSFfNCTHHg1lGDlUGSBqa5pcR5GCiWsl8=";
+    hash = "sha256-NnRm1HEdfK6WI5ntilLSwdR2B5czG5CIcMFzl2TzEds=";
  };

  vendorHash = null;
--- a/pkgs/by-name/gi/gitkraken/package.nix
+++ b/pkgs/by-name/gi/gitkraken/package.nix
@ -57,24 +57,24 @@

 let
  pname = "gitkraken";
-  version = "10.6.1";
+  version = "10.6.2";

  throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";

  srcs = {
    x86_64-linux = fetchzip {
      url = "https://release.axocdn.com/linux/GitKraken-v${version}.tar.gz";
-      hash = "sha256-OzVBimAi9vAi6YhSRV0a51MWSmdHmHvvXbimeaNFpBU=";
+      hash = "sha256-E/9BR4PE5QF075+NgJZTtgDoShHEqeRcoICnMLt3RuY=";
    };

    x86_64-darwin = fetchzip {
      url = "https://release.axocdn.com/darwin/GitKraken-v${version}.zip";
-      hash = "sha256-MF6H3tNUw4P4BAzScMsolyB9Qage/7aZwe84gCBjyV4=";
+      hash = "sha256-gCiZN+ivXEF5KLas7eZn9iWfXcDGwf1gXK1ejY2C4xs=";
    };

    aarch64-darwin = fetchzip {
      url = "https://release.axocdn.com/darwin-arm64/GitKraken-v${version}.zip";
-      hash = "sha256-Akn8LSSYEj/dUU8iNWm5wO239wKGBmQp9RfzbCjI5Wo=";
+      hash = "sha256-1zd57Kqi5iKHw/dNqLQ7jVAkNFvkFeqQbZPN32kF9IU=";
    };
  };

--- a/pkgs/by-name/gl/glab/package.nix
+++ b/pkgs/by-name/gl/glab/package.nix
@ -9,16 +9,16 @@

 buildGo123Module rec {
  pname = "glab";
-  version = "1.51.0";
+  version = "1.52.0";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-EWcoEm6DbRT0PP2qYhdwDHCkbeAG6vDVATPhX9pPfiw=";
+    hash = "sha256-XK/6b2KWwyHev3zVyNKJlOHTenloO28dXgG1ZazE54Q=";
  };

-  vendorHash = "sha256-f6qAFeB9kshtQ2AW6OnEGSnhJYlJ2gAGRDplVmQSVNA=";
+  vendorHash = "sha256-0Mx7QbQQbRhtBcsRWdnSJvEXAtUus/n/KzXTi33ekvc=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/go/gollama/package.nix
+++ b/pkgs/by-name/go/gollama/package.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "gollama";
-  version = "1.28.4";
+  version = "1.28.5";

  src = fetchFromGitHub {
    owner = "sammcj";
    repo = "gollama";
    tag = "v${version}";
-    hash = "sha256-n3GbEPh69mrr5qZ2TVzKv06lkR+zuhH9TtjmusXDHQg=";
+    hash = "sha256-7wCBflX34prZJl4HhZUU2a2qHxaBs1fMKHpwE0vX1GE=";
  };

  vendorHash = "sha256-Y5yg54em+vqoWXxS3JVQVPEM+fLXgoblmY+48WpxSCQ=";
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@ -93,6 +93,9 @@
  # For Vulkan support (--enable-features=Vulkan)
  addDriverRunpath,
  undmg,
+
+  # For QT support
+  qt6,
 }:

 let
@ -162,6 +165,8 @@ let
    ++ [
      gtk3
      gtk4
+      qt6.qtbase
+      qt6.qtwayland
    ];

  linux = stdenv.mkDerivation (finalAttrs: {
@ -243,6 +248,9 @@ let

      # "--simulate-outdated-no-au" disables auto updates and browser outdated popup
      makeWrapper "$out/share/google/$appname/google-$appname" "$exe" \
+        --prefix QT_PLUGIN_PATH  : "${qt6.qtbase}/lib/qt-6/plugins" \
+        --prefix QT_PLUGIN_PATH  : "${qt6.qtwayland}/lib/qt-6/plugins" \
+        --prefix NIXPKGS_QT6_QML_IMPORT_PATH : "${qt6.qtwayland}/lib/qt-6/qml" \
        --prefix LD_LIBRARY_PATH : "$rpath" \
        --prefix PATH            : "$binpath" \
        --suffix PATH            : "${lib.makeBinPath [ xdg-utils ]}" \
--- a/pkgs/by-name/go/google-cloud-sql-proxy/package.nix
+++ b/pkgs/by-name/go/google-cloud-sql-proxy/package.nix
@ -7,18 +7,18 @@

 buildGoModule rec {
  pname = "google-cloud-sql-proxy";
-  version = "2.14.2";
+  version = "2.14.3";

  src = fetchFromGitHub {
    owner = "GoogleCloudPlatform";
    repo = "cloud-sql-proxy";
    rev = "v${version}";
-    hash = "sha256-jnecQkfZzg7psWOamJTpUnxjkW0tJkuGw06GGBNbub0=";
+    hash = "sha256-zY4V5QNoesvwJxW9htTkmMk6KPCxKvLg1FVn+xmlw14=";
  };

  subPackages = [ "." ];

-  vendorHash = "sha256-7jMDSW32MoHCN51yqLliUBfcjsE5l0mPvGXair5KLxA=";
+  vendorHash = "sha256-ZwCe8gJ1Sowvt0X+inFoiYpJjhl/sdQUqrkXte2gV2I=";

  checkFlags = [
    "-short"
--- a/pkgs/by-name/gr/grpc-gateway/package.nix
+++ b/pkgs/by-name/gr/grpc-gateway/package.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "grpc-gateway";
-  version = "2.25.1";
+  version = "2.26.0";

  src = fetchFromGitHub {
    owner = "grpc-ecosystem";
    repo = "grpc-gateway";
    tag = "v${version}";
-    sha256 = "sha256-1bNYTzfBSwEEi5tjDjUI9i+0Xh+T0SQNE+8GgDwexx0=";
+    sha256 = "sha256-Vg47U57gHau7t5a1TEQuTKRUtn90gbrTETO+ngd8Bzc=";
  };

-  vendorHash = "sha256-zWWJxvwOZTAk5f6AMrhCBo3n5/Np6hucx6AM+Ucq6ec=";
+  vendorHash = "sha256-8YxAPvTP9o7ns4Gjs1WdqFColyZg7LoYolGQmNdCvTs=";

  ldflags = [
    "-X=main.version=${version}"
--- a/pkgs/by-name/gu/guile-hoot/package.nix
+++ b/pkgs/by-name/gu/guile-hoot/package.nix
@ -0,0 +1,47 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  autoreconfHook,
+  guile,
+  pkg-config,
+  texinfo,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "guile-hoot";
+  version = "0.5.0";
+
+  src = fetchFromGitLab {
+    owner = "spritely";
+    repo = "guile-hoot";
+    rev = "v${version}";
+    hash = "sha256-n8u0xK2qDLGySxiYWH882/tkL8ggu3hivHn3qdDO9eI=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    guile
+    pkg-config
+    texinfo
+  ];
+  buildInputs = [
+    guile
+  ];
+  strictDeps = true;
+
+  makeFlags = [ "GUILE_AUTO_COMPILE=0" ];
+
+  configureFlags = [
+    "--with-guile-site-dir=$(out)/${guile.siteDir}"
+    "--with-guile-site-ccache-dir=$(out)/${guile.siteCcacheDir}"
+  ];
+
+  meta = {
+    description = "Scheme to WebAssembly compiler backend for GNU Guile and a general purpose WASM toolchain";
+    homepage = "https://gitlab.com/spritely/guile-hoot";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ jinser ];
+    platforms = lib.platforms.unix;
+  };
+}
--- a/pkgs/by-name/he/hexpatch/package.nix
+++ b/pkgs/by-name/he/hexpatch/package.nix
@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "hexpatch";
-  version = "1.9.4";
+  version = "1.9.5";

  src = fetchFromGitHub {
    owner = "Etto48";
    repo = "HexPatch";
    tag = "v${version}";
-    hash = "sha256-tVJp8ZFHaHM6Yhty0n5W4ZDKG/L5+8ZcbbTnw2yLEOI=";
+    hash = "sha256-DRuknqj4E+G4ChN5CH5N4Zrl3btSo1HdqiRPfLC5YTE=";
  };

-  cargoHash = "sha256-oKZjLS4+blGMt3K6in4i7JLqKZ8uWAv/uBFU9VT0Ha8=";
+  cargoHash = "sha256-5yZ+eJUjUUNCmJtFYRSzvdjZ7tnyjCO+lgwdDHluSGg=";

  nativeBuildInputs = [
    cmake
@ -37,7 +37,7 @@ rustPlatform.buildRustPackage rec {
  doInstallCheck = true;

  passthru = {
-    upateScript = nix-update-script { };
+    updateScript = nix-update-script { };
  };

  meta = {
--- a/pkgs/by-name/ht/httm/package.nix
+++ b/pkgs/by-name/ht/httm/package.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "httm";
-  version = "0.44.1";
+  version = "0.45.0";

  src = fetchFromGitHub {
    owner = "kimono-koans";
    repo = pname;
    rev = version;
-    hash = "sha256-vf5wIXYMBB7I6enmCYByoAE+2MWA/iUoq3UY86yRsEU=";
+    hash = "sha256-g+UUiFgOTuSNymg3OcIsoTqWA/OOZzwFCUQ7YxW1AzE=";
  };

-  cargoHash = "sha256-o9Ctt5a96vBhh0eB0z9N9qR3txVWdeq2qH9dYaxqtoA=";
+  cargoHash = "sha256-+ygXGSnhs9N7oHGqVA7Bo3JIgR8TZpY9y4tkBd4vZy8=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/k3/k3sup/package.nix
+++ b/pkgs/by-name/k3/k3sup/package.nix
@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "k3sup";
-  version = "0.13.7";
+  version = "0.13.8";

  src = fetchFromGitHub {
    owner = "alexellis";
    repo = "k3sup";
    rev = version;
-    sha256 = "sha256-B9Mo0+dqF15LuhCytMBax2gKjHl9mBkxLXCdb9f0Big=";
+    sha256 = "sha256-WmvCmG/wk63VnfJTFk3HhiaLzCe9O6kdUc7GpYNAwP4=";
  };

  nativeBuildInputs = [ makeWrapper installShellFiles ];
--- a/pkgs/by-name/ka/kakoune-lsp/package.nix
+++ b/pkgs/by-name/ka/kakoune-lsp/package.nix
@ -12,18 +12,18 @@

 rustPlatform.buildRustPackage rec {
  pname = "kakoune-lsp";
-  version = "18.1.1";
+  version = "18.1.2";

  src = fetchFromGitHub {
    owner = "kakoune-lsp";
    repo = "kakoune-lsp";
    rev = "v${version}";
-    hash = "sha256-7ULohcCpIKOb7CtsF2dIkiRt94uBIrGD5pQ2AEfrNrY=";
+    hash = "sha256-wIKAChmD6gVfrRguywiAnpT3kbCbRk2k2u4ckd1CNOw=";
  };

  patches = [ (replaceVars ./Hardcode-perl.patch { inherit perl; }) ];

-  cargoHash = "sha256-eG9VPsZkdNTieUc4ghngLqE2ps6wJFR7W8qcmfMu0fs=";
+  cargoHash = "sha256-6qXdZ1EtYdne0zs5usLXkZm2qYl1gwpTki0cvip+FkE=";

  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
    CoreServices
--- a/pkgs/by-name/ko/komac/package.nix
+++ b/pkgs/by-name/ko/komac/package.nix
@ -13,15 +13,16 @@
  installShellFiles,
  versionCheckHook,
  nix-update-script,
+  bzip2,
 }:

 let
-  version = "2.8.0";
+  version = "2.9.0";
  src = fetchFromGitHub {
    owner = "russellbanks";
    repo = "Komac";
    tag = "v${version}";
-    hash = "sha256-yAf89GtKu500VPn+CKF6sGC+TPhJcGz2lR7C30/YBRI=";
+    hash = "sha256-5mGjzWuArEIl5+SHUaOFIRBEjdeCKQOAsUVepPBbsFM=";
  };
 in
 rustPlatform.buildRustPackage {
@ -29,7 +30,7 @@ rustPlatform.buildRustPackage {

  pname = "komac";

-  cargoHash = "sha256-wgOZoKsbYkbbCKS+2pfqgsHD5Azw72gPJXHhfw5mNqo=";
+  cargoHash = "sha256-IM+swMrLoHeY/sk9w6CB66IGCNNioVJzNyKKtXimN5g=";

  nativeBuildInputs =
    [
@ -44,6 +45,7 @@ rustPlatform.buildRustPackage {
      dbus
      openssl
      zstd
+      bzip2
    ]
    ++ lib.optionals stdenv.hostPlatform.isDarwin [
      darwin.apple_sdk.frameworks.Security
--- a/pkgs/by-name/kr/kryptor/deps.json
+++ b/pkgs/by-name/kr/kryptor/deps.json
@ -1,23 +1,23 @@
 [
  {
    "pname": "Geralt",
-    "version": "2.1.0",
-    "hash": "sha256-BCXJKa9200GFqlm0GFAyAxGRzlorFxHct83VXyZZlvQ="
+    "version": "3.3.0",
+    "hash": "sha256-vTGhyPsE5xxfM4nbADq54wM9FpEXLJgxuT5a2WvY79g="
  },
  {
    "pname": "libsodium",
-    "version": "1.0.18.4",
-    "hash": "sha256-mdV0etNrKc5rjsIxhCkj7qafT+yv6PTuYCheveVjPwI="
+    "version": "1.0.20.1",
+    "hash": "sha256-wd/z31FRbcaVGrogSNVjefEYWjNxTGzQd04DOlY1PFE="
  },
  {
    "pname": "McMaster.Extensions.CommandLineUtils",
-    "version": "4.0.2",
-    "hash": "sha256-e+UEOOxYPOEcX6QXTU8F+G5093qPSrfOqsYCLDcwSvQ="
+    "version": "4.1.1",
+    "hash": "sha256-K10ukfRqcRIKJT7PFxc7NFpKWRT+FIDg8IJAR8HA5Eo="
  },
  {
    "pname": "Monocypher",
-    "version": "0.3.0",
-    "hash": "sha256-InbhO6d2wZ96Zl69b+KIUVM6XRU1X1op6e15afx6hps="
+    "version": "0.4.1",
+    "hash": "sha256-mfLdmQkgsmpCdQuxbdU0IE900FfPrWTdi1iN/ZBL0ow="
  },
  {
    "pname": "System.ComponentModel.Annotations",
--- a/pkgs/by-name/kr/kryptor/package.nix
+++ b/pkgs/by-name/kr/kryptor/package.nix
@ -8,23 +8,21 @@

 buildDotnetModule rec {
  pname = "kryptor";
-  version = "4.1.0";
+  version = "4.1.1";

  src = fetchFromGitHub {
    owner = "samuel-lucas6";
    repo = "Kryptor";
    tag = "v${version}";
-    hash = "sha256-BxUmDzmfvRelQDHb5uLcQ2YPL7ClxZNFGm/gQoDK8t8=";
+    hash = "sha256-+pG3u4U3IZ6jw2p2f1jptX7C/qt0mPIcMG82XYtPzbs=";
  };

  dotnet-sdk = dotnetCorePackages.sdk_8_0;
-  projectFile = "src/Kryptor.sln";
+  projectFile = "src/Kryptor/Kryptor.csproj";
  nugetDeps = ./deps.json;

  executables = [ "kryptor" ];

-  dotnetFlags = [ "-p:TargetFramework=net8.0" ];
-
  doInstallCheck = true;
  nativeInstallCheckInputs = [ versionCheckHook ];

--- a/pkgs/by-name/kt/ktor-cli/package.nix
+++ b/pkgs/by-name/kt/ktor-cli/package.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "ktor-cli";
-  version = "0.3.1";
+  version = "0.4.0";

  src = fetchFromGitHub {
    owner = "ktorio";
    repo = "ktor-cli";
    tag = version;
-    hash = "sha256-UOO6hoUZazlrP+OJ6WCdY358wnRnAiQHEXrOpN7ZIvU=";
+    hash = "sha256-TGwkGm1Rsg82f6FJeTnhyvfS2MRMe5+DTdxTsOwwb1Q=";
  };

  subPackages = "cmd/ktor";
--- a/pkgs/by-name/li/libfakekey/package.nix
+++ b/pkgs/by-name/li/libfakekey/package.nix
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
    hash = "sha256-QNJlxZ9uNwNgFWm9qRJdPfusx7dXHZajjFH7wDhpgcs=";
  };

-  preConfigure = "./autogen.sh";
+  configureScript = "./autogen.sh";

  nativeBuildInputs = [
    automake
--- a/pkgs/by-name/li/litmusctl/package.nix
+++ b/pkgs/by-name/li/litmusctl/package.nix
@ -8,7 +8,7 @@

 buildGoModule rec {
  pname = "litmusctl";
-  version = "1.13.0";
+  version = "1.14.0";

  nativeBuildInputs = [
    installShellFiles
@ -22,7 +22,7 @@ buildGoModule rec {
    owner = "litmuschaos";
    repo = "litmusctl";
    rev = "${version}";
-    hash = "sha256-lPdejdnBefhYgv52I7BOm1VTgqHSp8u1lgJJxK5GWSA=";
+    hash = "sha256-Saj5sx5YkcKsnMrnIzPcLok+mgEZSh9p8rnfQbJhAeU=";
  };

  vendorHash = "sha256-7FYOQ89aUFPX+5NCPYKg+YGCXstQ6j9DK4V2mCgklu0=";
--- a/pkgs/by-name/lm/lm_sensors/package.nix
+++ b/pkgs/by-name/lm/lm_sensors/package.nix
@ -14,7 +14,7 @@

 let
  version = "3.6.0";
-  tag = lib.replaceStrings [ "." ] [ "-" ] version;
+  tag = "V" + lib.replaceStrings [ "." ] [ "-" ] version;
 in

 stdenv.mkDerivation {
--- a/pkgs/servers/web-apps/matomo/bootstrap.php
+++ b/pkgs/servers/web-apps/matomo/bootstrap.php
--- a/pkgs/servers/web-apps/matomo/change-path-geoip2-5.x.patch
+++ b/pkgs/servers/web-apps/matomo/change-path-geoip2-5.x.patch
--- a/pkgs/servers/web-apps/matomo/make-localhost-default-database-host.patch
+++ b/pkgs/servers/web-apps/matomo/make-localhost-default-database-host.patch
--- a/pkgs/by-name/ma/matomo/package.nix
+++ b/pkgs/by-name/ma/matomo/package.nix
@ -0,0 +1,123 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  makeWrapper,
+  php,
+  nixosTests,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "matomo";
+  version = "5.2.1";
+
+  src = fetchurl {
+    url = "https://builds.matomo.org/matomo-${finalAttrs.version}.tar.gz";
+    hash = "sha256-5glMwwIG0Uo8bu904u40FUa+yaUlrQe1nUCkv9/ATks=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  patches = [
+    # This changes the default value of the database server field
+    # from 127.0.0.1 to localhost.
+    # unix socket authentication only works with localhost,
+    # but password-based SQL authentication works with both.
+    # TODO: is upstream interested in this?
+    # -> discussion at https://github.com/matomo-org/matomo/issues/12646
+    ./make-localhost-default-database-host.patch
+    # This changes the default config for path.geoip2 so that it doesn't point
+    # to the nix store.
+    ./change-path-geoip2-5.x.patch
+  ];
+
+  # this bootstrap.php adds support for getting PIWIK_USER_PATH
+  # from an environment variable. Point it to a mutable location
+  # to be able to use matomo read-only from the nix store
+  postPatch = ''
+    cp ${./bootstrap.php} bootstrap.php
+  '';
+
+  # TODO: future versions might rename the PIWIK_… variables to MATOMO_…
+  # TODO: Move more unnecessary files from share/, especially using PIWIK_INCLUDE_PATH.
+  #       See https://forum.matomo.org/t/bootstrap-php/5926/10 and
+  #       https://github.com/matomo-org/matomo/issues/11654#issuecomment-297730843
+  installPhase = ''
+    runHook preInstall
+
+    # copy everything to share/, used as webroot folder, and then remove what's known to be not needed
+    mkdir -p $out/share
+    cp -ra * $out/share/
+    # tmp/ is created by matomo in PIWIK_USER_PATH
+    rmdir $out/share/tmp
+    # config/ needs to be accessed by PIWIK_USER_PATH anyway
+    ln -s $out/share/config $out/
+
+    makeWrapper ${php}/bin/php $out/bin/matomo-console \
+      --add-flags "$out/share/console"
+
+    runHook postInstall
+  '';
+
+  filesToFix = [
+    "misc/composer/build-xhprof.sh"
+    "misc/composer/clean-xhprof.sh"
+    "misc/cron/archive.sh"
+    "plugins/GeoIp2/config/config.php"
+    "plugins/Installation/FormDatabaseSetup.php"
+    "vendor/pear/archive_tar/sync-php4"
+    "vendor/szymach/c-pchart/coverage.sh"
+    "vendor/matomo/matomo-php-tracker/run_tests.sh"
+    "vendor/twig/twig/drupal_test.sh"
+  ];
+
+  # This fixes the consistency check in the admin interface
+  #
+  # The filesToFix list may contain files that are exclusive to only one of the versions we build
+  # make sure to test for existence to avoid erroring on an incompatible version and failing
+  postFixup = ''
+    pushd $out/share > /dev/null
+    for f in $filesToFix; do
+      if [ -f "$f" ]; then
+        length="$(wc -c "$f" | cut -d' ' -f1)"
+        hash="$(md5sum "$f" | cut -d' ' -f1)"
+        sed -i "s:\\(\"$f\"[^(]*(\\).*:\\1\"$length\", \"$hash\"),:g" config/manifest.inc.php
+      else
+        echo "INFO(files-to-fix): $f does not exist in this version"
+      fi
+    done
+    popd > /dev/null
+  '';
+
+  passthru = {
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--url"
+        "https://github.com/matomo-org/matomo"
+      ];
+    };
+    tests = lib.optionalAttrs stdenv.hostPlatform.isLinux {
+      inherit (nixosTests) matomo;
+    };
+  };
+
+  meta = {
+    description = "Real-time web analytics application";
+    mainProgram = "matomo-console";
+    license = lib.licenses.gpl3Plus;
+    homepage = "https://matomo.org/";
+    changelog = "https://github.com/matomo-org/matomo/releases/tag/${finalAttrs.version}";
+    platforms = lib.platforms.all;
+    maintainers =
+      with lib.maintainers;
+      [
+        florianjacob
+        sebbel
+        twey
+        boozedog
+        niklaskorz
+      ]
+      ++ lib.teams.flyingcircus.members;
+  };
+})
--- a/pkgs/by-name/me/mediawiki/package.nix
+++ b/pkgs/by-name/me/mediawiki/package.nix
@ -2,11 +2,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "mediawiki";
-  version = "1.42.4";
+  version = "1.43.0";

  src = fetchurl {
    url = "https://releases.wikimedia.org/mediawiki/${lib.versions.majorMinor version}/mediawiki-${version}.tar.gz";
-    hash = "sha256-jiCXmH1Nu6fASFP2LNo338M4GeACjKSALSXzRM/o5yc=";
+    hash = "sha256-VuCn/i/3jlC5yHs9WJ8tjfW8qwAY5FSypKI5yFhr2O4=";
  };

  postPatch = ''
--- a/pkgs/by-name/mi/miniflux/package.nix
+++ b/pkgs/by-name/mi/miniflux/package.nix
@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "miniflux";
-  version = "2.2.4";
+  version = "2.2.5";

  src = fetchFromGitHub {
    owner = "miniflux";
    repo = "v2";
    tag = version;
-    hash = "sha256-h5bOZPaYu5DlN4trwf+iMafzfcyXemNdssTYpM6NCZY=";
+    hash = "sha256-jyGkuLGdf+nZnjSXHdq/tUX1SmnJ/6RNzDMeqA7BoHs=";
  };

-  vendorHash = "sha256-UR1nxza+rZtiSpY5hwAdCU4yiLm8weOCkrZHTqXQEpQ=";
+  vendorHash = "sha256-clqYjf7aObHaUmjX81czF+DJd5Ka0ZXHvw37f0mzA1I=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/mo/moar/package.nix
+++ b/pkgs/by-name/mo/moar/package.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "moar";
-  version = "1.31.0";
+  version = "1.31.2";

  src = fetchFromGitHub {
    owner = "walles";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-0HDFK2wPQtwIAVup/pVSjrdt1zpbfLV08HxeVPWC8dE=";
+    hash = "sha256-0B3XouAxQ6b9cWoov+Ofhlt+zgGh6AP1gy46LoiumoE=";
  };

  vendorHash = "sha256-J9u7LxzXk4npRyymmMKyN2ZTmhT4WwKjy0X5ITcHtoE=";
--- a/pkgs/by-name/mp/mprocs/package.nix
+++ b/pkgs/by-name/mp/mprocs/package.nix
@ -2,27 +2,31 @@
  lib,
  fetchFromGitHub,
  rustPlatform,
+  versionCheckHook,
  nix-update-script,
-  testers,
-  mprocs,
 }:

 rustPlatform.buildRustPackage rec {
  pname = "mprocs";
-  version = "0.7.1";
+  version = "0.7.2";

  src = fetchFromGitHub {
    owner = "pvolok";
    repo = "mprocs";
    tag = "v${version}";
-    sha256 = "sha256-gK2kgc0Y0s1xys+pUadi8BhGeYxtyKRhNycCoqftmDI=";
+    hash = "sha256-bNA+P6Mnhxi6YH5gAUwvAPN7STUvwDnU/r/ZBYwzgrw=";
  };

-  cargoHash = "sha256-lcs+x2devOEZg5YwAzlZKJl6VpCJXzVqNUr6N5pCei8=";
+  cargoHash = "sha256-1S2KD4N6HAAOIyXWHGwItNIDj3iyh4A9LBXQTxWb0kI=";
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = [ "--version" ];
+  doInstallCheck = true;

  passthru = {
    updateScript = nix-update-script { };
-    tests.version = testers.testVersion { package = mprocs; };
  };

  meta = {
--- a/pkgs/by-name/os/osu-lazer-bin/package.nix
+++ b/pkgs/by-name/os/osu-lazer-bin/package.nix
@ -10,23 +10,23 @@

 let
  pname = "osu-lazer-bin";
-  version = "2025.101.0";
+  version = "2025.118.2";

  src =
    {
      aarch64-darwin = fetchzip {
        url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Apple.Silicon.zip";
-        hash = "sha256-JPRjnpBt9CW4/8ykPbVCM6kv8CXEacqJTt6CPByd1P4=";
+        hash = "sha256-cUyndZAKc2Dd3YHb+rdq5QRE7ei9MxrLaal7yvjVsKE=";
        stripRoot = false;
      };
      x86_64-darwin = fetchzip {
        url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Intel.zip";
-        hash = "sha256-ryDKe8A8pCycPpupWv+zEtGWFs96sBahLF00hCzUViM=";
+        hash = "sha256-tTuiFEUv5ZVXxiN4ZN26p4ysJWeU2ccQsN06/zR2780=";
        stripRoot = false;
      };
      x86_64-linux = fetchurl {
        url = "https://github.com/ppy/osu/releases/download/${version}/osu.AppImage";
-        hash = "sha256-GsnTxVpNk2RXHLET6Ugv0/ZOlq8RUkw2ZXqRjkU+dzw=";
+        hash = "sha256-E2WWjLFEAqDqFso8eO+coZ2cuQEhUS0nBZY45jInEFA=";
      };
    }
    .${stdenvNoCC.system} or (throw "osu-lazer-bin: ${stdenvNoCC.system} is unsupported.");
--- a/pkgs/by-name/os/osu-lazer/deps.json
+++ b/pkgs/by-name/os/osu-lazer/deps.json
@ -26,8 +26,8 @@
  },
  {
    "pname": "Fody",
-    "version": "6.8.0",
-    "hash": "sha256-2laYscz0i0LalGTAup7dsh6XlYRZSojYpp8XOwZJJfg="
+    "version": "6.9.1",
+    "hash": "sha256-yDzLI06oFVNI4wiexSQK114YZlSOoGPTr8LIlr22M8I="
  },
  {
    "pname": "HidSharpCore",
@ -36,8 +36,8 @@
  },
  {
    "pname": "HtmlAgilityPack",
-    "version": "1.11.70",
-    "hash": "sha256-V/SI2N1+jNkwjSQRd2Y/XVVhdOKvSNz3/NeIFE9V3wY="
+    "version": "1.11.72",
+    "hash": "sha256-MRt7yj6+/ORmr2WBERpQ+1gMRzIaPFKddHoB4zZmv2k="
  },
  {
    "pname": "Humanizer",
@ -311,58 +311,73 @@
  },
  {
    "pname": "MessagePack",
-    "version": "2.5.187",
-    "hash": "sha256-3sBINhdkGdKPKTKxE4YuLGFHg6stAEHUIboR1g7eXgA="
+    "version": "3.1.1",
+    "hash": "sha256-8ClMtDZrSJHc51HNUn/vqGAZlVHIs63BcMnjLczLU6k="
  },
  {
    "pname": "MessagePack.Annotations",
-    "version": "2.5.187",
-    "hash": "sha256-SQCJa6u8coWMptbR9iQJLjoi/YkT9t0kJNbojh9vUPw="
+    "version": "3.1.1",
+    "hash": "sha256-WGuowO8AJ4nGfSBYtu+qJgP6QqS5mJMHtP/rRHl2Q6w="
+  },
+  {
+    "pname": "MessagePackAnalyzer",
+    "version": "3.1.1",
+    "hash": "sha256-V3YSKLjq4mEp8aIGQwPSOvqgCU7xotG0tWOjOqFg7wQ="
  },
  {
    "pname": "Microsoft.AspNetCore.Connections.Abstractions",
-    "version": "8.0.10",
-    "hash": "sha256-xnc9qaYB07MAlqCswm6kUX0HMAKcBhxWXClPN2bB8ZA="
+    "version": "9.0.0",
+    "hash": "sha256-4o05T9dNf3mBRo2QC+wa2N2n+78bOi3ShzaiauOWXZU="
  },
  {
    "pname": "Microsoft.AspNetCore.Http.Connections.Client",
-    "version": "8.0.10",
-    "hash": "sha256-yp0hgu8kyTE2zU156TWmRUpW24SAaKJm7he4MnEuiG8="
+    "version": "9.0.0",
+    "hash": "sha256-eK92e37pNx+GIAUYsW4XS42JVrTj3LyKSURxburvOCE="
  },
  {
    "pname": "Microsoft.AspNetCore.Http.Connections.Common",
-    "version": "8.0.10",
-    "hash": "sha256-ulLp+Rni007Wq9n5w2BA8DX7uG1HhYNF/KV5TN3SKSs="
+    "version": "9.0.0",
+    "hash": "sha256-IkEyefTMiD4LLwzGSCroueZVHfR06Am3QSE/ufWRq2M="
  },
  {
    "pname": "Microsoft.AspNetCore.SignalR.Client",
-    "version": "8.0.10",
-    "hash": "sha256-GEiMdjLvuc0Xmxj9/zKo3b4Y0Vh5jAjfZqPs6vwj5o0="
+    "version": "9.0.0",
+    "hash": "sha256-yXqMffVsnSBf/VDzHln1QNXOsYLoeAC5QlmjpqlTgxc="
  },
  {
    "pname": "Microsoft.AspNetCore.SignalR.Client.Core",
-    "version": "8.0.10",
-    "hash": "sha256-vTk+Smuu0Pi/MmmHZtIjdyBsZuC0gWsL/63ovmtMRWQ="
+    "version": "9.0.0",
+    "hash": "sha256-tgXFINCIRruKZAB0wfCLTeKHcAEhSalQmkHX/Zfs1iw="
  },
  {
    "pname": "Microsoft.AspNetCore.SignalR.Common",
-    "version": "8.0.10",
-    "hash": "sha256-LlOfWupgG9pXpNXOfHo3/tmS9ZZy3hziAEqI1X42sh4="
+    "version": "9.0.0",
+    "hash": "sha256-en6periuk86BXYnnJVy5zfeIqlAKjFVliR6DO5J2UiA="
  },
  {
    "pname": "Microsoft.AspNetCore.SignalR.Protocols.Json",
-    "version": "8.0.10",
-    "hash": "sha256-ZWDnjvZLr0FK91cyeJxtAJk2Cf+YW+6SZTW+zEIozGc="
+    "version": "9.0.0",
+    "hash": "sha256-7x5ZJ7NP0+fnVtKPX7EFBgKqVifIw4qqAZWJTzzM2fE="
  },
  {
    "pname": "Microsoft.AspNetCore.SignalR.Protocols.MessagePack",
-    "version": "8.0.10",
-    "hash": "sha256-xgxjqns/uNbzisoPX1cAmqMMrRCHxcon+l8I5TLUKGo="
+    "version": "9.0.0",
+    "hash": "sha256-2z9pE9ZYqTV2Y8dITi1famb37/sn//QytznGR1Mp9zk="
  },
  {
    "pname": "Microsoft.AspNetCore.SignalR.Protocols.NewtonsoftJson",
-    "version": "8.0.10",
-    "hash": "sha256-HgRvpIaMuEUMJGGuUCxxEigHv/Tlb2/Pd+OQJBHE5DU="
+    "version": "9.0.0",
+    "hash": "sha256-4O9K6+55QL5vV5ywvUFPSefpozcY/xeVjeCFiH3kvIE="
+  },
+  {
+    "pname": "Microsoft.Bcl.AsyncInterfaces",
+    "version": "9.0.0",
+    "hash": "sha256-BsXNOWEgfFq3Yz7VTtK6m/ov4/erRqyBzieWSIpmc1U="
+  },
+  {
+    "pname": "Microsoft.Bcl.TimeProvider",
+    "version": "9.0.0",
+    "hash": "sha256-m3IMExnLJeARejxaFiJyTxLHDoaVv/B75/EEFSPlWWo="
  },
  {
    "pname": "Microsoft.CodeAnalysis.BannedApiAnalyzers",
@ -376,8 +391,8 @@
  },
  {
    "pname": "Microsoft.Data.Sqlite.Core",
-    "version": "8.0.10",
-    "hash": "sha256-YBjY88KAC4ShfcGXcNHL6y1A9NH2xvk4d/qTMfuLuoE="
+    "version": "9.0.0",
+    "hash": "sha256-zxVvQSpfECqsjawJVIUBuE82pG5mN2F7iPCRLoK7Q4c="
  },
  {
    "pname": "Microsoft.Diagnostics.NETCore.Client",
@ -396,8 +411,8 @@
  },
  {
    "pname": "Microsoft.Extensions.Configuration.Abstractions",
-    "version": "8.0.0",
-    "hash": "sha256-4eBpDkf7MJozTZnOwQvwcfgRKQGcNXe0K/kF+h5Rl8o="
+    "version": "9.0.0",
+    "hash": "sha256-xtG2USC9Qm0f2Nn6jkcklpyEDT3hcEZOxOwTc0ep7uc="
  },
  {
    "pname": "Microsoft.Extensions.DependencyInjection",
@ -406,8 +421,8 @@
  },
  {
    "pname": "Microsoft.Extensions.DependencyInjection",
-    "version": "8.0.1",
-    "hash": "sha256-O9g0jWS+jfGoT3yqKwZYJGL+jGSIeSbwmvomKDC3hTU="
+    "version": "9.0.0",
+    "hash": "sha256-dAH52PPlTLn7X+1aI/7npdrDzMEFPMXRv4isV1a+14k="
  },
  {
    "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
@ -426,8 +441,8 @@
  },
  {
    "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
-    "version": "8.0.2",
-    "hash": "sha256-UfLfEQAkXxDaVPC7foE/J3FVEXd31Pu6uQIhTic3JgY="
+    "version": "9.0.0",
+    "hash": "sha256-CncVwkKZ5CsIG2O0+OM9qXuYXh3p6UGyueTHSLDVL+c="
  },
  {
    "pname": "Microsoft.Extensions.DependencyModel",
@ -436,13 +451,13 @@
  },
  {
    "pname": "Microsoft.Extensions.Features",
-    "version": "8.0.10",
-    "hash": "sha256-mJXz6jSbr1xG8L3cILyODzX21uh5o4Qy9yWYgZ6okxM="
+    "version": "9.0.0",
+    "hash": "sha256-dggXnp8B+17+54anZ3iqZA/amBODUZQe2E9MYgtdV28="
  },
  {
    "pname": "Microsoft.Extensions.Logging",
-    "version": "8.0.1",
-    "hash": "sha256-vkfVw4tQEg86Xg18v6QO0Qb4Ysz0Njx57d1XcNuj6IU="
+    "version": "9.0.0",
+    "hash": "sha256-kR16c+N8nQrWeYLajqnXPg7RiXjZMSFLnKLEs4VfjcM="
  },
  {
    "pname": "Microsoft.Extensions.Logging.Abstractions",
@ -451,8 +466,8 @@
  },
  {
    "pname": "Microsoft.Extensions.Logging.Abstractions",
-    "version": "8.0.2",
-    "hash": "sha256-cHpe8X2BgYa5DzulZfq24rg8O2K5Lmq2OiLhoyAVgJc="
+    "version": "9.0.0",
+    "hash": "sha256-iBTs9twjWXFeERt4CErkIIcoJZU1jrd1RWCI8V5j7KU="
  },
  {
    "pname": "Microsoft.Extensions.ObjectPool",
@ -466,8 +481,8 @@
  },
  {
    "pname": "Microsoft.Extensions.Options",
-    "version": "8.0.2",
-    "hash": "sha256-AjcldddddtN/9aH9pg7ClEZycWtFHLi9IPe1GGhNQys="
+    "version": "9.0.0",
+    "hash": "sha256-DT5euAQY/ItB5LPI8WIp6Dnd0lSvBRP35vFkOXC68ck="
  },
  {
    "pname": "Microsoft.Extensions.Primitives",
@ -476,13 +491,13 @@
  },
  {
    "pname": "Microsoft.Extensions.Primitives",
-    "version": "8.0.0",
-    "hash": "sha256-FU8qj3DR8bDdc1c+WeGZx/PCZeqqndweZM9epcpXjSo="
+    "version": "9.0.0",
+    "hash": "sha256-ZNLusK1CRuq5BZYZMDqaz04PIKScE2Z7sS2tehU7EJs="
  },
  {
    "pname": "Microsoft.NET.StringTools",
-    "version": "17.6.3",
-    "hash": "sha256-H2Qw8x47WyFOd/VmgRmGMc+uXySgUv68UISgK8Frsjw="
+    "version": "17.11.4",
+    "hash": "sha256-lWfzY35WQ+iKS9TpuztDTljgF9CIORhFhFEm0p1dVBE="
  },
  {
    "pname": "Microsoft.NETCore.Platforms",
@ -536,8 +551,8 @@
  },
  {
    "pname": "MongoDB.Bson",
-    "version": "2.19.1",
-    "hash": "sha256-HUdPLxxzJNYQm22NEmwJoq0B6LtRK8d4NBstqi0t9uw="
+    "version": "2.21.0",
+    "hash": "sha256-LZdDJkwQSVBLJfeE3SEckpi+EZcHIccHlhHoUxZ5FqE="
  },
  {
    "pname": "NativeLibraryLoader",
@ -576,8 +591,8 @@
  },
  {
    "pname": "NVika",
-    "version": "3.0.0",
-    "hash": "sha256-zgg8aUuIFQ4EZHScy+YHmkwDE9K5vzUJF8s9aiJNFuw="
+    "version": "4.0.0",
+    "hash": "sha256-daeovN+AsZX0r59SKYDSbofVAsXxT2DOTV892QrgMLY="
  },
  {
    "pname": "OpenTabletDriver",
@ -636,8 +651,8 @@
  },
  {
    "pname": "ppy.osu.Framework",
-    "version": "2024.1224.0",
-    "hash": "sha256-Ci0tblihnKxv8c0vgYvTDTfu2Fl6huEsl/2/SDdh5CQ="
+    "version": "2025.117.0",
+    "hash": "sha256-kEYVwig05l5qmS/4OAATHwYCFMyToVt/EGhwtUfV7sg="
  },
  {
    "pname": "ppy.osu.Framework.NativeLibs",
@ -666,8 +681,8 @@
  },
  {
    "pname": "ppy.SDL3-CS",
-    "version": "2024.1128.0",
-    "hash": "sha256-iiIBD2MeSMMxw7jn0QBrnD6fu457x9d3jKYe0upxoA4="
+    "version": "2025.104.0",
+    "hash": "sha256-qsszZxBGVycfukowE0fxNtM1EZFqKyssZJoOzB5K80g="
  },
  {
    "pname": "ppy.Veldrid",
@ -696,13 +711,8 @@
  },
  {
    "pname": "Realm",
-    "version": "11.5.0",
-    "hash": "sha256-ykC2fyOh4XeRJyLoO3jQQC4sZcFhSms7wswSO6Iu8mQ="
-  },
-  {
-    "pname": "Realm.PlatformHelpers",
-    "version": "11.5.0",
-    "hash": "sha256-6QUO6jQC3VwxKsNY24WSgLNtOwcaGjQDtP0S4DSt670="
+    "version": "20.1.0",
+    "hash": "sha256-DxJwBTYKGw3CcLj7j5dv7GmJTjGo5c8Z+0VwNjY74lA="
  },
  {
    "pname": "Remotion.Linq",
@ -799,16 +809,31 @@
    "version": "4.3.0",
    "hash": "sha256-LXUPLX3DJxsU1Pd3UwjO1PO9NM2elNEDXeu2Mu/vNps="
  },
+  {
+    "pname": "runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.2",
+    "hash": "sha256-EbnOqPOrAgI9eNheXLR++VnY4pHzMsEKw1dFPJ/Fl2c="
+  },
  {
    "pname": "runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl",
    "version": "4.3.0",
    "hash": "sha256-qeSqaUI80+lqw5MK4vMpmO0CZaqrmYktwp6L+vQAb0I="
  },
+  {
+    "pname": "runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.2",
+    "hash": "sha256-mVg02TNvJc1BuHU03q3fH3M6cMgkKaQPBxraSHl/Btg="
+  },
  {
    "pname": "runtime.fedora.24-x64.runtime.native.System.Security.Cryptography.OpenSsl",
    "version": "4.3.0",
    "hash": "sha256-SrHqT9wrCBsxILWtaJgGKd6Odmxm8/Mh7Kh0CUkZVzA="
  },
+  {
+    "pname": "runtime.fedora.24-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.2",
+    "hash": "sha256-g9Uiikrl+M40hYe0JMlGHe/lrR0+nN05YF64wzLmBBA="
+  },
  {
    "pname": "runtime.native.System",
    "version": "4.0.0",
@ -844,16 +869,31 @@
    "version": "4.3.0",
    "hash": "sha256-Jy01KhtcCl2wjMpZWH+X3fhHcVn+SyllWFY8zWlz/6I="
  },
+  {
+    "pname": "runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.2",
+    "hash": "sha256-xqF6LbbtpzNC9n1Ua16PnYgXHU0LvblEROTfK4vIxX8="
+  },
  {
    "pname": "runtime.opensuse.13.2-x64.runtime.native.System.Security.Cryptography.OpenSsl",
    "version": "4.3.0",
    "hash": "sha256-wyv00gdlqf8ckxEdV7E+Ql9hJIoPcmYEuyeWb5Oz3mM="
  },
+  {
+    "pname": "runtime.opensuse.13.2-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.2",
+    "hash": "sha256-aJBu6Frcg6webvzVcKNoUP1b462OAqReF2giTSyBzCQ="
+  },
  {
    "pname": "runtime.opensuse.42.1-x64.runtime.native.System.Security.Cryptography.OpenSsl",
    "version": "4.3.0",
    "hash": "sha256-zi+b4sCFrA9QBiSGDD7xPV27r3iHGlV99gpyVUjRmc4="
  },
+  {
+    "pname": "runtime.opensuse.42.1-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.2",
+    "hash": "sha256-Mpt7KN2Kq51QYOEVesEjhWcCGTqWckuPf8HlQ110qLY="
+  },
  {
    "pname": "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.Apple",
    "version": "4.3.0",
@ -864,26 +904,51 @@
    "version": "4.3.0",
    "hash": "sha256-gybQU6mPgaWV3rBG2dbH6tT3tBq8mgze3PROdsuWnX0="
  },
+  {
+    "pname": "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.2",
+    "hash": "sha256-JvMltmfVC53mCZtKDHE69G3RT6Id28hnskntP9MMP9U="
+  },
  {
    "pname": "runtime.rhel.7-x64.runtime.native.System.Security.Cryptography.OpenSsl",
    "version": "4.3.0",
    "hash": "sha256-VsP72GVveWnGUvS/vjOQLv1U80H2K8nZ4fDAmI61Hm4="
  },
+  {
+    "pname": "runtime.rhel.7-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.2",
+    "hash": "sha256-QfFxWTVRNBhN4Dm1XRbCf+soNQpy81PsZed3x6op/bI="
+  },
  {
    "pname": "runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl",
    "version": "4.3.0",
    "hash": "sha256-4yKGa/IrNCKuQ3zaDzILdNPD32bNdy6xr5gdJigyF5g="
  },
+  {
+    "pname": "runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.2",
+    "hash": "sha256-EaJHVc9aDZ6F7ltM2JwlIuiJvqM67CKRq682iVSo+pU="
+  },
  {
    "pname": "runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl",
    "version": "4.3.0",
    "hash": "sha256-HmdJhhRsiVoOOCcUvAwdjpMRiyuSwdcgEv2j9hxi+Zc="
  },
+  {
+    "pname": "runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.2",
+    "hash": "sha256-PHR0+6rIjJswn89eoiWYY1DuU8u6xRJLrtjykAMuFmA="
+  },
  {
    "pname": "runtime.ubuntu.16.10-x64.runtime.native.System.Security.Cryptography.OpenSsl",
    "version": "4.3.0",
    "hash": "sha256-pVFUKuPPIx0edQKjzRon3zKq8zhzHEzko/lc01V/jdw="
  },
+  {
+    "pname": "runtime.ubuntu.16.10-x64.runtime.native.System.Security.Cryptography.OpenSsl",
+    "version": "4.3.2",
+    "hash": "sha256-LFkh7ua7R4rI5w2KGjcHlGXLecsncCy6kDXLuy4qD/Q="
+  },
  {
    "pname": "runtime.unix.Microsoft.Win32.Primitives",
    "version": "4.3.0",
@ -926,8 +991,8 @@
  },
  {
    "pname": "Sentry",
-    "version": "4.13.0",
-    "hash": "sha256-JeyxQFOic72eQ41Guy4NbPy/A4wXvA812229vpLcLCM="
+    "version": "5.0.0",
+    "hash": "sha256-kafv0LOBPgYpX7YHU3RK7XmwVn9wuPfHZufw39aeFec="
  },
  {
    "pname": "SharpCompress",
@ -964,11 +1029,6 @@
    "version": "2.1.10",
    "hash": "sha256-gpZcYwiJVCVwCyJu0R6hYxyMB39VhJDmYh9LxcIVAA8="
  },
-  {
-    "pname": "SQLitePCLRaw.core",
-    "version": "2.1.6",
-    "hash": "sha256-RxWjm52PdmMV98dgDy0BCpF988+BssRZUgALLv7TH/E="
-  },
  {
    "pname": "SQLitePCLRaw.lib.e_sqlite3",
    "version": "2.1.10",
@ -1049,6 +1109,11 @@
    "version": "4.3.0",
    "hash": "sha256-OFJRb0ygep0Z3yDBLwAgM/Tkfs4JCDtsNhwDH9cd1Xw="
  },
+  {
+    "pname": "System.Diagnostics.DiagnosticSource",
+    "version": "9.0.0",
+    "hash": "sha256-1VzO9i8Uq2KlTw1wnCCrEdABPZuB2JBD5gBsMTFTSvE="
+  },
  {
    "pname": "System.Diagnostics.Tools",
    "version": "4.3.0",
@ -1126,13 +1191,13 @@
  },
  {
    "pname": "System.IO.Packaging",
-    "version": "8.0.1",
-    "hash": "sha256-xf0BAfqQvITompBsvfpxiLts/6sRQEzdjNA3f/q/vY4="
+    "version": "9.0.0",
+    "hash": "sha256-uIMItgRrAKHBUes9A17SqNFwTd7gjFjUsfD92v4rie4="
  },
  {
    "pname": "System.IO.Pipelines",
-    "version": "8.0.0",
-    "hash": "sha256-LdpB1s4vQzsOODaxiKstLks57X9DTD5D6cPx8DE1wwE="
+    "version": "9.0.0",
+    "hash": "sha256-vb0NrPjfEao3kfZ0tavp2J/29XnsQTJgXv3/qaAwwz0="
  },
  {
    "pname": "System.Linq",
@ -1191,8 +1256,13 @@
  },
  {
    "pname": "System.Net.Security",
-    "version": "4.3.0",
-    "hash": "sha256-B7laE1z1+ldbo6JkjlDjZynG5JiMZ/3uNHPHMP6LRak="
+    "version": "4.3.2",
+    "hash": "sha256-CAuJ0uLmDKRqbG42rBhHjHcKelYTE5gpjRlrvYNigas="
+  },
+  {
+    "pname": "System.Net.ServerSentEvents",
+    "version": "9.0.0",
+    "hash": "sha256-WOMFdUD4R7a+4OU6R0+Ch/yQ9LoepxBrMBBiq2Pnb7s="
  },
  {
    "pname": "System.Net.Sockets",
@ -1464,6 +1534,16 @@
    "version": "4.3.0",
    "hash": "sha256-vufHXg8QAKxHlujPHHcrtGwAqFmsCD6HKjfDAiHyAYc="
  },
+  {
+    "pname": "System.Text.Encodings.Web",
+    "version": "9.0.0",
+    "hash": "sha256-WGaUklQEJywoGR2jtCEs5bxdvYu5SHaQchd6s4RE5x0="
+  },
+  {
+    "pname": "System.Text.Json",
+    "version": "9.0.0",
+    "hash": "sha256-aM5Dh4okLnDv940zmoFAzRmqZre83uQBtGOImJpoIqk="
+  },
  {
    "pname": "System.Text.RegularExpressions",
    "version": "4.3.0",
@ -1486,8 +1566,8 @@
  },
  {
    "pname": "System.Threading.Channels",
-    "version": "8.0.0",
-    "hash": "sha256-c5TYoLNXDLroLIPnlfyMHk7nZ70QAckc/c7V199YChg="
+    "version": "9.0.0",
+    "hash": "sha256-depIorJqzjyWew0+aBRgbGh88KWivbp9RrtWZHFr+pI="
  },
  {
    "pname": "System.Threading.Tasks",
@ -1531,8 +1611,8 @@
  },
  {
    "pname": "Velopack",
-    "version": "0.0.915",
-    "hash": "sha256-L31qPk7/MLexF+5FP4gdNfwAWB6kNlvMFL2nfkQBSQU="
+    "version": "0.0.1053",
+    "hash": "sha256-YAOvvHDyazxqxQoZ7rDB3szkYnTq/zrzS9mXnpI+2jI="
  },
  {
    "pname": "Vortice.D3DCompiler",
--- a/pkgs/by-name/os/osu-lazer/package.nix
+++ b/pkgs/by-name/os/osu-lazer/package.nix
@ -21,13 +21,13 @@

 buildDotnetModule rec {
  pname = "osu-lazer";
-  version = "2025.101.0";
+  version = "2025.118.2";

  src = fetchFromGitHub {
    owner = "ppy";
    repo = "osu";
    tag = version;
-    hash = "sha256-8sckmwFFL7Vcf947EVxqIRPU/yYrEFVwz+zqwZZ34Mw=";
+    hash = "sha256-pQEMd+y+uS+Xl8lBuk7KwX7AcPs0MCXwkY5oPBPWmEE=";
  };

  projectFile = "osu.Desktop/osu.Desktop.csproj";
--- a/Show more
+++ b/Show more