From a167dcb961c32f7baea11c8ae5c7ed17852fd6cb Mon Sep 17 00:00:00 2001
From: arthsmn <arthsmn@proton.me>
Date: Thu, 12 Jun 2025 11:34:50 -0300
Subject: [PATCH 01/92] odin: dev-2025-04 -> dev-2025-06

---
 .../by-name/od/odin/darwin-remove-impure-links.patch | 12 ++++++------
 pkgs/by-name/od/odin/package.nix                     |  4 ++--
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/od/odin/darwin-remove-impure-links.patch b/pkgs/by-name/od/odin/darwin-remove-impure-links.patch
index eb7fa04c415a..3716c6662efd 100644
--- a/pkgs/by-name/od/odin/darwin-remove-impure-links.patch
+++ b/pkgs/by-name/od/odin/darwin-remove-impure-links.patch
@@ -1,12 +1,12 @@
 diff --git a/src/linker.cpp b/src/linker.cpp
-index ec165ef7d..91a28b8fc 100644
+index 2210c13..803b654 100644
 --- a/src/linker.cpp
 +++ b/src/linker.cpp
-@@ -769,18 +769,6 @@ try_cross_linking:;
- 			gbString platform_lib_str = gb_string_make(heap_allocator(), "");
- 			defer (gb_string_free(platform_lib_str));
- 			if (build_context.metrics.os == TargetOs_darwin) {
--				platform_lib_str = gb_string_appendc(platform_lib_str, "-Wl,-syslibroot /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk -L/usr/local/lib ");
+@@ -779,18 +779,6 @@ try_cross_linking:;
+ 				}
+ 				platform_lib_str = gb_string_append_fmt(platform_lib_str, "--sysroot %s ", darwin_sdk_path);
+ 
+-				platform_lib_str = gb_string_appendc(platform_lib_str, "-L/usr/local/lib ");
 -
 -				// Homebrew's default library path, checking if it exists to avoid linking warnings.
 -				if (gb_file_exists("/opt/homebrew/lib")) {
diff --git a/pkgs/by-name/od/odin/package.nix b/pkgs/by-name/od/odin/package.nix
index 6fea6313b0f2..183abca3996b 100644
--- a/pkgs/by-name/od/odin/package.nix
+++ b/pkgs/by-name/od/odin/package.nix
@@ -12,13 +12,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "odin";
-  version = "dev-2025-04";
+  version = "dev-2025-06";
 
   src = fetchFromGitHub {
     owner = "odin-lang";
     repo = "Odin";
     tag = finalAttrs.version;
-    hash = "sha256-dVC7MgaNdgKy3X9OE5ZcNCPnuDwqXszX9iAoUglfz2k=";
+    hash = "sha256-Dhy62+ccIjXUL/lK8IQ+vvGEsTrd153tPp4WIdl3rh4=";
   };
 
   patches = [

From c450a25874c1cb0e09ed41b58bc1ca8da9709b01 Mon Sep 17 00:00:00 2001
From: "Markus S. Wamser" <github-dev@mail2013.wamser.eu>
Date: Fri, 27 Jun 2025 22:52:19 +0200
Subject: [PATCH 02/92] python3Packages.bundlewrap: 4.22.0 -> 4.23.1

also added meta.changelog and cleaned up derivation
---
 .../python-modules/bundlewrap/default.nix     | 33 ++++++++++++-------
 1 file changed, 21 insertions(+), 12 deletions(-)

diff --git a/pkgs/development/python-modules/bundlewrap/default.nix b/pkgs/development/python-modules/bundlewrap/default.nix
index 98d07040218b..30b61ffbd815 100644
--- a/pkgs/development/python-modules/bundlewrap/default.nix
+++ b/pkgs/development/python-modules/bundlewrap/default.nix
@@ -5,37 +5,40 @@
   pythonOlder,
   cryptography,
   jinja2,
+  librouteros,
   mako,
+  packaging,
   passlib,
   pyyaml,
   requests,
   rtoml,
   setuptools,
   tomlkit,
-  librouteros,
   pytestCheckHook,
+  versionCheckHook,
 }:
 
-buildPythonPackage rec {
+let
+  version = "4.23.1";
+in
+buildPythonPackage {
   pname = "bundlewrap";
-  version = "4.22.0";
+  inherit version;
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
   src = fetchFromGitHub {
     owner = "bundlewrap";
     repo = "bundlewrap";
     tag = version;
-    hash = "sha256-F3Ipoep9ZmAqkh8mFLXpaEcYb4dpV9Dt/VgMa9X24Hw=";
+    hash = "sha256-Nzfx2L/FlYXQcbKq/cuRZ+PWnjv4HDld9q01nwQ1sA8=";
   };
 
   build-system = [ setuptools ];
   dependencies = [
-    setuptools
     cryptography
     jinja2
     mako
+    packaging
     passlib
     pyyaml
     requests
@@ -45,18 +48,24 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "bundlewrap" ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+    versionCheckHook
+  ];
+  versionCheckProgram = "${placeholder "out"}/bin/bw";
+  versionCheckProgramArg = "--version";
 
-  pytestFlagsArray = [
+  pytestFlags = [
     # only unit tests as integration tests need a OpenSSH client/server setup
     "tests/unit"
   ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://bundlewrap.org/";
     description = "Easy, Concise and Decentralized Config management with Python";
+    changelog = "https://github.com/bundlewrap/bundlewrap/blob/${version}/CHANGELOG.md";
     mainProgram = "bw";
-    license = [ licenses.gpl3 ];
-    maintainers = with maintainers; [ wamserma ];
+    license = [ lib.licenses.gpl3 ];
+    maintainers = with lib.maintainers; [ wamserma ];
   };
 }

From c002f9ae8dd52d847915c71838007f11d279fe5b Mon Sep 17 00:00:00 2001
From: qbisi <qbisicwate@gmail.com>
Date: Mon, 30 Jun 2025 23:30:17 +0800
Subject: [PATCH 03/92] freecad: remove duplicated cmakeFlag

---
 pkgs/by-name/fr/freecad/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/fr/freecad/package.nix b/pkgs/by-name/fr/freecad/package.nix
index 384a2fd97d8f..2c4dcd465b80 100644
--- a/pkgs/by-name/fr/freecad/package.nix
+++ b/pkgs/by-name/fr/freecad/package.nix
@@ -123,7 +123,6 @@ freecad-utils.makeCustomizable (
 
     cmakeFlags = [
       "-Wno-dev" # turns off warnings which otherwise makes it hard to see what is going on
-      "-DBUILD_FLAT_MESH:BOOL=ON"
       "-DBUILD_DRAWING=ON"
       "-DBUILD_FLAT_MESH:BOOL=ON"
       "-DINSTALL_TO_SITEPACKAGES=OFF"

From 51fb016f9d7096334a7f1a6a007c94c7746aca8e Mon Sep 17 00:00:00 2001
From: qbisi <qbisicwate@gmail.com>
Date: Mon, 30 Jun 2025 23:34:15 +0800
Subject: [PATCH 04/92] freecad: fix build with vtk 9.5

---
 pkgs/by-name/fr/freecad/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/fr/freecad/package.nix b/pkgs/by-name/fr/freecad/package.nix
index 2c4dcd465b80..926876295c45 100644
--- a/pkgs/by-name/fr/freecad/package.nix
+++ b/pkgs/by-name/fr/freecad/package.nix
@@ -119,6 +119,11 @@ freecad-utils.makeCustomizable (
         url = "https://github.com/FreeCAD/FreeCAD/commit/8e04c0a3dd9435df0c2dec813b17d02f7b723b19.patch?full_index=1";
         hash = "sha256-H6WbJFTY5/IqEdoi5N+7D4A6pVAmZR4D+SqDglwS18c=";
       })
+      # https://github.com/FreeCAD/FreeCAD/pull/22221
+      (fetchpatch {
+        url = "https://github.com/FreeCAD/FreeCAD/commit/3d2b7dc9c7ac898b30fe469b7cbd424ed1bca0a2.patch?full_index=1";
+        hash = "sha256-XCQdv/+dYdJ/ptA2VKrD63qYILyaP276ISMkmWLtT30=";
+      })
     ];
 
     cmakeFlags = [

From c6b8e4470cae3b2e14049f5a4a59a82444fdbb5b Mon Sep 17 00:00:00 2001
From: Yueh-Shun Li <shamrocklee@posteo.net>
Date: Tue, 1 Jul 2025 11:53:18 +0800
Subject: [PATCH 05/92] fetchhg: allow hash to be empty string and move
 assertion down under outputHash

---
 pkgs/build-support/fetchhg/default.nix | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/pkgs/build-support/fetchhg/default.nix b/pkgs/build-support/fetchhg/default.nix
index dd6a8cfa87be..48255b984aca 100644
--- a/pkgs/build-support/fetchhg/default.nix
+++ b/pkgs/build-support/fetchhg/default.nix
@@ -13,9 +13,6 @@
   preferLocalBuild ? true,
 }:
 
-if hash != null && sha256 != null then
-  throw "Only one of sha256 or hash can be set"
-else
   # TODO: statically check if mercurial as the https support if the url starts with https.
   stdenvNoCC.mkDerivation {
     name = "hg-archive" + (lib.optionalString (name != null) "-${name}");
@@ -26,15 +23,20 @@ else
 
     subrepoClause = lib.optionalString fetchSubrepos "S";
 
-    outputHashAlgo = if hash != null then null else "sha256";
+    outputHashAlgo = if hash != null && hash != "" then null else "sha256";
     outputHashMode = "recursive";
     outputHash =
-      if hash != null then
-        hash
-      else if sha256 != null then
-        sha256
-      else
-        lib.fakeSha256;
+      lib.throwIf
+        (hash != null && sha256 != null)
+        "Only one of sha256 or hash can be set"
+        (
+          if hash != null then
+            hash
+          else if sha256 != null then
+            sha256
+          else
+            ""
+        );
 
     inherit url rev;
     inherit preferLocalBuild;

From e4be7b0500e7dddddda91357e417a2f72ecb0f52 Mon Sep 17 00:00:00 2001
From: Florian Brandes <florian.brandes@posteo.de>
Date: Mon, 30 Jun 2025 17:25:18 +0200
Subject: [PATCH 06/92] octoprint: fix header issue with tornado

Signed-off-by: Florian Brandes <florian.brandes@posteo.de>
---
 pkgs/by-name/oc/octoprint/package.nix | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/pkgs/by-name/oc/octoprint/package.nix b/pkgs/by-name/oc/octoprint/package.nix
index d6d4112bdfbe..8441f3a1b228 100644
--- a/pkgs/by-name/oc/octoprint/package.nix
+++ b/pkgs/by-name/oc/octoprint/package.nix
@@ -16,6 +16,23 @@ let
   py = python3.override {
     self = py;
     packageOverrides = lib.foldr lib.composeExtensions (self: super: { }) ([
+      (
+
+        self: super: {
+          # fix tornado.httputil.HTTPInputError: Multiple host headers not allowed
+          tornado = super.tornado.overridePythonAttrs (oldAttrs: {
+            version = "6.4.2";
+            format = "setuptools";
+            pyproject = null;
+            src = fetchFromGitHub {
+              owner = "tornadoweb";
+              repo = "tornado";
+              tag = "v6.4.2";
+              hash = "sha256-qgJh8pnC1ALF8KxhAYkZFAc0DE6jHVB8R/ERJFL4OFc=";
+            };
+            doCheck = false;
+          });
+        })
       # Built-in dependency
       (self: super: {
         octoprint-filecheck = self.buildPythonPackage rec {

From 5e7cb7d97627ce86bd63f34aefb1a27a5bd98c08 Mon Sep 17 00:00:00 2001
From: Yueh-Shun Li <shamrocklee@posteo.net>
Date: Tue, 1 Jul 2025 12:10:49 +0800
Subject: [PATCH 07/92] fetchhg: use extendMkDerivation

---
 pkgs/build-support/fetchhg/default.nix | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/pkgs/build-support/fetchhg/default.nix b/pkgs/build-support/fetchhg/default.nix
index 48255b984aca..4c8a8f312929 100644
--- a/pkgs/build-support/fetchhg/default.nix
+++ b/pkgs/build-support/fetchhg/default.nix
@@ -3,6 +3,12 @@
   stdenvNoCC,
   mercurial,
 }:
+
+lib.extendMkDerivation {
+  constructDrv = stdenvNoCC.mkDerivation;
+
+  extendDrvArgs =
+    finalAttrs:
 {
   name ? null,
   url,
@@ -12,9 +18,8 @@
   fetchSubrepos ? false,
   preferLocalBuild ? true,
 }:
-
   # TODO: statically check if mercurial as the https support if the url starts with https.
-  stdenvNoCC.mkDerivation {
+  {
     name = "hg-archive" + (lib.optionalString (name != null) "-${name}");
     builder = ./builder.sh;
     nativeBuildInputs = [ mercurial ];
@@ -40,4 +45,8 @@
 
     inherit url rev;
     inherit preferLocalBuild;
-  }
+  };
+
+  # No ellipsis
+  inheritFunctionArgs = false;
+}

From e855ce20c9629253c0e1c447a09f6d7e28c081e3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 2 Jul 2025 08:42:41 +0000
Subject: [PATCH 08/92] sidplayfp: 2.14.1 -> 2.15.0

---
 pkgs/by-name/si/sidplayfp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/si/sidplayfp/package.nix b/pkgs/by-name/si/sidplayfp/package.nix
index 0ef29c2b851e..275ae26bc196 100644
--- a/pkgs/by-name/si/sidplayfp/package.nix
+++ b/pkgs/by-name/si/sidplayfp/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sidplayfp";
-  version = "2.14.1";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "libsidplayfp";
     repo = "sidplayfp";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-t2bZcslHPRxrTt3cDW6mTXK35/MMw1u1CnVXTzN/UEs=";
+    hash = "sha256-piPvNXEmjqz7r0+Uft6cmSJsWJdxwMJFpluVV1hEO2U=";
   };
 
   strictDeps = true;

From 2e36163f1c22a06d34b1c68f0a9e7b7be238ac87 Mon Sep 17 00:00:00 2001
From: Paul Meyer <katexochen0@gmail.com>
Date: Wed, 2 Jul 2025 19:34:49 +0200
Subject: [PATCH 09/92] nvidia_x11.mkDriver: use finalAttrs

This allows correct usage of overrideAttrs and also ensures
overrides are properly propagated to the packages in passthru.

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
---
 pkgs/os-specific/linux/nvidia-x11/generic.nix | 396 +++++++++---------
 1 file changed, 199 insertions(+), 197 deletions(-)

diff --git a/pkgs/os-specific/linux/nvidia-x11/generic.nix b/pkgs/os-specific/linux/nvidia-x11/generic.nix
index ed2cb8df588a..eebfe4097e17 100644
--- a/pkgs/os-specific/linux/nvidia-x11/generic.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/generic.nix
@@ -6,9 +6,9 @@
   sha256_aarch64 ? null,
   openSha256 ? null,
   settingsSha256 ? null,
-  settingsVersion ? version,
+  settingsVersion ? null,
   persistencedSha256 ? null,
-  persistencedVersion ? version,
+  persistencedVersion ? null,
   fabricmanagerSha256 ? null,
   fabricmanagerVersion ? version,
   useGLVND ? true,
@@ -140,199 +140,201 @@ let
 
     [1]: https://www.nvidia.com/content/DriverDownloads/licence.php?lang=us
   '';
-
-  self = stdenv.mkDerivation {
-    name = "nvidia-${if useFabricmanager then "dc" else "x11"}-${version}${nameSuffix}";
-
-    builder = ./builder.sh;
-
-    src =
-      if !acceptLicense && (openSha256 == null) then
-        throwLicense
-      else if stdenv.hostPlatform.system == "x86_64-linux" then
-        fetchurl {
-          urls =
-            if args ? url then
-              [ args.url ]
-            else
-              [
-                "https://us.download.nvidia.com/XFree86/Linux-x86_64/${version}/NVIDIA-Linux-x86_64-${version}${pkgSuffix}.run"
-                "https://download.nvidia.com/XFree86/Linux-x86_64/${version}/NVIDIA-Linux-x86_64-${version}${pkgSuffix}.run"
-              ];
-          sha256 = sha256_64bit;
-        }
-      else if stdenv.hostPlatform.system == "i686-linux" then
-        fetchurl {
-          urls =
-            if args ? url then
-              [ args.url ]
-            else
-              [
-                "https://us.download.nvidia.com/XFree86/Linux-x86/${version}/NVIDIA-Linux-x86-${version}${pkgSuffix}.run"
-                "https://download.nvidia.com/XFree86/Linux-x86/${version}/NVIDIA-Linux-x86-${version}${pkgSuffix}.run"
-              ];
-          sha256 = sha256_32bit;
-        }
-      else if stdenv.hostPlatform.system == "aarch64-linux" && sha256_aarch64 != null then
-        fetchurl {
-          urls =
-            if args ? url then
-              [ args.url ]
-            else
-              [
-                "https://us.download.nvidia.com/XFree86/aarch64/${version}/NVIDIA-Linux-aarch64-${version}${pkgSuffix}.run"
-                "https://download.nvidia.com/XFree86/Linux-aarch64/${version}/NVIDIA-Linux-aarch64-${version}${pkgSuffix}.run"
-              ];
-          sha256 = sha256_aarch64;
-        }
-      else
-        throw "nvidia-x11 does not support platform ${stdenv.hostPlatform.system}";
-
-    patches = if libsOnly then null else patches;
-    inherit prePatch postPatch patchFlags;
-    inherit preInstall postInstall;
-    inherit version useGLVND useProfiles;
-    inherit (stdenv.hostPlatform) system;
-    inherit i686bundled;
-
-    outputs =
-      [ "out" ]
-      ++ lib.optional i686bundled "lib32"
-      ++ lib.optional (!libsOnly) "bin"
-      ++ lib.optional (!libsOnly && firmware) "firmware";
-    outputDev = if libsOnly then null else "bin";
-
-    kernel = if libsOnly then null else kernel.dev;
-    kernelVersion = if libsOnly then null else kernel.modDirVersion;
-
-    makeFlags = lib.optionals (!libsOnly) (
-      kernelModuleMakeFlags
-      ++ [
-        "IGNORE_PREEMPT_RT_PRESENCE=1"
-        "NV_BUILD_SUPPORTS_HMM=1"
-        "SYSSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source"
-        "SYSOUT=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
-      ]
-    );
-
-    hardeningDisable = [
-      "pic"
-      "format"
-    ];
-
-    dontStrip = true;
-    dontPatchELF = true;
-
-    libPath = libPathFor pkgs;
-    libPath32 = lib.optionalString i686bundled (libPathFor pkgsi686Linux);
-
-    nativeBuildInputs = [
-      perl
-      nukeReferences
-      which
-      libarchive
-      jq
-    ] ++ lib.optionals (!libsOnly) kernel.moduleBuildDependencies;
-
-    disallowedReferences = lib.optionals (!libsOnly) [ kernel.dev ];
-
-    passthru =
-      let
-        fetchFromGithubOrNvidia =
-          {
-            owner,
-            repo,
-            rev,
-            ...
-          }@args:
-          let
-            args' = builtins.removeAttrs args [
-              "owner"
-              "repo"
-              "rev"
-            ];
-            baseUrl = "https://github.com/${owner}/${repo}";
-          in
-          fetchzip (
-            args'
-            // {
-              urls = [
-                "${baseUrl}/archive/${rev}.tar.gz"
-                "https://download.nvidia.com/XFree86/${repo}/${repo}-${rev}.tar.bz2"
-              ];
-              # github and nvidia use different compression algorithms,
-              #  use an invalid file extension to force detection.
-              extension = "tar.??";
-            }
-          );
-      in
-      {
-        open = lib.mapNullable (
-          hash:
-          callPackage ./open.nix {
-            inherit hash;
-            nvidia_x11 = self;
-            patches =
-              (builtins.map (rewritePatch {
-                from = "kernel";
-                to = "kernel-open";
-              }) patches)
-              ++ patchesOpen;
-            broken = brokenOpen;
-          }
-        ) openSha256;
-        settings =
-          if useSettings then
-            (if settings32Bit then pkgsi686Linux.callPackage else callPackage)
-              (import ./settings.nix self settingsSha256)
-              {
-                withGtk2 = preferGtk2;
-                withGtk3 = !preferGtk2;
-                fetchFromGitHub = fetchFromGithubOrNvidia;
-              }
-          else
-            { };
-        persistenced =
-          if usePersistenced then
-            lib.mapNullable (
-              hash:
-              callPackage (import ./persistenced.nix self hash) {
-                fetchFromGitHub = fetchFromGithubOrNvidia;
-              }
-            ) persistencedSha256
-          else
-            { };
-        fabricmanager =
-          if useFabricmanager then
-            lib.mapNullable (hash: callPackage (import ./fabricmanager.nix self hash) { }) fabricmanagerSha256
-          else
-            { };
-        inherit persistencedVersion settingsVersion;
-        compressFirmware = false;
-        ibtSupport = ibtSupport || (lib.versionAtLeast version "530");
-      }
-      // lib.optionalAttrs (!i686bundled) {
-        inherit lib32;
-      };
-
-    meta = with lib; {
-      homepage = "https://www.nvidia.com/object/unix.html";
-      description = "${
-        if useFabricmanager then "Data Center" else "X.org"
-      } driver and kernel module for NVIDIA cards";
-      license = licenses.unfreeRedistributable;
-      platforms =
-        [ "x86_64-linux" ]
-        ++ lib.optionals (sha256_32bit != null) [ "i686-linux" ]
-        ++ lib.optionals (sha256_aarch64 != null) [ "aarch64-linux" ];
-      maintainers = with maintainers; [
-        kiskae
-        edwtjo
-      ];
-      priority = 4; # resolves collision with xorg-server's "lib/xorg/modules/extensions/libglx.so"
-      inherit broken;
-    };
-  };
-
 in
-self
+
+stdenv.mkDerivation (finalAttrs: {
+  name = "nvidia-${if useFabricmanager then "dc" else "x11"}-${version}${nameSuffix}";
+
+  builder = ./builder.sh;
+
+  src =
+    if !acceptLicense && (openSha256 == null) then
+      throwLicense
+    else if stdenv.hostPlatform.system == "x86_64-linux" then
+      fetchurl {
+        urls =
+          if args ? url then
+            [ args.url ]
+          else
+            [
+              "https://us.download.nvidia.com/XFree86/Linux-x86_64/${version}/NVIDIA-Linux-x86_64-${version}${pkgSuffix}.run"
+              "https://download.nvidia.com/XFree86/Linux-x86_64/${version}/NVIDIA-Linux-x86_64-${version}${pkgSuffix}.run"
+            ];
+        sha256 = sha256_64bit;
+      }
+    else if stdenv.hostPlatform.system == "i686-linux" then
+      fetchurl {
+        urls =
+          if args ? url then
+            [ args.url ]
+          else
+            [
+              "https://us.download.nvidia.com/XFree86/Linux-x86/${version}/NVIDIA-Linux-x86-${version}${pkgSuffix}.run"
+              "https://download.nvidia.com/XFree86/Linux-x86/${version}/NVIDIA-Linux-x86-${version}${pkgSuffix}.run"
+            ];
+        sha256 = sha256_32bit;
+      }
+    else if stdenv.hostPlatform.system == "aarch64-linux" && sha256_aarch64 != null then
+      fetchurl {
+        urls =
+          if args ? url then
+            [ args.url ]
+          else
+            [
+              "https://us.download.nvidia.com/XFree86/aarch64/${version}/NVIDIA-Linux-aarch64-${version}${pkgSuffix}.run"
+              "https://download.nvidia.com/XFree86/Linux-aarch64/${version}/NVIDIA-Linux-aarch64-${version}${pkgSuffix}.run"
+            ];
+        sha256 = sha256_aarch64;
+      }
+    else
+      throw "nvidia-x11 does not support platform ${stdenv.hostPlatform.system}";
+
+  patches = if libsOnly then null else patches;
+  inherit prePatch postPatch patchFlags;
+  inherit preInstall postInstall;
+  inherit version useGLVND useProfiles;
+  inherit (stdenv.hostPlatform) system;
+  inherit i686bundled;
+
+  outputs =
+    [ "out" ]
+    ++ lib.optional i686bundled "lib32"
+    ++ lib.optional (!libsOnly) "bin"
+    ++ lib.optional (!libsOnly && firmware) "firmware";
+  outputDev = if libsOnly then null else "bin";
+
+  kernel = if libsOnly then null else kernel.dev;
+  kernelVersion = if libsOnly then null else kernel.modDirVersion;
+
+  makeFlags = lib.optionals (!libsOnly) (
+    kernelModuleMakeFlags
+    ++ [
+      "IGNORE_PREEMPT_RT_PRESENCE=1"
+      "NV_BUILD_SUPPORTS_HMM=1"
+      "SYSSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source"
+      "SYSOUT=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    ]
+  );
+
+  hardeningDisable = [
+    "pic"
+    "format"
+  ];
+
+  dontStrip = true;
+  dontPatchELF = true;
+
+  libPath = libPathFor pkgs;
+  libPath32 = lib.optionalString i686bundled (libPathFor pkgsi686Linux);
+
+  nativeBuildInputs = [
+    perl
+    nukeReferences
+    which
+    libarchive
+    jq
+  ] ++ lib.optionals (!libsOnly) kernel.moduleBuildDependencies;
+
+  disallowedReferences = lib.optionals (!libsOnly) [ kernel.dev ];
+
+  passthru =
+    let
+      fetchFromGithubOrNvidia =
+        {
+          owner,
+          repo,
+          rev,
+          ...
+        }@args:
+        let
+          args' = builtins.removeAttrs args [
+            "owner"
+            "repo"
+            "rev"
+          ];
+          baseUrl = "https://github.com/${owner}/${repo}";
+        in
+        fetchzip (
+          args'
+          // {
+            urls = [
+              "${baseUrl}/archive/${rev}.tar.gz"
+              "https://download.nvidia.com/XFree86/${repo}/${repo}-${rev}.tar.bz2"
+            ];
+            # github and nvidia use different compression algorithms,
+            #  use an invalid file extension to force detection.
+            extension = "tar.??";
+          }
+        );
+    in
+    {
+      open = lib.mapNullable (
+        hash:
+        callPackage ./open.nix {
+          inherit hash;
+          nvidia_x11 = finalAttrs.finalPackage;
+          patches =
+            (builtins.map (rewritePatch {
+              from = "kernel";
+              to = "kernel-open";
+            }) patches)
+            ++ patchesOpen;
+          broken = brokenOpen;
+        }
+      ) openSha256;
+      settings =
+        if useSettings then
+          (if settings32Bit then pkgsi686Linux.callPackage else callPackage)
+            (import ./settings.nix finalAttrs.finalPackage settingsSha256)
+            {
+              withGtk2 = preferGtk2;
+              withGtk3 = !preferGtk2;
+              fetchFromGitHub = fetchFromGithubOrNvidia;
+            }
+        else
+          { };
+      persistenced =
+        if usePersistenced then
+          lib.mapNullable (
+            hash:
+            callPackage (import ./persistenced.nix finalAttrs.finalPackage hash) {
+              fetchFromGitHub = fetchFromGithubOrNvidia;
+            }
+          ) persistencedSha256
+        else
+          { };
+      fabricmanager =
+        if useFabricmanager then
+          lib.mapNullable (
+            hash: callPackage (import ./fabricmanager.nix finalAttrs.finalPackage hash) { }
+          ) fabricmanagerSha256
+        else
+          { };
+      settingsVersion = if settingsVersion != null then settingsVersion else finalAttrs.version;
+      persistencedVersion =
+        if persistencedVersion != null then persistencedVersion else finalAttrs.version;
+      compressFirmware = false;
+      ibtSupport = ibtSupport || (lib.versionAtLeast version "530");
+    }
+    // lib.optionalAttrs (!i686bundled) {
+      inherit lib32;
+    };
+
+  meta = with lib; {
+    homepage = "https://www.nvidia.com/object/unix.html";
+    description = "${
+      if useFabricmanager then "Data Center" else "X.org"
+    } driver and kernel module for NVIDIA cards";
+    license = licenses.unfreeRedistributable;
+    platforms =
+      [ "x86_64-linux" ]
+      ++ lib.optionals (sha256_32bit != null) [ "i686-linux" ]
+      ++ lib.optionals (sha256_aarch64 != null) [ "aarch64-linux" ];
+    maintainers = with maintainers; [
+      kiskae
+      edwtjo
+    ];
+    priority = 4; # resolves collision with xorg-server's "lib/xorg/modules/extensions/libglx.so"
+    inherit broken;
+  };
+})

From cd77642de1f50d19f5642e23b94c95c0ee7683c8 Mon Sep 17 00:00:00 2001
From: Paul Meyer <katexochen0@gmail.com>
Date: Wed, 2 Jul 2025 20:07:53 +0200
Subject: [PATCH 10/92] nvidia_x11.fabricmanager: use fabricmanagerVersion

Looks like fabricmanagerVersion was unused since introduction.

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
---
 pkgs/os-specific/linux/nvidia-x11/fabricmanager.nix | 2 +-
 pkgs/os-specific/linux/nvidia-x11/generic.nix       | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/nvidia-x11/fabricmanager.nix b/pkgs/os-specific/linux/nvidia-x11/fabricmanager.nix
index cc11ad9d745e..9880425393dd 100644
--- a/pkgs/os-specific/linux/nvidia-x11/fabricmanager.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/fabricmanager.nix
@@ -12,7 +12,7 @@ nvidia_x11: sha256:
 let
   sys = lib.concatStringsSep "-" (lib.reverseList (lib.splitString "-" stdenv.system));
   bsys = builtins.replaceStrings [ "_" ] [ "-" ] sys;
-  fmver = nvidia_x11.version;
+  fmver = nvidia_x11.fabricmanagerVersion;
   ldd = (lib.getBin glibc) + "/bin/ldd";
 in
 
diff --git a/pkgs/os-specific/linux/nvidia-x11/generic.nix b/pkgs/os-specific/linux/nvidia-x11/generic.nix
index eebfe4097e17..baed507561fc 100644
--- a/pkgs/os-specific/linux/nvidia-x11/generic.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/generic.nix
@@ -10,7 +10,7 @@
   persistencedSha256 ? null,
   persistencedVersion ? null,
   fabricmanagerSha256 ? null,
-  fabricmanagerVersion ? version,
+  fabricmanagerVersion ? null,
   useGLVND ? true,
   useProfiles ? true,
   preferGtk2 ? false,
@@ -313,6 +313,8 @@ stdenv.mkDerivation (finalAttrs: {
       settingsVersion = if settingsVersion != null then settingsVersion else finalAttrs.version;
       persistencedVersion =
         if persistencedVersion != null then persistencedVersion else finalAttrs.version;
+      fabricmanagerVersion =
+        if fabricmanagerVersion != null then fabricmanagerVersion else finalAttrs.version;
       compressFirmware = false;
       ibtSupport = ibtSupport || (lib.versionAtLeast version "530");
     }

From ed5ccae729e341970cf9e32fb4c392d6b7f7405c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Arcadio=20Rubio=20Garc=C3=ADa?= <arcadio@pm.me>
Date: Fri, 4 Jul 2025 23:12:55 +0200
Subject: [PATCH 11/92] kallisto: cleanup and migrate to pkgs/by-name

---
 .../ka/kallisto/package.nix}                   | 18 +++++++++++++++---
 pkgs/top-level/all-packages.nix                |  4 ----
 2 files changed, 15 insertions(+), 7 deletions(-)
 rename pkgs/{applications/science/biology/kallisto/default.nix => by-name/ka/kallisto/package.nix} (53%)

diff --git a/pkgs/applications/science/biology/kallisto/default.nix b/pkgs/by-name/ka/kallisto/package.nix
similarity index 53%
rename from pkgs/applications/science/biology/kallisto/default.nix
rename to pkgs/by-name/ka/kallisto/package.nix
index 9ba81327710d..1a252345512e 100644
--- a/pkgs/applications/science/biology/kallisto/default.nix
+++ b/pkgs/by-name/ka/kallisto/package.nix
@@ -5,6 +5,7 @@
   autoconf,
   cmake,
   hdf5,
+  versionCheckHook,
   zlib,
   nix-update-script,
 }:
@@ -32,17 +33,28 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DUSE_HDF5=ON" ];
 
-  # Parallel build fails in some cases: https://github.com/pachterlab/kallisto/issues/160
   enableParallelBuilding = false;
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "version";
+  doInstallCheck = true;
+
   passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
-    description = "Program for quantifying abundances of transcripts from RNA-Seq data";
+    description = "Near-optimal quantification of transcripts from RNA-seq data";
+    longDescription = ''
+      kallisto is a program for quantifying abundances of transcripts
+      from RNA sequencing data, or more generally of target sequences
+      using high-throughput sequencing reads. It is based on the novel
+      idea of pseudoalignment for rapidly determining the
+      compatibility of reads with targets, without the need for
+      alignment.
+    '';
     mainProgram = "kallisto";
     homepage = "https://pachterlab.github.io/kallisto";
     license = licenses.bsd2;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ arcadio ];
+    maintainers = [ maintainers.arcadio ];
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 165a1309d0d7..d5df4ebfeaa8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15312,10 +15312,6 @@ with pkgs;
     inherit (llvmPackages) openmp;
   };
 
-  kallisto = callPackage ../applications/science/biology/kallisto {
-    autoconf = buildPackages.autoconf269;
-  };
-
   mirtk = callPackage ../development/libraries/science/biology/mirtk { itk = itk_5_2; };
 
   nest = callPackage ../applications/science/biology/nest { };

From fb191295e335813b7fff23df9435601049ce1e11 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 6 Jul 2025 10:14:10 +0000
Subject: [PATCH 12/92] weaver: 0.15.2 -> 0.16.1

---
 pkgs/by-name/we/weaver/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/we/weaver/package.nix b/pkgs/by-name/we/weaver/package.nix
index a2e911271e06..45d357d8525d 100644
--- a/pkgs/by-name/we/weaver/package.nix
+++ b/pkgs/by-name/we/weaver/package.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "weaver";
-  version = "0.15.2";
+  version = "0.16.1";
 
   src = fetchFromGitHub {
     owner = "open-telemetry";
     repo = "weaver";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-F7FLQ0EAJFll8Twbg11MQ7fqzzlOntqwqVG9+PjRfQM=";
+    hash = "sha256-fpr6GMUYRkHqy0e9M2qU4qKTiziSmfrHH+EBav7mgeA=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-alk9TIBN69JvrygcODkuDWQB8qvo7pF9HKoMJsNpaY4=";
+  cargoHash = "sha256-8+gOEpeM2n3H1nboZgtaMnWXX90eRom1ERnfItPqmFA=";
 
   checkFlags = [
     # Skip tests requiring network

From 38e2c95ba5ff554778fc82eb98d61230a9d00e3b Mon Sep 17 00:00:00 2001
From: Yifei Sun <ysun@hey.com>
Date: Sun, 6 Jul 2025 21:09:27 +0200
Subject: [PATCH 13/92] coconutbattery: 4.0.2,152 -> 4.0.4,166

---
 pkgs/by-name/co/coconutbattery/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/co/coconutbattery/package.nix b/pkgs/by-name/co/coconutbattery/package.nix
index a822dac98fab..80cb8625bab2 100644
--- a/pkgs/by-name/co/coconutbattery/package.nix
+++ b/pkgs/by-name/co/coconutbattery/package.nix
@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "coconutbattery";
-  version = "4.0.2,152";
+  version = "4.0.4,166";
 
   src = fetchzip {
     url = "https://coconut-flavour.com/downloads/coconutBattery_${
       lib.replaceStrings [ "." "," ] [ "" "_" ] finalAttrs.version
     }.zip";
-    hash = "sha256-PNSDUp07lUx5ebcfM3WSJAfRQjeuIIy7KfY0KJ0i1AE=";
+    hash = "sha256-ZbxO6pR752pjaBocA/wqyjPCZaUxV051MaHz1gqQjSg=";
   };
 
   installPhase = ''

From 84412fd8866dc80c1539e667adb766746e89b4dd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 7 Jul 2025 00:34:08 +0000
Subject: [PATCH 14/92] geonkick: 3.5.2 -> 3.6.0

---
 pkgs/by-name/ge/geonkick/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ge/geonkick/package.nix b/pkgs/by-name/ge/geonkick/package.nix
index d54b9797d59c..49fb9bf01e5e 100644
--- a/pkgs/by-name/ge/geonkick/package.nix
+++ b/pkgs/by-name/ge/geonkick/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "geonkick";
-  version = "3.5.2";
+  version = "3.6.0";
 
   src = fetchFromGitLab {
     owner = "Geonkick-Synthesizer";
     repo = "geonkick";
     rev = "v${version}";
-    hash = "sha256-QtBzrYW/yYnWSXyHV63gKzgdAR5kamij9Z0g+15CTPg=";
+    hash = "sha256-lTJ5O2UfXRUELErbMS9fCdCUgxhBxKRv/nIK8w5Fkiw=";
   };
 
   nativeBuildInputs = [

From b3e86dc1e942c0173c816cf1690509305ed1f55f Mon Sep 17 00:00:00 2001
From: Jared Baur <jaredbaur@fastmail.com>
Date: Wed, 11 Sep 2024 21:49:30 -0700
Subject: [PATCH 15/92] nixosTests.systemd-initrd.bridge: fix failing test

Since slave interfaces of a bridge cannot be assigned IP addresses, we
must prevent IPs from being assigned to them via the test framework
modules. Since c6f6c282181d5c6fb8f63d95738b97b09f25c945, all nodes get
ipv6 addresses by default, so we must ensure IP addresses of any type
don't get assigned to the bridge slave interfaces.
---
 nixos/tests/systemd-initrd-bridge.nix | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/nixos/tests/systemd-initrd-bridge.nix b/nixos/tests/systemd-initrd-bridge.nix
index f0c7d5f98f7a..7548787bc18c 100644
--- a/nixos/tests/systemd-initrd-bridge.nix
+++ b/nixos/tests/systemd-initrd-bridge.nix
@@ -24,20 +24,23 @@
           serviceConfig.Type = "oneshot";
         };
 
-        networking.primaryIPAddress = "192.168.1.${toString config.virtualisation.test.nodeNumber}";
+        networking.primaryIPAddress = lib.mkForce "192.168.1.${toString config.virtualisation.test.nodeNumber}";
+
+        virtualisation.interfaces.eth1 = {
+          vlan = 1;
+          assignIP = false;
+        };
+        virtualisation.interfaces.eth2 = {
+          vlan = 2;
+          assignIP = false;
+        };
 
-        virtualisation.vlans = [
-          1
-          2
-        ];
         networking.bridges.br0.interfaces = [
           "eth1"
           "eth2"
         ];
 
         networking.interfaces = {
-          eth1.ipv4.addresses = lib.mkForce [ ];
-          eth2.ipv4.addresses = lib.mkForce [ ];
           br0.ipv4.addresses = [
             {
               address = config.networking.primaryIPAddress;

From bbde01968ef96ab873608cf1da309c3140befb6a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 7 Jul 2025 05:05:19 +0000
Subject: [PATCH 16/92] marge-bot: 0.16.0 -> 0.16.1

---
 pkgs/by-name/ma/marge-bot/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ma/marge-bot/package.nix b/pkgs/by-name/ma/marge-bot/package.nix
index 4072d3244879..bf41ad200f45 100644
--- a/pkgs/by-name/ma/marge-bot/package.nix
+++ b/pkgs/by-name/ma/marge-bot/package.nix
@@ -9,14 +9,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "marge-bot";
-  version = "0.16.0";
+  version = "0.16.1";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "marge-org";
     repo = "marge-bot";
     rev = version;
-    hash = "sha256-UgdbeJegeTFP6YF6oMxAeQDI9AO2k6yk4WAFZ/Xspu8=";
+    hash = "sha256-I1yQwTqHFynEbjF0BpGBHek6qgtTzZztDAqdl+2j2U0=";
   };
 
   nativeBuildInputs = [

From 747c0dbbe73742e682eeaa2b27048fee325854a9 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Mon, 7 Jul 2025 13:18:10 +0800
Subject: [PATCH 17/92] dokieli: fix description

---
 pkgs/by-name/do/dokieli/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/do/dokieli/package.nix b/pkgs/by-name/do/dokieli/package.nix
index 8794d3bc00d5..e472e39f5b38 100644
--- a/pkgs/by-name/do/dokieli/package.nix
+++ b/pkgs/by-name/do/dokieli/package.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
   doDist = false;
 
   meta = {
-    description = "dokieli is a clientside editor for decentralised article publishing, annotations and social interactions";
+    description = "Clientside editor for decentralised article publishing, annotations and social interactions";
     homepage = "https://github.com/linkeddata/dokieli";
     license = lib.licenses.mit;
     platforms = lib.platforms.all;

From bf9d282c9af8a1b2a9d74b5835cbb7b8eac67bdf Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Mon, 7 Jul 2025 13:18:10 +0800
Subject: [PATCH 18/92] dokieli: fix license

---
 pkgs/by-name/do/dokieli/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/do/dokieli/package.nix b/pkgs/by-name/do/dokieli/package.nix
index e472e39f5b38..9d029b171d1d 100644
--- a/pkgs/by-name/do/dokieli/package.nix
+++ b/pkgs/by-name/do/dokieli/package.nix
@@ -63,7 +63,10 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Clientside editor for decentralised article publishing, annotations and social interactions";
     homepage = "https://github.com/linkeddata/dokieli";
-    license = lib.licenses.mit;
+    license = with lib.licenses; [
+      cc-by-40
+      mit
+    ];
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ shogo ];
     teams = [ lib.teams.ngi ];

From cbc1476ce2cdc92e2ec80dfa6f435c158f94fd18 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 7 Jul 2025 05:38:31 +0000
Subject: [PATCH 19/92] saxon-he: 12.7 -> 12.8

---
 pkgs/development/libraries/java/saxon/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/java/saxon/default.nix b/pkgs/development/libraries/java/saxon/default.nix
index 337ca1e05a92..ffd2f94b3189 100644
--- a/pkgs/development/libraries/java/saxon/default.nix
+++ b/pkgs/development/libraries/java/saxon/default.nix
@@ -186,11 +186,11 @@ in
 
   saxon_12-he = common rec {
     pname = "saxon-he";
-    version = "12.7";
+    version = "12.8";
     jar = "saxon-he-${version}";
     src = fetchurl {
       url = github.downloadUrl version;
-      hash = "sha256-+J4ghaw1fZtsuKIxcHrrxff20LTsOmJhRLqWVvdZLN4=";
+      hash = "sha256-K6hRrseSW4giCBgsSMk2IwIF1VjjNWNrvkZia9gANZg=";
     };
     updateScript = github.updateScript version;
     description = "Processor for XSLT 3.0, XPath 3.1, and XQuery 3.1";

From 95c0d7765209f22de2e10a07f5d202601ec85c25 Mon Sep 17 00:00:00 2001
From: Paul Meyer <katexochen0@gmail.com>
Date: Mon, 7 Jul 2025 08:25:44 +0200
Subject: [PATCH 20/92] sonic-pi: add qtwayland dep

Running sonic-pi under wayland/sway, I noticed the following output:

```
qt.qpa.plugin: Could not find the Qt platform plugin "wayland" in ""
```

I couldn't find any functional issue due to this, but looked into it
anyway.

Adding `qtwayland` dependency resolves this issue, it now prints:

```
qt.qpa.wayland: Wayland does not support QWindow::requestActivate()

```

The dependency on `qtwayland` is documented upstream in
https://github.com/sonic-pi-net/sonic-pi/blob/5145973b25a7f21cf94151f5978ba4819550012d/BUILD-LINUX.md?plain=1#L63

Which looks a bit healthier. Not sure if there are other things to
improve for wayland support, but this is a start.

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
---
 pkgs/applications/audio/sonic-pi/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/applications/audio/sonic-pi/default.nix b/pkgs/applications/audio/sonic-pi/default.nix
index 221f67badc02..124f3a264389 100644
--- a/pkgs/applications/audio/sonic-pi/default.nix
+++ b/pkgs/applications/audio/sonic-pi/default.nix
@@ -11,6 +11,7 @@
   qtbase,
   qtsvg,
   qttools,
+  qtwayland,
   qwt,
   qscintilla,
   kissfftFloat,
@@ -82,6 +83,7 @@ stdenv.mkDerivation rec {
       qtbase
       qtsvg
       qttools
+      qtwayland
       qwt
       qscintilla
       kissfftFloat

From e475bfce8f6564023ed34951e4ee75689d6d4f0b Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Mon, 7 Jul 2025 13:18:10 +0800
Subject: [PATCH 21/92] dokieli: 0-unstable-2024-12-12 -> 0-unstable-2025-07-06

---
 pkgs/by-name/do/dokieli/missing-hashes.json | 47 +++++++++++++++
 pkgs/by-name/do/dokieli/package.nix         | 65 +++++++++------------
 2 files changed, 75 insertions(+), 37 deletions(-)
 create mode 100644 pkgs/by-name/do/dokieli/missing-hashes.json

diff --git a/pkgs/by-name/do/dokieli/missing-hashes.json b/pkgs/by-name/do/dokieli/missing-hashes.json
new file mode 100644
index 000000000000..fc0ef7e8cd5a
--- /dev/null
+++ b/pkgs/by-name/do/dokieli/missing-hashes.json
@@ -0,0 +1,47 @@
+{
+  "@esbuild/aix-ppc64@npm:0.25.4": "0d8f2e73ed75c2273cfe01452ad86585d5205a3f4abaddb5a040cfdb144b83a3e6192e34ab0ceaa77ce1bb08a5d8e5feb98cc30f1f1f6e4a2dccd177fbe6ccda",
+  "@esbuild/android-arm64@npm:0.25.4": "a6bc6be3a75c575e21a4f5135faed0575628ad41fdfa582e5a27e992c66fa0fc7e61fb5edce0eb9dcc28bd33656945bcb48d6e4eaa3f197a56c7399e04d3dd07",
+  "@esbuild/android-arm@npm:0.25.4": "2840ee03556a470145a14416348c7bc8e3e93c7f4c1ab1579f0b1e428f242c9349987c74501d3740bc2679cfd86e63e6288a8ce01e81459e00f95a812fb19e13",
+  "@esbuild/android-x64@npm:0.25.4": "4808d422695cf0f9674bbbd50bd7773d2594563375bbbb24b774cd2060373533bdf726653b16daa73a85cc222e16ccf33bfff1fa14e365aea28293e8df8b027d",
+  "@esbuild/darwin-arm64@npm:0.25.4": "73a6b24a30432074dffc4b725d291a9fb30d787f28b3a17b6c99072854e3317af7ef510577b8c2732636ac4aa51465be8dd71f6443e3113944e8f8bcd8315fe2",
+  "@esbuild/darwin-x64@npm:0.25.4": "cdbe0cdcf8a14402cb8180b1189dd08c457ffbfc23a49f83b6a47d56802bdca5d3701b97e5fea0f11639f455822d29d74aa9a0dceb4b36b02a2bc38d3570c7b9",
+  "@esbuild/freebsd-arm64@npm:0.25.4": "583d6a4649eaed0db27bc06e997ec786df2f854ff7f979b8b24d76750f90f50f8b356ee159466cf08f95c6fe86fad4650817f3812b7b78901974f47ccc5a0f29",
+  "@esbuild/freebsd-x64@npm:0.25.4": "e1a092fa2493d1c193abb9858aa01111287457318f43f167c351fbb5baf32848a78813f2e14bbbb05124bf34f0f2fe5d54bee2514b5aed5171616a9c8e130fe8",
+  "@esbuild/linux-arm64@npm:0.25.4": "6ab9f163a787e1209c87ce2029ff7223645646aa05d1ef7c8d0f33b3230ccdcd62b4cf3fc05636dc4c8209cf58ccb1bd9306ce5eac76add4448c8175fc13311e",
+  "@esbuild/linux-arm@npm:0.25.4": "ab5c452fd502b04d88729cf8fa2b39ae866f0bd7a61e3fd1704f0c4423e4c6a2bee8ae7d03dd5942edbd68d2008e8cfc3dd18e99b5298f366bef452a4e350eb3",
+  "@esbuild/linux-ia32@npm:0.25.4": "ca88f8357a8af3bb7baae8f8cef3c0b19c6fcb5737f75e9d53ec05ac171516abedbfd5072c0a3e0eea5faab4f38f876ea54fa996609803af0b4fd4c8fc8fa963",
+  "@esbuild/linux-loong64@npm:0.25.4": "cfbf0ab09f7ad3576fc85d8d7081e454f89f2b17b4be77aa40e1e6352b79b112adb6db536817954533e7da1a3cfe17cfcb66552f485a8eae1acc54764242c165",
+  "@esbuild/linux-mips64el@npm:0.25.4": "0d530ac0cbf26b5c6595f3bbce0828a36cb00b42e41759e9bd98344aaeafc20c9850f3adf86447f43258bca043236cca36f1617114c65db5155c3e5dd00d083b",
+  "@esbuild/linux-ppc64@npm:0.25.4": "0b9663f108192b8781b4993b406ec6a6beeffba81de689f9fc3d798a012a0e1b270858c8554a4a7bc5d11f43f619b6cef96bf3abdf7ea1b435c3dd3857ba3315",
+  "@esbuild/linux-riscv64@npm:0.25.4": "b24ce37a0b2b573782bf3cd530c5754baea8c1fa22320f6f2baa2bb3f530056a1ac15ea75e0bb2e744b90d197c9fc305e5372a6bfa50e1c71614e2c9dced8e97",
+  "@esbuild/linux-s390x@npm:0.25.4": "4207474583d46be6657390b9f440ddae0e9643cea20fb9d2f80df63ed780efb07acfb34b29ddd67ded8f6bf8a7e2ce2349db61772814d862294a2e081c61e643",
+  "@esbuild/linux-x64@npm:0.25.4": "bf208856a7b9d9b161f02717704fcf5473055994e25d6f7ddd323cf749dc4232193d15a8a69deadf5e803c33bd9cc99e8e2f452fe9ca006c9fe258245b35745c",
+  "@esbuild/netbsd-arm64@npm:0.25.4": "b0c09632d59399fec5f05aa772a649f1812a8b14ec38a6c688113c10be056a7202dc2383b5b9ac74f78ba9abd5a48485aa1ca0b70faf38cce95ab23682f9b7ed",
+  "@esbuild/netbsd-x64@npm:0.25.4": "4c7b46aa8855d1a6d3bae0bd552aa6e8c4662d8c0cff80c33a6d94169cdeb9c576a6d7a44f9b0eacc95435faa7db779c117ac2c7aabb4eddcbd0738423d30e5e",
+  "@esbuild/openbsd-arm64@npm:0.25.4": "55bb5cea852eef8de2e44e0486257a3841988f8114ad1dbaf1b47c869c6e449a69f12d0d2dc82a20830496d9f06a5b1ee109d856dd1285b3a48963eedb70c5e1",
+  "@esbuild/openbsd-x64@npm:0.25.4": "fdfd19bd660a545a648413ba255e3e07e3a1de7b81fde1fc25ede3ff5d8c5f1cf23355655709805d207781850f850e728c91f32e90431e2125a8ef87d66a98f3",
+  "@esbuild/sunos-x64@npm:0.25.4": "78934b4622c935f975e96819cfcbcb223bba65a272b06213ce16177eb3afb92f5e82ec6b9ca4eabefc90bf05a69e22f1788e6b269d4150c090a20446fdbf2e3c",
+  "@esbuild/win32-arm64@npm:0.25.4": "d7d751f6787f2aa56b1e7158e77c81f327502f42ebd2a8685811e19ea4b7536d73a0c4bc3850a7fea0e8ea1de5f89d2b8328d8a41d79b11c03341ba1facf9360",
+  "@esbuild/win32-ia32@npm:0.25.4": "72d90ea6406e58f3fa423e3736aab7da3475a2b8e98713106106218536186501367e19822463d78fd0ce25a1412ab52610313f4b878fed977e179d2a8794dd1a",
+  "@esbuild/win32-x64@npm:0.25.4": "b929850a2cd8cec7431867dc26bb8cb9f8654ddff5a8417be176eea51fa83f7925bdbc61933575d2db5e12bbc44042ed97e30507e5d7bcf5dc590f7808adaad6",
+  "@rollup/rollup-android-arm-eabi@npm:4.41.0": "4bd62501cc9b5571ec314bba4ff5db2ea5216e96eb06bd7e020c4dd569968e54b23ef3d67a13c9a33514ee032ca8bf375e6de5b2be56a7f0db5c57654c0c223a",
+  "@rollup/rollup-android-arm64@npm:4.41.0": "d1f27fe5e0616ceb88208267ccda7aa2cf6e6390af3b32c4f2826b5ec06d8815a7b44e0d29484b92afa92a38915066f0ee5dcbe507870be0b0849a2699962e82",
+  "@rollup/rollup-darwin-arm64@npm:4.41.0": "431ff15144dd58823b17754f16e484e05d16a49818efeb725220497cef265da2080611aebb19eb4283f48085dc7e3fd504f6c7493945f85c2d8887cabadcb1e2",
+  "@rollup/rollup-darwin-x64@npm:4.41.0": "715a2e161a0ea6d1d92ad39fd97cae3ec01c8ae9a0cc6ae0a533d451c187968533bafba0c4695947a4bcd1249dca9478fdb1ebac35f649f0995d34922d06a486",
+  "@rollup/rollup-freebsd-arm64@npm:4.41.0": "b12cf55a85baf59ddb9a03095b13255fea65a4875c38af292dc92c8ef7f1e811ab5e5e79b423ebdb1936bb446fec004a7a42bbf376f94fa94126a2a64901ea6d",
+  "@rollup/rollup-freebsd-x64@npm:4.41.0": "9bf78726c78eeb0c1212ec3e3605744a9b1087fd0e1469d0f54fdd08b4dc81302f1621fc31ea2249d8fb944407343ec7d2857ef57a06d56c6d287d2e3574d06d",
+  "@rollup/rollup-linux-arm-gnueabihf@npm:4.41.0": "b117d0f6f4aaee502b27930d3b3523171528bfbbd31a1791ac7ec36f7aebd8b6cf7f8bd40a3adba8d7048c0a11e9cc665ad1c785740a4422d9b3353dd3f67886",
+  "@rollup/rollup-linux-arm-musleabihf@npm:4.41.0": "7fafe40a34e0095d96f8b610e6d0052d105c734121d3f79c5d44eccee0006d8ccb69ae3bfb8c8cf6f29fc5460347601eaa6a118e51f783dc30031ee8b9998be0",
+  "@rollup/rollup-linux-arm64-gnu@npm:4.41.0": "9f0cd0828e56f7d15975767d7f0ac7163614df9838e37baa716b628ab780d879df13ed84f5ed8de2f324dffa35ee7952fdd4de73b8598de3ccba307c7b2a4c44",
+  "@rollup/rollup-linux-arm64-musl@npm:4.41.0": "7bbd1323a9acc4e7803561f5c19e5d38f3db8d58e0eafcfc8ea08c3a3fdadd4ebc85c3c535a1b9d94f6f3ff62e6c69160d7769887bbda8324f5030f364d88c1a",
+  "@rollup/rollup-linux-loongarch64-gnu@npm:4.41.0": "e3322d87f3ab12c5dbed3ffdcc6c4a341e4d8714454758707af5ec4460003b00d18d44b210313f4e6233f505a30da4af5f46480bd983454c5595f6970c752d0e",
+  "@rollup/rollup-linux-powerpc64le-gnu@npm:4.41.0": "3b7f57d9ce5ffa72f79075261c052017e80927f513926526902b362c1f328ba16b9dd62938e084e394f9dbb77deccaf32dc330434581384fb18bd1d2f2384a43",
+  "@rollup/rollup-linux-riscv64-gnu@npm:4.41.0": "1f64fa850a0952f62e77a5096c6cd81b32710d9d9f8a699fc4d4a39d086c6aff13675f67c359823eed016c1967b157861e96847eb5e8b0663f5db25d42ae0fc3",
+  "@rollup/rollup-linux-riscv64-musl@npm:4.41.0": "e6588e3a75b87a602ed1ece39680bc3b67792e53cc9835757b6b91ce9a728aaab64fe6b25b83aef5f05933addef49ae5f7e80ea206b0c9be488c8d896087f61c",
+  "@rollup/rollup-linux-s390x-gnu@npm:4.41.0": "c664fb7c55d800371fa7ab549242f5e46ab52ec9eadbf998beaf745712e6e00a27aa7074b32098fc0a571acb29be403c206e71c4ce7cfccf00783985eb0c6554",
+  "@rollup/rollup-linux-x64-gnu@npm:4.41.0": "cf9337ee96b3cd3d7165cab9d8514fa6022607e99bf95ba147512bb62ad6af5000971ddcac04c65e7329eb63f505328b5a4f33e78e46f4ebf132e333938678b4",
+  "@rollup/rollup-linux-x64-musl@npm:4.41.0": "357fc65d5db7e66d80a4ef9d4820430db8ae14e0cf7d3f9c78dc2e2c2d9902d680c763f6695ca32703669009dd26f6f969b1ccfd4318eafece4ea754fc014ee8",
+  "@rollup/rollup-win32-arm64-msvc@npm:4.41.0": "abb25ae4c9566d0cba63cfe30d59a141b3c2b84d6742f1ca80bdad62919d3cd0f9237e4ed76bdeac130de2071df1290a5985f6e48f02cba7713cedebfb5c22f8",
+  "@rollup/rollup-win32-ia32-msvc@npm:4.41.0": "914685bea8d942d350528ce7bd36db3b223ec0cb42cdbe2a7368359fab43a7b90bc37cedaa134c43be6a0c068187f130d301d7a0d6301758095b283c00205969",
+  "@rollup/rollup-win32-x64-msvc@npm:4.41.0": "60dd4af8bccaa9148ab8be40d650e3254fc584500927951468b5ec533a59578cdd2269c4c33139fc24e2c890c16f34b9df98dba70d0359e9a500264c620e3a41"
+}
diff --git a/pkgs/by-name/do/dokieli/package.nix b/pkgs/by-name/do/dokieli/package.nix
index 9d029b171d1d..2ee4ef6ef8a4 100644
--- a/pkgs/by-name/do/dokieli/package.nix
+++ b/pkgs/by-name/do/dokieli/package.nix
@@ -1,64 +1,55 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
-  fetchYarnDeps,
-  yarnConfigHook,
   makeWrapper,
-  yarnBuildHook,
-  yarnInstallHook,
-  nodejs,
+  nodePackages,
+  stdenv,
   xsel,
+  yarn-berry_4,
 }:
-
+let
+  yarn-berry = yarn-berry_4;
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "dokieli";
-  version = "0-unstable-2024-12-12";
+  version = "0-unstable-2025-07-06";
 
-  # Can't update newer versions currently because newer versions require yarn-berry, and it's not in nixpkgs, yet.
   src = fetchFromGitHub {
-    owner = "linkeddata";
+    owner = "dokieli";
     repo = "dokieli";
-    rev = "d8dc72c81b84ec12f791892a6377a7f6ec46ed3b";
-    hash = "sha256-CzSyQVyeJVOP8NCsa7ST3atG87V1KPSBzTRi0brMFYw=";
+    rev = "825d3aa5d754b512f8cbde2cc504b1d00788022c";
+    hash = "sha256-ZjsRG+qIzRb+8FM7a4qSkahxQeq1ayXSgD/oo7jdi6w=";
   };
 
-  offlineCache = fetchYarnDeps {
-    yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash =
-      if stdenv.hostPlatform.isDarwin then
-        "sha256-bw5HszcHZ60qgYgm4qfhZEYXjJAQ2DXhWU0Reqb9VpQ="
-      else
-        "sha256-rwHBDBWZe4cdTyL7lNkB4nlpd5MWzbTU6kzdLBWcq0M=";
+  missingHashes = ./missing-hashes.json;
+  offlineCache = yarn-berry.fetchYarnBerryDeps {
+    inherit (finalAttrs) src missingHashes;
+    hash = "sha256-4SK1ecjEnnaow5Z2biCPaHirpX6J/5cytQWWicPgmB0=";
   };
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/bin
     cp -r * $out
+
+    runHook postInstall
   '';
 
   nativeBuildInputs = [
     makeWrapper
-    yarnConfigHook
-    yarnBuildHook
-    yarnInstallHook
-    # Needed for executing package.json scripts
-    nodejs
+    yarn-berry.yarnBerryConfigHook
   ];
 
-  postFixup = ''
-    makeWrapper ${nodejs}/bin/npx $out/bin/dokieli           \
-      --prefix PATH : ${
-        lib.makeBinPath ([
-          nodejs
-          xsel
-        ])
-      }   \
-      --add-flags serve                                      \
-      --chdir $out/deps/dokieli
-  '';
-
-  doDist = false;
+  postFixup =
+    let
+      serve = lib.getExe' nodePackages.serve "serve";
+    in
+    ''
+      makeWrapper ${serve} $out/bin/dokieli \
+        --prefix PATH : ${lib.makeBinPath [ xsel ]} \
+        --chdir $out
+    '';
 
   meta = {
     description = "Clientside editor for decentralised article publishing, annotations and social interactions";

From bb05c144ae936af35e1b130044833ec299e023ef Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Mon, 7 Jul 2025 14:22:00 +0800
Subject: [PATCH 22/92] dokieli: add updateScript

---
 pkgs/by-name/do/dokieli/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/do/dokieli/package.nix b/pkgs/by-name/do/dokieli/package.nix
index 2ee4ef6ef8a4..7a16484d9a5a 100644
--- a/pkgs/by-name/do/dokieli/package.nix
+++ b/pkgs/by-name/do/dokieli/package.nix
@@ -2,6 +2,7 @@
   lib,
   fetchFromGitHub,
   makeWrapper,
+  nix-update-script,
   nodePackages,
   stdenv,
   xsel,
@@ -51,6 +52,10 @@ stdenv.mkDerivation (finalAttrs: {
         --chdir $out
     '';
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
+
   meta = {
     description = "Clientside editor for decentralised article publishing, annotations and social interactions";
     homepage = "https://github.com/linkeddata/dokieli";

From deb61643f6f2f960f8481b0d12332f9d51b51046 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 7 Jul 2025 06:44:28 +0000
Subject: [PATCH 23/92] saxon_11-he: 11.6 -> 11.7

---
 pkgs/development/libraries/java/saxon/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/java/saxon/default.nix b/pkgs/development/libraries/java/saxon/default.nix
index 337ca1e05a92..3f231d6a0612 100644
--- a/pkgs/development/libraries/java/saxon/default.nix
+++ b/pkgs/development/libraries/java/saxon/default.nix
@@ -174,11 +174,11 @@ in
 
   saxon_11-he = common rec {
     pname = "saxon-he";
-    version = "11.6";
+    version = "11.7";
     jar = "saxon-he-${version}";
     src = fetchurl {
       url = github.downloadUrl version;
-      sha256 = "/AVX5mtZSO6Is19t3+FlEvtIBsnwB3MIWAPCht8Aqnw=";
+      sha256 = "MGzhUW9ZLVvTSqEdpAZWAiwTYxCZxbn26zESDmIe4Vo=";
     };
     updateScript = github.updateScript version;
     description = "Processor for XSLT 3.0, XPath 2.0 and 3.1, and XQuery 3.1";

From e20c5de7247c4fd9b0fa50a1a6e60aa6618d4ef6 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Mon, 7 Jul 2025 14:54:56 +0800
Subject: [PATCH 24/92] galene: add updateScript

---
 pkgs/by-name/ga/galene/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/ga/galene/package.nix b/pkgs/by-name/ga/galene/package.nix
index a593b4e2f588..74beb7f8966e 100644
--- a/pkgs/by-name/ga/galene/package.nix
+++ b/pkgs/by-name/ga/galene/package.nix
@@ -3,6 +3,7 @@
   fetchFromGitHub,
   buildGoModule,
   nixosTests,
+  nix-update-script,
 }:
 
 buildGoModule rec {
@@ -36,6 +37,9 @@ buildGoModule rec {
 
   passthru = {
     tests.vm = nixosTests.galene.basic;
+    updateScript = nix-update-script {
+      extraArgs = [ "--version-regex=galene-(.*)" ];
+    };
   };
 
   meta = {

From 23a28c2d928fcde795a56cba71b8fb65ec125cd8 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Mon, 7 Jul 2025 14:58:05 +0800
Subject: [PATCH 25/92] galene: use finalAttrs

---
 pkgs/by-name/ga/galene/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ga/galene/package.nix b/pkgs/by-name/ga/galene/package.nix
index 74beb7f8966e..4462e0b61321 100644
--- a/pkgs/by-name/ga/galene/package.nix
+++ b/pkgs/by-name/ga/galene/package.nix
@@ -6,14 +6,14 @@
   nix-update-script,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "galene";
   version = "0.96.3";
 
   src = fetchFromGitHub {
     owner = "jech";
     repo = "galene";
-    rev = "galene-${version}";
+    tag = "galene-${finalAttrs.version}";
     hash = "sha256-loAiPfwTyPi4BKn4TNgVVde2mO119h443A+HwlLvi4g=";
   };
 
@@ -45,7 +45,7 @@ buildGoModule rec {
   meta = {
     description = "Videoconferencing server that is easy to deploy, written in Go";
     homepage = "https://github.com/jech/galene";
-    changelog = "https://github.com/jech/galene/raw/galene-${version}/CHANGES";
+    changelog = "https://github.com/jech/galene/raw/${finalAttrs.src.tag}/CHANGES";
     license = lib.licenses.mit;
     platforms = lib.platforms.linux;
     teams = [ lib.teams.ngi ];
@@ -54,4 +54,4 @@ buildGoModule rec {
       erdnaxe
     ];
   };
-}
+})

From c4f9e622b0d2ab8380238ce50603ad98f7248321 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 7 Jul 2025 08:13:32 +0000
Subject: [PATCH 26/92] speedscope: 1.22.2 -> 1.23.0

---
 pkgs/by-name/sp/speedscope/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sp/speedscope/package.nix b/pkgs/by-name/sp/speedscope/package.nix
index 114bf98add0c..7b319f306dd5 100644
--- a/pkgs/by-name/sp/speedscope/package.nix
+++ b/pkgs/by-name/sp/speedscope/package.nix
@@ -7,13 +7,13 @@
 
 buildNpmPackage rec {
   pname = "speedscope";
-  version = "1.22.2";
+  version = "1.23.0";
 
   src = fetchFromGitHub {
     owner = "jlfwong";
     repo = "speedscope";
     tag = "v${version}";
-    hash = "sha256-JzlS5onVac1UKJUl1YYE7a3oWk2crMyuowea8a7UoOo=";
+    hash = "sha256-I7XulOJuMSxDXyGlXL6AeqP0ohjNhzGTEyWsq6MiTho=";
 
     # scripts/prepack.sh wants to extract the git commit from .git
     # We don't want to keep .git for reproducibility reasons, so save the commit
@@ -25,7 +25,7 @@ buildNpmPackage rec {
     '';
   };
 
-  npmDepsHash = "sha256-3LCixJJyz3O6xQxP0A/WyQXsDvkXpdo7KYNDoufZVS4=";
+  npmDepsHash = "sha256-5gsWnk37F+fModNUWETBercXE1avEtbAAu8/qi76yDY=";
 
   patches = [
     ./fix-shebang.patch

From 760ae22a184fbf84ff2a2130e1ddc7b5a58ca203 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Mon, 7 Jul 2025 16:18:44 +0800
Subject: [PATCH 27/92] lib25519: add ngi team

---
 pkgs/by-name/li/lib25519/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/li/lib25519/package.nix b/pkgs/by-name/li/lib25519/package.nix
index bf21ad06ca95..a448133ab43e 100644
--- a/pkgs/by-name/li/lib25519/package.nix
+++ b/pkgs/by-name/li/lib25519/package.nix
@@ -87,6 +87,7 @@ stdenv.mkDerivation (finalAttrs: {
       imadnyc
       jleightcap
     ];
+    teams = with lib.teams; [ ngi ];
     # This supports whatever platforms libcpucycles supports
     inherit (libcpucycles.meta) platforms;
   };

From b0f78091fe4c91649fb50db8ffd9dd3d37a3a4d7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 7 Jul 2025 08:23:16 +0000
Subject: [PATCH 28/92] feedbackd-device-themes: 0.8.3 -> 0.8.4

---
 pkgs/by-name/fe/feedbackd-device-themes/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fe/feedbackd-device-themes/package.nix b/pkgs/by-name/fe/feedbackd-device-themes/package.nix
index 711e77962b09..816ffc102ea2 100644
--- a/pkgs/by-name/fe/feedbackd-device-themes/package.nix
+++ b/pkgs/by-name/fe/feedbackd-device-themes/package.nix
@@ -11,14 +11,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "feedbackd-device-themes";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "agx";
     repo = "feedbackd-device-themes";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-z+A2G1g2gNfC0cVWUO/LT3QVvXeotcBd+5UEpEtcPfY=";
+    hash = "sha256-eLR1BnPpIdo6udQsLcLn4hK2TTRYUIh5vwAg+rdMLKU=";
   };
 
   nativeBuildInputs = [

From f7a90b20d08537073d71a1c9b77d3691c78e4158 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Mon, 7 Jul 2025 17:34:15 +0800
Subject: [PATCH 29/92] mox: use finalAttrs

---
 pkgs/by-name/mo/mox/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/mo/mox/package.nix b/pkgs/by-name/mo/mox/package.nix
index 8997a9604b75..69fdf396f202 100644
--- a/pkgs/by-name/mo/mox/package.nix
+++ b/pkgs/by-name/mo/mox/package.nix
@@ -4,14 +4,14 @@
   fetchFromGitHub,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "mox";
   version = "0.0.15";
 
   src = fetchFromGitHub {
     owner = "mjl-";
     repo = "mox";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-apIV+nClXTUbmCssnvgG9UwpTNTHTe6FgLCxp14/s0A=";
   };
 
@@ -23,8 +23,8 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/mjl-/mox/moxvar.Version=${version}"
-    "-X github.com/mjl-/mox/moxvar.VersionBare=${version}"
+    "-X github.com/mjl-/mox/moxvar.Version=${finalAttrs.version}"
+    "-X github.com/mjl-/mox/moxvar.VersionBare=${finalAttrs.version}"
   ];
 
   meta = {
@@ -37,4 +37,4 @@ buildGoModule rec {
       kotatsuyaki
     ];
   };
-}
+})

From 09388f9aa4f6147387c033243073d66f221c2d07 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Mon, 7 Jul 2025 17:35:10 +0800
Subject: [PATCH 30/92] mox: add ngi team

---
 pkgs/by-name/mo/mox/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/mo/mox/package.nix b/pkgs/by-name/mo/mox/package.nix
index 69fdf396f202..a223f42d2634 100644
--- a/pkgs/by-name/mo/mox/package.nix
+++ b/pkgs/by-name/mo/mox/package.nix
@@ -36,5 +36,6 @@ buildGoModule (finalAttrs: {
       dit7ya
       kotatsuyaki
     ];
+    teams = with lib.teams; [ ngi ];
   };
 })

From 46697bcabc53e6582e746b08e1de8c5711b6982e Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Mon, 7 Jul 2025 17:35:43 +0800
Subject: [PATCH 31/92] mox: add updateScript

---
 pkgs/by-name/mo/mox/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/mo/mox/package.nix b/pkgs/by-name/mo/mox/package.nix
index a223f42d2634..bf9d26a53fdb 100644
--- a/pkgs/by-name/mo/mox/package.nix
+++ b/pkgs/by-name/mo/mox/package.nix
@@ -2,6 +2,7 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  nix-update-script,
 }:
 
 buildGoModule (finalAttrs: {
@@ -27,6 +28,8 @@ buildGoModule (finalAttrs: {
     "-X github.com/mjl-/mox/moxvar.VersionBare=${finalAttrs.version}"
   ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Modern full-featured open source secure mail server for low-maintenance self-hosted email";
     mainProgram = "mox";

From 4f268199dc0033dbc4a3f05ce35f5a93794ceb0c Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Mon, 7 Jul 2025 16:19:37 +0800
Subject: [PATCH 32/92] lib25519: use finalAttrs

---
 pkgs/by-name/li/lib25519/package.nix | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/li/lib25519/package.nix b/pkgs/by-name/li/lib25519/package.nix
index a448133ab43e..0cd67b7b9451 100644
--- a/pkgs/by-name/li/lib25519/package.nix
+++ b/pkgs/by-name/li/lib25519/package.nix
@@ -7,14 +7,10 @@
   valgrind,
   librandombytes,
   libcpucycles,
-  lib25519,
 }:
-let
-  version = "20241004";
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "lib25519";
-  inherit version;
+  version = "20241004";
 
   src = fetchzip {
     url = "https://lib25519.cr.yp.to/lib25519-${finalAttrs.version}.tar.gz";
@@ -64,9 +60,9 @@ stdenv.mkDerivation (finalAttrs: {
   passthru = {
     updateScript = ./update.sh;
     tests.version = testers.testVersion {
-      package = lib25519;
+      package = finalAttrs.finalPackage;
       command = "lib25519-test | head -n 2 | grep version";
-      version = "lib25519 version ${version}";
+      version = "lib25519 version ${finalAttrs.version}";
     };
   };
 

From 0b355a6f9f119c432d881da5f47b181b49911836 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 7 Jul 2025 13:09:50 +0000
Subject: [PATCH 33/92] pueue: 4.0.0 -> 4.0.1

---
 pkgs/by-name/pu/pueue/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pu/pueue/package.nix b/pkgs/by-name/pu/pueue/package.nix
index 4324c882cf4a..6b3d4f05bda1 100644
--- a/pkgs/by-name/pu/pueue/package.nix
+++ b/pkgs/by-name/pu/pueue/package.nix
@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pueue";
-  version = "4.0.0";
+  version = "4.0.1";
 
   src = fetchFromGitHub {
     owner = "Nukesor";
     repo = "pueue";
     rev = "v${version}";
-    hash = "sha256-TDxTj7VGzJzd6RWyVbe2ubpVS57bqq7OVvi23ZHmYDM=";
+    hash = "sha256-m6mXq62imJ9yVpH6M8O3I7Z4FDdnEtp9ADfMjD4RDM4=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-R94D9/J+Zl86Rb4+5O2Hp9GmcwnRt+0wJ56CHFoy/zg=";
+  cargoHash = "sha256-E2mLpRCffFySzBZVtxS4YZPuTRhjU4LrFEfC1dbF6ug=";
 
   nativeBuildInputs =
     [

From 821dbd384e0927b25445c240b2d10153703caf3a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A1nos=20Kukovecz?= <kukoveczjanos@gmail.com>
Date: Mon, 7 Jul 2025 19:03:56 +0200
Subject: [PATCH 34/92] headsetcontrol: 3.0.0 -> 3.1.0

https://github.com/Sapd/HeadsetControl/releases/tag/3.1.0
---
 pkgs/by-name/he/headsetcontrol/package.nix | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/he/headsetcontrol/package.nix b/pkgs/by-name/he/headsetcontrol/package.nix
index 05f3ffec1834..954edcd0d48c 100644
--- a/pkgs/by-name/he/headsetcontrol/package.nix
+++ b/pkgs/by-name/he/headsetcontrol/package.nix
@@ -2,7 +2,6 @@
   stdenv,
   lib,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
   hidapi,
   udevCheckHook,
@@ -10,22 +9,15 @@
 
 stdenv.mkDerivation rec {
   pname = "headsetcontrol";
-  version = "3.0.0";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "Sapd";
     repo = "HeadsetControl";
     rev = version;
-    sha256 = "sha256-N1c94iAJgCPhGNDCGjMINg0AL2wPX5gVIsJ+pzn/l9Y=";
+    sha256 = "sha256-9LUqYV0MMTtlFYZCEn81kML5F46GDYWYwoKpO0UORcQ=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://patch-diff.githubusercontent.com/raw/Sapd/HeadsetControl/pull/337.patch";
-      hash = "sha256-18w9BQsMljEA/eY3rnosHvKwhiaF79TrWH/ayuyZMrM=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     udevCheckHook

From 8e990d860979e8214a55d291d6090b30a4d69b76 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sun, 6 Jul 2025 11:51:23 -0700
Subject: [PATCH 35/92] python312Packages.reflex: disable broken test due to
 use of magic string

---
 pkgs/development/python-modules/reflex/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/python-modules/reflex/default.nix b/pkgs/development/python-modules/reflex/default.nix
index c6183a2fbe26..83c179a05136 100644
--- a/pkgs/development/python-modules/reflex/default.nix
+++ b/pkgs/development/python-modules/reflex/default.nix
@@ -125,6 +125,9 @@ buildPythonPackage rec {
     "test_state_with_invalid_yield"
     # tries to run bun or npm
     "test_output_system_info"
+    # Comparison with magic string
+    # TODO Recheck on next update as it appears to be fixed in 8.0.x
+    "test_background_task_no_block"
   ];
 
   disabledTestPaths = [

From 64befe596e0217aeb94873009f0b996e053e19e0 Mon Sep 17 00:00:00 2001
From: teutat3s <10206665+teutat3s@users.noreply.github.com>
Date: Mon, 7 Jul 2025 20:57:33 +0200
Subject: [PATCH 36/92] syn2mas: drop

'syn2mas' has been removed. It has been integrated into the main
matrix-authentication-service CLI as a subcommand: 'mas-cli syn2mas'.
---
 pkgs/by-name/sy/syn2mas/package.nix | 31 -----------------------------
 pkgs/top-level/aliases.nix          |  1 +
 2 files changed, 1 insertion(+), 31 deletions(-)
 delete mode 100644 pkgs/by-name/sy/syn2mas/package.nix

diff --git a/pkgs/by-name/sy/syn2mas/package.nix b/pkgs/by-name/sy/syn2mas/package.nix
deleted file mode 100644
index 5e98fd15467a..000000000000
--- a/pkgs/by-name/sy/syn2mas/package.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{
-  lib,
-  buildNpmPackage,
-  fetchFromGitHub,
-}:
-
-buildNpmPackage rec {
-  pname = "syn2mas";
-  version = "0.15.0";
-
-  src = fetchFromGitHub {
-    owner = "element-hq";
-    repo = "matrix-authentication-service";
-    rev = "v${version}";
-    hash = "sha256-RK58yfsPJirOKHyBnth42sLTkWo+AkMylEigH0w/RWc=";
-  };
-
-  sourceRoot = "${src.name}/tools/syn2mas";
-
-  npmDepsHash = "sha256-RzZjTKS4d/n9mIJ+eUY7NlqWssCnJ2Yh2nAMwasY8Fk=";
-
-  dontBuild = true;
-
-  meta = {
-    description = "Tool to help with the migration of a Matrix Synapse installation to the Matrix Authentication Service";
-    homepage = "https://github.com/element-hq/matrix-authentication-service/tree/main/tools/syn2mas";
-    license = lib.licenses.agpl3Only;
-    maintainers = with lib.maintainers; [ teutat3s ];
-    mainProgram = "syn2mas";
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 4c40dac8e6d4..5cc753130ff5 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1905,6 +1905,7 @@ mapAliases {
   swt_jdk8 = throw "'swt_jdk8' has been removed due to being unused and broken for a long time"; # Added 2025-01-07
   Sylk = sylk; # Added 2024-06-12
   symbiyosys = sby; # Added 2024-08-18
+  syn2mas = throw "'syn2mas' has been removed. It has been integrated into the main matrix-authentication-service CLI as a subcommand: 'mas-cli syn2mas'."; # Added 2025-07-07
   sync = taler-sync; # Added 2024-09-04
   syncthing-cli = throw "'syncthing-cli' has been renamed to/replaced by 'syncthing'"; # Converted to throw 2024-10-17
   syncthingtray-qt6 = syncthingtray; # Added 2024-03-06

From e90c62d5abd0162421dd6ffefe8b2a45ae679b58 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Mon, 7 Jul 2025 18:57:36 +0200
Subject: [PATCH 37/92] workflows/labels: small refactor

To avoid having a diff when moving the file in the next commit.
---
 .github/workflows/labels.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index c6ffd31ee1a2..b27a937098ec 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -377,7 +377,7 @@ jobs:
                   github.rest.search.issuesAndPullRequests,
                   {
                     q: [
-                      `repo:"${process.env.GITHUB_REPOSITORY}"`,
+                      `repo:"${context.repo.owner}/${context.repo.repo}"`,
                       'is:open',
                       `updated:>=${cutoff.toISOString()}`
                     ].join(' AND '),

From a8ad2b129efde5e4d41bb1eb6296fafccac9bafc Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Mon, 7 Jul 2025 19:51:22 -0400
Subject: [PATCH 38/92] yaml2json: cleanup, add versionCheckHook,
 nix-update-script

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 pkgs/by-name/ya/yaml2json/package.nix | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/ya/yaml2json/package.nix b/pkgs/by-name/ya/yaml2json/package.nix
index 1e843d0da18a..fcd2943e52e7 100644
--- a/pkgs/by-name/ya/yaml2json/package.nix
+++ b/pkgs/by-name/ya/yaml2json/package.nix
@@ -2,16 +2,18 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "yaml2json";
   version = "1.3.5";
 
   src = fetchFromGitHub {
     owner = "bronze1man";
     repo = "yaml2json";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-mIjtR1VsSeUhEgeSKDG0qT0kj+NCqVwn31m300cMDeU=";
   };
 
@@ -24,11 +26,18 @@ buildGoModule rec {
     "-w"
   ];
 
-  meta = with lib; {
+  nativeCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     homepage = "https://github.com/bronze1man/yaml2json";
+    changelog = "https://github.com/bronze1man/yaml2json/releases/tag/v${finalAttrs.version}";
     description = "Convert yaml to json";
     mainProgram = "yaml2json";
-    license = with licenses; [ mit ];
+    license = with lib.licenses; [ mit ];
     maintainers = [ ];
   };
-}
+})

From ae9763c81b7dd1ae2f7f308598e7fa7f66488ef8 Mon Sep 17 00:00:00 2001
From: Kenichi Kamiya <kachick1@gmail.com>
Date: Tue, 8 Jul 2025 12:15:38 +0900
Subject: [PATCH 39/92] typstyle: update GitHub owner

Clarified in v0.13.12:

* https://github.com/typstyle-rs/typstyle/blob/v0.13.12/CHANGELOG.md?plain=1#L5
* https://github.com/typstyle-rs/typstyle/commit/87ba66c1522b16ea9e933d21f642b4a2f124fd1f
---
 pkgs/by-name/ty/typstyle/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ty/typstyle/package.nix b/pkgs/by-name/ty/typstyle/package.nix
index 92813caad98d..32fc2c8575f9 100644
--- a/pkgs/by-name/ty/typstyle/package.nix
+++ b/pkgs/by-name/ty/typstyle/package.nix
@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   version = "0.13.13";
 
   src = fetchFromGitHub {
-    owner = "Enter-tainer";
+    owner = "typstyle-rs";
     repo = "typstyle";
     tag = "v${finalAttrs.version}";
     hash = "sha256-IAKCwKekeFekHBjfdC4pi74SXJzCDFoby3n1Z0Pu5q4=";
@@ -36,9 +36,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
   };
 
   meta = {
-    changelog = "https://github.com/Enter-tainer/typstyle/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/typstyle-rs/typstyle/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     description = "Format your typst source code";
-    homepage = "https://github.com/Enter-tainer/typstyle";
+    homepage = "https://github.com/typstyle-rs/typstyle";
     license = lib.licenses.asl20;
     mainProgram = "typstyle";
     maintainers = with lib.maintainers; [

From 45cbfe3b835007a7a234df0506dc446b8e460234 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 8 Jul 2025 04:45:19 +0000
Subject: [PATCH 40/92] cynthion: 0.2.0 -> 0.2.2

---
 pkgs/development/python-modules/cynthion/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/cynthion/default.nix b/pkgs/development/python-modules/cynthion/default.nix
index c16d632142ab..1d265c8da52d 100644
--- a/pkgs/development/python-modules/cynthion/default.nix
+++ b/pkgs/development/python-modules/cynthion/default.nix
@@ -26,14 +26,14 @@
 }:
 buildPythonPackage rec {
   pname = "cynthion";
-  version = "0.2.0";
+  version = "0.2.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "greatscottgadgets";
     repo = "cynthion";
     tag = version;
-    hash = "sha256-rbvw2eieZwTxStwCRuvIx/f4vdPsOFnV/U80Ga+fNPA=";
+    hash = "sha256-xL1/ckX+xKUQpugQkLB3SlZeNcBEaTMascTgoQ4C+hA=";
   };
 
   sourceRoot = "${src.name}/cynthion/python";

From 882fab6f25564dad4c3e8e8deeb39b18c1cc9472 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 8 Jul 2025 07:18:59 +0000
Subject: [PATCH 41/92] similarity: 0.2.4 -> 0.3.1

---
 pkgs/by-name/si/similarity/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/si/similarity/package.nix b/pkgs/by-name/si/similarity/package.nix
index c10e5dfc9279..3ad4c9c5072d 100644
--- a/pkgs/by-name/si/similarity/package.nix
+++ b/pkgs/by-name/si/similarity/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "similarity";
-  version = "0.2.4";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "mizchi";
     repo = "similarity";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Z2ZaKBpq7N8KIX8nOzPhm8evfoUxBzaAK0+4cU9qBDE=";
+    hash = "sha256-eZQ0FTmysFYwqg3sjasZW3S0lps2XbFWUbWuZzkFWkA=";
   };
 
-  cargoHash = "sha256-oYqdCHGY6OZSbYXhjIt20ZL2JkZP7UEOhn0fhuZQnZo=";
+  cargoHash = "sha256-7qLC1RvjBXd9JFrJdDTIngZhMvyQV1ko3MXRr/2y7hA=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgram = "${placeholder "out"}/bin/${finalAttrs.pname}-ts";

From d4209774aa40e8b5d13ef2018fcae98d4a592624 Mon Sep 17 00:00:00 2001
From: rewine <luhongxu@deepin.org>
Date: Tue, 8 Jul 2025 17:01:33 +0800
Subject: [PATCH 42/92] grim: 1.4.1 -> 1.5.0

---
 pkgs/by-name/gr/grim/package.nix | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/gr/grim/package.nix b/pkgs/by-name/gr/grim/package.nix
index 7a226b0884e5..45017b3c3158 100644
--- a/pkgs/by-name/gr/grim/package.nix
+++ b/pkgs/by-name/gr/grim/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  fetchFromSourcehut,
+  fetchFromGitLab,
   libjpeg,
   libpng,
   meson,
@@ -16,15 +16,21 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "grim";
-  version = "1.4.1";
+  version = "1.5.0";
 
-  src = fetchFromSourcehut {
-    owner = "~emersion";
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "emersion";
     repo = "grim";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-5csJqRLNqhyeXR4dEQtnPUSwuZ8oY+BIt6AVICkm1+o=";
+    hash = "sha256-oPo6zrS3gCnviIK0+gPvtal+6c7fNFWtXnAA0YfaS+U=";
   };
 
+  depsBuildBuild = [
+    # To find wayland-scanner
+    pkg-config
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
@@ -46,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
   strictDeps = true;
 
   meta = {
-    homepage = "https://sr.ht/~emersion/grim";
+    homepage = "https://gitlab.freedesktop.org/emersion/grim";
     description = "Grab images from a Wayland compositor";
     license = lib.licenses.mit;
     mainProgram = "grim";

From 65f9a28658d7e28f7aff0ab90d42605bb1445ed7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 8 Jul 2025 09:26:39 +0000
Subject: [PATCH 43/92] karmor: 1.4.3 -> 1.4.4

---
 pkgs/by-name/ka/karmor/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ka/karmor/package.nix b/pkgs/by-name/ka/karmor/package.nix
index 99ab6663e949..68b4b82c57c4 100644
--- a/pkgs/by-name/ka/karmor/package.nix
+++ b/pkgs/by-name/ka/karmor/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "karmor";
-  version = "1.4.3";
+  version = "1.4.4";
 
   src = fetchFromGitHub {
     owner = "kubearmor";
     repo = "kubearmor-client";
     rev = "v${version}";
-    hash = "sha256-g60T9npfU1uwQvs95ntRrwwfxXeC67C0iF867ki3WAI=";
+    hash = "sha256-BlMWbd+c/dW3nrG9mQn4lfyXvauJ4GCcJypp+SMfAuY=";
   };
 
-  vendorHash = "sha256-4F/q6vYOGtLef+rrJXKhLwjM71NMNI4es4dKe1pohZU=";
+  vendorHash = "sha256-SZAJsstFUtZi+/sSkgmvFSjd4115YKsPuPEksWxE9D0=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From 147ccdb97545c97f7830ff552d0208a59099bd9a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 8 Jul 2025 11:04:15 +0000
Subject: [PATCH 44/92] cargo-tauri: 2.5.0 -> 2.6.2

---
 pkgs/by-name/ca/cargo-tauri/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ca/cargo-tauri/package.nix b/pkgs/by-name/ca/cargo-tauri/package.nix
index 9be1ca1e89ee..42f9aeec2039 100644
--- a/pkgs/by-name/ca/cargo-tauri/package.nix
+++ b/pkgs/by-name/ca/cargo-tauri/package.nix
@@ -13,17 +13,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tauri";
-  version = "2.5.0";
+  version = "2.6.2";
 
   src = fetchFromGitHub {
     owner = "tauri-apps";
     repo = "tauri";
     tag = "tauri-cli-v${version}";
-    hash = "sha256-ut5Etn5yf4X3NvFa5JCRH2sQGnC/xzaRhALoyxdjy2k=";
+    hash = "sha256-QdboIHbRKC/0k6FGKDuCA7AR3eIa7KVij3fGekD9kNk=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-1YLpK2frSmdCj5aksuZhnHkAZdwHX/ZuVKXyqVJel/s=";
+  cargoHash = "sha256-GFqUQLLURfm6sRpf4MwAp89aKpTwWIlxk3NNRf9QgC0=";
 
   nativeBuildInputs = [ pkg-config ];
 

From 47754b692045206b960d62b04e730d78562db7a5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 8 Jul 2025 13:19:45 +0000
Subject: [PATCH 45/92] postgresqlPackages.timescaledb-apache: 2.20.3 -> 2.21.0

---
 pkgs/servers/sql/postgresql/ext/timescaledb.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/ext/timescaledb.nix b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
index 349732a40010..e2fbf6c86804 100644
--- a/pkgs/servers/sql/postgresql/ext/timescaledb.nix
+++ b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
@@ -13,13 +13,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "timescaledb${lib.optionalString (!enableUnfree) "-apache"}";
-  version = "2.20.3";
+  version = "2.21.0";
 
   src = fetchFromGitHub {
     owner = "timescale";
     repo = "timescaledb";
     tag = finalAttrs.version;
-    hash = "sha256-Ma6h2ISMjBz14y5Pbx4T4QOMrrvUy5wkPyKawm9rpx0=";
+    hash = "sha256-t3BPy1rmV3f/OFDHqiRh1E9tNH7dc1LCTktvkSSZLro=";
   };
 
   nativeBuildInputs = [ cmake ];

From 30ff8c73202dffcb8052e7e345c65eebf072e284 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Tue, 8 Jul 2025 09:41:10 -0500
Subject: [PATCH 46/92] cdrtools: move to pkgs/by-name

---
 .../cdrtools/default.nix => by-name/cd/cdrtools/package.nix}    | 0
 pkgs/top-level/all-packages.nix                                 | 2 --
 2 files changed, 2 deletions(-)
 rename pkgs/{tools/cd-dvd/cdrtools/default.nix => by-name/cd/cdrtools/package.nix} (100%)

diff --git a/pkgs/tools/cd-dvd/cdrtools/default.nix b/pkgs/by-name/cd/cdrtools/package.nix
similarity index 100%
rename from pkgs/tools/cd-dvd/cdrtools/default.nix
rename to pkgs/by-name/cd/cdrtools/package.nix
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e611c86f0fa4..758cf2852a15 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2485,8 +2485,6 @@ with pkgs;
 
   cdist = python3Packages.callPackage ../tools/admin/cdist { };
 
-  cdrtools = callPackage ../tools/cd-dvd/cdrtools { };
-
   cemu-ti = qt5.callPackage ../applications/science/math/cemu-ti { };
 
   libceph = ceph.lib;

From 67d523b8d6b678d7934d6ef801da6e8b4366006f Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Tue, 8 Jul 2025 09:42:29 -0500
Subject: [PATCH 47/92] cdrtools: modernize

---
 pkgs/by-name/cd/cdrtools/package.nix | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/cd/cdrtools/package.nix b/pkgs/by-name/cd/cdrtools/package.nix
index 3f61dd45854d..bf36cda6f08b 100644
--- a/pkgs/by-name/cd/cdrtools/package.nix
+++ b/pkgs/by-name/cd/cdrtools/package.nix
@@ -7,16 +7,17 @@
   libcap,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "cdrtools";
   version = "3.02a09";
 
   src = fetchurl {
-    url = "mirror://sourceforge/cdrtools/${pname}-${version}.tar.bz2";
-    sha256 = "10ayj48jax2pvsv6j5gybwfsx7b74zdjj84znwag7wwf8n7l6a5a";
+    url = "mirror://sourceforge/cdrtools/cdrtools-${finalAttrs.version}.tar.bz2";
+    hash = "sha256-qihDj0WO8/MUt58gKdsnZ52uHV/+FWm23ld0JRGRXoE=";
   };
 
   nativeBuildInputs = [ m4 ];
+
   buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [
     acl
     libcap
@@ -57,19 +58,19 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = lib.optional stdenv.hostPlatform.isMusl "fortify";
 
-  meta = with lib; {
+  meta = {
     homepage = "https://cdrtools.sourceforge.net/private/cdrecord.html";
     description = "Highly portable CD/DVD/BluRay command line recording software";
-    license = with licenses; [
+    license = with lib.licenses; [
       cddl
       gpl2Plus
-      lgpl21
+      lgpl21Plus
     ];
-    maintainers = with maintainers; [ wegank ];
-    platforms = with platforms; linux ++ darwin;
+    maintainers = with lib.maintainers; [ wegank ];
+    platforms = with lib.platforms; linux ++ darwin;
     # Licensing issues: This package contains code licensed under CDDL, GPL2
     # and LGPL2. There is a debate regarding the legality of distributing this
     # package in binary form.
     hydraPlatforms = [ ];
   };
-}
+})

From 9ba028f6b0c1a1c0ff984b94e03c6e42e4524636 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 8 Jul 2025 16:59:32 +0200
Subject: [PATCH 48/92] draupnir: 2.4.1 -> 2.5.0

https://github.com/the-draupnir-project/Draupnir/releases/tag/v2.5.0
---
 pkgs/by-name/dr/draupnir/hashes.json  | 2 +-
 pkgs/by-name/dr/draupnir/package.json | 4 ++--
 pkgs/by-name/dr/draupnir/package.nix  | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/dr/draupnir/hashes.json b/pkgs/by-name/dr/draupnir/hashes.json
index 3bf0d669f051..e8efb8111d6b 100644
--- a/pkgs/by-name/dr/draupnir/hashes.json
+++ b/pkgs/by-name/dr/draupnir/hashes.json
@@ -1,3 +1,3 @@
 {
-  "yarn_offline_cache_hash": "sha256-OFzs3151Y5GGMS9VfV/Y7yUSqTOCns4QE+S/Cn3TN90="
+  "yarn_offline_cache_hash": "sha256-M0K26W917xtv2KxyATI2pCsyDo8ybjiFqLHPlXY9c8g="
 }
diff --git a/pkgs/by-name/dr/draupnir/package.json b/pkgs/by-name/dr/draupnir/package.json
index 53de23a7ee30..cd91cacb1519 100644
--- a/pkgs/by-name/dr/draupnir/package.json
+++ b/pkgs/by-name/dr/draupnir/package.json
@@ -1,6 +1,6 @@
 {
   "name": "draupnir",
-  "version": "2.4.1",
+  "version": "2.5.0",
   "description": "A moderation tool for Matrix",
   "main": "lib/index.js",
   "repository": "https://github.com/the-draupnir-project/Draupnir.git",
@@ -63,7 +63,7 @@
     "jsdom": "^24.0.0",
     "matrix-appservice-bridge": "^10.3.1",
     "matrix-bot-sdk": "npm:@vector-im/matrix-bot-sdk@^0.7.1-element.6",
-    "matrix-protection-suite": "npm:@gnuxie/matrix-protection-suite@3.6.2",
+    "matrix-protection-suite": "npm:@gnuxie/matrix-protection-suite@3.7.1",
     "matrix-protection-suite-for-matrix-bot-sdk": "npm:@gnuxie/matrix-protection-suite-for-matrix-bot-sdk@3.6.6",
     "pg": "^8.8.0",
     "yaml": "^2.3.2"
diff --git a/pkgs/by-name/dr/draupnir/package.nix b/pkgs/by-name/dr/draupnir/package.nix
index 687399b3ee3c..e3abe656c1d6 100644
--- a/pkgs/by-name/dr/draupnir/package.nix
+++ b/pkgs/by-name/dr/draupnir/package.nix
@@ -22,13 +22,13 @@ let
 in
 mkYarnPackage rec {
   pname = "draupnir";
-  version = "2.4.1";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "the-draupnir-project";
     repo = "Draupnir";
     tag = "v${version}";
-    hash = "sha256-mH5SzguZq1H+njHxWLfjXF3y3/v34KUg45ELL+femNw=";
+    hash = "sha256-au0qYS646MAXyfQTk6gJem3geTecgDwzZl+87/6VE5A=";
   };
 
   nativeBuildInputs = [

From 89ee8975ab70b62e7eb163d2e7f25082a66742e1 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Mon, 7 Jul 2025 18:56:07 +0200
Subject: [PATCH 49/92] ci/labels: init from workflows/labels

Moves the labels job into a separate ci/ subfolder to run it locally.
This eases debugging *a lot*.
---
 .github/workflows/labels.yml |  408 +-------
 ci/labels/.editorconfig      |    4 +
 ci/labels/.gitignore         |    1 +
 ci/labels/.npmrc             |    1 +
 ci/labels/README.md          |    4 +
 ci/labels/labels.cjs         |  402 +++++++
 ci/labels/package-lock.json  | 1897 ++++++++++++++++++++++++++++++++++
 ci/labels/package.json       |    9 +
 ci/labels/run.js             |   44 +
 ci/labels/shell.nix          |   23 +
 10 files changed, 2394 insertions(+), 399 deletions(-)
 create mode 100644 ci/labels/.editorconfig
 create mode 100644 ci/labels/.gitignore
 create mode 100644 ci/labels/.npmrc
 create mode 100644 ci/labels/README.md
 create mode 100644 ci/labels/labels.cjs
 create mode 100644 ci/labels/package-lock.json
 create mode 100644 ci/labels/package.json
 create mode 100755 ci/labels/run.js
 create mode 100644 ci/labels/shell.nix

diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index b27a937098ec..e4a4205f3eba 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -40,6 +40,11 @@ jobs:
     runs-on: ubuntu-24.04-arm
     if: github.event_name != 'schedule' || github.repository_owner == 'NixOS'
     steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          sparse-checkout: |
+            ci/labels
+
       - name: Install dependencies
         run: npm install @actions/artifact bottleneck
 
@@ -64,406 +69,11 @@ jobs:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           retries: 3
           script: |
-            const Bottleneck = require('bottleneck')
-            const path = require('node:path')
-            const { DefaultArtifactClient } = require('@actions/artifact')
-            const { readFile, writeFile } = require('node:fs/promises')
-
-            const artifactClient = new DefaultArtifactClient()
-
-            const stats = {
-              issues: 0,
-              prs: 0,
-              requests: 0,
-              artifacts: 0
-            }
-
-            // Rate-Limiting and Throttling, see for details:
-            //   https://github.com/octokit/octokit.js/issues/1069#throttling
-            //   https://docs.github.com/en/rest/using-the-rest-api/best-practices-for-using-the-rest-api
-            const allLimits = new Bottleneck({
-              // Avoid concurrent requests
-              maxConcurrent: 1,
-              // Will be updated with first `updateReservoir()` call below.
-              reservoir: 0
+            require('./ci/labels/labels.cjs')({
+              github,
+              context,
+              core,
             })
-            // Pause between mutative requests
-            const writeLimits = new Bottleneck({ minTime: 1000 }).chain(allLimits)
-            github.hook.wrap('request', async (request, options) => {
-              // Requests to the /rate_limit endpoint do not count against the rate limit.
-              if (options.url == '/rate_limit') return request(options)
-              // Search requests are in a different resource group, which allows 30 requests / minute.
-              // We do less than a handful each run, so not implementing throttling for now.
-              if (options.url.startsWith('/search/')) return request(options)
-              stats.requests++
-              if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(options.method))
-                return writeLimits.schedule(request.bind(null, options))
-              else
-                return allLimits.schedule(request.bind(null, options))
-            })
-
-            async function updateReservoir() {
-              let response
-              try {
-                response = await github.rest.rateLimit.get()
-              } catch (err) {
-                core.error(`Failed updating reservoir:\n${err}`)
-                // Keep retrying on failed rate limit requests instead of exiting the script early.
-                return
-              }
-              // Always keep 1000 spare requests for other jobs to do their regular duty.
-              // They normally use below 100, so 1000 is *plenty* of room to work with.
-              const reservoir = Math.max(0, response.data.resources.core.remaining - 1000)
-              core.info(`Updating reservoir to: ${reservoir}`)
-              allLimits.updateSettings({ reservoir })
-            }
-            await updateReservoir()
-            // Update remaining requests every minute to account for other jobs running in parallel.
-            const reservoirUpdater = setInterval(updateReservoir, 60 * 1000)
-
-            async function handlePullRequest(item) {
-              const log = (k,v) => core.info(`PR #${item.number} - ${k}: ${v}`)
-
-              const pull_number = item.number
-
-              // This API request is important for the merge-conflict label, because it triggers the
-              // creation of a new test merge commit. This is needed to actually determine the state of a PR.
-              const pull_request = (await github.rest.pulls.get({
-                ...context.repo,
-                pull_number
-              })).data
-
-              const reviews = await github.paginate(github.rest.pulls.listReviews, {
-                  ...context.repo,
-                  pull_number
-                })
-
-              const approvals = new Set(
-                reviews
-                .filter(review => review.state == 'APPROVED')
-                .map(review => review.user?.id)
-              )
-
-              // After creation of a Pull Request, `merge_commit_sha` will be null initially:
-              // The very first merge commit will only be calculated after a little while.
-              // To avoid labeling the PR as conflicted before that, we wait a few minutes.
-              // This is intentionally less than the time that Eval takes, so that the label job
-              // running after Eval can indeed label the PR as conflicted if that is the case.
-              const merge_commit_sha_valid = new Date() - new Date(pull_request.created_at) > 3 * 60 * 1000
-
-              const prLabels = {
-                // We intentionally don't use the mergeable or mergeable_state attributes.
-                // Those have an intermediate state while the test merge commit is created.
-                // This doesn't work well for us, because we might have just triggered another
-                // test merge commit creation by request the pull request via API at the start
-                // of this function.
-                // The attribute merge_commit_sha keeps the old value of null or the hash *until*
-                // the new test merge commit has either successfully been created or failed so.
-                // This essentially means we are updating the merge conflict label in two steps:
-                // On the first pass of the day, we just fetch the pull request, which triggers
-                // the creation. At this stage, the label is likely not updated, yet.
-                // The second pass will then read the result from the first pass and set the label.
-                '2.status: merge conflict': merge_commit_sha_valid && !pull_request.merge_commit_sha,
-                '12.approvals: 1': approvals.size == 1,
-                '12.approvals: 2': approvals.size == 2,
-                '12.approvals: 3+': approvals.size >= 3,
-                '12.first-time contribution':
-                  [ 'NONE', 'FIRST_TIMER', 'FIRST_TIME_CONTRIBUTOR' ].includes(pull_request.author_association),
-              }
-
-              const { id: run_id, conclusion } = (await github.rest.actions.listWorkflowRuns({
-                ...context.repo,
-                workflow_id: 'pr.yml',
-                event: 'pull_request_target',
-                exclude_pull_requests: true,
-                head_sha: pull_request.head.sha
-              })).data.workflow_runs[0] ??
-                // TODO: Remove this after 2025-09-17, at which point all eval.yml artifacts will have expired.
-                (await github.rest.actions.listWorkflowRuns({
-                  ...context.repo,
-                  // In older PRs, we need eval.yml instead of pr.yml.
-                  workflow_id: 'eval.yml',
-                  event: 'pull_request_target',
-                  status: 'success',
-                  exclude_pull_requests: true,
-                  head_sha: pull_request.head.sha
-                })).data.workflow_runs[0] ?? {}
-
-              // Newer PRs might not have run Eval to completion, yet.
-              // Older PRs might not have an eval.yml workflow, yet.
-              // In either case we continue without fetching an artifact on a best-effort basis.
-              log('Last eval run', run_id ?? '<n/a>')
-
-              if (conclusion === 'success') {
-                Object.assign(prLabels, {
-                  // We only set this label if the latest eval run was successful, because if it was not, it
-                  // *could* have requested reviewers. We will let the PR author fix CI first, before "escalating"
-                  // this PR to "needs: reviewer".
-                  // Since the first Eval run on a PR always sets rebuild labels, the same PR will be "recently
-                  // updated" for the next scheduled run. Thus, this label will still be set within a few minutes
-                  // after a PR is created, if required.
-                  // Note that a "requested reviewer" disappears once they have given a review, so we check
-                  // existing reviews, too.
-                  '9.needs: reviewer':
-                    !pull_request.draft &&
-                    pull_request.requested_reviewers.length == 0 &&
-                    reviews.length == 0,
-                })
-              }
-
-              const artifact = run_id && (await github.rest.actions.listWorkflowRunArtifacts({
-                ...context.repo,
-                run_id,
-                name: 'comparison'
-              })).data.artifacts[0]
-
-              // Instead of checking the boolean artifact.expired, we will give us a minute to
-              // actually download the artifact in the next step and avoid that race condition.
-              // Older PRs, where the workflow run was already eval.yml, but the artifact was not
-              // called "comparison", yet, will skip the download.
-              const expired = !artifact || new Date(artifact?.expires_at ?? 0) < new Date(new Date().getTime() + 60 * 1000)
-              log('Artifact expires at', artifact?.expires_at ?? '<n/a>')
-              if (!expired) {
-                stats.artifacts++
-
-                await artifactClient.downloadArtifact(artifact.id, {
-                  findBy: {
-                    repositoryName: context.repo.repo,
-                    repositoryOwner: context.repo.owner,
-                    token: core.getInput('github-token')
-                  },
-                  path: path.resolve(pull_number.toString()),
-                  expectedHash: artifact.digest
-                })
-
-                const maintainers = new Set(Object.keys(
-                  JSON.parse(await readFile(`${pull_number}/maintainers.json`, 'utf-8'))
-                ).map(m => Number.parseInt(m, 10)))
-
-                const evalLabels = JSON.parse(await readFile(`${pull_number}/changed-paths.json`, 'utf-8')).labels
-
-                Object.assign(
-                  prLabels,
-                  // Ignore `evalLabels` if it's an array.
-                  // This can happen for older eval runs, before we switched to objects.
-                  // The old eval labels would have been set by the eval run,
-                  // so now they'll be present in `before`.
-                  // TODO: Simplify once old eval results have expired (~2025-10)
-                  (Array.isArray(evalLabels) ? undefined : evalLabels),
-                  {
-                    '12.approved-by: package-maintainer': Array.from(maintainers).some(m => approvals.has(m)),
-                  }
-                )
-              }
-
-              return prLabels
-            }
-
-            async function handle(item) {
-              try {
-                const log = (k,v,skip) => {
-                  core.info(`#${item.number} - ${k}: ${v}` + (skip ? ' (skipped)' : ''))
-                  return skip
-                }
-
-                log('Last updated at', item.updated_at)
-                log('URL', item.html_url)
-
-                const issue_number = item.number
-
-                const itemLabels = {}
-
-                if (item.pull_request) {
-                  stats.prs++
-                  Object.assign(itemLabels, await handlePullRequest(item))
-                } else {
-                  stats.issues++
-                }
-
-                const latest_event_at = new Date(
-                  (await github.paginate(
-                    github.rest.issues.listEventsForTimeline,
-                    {
-                      ...context.repo,
-                      issue_number,
-                      per_page: 100
-                    }
-                  ))
-                  .filter(({ event }) => [
-                    // These events are hand-picked from:
-                    //   https://docs.github.com/en/rest/using-the-rest-api/issue-event-types?apiVersion=2022-11-28
-                    // Each of those causes a PR/issue to *not* be considered as stale anymore.
-                    // Most of these use created_at.
-                    'assigned',
-                    'commented', // uses updated_at, because that could be > created_at
-                    'committed', // uses committer.date
-                    'head_ref_force_pushed',
-                    'milestoned',
-                    'pinned',
-                    'ready_for_review',
-                    'renamed',
-                    'reopened',
-                    'review_dismissed',
-                    'review_requested',
-                    'reviewed', // uses submitted_at
-                    'unlocked',
-                    'unmarked_as_duplicate',
-                  ].includes(event))
-                  .map(({ created_at, updated_at, committer, submitted_at }) => new Date(updated_at ?? created_at ?? submitted_at ?? committer.date))
-                  // Reverse sort by date value. The default sort() sorts by string representation, which is bad for dates.
-                  .sort((a,b) => b-a)
-                  .at(0) ?? item.created_at
-                )
-                log('latest_event_at', latest_event_at.toISOString())
-
-                const stale_at = new Date(new Date().setDate(new Date().getDate() - 180))
-
-                // Create a map (Label -> Boolean) of all currently set labels.
-                // Each label is set to True and can be disabled later.
-                const before = Object.fromEntries(
-                  (await github.paginate(github.rest.issues.listLabelsOnIssue, {
-                    ...context.repo,
-                    issue_number
-                  }))
-                  .map(({ name }) => [name, true])
-                )
-
-                Object.assign(itemLabels, {
-                  '2.status: stale': !before['1.severity: security'] && latest_event_at < stale_at,
-                })
-
-                const after = Object.assign({}, before, itemLabels)
-
-                // No need for an API request, if all labels are the same.
-                const hasChanges = Object.keys(after).some(name => (before[name] ?? false) != after[name])
-                if (log('Has changes', hasChanges, !hasChanges))
-                  return;
-
-                // Skipping labeling on a pull_request event, because we have no privileges.
-                const labels = Object.entries(after).filter(([,value]) => value).map(([name]) => name)
-                if (log('Set labels', labels, context.eventName == 'pull_request'))
-                  return;
-
-                await github.rest.issues.setLabels({
-                  ...context.repo,
-                  issue_number,
-                  labels
-                })
-              } catch (cause) {
-                throw new Error(`Labeling #${item.number} failed.`, { cause })
-              }
-            }
-
-            try {
-              if (context.payload.pull_request) {
-                await handle(context.payload.pull_request)
-              } else {
-                const lastRun = (await github.rest.actions.listWorkflowRuns({
-                  ...context.repo,
-                  workflow_id: 'labels.yml',
-                  event: 'schedule',
-                  status: 'success',
-                  exclude_pull_requests: true,
-                  per_page: 1
-                })).data.workflow_runs[0]
-
-                // Go back as far as the last successful run of this workflow to make sure
-                // we are not leaving anyone behind on GHA failures.
-                // Defaults to go back 1 hour on the first run.
-                const cutoff = new Date(lastRun?.created_at ?? new Date().getTime() - 1 * 60 * 60 * 1000)
-                core.info('cutoff timestamp: ' + cutoff.toISOString())
-
-                const updatedItems = await github.paginate(
-                  github.rest.search.issuesAndPullRequests,
-                  {
-                    q: [
-                      `repo:"${context.repo.owner}/${context.repo.repo}"`,
-                      'is:open',
-                      `updated:>=${cutoff.toISOString()}`
-                    ].join(' AND '),
-                    // TODO: Remove in 2025-10, when it becomes the default.
-                    advanced_search: true
-                  }
-                )
-
-                let cursor
-
-                // No workflow run available the first time.
-                if (lastRun) {
-                  // The cursor to iterate through the full list of issues and pull requests
-                  // is passed between jobs as an artifact.
-                  const artifact = (await github.rest.actions.listWorkflowRunArtifacts({
-                    ...context.repo,
-                    run_id: lastRun.id,
-                    name: 'pagination-cursor'
-                  })).data.artifacts[0]
-
-                  // If the artifact is not available, the next iteration starts at the beginning.
-                  if (artifact) {
-                    stats.artifacts++
-
-                    const { downloadPath } = await artifactClient.downloadArtifact(artifact.id, {
-                      findBy: {
-                        repositoryName: context.repo.repo,
-                        repositoryOwner: context.repo.owner,
-                        token: core.getInput('github-token')
-                      },
-                      expectedHash: artifact.digest
-                    })
-
-                    cursor = await readFile(path.resolve(downloadPath, 'cursor'), 'utf-8')
-                  }
-                }
-
-                // From GitHub's API docs:
-                //   GitHub's REST API considers every pull request an issue, but not every issue is a pull request.
-                //   For this reason, "Issues" endpoints may return both issues and pull requests in the response.
-                //   You can identify pull requests by the pull_request key.
-                const allItems = await github.rest.issues.listForRepo({
-                  ...context.repo,
-                  state: 'open',
-                  sort: 'created',
-                  direction: 'asc',
-                  per_page: 100,
-                  after: cursor
-                })
-
-                // Regex taken and comment adjusted from:
-                // https://github.com/octokit/plugin-paginate-rest.js/blob/8e5da25f975d2f31dda6b8b588d71f2c768a8df2/src/iterator.ts#L36-L41
-                // `allItems.headers.link` format:
-                //   <https://api.github.com/repositories/4542716/issues?page=3&per_page=100&after=Y3Vyc29yOnYyOpLPAAABl8qNnYDOvnSJxA%3D%3D>; rel="next",
-                //   <https://api.github.com/repositories/4542716/issues?page=1&per_page=100&before=Y3Vyc29yOnYyOpLPAAABl8xFV9DOvoouJg%3D%3D>; rel="prev"
-                // Sets `next` to undefined if "next" URL is not present or `link` header is not set.
-                const next = ((allItems.headers.link ?? '').match(/<([^<>]+)>;\s*rel="next"/) ?? [])[1]
-                if (next) {
-                  cursor = new URL(next).searchParams.get('after')
-                  const uploadPath = path.resolve('cursor')
-                  await writeFile(uploadPath, cursor, 'utf-8')
-                  // No stats.artifacts++, because this does not allow passing a custom token.
-                  // Thus, the upload will not happen with the app token, but the default github.token.
-                  await artifactClient.uploadArtifact(
-                    'pagination-cursor',
-                    [uploadPath],
-                    path.resolve('.'),
-                    {
-                      retentionDays: 1
-                    }
-                  )
-                }
-
-                // Some items might be in both search results, so filtering out duplicates as well.
-                const items = [].concat(updatedItems, allItems.data)
-                  .filter((thisItem, idx, arr) => idx == arr.findIndex(firstItem => firstItem.number == thisItem.number))
-
-                ;(await Promise.allSettled(items.map(handle)))
-                  .filter(({ status }) => status == 'rejected')
-                  .map(({ reason }) => core.setFailed(`${reason.message}\n${reason.cause.stack}`))
-
-                core.notice(`Processed ${stats.prs} PRs, ${stats.issues} Issues, made ${stats.requests + stats.artifacts} API requests and downloaded ${stats.artifacts} artifacts.`)
-              }
-            } finally {
-              clearInterval(reservoirUpdater)
-            }
 
       - name: Log current API rate limits
         env:
diff --git a/ci/labels/.editorconfig b/ci/labels/.editorconfig
new file mode 100644
index 000000000000..08ca1a194873
--- /dev/null
+++ b/ci/labels/.editorconfig
@@ -0,0 +1,4 @@
+# TODO: Move to <top-level>/.editorconfig, once ci/.editorconfig has made its way through staging.
+[*.cjs]
+indent_style = space
+indent_size = 2
diff --git a/ci/labels/.gitignore b/ci/labels/.gitignore
new file mode 100644
index 000000000000..3c3629e647f5
--- /dev/null
+++ b/ci/labels/.gitignore
@@ -0,0 +1 @@
+node_modules
diff --git a/ci/labels/.npmrc b/ci/labels/.npmrc
new file mode 100644
index 000000000000..f91a336f47b6
--- /dev/null
+++ b/ci/labels/.npmrc
@@ -0,0 +1 @@
+package-lock-only = true
diff --git a/ci/labels/README.md b/ci/labels/README.md
new file mode 100644
index 000000000000..4631437a9654
--- /dev/null
+++ b/ci/labels/README.md
@@ -0,0 +1,4 @@
+To test the labeler locally:
+- Provide `gh` on `PATH` and make sure it's authenticated.
+- Enter `nix-shell` in `./ci/labels`.
+- Run `./run.js OWNER REPO`, where OWNER is your username and REPO the name of your fork (normally nixpkgs).
diff --git a/ci/labels/labels.cjs b/ci/labels/labels.cjs
new file mode 100644
index 000000000000..cafd79089c5e
--- /dev/null
+++ b/ci/labels/labels.cjs
@@ -0,0 +1,402 @@
+module.exports = async function({ github, context, core }) {
+  const Bottleneck = require('bottleneck')
+  const path = require('node:path')
+  const { DefaultArtifactClient } = require('@actions/artifact')
+  const { readFile, writeFile } = require('node:fs/promises')
+
+  const artifactClient = new DefaultArtifactClient()
+
+  const stats = {
+    issues: 0,
+    prs: 0,
+    requests: 0,
+    artifacts: 0
+  }
+
+  // Rate-Limiting and Throttling, see for details:
+  //   https://github.com/octokit/octokit.js/issues/1069#throttling
+  //   https://docs.github.com/en/rest/using-the-rest-api/best-practices-for-using-the-rest-api
+  const allLimits = new Bottleneck({
+    // Avoid concurrent requests
+    maxConcurrent: 1,
+    // Will be updated with first `updateReservoir()` call below.
+    reservoir: 0
+  })
+  // Pause between mutative requests
+  const writeLimits = new Bottleneck({ minTime: 1000 }).chain(allLimits)
+  github.hook.wrap('request', async (request, options) => {
+    // Requests to the /rate_limit endpoint do not count against the rate limit.
+    if (options.url == '/rate_limit') return request(options)
+    // Search requests are in a different resource group, which allows 30 requests / minute.
+    // We do less than a handful each run, so not implementing throttling for now.
+    if (options.url.startsWith('/search/')) return request(options)
+    stats.requests++
+    if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(options.method))
+      return writeLimits.schedule(request.bind(null, options))
+    else
+      return allLimits.schedule(request.bind(null, options))
+  })
+
+  async function updateReservoir() {
+    let response
+    try {
+      response = await github.rest.rateLimit.get()
+    } catch (err) {
+      core.error(`Failed updating reservoir:\n${err}`)
+      // Keep retrying on failed rate limit requests instead of exiting the script early.
+      return
+    }
+    // Always keep 1000 spare requests for other jobs to do their regular duty.
+    // They normally use below 100, so 1000 is *plenty* of room to work with.
+    const reservoir = Math.max(0, response.data.resources.core.remaining - 1000)
+    core.info(`Updating reservoir to: ${reservoir}`)
+    allLimits.updateSettings({ reservoir })
+  }
+  await updateReservoir()
+  // Update remaining requests every minute to account for other jobs running in parallel.
+  const reservoirUpdater = setInterval(updateReservoir, 60 * 1000)
+
+  async function handlePullRequest(item) {
+    const log = (k,v) => core.info(`PR #${item.number} - ${k}: ${v}`)
+
+    const pull_number = item.number
+
+    // This API request is important for the merge-conflict label, because it triggers the
+    // creation of a new test merge commit. This is needed to actually determine the state of a PR.
+    const pull_request = (await github.rest.pulls.get({
+      ...context.repo,
+      pull_number
+    })).data
+
+    const reviews = await github.paginate(github.rest.pulls.listReviews, {
+        ...context.repo,
+        pull_number
+      })
+
+    const approvals = new Set(
+      reviews
+      .filter(review => review.state == 'APPROVED')
+      .map(review => review.user?.id)
+    )
+
+    // After creation of a Pull Request, `merge_commit_sha` will be null initially:
+    // The very first merge commit will only be calculated after a little while.
+    // To avoid labeling the PR as conflicted before that, we wait a few minutes.
+    // This is intentionally less than the time that Eval takes, so that the label job
+    // running after Eval can indeed label the PR as conflicted if that is the case.
+    const merge_commit_sha_valid = new Date() - new Date(pull_request.created_at) > 3 * 60 * 1000
+
+    const prLabels = {
+      // We intentionally don't use the mergeable or mergeable_state attributes.
+      // Those have an intermediate state while the test merge commit is created.
+      // This doesn't work well for us, because we might have just triggered another
+      // test merge commit creation by request the pull request via API at the start
+      // of this function.
+      // The attribute merge_commit_sha keeps the old value of null or the hash *until*
+      // the new test merge commit has either successfully been created or failed so.
+      // This essentially means we are updating the merge conflict label in two steps:
+      // On the first pass of the day, we just fetch the pull request, which triggers
+      // the creation. At this stage, the label is likely not updated, yet.
+      // The second pass will then read the result from the first pass and set the label.
+      '2.status: merge conflict': merge_commit_sha_valid && !pull_request.merge_commit_sha,
+      '12.approvals: 1': approvals.size == 1,
+      '12.approvals: 2': approvals.size == 2,
+      '12.approvals: 3+': approvals.size >= 3,
+      '12.first-time contribution':
+        [ 'NONE', 'FIRST_TIMER', 'FIRST_TIME_CONTRIBUTOR' ].includes(pull_request.author_association),
+    }
+
+    const { id: run_id, conclusion } = (await github.rest.actions.listWorkflowRuns({
+      ...context.repo,
+      workflow_id: 'pr.yml',
+      event: 'pull_request_target',
+      exclude_pull_requests: true,
+      head_sha: pull_request.head.sha
+    })).data.workflow_runs[0] ??
+      // TODO: Remove this after 2025-09-17, at which point all eval.yml artifacts will have expired.
+      (await github.rest.actions.listWorkflowRuns({
+        ...context.repo,
+        // In older PRs, we need eval.yml instead of pr.yml.
+        workflow_id: 'eval.yml',
+        event: 'pull_request_target',
+        status: 'success',
+        exclude_pull_requests: true,
+        head_sha: pull_request.head.sha
+      })).data.workflow_runs[0] ?? {}
+
+    // Newer PRs might not have run Eval to completion, yet.
+    // Older PRs might not have an eval.yml workflow, yet.
+    // In either case we continue without fetching an artifact on a best-effort basis.
+    log('Last eval run', run_id ?? '<n/a>')
+
+    if (conclusion === 'success') {
+      Object.assign(prLabels, {
+        // We only set this label if the latest eval run was successful, because if it was not, it
+        // *could* have requested reviewers. We will let the PR author fix CI first, before "escalating"
+        // this PR to "needs: reviewer".
+        // Since the first Eval run on a PR always sets rebuild labels, the same PR will be "recently
+        // updated" for the next scheduled run. Thus, this label will still be set within a few minutes
+        // after a PR is created, if required.
+        // Note that a "requested reviewer" disappears once they have given a review, so we check
+        // existing reviews, too.
+        '9.needs: reviewer':
+          !pull_request.draft &&
+          pull_request.requested_reviewers.length == 0 &&
+          reviews.length == 0,
+      })
+    }
+
+    const artifact = run_id && (await github.rest.actions.listWorkflowRunArtifacts({
+      ...context.repo,
+      run_id,
+      name: 'comparison'
+    })).data.artifacts[0]
+
+    // Instead of checking the boolean artifact.expired, we will give us a minute to
+    // actually download the artifact in the next step and avoid that race condition.
+    // Older PRs, where the workflow run was already eval.yml, but the artifact was not
+    // called "comparison", yet, will skip the download.
+    const expired = !artifact || new Date(artifact?.expires_at ?? 0) < new Date(new Date().getTime() + 60 * 1000)
+    log('Artifact expires at', artifact?.expires_at ?? '<n/a>')
+    if (!expired) {
+      stats.artifacts++
+
+      await artifactClient.downloadArtifact(artifact.id, {
+        findBy: {
+          repositoryName: context.repo.repo,
+          repositoryOwner: context.repo.owner,
+          token: core.getInput('github-token')
+        },
+        path: path.resolve(pull_number.toString()),
+        expectedHash: artifact.digest
+      })
+
+      const maintainers = new Set(Object.keys(
+        JSON.parse(await readFile(`${pull_number}/maintainers.json`, 'utf-8'))
+      ).map(m => Number.parseInt(m, 10)))
+
+      const evalLabels = JSON.parse(await readFile(`${pull_number}/changed-paths.json`, 'utf-8')).labels
+
+      Object.assign(
+        prLabels,
+        // Ignore `evalLabels` if it's an array.
+        // This can happen for older eval runs, before we switched to objects.
+        // The old eval labels would have been set by the eval run,
+        // so now they'll be present in `before`.
+        // TODO: Simplify once old eval results have expired (~2025-10)
+        (Array.isArray(evalLabels) ? undefined : evalLabels),
+        {
+          '12.approved-by: package-maintainer': Array.from(maintainers).some(m => approvals.has(m)),
+        }
+      )
+    }
+
+    return prLabels
+  }
+
+  async function handle(item) {
+    try {
+      const log = (k,v,skip) => {
+        core.info(`#${item.number} - ${k}: ${v}` + (skip ? ' (skipped)' : ''))
+        return skip
+      }
+
+      log('Last updated at', item.updated_at)
+      log('URL', item.html_url)
+
+      const issue_number = item.number
+
+      const itemLabels = {}
+
+      if (item.pull_request) {
+        stats.prs++
+        Object.assign(itemLabels, await handlePullRequest(item))
+      } else {
+        stats.issues++
+      }
+
+      const latest_event_at = new Date(
+        (await github.paginate(
+          github.rest.issues.listEventsForTimeline,
+          {
+            ...context.repo,
+            issue_number,
+            per_page: 100
+          }
+        ))
+        .filter(({ event }) => [
+          // These events are hand-picked from:
+          //   https://docs.github.com/en/rest/using-the-rest-api/issue-event-types?apiVersion=2022-11-28
+          // Each of those causes a PR/issue to *not* be considered as stale anymore.
+          // Most of these use created_at.
+          'assigned',
+          'commented', // uses updated_at, because that could be > created_at
+          'committed', // uses committer.date
+          'head_ref_force_pushed',
+          'milestoned',
+          'pinned',
+          'ready_for_review',
+          'renamed',
+          'reopened',
+          'review_dismissed',
+          'review_requested',
+          'reviewed', // uses submitted_at
+          'unlocked',
+          'unmarked_as_duplicate',
+        ].includes(event))
+        .map(({ created_at, updated_at, committer, submitted_at }) => new Date(updated_at ?? created_at ?? submitted_at ?? committer.date))
+        // Reverse sort by date value. The default sort() sorts by string representation, which is bad for dates.
+        .sort((a,b) => b-a)
+        .at(0) ?? item.created_at
+      )
+      log('latest_event_at', latest_event_at.toISOString())
+
+      const stale_at = new Date(new Date().setDate(new Date().getDate() - 180))
+
+      // Create a map (Label -> Boolean) of all currently set labels.
+      // Each label is set to True and can be disabled later.
+      const before = Object.fromEntries(
+        (await github.paginate(github.rest.issues.listLabelsOnIssue, {
+          ...context.repo,
+          issue_number
+        }))
+        .map(({ name }) => [name, true])
+      )
+
+      Object.assign(itemLabels, {
+        '2.status: stale': !before['1.severity: security'] && latest_event_at < stale_at,
+      })
+
+      const after = Object.assign({}, before, itemLabels)
+
+      // No need for an API request, if all labels are the same.
+      const hasChanges = Object.keys(after).some(name => (before[name] ?? false) != after[name])
+      if (log('Has changes', hasChanges, !hasChanges))
+        return;
+
+      // Skipping labeling on a pull_request event, because we have no privileges.
+      const labels = Object.entries(after).filter(([,value]) => value).map(([name]) => name)
+      if (log('Set labels', labels, context.eventName == 'pull_request'))
+        return;
+
+      await github.rest.issues.setLabels({
+        ...context.repo,
+        issue_number,
+        labels
+      })
+    } catch (cause) {
+      throw new Error(`Labeling #${item.number} failed.`, { cause })
+    }
+  }
+
+  try {
+    if (context.payload.pull_request) {
+      await handle(context.payload.pull_request)
+    } else {
+      const lastRun = (await github.rest.actions.listWorkflowRuns({
+        ...context.repo,
+        workflow_id: 'labels.yml',
+        event: 'schedule',
+        status: 'success',
+        exclude_pull_requests: true,
+        per_page: 1
+      })).data.workflow_runs[0]
+
+      // Go back as far as the last successful run of this workflow to make sure
+      // we are not leaving anyone behind on GHA failures.
+      // Defaults to go back 1 hour on the first run.
+      const cutoff = new Date(lastRun?.created_at ?? new Date().getTime() - 1 * 60 * 60 * 1000)
+      core.info('cutoff timestamp: ' + cutoff.toISOString())
+
+      const updatedItems = await github.paginate(
+        github.rest.search.issuesAndPullRequests,
+        {
+          q: [
+            `repo:"${context.repo.owner}/${context.repo.repo}"`,
+            'is:open',
+            `updated:>=${cutoff.toISOString()}`
+          ].join(' AND '),
+          // TODO: Remove in 2025-10, when it becomes the default.
+          advanced_search: true
+        }
+      )
+
+      let cursor
+
+      // No workflow run available the first time.
+      if (lastRun) {
+        // The cursor to iterate through the full list of issues and pull requests
+        // is passed between jobs as an artifact.
+        const artifact = (await github.rest.actions.listWorkflowRunArtifacts({
+          ...context.repo,
+          run_id: lastRun.id,
+          name: 'pagination-cursor'
+        })).data.artifacts[0]
+
+        // If the artifact is not available, the next iteration starts at the beginning.
+        if (artifact) {
+          stats.artifacts++
+
+          const { downloadPath } = await artifactClient.downloadArtifact(artifact.id, {
+            findBy: {
+              repositoryName: context.repo.repo,
+              repositoryOwner: context.repo.owner,
+              token: core.getInput('github-token')
+            },
+            expectedHash: artifact.digest
+          })
+
+          cursor = await readFile(path.resolve(downloadPath, 'cursor'), 'utf-8')
+        }
+      }
+
+      // From GitHub's API docs:
+      //   GitHub's REST API considers every pull request an issue, but not every issue is a pull request.
+      //   For this reason, "Issues" endpoints may return both issues and pull requests in the response.
+      //   You can identify pull requests by the pull_request key.
+      const allItems = await github.rest.issues.listForRepo({
+        ...context.repo,
+        state: 'open',
+        sort: 'created',
+        direction: 'asc',
+        per_page: 100,
+        after: cursor
+      })
+
+      // Regex taken and comment adjusted from:
+      // https://github.com/octokit/plugin-paginate-rest.js/blob/8e5da25f975d2f31dda6b8b588d71f2c768a8df2/src/iterator.ts#L36-L41
+      // `allItems.headers.link` format:
+      //   <https://api.github.com/repositories/4542716/issues?page=3&per_page=100&after=Y3Vyc29yOnYyOpLPAAABl8qNnYDOvnSJxA%3D%3D>; rel="next",
+      //   <https://api.github.com/repositories/4542716/issues?page=1&per_page=100&before=Y3Vyc29yOnYyOpLPAAABl8xFV9DOvoouJg%3D%3D>; rel="prev"
+      // Sets `next` to undefined if "next" URL is not present or `link` header is not set.
+      const next = ((allItems.headers.link ?? '').match(/<([^<>]+)>;\s*rel="next"/) ?? [])[1]
+      if (next) {
+        cursor = new URL(next).searchParams.get('after')
+        const uploadPath = path.resolve('cursor')
+        await writeFile(uploadPath, cursor, 'utf-8')
+        // No stats.artifacts++, because this does not allow passing a custom token.
+        // Thus, the upload will not happen with the app token, but the default github.token.
+        await artifactClient.uploadArtifact(
+          'pagination-cursor',
+          [uploadPath],
+          path.resolve('.'),
+          {
+            retentionDays: 1
+          }
+        )
+      }
+
+      // Some items might be in both search results, so filtering out duplicates as well.
+      const items = [].concat(updatedItems, allItems.data)
+        .filter((thisItem, idx, arr) => idx == arr.findIndex(firstItem => firstItem.number == thisItem.number))
+
+      ;(await Promise.allSettled(items.map(handle)))
+        .filter(({ status }) => status == 'rejected')
+        .map(({ reason }) => core.setFailed(`${reason.message}\n${reason.cause.stack}`))
+
+      core.notice(`Processed ${stats.prs} PRs, ${stats.issues} Issues, made ${stats.requests + stats.artifacts} API requests and downloaded ${stats.artifacts} artifacts.`)
+    }
+  } finally {
+    clearInterval(reservoirUpdater)
+  }
+}
diff --git a/ci/labels/package-lock.json b/ci/labels/package-lock.json
new file mode 100644
index 000000000000..5c5ee09ad67e
--- /dev/null
+++ b/ci/labels/package-lock.json
@@ -0,0 +1,1897 @@
+{
+  "name": "labels",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "dependencies": {
+        "@actions/artifact": "2.3.2",
+        "@actions/github": "6.0.1",
+        "bottleneck": "2.19.5"
+      }
+    },
+    "node_modules/@actions/artifact": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/@actions/artifact/-/artifact-2.3.2.tgz",
+      "integrity": "sha512-uX2Mr5KEPcwnzqa0Og9wOTEKIae6C/yx9P/m8bIglzCS5nZDkcQC/zRWjjoEsyVecL6oQpBx5BuqQj/yuVm0gw==",
+      "license": "MIT",
+      "dependencies": {
+        "@actions/core": "^1.10.0",
+        "@actions/github": "^5.1.1",
+        "@actions/http-client": "^2.1.0",
+        "@azure/storage-blob": "^12.15.0",
+        "@octokit/core": "^3.5.1",
+        "@octokit/plugin-request-log": "^1.0.4",
+        "@octokit/plugin-retry": "^3.0.9",
+        "@octokit/request-error": "^5.0.0",
+        "@protobuf-ts/plugin": "^2.2.3-alpha.1",
+        "archiver": "^7.0.1",
+        "jwt-decode": "^3.1.2",
+        "unzip-stream": "^0.3.1"
+      }
+    },
+    "node_modules/@actions/artifact/node_modules/@actions/github": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/@actions/github/-/github-5.1.1.tgz",
+      "integrity": "sha512-Nk59rMDoJaV+mHCOJPXuvB1zIbomlKS0dmSIqPGxd0enAXBnOfn4VWF+CGtRCwXZG9Epa54tZA7VIRlJDS8A6g==",
+      "license": "MIT",
+      "dependencies": {
+        "@actions/http-client": "^2.0.1",
+        "@octokit/core": "^3.6.0",
+        "@octokit/plugin-paginate-rest": "^2.17.0",
+        "@octokit/plugin-rest-endpoint-methods": "^5.13.0"
+      }
+    },
+    "node_modules/@actions/core": {
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.11.1.tgz",
+      "integrity": "sha512-hXJCSrkwfA46Vd9Z3q4cpEpHB1rL5NG04+/rbqW9d3+CSvtB1tYe8UTpAlixa1vj0m/ULglfEK2UKxMGxCxv5A==",
+      "license": "MIT",
+      "dependencies": {
+        "@actions/exec": "^1.1.1",
+        "@actions/http-client": "^2.0.1"
+      }
+    },
+    "node_modules/@actions/exec": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-1.1.1.tgz",
+      "integrity": "sha512-+sCcHHbVdk93a0XT19ECtO/gIXoxvdsgQLzb2fE2/5sIZmWQuluYyjPQtrtTHdU1YzTZ7bAPN4sITq2xi1679w==",
+      "license": "MIT",
+      "dependencies": {
+        "@actions/io": "^1.0.1"
+      }
+    },
+    "node_modules/@actions/github": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/@actions/github/-/github-6.0.1.tgz",
+      "integrity": "sha512-xbZVcaqD4XnQAe35qSQqskb3SqIAfRyLBrHMd/8TuL7hJSz2QtbDwnNM8zWx4zO5l2fnGtseNE3MbEvD7BxVMw==",
+      "license": "MIT",
+      "dependencies": {
+        "@actions/http-client": "^2.2.0",
+        "@octokit/core": "^5.0.1",
+        "@octokit/plugin-paginate-rest": "^9.2.2",
+        "@octokit/plugin-rest-endpoint-methods": "^10.4.0",
+        "@octokit/request": "^8.4.1",
+        "@octokit/request-error": "^5.1.1",
+        "undici": "^5.28.5"
+      }
+    },
+    "node_modules/@actions/github/node_modules/@octokit/auth-token": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-4.0.0.tgz",
+      "integrity": "sha512-tY/msAuJo6ARbK6SPIxZrPBms3xPbfwBrulZe0Wtr/DIY9lje2HeV1uoebShn6mx7SjCHif6EjMvoREj+gZ+SA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/@actions/github/node_modules/@octokit/core": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-5.2.1.tgz",
+      "integrity": "sha512-dKYCMuPO1bmrpuogcjQ8z7ICCH3FP6WmxpwC03yjzGfZhj9fTJg6+bS1+UAplekbN2C+M61UNllGOOoAfGCrdQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/auth-token": "^4.0.0",
+        "@octokit/graphql": "^7.1.0",
+        "@octokit/request": "^8.4.1",
+        "@octokit/request-error": "^5.1.1",
+        "@octokit/types": "^13.0.0",
+        "before-after-hook": "^2.2.0",
+        "universal-user-agent": "^6.0.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/@actions/github/node_modules/@octokit/endpoint": {
+      "version": "9.0.6",
+      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-9.0.6.tgz",
+      "integrity": "sha512-H1fNTMA57HbkFESSt3Y9+FBICv+0jFceJFPWDePYlR/iMGrwM5ph+Dd4XRQs+8X+PUFURLQgX9ChPfhJ/1uNQw==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^13.1.0",
+        "universal-user-agent": "^6.0.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/@actions/github/node_modules/@octokit/graphql": {
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-7.1.1.tgz",
+      "integrity": "sha512-3mkDltSfcDUoa176nlGoA32RGjeWjl3K7F/BwHwRMJUW/IteSa4bnSV8p2ThNkcIcZU2umkZWxwETSSCJf2Q7g==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/request": "^8.4.1",
+        "@octokit/types": "^13.0.0",
+        "universal-user-agent": "^6.0.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/@actions/github/node_modules/@octokit/openapi-types": {
+      "version": "24.2.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
+      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
+      "license": "MIT"
+    },
+    "node_modules/@actions/github/node_modules/@octokit/plugin-paginate-rest": {
+      "version": "9.2.2",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-9.2.2.tgz",
+      "integrity": "sha512-u3KYkGF7GcZnSD/3UP0S7K5XUFT2FkOQdcfXZGZQPGv3lm4F2Xbf71lvjldr8c1H3nNbF+33cLEkWYbokGWqiQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^12.6.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "peerDependencies": {
+        "@octokit/core": "5"
+      }
+    },
+    "node_modules/@actions/github/node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/openapi-types": {
+      "version": "20.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-20.0.0.tgz",
+      "integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA==",
+      "license": "MIT"
+    },
+    "node_modules/@actions/github/node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/types": {
+      "version": "12.6.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.6.0.tgz",
+      "integrity": "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^20.0.0"
+      }
+    },
+    "node_modules/@actions/github/node_modules/@octokit/plugin-rest-endpoint-methods": {
+      "version": "10.4.1",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-10.4.1.tgz",
+      "integrity": "sha512-xV1b+ceKV9KytQe3zCVqjg+8GTGfDYwaT1ATU5isiUyVtlVAO3HNdzpS4sr4GBx4hxQ46s7ITtZrAsxG22+rVg==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^12.6.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "peerDependencies": {
+        "@octokit/core": "5"
+      }
+    },
+    "node_modules/@actions/github/node_modules/@octokit/plugin-rest-endpoint-methods/node_modules/@octokit/openapi-types": {
+      "version": "20.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-20.0.0.tgz",
+      "integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA==",
+      "license": "MIT"
+    },
+    "node_modules/@actions/github/node_modules/@octokit/plugin-rest-endpoint-methods/node_modules/@octokit/types": {
+      "version": "12.6.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.6.0.tgz",
+      "integrity": "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^20.0.0"
+      }
+    },
+    "node_modules/@actions/github/node_modules/@octokit/request": {
+      "version": "8.4.1",
+      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-8.4.1.tgz",
+      "integrity": "sha512-qnB2+SY3hkCmBxZsR/MPCybNmbJe4KAlfWErXq+rBKkQJlbjdJeS85VI9r8UqeLYLvnAenU8Q1okM/0MBsAGXw==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/endpoint": "^9.0.6",
+        "@octokit/request-error": "^5.1.1",
+        "@octokit/types": "^13.1.0",
+        "universal-user-agent": "^6.0.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/@actions/github/node_modules/@octokit/types": {
+      "version": "13.10.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
+      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^24.2.0"
+      }
+    },
+    "node_modules/@actions/http-client": {
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-2.2.3.tgz",
+      "integrity": "sha512-mx8hyJi/hjFvbPokCg4uRd4ZX78t+YyRPtnKWwIl+RzNaVuFpQHfmlGVfsKEJN8LwTCvL+DfVgAM04XaHkm6bA==",
+      "license": "MIT",
+      "dependencies": {
+        "tunnel": "^0.0.6",
+        "undici": "^5.25.4"
+      }
+    },
+    "node_modules/@actions/io": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@actions/io/-/io-1.1.3.tgz",
+      "integrity": "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q==",
+      "license": "MIT"
+    },
+    "node_modules/@azure/abort-controller": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
+      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@azure/core-auth": {
+      "version": "1.9.0",
+      "resolved": "https://registry.npmjs.org/@azure/core-auth/-/core-auth-1.9.0.tgz",
+      "integrity": "sha512-FPwHpZywuyasDSLMqJ6fhbOK3TqUdviZNF8OqRGA4W5Ewib2lEEZ+pBsYcBa88B2NGO/SEnYPGhyBqNlE8ilSw==",
+      "license": "MIT",
+      "dependencies": {
+        "@azure/abort-controller": "^2.0.0",
+        "@azure/core-util": "^1.11.0",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@azure/core-client": {
+      "version": "1.9.4",
+      "resolved": "https://registry.npmjs.org/@azure/core-client/-/core-client-1.9.4.tgz",
+      "integrity": "sha512-f7IxTD15Qdux30s2qFARH+JxgwxWLG2Rlr4oSkPGuLWm+1p5y1+C04XGLA0vmX6EtqfutmjvpNmAfgwVIS5hpw==",
+      "license": "MIT",
+      "dependencies": {
+        "@azure/abort-controller": "^2.0.0",
+        "@azure/core-auth": "^1.4.0",
+        "@azure/core-rest-pipeline": "^1.20.0",
+        "@azure/core-tracing": "^1.0.0",
+        "@azure/core-util": "^1.6.1",
+        "@azure/logger": "^1.0.0",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@azure/core-http-compat": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/@azure/core-http-compat/-/core-http-compat-2.3.0.tgz",
+      "integrity": "sha512-qLQujmUypBBG0gxHd0j6/Jdmul6ttl24c8WGiLXIk7IHXdBlfoBqW27hyz3Xn6xbfdyVSarl1Ttbk0AwnZBYCw==",
+      "license": "MIT",
+      "dependencies": {
+        "@azure/abort-controller": "^2.0.0",
+        "@azure/core-client": "^1.3.0",
+        "@azure/core-rest-pipeline": "^1.20.0"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@azure/core-lro": {
+      "version": "2.7.2",
+      "resolved": "https://registry.npmjs.org/@azure/core-lro/-/core-lro-2.7.2.tgz",
+      "integrity": "sha512-0YIpccoX8m/k00O7mDDMdJpbr6mf1yWo2dfmxt5A8XVZVVMz2SSKaEbMCeJRvgQ0IaSlqhjT47p4hVIRRy90xw==",
+      "license": "MIT",
+      "dependencies": {
+        "@azure/abort-controller": "^2.0.0",
+        "@azure/core-util": "^1.2.0",
+        "@azure/logger": "^1.0.0",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@azure/core-paging": {
+      "version": "1.6.2",
+      "resolved": "https://registry.npmjs.org/@azure/core-paging/-/core-paging-1.6.2.tgz",
+      "integrity": "sha512-YKWi9YuCU04B55h25cnOYZHxXYtEvQEbKST5vqRga7hWY9ydd3FZHdeQF8pyh+acWZvppw13M/LMGx0LABUVMA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@azure/core-rest-pipeline": {
+      "version": "1.21.0",
+      "resolved": "https://registry.npmjs.org/@azure/core-rest-pipeline/-/core-rest-pipeline-1.21.0.tgz",
+      "integrity": "sha512-a4MBwe/5WKbq9MIxikzgxLBbruC5qlkFYlBdI7Ev50Y7ib5Vo/Jvt5jnJo7NaWeJ908LCHL0S1Us4UMf1VoTfg==",
+      "license": "MIT",
+      "dependencies": {
+        "@azure/abort-controller": "^2.0.0",
+        "@azure/core-auth": "^1.8.0",
+        "@azure/core-tracing": "^1.0.1",
+        "@azure/core-util": "^1.11.0",
+        "@azure/logger": "^1.0.0",
+        "@typespec/ts-http-runtime": "^0.2.3",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@azure/core-tracing": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/@azure/core-tracing/-/core-tracing-1.2.0.tgz",
+      "integrity": "sha512-UKTiEJPkWcESPYJz3X5uKRYyOcJD+4nYph+KpfdPRnQJVrZfk0KJgdnaAWKfhsBBtAf/D58Az4AvCJEmWgIBAg==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@azure/core-util": {
+      "version": "1.12.0",
+      "resolved": "https://registry.npmjs.org/@azure/core-util/-/core-util-1.12.0.tgz",
+      "integrity": "sha512-13IyjTQgABPARvG90+N2dXpC+hwp466XCdQXPCRlbWHgd3SJd5Q1VvaBGv6k1BIa4MQm6hAF1UBU1m8QUxV8sQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@azure/abort-controller": "^2.0.0",
+        "@typespec/ts-http-runtime": "^0.2.2",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@azure/core-xml": {
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/@azure/core-xml/-/core-xml-1.4.5.tgz",
+      "integrity": "sha512-gT4H8mTaSXRz7eGTuQyq1aIJnJqeXzpOe9Ay7Z3FrCouer14CbV3VzjnJrNrQfbBpGBLO9oy8BmrY75A0p53cA==",
+      "license": "MIT",
+      "dependencies": {
+        "fast-xml-parser": "^5.0.7",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@azure/logger": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/@azure/logger/-/logger-1.2.0.tgz",
+      "integrity": "sha512-0hKEzLhpw+ZTAfNJyRrn6s+V0nDWzXk9OjBr2TiGIu0OfMr5s2V4FpKLTAK3Ca5r5OKLbf4hkOGDPyiRjie/jA==",
+      "license": "MIT",
+      "dependencies": {
+        "@typespec/ts-http-runtime": "^0.2.2",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@azure/storage-blob": {
+      "version": "12.27.0",
+      "resolved": "https://registry.npmjs.org/@azure/storage-blob/-/storage-blob-12.27.0.tgz",
+      "integrity": "sha512-IQjj9RIzAKatmNca3D6bT0qJ+Pkox1WZGOg2esJF2YLHb45pQKOwGPIAV+w3rfgkj7zV3RMxpn/c6iftzSOZJQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@azure/abort-controller": "^2.1.2",
+        "@azure/core-auth": "^1.4.0",
+        "@azure/core-client": "^1.6.2",
+        "@azure/core-http-compat": "^2.0.0",
+        "@azure/core-lro": "^2.2.0",
+        "@azure/core-paging": "^1.1.1",
+        "@azure/core-rest-pipeline": "^1.10.1",
+        "@azure/core-tracing": "^1.1.2",
+        "@azure/core-util": "^1.6.1",
+        "@azure/core-xml": "^1.4.3",
+        "@azure/logger": "^1.0.0",
+        "events": "^3.0.0",
+        "tslib": "^2.2.0"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@bufbuild/protobuf": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@bufbuild/protobuf/-/protobuf-2.6.0.tgz",
+      "integrity": "sha512-6cuonJVNOIL7lTj5zgo/Rc2bKAo4/GvN+rKCrUj7GdEHRzCk8zKOfFwUsL9nAVk5rSIsRmlgcpLzTRysopEeeg==",
+      "license": "(Apache-2.0 AND BSD-3-Clause)"
+    },
+    "node_modules/@bufbuild/protoplugin": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@bufbuild/protoplugin/-/protoplugin-2.6.0.tgz",
+      "integrity": "sha512-mfAwI+4GqUtbw/ddfyolEHaAL86ozRIVlOg2A+SVRbjx1CjsMc1YJO+hBSkt/pqfpR+PmWBbZLstHbXP8KGtMQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@bufbuild/protobuf": "2.6.0",
+        "@typescript/vfs": "^1.5.2",
+        "typescript": "5.4.5"
+      }
+    },
+    "node_modules/@bufbuild/protoplugin/node_modules/typescript": {
+      "version": "5.4.5",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.4.5.tgz",
+      "integrity": "sha512-vcI4UpRgg81oIRUFwR0WSIHKt11nJ7SAVlYNIu+QpqeyXP+gpQJy/Z4+F0aGxSE4MqwjyXvW/TzgkLAx2AGHwQ==",
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
+    "node_modules/@fastify/busboy": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-2.1.1.tgz",
+      "integrity": "sha512-vBZP4NlzfOlerQTnba4aqZoMhE/a9HY7HRqoOPaETQcSQuWEIyZMHGfVu6w9wGtGK5fED5qRs2DteVCjOH60sA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@isaacs/cliui": {
+      "version": "8.0.2",
+      "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
+      "integrity": "sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==",
+      "license": "ISC",
+      "dependencies": {
+        "string-width": "^5.1.2",
+        "string-width-cjs": "npm:string-width@^4.2.0",
+        "strip-ansi": "^7.0.1",
+        "strip-ansi-cjs": "npm:strip-ansi@^6.0.1",
+        "wrap-ansi": "^8.1.0",
+        "wrap-ansi-cjs": "npm:wrap-ansi@^7.0.0"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@octokit/auth-token": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-2.5.0.tgz",
+      "integrity": "sha512-r5FVUJCOLl19AxiuZD2VRZ/ORjp/4IN98Of6YJoJOkY75CIBuYfmiNHGrDwXr+aLGG55igl9QrxX3hbiXlLb+g==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^6.0.3"
+      }
+    },
+    "node_modules/@octokit/core": {
+      "version": "3.6.0",
+      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-3.6.0.tgz",
+      "integrity": "sha512-7RKRKuA4xTjMhY+eG3jthb3hlZCsOwg3rztWh75Xc+ShDWOfDDATWbeZpAHBNRpm4Tv9WgBMOy1zEJYXG6NJ7Q==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/auth-token": "^2.4.4",
+        "@octokit/graphql": "^4.5.8",
+        "@octokit/request": "^5.6.3",
+        "@octokit/request-error": "^2.0.5",
+        "@octokit/types": "^6.0.3",
+        "before-after-hook": "^2.2.0",
+        "universal-user-agent": "^6.0.0"
+      }
+    },
+    "node_modules/@octokit/core/node_modules/@octokit/request-error": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-2.1.0.tgz",
+      "integrity": "sha512-1VIvgXxs9WHSjicsRwq8PlR2LR2x6DwsJAaFgzdi0JfJoGSO8mYI/cHJQ+9FbN21aa+DrgNLnwObmyeSC8Rmpg==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^6.0.3",
+        "deprecation": "^2.0.0",
+        "once": "^1.4.0"
+      }
+    },
+    "node_modules/@octokit/endpoint": {
+      "version": "6.0.12",
+      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-6.0.12.tgz",
+      "integrity": "sha512-lF3puPwkQWGfkMClXb4k/eUT/nZKQfxinRWJrdZaJO85Dqwo/G0yOC434Jr2ojwafWJMYqFGFa5ms4jJUgujdA==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^6.0.3",
+        "is-plain-object": "^5.0.0",
+        "universal-user-agent": "^6.0.0"
+      }
+    },
+    "node_modules/@octokit/graphql": {
+      "version": "4.8.0",
+      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-4.8.0.tgz",
+      "integrity": "sha512-0gv+qLSBLKF0z8TKaSKTsS39scVKF9dbMxJpj3U0vC7wjNWFuIpL/z76Qe2fiuCbDRcJSavkXsVtMS6/dtQQsg==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/request": "^5.6.0",
+        "@octokit/types": "^6.0.3",
+        "universal-user-agent": "^6.0.0"
+      }
+    },
+    "node_modules/@octokit/openapi-types": {
+      "version": "12.11.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-12.11.0.tgz",
+      "integrity": "sha512-VsXyi8peyRq9PqIz/tpqiL2w3w80OgVMwBHltTml3LmVvXiphgeqmY9mvBw9Wu7e0QWk/fqD37ux8yP5uVekyQ==",
+      "license": "MIT"
+    },
+    "node_modules/@octokit/plugin-paginate-rest": {
+      "version": "2.21.3",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-2.21.3.tgz",
+      "integrity": "sha512-aCZTEf0y2h3OLbrgKkrfFdjRL6eSOo8komneVQJnYecAxIej7Bafor2xhuDJOIFau4pk0i/P28/XgtbyPF0ZHw==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^6.40.0"
+      },
+      "peerDependencies": {
+        "@octokit/core": ">=2"
+      }
+    },
+    "node_modules/@octokit/plugin-request-log": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-request-log/-/plugin-request-log-1.0.4.tgz",
+      "integrity": "sha512-mLUsMkgP7K/cnFEw07kWqXGF5LKrOkD+lhCrKvPHXWDywAwuDUeDwWBpc69XK3pNX0uKiVt8g5z96PJ6z9xCFA==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@octokit/core": ">=3"
+      }
+    },
+    "node_modules/@octokit/plugin-rest-endpoint-methods": {
+      "version": "5.16.2",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-5.16.2.tgz",
+      "integrity": "sha512-8QFz29Fg5jDuTPXVtey05BLm7OB+M8fnvE64RNegzX7U+5NUXcOcnpTIK0YfSHBg8gYd0oxIq3IZTe9SfPZiRw==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^6.39.0",
+        "deprecation": "^2.3.1"
+      },
+      "peerDependencies": {
+        "@octokit/core": ">=3"
+      }
+    },
+    "node_modules/@octokit/plugin-retry": {
+      "version": "3.0.9",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-3.0.9.tgz",
+      "integrity": "sha512-r+fArdP5+TG6l1Rv/C9hVoty6tldw6cE2pRHNGmFPdyfrc696R6JjrQ3d7HdVqGwuzfyrcaLAKD7K8TX8aehUQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^6.0.3",
+        "bottleneck": "^2.15.3"
+      }
+    },
+    "node_modules/@octokit/request": {
+      "version": "5.6.3",
+      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-5.6.3.tgz",
+      "integrity": "sha512-bFJl0I1KVc9jYTe9tdGGpAMPy32dLBXXo1dS/YwSCTL/2nd9XeHsY616RE3HPXDVk+a+dBuzyz5YdlXwcDTr2A==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/endpoint": "^6.0.1",
+        "@octokit/request-error": "^2.1.0",
+        "@octokit/types": "^6.16.1",
+        "is-plain-object": "^5.0.0",
+        "node-fetch": "^2.6.7",
+        "universal-user-agent": "^6.0.0"
+      }
+    },
+    "node_modules/@octokit/request-error": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.1.1.tgz",
+      "integrity": "sha512-v9iyEQJH6ZntoENr9/yXxjuezh4My67CBSu9r6Ve/05Iu5gNgnisNWOsoJHTP6k0Rr0+HQIpnH+kyammu90q/g==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^13.1.0",
+        "deprecation": "^2.0.0",
+        "once": "^1.4.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/@octokit/request-error/node_modules/@octokit/openapi-types": {
+      "version": "24.2.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
+      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
+      "license": "MIT"
+    },
+    "node_modules/@octokit/request-error/node_modules/@octokit/types": {
+      "version": "13.10.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
+      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^24.2.0"
+      }
+    },
+    "node_modules/@octokit/request/node_modules/@octokit/request-error": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-2.1.0.tgz",
+      "integrity": "sha512-1VIvgXxs9WHSjicsRwq8PlR2LR2x6DwsJAaFgzdi0JfJoGSO8mYI/cHJQ+9FbN21aa+DrgNLnwObmyeSC8Rmpg==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^6.0.3",
+        "deprecation": "^2.0.0",
+        "once": "^1.4.0"
+      }
+    },
+    "node_modules/@octokit/types": {
+      "version": "6.41.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-6.41.0.tgz",
+      "integrity": "sha512-eJ2jbzjdijiL3B4PrSQaSjuF2sPEQPVCPzBvTHJD9Nz+9dw2SGH4K4xeQJ77YfTq5bRQ+bD8wT11JbeDPmxmGg==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^12.11.0"
+      }
+    },
+    "node_modules/@pkgjs/parseargs": {
+      "version": "0.11.0",
+      "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz",
+      "integrity": "sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==",
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@protobuf-ts/plugin": {
+      "version": "2.11.1",
+      "resolved": "https://registry.npmjs.org/@protobuf-ts/plugin/-/plugin-2.11.1.tgz",
+      "integrity": "sha512-HyuprDcw0bEEJqkOWe1rnXUP0gwYLij8YhPuZyZk6cJbIgc/Q0IFgoHQxOXNIXAcXM4Sbehh6kjVnCzasElw1A==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@bufbuild/protobuf": "^2.4.0",
+        "@bufbuild/protoplugin": "^2.4.0",
+        "@protobuf-ts/protoc": "^2.11.1",
+        "@protobuf-ts/runtime": "^2.11.1",
+        "@protobuf-ts/runtime-rpc": "^2.11.1",
+        "typescript": "^3.9"
+      },
+      "bin": {
+        "protoc-gen-dump": "bin/protoc-gen-dump",
+        "protoc-gen-ts": "bin/protoc-gen-ts"
+      }
+    },
+    "node_modules/@protobuf-ts/protoc": {
+      "version": "2.11.1",
+      "resolved": "https://registry.npmjs.org/@protobuf-ts/protoc/-/protoc-2.11.1.tgz",
+      "integrity": "sha512-mUZJaV0daGO6HUX90o/atzQ6A7bbN2RSuHtdwo8SSF2Qoe3zHwa4IHyCN1evftTeHfLmdz+45qo47sL+5P8nyg==",
+      "license": "Apache-2.0",
+      "bin": {
+        "protoc": "protoc.js"
+      }
+    },
+    "node_modules/@protobuf-ts/runtime": {
+      "version": "2.11.1",
+      "resolved": "https://registry.npmjs.org/@protobuf-ts/runtime/-/runtime-2.11.1.tgz",
+      "integrity": "sha512-KuDaT1IfHkugM2pyz+FwiY80ejWrkH1pAtOBOZFuR6SXEFTsnb/jiQWQ1rCIrcKx2BtyxnxW6BWwsVSA/Ie+WQ==",
+      "license": "(Apache-2.0 AND BSD-3-Clause)"
+    },
+    "node_modules/@protobuf-ts/runtime-rpc": {
+      "version": "2.11.1",
+      "resolved": "https://registry.npmjs.org/@protobuf-ts/runtime-rpc/-/runtime-rpc-2.11.1.tgz",
+      "integrity": "sha512-4CqqUmNA+/uMz00+d3CYKgElXO9VrEbucjnBFEjqI4GuDrEQ32MaI3q+9qPBvIGOlL4PmHXrzM32vBPWRhQKWQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@protobuf-ts/runtime": "^2.11.1"
+      }
+    },
+    "node_modules/@typescript/vfs": {
+      "version": "1.6.1",
+      "resolved": "https://registry.npmjs.org/@typescript/vfs/-/vfs-1.6.1.tgz",
+      "integrity": "sha512-JwoxboBh7Oz1v38tPbkrZ62ZXNHAk9bJ7c9x0eI5zBfBnBYGhURdbnh7Z4smN/MV48Y5OCcZb58n972UtbazsA==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.1.1"
+      },
+      "peerDependencies": {
+        "typescript": "*"
+      }
+    },
+    "node_modules/@typespec/ts-http-runtime": {
+      "version": "0.2.3",
+      "resolved": "https://registry.npmjs.org/@typespec/ts-http-runtime/-/ts-http-runtime-0.2.3.tgz",
+      "integrity": "sha512-oRhjSzcVjX8ExyaF8hC0zzTqxlVuRlgMHL/Bh4w3xB9+wjbm0FpXylVU/lBrn+kgphwYTrOk3tp+AVShGmlYCg==",
+      "license": "MIT",
+      "dependencies": {
+        "http-proxy-agent": "^7.0.0",
+        "https-proxy-agent": "^7.0.0",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/abort-controller": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/abort-controller/-/abort-controller-3.0.0.tgz",
+      "integrity": "sha512-h8lQ8tacZYnR3vNQTgibj+tODHI5/+l06Au2Pcriv/Gmet0eaj4TwWH41sO9wnHDiQsEj19q0drzdWdeAHtweg==",
+      "license": "MIT",
+      "dependencies": {
+        "event-target-shim": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=6.5"
+      }
+    },
+    "node_modules/agent-base": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.3.tgz",
+      "integrity": "sha512-jRR5wdylq8CkOe6hei19GGZnxM6rBGwFl3Bg0YItGDimvjGtAvdZk4Pu6Cl4u4Igsws4a1fd1Vq3ezrhn4KmFw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/ansi-regex": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.1.0.tgz",
+      "integrity": "sha512-7HSX4QQb4CspciLpVFwyRe79O3xsIZDDLER21kERQ71oaPodF8jL725AgJMFAYbooIqolJoRLuM81SpeUkpkvA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-regex?sponsor=1"
+      }
+    },
+    "node_modules/ansi-styles": {
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.1.tgz",
+      "integrity": "sha512-bN798gFfQX+viw3R7yrGWRqnrN2oRkEkUjjl4JNn4E8GxxbjtG3FbrEIIY3l8/hrwUwIeCZvi4QuOTP4MErVug==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/archiver": {
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/archiver/-/archiver-7.0.1.tgz",
+      "integrity": "sha512-ZcbTaIqJOfCc03QwD468Unz/5Ir8ATtvAHsK+FdXbDIbGfihqh9mrvdcYunQzqn4HrvWWaFyaxJhGZagaJJpPQ==",
+      "license": "MIT",
+      "dependencies": {
+        "archiver-utils": "^5.0.2",
+        "async": "^3.2.4",
+        "buffer-crc32": "^1.0.0",
+        "readable-stream": "^4.0.0",
+        "readdir-glob": "^1.1.2",
+        "tar-stream": "^3.0.0",
+        "zip-stream": "^6.0.1"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/archiver-utils": {
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/archiver-utils/-/archiver-utils-5.0.2.tgz",
+      "integrity": "sha512-wuLJMmIBQYCsGZgYLTy5FIB2pF6Lfb6cXMSF8Qywwk3t20zWnAi7zLcQFdKQmIB8wyZpY5ER38x08GbwtR2cLA==",
+      "license": "MIT",
+      "dependencies": {
+        "glob": "^10.0.0",
+        "graceful-fs": "^4.2.0",
+        "is-stream": "^2.0.1",
+        "lazystream": "^1.0.0",
+        "lodash": "^4.17.15",
+        "normalize-path": "^3.0.0",
+        "readable-stream": "^4.0.0"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/async": {
+      "version": "3.2.6",
+      "resolved": "https://registry.npmjs.org/async/-/async-3.2.6.tgz",
+      "integrity": "sha512-htCUDlxyyCLMgaM3xXg0C0LW2xqfuQ6p05pCEIsXuyQ+a1koYKTuBMzRNwmybfLgvJDMd0r1LTn4+E0Ti6C2AA==",
+      "license": "MIT"
+    },
+    "node_modules/b4a": {
+      "version": "1.6.7",
+      "resolved": "https://registry.npmjs.org/b4a/-/b4a-1.6.7.tgz",
+      "integrity": "sha512-OnAYlL5b7LEkALw87fUVafQw5rVR9RjwGd4KUwNQ6DrrNmaVaUCgLipfVlzrPQ4tWOR9P0IXGNOx50jYCCdSJg==",
+      "license": "Apache-2.0"
+    },
+    "node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "license": "MIT"
+    },
+    "node_modules/bare-events": {
+      "version": "2.5.4",
+      "resolved": "https://registry.npmjs.org/bare-events/-/bare-events-2.5.4.tgz",
+      "integrity": "sha512-+gFfDkR8pj4/TrWCGUGWmJIkBwuxPS5F+a5yWjOHQt2hHvNZd5YLzadjmDUtFmMM4y429bnKLa8bYBMHcYdnQA==",
+      "license": "Apache-2.0",
+      "optional": true
+    },
+    "node_modules/base64-js": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
+      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/before-after-hook": {
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-2.2.3.tgz",
+      "integrity": "sha512-NzUnlZexiaH/46WDhANlyR2bXRopNg4F/zuSA3OpZnllCUgRaOF2znDioDWrmbNVsuZk6l9pMquQB38cfBZwkQ==",
+      "license": "Apache-2.0"
+    },
+    "node_modules/binary": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/binary/-/binary-0.3.0.tgz",
+      "integrity": "sha512-D4H1y5KYwpJgK8wk1Cue5LLPgmwHKYSChkbspQg5JtVuR5ulGckxfR62H3AE9UDkdMC8yyXlqYihuz3Aqg2XZg==",
+      "license": "MIT",
+      "dependencies": {
+        "buffers": "~0.1.1",
+        "chainsaw": "~0.1.0"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/bottleneck": {
+      "version": "2.19.5",
+      "resolved": "https://registry.npmjs.org/bottleneck/-/bottleneck-2.19.5.tgz",
+      "integrity": "sha512-VHiNCbI1lKdl44tGrhNfU3lup0Tj/ZBMJB5/2ZbNXRCPuRCO7ed2mgcK4r17y+KB2EfuYuRaVlwNbAeaWGSpbw==",
+      "license": "MIT"
+    },
+    "node_modules/brace-expansion": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
+      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0"
+      }
+    },
+    "node_modules/buffer": {
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/buffer/-/buffer-6.0.3.tgz",
+      "integrity": "sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "base64-js": "^1.3.1",
+        "ieee754": "^1.2.1"
+      }
+    },
+    "node_modules/buffer-crc32": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-1.0.0.tgz",
+      "integrity": "sha512-Db1SbgBS/fg/392AblrMJk97KggmvYhr4pB5ZIMTWtaivCPMWLkmb7m21cJvpvgK+J3nsU2CmmixNBZx4vFj/w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
+    "node_modules/buffers": {
+      "version": "0.1.1",
+      "resolved": "https://registry.npmjs.org/buffers/-/buffers-0.1.1.tgz",
+      "integrity": "sha512-9q/rDEGSb/Qsvv2qvzIzdluL5k7AaJOTrw23z9reQthrbF7is4CtlT0DXyO1oei2DCp4uojjzQ7igaSHp1kAEQ==",
+      "engines": {
+        "node": ">=0.2.0"
+      }
+    },
+    "node_modules/chainsaw": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/chainsaw/-/chainsaw-0.1.0.tgz",
+      "integrity": "sha512-75kWfWt6MEKNC8xYXIdRpDehRYY/tNSgwKaJq+dbbDcxORuVrrQ+SEHoWsniVn9XPYfP4gmdWIeDk/4YNp1rNQ==",
+      "license": "MIT/X11",
+      "dependencies": {
+        "traverse": ">=0.3.0 <0.4"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "license": "MIT",
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "license": "MIT"
+    },
+    "node_modules/compress-commons": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/compress-commons/-/compress-commons-6.0.2.tgz",
+      "integrity": "sha512-6FqVXeETqWPoGcfzrXb37E50NP0LXT8kAMu5ooZayhWWdgEY4lBEEcbQNXtkuKQsGduxiIcI4gOTsxTmuq/bSg==",
+      "license": "MIT",
+      "dependencies": {
+        "crc-32": "^1.2.0",
+        "crc32-stream": "^6.0.0",
+        "is-stream": "^2.0.1",
+        "normalize-path": "^3.0.0",
+        "readable-stream": "^4.0.0"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/core-util-is": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.3.tgz",
+      "integrity": "sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==",
+      "license": "MIT"
+    },
+    "node_modules/crc-32": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/crc-32/-/crc-32-1.2.2.tgz",
+      "integrity": "sha512-ROmzCKrTnOwybPcJApAA6WBWij23HVfGVNKqqrZpuyZOHqK2CwHSvpGuyt/UNNvaIjEd8X5IFGp4Mh+Ie1IHJQ==",
+      "license": "Apache-2.0",
+      "bin": {
+        "crc32": "bin/crc32.njs"
+      },
+      "engines": {
+        "node": ">=0.8"
+      }
+    },
+    "node_modules/crc32-stream": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/crc32-stream/-/crc32-stream-6.0.0.tgz",
+      "integrity": "sha512-piICUB6ei4IlTv1+653yq5+KoqfBYmj9bw6LqXoOneTMDXk5nM1qt12mFW1caG3LlJXEKW1Bp0WggEmIfQB34g==",
+      "license": "MIT",
+      "dependencies": {
+        "crc-32": "^1.2.0",
+        "readable-stream": "^4.0.0"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/cross-spawn": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
+      "license": "MIT",
+      "dependencies": {
+        "path-key": "^3.1.0",
+        "shebang-command": "^2.0.0",
+        "which": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/debug": {
+      "version": "4.4.1",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.1.tgz",
+      "integrity": "sha512-KcKCqiftBJcZr++7ykoDIEwSa3XWowTfNPo92BYxjXiyYEVrUQh2aLyhxBCwww+heortUFxEJYcRzosstTEBYQ==",
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/deprecation": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/deprecation/-/deprecation-2.3.1.tgz",
+      "integrity": "sha512-xmHIy4F3scKVwMsQ4WnVaS8bHOx0DmVwRywosKhaILI0ywMDWPtBSku2HNxRvF7jtwDRsoEwYQSfbxj8b7RlJQ==",
+      "license": "ISC"
+    },
+    "node_modules/eastasianwidth": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz",
+      "integrity": "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==",
+      "license": "MIT"
+    },
+    "node_modules/emoji-regex": {
+      "version": "9.2.2",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
+      "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==",
+      "license": "MIT"
+    },
+    "node_modules/event-target-shim": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/event-target-shim/-/event-target-shim-5.0.1.tgz",
+      "integrity": "sha512-i/2XbnSz/uxRCU6+NdVJgKWDTM427+MqYbkQzD321DuCQJUqOuJKIA0IM2+W2xtYHdKOmZ4dR6fExsd4SXL+WQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/events": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/events/-/events-3.3.0.tgz",
+      "integrity": "sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.8.x"
+      }
+    },
+    "node_modules/fast-fifo": {
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/fast-fifo/-/fast-fifo-1.3.2.tgz",
+      "integrity": "sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ==",
+      "license": "MIT"
+    },
+    "node_modules/fast-xml-parser": {
+      "version": "5.2.5",
+      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.2.5.tgz",
+      "integrity": "sha512-pfX9uG9Ki0yekDHx2SiuRIyFdyAr1kMIMitPvb0YBo8SUfKvia7w7FIyd/l6av85pFYRhZscS75MwMnbvY+hcQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "strnum": "^2.1.0"
+      },
+      "bin": {
+        "fxparser": "src/cli/cli.js"
+      }
+    },
+    "node_modules/foreground-child": {
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz",
+      "integrity": "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==",
+      "license": "ISC",
+      "dependencies": {
+        "cross-spawn": "^7.0.6",
+        "signal-exit": "^4.0.1"
+      },
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/glob": {
+      "version": "10.4.5",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-10.4.5.tgz",
+      "integrity": "sha512-7Bv8RF0k6xjo7d4A/PxYLbUCfb6c+Vpd2/mB2yRDlew7Jb5hEXiCD9ibfO7wpk8i4sevK6DFny9h7EYbM3/sHg==",
+      "license": "ISC",
+      "dependencies": {
+        "foreground-child": "^3.1.0",
+        "jackspeak": "^3.1.2",
+        "minimatch": "^9.0.4",
+        "minipass": "^7.1.2",
+        "package-json-from-dist": "^1.0.0",
+        "path-scurry": "^1.11.1"
+      },
+      "bin": {
+        "glob": "dist/esm/bin.mjs"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/graceful-fs": {
+      "version": "4.2.11",
+      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
+      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
+      "license": "ISC"
+    },
+    "node_modules/http-proxy-agent": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
+      "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.0",
+        "debug": "^4.3.4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/https-proxy-agent": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
+      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.2",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/ieee754": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
+      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "license": "ISC"
+    },
+    "node_modules/is-fullwidth-code-point": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
+      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/is-plain-object": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-5.0.0.tgz",
+      "integrity": "sha512-VRSzKkbMm5jMDoKLbltAkFQ5Qr7VDiTFGXxYFXXowVj387GeGNOCsOH6Msy00SGZ3Fp84b1Naa1psqgcCIEP5Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-stream": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz",
+      "integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/isarray": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
+      "integrity": "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==",
+      "license": "MIT"
+    },
+    "node_modules/isexe": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
+      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
+      "license": "ISC"
+    },
+    "node_modules/jackspeak": {
+      "version": "3.4.3",
+      "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-3.4.3.tgz",
+      "integrity": "sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw==",
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "@isaacs/cliui": "^8.0.2"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      },
+      "optionalDependencies": {
+        "@pkgjs/parseargs": "^0.11.0"
+      }
+    },
+    "node_modules/jwt-decode": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/jwt-decode/-/jwt-decode-3.1.2.tgz",
+      "integrity": "sha512-UfpWE/VZn0iP50d8cz9NrZLM9lSWhcJ+0Gt/nm4by88UL+J1SiKN8/5dkjMmbEzwL2CAe+67GsegCbIKtbp75A==",
+      "license": "MIT"
+    },
+    "node_modules/lazystream": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/lazystream/-/lazystream-1.0.1.tgz",
+      "integrity": "sha512-b94GiNHQNy6JNTrt5w6zNyffMrNkXZb3KTkCZJb2V1xaEGCk093vkZ2jk3tpaeP33/OiXC+WvK9AxUebnf5nbw==",
+      "license": "MIT",
+      "dependencies": {
+        "readable-stream": "^2.0.5"
+      },
+      "engines": {
+        "node": ">= 0.6.3"
+      }
+    },
+    "node_modules/lazystream/node_modules/readable-stream": {
+      "version": "2.3.8",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz",
+      "integrity": "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==",
+      "license": "MIT",
+      "dependencies": {
+        "core-util-is": "~1.0.0",
+        "inherits": "~2.0.3",
+        "isarray": "~1.0.0",
+        "process-nextick-args": "~2.0.0",
+        "safe-buffer": "~5.1.1",
+        "string_decoder": "~1.1.1",
+        "util-deprecate": "~1.0.1"
+      }
+    },
+    "node_modules/lazystream/node_modules/safe-buffer": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
+      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
+      "license": "MIT"
+    },
+    "node_modules/lazystream/node_modules/string_decoder": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
+      "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "~5.1.0"
+      }
+    },
+    "node_modules/lodash": {
+      "version": "4.17.21",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
+      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
+      "license": "MIT"
+    },
+    "node_modules/lru-cache": {
+      "version": "10.4.3",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
+      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
+      "license": "ISC"
+    },
+    "node_modules/minimatch": {
+      "version": "9.0.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
+      "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/minimist": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
+      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/minipass": {
+      "version": "7.1.2",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.2.tgz",
+      "integrity": "sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      }
+    },
+    "node_modules/mkdirp": {
+      "version": "0.5.6",
+      "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.6.tgz",
+      "integrity": "sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==",
+      "license": "MIT",
+      "dependencies": {
+        "minimist": "^1.2.6"
+      },
+      "bin": {
+        "mkdirp": "bin/cmd.js"
+      }
+    },
+    "node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT"
+    },
+    "node_modules/node-fetch": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.7.0.tgz",
+      "integrity": "sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==",
+      "license": "MIT",
+      "dependencies": {
+        "whatwg-url": "^5.0.0"
+      },
+      "engines": {
+        "node": "4.x || >=6.0.0"
+      },
+      "peerDependencies": {
+        "encoding": "^0.1.0"
+      },
+      "peerDependenciesMeta": {
+        "encoding": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/normalize-path": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz",
+      "integrity": "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "license": "ISC",
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
+    "node_modules/package-json-from-dist": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/package-json-from-dist/-/package-json-from-dist-1.0.1.tgz",
+      "integrity": "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==",
+      "license": "BlueOak-1.0.0"
+    },
+    "node_modules/path-key": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/path-scurry": {
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.11.1.tgz",
+      "integrity": "sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==",
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "lru-cache": "^10.2.0",
+        "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/process": {
+      "version": "0.11.10",
+      "resolved": "https://registry.npmjs.org/process/-/process-0.11.10.tgz",
+      "integrity": "sha512-cdGef/drWFoydD1JsMzuFf8100nZl+GT+yacc2bEced5f9Rjk4z+WtFUTBu9PhOi9j/jfmBPu0mMEY4wIdAF8A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6.0"
+      }
+    },
+    "node_modules/process-nextick-args": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz",
+      "integrity": "sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==",
+      "license": "MIT"
+    },
+    "node_modules/readable-stream": {
+      "version": "4.7.0",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-4.7.0.tgz",
+      "integrity": "sha512-oIGGmcpTLwPga8Bn6/Z75SVaH1z5dUut2ibSyAMVhmUggWpmDn2dapB0n7f8nwaSiRtepAsfJyfXIO5DCVAODg==",
+      "license": "MIT",
+      "dependencies": {
+        "abort-controller": "^3.0.0",
+        "buffer": "^6.0.3",
+        "events": "^3.3.0",
+        "process": "^0.11.10",
+        "string_decoder": "^1.3.0"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      }
+    },
+    "node_modules/readdir-glob": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/readdir-glob/-/readdir-glob-1.1.3.tgz",
+      "integrity": "sha512-v05I2k7xN8zXvPD9N+z/uhXPaj0sUFCe2rcWZIpBsqxfP7xXFQ0tipAd/wjj1YxWyWtUS5IDJpOG82JKt2EAVA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "minimatch": "^5.1.0"
+      }
+    },
+    "node_modules/readdir-glob/node_modules/minimatch": {
+      "version": "5.1.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.6.tgz",
+      "integrity": "sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g==",
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/safe-buffer": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/shebang-command": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "license": "MIT",
+      "dependencies": {
+        "shebang-regex": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/shebang-regex": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/signal-exit": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
+      "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/streamx": {
+      "version": "2.22.1",
+      "resolved": "https://registry.npmjs.org/streamx/-/streamx-2.22.1.tgz",
+      "integrity": "sha512-znKXEBxfatz2GBNK02kRnCXjV+AA4kjZIUxeWSr3UGirZMJfTE9uiwKHobnbgxWyL/JWro8tTq+vOqAK1/qbSA==",
+      "license": "MIT",
+      "dependencies": {
+        "fast-fifo": "^1.3.2",
+        "text-decoder": "^1.1.0"
+      },
+      "optionalDependencies": {
+        "bare-events": "^2.2.0"
+      }
+    },
+    "node_modules/string_decoder": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
+      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "~5.2.0"
+      }
+    },
+    "node_modules/string-width": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
+      "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
+      "license": "MIT",
+      "dependencies": {
+        "eastasianwidth": "^0.2.0",
+        "emoji-regex": "^9.2.2",
+        "strip-ansi": "^7.0.1"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/string-width-cjs": {
+      "name": "string-width",
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "license": "MIT",
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/string-width-cjs/node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/string-width-cjs/node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+      "license": "MIT"
+    },
+    "node_modules/string-width-cjs/node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-ansi": {
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.0.tgz",
+      "integrity": "sha512-iq6eVVI64nQQTRYq2KtEg2d2uU7LElhTJwsH4YzIHZshxlgZms/wIc4VoDQTlG/IvVIrBKG06CrZnp0qv7hkcQ==",
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/strip-ansi?sponsor=1"
+      }
+    },
+    "node_modules/strip-ansi-cjs": {
+      "name": "strip-ansi",
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-ansi-cjs/node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strnum": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.1.1.tgz",
+      "integrity": "sha512-7ZvoFTiCnGxBtDqJ//Cu6fWtZtc7Y3x+QOirG15wztbdngGSkht27o2pyGWrVy0b4WAy3jbKmnoK6g5VlVNUUw==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/tar-stream": {
+      "version": "3.1.7",
+      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-3.1.7.tgz",
+      "integrity": "sha512-qJj60CXt7IU1Ffyc3NJMjh6EkuCFej46zUqJ4J7pqYlThyd9bO0XBTmcOIhSzZJVWfsLks0+nle/j538YAW9RQ==",
+      "license": "MIT",
+      "dependencies": {
+        "b4a": "^1.6.4",
+        "fast-fifo": "^1.2.0",
+        "streamx": "^2.15.0"
+      }
+    },
+    "node_modules/text-decoder": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/text-decoder/-/text-decoder-1.2.3.tgz",
+      "integrity": "sha512-3/o9z3X0X0fTupwsYvR03pJ/DjWuqqrfwBgTQzdWDiQSm9KitAyz/9WqsT2JQW7KV2m+bC2ol/zqpW37NHxLaA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "b4a": "^1.6.4"
+      }
+    },
+    "node_modules/tr46": {
+      "version": "0.0.3",
+      "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz",
+      "integrity": "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==",
+      "license": "MIT"
+    },
+    "node_modules/traverse": {
+      "version": "0.3.9",
+      "resolved": "https://registry.npmjs.org/traverse/-/traverse-0.3.9.tgz",
+      "integrity": "sha512-iawgk0hLP3SxGKDfnDJf8wTz4p2qImnyihM5Hh/sGvQ3K37dPi/w8sRhdNIxYA1TwFwc5mDhIJq+O0RsvXBKdQ==",
+      "license": "MIT/X11",
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "license": "0BSD"
+    },
+    "node_modules/tunnel": {
+      "version": "0.0.6",
+      "resolved": "https://registry.npmjs.org/tunnel/-/tunnel-0.0.6.tgz",
+      "integrity": "sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.6.11 <=0.7.0 || >=0.7.3"
+      }
+    },
+    "node_modules/typescript": {
+      "version": "3.9.10",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-3.9.10.tgz",
+      "integrity": "sha512-w6fIxVE/H1PkLKcCPsFqKE7Kv7QUwhU8qQY2MueZXWx5cPZdwFupLgKK3vntcK98BtNHZtAF4LA/yl2a7k8R6Q==",
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=4.2.0"
+      }
+    },
+    "node_modules/undici": {
+      "version": "5.29.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
+      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
+      "license": "MIT",
+      "dependencies": {
+        "@fastify/busboy": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=14.0"
+      }
+    },
+    "node_modules/universal-user-agent": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-6.0.1.tgz",
+      "integrity": "sha512-yCzhz6FN2wU1NiiQRogkTQszlQSlpWaw8SvVegAc+bDxbzHgh1vX8uIe8OYyMH6DwH+sdTJsgMl36+mSMdRJIQ==",
+      "license": "ISC"
+    },
+    "node_modules/unzip-stream": {
+      "version": "0.3.4",
+      "resolved": "https://registry.npmjs.org/unzip-stream/-/unzip-stream-0.3.4.tgz",
+      "integrity": "sha512-PyofABPVv+d7fL7GOpusx7eRT9YETY2X04PhwbSipdj6bMxVCFJrr+nm0Mxqbf9hUiTin/UsnuFWBXlDZFy0Cw==",
+      "license": "MIT",
+      "dependencies": {
+        "binary": "^0.3.0",
+        "mkdirp": "^0.5.1"
+      }
+    },
+    "node_modules/util-deprecate": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
+      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
+      "license": "MIT"
+    },
+    "node_modules/webidl-conversions": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",
+      "integrity": "sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==",
+      "license": "BSD-2-Clause"
+    },
+    "node_modules/whatwg-url": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz",
+      "integrity": "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==",
+      "license": "MIT",
+      "dependencies": {
+        "tr46": "~0.0.3",
+        "webidl-conversions": "^3.0.0"
+      }
+    },
+    "node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "license": "ISC",
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/wrap-ansi": {
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-8.1.0.tgz",
+      "integrity": "sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ==",
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^6.1.0",
+        "string-width": "^5.0.1",
+        "strip-ansi": "^7.0.1"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+      }
+    },
+    "node_modules/wrap-ansi-cjs": {
+      "name": "wrap-ansi",
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
+      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^4.0.0",
+        "string-width": "^4.1.0",
+        "strip-ansi": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+      }
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "license": "MIT",
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+      "license": "MIT"
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/string-width": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "license": "MIT",
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
+      "license": "ISC"
+    },
+    "node_modules/zip-stream": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/zip-stream/-/zip-stream-6.0.1.tgz",
+      "integrity": "sha512-zK7YHHz4ZXpW89AHXUPbQVGKI7uvkd3hzusTdotCg1UxyaVtg0zFJSTfW/Dq5f7OBBVnq6cZIaC8Ti4hb6dtCA==",
+      "license": "MIT",
+      "dependencies": {
+        "archiver-utils": "^5.0.0",
+        "compress-commons": "^6.0.2",
+        "readable-stream": "^4.0.0"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    }
+  }
+}
diff --git a/ci/labels/package.json b/ci/labels/package.json
new file mode 100644
index 000000000000..e07813aa86b5
--- /dev/null
+++ b/ci/labels/package.json
@@ -0,0 +1,9 @@
+{
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "@actions/artifact": "2.3.2",
+    "@actions/github": "6.0.1",
+    "bottleneck": "2.19.5"
+  }
+}
diff --git a/ci/labels/run.js b/ci/labels/run.js
new file mode 100755
index 000000000000..0a89e3d83f45
--- /dev/null
+++ b/ci/labels/run.js
@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+import { execSync } from 'node:child_process'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { getOctokit } from '@actions/github'
+import labels from './labels.cjs'
+
+if (process.argv.length !== 4)
+  throw new Error('Call this with exactly two arguments: ./run.js OWNER REPO')
+const [, , owner, repo] = process.argv
+
+const token = execSync('gh auth token', { encoding: 'utf-8' }).trim()
+
+const tmp = mkdtempSync(join(tmpdir(), 'labels-'))
+try {
+  process.env.GITHUB_WORKSPACE = tmp
+  process.chdir(tmp)
+
+  await labels({
+    github: getOctokit(token),
+    context: {
+      payload: {},
+      repo: {
+        owner,
+        repo,
+      },
+    },
+    core: {
+      getInput() {
+        return token
+      },
+      error: console.error,
+      info: console.log,
+      notice: console.log,
+      setFailed(msg) {
+        console.error(msg)
+        process.exitCode = 1
+      },
+    },
+  })
+} finally {
+  rmSync(tmp, { recursive: true })
+}
diff --git a/ci/labels/shell.nix b/ci/labels/shell.nix
new file mode 100644
index 000000000000..dd84ba3ad73d
--- /dev/null
+++ b/ci/labels/shell.nix
@@ -0,0 +1,23 @@
+{
+  system ? builtins.currentSystem,
+  pkgs ? (import ../. { inherit system; }).pkgs,
+}:
+
+pkgs.callPackage (
+  {
+    mkShell,
+    importNpmLock,
+    nodejs,
+  }:
+  mkShell {
+    packages = [
+      importNpmLock.hooks.linkNodeModulesHook
+      nodejs
+    ];
+
+    npmDeps = importNpmLock.buildNodeModules {
+      npmRoot = ./.;
+      inherit nodejs;
+    };
+  }
+) { }

From 9936e7d751efbe6a47e5462b81d288b2d5265535 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Mon, 7 Jul 2025 19:55:53 +0200
Subject: [PATCH 50/92] ci/labels: run prettier

This is the result of:

  prettier --no-semi --single-quote
---
 ci/labels/labels.cjs | 309 +++++++++++++++++++++++++------------------
 1 file changed, 183 insertions(+), 126 deletions(-)

diff --git a/ci/labels/labels.cjs b/ci/labels/labels.cjs
index cafd79089c5e..ea30e2dc6244 100644
--- a/ci/labels/labels.cjs
+++ b/ci/labels/labels.cjs
@@ -1,4 +1,4 @@
-module.exports = async function({ github, context, core }) {
+module.exports = async function ({ github, context, core }) {
   const Bottleneck = require('bottleneck')
   const path = require('node:path')
   const { DefaultArtifactClient } = require('@actions/artifact')
@@ -10,7 +10,7 @@ module.exports = async function({ github, context, core }) {
     issues: 0,
     prs: 0,
     requests: 0,
-    artifacts: 0
+    artifacts: 0,
   }
 
   // Rate-Limiting and Throttling, see for details:
@@ -20,7 +20,7 @@ module.exports = async function({ github, context, core }) {
     // Avoid concurrent requests
     maxConcurrent: 1,
     // Will be updated with first `updateReservoir()` call below.
-    reservoir: 0
+    reservoir: 0,
   })
   // Pause between mutative requests
   const writeLimits = new Bottleneck({ minTime: 1000 }).chain(allLimits)
@@ -33,8 +33,7 @@ module.exports = async function({ github, context, core }) {
     stats.requests++
     if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(options.method))
       return writeLimits.schedule(request.bind(null, options))
-    else
-      return allLimits.schedule(request.bind(null, options))
+    else return allLimits.schedule(request.bind(null, options))
   })
 
   async function updateReservoir() {
@@ -57,26 +56,28 @@ module.exports = async function({ github, context, core }) {
   const reservoirUpdater = setInterval(updateReservoir, 60 * 1000)
 
   async function handlePullRequest(item) {
-    const log = (k,v) => core.info(`PR #${item.number} - ${k}: ${v}`)
+    const log = (k, v) => core.info(`PR #${item.number} - ${k}: ${v}`)
 
     const pull_number = item.number
 
     // This API request is important for the merge-conflict label, because it triggers the
     // creation of a new test merge commit. This is needed to actually determine the state of a PR.
-    const pull_request = (await github.rest.pulls.get({
-      ...context.repo,
-      pull_number
-    })).data
+    const pull_request = (
+      await github.rest.pulls.get({
+        ...context.repo,
+        pull_number,
+      })
+    ).data
 
     const reviews = await github.paginate(github.rest.pulls.listReviews, {
-        ...context.repo,
-        pull_number
-      })
+      ...context.repo,
+      pull_number,
+    })
 
     const approvals = new Set(
       reviews
-      .filter(review => review.state == 'APPROVED')
-      .map(review => review.user?.id)
+        .filter((review) => review.state == 'APPROVED')
+        .map((review) => review.user?.id),
     )
 
     // After creation of a Pull Request, `merge_commit_sha` will be null initially:
@@ -84,7 +85,8 @@ module.exports = async function({ github, context, core }) {
     // To avoid labeling the PR as conflicted before that, we wait a few minutes.
     // This is intentionally less than the time that Eval takes, so that the label job
     // running after Eval can indeed label the PR as conflicted if that is the case.
-    const merge_commit_sha_valid = new Date() - new Date(pull_request.created_at) > 3 * 60 * 1000
+    const merge_commit_sha_valid =
+      new Date() - new Date(pull_request.created_at) > 3 * 60 * 1000
 
     const prLabels = {
       // We intentionally don't use the mergeable or mergeable_state attributes.
@@ -98,31 +100,41 @@ module.exports = async function({ github, context, core }) {
       // On the first pass of the day, we just fetch the pull request, which triggers
       // the creation. At this stage, the label is likely not updated, yet.
       // The second pass will then read the result from the first pass and set the label.
-      '2.status: merge conflict': merge_commit_sha_valid && !pull_request.merge_commit_sha,
+      '2.status: merge conflict':
+        merge_commit_sha_valid && !pull_request.merge_commit_sha,
       '12.approvals: 1': approvals.size == 1,
       '12.approvals: 2': approvals.size == 2,
       '12.approvals: 3+': approvals.size >= 3,
-      '12.first-time contribution':
-        [ 'NONE', 'FIRST_TIMER', 'FIRST_TIME_CONTRIBUTOR' ].includes(pull_request.author_association),
+      '12.first-time contribution': [
+        'NONE',
+        'FIRST_TIMER',
+        'FIRST_TIME_CONTRIBUTOR',
+      ].includes(pull_request.author_association),
     }
 
-    const { id: run_id, conclusion } = (await github.rest.actions.listWorkflowRuns({
-      ...context.repo,
-      workflow_id: 'pr.yml',
-      event: 'pull_request_target',
-      exclude_pull_requests: true,
-      head_sha: pull_request.head.sha
-    })).data.workflow_runs[0] ??
+    const { id: run_id, conclusion } =
+      (
+        await github.rest.actions.listWorkflowRuns({
+          ...context.repo,
+          workflow_id: 'pr.yml',
+          event: 'pull_request_target',
+          exclude_pull_requests: true,
+          head_sha: pull_request.head.sha,
+        })
+      ).data.workflow_runs[0] ??
       // TODO: Remove this after 2025-09-17, at which point all eval.yml artifacts will have expired.
-      (await github.rest.actions.listWorkflowRuns({
-        ...context.repo,
-        // In older PRs, we need eval.yml instead of pr.yml.
-        workflow_id: 'eval.yml',
-        event: 'pull_request_target',
-        status: 'success',
-        exclude_pull_requests: true,
-        head_sha: pull_request.head.sha
-      })).data.workflow_runs[0] ?? {}
+      (
+        await github.rest.actions.listWorkflowRuns({
+          ...context.repo,
+          // In older PRs, we need eval.yml instead of pr.yml.
+          workflow_id: 'eval.yml',
+          event: 'pull_request_target',
+          status: 'success',
+          exclude_pull_requests: true,
+          head_sha: pull_request.head.sha,
+        })
+      ).data.workflow_runs[0] ??
+      {}
 
     // Newer PRs might not have run Eval to completion, yet.
     // Older PRs might not have an eval.yml workflow, yet.
@@ -146,17 +158,24 @@ module.exports = async function({ github, context, core }) {
       })
     }
 
-    const artifact = run_id && (await github.rest.actions.listWorkflowRunArtifacts({
-      ...context.repo,
-      run_id,
-      name: 'comparison'
-    })).data.artifacts[0]
+    const artifact =
+      run_id &&
+      (
+        await github.rest.actions.listWorkflowRunArtifacts({
+          ...context.repo,
+          run_id,
+          name: 'comparison',
+        })
+      ).data.artifacts[0]
 
     // Instead of checking the boolean artifact.expired, we will give us a minute to
     // actually download the artifact in the next step and avoid that race condition.
     // Older PRs, where the workflow run was already eval.yml, but the artifact was not
     // called "comparison", yet, will skip the download.
-    const expired = !artifact || new Date(artifact?.expires_at ?? 0) < new Date(new Date().getTime() + 60 * 1000)
+    const expired =
+      !artifact ||
+      new Date(artifact?.expires_at ?? 0) <
+        new Date(new Date().getTime() + 60 * 1000)
     log('Artifact expires at', artifact?.expires_at ?? '<n/a>')
     if (!expired) {
       stats.artifacts++
@@ -165,17 +184,23 @@ module.exports = async function({ github, context, core }) {
         findBy: {
           repositoryName: context.repo.repo,
           repositoryOwner: context.repo.owner,
-          token: core.getInput('github-token')
+          token: core.getInput('github-token'),
         },
         path: path.resolve(pull_number.toString()),
-        expectedHash: artifact.digest
+        expectedHash: artifact.digest,
       })
 
-      const maintainers = new Set(Object.keys(
-        JSON.parse(await readFile(`${pull_number}/maintainers.json`, 'utf-8'))
-      ).map(m => Number.parseInt(m, 10)))
+      const maintainers = new Set(
+        Object.keys(
+          JSON.parse(
+            await readFile(`${pull_number}/maintainers.json`, 'utf-8'),
+          ),
+        ).map((m) => Number.parseInt(m, 10)),
+      )
 
-      const evalLabels = JSON.parse(await readFile(`${pull_number}/changed-paths.json`, 'utf-8')).labels
+      const evalLabels = JSON.parse(
+        await readFile(`${pull_number}/changed-paths.json`, 'utf-8'),
+      ).labels
 
       Object.assign(
         prLabels,
@@ -184,10 +209,12 @@ module.exports = async function({ github, context, core }) {
         // The old eval labels would have been set by the eval run,
         // so now they'll be present in `before`.
         // TODO: Simplify once old eval results have expired (~2025-10)
-        (Array.isArray(evalLabels) ? undefined : evalLabels),
+        Array.isArray(evalLabels) ? undefined : evalLabels,
         {
-          '12.approved-by: package-maintainer': Array.from(maintainers).some(m => approvals.has(m)),
-        }
+          '12.approved-by: package-maintainer': Array.from(maintainers).some(
+            (m) => approvals.has(m),
+          ),
+        },
       )
     }
 
@@ -196,7 +223,7 @@ module.exports = async function({ github, context, core }) {
 
   async function handle(item) {
     try {
-      const log = (k,v,skip) => {
+      const log = (k, v, skip) => {
         core.info(`#${item.number} - ${k}: ${v}` + (skip ? ' (skipped)' : ''))
         return skip
       }
@@ -216,38 +243,44 @@ module.exports = async function({ github, context, core }) {
       }
 
       const latest_event_at = new Date(
-        (await github.paginate(
-          github.rest.issues.listEventsForTimeline,
-          {
+        (
+          await github.paginate(github.rest.issues.listEventsForTimeline, {
             ...context.repo,
             issue_number,
-            per_page: 100
-          }
-        ))
-        .filter(({ event }) => [
-          // These events are hand-picked from:
-          //   https://docs.github.com/en/rest/using-the-rest-api/issue-event-types?apiVersion=2022-11-28
-          // Each of those causes a PR/issue to *not* be considered as stale anymore.
-          // Most of these use created_at.
-          'assigned',
-          'commented', // uses updated_at, because that could be > created_at
-          'committed', // uses committer.date
-          'head_ref_force_pushed',
-          'milestoned',
-          'pinned',
-          'ready_for_review',
-          'renamed',
-          'reopened',
-          'review_dismissed',
-          'review_requested',
-          'reviewed', // uses submitted_at
-          'unlocked',
-          'unmarked_as_duplicate',
-        ].includes(event))
-        .map(({ created_at, updated_at, committer, submitted_at }) => new Date(updated_at ?? created_at ?? submitted_at ?? committer.date))
-        // Reverse sort by date value. The default sort() sorts by string representation, which is bad for dates.
-        .sort((a,b) => b-a)
-        .at(0) ?? item.created_at
+            per_page: 100,
+          })
+        )
+          .filter(({ event }) =>
+            [
+              // These events are hand-picked from:
+              //   https://docs.github.com/en/rest/using-the-rest-api/issue-event-types?apiVersion=2022-11-28
+              // Each of those causes a PR/issue to *not* be considered as stale anymore.
+              // Most of these use created_at.
+              'assigned',
+              'commented', // uses updated_at, because that could be > created_at
+              'committed', // uses committer.date
+              'head_ref_force_pushed',
+              'milestoned',
+              'pinned',
+              'ready_for_review',
+              'renamed',
+              'reopened',
+              'review_dismissed',
+              'review_requested',
+              'reviewed', // uses submitted_at
+              'unlocked',
+              'unmarked_as_duplicate',
+            ].includes(event),
+          )
+          .map(
+            ({ created_at, updated_at, committer, submitted_at }) =>
+              new Date(
+                updated_at ?? created_at ?? submitted_at ?? committer.date,
+              ),
+          )
+          // Reverse sort by date value. The default sort() sorts by string representation, which is bad for dates.
+          .sort((a, b) => b - a)
+          .at(0) ?? item.created_at,
       )
       log('latest_event_at', latest_event_at.toISOString())
 
@@ -256,33 +289,37 @@ module.exports = async function({ github, context, core }) {
       // Create a map (Label -> Boolean) of all currently set labels.
       // Each label is set to True and can be disabled later.
       const before = Object.fromEntries(
-        (await github.paginate(github.rest.issues.listLabelsOnIssue, {
-          ...context.repo,
-          issue_number
-        }))
-        .map(({ name }) => [name, true])
+        (
+          await github.paginate(github.rest.issues.listLabelsOnIssue, {
+            ...context.repo,
+            issue_number,
+          })
+        ).map(({ name }) => [name, true]),
       )
 
       Object.assign(itemLabels, {
-        '2.status: stale': !before['1.severity: security'] && latest_event_at < stale_at,
+        '2.status: stale':
+          !before['1.severity: security'] && latest_event_at < stale_at,
       })
 
       const after = Object.assign({}, before, itemLabels)
 
       // No need for an API request, if all labels are the same.
-      const hasChanges = Object.keys(after).some(name => (before[name] ?? false) != after[name])
-      if (log('Has changes', hasChanges, !hasChanges))
-        return;
+      const hasChanges = Object.keys(after).some(
+        (name) => (before[name] ?? false) != after[name],
+      )
+      if (log('Has changes', hasChanges, !hasChanges)) return
 
       // Skipping labeling on a pull_request event, because we have no privileges.
-      const labels = Object.entries(after).filter(([,value]) => value).map(([name]) => name)
-      if (log('Set labels', labels, context.eventName == 'pull_request'))
-        return;
+      const labels = Object.entries(after)
+        .filter(([, value]) => value)
+        .map(([name]) => name)
+      if (log('Set labels', labels, context.eventName == 'pull_request')) return
 
       await github.rest.issues.setLabels({
         ...context.repo,
         issue_number,
-        labels
+        labels,
       })
     } catch (cause) {
       throw new Error(`Labeling #${item.number} failed.`, { cause })
@@ -293,19 +330,23 @@ module.exports = async function({ github, context, core }) {
     if (context.payload.pull_request) {
       await handle(context.payload.pull_request)
     } else {
-      const lastRun = (await github.rest.actions.listWorkflowRuns({
-        ...context.repo,
-        workflow_id: 'labels.yml',
-        event: 'schedule',
-        status: 'success',
-        exclude_pull_requests: true,
-        per_page: 1
-      })).data.workflow_runs[0]
+      const lastRun = (
+        await github.rest.actions.listWorkflowRuns({
+          ...context.repo,
+          workflow_id: 'labels.yml',
+          event: 'schedule',
+          status: 'success',
+          exclude_pull_requests: true,
+          per_page: 1,
+        })
+      ).data.workflow_runs[0]
 
       // Go back as far as the last successful run of this workflow to make sure
       // we are not leaving anyone behind on GHA failures.
       // Defaults to go back 1 hour on the first run.
-      const cutoff = new Date(lastRun?.created_at ?? new Date().getTime() - 1 * 60 * 60 * 1000)
+      const cutoff = new Date(
+        lastRun?.created_at ?? new Date().getTime() - 1 * 60 * 60 * 1000,
+      )
       core.info('cutoff timestamp: ' + cutoff.toISOString())
 
       const updatedItems = await github.paginate(
@@ -314,11 +355,11 @@ module.exports = async function({ github, context, core }) {
           q: [
             `repo:"${context.repo.owner}/${context.repo.repo}"`,
             'is:open',
-            `updated:>=${cutoff.toISOString()}`
+            `updated:>=${cutoff.toISOString()}`,
           ].join(' AND '),
           // TODO: Remove in 2025-10, when it becomes the default.
-          advanced_search: true
-        }
+          advanced_search: true,
+        },
       )
 
       let cursor
@@ -327,24 +368,29 @@ module.exports = async function({ github, context, core }) {
       if (lastRun) {
         // The cursor to iterate through the full list of issues and pull requests
         // is passed between jobs as an artifact.
-        const artifact = (await github.rest.actions.listWorkflowRunArtifacts({
-          ...context.repo,
-          run_id: lastRun.id,
-          name: 'pagination-cursor'
-        })).data.artifacts[0]
+        const artifact = (
+          await github.rest.actions.listWorkflowRunArtifacts({
+            ...context.repo,
+            run_id: lastRun.id,
+            name: 'pagination-cursor',
+          })
+        ).data.artifacts[0]
 
         // If the artifact is not available, the next iteration starts at the beginning.
         if (artifact) {
           stats.artifacts++
 
-          const { downloadPath } = await artifactClient.downloadArtifact(artifact.id, {
-            findBy: {
-              repositoryName: context.repo.repo,
-              repositoryOwner: context.repo.owner,
-              token: core.getInput('github-token')
+          const { downloadPath } = await artifactClient.downloadArtifact(
+            artifact.id,
+            {
+              findBy: {
+                repositoryName: context.repo.repo,
+                repositoryOwner: context.repo.owner,
+                token: core.getInput('github-token'),
+              },
+              expectedHash: artifact.digest,
             },
-            expectedHash: artifact.digest
-          })
+          )
 
           cursor = await readFile(path.resolve(downloadPath, 'cursor'), 'utf-8')
         }
@@ -360,7 +406,7 @@ module.exports = async function({ github, context, core }) {
         sort: 'created',
         direction: 'asc',
         per_page: 100,
-        after: cursor
+        after: cursor,
       })
 
       // Regex taken and comment adjusted from:
@@ -369,7 +415,9 @@ module.exports = async function({ github, context, core }) {
       //   <https://api.github.com/repositories/4542716/issues?page=3&per_page=100&after=Y3Vyc29yOnYyOpLPAAABl8qNnYDOvnSJxA%3D%3D>; rel="next",
       //   <https://api.github.com/repositories/4542716/issues?page=1&per_page=100&before=Y3Vyc29yOnYyOpLPAAABl8xFV9DOvoouJg%3D%3D>; rel="prev"
       // Sets `next` to undefined if "next" URL is not present or `link` header is not set.
-      const next = ((allItems.headers.link ?? '').match(/<([^<>]+)>;\s*rel="next"/) ?? [])[1]
+      const next = ((allItems.headers.link ?? '').match(
+        /<([^<>]+)>;\s*rel="next"/,
+      ) ?? [])[1]
       if (next) {
         cursor = new URL(next).searchParams.get('after')
         const uploadPath = path.resolve('cursor')
@@ -381,20 +429,29 @@ module.exports = async function({ github, context, core }) {
           [uploadPath],
           path.resolve('.'),
           {
-            retentionDays: 1
-          }
+            retentionDays: 1,
+          },
         )
       }
 
       // Some items might be in both search results, so filtering out duplicates as well.
-      const items = [].concat(updatedItems, allItems.data)
-        .filter((thisItem, idx, arr) => idx == arr.findIndex(firstItem => firstItem.number == thisItem.number))
+      const items = []
+        .concat(updatedItems, allItems.data)
+        .filter(
+          (thisItem, idx, arr) =>
+            idx ==
+            arr.findIndex((firstItem) => firstItem.number == thisItem.number),
+        )
 
       ;(await Promise.allSettled(items.map(handle)))
         .filter(({ status }) => status == 'rejected')
-        .map(({ reason }) => core.setFailed(`${reason.message}\n${reason.cause.stack}`))
+        .map(({ reason }) =>
+          core.setFailed(`${reason.message}\n${reason.cause.stack}`),
+        )
 
-      core.notice(`Processed ${stats.prs} PRs, ${stats.issues} Issues, made ${stats.requests + stats.artifacts} API requests and downloaded ${stats.artifacts} artifacts.`)
+      core.notice(
+        `Processed ${stats.prs} PRs, ${stats.issues} Issues, made ${stats.requests + stats.artifacts} API requests and downloaded ${stats.artifacts} artifacts.`,
+      )
     }
   } finally {
     clearInterval(reservoirUpdater)

From dd8357185a38ce53d91f1566372710f6fc121228 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Mon, 7 Jul 2025 20:06:12 +0200
Subject: [PATCH 51/92] ci/labels: run in dry mode locally

To avoid mistakes when developing and testing against the upstream repo.
---
 .github/workflows/labels.yml |  1 +
 ci/labels/README.md          |  2 +-
 ci/labels/labels.cjs         | 28 ++++++++++++++++------------
 ci/labels/run.js             |  1 +
 4 files changed, 19 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index e4a4205f3eba..f5a04ad073bc 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -73,6 +73,7 @@ jobs:
               github,
               context,
               core,
+              dry: context.eventName == 'pull_request'
             })
 
       - name: Log current API rate limits
diff --git a/ci/labels/README.md b/ci/labels/README.md
index 4631437a9654..26cd88763fe6 100644
--- a/ci/labels/README.md
+++ b/ci/labels/README.md
@@ -1,4 +1,4 @@
 To test the labeler locally:
 - Provide `gh` on `PATH` and make sure it's authenticated.
 - Enter `nix-shell` in `./ci/labels`.
-- Run `./run.js OWNER REPO`, where OWNER is your username and REPO the name of your fork (normally nixpkgs).
+- Run `./run.js OWNER REPO`, where OWNER is your username or "NixOS" and REPO the name of your fork or "nixpkgs".
diff --git a/ci/labels/labels.cjs b/ci/labels/labels.cjs
index ea30e2dc6244..5527059f6e45 100644
--- a/ci/labels/labels.cjs
+++ b/ci/labels/labels.cjs
@@ -1,4 +1,4 @@
-module.exports = async function ({ github, context, core }) {
+module.exports = async function ({ github, context, core, dry }) {
   const Bottleneck = require('bottleneck')
   const path = require('node:path')
   const { DefaultArtifactClient } = require('@actions/artifact')
@@ -314,7 +314,7 @@ module.exports = async function ({ github, context, core }) {
       const labels = Object.entries(after)
         .filter(([, value]) => value)
         .map(([name]) => name)
-      if (log('Set labels', labels, context.eventName == 'pull_request')) return
+      if (log('Set labels', labels, dry)) return
 
       await github.rest.issues.setLabels({
         ...context.repo,
@@ -422,16 +422,20 @@ module.exports = async function ({ github, context, core }) {
         cursor = new URL(next).searchParams.get('after')
         const uploadPath = path.resolve('cursor')
         await writeFile(uploadPath, cursor, 'utf-8')
-        // No stats.artifacts++, because this does not allow passing a custom token.
-        // Thus, the upload will not happen with the app token, but the default github.token.
-        await artifactClient.uploadArtifact(
-          'pagination-cursor',
-          [uploadPath],
-          path.resolve('.'),
-          {
-            retentionDays: 1,
-          },
-        )
+        if (dry) {
+          core.info(`pagination-cursor: ${cursor} (upload skipped)`)
+        } else {
+          // No stats.artifacts++, because this does not allow passing a custom token.
+          // Thus, the upload will not happen with the app token, but the default github.token.
+          await artifactClient.uploadArtifact(
+            'pagination-cursor',
+            [uploadPath],
+            path.resolve('.'),
+            {
+              retentionDays: 1,
+            },
+          )
+        }
       }
 
       // Some items might be in both search results, so filtering out duplicates as well.
diff --git a/ci/labels/run.js b/ci/labels/run.js
index 0a89e3d83f45..d7e8e9ff9401 100755
--- a/ci/labels/run.js
+++ b/ci/labels/run.js
@@ -38,6 +38,7 @@ try {
         process.exitCode = 1
       },
     },
+    dry: true,
   })
 } finally {
   rmSync(tmp, { recursive: true })

From 7c291f8e2cac75d3ca8faab5fc8b4f09af2de000 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Tue, 8 Jul 2025 17:05:14 +0200
Subject: [PATCH 52/92] thunderbird: 139.0.2 -> 140.0

https://www.thunderbird.net/en-US/thunderbird/140.0/releasenotes/
The patch needed tiny conflict-resolution.
---
 .../thunderbird/no-buildconfig-tb140.patch           | 12 ++++++++++++
 .../networking/mailreaders/thunderbird/packages.nix  |  6 +++---
 2 files changed, 15 insertions(+), 3 deletions(-)
 create mode 100644 pkgs/applications/networking/mailreaders/thunderbird/no-buildconfig-tb140.patch

diff --git a/pkgs/applications/networking/mailreaders/thunderbird/no-buildconfig-tb140.patch b/pkgs/applications/networking/mailreaders/thunderbird/no-buildconfig-tb140.patch
new file mode 100644
index 000000000000..4ac9834696b0
--- /dev/null
+++ b/pkgs/applications/networking/mailreaders/thunderbird/no-buildconfig-tb140.patch
@@ -0,0 +1,12 @@
+Remove about:buildconfig.  If used as-is, it would add unnecessary runtime dependencies.
+--- a/comm/mail/base/jar.mn
++++ b/comm/mail/base/jar.mn
+@@ -132,8 +132,6 @@
+ % override chrome://mozapps/content/profile/profileDowngrade.js chrome://messenger/content/profileDowngrade.js
+ % override chrome://mozapps/content/profile/profileDowngrade.xhtml chrome://messenger/content/profileDowngrade.xhtml
+ 
+-*   content/messenger/buildconfig.html              (content/buildconfig.html)
+-% override chrome://global/content/buildconfig.html chrome://messenger/content/buildconfig.html
+ % override chrome://global/locale/appstrings.properties chrome://messenger/locale/appstrings.properties
+ 
+ comm.jar:
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index 1b2659decf9e..e948075cc125 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -47,7 +47,7 @@ let
       extraPatches =
         [
           # The file to be patched is different from firefox's `no-buildconfig-ffx90.patch`.
-          ./no-buildconfig.patch
+          (if lib.versionOlder version "140" then ./no-buildconfig.patch else ./no-buildconfig-tb140.patch)
         ]
         ++ lib.optionals (lib.versionOlder version "139") [
           # clang-19 fixes for char_traits build issue
@@ -95,8 +95,8 @@ rec {
   thunderbird = thunderbird-latest;
 
   thunderbird-latest = common {
-    version = "139.0.2";
-    sha512 = "edb20c692674dc5c3ba70673f7dd03710bf7ac0ce2be614a7a4b3d2b40b20b4974aab2a621dd5b43720c412a590c08f8b78abeb9b61f288f3217c6a04cc1e8ff";
+    version = "140.0";
+    sha512 = "2e9a5fb44b21eba3e3295205142bfad666a65f9eea43118388968320597a940cf3c5675fbcf458fbbaa9e1bb85fe8a663feda6461b7e23f7103c5bb7a1103bd4";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-latest";

From 428c7db6333c4bf955578e8ecf68707a322fea2d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 8 Jul 2025 19:57:25 +0000
Subject: [PATCH 53/92] faas-cli: 0.17.4 -> 0.17.5

---
 pkgs/by-name/fa/faas-cli/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fa/faas-cli/package.nix b/pkgs/by-name/fa/faas-cli/package.nix
index 5032f6afb684..d3d8333712ff 100644
--- a/pkgs/by-name/fa/faas-cli/package.nix
+++ b/pkgs/by-name/fa/faas-cli/package.nix
@@ -24,13 +24,13 @@ let
 in
 buildGoModule rec {
   pname = "faas-cli";
-  version = "0.17.4";
+  version = "0.17.5";
 
   src = fetchFromGitHub {
     owner = "openfaas";
     repo = "faas-cli";
     rev = version;
-    sha256 = "sha256-GM2gRfrdfUhfBn2atG21H7bNbW1HtgwQ7d7kMXvyMAs=";
+    sha256 = "sha256-/gDst9XDh63j2ZfLfioIKcIiXbOGyJWvYIbQwbV6xOc=";
   };
 
   vendorHash = null;

From ef2f8315bf538f1e76ca2f2257a53f583df3989e Mon Sep 17 00:00:00 2001
From: Yueh-Shun Li <shamrocklee@posteo.net>
Date: Wed, 9 Jul 2025 01:08:38 +0800
Subject: [PATCH 54/92] fetchhg: make argument hash overridable

---
 doc/build-helpers/fetchers.chapter.md  |  2 +-
 pkgs/build-support/fetchhg/default.nix | 10 +++---
 pkgs/test/overriding.nix               | 47 +++++++++++++++++++++++++-
 3 files changed, 52 insertions(+), 7 deletions(-)

diff --git a/doc/build-helpers/fetchers.chapter.md b/doc/build-helpers/fetchers.chapter.md
index 96b85d7b0d4f..8ff1fdf11a19 100644
--- a/doc/build-helpers/fetchers.chapter.md
+++ b/doc/build-helpers/fetchers.chapter.md
@@ -840,7 +840,7 @@ Used with CVS. Expects `cvsRoot`, `tag`, and `hash`.
 
 ## `fetchhg` {#fetchhg}
 
-Used with Mercurial. Expects `url`, `rev`, and `hash`.
+Used with Mercurial. Expects `url`, `rev`, `hash`, overridable with [`<pkg>.overrideAttrs`](#sec-pkg-overrideAttrs).
 
 A number of fetcher functions wrap part of `fetchurl` and `fetchzip`. They are mainly convenience functions intended for commonly used destinations of source code in Nixpkgs. These wrapper fetchers are listed below.
 
diff --git a/pkgs/build-support/fetchhg/default.nix b/pkgs/build-support/fetchhg/default.nix
index 4c8a8f312929..f22e32aca44a 100644
--- a/pkgs/build-support/fetchhg/default.nix
+++ b/pkgs/build-support/fetchhg/default.nix
@@ -28,22 +28,22 @@ lib.extendMkDerivation {
 
     subrepoClause = lib.optionalString fetchSubrepos "S";
 
-    outputHashAlgo = if hash != null && hash != "" then null else "sha256";
+    outputHashAlgo = if finalAttrs.hash != null && finalAttrs.hash != "" then null else "sha256";
     outputHashMode = "recursive";
     outputHash =
       lib.throwIf
-        (hash != null && sha256 != null)
+        (finalAttrs.hash != null && sha256 != null)
         "Only one of sha256 or hash can be set"
         (
-          if hash != null then
-            hash
+          if finalAttrs.hash != null then
+            finalAttrs.hash
           else if sha256 != null then
             sha256
           else
             ""
         );
 
-    inherit url rev;
+    inherit url rev hash;
     inherit preferLocalBuild;
   };
 
diff --git a/pkgs/test/overriding.nix b/pkgs/test/overriding.nix
index 27f57ab1ab9d..29bdbf2fd8fd 100644
--- a/pkgs/test/overriding.nix
+++ b/pkgs/test/overriding.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  tests = tests-stdenv // test-extendMkDerivation // tests-go // tests-python;
+  tests = tests-stdenv // test-extendMkDerivation // tests-fetchhg // tests-go // tests-python;
 
   tests-stdenv =
     let
@@ -131,6 +131,51 @@ let
       };
     };
 
+  tests-fetchhg =
+    let
+      ruamel_0_18_14-hash = "sha256-HDkPPp1xI3uoGYlS9mwPp1ZjG2gKvx6vog0Blj6tBuI=";
+      ruamel_0_18_14-src = pkgs.fetchhg {
+        url = "http://hg.code.sf.net/p/ruamel-yaml/code";
+        rev = "0.18.14";
+        hash = ruamel_0_18_14-hash;
+      };
+      ruamel_0_17_21-hash = "sha256-6PV0NyPQfd+4RBqoj5vJaOHShx+TJVHD2IamRinU0VU=";
+      ruamel_0_17_21-src = pkgs.fetchhg {
+        url = "http://hg.code.sf.net/p/ruamel-yaml/code";
+        rev = "0.17.21";
+        hash = ruamel_0_17_21-hash;
+      };
+      ruamel_0_17_21-src-by-overriding = ruamel_0_18_14-src.overrideAttrs {
+        rev = "0.17.21";
+        hash = ruamel_0_17_21-hash;
+      };
+    in
+    {
+      hash-outputHash-equivalence = {
+        expr = ruamel_0_17_21-src.outputHash == ruamel_0_17_21-hash;
+        expected = true;
+      };
+
+      hash-overridability-outputHash = {
+        expr = ruamel_0_17_21-src-by-overriding.outputHash == ruamel_0_17_21-hash;
+        expected = true;
+      };
+
+      hash-overridability-drvPath = {
+        expr =
+          lib.isString ruamel_0_17_21-src-by-overriding.drvPath
+          && ruamel_0_17_21-src-by-overriding.drvPath == ruamel_0_17_21-src.drvPath;
+        expected = true;
+      };
+
+      hash-overridability-outPath = {
+        expr =
+          lib.isString ruamel_0_17_21-src-by-overriding.outPath
+          && ruamel_0_17_21-src-by-overriding.outPath == ruamel_0_17_21-src.outPath;
+        expected = true;
+      };
+    };
+
   tests-go =
     let
       pet_0_3_4 = pkgs.buildGoModule rec {

From 34a5b1eb23129f8fb62c677e3760903f6d43228f Mon Sep 17 00:00:00 2001
From: Yueh-Shun Li <shamrocklee@posteo.net>
Date: Tue, 1 Jul 2025 17:47:25 +0800
Subject: [PATCH 55/92] fetchhg: format with nixfmt-rfc-style

---
 pkgs/build-support/fetchhg/default.nix | 64 +++++++++++++-------------
 1 file changed, 31 insertions(+), 33 deletions(-)

diff --git a/pkgs/build-support/fetchhg/default.nix b/pkgs/build-support/fetchhg/default.nix
index f22e32aca44a..1e5e76ec4ca0 100644
--- a/pkgs/build-support/fetchhg/default.nix
+++ b/pkgs/build-support/fetchhg/default.nix
@@ -9,43 +9,41 @@ lib.extendMkDerivation {
 
   extendDrvArgs =
     finalAttrs:
-{
-  name ? null,
-  url,
-  rev ? null,
-  sha256 ? null,
-  hash ? null,
-  fetchSubrepos ? false,
-  preferLocalBuild ? true,
-}:
-  # TODO: statically check if mercurial as the https support if the url starts with https.
-  {
-    name = "hg-archive" + (lib.optionalString (name != null) "-${name}");
-    builder = ./builder.sh;
-    nativeBuildInputs = [ mercurial ];
+    {
+      name ? null,
+      url,
+      rev ? null,
+      sha256 ? null,
+      hash ? null,
+      fetchSubrepos ? false,
+      preferLocalBuild ? true,
+    }:
+    # TODO: statically check if mercurial as the https support if the url starts with https.
+    {
+      name = "hg-archive" + (lib.optionalString (name != null) "-${name}");
+      builder = ./builder.sh;
+      nativeBuildInputs = [ mercurial ];
 
-    impureEnvVars = lib.fetchers.proxyImpureEnvVars;
+      impureEnvVars = lib.fetchers.proxyImpureEnvVars;
 
-    subrepoClause = lib.optionalString fetchSubrepos "S";
+      subrepoClause = lib.optionalString fetchSubrepos "S";
 
-    outputHashAlgo = if finalAttrs.hash != null && finalAttrs.hash != "" then null else "sha256";
-    outputHashMode = "recursive";
-    outputHash =
-      lib.throwIf
-        (finalAttrs.hash != null && sha256 != null)
-        "Only one of sha256 or hash can be set"
-        (
-          if finalAttrs.hash != null then
-            finalAttrs.hash
-          else if sha256 != null then
-            sha256
-          else
-            ""
-        );
+      outputHashAlgo = if finalAttrs.hash != null && finalAttrs.hash != "" then null else "sha256";
+      outputHashMode = "recursive";
+      outputHash =
+        lib.throwIf (finalAttrs.hash != null && sha256 != null) "Only one of sha256 or hash can be set"
+          (
+            if finalAttrs.hash != null then
+              finalAttrs.hash
+            else if sha256 != null then
+              sha256
+            else
+              ""
+          );
 
-    inherit url rev hash;
-    inherit preferLocalBuild;
-  };
+      inherit url rev hash;
+      inherit preferLocalBuild;
+    };
 
   # No ellipsis
   inheritFunctionArgs = false;

From 3d7b288269865abb87deb717f38beaf5b1a43829 Mon Sep 17 00:00:00 2001
From: Yueh-Shun Li <shamrocklee@posteo.net>
Date: Wed, 9 Jul 2025 01:18:43 +0800
Subject: [PATCH 56/92] .git-blame-ignore-revs: add fetchhg formatting after
 refactoring with lib.extendMkDerivation

---
 .git-blame-ignore-revs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs
index 5d3c35edb4d4..9156c6563ec7 100644
--- a/.git-blame-ignore-revs
+++ b/.git-blame-ignore-revs
@@ -193,6 +193,9 @@ cffc27daf06c77c0d76bc35d24b929cb9d68c3c9
 # nixos/kanidm: inherit lib, nixfmt
 8f18393d380079904d072007fb19dc64baef0a3a
 
+# fetchhg: format after refactoring with lib.extendMkDerivation and make overridable (#423539)
+34a5b1eb23129f8fb62c677e3760903f6d43228f
+
 # fetchurl: nixfmt-rfc-style
 ce21e97a1f20dee15da85c084f9d1148d84f853b
 

From ff4b407e3cf81dd440b9fe946681609dff24cb50 Mon Sep 17 00:00:00 2001
From: Will Fancher <elvishjerricco@gmail.com>
Date: Fri, 20 Jun 2025 13:03:21 -0400
Subject: [PATCH 57/92] lib/sources: add jj to clean source

---
 lib/sources.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/sources.nix b/lib/sources.nix
index 47376d0d0369..5dff2651d354 100644
--- a/lib/sources.nix
+++ b/lib/sources.nix
@@ -42,7 +42,9 @@ let
       # Filter out version control software files/directories
       (
         baseName == ".git"
-        || type == "directory" && (baseName == ".svn" || baseName == "CVS" || baseName == ".hg")
+        ||
+          type == "directory"
+          && (baseName == ".svn" || baseName == "CVS" || baseName == ".hg" || baseName == ".jj")
       )
       ||
         # Filter out editor backup / swap files.

From 46d4b09b20c9840af87872d2bee5249b4a9c9b2c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 8 Jul 2025 21:20:23 +0000
Subject: [PATCH 58/92] python3Packages.mpltoolbox: 25.04.0 -> 25.05.0

---
 pkgs/development/python-modules/mpltoolbox/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mpltoolbox/default.nix b/pkgs/development/python-modules/mpltoolbox/default.nix
index ddada447daf3..991dc38df82b 100644
--- a/pkgs/development/python-modules/mpltoolbox/default.nix
+++ b/pkgs/development/python-modules/mpltoolbox/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "mpltoolbox";
-  version = "25.04.0";
+  version = "25.05.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scipp";
     repo = "mpltoolbox";
     tag = version;
-    hash = "sha256-+LqPTlVbSxuewWuPNUfGdgQjWFxo7s2i3e21WkNNK78=";
+    hash = "sha256-XDfCzkn/Mr0Rca+Ku/mDSneqSfMHS9i/XUP8vVLSKMQ=";
   };
 
   build-system = [

From 1d121ebf9a9e9a0edab73cc0cb3156856a061d45 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 8 Jul 2025 21:42:29 +0000
Subject: [PATCH 59/92] myks: 4.8.4 -> 4.11.0

---
 pkgs/by-name/my/myks/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/my/myks/package.nix b/pkgs/by-name/my/myks/package.nix
index 792a07e07271..7c8b727e5c9f 100644
--- a/pkgs/by-name/my/myks/package.nix
+++ b/pkgs/by-name/my/myks/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "myks";
-  version = "4.8.4";
+  version = "4.11.0";
 
   src = fetchFromGitHub {
     owner = "mykso";
     repo = "myks";
     tag = "v${version}";
-    hash = "sha256-WMedmDw4AlM8XAwbnFBiNFHd9ocBJhXq8qVQTOm9aDI=";
+    hash = "sha256-NXb+7JEk5w1hq7ML6LQD1QXbnOqp+BJ9K+uqrwUsrDs=";
   };
 
-  vendorHash = "sha256-IZopDehj8y7I4EDkiWGod5bexj8vzIS7eLx22UscXOs=";
+  vendorHash = "sha256-iAihVBR63OcORNAW7szKPOMyc+X1X76u++j5HLHU35I=";
 
   subPackages = ".";
 

From cc12c638ca104e6afd6bf29743e7531138214d6c Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 9 Jul 2025 00:30:40 +0200
Subject: [PATCH 60/92] hostname: default to hostname-debian on linux

---
 pkgs/top-level/unixtools.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/top-level/unixtools.nix b/pkgs/top-level/unixtools.nix
index d2d678467c5f..ba613a51ca07 100644
--- a/pkgs/top-level/unixtools.nix
+++ b/pkgs/top-level/unixtools.nix
@@ -126,7 +126,7 @@ let
       darwin = pkgs.darwin.shell_cmds;
     };
     hostname = {
-      linux = pkgs.nettools;
+      linux = pkgs.hostname-debian;
       darwin = pkgs.darwin.shell_cmds;
       freebsd = pkgs.freebsd.bin;
       openbsd = pkgs.openbsd.hostname;

From 9b504cfe4b7951b231feb2224dc7ab6766f20316 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 9 Jul 2025 00:32:49 +0200
Subject: [PATCH 61/92] xdg-utils: use hostname per system indirection

Fixes the build on darwin.
---
 pkgs/by-name/xd/xdg-utils/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/xd/xdg-utils/package.nix b/pkgs/by-name/xd/xdg-utils/package.nix
index 0b26dfd1b128..9c7119cf87b5 100644
--- a/pkgs/by-name/xd/xdg-utils/package.nix
+++ b/pkgs/by-name/xd/xdg-utils/package.nix
@@ -21,7 +21,7 @@
   glib,
   gnugrep,
   gnused,
-  hostname-debian,
+  hostname,
   jq,
   procps,
   which,
@@ -166,7 +166,7 @@ let
       scripts = [ "bin/xdg-open" ];
       interpreter = "${bash}/bin/bash";
       inputs = commonDeps ++ [
-        hostname-debian
+        hostname
         glib.bin
         "${placeholder "out"}/bin"
       ];
@@ -206,7 +206,7 @@ let
       scripts = [ "bin/xdg-screensaver" ];
       interpreter = "${bash}/bin/bash";
       inputs = commonDeps ++ [
-        hostname-debian
+        hostname
         perl
         procps
       ];

From ef9a79a35c84ddd09252e7f9f6f47770a80b0244 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 9 Jul 2025 01:28:02 +0200
Subject: [PATCH 62/92] vectorcode: 0.7.4 -> 0.7.7

Diff: https://github.com/Davidyz/VectorCode/compare/refs/tags/0.7.4...refs/tags/0.7.7

Changelog: https://github.com/Davidyz/VectorCode/releases/tag/0.7.7
---
 pkgs/by-name/ve/vectorcode/package.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ve/vectorcode/package.nix b/pkgs/by-name/ve/vectorcode/package.nix
index 7af4424e2569..319c25eabba8 100644
--- a/pkgs/by-name/ve/vectorcode/package.nix
+++ b/pkgs/by-name/ve/vectorcode/package.nix
@@ -92,20 +92,23 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "vectorcode";
-  version = "0.7.4";
+  version = "0.7.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Davidyz";
     repo = "VectorCode";
     tag = version;
-    hash = "sha256-N74XBQahUIj0rKJI0emtNvGlG9uYkeHqweppp8fUSLU=";
+    hash = "sha256-c8Wp/bP5KHDN/i2bMyiOQgnHDw8tPbg4IZIQ5Ut4SIo=";
   };
 
   build-system = with python.pkgs; [
     pdm-backend
   ];
 
+  pythonRelaxDeps = [
+    "posthog"
+  ];
   dependencies =
     with python.pkgs;
     [

From bd6de4f234337b6d8009af2a0099689636ae8429 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Wed, 9 Jul 2025 09:38:31 +1000
Subject: [PATCH 63/92] go_1_23: 1.23.10 -> 1.23.11

Changelog: https://go.dev/doc/devel/release#go1.23.11
---
 pkgs/development/compilers/go/1.23.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/go/1.23.nix b/pkgs/development/compilers/go/1.23.nix
index 2c8444823d00..76368433205b 100644
--- a/pkgs/development/compilers/go/1.23.nix
+++ b/pkgs/development/compilers/go/1.23.nix
@@ -27,11 +27,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.23.10";
+  version = "1.23.11";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-gAp64b/xeaIntlOi9kRRfIAEQ7i0q/MnOvXhy3ET3lk=";
+    hash = "sha256-KWOBYHpIOoqGZ9dpUzF1L5Sh8jHCBOJSfS8i4ePRJH0=";
   };
 
   strictDeps = true;

From 26a239fcb3ef5d79bcc4a4bce40e9395d00b2a06 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 8 Jul 2025 23:45:53 +0000
Subject: [PATCH 64/92] vsce: 3.5.0 -> 3.6.0

---
 pkgs/by-name/vs/vsce/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/vs/vsce/package.nix b/pkgs/by-name/vs/vsce/package.nix
index 1acd6064ceeb..764e7a0fa712 100644
--- a/pkgs/by-name/vs/vsce/package.nix
+++ b/pkgs/by-name/vs/vsce/package.nix
@@ -12,16 +12,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "vsce";
-  version = "3.5.0";
+  version = "3.6.0";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "vscode-vsce";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-55yiW2BJe0AlfHit8gpZJyZSHqVq6kywuEtZ5HGcfT0=";
+    hash = "sha256-6Tt7IewbCLHG8DVoD8PV6VmrNu3MCUHITgYFq9smvOo=";
   };
 
-  npmDepsHash = "sha256-tUboOVkZY4iag+36aJLbHGJqqlFE7fx8BXK50G7DJ64=";
+  npmDepsHash = "sha256-pZUDui2mhGe+My9QL+pqeBU16AyJ+/udULbo2EQjZd0=";
 
   postPatch = ''
     substituteInPlace package.json --replace-fail '"version": "0.0.0"' '"version": "${finalAttrs.version}"'

From b06760aafb06f179c241fbdaccc39b9fb4cff5fe Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 9 Jul 2025 00:03:56 +0000
Subject: [PATCH 65/92] libretro.mame2003-plus: 0-unstable-2025-05-16 ->
 0-unstable-2025-06-28

---
 .../applications/emulators/libretro/cores/mame2003-plus.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/libretro/cores/mame2003-plus.nix b/pkgs/applications/emulators/libretro/cores/mame2003-plus.nix
index e83c9b162354..bd72f0532a6d 100644
--- a/pkgs/applications/emulators/libretro/cores/mame2003-plus.nix
+++ b/pkgs/applications/emulators/libretro/cores/mame2003-plus.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mame2003-plus";
-  version = "0-unstable-2025-05-16";
+  version = "0-unstable-2025-06-28";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame2003-plus-libretro";
-    rev = "c478eae7484b76aaacc76659dd4d7b8e1163bc87";
-    hash = "sha256-l7GwSj7/A/1ZAAqWz1GtMDCl6F45GJqucDBD89yqcsU=";
+    rev = "04fb75e4f1291a490574168f3a04f9455e4a008d";
+    hash = "sha256-dMfLK47DojJwSvd7KMW0D0azgQalRW8mBJqYJHTA6ew=";
   };
 
   makefile = "Makefile";

From cb737057b6d6cfaf03e88e4e34db4b8235df35bb Mon Sep 17 00:00:00 2001
From: Heitor Augusto <IAm.HeitorALN@proton.me>
Date: Tue, 1 Jul 2025 14:34:00 -0300
Subject: [PATCH 66/92] beeref: init at 0.3.3

---
 pkgs/by-name/be/beeref/package.nix | 58 ++++++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)
 create mode 100644 pkgs/by-name/be/beeref/package.nix

diff --git a/pkgs/by-name/be/beeref/package.nix b/pkgs/by-name/be/beeref/package.nix
new file mode 100644
index 000000000000..d7595248c5ee
--- /dev/null
+++ b/pkgs/by-name/be/beeref/package.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+python3Packages.buildPythonApplication rec {
+  pname = "beeref";
+  version = "0.3.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "rbreu";
+    repo = "beeref";
+    tag = "v${version}";
+    hash = "sha256-GtxiJKj3tlzI1kVXzJg0LNAUcodXSna17ZvAtsAEH4M=";
+  };
+
+  build-system = [ python3Packages.setuptools ];
+
+  dependencies = with python3Packages; [
+    exif
+    lxml
+    pyqt6
+    rectangle-packer
+  ];
+
+  pythonRelaxDeps = [
+    "lxml"
+    "pyqt6"
+    "rectangle-packer"
+  ];
+
+  pythonRemoveDeps = [ "pyqt6-qt6" ];
+
+  pythonImportsCheck = [ "beeref" ];
+
+  # Tests fail with "Fatal Python error: Aborted" due to PyQt6 GUI initialization issues in sandbox
+  # Only versionCheckHook and pythonImportsCheck are used for basic validation
+  nativeCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    changelog = "https://github.com/rbreu/beeref/blob/v${version}/CHANGELOG.rst";
+    description = "Reference image viewer";
+    homepage = "https://beeref.org";
+    license = with lib.licenses; [
+      cc0
+      gpl3Only
+    ];
+    mainProgram = "beeref";
+    maintainers = with lib.maintainers; [ HeitorAugustoLN ];
+    platforms = lib.platforms.all;
+    sourceProvenance = [ lib.sourceTypes.fromSource ];
+  };
+}

From 802bb3674bcb6074c99dbe98f090912ac547fc73 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 9 Jul 2025 01:45:37 +0000
Subject: [PATCH 67/92] kubernetes-helm: 3.18.3 -> 3.18.4

---
 pkgs/applications/networking/cluster/helm/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/helm/default.nix b/pkgs/applications/networking/cluster/helm/default.nix
index 5a6fb4af2537..d3f9f85c6bc5 100644
--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@@ -9,15 +9,15 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubernetes-helm";
-  version = "3.18.3";
+  version = "3.18.4";
 
   src = fetchFromGitHub {
     owner = "helm";
     repo = "helm";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-V5gWzgsinT0hGFDocPlljH1ls8Z0j5cz37oPrB6LI9Y=";
+    sha256 = "sha256-2xOrTguenFzX7rvwm1ojSqV6ARCUSPUs07y3ut9Teec=";
   };
-  vendorHash = "sha256-r9DLYgEjxapUOAz+FCgYXqdE6APhGKO/YnshbLRmdrU=";
+  vendorHash = "sha256-Z3OAbuoeAtChd9Sk4bbzgwIxmFrw+/1c4zyxpNP0xXg=";
 
   subPackages = [ "cmd/helm" ];
   ldflags = [

From a31974dc25be1014a42580afa9c0323e0bbe2a5b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 9 Jul 2025 03:05:53 +0000
Subject: [PATCH 68/92] sourcegit: 2025.23 -> 2025.25

---
 pkgs/by-name/so/sourcegit/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/so/sourcegit/package.nix b/pkgs/by-name/so/sourcegit/package.nix
index 4fc18113d035..d3d2b2906aeb 100644
--- a/pkgs/by-name/so/sourcegit/package.nix
+++ b/pkgs/by-name/so/sourcegit/package.nix
@@ -21,13 +21,13 @@
 
 buildDotnetModule (finalAttrs: {
   pname = "sourcegit";
-  version = "2025.23";
+  version = "2025.25";
 
   src = fetchFromGitHub {
     owner = "sourcegit-scm";
     repo = "sourcegit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-q8w1AOVsj9zVGRQzn8paUnjH3VDf+2egVSjiH24q6zI=";
+    hash = "sha256-WPwvOfbCOCQBOvJU2HuGU9/Rh00MCmhZEaKn9Nr1Q0I=";
   };
 
   patches = [ ./fix-darwin-git-path.patch ];

From 3332ddd102a528b156b57f69f12dd15c476e6ce6 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Wed, 9 Jul 2025 13:20:31 +0800
Subject: [PATCH 69/92] wechat: 4.0.6.17-29381 -> 4.0.6.19-29383 for darwin

---
 pkgs/by-name/we/wechat/package.nix | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/we/wechat/package.nix b/pkgs/by-name/we/wechat/package.nix
index 793d857a2665..ca5db30472f3 100644
--- a/pkgs/by-name/we/wechat/package.nix
+++ b/pkgs/by-name/we/wechat/package.nix
@@ -28,13 +28,18 @@ let
   sources =
     let
       # https://dldir1.qq.com/weixin/mac/mac-release.xml
-      any-darwin = {
-        version = "4.0.6.17-29381";
-        src = fetchurl {
-          url = "https://dldir1v6.qq.com/weixin/Universal/Mac/xWeChatMac_universal_4.0.6.17_29381.dmg";
-          hash = "sha256-Fv5UYZ5+WfHvs+V3yiLSQitj++3WU+0GJsnIdlwB+TE=";
+      any-darwin =
+        let
+          version = "4.0.6.19-29383";
+          version' = lib.replaceString "-" "_" version;
+        in
+        {
+          inherit version;
+          src = fetchurl {
+            url = "https://dldir1v6.qq.com/weixin/Universal/Mac/xWeChatMac_universal_${version'}.dmg";
+            hash = "sha256-HloG++DGzsxM7C0AbN4PXkkzFdhUhBDcH5Vq+bTUuEE=";
+          };
         };
-      };
     in
     {
       aarch64-darwin = any-darwin;

From 1dcba47ef55717529748876b9eef5b8a9a341c50 Mon Sep 17 00:00:00 2001
From: Mutsuha Asada <me@momee.mt>
Date: Mon, 9 Jun 2025 08:14:10 +0900
Subject: [PATCH 70/92] ocamlPackages.kcas: 0.6.1 -> 0.7.0

Diff: https://github.com/ocaml-multicore/kcas/compare/0.6.1...0.7.0
Changelog: https://github.com/ocaml-multicore/kcas/releases/tag/0.7.0

ocamlPackages.kcas: add meta.longDescription and meta.changelog
---
 .../ocaml-modules/kcas/default.nix            | 23 ++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/ocaml-modules/kcas/default.nix b/pkgs/development/ocaml-modules/kcas/default.nix
index 7f7a12258baf..f1945790168c 100644
--- a/pkgs/development/ocaml-modules/kcas/default.nix
+++ b/pkgs/development/ocaml-modules/kcas/default.nix
@@ -5,28 +5,45 @@
   domain-local-await,
   domain-local-timeout,
   alcotest,
+  multicore-magic,
+  backoff,
+  domain_shims,
+  mdx,
 }:
 
 buildDunePackage rec {
   pname = "kcas";
-  version = "0.6.1";
+  version = "0.7.0";
+
+  minimalOCamlVersion = "4.13.0";
 
   src = fetchurl {
     url = "https://github.com/ocaml-multicore/kcas/releases/download/${version}/kcas-${version}.tbz";
-    hash = "sha256-u3Z8uAvITRUhOcB2EUYjWtpxIFJMvm2O/kyNr/AELWI=";
+    hash = "sha256-mo/otnkB79QdyVgLw1sZFfkR/Z/l15cRVfEYPPd6H5E=";
   };
 
   propagatedBuildInputs = [
     domain-local-await
     domain-local-timeout
+    multicore-magic
+    backoff
   ];
 
   doCheck = true;
-  checkInputs = [ alcotest ];
+  nativeCheckInputs = [ mdx.bin ];
+  checkInputs = [
+    alcotest
+    domain_shims
+    mdx
+  ];
 
   meta = {
     homepage = "https://github.com/ocaml-multicore/kcas";
     description = "STM based on lock-free MCAS";
+    longDescription = ''
+      A software transactional memory (STM) implementation based on an atomic lock-free multi-word compare-and-set (MCAS) algorithm enhanced with read-only compare operations and ability to block awaiting for changes.
+    '';
+    changelog = "https://raw.githubusercontent.com/ocaml-multicore/kcas/refs/tags/${version}/CHANGES.md";
     license = lib.licenses.isc;
     maintainers = [ lib.maintainers.vbgl ];
   };

From 5df61058510d82b7c8be3058c646dbfe9e54af13 Mon Sep 17 00:00:00 2001
From: Arsenii Zorin <me@wrb.bz>
Date: Tue, 8 Jul 2025 15:46:23 +0300
Subject: [PATCH 71/92] biome: add wrbbz to maintainers

---
 pkgs/by-name/bi/biome/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/bi/biome/package.nix b/pkgs/by-name/bi/biome/package.nix
index 82232fc576a7..9dd475ea8b1e 100644
--- a/pkgs/by-name/bi/biome/package.nix
+++ b/pkgs/by-name/bi/biome/package.nix
@@ -66,6 +66,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     maintainers = with lib.maintainers; [
       figsoda
       isabelroses
+      wrbbz
     ];
     mainProgram = "biome";
   };

From 1521c78a1cdb2dca55af456f41dba5b5c89eea49 Mon Sep 17 00:00:00 2001
From: Arsenii Zorin <me@wrb.bz>
Date: Tue, 8 Jul 2025 16:16:03 +0300
Subject: [PATCH 72/92] biome: 2.0.0 -> 2.1.1

---
 pkgs/by-name/bi/biome/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/bi/biome/package.nix b/pkgs/by-name/bi/biome/package.nix
index 9dd475ea8b1e..aeefd9e2fbd1 100644
--- a/pkgs/by-name/bi/biome/package.nix
+++ b/pkgs/by-name/bi/biome/package.nix
@@ -10,17 +10,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "biome";
-  version = "2.0.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "biomejs";
     repo = "biome";
     rev = "@biomejs/biome@${finalAttrs.version}";
-    hash = "sha256-2oHEaHKTyD+j34Or/Obb0pPGpEXEgSq6wowyYVV6DqI=";
+    hash = "sha256-ZnmMo3zUk+///avGQ497YNj9gChds4efpD88cjTr2JA=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-jh7LlX7Ip2oy5NcXHfFkGeyJVGeu4Y0HqN690bok+/E=";
+  cargoHash = "sha256-WIZrxQh83tebalDMa/2/d/+xFDe7uhpTf/Gmx1Kr55E=";
 
   nativeBuildInputs = [ pkg-config ];
 

From 7a52ef48cfa9f493e0efb606bbad143917c1af1b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 9 Jul 2025 06:47:55 +0000
Subject: [PATCH 73/92] terraform-local: 0.23.0 -> 0.24.0

---
 pkgs/by-name/te/terraform-local/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/te/terraform-local/package.nix b/pkgs/by-name/te/terraform-local/package.nix
index ddd13bbfd0cd..d5df70251297 100644
--- a/pkgs/by-name/te/terraform-local/package.nix
+++ b/pkgs/by-name/te/terraform-local/package.nix
@@ -5,12 +5,12 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "terraform_local";
-  version = "0.23.0";
+  version = "0.24.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-3GlXR2F28jpeXhFsJAH7yrKp8vrVhCozS8Ew6oi39P4=";
+    hash = "sha256-w+Jd8OPA5XjLw5zp8AEwHlPT5Or4z+elaW9pFKMR9OA=";
   };
 
   build-system = with python3Packages; [ setuptools ];

From 69aaa32b8626d387d0c5e1deec4db701b0f062ee Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 9 Jul 2025 07:06:44 +0000
Subject: [PATCH 74/92] gnunet: 0.24.2 -> 0.24.3

---
 pkgs/applications/networking/p2p/gnunet/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/p2p/gnunet/default.nix b/pkgs/applications/networking/p2p/gnunet/default.nix
index 37dbcb5cc1d5..849d94bb59e9 100644
--- a/pkgs/applications/networking/p2p/gnunet/default.nix
+++ b/pkgs/applications/networking/p2p/gnunet/default.nix
@@ -39,11 +39,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnunet";
-  version = "0.24.2";
+  version = "0.24.3";
 
   src = fetchurl {
     url = "mirror://gnu/gnunet/gnunet-${finalAttrs.version}.tar.gz";
-    hash = "sha256-Lk5KkH2UJ/DD3U1nlczq9yzPOX6dyWH2DtvvMAb2r0c=";
+    hash = "sha256-WwaJew6ESJu7Q4J47HPkNiRCsuBaY+QAI+wdDMzGxXY=";
   };
 
   enableParallelBuilding = true;

From 8968c9c5a3e6d0796a0adf549acd64926b0f73d1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 9 Jul 2025 07:17:13 +0000
Subject: [PATCH 75/92] goreleaser: 2.10.2 -> 2.11.0

---
 pkgs/by-name/go/goreleaser/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/go/goreleaser/package.nix b/pkgs/by-name/go/goreleaser/package.nix
index c77eaa932acc..18632603888a 100644
--- a/pkgs/by-name/go/goreleaser/package.nix
+++ b/pkgs/by-name/go/goreleaser/package.nix
@@ -10,16 +10,16 @@
 }:
 buildGoModule rec {
   pname = "goreleaser";
-  version = "2.10.2";
+  version = "2.11.0";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = "goreleaser";
     rev = "v${version}";
-    hash = "sha256-MryN6Qm/cedL/aIpf8Pxb4nPdH4iw9aW0mhEv5jBvUo=";
+    hash = "sha256-YneVW3oyDGhyliQefpqEsS9VLDGm+/chSxCyDifNrtk=";
   };
 
-  vendorHash = "sha256-s23FmEbtITW/PD64f8qecClC7SDp08VhC4bRpbgVrb0=";
+  vendorHash = "sha256-+6Icafqyig0xm5qZARn1a7Yu7UGi6ejJmzyvOIHsfH0=";
 
   ldflags = [
     "-s"

From e5724bdebe4246c3a5f6eafb225668f0541516b8 Mon Sep 17 00:00:00 2001
From: Mutsuha Asada <me@momee.mt>
Date: Mon, 9 Jun 2025 09:16:49 +0900
Subject: [PATCH 76/92] ocamlPackages.mmap: 1.1.0 -> 1.2.0

Changelog: https://github.com/mirage/mmap/releases/tag/v1.2.0
Diff: https://github.com/mirage/mmap/compare/v1.1.0...v1.2.0
---
 pkgs/development/ocaml-modules/mmap/default.nix | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/ocaml-modules/mmap/default.nix b/pkgs/development/ocaml-modules/mmap/default.nix
index ea9740494ad7..7eb032aa3c59 100644
--- a/pkgs/development/ocaml-modules/mmap/default.nix
+++ b/pkgs/development/ocaml-modules/mmap/default.nix
@@ -2,22 +2,27 @@
   lib,
   buildDunePackage,
   fetchurl,
+  bigarray-compat,
 }:
 
 buildDunePackage rec {
   pname = "mmap";
-  version = "1.1.0";
-
-  useDune2 = true;
+  version = "1.2.0";
 
   src = fetchurl {
-    url = "https://github.com/mirage/mmap/releases/download/v${version}/mmap-v${version}.tbz";
-    sha256 = "0l6waidal2n8mkdn74avbslvc10sf49f5d889n838z03pra5chsc";
+    url = "https://github.com/mirage/mmap/releases/download/v${version}/mmap-${version}.tbz";
+    hash = "sha256-FgKoq8jiMvqUdxpS5UDleAtAwvJ2Lu5q+9koZQIRbds=";
   };
 
+  propagatedBuildInputs = [ bigarray-compat ];
+
   meta = {
     homepage = "https://github.com/mirage/mmap";
     description = "Function for mapping files in memory";
+    longDescription = ''
+      This project provides a Mmap.map_file functions for mapping files in memory.
+    '';
+    changelog = "https://raw.githubusercontent.com/mirage/mmap/refs/tags/v${version}/CHANGES.md";
     license = lib.licenses.lgpl21;
     maintainers = [ lib.maintainers.vbgl ];
   };

From 50ded52850258008bc32dea3fc2c04b88b3231e8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ga=C3=ABl=20James?= <gaeljames@gmail.com>
Date: Mon, 7 Jul 2025 20:40:03 +0200
Subject: [PATCH 77/92] oterm: 0.12.1 -> 0.14.1

---
 pkgs/by-name/ot/oterm/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ot/oterm/package.nix b/pkgs/by-name/ot/oterm/package.nix
index a6edcabadeca..60575cd030e0 100644
--- a/pkgs/by-name/ot/oterm/package.nix
+++ b/pkgs/by-name/ot/oterm/package.nix
@@ -9,14 +9,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "oterm";
-  version = "0.12.1";
+  version = "0.14.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ggozad";
     repo = "oterm";
     tag = version;
-    hash = "sha256-6y73Lh3cV/fnvpZWzfyD4CletC4UV2zl+I7l88BYPIk=";
+    hash = "sha256-Fkr0oabFSkgUkqO3cqZANP3xUSD0uO2F8I/VEzkhvis=";
   };
 
   pythonRelaxDeps = [

From 8219113d2ed68693aeae62659a456faa172870bd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 9 Jul 2025 07:41:14 +0000
Subject: [PATCH 78/92] mdbook-alerts: 0.7.0 -> 0.8.0

---
 pkgs/by-name/md/mdbook-alerts/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/md/mdbook-alerts/package.nix b/pkgs/by-name/md/mdbook-alerts/package.nix
index 22fde5a1ee22..6ab949650854 100644
--- a/pkgs/by-name/md/mdbook-alerts/package.nix
+++ b/pkgs/by-name/md/mdbook-alerts/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-alerts";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "lambdalisue";
     repo = "rs-mdbook-alerts";
     rev = "v${version}";
-    hash = "sha256-MZS9TESITj3tzdaXYu5S2QUCW7cZuTpH1skFKeVi/sQ=";
+    hash = "sha256-82WbO/j9F0WKGkSkTf27dGdxdHF3OONFvn68ujWMwSM=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-ZL8M9Ces8qs8ClayjJTt5FvlG+WcRpJLuZBNATEbLtQ=";
+  cargoHash = "sha256-A+jodjynhQ6WFp/Ci5Jk0+baDx6QzJ8u+UMmLugtJUc=";
 
   meta = {
     description = "Preprocessor for mdbook to support the inclusion of Markdown alerts";

From 234af4161bc52dc9328eb4208bec13fc4790d693 Mon Sep 17 00:00:00 2001
From: Kenichi Kamiya <kachick1@gmail.com>
Date: Wed, 9 Jul 2025 15:13:19 +0900
Subject: [PATCH 79/92] oku: generalize executable

Binary cache from https://hydra.nixos.org/build/301557563
coredumps on non-AVX-512 devices.

Improved this comment by Prince213

Co-authored-by: Sizhe Zhao <prc.zhao@outlook.com>
---
 pkgs/by-name/ok/oku/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/ok/oku/package.nix b/pkgs/by-name/ok/oku/package.nix
index cfef18cd733c..08dcd44594a9 100644
--- a/pkgs/by-name/ok/oku/package.nix
+++ b/pkgs/by-name/ok/oku/package.nix
@@ -25,6 +25,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-utbey8DFXUWU6u2H2unNjCHE3/bwhPdrxAOApC+unGA=";
   };
 
+  # Avoiding optimizations for reproducibility
+  prePatch = ''
+    substituteInPlace .cargo/config.toml \
+      --replace-fail '"-C", "target-cpu=native", ' ""
+  '';
+
   cargoHash = "sha256-rwf9jdr+RDpUcTEG7Xhpph0zuyz6tdFx6hWEZRuxkTY=";
 
   nativeBuildInputs = [

From b879c671091aca4ac1cc8d8a664f8db75e59669b Mon Sep 17 00:00:00 2001
From: Ivan Mincik <ivan.mincik@gmail.com>
Date: Wed, 9 Jul 2025 10:38:23 +0200
Subject: [PATCH 80/92] teams/geospatial: update team description

---
 maintainers/team-list.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 2cf64879652b..07c3bb3ab881 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -478,7 +478,7 @@ with lib.maintainers;
       willcohen
     ];
     githubTeams = [ "geospatial" ];
-    scope = "Maintain geospatial packages.";
+    scope = "Maintain geospatial, remote sensing and OpenStreetMap software.";
     shortName = "Geospatial";
     enableFeatureFreezePing = true;
   };

From f548a3009647abdd240289596ee6c942466cd2cf Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 9 Jul 2025 08:52:19 +0000
Subject: [PATCH 81/92] codebook: 0.3.3 -> 0.3.5

---
 pkgs/by-name/co/codebook/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/co/codebook/package.nix b/pkgs/by-name/co/codebook/package.nix
index a3fab9601180..695f74af899b 100644
--- a/pkgs/by-name/co/codebook/package.nix
+++ b/pkgs/by-name/co/codebook/package.nix
@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codebook";
-  version = "0.3.3";
+  version = "0.3.5";
 
   src = fetchFromGitHub {
     owner = "blopker";
     repo = "codebook";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9tXzruyISC+JdzV4aPBB31OCKgZVAO0eU3SsgAZy/+I=";
+    hash = "sha256-lQfk4dJ9WFraxMDWJVSBiTGumikfHYlMBe+0NHa/3nY=";
   };
 
   buildAndTestSubdir = "crates/codebook-lsp";
-  cargoHash = "sha256-Bba5v0J5HRaylQRHV41LQ2My0zYybme/AHZ+HDekoHc=";
+  cargoHash = "sha256-MLd7V5Pp8yx4pFAXSjZf4KUGp964ombrnGKbrtXhC0I=";
 
   # Integration tests require internet access for dictionaries
   doCheck = false;

From 6df8184d859ee8c714134174a04338bf2f570d80 Mon Sep 17 00:00:00 2001
From: Louis Bailleau <louis13.bailleau@gmail.com>
Date: Wed, 9 Jul 2025 10:59:31 +0200
Subject: [PATCH 82/92] microsoft-edge: 138.0.3351.65 -> 138.0.3351.77

---
 pkgs/by-name/mi/microsoft-edge/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mi/microsoft-edge/package.nix b/pkgs/by-name/mi/microsoft-edge/package.nix
index 81d6d647cd59..de3ebc0f46f5 100644
--- a/pkgs/by-name/mi/microsoft-edge/package.nix
+++ b/pkgs/by-name/mi/microsoft-edge/package.nix
@@ -179,11 +179,11 @@ in
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "microsoft-edge";
-  version = "138.0.3351.65";
+  version = "138.0.3351.77";
 
   src = fetchurl {
     url = "https://packages.microsoft.com/repos/edge/pool/main/m/microsoft-edge-stable/microsoft-edge-stable_${finalAttrs.version}-1_amd64.deb";
-    hash = "sha256-+8bV3pwoYvp4e0eJHj5/NSu15QiFwVJuGxFJkS76gwI=";
+    hash = "sha256-8D0aYlzkp5ol7s6m1342BJONiiQgyZeClREFw0mZqHY=";
   };
 
   # With strictDeps on, some shebangs were not being patched correctly

From 9bbcfea275cb154aa753ff794d12cb5214bb8484 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Thu, 12 Jun 2025 09:36:58 +1000
Subject: [PATCH 83/92] go_1_25: init at 1.25rc2

---
 pkgs/development/compilers/go/1.25.nix        | 173 ++++++++++++++++++
 .../compilers/go/iana-etc-1.25.patch          |  26 +++
 pkgs/top-level/all-packages.nix               |   5 +
 3 files changed, 204 insertions(+)
 create mode 100644 pkgs/development/compilers/go/1.25.nix
 create mode 100644 pkgs/development/compilers/go/iana-etc-1.25.patch

diff --git a/pkgs/development/compilers/go/1.25.nix b/pkgs/development/compilers/go/1.25.nix
new file mode 100644
index 000000000000..b5cbfd3aa802
--- /dev/null
+++ b/pkgs/development/compilers/go/1.25.nix
@@ -0,0 +1,173 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  apple-sdk_12,
+  tzdata,
+  replaceVars,
+  iana-etc,
+  mailcap,
+  buildPackages,
+  pkgsBuildTarget,
+  targetPackages,
+  testers,
+  skopeo,
+  buildGo125Module,
+}:
+
+let
+  goBootstrap = buildPackages.callPackage ./bootstrap122.nix { };
+
+  skopeoTest = skopeo.override { buildGoModule = buildGo125Module; };
+
+  # We need a target compiler which is still runnable at build time,
+  # to handle the cross-building case where build != host == target
+  targetCC = pkgsBuildTarget.targetPackages.stdenv.cc;
+
+  isCross = stdenv.buildPlatform != stdenv.targetPlatform;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "go";
+  version = "1.25rc2";
+
+  src = fetchurl {
+    url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
+    hash = "sha256-5jFKMjTEwDuNAGvNHRRZTZKBcNGES23/3V+lojM0SeE=";
+  };
+
+  strictDeps = true;
+  buildInputs =
+    [ ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [ stdenv.cc.libc.out ]
+    ++ lib.optionals (stdenv.hostPlatform.libc == "glibc") [ stdenv.cc.libc.static ];
+
+  depsTargetTargetPropagated = lib.optionals stdenv.targetPlatform.isDarwin [
+    apple-sdk_12
+  ];
+
+  depsBuildTarget = lib.optional isCross targetCC;
+
+  depsTargetTarget = lib.optional stdenv.targetPlatform.isWindows targetPackages.threads.package;
+
+  postPatch = ''
+    patchShebangs .
+  '';
+
+  patches = [
+    (replaceVars ./iana-etc-1.25.patch {
+      iana = iana-etc;
+    })
+    # Patch the mimetype database location which is missing on NixOS.
+    # but also allow static binaries built with NixOS to run outside nix
+    (replaceVars ./mailcap-1.17.patch {
+      inherit mailcap;
+    })
+    # prepend the nix path to the zoneinfo files but also leave the original value for static binaries
+    # that run outside a nix server
+    (replaceVars ./tzdata-1.19.patch {
+      inherit tzdata;
+    })
+    ./remove-tools-1.11.patch
+    ./go_no_vendor_checks-1.23.patch
+  ];
+
+  inherit (stdenv.targetPlatform.go) GOOS GOARCH GOARM;
+  # GOHOSTOS/GOHOSTARCH must match the building system, not the host system.
+  # Go will nevertheless build a for host system that we will copy over in
+  # the install phase.
+  GOHOSTOS = stdenv.buildPlatform.go.GOOS;
+  GOHOSTARCH = stdenv.buildPlatform.go.GOARCH;
+
+  # {CC,CXX}_FOR_TARGET must be only set for cross compilation case as go expect those
+  # to be different from CC/CXX
+  CC_FOR_TARGET = if isCross then "${targetCC}/bin/${targetCC.targetPrefix}cc" else null;
+  CXX_FOR_TARGET = if isCross then "${targetCC}/bin/${targetCC.targetPrefix}c++" else null;
+
+  GO386 = "softfloat"; # from Arch: don't assume sse2 on i686
+  # Wasi does not support CGO
+  CGO_ENABLED = if stdenv.targetPlatform.isWasi then 0 else 1;
+
+  GOROOT_BOOTSTRAP = "${goBootstrap}/share/go";
+
+  buildPhase = ''
+    runHook preBuild
+    export GOCACHE=$TMPDIR/go-cache
+
+    export PATH=$(pwd)/bin:$PATH
+
+    ${lib.optionalString isCross ''
+      # Independent from host/target, CC should produce code for the building system.
+      # We only set it when cross-compiling.
+      export CC=${buildPackages.stdenv.cc}/bin/cc
+    ''}
+    ulimit -a
+
+    pushd src
+    ./make.bash
+    popd
+    runHook postBuild
+  '';
+
+  preInstall =
+    ''
+      # Contains the wrong perl shebang when cross compiling,
+      # since it is not used for anything we can deleted as well.
+      rm src/regexp/syntax/make_perl_groups.pl
+    ''
+    + (
+      if (stdenv.buildPlatform.system != stdenv.hostPlatform.system) then
+        ''
+          mv bin/*_*/* bin
+          rmdir bin/*_*
+          ${lib.optionalString
+            (!(finalAttrs.GOHOSTARCH == finalAttrs.GOARCH && finalAttrs.GOOS == finalAttrs.GOHOSTOS))
+            ''
+              rm -rf pkg/${finalAttrs.GOHOSTOS}_${finalAttrs.GOHOSTARCH} pkg/tool/${finalAttrs.GOHOSTOS}_${finalAttrs.GOHOSTARCH}
+            ''
+          }
+        ''
+      else
+        lib.optionalString (stdenv.hostPlatform.system != stdenv.targetPlatform.system) ''
+          rm -rf bin/*_*
+          ${lib.optionalString
+            (!(finalAttrs.GOHOSTARCH == finalAttrs.GOARCH && finalAttrs.GOOS == finalAttrs.GOHOSTOS))
+            ''
+              rm -rf pkg/${finalAttrs.GOOS}_${finalAttrs.GOARCH} pkg/tool/${finalAttrs.GOOS}_${finalAttrs.GOARCH}
+            ''
+          }
+        ''
+    );
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/share/go
+    cp -a bin pkg src lib misc api doc go.env VERSION $out/share/go
+    mkdir -p $out/bin
+    ln -s $out/share/go/bin/* $out/bin
+    runHook postInstall
+  '';
+
+  disallowedReferences = [ goBootstrap ];
+
+  passthru = {
+    inherit goBootstrap skopeoTest;
+    tests = {
+      skopeo = testers.testVersion { package = skopeoTest; };
+      version = testers.testVersion {
+        package = finalAttrs.finalPackage;
+        command = "go version";
+        version = "go${finalAttrs.version}";
+      };
+    };
+  };
+
+  meta = with lib; {
+    changelog = "https://go.dev/doc/devel/release#go${lib.versions.majorMinor finalAttrs.version}";
+    description = "Go Programming language";
+    homepage = "https://go.dev/";
+    license = licenses.bsd3;
+    teams = [ teams.golang ];
+    platforms = platforms.darwin ++ platforms.linux ++ platforms.wasi ++ platforms.freebsd;
+    mainProgram = "go";
+  };
+})
diff --git a/pkgs/development/compilers/go/iana-etc-1.25.patch b/pkgs/development/compilers/go/iana-etc-1.25.patch
new file mode 100644
index 000000000000..2922dadaea54
--- /dev/null
+++ b/pkgs/development/compilers/go/iana-etc-1.25.patch
@@ -0,0 +1,26 @@
+diff --git a/src/net/lookup_unix.go b/src/net/lookup_unix.go
+index 7416cb01f8..62722cab14 100644
+--- a/src/net/lookup_unix.go
++++ b/src/net/lookup_unix.go
+@@ -15,7 +15,7 @@ import (
+ // readProtocolsOnce loads contents of /etc/protocols into protocols map
+ // for quick access.
+ var readProtocolsOnce = sync.OnceFunc(func() {
+-	file, err := open("/etc/protocols")
++	file, err := open("@iana@/etc/protocols")
+ 	if err != nil {
+ 		return
+ 	}
+diff --git a/src/net/port_unix.go b/src/net/port_unix.go
+index df73dbabb3..a5dcf2ca1c 100644
+--- a/src/net/port_unix.go
++++ b/src/net/port_unix.go
+@@ -16,7 +16,7 @@ import (
+ var onceReadServices sync.Once
+ 
+ func readServices() {
+-	file, err := open("/etc/services")
++	file, err := open("@iana@/etc/services")
+ 	if err != nil {
+ 		return
+ 	}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 874e476d468b..084347f49901 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9827,6 +9827,11 @@ with pkgs;
     go = buildPackages.go_1_24;
   };
 
+  go_1_25 = callPackage ../development/compilers/go/1.25.nix { };
+  buildGo125Module = callPackage ../build-support/go/module.nix {
+    go = buildPackages.go_1_25;
+  };
+
   ### DEVELOPMENT / HARE
 
   hareHook = callPackage ../by-name/ha/hare/hook.nix { };

From 699c5626beb79e9a27efcdf0de379f3f3c5518d3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 9 Jul 2025 09:04:46 +0000
Subject: [PATCH 84/92] firebase-tools: 14.7.0 -> 14.9.0

---
 pkgs/by-name/fi/firebase-tools/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fi/firebase-tools/package.nix b/pkgs/by-name/fi/firebase-tools/package.nix
index e4eb04fffded..2979704c856d 100644
--- a/pkgs/by-name/fi/firebase-tools/package.nix
+++ b/pkgs/by-name/fi/firebase-tools/package.nix
@@ -10,16 +10,16 @@
 
 buildNpmPackage rec {
   pname = "firebase-tools";
-  version = "14.7.0";
+  version = "14.9.0";
 
   src = fetchFromGitHub {
     owner = "firebase";
     repo = "firebase-tools";
     tag = "v${version}";
-    hash = "sha256-sZQoP6XsJkDI6I41eQv678aDtHhaRX6u03z/D6S7nBQ=";
+    hash = "sha256-LUPG0FiwOvC+4ZXkrGGHnayusg06QvIw96Jg0ug+UBQ=";
   };
 
-  npmDepsHash = "sha256-QrJgImV7YCzME/ZwzwJP3FFvonmvCSm0hd9fLc8gyyk=";
+  npmDepsHash = "sha256-g6tcBNzCr5lOR874qAGPAuG8WBManHYY40GKqsrBEJM=";
 
   postPatch = ''
     ln -s npm-shrinkwrap.json package-lock.json

From 080d774e8e8f4bdd6d3ade68f79f5c297946c174 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 9 Jul 2025 09:07:54 +0000
Subject: [PATCH 85/92] shogihome: 1.23.2 -> 1.24.0

---
 pkgs/by-name/sh/shogihome/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/sh/shogihome/package.nix b/pkgs/by-name/sh/shogihome/package.nix
index 02459a2d722e..d5537e1d66de 100644
--- a/pkgs/by-name/sh/shogihome/package.nix
+++ b/pkgs/by-name/sh/shogihome/package.nix
@@ -4,7 +4,7 @@
   buildNpmPackage,
   fetchFromGitHub,
   makeWrapper,
-  electron_36,
+  electron_37,
   vulkan-loader,
   makeDesktopItem,
   copyDesktopItems,
@@ -18,20 +18,20 @@
 }:
 
 let
-  electron = electron_36;
+  electron = electron_37;
 in
 buildNpmPackage (finalAttrs: {
   pname = "shogihome";
-  version = "1.23.2";
+  version = "1.24.0";
 
   src = fetchFromGitHub {
     owner = "sunfish-shogi";
     repo = "shogihome";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tZw9iEhZ5ss+mv/WUFaj+xQ6GP4GAHq+PvBOv6F5tgM=";
+    hash = "sha256-8tHKU/6jEyt3o7kbYyhYfQY7luLbX01U7EtK4eEHh+M=";
   };
 
-  npmDepsHash = "sha256-dx66k82o+TWrrK9xBHPbnudDn0CG8mM7c1xeoSAM4Fs=";
+  npmDepsHash = "sha256-QARCfpeC19iCpnllHlzAS3Ey9Sj35QQCsPA+/JdzLjM=";
 
   postPatch = ''
     substituteInPlace package.json \

From 7dd066b749b7a70151846c532594219fd44b6ab6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 9 Jul 2025 09:13:02 +0000
Subject: [PATCH 86/92] python3Packages.craft-parts: 2.15.0 -> 2.16.0

---
 pkgs/development/python-modules/craft-parts/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/craft-parts/default.nix b/pkgs/development/python-modules/craft-parts/default.nix
index 5b91e3fc3f89..845d4e92252d 100644
--- a/pkgs/development/python-modules/craft-parts/default.nix
+++ b/pkgs/development/python-modules/craft-parts/default.nix
@@ -30,7 +30,7 @@
 
 buildPythonPackage rec {
   pname = "craft-parts";
-  version = "2.15.0";
+  version = "2.16.0";
 
   pyproject = true;
 
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "canonical";
     repo = "craft-parts";
     tag = version;
-    hash = "sha256-UW4VdJvEG4w7CM5aj1OKK91nsywQgsguJ+tnhEbqwYA=";
+    hash = "sha256-JuFx5Ap2ioYsc20E5Ho4z+/DFs7d+OBF3XLlOOZ10Zk=";
   };
 
   patches = [ ./bash-path.patch ];

From 5e20b5940b7b94b37362f159e37178b5f1be5d46 Mon Sep 17 00:00:00 2001
From: Dyson <dyson.dyson@icloud.com>
Date: Wed, 9 Jul 2025 09:51:55 +0000
Subject: [PATCH 87/92] fahclient: 8.3.18 -> 8.4.9 (#423651)

---
 pkgs/applications/science/misc/foldingathome/client.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/science/misc/foldingathome/client.nix b/pkgs/applications/science/misc/foldingathome/client.nix
index 24de920d1ddc..4c2ffc4b6439 100644
--- a/pkgs/applications/science/misc/foldingathome/client.nix
+++ b/pkgs/applications/science/misc/foldingathome/client.nix
@@ -15,13 +15,13 @@
 }:
 let
   pname = "fah-client";
-  version = "8.3.18";
+  version = "8.4.9";
 
   cbangSrc = fetchFromGitHub {
     owner = "cauldrondevelopmentllc";
     repo = "cbang";
     rev = "bastet-v${version}";
-    sha256 = "sha256-BQNomjz6Bhod3FOC5iICwt1rPrZgIxGQ08yspSvAnJc=";
+    sha256 = "sha256-xApE5m8YyIFRJLQYeboWelWukuuIjHNZxPDyq0RzSL4=";
   };
 
   fah-client = stdenv.mkDerivation {
@@ -31,7 +31,7 @@ let
       owner = "FoldingAtHome";
       repo = "fah-client-bastet";
       rev = "v${version}";
-      sha256 = "sha256-lqpC1fAMFb8iX02daVre/pE0c7DkwswlFigJS3ZGEjM=";
+      sha256 = "sha256-PewXhmkTru2yJhMkenbn7pcmVsa7eomjrMvs1PUGph8=";
     };
 
     nativeBuildInputs = [

From 132526a19c8e1958a4b2ef35e779aabca7cb50a6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 8 Jul 2025 22:57:52 +0000
Subject: [PATCH 88/92] hyprutils: 0.7.1 -> 0.8.1

---
 pkgs/by-name/hy/hyprutils/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/hy/hyprutils/package.nix b/pkgs/by-name/hy/hyprutils/package.nix
index 60354ad36f88..b270e2f3785c 100644
--- a/pkgs/by-name/hy/hyprutils/package.nix
+++ b/pkgs/by-name/hy/hyprutils/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprutils";
-  version = "0.7.1";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprutils";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-W9G9bb0zRYDBRseHbVez0J8qVpD5QbizX67H/vsudhM=";
+    hash = "sha256-F2SV9WGqgtRsXIdUrl3sRe0wXlQD+kRRZcSfbepjPJY=";
   };
 
   nativeBuildInputs = [

From 29ef9ed91c43eae942490f4b17ca176bc19bf621 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 7 Jul 2025 07:29:42 +0000
Subject: [PATCH 89/92] libpulsar: 3.7.1 -> 3.7.2

---
 pkgs/development/libraries/libpulsar/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libpulsar/default.nix b/pkgs/development/libraries/libpulsar/default.nix
index 8d8f88f7e907..3e8c5059def7 100644
--- a/pkgs/development/libraries/libpulsar/default.nix
+++ b/pkgs/development/libraries/libpulsar/default.nix
@@ -48,13 +48,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "libpulsar";
-  version = "3.7.1";
+  version = "3.7.2";
 
   src = fetchFromGitHub {
     owner = "apache";
     repo = "pulsar-client-cpp";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-RHWi0KCq7U7Dr3Ic7kduc8P64VpAThTQ3lDxLLEqzIU=";
+    hash = "sha256-3kUyimyv0Si3zUFaIsIVdulzH8l2fxe6BO9a5L6n8I8=";
   };
 
   nativeBuildInputs =

From bd64cb6cbff9cbd1b1df3417cb74ac9438c1af89 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 7 Jul 2025 23:42:39 +0000
Subject: [PATCH 90/92] python3Packages.pypdf: 5.6.1 -> 5.7.0

---
 pkgs/development/python-modules/pypdf/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pypdf/default.nix b/pkgs/development/python-modules/pypdf/default.nix
index ec10d3d3e3cc..84fc92953b59 100644
--- a/pkgs/development/python-modules/pypdf/default.nix
+++ b/pkgs/development/python-modules/pypdf/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "pypdf";
-  version = "5.6.1";
+  version = "5.7.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     tag = version;
     # fetch sample files used in tests
     fetchSubmodules = true;
-    hash = "sha256-+/tb370yraT78wGeLc0WVYQ5/SE9PBXMtuazGLiaAJc=";
+    hash = "sha256-O1kV9VKbI3MFsWvr3jrDg9rJ0G+92ny0v7g4Xx/1ytM=";
   };
 
   outputs = [

From 0e7e96577894789636429be3bf694e30a24b92d6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 9 Jul 2025 10:57:54 +0000
Subject: [PATCH 91/92] spectra: 1.1.0 -> 1.2.0

---
 pkgs/by-name/sp/spectra/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sp/spectra/package.nix b/pkgs/by-name/sp/spectra/package.nix
index 9db8b068fb3f..b426f0b6eea7 100644
--- a/pkgs/by-name/sp/spectra/package.nix
+++ b/pkgs/by-name/sp/spectra/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spectra";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "yixuan";
     repo = "spectra";
     rev = "v${version}";
-    sha256 = "sha256-ut6nEOpzIoFy+IUWQy9x2pJ4+sA0d/Dt8WaNq5AFCFg=";
+    sha256 = "sha256-lfbOwnTP3GrN/1N/tyMXZrtEHIxAq3EjuHS8M+I87to=";
   };
 
   nativeBuildInputs = [ cmake ];

From c8723acd6a1488082520a0f22e2692322fdcc7d4 Mon Sep 17 00:00:00 2001
From: Pierre Roux <pierre.roux@onera.fr>
Date: Wed, 9 Jul 2025 13:24:20 +0200
Subject: [PATCH 92/92] coqPackages.*: more 9.0 -> 9.1

---
 .../coq-modules/ElmExtraction/default.nix     |  2 +-
 .../coq-modules/RustExtraction/default.nix    | 25 ++++++++-----------
 .../coq-modules/coq-record-update/default.nix |  2 +-
 .../coq-modules/coquelicot/default.nix        |  2 +-
 .../coq-modules/fcsl-pcm/default.nix          |  2 +-
 .../development/coq-modules/flocq/default.nix |  2 +-
 .../coq-modules/jasmin/default.nix            |  2 +-
 .../vscoq-language-server/default.nix         | 23 ++++++-----------
 8 files changed, 24 insertions(+), 36 deletions(-)

diff --git a/pkgs/development/coq-modules/ElmExtraction/default.nix b/pkgs/development/coq-modules/ElmExtraction/default.nix
index 5213e23bfc60..c90c128ba5d2 100644
--- a/pkgs/development/coq-modules/ElmExtraction/default.nix
+++ b/pkgs/development/coq-modules/ElmExtraction/default.nix
@@ -32,7 +32,7 @@ mkCoqDerivation {
         metacoq.version
       ]
       [
-        (case (range "8.17" "9.1") (range "1.3.1" "1.3.4") "0.1.1")
+        (case (range "8.17" "9.0") (range "1.3.1" "1.3.4") "0.1.1")
       ]
       null;
 
diff --git a/pkgs/development/coq-modules/RustExtraction/default.nix b/pkgs/development/coq-modules/RustExtraction/default.nix
index 6f2171bf0875..7cddfbf14b0e 100644
--- a/pkgs/development/coq-modules/RustExtraction/default.nix
+++ b/pkgs/development/coq-modules/RustExtraction/default.nix
@@ -16,6 +16,15 @@ mkCoqDerivation {
 
   inherit version;
   defaultVersion =
+    let
+      case = coq: mc: out: {
+        cases = [
+          coq
+          mc
+        ];
+        inherit out;
+      };
+    in
     with versions;
     switch
       [
@@ -23,20 +32,8 @@ mkCoqDerivation {
         metacoq.version
       ]
       [
-        {
-          cases = [
-            (range "8.17" "8.19")
-            (range "1.3.1" "1.3.3")
-          ];
-          out = "0.1.0";
-        }
-        {
-          cases = [
-            (range "8.20" "9.0")
-            (range "1.3.2" "1.3.4")
-          ];
-          out = "0.1.1";
-        }
+        (case (range "8.20" "9.0") (range "1.3.2" "1.3.4") "0.1.1")
+        (case (range "8.17" "8.19") (range "1.3.1" "1.3.3") "0.1.0")
       ]
       null;
 
diff --git a/pkgs/development/coq-modules/coq-record-update/default.nix b/pkgs/development/coq-modules/coq-record-update/default.nix
index c1e125b509ac..e8bfcc2bfff1 100644
--- a/pkgs/development/coq-modules/coq-record-update/default.nix
+++ b/pkgs/development/coq-modules/coq-record-update/default.nix
@@ -15,7 +15,7 @@ mkCoqDerivation {
     in
     with lib.versions;
     lib.switch coq.coq-version [
-      (case (range "8.10" "9.0") "0.3.4")
+      (case (range "8.10" "9.1") "0.3.4")
     ] null;
   release."0.3.4".sha256 = "sha256-AhEcugUiVIsgbq884Lur/bQIuGw8prk+3AlNkP1omcw=";
   release."0.3.3".sha256 = "sha256-HDIPeFHiC9EwhiOH7yMGJ9d2zJMhboTpRGf9kWcB9Io=";
diff --git a/pkgs/development/coq-modules/coquelicot/default.nix b/pkgs/development/coq-modules/coquelicot/default.nix
index b9f3ff50a27c..ac3fd2e054f6 100644
--- a/pkgs/development/coq-modules/coquelicot/default.nix
+++ b/pkgs/development/coq-modules/coquelicot/default.nix
@@ -19,7 +19,7 @@ mkCoqDerivation {
     in
     with lib.versions;
     lib.switch coq.coq-version [
-      (case (range "8.12" "9.0") "3.4.3")
+      (case (range "8.12" "9.1") "3.4.3")
       (case (range "8.12" "8.20") "3.4.2")
       (case (range "8.12" "8.18") "3.4.0")
       (case (range "8.12" "8.17") "3.3.0")
diff --git a/pkgs/development/coq-modules/fcsl-pcm/default.nix b/pkgs/development/coq-modules/fcsl-pcm/default.nix
index 98c743ad06cc..8b32371446d3 100644
--- a/pkgs/development/coq-modules/fcsl-pcm/default.nix
+++ b/pkgs/development/coq-modules/fcsl-pcm/default.nix
@@ -26,7 +26,7 @@ mkCoqDerivation {
     lib.switch
       [ coq.coq-version mathcomp-algebra.version ]
       [
-        (case (range "9.0" "9.0") (range "2.4.0" "2.4.0") "2.2.0")
+        (case (range "9.0" "9.1") (range "2.4.0" "2.4.0") "2.2.0")
       ]
       null;
   release."2.2.0".sha256 = "sha256-VnfK+RHWiq27hxEJ9stpVp609/dMiPH6UHFhzaHdAnM=";
diff --git a/pkgs/development/coq-modules/flocq/default.nix b/pkgs/development/coq-modules/flocq/default.nix
index 1d7871089fa9..c7b44e391926 100644
--- a/pkgs/development/coq-modules/flocq/default.nix
+++ b/pkgs/development/coq-modules/flocq/default.nix
@@ -19,7 +19,7 @@ mkCoqDerivation {
     in
     with lib.versions;
     lib.switch coq.coq-version [
-      (case (range "8.15" "9.0") "4.2.1")
+      (case (range "8.15" "9.1") "4.2.1")
       (case (range "8.14" "8.20") "4.2.0")
       (case (range "8.14" "8.18") "4.1.3")
       (case (range "8.14" "8.17") "4.1.1")
diff --git a/pkgs/development/coq-modules/jasmin/default.nix b/pkgs/development/coq-modules/jasmin/default.nix
index d7545d9bba62..1743ff667328 100644
--- a/pkgs/development/coq-modules/jasmin/default.nix
+++ b/pkgs/development/coq-modules/jasmin/default.nix
@@ -27,7 +27,7 @@ mkCoqDerivation {
     lib.switch
       [ coq.coq-version mathcomp.version ]
       [
-        (case (range "8.19" "9.0") (range "2.2" "2.4") "2025.02.0")
+        (case (range "8.19" "9.1") (range "2.2" "2.4") "2025.02.0")
         (case (isEq "8.18") (isEq "2.2") "2024.07.2")
       ]
       null;
diff --git a/pkgs/development/coq-modules/vscoq-language-server/default.nix b/pkgs/development/coq-modules/vscoq-language-server/default.nix
index f4fd8e2ecb29..a17ecfe91d36 100644
--- a/pkgs/development/coq-modules/vscoq-language-server/default.nix
+++ b/pkgs/development/coq-modules/vscoq-language-server/default.nix
@@ -11,24 +11,15 @@
 let
   ocamlPackages = coq.ocamlPackages;
   defaultVersion =
+    let
+      case = case: out: { inherit case out; };
+    in
     with lib.versions;
     lib.switch coq.coq-version [
-      {
-        case = range "8.18" "9.0";
-        out = "2.2.6";
-      }
-      {
-        case = range "8.18" "8.20";
-        out = "2.2.1";
-      }
-      {
-        case = range "8.18" "8.19";
-        out = "2.1.2";
-      }
-      {
-        case = isEq "8.18";
-        out = "2.0.3+coq8.18";
-      }
+      (case (range "8.18" "9.1") "2.2.6")
+      (case (range "8.18" "8.20") "2.2.1")
+      (case (range "8.18" "8.19") "2.1.2")
+      (case (isEq "8.18") "2.0.3+coq8.18")
     ] null;
   location = {
     domain = "github.com";