Merge staging-next into staging

2025-06-10 03:23:29 +03:00 · 2025-04-23 12:06:57 +00:00 · 2025-04-23 12:06:57 +00:00 · ac976cffa0
commit ac976cffa0
parent de82e1ccc3 675760c789
95 changed files with 1269 additions and 858 deletions
--- a/doc/release-notes/rl-2505.section.md
+++ b/doc/release-notes/rl-2505.section.md
@ -256,7 +256,7 @@

 - `nodePackages.meshcommander` has been removed, as the package was deprecated by Intel.

- The default version of `z3` has been updated from 4.8 to 4.13. There are still a few packages that need specific older versions; those will continue to be maintained as long as other packages depend on them but may be removed in the future.
+- The default version of `z3` has been updated from 4.8 to 4.14, and all old versions have been dropped. Note that `fstar` still depends on specific versions, and maintains them as overrides.

 - `prometheus` has been updated from 2.55.0 to 3.1.0.
  Read the [release blog post](https://prometheus.io/blog/2024/11/14/prometheus-3-0/) and
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@ -162,6 +162,8 @@

 - [GlitchTip](https://glitchtip.com/), an open source Sentry API compatible error tracking platform. Available as [services.glitchtip](#opt-services.glitchtip.enable).

+- [`yarr`](https://github.com/nkanaev/yarr), a small, web-based feed aggregator and RSS reader. Available as [services.yarr](#opt-services.yarr.enable).
+
 - [Stash](https://github.com/stashapp/stash), An organizer for your adult videos/images, written in Go. Available as [services.stash](#opt-services.stash.enable).

 - [vsmartcard-vpcd](https://frankmorgner.github.io/vsmartcard/virtualsmartcard/README.html), a virtual smart card driver. Available as [services.vsmartcard-vpcd](#opt-services.vsmartcard-vpcd.enable).
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -929,6 +929,7 @@
  ./services/misc/weechat.nix
  ./services/misc/workout-tracker.nix
  ./services/misc/xmrig.nix
+  ./services/misc/yarr.nix
  ./services/misc/ytdl-sub.nix
  ./services/misc/zoneminder.nix
  ./services/misc/zookeeper.nix
--- a/nixos/modules/services/misc/yarr.nix
+++ b/nixos/modules/services/misc/yarr.nix
@ -0,0 +1,118 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    types
+    mkIf
+    mkOption
+    mkEnableOption
+    mkPackageOption
+    optionalString
+    ;
+
+  cfg = config.services.yarr;
+in
+{
+  meta.maintainers = with lib.maintainers; [ christoph-heiss ];
+
+  options.services.yarr = {
+    enable = mkEnableOption "Yet another rss reader";
+
+    package = mkPackageOption pkgs "yarr" { };
+
+    environmentFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        Environment file for specifying additional settings such as secrets.
+
+        See `yarr -help` for all available options.
+      '';
+    };
+
+    address = mkOption {
+      type = types.str;
+      default = "localhost";
+      description = "Address to run server on.";
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 7070;
+      description = "Port to run server on.";
+    };
+
+    baseUrl = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = "Base path of the service url.";
+    };
+
+    authFilePath = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = "Path to a file containing username:password. `null` means no authentication required to use the service.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.yarr = {
+      description = "Yet another rss reader";
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      environment.XDG_CONFIG_HOME = "/var/lib/yarr/.config";
+
+      serviceConfig = {
+        Type = "simple";
+        Restart = "on-failure";
+
+        StateDirectory = "yarr";
+        StateDirectoryMode = "0700";
+        WorkingDirectory = "/var/lib/yarr";
+        EnvironmentFile = cfg.environmentFile;
+
+        LoadCredential = mkIf (cfg.authFilePath != null) "authfile:${cfg.authFilePath}";
+
+        DynamicUser = true;
+        DevicePolicy = "closed";
+        LockPersonality = "yes";
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = "AF_INET AF_INET6";
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        UMask = "0077";
+
+        ExecStart = ''
+          ${lib.getExe cfg.package} \
+            -db storage.db \
+            -addr "${cfg.address}:${toString cfg.port}" \
+            ${optionalString (cfg.baseUrl != null) "-base ${cfg.baseUrl}"} \
+            ${optionalString (cfg.authFilePath != null) "-auth-file /run/credentials/yarr.service/authfile"}
+        '';
+      };
+    };
+  };
+}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -1478,6 +1478,7 @@ in
  xterm = runTest ./xterm.nix;
  xxh = runTest ./xxh.nix;
  yabar = runTest ./yabar.nix;
+  yarr = runTest ./yarr.nix;
  ydotool = handleTest ./ydotool.nix { };
  yggdrasil = runTest ./yggdrasil.nix;
  your_spotify = runTest ./your_spotify.nix;
--- a/nixos/tests/armagetronad.nix
+++ b/nixos/tests/armagetronad.nix
@ -115,7 +115,7 @@ in
          self.node.wait_for_text(text)
          self.send(*keys)

-      Server = namedtuple('Server', ('node', 'name', 'address', 'port', 'welcome', 'attacker', 'victim', 'coredump_delay'))
+      Server = namedtuple('Server', ('node', 'name', 'address', 'port', 'welcome', 'player1', 'player2'))

      # Clients and their in-game names
      clients = (
@ -125,9 +125,9 @@ in

      # Server configs.
      servers = (
-        Server(server, 'high-rubber', 'server', 4534, 'NixOS Smoke Test Server', 'SmOoThIcE', 'Arduino', 8),
-        Server(server, 'sty', 'server', 4535, 'NixOS Smoke Test sty+ct+ap Server', 'Arduino', 'SmOoThIcE', 8),
-        Server(server, 'trunk', 'server', 4536, 'NixOS Smoke Test 0.4 Server', 'Arduino', 'SmOoThIcE', 8)
+        Server(server, 'high-rubber', 'server', 4534, 'NixOS Smoke Test Server', 'SmOoThIcE', 'Arduino'),
+        Server(server, 'sty', 'server', 4535, 'NixOS Smoke Test sty+ct+ap Server', 'Arduino', 'SmOoThIcE'),
+        Server(server, 'trunk', 'server', 4536, 'NixOS Smoke Test 0.4 Server', 'Arduino', 'SmOoThIcE')
      )

      """
@ -146,8 +146,55 @@ in
          client.node.screenshot(f"screen_{client.name}_{screenshot_idx}")
        return screenshot_idx + 1

-      # Wait for the servers to come up.
+      """
+      Sets up a client, waiting for the given barrier on completion.
+      """
+      def client_setup(client, servers, barrier):
+        client.node.wait_for_x()
+
+        # Configure Armagetron so we skip the tutorial.
+        client.node.succeed(
+          run("mkdir -p ~/.armagetronad/var"),
+          run(f"echo 'PLAYER_1 {client.name}' >> ~/.armagetronad/var/autoexec.cfg"),
+          run("echo 'FIRST_USE 0' >> ~/.armagetronad/var/autoexec.cfg")
+        )
+        for idx, srv in enumerate(servers):
+          client.node.succeed(
+            run(f"echo 'BOOKMARK_{idx+1}_ADDRESS {srv.address}' >> ~/.armagetronad/var/autoexec.cfg"),
+            run(f"echo 'BOOKMARK_{idx+1}_NAME {srv.name}' >> ~/.armagetronad/var/autoexec.cfg"),
+            run(f"echo 'BOOKMARK_{idx+1}_PORT {srv.port}' >> ~/.armagetronad/var/autoexec.cfg")
+          )
+
+        # Start Armagetron. Use the recording mode since it skips the splashscreen.
+        client.node.succeed(run("cd; ulimit -c unlimited; armagetronad --record test.aarec >&2 & disown"))
+        client.node.wait_until_succeeds(
+          run(
+            "${xdo "create_new_win-select_main_window" ''
+              search --onlyvisible --name "Armagetron Advanced"
+              windowfocus --sync
+              windowactivate --sync
+            ''}"
+          )
+        )
+
+        # Get into the multiplayer menu.
+        client.send_on('Armagetron Advanced', 'ret')
+        client.send_on('Play Game', 'ret')
+
+        # Online > LAN > Network Setup > Mates > Server Bookmarks
+        client.send_on('Multiplayer', 'down', 'down', 'down', 'down', 'ret')
+
+        barrier.wait()
+
+      # Start everything.
      start_all()
+
+      # Get to the Server Bookmarks screen on both clients. This takes a while so do it asynchronously.
+      barrier = threading.Barrier(len(clients) + 1, timeout=600)
+      for client in clients:
+        threading.Thread(target=client_setup, args=(client, servers, barrier)).start()
+
+      # Wait for the servers to come up.
      for srv in servers:
        srv.node.wait_for_unit(f"armagetronad-{srv.name}")
        srv.node.wait_until_succeeds(f"ss --numeric --udp --listening | grep -q {srv.port}")
@ -167,55 +214,7 @@ in
          f"journalctl -u armagetronad-{srv.name} -e | grep -q 'Admin: Testing again!'"
        )

-      """
-      Sets up a client, waiting for the given barrier on completion.
-      """
-      def client_setup(client, servers, barrier):
-        client.node.wait_for_x()
-
-        # Configure Armagetron.
-        client.node.succeed(
-          run("mkdir -p ~/.armagetronad/var"),
-          run(f"echo 'PLAYER_1 {client.name}' >> ~/.armagetronad/var/autoexec.cfg")
-        )
-        for idx, srv in enumerate(servers):
-          client.node.succeed(
-            run(f"echo 'BOOKMARK_{idx+1}_ADDRESS {srv.address}' >> ~/.armagetronad/var/autoexec.cfg"),
-            run(f"echo 'BOOKMARK_{idx+1}_NAME {srv.name}' >> ~/.armagetronad/var/autoexec.cfg"),
-            run(f"echo 'BOOKMARK_{idx+1}_PORT {srv.port}' >> ~/.armagetronad/var/autoexec.cfg")
-          )
-
-        # Start Armagetron.
-        client.node.succeed(run("ulimit -c unlimited; armagetronad >&2 & disown"))
-        client.node.wait_until_succeeds(
-          run(
-            "${xdo "create_new_win-select_main_window" ''
-              search --onlyvisible --name "Armagetron Advanced"
-              windowfocus --sync
-              windowactivate --sync
-            ''}"
-          )
-        )
-
-        # Get through the tutorial.
-        client.send_on('Language Settings', 'ret')
-        client.send_on('First Setup', 'ret')
-        client.send_on('Welcome to Armagetron Advanced', 'ret')
-        client.send_on('round 1', 'esc')
-        client.send_on('Menu', 'up', 'up', 'ret')
-        client.send_on('We hope you', 'ret')
-        client.send_on('Armagetron Advanced', 'ret')
-        client.send_on('Play Game', 'ret')
-
-        # Online > LAN > Network Setup > Mates > Server Bookmarks
-        client.send_on('Multiplayer', 'down', 'down', 'down', 'down', 'ret')
-
-        barrier.wait()
-
-      # Get to the Server Bookmarks screen on both clients. This takes a while so do it asynchronously.
-      barrier = threading.Barrier(len(clients) + 1, timeout=240)
-      for client in clients:
-        threading.Thread(target=client_setup, args=(client, servers, barrier)).start()
+      # Wait for the client setup to complete.
      barrier.wait()

      # Main testing loop. Iterates through each server bookmark and connects to them in sequence.
@ -245,18 +244,14 @@ in
          f"journalctl -u armagetronad-{srv.name} -e | grep -q 'Go (round 1 of 10)'"
        )

-        # Wait a bit
-        srv.node.sleep(srv.coredump_delay)
-
-        # Turn the attacker player's lightcycle left
-        attacker = next(client for client in clients if client.name == srv.attacker)
-        victim = next(client for client in clients if client.name == srv.victim)
-        attacker.send('left')
-        screenshot_idx = take_screenshots(screenshot_idx)
-
-        # Wait for coredump.
+        # Wait for the players to die by running into the wall.
+        player1 = next(client for client in clients if client.name == srv.player1)
+        player2 = next(client for client in clients if client.name == srv.player2)
        srv.node.wait_until_succeeds(
-          f"journalctl -u armagetronad-{srv.name} -e | grep -q '{attacker.name} core dumped {victim.name}'"
+          f"journalctl -u armagetronad-{srv.name} -e | grep -q '{player1.name}.*lost 4 points'"
+        )
+        srv.node.wait_until_succeeds(
+          f"journalctl -u armagetronad-{srv.name} -e | grep -q '{player2.name}.*lost 4 points'"
        )
        screenshot_idx = take_screenshots(screenshot_idx)

--- a/nixos/tests/yarr.nix
+++ b/nixos/tests/yarr.nix
@ -0,0 +1,19 @@
+{ lib, pkgs, ... }:
+
+{
+  name = "yarr";
+  meta.maintainers = with lib.maintainers; [ christoph-heiss ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.yarr.enable = true;
+    };
+
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("yarr.service")
+    machine.wait_for_open_port(7070)
+    machine.succeed("curl -sSf http://localhost:7070 | grep '<title>yarr!</title>'")
+  '';
+}
--- a/pkgs/applications/editors/texmacs/default.nix
+++ b/pkgs/applications/editors/texmacs/default.nix
@ -20,6 +20,7 @@
  qtbase,
  qtsvg,
  qtmacextras,
+  fetchpatch,
  ghostscriptX ? null,
  extraFonts ? false,
  chineseFonts ? false,
@ -79,6 +80,14 @@ stdenv.mkDerivation {
      qtmacextras
    ];

+  patches = [
+    (fetchpatch {
+      name = "fix-compile-clang-19.5.patch";
+      url = "https://github.com/texmacs/texmacs/commit/e72783b023f22eaa0456d2e4cc76ae509d963672.patch";
+      hash = "sha256-oJCiXWTY89BdxwbgtFvfThid0WM83+TAUThSihfr0oA=";
+    })
+  ];
+
  cmakeFlags = lib.optionals stdenv.hostPlatform.isDarwin [
    (lib.cmakeFeature "TEXMACS_GUI" "Qt")
    (lib.cmakeFeature "CMAKE_INSTALL_PREFIX" "./TeXmacs.app/Contents/Resources")
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -14937,6 +14937,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  unimpaired-which-key-nvim = buildVimPlugin {
+    pname = "unimpaired-which-key.nvim";
+    version = "2024-08-16";
+    src = fetchFromGitHub {
+      owner = "afreakk";
+      repo = "unimpaired-which-key.nvim";
+      rev = "c35f413a631e2d2a29778cc390e4d2da28fc2727";
+      sha256 = "11skr474c9drq25823rx1jxcv5d57si0085zw60nq3wxmx999cg3";
+    };
+    meta.homepage = "https://github.com/afreakk/unimpaired-which-key.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
  unison = buildVimPlugin {
    pname = "unison";
    version = "2025-04-18";
--- a/pkgs/applications/editors/vim/plugins/non-generated/sonarlint-nvim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/sonarlint-nvim/default.nix
@ -15,7 +15,9 @@ vimUtils.buildVimPlugin {
    hash = "sha256-EUwuIFFe4tmw8u6RqEvOLL0Yi8J5cLBQx7ICxnmkT4k=";
  };

-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };

  meta = {
    homepage = "https://gitlab.com/schrieveslaach/sonarlint.nvim";
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -1145,6 +1145,7 @@ https://github.com/altermo/ultimate-autopair.nvim/,HEAD,
 https://github.com/SirVer/ultisnips/,,
 https://github.com/mbbill/undotree/,,
 https://github.com/chrisbra/unicode.vim/,,
+https://github.com/afreakk/unimpaired-which-key.nvim/,HEAD,
 https://github.com/tummetott/unimpaired.nvim/,HEAD,
 https://github.com/unisonweb/unison/,,
 https://github.com/Shougo/unite.vim/,,
--- a/pkgs/applications/misc/syncthingtray/default.nix
+++ b/pkgs/applications/misc/syncthingtray/default.nix
@ -38,14 +38,14 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "1.7.5";
+  version = "1.7.6";
  pname = "syncthingtray";

  src = fetchFromGitHub {
    owner = "Martchus";
    repo = "syncthingtray";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-/1X+wbVwLu0+SOMaVDJejBA+Z3szgs8IDtAZ9Yj7hXs=";
+    hash = "sha256-vJIHDp91T9oMtUT7bsSCxj6XkvT4bLMol9wEr19Wkig=";
  };

  buildInputs =
--- a/pkgs/applications/science/biology/mrtrix/default.nix
+++ b/pkgs/applications/science/biology/mrtrix/default.nix
@ -4,7 +4,7 @@
  fetchFromGitHub,
  python,
  makeWrapper,
-  eigen,
+  eigen_3_4_0,
  fftw,
  libtiff,
  libpng,
@ -18,41 +18,8 @@
  libXext,
  less,
  withGui ? true,
-  fetchFromGitLab,
-  fetchpatch,
 }:

-let
-  # reverts 'eigen: 3.4.0 -> 3.4.0-unstable-2022-05-19'
-  # https://github.com/NixOS/nixpkgs/commit/d298f046edabc84b56bd788e11eaf7ed72f8171c
-  eigen' = (
-    eigen.overrideAttrs (old: rec {
-      version = "3.4.0";
-      src = fetchFromGitLab {
-        owner = "libeigen";
-        repo = "eigen";
-        tag = version;
-        hash = "sha256-1/4xMetKMDOgZgzz3WMxfHUEpmdAm52RqZvz6i0mLEw=";
-      };
-      patches = (old.patches or [ ]) ++ [
-        # Fixes e.g. onnxruntime on aarch64-darwin:
-        # https://hydra.nixos.org/build/248915128/nixlog/1,
-        # originally suggested in https://github.com/NixOS/nixpkgs/pull/258392.
-        #
-        # The patch is from
-        # ["Fix vectorized reductions for Eigen::half"](https://gitlab.com/libeigen/eigen/-/merge_requests/699)
-        # which is two years old,
-        # but Eigen hasn't had a release in two years either:
-        # https://gitlab.com/libeigen/eigen/-/issues/2699.
-        (fetchpatch {
-          url = "https://gitlab.com/libeigen/eigen/-/commit/d0e3791b1a0e2db9edd5f1d1befdb2ac5a40efe0.patch";
-          hash = "sha256-8qiNpuYehnoiGiqy0c3Mcb45pwrmc6W4rzCxoLDSvj0=";
-        })
-      ];
-    })
-  );
-in
-
 stdenv.mkDerivation rec {
  pname = "mrtrix";
  version = "3.0.4-unstable-2025-04-09";
@ -74,7 +41,7 @@ stdenv.mkDerivation rec {
  buildInputs =
    [
      ants
-      eigen'
+      eigen_3_4_0
      python
      fftw
      libtiff
@ -113,7 +80,7 @@ stdenv.mkDerivation rec {

  configurePhase = ''
    runHook preConfigure
-    export EIGEN_CFLAGS="-isystem ${eigen'}/include/eigen3"
+    export EIGEN_CFLAGS="-isystem ${eigen_3_4_0}/include/eigen3"
    unset LD  # similar to https://github.com/MRtrix3/mrtrix3/issues/1519
    ./configure ${lib.optionalString (!withGui) "-nogui"};
    runHook postConfigure
--- a/pkgs/applications/science/logic/z3/4-8-5-typos.diff
+++ b/pkgs/applications/science/logic/z3/4-8-5-typos.diff
@ -1,26 +0,0 @@
-diff --git a/src/util/lp/lp_core_solver_base.h b/src/util/lp/lp_core_solver_base.h
-index 4c17df2..4c3c311 100644
--- a/src/util/lp/lp_core_solver_base.h
-+++ b/src/util/lp/lp_core_solver_base.h
-@@ -600,8 +600,6 @@ public:
-            out << " \n";
-     }
- 
-    bool column_is_free(unsigned j) const { return this->m_column_type[j] == free; }
-
-     bool column_has_upper_bound(unsigned j) const {
-         switch(m_column_types[j]) {
-         case column_type::free_column:
-diff --git a/src/util/lp/static_matrix_def.h b/src/util/lp/static_matrix_def.h
-index 7949573..2f1cb42 100644
--- a/src/util/lp/static_matrix_def.h
-+++ b/src/util/lp/static_matrix_def.h
-@@ -86,7 +86,7 @@ static_matrix<T, X>::static_matrix(static_matrix const &A, unsigned * /* basis *
-     init_row_columns(m, m);
-     while (m--) {
-         for (auto & col : A.m_columns[m]){
-            set(col.var(), m, A.get_value_of_column_cell(col));
-+            set(col.var(), m, A.get_column_cell(col));
-         }
-     }
- }
--- a/pkgs/applications/science/logic/z3/default.nix
+++ b/pkgs/applications/science/logic/z3/default.nix
@ -1,216 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchpatch,
-  python,
-  fixDarwinDylibNames,
-  javaBindings ? false,
-  ocamlBindings ? false,
-  pythonBindings ? true,
-  jdk ? null,
-  ocaml ? null,
-  findlib ? null,
-  zarith ? null,
-  writeScript,
-  replaceVars,
-}:
-
-assert javaBindings -> jdk != null;
-assert ocamlBindings -> ocaml != null && findlib != null && zarith != null;
-
-let
-  common =
-    {
-      version,
-      sha256,
-      patches ? [ ],
-      tag ? "z3",
-      doCheck ? true,
-    }:
-    stdenv.mkDerivation rec {
-      pname = "z3";
-      inherit version sha256 patches;
-      src = fetchFromGitHub {
-        owner = "Z3Prover";
-        repo = "z3";
-        rev = "${tag}-${version}";
-        sha256 = sha256;
-      };
-
-      strictDeps = true;
-
-      nativeBuildInputs =
-        [ python ]
-        ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames
-        ++ lib.optional javaBindings jdk
-        ++ lib.optionals ocamlBindings [
-          ocaml
-          findlib
-        ];
-      propagatedBuildInputs = [ python.pkgs.setuptools ] ++ lib.optionals ocamlBindings [ zarith ];
-      enableParallelBuilding = true;
-
-      postPatch =
-        lib.optionalString ocamlBindings ''
-          export OCAMLFIND_DESTDIR=$ocaml/lib/ocaml/${ocaml.version}/site-lib
-          mkdir -p $OCAMLFIND_DESTDIR/stublibs
-        ''
-        +
-          lib.optionalString
-            ((lib.versionAtLeast python.version "3.12") && (lib.versionOlder version "4.8.14"))
-            ''
-              # See https://github.com/Z3Prover/z3/pull/5729. This is a specialization of this patch for 4.8.5.
-              for file in scripts/mk_util.py src/api/python/CMakeLists.txt; do
-                substituteInPlace "$file" \
-                  --replace-fail "distutils.sysconfig.get_python_lib()" "sysconfig.get_path('purelib')" \
-                  --replace-fail "distutils.sysconfig" "sysconfig"
-              done
-            '';
-
-      configurePhase =
-        lib.concatStringsSep " " (
-          [ "${python.pythonOnBuildForHost.interpreter} scripts/mk_make.py --prefix=$out" ]
-          ++ lib.optional javaBindings "--java"
-          ++ lib.optional ocamlBindings "--ml"
-          ++ lib.optional pythonBindings "--python --pypkgdir=$out/${python.sitePackages}"
-        )
-        + "\n"
-        + "cd build";
-
-      inherit doCheck;
-      checkPhase = ''
-        make -j $NIX_BUILD_CORES test
-        ./test-z3 -a
-      '';
-
-      postInstall =
-        ''
-          mkdir -p $dev $lib
-          mv $out/lib $lib/lib
-          mv $out/include $dev/include
-        ''
-        + lib.optionalString pythonBindings ''
-          mkdir -p $python/lib
-          mv $lib/lib/python* $python/lib/
-          ln -sf $lib/lib/libz3${stdenv.hostPlatform.extensions.sharedLibrary} $python/${python.sitePackages}/z3/lib/libz3${stdenv.hostPlatform.extensions.sharedLibrary}
-        ''
-        + lib.optionalString javaBindings ''
-          mkdir -p $java/share/java
-          mv com.microsoft.z3.jar $java/share/java
-          moveToOutput "lib/libz3java.${stdenv.hostPlatform.extensions.sharedLibrary}" "$java"
-        '';
-
-      doInstallCheck = true;
-      installCheckPhase = ''
-        $out/bin/z3 -version 2>&1 | grep -F "Z3 version $version"
-      '';
-
-      outputs =
-        [
-          "out"
-          "lib"
-          "dev"
-          "python"
-        ]
-        ++ lib.optional javaBindings "java"
-        ++ lib.optional ocamlBindings "ocaml";
-
-      meta = with lib; {
-        description = "High-performance theorem prover and SMT solver";
-        mainProgram = "z3";
-        homepage = "https://github.com/Z3Prover/z3";
-        changelog = "https://github.com/Z3Prover/z3/releases/tag/z3-${version}";
-        license = licenses.mit;
-        platforms = platforms.unix;
-        maintainers = with maintainers; [
-          thoughtpolice
-          ttuegel
-          numinit
-        ];
-      };
-    };
-
-  static-matrix-def-patch = fetchpatch {
-    # clang / gcc fixes. fixes typos in some member names
-    name = "gcc-15-fixes.patch";
-    url = "https://github.com/Z3Prover/z3/commit/2ce89e5f491fa817d02d8fdce8c62798beab258b.patch";
-    includes = [ "src/math/lp/static_matrix_def.h" ];
-    hash = "sha256-rEH+UzylzyhBdtx65uf8QYj5xwuXOyG6bV/4jgKkXGo=";
-  };
-
-  static-matrix-patch = fetchpatch {
-    # clang / gcc fixes. fixes typos in some member names
-    name = "gcc-15-fixes.patch";
-    url = "https://github.com/Z3Prover/z3/commit/2ce89e5f491fa817d02d8fdce8c62798beab258b.patch";
-    includes = [ "src/@dir@/lp/static_matrix.h" ];
-    stripLen = 3;
-    extraPrefix = "src/@dir@/";
-    hash = "sha256-+H1/VJPyI0yq4M/61ay8SRCa6OaoJ/5i+I3zVTAPUVo=";
-  };
-
-  # replace @dir@ in the path of the given list of patches
-  fixupPatches = dir: map (patch: replaceVars patch { inherit dir; });
-in
-{
-  z3_4_14 = common {
-    version = "4.14.1";
-    sha256 = "sha256-pTsDzf6Frk4mYAgF81wlR5Kb1x56joFggO5Fa3G2s70=";
-  };
-  z3_4_13 = common {
-    version = "4.13.4";
-    sha256 = "sha256-8hWXCr6IuNVKkOegEmWooo5jkdmln9nU7wI8T882BSE=";
-  };
-  z3_4_12 = common {
-    version = "4.12.6";
-    sha256 = "sha256-X4wfPWVSswENV0zXJp/5u9SQwGJWocLKJ/CNv57Bt+E=";
-    patches =
-      fixupPatches "math" [
-        ./lower-bound-typo.diff
-        static-matrix-patch
-      ]
-      ++ [
-        static-matrix-def-patch
-      ];
-  };
-  z3_4_11 = common {
-    version = "4.11.2";
-    sha256 = "sha256-OO0wtCvSKwGxnKvu+AfXe4mEzv4nofa7A00BjX+KVjc=";
-    patches =
-      fixupPatches "math" [
-        ./lower-bound-typo.diff
-        static-matrix-patch
-        ./tail-matrix.diff
-      ]
-      ++ [
-        static-matrix-def-patch
-      ];
-  };
-  z3_4_8 = common {
-    version = "4.8.17";
-    sha256 = "sha256-BSwjgOU9EgCcm18Zx0P9mnoPc9ZeYsJwEu0ffnACa+8=";
-    patches =
-      fixupPatches "math" [
-        ./lower-bound-typo.diff
-        static-matrix-patch
-        ./tail-matrix.diff
-      ]
-      ++ [
-        static-matrix-def-patch
-      ];
-  };
-  z3_4_8_5 = common {
-    tag = "Z3";
-    version = "4.8.5";
-    sha256 = "sha256-ytG5O9HczbIVJAiIGZfUXC/MuYH7d7yLApaeTRlKXoc=";
-    patches =
-      fixupPatches "util" [
-        ./lower-bound-typo.diff
-        static-matrix-patch
-        ./tail-matrix.diff
-      ]
-      ++ [
-        ./4-8-5-typos.diff
-      ];
-  };
-}
--- a/pkgs/applications/science/logic/z3/lower-bound-typo.diff
+++ b/pkgs/applications/science/logic/z3/lower-bound-typo.diff
@ -1,13 +0,0 @@
-diff --git a/src/@dir@/lp/column_info.h b/src/@dir@/lp/column_info.h
-index 1dc0c60..9cbeea6 100644
--- a/src/@dir@/lp/column_info.h
-+++ b/src/@dir@/lp/column_info.h
-@@ -47,7 +47,7 @@ public:
-             m_lower_bound_is_strict == c.m_lower_bound_is_strict &&
-             m_upper_bound_is_set == c.m_upper_bound_is_set&&
-             m_upper_bound_is_strict == c.m_upper_bound_is_strict&&
-            (!m_lower_bound_is_set || m_lower_bound == c.m_low_bound) &&
-+            (!m_lower_bound_is_set || m_lower_bound == c.m_lower_bound) &&
-             (!m_upper_bound_is_set || m_upper_bound == c.m_upper_bound) &&
-             m_cost == c.m_cost &&
-             m_is_fixed == c.m_is_fixed &&
--- a/pkgs/applications/science/logic/z3/tail-matrix.diff
+++ b/pkgs/applications/science/logic/z3/tail-matrix.diff
@ -1,12 +0,0 @@
-diff --git a/src/@dir@/lp/tail_matrix.h b/src/@dir@/lp/tail_matrix.h
-index 2047e8c..c84340e 100644
--- a/src/@dir@/lp/tail_matrix.h
-+++ b/src/@dir@/lp/tail_matrix.h
-@@ -43,7 +43,6 @@ public:
-         const tail_matrix & m_A;
-         unsigned m_row;
-         ref_row(const tail_matrix& m, unsigned row): m_A(m), m_row(row) {}
-        T operator[](unsigned j) const { return m_A.get_elem(m_row, j);}
-     };
-     ref_row operator[](unsigned i) const { return ref_row(*this, i);}
- };
--- a/pkgs/by-name/ar/ares-cli/package.nix
+++ b/pkgs/by-name/ar/ares-cli/package.nix
@ -6,12 +6,12 @@
 }:
 buildNpmPackage rec {
  pname = "ares-cli";
-  version = "3.2.0";
+  version = "3.2.1";
  src = fetchFromGitHub {
    owner = "webos-tools";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-tSnmIDDDEhhQBrjZ5bujmCaYpetTjpdCGUjKomue+Bc=";
+    hash = "sha256-L8suZDtXVchVyvp7KCv0UaceJqqGBdfopd5tZzwj3MY=";
  };

  postPatch = ''
@ -19,7 +19,7 @@ buildNpmPackage rec {
  '';

  dontNpmBuild = true;
-  npmDepsHash = "sha256-eTuAi+32pK8rGQ5UDWesDFvlkjWj/ERevD+aYXYYr0Q=";
+  npmDepsHash = "sha256-ATIxe/sulfOpz5KiWauDAPZrlfUOFyiTa+5ECFbVd+0=";

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/ca/cargo-sonar/package.nix
+++ b/pkgs/by-name/ca/cargo-sonar/package.nix
@ -0,0 +1,34 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitLab,
+  versionCheckHook,
+  nix-update-script,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "cargo-sonar";
+  version = "1.3.0";
+
+  src = fetchFromGitLab {
+    owner = "woshilapin";
+    repo = "cargo-sonar";
+    tag = finalAttrs.version;
+    hash = "sha256-f319hi6mrnlHTvsn7kN2wFHyamXtplLZ8A6TN0+H3jY=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-KLw6kAR2pF5RFhRDfsL093K+jk3oiSHLZ2CQvrBuhWY=";
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Utility to produce some Sonar-compatible format from different Rust tools like cargo-clippy cargo-audit or cargo-outdated";
+    mainProgram = "cargo-sonar";
+    homepage = "https://gitlab.com/woshilapin/cargo-sonar";
+    license = [ lib.licenses.mit ];
+    maintainers = [ lib.maintainers.jonboh ];
+  };
+})
--- a/pkgs/by-name/cu/curv/package.nix
+++ b/pkgs/by-name/cu/curv/package.nix
@ -2,13 +2,11 @@
  lib,
  stdenv,
  fetchFromGitea,
-  fetchFromGitLab,
-  fetchpatch,
  cmake,
  git,
  pkg-config,
  boost,
-  eigen,
+  eigen_3_4_0,
  glm,
  libGL,
  libpng,
@ -43,33 +41,7 @@ stdenv.mkDerivation {
  buildInputs =
    [
      boost
-      # https://codeberg.org/doug-moen/curv/issues/228
-      # reverts 'eigen: 3.4.0 -> 3.4.0-unstable-2022-05-19'
-      # https://github.com/nixos/nixpkgs/commit/d298f046edabc84b56bd788e11eaf7ed72f8171c
-      (eigen.overrideAttrs (old: rec {
-        version = "3.4.0";
-        src = fetchFromGitLab {
-          owner = "libeigen";
-          repo = "eigen";
-          rev = version;
-          hash = "sha256-1/4xMetKMDOgZgzz3WMxfHUEpmdAm52RqZvz6i0mLEw=";
-        };
-        patches = (old.patches or [ ]) ++ [
-          # Fixes e.g. onnxruntime on aarch64-darwin:
-          # https://hydra.nixos.org/build/248915128/nixlog/1,
-          # originally suggested in https://github.com/NixOS/nixpkgs/pull/258392.
-          #
-          # The patch is from
-          # ["Fix vectorized reductions for Eigen::half"](https://gitlab.com/libeigen/eigen/-/merge_requests/699)
-          # which is two years old,
-          # but Eigen hasn't had a release in two years either:
-          # https://gitlab.com/libeigen/eigen/-/issues/2699.
-          (fetchpatch {
-            url = "https://gitlab.com/libeigen/eigen/-/commit/d0e3791b1a0e2db9edd5f1d1befdb2ac5a40efe0.patch";
-            hash = "sha256-8qiNpuYehnoiGiqy0c3Mcb45pwrmc6W4rzCxoLDSvj0=";
-          })
-        ];
-      }))
+      eigen_3_4_0
      glm
      libGL
      libpng
--- a/pkgs/development/libraries/eigen/include-dir.patch
+++ b/pkgs/development/libraries/eigen/include-dir.patch
--- a/pkgs/development/libraries/eigen/default.nix
+++ b/pkgs/development/libraries/eigen/default.nix
--- a/pkgs/development/libraries/eigen/2.0.nix
+++ b/pkgs/development/libraries/eigen/2.0.nix
--- a/pkgs/by-name/ei/eigen_3_4_0/include-dir.patch
+++ b/pkgs/by-name/ei/eigen_3_4_0/include-dir.patch
@ -0,0 +1,57 @@
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -1,5 +1,5 @@
+ # cmake_minimum_require must be the first command of the file
+-cmake_minimum_required(VERSION 3.5.0)
+cmake_minimum_required(VERSION 3.7.0)
+ 
+ project(Eigen3)
+ 
+@@ -443,7 +443,7 @@ set(PKGCONFIG_INSTALL_DIR
+     CACHE PATH "The directory relative to CMAKE_INSTALL_PREFIX where eigen3.pc is installed"
+     )
+ 
+-foreach(var INCLUDE_INSTALL_DIR CMAKEPACKAGE_INSTALL_DIR PKGCONFIG_INSTALL_DIR)
+foreach(var CMAKEPACKAGE_INSTALL_DIR PKGCONFIG_INSTALL_DIR)
+   # If an absolute path is specified, make it relative to "{CMAKE_INSTALL_PREFIX}".
+   if(IS_ABSOLUTE "${${var}}")
+     file(RELATIVE_PATH "${var}" "${CMAKE_INSTALL_PREFIX}" "${${var}}")
+@@ -466,13 +466,6 @@ install(FILES
+   DESTINATION ${INCLUDE_INSTALL_DIR} COMPONENT Devel
+   )
+ 
+-if(EIGEN_BUILD_PKGCONFIG)
+-    configure_file(eigen3.pc.in eigen3.pc @ONLY)
+-    install(FILES ${CMAKE_CURRENT_BINARY_DIR}/eigen3.pc
+-        DESTINATION ${PKGCONFIG_INSTALL_DIR}
+-        )
+-endif()
+-
+ install(DIRECTORY Eigen DESTINATION ${INCLUDE_INSTALL_DIR} COMPONENT Devel)
+ 
+ 
+@@ -593,8 +586,15 @@ set ( EIGEN_VERSION_MAJOR  ${EIGEN_WORLD_VERSION} )
+ set ( EIGEN_VERSION_MINOR  ${EIGEN_MAJOR_VERSION} )
+ set ( EIGEN_VERSION_PATCH  ${EIGEN_MINOR_VERSION} )
+ set ( EIGEN_DEFINITIONS "")
+-set ( EIGEN_INCLUDE_DIR "${CMAKE_INSTALL_PREFIX}/${INCLUDE_INSTALL_DIR}" )
+ set ( EIGEN_ROOT_DIR ${CMAKE_INSTALL_PREFIX} )
+GNUInstallDirs_get_absolute_install_dir(EIGEN_INCLUDE_DIR INCLUDE_INSTALL_DIR)
+
+if(EIGEN_BUILD_PKGCONFIG)
+    configure_file(eigen3.pc.in eigen3.pc @ONLY)
+    install(FILES ${CMAKE_CURRENT_BINARY_DIR}/eigen3.pc
+        DESTINATION ${PKGCONFIG_INSTALL_DIR}
+        )
+endif()
+ 
+ include (CMakePackageConfigHelpers)
+ 
+--- a/eigen3.pc.in
+++ b/eigen3.pc.in
+@@ -6,4 +6,4 @@ Description: A C++ template library for linear algebra: vectors, matrices, and r
+ Requires:
+ Version: @EIGEN_VERSION_NUMBER@
+ Libs:
+-Cflags: -I${prefix}/@INCLUDE_INSTALL_DIR@
+Cflags: -I@EIGEN_INCLUDE_DIR@
--- a/pkgs/by-name/ei/eigen_3_4_0/package.nix
+++ b/pkgs/by-name/ei/eigen_3_4_0/package.nix
@ -0,0 +1,50 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  fetchpatch,
+  cmake,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "eigen";
+  version = "3.4.0";
+
+  src = fetchFromGitLab {
+    owner = "libeigen";
+    repo = "eigen";
+    rev = version;
+    hash = "sha256-1/4xMetKMDOgZgzz3WMxfHUEpmdAm52RqZvz6i0mLEw=";
+  };
+
+  patches = [
+    ./include-dir.patch
+    # Fixes e.g. onnxruntime on aarch64-darwin:
+    # https://hydra.nixos.org/build/248915128/nixlog/1,
+    # originally suggested in https://github.com/NixOS/nixpkgs/pull/258392.
+    #
+    # The patch is from
+    # ["Fix vectorized reductions for Eigen::half"](https://gitlab.com/libeigen/eigen/-/merge_requests/699)
+    # which is two years old,
+    # but Eigen hasn't had a release in two years either:
+    # https://gitlab.com/libeigen/eigen/-/issues/2699.
+    (fetchpatch {
+      url = "https://gitlab.com/libeigen/eigen/-/commit/d0e3791b1a0e2db9edd5f1d1befdb2ac5a40efe0.patch";
+      hash = "sha256-8qiNpuYehnoiGiqy0c3Mcb45pwrmc6W4rzCxoLDSvj0=";
+    })
+  ];
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = with lib; {
+    homepage = "https://eigen.tuxfamily.org";
+    description = "C++ template library for linear algebra: vectors, matrices, and related algorithms";
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [
+      sander
+      raskin
+      pbsds
+    ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/by-name/fx/fx-cast-bridge/bump-nan.patch
+++ b/pkgs/by-name/fx/fx-cast-bridge/bump-nan.patch
@ -0,0 +1,31 @@
+diff --git a/package-lock.json b/package-lock.json
+index c856a73..59d3cc5 100644
+--- a/package-lock.json
+++ b/package-lock.json
+@@ -1240,9 +1240,10 @@
+             }
+         },
+         "node_modules/nan": {
+-            "version": "2.15.0",
+-            "resolved": "https://registry.npmjs.org/nan/-/nan-2.15.0.tgz",
+-            "integrity": "sha512-8ZtvEnA2c5aYCZYd1cvgdnU6cqwixRoYg70xPLWUws5ORTa/lnw+u4amixRS/Ac5U5mQVgp9pnlSUnbNWFaWZQ=="
+            "version": "2.22.2",
+            "resolved": "https://registry.npmjs.org/nan/-/nan-2.22.2.tgz",
+            "integrity": "sha512-DANghxFkS1plDdRsX0X9pm0Z6SJNN6gBdtXfanwoZ8hooC5gosGFSBGRYHUVPz1asKA/kMRqDRdHrluZ61SpBQ==",
+            "license": "MIT"
+         },
+         "node_modules/napi-build-utils": {
+             "version": "1.0.2",
+@@ -3189,9 +3190,9 @@
+             "dev": true
+         },
+         "nan": {
+-            "version": "2.15.0",
+-            "resolved": "https://registry.npmjs.org/nan/-/nan-2.15.0.tgz",
+-            "integrity": "sha512-8ZtvEnA2c5aYCZYd1cvgdnU6cqwixRoYg70xPLWUws5ORTa/lnw+u4amixRS/Ac5U5mQVgp9pnlSUnbNWFaWZQ=="
+            "version": "2.22.2",
+            "resolved": "https://registry.npmjs.org/nan/-/nan-2.22.2.tgz",
+            "integrity": "sha512-DANghxFkS1plDdRsX0X9pm0Z6SJNN6gBdtXfanwoZ8hooC5gosGFSBGRYHUVPz1asKA/kMRqDRdHrluZ61SpBQ=="
+         },
+         "napi-build-utils": {
+             "version": "1.0.2",
--- a/pkgs/by-name/fx/fx-cast-bridge/package.nix
+++ b/pkgs/by-name/fx/fx-cast-bridge/package.nix
@ -3,7 +3,7 @@
  buildNpmPackage,
  fetchFromGitHub,
  avahi-compat,
-  nodejs_18,
+  nodejs_22,
  python3,
  stdenv,
 }:
@ -12,7 +12,7 @@ buildNpmPackage rec {
  pname = "fx-cast-bridge";
  version = "0.3.1";

-  nodejs = nodejs_18;
+  nodejs = nodejs_22;

  src = fetchFromGitHub {
    owner = "hensm";
@ -20,15 +20,23 @@ buildNpmPackage rec {
    rev = "v${version}";
    hash = "sha256-hB4NVJW2exHoKsMp0CKzHerYgj8aR77rV+ZsCoWA1Dg=";
  };
+
  sourceRoot = "${src.name}/app";
-  npmDepsHash = "sha256-GLrDRZqKcX1PDGREx+MLZ1TEjr88r9nz4TvZ9nvo40g=";
+
+  patches = [
+    # to support later versions of nodejs
+    # generated by running `npm update nan --ignore-scripts` in the ./app dir
+    ./bump-nan.patch
+  ];
+
+  npmDepsHash = "sha256-23EZC9v4ODu3k+O9NDVhOdGJ/FfaiTVWtTrK8liAevk=";

  nativeBuildInputs = [ python3 ];
  buildInputs = [ avahi-compat ];

  postPatch = ''
    substituteInPlace bin/lib/paths.js \
-      --replace "../../../" "../../"
+      --replace-fail "../../../" "../../"
  '';

  dontNpmInstall = true;
@ -38,7 +46,7 @@ buildNpmPackage rec {
    mkdir -p $out/{bin,lib/mozilla/native-messaging-hosts}

    substituteInPlace dist/app/fx_cast_bridge.json \
-      --replace "$(realpath dist/app/fx_cast_bridge.sh)" "$out/bin/fx_cast_bridge"
+      --replace-fail "$(realpath dist/app/fx_cast_bridge.sh)" "$out/bin/fx_cast_bridge"
    mv dist/app/fx_cast_bridge.json $out/lib/mozilla/native-messaging-hosts

    rm dist/app/fx_cast_bridge.sh
--- a/pkgs/by-name/gi/git-town/package.nix
+++ b/pkgs/by-name/gi/git-town/package.nix
@ -12,13 +12,13 @@

 buildGoModule rec {
  pname = "git-town";
-  version = "18.1.0";
+  version = "19.0.0";

  src = fetchFromGitHub {
    owner = "git-town";
    repo = "git-town";
    tag = "v${version}";
-    hash = "sha256-dx19gzHhCCcdlI80CYhbfKHRS0AQB0DnHphV2mqmI/Y=";
+    hash = "sha256-To+WtPkMbVDuUBaOkemua9i7WOs/X214YunWtbKt02Y=";
  };

  vendorHash = null;
--- a/pkgs/by-name/ks/kstars/package.nix
+++ b/pkgs/by-name/ks/kstars/package.nix
@ -2,12 +2,10 @@
  lib,
  stdenv,
  fetchurl,
-  fetchFromGitLab,
-  fetchpatch,
  cfitsio,
  cmake,
  curl,
-  eigen,
+  eigen_3_4_0,
  gsl,
  indi-full,
  kdePackages,
@ -22,35 +20,6 @@
  zlib,
 }:

-let
-  # reverts 'eigen: 3.4.0 -> 3.4.0-unstable-2022-05-19'
-  # https://github.com/nixos/nixpkgs/commit/d298f046edabc84b56bd788e11eaf7ed72f8171c
-  eigen' = eigen.overrideAttrs (old: rec {
-    version = "3.4.0";
-    src = fetchFromGitLab {
-      owner = "libeigen";
-      repo = "eigen";
-      rev = version;
-      hash = "sha256-1/4xMetKMDOgZgzz3WMxfHUEpmdAm52RqZvz6i0mLEw=";
-    };
-    patches = (old.patches or [ ]) ++ [
-      # Fixes e.g. onnxruntime on aarch64-darwin:
-      # https://hydra.nixos.org/build/248915128/nixlog/1,
-      # originally suggested in https://github.com/NixOS/nixpkgs/pull/258392.
-      #
-      # The patch is from
-      # ["Fix vectorized reductions for Eigen::half"](https://gitlab.com/libeigen/eigen/-/merge_requests/699)
-      # which is two years old,
-      # but Eigen hasn't had a release in two years either:
-      # https://gitlab.com/libeigen/eigen/-/issues/2699.
-      (fetchpatch {
-        url = "https://gitlab.com/libeigen/eigen/-/commit/d0e3791b1a0e2db9edd5f1d1befdb2ac5a40efe0.patch";
-        hash = "sha256-8qiNpuYehnoiGiqy0c3Mcb45pwrmc6W4rzCxoLDSvj0=";
-      })
-    ];
-  });
-in
-
 stdenv.mkDerivation (finalAttrs: {
  pname = "kstars";
  version = "3.7.5";
@ -70,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
    breeze-icons
    cfitsio
    curl
-    eigen'
+    eigen_3_4_0
    gsl
    indi-full
    kconfig
--- a/pkgs/by-name/li/libblake3/package.nix
+++ b/pkgs/by-name/li/libblake3/package.nix
@ -5,23 +5,18 @@
  fetchFromGitHub,
  tbb_2021_11,

-  # Until we have a release with
-  # https://github.com/BLAKE3-team/BLAKE3/pull/461 and similar, or those
-  # PRs are patched onto this current release. Even then, I think we
-  # still need to disable for MinGW build because
-  # https://github.com/BLAKE3-team/BLAKE3/issues/467
-  useTBB ? false,
+  useTBB ? true,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "libblake3";
-  version = "1.8.0";
+  version = "1.8.2";

  src = fetchFromGitHub {
    owner = "BLAKE3-team";
    repo = "BLAKE3";
    tag = finalAttrs.version;
-    hash = "sha256-Krh0yVNZKL6Mb0McqWTIMNownsgM3MUEX2IP+F/fu+k=";
+    hash = "sha256-IABVErXWYQFXZcwsFKfQhm3ox7UZUcW5uzVrGwsSp94=";
  };

  sourceRoot = finalAttrs.src.name + "/c";
--- a/pkgs/by-name/li/librenms/package.nix
+++ b/pkgs/by-name/li/librenms/package.nix
@ -27,16 +27,16 @@ let
 in
 phpPackage.buildComposerProject2 rec {
  pname = "librenms";
-  version = "25.3.0";
+  version = "25.4.0";

  src = fetchFromGitHub {
    owner = "librenms";
    repo = pname;
    tag = version;
-    sha256 = "sha256-iCcBP/BDHdTxlzgDGZzBdT0tFL26oCvMI+q2UuEg5jw=";
+    sha256 = "sha256-t+RupwKnUtQd3A0VzWhCXNzc+TnVnDMaMJ6Jcgp+Sfg=";
  };

-  vendorHash = "sha256-0YBXORA647IfR0Fes2q4lbJsgrkpcvRj1aIHJ/Te/zU=";
+  vendorHash = "sha256-t/3wBSXJJHqbGR1iKF4zC2Ia99gXNlanabR/iPPlHqw=";

  php = phpPackage;

--- a/pkgs/by-name/ll/lls/package.nix
+++ b/pkgs/by-name/ll/lls/package.nix
@ -5,17 +5,17 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "lls";
-  version = "0.4.1";
+  version = "0.4.2";

  src = fetchFromGitHub {
    owner = "jcaesar";
    repo = "lls";
    tag = "v${version}";
-    hash = "sha256-OszKEWrpXEyi+0ayTzqy6O+cMZ/AVmesN3QJWCAHF7Q=";
+    hash = "sha256-eFGyrGtH57a5iRWHWqt1h58QMdmPf2rPqHnuVj5u6PQ=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-GIAGy0yLV7hRUk7cMEKxjmXJxpZSNyMXICEGr4vfIxc=";
+  cargoHash = "sha256-TY7s0sIeW+FgxqbbYvK3uZ2RwPLVKKhLq3DOurer+Gc=";

  meta = with lib; {
    description = "Tool to list listening sockets";
--- a/pkgs/by-name/mo/mongodb-atlas-cli/package.nix
+++ b/pkgs/by-name/mo/mongodb-atlas-cli/package.nix
@ -0,0 +1,57 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+  nix-update-script,
+  testers,
+  mongodb-atlas-cli,
+}:
+
+buildGoModule rec {
+  pname = "mongodb-atlas-cli";
+  version = "1.42.0";
+
+  vendorHash = "sha256-5kCaQ4bBRiGjRh65Tx3g5SlwAb+/S8o+z/2x8IqSXDM=";
+
+  src = fetchFromGitHub {
+    owner = "mongodb";
+    repo = "mongodb-atlas-cli";
+    rev = "refs/tags/atlascli/v${version}";
+    sha256 = "sha256-7umwluhPNhY/AGmVhxITLeoAGJPglRP+1PuXOM6TmBA=";
+  };
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/mongodb/mongodb-atlas-cli/atlascli/internal/version.GitCommit=${src.rev}"
+    "-X github.com/mongodb/mongodb-atlas-cli/atlascli/internal/version.Version=v${version}"
+  ];
+
+  postInstall = ''
+    installShellCompletion --cmd atlas \
+      --bash <($out/bin/atlas completion bash) \
+      --fish <($out/bin/atlas completion fish) \
+      --zsh <($out/bin/atlas completion zsh)
+  '';
+
+  passthru = {
+    updateScript = nix-update-script {
+      extraArgs = [ "--version-regex=atlascli/v(.+)" ];
+    };
+    tests.version = testers.testVersion {
+      package = mongodb-atlas-cli;
+      version = "v${version}";
+    };
+  };
+
+  meta = {
+    homepage = "https://www.mongodb.com/try/download/shell";
+    description = "CLI utility to manage MongoDB Atlas from the terminal";
+    maintainers = with lib.maintainers; [ aduh95 ];
+    license = lib.licenses.asl20;
+    mainProgram = "atlas";
+  };
+}
--- a/pkgs/by-name/mu/mupen64plus/package.nix
+++ b/pkgs/by-name/mu/mupen64plus/package.nix
@ -24,6 +24,11 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-KX4XGAzXanuOqAnRob4smO1cc1LccWllqA3rWYsh4TE=";
  };

+  patches = [
+    # Remove unused SDL2 header that erroneously adds libX11 dependency
+    ./remove-unused-header.patch
+  ];
+
  nativeBuildInputs = [
    pkg-config
    nasm
--- a/pkgs/by-name/mu/mupen64plus/remove-unused-header.patch
+++ b/pkgs/by-name/mu/mupen64plus/remove-unused-header.patch
@ -0,0 +1,21 @@
+From d737386a5422f798dcb196bc58a99808a0843317 Mon Sep 17 00:00:00 2001
+From: Marcin Serwin <marcin@serwin.dev>
+Date: Sun, 20 Apr 2025 21:33:00 +0200
+Subject: [PATCH] Remove unused SDL_syswm header
+
+---
+ src/main/eventloop.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/source/mupen64plus-core/src/main/eventloop.c b/source/mupen64plus-core/src/main/eventloop.c
+index 6625638b4..eb0fd1919 100644
+--- a/source/mupen64plus-core/src/main/eventloop.c
+++ b/source/mupen64plus-core/src/main/eventloop.c
+@@ -21,7 +21,6 @@
+  * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
+ 
+ #include <SDL.h>
+-#include <SDL_syswm.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <string.h>
--- a/pkgs/by-name/ne/netbox_4_1/package.nix
+++ b/pkgs/by-name/ne/netbox_4_1/package.nix
@ -15,7 +15,7 @@ let
 in
 py.pkgs.buildPythonApplication rec {
  pname = "netbox";
-  version = "4.1.7";
+  version = "4.1.11";

  format = "other";

@ -23,7 +23,7 @@ py.pkgs.buildPythonApplication rec {
    owner = "netbox-community";
    repo = "netbox";
    tag = "v${version}";
-    hash = "sha256-0AyIXSiNsAHELM8Ry/bcm7sd7K+ApeoEguiEm8ecAU0=";
+    hash = "sha256-Nd8HWXn7v0llmg934KGtS5+Tj2RvBhJDuXEvB2Pg3nQ=";
  };

  patches = [
--- a/pkgs/by-name/ne/netbox_4_2/package.nix
+++ b/pkgs/by-name/ne/netbox_4_2/package.nix
@ -14,7 +14,7 @@ let
 in
 py.pkgs.buildPythonApplication rec {
  pname = "netbox";
-  version = "4.2.6";
+  version = "4.2.7";

  format = "other";

@ -22,7 +22,7 @@ py.pkgs.buildPythonApplication rec {
    owner = "netbox-community";
    repo = "netbox";
    tag = "v${version}";
-    hash = "sha256-SOGVMaqAYc+DeyeF5ZQ4TQr9RIhWH23Lwth3h0Y3Dtg=";
+    hash = "sha256-SZES80hdoP+k6o5ablMnwaFrsVGE8Baew44eX2ZCk/Y=";
  };

  patches = [
--- a/pkgs/by-name/ob/obsidian/package.nix
+++ b/pkgs/by-name/ob/obsidian/package.nix
@ -12,7 +12,7 @@
 }:
 let
  pname = "obsidian";
-  version = "1.8.9";
+  version = "1.8.10";
  appname = "Obsidian";
  meta = with lib; {
    description = "Powerful knowledge base that works on top of a local folder of plain text Markdown files";
@ -36,9 +36,9 @@ let
    url = "https://github.com/obsidianmd/obsidian-releases/releases/download/v${version}/${filename}";
    hash =
      if stdenv.hostPlatform.isDarwin then
-        "sha256-OPK5GI0P52zk7EF8Gk5i15N/WddbNjS47YNy55o2A8k="
+        "sha256-3BiPbT1ME75WpR/mTDl8/TI+yq6+WMU+RaZXykUG8yE="
      else
-        "sha256-XVq0nQiyT2HvKQpzJIvhghsGgg4ye7uqZcyA1nH4O/o=";
+        "sha256-xZoi4Z9JMM/FEPfvjBXEag3pT/uJH9dvFp8qHnTFNKE=";
  };

  icon = fetchurl {
--- a/pkgs/by-name/os/osrm-backend/package.nix
+++ b/pkgs/by-name/os/osrm-backend/package.nix
@ -10,27 +10,25 @@
  boost,
  lua,
  luabind,
-  tbb,
+  tbb_2022_0,
  expat,
  nixosTests,
 }:

-stdenv.mkDerivation {
+let
+  tbb = tbb_2022_0;
+in
+stdenv.mkDerivation rec {
  pname = "osrm-backend";
-  version = "5.27.1-unstable-2024-11-03";
+  version = "6.0.0";

  src = fetchFromGitHub {
    owner = "Project-OSRM";
    repo = "osrm-backend";
-    rev = "3614af7f6429ee35c3f2e836513b784a74664ab6";
-    hash = "sha256-iix++G49cC13wZGZIpXu1SWGtVAcqpuX3GhsIaETzUU=";
+    tag = "V${version}";
+    hash = "sha256-R2Sx+DbT6gROI8X1fkxqOGbMqgmsnNiw2rUX6gSZuTs=";
  };

-  patches = [
-    # Taken from https://github.com/Project-OSRM/osrm-backend/pull/7073.
-    ./boost187-compat.patch
-  ];
-
  nativeBuildInputs = [
    cmake
    pkg-config
@ -60,9 +58,9 @@ stdenv.mkDerivation {
  };

  meta = {
-    homepage = "https://github.com/Project-OSRM/osrm-backend/wiki";
+    homepage = "https://project-osrm.org/";
    description = "Open Source Routing Machine computes shortest paths in a graph. It was designed to run well with map data from the Openstreetmap Project";
-    changelog = "https://github.com/Project-OSRM/osrm-backend/blob/master/CHANGELOG.md";
+    changelog = "https://github.com/Project-OSRM/osrm-backend/blob/${src.tag}/CHANGELOG.md";
    license = lib.licenses.bsd2;
    maintainers = with lib.maintainers; [ erictapen ];
    platforms = lib.platforms.unix;
--- a/pkgs/by-name/ov/ovftool/package.nix
+++ b/pkgs/by-name/ov/ovftool/package.nix
@ -1,62 +1,108 @@
 {
  autoPatchelfHook,
  c-ares,
+  curl,
  darwin,
  expat,
  fetchurl,
  glibc,
  icu60,
+  jq,
  lib,
  libiconv,
  libredirect,
  libxcrypt-legacy,
  libxml2,
  makeWrapper,
+  openssl,
  stdenv,
  unzip,
  xercesc,
  zlib,
+  acceptBroadcomEula ? false,
 }:

 let
+  # Returns the base URL for the given tool ID.
+  mkBaseUrl = toolId: "https://developer.broadcom.com/tools/${toolId}/latest";
+  ovftoolId = "open-virtualization-format-ovf-tool";

-  ovftoolSystems =
-    let
-      baseUrl = "https://vdc-download.vmware.com/vmwb-repository/dcr-public";
-    in
+  # Use browser devtools to figure out how this works.
+  fetchFromBroadcom =
    {
-      "i686-linux" = rec {
-        name = "VMware-ovftool-${version}-lin.i386.zip";
-        # As of 2024-02-20 the "Zip of OVF Tool for 32-bit Linux" download link
-        # on the v4.6.2 page links to v4.6.0.
-        version = "4.6.0-21452615";
-        url = "${baseUrl}/7254abb2-434d-4f5d-83e2-9311ced9752e/57e666a2-874c-48fe-b1d2-4b6381f7fe97/${name}";
-        hash = "sha256-qEOr/3SW643G5ZQQNJTelZbUxB8HmxPd5uD+Gqsoxz0=";
+      fileName,
+      version,
+      toolId ? ovftoolId,
+      artifactId ? 21342,
+      fileType ? "Download",
+      source ? "",
+      hash ? "",
+    }:
+    let
+      requestJson = builtins.toJSON {
+        inherit
+          fileName
+          artifactId
+          fileType
+          source
+          ;
      };
+    in
+    fetchurl {
+      name = fileName;
+      url =
+        (mkBaseUrl toolId)
+        + "?p_p_id=SDK_AND_TOOL_DETAILS_INSTANCE_iwlk&p_p_lifecycle=2&p_p_resource_id=documentDownloadArtifact";
+      curlOptsList = [
+        "--json"
+        requestJson
+      ];
+      downloadToTemp = true;
+      nativeBuildInputs = [ jq ];
+      postFetch = ''
+        # Try again with the new URL
+        urls="$(jq -r 'if (.success == true) then .data.downloadUrl else error(. | tostring) end' < "$downloadedFile" || exit $?)" \
+          downloadToTemp="" \
+          curlOptsList="" \
+          curlOpts="" \
+          postFetch="" \
+          exec "$SHELL" "''${BASH_ARGV[@]}"
+      '';
+      inherit hash;
+    };
+
+  ovftoolSystems = {
    "x86_64-linux" = rec {
-        name = "VMware-ovftool-${version}-lin.x86_64.zip";
-        version = "4.6.2-22220919";
-        url = "${baseUrl}/8a93ce23-4f88-4ae8-b067-ae174291e98f/c609234d-59f2-4758-a113-0ec5bbe4b120/${name}";
-        hash = "sha256-3B1cUDldoTqLsbSARj2abM65nv+Ot0z/Fa35/klJXEY=";
+      version = "4.6.3-24031167";
+      fileName = "VMware-ovftool-${version}-lin.x86_64.zip";
+      hash = "sha256-NEwwgmEh/mrZkMMhI+Kq+SYdd3MJ0+IBLdUhd1+kPow=";
    };
    "x86_64-darwin" = rec {
-        name = "VMware-ovftool-${version}-mac.x64.zip";
-        version = "4.6.2-22220919";
-        url = "${baseUrl}/91091b23-280a-487a-a048-0c2594303c92/dc666e23-104f-4b9b-be11-6d88dcf3ab98/${name}";
-        hash = "sha256-AZufZ0wxt5DYjnpahDfy36W8i7kjIfEkW6MoELSx11k=";
+      version = "4.6.3-24031167";
+      fileName = "VMware-ovftool-${version}-mac.x64.zip";
+      hash = "sha256-vhACcc4tjaQhvKwZyWkgpaKaoC+coWGl1zfSIC6WebM=";
    };
  };

  ovftoolSystem = ovftoolSystems.${stdenv.system} or (throw "unsupported system ${stdenv.system}");
-
 in
-stdenv.mkDerivation {
+stdenv.mkDerivation (final: {
  pname = "ovftool";
  inherit (ovftoolSystem) version;

-  src = fetchurl {
-    inherit (ovftoolSystem) name url hash;
-  };
+  src =
+    if acceptBroadcomEula then
+      fetchFromBroadcom {
+        inherit (ovftoolSystem) fileName version hash;
+      }
+    else
+      throw ''
+        See the following URL for terms of using this software:
+        ${mkBaseUrl ovftoolId}
+
+        Use `${final.pname}.override { acceptBroadcomEula = true; }` if you accept Broadcom's terms
+        and would like to use this package.
+      '';

  buildInputs =
    [
@ -67,9 +113,11 @@ stdenv.mkDerivation {
      libxcrypt-legacy
      xercesc
      zlib
+      curl
    ]
    ++ lib.optionals stdenv.hostPlatform.isLinux [
      glibc
+      openssl
    ]
    ++ lib.optionals stdenv.hostPlatform.isDarwin [
      libxml2
@ -97,12 +145,11 @@ stdenv.mkDerivation {
      # with the addition of a libexec directory and a Nix-style binary wrapper.

      # Almost all libs in the package appear to be VMware proprietary except for
-      # libgoogleurl and libcurl. The rest of the libraries that the installer
-      # extracts are omitted here, and provided in buildInputs. Since libcurl
-      # depends on VMware's OpenSSL, both libs are still used.
+      # libgoogleurl and libcurl.
+      #
      # FIXME: Replace libgoogleurl? Possibly from Chromium?
-      # FIXME: Tell VMware to use a modern version of OpenSSL. As of ovftool
-      # v4.6.2 ovftool uses openssl-1.0.2zh which in seems to be the extended
+      # FIXME: Tell VMware to use a modern version of OpenSSL on macOS. As of ovftool
+      # v4.6.3 ovftool uses openssl-1.0.2zj which in seems to be the extended
      # support LTS release: https://www.openssl.org/support/contracts.html

      # Install all libs that are not patched in preFixup.
@ -111,18 +158,15 @@ stdenv.mkDerivation {
      install -m 644 -t "$out/lib" \
    ''
    + lib.optionalString stdenv.hostPlatform.isLinux ''
-      libcrypto.so.1.0.2 \
-      libcurl.so.4 \
      libgoogleurl.so.59 \
-      libssl.so.1.0.2 \
      libssoclient.so \
      libvim-types.so \
      libvmacore.so \
      libvmomi.so
    ''
+    # macOS still relies on OpenSSL 1.0.2 as of v4.6.3, but Linux is in the clear
    + lib.optionalString stdenv.hostPlatform.isDarwin ''
      lib/libcrypto.1.0.2.dylib \
-      lib/libcurl.4.dylib \
      lib/libgoogleurl.59.0.30.45.2.dylib \
      lib/libssl.1.0.2.dylib \
      lib/libssoclient.dylib \
@ -151,6 +195,7 @@ stdenv.mkDerivation {
      install -m 644 -t "$out/share/licenses" \
        "vmware.eula" \
        "vmware-eula.rtf" \
+        "README.txt" \
        "open_source_licenses.txt"

      # Install Docs
@ -195,8 +240,12 @@ stdenv.mkDerivation {
      change_args+=(-change @loader_path/lib/libicuuc.60.2.dylib ${icu60}/lib/libicuuc.60.2.dylib)
      change_args+=(-change @loader_path/lib/libxerces-c-3.2.dylib ${xercesc}/lib/libxerces-c-3.2.dylib)

+      # lolwut
+      change_args+=(-change @GOBUILD_CAYMAN_CURL_ROOT@/apple_mac64/lib/libcurl.4.dylib ${curl.out}/lib/libcurl.4.dylib)
+
      # Patch binary
      install_name_tool "''${change_args[@]}" "$out/libexec/ovftool"
+      otool -L "$out/libexec/ovftool"

      # Additional patches for ovftool dylibs
      change_args+=(-change /usr/lib/libresolv.9.dylib ${lib.getLib darwin.libresolv}/lib/libresolv.9.dylib)
@ -206,7 +255,7 @@ stdenv.mkDerivation {
      change_args+=(-change @loader_path/libicuuc.60.2.dylib ${icu60}/lib/libicuuc.60.2.dylib)
      change_args+=(-change @loader_path/libxerces-c-3.2.dylib ${xercesc}/lib/libxerces-c-3.2.dylib)

-      # Add new abolute paths for other libs to all libs
+      # Add new absolute paths for other libs to all libs
      for lib in $out/lib/*.dylib; do
        libname=$(basename $lib)
        change_args+=(-change "@loader_path/$libname" "$out/lib/$libname")
@ -217,6 +266,7 @@ stdenv.mkDerivation {
        libname=$(basename $lib)
        install_name_tool -id "$libname" "$lib"
        install_name_tool "''${change_args[@]}" "$lib"
+        otool -L "$lib"
      done
    '';

@ -227,29 +277,34 @@ stdenv.mkDerivation {
    (allow file-read* (subpath "/System/Library/TextEncodings"))
  '';

-  doInstallCheck = true;
+  # Seems to get stuck and return 255, but works outside the sandbox
+  doInstallCheck = !stdenv.hostPlatform.isDarwin;

  postInstallCheck =
    lib.optionalString stdenv.hostPlatform.isDarwin ''
      export HOME=$TMPDIR
      # Construct a dummy /etc/passwd file - ovftool attempts to determine the
      # user's "real" home using this
-      DUMMY_PASSWD="$(realpath $HOME/dummy-passwd)"
+      DUMMY_PASSWD="$HOME/dummy-passwd"
      cat > $DUMMY_PASSWD <<EOF
      $(whoami)::$(id -u):$(id -g)::$HOME:$SHELL
      EOF
      export DYLD_INSERT_LIBRARIES="${libredirect}/lib/libredirect.dylib"
-      export NIX_REDIRECTS="/etc/passwd=$DUMMY_PASSWD"
+      export NIX_REDIRECTS="/etc/passwd=$(realpath "$DUMMY_PASSWD")"
    ''
    + ''
      mkdir -p ovftool-check && cd ovftool-check

      ovftool_with_args="$out/bin/ovftool --X:logToConsole"

+      # There are non-fatal warnings if we don't provide this, due to the sandbox.
+      export LC_ALL=C
+
      # `installCheckPhase.ova` is a NixOS 22.11 image (doesn't actually matter)
      # with a 1 MiB root disk that's all zero. Make sure that it converts
      # properly.

+      set -x
      $ovftool_with_args --schemaValidate ${./installCheckPhase.ova}
      $ovftool_with_args --sourceType=OVA --targetType=OVF ${./installCheckPhase.ova} nixos.ovf

@ -259,6 +314,7 @@ stdenv.mkDerivation {
      test -f nixos-disk1.vmdk

      $ovftool_with_args --schemaValidate nixos.ovf
+      set +x
    '';

  meta = with lib; {
@ -272,15 +328,13 @@ stdenv.mkDerivation {
    ];
    platforms = builtins.attrNames ovftoolSystems;
    mainProgram = "ovftool";
-    knownVulnerabilities = [
-      "The bundled version of openssl 1.0.2zh in ovftool has open vulnerabilities."
+    knownVulnerabilities = lib.optionals (stdenv.isDarwin) [
+      "The bundled version of openssl 1.0.2zj in ovftool for Darwin has open vulnerabilities."
+      "https://openssl-library.org/news/vulnerabilities-1.0.2/"
      "CVE-2024-0727"
-      "CVE-2023-5678"
-      "CVE-2023-3817"
-      "CVE-2009-3767"
-      "CVE-2009-3766"
-      "CVE-2009-3765"
-      "CVE-2009-1390"
+      "CVE-2024-5535"
+      "CVE-2024-9143"
+      "CVE-2024-13176"
    ];
  };
-}
+})
--- a/pkgs/by-name/pf/pferd/package.nix
+++ b/pkgs/by-name/pf/pferd/package.nix
@ -5,14 +5,14 @@
 }:
 python3Packages.buildPythonApplication rec {
  pname = "pferd";
-  version = "3.7.0";
+  version = "3.8.0";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "Garmelon";
    repo = "PFERD";
    tag = "v${version}";
-    sha256 = "sha256-4+LlnGv/i9zDf+HeW86PJ6XsPMEkJ0JzhLr14MJ4WKM=";
+    sha256 = "sha256-pbMT6KqqITDBPGgLGq4gmCmasby4lhuZzq02ixnDeSI=";
  };

  nativeBuildInputs = with python3Packages; [
--- a/pkgs/by-name/qw/qwertone/package.nix
+++ b/pkgs/by-name/qw/qwertone/package.nix
@ -0,0 +1,46 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitLab,
+  wrapGAppsHook3,
+  pkg-config,
+  alsa-lib,
+  atk,
+  gtk3,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "qwertone";
+  version = "0.5.0";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.com";
+    owner = "azymohliad";
+    repo = "qwertone";
+    tag = "v${version}";
+    hash = "sha256-GD7iFDAaS6D7DGPvK+Cof4rVbUwPX9aCI1jfc0XTxn8=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-5hrjmX+eUPrj48Ii1YHPZFPMvynowSwSArcNnUOw4hc=";
+
+  nativeBuildInputs = [
+    wrapGAppsHook3
+    pkg-config
+  ];
+
+  buildInputs = [
+    alsa-lib
+    atk
+    gtk3
+  ];
+
+  meta = {
+    description = "Simple music synthesizer app based on usual qwerty-keyboard for input";
+    mainProgram = "qwertone";
+    homepage = "https://gitlab.com/azymohliad/qwertone";
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ linsui ];
+  };
+}
--- a/pkgs/by-name/re/reddit-tui/package.nix
+++ b/pkgs/by-name/re/reddit-tui/package.nix
@ -7,14 +7,14 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "reddit-tui";
-  version = "0.3.4";
+  version = "0.3.5";
  src = fetchFromGitHub {
    owner = "tonymajestro";
    repo = "reddit-tui";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-FlGprSbt1/jTRe2p/aXt5f5aZAxnQlb6M70wvUdE9qk=";
+    hash = "sha256-M6GYfsKKvqVlDzEndaX92Zo5wwqVgrYGUKtbs94Krz4=";
  };
-  vendorHash = "sha256-H2ukIIi30b8kGOjESXJGv/VW5pPgfxG2c3H6S4jRAA4=";
+  vendorHash = "sha256-Yqo80adzA9gtSD3qzM+fObzRt3WbcMATQef0g7/z2Dw=";
  doCheck = false;

  passthru.updateScript = nix-update-script { };
--- a/pkgs/by-name/re/redisinsight/package.nix
+++ b/pkgs/by-name/re/redisinsight/package.nix
@ -1,108 +1,108 @@
 {
  lib,
  stdenv,
+
  fetchFromGitHub,
-  makeWrapper,
-  makeDesktopItem,
-  copyDesktopItems,
-  fixup-yarn-lock,
-  yarn,
-  nodejs_18,
-  python3,
  fetchYarnDeps,
-  electron,
-  nest-cli,
-  libsass,
-  buildPackages,
+  makeDesktopItem,
+
+  copyDesktopItems,
+  dart-sass,
+  makeWrapper,
+  nodejs_20,
  pkg-config,
+  yarnConfigHook,
+
+  electron,
+  libsecret,
  sqlite,
-  xdg-utils,
 }:

 let
-  nodejs = nodejs_18;
+  nodejs = nodejs_20;
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "redisinsight";
-  version = "2.48.0";
+  version = "2.68.0";

  src = fetchFromGitHub {
    owner = "RedisInsight";
    repo = "RedisInsight";
    rev = finalAttrs.version;
-    hash = "sha256-ek0Fp8v6j+mZPK2cEuFNrBgInXdYIKBBUg0UD1I51Sg=";
+    hash = "sha256-rXp3C/Ui3vMBscsxlwU9fRF1bmvMrvXLtmJfGzfh1Rk=";
  };

-  offlineCache = fetchYarnDeps {
-    yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-ohtU1h6wrg7asXDxTt1Jlzx9GaS3zDrGQD9P9tgzCOE=";
+  patches = [
+    # the `file:` specifier doesn't seem to be supported with fetchYarnDeps
+    # upstream uses it to point the cpu-features dependency to a stub package
+    # so it's safe to remove
+    ./remove-cpu-features.patch
+  ];
+
+  baseOfflineCache = fetchYarnDeps {
+    name = "redisinsight-${finalAttrs.version}-base-offline-cache";
+    inherit (finalAttrs) src patches;
+    hash = "sha256-ORVftwl/8Yrug2MeqWfZTsHNTRJlpKGn2P7JCHUf3do=";
  };

-  feOfflineCache = fetchYarnDeps {
-    yarnLock = finalAttrs.src + "/redisinsight/yarn.lock";
-    hash = "sha256-9xbIdDeLUEk4eNeK7RTwidqDGinA8SPfcumqml66kTw=";
+  innerOfflineCache = fetchYarnDeps {
+    name = "redisinsight-${finalAttrs.version}-inner-offline-cache";
+    inherit (finalAttrs) src patches;
+    postPatch = "cd redisinsight";
+    hash = "sha256-yFfkpWV/GD2CcAzb0D3lNZwmqzEN6Bi1MjPyRwClaQ0=";
  };

  apiOfflineCache = fetchYarnDeps {
-    yarnLock = finalAttrs.src + "/redisinsight/api/yarn.lock";
-    hash = "sha256-4zbffuneTceMEyKb8atTXTFhTv0DhrsRMdepZWgoxMQ=";
+    name = "redisinsight-${finalAttrs.version}-api-offline-cache";
+    inherit (finalAttrs) src patches;
+    postPatch = "cd redisinsight/api";
+    hash = "sha256-go7IR1UsW8TrWjaFSlC6/biUvb9cHo3PgJa16tF0XHo=";
  };

  nativeBuildInputs = [
-    yarn
-    fixup-yarn-lock
-    nodejs
-    makeWrapper
-    (python3.withPackages (ps: [ ps.setuptools ]))
-    nest-cli
-    libsass
-    pkg-config
    copyDesktopItems
+    makeWrapper
+    nodejs
+    (nodejs.python.withPackages (ps: [ ps.setuptools ]))
+    pkg-config
+    yarnConfigHook
  ];

  buildInputs = [
-    sqlite
-    xdg-utils
+    sqlite # for `sqlite3` node module
+    libsecret # for `keytar` node module
  ];

+  postPatch = ''
+    substituteInPlace redisinsight/api/config/default.ts \
+      --replace-fail "process['resourcesPath']" "\"$out/share/redisinsight\""
+
+    # has irrelevant files
+    rm -r resources/app
+  '';
+
+  # will run yarnConfigHook manually later
+  dontYarnInstallDeps = true;
+
  configurePhase = ''
    runHook preConfigure

-    export HOME=$(mktemp -d)
-    yarn config --offline set yarn-offline-mirror ${finalAttrs.offlineCache}
-    fixup-yarn-lock yarn.lock
-    yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
+    yarnOfflineCache="$baseOfflineCache" yarnConfigHook
+    cd redisinsight
+    yarnOfflineCache="$innerOfflineCache" yarnConfigHook
+    cd api
+    yarnOfflineCache="$apiOfflineCache" yarnConfigHook
+    cd ../..

-    yarn config --offline set yarn-offline-mirror ${finalAttrs.feOfflineCache}
-    fixup-yarn-lock redisinsight/yarn.lock
-    yarn --offline --cwd redisinsight/ --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
-
-    yarn config --offline set yarn-offline-mirror ${finalAttrs.apiOfflineCache}
-    fixup-yarn-lock redisinsight/api/yarn.lock
-    yarn --offline --cwd redisinsight/api/ --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
-
-    patchShebangs node_modules/
-    patchShebangs redisinsight/node_modules/
-    patchShebangs redisinsight/api/node_modules/
-
-    mkdir -p "$HOME/.node-gyp/${nodejs.version}"
-    echo 9 >"$HOME/.node-gyp/${nodejs.version}/installVersion"
-    ln -sfv "${nodejs}/include" "$HOME/.node-gyp/${nodejs.version}"
-    export npm_config_nodedir=${nodejs}
-
-    # Build the sqlite3 package.
-    pushd redisinsight
-    npm_config_node_gyp="${buildPackages.nodejs}/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js" npm rebuild --verbose --sqlite=${sqlite.dev} sqlite3
-    popd
-
-    # Build node-sass
-    LIBSASS_EXT=auto npm rebuild --verbose node-sass
-
-    substituteInPlace redisinsight/api/config/default.ts \
-      --replace-fail "process['resourcesPath']" "\"$out/share/redisinsight\"" \
-
-    # has irrelevant files
-    rm -r resources/app
+    export npm_config_nodedir=${electron.headers}
+    export npm_config_sqlite=${lib.getDev sqlite}
+    export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+    npm rebuild --verbose --no-progress
+    cd redisinsight
+    npm rebuild --verbose --no-progress
+    cd api
+    npm rebuild --verbose --no-progress
+    cd ../..

    runHook postConfigure
  '';
@ -110,14 +110,20 @@ stdenv.mkDerivation (finalAttrs: {
  buildPhase = ''
    runHook preBuild

-    yarn config --offline set yarn-offline-mirror ${finalAttrs.offlineCache}
+    # force the sass npm dependency to use our own sass binary instead of the bundled one
+    substituteInPlace node_modules/sass/dist/lib/src/compiler-path.js \
+      --replace-fail 'compilerCommand = (() => {' 'compilerCommand = (() => { return ["${lib.getExe dart-sass}"];'

    yarn --offline build:prod

+    # TODO: Generate defaults. Currently broken because it requires network access.
+    # yarn --offline --cwd=redisinsight/api build:defaults
+
    yarn --offline electron-builder \
      --dir \
      -c.electronDist=${electron.dist} \
-      -c.electronVersion=${electron.version}
+      -c.electronVersion=${electron.version} \
+      -c.npmRebuild=false # we've already rebuilt the native libs using the electron headers

    runHook postBuild
  '';
@ -159,7 +165,7 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  meta = {
-    description = "RedisInsight Redis client powered by Electron";
+    description = "Developer GUI for Redis";
    homepage = "https://github.com/RedisInsight/RedisInsight";
    license = lib.licenses.sspl;
    maintainers = with lib.maintainers; [
--- a/pkgs/by-name/re/redisinsight/remove-cpu-features.patch
+++ b/pkgs/by-name/re/redisinsight/remove-cpu-features.patch
@ -0,0 +1,70 @@
+diff --git a/redisinsight/api/package.json b/redisinsight/api/package.json
+index 4a24ac8..fab339c 100644
+--- a/redisinsight/api/package.json
+++ b/redisinsight/api/package.json
+@@ -49,7 +49,6 @@
+     "@nestjs/platform-socket.io/socket.io": "^4.8.0",
+     "@nestjs/cli/**/braces": "^3.0.3",
+     "**/semver": "^7.5.2",
+-    "**/cpu-features": "file:./stubs/cpu-features",
+     "**/cross-spawn": "^7.0.5",
+     "**/redis-parser": "3.0.0",
+     "winston-daily-rotate-file/**/file-stream-rotator": "^1.0.0"
+diff --git a/redisinsight/api/yarn.lock b/redisinsight/api/yarn.lock
+index e0e8495..dfed1ae 100644
+--- a/redisinsight/api/yarn.lock
+++ b/redisinsight/api/yarn.lock
+@@ -3223,9 +3223,6 @@ cosmiconfig@^8.2.0:
+     parse-json "^5.2.0"
+     path-type "^4.0.0"
+ 
+-"cpu-features@file:./stubs/cpu-features", cpu-features@~0.0.9:
+-  version "1.0.0"
+-
+ create-jest@^29.7.0:
+   version "29.7.0"
+   resolved "https://registry.yarnpkg.com/create-jest/-/create-jest-29.7.0.tgz#a355c5b3cb1e1af02ba177fe7afd7feee49a5320"
+@@ -7969,7 +7966,6 @@ ssh2@^1.15.0:
+     asn1 "^0.2.6"
+     bcrypt-pbkdf "^1.0.2"
+   optionalDependencies:
+-    cpu-features "~0.0.9"
+     nan "^2.18.0"
+ 
+ ssri@^8.0.0, ssri@^8.0.1:
+diff --git a/redisinsight/package.json b/redisinsight/package.json
+index 8649be7..354ed42 100644
+--- a/redisinsight/package.json
+++ b/redisinsight/package.json
+@@ -16,8 +16,7 @@
+   },
+   "resolutions": {
+     "**/semver": "^7.5.2",
+-    "sqlite3/**/tar": "^6.2.1",
+-    "**/cpu-features": "file:./api/stubs/cpu-features"
+    "sqlite3/**/tar": "^6.2.1"
+   },
+   "dependencies": {
+     "keytar": "^7.9.0",
+diff --git a/redisinsight/yarn.lock b/redisinsight/yarn.lock
+index 7a063ce..22f37a7 100644
+--- a/redisinsight/yarn.lock
+++ b/redisinsight/yarn.lock
+@@ -183,9 +183,6 @@ console-control-strings@^1.1.0:
+   resolved "https://registry.yarnpkg.com/console-control-strings/-/console-control-strings-1.1.0.tgz#3d7cf4464db6446ea644bf4b39507f9851008e8e"
+   integrity sha512-ty/fTekppD2fIwRvnZAVdeOiGd1c7YXEixbgJTNzqcxJWKQnjJ/V1bNEEE6hygpM3WjwHFUVK6HTjWSzV4a8sQ==
+ 
+-"cpu-features@file:./api/stubs/cpu-features", cpu-features@~0.0.10:
+-  version "1.0.0"
+-
+ debug@4, debug@^4.3.3:
+   version "4.3.4"
+   resolved "https://registry.yarnpkg.com/debug/-/debug-4.3.4.tgz#1319f6579357f2338d3337d2cdd4914bb5dcc865"
+@@ -807,7 +804,6 @@ ssh2@^1.15.0:
+     asn1 "^0.2.6"
+     bcrypt-pbkdf "^1.0.2"
+   optionalDependencies:
+-    cpu-features "~0.0.10"
+     nan "^2.20.0"
+ 
+ ssri@^8.0.0, ssri@^8.0.1:
--- a/pkgs/by-name/rs/rspamd/package.nix
+++ b/pkgs/by-name/rs/rspamd/package.nix
@ -13,6 +13,7 @@
  pkg-config,
  sqlite,
  ragel,
+  fasttext,
  icu,
  vectorscan,
  jemalloc,
@ -57,6 +58,7 @@ stdenv.mkDerivation rec {
      pcre
      sqlite
      ragel
+      fasttext
      icu
      jemalloc
      libsodium
@ -80,6 +82,8 @@ stdenv.mkDerivation rec {
    "-DDBDIR=/var/lib/rspamd"
    "-DLOGDIR=/var/log/rspamd"
    "-DLOCAL_CONFDIR=/etc/rspamd"
+    "-DENABLE_BLAS=${if withBlas then "ON" else "OFF"}"
+    "-DENABLE_FASTTEXT=ON"
    "-DENABLE_JEMALLOC=ON"
    "-DSYSTEM_DOCTEST=ON"
    "-DSYSTEM_FMT=ON"
--- a/pkgs/by-name/sp/splash/package.nix
+++ b/pkgs/by-name/sp/splash/package.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "splash";
-  version = "3.11.2";
+  version = "3.11.3";

  src = fetchFromGitHub {
    owner = "danieljprice";
    repo = "splash";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-YB0cgxpRlya8/7fYxPKWBCovHvE/N7HY/7nwKnzYiJc=";
+    hash = "sha256-deuQTCDSLzScd9lFxv83Y8gX7D7WZtikIUfMxbmH2m8=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/to/tone/deps.json
+++ b/pkgs/by-name/to/tone/deps.json
@ -6,8 +6,8 @@
  },
  {
    "pname": "CliWrap",
-    "version": "3.7.0",
-    "hash": "sha256-hXClLGuhscCrcBaymrp57Prh4m8Qe0vdE4S2ErIM13w="
+    "version": "3.7.1",
+    "hash": "sha256-e0snh/9Ai6/Gw5ycQox2H5nGrPhKfT2sH9dQNjbrrCI="
  },
  {
    "pname": "CSharp.OperationResult",
@ -21,8 +21,8 @@
  },
  {
    "pname": "HtmlAgilityPack",
-    "version": "1.11.71",
-    "hash": "sha256-ddNrIXTfiu8gwrUs/5xYDjpD0sOth90kut6qCgxGUSE="
+    "version": "1.11.72",
+    "hash": "sha256-MRt7yj6+/ORmr2WBERpQ+1gMRzIaPFKddHoB4zZmv2k="
  },
  {
    "pname": "Jint",
@ -31,44 +31,59 @@
  },
  {
    "pname": "Microsoft.Extensions.Configuration",
-    "version": "9.0.0",
-    "hash": "sha256-uBLeb4z60y8z7NelHs9uT3cLD6wODkdwyfJm6/YZLDM="
+    "version": "9.0.1",
+    "hash": "sha256-QKWRIGi8RaZjheuW9gMouXa3oaL/nMwlmg28/xxEvgs="
  },
  {
    "pname": "Microsoft.Extensions.Configuration.Abstractions",
    "version": "9.0.0",
    "hash": "sha256-xtG2USC9Qm0f2Nn6jkcklpyEDT3hcEZOxOwTc0ep7uc="
  },
+  {
+    "pname": "Microsoft.Extensions.Configuration.Abstractions",
+    "version": "9.0.1",
+    "hash": "sha256-r3iWP+kwKo4Aib8SGo91kKWR5WusLrbFHUAw5uKQeNA="
+  },
  {
    "pname": "Microsoft.Extensions.Configuration.Binder",
    "version": "9.0.0",
    "hash": "sha256-6ajYWcNOQX2WqftgnoUmVtyvC1kkPOtTCif4AiKEffU="
  },
+  {
+    "pname": "Microsoft.Extensions.Configuration.Binder",
+    "version": "9.0.1",
+    "hash": "sha256-uq6i0gTobSTqaNm/0XZuv8GGjFpnvgwXnCCPWl9FP9g="
+  },
  {
    "pname": "Microsoft.Extensions.Configuration.EnvironmentVariables",
-    "version": "9.0.0",
-    "hash": "sha256-tDJx2prYZpr0RKSwmJfsK9FlUGwaDmyuSz2kqQxsWoI="
+    "version": "9.0.1",
+    "hash": "sha256-NS38eSGrEMQf1CgwwcLtmjMNmcLB6ssOWwU4EZw2zBk="
  },
  {
    "pname": "Microsoft.Extensions.Configuration.FileExtensions",
-    "version": "9.0.0",
-    "hash": "sha256-PsLo6mrLGYfbi96rfCG8YS1APXkUXBG4hLstpT60I4s="
+    "version": "9.0.1",
+    "hash": "sha256-xEgobzCPSB+8NbAcjOjES1oYKBdwk5hVdfENL2XPWbk="
  },
  {
    "pname": "Microsoft.Extensions.Configuration.Json",
-    "version": "9.0.0",
-    "hash": "sha256-qQn7Ol0CvPYuyecYWYBkPpTMdocO7I6n+jXQI2udzLI="
+    "version": "9.0.1",
+    "hash": "sha256-8mqWcbJk8FOonELQPaxmAQAkVEz8OrHqn/4sl8SDigM="
  },
  {
    "pname": "Microsoft.Extensions.DependencyInjection",
-    "version": "9.0.0",
-    "hash": "sha256-dAH52PPlTLn7X+1aI/7npdrDzMEFPMXRv4isV1a+14k="
+    "version": "9.0.1",
+    "hash": "sha256-Kt9fczXVeOIlvwuxXdQDKRfIZKClay0ESGUIAJpYiOw="
  },
  {
    "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
    "version": "9.0.0",
    "hash": "sha256-CncVwkKZ5CsIG2O0+OM9qXuYXh3p6UGyueTHSLDVL+c="
  },
+  {
+    "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
+    "version": "9.0.1",
+    "hash": "sha256-2tWVTPHsw1NG2zO0zsxvi1GybryqeE1V00ZRE66YZB4="
+  },
  {
    "pname": "Microsoft.Extensions.DependencyModel",
    "version": "9.0.0",
@ -76,59 +91,79 @@
  },
  {
    "pname": "Microsoft.Extensions.Diagnostics",
-    "version": "9.0.0",
-    "hash": "sha256-JMbhtjdcWRlrcrbgPlowfj26+pM+MYhnPIaYKnv9byU="
+    "version": "9.0.1",
+    "hash": "sha256-WOuWbkV9IxXnIN2xpqeoovoD3rbMpwAXSJlYKSI4dUI="
  },
  {
    "pname": "Microsoft.Extensions.Diagnostics.Abstractions",
-    "version": "9.0.0",
-    "hash": "sha256-wG1LcET+MPRjUdz3HIOTHVEnbG/INFJUqzPErCM79eY="
+    "version": "9.0.1",
+    "hash": "sha256-/JkeyAQ//lfuHrWbq8ZFrHZiLvIXSnBj0MG0rU8eggQ="
  },
  {
    "pname": "Microsoft.Extensions.FileProviders.Abstractions",
-    "version": "9.0.0",
-    "hash": "sha256-mVfLjZ8VrnOQR/uQjv74P2uEG+rgW72jfiGdSZhIfDc="
+    "version": "9.0.1",
+    "hash": "sha256-ZVnTUbr2eIVFHdtTG9H1kR4DzgpDiMFzRcNx0brHf3o="
  },
  {
    "pname": "Microsoft.Extensions.FileProviders.Physical",
-    "version": "9.0.0",
-    "hash": "sha256-IzFpjKHmF1L3eVbFLUZa2N5aH3oJkJ7KE1duGIS7DP8="
+    "version": "9.0.1",
+    "hash": "sha256-GKyzSDYPl5Y0AAHufaULu8BLKWQU1ofAUJt4YENVaXU="
  },
  {
    "pname": "Microsoft.Extensions.FileSystemGlobbing",
-    "version": "9.0.0",
-    "hash": "sha256-eBLa8pW/y/hRj+JbEr340zbHRABIeFlcdqE0jf5/Uhc="
+    "version": "9.0.1",
+    "hash": "sha256-eoJViA7yWsT9gD/oY5WJHaEWHDibek6uClj8woyteHM="
  },
  {
    "pname": "Microsoft.Extensions.Http",
-    "version": "9.0.0",
-    "hash": "sha256-MsStH3oUfyBbcSEoxm+rfxFBKI/rtB5PZrSGvtDjVe0="
+    "version": "9.0.1",
+    "hash": "sha256-MvQon3jJ/wIhXCLFuI2s0tW4+bh0jUAu6H5I5R8WjaQ="
  },
  {
    "pname": "Microsoft.Extensions.Logging",
    "version": "9.0.0",
    "hash": "sha256-kR16c+N8nQrWeYLajqnXPg7RiXjZMSFLnKLEs4VfjcM="
  },
+  {
+    "pname": "Microsoft.Extensions.Logging",
+    "version": "9.0.1",
+    "hash": "sha256-IjszwetJ/r1NvwVyh+/SlavabNt9UXf3ZSGP9gGwnkk="
+  },
  {
    "pname": "Microsoft.Extensions.Logging.Abstractions",
    "version": "9.0.0",
    "hash": "sha256-iBTs9twjWXFeERt4CErkIIcoJZU1jrd1RWCI8V5j7KU="
  },
+  {
+    "pname": "Microsoft.Extensions.Logging.Abstractions",
+    "version": "9.0.1",
+    "hash": "sha256-aFZeUno9yLLbvtrj53gA7oD41vxZZYkrJhlOghpMEjo="
+  },
  {
    "pname": "Microsoft.Extensions.Options",
    "version": "9.0.0",
    "hash": "sha256-DT5euAQY/ItB5LPI8WIp6Dnd0lSvBRP35vFkOXC68ck="
  },
+  {
+    "pname": "Microsoft.Extensions.Options",
+    "version": "9.0.1",
+    "hash": "sha256-wOKd/0+kRK3WrGA2HmS/KNYUTUwXHmTAD5IsClTFA10="
+  },
  {
    "pname": "Microsoft.Extensions.Options.ConfigurationExtensions",
-    "version": "9.0.0",
-    "hash": "sha256-r1Z3sEVSIjeH2UKj+KMj86har68g/zybSqoSjESBcoA="
+    "version": "9.0.1",
+    "hash": "sha256-pzc49CPyBlSoyflWvW6J+xqk2RXEVfPczcDiR0Aj9xA="
  },
  {
    "pname": "Microsoft.Extensions.Primitives",
    "version": "9.0.0",
    "hash": "sha256-ZNLusK1CRuq5BZYZMDqaz04PIKScE2Z7sS2tehU7EJs="
  },
+  {
+    "pname": "Microsoft.Extensions.Primitives",
+    "version": "9.0.1",
+    "hash": "sha256-tdbtoC7eQGW5yh66FWCJQqmFJkNJD+9e6DDKTs7YAjs="
+  },
  {
    "pname": "Newtonsoft.Json",
    "version": "13.0.3",
@ -141,8 +176,8 @@
  },
  {
    "pname": "Sandreas.AudioMetadata",
-    "version": "0.2.7",
-    "hash": "sha256-GYD+nAURuU99/3JH/4QTthhzAVsau/qpcvih4eiJxtk="
+    "version": "0.2.8",
+    "hash": "sha256-fxzUNFUC/HesKbucrFkOcfqzZfvGqSe3Kr3ZrUzJEic="
  },
  {
    "pname": "Sandreas.Files",
@ -189,16 +224,16 @@
    "version": "0.49.1",
    "hash": "sha256-sar9rhft1ivDMj1kU683+4KxUPUZL+Fb++ewMA6RD4Q="
  },
-  {
-    "pname": "System.CodeDom",
-    "version": "9.0.0",
-    "hash": "sha256-578lcBgswW0eM16r0EnJzfGodPx86RxxFoZHc2PSzsw="
-  },
  {
    "pname": "System.Diagnostics.DiagnosticSource",
    "version": "9.0.0",
    "hash": "sha256-1VzO9i8Uq2KlTw1wnCCrEdABPZuB2JBD5gBsMTFTSvE="
  },
+  {
+    "pname": "System.Diagnostics.DiagnosticSource",
+    "version": "9.0.1",
+    "hash": "sha256-nIIvVK+5uyOhAuU2sERNADK4N/A/x0MilBH/EAr1gOA="
+  },
  {
    "pname": "System.IO.Abstractions",
    "version": "19.0.1",
@ -210,20 +245,30 @@
    "hash": "sha256-vb0NrPjfEao3kfZ0tavp2J/29XnsQTJgXv3/qaAwwz0="
  },
  {
-    "pname": "System.Management",
-    "version": "9.0.0",
-    "hash": "sha256-UyLO5dgNVC7rBT1S6o/Ix6EQGlVTSWUQtVC+/cyTkfQ="
+    "pname": "System.IO.Pipelines",
+    "version": "9.0.1",
+    "hash": "sha256-CnmDanknCGbNnoDjgZw62M/Grg8IMTJDa8x3P07UR2A="
  },
  {
    "pname": "System.Text.Encodings.Web",
    "version": "9.0.0",
    "hash": "sha256-WGaUklQEJywoGR2jtCEs5bxdvYu5SHaQchd6s4RE5x0="
  },
+  {
+    "pname": "System.Text.Encodings.Web",
+    "version": "9.0.1",
+    "hash": "sha256-iuAVcTiiZQLCZjDfDqdLLPHqZdZqvFabwLFHiVYdRJo="
+  },
  {
    "pname": "System.Text.Json",
    "version": "9.0.0",
    "hash": "sha256-aM5Dh4okLnDv940zmoFAzRmqZre83uQBtGOImJpoIqk="
  },
+  {
+    "pname": "System.Text.Json",
+    "version": "9.0.1",
+    "hash": "sha256-2dqE+Mx5eJZ8db74ofUiUXHOSxDCmXw5n9VC9w4fUr0="
+  },
  {
    "pname": "TestableIO.System.IO.Abstractions",
    "version": "19.0.1",
@ -241,7 +286,7 @@
  },
  {
    "pname": "z440.atl.core",
-    "version": "6.11.0",
-    "hash": "sha256-V1r1ftZ/Ud0pw/qwnqpJodRaGi9FyG3uIy3ykJUvxjg="
+    "version": "6.14.0",
+    "hash": "sha256-H9Z9a+Vfn1P3u5ClwRB3x1ooXvUQbayyPrRvIiop9aU="
  }
 ]
--- a/pkgs/by-name/to/tone/package.nix
+++ b/pkgs/by-name/to/tone/package.nix
@ -10,15 +10,20 @@

 buildDotnetModule rec {
  pname = "tone";
-  version = "0.2.4";
+  version = "0.2.5";

  src = fetchFromGitHub {
    owner = "sandreas";
    repo = "tone";
    tag = "v${version}";
-    hash = "sha256-DX54NSlqAZzVQObm9qjUsYatjxjHKGcSLHH1kVD4Row=";
+    hash = "sha256-yqcxqwlCfVDTv5jkcneimlS5EgnDlB7ZvxPt53t9jbQ=";
  };

+  patchPhase = ''
+    substituteInPlace tone/Program.cs \
+      --replace-fail "@package_version@" ${version}
+  '';
+
  projectFile = "tone/tone.csproj";
  executables = [ "tone" ];
  nugetDeps = ./deps.json;
--- a/pkgs/by-name/ur/url-parser/package.nix
+++ b/pkgs/by-name/ur/url-parser/package.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "url-parser";
-  version = "2.1.4";
+  version = "2.1.5";

  src = fetchFromGitHub {
    owner = "thegeeklab";
    repo = "url-parser";
    tag = "v${version}";
-    hash = "sha256-GIJj4t6xDXfXMWfSpUR1iI1Ju/W/2REedgtyEFgbylE=";
+    hash = "sha256-Kwjub9qAfHhqNL3mRzlJws1wnwVPAJ3jPYh0s/cu7+8=";
  };

-  vendorHash = "sha256-gYkuSBgkDdAaJArsvTyZXkvYCKXkhic5XzLqPbbGVOw=";
+  vendorHash = "sha256-MR8SjQ8IrHC6hZTvmnqXvqJ6odo0+RIMDtMpYwY+iMs=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/ya/yarr/package.nix
+++ b/pkgs/by-name/ya/yarr/package.nix
@ -1,26 +1,26 @@
 {
  lib,
+  stdenv,
  buildGoModule,
  fetchFromGitHub,
-  testers,
-  yarr,
+  versionCheckHook,
+  nix-update-script,
+  nixosTests,
 }:

 buildGoModule rec {
  pname = "yarr";
-  version = "2.4";
+  version = "2.5";

  src = fetchFromGitHub {
    owner = "nkanaev";
    repo = "yarr";
    rev = "v${version}";
-    hash = "sha256-ZMQ+IX8dZuxyxQhD/eWAe4bGGCVcaCeVgF+Wqs79G+k=";
+    hash = "sha256-yII0KV4AKIS1Tfhvj588O631JDArnr0/30rNynTSwzk=";
  };

  vendorHash = null;

-  subPackages = [ "src" ];
-
  ldflags = [
    "-s"
    "-w"
@ -30,16 +30,16 @@ buildGoModule rec {

  tags = [
    "sqlite_foreign_keys"
-    "release"
+    "sqlite_json"
  ];

-  postInstall = ''
-    mv $out/bin/{src,yarr}
-  '';
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";

-  passthru.tests.version = testers.testVersion {
-    package = yarr;
-    version = "v${version}";
+  passthru = {
+    updateScript = nix-update-script { };
+    tests = lib.optionalAttrs stdenv.hostPlatform.isLinux nixosTests.yarr;
  };

  meta = with lib; {
@ -48,6 +48,9 @@ buildGoModule rec {
    homepage = "https://github.com/nkanaev/yarr";
    changelog = "https://github.com/nkanaev/yarr/blob/v${version}/doc/changelog.txt";
    license = licenses.mit;
-    maintainers = with maintainers; [ sikmir ];
+    maintainers = with maintainers; [
+      sikmir
+      christoph-heiss
+    ];
  };
 }
--- a/pkgs/by-name/yo/your_spotify/package.nix
+++ b/pkgs/by-name/yo/your_spotify/package.nix
@ -51,6 +51,7 @@ stdenv.mkDerivation (finalAttrs: {

    mkdir -p $out/share/your_spotify
    cp -r node_modules $out/share/your_spotify/node_modules
+    rm $out/share/your_spotify/node_modules/@your_spotify/{client,dev,server}
    cp -r ./apps/server/{lib,package.json} $out
    mkdir -p $out/bin
    makeWrapper ${lib.escapeShellArg (lib.getExe nodejs)} "$out/bin/your_spotify_migrate" \
--- a/pkgs/applications/science/logic/z3/tptp.nix
+++ b/pkgs/applications/science/logic/z3/tptp.nix
@ -30,6 +30,6 @@ stdenv.mkDerivation rec {
  meta = {
    inherit (z3.meta) license homepage platforms;
    description = "TPTP wrapper for Z3 prover";
-    maintainers = [ lib.maintainers.raskin ];
+    maintainers = z3.meta.maintainers ++ [ lib.maintainers.raskin ];
  };
 }
--- a/pkgs/by-name/z3/z3/package.nix
+++ b/pkgs/by-name/z3/z3/package.nix
@ -0,0 +1,6 @@
+{
+  z3_4_14,
+  ...
+}@args:
+
+z3_4_14.override args
--- a/pkgs/by-name/z3/z3_4_14/package.nix
+++ b/pkgs/by-name/z3/z3_4_14/package.nix
@ -0,0 +1,130 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  python3,
+  fixDarwinDylibNames,
+  nix-update-script,
+  javaBindings ? false,
+  ocamlBindings ? false,
+  pythonBindings ? true,
+  jdk ? null,
+  ocaml ? null,
+  findlib ? null,
+  zarith ? null,
+  versionInfo ? {
+    regex = "^v(4\\.14\\.[0-9]+)$";
+    version = "4.14.1";
+    hash = "sha256-pTsDzf6Frk4mYAgF81wlR5Kb1x56joFggO5Fa3G2s70=";
+  },
+  ...
+}:
+
+assert javaBindings -> jdk != null;
+assert ocamlBindings -> ocaml != null && findlib != null && zarith != null;
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "z3";
+  inherit (versionInfo) version;
+
+  src = fetchFromGitHub {
+    owner = "Z3Prover";
+    repo = "z3";
+    rev = "z3-${finalAttrs.version}";
+    inherit (versionInfo) hash;
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs =
+    [ python3 ]
+    ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames
+    ++ lib.optional javaBindings jdk
+    ++ lib.optionals ocamlBindings [
+      ocaml
+      findlib
+    ];
+  propagatedBuildInputs = [ python3.pkgs.setuptools ] ++ lib.optionals ocamlBindings [ zarith ];
+  enableParallelBuilding = true;
+
+  postPatch = lib.optionalString ocamlBindings ''
+    export OCAMLFIND_DESTDIR=$ocaml/lib/ocaml/${ocaml.version}/site-lib
+    mkdir -p $OCAMLFIND_DESTDIR/stublibs
+  '';
+
+  configurePhase =
+    lib.concatStringsSep " " (
+      [ "${python3.pythonOnBuildForHost.interpreter} scripts/mk_make.py --prefix=$out" ]
+      ++ lib.optional javaBindings "--java"
+      ++ lib.optional ocamlBindings "--ml"
+      ++ lib.optional pythonBindings "--python --pypkgdir=$out/${python3.sitePackages}"
+    )
+    + "\n"
+    + "cd build";
+
+  doCheck = true;
+  checkPhase = ''
+    make -j $NIX_BUILD_CORES test
+    ./test-z3 -a
+  '';
+
+  postInstall =
+    ''
+      mkdir -p $dev $lib
+      mv $out/lib $lib/lib
+      mv $out/include $dev/include
+    ''
+    + lib.optionalString pythonBindings ''
+      mkdir -p $python/lib
+      mv $lib/lib/python* $python/lib/
+      ln -sf $lib/lib/libz3${stdenv.hostPlatform.extensions.sharedLibrary} $python/${python3.sitePackages}/z3/lib/libz3${stdenv.hostPlatform.extensions.sharedLibrary}
+    ''
+    + lib.optionalString javaBindings ''
+      mkdir -p $java/share/java
+      mv com.microsoft.z3.jar $java/share/java
+      moveToOutput "lib/libz3java.${stdenv.hostPlatform.extensions.sharedLibrary}" "$java"
+    '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/z3 -version 2>&1 | grep -F "Z3 version $version"
+  '';
+
+  outputs =
+    [
+      "out"
+      "lib"
+      "dev"
+      "python"
+    ]
+    ++ lib.optional javaBindings "java"
+    ++ lib.optional ocamlBindings "ocaml";
+
+  passthru = {
+    updateScript = nix-update-script {
+      extraArgs =
+        [
+          "--version-regex"
+          versionInfo.regex
+        ]
+        ++ lib.optionals (versionInfo.autoUpdate or null != null) [
+          "--override-filename"
+          versionInfo.autoUpdate
+        ];
+    };
+  };
+
+  meta = {
+    description = "High-performance theorem prover and SMT solver";
+    mainProgram = "z3";
+    homepage = "https://github.com/Z3Prover/z3";
+    changelog = "https://github.com/Z3Prover/z3/releases/tag/z3-${finalAttrs.version}";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [
+      thoughtpolice
+      ttuegel
+      numinit
+    ];
+  };
+})
--- a/pkgs/development/libraries/libfive/default.nix
+++ b/pkgs/development/libraries/libfive/default.nix
@ -3,13 +3,11 @@
  stdenv,
  wrapQtAppsHook,
  fetchFromGitHub,
-  fetchFromGitLab,
-  fetchpatch,
  unstableGitUpdater,
  cmake,
  ninja,
  pkg-config,
-  eigen,
+  eigen_3_4_0,
  zlib,
  libpng,
  boost,
@ -37,32 +35,7 @@ stdenv.mkDerivation {
    python.pkgs.pythonImportsCheckHook
  ];
  buildInputs = [
-    # reverts 'eigen: 3.4.0 -> 3.4.0-unstable-2022-05-19'
-    # https://github.com/nixos/nixpkgs/commit/d298f046edabc84b56bd788e11eaf7ed72f8171c
-    (eigen.overrideAttrs (old: rec {
-      version = "3.4.0";
-      src = fetchFromGitLab {
-        owner = "libeigen";
-        repo = "eigen";
-        rev = version;
-        hash = "sha256-1/4xMetKMDOgZgzz3WMxfHUEpmdAm52RqZvz6i0mLEw=";
-      };
-      patches = (old.patches or [ ]) ++ [
-        # Fixes e.g. onnxruntime on aarch64-darwin:
-        # https://hydra.nixos.org/build/248915128/nixlog/1,
-        # originally suggested in https://github.com/NixOS/nixpkgs/pull/258392.
-        #
-        # The patch is from
-        # ["Fix vectorized reductions for Eigen::half"](https://gitlab.com/libeigen/eigen/-/merge_requests/699)
-        # which is two years old,
-        # but Eigen hasn't had a release in two years either:
-        # https://gitlab.com/libeigen/eigen/-/issues/2699.
-        (fetchpatch {
-          url = "https://gitlab.com/libeigen/eigen/-/commit/d0e3791b1a0e2db9edd5f1d1befdb2ac5a40efe0.patch";
-          hash = "sha256-8qiNpuYehnoiGiqy0c3Mcb45pwrmc6W4rzCxoLDSvj0=";
-        })
-      ];
-    }))
+    eigen_3_4_0
    zlib
    libpng
    boost
--- a/pkgs/development/python-modules/azure-mgmt-netapp/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-netapp/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "azure-mgmt-netapp";
-  version = "13.4.0";
+  version = "13.5.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -19,7 +19,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "azure_mgmt_netapp";
    inherit version;
-    hash = "sha256-w095/AskU8P+jNAnkL+a8Fe6SqhP3Wd22I6GCjeRL6I=";
+    hash = "sha256-StCIk/lM+SceJVjw5CDwheg6avcSep1VYXLwi96UXJE=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/bleak-esphome/default.nix
+++ b/pkgs/development/python-modules/bleak-esphome/default.nix
@ -19,14 +19,14 @@

 buildPythonPackage rec {
  pname = "bleak-esphome";
-  version = "2.12.0";
+  version = "2.13.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "bluetooth-devices";
    repo = "bleak-esphome";
    tag = "v${version}";
-    hash = "sha256-dR4KuaJWrWTVDWY11E/MRF12jCvOlC8c2flDOnkPjxw=";
+    hash = "sha256-ziUSqIox5tWp64EJ+Hacy1Wbh8NMpH/GUY9TUaN7Y3M=";
  };

  postPatch = ''
@ -61,7 +61,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Bleak backend of ESPHome";
    homepage = "https://github.com/bluetooth-devices/bleak-esphome";
-    changelog = "https://github.com/bluetooth-devices/bleak-esphome/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/bluetooth-devices/bleak-esphome/blob/${src.tag}/CHANGELOG.md";
    license = licenses.mit;
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/cf-xarray/default.nix
+++ b/pkgs/development/python-modules/cf-xarray/default.nix
@ -24,14 +24,14 @@

 buildPythonPackage rec {
  pname = "cf-xarray";
-  version = "0.10.4";
+  version = "0.10.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "xarray-contrib";
    repo = "cf-xarray";
    tag = "v${version}";
-    hash = "sha256-OlPoCFTeLTrYEUONu5PMZyfkQiHoqF/2Bj4OkUOCei8=";
+    hash = "sha256-ty7gPBs2vp0mVnn914F84Dg4+DLCBLl7aHMqqrXx9So=";
  };

  build-system = [
--- a/pkgs/development/python-modules/coinmetrics-api-client/default.nix
+++ b/pkgs/development/python-modules/coinmetrics-api-client/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "coinmetrics-api-client";
-  version = "2025.3.12.17";
+  version = "2025.4.15.13";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -28,7 +28,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    inherit version;
    pname = "coinmetrics_api_client";
-    hash = "sha256-vmmsslR+4fhNqkzvXB87ilc6vQ+b9PdMlj6LEV7ms7A=";
+    hash = "sha256-Wyst1/7CN4ZfkzvAkoUSDlSNECgwlx+11yQEzfddcJQ=";
  };

  pythonRelaxDeps = [ "typer" ];
--- a/pkgs/development/python-modules/dask-image/default.nix
+++ b/pkgs/development/python-modules/dask-image/default.nix
@ -35,6 +35,9 @@ buildPythonPackage rec {
  postPatch = ''
    substituteInPlace dask_image/ndinterp/__init__.py \
      --replace-fail "out_bounds.ptp(axis=1)" "np.ptp(out_bounds, axis=1)"
+
+    substituteInPlace tests/test_dask_image/test_imread/test_core.py \
+      --replace-fail "fh.save(" "fh.write("
  '';

  build-system = [
@ -64,6 +67,7 @@ buildPythonPackage rec {
    # AttributeError: 'str' object has no attribute 'start'
    "test_find_objects"
    "test_3d_find_objects"
+
    # AssertionError (comparing slices)
    "test_find_objects_with_empty_chunks"
  ];
--- a/pkgs/development/python-modules/gdsfactory/default.nix
+++ b/pkgs/development/python-modules/gdsfactory/default.nix
@ -2,8 +2,11 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
-  pytestCheckHook,
+
+  # build-system
  flit-core,
+
+  # dependencies
  jinja2,
  loguru,
  matplotlib,
@ -32,21 +35,25 @@
  ipykernel,
  attrs,
  graphviz,
+  pyglet,
+  typing-extensions,
+
  # tests
  jsondiff,
  jsonschema,
  pytest-regressions,
+  pytestCheckHook,
 }:
 buildPythonPackage rec {
  pname = "gdsfactory";
-  version = "8.18.1";
+  version = "9.5.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "gdsfactory";
    repo = "gdsfactory";
-    rev = "v${version}";
-    hash = "sha256-wDz8QpRgu40FB8+otnGsHVn2e6/SWXIZgA1aeMqMhPQ=";
+    tag = "v${version}";
+    hash = "sha256-z8zKPbWLl554MZq6/Iy3ecvwWiRpy57VYji8xHR+JBo=";
  };

  build-system = [ flit-core ];
@ -80,13 +87,15 @@ buildPythonPackage rec {
    ipykernel
    attrs
    graphviz
+    pyglet
+    typing-extensions
  ];

  nativeCheckInputs = [
    jsondiff
    jsonschema
-    pytestCheckHook
    pytest-regressions
+    pytestCheckHook
  ];

  pythonRelaxDeps = [
@ -99,10 +108,11 @@ buildPythonPackage rec {

  pythonImportsCheck = [ "gdsfactory" ];

-  meta = with lib; {
+  meta = {
    description = "Python library to generate GDS layouts";
    homepage = "https://github.com/gdsfactory/gdsfactory";
-    license = licenses.mit;
-    maintainers = with maintainers; [ fbeffa ];
+    changelog = "https://github.com/gdsfactory/gdsfactory/blob/v${version}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fbeffa ];
  };
 }
--- a/pkgs/development/python-modules/google-cloud-org-policy/default.nix
+++ b/pkgs/development/python-modules/google-cloud-org-policy/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "google-cloud-org-policy";
-  version = "1.13.1";
+  version = "1.14.0";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -21,7 +21,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "google_cloud_org_policy";
    inherit version;
-    hash = "sha256-2yPr1sgmxMnQwk6Z1T9i2MFPeAxjb40r4IqNoAd7WZk=";
+    hash = "sha256-TId9QgosUStFTmLqzSVXy7x09zTAeZRuMOYfYnkbMZw=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/google-generativeai/default.nix
+++ b/pkgs/development/python-modules/google-generativeai/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "google-generativeai";
-  version = "0.8.4";
+  version = "0.8.5";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "google";
    repo = "generative-ai-python";
    tag = "v${version}";
-    hash = "sha256-Snsp6hP1BKNLSFGbcotdhmluTuuBPZBcLkNY8mtOl6o=";
+    hash = "sha256-wc35JSc98xvepI7Gpe5jSJ+c8n7WLKa96axoWVcH7UM=";
  };

  pythonRelaxDeps = [ "google-ai-generativelanguage" ];
@ -51,7 +51,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Python client library for Google's large language model PaLM API";
    homepage = "https://github.com/google/generative-ai-python";
-    changelog = "https://github.com/google/generative-ai-python/releases/tag/v${version}";
+    changelog = "https://github.com/google/generative-ai-python/releases/tag/${src.tag}";
    license = licenses.asl20;
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/holidays/default.nix
+++ b/pkgs/development/python-modules/holidays/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "holidays";
-  version = "0.70";
+  version = "0.71";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "vacanza";
    repo = "python-holidays";
    tag = "v${version}";
-    hash = "sha256-0YjkuGJZbueoFerHKSHjIGn+NwFrz7rJRnrFLx28v6w=";
+    hash = "sha256-umfwSIi9Vu3fDvSVbq3cbQZ83q925VwxVPHedzrcqag=";
  };

  build-system = [
--- a/pkgs/development/python-modules/kfactory/default.nix
+++ b/pkgs/development/python-modules/kfactory/default.nix
@ -2,37 +2,43 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
-  pytestCheckHook,
+
+  # build-system
  setuptools,
  setuptools-scm,
-  klayout,
+
+  # dependencies
  aenum,
  cachetools,
  gitpython,
+  klayout,
  loguru,
+  numpy,
  pydantic,
  pydantic-settings,
  rectangle-packer,
  requests,
+  ruamel-yaml,
  ruamel-yaml-string,
  scipy,
  tomli,
  toolz,
  typer,
-  numpy,
-  ruamel-yaml,
+
+  # tests
+  pytestCheckHook,
 }:

 buildPythonPackage rec {
  pname = "kfactory";
-  version = "0.21.7";
+  version = "1.4.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "gdsfactory";
    repo = "kfactory";
-    rev = "v${version}";
-    sha256 = "sha256-VLhAJ5rOBKEO1FDCnlaseA+SmrMSoyS+BaEzjdHm59Y=";
+    tag = "v${version}";
+    hash = "sha256-/dhlAcrqQP/YeKGhnBAVMEy80X3yShn65ywoZMRU/ZM=";
  };

  build-system = [
@ -63,15 +69,16 @@ buildPythonPackage rec {

  nativeCheckInputs = [ pytestCheckHook ];

-  # https://github.com/gdsfactory/kfactory/issues/511
  disabledTestPaths = [
+    # https://github.com/gdsfactory/kfactory/issues/511
    "tests/test_pdk.py"
  ];

-  meta = with lib; {
+  meta = {
    description = "KLayout API implementation of gdsfactory";
    homepage = "https://github.com/gdsfactory/kfactory";
-    license = licenses.mit;
-    maintainers = with maintainers; [ fbeffa ];
+    changelog = "https://github.com/gdsfactory/kfactory/blob/v${version}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fbeffa ];
  };
 }
--- a/pkgs/development/python-modules/lacuscore/default.nix
+++ b/pkgs/development/python-modules/lacuscore/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "lacuscore";
-  version = "1.13.9";
+  version = "1.14.0";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "ail-project";
    repo = "LacusCore";
    tag = "v${version}";
-    hash = "sha256-knAM4cdevww4/dheOw7AnGtegXuMiXt9R0Tmw1wNV80=";
+    hash = "sha256-szcvg4jfJ84kHYWjPBwecfvfsc258SS0OIuYle1lC1g=";
  };

  pythonRelaxDeps = [
--- a/pkgs/development/python-modules/lib4package/default.nix
+++ b/pkgs/development/python-modules/lib4package/default.nix
@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "lib4package";
-  version = "0.3.1";
+  version = "0.3.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "anthonyharrison";
    repo = "lib4package";
    tag = "v${version}";
-    hash = "sha256-ZU5Lne2/xBgaFrTumWpZsuL9ckqdACrb0iRraWo+Rk0=";
+    hash = "sha256-AxAnSxm8eEnfi63SedWIdUvad1bD4g0rqBk4W/DQGHY=";
  };

  build-system = [
@ -31,7 +31,7 @@ buildPythonPackage rec {
  ];

  meta = {
-    changelog = "https://github.com/anthonyharrison/lib4package/releases/tag/v${version}";
+    changelog = "https://github.com/anthonyharrison/lib4package/releases/tag/${src.tag}";
    description = "Utility for handling package metadata to include in Software Bill of Materials (SBOMs";
    homepage = "https://github.com/anthonyharrison/lib4package";
    license = lib.licenses.asl20;
--- a/pkgs/development/python-modules/mcpadapt/default.nix
+++ b/pkgs/development/python-modules/mcpadapt/default.nix
@ -16,14 +16,14 @@

 buildPythonPackage rec {
  pname = "mcpadapt";
-  version = "0.1.0";
+  version = "0.1.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "grll";
    repo = "mcpadapt";
    tag = "v${version}";
-    hash = "sha256-hSmE53LfpLAZosVWHqy3795UPqqLdknMVfWrIxAxWBM=";
+    hash = "sha256-9TMVg70kj25bSNvgVxeFNsY6YnBg+9KswOfcv4Y2SqA=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/metaflow/default.nix
+++ b/pkgs/development/python-modules/metaflow/default.nix
@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "metaflow";
-  version = "2.15.7";
+  version = "2.15.9";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Netflix";
    repo = "metaflow";
    tag = version;
-    hash = "sha256-D7BwlDmsj2/RiZ//3cyw6Wti+6P2PwRmn0xsvPkyI54=";
+    hash = "sha256-so9bmMD0IgUP9FJCyVZa6rCp1iHhbHfB92KScW/ltQU=";
  };

  build-system = [
--- a/pkgs/development/python-modules/model-checker/default.nix
+++ b/pkgs/development/python-modules/model-checker/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "model-checker";
-  version = "0.9.17";
+  version = "0.9.18";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -19,7 +19,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "model_checker";
    inherit version;
-    hash = "sha256-MD0w45a8c1sXUVfM5/pAZZ/WbM1bFGwBVQ37bch+Fcw=";
+    hash = "sha256-soOwym5oZZMLOOWTF14ZLcFX0RQcGnvC1Eg+k8qUMbo=";
  };

  # z3 does not provide a dist-info, so python-runtime-deps-check will fail
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@ -138,8 +138,8 @@ rec {
      "sha256-4eY2gziQLvX2t39e201UitkV/Cs0E2RSP4yAG6/OdbI=";

  mypy-boto3-arc-zonal-shift =
-    buildMypyBoto3Package "arc-zonal-shift" "1.37.21"
-      "sha256-m88NXN/OxX65E92CnQoIZ9+Uq/D1idXzq3NvYQqEilM=";
+    buildMypyBoto3Package "arc-zonal-shift" "1.37.38"
+      "sha256-tCBeOSdgTbAYXxRfA9mH7ON5aAeXxbz3jNuRRoNxj5Q=";

  mypy-boto3-athena =
    buildMypyBoto3Package "athena" "1.37.0"
@ -178,8 +178,8 @@ rec {
      "sha256-qGK4daMp3zODuppGz335Or5hpggK6uTkbQqfXOKq6eM=";

  mypy-boto3-budgets =
-    buildMypyBoto3Package "budgets" "1.37.0"
-      "sha256-M1WWs/HMcN0L9qK2eu4x+JmZsvbEbmxZzQBkjU5gfh4=";
+    buildMypyBoto3Package "budgets" "1.37.38"
+      "sha256-WdJfpMdYkmqNyh+YDnMJZ+q0gUC83e/L9lEnHsCQfrk=";

  mypy-boto3-ce =
    buildMypyBoto3Package "ce" "1.37.30"
@ -534,8 +534,8 @@ rec {
      "sha256-MNUVaGlc2+UUEePFnslKpti//rJddHW4NZ8yZdOuQBU=";

  mypy-boto3-firehose =
-    buildMypyBoto3Package "firehose" "1.37.0"
-      "sha256-+OaeV4txp25XN9UB9GSLc9me9Isha918q2Hn3gyAPHM=";
+    buildMypyBoto3Package "firehose" "1.37.38"
+      "sha256-yJ0qwf+3vVS7l4tXqCPC44vvCTXJrDDQ5q5cArRSjqM=";

  mypy-boto3-fis =
    buildMypyBoto3Package "fis" "1.37.0"
@ -890,8 +890,8 @@ rec {
      "sha256-g/KoroOmWZgWPfC0HMgLGQrGpr9QWEirTL3S9t7iMjs=";

  mypy-boto3-mediatailor =
-    buildMypyBoto3Package "mediatailor" "1.37.21"
-      "sha256-SssQmTozr5f/uwsbwmMZpkXKG4SWG43IkEmehVG53Lw=";
+    buildMypyBoto3Package "mediatailor" "1.37.38"
+      "sha256-TobCXyGJhfpcRO8s6n6tl/gXxEHo4m8DXR5k1IkzWdw=";

  mypy-boto3-medical-imaging =
    buildMypyBoto3Package "medical-imaging" "1.37.0"
--- a/pkgs/development/python-modules/notus-scanner/default.nix
+++ b/pkgs/development/python-modules/notus-scanner/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "notus-scanner";
-  version = "22.6.5";
+  version = "22.7.1";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "greenbone";
    repo = "notus-scanner";
    tag = "v${version}";
-    hash = "sha256-PPwQjZIKSQ1OmyYJ8ErkqdbHZfH4iHPMiDdKZ3imBwo=";
+    hash = "sha256-iTcGo33GRf+CihSRuK1GFXOpYL6TT8e3CRyK2/AA38U=";
  };

  pythonRelaxDeps = [
@ -48,7 +48,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Helper to create results from local security checks";
    homepage = "https://github.com/greenbone/notus-scanner";
-    changelog = "https://github.com/greenbone/notus-scanner/releases/tag/v${version}";
+    changelog = "https://github.com/greenbone/notus-scanner/releases/tag/${src.tag}";
    license = with licenses; [ agpl3Plus ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/okta/default.nix
+++ b/pkgs/development/python-modules/okta/default.nix
@ -25,14 +25,14 @@

 buildPythonPackage rec {
  pname = "okta";
-  version = "2.9.11";
+  version = "2.9.12";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-Ca+xjr1aqCX7MmEb7MXD63Dhib/8hggnudj32pjiTyw=";
+    hash = "sha256-pu5UEVgys6glBnWCIozj2dubQvnF75KCA6fxeujx/pA=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/oracledb/default.nix
+++ b/pkgs/development/python-modules/oracledb/default.nix
@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "oracledb";
-  version = "3.0.0";
+  version = "3.1.0";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-ZNyG7lwDL+vFVnmLBuewAO9oKLsCUghPat2srTNj24U=";
+    hash = "sha256-94z3RSEo+lZKmBnSE1c6fJPjsFOysu9QXxg85+R7Hns=";
  };

  build-system = [
--- a/pkgs/development/python-modules/playwrightcapture/default.nix
+++ b/pkgs/development/python-modules/playwrightcapture/default.nix
@ -5,6 +5,7 @@
  beautifulsoup4,
  buildPythonPackage,
  dateparser,
+  dnspython,
  fetchFromGitHub,
  playwright-stealth,
  playwright,
@ -22,7 +23,7 @@

 buildPythonPackage rec {
  pname = "playwrightcapture";
-  version = "1.28.6";
+  version = "1.29.0";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -31,7 +32,7 @@ buildPythonPackage rec {
    owner = "Lookyloo";
    repo = "PlaywrightCapture";
    tag = "v${version}";
-    hash = "sha256-f1XCNDc2oNJ/EM8S12nCSYtQh7nUi4UROEzTuOH41Ds=";
+    hash = "sha256-p2EprahxHqq4jL7bdnq1+BK3IPea5tZLu/X4N+kZLSY=";
  };

  pythonRelaxDeps = [
@ -50,6 +51,7 @@ buildPythonPackage rec {
    aiohttp-socks
    beautifulsoup4
    dateparser
+    dnspython
    playwright
    playwright-stealth
    puremagic
--- a/pkgs/development/python-modules/posthog/default.nix
+++ b/pkgs/development/python-modules/posthog/default.nix
@ -19,14 +19,14 @@

 buildPythonPackage rec {
  pname = "posthog";
-  version = "3.23.0";
+  version = "3.25.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "PostHog";
    repo = "posthog-python";
    tag = "v${version}";
-    hash = "sha256-+nmCmO1vPnNgZJdZSWwapeFfckNXEcdc/129yaLygf8=";
+    hash = "sha256-DETcD6VJseQelGhSYKqXpIxsQxB3/5RY2wWB9pxhI68=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/pydantic-compat/default.nix
+++ b/pkgs/development/python-modules/pydantic-compat/default.nix
@ -2,13 +2,12 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
-  git,
  hatch-vcs,
  hatchling,
+  gitMinimal,
  importlib-metadata,
  pydantic,
  pytestCheckHook,
-  pythonOlder,
 }:

 buildPythonPackage rec {
@ -16,36 +15,45 @@ buildPythonPackage rec {
  version = "0.1.2";
  pyproject = true;

-  disabled = pythonOlder "3.7";
-
  src = fetchFromGitHub {
    owner = "pyapp-kit";
    repo = "pydantic-compat";
    tag = "v${version}";
-    hash = "sha256-YJUfWu+nyGlwpJpxYghCKzj3CasdAaqYoNVCcfo/7YE=";
    leaveDotGit = true;
+    hash = "sha256-YJUfWu+nyGlwpJpxYghCKzj3CasdAaqYoNVCcfo/7YE=";
  };

-  nativeBuildInputs = [
-    git
+  build-system = [
    hatch-vcs
    hatchling
  ];

-  propagatedBuildInputs = [
+  nativeBuildInputs = [
+    gitMinimal
+  ];
+
+  dependencies = [
    importlib-metadata
    pydantic
  ];

-  nativeCheckInputs = [ pytestCheckHook ];
-
  pythonImportsCheck = [ "pydantic_compat" ];

-  meta = with lib; {
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pytestFlagsArray = [
+    "-W"
+    # pydantic.warnings.PydanticDeprecatedSince211: Accessing this attribute on the instance is
+    # deprecated, and will be removed in Pydantic V3. Instead, you should access this attribute from
+    # the model class. Deprecated in Pydantic V2.11 to be removed in V3.0.
+    "ignore::pydantic.warnings.PydanticDeprecatedSince211"
+  ];
+
+  meta = {
    description = "Compatibility layer for pydantic v1/v2";
    homepage = "https://github.com/pyapp-kit/pydantic-compat";
    changelog = "https://github.com/pyapp-kit/pydantic-compat/releases/tag/v${version}";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ fab ];
  };
 }
--- a/pkgs/development/python-modules/pyexploitdb/default.nix
+++ b/pkgs/development/python-modules/pyexploitdb/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "pyexploitdb";
-  version = "0.2.76";
+  version = "0.2.77";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "pyExploitDb";
    inherit version;
-    hash = "sha256-HcedkHQVatxyoVHRxivTd5vPxs4zMkLC2X27cmmAcMo=";
+    hash = "sha256-x6RY+9jmZ/+7Q18FRmfoVgSqhCN8h7Kp0kMayY3xec8=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/pylutron/default.nix
+++ b/pkgs/development/python-modules/pylutron/default.nix
@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "pylutron";
-  version = "0.2.16";
+  version = "0.2.18";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-SuG5x8GWTsCOve3jj1hrtsm37yNRHVFuFjapQafHTbA=";
+    hash = "sha256-7ZnNfa4POUTMi9sDGMyR6gu9Xpg+j/JmyWVnBBSnRSE=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/pyschlage/default.nix
+++ b/pkgs/development/python-modules/pyschlage/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "pyschlage";
-  version = "2024.11.0";
+  version = "2025.4.0";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "dknowles2";
    repo = "pyschlage";
    tag = version;
-    hash = "sha256-ftoBchKK3I0kzw70MPaAlo/M2YLUx8OFwMNkJQ3itbo=";
+    hash = "sha256-RgPobb9RhM+eFX3Y+wSKlDQ6SddnGKlNTG1nIeEVDFs=";
  };

  build-system = [
--- a/pkgs/development/python-modules/reflex/default.nix
+++ b/pkgs/development/python-modules/reflex/default.nix
@ -51,14 +51,14 @@

 buildPythonPackage rec {
  pname = "reflex";
-  version = "0.7.7";
+  version = "0.7.8";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "reflex-dev";
    repo = "reflex";
    tag = "v${version}";
-    hash = "sha256-27sgU9ugSkStDOg64W1RgiqmlbOzrdxg7kz2AztfERA=";
+    hash = "sha256-/Kf1V1goGaoYarhJ9wlZ2lf6e3BUH/F7UJqoPEnMnk0=";
  };

  # 'rich' is also somehow checked when building the wheel,
--- a/pkgs/development/python-modules/rioxarray/default.nix
+++ b/pkgs/development/python-modules/rioxarray/default.nix
@ -1,17 +1,18 @@
 {
  lib,
  buildPythonPackage,
-  pythonOlder,
  fetchFromGitHub,

  # build-system
  setuptools,
+
  # dependencies
  numpy,
  packaging,
  pyproj,
  rasterio,
  xarray,
+
  # tests
  dask,
  netcdf4,
@ -21,15 +22,14 @@

 buildPythonPackage rec {
  pname = "rioxarray";
-  version = "0.18.2";
+  version = "0.19.0";
  pyproject = true;
-  disabled = pythonOlder "3.10";

  src = fetchFromGitHub {
    owner = "corteva";
    repo = "rioxarray";
    tag = version;
-    hash = "sha256-HNtMLY83e6MQakIlmsJohmhjDWiM5/hqq25qSY1dPBw=";
+    hash = "sha256-tNcBuMyBVDVPbmujfn4WauquutOEn727lxcR19hfyuE=";
  };

  build-system = [ setuptools ];
@ -49,10 +49,11 @@ buildPythonPackage rec {
  ];

  disabledTests =
-    [ "test_clip_geojson__no_drop" ]
-    ++ lib.optionals
-      (stdenv.hostPlatform.system == "aarch64-linux" || stdenv.hostPlatform.system == "aarch64-darwin")
    [
+      # AssertionError: assert 535727386 == 535691205
+      "test_clip_geojson__no_drop"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isAarch64 [
      # numerical errors
      "test_clip_geojson"
      "test_open_rasterio_mask_chunk_clip"
@ -61,9 +62,9 @@ buildPythonPackage rec {
  pythonImportsCheck = [ "rioxarray" ];

  meta = {
-    description = "geospatial xarray extension powered by rasterio";
+    description = "Geospatial xarray extension powered by rasterio";
    homepage = "https://corteva.github.io/rioxarray/";
-    changelog = "https://github.com/corteva/rioxarray/releases/tag/${src.tag}";
+    changelog = "https://github.com/corteva/rioxarray/releases/tag/${version}";
    license = lib.licenses.asl20;
    maintainers = lib.teams.geospatial.members;
  };
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "tencentcloud-sdk-python";
-  version = "3.0.1362";
+  version = "3.0.1363";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "TencentCloud";
    repo = "tencentcloud-sdk-python";
    tag = version;
-    hash = "sha256-twAjyHTHEy1FNH0yBRrvb8va2pau4HpeunN1oGiTNzY=";
+    hash = "sha256-VcPedb0qTAzZQpHBAcJtZZhBcGasMcBxH9MQ5tnHcks=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/venstarcolortouch/default.nix
+++ b/pkgs/development/python-modules/venstarcolortouch/default.nix
@ -7,12 +7,12 @@

 buildPythonPackage rec {
  pname = "venstarcolortouch";
-  version = "0.19";
+  version = "0.20";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-QjcoF46GrBH7ExGQno8xDgtOSGNxhAP+NycJb22hL+E=";
+    hash = "sha256-HX1GPhLksD7T0jbnGxk85CgF8bnPXWrUnbOgCKsmeT0=";
  };

  propagatedBuildInputs = [ requests ];
--- a/pkgs/games/armagetronad/default.nix
+++ b/pkgs/games/armagetronad/default.nix
@ -70,8 +70,8 @@ let
      # https://gitlab.com/armagetronad/armagetronad/-/commits/trunk/?ref_type=heads
      ${unstableVersionMajor} =
        let
-          rev = "391a74625c1222dd180f069f1b61c3e069a3ba8c";
-          hash = "sha256-fUY0dBj85k0QhnAoDzyBmmKmRh9oCYC6r6X4ukt7/L0=";
+          rev = "1830e09888597b372fad192b0d246aefe555540c";
+          hash = "sha256-svVcg2AMk2GHmg1Szny10KCLZQ6Cly1RrSVNGmf7Fdg=";
        in
        dedicatedServer: {
          version = "${unstableVersionMajor}-${builtins.substring 0 8 rev}";
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@ -44,7 +44,7 @@ let
 in
 buildGoModule rec {
  pname = "grafana";
-  version = "11.6.0";
+  version = "11.6.0+security-01";

  subPackages = [
    "pkg/cmd/grafana"
@ -56,7 +56,7 @@ buildGoModule rec {
    owner = "grafana";
    repo = "grafana";
    rev = "v${version}";
-    hash = "sha256-oXotHi79XBhxD/qYC7QDQwn7jiX0wKWe/RXZS5DwN9o=";
+    hash = "sha256-JG4Dr0CGDYHH6hBAAtdHPO8Vy9U/bg4GPzX6biZk028=";
  };

  # borrowed from: https://github.com/NixOS/nixpkgs/blob/d70d9425f49f9aba3c49e2c389fe6d42bac8c5b0/pkgs/development/tools/analysis/snyk/default.nix#L20-L22
@ -106,7 +106,7 @@ buildGoModule rec {

  postPatch = patchGoVersion;

-  vendorHash = "sha256-cYE43OAagPHFhWsUJLMcJVfsJj6d0vUqzjbAviYSuSc=";
+  vendorHash = "sha256-Ziohfy9fMVmYnk9c0iRNi4wJZd2E8vCP+ozsTM0eLTA=";

  proxyVendor = true;

--- a/pkgs/servers/osrm-backend/boost187-compat.patch
+++ b/pkgs/servers/osrm-backend/boost187-compat.patch
@ -1,14 +0,0 @@
-diff --git a/include/server/server.hpp b/include/server/server.hpp
-index 34b8982e67a..02b0dda050d 100644
--- a/include/server/server.hpp
-+++ b/include/server/server.hpp
-@@ -53,8 +53,7 @@ class Server
-         const auto port_string = std::to_string(port);
- 
-         boost::asio::ip::tcp::resolver resolver(io_context);
-        boost::asio::ip::tcp::resolver::query query(address, port_string);
-        boost::asio::ip::tcp::endpoint endpoint = *resolver.resolve(query);
-+        boost::asio::ip::tcp::endpoint endpoint = *resolver.resolve(address, port_string).begin();
- 
-         acceptor.open(endpoint.protocol());
- #ifdef SO_REUSEPORT
--- a/pkgs/servers/web-apps/wordpress/packages/default.nix
+++ b/pkgs/servers/web-apps/wordpress/packages/default.nix
@ -184,6 +184,7 @@ let
    }
    // lib.mapAttrs (
      type: pkgs:
+      lib.recurseIntoAttrs (
        lib.makeExtensible (
          _:
          lib.mapAttrs (
@ -195,6 +196,7 @@ let
            }
          ) pkgs
        )
+      )
    ) generatedJson;

 in
--- a/pkgs/tools/package-management/lix/common-nix-eval-jobs.nix
+++ b/pkgs/tools/package-management/lix/common-nix-eval-jobs.nix
@ -40,6 +40,14 @@ stdenv.mkDerivation {
  # point 'nix edit' and ofborg at the file that defines the attribute,
  # not this common file.
  pos = builtins.unsafeGetAttrPos "version" args;
+
+  # Since this package is intimately tied to a specific Nix release, we
+  # propagate the Nix used for building it to make it easier for users
+  # downstream to reference it.
+  passthru = {
+    nix = lix;
+  };
+
  meta = {
    description = "Hydra's builtin `hydra-eval-jobs` as a standalone tool";
    mainProgram = "nix-eval-jobs";
--- a/pkgs/tools/package-management/lix/default.nix
+++ b/pkgs/tools/package-management/lix/default.nix
@ -11,6 +11,7 @@
  editline,
  ncurses,
  clangStdenv,
+  nix-fast-build,

  storeDir ? "/nix/store",
  stateDir ? "/nix/var",
@ -83,6 +84,10 @@ let
        nix-eval-jobs = self.callPackage (callPackage ./common-nix-eval-jobs.nix nix-eval-jobs-args) {
          stdenv = lixStdenv;
        };
+
+        nix-fast-build = nix-fast-build.override {
+          inherit (self) nix-eval-jobs;
+        };
      }
    );
 in
--- a/pkgs/tools/security/cnspec/default.nix
+++ b/pkgs/tools/security/cnspec/default.nix
@ -6,18 +6,18 @@

 buildGoModule rec {
  pname = "cnspec";
-  version = "11.50.0";
+  version = "11.51.1";

  src = fetchFromGitHub {
    owner = "mondoohq";
    repo = "cnspec";
    tag = "v${version}";
-    hash = "sha256-Ope7bPXTNMWuRlGWBuqjp31xCH6bjbgu6Hjf9sSQB+0=";
+    hash = "sha256-iTS8+ZmJWHRA6VSwei9mIWPqZHshb8JniXSXl+hGyPg=";
  };

  proxyVendor = true;

-  vendorHash = "sha256-EChYXDMsk40NyOHTZNMEbfcTu3vqoFgR4n8PXTlerV0=";
+  vendorHash = "sha256-TbIXNPMygNXqX2TCbkZOhXpdoz/cjZD5uoItgmYf7wk=";

  subPackages = [ "apps/cnspec" ];

--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "trufflehog";
-  version = "3.88.24";
+  version = "3.88.25";

  src = fetchFromGitHub {
    owner = "trufflesecurity";
    repo = "trufflehog";
    tag = "v${version}";
-    hash = "sha256-50IKxJAuR8IMcKArnIE8BHlssKSGthfFVc+h+M/+204=";
+    hash = "sha256-yAGeB2+FGtdL5zbJkYL96RPf+jBoCSPz1OpFV9tsGdk=";
  };

-  vendorHash = "sha256-eyAHR9tx9Fvih/KZZX8FtcDZyMn93X6b08iADEyIiZw=";
+  vendorHash = "sha256-uNJmM1xVaSaAGolb1ArRkr3iQ8Yar2MEY8/G0AhGAuU=";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -8475,10 +8475,6 @@ with pkgs;
    stdenv = if stdenv.hostPlatform.isDarwin then gccStdenv else stdenv;
  };

-  eigen = callPackage ../development/libraries/eigen { };
-
-  eigen2 = callPackage ../development/libraries/eigen/2.0.nix { };
-
  vapoursynth-editor = libsForQt5.callPackage ../by-name/va/vapoursynth/editor.nix { };

  vmmlib = callPackage ../development/libraries/vmmlib { };
@ -11227,9 +11223,6 @@ with pkgs;
  opensmtpd = callPackage ../servers/mail/opensmtpd { };
  opensmtpd-extras = callPackage ../servers/mail/opensmtpd/extras.nix { };
  opensmtpd-filter-rspamd = callPackage ../servers/mail/opensmtpd/filter-rspamd.nix { };
-  osrm-backend = callPackage ../servers/osrm-backend {
-    tbb = tbb_2021_11;
-  };

  system-sendmail = lowPrio (callPackage ../servers/mail/system-sendmail { });

@ -16843,17 +16836,6 @@ with pkgs;
    gmp-static = gmp.override { withStatic = true; };
  };

-  inherit (callPackages ../applications/science/logic/z3 { python = python3; })
-    z3_4_14
-    z3_4_13
-    z3_4_12
-    z3_4_11
-    z3_4_8
-    z3_4_8_5
-    ;
-  z3 = z3_4_13;
-  z3-tptp = callPackage ../applications/science/logic/z3/tptp.nix { };
-
  tlaplus = callPackage ../applications/science/logic/tlaplus {
    jre = jre8; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731
  };
@ -17687,7 +17669,7 @@ with pkgs;
    wordpress_6_7
    ;

-  wordpressPackages = (
+  wordpressPackages = recurseIntoAttrs (
    callPackage ../servers/web-apps/wordpress/packages {
      plugins = lib.importJSON ../servers/web-apps/wordpress/packages/plugins.json;
      themes = lib.importJSON ../servers/web-apps/wordpress/packages/themes.json;
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -19168,12 +19168,7 @@ self: super: with self; {

  yubico-client = callPackage ../development/python-modules/yubico-client { };

-  z3-solver =
-    (toPythonModule (
-      (pkgs.z3.override { inherit python; }).overrideAttrs (_: {
-        pname = "z3-solver";
-      })
-    )).python;
+  z3-solver = (toPythonModule (pkgs.z3.override { python3 = python; })).python;

  z3c-checkversions = callPackage ../development/python-modules/z3c-checkversions { };