Merge 7c3df50c30 into haskell-updates

2025-06-12 20:55:31 +03:00 · 2025-04-24 00:19:47 +00:00 · 2025-04-24 00:19:47 +00:00 · d5802b9fdb
commit d5802b9fdb
parent d20c75ee68 7c3df50c30
495 changed files with 6556 additions and 4505 deletions
--- a/doc/languages-frameworks/gnome.section.md
+++ b/doc/languages-frameworks/gnome.section.md
@ -214,7 +214,7 @@ stdenv.mkDerivation {

 You can rely on applications depending on the library setting the necessary environment variables but that is often easy to miss. Instead we recommend to patch the paths in the source code whenever possible. Here are some examples:

- []{#ssec-gnome-common-issues-unwrappable-package-gnome-shell-ext} [Replacing a `GI_TYPELIB_PATH` in GNOME Shell extension](https://github.com/NixOS/nixpkgs/blob/7bb8f05f12ca3cff9da72b56caa2f7472d5732bc/pkgs/desktops/gnome-3/core/gnome-shell-extensions/default.nix#L21-L24) – we are using `substituteAll` to include the path to a typelib into a patch.
+- []{#ssec-gnome-common-issues-unwrappable-package-gnome-shell-ext} [Replacing a `GI_TYPELIB_PATH` in GNOME Shell extension](https://github.com/NixOS/nixpkgs/blob/e981466fbb08e6231a1377539ff17fbba3270fda/pkgs/by-name/gn/gnome-shell-extensions/package.nix#L25-L32) – we are using `replaceVars` to include the path to a typelib into a patch.

 - []{#ssec-gnome-common-issues-unwrappable-package-gsettings} The following examples are hardcoding GSettings schema paths. To get the schema paths we use the functions

@ -222,7 +222,7 @@ You can rely on applications depending on the library setting the necessary envi

  * `glib.makeSchemaPath` Takes a package output like `$out` and a derivation name. You should use this if the schemas you need to hardcode are in the same derivation.

-  []{#ssec-gnome-common-issues-unwrappable-package-gsettings-vala} [Hard-coding GSettings schema path in Vala plug-in (dynamically loaded library)](https://github.com/NixOS/nixpkgs/blob/7bb8f05f12ca3cff9da72b56caa2f7472d5732bc/pkgs/desktops/pantheon/apps/elementary-files/default.nix#L78-L86) – here, `substituteAll` cannot be used since the schema comes from the same package preventing us from pass its path to the function, probably due to a [Nix bug](https://github.com/NixOS/nix/issues/1846).
+  []{#ssec-gnome-common-issues-unwrappable-package-gsettings-vala} [Hard-coding GSettings schema path in Vala plug-in (dynamically loaded library)](https://github.com/NixOS/nixpkgs/blob/7bb8f05f12ca3cff9da72b56caa2f7472d5732bc/pkgs/desktops/pantheon/apps/elementary-files/default.nix#L78-L86) – here, `replaceVars` cannot be used since the schema comes from the same package preventing us from pass its path to the function, probably due to a [Nix bug](https://github.com/NixOS/nix/issues/1846).

  []{#ssec-gnome-common-issues-unwrappable-package-gsettings-c} [Hard-coding GSettings schema path in C library](https://github.com/NixOS/nixpkgs/blob/29c120c065d03b000224872251bed93932d42412/pkgs/development/libraries/glib-networking/default.nix#L31-L34) – nothing special other than using [Coccinelle patch](https://github.com/NixOS/nixpkgs/pull/67957#issuecomment-527717467) to generate the patch itself.

--- a/doc/languages-frameworks/php.section.md
+++ b/doc/languages-frameworks/php.section.md
@ -214,7 +214,7 @@ code, while others choose not to.

 In Nix, there are multiple approaches to building a Composer-based project.

-One such method is the `php.buildComposerProject` helper function, which serves
+One such method is the `php.buildComposerProject2` helper function, which serves
 as a wrapper around `mkDerivation`.

 Using this function, you can build a PHP project that includes both a
@ -249,19 +249,19 @@ To customize the PHP version, you can specify the `php` attribute. Similarly, if
 you wish to modify the Composer version, use the `composer` attribute. It is
 important to note that both attributes should be of the `derivation` type.

-Here's an example of working code example using `php.buildComposerProject`:
+Here's an example of working code example using `php.buildComposerProject2`:

 ```nix
 { php, fetchFromGitHub }:

-php.buildComposerProject (finalAttrs: {
+php.buildComposerProject2 (finalAttrs: {
  pname = "php-app";
  version = "1.0.0";

  src = fetchFromGitHub {
    owner = "git-owner";
    repo = "git-repo";
-    rev = finalAttrs.version;
+    tag = finalAttrs.version;
    hash = "sha256-VcQRSss2dssfkJ+iUb5qT+FJ10GHiFDzySigcmuVI+8=";
  };

--- a/doc/packages/build-support.md
+++ b/doc/packages/build-support.md
@ -30,13 +30,12 @@ substitute {
 ```
 :::

-## `pkgs.substituteAll` {#pkgs-substituteall}
+## `pkgs.replaceVars` {#pkgs-replacevars}

-`pkgs.substituteAll` substitutes all instances of `@varName@` (`@`s included) in file `src` with the value of the corresponding environment variable.
-As this uses the [`substituteAll`] (#fun-substitute) function, its limitations regarding variable names that will or will not be replaced also apply here.
+`pkgs.replaceVars <src> <replacements>` replaces all instances of `@varName@` (`@`s included) in file `src` with the respective value in the attribute set `replacements`.

-:::{.example #ex-pkgs-substituteAll}
-# Usage of `pkgs.substituteAll`
+:::{.example #ex-pkgs-replace-vars}
+# Usage of `pkgs.replaceVars`

 If `say-goodbye.sh` contains the following:

@ -51,16 +50,14 @@ the following derivation will make substitutions to `@bash@`, `@hello@`, and `@g

 ```nix
 {
-  substituteAll,
+  replaceVars,
  bash,
  hello,
 }:
-substituteAll {
-  src = ./say-goodbye.sh;
-  env = {
+replaceVars ./say-goodbye.sh {
  inherit bash hello;
  greeting = "goodbye";
-  };
+  unchanged = null;
 }
 ```

@ -72,31 +69,37 @@ such that `$out` will result in something like the following:
 echo @unchanged@
 /nix/store/566f5isbvw014h7knmzmxa5l6hshx43k-hello-2.12.1/bin/hello --greeting goodbye
 ```
+
+Note that, in contrast to the old `substituteAll`, `unchanged = null` must explicitly be set.
+Any unreferenced `@...@` pattern in the source file will throw an error.
 :::

-## `pkgs.substituteAllFiles` {#pkgs-substituteallfiles}
+## `pkgs.replaceVarsWith` {#pkgs-replacevarswith}

-`pkgs.substituteAllFiles` replaces `@varName@` with the value of the environment variable `varName`.
-It expects `src` to be a directory and requires a `files` argument that specifies which files will be subject to replacements; only these files will be placed in `$out`.
+`pkgs.replaceVarsWith` works the same way as [pkgs.replaceVars](#pkgs-replacevars), but additionally allows more options.

-As it also uses the `substituteAll` function, it is subject to the same limitations on environment variables as discussed in [pkgs.substituteAll](#pkgs-substituteall).
+:::{.example #ex-pkgs-replace-vars-with}
+# Usage of `pkgs.replaceVarsWith`

-:::{.example #ex-pkgs-substitute-all-files}
-# Usage of `pkgs.substituteAllFiles`
-
-If the current directory contains `{foo,bar,baz}.txt` and the following `default.nix`
+With the example file `say-goodbye.sh`, consider:

 ```nix
-{ substituteAllFiles }:
-substituteAllFiles {
-  src = ./.;
-  files = [
-    "foo.txt"
-    "bar.txt"
-  ];
-  hello = "there";
+{ replaceVarsWith }:
+replaceVarsWith {
+  src = ./say-goodbye.sh;
+
+  replacements = {
+    inherit bash hello;
+    greeting = "goodbye";
+    unchanged = null;
+  };
+
+  name = "say-goodbye";
+  dir = "bin";
+  isExecutable = true;
+  meta.mainProgram = "say-goodbye";
 }
 ```

-in the resulting derivation, every instance of `@hello@` will be replaced with `there` in `$out/foo.txt` and `$out/bar.txt`; `baz.txt` will not be processed nor will it appear in `$out`.
+This will make the resulting file executable, put it in `bin/say-goodbye` and set `meta` attributes respectively.
 :::
--- a/doc/preface.chapter.md
+++ b/doc/preface.chapter.md
@ -42,7 +42,7 @@ shows the status of tests for the `nixpkgs-unstable` channel.

 The tests are conducted by a cluster called [Hydra](https://nixos.org/hydra/),
 which also builds binary packages from the Nix expressions in Nixpkgs for
-`x86_64-linux`, `i686-linux` and `x86_64-darwin`.
+`x86_64-linux`, `aarch64-linux`, `x86_64-darwin` and `aarch64-darwin`.
 The binaries are made available via a [binary cache](https://cache.nixos.org).

 The current Nix expressions of the channels are available in the
--- a/doc/redirects.json
+++ b/doc/redirects.json
@ -8,6 +8,14 @@
  "ex-build-helpers-extendMkDerivation": [
    "index.html#ex-build-helpers-extendMkDerivation"
  ],
+  "ex-pkgs-replace-vars": [
+    "index.html#ex-pkgs-replace-vars",
+    "index.html#ex-pkgs-substituteAll",
+    "index.html#ex-pkgs-substitute-all-files"
+  ],
+  "ex-pkgs-replace-vars-with": [
+    "index.html#ex-pkgs-replace-vars-with"
+  ],
  "ex-shfmt": [
    "index.html#ex-shfmt"
  ],
@ -35,6 +43,14 @@
  "no-broken-symlinks.sh": [
    "index.html#no-broken-symlinks.sh"
  ],
+  "pkgs-replacevars": [
+    "index.html#pkgs-replacevars",
+    "index.html#pkgs-substituteall",
+    "index.html#pkgs-substituteallfiles"
+  ],
+  "pkgs-replacevarswith": [
+    "index.html#pkgs-replacevarswith"
+  ],
  "preface": [
    "index.html#preface"
  ],
@ -4193,18 +4209,6 @@
  "ex-pkgs-substitute": [
    "index.html#ex-pkgs-substitute"
  ],
-  "pkgs-substituteall": [
-    "index.html#pkgs-substituteall"
-  ],
-  "ex-pkgs-substituteAll": [
-    "index.html#ex-pkgs-substituteAll"
-  ],
-  "pkgs-substituteallfiles": [
-    "index.html#pkgs-substituteallfiles"
-  ],
-  "ex-pkgs-substitute-all-files": [
-    "index.html#ex-pkgs-substitute-all-files"
-  ],
  "part-development": [
    "index.html#part-development"
  ],
--- a/doc/release-notes/rl-2505.section.md
+++ b/doc/release-notes/rl-2505.section.md
@ -98,6 +98,8 @@

 - `cassandra_3_0` and `cassandra_3_11` have been removed as they have reached end-of-life. Please update to `cassandra_4`. See the [changelog](https://github.com/apache/cassandra/blob/cassandra-4.0.17/NEWS.txt) for more information about the upgrade process.

+- `mariadb_105` has been removed as it has reached end-of-life in 2025-06. Please update to `mariadb_106`.
+
 - NetBox was updated to `>= 4.2.0`. Have a look at the breaking changes
  of the [4.1 release](https://github.com/netbox-community/netbox/releases/tag/v4.1.0)
  and the [4.2 release](https://github.com/netbox-community/netbox/releases/tag/v4.2.0),
@ -113,6 +115,8 @@

 - All support for 32‐bit Darwin systems has been dropped.

+- `substituteAll` and `substituteAllFiles` have been deprecated in favor of `replaceVars` and will be removed in the next release.
+
 - Default ICU version updated from 74 to 76

 - Apache Kafka was updated to `>= 4.0.0`. Please note that this is the first release which operates
@ -192,6 +196,8 @@

 - `mkBinaryCache` now defaults to using `zstd` compression for the binary caches it creates. The previous `xz` compression method can be used by passing `compression = "xz";`.

+- `nodejs_18` package was removed due to upstream End-of-Life in April 2025.
+
 - `nodePackages."@commitlint/config-conventional"` has been removed, as it is a library, and projects should depend on it instead.

 -  zigbee2mqtt is now available in version 2.x as `zigbee2mqtt_2`. In NixOS 25.11 we'll remove `zigbee2mqtt_1` and default to `zigbee2mqtt_2`. See the [breaking changes](https://github.com/Koenkk/zigbee2mqtt/discussions/24198) announcement for 2.0.0.
@ -252,7 +258,7 @@

 - `nodePackages.meshcommander` has been removed, as the package was deprecated by Intel.

- The default version of `z3` has been updated from 4.8 to 4.13. There are still a few packages that need specific older versions; those will continue to be maintained as long as other packages depend on them but may be removed in the future.
+- The default version of `z3` has been updated from 4.8 to 4.14, and all old versions have been dropped. Note that `fstar` still depends on specific versions, and maintains them as overrides.

 - `prometheus` has been updated from 2.55.0 to 3.1.0.
  Read the [release blog post](https://prometheus.io/blog/2024/11/14/prometheus-3-0/) and
--- a/lib/attrsets.nix
+++ b/lib/attrsets.nix
@ -301,9 +301,9 @@ rec {
    Nix has an [attribute selection operator](https://nixos.org/manual/nix/stable/language/operators#attribute-selection) which is sufficient for such queries, as long as the number of attributes is static. For example:

    ```nix
-    x.a.b == getAttrByPath ["a" "b"] x
+    x.a.b == getAttrFromPath ["a" "b"] x
    # and
-    x.${f p}."example.com" == getAttrByPath [ (f p) "example.com" ] x
+    x.${f p}."example.com" == getAttrFromPath [ (f p) "example.com" ] x
    ```

    # Inputs
--- a/lib/default.nix
+++ b/lib/default.nix
@ -279,6 +279,7 @@ let
        naturalSort
        compareLists
        take
+        takeEnd
        drop
        dropEnd
        sublist
@ -347,6 +348,7 @@ let
        toSentenceCase
        addContextFrom
        splitString
+        splitStringBy
        removePrefix
        removeSuffix
        versionOlder
--- a/lib/lists.nix
+++ b/lib/lists.nix
@ -1462,6 +1462,40 @@ rec {
  */
  take = count: sublist 0 count;

+  /**
+    Return the last (at most) N elements of a list.
+
+    # Inputs
+
+    `count`
+
+    : Maximum number of elements to pick
+
+    `list`
+
+    : Input list
+
+    # Type
+
+    ```
+    takeEnd :: int -> [a] -> [a]
+    ```
+
+    # Examples
+    :::{.example}
+    ## `lib.lists.takeEnd` usage example
+
+    ```nix
+    takeEnd 2 [ "a" "b" "c" "d" ]
+    => [ "c" "d" ]
+    takeEnd 2 [ ]
+    => [ ]
+    ```
+
+    :::
+  */
+  takeEnd = n: xs: drop (max 0 (length xs - n)) xs;
+
  /**
    Remove the first (at most) N elements of a list.

--- a/lib/strings.nix
+++ b/lib/strings.nix
@ -1592,6 +1592,97 @@ rec {
    in
    map (addContextFrom s) splits;

+  /**
+    Splits a string into substrings based on a predicate that examines adjacent characters.
+
+    This function provides a flexible way to split strings by checking pairs of characters
+    against a custom predicate function. Unlike simpler splitting functions, this allows
+    for context-aware splitting based on character transitions and patterns.
+
+    # Inputs
+
+    `predicate`
+    : Function that takes two arguments (previous character and current character)
+      and returns true when the string should be split at the current position.
+      For the first character, previous will be "" (empty string).
+
+    `keepSplit`
+    : Boolean that determines whether the splitting character should be kept as
+      part of the result. If true, the character will be included at the beginning
+      of the next substring; if false, it will be discarded.
+
+    `str`
+    : The input string to split.
+
+    # Return
+
+    A list of substrings from the original string, split according to the predicate.
+
+    # Type
+
+    ```
+    splitStringBy :: (string -> string -> bool) -> bool -> string -> [string]
+    ```
+
+    # Examples
+    :::{.example}
+    ## `lib.strings.splitStringBy` usage example
+
+    Split on periods and hyphens, discarding the separators:
+    ```nix
+    splitStringBy (prev: curr: builtins.elem curr [ "." "-" ]) false "foo.bar-baz"
+    => [ "foo" "bar" "baz" ]
+    ```
+
+    Split on transitions from lowercase to uppercase, keeping the uppercase characters:
+    ```nix
+    splitStringBy (prev: curr: builtins.match "[a-z]" prev != null && builtins.match "[A-Z]" curr != null) true "fooBarBaz"
+    => [ "foo" "Bar" "Baz" ]
+    ```
+
+    Handle leading separators correctly:
+    ```nix
+    splitStringBy (prev: curr: builtins.elem curr [ "." ]) false ".foo.bar.baz"
+    => [ "" "foo" "bar" "baz" ]
+    ```
+
+    Handle trailing separators correctly:
+    ```nix
+    splitStringBy (prev: curr: builtins.elem curr [ "." ]) false "foo.bar.baz."
+    => [ "foo" "bar" "baz" "" ]
+    ```
+    :::
+  */
+  splitStringBy =
+    predicate: keepSplit: str:
+    let
+      len = stringLength str;
+
+      # Helper function that processes the string character by character
+      go =
+        pos: currentPart: result:
+        # Base case: reached end of string
+        if pos == len then
+          result ++ [ currentPart ]
+        else
+          let
+            currChar = substring pos 1 str;
+            prevChar = if pos > 0 then substring (pos - 1) 1 str else "";
+            isSplit = predicate prevChar currChar;
+          in
+          if isSplit then
+            # Split here - add current part to results and start a new one
+            let
+              newResult = result ++ [ currentPart ];
+              newCurrentPart = if keepSplit then currChar else "";
+            in
+            go (pos + 1) newCurrentPart newResult
+          else
+            # Keep building current part
+            go (pos + 1) (currentPart + currChar) result;
+    in
+    if len == 0 then [ (addContextFrom str "") ] else map (addContextFrom str) (go 0 "" [ ]);
+
  /**
    Return a string without the specified prefix, if the prefix matches.

--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@ -631,6 +631,101 @@ runTests {
    ];
  };

+  testSplitStringBySimpleDelimiter = {
+    expr = strings.splitStringBy (
+      prev: curr:
+      builtins.elem curr [
+        "."
+        "-"
+      ]
+    ) false "foo.bar-baz";
+    expected = [
+      "foo"
+      "bar"
+      "baz"
+    ];
+  };
+
+  testSplitStringByLeadingDelimiter = {
+    expr = strings.splitStringBy (prev: curr: builtins.elem curr [ "." ]) false ".foo.bar.baz";
+    expected = [
+      ""
+      "foo"
+      "bar"
+      "baz"
+    ];
+  };
+
+  testSplitStringByTrailingDelimiter = {
+    expr = strings.splitStringBy (prev: curr: builtins.elem curr [ "." ]) false "foo.bar.baz.";
+    expected = [
+      "foo"
+      "bar"
+      "baz"
+      ""
+    ];
+  };
+
+  testSplitStringByMultipleConsecutiveDelimiters = {
+    expr = strings.splitStringBy (prev: curr: builtins.elem curr [ "." ]) false "foo...bar";
+    expected = [
+      "foo"
+      ""
+      ""
+      "bar"
+    ];
+  };
+
+  testSplitStringByKeepingSplitChar = {
+    expr = strings.splitStringBy (prev: curr: builtins.elem curr [ "." ]) true "foo.bar.baz";
+    expected = [
+      "foo"
+      ".bar"
+      ".baz"
+    ];
+  };
+
+  testSplitStringByCaseTransition = {
+    expr = strings.splitStringBy (
+      prev: curr: builtins.match "[a-z]" prev != null && builtins.match "[A-Z]" curr != null
+    ) true "fooBarBaz";
+    expected = [
+      "foo"
+      "Bar"
+      "Baz"
+    ];
+  };
+
+  testSplitStringByEmptyString = {
+    expr = strings.splitStringBy (prev: curr: builtins.elem curr [ "." ]) false "";
+    expected = [ "" ];
+  };
+
+  testSplitStringByComplexPredicate = {
+    expr = strings.splitStringBy (
+      prev: curr:
+      prev != ""
+      && curr != ""
+      && builtins.match "[0-9]" prev != null
+      && builtins.match "[a-z]" curr != null
+    ) true "123abc456def";
+    expected = [
+      "123"
+      "abc456"
+      "def"
+    ];
+  };
+
+  testSplitStringByUpperCaseStart = {
+    expr = strings.splitStringBy (prev: curr: builtins.match "[A-Z]" curr != null) true "FooBarBaz";
+    expected = [
+      ""
+      "Foo"
+      "Bar"
+      "Baz"
+    ];
+  };
+
  testEscapeShellArg = {
    expr = strings.escapeShellArg "esc'ape\nme";
    expected = "'esc'\\''ape\nme'";
@ -1262,6 +1357,69 @@ runTests {
    )
  ];

+  testTakeEnd =
+    let
+      inherit (lib) takeEnd;
+    in
+    testAllTrue [
+      (
+        takeEnd 0 [
+          1
+          2
+          3
+        ] == [ ]
+      )
+      (
+        takeEnd 1 [
+          1
+          2
+          3
+        ] == [ 3 ]
+      )
+      (
+        takeEnd 2 [
+          1
+          2
+          3
+        ] == [
+          2
+          3
+        ]
+      )
+      (
+        takeEnd 3 [
+          1
+          2
+          3
+        ] == [
+          1
+          2
+          3
+        ]
+      )
+      (
+        takeEnd 4 [
+          1
+          2
+          3
+        ] == [
+          1
+          2
+          3
+        ]
+      )
+      (takeEnd 0 [ ] == [ ])
+      (takeEnd 1 [ ] == [ ])
+      (
+        takeEnd (-1) [
+          1
+          2
+          3
+        ] == [ ]
+      )
+      (takeEnd (-1) [ ] == [ ])
+    ];
+
  testDrop =
    let
      inherit (lib) drop;
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -2129,6 +2129,11 @@
    githubId = 11493130;
    name = "Asbjørn Olling";
  };
+  aschleck = {
+    name = "April Schleck";
+    github = "aschleck";
+    githubId = 115766;
+  };
  ascii17 = {
    name = "Allen Conlon";
    email = "software@conlon.dev";
@ -2513,6 +2518,7 @@
  };
  awwpotato = {
    email = "awwpotato@voidq.com";
+    matrix = "@awwpotato:envs.net";
    github = "awwpotato";
    githubId = 153149335;
    name = "awwpotato";
@ -8483,6 +8489,12 @@
    githubId = 12715461;
    name = "Anders Bo Rasmussen";
  };
+  fvckgrimm = {
+    email = "nixpkgs@grimm.wtf";
+    github = "fvckgrimm";
+    githubId = 55907409;
+    name = "Grimm";
+  };
  fwc = {
    github = "fwc";
    githubId = 29337229;
@ -12835,6 +12847,12 @@
    githubId = 1915;
    name = "Asherah Connor";
  };
+  kiyotoko = {
+    email = "karl.zschiebsch@gmail.com";
+    github = "Kiyotoko";
+    githubId = 49951907;
+    name = "Karl Zschiebsch";
+  };
  kjeremy = {
    email = "kjeremy@gmail.com";
    name = "Jeremy Kolb";
@ -13883,12 +13901,6 @@
    githubId = 74221543;
    name = "Moritz Goltdammer";
  };
-  linuxmobile = {
-    email = "bdiez19@gmail.com";
-    github = "linuxmobile";
-    githubId = 10554636;
-    name = "Braian A. Diez";
-  };
  linuxwhata = {
    email = "linuxwhata@qq.com";
    matrix = "@lwa:envs.net";
@ -18061,6 +18073,12 @@
    githubId = 817073;
    name = "Yc. Shen";
  };
+  onnimonni = {
+    email = "onni@flaky.build";
+    github = "onnimonni";
+    githubId = 5691777;
+    name = "Onni Hakala";
+  };
  onny = {
    email = "onny@project-insanity.org";
    github = "onny";
@ -20392,6 +20410,11 @@
    githubId = 4196789;
    name = "Nathan Ringo";
  };
+  remko = {
+    github = "remko";
+    githubId = 12300;
+    name = "Remko Tronçon";
+  };
  remyvv = {
    name = "Remy van Velthuijsen";
    email = "remy@remysplace.de";
@ -26312,6 +26335,13 @@
    github = "x3rAx";
    githubId = 2268851;
  };
+  x807x = {
+    name = "x807x";
+    email = "s10855168@gmail.com";
+    matrix = "@x807x:matrix.org";
+    github = "x807x";
+    githubId = 86676478;
+  };
  xanderio = {
    name = "Alexander Sieg";
    email = "alex@xanderio.de";
--- a/nixos/doc/manual/installation/building-images-via-nixos-rebuild-build-image.chapter.md
+++ b/nixos/doc/manual/installation/building-images-via-nixos-rebuild-build-image.chapter.md
@ -2,15 +2,30 @@

 Nixpkgs contains a variety of modules to build custom images for different virtualization platforms and cloud providers, such as e.g. `amazon-image.nix` and `proxmox-lxc.nix`.

-While those can be imported individually, `system.build.images` provides an attribute set mapping variant names to image derivations. Available variants are defined - end extendable - in `image.modules`, an attribute set mapping variant names to a list of NixOS modules.
+While those can be imported directly, `system.build.images` provides an attribute set mapping variant names to image derivations. Available variants are defined - end extendable - in `image.modules`, an attribute set mapping variant names to NixOS modules.

-All of those images can be built via both, their `system.build.image` attribute, and the CLI `nixos-rebuild build-image`. To build i.e. an Amazon image from your existing NixOS configuration:
+All of those images can be built via both, their `system.build.image` attribute and the `nixos-rebuild build-image` command.
+
+For example, to build an Amazon image from your existing NixOS configuration, run:

 ```ShellSession
 $ nixos-rebuild build-image --image-variant amazon
-$ ls result
-nixos-image-amazon-25.05pre-git-x86_64-linux.vhd  nix-support
+[...]
+Done. The disk image can be found in /nix/store/[hash]-nixos-image-amazon-25.05pre-git-x86_64-linux/nixos-image-amazon-25.05pre-git-x86_64-linux.vpc
 ```

 To get a list of all variants available, run `nixos-rebuild build-image` without arguments.

+::: {.example #ex-nixos-rebuild-build-image-customize}
+
+## Customize specific image variants {#sec-image-nixos-rebuild-build-image-customize}
+
+The `image.modules` option can be used to set specific options per image variant, in a similar fashion as [specialisations](options.html#opt-specialisation) for generic NixOS configurations.
+
+E.g. images for the cloud provider Linode use `grub2` as a bootloader by default. If you are using `systemd-boot` on other platforms and want to disable it for Linode only, you could use the following options:
+
+``` nix
+  image.modules.linode = {
+    boot.loader.systemd-boot.enable = lib.mkForce false;
+  };
+```
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@ -161,6 +161,9 @@
  "ex-config": [
    "index.html#ex-config"
  ],
+  "ex-nixos-rebuild-build-image-customize": [
+    "index.html#ex-nixos-rebuild-build-image-customize"
+  ],
  "sec-installation-additional-notes": [
    "index.html#sec-installation-additional-notes"
  ],
@ -215,6 +218,9 @@
  "sec-image-nixos-rebuild-build-image": [
    "index.html#sec-image-nixos-rebuild-build-image"
  ],
+  "sec-image-nixos-rebuild-build-image-customize": [
+    "index.html#sec-image-nixos-rebuild-build-image-customize"
+  ],
  "sec-image-repart": [
    "index.html#sec-image-repart"
  ],
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@ -160,6 +160,8 @@

 - [GlitchTip](https://glitchtip.com/), an open source Sentry API compatible error tracking platform. Available as [services.glitchtip](#opt-services.glitchtip.enable).

+- [`yarr`](https://github.com/nkanaev/yarr), a small, web-based feed aggregator and RSS reader. Available as [services.yarr](#opt-services.yarr.enable).
+
 - [Stash](https://github.com/stashapp/stash), An organizer for your adult videos/images, written in Go. Available as [services.stash](#opt-services.stash.enable).

 - [vsmartcard-vpcd](https://frankmorgner.github.io/vsmartcard/virtualsmartcard/README.html), a virtual smart card driver. Available as [services.vsmartcard-vpcd](#opt-services.vsmartcard-vpcd.enable).
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -536,8 +536,7 @@
  ./services/desktops/deepin/dde-api.nix
  ./services/desktops/deepin/app-services.nix
  ./services/desktops/deepin/dde-daemon.nix
-  ./services/desktops/dleyna-renderer.nix
-  ./services/desktops/dleyna-server.nix
+  ./services/desktops/dleyna.nix
  ./services/desktops/espanso.nix
  ./services/desktops/flatpak.nix
  ./services/desktops/geoclue2.nix
@ -929,6 +928,7 @@
  ./services/misc/weechat.nix
  ./services/misc/workout-tracker.nix
  ./services/misc/xmrig.nix
+  ./services/misc/yarr.nix
  ./services/misc/ytdl-sub.nix
  ./services/misc/zoneminder.nix
  ./services/misc/zookeeper.nix
--- a/nixos/modules/services/desktops/dleyna-renderer.nix
+++ b/nixos/modules/services/desktops/dleyna-renderer.nix
@ -1,29 +0,0 @@
-# dleyna-renderer service.
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-{
-  ###### interface
-  options = {
-    services.dleyna-renderer = {
-      enable = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = ''
-          Whether to enable dleyna-renderer service, a DBus service
-          for handling DLNA renderers.
-        '';
-      };
-    };
-  };
-
-  ###### implementation
-  config = lib.mkIf config.services.dleyna-renderer.enable {
-    environment.systemPackages = [ pkgs.dleyna-renderer ];
-
-    services.dbus.packages = [ pkgs.dleyna-renderer ];
-  };
-}
--- a/nixos/modules/services/desktops/dleyna-server.nix
+++ b/nixos/modules/services/desktops/dleyna-server.nix
@ -1,29 +0,0 @@
-# dleyna-server service.
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-{
-  ###### interface
-  options = {
-    services.dleyna-server = {
-      enable = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = ''
-          Whether to enable dleyna-server service, a DBus service
-          for handling DLNA servers.
-        '';
-      };
-    };
-  };
-
-  ###### implementation
-  config = lib.mkIf config.services.dleyna-server.enable {
-    environment.systemPackages = [ pkgs.dleyna-server ];
-
-    services.dbus.packages = [ pkgs.dleyna-server ];
-  };
-}
--- a/nixos/modules/services/desktops/dleyna.nix
+++ b/nixos/modules/services/desktops/dleyna.nix
@ -0,0 +1,33 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  imports = [
+    (lib.mkRenamedOptionModule [ "services" "dleyna-server" ] [ "services" "dleyna" ])
+    (lib.mkRenamedOptionModule [ "services" "dleyna-renderer" ] [ "services" "dleyna" ])
+  ];
+
+  ###### interface
+  options = {
+    services.dleyna = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          Whether to enable dleyna-renderer and dleyna-server service,
+          a DBus service for handling DLNA servers and renderers.
+        '';
+      };
+    };
+  };
+
+  ###### implementation
+  config = lib.mkIf config.services.dleyna.enable {
+    environment.systemPackages = [ pkgs.dleyna ];
+
+    services.dbus.packages = [ pkgs.dleyna ];
+  };
+}
--- a/nixos/modules/services/editors/emacs.nix
+++ b/nixos/modules/services/editors/emacs.nix
@ -73,7 +73,8 @@ in
        serviceConfig = {
          Type = "notify";
          ExecStart = "${pkgs.runtimeShell} -c 'source ${config.system.build.setEnvironment}; exec ${cfg.package}/bin/emacs --fg-daemon'";
-          ExecStop = "${cfg.package}/bin/emacsclient --eval (kill-emacs)";
+          # Emacs exits with exit code 15 (SIGTERM), when stopped by systemd.
+          SuccessExitStatus = 15;
          Restart = "always";
        };

--- a/nixos/modules/services/mail/maddy.nix
+++ b/nixos/modules/services/mail/maddy.nix
@ -143,6 +143,8 @@ in

      enable = lib.mkEnableOption "Maddy, a free an open source mail server";

+      package = lib.mkPackageOption pkgs "maddy" { };
+
      user = lib.mkOption {
        default = "maddy";
        type = with lib.types; uniq str;
@ -386,7 +388,7 @@ in

    systemd = {

-      packages = [ pkgs.maddy ];
+      packages = [ cfg.package ];
      services = {
        maddy = {
          serviceConfig = {
@ -402,16 +404,16 @@ in
          script = ''
            ${lib.optionalString (cfg.ensureAccounts != [ ]) ''
              ${lib.concatMapStrings (account: ''
-                if ! ${pkgs.maddy}/bin/maddyctl imap-acct list | grep "${account}"; then
-                  ${pkgs.maddy}/bin/maddyctl imap-acct create ${account}
+                if ! ${cfg.package}/bin/maddyctl imap-acct list | grep "${account}"; then
+                  ${cfg.package}/bin/maddyctl imap-acct create ${account}
                fi
              '') cfg.ensureAccounts}
            ''}
            ${lib.optionalString (cfg.ensureCredentials != { }) ''
              ${lib.concatStringsSep "\n" (
-                lib.mapAttrsToList (name: cfg: ''
-                  if ! ${pkgs.maddy}/bin/maddyctl creds list | grep "${name}"; then
-                    ${pkgs.maddy}/bin/maddyctl creds create --password $(cat ${lib.escapeShellArg cfg.passwordFile}) ${name}
+                lib.mapAttrsToList (name: credentials: ''
+                  if ! ${cfg.package}/bin/maddyctl creds list | grep "${name}"; then
+                    ${cfg.package}/bin/maddyctl creds create --password $(cat ${lib.escapeShellArg credentials.passwordFile}) ${name}
                  fi
                '') cfg.ensureCredentials
              )}
@ -486,7 +488,7 @@ in
    };

    environment.systemPackages = [
-      pkgs.maddy
+      cfg.package
    ];
  };
 }
--- a/nixos/modules/services/misc/yarr.nix
+++ b/nixos/modules/services/misc/yarr.nix
@ -0,0 +1,118 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    types
+    mkIf
+    mkOption
+    mkEnableOption
+    mkPackageOption
+    optionalString
+    ;
+
+  cfg = config.services.yarr;
+in
+{
+  meta.maintainers = with lib.maintainers; [ christoph-heiss ];
+
+  options.services.yarr = {
+    enable = mkEnableOption "Yet another rss reader";
+
+    package = mkPackageOption pkgs "yarr" { };
+
+    environmentFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        Environment file for specifying additional settings such as secrets.
+
+        See `yarr -help` for all available options.
+      '';
+    };
+
+    address = mkOption {
+      type = types.str;
+      default = "localhost";
+      description = "Address to run server on.";
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 7070;
+      description = "Port to run server on.";
+    };
+
+    baseUrl = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = "Base path of the service url.";
+    };
+
+    authFilePath = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = "Path to a file containing username:password. `null` means no authentication required to use the service.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.yarr = {
+      description = "Yet another rss reader";
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      environment.XDG_CONFIG_HOME = "/var/lib/yarr/.config";
+
+      serviceConfig = {
+        Type = "simple";
+        Restart = "on-failure";
+
+        StateDirectory = "yarr";
+        StateDirectoryMode = "0700";
+        WorkingDirectory = "/var/lib/yarr";
+        EnvironmentFile = cfg.environmentFile;
+
+        LoadCredential = mkIf (cfg.authFilePath != null) "authfile:${cfg.authFilePath}";
+
+        DynamicUser = true;
+        DevicePolicy = "closed";
+        LockPersonality = "yes";
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = "AF_INET AF_INET6";
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        UMask = "0077";
+
+        ExecStart = ''
+          ${lib.getExe cfg.package} \
+            -db storage.db \
+            -addr "${cfg.address}:${toString cfg.port}" \
+            ${optionalString (cfg.baseUrl != null) "-base ${cfg.baseUrl}"} \
+            ${optionalString (cfg.authFilePath != null) "-auth-file /run/credentials/yarr.service/authfile"}
+        '';
+      };
+    };
+  };
+}
--- a/nixos/modules/services/web-apps/dependency-track.nix
+++ b/nixos/modules/services/web-apps/dependency-track.nix
@ -509,9 +509,27 @@ in
      upstreams.dependency-track.servers."localhost:${toString cfg.port}" = { };
      virtualHosts.${cfg.nginx.domain} = {
        locations = {
-          "/".alias = "${cfg.package.frontend}/dist/";
+          "/" = {
+            alias = "${cfg.package.frontend}/dist/";
+            index = "index.html";
+            tryFiles = "$uri $uri/ /index.html";
+            extraConfig = ''
+              location ~ (index\.html)$ {
+                add_header Cache-Control "max-age=0, no-cache, no-store, must-revalidate";
+                add_header Pragma "no-cache";
+                add_header Expires 0;
+              }
+            '';
+          };
          "/api".proxyPass = "http://dependency-track";
-          "= /static/config.json".alias = frontendConfigFile;
+          "= /static/config.json" = {
+            alias = frontendConfigFile;
+            extraConfig = ''
+              add_header Cache-Control "max-age=0, no-cache, no-store, must-revalidate";
+              add_header Pragma "no-cache";
+              add_header Expires 0;
+            '';
+          };
        };
      };
    };
--- a/nixos/modules/services/web-apps/peertube.nix
+++ b/nixos/modules/services/web-apps/peertube.nix
@ -489,7 +489,7 @@ in
      environment = env;

      path = with pkgs; [
-        nodejs_18
+        nodejs_20
        yarn
        ffmpeg-headless
        openssl
@ -945,7 +945,7 @@ in
      })
      (lib.attrsets.setAttrByPath
        [ cfg.user "packages" ]
-        [ peertubeEnv pkgs.nodejs_18 pkgs.yarn pkgs.ffmpeg-headless ]
+        [ peertubeEnv pkgs.nodejs_20 pkgs.yarn pkgs.ffmpeg-headless ]
      )
      (lib.mkIf cfg.redis.enableUnixSocket {
        ${config.services.peertube.user}.extraGroups = [ "redis-peertube" ];
--- a/nixos/modules/services/web-apps/wiki-js.nix
+++ b/nixos/modules/services/web-apps/wiki-js.nix
@ -151,7 +151,7 @@ in
        WorkingDirectory = "/var/lib/${cfg.stateDirectoryName}";
        DynamicUser = true;
        PrivateTmp = true;
-        ExecStart = "${pkgs.nodejs_18}/bin/node ${pkgs.wiki-js}/server";
+        ExecStart = "${pkgs.nodejs_20}/bin/node ${pkgs.wiki-js}/server";
      };
    };
  };
--- a/nixos/modules/services/x11/desktop-managers/budgie.nix
+++ b/nixos/modules/services/x11/desktop-managers/budgie.nix
@ -245,8 +245,7 @@ in
    services.system-config-printer.enable = config.services.printing.enable;

    # For BCC's Sharing panel.
-    services.dleyna-renderer.enable = mkDefault true;
-    services.dleyna-server.enable = mkDefault true;
+    services.dleyna.enable = mkDefault true;
    services.gnome.gnome-user-share.enable = mkDefault true;
    services.gnome.rygel.enable = mkDefault true;

--- a/nixos/modules/services/x11/desktop-managers/gnome.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome.nix
@ -282,8 +282,7 @@ in
      programs.dconf.enable = true;
      security.polkit.enable = true;
      services.accounts-daemon.enable = true;
-      services.dleyna-renderer.enable = mkDefault true;
-      services.dleyna-server.enable = mkDefault true;
+      services.dleyna.enable = mkDefault true;
      services.power-profiles-daemon.enable = mkDefault true;
      services.gnome.at-spi2-core.enable = true;
      services.gnome.evolution-data-server.enable = true;
--- a/nixos/modules/services/x11/window-managers/exwm.nix
+++ b/nixos/modules/services/x11/window-managers/exwm.nix
@ -13,7 +13,7 @@ let
    ${cfg.loadScript}
  '';
  packages = epkgs: cfg.extraPackages epkgs ++ [ epkgs.exwm ];
-  exwm-emacs = pkgs.emacs.pkgs.withPackages packages;
+  exwm-emacs = cfg.package.pkgs.withPackages packages;
 in
 {

@ -38,6 +38,10 @@ in
          file.
        '';
      };
+      package = mkPackageOption pkgs "Emacs" {
+        default = "emacs";
+        example = [ "emacs-gtk" ];
+      };
      extraPackages = mkOption {
        type = types.functionTo (types.listOf types.package);
        default = epkgs: [ ];
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -948,7 +948,7 @@ in
  nomad = runTest ./nomad.nix;
  non-default-filesystems = handleTest ./non-default-filesystems.nix { };
  non-switchable-system = runTest ./non-switchable-system.nix;
-  noto-fonts = handleTest ./noto-fonts.nix { };
+  noto-fonts = runTest ./noto-fonts.nix;
  noto-fonts-cjk-qt-default-weight = handleTest ./noto-fonts-cjk-qt-default-weight.nix { };
  novacomd = handleTestOn [ "x86_64-linux" ] ./novacomd.nix { };
  npmrc = handleTest ./npmrc.nix { };
@ -1478,6 +1478,7 @@ in
  xterm = runTest ./xterm.nix;
  xxh = runTest ./xxh.nix;
  yabar = runTest ./yabar.nix;
+  yarr = runTest ./yarr.nix;
  ydotool = handleTest ./ydotool.nix { };
  yggdrasil = runTest ./yggdrasil.nix;
  your_spotify = runTest ./your_spotify.nix;
--- a/nixos/tests/armagetronad.nix
+++ b/nixos/tests/armagetronad.nix
@ -115,7 +115,7 @@ in
          self.node.wait_for_text(text)
          self.send(*keys)

-      Server = namedtuple('Server', ('node', 'name', 'address', 'port', 'welcome', 'attacker', 'victim', 'coredump_delay'))
+      Server = namedtuple('Server', ('node', 'name', 'address', 'port', 'welcome', 'player1', 'player2'))

      # Clients and their in-game names
      clients = (
@ -125,9 +125,9 @@ in

      # Server configs.
      servers = (
-        Server(server, 'high-rubber', 'server', 4534, 'NixOS Smoke Test Server', 'SmOoThIcE', 'Arduino', 8),
-        Server(server, 'sty', 'server', 4535, 'NixOS Smoke Test sty+ct+ap Server', 'Arduino', 'SmOoThIcE', 8),
-        Server(server, 'trunk', 'server', 4536, 'NixOS Smoke Test 0.4 Server', 'Arduino', 'SmOoThIcE', 8)
+        Server(server, 'high-rubber', 'server', 4534, 'NixOS Smoke Test Server', 'SmOoThIcE', 'Arduino'),
+        Server(server, 'sty', 'server', 4535, 'NixOS Smoke Test sty+ct+ap Server', 'Arduino', 'SmOoThIcE'),
+        Server(server, 'trunk', 'server', 4536, 'NixOS Smoke Test 0.4 Server', 'Arduino', 'SmOoThIcE')
      )

      """
@ -146,8 +146,55 @@ in
          client.node.screenshot(f"screen_{client.name}_{screenshot_idx}")
        return screenshot_idx + 1

-      # Wait for the servers to come up.
+      """
+      Sets up a client, waiting for the given barrier on completion.
+      """
+      def client_setup(client, servers, barrier):
+        client.node.wait_for_x()
+
+        # Configure Armagetron so we skip the tutorial.
+        client.node.succeed(
+          run("mkdir -p ~/.armagetronad/var"),
+          run(f"echo 'PLAYER_1 {client.name}' >> ~/.armagetronad/var/autoexec.cfg"),
+          run("echo 'FIRST_USE 0' >> ~/.armagetronad/var/autoexec.cfg")
+        )
+        for idx, srv in enumerate(servers):
+          client.node.succeed(
+            run(f"echo 'BOOKMARK_{idx+1}_ADDRESS {srv.address}' >> ~/.armagetronad/var/autoexec.cfg"),
+            run(f"echo 'BOOKMARK_{idx+1}_NAME {srv.name}' >> ~/.armagetronad/var/autoexec.cfg"),
+            run(f"echo 'BOOKMARK_{idx+1}_PORT {srv.port}' >> ~/.armagetronad/var/autoexec.cfg")
+          )
+
+        # Start Armagetron. Use the recording mode since it skips the splashscreen.
+        client.node.succeed(run("cd; ulimit -c unlimited; armagetronad --record test.aarec >&2 & disown"))
+        client.node.wait_until_succeeds(
+          run(
+            "${xdo "create_new_win-select_main_window" ''
+              search --onlyvisible --name "Armagetron Advanced"
+              windowfocus --sync
+              windowactivate --sync
+            ''}"
+          )
+        )
+
+        # Get into the multiplayer menu.
+        client.send_on('Armagetron Advanced', 'ret')
+        client.send_on('Play Game', 'ret')
+
+        # Online > LAN > Network Setup > Mates > Server Bookmarks
+        client.send_on('Multiplayer', 'down', 'down', 'down', 'down', 'ret')
+
+        barrier.wait()
+
+      # Start everything.
      start_all()
+
+      # Get to the Server Bookmarks screen on both clients. This takes a while so do it asynchronously.
+      barrier = threading.Barrier(len(clients) + 1, timeout=600)
+      for client in clients:
+        threading.Thread(target=client_setup, args=(client, servers, barrier)).start()
+
+      # Wait for the servers to come up.
      for srv in servers:
        srv.node.wait_for_unit(f"armagetronad-{srv.name}")
        srv.node.wait_until_succeeds(f"ss --numeric --udp --listening | grep -q {srv.port}")
@ -167,55 +214,7 @@ in
          f"journalctl -u armagetronad-{srv.name} -e | grep -q 'Admin: Testing again!'"
        )

-      """
-      Sets up a client, waiting for the given barrier on completion.
-      """
-      def client_setup(client, servers, barrier):
-        client.node.wait_for_x()
-
-        # Configure Armagetron.
-        client.node.succeed(
-          run("mkdir -p ~/.armagetronad/var"),
-          run(f"echo 'PLAYER_1 {client.name}' >> ~/.armagetronad/var/autoexec.cfg")
-        )
-        for idx, srv in enumerate(servers):
-          client.node.succeed(
-            run(f"echo 'BOOKMARK_{idx+1}_ADDRESS {srv.address}' >> ~/.armagetronad/var/autoexec.cfg"),
-            run(f"echo 'BOOKMARK_{idx+1}_NAME {srv.name}' >> ~/.armagetronad/var/autoexec.cfg"),
-            run(f"echo 'BOOKMARK_{idx+1}_PORT {srv.port}' >> ~/.armagetronad/var/autoexec.cfg")
-          )
-
-        # Start Armagetron.
-        client.node.succeed(run("ulimit -c unlimited; armagetronad >&2 & disown"))
-        client.node.wait_until_succeeds(
-          run(
-            "${xdo "create_new_win-select_main_window" ''
-              search --onlyvisible --name "Armagetron Advanced"
-              windowfocus --sync
-              windowactivate --sync
-            ''}"
-          )
-        )
-
-        # Get through the tutorial.
-        client.send_on('Language Settings', 'ret')
-        client.send_on('First Setup', 'ret')
-        client.send_on('Welcome to Armagetron Advanced', 'ret')
-        client.send_on('round 1', 'esc')
-        client.send_on('Menu', 'up', 'up', 'ret')
-        client.send_on('We hope you', 'ret')
-        client.send_on('Armagetron Advanced', 'ret')
-        client.send_on('Play Game', 'ret')
-
-        # Online > LAN > Network Setup > Mates > Server Bookmarks
-        client.send_on('Multiplayer', 'down', 'down', 'down', 'down', 'ret')
-
-        barrier.wait()
-
-      # Get to the Server Bookmarks screen on both clients. This takes a while so do it asynchronously.
-      barrier = threading.Barrier(len(clients) + 1, timeout=240)
-      for client in clients:
-        threading.Thread(target=client_setup, args=(client, servers, barrier)).start()
+      # Wait for the client setup to complete.
      barrier.wait()

      # Main testing loop. Iterates through each server bookmark and connects to them in sequence.
@ -245,18 +244,14 @@ in
          f"journalctl -u armagetronad-{srv.name} -e | grep -q 'Go (round 1 of 10)'"
        )

-        # Wait a bit
-        srv.node.sleep(srv.coredump_delay)
-
-        # Turn the attacker player's lightcycle left
-        attacker = next(client for client in clients if client.name == srv.attacker)
-        victim = next(client for client in clients if client.name == srv.victim)
-        attacker.send('left')
-        screenshot_idx = take_screenshots(screenshot_idx)
-
-        # Wait for coredump.
+        # Wait for the players to die by running into the wall.
+        player1 = next(client for client in clients if client.name == srv.player1)
+        player2 = next(client for client in clients if client.name == srv.player2)
        srv.node.wait_until_succeeds(
-          f"journalctl -u armagetronad-{srv.name} -e | grep -q '{attacker.name} core dumped {victim.name}'"
+          f"journalctl -u armagetronad-{srv.name} -e | grep -q '{player1.name}.*lost 4 points'"
+        )
+        srv.node.wait_until_succeeds(
+          f"journalctl -u armagetronad-{srv.name} -e | grep -q '{player2.name}.*lost 4 points'"
        )
        screenshot_idx = take_screenshots(screenshot_idx)

--- a/nixos/tests/dependency-track.nix
+++ b/nixos/tests/dependency-track.nix
@ -45,7 +45,9 @@ import ./make-test-python.nix (
        };
    };

-    testScript = ''
+    testScript =
+      # python
+      ''
        import json

        start_all()
@ -61,6 +63,9 @@ import ./make-test-python.nix (
            server.succeed("curl http://localhost/api/version")
          )
          assert version["version"] == "${pkgs.dependency-track.version}"
+
+        with subtest("nginx serves frontend"):
+          server.succeed("curl http://localhost/ | grep \"<title>Dependency-Track</title>\"")
      '';
  }
 )
--- a/nixos/tests/netdata.nix
+++ b/nixos/tests/netdata.nix
@ -22,6 +22,7 @@ import ./make-test-python.nix (
          ];
          services.netdata = {
            enable = true;
+            package = pkgs.netdataCloud;
            python.recommendedPythonPackages = true;

            configDir."apps_groups.conf" = pkgs.writeText "apps_groups.conf" ''
@ -40,27 +41,17 @@ import ./make-test-python.nix (
        netdata.wait_for_open_port(19999)

      # check if the netdata main page loads.
-      netdata.succeed("curl --fail http://localhost:19999/")
+      netdata.succeed("curl --fail http://127.0.0.1:19999")
      netdata.succeed("sleep 4")

-      # check if netdata can read disk ops for root owned processes.
-      # if > 0, successful. verifies both netdata working and
-      # apps.plugin has elevated capabilities.
-      url = "http://localhost:19999/api/v1/data?chart=user.root_disk_physical_io"
-      filter = '[.data[range(10)][2]] | add | . < 0'
+      # check if netdata api shows correct os
+      url = "http://127.0.0.1:19999/api/v3/info"
+      filter = '.agents[0].application.os.os | . == "NixOS"'
      cmd = f"curl -s {url} | jq -e '{filter}'"
      netdata.wait_until_succeeds(cmd)

      # check if the control socket is available
      netdata.succeed("sudo netdatacli ping")
-
-      # check that custom groups in apps_groups.conf are used.
-      # if > 0, successful. verifies that user-specified apps_group.conf
-      # is used.
-      url = "http://localhost:19999/api/v1/data?chart=app.netdata_test_cpu_utilization"
-      filter = '[.data[range(10)][2]] | add | . > 0'
-      cmd = f"curl -s {url} | jq -e '{filter}'"
-      netdata.wait_until_succeeds(cmd, timeout=30)
    '';
  }
 )
--- a/nixos/tests/noto-fonts.nix
+++ b/nixos/tests/noto-fonts.nix
@ -1,13 +1,14 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
+{ lib, ... }:
+{
  name = "noto-fonts";
  meta.maintainers = with lib.maintainers; [
    nickcao
    midchildan
  ];

-    nodes.machine = {
+  nodes.machine =
+    { pkgs, ... }:
+    {
      imports = [ ./common/x11.nix ];
      environment.systemPackages = [ pkgs.gedit ];
      fonts = {
@ -55,5 +56,4 @@ import ./make-test-python.nix (
      machine.sleep(10)
      machine.screenshot("screen")
    '';
-  }
-)
+}
--- a/nixos/tests/yarr.nix
+++ b/nixos/tests/yarr.nix
@ -0,0 +1,19 @@
+{ lib, pkgs, ... }:
+
+{
+  name = "yarr";
+  meta.maintainers = with lib.maintainers; [ christoph-heiss ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.yarr.enable = true;
+    };
+
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("yarr.service")
+    machine.wait_for_open_port(7070)
+    machine.succeed("curl -sSf http://localhost:7070 | grep '<title>yarr!</title>'")
+  '';
+}
--- a/pkgs/applications/audio/clementine/default.nix
+++ b/pkgs/applications/audio/clementine/default.nix
@ -49,13 +49,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "clementine";
-  version = "1.4.1-37-g3369f3085";
+  version = "1.4.1-38-g1fc7fe0e1";

  src = fetchFromGitHub {
    owner = "clementine-player";
    repo = "Clementine";
    tag = finalAttrs.version;
-    hash = "sha256-zwt4PkCXVYJn8IsZL0JEJLX1LiAvDrNdhh0s2oDxGgY=";
+    hash = "sha256-KV3au25iZ2W9tufNbaI0+UCeLjoJR5Um1U3Gmlk0O2s=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/audio/drumkv1/default.nix
+++ b/pkgs/applications/audio/drumkv1/default.nix
@ -15,11 +15,11 @@

 stdenv.mkDerivation rec {
  pname = "drumkv1";
-  version = "1.3.0";
+  version = "1.3.1";

  src = fetchurl {
    url = "mirror://sourceforge/drumkv1/drumkv1-${version}.tar.gz";
-    hash = "sha256-WcWhq1Li9dfj0piyW6F0mdfzcK+nvk5Rtl8pQZTYyt8=";
+    hash = "sha256-CzboTrMRxPr5O6caKrxW9X9uSi5Su5LRSQpwJBMGkGI=";
  };

  buildInputs = [
--- a/pkgs/applications/audio/samplv1/default.nix
+++ b/pkgs/applications/audio/samplv1/default.nix
@ -18,11 +18,11 @@

 stdenv.mkDerivation rec {
  pname = "samplv1";
-  version = "1.3.0";
+  version = "1.3.1";

  src = fetchurl {
    url = "mirror://sourceforge/samplv1/samplv1-${version}.tar.gz";
-    hash = "sha256-ZmRsiFDqJsG28FiFR/RbeXkeeLn2HBfImKQM5PaRF78=";
+    hash = "sha256-DcMtNGiMJ9YfTKZLns+3mBKHbkG3Ven3IJAU/qSDyh0=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/editors/emacs/make-emacs.nix
+++ b/pkgs/applications/editors/emacs/make-emacs.nix
@ -66,7 +66,11 @@
  zlib,

  # Boolean flags
-  withNativeCompilation ? stdenv.buildPlatform.canExecute stdenv.hostPlatform,
+
+  # FIXME: Native compilation breaks build and runtime on macOS 15.4;
+  # see <https://github.com/NixOS/nixpkgs/issues/395169>.
+  withNativeCompilation ?
+    stdenv.buildPlatform.canExecute stdenv.hostPlatform && !stdenv.hostPlatform.isDarwin,
  noGui ? false,
  srcRepo ? true,
  withAcl ? false,
--- a/pkgs/applications/editors/okteta/default.nix
+++ b/pkgs/applications/editors/okteta/default.nix
@ -19,11 +19,11 @@

 mkDerivation rec {
  pname = "okteta";
-  version = "0.26.20";
+  version = "0.26.21";

  src = fetchurl {
    url = "mirror://kde/stable/okteta/${version}/src/${pname}-${version}.tar.xz";
-    sha256 = "sha256-lKGjIeNxdBqmlsXvZTe8BnRirt+VrxwX/9CCQVVUuow=";
+    sha256 = "sha256-tuYvcfcxdX1nzTR603rEYIgXLEjnZH3mDRJUD/BVRJs=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/editors/rstudio/default.nix
+++ b/pkgs/applications/editors/rstudio/default.nix
@ -33,7 +33,7 @@
  zip,
  git,
  makeWrapper,
-  electron_33,
+  electron_34,
  server ? false, # build server version
  pam,
  nixosTests,
@ -42,7 +42,7 @@
 let
  # Note: we shouldn't use the latest electron here, since the node-abi dependency might
  # need to be updated every time the latest electron gets a new abi version number
-  electron = electron_33;
+  electron = electron_34;

  mathJaxSrc = fetchzip {
    url = "https://s3.amazonaws.com/rstudio-buildtools/mathjax-27.zip";
--- a/pkgs/applications/editors/texmacs/default.nix
+++ b/pkgs/applications/editors/texmacs/default.nix
@ -20,6 +20,7 @@
  qtbase,
  qtsvg,
  qtmacextras,
+  fetchpatch,
  ghostscriptX ? null,
  extraFonts ? false,
  chineseFonts ? false,
@ -79,6 +80,14 @@ stdenv.mkDerivation {
      qtmacextras
    ];

+  patches = [
+    (fetchpatch {
+      name = "fix-compile-clang-19.5.patch";
+      url = "https://github.com/texmacs/texmacs/commit/e72783b023f22eaa0456d2e4cc76ae509d963672.patch";
+      hash = "sha256-oJCiXWTY89BdxwbgtFvfThid0WM83+TAUThSihfr0oA=";
+    })
+  ];
+
  cmakeFlags = lib.optionals stdenv.hostPlatform.isDarwin [
    (lib.cmakeFeature "TEXMACS_GUI" "Qt")
    (lib.cmakeFeature "CMAKE_INSTALL_PREFIX" "./TeXmacs.app/Contents/Resources")
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -14937,6 +14937,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  unimpaired-which-key-nvim = buildVimPlugin {
+    pname = "unimpaired-which-key.nvim";
+    version = "2024-08-16";
+    src = fetchFromGitHub {
+      owner = "afreakk";
+      repo = "unimpaired-which-key.nvim";
+      rev = "c35f413a631e2d2a29778cc390e4d2da28fc2727";
+      sha256 = "11skr474c9drq25823rx1jxcv5d57si0085zw60nq3wxmx999cg3";
+    };
+    meta.homepage = "https://github.com/afreakk/unimpaired-which-key.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
  unison = buildVimPlugin {
    pname = "unison";
    version = "2025-04-18";
--- a/pkgs/applications/editors/vim/plugins/non-generated/sonarlint-nvim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/sonarlint-nvim/default.nix
@ -15,7 +15,9 @@ vimUtils.buildVimPlugin {
    hash = "sha256-EUwuIFFe4tmw8u6RqEvOLL0Yi8J5cLBQx7ICxnmkT4k=";
  };

-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };

  meta = {
    homepage = "https://gitlab.com/schrieveslaach/sonarlint.nvim";
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -1145,6 +1145,7 @@ https://github.com/altermo/ultimate-autopair.nvim/,HEAD,
 https://github.com/SirVer/ultisnips/,,
 https://github.com/mbbill/undotree/,,
 https://github.com/chrisbra/unicode.vim/,,
+https://github.com/afreakk/unimpaired-which-key.nvim/,HEAD,
 https://github.com/tummetott/unimpaired.nvim/,HEAD,
 https://github.com/unisonweb/unison/,,
 https://github.com/Shougo/unite.vim/,,
--- a/pkgs/applications/editors/vscode/extensions/ms-pyright.pyright/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-pyright.pyright/default.nix
@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    publisher = "ms-pyright";
    name = "pyright";
-    version = "1.1.399";
-    hash = "sha256-dKkx01NVbg0f6+LkZPs1/djqJjOAY/BjROEr4455Shc=";
+    version = "1.1.400";
+    hash = "sha256-Twpsxtr6fUSDgCfMYFJF3asgaKLB/axIvOZRItuFyig=";
  };

  meta = {
--- a/pkgs/applications/emulators/wine/sources.nix
+++ b/pkgs/applications/emulators/wine/sources.nix
@ -65,6 +65,23 @@ let
    source ${./update-lib.sh}
  '';

+  # Needed for wine versions < 10.2 to fix compatibility with binutils 2.44
+  # https://github.com/NixOS/nixpkgs/issues/399714
+  # https://bugs.winehq.org/show_bug.cgi?id=57819
+  # https://gitlab.winehq.org/wine/wine/-/merge_requests/7328
+  patches-binutils-2_44-fix-wine-older-than-10_2 = [
+    (pkgs.fetchpatch {
+      name = "ntdll-use-signed-type";
+      url = "https://gitlab.winehq.org/wine/wine/-/commit/fd59962827a715d321f91c9bdb43f3e61f9ebbc.patch";
+      hash = "sha256-PvFom9NJ32XZO1gYor9Cuk8+eaRFvmG572OAtNx1tks=";
+    })
+    (pkgs.fetchpatch {
+      name = "winebuild-avoid using-idata-section";
+      url = "https://gitlab.winehq.org/wine/wine/-/commit/c9519f68ea04915a60704534ab3afec5ec1b8fd7.patch";
+      hash = "sha256-vA58SfAgCXoCT+NB4SRHi85AnI4kj9S2deHGp4L36vI=";
+    })
+  ];
+
  inherit (pkgs) writeShellScript;
 in
 rec {
@ -96,7 +113,7 @@ rec {
    patches = [
      # Also look for root certificates at $NIX_SSL_CERT_FILE
      ./cert-path.patch
-    ];
+    ] ++ patches-binutils-2_44-fix-wine-older-than-10_2;

    updateScript = writeShellScript "update-wine-stable" (''
      ${updateScriptPreamble}
@ -118,7 +135,11 @@ rec {
    version = "10.5";
    url = "https://dl.winehq.org/wine/source/10.x/wine-${version}.tar.xz";
    hash = "sha256-wDbsHvR2dHdKX5lFgwIuni62j+j8GLOox55oWzvsibw=";
-    inherit (stable) patches;
+
+    patches = [
+      # Also look for root certificates at $NIX_SSL_CERT_FILE
+      ./cert-path.patch
+    ];

    # see https://gitlab.winehq.org/wine/wine-staging
    staging = fetchFromGitLab {
@ -177,7 +198,11 @@ rec {
    version = "9.21";
    url = "https://dl.winehq.org/wine/source/9.x/wine-${version}.tar.xz";
    hash = "sha256-REK0f/2bLqRXEA427V/U5vTYKdnbeaJeYFF1qYjKL/8=";
-    inherit (stable) patches;
+
+    patches = [
+      # Also look for root certificates at $NIX_SSL_CERT_FILE
+      ./cert-path.patch
+    ] ++ patches-binutils-2_44-fix-wine-older-than-10_2;

    # see https://gitlab.winehq.org/wine/wine-staging
    staging = fetchFromGitLab {
--- a/pkgs/applications/graphics/vengi-tools/default.nix
+++ b/pkgs/applications/graphics/vengi-tools/default.nix
@ -27,9 +27,6 @@
  SDL2,
  SDL2_mixer,
  wayland-protocols,
-  Carbon,
-  CoreServices,
-  OpenCL,

  callPackage,
  nixosTests,
@ -46,6 +43,15 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-8rGnW+VtqNJYqUqQDp0yOVIQd7w+cq7PIpqqIQPhkbE=";
  };

+  prePatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    # Disable code signing on macOS
+    substituteInPlace cmake/macros.cmake --replace-fail "codesign" "true"
+    substituteInPlace cmake/system/apple.cmake --replace-fail "if(APPLE)" "if(false)"
+
+    # calls otool -L on /usr/lib/libSystem.B.dylib and fails because it doesn't exist
+    substituteInPlace cmake/applebundle.cmake --replace-fail 'fixup_bundle("''${TARGET_BUNDLE_DIR}" "" "")' ""
+  '';
+
  nativeBuildInputs = [
    cmake
    pkg-config
@ -73,15 +79,8 @@ stdenv.mkDerivation (finalAttrs: {
      SDL2_mixer
    ]
    ++ lib.optional stdenv.hostPlatform.isLinux wayland-protocols
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Carbon
-      CoreServices
-      OpenCL
-    ]
    ++ lib.optional (!stdenv.hostPlatform.isDarwin) opencl-headers;

-  cmakeFlags = lib.optional stdenv.hostPlatform.isDarwin "-DCORESERVICES_LIB=${CoreServices}";
-
  # error: "The plain signature for target_link_libraries has already been used"
  doCheck = false;

@ -89,12 +88,22 @@ stdenv.mkDerivation (finalAttrs: {
    gtest
  ];

+  postInstall =
+    if stdenv.hostPlatform.isDarwin then
+      ''
+        mkdir -p $out/Applications
+        mv $out/*.app $out/Applications/
+
+        mkdir -p $out/bin
+        ln -s $out/Applications/vengi-voxconvert.app/Contents/MacOS/vengi-voxconvert $out/bin/vengi-voxconvert
+      ''
+    else
      # Set the data directory for each executable. We cannot set it at build time
      # with the PKGDATADIR cmake variable because each executable needs a specific
      # one.
      # This is not needed on darwin, since on that platform data files are saved
      # in *.app/Contents/Resources/ too, and are picked up automatically.
-  postInstall = lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
+      ''
        for prog in $out/bin/*; do
          wrapProgram "$prog" \
            --set CORE_PATH $out/share/$(basename "$prog")/
@ -124,6 +133,5 @@ stdenv.mkDerivation (finalAttrs: {
    ];
    maintainers = with maintainers; [ fgaz ];
    platforms = platforms.all;
-    broken = stdenv.hostPlatform.isDarwin;
  };
 })
--- a/pkgs/applications/misc/redshift/default.nix
+++ b/pkgs/applications/misc/redshift/default.nix
@ -180,13 +180,13 @@ rec {

  gammastep = mkRedshift rec {
    pname = "gammastep";
-    version = "2.0.9";
+    version = "2.0.11";

    src = fetchFromGitLab {
      owner = "chinstrap";
      repo = pname;
      rev = "v${version}";
-      hash = "sha256-EdVLBBIEjMu+yy9rmcxQf4zdW47spUz5SbBDbhmLjOU=";
+      hash = "sha256-c8JpQLHHLYuzSC9bdymzRTF6dNqOLwYqgwUOpKcgAEU=";
    };

    meta = redshift.meta // {
--- a/pkgs/applications/misc/syncthingtray/default.nix
+++ b/pkgs/applications/misc/syncthingtray/default.nix
@ -38,14 +38,14 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "1.7.5";
+  version = "1.7.6";
  pname = "syncthingtray";

  src = fetchFromGitHub {
    owner = "Martchus";
    repo = "syncthingtray";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-/1X+wbVwLu0+SOMaVDJejBA+Z3szgs8IDtAZ9Yj7hXs=";
+    hash = "sha256-vJIHDp91T9oMtUT7bsSCxj6XkvT4bLMol9wEr19Wkig=";
  };

  buildInputs =
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@ -1,10 +1,10 @@
 {
  "chromium": {
-    "version": "135.0.7049.95",
+    "version": "135.0.7049.114",
    "chromedriver": {
-      "version": "135.0.7049.96",
-      "hash_darwin": "sha256-MmL/hQGPk/kGBtbXSekE+lHktucPCv3HFr8VYTnff5w=",
-      "hash_darwin_aarch64": "sha256-TGiVrAYgeLGniGBZ2dHUBk6Hg996ouBSJHZm9hXExQ4="
+      "version": "135.0.7049.115",
+      "hash_darwin": "sha256-fEqjiSP6p//NY8HCi409sftXlK6CVvzsw2oZbSgTgJ4=",
+      "hash_darwin_aarch64": "sha256-K1jH+yxYio8yyxZ7M15QhOQ9fu2VhjeaevS8zM5D8Lk="
    },
    "deps": {
      "depot_tools": {
@ -20,8 +20,8 @@
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "de2eb485a1951079e63bdb57ce25544d2dc79c15",
-        "hash": "sha256-6ydyJWsDawt0bfYAFHotTB9ujmIYsqUUpNwB6q6RNQE=",
+        "rev": "63fd8a7d9d09e41ba37b84386c85d5f249f848f7",
+        "hash": "sha256-U6OJHocA6vI36QCU8UITUsVlentm210CwdThCwlDw5E=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
--- a/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
--- a/pkgs/applications/networking/browsers/firefox-bin/developer-edition_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/developer-edition_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
@ -10,13 +10,13 @@
 buildMozillaMach rec {
  pname = "firefox-devedition";
  binaryName = pname;
-  version = "138.0b5";
+  version = "138.0b9";
  applicationName = "Firefox Developer Edition";
  requireSigning = false;
  branding = "browser/branding/aurora";
  src = fetchurl {
    url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "07da38a6aa19de812539ba9b286d5189607ef45e7d8665a0f42facdcf7b3f7854561ad3cb54dce7e049199574b7d6dff01dba03763730e49306efb82833270fb";
+    sha512 = "cf737b8c394150430cda512a84ebdf04426db0c413863eb37a327c44fc952db7de1be07956aaded3ddb769480fb307a102c1f4f7dab4ba8a38f2371fdd35a961";
  };

  meta = {
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/default.nix
@ -71,7 +71,7 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "vivaldi";
-  version = "7.3.3635.7";
+  version = "7.3.3635.11";

  suffix =
    {
@ -84,8 +84,8 @@ stdenv.mkDerivation rec {
    url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}-1_${suffix}.deb";
    hash =
      {
-        aarch64-linux = "sha256-E/tvarNTUm0VZMxFM/FcZKM3U/psTyq4bJl2r6orpeY=";
-        x86_64-linux = "sha256-8Jy7L5BSWZVIFizW11pOfXhgeT9rP1Z2T0aDmC79fbQ=";
+        aarch64-linux = "sha256-w1/wWP3lZUQ5tBvv6XOCkoR1OCoByURBEvaaemsY19U=";
+        x86_64-linux = "sha256-kJNFPXiZekjofGtKFbGc85c8yQymhntkCBuhylwQBpE=";
      }
      .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  };
--- a/pkgs/applications/networking/instant-messengers/franz/default.nix
+++ b/pkgs/applications/networking/instant-messengers/franz/default.nix
@ -7,10 +7,10 @@
 mkFranzDerivation rec {
  pname = "franz";
  name = "Franz";
-  version = "5.10.0";
+  version = "5.11.0";
  src = fetchurl {
    url = "https://github.com/meetfranz/franz/releases/download/v${version}/franz_${version}_amd64.deb";
-    sha256 = "sha256-zQhZlxr7kyMWx6txDnV+ECBTzVEwnUaBsLWKJy3XYFg=";
+    sha256 = "sha256-4+HeH9lY5/2fswSwzMPM1Idllj01zU7nmlLOMYfcSsU=";
  };
  meta = with lib; {
    description = "Free messaging app that combines chat & messaging services into one application";
--- a/pkgs/applications/networking/p2p/gnunet/default.nix
+++ b/pkgs/applications/networking/p2p/gnunet/default.nix
@ -38,11 +38,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gnunet";
-  version = "0.24.0";
+  version = "0.24.1";

  src = fetchurl {
    url = "mirror://gnu/gnunet/gnunet-${finalAttrs.version}.tar.gz";
-    hash = "sha256-BoUvn0gz5ssGvu3fhyerlMQ4U69yOnY4etdxYS4WPFc=";
+    hash = "sha256-xPj50l06APgHCVg7h6qDEtAUVAkLc6QTtD7H7HwHujk=";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/office/grisbi/default.nix
+++ b/pkgs/applications/office/grisbi/default.nix
@ -1,39 +1,45 @@
 {
-  fetchurl,
+  fetchFromGitHub,
  lib,
  stdenv,
  gtk,
  pkg-config,
  libgsf,
  libofx,
+  autoreconfHook,
  intltool,
  wrapGAppsHook3,
-  libsoup_2_4,
  adwaita-icon-theme,
+  nix-update-script,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "grisbi";
-  version = "2.0.5";
+  version = "3.0.4";

-  src = fetchurl {
-    url = "mirror://sourceforge/grisbi/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-vTrbq/xLTfwF7/YtKzZFiiSw8A0HzzWin2ry8gPHej8=";
+  src = fetchFromGitHub {
+    owner = "grisbi";
+    repo = "grisbi";
+    tag = "upstream_version_${lib.replaceStrings [ "." ] [ "_" ] finalAttrs.version}";
+    hash = "sha256-3E57M/XE4xyo3ppVceDA4OFDnVicosCY8ikE2gDJoUQ=";
  };

  nativeBuildInputs = [
    pkg-config
    wrapGAppsHook3
    intltool
+    autoreconfHook
  ];
+
  buildInputs = [
    gtk
    libgsf
    libofx
-    libsoup_2_4
    adwaita-icon-theme
  ];

+  passthru.updateScript = nix-update-script { };
+
  meta = with lib; {
    description = "Personnal accounting application";
    mainProgram = "grisbi";
@ -50,4 +56,4 @@ stdenv.mkDerivation rec {
    maintainers = with maintainers; [ layus ];
    platforms = platforms.linux;
  };
-}
+})
--- a/pkgs/applications/office/mendeley/default.nix
+++ b/pkgs/applications/office/mendeley/default.nix
@ -8,13 +8,13 @@

 let
  pname = "mendeley";
-  version = "2.132.0";
+  version = "2.132.1";

  executableName = "${pname}-reference-manager";

  src = fetchurl {
    url = "https://static.mendeley.com/bin/desktop/mendeley-reference-manager-${version}-x86_64.AppImage";
-    hash = "sha256-d4B+rVwWHKLVgY/aK3E6i6CyQKD4TsxZ/XyKbbCrQE0=";
+    hash = "sha256-FzniIT3foLbXGQ6Rnmea9MmBs0mXAFDgwv0iu9eX3lM=";
  };

  appimageContents = appimageTools.extractType2 {
--- a/pkgs/applications/science/biology/mrtrix/default.nix
+++ b/pkgs/applications/science/biology/mrtrix/default.nix
@ -4,7 +4,7 @@
  fetchFromGitHub,
  python,
  makeWrapper,
-  eigen,
+  eigen_3_4_0,
  fftw,
  libtiff,
  libpng,
@ -18,41 +18,8 @@
  libXext,
  less,
  withGui ? true,
-  fetchFromGitLab,
-  fetchpatch,
 }:

-let
-  # reverts 'eigen: 3.4.0 -> 3.4.0-unstable-2022-05-19'
-  # https://github.com/NixOS/nixpkgs/commit/d298f046edabc84b56bd788e11eaf7ed72f8171c
-  eigen' = (
-    eigen.overrideAttrs (old: rec {
-      version = "3.4.0";
-      src = fetchFromGitLab {
-        owner = "libeigen";
-        repo = "eigen";
-        tag = version;
-        hash = "sha256-1/4xMetKMDOgZgzz3WMxfHUEpmdAm52RqZvz6i0mLEw=";
-      };
-      patches = (old.patches or [ ]) ++ [
-        # Fixes e.g. onnxruntime on aarch64-darwin:
-        # https://hydra.nixos.org/build/248915128/nixlog/1,
-        # originally suggested in https://github.com/NixOS/nixpkgs/pull/258392.
-        #
-        # The patch is from
-        # ["Fix vectorized reductions for Eigen::half"](https://gitlab.com/libeigen/eigen/-/merge_requests/699)
-        # which is two years old,
-        # but Eigen hasn't had a release in two years either:
-        # https://gitlab.com/libeigen/eigen/-/issues/2699.
-        (fetchpatch {
-          url = "https://gitlab.com/libeigen/eigen/-/commit/d0e3791b1a0e2db9edd5f1d1befdb2ac5a40efe0.patch";
-          hash = "sha256-8qiNpuYehnoiGiqy0c3Mcb45pwrmc6W4rzCxoLDSvj0=";
-        })
-      ];
-    })
-  );
-in
-
 stdenv.mkDerivation rec {
  pname = "mrtrix";
  version = "3.0.4-unstable-2025-04-09";
@ -74,7 +41,7 @@ stdenv.mkDerivation rec {
  buildInputs =
    [
      ants
-      eigen'
+      eigen_3_4_0
      python
      fftw
      libtiff
@ -113,7 +80,7 @@ stdenv.mkDerivation rec {

  configurePhase = ''
    runHook preConfigure
-    export EIGEN_CFLAGS="-isystem ${eigen'}/include/eigen3"
+    export EIGEN_CFLAGS="-isystem ${eigen_3_4_0}/include/eigen3"
    unset LD  # similar to https://github.com/MRtrix3/mrtrix3/issues/1519
    ./configure ${lib.optionalString (!withGui) "-nogui"};
    runHook postConfigure
--- a/pkgs/applications/science/logic/eprover/default.nix
+++ b/pkgs/applications/science/logic/eprover/default.nix
@ -6,13 +6,13 @@
  enableHO ? false,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "eprover";
-  version = "3.1";
+  version = "3.2";

  src = fetchurl {
-    url = "https://wwwlehre.dhbw-stuttgart.de/~sschulz/WORK/E_DOWNLOAD/V_${version}/E.tgz";
-    hash = "sha256-+E2z7JAkiNXhZrWRXFbhI5f9NmB0Q4eixab4GlAFqYY=";
+    url = "https://wwwlehre.dhbw-stuttgart.de/~sschulz/WORK/E_DOWNLOAD/V_${finalAttrs.version}/E.tgz";
+    hash = "sha256-B0yOX8MGJHY0HOeQ/RWtgATTIta2YnhEvSdoqIML1K4=";
  };

  buildInputs = [ which ];
@ -20,6 +20,7 @@ stdenv.mkDerivation rec {
  preConfigure = ''
    sed -e 's/ *CC *= *gcc$//' -i Makefile.vars
  '';
+
  configureFlags =
    [
      "--exec-prefix=$(out)"
@ -29,13 +30,13 @@ stdenv.mkDerivation rec {
      "--enable-ho"
    ];

-  meta = with lib; {
+  meta = {
    description = "Automated theorem prover for full first-order logic with equality";
    homepage = "http://www.eprover.org/";
-    license = licenses.gpl2;
-    maintainers = with maintainers; [
+    license = lib.licenses.gpl2;
+    maintainers = with lib.maintainers; [
      raskin
    ];
-    platforms = platforms.all;
+    platforms = lib.platforms.all;
  };
-}
+})
--- a/pkgs/applications/science/logic/z3/4-8-5-typos.diff
+++ b/pkgs/applications/science/logic/z3/4-8-5-typos.diff
@ -1,26 +0,0 @@
-diff --git a/src/util/lp/lp_core_solver_base.h b/src/util/lp/lp_core_solver_base.h
-index 4c17df2..4c3c311 100644
--- a/src/util/lp/lp_core_solver_base.h
-+++ b/src/util/lp/lp_core_solver_base.h
-@@ -600,8 +600,6 @@ public:
-            out << " \n";
-     }
- 
-    bool column_is_free(unsigned j) const { return this->m_column_type[j] == free; }
-
-     bool column_has_upper_bound(unsigned j) const {
-         switch(m_column_types[j]) {
-         case column_type::free_column:
-diff --git a/src/util/lp/static_matrix_def.h b/src/util/lp/static_matrix_def.h
-index 7949573..2f1cb42 100644
--- a/src/util/lp/static_matrix_def.h
-+++ b/src/util/lp/static_matrix_def.h
-@@ -86,7 +86,7 @@ static_matrix<T, X>::static_matrix(static_matrix const &A, unsigned * /* basis *
-     init_row_columns(m, m);
-     while (m--) {
-         for (auto & col : A.m_columns[m]){
-            set(col.var(), m, A.get_value_of_column_cell(col));
-+            set(col.var(), m, A.get_column_cell(col));
-         }
-     }
- }
--- a/pkgs/applications/science/logic/z3/default.nix
+++ b/pkgs/applications/science/logic/z3/default.nix
@ -1,216 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchpatch,
-  python,
-  fixDarwinDylibNames,
-  javaBindings ? false,
-  ocamlBindings ? false,
-  pythonBindings ? true,
-  jdk ? null,
-  ocaml ? null,
-  findlib ? null,
-  zarith ? null,
-  writeScript,
-  replaceVars,
-}:
-
-assert javaBindings -> jdk != null;
-assert ocamlBindings -> ocaml != null && findlib != null && zarith != null;
-
-let
-  common =
-    {
-      version,
-      sha256,
-      patches ? [ ],
-      tag ? "z3",
-      doCheck ? true,
-    }:
-    stdenv.mkDerivation rec {
-      pname = "z3";
-      inherit version sha256 patches;
-      src = fetchFromGitHub {
-        owner = "Z3Prover";
-        repo = "z3";
-        rev = "${tag}-${version}";
-        sha256 = sha256;
-      };
-
-      strictDeps = true;
-
-      nativeBuildInputs =
-        [ python ]
-        ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames
-        ++ lib.optional javaBindings jdk
-        ++ lib.optionals ocamlBindings [
-          ocaml
-          findlib
-        ];
-      propagatedBuildInputs = [ python.pkgs.setuptools ] ++ lib.optionals ocamlBindings [ zarith ];
-      enableParallelBuilding = true;
-
-      postPatch =
-        lib.optionalString ocamlBindings ''
-          export OCAMLFIND_DESTDIR=$ocaml/lib/ocaml/${ocaml.version}/site-lib
-          mkdir -p $OCAMLFIND_DESTDIR/stublibs
-        ''
-        +
-          lib.optionalString
-            ((lib.versionAtLeast python.version "3.12") && (lib.versionOlder version "4.8.14"))
-            ''
-              # See https://github.com/Z3Prover/z3/pull/5729. This is a specialization of this patch for 4.8.5.
-              for file in scripts/mk_util.py src/api/python/CMakeLists.txt; do
-                substituteInPlace "$file" \
-                  --replace-fail "distutils.sysconfig.get_python_lib()" "sysconfig.get_path('purelib')" \
-                  --replace-fail "distutils.sysconfig" "sysconfig"
-              done
-            '';
-
-      configurePhase =
-        lib.concatStringsSep " " (
-          [ "${python.pythonOnBuildForHost.interpreter} scripts/mk_make.py --prefix=$out" ]
-          ++ lib.optional javaBindings "--java"
-          ++ lib.optional ocamlBindings "--ml"
-          ++ lib.optional pythonBindings "--python --pypkgdir=$out/${python.sitePackages}"
-        )
-        + "\n"
-        + "cd build";
-
-      inherit doCheck;
-      checkPhase = ''
-        make -j $NIX_BUILD_CORES test
-        ./test-z3 -a
-      '';
-
-      postInstall =
-        ''
-          mkdir -p $dev $lib
-          mv $out/lib $lib/lib
-          mv $out/include $dev/include
-        ''
-        + lib.optionalString pythonBindings ''
-          mkdir -p $python/lib
-          mv $lib/lib/python* $python/lib/
-          ln -sf $lib/lib/libz3${stdenv.hostPlatform.extensions.sharedLibrary} $python/${python.sitePackages}/z3/lib/libz3${stdenv.hostPlatform.extensions.sharedLibrary}
-        ''
-        + lib.optionalString javaBindings ''
-          mkdir -p $java/share/java
-          mv com.microsoft.z3.jar $java/share/java
-          moveToOutput "lib/libz3java.${stdenv.hostPlatform.extensions.sharedLibrary}" "$java"
-        '';
-
-      doInstallCheck = true;
-      installCheckPhase = ''
-        $out/bin/z3 -version 2>&1 | grep -F "Z3 version $version"
-      '';
-
-      outputs =
-        [
-          "out"
-          "lib"
-          "dev"
-          "python"
-        ]
-        ++ lib.optional javaBindings "java"
-        ++ lib.optional ocamlBindings "ocaml";
-
-      meta = with lib; {
-        description = "High-performance theorem prover and SMT solver";
-        mainProgram = "z3";
-        homepage = "https://github.com/Z3Prover/z3";
-        changelog = "https://github.com/Z3Prover/z3/releases/tag/z3-${version}";
-        license = licenses.mit;
-        platforms = platforms.unix;
-        maintainers = with maintainers; [
-          thoughtpolice
-          ttuegel
-          numinit
-        ];
-      };
-    };
-
-  static-matrix-def-patch = fetchpatch {
-    # clang / gcc fixes. fixes typos in some member names
-    name = "gcc-15-fixes.patch";
-    url = "https://github.com/Z3Prover/z3/commit/2ce89e5f491fa817d02d8fdce8c62798beab258b.patch";
-    includes = [ "src/math/lp/static_matrix_def.h" ];
-    hash = "sha256-rEH+UzylzyhBdtx65uf8QYj5xwuXOyG6bV/4jgKkXGo=";
-  };
-
-  static-matrix-patch = fetchpatch {
-    # clang / gcc fixes. fixes typos in some member names
-    name = "gcc-15-fixes.patch";
-    url = "https://github.com/Z3Prover/z3/commit/2ce89e5f491fa817d02d8fdce8c62798beab258b.patch";
-    includes = [ "src/@dir@/lp/static_matrix.h" ];
-    stripLen = 3;
-    extraPrefix = "src/@dir@/";
-    hash = "sha256-+H1/VJPyI0yq4M/61ay8SRCa6OaoJ/5i+I3zVTAPUVo=";
-  };
-
-  # replace @dir@ in the path of the given list of patches
-  fixupPatches = dir: map (patch: replaceVars patch { inherit dir; });
-in
-{
-  z3_4_14 = common {
-    version = "4.14.1";
-    sha256 = "sha256-pTsDzf6Frk4mYAgF81wlR5Kb1x56joFggO5Fa3G2s70=";
-  };
-  z3_4_13 = common {
-    version = "4.13.4";
-    sha256 = "sha256-8hWXCr6IuNVKkOegEmWooo5jkdmln9nU7wI8T882BSE=";
-  };
-  z3_4_12 = common {
-    version = "4.12.6";
-    sha256 = "sha256-X4wfPWVSswENV0zXJp/5u9SQwGJWocLKJ/CNv57Bt+E=";
-    patches =
-      fixupPatches "math" [
-        ./lower-bound-typo.diff
-        static-matrix-patch
-      ]
-      ++ [
-        static-matrix-def-patch
-      ];
-  };
-  z3_4_11 = common {
-    version = "4.11.2";
-    sha256 = "sha256-OO0wtCvSKwGxnKvu+AfXe4mEzv4nofa7A00BjX+KVjc=";
-    patches =
-      fixupPatches "math" [
-        ./lower-bound-typo.diff
-        static-matrix-patch
-        ./tail-matrix.diff
-      ]
-      ++ [
-        static-matrix-def-patch
-      ];
-  };
-  z3_4_8 = common {
-    version = "4.8.17";
-    sha256 = "sha256-BSwjgOU9EgCcm18Zx0P9mnoPc9ZeYsJwEu0ffnACa+8=";
-    patches =
-      fixupPatches "math" [
-        ./lower-bound-typo.diff
-        static-matrix-patch
-        ./tail-matrix.diff
-      ]
-      ++ [
-        static-matrix-def-patch
-      ];
-  };
-  z3_4_8_5 = common {
-    tag = "Z3";
-    version = "4.8.5";
-    sha256 = "sha256-ytG5O9HczbIVJAiIGZfUXC/MuYH7d7yLApaeTRlKXoc=";
-    patches =
-      fixupPatches "util" [
-        ./lower-bound-typo.diff
-        static-matrix-patch
-        ./tail-matrix.diff
-      ]
-      ++ [
-        ./4-8-5-typos.diff
-      ];
-  };
-}
--- a/pkgs/applications/science/logic/z3/lower-bound-typo.diff
+++ b/pkgs/applications/science/logic/z3/lower-bound-typo.diff
@ -1,13 +0,0 @@
-diff --git a/src/@dir@/lp/column_info.h b/src/@dir@/lp/column_info.h
-index 1dc0c60..9cbeea6 100644
--- a/src/@dir@/lp/column_info.h
-+++ b/src/@dir@/lp/column_info.h
-@@ -47,7 +47,7 @@ public:
-             m_lower_bound_is_strict == c.m_lower_bound_is_strict &&
-             m_upper_bound_is_set == c.m_upper_bound_is_set&&
-             m_upper_bound_is_strict == c.m_upper_bound_is_strict&&
-            (!m_lower_bound_is_set || m_lower_bound == c.m_low_bound) &&
-+            (!m_lower_bound_is_set || m_lower_bound == c.m_lower_bound) &&
-             (!m_upper_bound_is_set || m_upper_bound == c.m_upper_bound) &&
-             m_cost == c.m_cost &&
-             m_is_fixed == c.m_is_fixed &&
--- a/pkgs/applications/science/logic/z3/tail-matrix.diff
+++ b/pkgs/applications/science/logic/z3/tail-matrix.diff
@ -1,12 +0,0 @@
-diff --git a/src/@dir@/lp/tail_matrix.h b/src/@dir@/lp/tail_matrix.h
-index 2047e8c..c84340e 100644
--- a/src/@dir@/lp/tail_matrix.h
-+++ b/src/@dir@/lp/tail_matrix.h
-@@ -43,7 +43,6 @@ public:
-         const tail_matrix & m_A;
-         unsigned m_row;
-         ref_row(const tail_matrix& m, unsigned row): m_A(m), m_row(row) {}
-        T operator[](unsigned j) const { return m_A.get_elem(m_row, j);}
-     };
-     ref_row operator[](unsigned i) const { return ref_row(*this, i);}
- };
--- a/pkgs/applications/version-management/git-machete/default.nix
+++ b/pkgs/applications/version-management/git-machete/default.nix
@ -11,13 +11,13 @@

 buildPythonApplication rec {
  pname = "git-machete";
-  version = "3.34.0";
+  version = "3.34.1";

  src = fetchFromGitHub {
    owner = "virtuslab";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-2Or4L3wrvqW7bvrJcgvK7rGqjqiob6k8CZc/XauguLo=";
+    hash = "sha256-CllaviW7pqLD9XD4oSHyW2nG4lObkPWFseXZbtkNUQI=";
  };

  nativeBuildInputs = [ installShellFiles ];
--- a/pkgs/applications/video/simplescreenrecorder/default.nix
+++ b/pkgs/applications/video/simplescreenrecorder/default.nix
@ -1,7 +1,6 @@
 {
  lib,
  stdenv,
-  mkDerivation,
  fetchFromGitHub,
  alsa-lib,
  ffmpeg,
@ -16,22 +15,24 @@
  pkg-config,
  libpulseaudio,
  libv4l,
+  pipewire,
  qtbase,
  qttools,
+  wrapQtAppsHook,
  cmake,
  ninja,
-  nix-update-script,
+  unstableGitUpdater,
 }:

-mkDerivation {
+stdenv.mkDerivation {
  pname = "simplescreenrecorder";
-  version = "0.4.4-unstable-2024-08-13";
+  version = "0.4.4-unstable-2025-01-25";

  src = fetchFromGitHub {
    owner = "MaartenBaert";
    repo = "ssr";
-    rev = "4e3ba13dd212fc4213fe0911f371bc7d34033b8d";
-    hash = "sha256-jBZkyrZOrUljWgO8U4SZOTCu3sOm83unQ7vyv+KkAuE=";
+    rev = "c50e83eea53f45eff503af58e6c86d0e928222f3";
+    hash = "sha256-pTgIooEOIYwOrSuXD0L5S7J7IsUIyzRuEX2ZziiIiAM=";
  };

  cmakeFlags = [
@ -52,7 +53,9 @@ mkDerivation {
    pkg-config
    cmake
    ninja
+    wrapQtAppsHook
  ];
+
  buildInputs = [
    alsa-lib
    ffmpeg
@ -65,12 +68,13 @@ mkDerivation {
    libGL
    libpulseaudio
    libv4l
+    pipewire
    qtbase
    qttools
    qtx11extras
  ];

-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = unstableGitUpdater { };

  meta = with lib; {
    description = "Screen recorder for Linux";
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@ -37,6 +37,9 @@ lib.extendMkDerivation {
          "buildGoModule: vendorHash is missing"
      ),

+      # The go.sum file to track which can cause rebuilds.
+      goSum ? null,
+
      # Whether to delete the vendor folder supplied with the source.
      deleteVendor ? false,

@ -69,13 +72,24 @@ lib.extendMkDerivation {
        vendorHash
        deleteVendor
        proxyVendor
+        goSum
        ;
      goModules =
        if (finalAttrs.vendorHash == null) then
          ""
        else
          (stdenv.mkDerivation {
-            name = "${finalAttrs.name or "${finalAttrs.pname}-${finalAttrs.version}"}-go-modules";
+            name =
+              let
+                prefix = "${finalAttrs.name or "${finalAttrs.pname}-${finalAttrs.version}"}-";
+
+                # If "goSum" is supplied then it can cause "goModules" to rebuild.
+                # Attach the hash name of the "go.sum" file so we can rebuild when it changes.
+                suffix = lib.optionalString (
+                  finalAttrs.goSum != null
+                ) "-${(lib.removeSuffix "-go.sum" (lib.removePrefix "${builtins.storeDir}/" finalAttrs.goSum))}";
+              in
+              "${prefix}go-modules${suffix}";

            nativeBuildInputs = (finalAttrs.nativeBuildInputs or [ ]) ++ [
              go
@ -83,7 +97,7 @@ lib.extendMkDerivation {
              cacert
            ];

-            inherit (finalAttrs) src modRoot;
+            inherit (finalAttrs) src modRoot goSum;

            # The following inheritance behavior is not trivial to expect, and some may
            # argue it's not ideal. Changing it may break vendor hashes in Nixpkgs and
--- a/pkgs/build-support/substitute-files/substitute-all-files.nix
+++ b/pkgs/build-support/substitute-files/substitute-all-files.nix
@ -2,7 +2,11 @@

 args:

-stdenv.mkDerivation (
+# TODO(@wolfgangwalther): Remove substituteAllFiles after 25.05 branch-off.
+lib.warn
+  "substituteAllFiles is deprecated and will be removed in 25.11. Use replaceVars for each file instead."
+  (
+    stdenv.mkDerivation (
      {
        name = if args ? name then args.name else baseNameOf (toString args.src);
        builder = builtins.toFile "builder.sh" ''
@ -25,4 +29,5 @@ stdenv.mkDerivation (
        allowSubstitutes = false;
      }
      // args
-)
+    )
+  )
--- a/pkgs/build-support/substitute/substitute-all.nix
+++ b/pkgs/build-support/substitute/substitute-all.nix
@ -6,7 +6,9 @@ let
  isInvalidArgName = x: builtins.match "^[a-z][a-zA-Z0-9_]*$" x == null;
  invalidArgs = builtins.filter isInvalidArgName (builtins.attrNames args);
 in
-if invalidArgs == [ ] then
+# TODO(@wolfgangwalther): Remove substituteAll, the nix function, after 25.05 branch-off.
+lib.warn "substituteAll is deprecated and will be removed in 25.11. Use replaceVars instead." (
+  if invalidArgs == [ ] then
    stdenvNoCC.mkDerivation (
      {
        name = if args ? name then args.name else baseNameOf (toString args.src);
@ -17,10 +19,11 @@ if invalidArgs == [ ] then
      }
      // args
    )
-else
+  else
    throw ''
      Argument names for `pkgs.substituteAll` must:
        - start with a lower case ASCII letter
        - only contain ASCII letters, digits and underscores
      Found invalid argument names: ${lib.concatStringsSep ", " invalidArgs}.
    ''
+)
--- a/pkgs/by-name/aa/aaaaxy/package.nix
+++ b/pkgs/by-name/aa/aaaaxy/package.nix
@ -22,17 +22,17 @@

 buildGoModule rec {
  pname = "aaaaxy";
-  version = "1.6.64";
+  version = "1.6.176";

  src = fetchFromGitHub {
    owner = "divVerent";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-0geit1ZDsNOPhpdmOeT1xSnQ3oitMiMY14zoGG8hsGU=";
+    hash = "sha256-LukI+FgM2gtKp2/3ySJ0FT6lTlBYTh400GFC5NK7S8I=";
    fetchSubmodules = true;
  };

-  vendorHash = "sha256-1osdAkUMmkBoLpKhoESUh2URMi3OYhLfRs+N9fDnnKQ=";
+  vendorHash = "sha256-bw2Zk4vHzVaXdKwYJF+DkfJefxJlZKlFlh5LGcgkZBY=";

  buildInputs = [
    alsa-lib
--- a/pkgs/by-name/ag/age-plugin-se/package.nix
+++ b/pkgs/by-name/ag/age-plugin-se/package.nix
@ -0,0 +1,63 @@
+{
+  lib,
+  fetchFromGitHub,
+  swiftPackages,
+  swift,
+  swiftpm,
+  nix-update-script,
+}:
+let
+  inherit (swiftPackages) stdenv;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "age-plugin-se";
+  version = "0.1.4";
+
+  src = fetchFromGitHub {
+    owner = "remko";
+    repo = "age-plugin-se";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-sg73DzlW4aXNbIIePZox4JkF10OfsMtPw0q/0DWwgDk=";
+  };
+
+  nativeBuildInputs = [
+    swift
+    swiftpm
+  ];
+
+  postPatch =
+    let
+      swift-crypto = fetchFromGitHub {
+        owner = "apple";
+        repo = "swift-crypto";
+        # FIXME: Update to a newer version once https://github.com/NixOS/nixpkgs/issues/343210 is fixed
+        # This is the last version to support swift tools 5.8 which is newest version supported by nixpkgs:
+        # https://github.com/apple/swift-crypto/commit/35703579f63c2518fc929a1ce49805ba6134137c
+        tag = "3.7.1";
+        hash = "sha256-zxmHxTryAezgqU5qjXlFFThJlfUsPxb1KRBan4DSm9A=";
+      };
+    in
+    ''
+      ln -s ${swift-crypto} swift-crypto
+      substituteInPlace Package.swift --replace-fail 'url: "https://github.com/apple/swift-crypto.git"' 'path: "./swift-crypto"), //'
+    '';
+
+  makeFlags = [
+    "PREFIX=$(out)"
+    "RELEASE=1"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Age plugin for Apple's Secure Enclave";
+    homepage = "https://github.com/remko/age-plugin-se/";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      onnimonni
+      remko
+    ];
+    mainProgram = "age-plugin-se";
+    platforms = lib.platforms.darwin;
+  };
+})
--- a/pkgs/by-name/ag/age/package.nix
+++ b/pkgs/by-name/ag/age/package.nix
@ -4,6 +4,7 @@
  fetchFromGitHub,
  installShellFiles,
  age-plugin-tpm,
+  age-plugin-se,
  age-plugin-sss,
  age-plugin-ledger,
  age-plugin-yubikey,
@ -59,6 +60,7 @@ buildGoModule (final: {
  passthru.plugins = {
    inherit
      age-plugin-tpm
+      age-plugin-se
      age-plugin-sss
      age-plugin-ledger
      age-plugin-yubikey
--- a/pkgs/by-name/al/all-the-package-names/package.nix
+++ b/pkgs/by-name/al/all-the-package-names/package.nix
@ -7,16 +7,16 @@

 buildNpmPackage rec {
  pname = "all-the-package-names";
-  version = "2.0.2129";
+  version = "2.0.2137";

  src = fetchFromGitHub {
    owner = "nice-registry";
    repo = "all-the-package-names";
    tag = "v${version}";
-    hash = "sha256-aq4WxaeMprw9ohcwd9HuiWq5GUpW6dI3FSudMyUo6Fg=";
+    hash = "sha256-1HabSjZUHjPWkKZc+Xeh11bzb6ycQ1V7GS/XGycFoKc=";
  };

-  npmDepsHash = "sha256-WM2FO/qsDcXaV/2oqBlRGXc+VHaPUxFVg1DF6F0iGso=";
+  npmDepsHash = "sha256-zSGpKDcmBYod81wCeoSzOqse1zSao4aURngh55wq6CA=";

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/al/allure/package.nix
+++ b/pkgs/by-name/al/allure/package.nix
@ -8,11 +8,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "allure";
-  version = "2.33.0";
+  version = "2.34.0";

  src = fetchurl {
    url = "https://github.com/allure-framework/allure2/releases/download/${finalAttrs.version}/allure-${finalAttrs.version}.tgz";
-    hash = "sha256-ZRAvIBF89LFYWfmO/bPqL85/XQ9l0TRGOs/uQ9no7tA=";
+    hash = "sha256-1R4x8LjUv4ZQXfFeJ1HkHml3sRLhb1tRV3UqApVEo7U=";
  };

  dontConfigure = true;
--- a/pkgs/by-name/an/angryoxide/package.nix
+++ b/pkgs/by-name/an/angryoxide/package.nix
@ -0,0 +1,59 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  libxkbcommon,
+  sqlite,
+  zlib,
+  wayland,
+}:
+
+let
+  libwifi = fetchFromGitHub {
+    owner = "Ragnt";
+    repo = "libwifi";
+    rev = "71268e1898ad88b8b5d709e186836db417b33e81";
+    hash = "sha256-2X/TZyLX9Tb54c6Sdla4bsWdq05NU72MVSuPvNfxySk=";
+  };
+in
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "angryoxide";
+  version = "0.8.32";
+
+  src = fetchFromGitHub {
+    owner = "Ragnt";
+    repo = "AngryOxide";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Sla5lvyqZho9JE4QVS9r0fx5+DVlU90c8OSfO4/f0B4=";
+  };
+
+  postPatch = ''
+    rm -r libs/libwifi
+    ln -s ${libwifi} libs/libwifi
+  '';
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-mry4l0a7DZOWkrChU40OVRCBjKwI39cyZtvEBA5tro0=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    libxkbcommon
+    sqlite
+    wayland
+    zlib
+  ];
+
+  meta = {
+    description = "802.11 Attack Tool";
+    changelog = "https://github.com/Ragnt/AngryOxide/releases/tag/v${finalAttrs.version}";
+    homepage = "https://github.com/Ragnt/AngryOxide/";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ fvckgrimm ];
+    mainProgram = "angryoxide";
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/an/anydesk/package.nix
+++ b/pkgs/by-name/an/anydesk/package.nix
@ -34,14 +34,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "anydesk";
-  version = "6.4.2";
+  version = "6.4.3";

  src = fetchurl {
    urls = [
      "https://download.anydesk.com/linux/anydesk-${finalAttrs.version}-amd64.tar.gz"
      "https://download.anydesk.com/linux/generic-linux/anydesk-${finalAttrs.version}-amd64.tar.gz"
    ];
-    hash = "sha256-KJTyIMuKNLymD/DsitN+Rgro7lgkY13fmkFNxsEUkWU=";
+    hash = "sha256-P90BPUayKG+uYszIQkbYcBg1vObQvueq67HU+su+GSI=";
  };

  buildInputs =
--- a/pkgs/by-name/ar/ares-cli/package.nix
+++ b/pkgs/by-name/ar/ares-cli/package.nix
@ -6,12 +6,12 @@
 }:
 buildNpmPackage rec {
  pname = "ares-cli";
-  version = "3.2.0";
+  version = "3.2.1";
  src = fetchFromGitHub {
    owner = "webos-tools";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-tSnmIDDDEhhQBrjZ5bujmCaYpetTjpdCGUjKomue+Bc=";
+    hash = "sha256-L8suZDtXVchVyvp7KCv0UaceJqqGBdfopd5tZzwj3MY=";
  };

  postPatch = ''
@ -19,7 +19,7 @@ buildNpmPackage rec {
  '';

  dontNpmBuild = true;
-  npmDepsHash = "sha256-eTuAi+32pK8rGQ5UDWesDFvlkjWj/ERevD+aYXYYr0Q=";
+  npmDepsHash = "sha256-ATIxe/sulfOpz5KiWauDAPZrlfUOFyiTa+5ECFbVd+0=";

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/ar/argocd/package.nix
+++ b/pkgs/by-name/ar/argocd/package.nix
@ -8,17 +8,17 @@

 buildGoModule rec {
  pname = "argocd";
-  version = "2.14.9";
+  version = "2.14.10";

  src = fetchFromGitHub {
    owner = "argoproj";
    repo = "argo-cd";
    rev = "v${version}";
-    hash = "sha256-L8ipYgMpL6IhPh/fSanNywzUMDJQfMZc7pyYr2dtbAw=";
+    hash = "sha256-Z+xSA0LrvXHHmNg7+i53Y1mSYnLYURZUglXRKvkld14=";
  };

  proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-j+uwLG9/r9dlK9JWrQmJdgBOqgZs/aIvkh1Sg81dm1I=";
+  vendorHash = "sha256-Xm9J08pxzm3fPQjMA6NDu+DPJGsvtUvj+n/qrOZ9BE4=";

  # Set target as ./cmd per cli-local
  # https://github.com/argoproj/argo-cd/blob/master/Makefile#L227
--- a/pkgs/by-name/at/atasm/package.nix
+++ b/pkgs/by-name/at/atasm/package.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "atasm";
-  version = "1.26";
+  version = "1.27";

  src = fetchFromGitHub {
    owner = "CycoPH";
    repo = "atasm";
    rev = "V${version}";
-    hash = "sha256-W9I1Wf2IVBy2l+jyrAOmlpO59uZM1SkBLuNcu2fXI1M=";
+    hash = "sha256-owr0mqib3zXMYcYliseCIkHp41nevpIPCC6nTqouAkA=";
  };

  makefile = "Makefile";
--- a/pkgs/by-name/ba/bandcamp-collection-downloader/deps.json
+++ b/pkgs/by-name/ba/bandcamp-collection-downloader/deps.json
@ -0,0 +1,340 @@
+{
+ "!comment": "This is a nixpkgs Gradle dependency lockfile. For more details, refer to the Gradle section in the nixpkgs manual.",
+ "!version": 1,
+ "https://plugins.gradle.org/m2": {
+  "com/google/code/gson#gson-parent/2.8.9": {
+   "pom": "sha256-sW4CbmNCfBlyrQ/GhwPsN5sVduQRuknDL6mjGrC7z/s="
+  },
+  "com/google/code/gson#gson/2.8.9": {
+   "jar": "sha256-05mSkYVd5JXJTHQ3YbirUXbP6r4oGlqw2OjUUyb9cD4=",
+   "pom": "sha256-r97W5qaQ+/OtSuZa2jl/CpCl9jCzA9G3QbnJeSb91N4="
+  },
+  "org/jetbrains/intellij/deps#trove4j/1.0.20200330": {
+   "jar": "sha256-xf1yW/+rUYRr88d9sTg8YKquv+G3/i8A0j/ht98KQ50=",
+   "pom": "sha256-h3IcuqZaPJfYsbqdIHhA8WTJ/jh1n8nqEP/iZWX40+k="
+  },
+  "org/jetbrains/kotlin#kotlin-build-statistics/2.0.21": {
+   "jar": "sha256-gBILdN8DYz1veeCIZBMe7jt6dIb2wF0vLtyGg3U8VNo=",
+   "pom": "sha256-/iTcYG/sg+yY3Qi8i7HPmeVAXejpF8URnVoMt++sVZ0="
+  },
+  "org/jetbrains/kotlin#kotlin-build-tools-api/2.0.21": {
+   "jar": "sha256-j8orSvbEzyRWXZp/ZMMXhIlRjQSeEGmB22cY7yLK4Y4=",
+   "pom": "sha256-zL2XaTA2Y0gWKVGY5JRFNPr7c9d4+M1NQ588h7CQ9JQ="
+  },
+  "org/jetbrains/kotlin#kotlin-compiler-embeddable/2.0.21": {
+   "jar": "sha256-n6jN0d4NzP/hVMmX1CPsa19TzW2Rd+OnepsN4D+xvIE=",
+   "pom": "sha256-vUZWpG7EGCUuW8Xhwg6yAp+yqODjzJTu3frH6HyM1bY="
+  },
+  "org/jetbrains/kotlin#kotlin-compiler-runner/2.0.21": {
+   "jar": "sha256-COYFvoEGD/YS0K65QFihm8SsmWJcNcRhxsCzAlYOkQQ=",
+   "pom": "sha256-+Wdq1JVBFLgc39CR6bW0J7xkkc+pRIRmjWU9TRkCPm0="
+  },
+  "org/jetbrains/kotlin#kotlin-daemon-client/2.0.21": {
+   "jar": "sha256-Nx6gjk8DaILMjgZP/PZEWZDfREKVuh7GiSjnzCtbwBU=",
+   "pom": "sha256-8oY4JGtQVSC/6TXxXz7POeS6VSb6RcjzKsfeejEjdAA="
+  },
+  "org/jetbrains/kotlin#kotlin-daemon-embeddable/2.0.21": {
+   "jar": "sha256-saCnPFAi+N0FpjjGt2sr1zYYGKHzhg/yZEEzsd0r2wM=",
+   "pom": "sha256-jbZ7QN1gJaLtBpKU8sm8+2uW2zFZz+927deEHCZq+/A="
+  },
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-annotations/2.0.21": {
+   "jar": "sha256-W0cHoy5GfvvhIsMY/2q9yhei/H2Mg/ZgN8mhILbcvC8=",
+   "pom": "sha256-P+CLlUN7C074sWt39hqImzn1xGt+lx1N+63mbUQOodg="
+  },
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.0.21": {
+   "jar": "sha256-Uur1LOMDtSneZ6vDusE+TxNZY1dUPfqDHE1y0tYxDlA=",
+   "module": "sha256-z29dNExVVVS/rGQFHq0AhcvUM4Z2uqP8h7UD6eSrvjQ=",
+   "pom": "sha256-gV5yqZ4ZFD1mLSTkYlKlnOdWMC18W9/FlIF9fMexI3g="
+  },
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea-proto/2.0.21": {
+   "jar": "sha256-UzVXQrV7qOFvvfCiBDn4s0UnYHHtsUTns9puYL42MYg=",
+   "pom": "sha256-OMyaLLf55K/UOcMQdvgzFThIsfftITMgCDXRtCDfbqs="
+  },
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea/2.0.21": {
+   "jar": "sha256-wfTqDBkmfx7tR0tUGwdxXEkWes+/AnqKL9B8u8gbjnI=",
+   "module": "sha256-YqcNAg27B4BkexFVGIBHE+Z2BkBa6XoQ2P2jgpOI0Uk=",
+   "pom": "sha256-1GjmNf3dsw9EQEuFixCyfcVm6Z1bVIusEMIjOp7OF74="
+  },
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-model/2.0.21": {
+   "jar": "sha256-lR13mJs1cAljH/HvsSsBYczzKcUpxUalKfih0x+bwDw=",
+   "module": "sha256-6qn9n4b71E/2BwoZfce90ZgPDUHo20myUoA9A6pMVaw=",
+   "pom": "sha256-5RVeYOyr2v1kUmVKaYALyyp37n0fxucH+tOo5p8HTCw="
+  },
+  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.0.21": {
+   "module": "sha256-D5iXoGwHo+h9ZHExzDSQofctGuVMEH8T9yJp1TRLCHo=",
+   "pom": "sha256-RenM7OM+TY36mUHMkS81RYIBqdPwQ3IMMket3lf0f/Y="
+  },
+  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.0.21/gradle85": {
+   "jar": "sha256-nfXH/xOx/GislFDKY8UxEYkdb2R73ewPQ5iz5yJb9tk="
+  },
+  "org/jetbrains/kotlin#kotlin-gradle-plugins-bom/2.0.21": {
+   "module": "sha256-8JRUh/5RlZ/fi2oUQXB6Ke1fGsMaIxx/3r4sPd0i/fE=",
+   "pom": "sha256-Z1AT1Mvu4JyIkgriuiRvmfKKeJuHT2NASeAS+j7r9Mg="
+  },
+  "org/jetbrains/kotlin#kotlin-klib-commonizer-api/2.0.21": {
+   "jar": "sha256-R1eJEWW2mPvazo9NpvK8DpiOrvnvNnE1SIZajycGmv0=",
+   "pom": "sha256-Y/6HvSI1sSlAnHIqCbYsIKe3eueQGeIgMSSK9zawPFQ="
+  },
+  "org/jetbrains/kotlin#kotlin-native-utils/2.0.21": {
+   "jar": "sha256-ResIo5Kfl8SKkpEsliV3nRVAvG8/IS+56UYg0DJrzAA=",
+   "pom": "sha256-ZpB3PnZJ0dD61V0GCaTiHh68mF3Q+iYenG/9OJhnBh0="
+  },
+  "org/jetbrains/kotlin#kotlin-tooling-core/2.0.21": {
+   "jar": "sha256-W28UhUj+ngdN9R9CJTREM78DdaxbOf/NPXvX1/YC1ik=",
+   "pom": "sha256-MiVe/o/PESl703OozHf4sYXXOYTpGxieeRZlKb36XVo="
+  },
+  "org/jetbrains/kotlin#kotlin-util-io/2.0.21": {
+   "jar": "sha256-Dv7kwg8+f5ErMceWxOR/nRTqaIA+x+1OXU8kJY46ph4=",
+   "pom": "sha256-4gD5F2fbCFJsjZSt3OB7kPNCVBSwTs/XzPjkHJ8QmKA="
+  },
+  "org/jetbrains/kotlin#kotlin-util-klib/2.0.21": {
+   "jar": "sha256-oTtziWVUtI5L702KRjDqfpQBSaxMrcysBpFGORRlSeo=",
+   "pom": "sha256-724nWZiUO5b1imSWQIUyDxAxdNYJ7GakqUnmASPHmPU="
+  },
+  "org/jetbrains/kotlin/jvm#org.jetbrains.kotlin.jvm.gradle.plugin/2.0.21": {
+   "pom": "sha256-Jk8V5sp1XIU/oPWvEPa9GgHwmLKsDPmOHP05kBF/tjo="
+  },
+  "org/jetbrains/kotlinx#kotlinx-coroutines-bom/1.6.4": {
+   "pom": "sha256-qyYUhV+6ZqqKQlFNvj1aiEMV/+HtY/WTLnEKgAYkXOE="
+  },
+  "org/jetbrains/kotlinx#kotlinx-coroutines-core-jvm/1.6.4": {
+   "jar": "sha256-wkyLsnuzIMSpOHFQGn5eDGFgdjiQexl672dVE9TIIL4=",
+   "module": "sha256-DZTIpBSD58Jwfr1pPhsTV6hBUpmM6FVQ67xUykMho6c=",
+   "pom": "sha256-Cdlg+FkikDwuUuEmsX6fpQILQlxGnsYZRLPAGDVUciQ="
+  },
+  "org/sonatype/oss#oss-parent/7": {
+   "pom": "sha256-tR+IZ8kranIkmVV/w6H96ne9+e9XRyL+kM5DailVlFQ="
+  }
+ },
+ "https://repo.maven.apache.org/maven2": {
+  "com/google/code/gson#gson-parent/2.11.0": {
+   "pom": "sha256-issfO3Km8CaRasBzW62aqwKT1Sftt7NlMn3vE6k2e3o="
+  },
+  "com/google/code/gson#gson/2.11.0": {
+   "jar": "sha256-V5KNblpu3rKr03cKj5W6RNzkXzsjt6ncKzCcWBVSp4s=",
+   "pom": "sha256-wOVHvqmYiI5uJcWIapDnYicryItSdTQ90sBd7Wyi42A="
+  },
+  "com/google/errorprone#error_prone_annotations/2.27.0": {
+   "jar": "sha256-JMkjNyxY410LnxagKJKbua7cd1IYZ8J08r0HNd9bofU=",
+   "pom": "sha256-TKWjXWEjXhZUmsNG0eNFUc3w/ifoSqV+A8vrJV6k5do="
+  },
+  "com/google/errorprone#error_prone_parent/2.27.0": {
+   "pom": "sha256-+oGCnQSVWd9pJ/nJpv1rvQn4tQ5tRzaucsgwC2w9dlQ="
+  },
+  "com/sun/mail#all/1.6.2": {
+   "pom": "sha256-S36Dqpt31l4AfpfLUPm4nNt1T6rxZBHl/ZTR49q3brM="
+  },
+  "com/sun/mail#javax.mail/1.6.2": {
+   "jar": "sha256-RbUV5xBJRMCeRbnHuxzl3/ZASGN0hS3SsugMw3Ut+hE=",
+   "pom": "sha256-xCKcBbWDbwAlITY9NDXz0HJmJ0RUi/F+fnreyv5ouf0="
+  },
+  "info/picocli#picocli/4.6.1": {
+   "jar": "sha256-Km4DMQ2xSfihHrBYqnjndcIp74FjM8loc3l2LSKDOtY=",
+   "pom": "sha256-sQOC7VBz9mKP84EayWFEkbHv8wLDz55Cmo81P2w75M8="
+  },
+  "javax/activation#activation/1.1": {
+   "jar": "sha256-KIHHnJ1u8BxY5ivuoT6dGsi4uqFvL8GYrW5ndt79zdM=",
+   "pom": "sha256-1JDlQKEVBLnXFxixyF/vez3mgCNhKQgkU5sHbVj6qKA="
+  },
+  "net/java#jvnet-parent/1": {
+   "pom": "sha256-KBRAgRJo5l2eJms8yJgpfiFOBPCXQNA4bO60qJI9Y78="
+  },
+  "org/apiguardian#apiguardian-api/1.1.2": {
+   "jar": "sha256-tQlEisUG1gcxnxglN/CzXXEAdYLsdBgyofER5bW3Czg=",
+   "module": "sha256-4IAoExN1s1fR0oc06aT7QhbahLJAZByz7358fWKCI/w=",
+   "pom": "sha256-MjVQgdEJCVw9XTdNWkO09MG3XVSemD71ByPidy5TAqA="
+  },
+  "org/ini4j#ini4j/0.5.4": {
+   "jar": "sha256-qtYGNe7lZyVO0p8Y+xjA+eTE2s9RyCKRKCAxg7s14t0=",
+   "pom": "sha256-XMYUkRJoPvybUbn9k3h307NQPfboBdMHHOTbOb41mY8="
+  },
+  "org/jetbrains#annotations/13.0": {
+   "jar": "sha256-rOKhDcji1f00kl7KwD5JiLLA+FFlDJS4zvSbob0RFHg=",
+   "pom": "sha256-llrrK+3/NpgZvd4b96CzuJuCR91pyIuGN112Fju4w5c="
+  },
+  "org/jetbrains/intellij/deps#trove4j/1.0.20200330": {
+   "jar": "sha256-xf1yW/+rUYRr88d9sTg8YKquv+G3/i8A0j/ht98KQ50=",
+   "pom": "sha256-h3IcuqZaPJfYsbqdIHhA8WTJ/jh1n8nqEP/iZWX40+k="
+  },
+  "org/jetbrains/kotlin#kotlin-build-common/2.0.21": {
+   "jar": "sha256-cLmHScMJc9O3YhCL37mROSB4swhzCKzTwa0zqg9GIV0=",
+   "pom": "sha256-qNP7huk2cgYkCh2+6LMBCteRP+oY+9Rtv2EB+Yvj4V0="
+  },
+  "org/jetbrains/kotlin#kotlin-build-tools-api/2.0.21": {
+   "jar": "sha256-j8orSvbEzyRWXZp/ZMMXhIlRjQSeEGmB22cY7yLK4Y4=",
+   "pom": "sha256-zL2XaTA2Y0gWKVGY5JRFNPr7c9d4+M1NQ588h7CQ9JQ="
+  },
+  "org/jetbrains/kotlin#kotlin-build-tools-impl/2.0.21": {
+   "jar": "sha256-um6iTa7URxf1AwcqkcWbDafpyvAAK9DsG+dzKUwSfcs=",
+   "pom": "sha256-epPI22tqqFtPyvD0jKcBa5qEzSOWoGUreumt52eaTkE="
+  },
+  "org/jetbrains/kotlin#kotlin-compiler-embeddable/2.0.21": {
+   "jar": "sha256-n6jN0d4NzP/hVMmX1CPsa19TzW2Rd+OnepsN4D+xvIE=",
+   "pom": "sha256-vUZWpG7EGCUuW8Xhwg6yAp+yqODjzJTu3frH6HyM1bY="
+  },
+  "org/jetbrains/kotlin#kotlin-compiler-runner/2.0.21": {
+   "jar": "sha256-COYFvoEGD/YS0K65QFihm8SsmWJcNcRhxsCzAlYOkQQ=",
+   "pom": "sha256-+Wdq1JVBFLgc39CR6bW0J7xkkc+pRIRmjWU9TRkCPm0="
+  },
+  "org/jetbrains/kotlin#kotlin-daemon-client/2.0.21": {
+   "jar": "sha256-Nx6gjk8DaILMjgZP/PZEWZDfREKVuh7GiSjnzCtbwBU=",
+   "pom": "sha256-8oY4JGtQVSC/6TXxXz7POeS6VSb6RcjzKsfeejEjdAA="
+  },
+  "org/jetbrains/kotlin#kotlin-daemon-embeddable/2.0.21": {
+   "jar": "sha256-saCnPFAi+N0FpjjGt2sr1zYYGKHzhg/yZEEzsd0r2wM=",
+   "pom": "sha256-jbZ7QN1gJaLtBpKU8sm8+2uW2zFZz+927deEHCZq+/A="
+  },
+  "org/jetbrains/kotlin#kotlin-klib-commonizer-embeddable/2.0.21": {
+   "jar": "sha256-2Gv0M4pthBzM37v/LaBb0DpJw9uMP5erhed+AhrQhFs=",
+   "pom": "sha256-esgfO7B8TWqo+pj/WjmaR6vRzhx4bU8/rZbvKBIL34o="
+  },
+  "org/jetbrains/kotlin#kotlin-native-prebuilt/2.0.21": {
+   "pom": "sha256-Gv4wJE4ZR67Wy+01BBrTbFnw6nZK/bxv/56agY7loEE="
+  },
+  "org/jetbrains/kotlin#kotlin-reflect/1.6.10": {
+   "jar": "sha256-MnesECrheq0QpVq+x1/1aWyNEJeQOWQ0tJbnUIeFQgM=",
+   "pom": "sha256-V5BVJCdKAK4CiqzMJyg/a8WSWpNKBGwcxdBsjuTW1ak="
+  },
+  "org/jetbrains/kotlin#kotlin-script-runtime/2.0.21": {
+   "jar": "sha256-nBEfjQit5FVWYnLVYZIa3CsstrekzO442YKcXjocpqM=",
+   "pom": "sha256-lbLpKa+hBxvZUv0Tey5+gdBP4bu4G3V+vtBrIW5aRSQ="
+  },
+  "org/jetbrains/kotlin#kotlin-scripting-common/2.0.21": {
+   "jar": "sha256-+H3rKxTQaPmcuhghfYCvhUgcApxzGthwRFjprdnKIPg=",
+   "pom": "sha256-hP6ezqjlV+/6iFbJAhMlrWPCHZ0TEh6q6xGZ9qZYZXU="
+  },
+  "org/jetbrains/kotlin#kotlin-scripting-compiler-embeddable/2.0.21": {
+   "jar": "sha256-JBPCMP3YzUfrvronPk35TPO0TLPsldLLNUcsk3aMnxw=",
+   "pom": "sha256-1Ch6fUD4+Birv3zJhH5/OSeC0Ufb7WqEQORzvE9r8ug="
+  },
+  "org/jetbrains/kotlin#kotlin-scripting-compiler-impl-embeddable/2.0.21": {
+   "jar": "sha256-btD6W+slRmiDmJtWQfNoCUeSYLcBRTVQL9OHzmx7qDM=",
+   "pom": "sha256-0ysb8kupKaL6MqbjRDIPp7nnvgbON/z3bvOm3ITiNrE="
+  },
+  "org/jetbrains/kotlin#kotlin-scripting-jvm/2.0.21": {
+   "jar": "sha256-iEJ/D3pMR4RfoiIdKfbg4NfL5zw+34vKMLTYs6M2p3w=",
+   "pom": "sha256-opCFi++0KZc09RtT7ZqUFaKU55um/CE8BMQnzch5nA0="
+  },
+  "org/jetbrains/kotlin#kotlin-stdlib/2.0.21": {
+   "jar": "sha256-8xzFPxBafkjAk2g7vVQ3Vh0SM5IFE3dLRwgFZBvtvAk=",
+   "module": "sha256-gf1tGBASSH7jJG7/TiustktYxG5bWqcpcaTd8b0VQe0=",
+   "pom": "sha256-/LraTNLp85ZYKTVw72E3UjMdtp/R2tHKuqYFSEA+F9o="
+  },
+  "org/jetbrains/kotlin#kotlin-stdlib/2.0.21/all": {
+   "jar": "sha256-UP+t6yC00kVqUmWVpPep6FiJaCcVBz5s26Gx2A461Fg="
+  },
+  "org/jetbrains/kotlin#kotlin-test-junit5/2.0.21": {
+   "jar": "sha256-rEfeYZt9h+K/339u7Gpiph0b3AwyV0DfUhhrFBk2cT0=",
+   "module": "sha256-pJ3WSbaBmpF2wNksgkT2sD6Q4xvXpTO3oJGsud6wleQ=",
+   "pom": "sha256-rdbbLWF1KU0hNI3eEMyqHeUWNT9uQHp24FNbS1RcJ30="
+  },
+  "org/jetbrains/kotlin#kotlin-test/2.0.21": {
+   "jar": "sha256-qJeyjGo+qOyPAO12aUGgwN+ZPX9lkIh1h5ho4IzriYU=",
+   "module": "sha256-1GaHPese5eDSFPdNDVC5BCGQZV+eUBRW/Qk72SCkL40=",
+   "pom": "sha256-6jadb0j7+WeUIXBPuf9tTM4mA3iZUKl8pd5bLsH5c4o="
+  },
+  "org/jetbrains/kotlin#kotlin-test/2.0.21/all": {
+   "jar": "sha256-2iho+pWj+4814rTjMcouKTIUhnAZZex2a66CD5jgJ3w="
+  },
+  "org/jetbrains/kotlin/kotlin-native-prebuilt/2.0.21/kotlin-native-prebuilt-2.0.21-linux-x86_64": {
+   "tar.gz": "sha256-8SXMZFcnRldupsPfHmVklSr9dpJcJNdc/4X4zdRG/ls="
+  },
+  "org/jetbrains/kotlinx#kotlinx-coroutines-bom/1.6.4": {
+   "pom": "sha256-qyYUhV+6ZqqKQlFNvj1aiEMV/+HtY/WTLnEKgAYkXOE="
+  },
+  "org/jetbrains/kotlinx#kotlinx-coroutines-core-jvm/1.6.4": {
+   "jar": "sha256-wkyLsnuzIMSpOHFQGn5eDGFgdjiQexl672dVE9TIIL4=",
+   "module": "sha256-DZTIpBSD58Jwfr1pPhsTV6hBUpmM6FVQ67xUykMho6c=",
+   "pom": "sha256-Cdlg+FkikDwuUuEmsX6fpQILQlxGnsYZRLPAGDVUciQ="
+  },
+  "org/jsoup#jsoup/1.18.1": {
+   "jar": "sha256-O7Ww7AKZir5FpR83185nwwaLTM1KtjyWWSnsUHTWTpE=",
+   "pom": "sha256-xN46hPu17vS9IpjW3pgcbNlyKHlQXINz4bZ/EdHK8n0="
+  },
+  "org/junit#junit-bom/5.10.1": {
+   "module": "sha256-IbCvz//i7LN3D16wCuehn+rulOdx+jkYFzhQ2ueAZ7c=",
+   "pom": "sha256-IcSwKG9LIAaVd/9LIJeKhcEArIpGtvHIZy+6qzN7w/I="
+  },
+  "org/junit#junit-bom/5.8.1": {
+   "module": "sha256-a4LLpSoTSxPBmC8M+WIsbUhTcdQLmJJG8xJOOwpbGFQ=",
+   "pom": "sha256-733Ef45KFoZPR3lyjofteFOYGeT7iSdoqdprjvkD+GM="
+  },
+  "org/junit/jupiter#junit-jupiter-api/5.10.1": {
+   "jar": "sha256-YNXDmMMtxwObmSglFK1gZAYdhBfPlZofa9IDjMkHyRM=",
+   "module": "sha256-+H9zEVSfSf4k5igqEWXpB+AXqR6XnK2r/fm/VMP3EG8=",
+   "pom": "sha256-PK9ZSxPa5xB1EN2Zj02en6J3MFzcohMh/dWRmdyHzz0="
+  },
+  "org/junit/jupiter#junit-jupiter-api/5.8.1": {
+   "jar": "sha256-zjN0p++6YF4tK2mj/vkBNAMrqz7MPthXmkhxscLEcpw=",
+   "module": "sha256-DWnbwja33Kq0ynNpqlYOmwqbvvf5WIgv+0hTPLunwJ0=",
+   "pom": "sha256-d61+1KYwutH8h0agpuZ1wj+2lAsnq2LMyzTk/Pz+Ob8="
+  },
+  "org/junit/jupiter#junit-jupiter-engine/5.10.1": {
+   "jar": "sha256-ApMN/klfk/5wsmVQrOOij34bkAyEQmwuRibOAgxygtY=",
+   "module": "sha256-VBIeWCzLLUYl7J+lRnlDbJA/oFPHQJe75F/fud22f7g=",
+   "pom": "sha256-MHCG3F5wjLdZAQhoXAQOCOCK3g7UlUkwsvM8BttT6l4="
+  },
+  "org/junit/jupiter#junit-jupiter-engine/5.8.1": {
+   "module": "sha256-aHkP7DP5ew7IQM9HrEDuDHLgVvEiyg88ZkZ0M0mTdpk=",
+   "pom": "sha256-qjIKMYpyceMyYsSA/POZZbmobap2Zm63dTQrgOnN1F4="
+  },
+  "org/junit/platform#junit-platform-commons/1.10.1": {
+   "jar": "sha256-fZhV7j8/cfAV6xR5VZv5I3gyQ8JPv72LKb7Y6AmbVnI=",
+   "module": "sha256-VtNwYvzicEHwtaNfOTxoyK0jr+NLLTDvjgewT8EZ1N0=",
+   "pom": "sha256-Su81pl6VGRWhPZ920fr/CaeMND5SJC+vNSBDtwx/bzA="
+  },
+  "org/junit/platform#junit-platform-commons/1.8.1": {
+   "jar": "sha256-+k+mjIvVTdDLScP8vpsuQvTaa+2+fnzPKgXxoeYJtZM=",
+   "module": "sha256-aY/QVBrLfv/GZZhI/Qx91QEKSfFfDBy6Q+U1gH+Q9ms=",
+   "pom": "sha256-4ZcoLlLnANEriJie3FSJh0aTUC5KqJB6zwgpgBq6bUQ="
+  },
+  "org/junit/platform#junit-platform-engine/1.10.1": {
+   "jar": "sha256-uqSORw1t7nNpoKiCDFHaicFGMnntpuE6ME0R9Fkix2A=",
+   "module": "sha256-KXiTcRuSz0lfdH41o6rLSDELHRNBpFzYTSP5QxxS4p0=",
+   "pom": "sha256-3X1k/Zr2eJywPFDCWGyRW7hrHizIwH+5dPHbDvhhZA0="
+  },
+  "org/junit/platform#junit-platform-engine/1.8.1": {
+   "module": "sha256-2fQgpkU5o+32D4DfDG/XIrdQcldEx5ykD30lrlbKS6Q=",
+   "pom": "sha256-hqrU5ld1TkOgDfIm3VTIrsHsarZTP1ASGQfkZi3i5fI="
+  },
+  "org/junit/platform#junit-platform-launcher/1.10.1": {
+   "jar": "sha256-3tQUxQTojQInAzEHGWkIThsv2bz4RD811E2ixuMwG8I=",
+   "module": "sha256-3ZcDx0TqC54Vv4yeP+vM/B40cBalXXHvf/qbC8TEBRI=",
+   "pom": "sha256-unroFwQMcqPCbTY6R/wTZIoc0MZOmjgYDd6YGKG1DjM="
+  },
+  "org/opentest4j#opentest4j/1.2.0": {
+   "jar": "sha256-WIEt5giY2Xb7ge87YtoFxmBMGP1KJJ9QRCgkefwoavI=",
+   "pom": "sha256-qW5nGBbB/4gDvex0ySQfAlvfsnfaXStO4CJmQFk2+ZQ="
+  },
+  "org/opentest4j#opentest4j/1.3.0": {
+   "jar": "sha256-SOLfY2yrZWPO1k3N/4q7I1VifLI27wvzdZhoLd90Lxs=",
+   "module": "sha256-SL8dbItdyU90ZSvReQD2VN63FDUCSM9ej8onuQkMjg0=",
+   "pom": "sha256-m/fP/EEPPoNywlIleN+cpW2dQ72TfjCUhwbCMqlDs1U="
+  },
+  "org/slf4j#slf4j-api/1.6.6": {
+   "pom": "sha256-cxmZMiteIokinNntRiTJQexXG3xh0qJ9alB+9zuXyho="
+  },
+  "org/slf4j#slf4j-api/1.7.32": {
+   "jar": "sha256-NiT4R0wa9G11+YvAl9eGSjI8gbOAiqQ2iabhxgHAJ74=",
+   "pom": "sha256-ABzeWzxrqRBwQlz+ny5pXkrri8KQotTNllMRJ6skT+U="
+  },
+  "org/slf4j#slf4j-parent/1.6.6": {
+   "pom": "sha256-QrjCR2CP2OENW2Zs98gKW1nSseEoRQ97bZ0sIM+2sxs="
+  },
+  "org/slf4j#slf4j-parent/1.7.32": {
+   "pom": "sha256-WrNJ0PTHvAjtDvH02ThssZQKL01vFSFQ4W277MC4PHA="
+  },
+  "org/slf4j#slf4j-simple/1.7.32": {
+   "jar": "sha256-0v3XtzyiAZogYtFFoNhheaWPmMjD41ynxzWieztWIcM=",
+   "pom": "sha256-VVTmGS0A/7oRfST9+HBIj50DkABH6Lq1XgDugzgvQdg="
+  },
+  "org/xerial#sqlite-jdbc/3.47.0.0": {
+   "jar": "sha256-k9R8AGN3xHb497RdANIGBrd9WVFCPzRu9WtbCBNhwtM=",
+   "pom": "sha256-3SmXElydGbywbhuMYYZoJWi8iqHfmOguXp9Litbx/X0="
+  },
+  "org/zeroturnaround#zt-zip/1.14": {
+   "jar": "sha256-lkDsuPjrnDFVsVbtu0BJyT3uXaKz31U6UdlGmK+3aNk=",
+   "pom": "sha256-esRAYySqeauHFiEV/lpCdp4yB8eCFbvCMZ2ZNeNV5hg="
+  }
+ }
+}
--- a/pkgs/by-name/ba/bandcamp-collection-downloader/package.nix
+++ b/pkgs/by-name/ba/bandcamp-collection-downloader/package.nix
@ -0,0 +1,68 @@
+{
+  lib,
+  jre,
+  gradle_8,
+
+  makeWrapper,
+  stdenv,
+  fetchFromGitLab,
+}:
+let
+  gradle = gradle_8;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "bandcamp-collection-downloader";
+  version = "0-unstable-2024-10-29";
+
+  src = fetchFromGitLab {
+    domain = "framagit.org";
+    owner = "Ezwen";
+    repo = "bandcamp-collection-downloader";
+    rev = "fe8a98d92d776d194be196b6860f55e194a999f8";
+    hash = "sha256-OaloKYlENq2kSzC8jvt4JJ7PsxLuqUuOdnYoazW5YUE=";
+  };
+
+  nativeBuildInputs = [
+    gradle
+    makeWrapper
+  ];
+
+  mitmCache = gradle.fetchDeps {
+    inherit (finalAttrs) pname;
+    data = ./deps.json;
+  };
+
+  # this is required for using mitm-cache on Darwin
+  __darwinAllowLocalNetworking = true;
+
+  # tests want to talk to bandcamp
+  doCheck = false;
+
+  gradleBuildTask = "fatjar";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    mkdir -p $out/share/bandcamp-collection-downloader
+    cp build/libs/bandcamp-collection-downloader.jar $out/share/bandcamp-collection-downloader/bandcamp-collection-downloader.jar
+
+    makeWrapper ${lib.getExe jre} $out/bin/bandcamp-collection-downloader \
+      --add-flags "-jar $out/share/bandcamp-collection-downloader/bandcamp-collection-downloader.jar"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Tool to automatically download purchased music from bandcamp";
+    license = lib.licenses.agpl3Only;
+    homepage = "https://framagit.org/Ezwen/bandcamp-collection-downloader";
+    maintainers = [ lib.maintainers.shelvacu ];
+    mainProgram = "bandcamp-collection-downloader";
+    platforms = lib.platforms.all;
+    sourceProvenance = with lib.sourceTypes; [
+      fromSource
+      binaryBytecode # mitm cache
+    ];
+  };
+})
--- a/pkgs/by-name/be/beeper/package.nix
+++ b/pkgs/by-name/be/beeper/package.nix
@ -27,12 +27,12 @@ appimageTools.wrapType2 {
    # disable creating a desktop file and icon in the home folder during runtime
    linuxConfigFilename=$out/resources/app/build/main/linux-*.mjs
    echo "export function registerLinuxConfig() {}" > $linuxConfigFilename
-    substituteInPlace $out/beepertexts.desktop --replace-fail "AppRun" "beeper"
  '';

  extraInstallCommands = ''
    install -Dm 644 ${appimageContents}/beepertexts.png $out/share/icons/hicolor/512x512/apps/beepertexts.png
    install -Dm 644 ${appimageContents}/beepertexts.desktop -t $out/share/applications/
+    substituteInPlace $out/share/applications/beepertexts.desktop --replace-fail "AppRun" "beeper"

    . ${makeWrapper}/nix-support/setup-hook
    wrapProgram $out/bin/beeper \
--- a/pkgs/by-name/be/beyond-all-reason/package.nix
+++ b/pkgs/by-name/be/beyond-all-reason/package.nix
@ -0,0 +1,32 @@
+{
+  lib,
+  fetchurl,
+  appimageTools,
+  openal,
+}:
+let
+  version = "1.2988.0";
+  pname = "beyond-all-reason";
+
+  src = fetchurl {
+    url = "https://github.com/beyond-all-reason/BYAR-Chobby/releases/download/v${version}/Beyond-All-Reason-${version}.AppImage";
+    hash = "sha256-ZJW5BdxxqyrM2TJTO0SBp4BXt3ILyi77EZx73X8hqJE=";
+  };
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
+
+  extraPkgs = pkgs: [ openal ];
+
+  meta = {
+    homepage = "https://www.beyondallreason.info/";
+    downloadPage = "https://www.beyondallreason.info/download";
+    changelog = "https://github.com/beyond-all-reason/BYAR-Chobby/releases/tag/v${version}";
+    description = "Free Real Time Strategy Game with a grand scale and full physical simulation in a sci-fi setting";
+    license = lib.licenses.gpl2Plus;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with lib.maintainers; [
+      kiyotoko
+    ];
+  };
+}
--- a/pkgs/by-name/bl/blender/package.nix
+++ b/pkgs/by-name/bl/blender/package.nix
@ -112,12 +112,12 @@ in

 stdenv'.mkDerivation (finalAttrs: {
  pname = "blender";
-  version = "4.4.0";
+  version = "4.4.1";

  srcs = fetchzip {
    name = "source";
    url = "https://download.blender.org/source/blender-${finalAttrs.version}.tar.xz";
-    hash = "sha256-pAzOayAPyRYgTixAyg2prkUtI70uFulRuBYhgU9ZNw4=";
+    hash = "sha256-5MsJ7UFpwwtaq905CiTkas/qPYOaeiacSSl3qu9h5w0=";
  };

  patches = [ ] ++ lib.optional stdenv.hostPlatform.isDarwin ./darwin.patch;
--- a/pkgs/by-name/bo/box2d/package.nix
+++ b/pkgs/by-name/bo/box2d/package.nix
@ -3,7 +3,7 @@
  stdenv,
  fetchFromGitHub,

-  substituteAll,
+  replaceVars,

  # nativeBuildInputs
  cmake,
@ -41,8 +41,7 @@ stdenv.mkDerivation (finalAttrs: {

  patches = [
    # prevent CMake from trying to download some libraries from the internet
-    (substituteAll {
-      src = ./cmake_dont_fetch_enkits.patch;
+    (replaceVars ./cmake_dont_fetch_enkits.patch {
      enkits_src = fetchFromGitHub {
        owner = "dougbinks";
        repo = "enkiTS";
--- a/pkgs/by-name/ca/calibre/package.nix
+++ b/pkgs/by-name/ca/calibre/package.nix
@ -219,6 +219,7 @@ stdenv.mkDerivation (finalAttrs: {
      $ETN 'test_qt'  # we don't include svg or webp support
      $ETN 'test_import_of_all_python_modules'  # explores actual file paths, gets confused
      $ETN 'test_websocket_basic'  # flakey
+      ${lib.optionalString stdenv.hostPlatform.isAarch64 "$ETN 'test_piper'"} # https://github.com/microsoft/onnxruntime/issues/10038
      ${lib.optionalString (!unrarSupport) "$ETN 'test_unrar'"}
    )

--- a/pkgs/by-name/ca/candy-icons/package.nix
+++ b/pkgs/by-name/ca/candy-icons/package.nix
@ -8,13 +8,13 @@

 stdenvNoCC.mkDerivation {
  pname = "candy-icons";
-  version = "0-unstable-2025-04-02";
+  version = "0-unstable-2025-04-14";

  src = fetchFromGitHub {
    owner = "EliverLara";
    repo = "candy-icons";
-    rev = "063a64161ec8f0fcb019e54db9be8a0f9a4be9ed";
-    hash = "sha256-T9j5OCPpuaZRktsfN8b8n0G3osjti8hXmAwD4MaADBU=";
+    rev = "2ba176007c40957b43d26b7a9be2c9f23a480e98";
+    hash = "sha256-6eWxf13ZBknN7IeLICpmDXu4GdxubkGJ9D4/ZEuOvfs=";
  };

  nativeBuildInputs = [ gtk3 ];
--- a/pkgs/by-name/ca/cargo-ament-build/Cargo.lock
+++ b/pkgs/by-name/ca/cargo-ament-build/Cargo.lock
@ -0,0 +1,122 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "anyhow"
+version = "1.0.98"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e16d2d3311acee920a9eb8d33b8cbc1787ce4a264e85f964c2404b969bdcd487"
+
+[[package]]
+name = "autocfg"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
+
+[[package]]
+name = "cargo-ament-build"
+version = "0.1.9"
+dependencies = [
+ "anyhow",
+ "cargo-manifest",
+ "pico-args",
+]
+
+[[package]]
+name = "cargo-manifest"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf5acda331466fdea759172dbc2fb9e650e382dbca6a8dd3f576d9aeeac76da6"
+dependencies = [
+ "serde",
+ "serde_derive",
+ "toml",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "indexmap"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+dependencies = [
+ "autocfg",
+ "hashbrown",
+]
+
+[[package]]
+name = "pico-args"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db8bcd96cb740d03149cbad5518db9fd87126a10ab519c011893b1754134c468"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.94"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a31971752e70b8b2686d7e46ec17fb38dad4051d94024c88df49b667caea9c84"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.219"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.219"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b09a44accad81e1ba1cd74a32461ba89dee89095ba17b32f5d03683b1b1fc2a0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "toml"
+version = "0.5.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4f7f0dd8d50a853a531c426359045b1998f04219d88799810762cd4ad314234"
+dependencies = [
+ "indexmap",
+ "serde",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
--- a/pkgs/by-name/ca/cargo-ament-build/package.nix
+++ b/pkgs/by-name/ca/cargo-ament-build/package.nix
@ -0,0 +1,36 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "cargo-ament-build";
+  version = "0.1.9";
+
+  src = fetchFromGitHub {
+    owner = "ros2-rust";
+    repo = "cargo-ament-build";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-5D0eB3GCQLgVYuYkHMTkboruiYSAaWy3qZjF/hVpRP0=";
+  };
+
+  cargoLock.lockFile = ./Cargo.lock;
+
+  postPatch = ''
+    ln -s ${./Cargo.lock} Cargo.lock
+  '';
+
+  nativeBuildInputs = [ pkg-config ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Cargo plugin for use with colcon workspaces";
+    homepage = "https://github.com/ros2-rust/cargo-ament-build";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ guelakais ];
+  };
+})
--- a/pkgs/by-name/ca/cargo-sonar/package.nix
+++ b/pkgs/by-name/ca/cargo-sonar/package.nix
@ -0,0 +1,34 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitLab,
+  versionCheckHook,
+  nix-update-script,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "cargo-sonar";
+  version = "1.3.0";
+
+  src = fetchFromGitLab {
+    owner = "woshilapin";
+    repo = "cargo-sonar";
+    tag = finalAttrs.version;
+    hash = "sha256-f319hi6mrnlHTvsn7kN2wFHyamXtplLZ8A6TN0+H3jY=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-KLw6kAR2pF5RFhRDfsL093K+jk3oiSHLZ2CQvrBuhWY=";
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Utility to produce some Sonar-compatible format from different Rust tools like cargo-clippy cargo-audit or cargo-outdated";
+    mainProgram = "cargo-sonar";
+    homepage = "https://gitlab.com/woshilapin/cargo-sonar";
+    license = [ lib.licenses.mit ];
+    maintainers = [ lib.maintainers.jonboh ];
+  };
+})
--- a/pkgs/by-name/cd/cdncheck/package.nix
+++ b/pkgs/by-name/cd/cdncheck/package.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "cdncheck";
-  version = "1.1.14";
+  version = "1.1.15";

  src = fetchFromGitHub {
    owner = "projectdiscovery";
    repo = "cdncheck";
    tag = "v${version}";
-    hash = "sha256-VbFpZilrPR7Ajs1FY0a+qlkBnwvh+F18fmIf2oYlIFE=";
+    hash = "sha256-iIK/MnhX+1mZCHeGPEsdUO8T4HOpSA3Fy0fnjgVzG5g=";
  };

  vendorHash = "sha256-/1REkZ5+sz/H4T4lXhloz7fu5cLv1GoaD3dlttN+Qd4=";
--- a/pkgs/by-name/ch/chamber/package.nix
+++ b/pkgs/by-name/ch/chamber/package.nix
@ -6,18 +6,18 @@

 buildGoModule rec {
  pname = "chamber";
-  version = "3.1.1";
+  version = "3.1.2";

  src = fetchFromGitHub {
    owner = "segmentio";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-1ySOlP0sFk3+IRt/zstZK6lEE2pzoVSiZz3wFxdesgc=";
+    sha256 = "sha256-9+I/zH4sHlLQkEn+fCboI3vCjYjlk+hdYnWuxq47r5I=";
  };

  env.CGO_ENABLED = 0;

-  vendorHash = "sha256-KlouLjW9hVKFi9uz34XHd4CzNOiyO245QNygkB338YQ=";
+  vendorHash = "sha256-IjCBf1h6r+EDLfgGqP/VfsHaD5oPkIR33nYBAcb6SLY=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/ch/cherry-studio/package.nix
+++ b/pkgs/by-name/ch/cherry-studio/package.nix
@ -14,13 +14,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "cherry-studio";
-  version = "1.1.10";
+  version = "1.2.4";

  src = fetchFromGitHub {
    owner = "CherryHQ";
    repo = "cherry-studio";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-rTIUBlQemYOAT0NRS80FcZfEc1Q9jUmlMU5YW99z0QE=";
+    hash = "sha256-vBE3yKNuL8yAuZrR5DrT+n1idmPor3ygPD1qMGGGgps=";
  };

  yarnOfflineCache = stdenvNoCC.mkDerivation {
@ -50,7 +50,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    '';

    outputHashMode = "recursive";
-    outputHash = "sha256-GVIa8/rNdYTcPYqaRZp8VGKeh0IiNttXzJEVvCpCAQo=";
+    outputHash = "sha256-A0YuGvNCsrYzp/oZ4Ob1Sp9HFc+psa9Yv5fb/8rQqZY=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ci/cilium-cli/package.nix
+++ b/pkgs/by-name/ci/cilium-cli/package.nix
@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "cilium-cli";
-  version = "0.18.2";
+  version = "0.18.3";

  src = fetchFromGitHub {
    owner = "cilium";
    repo = "cilium-cli";
    tag = "v${version}";
-    hash = "sha256-/R91MFE7JYutq8mOKpzLNPlt42R86dOZGJs4EOkLfKU=";
+    hash = "sha256-9+nNZEXjSoNB/Ftn/CtoBcR/uaD71C1jzDEaEG3Wpb4=";
  };

  nativeBuildInputs = [ installShellFiles ];
--- a/pkgs/by-name/cl/clever-tools/package.nix
+++ b/pkgs/by-name/cl/clever-tools/package.nix
@ -2,7 +2,7 @@
  lib,
  buildNpmPackage,
  fetchFromGitHub,
-  nodejs_18,
+  nodejs_20,
  installShellFiles,
  makeWrapper,
  stdenv,
@ -13,7 +13,7 @@ buildNpmPackage rec {

  version = "3.12.0";

-  nodejs = nodejs_18;
+  nodejs = nodejs_20;

  src = fetchFromGitHub {
    owner = "CleverCloud";
--- a/pkgs/by-name/cl/clightning/package.nix
+++ b/pkgs/by-name/cl/clightning/package.nix
@ -28,11 +28,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "clightning";
-  version = "24.11.1";
+  version = "25.02.1";

  src = fetchurl {
    url = "https://github.com/ElementsProject/lightning/releases/download/v${version}/clightning-v${version}.zip";
-    hash = "sha256-FdrD+FA0t90oJnXjUA8oalU7DDjUv70fAteNxbhscgk=";
+    hash = "sha256-0eRLc/bR4sjnNIKzhkX9yVCAoypf1TVhpa884mmVC54=";
  };

  # when building on darwin we need cctools to provide the correct libtool
@ -95,11 +95,6 @@ stdenv.mkDerivation rec {
    stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64
  ) "-Wno-error=gnu-folding-constant";

-  # The `clnrest` plugin requires a Python environment to run
-  postInstall = ''
-    rm -r $out/libexec/c-lightning/plugins/clnrest
-  '';
-
  meta = with lib; {
    description = "Bitcoin Lightning Network implementation in C";
    longDescription = ''
--- a/pkgs/by-name/cl/clock-rs/package.nix
+++ b/pkgs/by-name/cl/clock-rs/package.nix
@ -6,17 +6,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "clock-rs";
-  version = "0.1.214";
+  version = "0.1.215";

  src = fetchFromGitHub {
    owner = "Oughie";
    repo = "clock-rs";
    tag = "v${version}";
-    sha256 = "sha256-D0Wywl20TFIy8aQ9UkcI6T+5huyRuCCPc+jTeXsZd8g=";
+    sha256 = "sha256-uDEvJqaaBNRxohYqHE6qfqUF07ynRvGwJKWbYfgPEvg=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-W4m4JffqNwebGWYNsMF6U0bDroqXJAixmcmqcqYjyzw=";
+  cargoHash = "sha256-Zry6mkOUdEgC95Y3U3RCXPJUsmaSoRPlHvUThI92GQU=";

  meta = {
    description = "Modern, digital clock that effortlessly runs in your terminal";
--- a/pkgs/by-name/cl/clusterctl/package.nix
+++ b/pkgs/by-name/cl/clusterctl/package.nix
@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "clusterctl";
-  version = "1.9.6";
+  version = "1.10.0";

  src = fetchFromGitHub {
    owner = "kubernetes-sigs";
    repo = "cluster-api";
    rev = "v${version}";
-    hash = "sha256-XXtVGIpoR2JfkR7urfHuh6xKoIvsF42NV+4yjxb8nls=";
+    hash = "sha256-04ytG4U8Luc5yh5VAbS1AQpjjapKsWWZSSB3IU5Rf6U=";
  };

-  vendorHash = "sha256-SdLeME6EFraGUXE1zUdEfxTETUKLDmecYpWEg5DE4PQ=";
+  vendorHash = "sha256-iProsOETP9ahyemF2tHUVmoiqjG+ghjZkHb6PAhygb4=";

  subPackages = [ "cmd/clusterctl" ];

--- a/pkgs/by-name/co/codeium/package.nix
+++ b/pkgs/by-name/co/codeium/package.nix
@ -23,10 +23,10 @@ let

  hash =
    {
-      x86_64-linux = "sha256-iFJRdECSmFZt63yVkozaZeIT0MP8vfW3G5SvuE8/wZw=";
-      aarch64-linux = "sha256-JJxjYFgaj2f6RQRszWfxG26SjTokhoGDZjqbg7HGoV0=";
-      x86_64-darwin = "sha256-27bhqNIw3Aceq8u0UthR5Ju20SQiGVMCfUZiHbzC6wk=";
-      aarch64-darwin = "sha256-wajMCeRaOzXSJgb5z8i+ed+2w0xWTm0I2Wb3hTq1LqY=";
+      x86_64-linux = "sha256-wZl6wlR+K53rGeQ75ZVzmzKpiBnp6/UCTNx/iOHscug=";
+      aarch64-linux = "sha256-2wslvQlvhbaxZ9lwGh4UTBo0yHjSLcOZ8mxMQETY7kY=";
+      x86_64-darwin = "sha256-+34thUKUWV4P29Ak547fT5AKkaw/tgV9AMe+UT6GmD4=";
+      aarch64-darwin = "sha256-GkAh18MlZP4D+fpxZtAgXEPYSb3iiRycN/0sQm2oJnE=";
    }
    .${system} or throwSystem;

@ -35,7 +35,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "codeium";
-  version = "1.42.4";
+  version = "1.46.0";
  src = fetchurl {
    name = "${finalAttrs.pname}-${finalAttrs.version}.gz";
    url = "https://github.com/Exafunction/codeium/releases/download/language-server-v${finalAttrs.version}/language_server_${plat}.gz";
--- a/pkgs/by-name/co/coder/update.sh
+++ b/pkgs/by-name/co/coder/update.sh
@ -23,7 +23,7 @@ update_version_and_hashes() {
    # Update version number, using '#' as delimiter
    sed -i "/${channel} = {/,/};/{
        s#^\(\s*\)version = .*#\1version = \"$version\";#
-    }" ./default.nix
+    }" ./package.nix

    # Update hashes for each architecture
    for ARCH in "${!ARCHS[@]}"; do
@ -37,7 +37,7 @@ update_version_and_hashes() {
        # Update the Nix file with the new hash, using '#' as delimiter and preserving indentation
        sed -i "/${channel} = {/,/};/{
            s#^\(\s*\)${ARCH} = .*#\1${ARCH} = \"${SRI_HASH}\";#
-        }" ./default.nix
+        }" ./package.nix
    done
 }

--- a/Show more
+++ b/Show more