Merge master into staging-next

2025-06-10 19:55:41 +03:00 · 2025-05-13 12:07:00 +00:00 · 2025-05-13 12:07:00 +00:00 · f13b927ceb
commit f13b927ceb
parent d665ddf4a8 5f296019ea
60 changed files with 825 additions and 6280 deletions
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@ -166,7 +166,7 @@ jobs:
  tag:
    name: Tag
    runs-on: ubuntu-24.04-arm
-    needs: [ process ]
+    needs: [ get-merge-commit, process ]
    if: needs.process.outputs.targetRunId
    permissions:
      pull-requests: write
--- a/.github/workflows/get-merge-commit.yml
+++ b/.github/workflows/get-merge-commit.yml
@ -40,7 +40,7 @@ jobs:
              ;;
            pull_request_target)
              if commits=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then
-                echo "Checking the commits:\n$commits"
+                echo -e "Checking the commits:\n$commits"
                echo "$commits" >> "$GITHUB_OUTPUT"
              else
                # Skipping so that no notifications are sent
--- a/ci/default.nix
+++ b/ci/default.nix
@ -63,10 +63,7 @@ let
      fs = pkgs.lib.fileset;
      nixFilesSrc = fs.toSource {
        root = ../.;
-        fileset = fs.difference (fs.unions [
-          (fs.fileFilter (file: file.hasExt "nix") ../.)
-          ../.git-blame-ignore-revs
-        ]) (fs.maybeMissing ../.git);
+        fileset = fs.difference ../. (fs.maybeMissing ../.git);
      };
    in
    {
--- a/nixos/doc/manual/development/running-nixos-tests-interactively.section.md
+++ b/nixos/doc/manual/development/running-nixos-tests-interactively.section.md
@ -71,10 +71,19 @@ An SSH-based backdoor to log into machines can be enabled with
 {
  name = "…";
  nodes.machines = { /* … */ };
-  sshBackdoor.enable = true;
+  interactive.sshBackdoor.enable = true;
 }
 ```

+::: {.warning}
+Make sure to only enable the backdoor for interactive tests
+(i.e. by using `interactive.sshBackdoor.enable`)! This is the only
+supported configuration.
+
+Running a test in a sandbox with this will fail because `/dev/vhost-vsock` isn't available
+in the sandbox.
+:::
+
 This creates a [vsock socket](https://man7.org/linux/man-pages/man7/vsock.7.html)
 for each VM to log in with SSH. This configures root login with an empty password.

--- a/nixos/doc/manual/installation/installing-virtualbox-guest.section.md
+++ b/nixos/doc/manual/installation/installing-virtualbox-guest.section.md
@ -8,7 +8,7 @@ up a VirtualBox guest, follow these instructions:

 1.  Base Memory Size: 768 MB or higher.

-1.  New Hard Disk of 8 GB or higher.
+1.  New Hard Disk of 10 GB or higher.

 1.  Mount the CD-ROM with the NixOS ISO (by clicking on CD/DVD-ROM)

--- a/nixos/lib/testing/run.nix
+++ b/nixos/lib/testing/run.nix
@ -43,27 +43,30 @@ in
  };

  config = {
-    rawTestDerivation = hostPkgs.stdenv.mkDerivation {
-      name = "vm-test-run-${config.name}";
+    rawTestDerivation =
+      assert lib.assertMsg (!config.sshBackdoor.enable)
+        "The SSH backdoor is currently not supported for non-interactive testing! Please make sure to only set `interactive.sshBackdoor.enable = true;`!";
+      hostPkgs.stdenv.mkDerivation {
+        name = "vm-test-run-${config.name}";

-      requiredSystemFeatures =
-        [ "nixos-test" ]
-        ++ lib.optionals hostPkgs.stdenv.hostPlatform.isLinux [ "kvm" ]
-        ++ lib.optionals hostPkgs.stdenv.hostPlatform.isDarwin [ "apple-virt" ];
+        requiredSystemFeatures =
+          [ "nixos-test" ]
+          ++ lib.optionals hostPkgs.stdenv.hostPlatform.isLinux [ "kvm" ]
+          ++ lib.optionals hostPkgs.stdenv.hostPlatform.isDarwin [ "apple-virt" ];

-      buildCommand = ''
-        mkdir -p $out
+        buildCommand = ''
+          mkdir -p $out

-        # effectively mute the XMLLogger
-        export LOGFILE=/dev/null
+          # effectively mute the XMLLogger
+          export LOGFILE=/dev/null

-        ${config.driver}/bin/nixos-test-driver -o $out
-      '';
+          ${config.driver}/bin/nixos-test-driver -o $out
+        '';

-      passthru = config.passthru;
+        passthru = config.passthru;

-      meta = config.meta;
-    };
+        meta = config.meta;
+      };
    test = lib.lazyDerivation {
      # lazyDerivation improves performance when only passthru items and/or meta are used.
      derivation = config.rawTestDerivation;
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@ -116,7 +116,8 @@ let
    ++ (lib.optional (cfg.config.objectstore.s3.enable) "s3_secret:${cfg.config.objectstore.s3.secretFile}")
    ++ (lib.optional (
      cfg.config.objectstore.s3.sseCKeyFile != null
-    ) "s3_sse_c_key:${cfg.config.objectstore.s3.sseCKeyFile}");
+    ) "s3_sse_c_key:${cfg.config.objectstore.s3.sseCKeyFile}")
+    ++ (lib.optional (cfg.secretFile != null) "secret_file:${cfg.secretFile}");

  requiresRuntimeSystemdCredentials = (lib.length runtimeSystemdCredentials) != 0;

@ -195,7 +196,6 @@ let
  overrideConfig =
    let
      c = cfg.config;
-      requiresReadSecretFunction = c.dbpassFile != null || c.objectstore.s3.enable;
      objectstoreConfig =
        let
          s3 = c.objectstore.s3;
@ -232,7 +232,7 @@ let
    in
    pkgs.writeText "nextcloud-config.php" ''
      <?php
-      ${optionalString requiresReadSecretFunction ''
+      ${optionalString requiresRuntimeSystemdCredentials ''
        function nix_read_secret($credential_name) {
          $credentials_directory = getenv("CREDENTIALS_DIRECTORY");
          if (!$credentials_directory) {
@ -253,7 +253,19 @@ let
          }

          return trim(file_get_contents($credential_path));
-        }''}
+        }
+
+        function nix_read_secret_and_decode_json_file($credential_name) {
+          $decoded = json_decode(nix_read_secret($credential_name), true);
+
+          if (json_last_error() !== JSON_ERROR_NONE) {
+            error_log(sprintf("Cannot decode %s, because: %s", $file, json_last_error_msg()));
+            exit(1);
+          }
+
+          return $decoded;
+        }
+      ''}
      function nix_decode_json_file($file, $error) {
        if (!file_exists($file)) {
          throw new \RuntimeException(sprintf($error, $file));
@ -287,10 +299,7 @@ let
      ));

      ${optionalString (cfg.secretFile != null) ''
-        $CONFIG = array_replace_recursive($CONFIG, nix_decode_json_file(
-          "${cfg.secretFile}",
-          "Cannot start Nextcloud, secrets file %s set by NixOS doesn't exist!"
-        ));
+        $CONFIG = array_replace_recursive($CONFIG, nix_read_secret_and_decode_json_file('secret_file'));
      ''}
    '';
 in
--- a/nixos/tests/nextcloud/with-declarative-redis-and-secrets.nix
+++ b/nixos/tests/nextcloud/with-declarative-redis-and-secrets.nix
@ -84,13 +84,12 @@ runTest (
          # This file is meant to contain secret options which should
          # not go into the nix store. Here it is just used to set the
          # redis password.
-          environment.etc."nextcloud-secrets.json".text = ''
-            {
-              "redis": {
-                "password": "secret"
-              }
-            }
-          '';
+          environment.etc."nextcloud-secrets.json" = {
+            mode = "0600";
+            text = builtins.toJSON {
+              redis.password = "secret";
+            };
+          };
        };
    };

--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -2853,8 +2853,8 @@ let
        mktplcRef = {
          name = "language-julia";
          publisher = "julialang";
-          version = "1.138.1";
-          hash = "sha256-r98S0J+9sKlQacUuUakCI1WE6uRJ9zhYc2foLCN8Xzo=";
+          version = "1.140.2";
+          hash = "sha256-YQwJq3QSzb2pAOLyy0w8RtrjAlxudBGN52fQtj+OmOk=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/julialang.language-julia/changelog";
@ -4565,8 +4565,8 @@ let
        mktplcRef = {
          publisher = "sonarsource";
          name = "sonarlint-vscode";
-          version = "4.21.0";
-          hash = "sha256-pnxHROhjbQq93CeWkBU3KwIPeXVDA4K6ifkkoGfagIM=";
+          version = "4.22.0";
+          hash = "sha256-E50BmbYgm9w+jpr8m8BdZcOuCtPhpmhXTBhbx/tsips=";
        };
        meta.license = lib.licenses.lgpl3Only;
      };
@ -4770,8 +4770,8 @@ let
        mktplcRef = {
          name = "tabnine-vscode";
          publisher = "tabnine";
-          version = "3.268.0";
-          hash = "sha256-Gx9hQqieXTmFudRJaySI8+8cNIaKVRMtNwJqxGH0DV8=";
+          version = "3.271.0";
+          hash = "sha256-+lNWQOfmoxT6+j+oqT4Z2QTYWSJbVwSukxEx4fwXqPc=";
        };
        meta = {
          license = lib.licenses.mit;
--- a/pkgs/applications/emulators/libretro/cores/fceumm.nix
+++ b/pkgs/applications/emulators/libretro/cores/fceumm.nix
@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "fceumm";
-  version = "0-unstable-2025-04-11";
+  version = "0-unstable-2025-05-02";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "libretro-fceumm";
-    rev = "43e6496351b544df0de692fbb01b2a6942073f5c";
-    hash = "sha256-kGGvI1rKE/oSF2v3URDY/fLTThYc3Crk9UFN69Rcckg=";
+    rev = "3544ff567ecc417c170641587083b976739ef9db";
+    hash = "sha256-eNmzWLJVPeqFFEcFIhOQCn9OMrBp0iraTcft5pJVvvE=";
  };

  meta = {
--- a/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
+++ b/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "genesis-plus-gx";
-  version = "0-unstable-2025-04-25";
+  version = "0-unstable-2025-05-02";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "Genesis-Plus-GX";
-    rev = "99678a0ef3cfcca500ed01c24bbb1020d8af4c12";
-    hash = "sha256-iijYZ4+TM61EkJynDaPYBi/bYrypouFRmhaG63cxgJo=";
+    rev = "f64e0a1e04a67a5edf79026c07dc5094f8df74bc";
+    hash = "sha256-eG0lzdo/AWVAl+V71X8YNGK1Dk1oLW3jvGY3IS0ekNw=";
  };

  meta = {
--- a/pkgs/applications/virtualization/docker/compose.nix
+++ b/pkgs/applications/virtualization/docker/compose.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "docker-compose";
-  version = "2.35.1";
+  version = "2.36.0";

  src = fetchFromGitHub {
    owner = "docker";
    repo = "compose";
    rev = "v${version}";
-    hash = "sha256-Dq2YYiHmtt3j+qHAzsAIW4twbD3viXIjI0MXrV7HIW0=";
+    hash = "sha256-3WaTUylmXk2urn9Pe76AdnckJvFBJBSccXCvFSRotyo=";
  };

  postPatch = ''
@ -20,7 +20,7 @@ buildGoModule rec {
    rm -rf pkg/e2e/
  '';

-  vendorHash = "sha256-nycjWE3nFmA2csen8jT9lrhwRn5892xIRtrYEn+eVy0=";
+  vendorHash = "sha256-AcBBtetOuTnCA6ZQVUta+6lJQoSJhBXifEoToUhrpAk=";

  ldflags = [
    "-X github.com/docker/compose/v2/internal.Version=${version}"
--- a/pkgs/by-name/al/alt-ergo/package.nix
+++ b/pkgs/by-name/al/alt-ergo/package.nix
@ -8,11 +8,11 @@

 let
  pname = "alt-ergo";
-  version = "2.6.1";
+  version = "2.6.2";

  src = fetchurl {
    url = "https://github.com/OCamlPro/alt-ergo/releases/download/v${version}/alt-ergo-${version}.tbz";
-    hash = "sha256-31YEWjr3n7z70d7q8JAS1bw5C0wiI+HZwlwRwwHZ7ro=";
+    hash = "sha256-OeLJEop9HonzMuMaJxbzWfO54akl/oHxH6SnSbXSTYI=";
  };
 in

--- a/pkgs/by-name/ca/cargo-modules/package.nix
+++ b/pkgs/by-name/ca/cargo-modules/package.nix
@ -6,17 +6,17 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "cargo-modules";
-  version = "0.23.1";
+  version = "0.24.0";

  src = fetchFromGitHub {
    owner = "regexident";
    repo = "cargo-modules";
    tag = "v${version}";
-    hash = "sha256-L5goyuYn7qRVCgbOGRlSJA0B01MuOzIw9Lx5G/TanXs=";
+    hash = "sha256-MJswCl5eJjKarB2ufeNLQL0ZPDaRPpX6OGOqszG+a0g=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-txuTNuW6dJNnnLk9o5z4Pa42bJaAa9jB/ms8au+3Muc=";
+  cargoHash = "sha256-N1Bj0fqyirp51DNsrZEtRGOSUPS1YNbk+O3kdboQ+TQ=";

  checkFlags = [
    "--skip=cfg_test::with_tests::smoke"
--- a/pkgs/by-name/cl/clouddrive2/package.nix
+++ b/pkgs/by-name/cl/clouddrive2/package.nix
@ -11,16 +11,16 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "clouddrive2";
-  version = "0.8.16";
+  version = "0.8.17";

  src = fetchurl {
    url = "https://github.com/cloud-fs/cloud-fs.github.io/releases/download/v${finalAttrs.version}/clouddrive-2-${os}-${arch}-${finalAttrs.version}.tgz";
    hash =
      {
-        x86_64-linux = "sha256-NUXafHlH/TsIW4sTDOZ01AxNSnQ1M0yMgtoHBlYBzAU=";
-        aarch64-linux = "sha256-FcCz/DcNOIOm9WE2zuL3WA3mkbxO57eCtHpD9PjDG94=";
-        x86_64-darwin = "sha256-Bm5w6AgZ1cafopa+w5+0yADGS4rfsFXpHZ21NHu5tC8=";
-        aarch64-darwin = "sha256-4dwht7AbBB6b35n8joH7sR8zUgSQqILrkORIJaSm2xI=";
+        x86_64-linux = "sha256-j3QJJ6cF+dcotkMJcDbW1rf1ETdfofiTotDcV+bH8zY=";
+        aarch64-linux = "sha256-0N+D0ba3+D6xfiW8RjV1XHTcypLiGyuuHZFOqYS3JZE=";
+        x86_64-darwin = "sha256-YCn7jvpgh2+i6qWBbsqSBFmNlwPduPNExXF+QnxiQ+c=";
+        aarch64-darwin = "sha256-EOgrnJljZVSkzjZRZSUIfn1Ly6IrTS6I/8uwRVktnzE=";
      }
      .${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
  };
--- a/pkgs/by-name/cy/cyrus-imapd/package.nix
+++ b/pkgs/by-name/cy/cyrus-imapd/package.nix
@ -66,13 +66,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "cyrus-imapd";
-  version = "3.10.1";
+  version = "3.12.0";

  src = fetchFromGitHub {
    owner = "cyrusimap";
    repo = "cyrus-imapd";
    tag = "cyrus-imapd-${finalAttrs.version}";
-    hash = "sha256-jMSTduQmLB55smBmbJ32eLqiC24ufQyX/FT9d18lDCo=";
+    hash = "sha256-sdHAxlrxQHzcSt2buOGfRv/OR8BYFHrNoo+r/ePVFsg=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/di/diffnav/package.nix
+++ b/pkgs/by-name/di/diffnav/package.nix
@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "diffnav";
-  version = "0.3.0";
+  version = "0.3.1";

  src = fetchFromGitHub {
    owner = "dlvhdr";
    repo = "diffnav";
    rev = "refs/tags/v${version}";
-    hash = "sha256-JXxeRq8OuTvzkbxDr1xVXeW0RFtCRyEbhCGvXeWHb0g=";
+    hash = "sha256-admPiEKyatdUkR89vZP8RYHTqtZVSJ8KSvtpnsBViBw=";
  };

  vendorHash = "sha256-2JjQF+fwl8+Xoq9T3jCvngRAOa3935zpi9qbF4w4hEI=";
--- a/pkgs/by-name/gi/git-bug-migration/package.nix
+++ b/pkgs/by-name/gi/git-bug-migration/package.nix
@ -34,7 +34,10 @@ buildGoModule rec {
    description = "Tool for upgrading repositories using git-bug to new versions";
    homepage = "https://github.com/MichaelMure/git-bug-migration";
    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ DeeUnderscore ];
+    maintainers = with maintainers; [
+      DeeUnderscore
+      sudoforge
+    ];
    mainProgram = "git-bug-migration";
  };
 }
--- a/pkgs/by-name/go/go-task/package.nix
+++ b/pkgs/by-name/go/go-task/package.nix
@ -8,15 +8,15 @@
  versionCheckHook,
 }:

-buildGoModule rec {
+buildGoModule (finalAttrs: {
  pname = "go-task";
-  version = "3.43.2";
+  version = "3.43.3";

  src = fetchFromGitHub {
    owner = "go-task";
    repo = "task";
-    tag = "v${version}";
-    hash = "sha256-duq5OGUFki0OK/U09EmzBtTH5ObXdWwNYrmenUyubr0=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ZIZdk0yyykjjSdH6YG8K8WpI8e8426odk8RxISsJe80=";
  };

  vendorHash = "sha256-3Uu0ozwOgp6vQh+s9nGKojw6xPUI49MjjPqKh9g35lQ=";
@ -28,7 +28,7 @@ buildGoModule rec {
  ldflags = [
    "-s"
    "-w"
-    "-X=github.com/go-task/task/v3/internal/version.version=${version}"
+    "-X=github.com/go-task/task/v3/internal/version.version=${finalAttrs.version}"
  ];

  env.CGO_ENABLED = 0;
@ -56,8 +56,8 @@ buildGoModule rec {
  meta = with lib; {
    homepage = "https://taskfile.dev/";
    description = "Task runner / simpler Make alternative written in Go";
-    changelog = "https://github.com/go-task/task/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/go-task/task/blob/v${finalAttrs.version}/CHANGELOG.md";
    license = licenses.mit;
    maintainers = with maintainers; [ parasrah ];
  };
-}
+})
--- a/pkgs/by-name/gz/gz-cmake/package.nix
+++ b/pkgs/by-name/gz/gz-cmake/package.nix
@ -6,16 +6,22 @@
  doxygen,
  graphviz,
  pkg-config,
+  python3,
+  nix-update-script,
 }:
+let
+  version = "4.2.0";
+  versionPrefix = "gz-cmake${lib.versions.major version}";
+in
 stdenv.mkDerivation (finalAttrs: {
  pname = "gz-cmake";
-  version = "4.1.1";
+  inherit version;

  src = fetchFromGitHub {
    owner = "gazebosim";
    repo = "gz-cmake";
-    tag = "gz-cmake${lib.versions.major finalAttrs.version}_${finalAttrs.version}";
-    hash = "sha256-BWgRm+3UW65Cu7TqXtFFG05JlYF52dbpAsIE8aDnJM0=";
+    tag = "${versionPrefix}_${finalAttrs.version}";
+    hash = "sha256-+bMOcGWfcwPhxR9CBp4iH02CZC4oplCjsTDpPDsDnSs=";
  };

  nativeBuildInputs = [
@ -25,6 +31,26 @@ stdenv.mkDerivation (finalAttrs: {
    pkg-config
  ];

+  cmakeFlags = [
+    (lib.cmakeBool "BUILDSYSTEM_TESTING" finalAttrs.doCheck)
+  ];
+
+  nativeCheckInputs = [ python3 ];
+
+  # 98% tests passed, 1 tests failed out of 44
+  # 44 - c_child_requires_c_nodep (Failed)
+  #
+  # Package gz-c_child_private was not found in the pkg-config search path.
+  # Perhaps you should add the directory containing `gz-c_child_private.pc'
+  # to the PKG_CONFIG_PATH environment variable
+  # No package 'gz-c_child_private' found
+  doCheck = false;
+
+  # Extract the version by matching the tag's prefix.
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version-regex=${versionPrefix}_([\\d\\.]+)" ];
+  };
+
  meta = {
    description = "CMake modules to build Gazebo projects";
    homepage = "https://github.com/gazebosim/gz-cmake";
--- a/pkgs/by-name/ht/htcondor/package.nix
+++ b/pkgs/by-name/ht/htcondor/package.nix
@ -62,7 +62,8 @@ stdenv.mkDerivation rec {
    platforms = platforms.linux;
    license = licenses.asl20;
    maintainers = with maintainers; [ evey ];
-    # cannot find -lpthread: No such file or directory
-    broken = stdenv.hostPlatform.isAarch64;
+    # On Aarch64: ld: cannot find -lpthread: No such file or directory
+    # On x86_64:  ld: cannot find -ldl:      No such file or directory
+    broken = true;
  };
 }
--- a/pkgs/by-name/ju/just-lsp/package.nix
+++ b/pkgs/by-name/ju/just-lsp/package.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "just-lsp";
-  version = "0.2.1";
+  version = "0.2.2";

  src = fetchFromGitHub {
    owner = "terror";
    repo = "just-lsp";
    tag = finalAttrs.version;
-    hash = "sha256-MBkuLvMwAH0858X0TRAK1pL/JwsTIY/6Ra+Vd6X0odA=";
+    hash = "sha256-lR3VtPS96gPUj4OVZLeQSHnss22hBTRBLUV8n2Y3E9M=";
  };

-  cargoHash = "sha256-gVxWy8SGvAaavrdZHK/9aKfPAXUtfs98TyFKFkFa3+U=";
+  cargoHash = "sha256-eDjUYB5AN56hxolizw0KYb0Z/k28OWOUYOxhB/5pKV0=";

  passthru = {
    updateScript = nix-update-script { };
--- a/pkgs/by-name/kr/krillinai/package.nix
+++ b/pkgs/by-name/kr/krillinai/package.nix
@ -11,13 +11,13 @@

 buildGoModule (finalAttrs: {
  pname = "krillinai";
-  version = "1.1.4";
+  version = "1.1.5";

  src = fetchFromGitHub {
    owner = "krillinai";
    repo = "KrillinAI";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-espj6BFc0GA5pURyly1HV3rIqyEgd1S/bmqkUPczTqM=";
+    hash = "sha256-jQlgkpQ+UTzn6MqGa+yVQ9v04IGGlMQQim3s0Oc9Zts=";
  };

  vendorHash = "sha256-mpvypCZmvVVljftGpcV1aea3s7Xmhr0jLfKZIZ0nkX8=";
--- a/pkgs/by-name/ma/matrix-authentication-service/package.nix
+++ b/pkgs/by-name/ma/matrix-authentication-service/package.nix
@ -14,14 +14,14 @@
  cctools,
 }:

-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
  pname = "matrix-authentication-service";
  version = "0.16.0";

  src = fetchFromGitHub {
    owner = "element-hq";
    repo = "matrix-authentication-service";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-/UrMmC5DTxoN6uzvTB+V3//hGQmKlkYvi5Lv4p31fq4=";
  };

@ -29,8 +29,8 @@ rustPlatform.buildRustPackage rec {
  cargoHash = "sha256-UvRv69rHqPNqTg5nhUojTDHEFUIXF8LEB4ndzA7CHc0=";

  npmDeps = fetchNpmDeps {
-    name = "${pname}-${version}-npm-deps";
-    src = "${src}/${npmRoot}";
+    name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
+    src = "${finalAttrs.src}/${finalAttrs.npmRoot}";
    hash = "sha256-7EN8GIO8VutAZujVvgM67fGIXWD2aJhHhEJrTeHRiGE=";
  };

@ -52,6 +52,7 @@ rustPlatform.buildRustPackage rec {

  env = {
    ZSTD_SYS_USE_PKG_CONFIG = true;
+    VERGEN_GIT_DESCRIBE = finalAttrs.version;
  };

  buildNoDefaultFeatures = true;
@ -85,9 +86,9 @@ rustPlatform.buildRustPackage rec {
  meta = {
    description = "OAuth2.0 + OpenID Provider for Matrix Homeservers";
    homepage = "https://github.com/element-hq/matrix-authentication-service";
-    changelog = "https://github.com/element-hq/matrix-authentication-service/releases/tag/v${version}";
+    changelog = "https://github.com/element-hq/matrix-authentication-service/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.agpl3Only;
    maintainers = with lib.maintainers; [ teutat3s ];
    mainProgram = "mas-cli";
  };
-}
+})
--- a/pkgs/by-name/mo/mongosh/disable-telemetry.patch
+++ b/pkgs/by-name/mo/mongosh/disable-telemetry.patch
@ -0,0 +1,13 @@
+diff --git a/packages/cli-repl/src/cli-repl.ts b/packages/cli-repl/src/cli-repl.ts
+index b00c52e1..7a096d6d 100644
+--- a/packages/cli-repl/src/cli-repl.ts
+++ b/packages/cli-repl/src/cli-repl.ts
+@@ -159,7 +159,7 @@ export class CliRepl implements MongoshIOProvider {
+     this.config = {
+       userId: id,
+       telemetryAnonymousId: id,
+-      enableTelemetry: true,
+      enableTelemetry: false,
+     };
+ 
+     this.getCryptLibraryPaths = options.getCryptLibraryPaths;
--- a/pkgs/by-name/mo/mongosh/package-lock.json
+++ b/pkgs/by-name/mo/mongosh/package-lock.json
--- a/pkgs/by-name/mo/mongosh/package.nix
+++ b/pkgs/by-name/mo/mongosh/package.nix
@ -1,38 +1,59 @@
 {
  lib,
  buildNpmPackage,
-  fetchurl,
+  fetchFromGitHub,
+  fetchpatch,
+  libmongocrypt,
+  krb5,
  testers,
-  mongosh,
+  nix-update-script,
 }:

-let
-  source = lib.importJSON ./source.json;
-in
-buildNpmPackage {
+buildNpmPackage (finalAttrs: {
  pname = "mongosh";
-  inherit (source) version;
+  version = "2.5.1";

-  src = fetchurl {
-    url = "https://registry.npmjs.org/mongosh/-/${source.filename}";
-    hash = source.integrity;
+  src = fetchFromGitHub {
+    owner = "mongodb-js";
+    repo = "mongosh";
+
+    # Tracking a few commits ahead of 2.5.1 to ensure the package-lock.json patch below applies
+    #tag = "v${finalAttrs.version}";
+    rev = "2163e8b10a77af18e0cedfa164526506c051593e";
+
+    hash = "sha256-DYX8NqAISwzBpdilcv3YVrL72byXMeC4z/nLqd2nf2c=";
  };

-  postPatch = ''
-    ln -s ${./package-lock.json} package-lock.json
+  patches = [
+    # https://github.com/mongodb-js/mongosh/pull/2452
+    (fetchpatch {
+      url = "https://github.com/mongodb-js/mongosh/commit/30f66260fce3e1744298d086bd2b54b2d2bfffbb.patch";
+      hash = "sha256-c2QM/toeoagfhvuh4r+/5j7ZyV6DEr9brA9mXpEy1kM=";
+    })
+
+    ./disable-telemetry.patch
+  ];
+
+  npmDepsHash = "sha256-6uXEKAAGXxaODjXIszYml5Af4zSuEzy/QKdMgSzLD84=";
+  npmFlags = [
+    "--omit=optional"
+    "--ignore-scripts"
+  ];
+  npmBuildScript = "compile";
+  dontNpmInstall = true;
+  installPhase = ''
+    runHook preInstall
+    npmWorkspace=packages/mongosh npmInstallHook
+    cp -r packages configs $out/lib/node_modules/mongosh/
+    rm $out/lib/node_modules/mongosh/node_modules/@mongosh/docker-build-scripts # dangling symlink
+    runHook postInstall
  '';

-  npmDepsHash = source.deps;
-
-  makeCacheWritable = true;
-  dontNpmBuild = true;
-  npmFlags = [ "--omit=optional" ];
-
  passthru = {
    tests.version = testers.testVersion {
-      package = mongosh;
+      package = finalAttrs.finalPackage;
    };
-    updateScript = ./update.sh;
+    updateScript = nix-update-script { };
  };

  meta = {
@ -42,4 +63,4 @@ buildNpmPackage {
    license = lib.licenses.asl20;
    mainProgram = "mongosh";
  };
-}
+})
--- a/pkgs/by-name/mo/mongosh/source.json
+++ b/pkgs/by-name/mo/mongosh/source.json
@ -1,6 +0,0 @@
-{
-  "version": "2.4.2",
-  "integrity": "sha512-sNgCITVstYsOkHDH05//wGQ/FJnFfq5gHGoHpIMehX/r2vSm3LEcCW366JlLvRmFj/f4NRGjvFI9c1Ks30W+Zw==",
-  "filename": "mongosh-2.4.2.tgz",
-  "deps": "sha256-aXjK0cW48nih2nI/m2i25zRpmLQ/KHo0KMiNJSvb13g="
-}
--- a/pkgs/by-name/mo/mongosh/update.sh
+++ b/pkgs/by-name/mo/mongosh/update.sh
@ -1,25 +0,0 @@
-#!/usr/bin/env nix-shell
-#! nix-shell -i bash -p nodejs libarchive prefetch-npm-deps moreutils jq
-# shellcheck shell=bash
-
-set -exuo pipefail
-
-cd -- "$(dirname -- "${BASH_SOURCE[0]}")"
-
-TMPDIR="$(mktemp -d)"
-trap 'rm -r -- "$TMPDIR"' EXIT
-
-pushd -- "$TMPDIR"
-npm pack mongosh --json | jq '.[0] | { version, integrity, filename }' > source.json
-bsdtar -x -f "$(jq -r .filename source.json)"
-
-pushd package
-npm install --omit=optional --package-lock-only
-popd
-
-DEPS="$(prefetch-npm-deps package/package-lock.json)"
-jq ".deps = \"$DEPS\"" source.json | sponge source.json
-
-popd
-
-cp -t . -- "$TMPDIR/source.json" "$TMPDIR/package/package-lock.json"
--- a/pkgs/by-name/ni/nixf-diagnose/package.nix
+++ b/pkgs/by-name/ni/nixf-diagnose/package.nix
@ -0,0 +1,31 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nixf,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "nixf-diagnose";
+  version = "0.1.2";
+
+  src = fetchFromGitHub {
+    owner = "inclyc";
+    repo = "nixf-diagnose";
+    tag = finalAttrs.version;
+    hash = "sha256-gkeU3EwAl9810eRRp5/ddf1h0qpV6FrBBdntNBpBtsM=";
+  };
+
+  env.NIXF_TIDY_PATH = lib.getExe nixf;
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-nrr2/lTWPyH7MsG2hSMJjbFCpHsKWINEP8jwSYPhocg=";
+
+  meta = {
+    description = "CLI wrapper for nixf-tidy with fancy diagnostic output";
+    mainProgram = "nixf-diagnose";
+    homepage = "https://github.com/inclyc/nixf-diagnose";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ inclyc ];
+  };
+})
--- a/pkgs/by-name/ob/oboete/package.nix
+++ b/pkgs/by-name/ob/oboete/package.nix
@ -9,17 +9,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "oboete";
-  version = "0.1.8";
+  version = "0.1.9";

  src = fetchFromGitHub {
    owner = "mariinkys";
    repo = "oboete";
    tag = version;
-    hash = "sha256-tQn3ihGHkR91zNtBIiyyIEEo21Q0ZSKLEaV/3UI9pwU=";
+    hash = "sha256-Xs9o6V/rUtRkUp7F2hJXLz8PP7XWtqx4uaONo3Q23uo=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-91JMgdpMXL0a7oZXAG5xgiulOIyVXQ5x09wN3XDeSy0=";
+  cargoHash = "sha256-bhSkQcDqYhkRwqLbiOLXprQnMqjDKRetZ97K1ES5hrw=";

  nativeBuildInputs = [ libcosmicAppHook ];

--- a/pkgs/by-name/pa/paretosecurity/package.nix
+++ b/pkgs/by-name/pa/paretosecurity/package.nix
@ -17,13 +17,13 @@ buildGoModule (finalAttrs: {
    webkitgtk_4_1
  ];
  pname = "paretosecurity";
-  version = "0.2.15";
+  version = "0.2.17";

  src = fetchFromGitHub {
    owner = "ParetoSecurity";
    repo = "agent";
    rev = finalAttrs.version;
-    hash = "sha256-8lRIDW17oyQpoGuHGckSxL++jaeX3qPr2kvXBAeszjc=";
+    hash = "sha256-2Ev6LJWa+iPV7/Y/o9HrNf4vR4dbnIOim+qb4HdRXqU=";
  };

  vendorHash = "sha256-YnyACP/hJYxi4AWMwr0We4YUTbWwahKAIYN6RnHmzls=";
--- a/pkgs/by-name/pl/plakativ/package.nix
+++ b/pkgs/by-name/pl/plakativ/package.nix
@ -0,0 +1,33 @@
+{
+  lib,
+  python3Packages,
+  fetchPypi,
+  guiSupport ? true,
+}:
+let
+  pname = "plakativ";
+  version = "0.5.3";
+in
+python3Packages.buildPythonApplication {
+  inherit pname version;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-6TvMznd5obkn/gsQTyZ6Pc/dF55I53987EbuSNAlY58=";
+  };
+
+  dependencies =
+    with python3Packages;
+    [
+      pymupdf
+    ]
+    ++ lib.optional guiSupport tkinter;
+
+  meta = {
+    description = "Convert a PDF into a large poster that can be printed on multiple smaller pages";
+    mainProgram = "plakativ";
+    homepage = "https://gitlab.mister-muffin.de/josch/plakativ";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ marcin-serwin ];
+  };
+}
--- a/pkgs/by-name/po/podman-desktop/package.nix
+++ b/pkgs/by-name/po/podman-desktop/package.nix
@ -17,7 +17,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "podman-desktop";
-  version = "1.18.0";
+  version = "1.18.1";

  passthru.updateScript = nix-update-script { };

@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "containers";
    repo = "podman-desktop";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-u3Irn+hSyTNTLl8QenMZbISE5aFhb58mOSOooVoijKw=";
+    hash = "sha256-GYdetO/WiEQAvVSvu81tKqkOH7YUgkB7RVW0Crd/2ww=";
  };

  pnpmDeps = pnpm_9.fetchDeps {
--- a/pkgs/by-name/pr/process-compose/package.nix
+++ b/pkgs/by-name/pr/process-compose/package.nix
@ -10,13 +10,13 @@ let
 in
 buildGoModule rec {
  pname = "process-compose";
-  version = "1.63.0";
+  version = "1.64.1";

  src = fetchFromGitHub {
    owner = "F1bonacc1";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-FnxpaaZLpYMqLGXv/9HP3jh0DuujXoDH2H+omRzgeyQ=";
+    hash = "sha256-qv/fVfuQD7Nan5Nn1RkwXoGZuPYSRWQaojEn6MCF9BQ=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@ -45,7 +45,7 @@ buildGoModule rec {
    installShellFiles
  ];

-  vendorHash = "sha256-4ktj2mRSrY81xvQJd76jo9WJw/ohHXypWuSANp9C+6U=";
+  vendorHash = "sha256-NEKHTSLEF8jBSmAnHq/q+kyV8vPz3DTNj4Jquf5rnso=";

  doCheck = false;

--- a/pkgs/by-name/si/signal-desktop-bin/generic.nix
+++ b/pkgs/by-name/si/signal-desktop-bin/generic.nix
@ -262,6 +262,8 @@ stdenv.mkDerivation rec {
      --replace-fail "/${bindir}/signal-desktop" ${meta.mainProgram} \
      --replace-fail "StartupWMClass=Signal" "StartupWMClass=signal"

+    mv $out/share/applications/signal{-desktop,}.desktop
+
    # Note: The following path contains bundled libraries:
    # $out/lib/signal-desktop/resources/app.asar.unpacked/node_modules/
    patchelf --add-needed ${libpulseaudio}/lib/libpulse.so "$out/lib/signal-desktop/resources/app.asar.unpacked/node_modules/@signalapp/ringrtc/build/linux/libringrtc-${ARCH}.node"
@ -295,7 +297,6 @@ stdenv.mkDerivation rec {
      equirosa
      urandom
      bkchr
-      teutat3s
      emily
      Gliczy
    ];
--- a/pkgs/by-name/si/signal-desktop/package.nix
+++ b/pkgs/by-name/si/signal-desktop/package.nix
@ -218,7 +218,7 @@ stdenv.mkDerivation (finalAttrs: {

  desktopItems = [
    (makeDesktopItem {
-      name = finalAttrs.pname;
+      name = "signal";
      desktopName = "Signal";
      exec = "${finalAttrs.meta.mainProgram} %U";
      type = "Application";
@ -269,6 +269,7 @@ stdenv.mkDerivation (finalAttrs: {
      ++ lib.optional withAppleEmojis unfree;
    maintainers = with lib.maintainers; [
      marcin-serwin
+      teutat3s
    ];
    mainProgram = "signal-desktop";
    platforms = [
--- a/pkgs/by-name/sn/snipe-it/package.nix
+++ b/pkgs/by-name/sn/snipe-it/package.nix
@ -9,16 +9,16 @@

 php84.buildComposerProject2 (finalAttrs: {
  pname = "snipe-it";
-  version = "8.1.2";
+  version = "8.1.3";

  src = fetchFromGitHub {
    owner = "grokability";
    repo = "snipe-it";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-tF7lTkmowJAEz2BGNWK2yHkPYafS9Rs5Z98snsbCNQU=";
+    hash = "sha256-SzL1api9hObdvhKRtBrzgvZNuJHAoeB2GCt2etCZ6Kw=";
  };

-  vendorHash = "sha256-wVRmvxcrsu5ZBPYrIx9p4+ddWTgBBaeLvyqFMPj3iIg=";
+  vendorHash = "sha256-KOzPzKN1HXFidjXWe8tNPwFJ8DmdrkCDKeChNhGcTDo=";

  postInstall = ''
    snipe_it_out="$out/share/php/snipe-it"
--- a/pkgs/by-name/sp/spotify-player/package.nix
+++ b/pkgs/by-name/sp/spotify-player/package.nix
@ -46,17 +46,17 @@ assert lib.assertOneOf "withAudioBackend" withAudioBackend [

 rustPlatform.buildRustPackage rec {
  pname = "spotify-player";
-  version = "0.20.4";
+  version = "0.20.5";

  src = fetchFromGitHub {
    owner = "aome510";
    repo = "spotify-player";
    tag = "v${version}";
-    hash = "sha256-5N/zTkNgcIk/Ml11Oo+jyoO0r2Hh9SxFL+tdhD/1X/4=";
+    hash = "sha256-NlMQgVkMVCVrMv4IyFtPmRkAmf2k4F0dp6e8s63aBHg=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-0vIhAJ3u+PfujUGI07fddDs33P35Q4CSDz1sMuQwVws=";
+  cargoHash = "sha256-glQh6PzwJp5o35aXRW4+Pq2iSeGg9vjR5fJQomPpSOc=";

  nativeBuildInputs =
    [
--- a/pkgs/by-name/st/stalwart-mail/package.nix
+++ b/pkgs/by-name/st/stalwart-mail/package.nix
@ -15,10 +15,11 @@
  rocksdb,
  callPackage,
  withFoundationdb ? false,
+  stalwartEnterprise ? false,
 }:

 rustPlatform.buildRustPackage rec {
-  pname = "stalwart-mail";
+  pname = "stalwart-mail" + (lib.optionalString stalwartEnterprise "-enterprise");
  version = "0.11.8";

  src = fetchFromGitHub {
@ -46,15 +47,18 @@ rustPlatform.buildRustPackage rec {

  # Issue: https://github.com/stalwartlabs/mail-server/issues/1104
  buildNoDefaultFeatures = true;
-  buildFeatures = [
-    "sqlite"
-    "postgres"
-    "mysql"
-    "rocks"
-    "elastic"
-    "s3"
-    "redis"
-  ] ++ lib.optionals withFoundationdb [ "foundationdb" ];
+  buildFeatures =
+    [
+      "sqlite"
+      "postgres"
+      "mysql"
+      "rocks"
+      "elastic"
+      "s3"
+      "redis"
+    ]
+    ++ lib.optionals withFoundationdb [ "foundationdb" ]
+    ++ lib.optionals stalwartEnterprise [ "enterprise" ];

  env = {
    OPENSSL_NO_VENDOR = true;
@ -154,7 +158,17 @@ rustPlatform.buildRustPackage rec {
    description = "Secure & Modern All-in-One Mail Server (IMAP, JMAP, SMTP)";
    homepage = "https://github.com/stalwartlabs/mail-server";
    changelog = "https://github.com/stalwartlabs/mail-server/blob/main/CHANGELOG.md";
-    license = lib.licenses.agpl3Only;
+    license =
+      [ lib.licenses.agpl3Only ]
+      ++ lib.optionals stalwartEnterprise [
+        {
+          fullName = "Stalwart Enterprise License 1.0 (SELv1) Agreement";
+          url = "https://github.com/stalwartlabs/mail-server/blob/main/LICENSES/LicenseRef-SEL.txt";
+          free = false;
+          redistributable = false;
+        }
+      ];
+
    maintainers = with lib.maintainers; [
      happysalada
      onny
--- a/pkgs/by-name/sy/synapse-admin-etkecc/package.nix
+++ b/pkgs/by-name/sy/synapse-admin-etkecc/package.nix
@ -17,18 +17,18 @@ assert lib.asserts.assertMsg (

 stdenv.mkDerivation (finalAttrs: {
  pname = "synapse-admin-etkecc";
-  version = "0.10.3-etke39";
+  version = "0.10.4-etke40";

  src = fetchFromGitHub {
    owner = "etkecc";
    repo = "synapse-admin";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-1jE4QrHAnH27FrfpgM8rKd4I2AAJArtL0jgcWVc8TrU=";
+    hash = "sha256-QIOQ25K/QCpSAz3HMOADSIVb3iqfdNCNmWrn7xD0ytU=";
  };

  yarnOfflineCache = fetchYarnDeps {
    yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-60rS/OfPEQmmZ5j7mUjMPyK9prgNOX7MkYpu9djdjxQ=";
+    hash = "sha256-YQZN9tj0zGnC4gmTvHM32mdaOw5RFuUL2ZKd9/8GNZA=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ue/uesave/package.nix
+++ b/pkgs/by-name/ue/uesave/package.nix
@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "uesave";
-  version = "0.5.0";
+  version = "0.6.2";
  src = fetchFromGitHub {
    owner = "trumank";
    repo = "uesave-rs";
    rev = "v${version}";
-    hash = "sha256-9gOOSLejVfR1KJMhcNuKDkuTOvPC6sNG8xQOZlt8NxI=";
+    hash = "sha256-cwkeuHmtIS8zTxTSa1qLtWfN2OZinqKngMEYvrCCAk0=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-rAbZfAAW+/7wjsVg9x/OkoCmSbUWeuIkRUYlF+PY0Vs=";
+  cargoHash = "sha256-QGhaaBvxKYnljrkCCcFZLALppvM15c8Xtn36SecaNJ8=";

  nativeInstallCheckInputs = [
    versionCheckHook
--- a/pkgs/by-name/ug/ugs/package.nix
+++ b/pkgs/by-name/ug/ugs/package.nix
@ -19,11 +19,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "ugs";
-  version = "2.1.13";
+  version = "2.1.14";

  src = fetchzip {
    url = "https://github.com/winder/Universal-G-Code-Sender/releases/download/v${version}/UniversalGcodeSender.zip";
-    hash = "sha256-LgbZds747/ll9kwIlDR62c9GcnxTcz1TNbAAVXwg3wY=";
+    hash = "sha256-yPamI5Ww56J+jQ3IZW2VKtyW19SHZ1Cxhq2dOAOiUMo=";
  };

  dontUnpack = true;
--- a/pkgs/by-name/ya/yandex-music/package.nix
+++ b/pkgs/by-name/ya/yandex-music/package.nix
@ -29,13 +29,13 @@ assert lib.assertMsg (trayStyle >= 1 && trayStyle <= 3) "Tray style must be with
 assert lib.assertMsg (vibeAnimationMaxFps >= 0) "Vibe animation max FPS must be greater then 0";
 stdenvNoCC.mkDerivation rec {
  pname = "yandex-music";
-  version = "5.46.0";
+  version = "5.50.0";

  src = fetchFromGitHub {
    owner = "cucumber-sp";
    repo = "yandex-music-linux";
    rev = "v${version}";
-    hash = "sha256-JyDpJCNHmPV1l9+//3sgJGkD+pewuoAb33hgTUi5Ukc=";
+    hash = "sha256-xn/9LjRLm6CNLrnrLiYr9deeo09iRMEKCRFuM3SELjw=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ya/yandex-music/ym_info.json
+++ b/pkgs/by-name/ya/yandex-music/ym_info.json
@ -1,6 +1,6 @@
 {
-  "version": "5.46.0",
-  "exe_name": "Yandex_Music_x64_5.46.0.exe",
-  "exe_link": "https://music-desktop-application.s3.yandex.net/stable/Yandex_Music_x64_5.46.0.exe",
-  "exe_hash": "sha256-gvdJ/ucPeSG/oSD6ullFzWdRYzu0ovxo0qK8ZjLHi+g="
+  "version": "5.50.0",
+  "exe_name": "Yandex_Music_x64_5.50.0.exe",
+  "exe_link": "https://music-desktop-application.s3.yandex.net/stable/Yandex_Music_x64_5.50.0.exe",
+  "exe_hash": "sha256-l0QyY8iJkBO0hPUZ1gA0wyJgppO46nURa3L7JzxRBG0="
 }
--- a/pkgs/by-name/zm/zmap/package.nix
+++ b/pkgs/by-name/zm/zmap/package.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "zmap";
-  version = "4.3.3";
+  version = "4.3.4";

  src = fetchFromGitHub {
    owner = "zmap";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-BxvmbLZCuGsUZ+ajWUOrchojJ5lipTDOrHKb+fmKTbM=";
+    sha256 = "sha256-fHCVo8OwQUzpdDq7dMBxvK15Ojth5UmNoPTVuTGUP58=";
  };

  cmakeFlags = [ "-DRESPECT_INSTALL_PREFIX_CONFIG=ON" ];
--- a/pkgs/development/python-modules/docling/default.nix
+++ b/pkgs/development/python-modules/docling/default.nix
@ -52,14 +52,14 @@

 buildPythonPackage rec {
  pname = "docling";
-  version = "2.31.0";
+  version = "2.31.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "docling-project";
    repo = "docling";
    tag = "v${version}";
-    hash = "sha256-hvNvplEjF/zEchJBN2yJ0/D5Yec/Grr6kdpzRLXeyZU=";
+    hash = "sha256-XGOEYGv5l+7PO03S1YljjU//BuJZ1xpclrVnKTff7bg=";
  };

  build-system = [
--- a/pkgs/development/python-modules/litellm/default.nix
+++ b/pkgs/development/python-modules/litellm/default.nix
@ -37,11 +37,12 @@
  uvloop,
  uvicorn,
  nixosTests,
+  nix-update-script,
 }:

 buildPythonPackage rec {
  pname = "litellm";
-  version = "1.65.0";
+  version = "1.69.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -50,7 +51,7 @@ buildPythonPackage rec {
    owner = "BerriAI";
    repo = "litellm";
    tag = "v${version}-stable";
-    hash = "sha256-q6FDgSwU3G41bVvdofsTBVG90xoqi+NP6zUg9geNz9I=";
+    hash = "sha256-W2uql9fKzwAmSgeLTuESguh+dVn+b3JNTeGlCc9NP2A=";
  };

  build-system = [ poetry-core ];
@ -99,11 +100,20 @@ buildPythonPackage rec {

  pythonImportsCheck = [ "litellm" ];

+  # Relax dependency check on openai, may not be needed in the future
+  pythonRelaxDeps = [ "openai" ];
+
  # access network
  doCheck = false;

-  passthru.tests = {
-    inherit (nixosTests) litellm;
+  passthru = {
+    tests = { inherit (nixosTests) litellm; };
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--version-regex"
+        "v([0-9]+\\.[0-9]+\\.[0-9]+)-stable"
+      ];
+    };
  };

  meta = {
--- a/pkgs/development/python-modules/openai/default.nix
+++ b/pkgs/development/python-modules/openai/default.nix
@ -46,7 +46,7 @@

 buildPythonPackage rec {
  pname = "openai";
-  version = "1.78.0";
+  version = "1.78.1";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -55,7 +55,7 @@ buildPythonPackage rec {
    owner = "openai";
    repo = "openai-python";
    tag = "v${version}";
-    hash = "sha256-LY9px7l0xY1nnCagepm5p1USw4WW15Sc1UN7+Ep7bqo=";
+    hash = "sha256-rdK4usuFVhPpDL3jnSkapJfDfLOI5EH8zeS0a7xoy/g=";
  };

  postPatch = ''substituteInPlace pyproject.toml --replace-fail "hatchling==1.26.3" "hatchling"'';
--- a/pkgs/development/python-modules/plotpy/default.nix
+++ b/pkgs/development/python-modules/plotpy/default.nix
@ -32,14 +32,14 @@

 buildPythonPackage rec {
  pname = "plotpy";
-  version = "2.7.3";
+  version = "2.7.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "PlotPyStack";
    repo = "PlotPy";
    tag = "v${version}";
-    hash = "sha256-Z8aCDTBRdksbjjH5P+OXln3CHciw1MuYQN3K6KOcouk=";
+    hash = "sha256-FmSFcCAJZyzD9qRE+L2oxWtyh2spJSLRq+xtx4e1Rhg=";
  };

  build-system = [
@ -85,27 +85,32 @@ buildPythonPackage rec {

  passthru = {
    tests = {
-      # Upstream doesn't officially supports all of them, although they use
-      # qtpy, see: https://github.com/PlotPyStack/PlotPy/issues/20 . When this
-      # package was created, all worked besides withPySide2, with which there
-      # was a peculiar segmentation fault during the tests. In anycase, PySide2
-      # shouldn't be used for modern applications.
      withPyQt6 = plotpy.override {
        pyqt6 = pyqt6;
        qt6 = qt6;
      };
-      withPySide6 = plotpy.override {
-        pyqt6 = pyside6;
-        qt6 = qt6;
-      };
      withPyQt5 = plotpy.override {
        pyqt6 = pyqt5;
        qt6 = qt5;
      };
+    };
+    # Upstream doesn't officially supports all of them, although they use
+    # qtpy, see: https://github.com/PlotPyStack/PlotPy/issues/20
+    knownFailingTests = {
+      # Was failing with a peculiar segmentation fault during the tests, since
+      # this package was added to Nixpkgs. This is not too bad as PySide2
+      # shouldn't be used for modern applications.
      withPySide2 = plotpy.override {
        pyqt6 = pyside2;
        qt6 = qt5;
      };
+      # Has started failing too similarly to pyside2, ever since a certain
+      # version bump. See also:
+      # https://github.com/PlotPyStack/PlotPy/blob/v2.7.4/README.md?plain=1#L62
+      withPySide6 = plotpy.override {
+        pyqt6 = pyside6;
+        qt6 = qt6;
+      };
    };
  };

--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@ -412,9 +412,17 @@ lib.makeOverridable (
            if kernelConf.target == "uImage" && stdenv.hostPlatform.linuxArch == "arm" then
              "uinstall"
            else if
-              kernelConf.target == "zImage"
-              || kernelConf.target == "Image.gz"
-              || kernelConf.target == "vmlinuz.efi"
+              (
+                kernelConf.target == "zImage"
+                || kernelConf.target == "Image.gz"
+                || kernelConf.target == "vmlinuz.efi"
+              )
+              && builtins.elem stdenv.hostPlatform.linuxArch [
+                "arm"
+                "arm64"
+                "parisc"
+                "riscv"
+              ]
            then
              "zinstall"
            else
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@ -16,16 +16,16 @@ let
  variants = {
    # ./update-zen.py zen
    zen = {
-      version = "6.14.5"; # zen
+      version = "6.14.6"; # zen
      suffix = "zen1"; # zen
-      sha256 = "12ikiicar6agap4i7qpzlxabqrgqdc69im3ly9m6rrydhb5ig2an"; # zen
+      sha256 = "0qrx0c8bza9jj84ax209h3b9w2yn2sh122qj9ki77c8wgp6rwvrm"; # zen
      isLqx = false;
    };
    # ./update-zen.py lqx
    lqx = {
-      version = "6.14.5"; # lqx
+      version = "6.14.6"; # lqx
      suffix = "lqx1"; # lqx
-      sha256 = "18h9qxd1ljkqff4nh96nviqzhss2jzaia3h0wijwa6r7d5w4nk2z"; # lqx
+      sha256 = "0l2k4c1jv167dxx99r62anb1jwp4hz698z6ysdaagary103x8wk3"; # lqx
      isLqx = true;
    };
  };
--- a/pkgs/os-specific/linux/rtl8821ce/default.nix
+++ b/pkgs/os-specific/linux/rtl8821ce/default.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "rtl8821ce";
-  version = "0-unstable-2025-03-31";
+  version = "0-unstable-2025-05-02";

  src = fetchFromGitHub {
    owner = "tomaspinho";
    repo = "rtl8821ce";
-    rev = "98cff1d7dcbf17b36a98bac342df75dfe0b79017";
-    hash = "sha256-23UJE3EzWufjuAU+iBOk5Ia2xUWxQQGI6/eCp1UmRUA=";
+    rev = "6208d1dd190b7cb60bbbf760505bcb1c250518c2";
+    hash = "sha256-d2KWiUxx3/rZvobOzvK5nyGdovovOf8g2MaEd2QW+Pc=";
  };

  hardeningDisable = [ "pic" ];
--- a/pkgs/tools/audio/beets/default.nix
+++ b/pkgs/tools/audio/beets/default.nix
@ -4,7 +4,6 @@
  config,
  fetchFromGitHub,
  python3Packages,
-  fetchpatch,
 }:
 /*
  ** To customize the enabled beets plugins, use the pluginOverrides input to the
@ -21,24 +20,8 @@
 */
 let
  extraPatches = [
-    (fetchpatch {
-      # Already on master. TODO: remove when updating to the next release
-      # Issue: https://github.com/beetbox/beets/issues/5527
-      # PR: https://github.com/beetbox/beets/pull/5650
-      name = "fix-im-backend";
-      url = "https://github.com/beetbox/beets/commit/1f938674015ee71431fe9bd97c2214f58473efd2.patch";
-      hash = "sha256-koCYeiUhk1ifo6CptOSu3p7Nz0FFUeiuArTknM/tpVQ=";
-      excludes = [
-        "docs/changelog.rst"
-      ];
-    })
    # Bash completion fix for Nix
    ./patches/bash-completion-always-print.patch
-    # Remove after next release.
-    (fetchpatch {
-      url = "https://github.com/beetbox/beets/commit/bcc79a5b09225050ce7c88f63dfa56f49f8782a8.patch?full_index=1";
-      hash = "sha256-Y2Q5Co3UlDGKuzfxUvdUY3rSMNpsBoDW03ZWZOfzp3Y=";
-    })
  ];
 in
 lib.makeExtensible (
@ -48,12 +31,12 @@ lib.makeExtensible (

    beets-stable = callPackage ./common.nix rec {
      inherit python3Packages extraPatches;
-      version = "2.2.0";
+      version = "2.3.0";
      src = fetchFromGitHub {
        owner = "beetbox";
        repo = "beets";
        tag = "v${version}";
-        hash = "sha256-jhwXRgUUQJgQ/PLwvY1UfHCJ9UC8DcdBpE/janao0RM=";
+        hash = "sha256-mH3m2O+q5Ys9DJD3ulmhViyf/VPEpHevjmNerVe327s=";
      };
    };

@ -61,18 +44,19 @@ lib.makeExtensible (

    beets-unstable = callPackage ./common.nix {
      inherit python3Packages;
-      version = "2.2.0-unstable-2025-03-12";
+      version = "2.3.0";
      src = fetchFromGitHub {
        owner = "beetbox";
        repo = "beets";
-        rev = "670a3bcd17a46883c71cf07dd313fcd0dff4be9d";
-        hash = "sha256-hSY7FhpPL4poOY1/gqk7oLNgQ7KA/MJqx50xOLIP0QA=";
+        rev = "250b0da900c095a09bedc1a0717381010c01a3c6";
+        hash = "sha256-mH3m2O+q5Ys9DJD3ulmhViyf/VPEpHevjmNerVe327s=";
      };
    };

    alternatives = callPackage ./plugins/alternatives.nix { beets = self.beets-minimal; };
    audible = callPackage ./plugins/audible.nix { beets = self.beets-minimal; };
    copyartifacts = callPackage ./plugins/copyartifacts.nix { beets = self.beets-minimal; };
+    filetote = callPackage ./plugins/filetote.nix { beets = self.beets-minimal; };
  }
  // lib.optionalAttrs config.allowAliases {
    extrafiles = throw "extrafiles is unmaintained since 2020 and broken since beets 2.0.0";
--- a/pkgs/tools/audio/beets/plugins/alternatives.nix
+++ b/pkgs/tools/audio/beets/plugins/alternatives.nix
@ -8,14 +8,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "beets-alternatives";
-  version = "0.13.2";
+  version = "0.13.3";
  pyproject = true;

  src = fetchFromGitHub {
    repo = "beets-alternatives";
    owner = "geigerzaehler";
    tag = "v${version}";
-    hash = "sha256-OoQsP+QVIOnSA4oy1a8JJ3VeCUS+GR8sPPOysvmRMqI=";
+    hash = "sha256-j56AzbpZFACXy5KqafE8PCC+zM6pXrxr/rWy9UjZPQg=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/audio/beets/plugins/audible.nix
+++ b/pkgs/tools/audio/beets/plugins/audible.nix
@ -17,19 +17,21 @@ python3Packages.buildPythonApplication rec {
    hash = "sha256-Sds16h+W9t7N755ADPXXDi+SxwouBMxP9ApUqaXedqY=";
  };

+  nativeBuildInputs = [
+    beets
+  ];
+
  pythonRelaxDeps = true;

  build-system = with python3Packages; [
    hatchling
  ];

-  dependencies =
-    [ beets ]
-    ++ (with python3Packages; [
-      markdownify
-      natsort
-      tldextract
-    ]);
+  dependencies = with python3Packages; [
+    markdownify
+    natsort
+    tldextract
+  ];

  passthru = {
    updateScript = nix-update-script { };
--- a/pkgs/tools/audio/beets/plugins/copyartifacts.nix
+++ b/pkgs/tools/audio/beets/plugins/copyartifacts.nix
@ -19,7 +19,6 @@ python3Packages.buildPythonApplication rec {
  };

  postPatch = ''
-    sed -i -e '/install_requires/,/\]/{/beets/d}' setup.py
    sed -i -e '/namespace_packages/d' setup.py
    printf 'from pkgutil import extend_path\n__path__ = extend_path(__path__, __name__)\n' >beetsplug/__init__.py

@ -28,13 +27,20 @@ python3Packages.buildPythonApplication rec {
    sed -i -e 's/util\.py3_path/os.fsdecode/g' tests/_common.py
  '';

-  build-system = with python3Packages; [ setuptools ];
+  nativeBuildInputs = [
+    beets
+  ];

-  dependencies = with python3Packages; [ six ];
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  dependencies = with python3Packages; [
+    six
+  ];

  nativeCheckInputs = [
    python3Packages.pytestCheckHook
-    beets
    writableTmpDirAsHomeHook
  ];

--- a/pkgs/tools/audio/beets/plugins/filetote.nix
+++ b/pkgs/tools/audio/beets/plugins/filetote.nix
@ -0,0 +1,83 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+  beets,
+  beetsPackages,
+  writableTmpDirAsHomeHook,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "beets-filetote";
+  version = "1.0.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "gtronset";
+    repo = "beets-filetote";
+    tag = "v${version}";
+    hash = "sha256-LTJwZI/kQc+Iv0y8jAi5Xdh4wLEwbTA9hV76ndQsQzU=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml --replace-fail "poetry-core<2.0.0" "poetry-core"
+  '';
+
+  nativeBuildInputs = [
+    beets
+  ];
+
+  build-system = [ python3Packages.poetry-core ];
+
+  dependencies = with python3Packages; [
+    mediafile
+    reflink
+    toml
+    typeguard
+  ];
+
+  optional-dependencies = {
+    lint = with python3Packages; [
+      black
+      check-manifest
+      flake8
+      flake8-bugbear
+      flake8-bugbear-pyi
+      isort
+      mypy
+      pylint
+      typing_extensions
+    ];
+    test = with python3Packages; [
+      beetsPackages.audible
+      mediafile
+      pytest
+      reflink
+      toml
+      typeguard
+    ];
+    dev = optional-dependencies.lint ++ optional-dependencies.test ++ [ python3Packages.tox ];
+  };
+
+  pytestFlagsArray = [ "-r fEs" ];
+
+  disabledTestPaths = [
+    "tests/test_cli_operation.py"
+    "tests/test_pruning.py"
+    "tests/test_version.py"
+  ];
+
+  nativeCheckInputs = [
+    python3Packages.pytestCheckHook
+    writableTmpDirAsHomeHook
+  ] ++ optional-dependencies.test;
+
+  meta = with lib; {
+    description = "Beets plugin to move non-music files during the import process";
+    homepage = "https://github.com/gtronset/beets-filetote";
+    changelog = "https://github.com/gtronset/beets-filetote/blob/${src.rev}/CHANGELOG.md";
+    maintainers = with maintainers; [ dansbandit ];
+    license = licenses.mit;
+    inherit (beets.meta) platforms;
+  };
+}
--- a/pkgs/tools/filesystems/ceph/arrow-cpp-19.nix
+++ b/pkgs/tools/filesystems/ceph/arrow-cpp-19.nix
@ -0,0 +1,335 @@
+# This is is arrow-cpp < 20 used as a workaround for
+# Ceph not supporting >= yet, taken from nixpkgs commit
+#     97ae53798f6a7c7c3c259ad8c2cbcede6ca34b2a~
+# This should be entirely removed when upstream bug
+#     https://tracker.ceph.com/issues/71269
+# is fixed.
+{
+  stdenv,
+  lib,
+  fetchurl,
+  fetchFromGitHub,
+  fixDarwinDylibNames,
+  autoconf,
+  aws-sdk-cpp,
+  aws-sdk-cpp-arrow ? aws-sdk-cpp.override {
+    apis = [
+      "cognito-identity"
+      "config"
+      "identity-management"
+      "s3"
+      "sts"
+      "transfer"
+    ];
+  },
+  boost,
+  brotli,
+  bzip2,
+  cmake,
+  crc32c,
+  curl,
+  flatbuffers,
+  gflags,
+  glog,
+  google-cloud-cpp,
+  grpc,
+  gtest,
+  libbacktrace,
+  lz4,
+  minio,
+  ninja,
+  nlohmann_json,
+  openssl,
+  perl,
+  pkg-config,
+  protobuf_29,
+  python3,
+  rapidjson,
+  re2,
+  snappy,
+  sqlite,
+  thrift,
+  tzdata,
+  utf8proc,
+  which,
+  zlib,
+  zstd,
+  testers,
+  enableShared ? !stdenv.hostPlatform.isStatic,
+  enableFlight ? stdenv.buildPlatform == stdenv.hostPlatform,
+  # Disable also on RiscV
+  # configure: error: cannot determine number of significant virtual address bits
+  enableJemalloc ?
+    !stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isAarch64 && !stdenv.hostPlatform.isRiscV64,
+  enableS3 ? true,
+  # google-cloud-cpp fails to build on RiscV
+  enableGcs ? !stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isRiscV64,
+}:
+
+let
+  # https://github.com/apache/arrow/issues/45807
+  protobuf = protobuf_29;
+
+  arrow-testing = fetchFromGitHub {
+    name = "arrow-testing";
+    owner = "apache";
+    repo = "arrow-testing";
+    rev = "4d209492d514c2d3cb2d392681b9aa00e6d8da1c";
+    hash = "sha256-IkiCbuy0bWyClPZ4ZEdkEP7jFYLhM7RCuNLd6Lazd4o=";
+  };
+
+  parquet-testing = fetchFromGitHub {
+    name = "parquet-testing";
+    owner = "apache";
+    repo = "parquet-testing";
+    rev = "c7cf1374cf284c0c73024cd1437becea75558bf8";
+    hash = "sha256-DThjyZ34LajHwXZy1IhYKUGUG/ejQ9WvBNuI8eUKmSs=";
+  };
+
+  version = "19.0.1";
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "arrow-cpp";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "apache";
+    repo = "arrow";
+    rev = "apache-arrow-${version}";
+    hash = "sha256-toHwUIOZRpgR0K7pQtT5nqWpO9G7AuHYTcvA6UVg9lA=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/cpp";
+
+  # versions are all taken from
+  # https://github.com/apache/arrow/blob/apache-arrow-${version}/cpp/thirdparty/versions.txt
+
+  # jemalloc: arrow uses a custom prefix to prevent default allocator symbol
+  # collisions as well as custom build flags
+  ${if enableJemalloc then "ARROW_JEMALLOC_URL" else null} = fetchurl {
+    url = "https://github.com/jemalloc/jemalloc/releases/download/5.3.0/jemalloc-5.3.0.tar.bz2";
+    hash = "sha256-LbgtHnEZ3z5xt2QCGbbf6EeJvAU3mDw7esT3GJrs/qo=";
+  };
+
+  # mimalloc: arrow uses custom build flags for mimalloc
+  ARROW_MIMALLOC_URL = fetchFromGitHub {
+    owner = "microsoft";
+    repo = "mimalloc";
+    rev = "v2.0.6";
+    hash = "sha256-u2ITXABBN/dwU+mCIbL3tN1f4c17aBuSdNTV+Adtohc=";
+  };
+
+  ARROW_XSIMD_URL = fetchFromGitHub {
+    owner = "xtensor-stack";
+    repo = "xsimd";
+    rev = "13.0.0";
+    hash = "sha256-qElJYW5QDj3s59L3NgZj5zkhnUMzIP2mBa1sPks3/CE=";
+  };
+
+  ARROW_SUBSTRAIT_URL = fetchFromGitHub {
+    owner = "substrait-io";
+    repo = "substrait";
+    rev = "v0.44.0";
+    hash = "sha256-V739IFTGPtbGPlxcOi8sAaYSDhNUEpITvN9IqdPReug=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    ninja
+    autoconf # for vendored jemalloc
+    flatbuffers
+  ] ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
+  buildInputs =
+    [
+      boost
+      brotli
+      bzip2
+      flatbuffers
+      gflags
+      glog
+      gtest
+      libbacktrace
+      lz4
+      nlohmann_json # alternative JSON parser to rapidjson
+      protobuf # substrait requires protobuf
+      rapidjson
+      re2
+      snappy
+      thrift
+      utf8proc
+      zlib
+      zstd
+    ]
+    ++ lib.optionals enableFlight [
+      grpc
+      openssl
+      protobuf
+      sqlite
+    ]
+    ++ lib.optionals enableS3 [
+      aws-sdk-cpp-arrow
+      openssl
+    ]
+    ++ lib.optionals enableGcs [
+      crc32c
+      curl
+      google-cloud-cpp
+      grpc
+      nlohmann_json
+    ];
+
+  preConfigure = ''
+    patchShebangs build-support/
+    substituteInPlace "src/arrow/vendored/datetime/tz.cpp" \
+      --replace-fail 'discover_tz_dir();' '"${tzdata}/share/zoneinfo";'
+  '';
+
+  cmakeFlags =
+    [
+      "-DCMAKE_FIND_PACKAGE_PREFER_CONFIG=ON"
+      "-DARROW_BUILD_SHARED=${if enableShared then "ON" else "OFF"}"
+      "-DARROW_BUILD_STATIC=${if enableShared then "OFF" else "ON"}"
+      "-DARROW_BUILD_TESTS=${if enableShared then "ON" else "OFF"}"
+      "-DARROW_BUILD_INTEGRATION=ON"
+      "-DARROW_BUILD_UTILITIES=ON"
+      "-DARROW_EXTRA_ERROR_CONTEXT=ON"
+      "-DARROW_VERBOSE_THIRDPARTY_BUILD=ON"
+      "-DARROW_DEPENDENCY_SOURCE=SYSTEM"
+      "-Dxsimd_SOURCE=AUTO"
+      "-DARROW_DEPENDENCY_USE_SHARED=${if enableShared then "ON" else "OFF"}"
+      "-DARROW_COMPUTE=ON"
+      "-DARROW_CSV=ON"
+      "-DARROW_DATASET=ON"
+      "-DARROW_FILESYSTEM=ON"
+      "-DARROW_FLIGHT_SQL=${if enableFlight then "ON" else "OFF"}"
+      "-DARROW_HDFS=ON"
+      "-DARROW_IPC=ON"
+      "-DARROW_JEMALLOC=${if enableJemalloc then "ON" else "OFF"}"
+      "-DARROW_JSON=ON"
+      "-DARROW_USE_GLOG=ON"
+      "-DARROW_WITH_BACKTRACE=ON"
+      "-DARROW_WITH_BROTLI=ON"
+      "-DARROW_WITH_BZ2=ON"
+      "-DARROW_WITH_LZ4=ON"
+      "-DARROW_WITH_NLOHMANN_JSON=ON"
+      "-DARROW_WITH_SNAPPY=ON"
+      "-DARROW_WITH_UTF8PROC=ON"
+      "-DARROW_WITH_ZLIB=ON"
+      "-DARROW_WITH_ZSTD=ON"
+      "-DARROW_MIMALLOC=ON"
+      "-DARROW_SUBSTRAIT=ON"
+      "-DARROW_FLIGHT=${if enableFlight then "ON" else "OFF"}"
+      "-DARROW_FLIGHT_TESTING=${if enableFlight then "ON" else "OFF"}"
+      "-DARROW_S3=${if enableS3 then "ON" else "OFF"}"
+      "-DARROW_GCS=${if enableGcs then "ON" else "OFF"}"
+      # Parquet options:
+      "-DARROW_PARQUET=ON"
+      "-DPARQUET_BUILD_EXECUTABLES=ON"
+      "-DPARQUET_REQUIRE_ENCRYPTION=ON"
+    ]
+    ++ lib.optionals (!enableShared) [ "-DARROW_TEST_LINKAGE=static" ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      "-DCMAKE_INSTALL_RPATH=@loader_path/../lib" # needed for tools executables
+    ]
+    ++ lib.optionals (!stdenv.hostPlatform.isx86_64) [ "-DARROW_USE_SIMD=OFF" ]
+    ++ lib.optionals enableS3 [
+      "-DAWSSDK_CORE_HEADER_FILE=${aws-sdk-cpp-arrow}/include/aws/core/Aws.h"
+    ];
+
+  doInstallCheck = true;
+  ARROW_TEST_DATA = lib.optionalString finalAttrs.doInstallCheck "${arrow-testing}/data";
+  PARQUET_TEST_DATA = lib.optionalString finalAttrs.doInstallCheck "${parquet-testing}/data";
+  GTEST_FILTER =
+    let
+      # Upstream Issue: https://issues.apache.org/jira/browse/ARROW-11398
+      filteredTests =
+        lib.optionals stdenv.hostPlatform.isAarch64 [
+          "TestFilterKernelWithNumeric/3.CompareArrayAndFilterRandomNumeric"
+          "TestFilterKernelWithNumeric/7.CompareArrayAndFilterRandomNumeric"
+          "TestCompareKernel.PrimitiveRandomTests"
+        ]
+        ++ lib.optionals enableS3 [
+          "S3OptionsTest.FromUri"
+          "S3RegionResolutionTest.NonExistentBucket"
+          "S3RegionResolutionTest.PublicBucket"
+          "S3RegionResolutionTest.RestrictedBucket"
+          "TestMinioServer.Connect"
+          "TestS3FS.*"
+          "TestS3FSGeneric.*"
+        ]
+        ++ lib.optionals stdenv.hostPlatform.isDarwin [
+          # TODO: revisit at 12.0.0 or when
+          # https://github.com/apache/arrow/commit/295c6644ca6b67c95a662410b2c7faea0920c989
+          # is available, see
+          # https://github.com/apache/arrow/pull/15288#discussion_r1071244661
+          "ExecPlanExecution.StressSourceSinkStopped"
+        ];
+    in
+    lib.optionalString finalAttrs.doInstallCheck "-${lib.concatStringsSep ":" filteredTests}";
+
+  __darwinAllowLocalNetworking = true;
+
+  nativeInstallCheckInputs =
+    [
+      perl
+      which
+      sqlite
+    ]
+    ++ lib.optionals enableS3 [ minio ]
+    ++ lib.optionals enableFlight [ python3 ];
+
+  installCheckPhase =
+    let
+      disabledTests = [
+        # flaky
+        "arrow-flight-test"
+        # requires networking
+        "arrow-gcsfs-test"
+        "arrow-flight-integration-test"
+      ];
+    in
+    ''
+      runHook preInstallCheck
+
+      ctest -L unittest --exclude-regex '^(${lib.concatStringsSep "|" disabledTests})$'
+
+      runHook postInstallCheck
+    '';
+
+  meta = with lib; {
+    description = "Cross-language development platform for in-memory data";
+    homepage = "https://arrow.apache.org/docs/cpp/";
+    license = licenses.asl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [
+      tobim
+      veprbl
+      cpcloud
+    ];
+    pkgConfigModules = [
+      "arrow"
+      "arrow-acero"
+      "arrow-compute"
+      "arrow-csv"
+      "arrow-dataset"
+      "arrow-filesystem"
+      "arrow-flight"
+      "arrow-flight-sql"
+      "arrow-flight-testing"
+      "arrow-json"
+      "arrow-substrait"
+      "arrow-testing"
+      "parquet"
+    ];
+  };
+  passthru = {
+    inherit
+      enableFlight
+      enableJemalloc
+      enableS3
+      enableGcs
+      ;
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+})
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -2538,6 +2538,11 @@ with pkgs;
      # If we want to switch for that before upstream fixes it, use this patch:
      # https://github.com/NixOS/nixpkgs/pull/281858#issuecomment-1899648638
      fmt = fmt_9;
+
+      # Remove once Ceph supports arrow-cpp >= 20, see:
+      # * https://tracker.ceph.com/issues/71269
+      # * https://github.com/NixOS/nixpkgs/issues/406306
+      arrow-cpp = callPackage ../tools/filesystems/ceph/arrow-cpp-19.nix { };
    })
    ceph
    ceph-client
@ -10909,6 +10914,10 @@ with pkgs;

  stalwart-mail-webadmin = stalwart-mail.webadmin;

+  stalwart-mail-enterprise = stalwart-mail.override {
+    stalwartEnterprise = true;
+  };
+
  ruby-zoom = callPackage ../tools/text/ruby-zoom { };

  inherit (callPackages ../servers/monitoring/sensu-go { })