Merge staging-next into staging

2025-06-23 11:08:00 +00:00 · 2025-06-23 11:08:00 +00:00 · 83cd50533d
commit 83cd50533d
parent 4f7f72523b a8d3ccea20
74 changed files with 922 additions and 552 deletions
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@ -43,6 +43,11 @@ jobs:
          ref: ${{ github.event.pull_request.head.sha }}
          token: ${{ steps.app-token.outputs.token }}

+      - name: Log current API rate limits
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: gh api /rate_limit | jq
+
      - name: Create backport PRs
        id: backport
        uses: korthout/backport-action@436145e922f9561fc5ea157ff406f21af2d6b363 # v3.2.0
@ -56,6 +61,11 @@ jobs:
            * [ ] Before merging, ensure that this backport is [acceptable for the release](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#changes-acceptable-for-releases).
              * Even as a non-committer, if you find that it is not acceptable, leave a comment.

+      - name: Log current API rate limits
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: gh api /rate_limit | jq
+
      - name: "Add 'has: port to stable' label"
        if: steps.backport.outputs.created_pull_numbers != ''
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@ -3,6 +3,9 @@ name: Build
 on:
  workflow_call:
    inputs:
+      baseBranch:
+        required: true
+        type: string
      mergedSha:
        required: true
        type: string
@ -63,7 +66,7 @@ jobs:
      - name: Build NixOS manual
        if: |
          contains(matrix.builds, 'manual-nixos') && !cancelled() &&
-          (github.base_ref == 'master' || startsWith(github.base_ref, 'release-'))
+          contains(fromJSON(inputs.baseBranch).type, 'primary')
        run: nix-build untrusted/ci -A manual-nixos --argstr system ${{ matrix.system }} --out-link nixos-manual

      - name: Build Nixpkgs manual
@ -81,7 +84,7 @@ jobs:
      - name: Upload NixOS manual
        if: |
          contains(matrix.builds, 'manual-nixos') && !cancelled() &&
-          (github.base_ref == 'master' || startsWith(github.base_ref, 'release-'))
+          contains(fromJSON(inputs.baseBranch).type, 'primary')
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: nixos-manual-${{ matrix.system }}
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@ -2,6 +2,13 @@ name: Check

 on:
  workflow_call:
+    inputs:
+      baseBranch:
+        required: true
+        type: string
+      headBranch:
+        required: true
+        type: string

 permissions: {}

@ -12,9 +19,7 @@ defaults:
 jobs:
  no-channel-base:
    name: no channel base
-    if: |
-      startsWith(github.base_ref, 'nixos-') ||
-      startsWith(github.base_ref, 'nixpkgs-')
+    if: contains(fromJSON(inputs.baseBranch).type, 'channel')
    runs-on: ubuntu-24.04-arm
    steps:
      - run: |
@ -29,8 +34,7 @@ jobs:
  cherry-pick:
    if: |
      github.event_name == 'pull_request' ||
-      startsWith(github.base_ref, 'release-') ||
-      (startsWith(github.base_ref, 'staging-') && github.base_ref != 'staging-next')
+      (fromJSON(inputs.baseBranch).stable && !contains(fromJSON(inputs.headBranch).type, 'development'))
    permissions:
      pull-requests: write
    runs-on: ubuntu-24.04-arm
@ -50,6 +54,11 @@ jobs:
        run: |
          ./trusted/ci/check-cherry-picks.sh "$BASE_SHA" "$HEAD_SHA" checked-cherry-picks.md

+      - name: Log current API rate limits
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh api /rate_limit | jq
+
      - name: Prepare review
        if: steps.check.outcome == 'failure'
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
@ -148,3 +157,8 @@ jobs:
                }`, { node_id: review.node_id })
              })
            )
+
+      - name: Log current API rate limits
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh api /rate_limit | jq
--- a/.github/workflows/codeowners-v2.yml
+++ b/.github/workflows/codeowners-v2.yml
@ -79,6 +79,12 @@ jobs:
          permission-administration: read
          permission-members: read

+      - name: Log current API rate limits
+        if: steps.app-token.outputs.token
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: gh api /rate_limit | jq
+
      - name: Validate codeowners
        if: steps.app-token.outputs.token
        env:
@ -90,6 +96,12 @@ jobs:
          EXPERIMENTAL_CHECKS: "avoid-shadowing"
        run: result/bin/codeowners-validator

+      - name: Log current API rate limits
+        if: steps.app-token.outputs.token
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: gh api /rate_limit | jq
+
  # Request reviews from code owners
  request:
    name: Request
@ -116,8 +128,20 @@ jobs:
          permission-members: read
          permission-pull-requests: write

+      - name: Log current API rate limits
+        if: steps.app-token.outputs.token
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: gh api /rate_limit | jq
+
      - name: Request reviews
        if: steps.app-token.outputs.token
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: result/bin/request-code-owner-reviews.sh ${{ github.repository }} ${{ github.event.number }} "$OWNERS_FILE"
+
+      - name: Log current API rate limits
+        if: steps.app-token.outputs.token
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: gh api /rate_limit | jq
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@ -66,6 +66,11 @@ jobs:
          name: merged-${{ matrix.system }}
          path: merged/*

+      - name: Log current API rate limits
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh api /rate_limit | jq
+
      - name: Get target run id
        if: inputs.targetSha
        id: targetRunId
@ -108,6 +113,11 @@ jobs:
            // This should only happen when Eval is broken on the target branch and this PR fixes it.
            // Continue without targetRunId to skip the remaining steps, but pass the job.

+      - name: Log current API rate limits
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh api /rate_limit | jq
+
      - uses: actions/download-artifact@v4
        if: steps.targetRunId.outputs.targetRunId
        with:
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@ -9,6 +9,10 @@ on:
  schedule:
    - cron: '07,17,27,37,47,57 * * * *'
  workflow_call:
+    inputs:
+      headBranch:
+        required: true
+        type: string
  workflow_dispatch:
    inputs:
      updatedWithin:
@ -266,16 +270,16 @@ jobs:

            core.notice(`Processed ${stats.prs} PRs, made ${stats.requests + stats.artifacts} API requests and downloaded ${stats.artifacts} artifacts.`)

+      - name: Log current API rate limits
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh api /rate_limit | jq
+
      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
        name: Labels from touched files
        if: |
          github.event_name == 'pull_request_target' &&
-          (github.event.pull_request.head.repo.owner.login != 'NixOS' || !(
-            github.head_ref == 'haskell-updates' ||
-            github.head_ref == 'python-updates' ||
-            github.head_ref == 'staging-next' ||
-            startsWith(github.head_ref, 'staging-next-')
-          ))
+          !contains(fromJSON(inputs.headBranch).type, 'development')
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          configuration-path: .github/labeler.yml # default
@ -285,12 +289,7 @@ jobs:
        name: Labels from touched files (no sync)
        if: |
          github.event_name == 'pull_request_target' &&
-          (github.event.pull_request.head.repo.owner.login != 'NixOS' || !(
-            github.head_ref == 'haskell-updates' ||
-            github.head_ref == 'python-updates' ||
-            github.head_ref == 'staging-next' ||
-            startsWith(github.head_ref, 'staging-next-')
-          ))
+          !contains(fromJSON(inputs.headBranch).type, 'development')
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          configuration-path: .github/labeler-no-sync.yml
@ -303,13 +302,13 @@ jobs:
        # the backport labels.
        if: |
          github.event_name == 'pull_request_target' &&
-          (github.event.pull_request.head.repo.owner.login == 'NixOS' && (
-            github.head_ref == 'haskell-updates' ||
-            github.head_ref == 'python-updates' ||
-            github.head_ref == 'staging-next' ||
-            startsWith(github.head_ref, 'staging-next-')
-          ))
+          contains(fromJSON(inputs.headBranch).type, 'development')
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          configuration-path: .github/labeler-development-branches.yml
          sync-labels: true
+
+      - name: Log current API rate limits
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh api /rate_limit | jq
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@ -22,6 +22,8 @@ jobs:
  prepare:
    runs-on: ubuntu-24.04-arm
    outputs:
+      baseBranch: ${{ steps.branches.outputs.base }}
+      headBranch: ${{ steps.branches.outputs.head }}
      mergedSha: ${{ steps.get-merge-commit.outputs.mergedSha }}
      targetSha: ${{ steps.get-merge-commit.outputs.targetSha }}
      systems: ${{ steps.systems.outputs.systems }}
@ -30,6 +32,7 @@ jobs:
        with:
          sparse-checkout: |
            .github/actions
+            ci/supportedBranches.js
            ci/supportedSystems.json
      - name: Check if the PR can be merged and get the test merge commit
        uses: ./.github/actions/get-merge-commit
@ -40,12 +43,36 @@ jobs:
        run: |
          echo "systems=$(jq -c <ci/supportedSystems.json)" >> "$GITHUB_OUTPUT"

+      - name: Determine branch type
+        id: branches
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          script: |
+            const { classify } = require('./ci/supportedBranches.js')
+            const { base, head } = context.payload.pull_request
+
+            const baseClassification = classify(base.ref)
+            core.setOutput('base', baseClassification)
+            core.info('base classification:', baseClassification)
+
+            const headClassification =
+              (base.repo.full_name == head.repo.full_name) ?
+              classify(head.ref) :
+              // PRs from forks are always considered WIP.
+              { type: ['wip'] }
+            core.setOutput('head', headClassification)
+            core.info('head classification:', headClassification)
+
  check:
    name: Check
+    needs: [prepare]
    uses: ./.github/workflows/check.yml
    permissions:
      # cherry-picks
      pull-requests: write
+    with:
+      baseBranch: ${{ needs.prepare.outputs.baseBranch }}
+      headBranch: ${{ needs.prepare.outputs.headBranch }}

  lint:
    name: Lint
@ -71,16 +98,20 @@ jobs:

  labels:
    name: Labels
-    needs: [eval]
+    needs: [prepare, eval]
    uses: ./.github/workflows/labels.yml
    permissions:
      issues: write
      pull-requests: write
+    with:
+      headBranch: ${{ needs.prepare.outputs.headBranch }}

  reviewers:
    name: Reviewers
    needs: [prepare, eval]
-    if: needs.prepare.outputs.targetSha
+    if: |
+      needs.prepare.outputs.targetSha &&
+      !contains(fromJSON(needs.prepare.outputs.headBranch).type, 'development')
    uses: ./.github/workflows/reviewers.yml
    secrets:
      OWNER_APP_PRIVATE_KEY: ${{ secrets.OWNER_APP_PRIVATE_KEY }}
@ -92,6 +123,7 @@ jobs:
    secrets:
      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
    with:
+      baseBranch: ${{ needs.prepare.outputs.baseBranch }}
      mergedSha: ${{ needs.prepare.outputs.mergedSha }}

  # This job's only purpose is to serve as a target for the "Required Status Checks" branch ruleset.
--- a/.github/workflows/reviewers.yml
+++ b/.github/workflows/reviewers.yml
@ -54,6 +54,10 @@ jobs:
          permission-members: read
          permission-pull-requests: write

+      - name: Log current API rate limits (github.token)
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh api /rate_limit | jq

      # In the regular case, this workflow is called via workflow_call from the eval workflow directly.
      # In the more special case, when a PR is undrafted an eval run will have started already.
@ -87,6 +91,11 @@ jobs:
            }
            throw new Error("No comparison artifact found.")

+      - name: Log current API rate limits (github.token)
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh api /rate_limit | jq
+
      - name: Download the comparison results
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
@ -96,6 +105,17 @@ jobs:
          path: comparison
          merge-multiple: true

+      - name: Log current API rate limits (app-token)
+        if: ${{ steps.app-token.outputs.token }}
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: gh api /rate_limit | jq
+
+      - name: Log current API rate limits (github.token)
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh api /rate_limit | jq
+
      - name: Requesting maintainer reviews
        if: ${{ steps.app-token.outputs.token }}
        env:
@ -111,3 +131,14 @@ jobs:
          jq -r 'keys[]' comparison/maintainers.json \
            | while read -r id; do gh api /user/"$id" --jq .login; done \
            | GH_TOKEN=${{ steps.app-token.outputs.token }} result/bin/request-reviewers.sh "$REPOSITORY" "$NUMBER" "$AUTHOR"
+
+      - name: Log current API rate limits (app-token)
+        if: ${{ steps.app-token.outputs.token }}
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: gh api /rate_limit | jq
+
+      - name: Log current API rate limits (github.token)
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh api /rate_limit | jq
--- a/ci/.editorconfig
+++ b/ci/.editorconfig
@ -0,0 +1,4 @@
+# TODO: Move to top-level via staging PR
+[*.js]
+indent_style = space
+indent_size = 2
--- a/ci/README.md
+++ b/ci/README.md
@ -20,3 +20,32 @@ Arguments:

 - `BASE_BRANCH`: The base branch to use, e.g. master or release-24.05
 - `REPOSITORY`: The repository from which to fetch the base branch. Defaults to <https://github.com/NixOS/nixpkgs.git>.
+
+# Branch classification
+
+For the purposes of CI, branches in the NixOS/nixpkgs repository are classified as follows:
+
+- **Channel** branches
+  - `nixos-` or `nixpkgs-` prefix
+  - Are only updated from `master` or `release-` branches, when hydra passes.
+  - Otherwise not worked on, Pull Requests are not allowed.
+  - Long-lived, no deletion, no force push.
+- **Primary development** branches
+  - `release-` prefix and `master`
+  - Pull Requests required.
+  - Long-lived, no deletion, no force push.
+- **Secondary development** branches
+  - `staging-` prefix, `haskell-updates` and `python-updates`
+  - Pull Requests normally required, except when merging development branches into each other.
+  - Long-lived, no deletion, no force push.
+- **Work-In-Progress** branches
+  - `backport-`, `revert-` and `wip-` prefixes.
+  - Deprecated: All other branches, not matched by channel/development.
+  - Pull Requests are optional.
+  - Short-lived, force push allowed, deleted after merge.
+
+Some branches also have a version component, which is either `unstable` or `YY.MM`.
+
+`ci/supportedBranches.js` is a script imported by CI to classify the base and head branches of a Pull Request.
+This classification will then be used to skip certain jobs.
+This script can also be run locally to print basic test cases.
--- a/ci/supportedBranches.js
+++ b/ci/supportedBranches.js
@ -0,0 +1,62 @@
+#!/usr/bin/env nix-shell
+/*
+#!nix-shell -i node -p nodejs
+*/
+
+const typeConfig = {
+  master: ['development', 'primary'],
+  release: ['development', 'primary'],
+  staging: ['development', 'secondary'],
+  'staging-next': ['development', 'secondary'],
+  'haskell-updates': ['development', 'secondary'],
+  'python-updates': ['development', 'secondary'],
+  nixos: ['channel'],
+  nixpkgs: ['channel'],
+}
+
+function split(branch) {
+  return { ...branch.match(/(?<prefix>.+?)(-(?<version>\d{2}\.\d{2}|unstable)(?:-(?<suffix>.*))?)?$/).groups }
+}
+
+function classify(branch) {
+  const { prefix, version } = split(branch)
+  return {
+    stable: (version ?? 'unstable') !== 'unstable',
+    type: typeConfig[prefix] ?? [ 'wip' ]
+  }
+}
+
+module.exports = { classify }
+
+// If called directly via CLI, runs the following tests:
+if (!module.parent) {
+  console.log('split(branch)')
+  function testSplit(branch) {
+    console.log(branch, split(branch))
+  }
+  testSplit('master')
+  testSplit('release-25.05')
+  testSplit('staging-next')
+  testSplit('staging-25.05')
+  testSplit('staging-next-25.05')
+  testSplit('nixpkgs-25.05-darwin')
+  testSplit('nixpkgs-unstable')
+  testSplit('haskell-updates')
+  testSplit('backport-123-to-release-25.05')
+
+  console.log('')
+
+  console.log('classify(branch)')
+  function testClassify(branch) {
+    console.log(branch, classify(branch))
+  }
+  testClassify('master')
+  testClassify('release-25.05')
+  testClassify('staging-next')
+  testClassify('staging-25.05')
+  testClassify('staging-next-25.05')
+  testClassify('nixpkgs-25.05-darwin')
+  testClassify('nixpkgs-unstable')
+  testClassify('haskell-updates')
+  testClassify('backport-123-to-release-25.05')
+}
--- a/lib/tests/modules/types-attrTag.nix
+++ b/lib/tests/modules/types-attrTag.nix
@ -7,7 +7,7 @@
 let
  inherit (lib) mkOption types;
  forceDeep = x: builtins.deepSeq x x;
-  mergedSubOption = (options.merged.type.getSubOptions options.merged.loc).extensible."merged.<name>";
+  mergedSubOption = (options.merged.type.getSubOptions options.merged.loc).extensible;
 in
 {
  options = {
--- a/lib/types.nix
+++ b/lib/types.nix
@ -919,12 +919,7 @@ let
          description = "attribute-tagged union";
          descriptionClass = "noun";
          getSubOptions =
-            prefix:
-            mapAttrs (tagName: tagOption: {
-              "${lib.showOption prefix}" = tagOption // {
-                loc = prefix ++ [ tagName ];
-              };
-            }) tags;
+            prefix: mapAttrs (tagName: tagOption: tagOption // { loc = prefix ++ [ tagName ]; }) tags;
          check = v: isAttrs v && length (attrNames v) == 1 && tags ? ${head (attrNames v)};
          merge =
            loc: defs:
--- a/nixos/modules/services/misc/omnom.nix
+++ b/nixos/modules/services/misc/omnom.nix
@ -104,14 +104,6 @@ in
                default = "fs";
                description = "Storage type.";
              };
-              root = lib.mkOption {
-                type = lib.types.path;
-                default = "${cfg.dataDir}/static/data";
-                defaultText = lib.literalExpression ''
-                  "''${config.services.omnom.dataDir}/static/data"
-                '';
-                description = "Where the snapshots are saved.";
-              };
            };
            smtp = {
              tls = lib.mkEnableOption "Whether TLS encryption should be used.";
@ -142,6 +134,24 @@ in
                description = "Connection timeout duration in seconds.";
              };
            };
+            activitypub = {
+              pubkey = lib.mkOption {
+                type = lib.types.path;
+                default = "${cfg.dataDir}/public.pem";
+                defaultText = lib.literalExpression ''
+                  "''${config.services.omnom.dataDir}/public.pem"
+                '';
+                description = "ActivityPub public key. Will be generated, by default.";
+              };
+              privkey = lib.mkOption {
+                type = lib.types.path;
+                default = "${cfg.dataDir}/private.pem";
+                defaultText = lib.literalExpression ''
+                  "''${config.services.omnom.dataDir}/private.pem"
+                '';
+                description = "ActivityPub private key. Will be generated, by default.";
+              };
+            };
          };
        };
        default = { };
@ -150,6 +160,13 @@ in
  };

  config = lib.mkIf cfg.enable {
+    services.omnom = {
+      settings.app = {
+        static_dir = "${cfg.dataDir}/static";
+        template_dir = "${cfg.package}/share/templates";
+      };
+    };
+
    assertions = [
      {
        assertion = !lib.hasAttr "password" cfg.settings.smtp;
@ -157,16 +174,6 @@ in
          `services.omnom.settings.smtp.password` must be defined in `services.omnom.passwordFile`.
        '';
      }
-      {
-        assertion = !(cfg.settings.storage.root != "${cfg.dataDir}/static/data");
-        message = ''
-          For Omnom to access the snapshots, it needs the storage root
-          directory to be inside the service's working directory.
-
-          As such, `services.omnom.settings.storage.root` must be the same as
-          `''${services.omnom.dataDir}/static/data`.
-        '';
-      }
    ];

    systemd.services.omnom = {
@ -224,10 +231,10 @@ in
      in
      {
        "${cfg.dataDir}"."d" = settings;
-        "${cfg.dataDir}/templates"."L+" = settings // {
-          argument = "${cfg.package}/share/templates";
+        "${cfg.settings.app.static_dir}"."C" = settings // {
+          argument = "${cfg.package}/share/static";
        };
-        "${cfg.settings.storage.root}"."d" = settings;
+        "${cfg.settings.app.static_dir}/data"."d" = settings;
      };

    networking.firewall = lib.mkIf cfg.openFirewall {
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -1008,6 +1008,7 @@ in
  ollama-cuda = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./ollama-cuda.nix;
  ollama-rocm = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./ollama-rocm.nix;
  ombi = runTest ./ombi.nix;
+  omnom = runTest ./omnom.nix;
  openarena = runTest ./openarena.nix;
  openbao = runTest ./openbao.nix;
  opencloud = runTest ./opencloud.nix;
--- a/nixos/tests/omnom.nix
+++ b/nixos/tests/omnom.nix
@ -0,0 +1,42 @@
+{ lib, ... }:
+let
+  servicePort = 9090;
+in
+{
+  name = "Basic Omnom Test";
+  meta = {
+    maintainers = lib.teams.ngi.members;
+  };
+
+  nodes = {
+    server =
+      { config, lib, ... }:
+      {
+        services.omnom = {
+          enable = true;
+          openFirewall = true;
+
+          port = servicePort;
+
+          settings = {
+            app = {
+              disable_signup = false; # restrict CLI user-creation
+              results_per_page = 50;
+            };
+            server.address = "0.0.0.0:${toString servicePort}";
+          };
+        };
+      };
+  };
+
+  # TODO: take a snapshot
+  testScript =
+    { nodes, ... }:
+    # python
+    ''
+      server.start()
+      server.wait_for_unit("omnom.service")
+      server.wait_for_open_port(${toString servicePort})
+      server.succeed("curl -sf http://localhost:${toString servicePort}")
+    '';
+}
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -2779,8 +2779,8 @@ let
        mktplcRef = {
          name = "language-julia";
          publisher = "julialang";
-          version = "1.144.2";
-          hash = "sha256-9OFMQc5Y+979wYkd3qyuLuw7bRBMcsTQ9uSd2ea5cxk=";
+          version = "1.146.2";
+          hash = "sha256-PVs5TVtd8GGRJ/J9LJAZneVgYYuFdoJnN2U7ciKDjCQ=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/julialang.language-julia/changelog";
--- a/pkgs/applications/editors/vscode/extensions/ms-dotnettools.csdevkit/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-dotnettools.csdevkit/default.nix
@ -121,6 +121,10 @@ vscode-utils.buildVscodeMarketplaceExtension {
            --add-needed libssl.so \
            "$file"
        done
+
+        # Fix libxml2 breakage. See https://github.com/NixOS/nixpkgs/pull/396195#issuecomment-2881757108
+        mkdir -p "$out/lib"
+        ln -s "${lib.getLib libxml2}/lib/libxml2.so" "$out/lib/libxml2.so.2"
      ''}
    )
  '';
--- a/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix
+++ b/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix
@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "dosbox-pure";
-  version = "0-unstable-2025-06-14";
+  version = "0-unstable-2025-06-16";

  src = fetchFromGitHub {
    owner = "schellingb";
    repo = "dosbox-pure";
-    rev = "bdabec1651380f3f736eecff8d859090ae822f9b";
-    hash = "sha256-plUeFjkUSbWKs/TZHqQLR5MtOgWLNZLUg7QedtR+/Vo=";
+    rev = "8c48d34327f5ffc44892899cf2567feaa9bbf72a";
+    hash = "sha256-u5kxj4Sl7LpivEuNhTec8Z2u3Dw/X8xFDBQ++hQAtFc=";
  };

  hardeningDisable = [ "format" ];
--- a/pkgs/applications/networking/remote/teamviewer/default.nix
+++ b/pkgs/applications/networking/remote/teamviewer/default.nix
@ -30,7 +30,7 @@ mkDerivation rec {
    "out"
    "dev"
  ];
-  version = "15.61.3";
+  version = "15.66.5";

  src =
    let
@ -39,11 +39,11 @@ mkDerivation rec {
    {
      x86_64-linux = fetchurl {
        url = "${base_url}/teamviewer_${version}_amd64.deb";
-        hash = "sha256-o7Em+QRW4TebRTJS5xjcx1M6KPh1ziB1j0fvlO+RYa4=";
+        hash = "sha256-yQD2iFFFHlR6vX/5vEtBqmIOtGXa4eHbE7v7MdXgBds=";
      };
      aarch64-linux = fetchurl {
        url = "${base_url}/teamviewer_${version}_arm64.deb";
-        hash = "sha256-LDByF4u9xZV1MYApBrnlNrUPndbDrQt6DKX+r8Kmq6k=";
+        hash = "sha256-WqC4/5egq3pHgb4v8EPevJDDNmashuQr+VBQuFLdr7Q=";
      };
    }
    .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
--- a/pkgs/applications/science/logic/cvc5/default.nix
+++ b/pkgs/applications/science/logic/cvc5/default.nix
@ -10,10 +10,9 @@
  gmp,
  python3,
  gtest,
-  libantlr3c,
-  antlr3_4,
  boost,
  jdk,
+  libpoly,
 }:

 stdenv.mkDerivation rec {
@ -37,10 +36,9 @@ stdenv.mkDerivation rec {
    symfpu
    gmp
    gtest
-    libantlr3c
-    antlr3_4
    boost
    jdk
+    libpoly
    (python3.withPackages (
      ps: with ps; [
        pyparsing
@ -57,7 +55,7 @@ stdenv.mkDerivation rec {

  cmakeFlags = [
    "-DBUILD_SHARED_LIBS=1"
-    "-DANTLR3_JAR=${antlr3_4}/lib/antlr/antlr-3.4-complete.jar"
+    "-DUSE_POLY=ON"
  ];

  doCheck = true;
--- a/pkgs/by-name/am/amazon-q-cli/package.nix
+++ b/pkgs/by-name/am/amazon-q-cli/package.nix
@ -2,36 +2,32 @@
  lib,
  fetchFromGitHub,
  rustPlatform,
-  protobuf_26,
  versionCheckHook,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "amazon-q-cli";
-  version = "1.10.1";
+  version = "1.12.1";

  src = fetchFromGitHub {
    owner = "aws";
-    repo = "amazon-q-developer-cli";
+    repo = "amazon-q-developer-cli-autocomplete";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-HgbF5jistZhzebZmnTmMBlHuL6/fy1kcQplAFldzAV8=";
+    hash = "sha256-oY2hDOsws2WVQPKEFhGNPHITo26p/UZ5XzvRX7DoMyc=";
  };

  useFetchCargoVendor = true;

-  cargoHash = "sha256-yhSVnz8gzJy/E9T1U4GsT3b7wmYzSCYXEb8y2HOIQms=";
+  cargoHash = "sha256-xriK88OY6W1cOZVgiUPBIuItVHwEyFNq5Ywh367K6CU=";

  cargoBuildFlags = [
    "-p"
    "chat_cli"
  ];

-  nativeBuildInputs = [
-    protobuf_26
-  ];
-
  postInstall = ''
    install -m 0755 $out/bin/chat_cli $out/bin/amazon-q
+    rm -f $out/bin/chat_cli $out/bin/test_mcp_server
  '';

  cargoTestFlags = [
--- a/pkgs/by-name/be/beeper/package.nix
+++ b/pkgs/by-name/be/beeper/package.nix
@ -9,10 +9,10 @@
 }:
 let
  pname = "beeper";
-  version = "4.0.747";
+  version = "4.0.779";
  src = fetchurl {
    url = "https://beeper-desktop.download.beeper.com/builds/Beeper-${version}.AppImage";
-    hash = "sha256-eLNxuBCm3vzG/90mZsQCVInGu8lMPrr+/UBAHj+vGJ4=";
+    hash = "sha256-eRA/9OAWcYsn1C8xuC6NFj2/HxOHT0YISDC9Kp8H/Yg=";
  };
  appimageContents = appimageTools.extract {
    inherit pname version src;
--- a/pkgs/by-name/bo/bootdev-cli/package.nix
+++ b/pkgs/by-name/bo/bootdev-cli/package.nix
@ -11,13 +11,13 @@

 buildGoModule rec {
  pname = "bootdev-cli";
-  version = "1.19.1";
+  version = "1.19.2";

  src = fetchFromGitHub {
    owner = "bootdotdev";
    repo = "bootdev";
    tag = "v${version}";
-    hash = "sha256-cAVCTA4SZdD3QVgbSbha860fExq1swWnJjpWKpfHP2Q=";
+    hash = "sha256-jTI91t/gcEdOc3mwP0dFqL5sYeaC6nD96+RpuQfAf4s=";
  };

  vendorHash = "sha256-jhRoPXgfntDauInD+F7koCaJlX4XDj+jQSe/uEEYIMM=";
--- a/pkgs/by-name/bu/buildstream/package.nix
+++ b/pkgs/by-name/bu/buildstream/package.nix
@ -94,6 +94,9 @@ python3Packages.buildPythonApplication rec {

    # Blob not found in the local CAS
    "test_source_pull_partial_fallback_fetch"
+
+    # FAILED tests/sources/tar.py::test_out_of_basedir_hardlinks - AssertionError
+    "test_out_of_basedir_hardlinks"
  ];

  disabledTestPaths = [
--- a/pkgs/by-name/cn/cnquery/package.nix
+++ b/pkgs/by-name/cn/cnquery/package.nix
@ -6,18 +6,18 @@

 buildGoModule rec {
  pname = "cnquery";
-  version = "11.57.2";
+  version = "11.59.0";

  src = fetchFromGitHub {
    owner = "mondoohq";
    repo = "cnquery";
    tag = "v${version}";
-    hash = "sha256-RlDXoLBsJl/2TCDBfQhdWfr8zQfQiEedW5ckVtQn4eM=";
+    hash = "sha256-xSHIKy9kQrbDhLuTfJd1yDAt/Z7mqYNv4XT6fQZftho=";
  };

  subPackages = [ "apps/cnquery" ];

-  vendorHash = "sha256-JoFj3bHDb0jWwlrioYQv/V6e69ae7HFGkLYBNgntB00=";
+  vendorHash = "sha256-NGrDYN7+JozAmtysSBUcKPiQwKs/fUiQkUVEGrmTTCk=";

  ldflags = [
    "-w"
--- a/pkgs/by-name/db/dbus-broker/package.nix
+++ b/pkgs/by-name/db/dbus-broker/package.nix
@ -13,7 +13,10 @@

 let
  meta = {
-    maintainers = with lib.maintainers; [ peterhoeg ];
+    maintainers = with lib.maintainers; [
+      peterhoeg
+      rvdp
+    ];
    platforms = lib.platforms.linux;
  };

@ -54,8 +57,8 @@ let
  # part of the dbus-broker project, just in separate repositories.
  c-dvar = dep {
    pname = "c-dvar";
-    version = "1.1.0";
-    hash = "sha256-p/C+BktclVseCtZJ1Q/YK03vP2ClnYRLB1Vmj2OQJD4=";
+    version = "1.2.0";
+    hash = "sha256-OlV6yR1tNWFN+rxPPGmbfbh7WyB6FwORyZR1V553iYE=";
    buildInputs = [
      c-stdaux
      c-utf8
@ -91,8 +94,8 @@ let
  };
  c-stdaux = dep {
    pname = "c-stdaux";
-    version = "1.5.0";
-    hash = "sha256-MsnuEyVCmOIr/q6I1qyPsNXp48jxIEcXoYLHbOAZtW0=";
+    version = "1.6.0";
+    hash = "sha256-/15lop+WUkTW9v9h7BBdwRSpJgcBXaJNtMM7LXgcQE4=";
  };
  c-utf8 = dep {
    pname = "c-utf8";
@ -105,13 +108,13 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "dbus-broker";
-  version = "36";
+  version = "37";

  src = fetchFromGitHub {
    owner = "bus1";
    repo = "dbus-broker";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-5dAMKjybqrHG57vArbtWEPR/svSj2ION75JrjvnnpVM=";
+    hash = "sha256-a9ydcJKZP8MLzu9lv40p9sTyo8IsU++9HOFeGU3+Tok=";
  };

  patches = [
--- a/pkgs/by-name/db/dbus-broker/paths.patch
+++ b/pkgs/by-name/db/dbus-broker/paths.patch
@ -1,11 +1,11 @@
 diff --git a/src/launch/launcher.c b/src/launch/launcher.c
-index 5bf5cf5..06ce7f4 100644
+index 7b1fb19..6bc2c46 100644
 --- a/src/launch/launcher.c
 +++ b/src/launch/launcher.c
-@@ -924,9 +924,7 @@ static int launcher_load_standard_session_services(Launcher *launcher, NSSCache
- 
- static int launcher_load_standard_system_services(Launcher *launcher, NSSCache *nss_cache) {
+@@ -945,9 +945,7 @@ static int launcher_load_standard_system_services(Launcher *launcher, NSSCache *
         static const char *default_data_dirs[] = {
+                 "/etc",
+                 "/run",
 -                "/usr/local/share",
 -                "/usr/share",
 -                "/lib",
@ -13,7 +13,7 @@ index 5bf5cf5..06ce7f4 100644
                 NULL,
         };
         const char *suffix = "dbus-1/system-services";
-@@ -1012,9 +1010,9 @@ static int launcher_parse_config(Launcher *launcher, ConfigRoot **rootp, NSSCach
+@@ -1033,9 +1031,9 @@ static int launcher_parse_config(Launcher *launcher, ConfigRoot **rootp, NSSCach
         if (launcher->configfile)
                 configfile = launcher->configfile;
         else if (launcher->user_scope)
--- a/pkgs/by-name/gi/gitaly/package.nix
+++ b/pkgs/by-name/gi/gitaly/package.nix
@ -7,7 +7,7 @@
 }:

 let
-  version = "18.0.2";
+  version = "18.1.0";
  package_version = "v${lib.versions.major version}";
  gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";

@ -21,10 +21,10 @@ let
      owner = "gitlab-org";
      repo = "gitaly";
      rev = "v${version}";
-      hash = "sha256-Phzg0GAKBMfXPqzlMfLZQbKeqZzMKw1YdEDdzSs+IkE=";
+      hash = "sha256-nttZfGjQKRSYCoMHSljojYLNScyDPHd8ayCuDkvKXpE=";
    };

-    vendorHash = "sha256-PXONynRY5ZLQO2yQdtljDmLhVBIgfEYmyez9pIm9vtw=";
+    vendorHash = "sha256-BTpcnaHNyLgdAA9KqqA+mBo18fmQ0+OwLGNOPHRJ/IE=";

    ldflags = [
      "-X ${gitaly_package}/internal/version.version=${version}"
--- a/pkgs/by-name/gi/gitlab-elasticsearch-indexer/package.nix
+++ b/pkgs/by-name/gi/gitlab-elasticsearch-indexer/package.nix
@ -8,17 +8,17 @@

 buildGoModule rec {
  pname = "gitlab-elasticsearch-indexer";
-  version = "5.5.1";
+  version = "5.6.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-elasticsearch-indexer";
    rev = "v${version}";
-    hash = "sha256-N2H9jLpsP39nKrokWwphAspQwXcL3stAdvNVItIHFyo=";
+    hash = "sha256-XerIPK+s0OWYAqKVqE3HSSI+D4cXixYqRHmf9/4C2eg=";
  };

-  vendorHash = "sha256-Go02W09799Vu9v7y+P7z1gj7ijG3No5AVprRrmspPZE=";
+  vendorHash = "sha256-qNGACM5DKufyNVKhJyakmMRbaMXi+JJUfojhWdk0ptU=";

  buildInputs = [ icu ];
  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/by-name/gi/gitlab-pages/package.nix
+++ b/pkgs/by-name/gi/gitlab-pages/package.nix
@ -6,17 +6,17 @@

 buildGoModule rec {
  pname = "gitlab-pages";
-  version = "18.0.2";
+  version = "18.1.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-pages";
    rev = "v${version}";
-    hash = "sha256-zWWQZBN2J69YnjGhhQdB5wv4plC5ikk+kq6EfNPW6ZM=";
+    hash = "sha256-HwjbQLEc/GmFxVvyx0UMKKrNoHmfFADblVN/XOAtMZY=";
  };

-  vendorHash = "sha256-BjCwPt1duDINHP7L0qT2KNTjOZ62bWgVij88ztjjyPg=";
+  vendorHash = "sha256-6ZHKwPhC3N813kiw1NnPOMVc2CBSIClwc4MunDi0gCk=";
  subPackages = [ "." ];

  meta = {
--- a/pkgs/by-name/gi/gitlab/data.json
+++ b/pkgs/by-name/gi/gitlab/data.json
@ -1,15 +1,15 @@
 {
-  "version": "18.0.2",
-  "repo_hash": "03sqn21bnsdjs518akbmanyh96p8h4dyhpy4vqwcx1dc8lwnidki",
-  "yarn_hash": "0vv09y1pjcm2723jh842pgnmnrf4yqk7558v57dp08rxrqnsni5x",
+  "version": "18.1.0",
+  "repo_hash": "0d7xs0l6nzs1bpr4slycq0agw3kk9k9bw3q0dqqc2knla71i21fd",
+  "yarn_hash": "0c5pp3dpvw0q0nfl6w1lpdmk7dvkfinwb7z7a3vq22wgzca23x2m",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v18.0.2-ee",
+  "rev": "v18.1.0-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "18.0.2",
-    "GITLAB_PAGES_VERSION": "18.0.2",
+    "GITALY_SERVER_VERSION": "18.1.0",
+    "GITLAB_PAGES_VERSION": "18.1.0",
    "GITLAB_SHELL_VERSION": "14.42.0",
-    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.5.1",
-    "GITLAB_WORKHORSE_VERSION": "18.0.2"
+    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.6.0",
+    "GITLAB_WORKHORSE_VERSION": "18.1.0"
  }
 }
--- a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
@ -10,7 +10,7 @@ in
 buildGoModule rec {
  pname = "gitlab-workhorse";

-  version = "18.0.2";
+  version = "18.1.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
@ -22,7 +22,7 @@ buildGoModule rec {

  sourceRoot = "${src.name}/workhorse";

-  vendorHash = "sha256-tLlxsUCoSGvUpJnS0GsNobk2IuSEgs3R4UDUmNf+HrA=";
+  vendorHash = "sha256-jsp68duGIW1p8ltfSlK0jPd22iscjiIOyrxfsr+2QY0=";
  buildInputs = [ git ];
  ldflags = [ "-X main.Version=${version}" ];
  doCheck = false;
--- a/pkgs/by-name/gi/gitlab/package.nix
+++ b/pkgs/by-name/gi/gitlab/package.nix
@ -79,10 +79,11 @@ let
            dontBuilt = true;
            installPhase = ''
              cp -R ext/glfm_markdown $out
+              rm $out/Cargo.lock
              cp Cargo.lock $out
            '';
          };
-          hash = "sha256-73uliXjZNT8Ok98ai2rY+b0jYqxoQH3qW5YS+Ap6KK0=";
+          hash = "sha256-TG2pUE80o/Sa147Lcb7yIJC+mfaDzzW7m2d7dTi5yi0=";
        };

        dontBuild = false;
--- a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
@ -1,5 +1,9 @@
 # frozen_string_literal: true

+def next?
+  File.basename(__FILE__) == "Gemfile.next"
+end
+
 source 'https://rubygems.org'

 if ENV.fetch('BUNDLER_CHECKSUM_VERIFICATION_OPT_IN', 'false') != 'false' # this verification is still experimental
@ -19,13 +23,13 @@ extend ignore_feature_category

 gem 'bundler-checksum', '~> 0.1.0', path: 'vendor/gems/bundler-checksum', require: false, feature_category: :shared

-# NOTE: When incrementing the major or minor version here, also increment activerecord_version
-# in vendor/gems/attr_encrypted/attr_encrypted.gemspec until we resolve
-# https://gitlab.com/gitlab-org/gitlab/-/issues/375713
-#
 # See https://docs.gitlab.com/ee/development/gemfile.html#upgrade-rails for guidelines when upgrading Rails

-gem 'rails', '~> 7.1.5.1', feature_category: :shared
+if next?
+  gem 'rails', '~> 7.2.2.1', feature_category: :shared
+else
+  gem 'rails', '~> 7.1.5.1', feature_category: :shared
+end

 gem 'activerecord-gitlab', path: 'gems/activerecord-gitlab', feature_category: :shared
 # This can be dropped after upgrading to Rails 7.2: https://github.com/rails/rails/pull/49674
@ -38,9 +42,9 @@ gem 'bootsnap', '~> 1.18.3', require: false, feature_category: :shared
 # Avoid the precompiled native gems because Omnibus needs to build this to ensure
 # LD_LIBRARY_PATH is correct: https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/7730
 if RUBY_PLATFORM.include?('darwin')
-  gem 'ffi', '~> 1.17', feature_category: :shared
+  gem 'ffi', '~> 1.17.2', feature_category: :shared
 else
-  gem 'ffi', '~> 1.17', force_ruby_platform: true, feature_category: :shared
+  gem 'ffi', '~> 1.17.2', force_ruby_platform: true, feature_category: :shared
 end

 gem 'openssl', '~> 3.0', feature_category: :shared
@ -62,7 +66,7 @@ gem 'responders', '~> 3.0', feature_category: :shared
 gem 'sprockets', '~> 3.7.0', feature_category: :shared
 gem 'sprockets-rails', '~>  3.5.1', feature_category: :shared

-gem 'view_component', '~> 3.21.0', feature_category: :shared
+gem 'view_component', '~> 3.23.2', feature_category: :shared

 # Supported DBs
 gem 'pg', '~> 1.5.6', feature_category: :database
@ -72,7 +76,7 @@ gem 'rugged', '~> 1.6', feature_category: :gitaly
 gem 'faraday', '~> 2', feature_category: :shared
 gem 'faraday-retry', '~> 2', feature_category: :shared
 # Logger is a dependency of Faraday, but Logger 1.6.0 does not work with Chef.
-gem 'logger', '~> 1.6.0', feature_category: :shared
+gem 'logger', '~> 1.7.0', feature_category: :shared

 gem 'marginalia', '~> 1.11.1', feature_category: :database

@ -128,11 +132,11 @@ gem 'invisible_captcha', '~> 2.1.0', feature_category: :insider_threat
 gem 'devise-two-factor', '~> 4.1.1', feature_category: :system_access
 gem 'rqrcode', '~> 2.2', feature_category: :system_access

-gem 'attr_encrypted', '~> 3.2.4', path: 'vendor/gems/attr_encrypted', feature_category: :shared
+gem 'attr_encrypted', '~> 4.2', feature_category: :shared

 # GitLab Pages
 gem 'validates_hostname', '~> 1.0.13', feature_category: :pages
-gem 'rubyzip', '~> 2.3.2', require: 'zip', feature_category: :pages
+gem 'rubyzip', '~> 2.4.0', require: 'zip', feature_category: :pages
 # GitLab Pages letsencrypt support
 gem 'acme-client', '~> 2.0.19', feature_category: :pages

@ -170,7 +174,7 @@ gem 'gitlab-topology-service-client', '~> 0.1',
  feature_category: :cell

 # Duo Workflow
-gem 'gitlab-duo-workflow-service-client', '~> 0.1',
+gem 'gitlab-duo-workflow-service-client', '~> 0.2',
  path: 'vendor/gems/gitlab-duo-workflow-service-client',
  feature_category: :duo_workflow

@ -238,9 +242,9 @@ gem 'seed-fu', '~> 2.3.7', feature_category: :shared
 gem 'elasticsearch-model', '~> 7.2', feature_category: :global_search
 gem 'elasticsearch-rails', '~> 7.2', require: 'elasticsearch/rails/instrumentation', feature_category: :global_search
 gem 'elasticsearch-api', '7.17.11', feature_category: :global_search
-gem 'aws-sdk-core', '~> 3.223.0', feature_category: :global_search
+gem 'aws-sdk-core', '~> 3.225.0', feature_category: :global_search
 gem 'aws-sdk-cloudformation', '~> 1', feature_category: :global_search
-gem 'aws-sdk-s3', '~> 1.185.0', feature_category: :global_search
+gem 'aws-sdk-s3', '~> 1.189.0', feature_category: :global_search
 gem 'faraday-typhoeus', '~> 1.1', feature_category: :global_search
 gem 'faraday_middleware-aws-sigv4', '~> 1.0.1', feature_category: :global_search
 # Used with Elasticsearch to support http keep-alive connections
@ -266,7 +270,7 @@ gem 'asciidoctor-kroki', '~> 0.10.0', require: false, feature_category: :markdow
 gem 'rouge', '~> 4.5.0', feature_category: :shared
 gem 'truncato', '~> 0.7.13', feature_category: :team_planning
 gem 'nokogiri', '~> 1.18', feature_category: :shared
-gem 'gitlab-glfm-markdown', '~> 0.0.30', feature_category: :markdown
+gem 'gitlab-glfm-markdown', '~> 0.0.31', feature_category: :markdown
 gem 'tanuki_emoji', '~> 0.13', feature_category: :markdown
 gem 'unicode-emoji', '~> 4.0', feature_category: :markdown

@ -283,7 +287,7 @@ gem 'rack', '~> 2.2.9', feature_category: :shared
 gem 'rack-timeout', '~> 0.7.0', require: 'rack/timeout/base', feature_category: :shared

 group :puma do
-  gem 'puma', '= 6.5.0', require: false, feature_category: :shared
+  gem 'puma', '= 6.6.0', require: false, feature_category: :shared
  gem 'sd_notify', '~> 0.1.0', require: false, feature_category: :shared
 end

@ -302,7 +306,7 @@ gem 'gitlab-sidekiq-fetcher',
 gem 'fugit', '~> 1.11.1', feature_category: :continuous_integration

 # HTTP requests
-gem 'httparty', '~> 0.22.0', feature_category: :shared
+gem 'httparty', '~> 0.23.0', feature_category: :shared

 # Colored output to console
 gem 'rainbow', '~> 3.0', feature_category: :shared
@ -328,7 +332,7 @@ gem 'device_detector', feature_category: :shared
 # Redis
 gem 'redis', '~> 5.4.0', feature_category: :redis
 gem 'redis-clustering', '~> 5.4.0', feature_category: :redis
-gem 'connection_pool', '~> 2.4', feature_category: :shared
+gem 'connection_pool', '~> 2.5.3', feature_category: :shared

 # Redis session store
 gem 'redis-actionpack', '~> 5.5.0', feature_category: :redis
@ -347,7 +351,7 @@ gem 'ruby-fogbugz', '~> 0.3.0', feature_category: :importers
 gem 'kubeclient', '~> 4.11.0', feature_category: :shared

 # AI
-gem 'circuitbox', '2.0.0', feature_category: :ai_abstraction_layer
+gem 'circuitbox', '2.0.0', feature_category: :shared

 # Sanitize user input
 gem 'sanitize', '~> 6.0.2', feature_category: :shared
@ -431,7 +435,7 @@ gem 'prometheus-client-mmap', '~> 1.2.9', require: 'prometheus/client', feature_

 # Event-driven reactor for Ruby
 # Required manually in config/initializers/require_async_gem
-gem 'async', '~> 2.23.0', require: false, feature_category: :shared
+gem 'async', '~> 2.24.0', require: false, feature_category: :shared

 # Security report schemas used to validate CI job artifacts of security jobs
 gem 'gitlab-security_report_schemas', '0.1.2.min15.0.0.max15.2.1', feature_category: :vulnerability_management
@ -501,7 +505,7 @@ end

 group :development, :test do
  gem 'deprecation_toolkit', '~> 2.2.3', require: false, feature_category: :shared
-  gem 'bullet', '~> 7.2.0', feature_category: :shared
+  gem 'bullet', '~> 8.0.0', feature_category: :shared
  gem 'parser', '= 3.3.8.0', feature_category: :shared
  gem 'pry-byebug', feature_category: :shared
  gem 'pry-rails', '~> 0.3.9', feature_category: :shared
@ -510,7 +514,7 @@ group :development, :test do
  gem 'awesome_print', require: false, feature_category: :shared

  gem 'database_cleaner-active_record', '~> 2.2.0', feature_category: :database
-  gem 'rspec-rails', '~> 7.0.0', feature_category: :shared
+  gem 'rspec-rails', '~> 7.1.0', feature_category: :shared
  gem 'factory_bot_rails', '~> 6.4.3', feature_category: :tooling

  # Prevent occasions where minitest is not bundled in packaged versions of ruby (see #3826)
@ -530,7 +534,7 @@ group :development, :test do
  gem 'influxdb-client', '~> 3.1', require: false, feature_category: :tooling

  gem 'knapsack', '~> 4.0.0', feature_category: :tooling
-  gem 'gitlab-crystalball', '~> 0.7.2', require: false, feature_category: :tooling
+  gem 'gitlab-crystalball', '~> 1.1.0', require: false, feature_category: :tooling
  gem 'test_file_finder', '~> 0.3.1', feature_category: :tooling

  gem 'simple_po_parser', '~> 1.1.6', require: false, feature_category: :shared
@ -639,16 +643,12 @@ gem 'ssh_data', '~> 1.3', feature_category: :shared
 gem 'spamcheck', '~> 1.3.0', feature_category: :insider_threat

 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 17.8.0', feature_category: :gitaly
+gem 'gitaly', '~> 18.1.0.pre.rc1', feature_category: :gitaly

 # KAS GRPC protocol definitions
 gem 'gitlab-kas-grpc', '~> 17.11.0', feature_category: :deployment_management

-# Lock the version before issues below are resolved:
-# https://gitlab.com/gitlab-org/gitlab/-/issues/473169#note_2028352939
-# Or we can upgrade to a more recent version as long as we can confirm
-# that it doesn't have the same issues.
-gem 'grpc', '= 1.63.0', feature_category: :shared
+gem 'grpc', '~> 1.72.0', feature_category: :shared

 gem 'google-protobuf', '~> 3.25', '>= 3.25.3', feature_category: :shared

@ -756,4 +756,4 @@ gem 'paper_trail', '~> 16.0', feature_category: :shared

 gem "i18n_data", "~> 0.13.1", feature_category: :system_access

-gem "gitlab-cloud-connector", "~> 1.11", require: 'gitlab/cloud_connector', feature_category: :cloud_connector
+gem "gitlab-cloud-connector", "~> 1.14", require: 'gitlab/cloud_connector', feature_category: :cloud_connector
--- a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
@ -48,7 +48,7 @@ PATH
      google-cloud-storage_transfer (~> 1.2.0)
      google-protobuf (~> 3.25, >= 3.25.3)
      googleauth (~> 1.8.1)
-      grpc (= 1.63.0)
+      grpc (~> 1.72.0)
      json (~> 2.7)
      jwt (~> 2.5)
      logger (~> 1.5)
@ -126,12 +126,6 @@ PATH
      diffy (~> 3.4)
      oj (~> 3.16, >= 3.16.10)

-PATH
-  remote: vendor/gems/attr_encrypted
-  specs:
-    attr_encrypted (3.2.4)
-      encryptor (~> 3.0.0)
-
 PATH
  remote: vendor/gems/bundler-checksum
  specs:
@ -162,7 +156,7 @@ PATH
 PATH
  remote: vendor/gems/gitlab-duo-workflow-service-client
  specs:
-    gitlab-duo-workflow-service-client (0.1)
+    gitlab-duo-workflow-service-client (0.2)
      grpc

 PATH
@ -334,7 +328,7 @@ GEM
    asciidoctor-plantuml (0.0.16)
      asciidoctor (>= 2.0.17, < 3.0.0)
    ast (2.4.2)
-    async (2.23.1)
+    async (2.24.0)
      console (~> 1.29)
      fiber-annotation
      io-event (~> 1.9)
@ -342,15 +336,17 @@ GEM
      traces (~> 0.15)
    atlassian-jwt (0.2.1)
      jwt (~> 2.1)
+    attr_encrypted (4.2.0)
+      encryptor (~> 3.0.0)
    attr_required (1.0.2)
    awesome_print (1.9.2)
    awrence (1.2.1)
    aws-eventstream (1.3.0)
    aws-partitions (1.1001.0)
-    aws-sdk-cloudformation (1.41.0)
-      aws-sdk-core (~> 3, >= 3.99.0)
-      aws-sigv4 (~> 1.1)
-    aws-sdk-core (3.223.0)
+    aws-sdk-cloudformation (1.131.0)
+      aws-sdk-core (~> 3, >= 3.216.0)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-core (3.225.0)
      aws-eventstream (~> 1, >= 1.3.0)
      aws-partitions (~> 1, >= 1.992.0)
      aws-sigv4 (~> 1.9)
@ -360,8 +356,8 @@ GEM
    aws-sdk-kms (1.76.0)
      aws-sdk-core (~> 3, >= 3.188.0)
      aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.185.0)
-      aws-sdk-core (~> 3, >= 3.216.0)
+    aws-sdk-s3 (1.189.0)
+      aws-sdk-core (~> 3, >= 3.225.0)
      aws-sdk-kms (~> 1)
      aws-sigv4 (~> 1.5)
    aws-sigv4 (1.9.1)
@ -400,11 +396,11 @@ GEM
    bindata (2.4.11)
    binding_of_caller (1.0.0)
      debug_inspector (>= 0.0.1)
-    bootsnap (1.18.4)
+    bootsnap (1.18.6)
      msgpack (~> 1.2)
    browser (5.3.1)
    builder (3.2.4)
-    bullet (7.2.0)
+    bullet (8.0.8)
      activesupport (>= 3.0.0)
      uniform_notifier (~> 1.11)
    byebug (12.0.0)
@ -527,7 +523,7 @@ GEM
    descendants_tracker (0.0.4)
      thread_safe (~> 0.3, >= 0.3.1)
    devfile (0.4.4)
-    device_detector (1.0.0)
+    device_detector (1.1.3)
    devise (4.9.4)
      bcrypt (~> 3.0)
      orm_adapter (~> 0.1)
@ -541,7 +537,7 @@ GEM
      railties (~> 7.0)
      rotp (~> 6.0)
    diff-lcs (1.5.0)
-    diffy (3.4.3)
+    diffy (3.4.4)
    digest-crc (0.6.5)
      rake (>= 12.0.0, < 14.0.0)
    docile (1.4.0)
@ -615,7 +611,7 @@ GEM
    factory_bot_rails (6.4.4)
      factory_bot (~> 6.5)
      railties (>= 5.0.0)
-    faraday (2.12.2)
+    faraday (2.13.1)
      faraday-net_http (>= 2.0, < 3.5)
      json
      logger
@ -731,19 +727,20 @@ GEM
    git (1.19.1)
      addressable (~> 2.8)
      rchardet (~> 1.8)
-    gitaly (17.8.4)
+    gitaly (18.1.0.pre.rc1)
      grpc (~> 1.0)
    gitlab (4.19.0)
      httparty (~> 0.20)
      terminal-table (>= 1.5.1)
    gitlab-chronic (0.10.6)
      numerizer (~> 0.2)
-    gitlab-cloud-connector (1.12.0)
+    gitlab-cloud-connector (1.17.0)
      activesupport (~> 7.0)
      jwt (~> 2.9.3)
-    gitlab-crystalball (0.7.2)
+    gitlab-crystalball (1.1.0)
      git (< 4)
-    gitlab-dangerfiles (4.9.1)
+      ostruct (< 1)
+    gitlab-dangerfiles (4.9.2)
      danger (>= 9.3.0)
      danger-gitlab (>= 8.0.0)
      rake (~> 13.0)
@ -759,9 +756,9 @@ GEM
      mime-types
      net-http-persistent (~> 4.0)
      nokogiri (~> 1, >= 1.10.8)
-    gitlab-glfm-markdown (0.0.30)
+    gitlab-glfm-markdown (0.0.31)
      rb_sys (~> 0.9.109)
-    gitlab-kas-grpc (17.11.2)
+    gitlab-kas-grpc (17.11.3)
      grpc (~> 1.0)
    gitlab-labkit (0.37.0)
      actionpack (>= 5.0.0, < 8.1.0)
@ -785,8 +782,8 @@ GEM
      activesupport (>= 5.2.0)
      rake (~> 13.0)
      snowplow-tracker (~> 0.8.0)
-    gitlab-secret_detection (0.26.1)
-      grpc (~> 1.63.0)
+    gitlab-secret_detection (0.29.1)
+      grpc (>= 1.63.0, < 2)
      grpc_reflection (~> 0.1)
      parallel (~> 1)
      re2 (~> 2.7)
@ -907,12 +904,12 @@ GEM
    google-cloud-storage_transfer-v1 (0.8.0)
      gapic-common (>= 0.20.0, < 2.a)
      google-cloud-errors (~> 1.0)
-    google-protobuf (3.25.7)
+    google-protobuf (3.25.8)
    googleapis-common-protos (1.4.0)
      google-protobuf (~> 3.14)
      googleapis-common-protos-types (~> 1.2)
      grpc (~> 1.27)
-    googleapis-common-protos-types (1.19.0)
+    googleapis-common-protos-types (1.20.0)
      google-protobuf (>= 3.18, < 5.a)
    googleauth (1.8.1)
      faraday (>= 0.17.3, < 3.a)
@ -959,8 +956,8 @@ GEM
      graphql (~> 2.0)
      html-pipeline (~> 2.14, >= 2.14.3)
      sass-embedded (~> 1.58)
-    grpc (1.63.0)
-      google-protobuf (~> 3.25)
+    grpc (1.72.0)
+      google-protobuf (>= 3.25, < 5.0)
      googleapis-common-protos-types (~> 1.0)
    grpc-google-iam-v1 (1.5.0)
      google-protobuf (~> 3.18)
@ -1020,7 +1017,7 @@ GEM
    http-cookie (1.0.5)
      domain_name (~> 0.5)
    http-form_data (2.3.0)
-    httparty (0.22.0)
+    httparty (0.23.1)
      csv
      mini_mime (>= 1.0.0)
      multi_xml (>= 0.5.2)
@ -1049,7 +1046,7 @@ GEM
    jaeger-client (1.1.0)
      opentracing (~> 0.3)
      thrift
-    jaro_winkler (1.6.0)
+    jaro_winkler (1.6.1)
    jira-ruby (2.3.0)
      activesupport
      atlassian-jwt
@ -1107,7 +1104,7 @@ GEM
    language_server-protocol (3.17.0.3)
    launchy (2.5.2)
      addressable (~> 2.8)
-    lefthook (1.11.5)
+    lefthook (1.11.13)
    letter_opener (1.10.0)
      launchy (>= 2.2, < 4)
    letter_opener_web (3.0.0)
@ -1138,13 +1135,13 @@ GEM
      rake (~> 13.0)
    locale (2.1.4)
    lockbox (1.3.0)
-    logger (1.6.6)
+    logger (1.7.0)
    lograge (0.11.2)
      actionpack (>= 4)
      activesupport (>= 4)
      railties (>= 4)
      request_store (~> 1.0)
-    loofah (2.24.0)
+    loofah (2.24.1)
      crass (~> 1.0.2)
      nokogiri (>= 1.12.0)
    lookbook (2.3.4)
@ -1232,13 +1229,14 @@ GEM
      shellany (~> 0.0)
    numerizer (0.2.0)
    oauth (0.5.6)
-    oauth2 (2.0.9)
-      faraday (>= 0.17.3, < 3.0)
-      jwt (>= 1.0, < 3.0)
+    oauth2 (2.0.10)
+      faraday (>= 0.17.3, < 4.0)
+      jwt (>= 1.0, < 4.0)
+      logger (~> 1.2)
      multi_xml (~> 0.5)
      rack (>= 1.2, < 4)
      snaky_hash (~> 2.0)
-      version_gem (~> 1.1)
+      version_gem (>= 1.1.8, < 3)
    observer (0.1.2)
    octokit (9.2.0)
      faraday (>= 1, < 3)
@ -1256,7 +1254,7 @@ GEM
      plist (~> 3.1)
      train-core
      wmi-lite (~> 1.0)
-    oj (3.16.10)
+    oj (3.16.11)
      bigdecimal (>= 3.0)
      ostruct (>= 0.2)
    oj-introspect (0.8.0)
@ -1449,7 +1447,7 @@ GEM
    paper_trail (16.0.0)
      activerecord (>= 6.1)
      request_store (~> 1.4)
-    parallel (1.26.3)
+    parallel (1.27.0)
    parser (3.3.8.0)
      ast (~> 2.4.1)
      racc
@ -1492,7 +1490,7 @@ GEM
      coderay
      parser
      unparser
-    prometheus-client-mmap (1.2.9)
+    prometheus-client-mmap (1.2.10)
      base64
      bigdecimal
      logger
@ -1513,7 +1511,7 @@ GEM
      date
      stringio
    public_suffix (6.0.1)
-    puma (6.5.0)
+    puma (6.6.0)
      nio4r (~> 2.0)
    pyu-ruby-sasl (0.0.3.3)
    raabro (1.4.0)
@ -1647,7 +1645,7 @@ GEM
    rexml (3.4.1)
    rinku (2.0.0)
    rotp (6.3.0)
-    rouge (4.5.1)
+    rouge (4.5.2)
    rqrcode (2.2.0)
      chunky_png (~> 1.0)
      rqrcode_core (~> 1.0)
@ -1680,7 +1678,7 @@ GEM
    rspec-parameterized-table_syntax (1.0.0)
      binding_of_caller
      rspec-parameterized-core (< 2)
-    rspec-rails (7.0.1)
+    rspec-rails (7.1.1)
      actionpack (>= 7.0)
      activesupport (>= 7.0)
      railties (>= 7.0)
@ -1731,15 +1729,15 @@ GEM
    ruby-fogbugz (0.3.0)
      crack (~> 0.4)
      multipart-post (~> 2.0)
-    ruby-lsp (0.23.15)
+    ruby-lsp (0.23.20)
      language_server-protocol (~> 3.17.0)
      prism (>= 1.2, < 2.0)
      rbs (>= 3, < 4)
      sorbet-runtime (>= 0.5.10782)
    ruby-lsp-rails (0.3.31)
      ruby-lsp (>= 0.23.0, < 0.24.0)
-    ruby-lsp-rspec (0.1.22)
-      ruby-lsp (~> 0.23.0)
+    ruby-lsp-rspec (0.1.23)
+      ruby-lsp (~> 0.23.19)
    ruby-magic (0.6.0)
      mini_portile2 (~> 2.8)
    ruby-progressbar (1.11.0)
@ -1750,7 +1748,7 @@ GEM
    ruby2_keywords (0.0.5)
    rubyntlm (0.6.3)
    rubypants (0.2.0)
-    rubyzip (2.3.2)
+    rubyzip (2.4.1)
    rugged (1.6.3)
    safe_yaml (1.0.4)
    safety_net_attestation (0.4.0)
@ -1769,7 +1767,7 @@ GEM
    seed-fu (2.3.9)
      activerecord (>= 3.1)
      activesupport (>= 3.1)
-    selenium-webdriver (4.27.0)
+    selenium-webdriver (4.32.0)
      base64 (~> 0.2)
      logger (~> 1.4)
      rexml (~> 3.2, >= 3.2.5)
@ -1828,12 +1826,12 @@ GEM
      hashie
      version_gem (~> 1.1)
    snowplow-tracker (0.8.0)
-    solargraph (0.54.2)
+    solargraph (0.54.4)
      backport (~> 1.2)
      benchmark (~> 0.4)
      bundler (~> 2.0)
      diff-lcs (~> 1.4)
-      jaro_winkler (~> 1.6)
+      jaro_winkler (~> 1.6, >= 1.6.1)
      kramdown (~> 2.3)
      kramdown-parser-gfm (~> 1.1)
      logger (~> 1.6)
@ -1991,11 +1989,11 @@ GEM
    validates_hostname (1.0.13)
      activerecord (>= 3.0)
      activesupport (>= 3.0)
-    version_gem (1.1.0)
+    version_gem (1.1.8)
    version_sorter (2.3.0)
-    view_component (3.21.0)
+    view_component (3.23.2)
      activesupport (>= 5.2.0, < 8.1)
-      concurrent-ruby (~> 1.0)
+      concurrent-ruby (~> 1)
      method_source (~> 1.0)
    virtus (2.0.0)
      axiom-types (~> 0.1)
@ -2027,7 +2025,7 @@ GEM
      activesupport
      faraday (~> 2.0)
      faraday-follow_redirects
-    webmock (3.25.0)
+    webmock (3.25.1)
      addressable (>= 2.8.0)
      crack (>= 0.3.2)
      hashdiff (>= 0.4.0, < 2.0.0)
@ -2071,13 +2069,13 @@ DEPENDENCIES
  asciidoctor-include-ext (~> 0.4.0)
  asciidoctor-kroki (~> 0.10.0)
  asciidoctor-plantuml (~> 0.0.16)
-  async (~> 2.23.0)
+  async (~> 2.24.0)
  atlassian-jwt (~> 0.2.1)
-  attr_encrypted (~> 3.2.4)!
+  attr_encrypted (~> 4.2)
  awesome_print
  aws-sdk-cloudformation (~> 1)
-  aws-sdk-core (~> 3.223.0)
-  aws-sdk-s3 (~> 1.185.0)
+  aws-sdk-core (~> 3.225.0)
+  aws-sdk-s3 (~> 1.189.0)
  axe-core-rspec (~> 4.10.0)
  babosa (~> 2.0)
  base32 (~> 0.3.0)
@ -2088,7 +2086,7 @@ DEPENDENCIES
  better_errors (~> 2.10.1)
  bootsnap (~> 1.18.3)
  browser (~> 5.3.1)
-  bullet (~> 7.2.0)
+  bullet (~> 8.0.0)
  bundler-checksum (~> 0.1.0)!
  capybara (~> 3.40)
  capybara-screenshot (~> 1.0.26)
@ -2099,7 +2097,7 @@ DEPENDENCIES
  cloud_profiler_agent (~> 0.0.0)!
  commonmarker (~> 0.23.10)
  concurrent-ruby (~> 1.1)
-  connection_pool (~> 2.4)
+  connection_pool (~> 2.5.3)
  countries (~> 4.0.0)
  coverband (= 6.1.5)
  creole (~> 0.5.0)
@ -2138,7 +2136,7 @@ DEPENDENCIES
  faraday_middleware-aws-sigv4 (~> 1.0.1)
  fast_blank (~> 1.0.1)
  ffaker (~> 2.24)
-  ffi (~> 1.17)
+  ffi (~> 1.17.2)
  flipper (~> 0.28.0)
  flipper-active_record (~> 0.28.0)
  flipper-active_support_cache_store (~> 0.28.0)
@ -2152,17 +2150,17 @@ DEPENDENCIES
  gettext (~> 3.5, >= 3.5.1)
  gettext_i18n_rails (~> 1.13.0)
  git (~> 1.8)
-  gitaly (~> 17.8.0)
+  gitaly (~> 18.1.0.pre.rc1)
  gitlab-active-context!
  gitlab-backup-cli!
  gitlab-chronic (~> 0.10.5)
-  gitlab-cloud-connector (~> 1.11)
-  gitlab-crystalball (~> 0.7.2)
+  gitlab-cloud-connector (~> 1.14)
+  gitlab-crystalball (~> 1.1.0)
  gitlab-dangerfiles (~> 4.9.0)
-  gitlab-duo-workflow-service-client (~> 0.1)!
+  gitlab-duo-workflow-service-client (~> 0.2)!
  gitlab-experiment (~> 0.9.1)
  gitlab-fog-azure-rm (~> 2.2.0)
-  gitlab-glfm-markdown (~> 0.0.30)
+  gitlab-glfm-markdown (~> 0.0.31)
  gitlab-housekeeper!
  gitlab-http!
  gitlab-kas-grpc (~> 17.11.0)
@ -2212,7 +2210,7 @@ DEPENDENCIES
  graphlyte (~> 1.0.0)
  graphql (= 2.4.13)
  graphql-docs (~> 5.0.0)
-  grpc (= 1.63.0)
+  grpc (~> 1.72.0)
  gssapi (~> 1.3.1)
  guard-rspec
  haml_lint (~> 0.58)
@ -2221,7 +2219,7 @@ DEPENDENCIES
  health_check (~> 3.0)
  html-pipeline (~> 2.14.3)
  html2text
-  httparty (~> 0.22.0)
+  httparty (~> 0.23.0)
  i18n_data (~> 0.13.1)
  icalendar (~> 2.10.1)
  influxdb-client (~> 3.1)
@ -2244,7 +2242,7 @@ DEPENDENCIES
  licensee (~> 9.16)
  listen (~> 3.7)
  lockbox (~> 1.3.0)
-  logger (~> 1.6.0)
+  logger (~> 1.7.0)
  lograge (~> 0.5)
  loofah (~> 2.24.0)
  lookbook (~> 2.3)
@ -2326,7 +2324,7 @@ DEPENDENCIES
  pry-byebug
  pry-rails (~> 0.3.9)
  pry-shell (~> 0.6.4)
-  puma (= 6.5.0)
+  puma (= 6.6.0)
  rack (~> 2.2.9)
  rack-attack (~> 6.7.0)
  rack-cors (~> 2.0.1)
@ -2351,7 +2349,7 @@ DEPENDENCIES
  rqrcode (~> 2.2)
  rspec-benchmark (~> 0.6.0)
  rspec-parameterized (~> 1.0, >= 1.0.2)
-  rspec-rails (~> 7.0.0)
+  rspec-rails (~> 7.1.0)
  rspec-retry (~> 0.6.2)
  rspec_junit_formatter
  rspec_profiling (~> 0.0.9)
@ -2363,7 +2361,7 @@ DEPENDENCIES
  ruby-magic (~> 0.6)
  ruby-progressbar (~> 1.10)
  ruby-saml (~> 1.18)
-  rubyzip (~> 2.3.2)
+  rubyzip (~> 2.4.0)
  rugged (~> 1.6)
  sanitize (~> 6.0.2)
  sd_notify (~> 0.1.0)
@ -2414,7 +2412,7 @@ DEPENDENCIES
  valid_email (~> 0.1)
  validates_hostname (~> 1.0.13)
  version_sorter (~> 2.3)
-  view_component (~> 3.21.0)
+  view_component (~> 3.23.2)
  vite_rails (~> 3.0.17)
  vite_ruby (~> 3.9.0)
  vmstat (~> 2.3.0)
@ -2427,4 +2425,4 @@ DEPENDENCIES
  yard (~> 0.9)

 BUNDLED WITH
-   2.6.6
+   2.6.9
--- a/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
@ -468,10 +468,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "01jh5b1wh9gvgrkl2bgc93pimc0ncjbi5vsadgxxp9a8d4s9fb31";
+      sha256 = "0xs3qdlm8fj6zksqp5daamc51azwgbrp3b6mbqcxl22qdnn137aq";
      type = "gem";
    };
-    version = "2.23.1";
+    version = "2.24.0";
  };
  atlassian-jwt = {
    dependencies = [ "jwt" ];
@ -489,10 +489,11 @@ src: {
    groups = [ "default" ];
    platforms = [ ];
    source = {
-      path = "${src}/vendor/gems/attr_encrypted";
-      type = "path";
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0lddh6dznfvpic6c9pbb6wgzwd3jyp26abjfvi0fsf3fkqaq0p3y";
+      type = "gem";
    };
-    version = "3.2.4";
+    version = "4.2.0";
  };
  attr_required = {
    groups = [ "default" ];
@ -556,10 +557,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "09kb3k5vpymg846gajc5d3wznww63yiv3ygdf4v42d4pf4wpbr1i";
+      sha256 = "1bkkx0sz1lkqhzkrpklnalpv2dshvrdi12yq47xmv0nflhgzysmp";
      type = "gem";
    };
-    version = "1.41.0";
+    version = "1.131.0";
  };
  aws-sdk-core = {
    dependencies = [
@ -574,10 +575,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0xwcimg5i93ansmmww7ap8k6xxyijkxa8p896bxj9kc7cw8hkhyq";
+      sha256 = "1kafaaa9a2yh2cia6s2bn3m5jmya43l239j2ncbsndcq925xhjkw";
      type = "gem";
    };
-    version = "3.223.0";
+    version = "3.225.0";
  };
  aws-sdk-kms = {
    dependencies = [
@ -603,10 +604,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1ix5g1qnp7m0f8jk0bx0b5csx8p7zrxhnvkqc7jsyp9a3c4vnpky";
+      sha256 = "0x3ylssjaq9bvsgs89l601x1fywxzi80dc1xc8zgvzigsyk2yqia";
      type = "gem";
    };
-    version = "1.185.0";
+    version = "1.189.0";
  };
  aws-sigv4 = {
    dependencies = [ "aws-eventstream" ];
@ -873,10 +874,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0mdgj9yw1hmx3xh2qxyjc31y8igmxzd9h0c245ay2zkz76pl4k5c";
+      sha256 = "003xl226y120cbq1n99805jw6w75gcz1gs941yz3h7li3qy3kqha";
      type = "gem";
    };
-    version = "1.18.4";
+    version = "1.18.6";
  };
  browser = {
    groups = [ "default" ];
@ -914,10 +915,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "12gacycw1adsdjp14pm43619c6lcdaddhgbdizy7gnzmnjhwh0im";
+      sha256 = "0hn5nysivwlzwgwgh3m97kzjgfy8g7nl82b2pahdj0xqnrg91fdl";
      type = "gem";
    };
-    version = "7.2.0";
+    version = "8.0.8";
  };
  bundler-checksum = {
    dependencies = [ ];
@ -1636,10 +1637,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0zbsjj1bgwmsiqiw6x5fzbzp25xc10c02s37ggl2635ha0qzn05q";
+      sha256 = "0ycwbakxxir8dwh2fwg47hvi05dvp1s20fqr3yh8lbmb5kj3zzn5";
      type = "gem";
    };
-    version = "1.0.0";
+    version = "1.1.3";
  };
  devise = {
    dependencies = [
@ -1716,10 +1717,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "19xaz5qmw0kg1rdsjh13vk7674bpcmjy6cnddx1cvl80vgkvjr22";
+      sha256 = "1qs7drxvyzk3dg22xgblc12lq5kww9hhj7vpn8ay3l42rasllf3r";
      type = "gem";
    };
-    version = "3.4.3";
+    version = "3.4.4";
  };
  digest-crc = {
    dependencies = [ "rake" ];
@ -2211,10 +2212,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1mls9g490k63rdmjc9shqshqzznfn1y21wawkxrwp2vvbk13jwqm";
+      sha256 = "0xbv450qj2bx0qz9l2pjrd3kc057y6bglc3na7a78zby8ssiwlyc";
      type = "gem";
    };
-    version = "2.12.2";
+    version = "2.13.1";
  };
  faraday-follow_redirects = {
    dependencies = [ "faraday" ];
@ -2762,10 +2763,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0kvv1idqscqh03wp6xcb5mi03j5hksbnn8dadcwpv2izm0srfv8r";
+      sha256 = "02p7ysnali576bpdivlgnx31h4zwmg7aggx4kwfck51npg2s0rcg";
      type = "gem";
    };
-    version = "17.8.4";
+    version = "18.1.0.pre.rc1";
  };
  gitlab = {
    dependencies = [
@ -2856,13 +2857,16 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1bshayyh9pb2rgb9qc82dc9fr1xkf4kxj10rd0lkjqxnbh7ppsxi";
+      sha256 = "0d5zrz5vgb8zrnri42awqfvcq9kfzlrc032nprknddpb9iagbsmr";
      type = "gem";
    };
-    version = "1.12.0";
+    version = "1.17.0";
  };
  gitlab-crystalball = {
-    dependencies = [ "git" ];
+    dependencies = [
+      "git"
+      "ostruct"
+    ];
    groups = [
      "development"
      "test"
@ -2870,10 +2874,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "16mlrsd4lyvp9faqrnd7nmrl485wzrj2vp6y72x7f8wmsmqpivf4";
+      sha256 = "1a42qg2m7w0qn7as3zrc4v7lrxig532izi7yb2w8rbcwm114fcdx";
      type = "gem";
    };
-    version = "0.7.2";
+    version = "1.1.0";
  };
  gitlab-dangerfiles = {
    dependencies = [
@ -2889,10 +2893,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1cpiznkzlvsbanfcvnqdf0lxrzjd3i592d0j766xmr55mkc1jsr9";
+      sha256 = "162p00p59rxbhxglanzapl6qckc52q97s6hrf1p0ywnqhpv51h6m";
      type = "gem";
    };
-    version = "4.9.1";
+    version = "4.9.2";
  };
  gitlab-duo-workflow-service-client = {
    dependencies = [ "grpc" ];
@ -2902,7 +2906,7 @@ src: {
      path = "${src}/vendor/gems/gitlab-duo-workflow-service-client";
      type = "path";
    };
-    version = "0.1";
+    version = "0.2";
  };
  gitlab-experiment = {
    dependencies = [
@ -2944,10 +2948,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0rh0bij1nk0c6agqg39p5qwhc93fdgriwqwnshgrkn66kwzs7ppk";
+      sha256 = "06rd3q4xznh483aqmg2llaaa946psagrxd6va8g9zm3q3k3fkj4i";
      type = "gem";
    };
-    version = "0.0.30";
+    version = "0.0.31";
  };
  gitlab-housekeeper = {
    dependencies = [
@ -2990,10 +2994,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "075fasc3mv2l87l34cw5pw1vyf2ad254gsa9jpl4cqv3rx6hbfgj";
+      sha256 = "0lsz61cr7i3d72i6rxvbfqbq6f5anzbbmhmrmr7mprna4dy93d7q";
      type = "gem";
    };
-    version = "17.11.2";
+    version = "17.11.3";
  };
  gitlab-labkit = {
    dependencies = [
@ -3152,10 +3156,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1gip6bgsh6b284sjlz24ljydshsa9p5ikizwrmb82gnsc46dcsmk";
+      sha256 = "0b4908vic675qq1mh1i45vh5z9vdg1ynanxdbdzaazxvjkakdwzd";
      type = "gem";
    };
-    version = "0.26.1";
+    version = "0.29.1";
  };
  gitlab-security_report_schemas = {
    dependencies = [
@ -3656,10 +3660,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1afriizkvwwcyh0s0j1x9d9045pn4f767gpj5q49hicsqz8flq58";
+      sha256 = "1dsj349xm6jmd94xix8bgdn5m8jqqk9bsivlm9fll8ifa008ab0h";
      type = "gem";
    };
-    version = "3.25.7";
+    version = "3.25.8";
  };
  googleapis-common-protos = {
    dependencies = [
@ -3685,10 +3689,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "152nfvcnj1i1gsphhs7mhxzd0wa9pjdjb0xhgb2bry16ag57djxf";
+      sha256 = "0zyh9pxsw4zwv3iissirwqnx98qzkywqf3bwdrai6zpwph34ndsy";
      type = "gem";
    };
-    version = "1.19.0";
+    version = "1.20.0";
  };
  googleauth = {
    dependencies = [
@ -3882,10 +3886,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "11ink0ayf14qgs3msn5a7dpg49vm3ck2415r64nfk1i8xv286hsz";
+      sha256 = "02gakdhvpl777b41i8cgkrj7gk0jlq4fza9hjksp2r7ryji0vyjn";
      type = "gem";
    };
-    version = "1.63.0";
+    version = "1.72.0";
  };
  grpc-google-iam-v1 = {
    dependencies = [
@ -4203,10 +4207,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0v7s60abgwkahkqi4lf68hmz3j69jli3q25jsf9h1kvijif2lrbq";
+      sha256 = "0mbbjr774zxb2wcpbwc93l0i481bxk7ga5hpap76w3q1y9idvh9s";
      type = "gem";
    };
-    version = "0.22.0";
+    version = "0.23.1";
  };
  httpclient = {
    groups = [ "default" ];
@ -4410,10 +4414,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "09645h5an19zc1i7wlmixszj8xxqb2zc8qlf8dmx39bxpas1l24b";
+      sha256 = "14xkw4lb6wwvbcwqkf6ds116sridk9c8yz6y3caw07vzpwdvcmn0";
      type = "gem";
    };
-    version = "1.6.0";
+    version = "1.6.1";
  };
  jira-ruby = {
    dependencies = [
@ -4693,10 +4697,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "09m8m65iyk8d1y0g52srl7994c80f8ai33z8flbzhsjqr2wy17rh";
+      sha256 = "18msiw0b3krm9krxrahiladblh6pjpj395wcjjw2fvsimwyy7vk4";
      type = "gem";
    };
-    version = "1.11.5";
+    version = "1.11.13";
  };
  letter_opener = {
    dependencies = [ "launchy" ];
@ -4838,15 +4842,16 @@ src: {
      "danger"
      "default"
      "development"
+      "monorepo"
      "test"
    ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "05s008w9vy7is3njblmavrbdzyrwwc1fsziffdr58w9pwqj8sqfx";
+      sha256 = "00q2zznygpbls8asz5knjvvj2brr3ghmqxgr83xnrdj4rk3xwvhr";
      type = "gem";
    };
-    version = "1.6.6";
+    version = "1.7.0";
  };
  lograge = {
    dependencies = [
@ -4878,10 +4883,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "07pfa5kgl7k2hxlzzn89qna6bmiyrxlchgbzi0885frsi08agrk1";
+      sha256 = "0dx316q03x6rpdbl610rdaj2vfd5s8fanixk21j4gv3h5f230nk5";
      type = "gem";
    };
-    version = "2.24.0";
+    version = "2.24.1";
  };
  lookbook = {
    dependencies = [
@ -5561,6 +5566,7 @@ src: {
    dependencies = [
      "faraday"
      "jwt"
+      "logger"
      "multi_xml"
      "rack"
      "snaky_hash"
@ -5570,10 +5576,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1yzpaghh8kwzgmvmrlbzf36ks5s2hf34rayzw081dp2jrzprs7xj";
+      sha256 = "0hisvj04523xsq0cmaw2lzwjj2pgwvkxfs6c9dfqh8cdb5wjc4wg";
      type = "gem";
    };
-    version = "2.0.9";
+    version = "2.0.10";
  };
  observer = {
    groups = [
@ -5640,10 +5646,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0z1xw7xm7xkxnslhxqvfzvv5f1q1cl40niwvaxny2cg3fkcvw9kz";
+      sha256 = "1cajn3ylwhby1x51d9hbchm964qwb5zp63f7sfdm55n85ffn1ara";
      type = "gem";
    };
-    version = "3.16.10";
+    version = "3.16.11";
  };
  oj-introspect = {
    dependencies = [ "oj" ];
@ -6523,10 +6529,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1vy7sjs2pgz4i96v5yk9b7aafbffnvq7nn419fgvw55qlavsnsyq";
+      sha256 = "0c719bfgcszqvk9z47w2p8j2wkz5y35k48ywwas5yxbbh3hm3haa";
      type = "gem";
    };
-    version = "1.26.3";
+    version = "1.27.0";
  };
  parser = {
    dependencies = [
@ -6792,10 +6798,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0120712ar9cmjgyqrihf36pcslx8m73gp0l86dfw8yvn8gs9xzr0";
+      sha256 = "0i0l7v26vq8k6wvsfk9fzpswilbg4214d9p9xc87kmswl1kwxm26";
      type = "gem";
    };
-    version = "1.2.9";
+    version = "1.2.10";
  };
  pry = {
    dependencies = [
@ -6904,10 +6910,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1wl9q4fl8gvhwdpfxghx6jdqi4508287pcgiwi96sdbzmdfbglcl";
+      sha256 = "11xd3207k5rl6bz0qxhcb3zcr941rhx7ig2f19gxxmdk7s3hcp7j";
      type = "gem";
    };
-    version = "6.5.0";
+    version = "6.6.0";
  };
  pyu-ruby-sasl = {
    groups = [ "default" ];
@ -7659,10 +7665,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1pchwrkr0994v7mh054lcp0na3bk3mj2sk0dc33bn6bhxrnirj1a";
+      sha256 = "18v8if3jix029rr3j8iwisv73facw223353n0h7avl39ibxk6hh3";
      type = "gem";
    };
-    version = "4.5.1";
+    version = "4.5.2";
  };
  rqrcode = {
    dependencies = [
@ -7845,10 +7851,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1ycjggcmzbgrfjk04v26b43c3fj5jq2qic911qk7585wvav2qaxd";
+      sha256 = "0cg3ay2jin7jv20carhx3icv3gnwka0hqcr15zcjy7i1xnmwqpg1";
      type = "gem";
    };
-    version = "7.0.1";
+    version = "7.1.1";
  };
  rspec-retry = {
    dependencies = [ "rspec-core" ];
@ -8082,10 +8088,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "17z0hi70s201gxw251hgv4r9zmfky2jlmp3pwma7hixsfpkx6gay";
+      sha256 = "0s97zck9v2c1awk4lbj5ccsnn6p0jp018mrq12fvh5hp00sn3586";
      type = "gem";
    };
-    version = "0.23.15";
+    version = "0.23.20";
  };
  ruby-lsp-rails = {
    dependencies = [ "ruby-lsp" ];
@ -8104,10 +8110,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1h2rnylicx9cw2agrxzgxcr0bl2ac8iy99sz7w657hbfrpsyv0p9";
+      sha256 = "1lv886262vzmjpgcd0759zn86yaidjn1wznnscn75saj4d81bafj";
      type = "gem";
    };
-    version = "0.1.22";
+    version = "0.1.23";
  };
  ruby-magic = {
    dependencies = [ "mini_portile2" ];
@ -8206,10 +8212,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0grps9197qyxakbpw02pda59v45lfgbgiyw48i0mq9f2bn9y6mrz";
+      sha256 = "05an0wz87vkmqwcwyh5rjiaavydfn5f4q1lixcsqkphzvj7chxw5";
      type = "gem";
    };
-    version = "2.3.2";
+    version = "2.4.1";
  };
  rugged = {
    groups = [
@ -8352,10 +8358,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1q5nbszbxz566yzyiv0a4lvfk56q89k0lk4mqp6wyddrc2nz88c8";
+      sha256 = "1zlamvlgszczfx2f2v1b34q0lka15cqj46krwb4ymgl6nlkxznr0";
      type = "gem";
    };
-    version = "4.27.0";
+    version = "4.32.0";
  };
  semver_dialects = {
    dependencies = [
@ -8687,10 +8693,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0mkc1fxz4anv7fcq9jn26dc5ppwriand778f9dklzrpgq9pga8py";
+      sha256 = "1q40v3xrx8zzcpk84mcb4f80zc49vp98pphlffb5w20sa760a9w4";
      type = "gem";
    };
-    version = "0.54.2";
+    version = "0.54.4";
  };
  solargraph-rspec = {
    dependencies = [ "solargraph" ];
@ -9643,10 +9649,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "104s7p4zp5yvf0bvbwd9mqmnkgz2z89h4hbvxi8pzd8d08c9a03b";
+      sha256 = "0270m29n7mq9yq4xnjzryzr6jxf292ahjn9fzywm2rg3rdz7cr59";
      type = "gem";
    };
-    version = "1.1.0";
+    version = "1.1.8";
  };
  version_sorter = {
    groups = [ "default" ];
@ -9671,10 +9677,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0p6z21kqz05966l77rfj7hdmhb6drld7qaxdbx4qawwylay7fnkz";
+      sha256 = "0aw962shs2x52dy1vhzkw1qc0b5vxmgaab6lld7hggrqkr5ysbrw";
      type = "gem";
    };
-    version = "3.21.0";
+    version = "3.23.2";
  };
  virtus = {
    dependencies = [
@ -9807,10 +9813,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "13hrfja9as50ymbzsmlqsnv3ijirnf6mini21y1qq04793y26g2p";
+      sha256 = "08v374yrqqhjj3xjzmvwnv3yz21r22kn071yr0i67gmwaf9mv7db";
      type = "gem";
    };
-    version = "3.25.0";
+    version = "3.25.1";
  };
  webrick = {
    groups = [
--- a/pkgs/by-name/ho/home-manager/package.nix
+++ b/pkgs/by-name/ho/home-manager/package.nix
@ -19,14 +19,14 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "home-manager";
-  version = "0-unstable-2025-06-13";
+  version = "0-unstable-2025-06-22";

  src = fetchFromGitHub {
    name = "home-manager-source";
    owner = "nix-community";
    repo = "home-manager";
-    rev = "79dfd9aa295e53773aad45480b44c131da29f35b";
-    hash = "sha256-X3WAS322EsebI4ohJcXhKpiyG1v+7wE4VOiXy1pxM/c=";
+    rev = "7c35504839f915abec86a96435b881ead7eb6a2b";
+    hash = "sha256-6WH0aRFay79r775RuTqUcnoZNm6A4uHxU1sbcNIk63s=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ja/jasmin-compiler/package.nix
+++ b/pkgs/by-name/ja/jasmin-compiler/package.nix
@ -9,11 +9,11 @@

 stdenv.mkDerivation rec {
  pname = "jasmin-compiler";
-  version = "2025.02.1";
+  version = "2025.06.0";

  src = fetchurl {
    url = "https://github.com/jasmin-lang/jasmin/releases/download/v${version}/jasmin-compiler-v${version}.tar.bz2";
-    hash = "sha256-7WGEtsTJ4/R+30gzFlYpCvZrZyziZ6gDCemWEFX+5hk=";
+    hash = "sha256-VjWNvg/aF+omobF8b4YpRwVYM5K/b0GLoe1P/83ilk8=";
  };

  nativeBuildInputs = with ocamlPackages; [
--- a/pkgs/by-name/ka/kaniko/package.nix
+++ b/pkgs/by-name/ka/kaniko/package.nix
@ -6,17 +6,18 @@
  installShellFiles,
  testers,
  kaniko,
+  versionCheckHook,
 }:

-buildGoModule rec {
+buildGoModule (finalAttrs: {
  pname = "kaniko";
-  version = "1.24.0";
+  version = "1.25.0";

  src = fetchFromGitHub {
-    owner = "GoogleContainerTools";
+    owner = "chainguard-dev";
    repo = "kaniko";
-    rev = "v${version}";
-    hash = "sha256-Y/sdbLcmBxUBU9io1RV/CnbuBN4I334BWUDeBoHFRm8=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-6WOczDWIbxFH9OLMQ+KirUEwPeiq3vFm3MdQQk9D+po=";
  };

  vendorHash = null;
@ -24,29 +25,34 @@ buildGoModule rec {
  ldflags = [
    "-s"
    "-w"
-    "-X github.com/GoogleContainerTools/kaniko/pkg/version.version=${version}"
+    "-X github.com/chainguard-dev/kaniko/pkg/version.version=${finalAttrs.version}"
  ];

+  excludedPackages = [ "hack/release_notes" ];
+
  nativeBuildInputs = [ installShellFiles ];

  doCheck = false; # requires docker, container-diff (unpackaged yet)

-  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-    for shell in bash fish zsh; do
-      $out/bin/executor completion $shell > executor.$shell
-      installShellCompletion executor.$shell
-    done
-  '';
+  postInstall =
+    let
+      inherit (finalAttrs.meta) mainProgram;
+    in
+    lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+      for shell in bash fish zsh; do
+        $out/bin/${mainProgram} completion $shell > ${mainProgram}.$shell
+        installShellCompletion ${mainProgram}.$shell
+      done
+    '';

-  passthru.tests.version = testers.testVersion {
-    package = kaniko;
-    version = version;
-    command = "${kaniko}/bin/executor version";
-  };
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/${finalAttrs.meta.mainProgram}";
+  versionCheckProgramArg = "version";

  meta = {
    description = "Tool to build container images from a Dockerfile, inside a container or Kubernetes cluster";
-    homepage = "https://github.com/GoogleContainerTools/kaniko";
+    homepage = "https://github.com/chainguard-dev/kaniko";
    license = lib.licenses.asl20;
    platforms = lib.platforms.linux;
    maintainers = with lib.maintainers; [
@ -55,4 +61,4 @@ buildGoModule rec {
    ];
    mainProgram = "executor";
  };
-}
+})
--- a/pkgs/by-name/mo/monkeysAudio/package.nix
+++ b/pkgs/by-name/mo/monkeysAudio/package.nix
@ -6,12 +6,12 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "11.17";
+  version = "11.18";
  pname = "monkeys-audio";

  src = fetchzip {
    url = "https://monkeysaudio.com/files/MAC_${builtins.concatStringsSep "" (lib.strings.splitString "." finalAttrs.version)}_SDK.zip";
-    hash = "sha256-GPuor0A9NsObRr66HUYXCQJmM2EW87FyeMJiwB/K6Vc=";
+    hash = "sha256-RkxnV9b7gzZgRl5YaMwwVkOJwdtEFwyZRvQw/B1CciM=";
    stripRoot = false;
  };

--- a/pkgs/by-name/mu/museum/package.nix
+++ b/pkgs/by-name/mu/museum/package.nix
@ -9,14 +9,14 @@

 buildGoModule rec {
  pname = "museum";
-  version = "1.0.10";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "ente-io";
    repo = "ente";
    sparseCheckout = [ "server" ];
    rev = "photos-v${version}";
-    hash = "sha256-CX12JrKlI7FMizk29LXO5e5i7pmgjzni/RY97020UZg=";
+    hash = "sha256-1LG8JcZxG4zWSQ9qQCRQwuXfL5HY9rOQKK2n5erq/kU=";
  };

  vendorHash = "sha256-px4pMqeH73Fe06va4+n6hklIUDMbPmAQNKKRIhwv6ec=";
--- a/pkgs/by-name/ne/nezha/package.nix
+++ b/pkgs/by-name/ne/nezha/package.nix
@ -14,7 +14,7 @@

 let
  pname = "nezha";
-  version = "1.12.4";
+  version = "1.13.0";

  frontendName = lib.removePrefix "nezha-theme-";

@ -58,7 +58,7 @@ buildGo124Module {
    owner = "nezhahq";
    repo = "nezha";
    tag = "v${version}";
-    hash = "sha256-f9zP9koWjP8PPtQhbYx56J1mW8+xKuZCfxgOLw6XGc0=";
+    hash = "sha256-lZN9ZH70AzDCtvFnr2dxjXSKhGd/+HvN9hCydlOYpKU=";
  };

  proxyVendor = true;
--- a/pkgs/by-name/no/noto-fonts-color-emoji/package.nix
+++ b/pkgs/by-name/no/noto-fonts-color-emoji/package.nix
@ -14,13 +14,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "noto-fonts-color-emoji";
-  version = "2.047";
+  version = "2.048";

  src = fetchFromGitHub {
    owner = "googlefonts";
    repo = "noto-emoji";
    rev = "v${version}";
-    hash = "sha256-v1vLXs8peNF6S7iBLViAWQSW042lwIDqAjB270pRPF0=";
+    hash = "sha256-GYBnMpSUDNjAOZtbRPSmbW39TWP5ljEMukQRwq4J9U4=";
  };

  depsBuildBuild = [
--- a/pkgs/by-name/ol/olympus-unwrapped/package.nix
+++ b/pkgs/by-name/ol/olympus-unwrapped/package.nix
@ -31,9 +31,9 @@ let

  phome = "$out/lib/olympus";
  # The following variables are to be updated by the update script.
-  version = "25.04.20.01";
-  buildId = "4758"; # IMPORTANT: This line is matched with regex in update.sh.
-  rev = "10e01bf182e51d1fc2b6060622108a1fb98ae7b7";
+  version = "25.06.17.01";
+  buildId = "4899"; # IMPORTANT: This line is matched with regex in update.sh.
+  rev = "dc90221a4528e92e147de5746a6657d87b1856fa";
 in
 buildDotnetModule {
  pname = "olympus-unwrapped";
@ -44,7 +44,7 @@ buildDotnetModule {
    owner = "EverestAPI";
    repo = "Olympus";
    fetchSubmodules = true; # Required. See upstream's README.
-    hash = "sha256-7Xdd6AdDpHQUmQ3ogEyir/OQwvOcVDMtweE3D/v4uuQ=";
+    hash = "sha256-s73gIjqxTloYr5gwL9fHPhBh+fq5d1RFp8PeLe6bI84=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/om/omnom/0001-fix-minimal-go-version.patch
+++ b/pkgs/by-name/om/omnom/0001-fix-minimal-go-version.patch
@ -1,83 +0,0 @@
-Bump the minimal Go version as some features require Go 1.17 and higher to work
-
---
- go.mod | 48 ++++++++++++++++++++++++++++++++++++++----------
- 1 file changed, 38 insertions(+), 10 deletions(-)
-
-diff --git a/go.mod b/go.mod
-index 1756ffe..81f7fa2 100644
--- a/go.mod
-+++ b/go.mod
-@@ -1,31 +1,59 @@
- module github.com/asciimoo/omnom
-
-go 1.15
-+go 1.17
-
- require (
-	github.com/boj/redistore v0.0.0-20180917114910-cd5dcc76aeff // indirect
-	github.com/bytedance/sonic v1.12.1 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.5 // indirect
- 	github.com/gin-contrib/multitemplate v1.0.1
- 	github.com/gin-gonic/contrib v0.0.0-20240508051311-c1c6bf0061b0
- 	github.com/gin-gonic/gin v1.10.0
-+	github.com/spf13/cobra v1.8.1
-+	github.com/xhit/go-simple-mail/v2 v2.16.0
-+	golang.org/x/net v0.27.0
-+	gopkg.in/yaml.v2 v2.4.0
-+	gorm.io/driver/sqlite v1.5.6
-+	gorm.io/gorm v1.25.11
-+)
-+
-+require (
-+	github.com/boj/redistore v0.0.0-20180917114910-cd5dcc76aeff // indirect
-+	github.com/bytedance/sonic v1.12.1 // indirect
-+	github.com/bytedance/sonic/loader v0.2.0 // indirect
-+	github.com/cloudwego/base64x v0.1.4 // indirect
-+	github.com/cloudwego/iasm v0.2.0 // indirect
-+	github.com/gabriel-vasile/mimetype v1.4.5 // indirect
-+	github.com/gin-contrib/sse v0.1.0 // indirect
-+	github.com/go-playground/locales v0.14.1 // indirect
-+	github.com/go-playground/universal-translator v0.18.1 // indirect
- 	github.com/go-playground/validator/v10 v10.22.0 // indirect
- 	github.com/go-test/deep v1.1.1 // indirect
- 	github.com/goccy/go-json v0.10.3 // indirect
-+	github.com/gomodule/redigo v2.0.0+incompatible // indirect
-+	github.com/google/go-cmp v0.6.0 // indirect
- 	github.com/gorilla/context v1.1.2 // indirect
-+	github.com/gorilla/securecookie v1.1.2 // indirect
- 	github.com/gorilla/sessions v1.3.0 // indirect
-+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-+	github.com/jinzhu/inflection v1.0.0 // indirect
-+	github.com/jinzhu/now v1.1.5 // indirect
-+	github.com/json-iterator/go v1.1.12 // indirect
- 	github.com/klauspost/cpuid/v2 v2.2.8 // indirect
- 	github.com/kr/pretty v0.3.0 // indirect
-+	github.com/leodido/go-urn v1.4.0 // indirect
-+	github.com/mattn/go-isatty v0.0.20 // indirect
-+	github.com/mattn/go-sqlite3 v1.14.22 // indirect
-+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-+	github.com/modern-go/reflect2 v1.0.2 // indirect
-+	github.com/pelletier/go-toml/v2 v2.2.2 // indirect
- 	github.com/rogpeppe/go-internal v1.8.0 // indirect
-	github.com/spf13/cobra v1.8.1
-+	github.com/spf13/pflag v1.0.5 // indirect
- 	github.com/toorop/go-dkim v0.0.0-20240103092955-90b7d1423f92 // indirect
-	github.com/xhit/go-simple-mail/v2 v2.16.0
-+	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
-+	github.com/ugorji/go/codec v1.2.12 // indirect
- 	golang.org/x/arch v0.9.0 // indirect
-	golang.org/x/net v0.27.0
-+	golang.org/x/crypto v0.25.0 // indirect
- 	golang.org/x/sys v0.23.0 // indirect
-+	golang.org/x/text v0.16.0 // indirect
- 	google.golang.org/protobuf v1.34.2 // indirect
- 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
-	gopkg.in/yaml.v2 v2.4.0
-	gorm.io/driver/sqlite v1.5.6
-	gorm.io/gorm v1.25.11
-+	gopkg.in/yaml.v3 v3.0.1 // indirect
- )
--
-2.45.2
-
--- a/pkgs/by-name/om/omnom/package.nix
+++ b/pkgs/by-name/om/omnom/package.nix
@ -4,6 +4,7 @@
  fetchFromGitHub,
  nix-update-script,
  makeWrapper,
+  nixosTests,

  # for addons
  buildNpmPackage,
@ -12,22 +13,20 @@

 buildGoModule (finalAttrs: {
  pname = "omnom";
-  version = "0.3.0";
+  version = "0.4.0";

  src = fetchFromGitHub {
    owner = "asciimoo";
    repo = "omnom";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-2D+hEOlyjCJQKnLBBO1cXeqTS/QUWraPWPtI8pCf9KM=";
+    hash = "sha256-xspzTRIYUJSdI2Z/FAS2ecLpEEmEVGIwlhjrS5Yxh2c=";
    fetchSubmodules = true;
  };

-  vendorHash = "sha256-dsS5w8JXIwkneWScOFzLSDiXq+clgK+RdYiMw0+FnvY=";
+  vendorHash = "sha256-qOl6f83k91K7YNF7lBbL66lXb/XWbGHyXeN7ZTchsI8=";

  passthru.updateScript = nix-update-script { };

-  patches = [ ./0001-fix-minimal-go-version.patch ];
-
  nativeBuildInputs = [ makeWrapper ];

  ldflags = [
@ -47,6 +46,12 @@ buildGoModule (finalAttrs: {

        nativeBuildInputs = [ zip ];

+        # Fix path for the `static` directory
+        postConfigure = ''
+          substituteInPlace webpack.config.js \
+          --replace-fail '"..", ".."' '".."'
+        '';
+
        postBuild = ''
          mkdir -p $out

@ -77,6 +82,8 @@ buildGoModule (finalAttrs: {
    cp config.yml_sample $out/share/examples/config.yml
  '';

+  passthru.tests = nixosTests.omnom;
+
  meta = {
    description = "Webpage bookmarking and snapshotting service";
    homepage = "https://github.com/asciimoo/omnom";
--- a/pkgs/by-name/ou/ouch/package.nix
+++ b/pkgs/by-name/ou/ouch/package.nix
@ -10,6 +10,10 @@
  git,
  zlib,
  zstd,
+
+  # RAR code is under non-free unRAR license
+  # see the meta.license section below for more details
+  enableUnfree ? false,
 }:

 rustPlatform.buildRustPackage rec {
@ -44,7 +48,17 @@ rustPlatform.buildRustPackage rec {
    zstd
  ];

-  buildFeatures = [ "zstd/pkg-config" ];
+  buildNoDefaultFeatures = true;
+  buildFeatures =
+    [
+      "use_zlib"
+      "use_zstd_thin"
+      # "bzip3" will be optional in the next version
+      "zstd/pkg-config"
+    ]
+    ++ lib.optionals enableUnfree [
+      "unrar"
+    ];

  postInstall = ''
    installManPage artifacts/*.1
@ -57,7 +71,7 @@ rustPlatform.buildRustPackage rec {
    description = "Command-line utility for easily compressing and decompressing files and directories";
    homepage = "https://github.com/ouch-org/ouch";
    changelog = "https://github.com/ouch-org/ouch/blob/${version}/CHANGELOG.md";
-    license = lib.licenses.mit;
+    license = with lib.licenses; [ mit ] ++ lib.optionals enableUnfree [ unfreeRedistributable ];
    maintainers = with lib.maintainers; [
      figsoda
      psibi
--- a/pkgs/by-name/si/sillytavern/package.nix
+++ b/pkgs/by-name/si/sillytavern/package.nix
@ -7,15 +7,15 @@
 }:
 buildNpmPackage (finalAttrs: {
  pname = "sillytavern";
-  version = "1.13.0";
+  version = "1.13.1";

  src = fetchFromGitHub {
    owner = "SillyTavern";
    repo = "SillyTavern";
    tag = finalAttrs.version;
-    hash = "sha256-HUlypAPadlad12J60Xfa30qE18II6MceVYkMqANWlyI=";
+    hash = "sha256-rWDJBuGzgG34jpsBPdLqIegcOfV3bRyOdulRsMS2mhg=";
  };
-  npmDepsHash = "sha256-IZMwDgazY+6oyuOlE7zdWcDn5D2/8v2mHX9yDBwK+4I=";
+  npmDepsHash = "sha256-DyqAaaeSCAdsKXWUo1t4FpUuqu1n4TfZBLg23URuNUM=";

  nativeBuildInputs = [ makeBinaryWrapper ];

--- a/pkgs/by-name/sn/snapcraft/package.nix
+++ b/pkgs/by-name/sn/snapcraft/package.nix
@ -14,7 +14,7 @@

 python312Packages.buildPythonApplication rec {
  pname = "snapcraft";
-  version = "8.9.4";
+  version = "8.9.5";

  pyproject = true;

@ -22,7 +22,7 @@ python312Packages.buildPythonApplication rec {
    owner = "canonical";
    repo = "snapcraft";
    tag = version;
-    hash = "sha256-iiz+sVncztaCNndU+4YMhxECw7R6ks+25apRnd0WgyM=";
+    hash = "sha256-bwk9wK8fIXhhmj4XdtpTzZfzZkAtETpfMleTrbYt6Ww=";
  };

  patches = [
--- a/pkgs/by-name/sn/snx-rs/package.nix
+++ b/pkgs/by-name/sn/snx-rs/package.nix
@ -14,13 +14,13 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "snx-rs";
-  version = "4.4.3";
+  version = "4.4.4";

  src = fetchFromGitHub {
    owner = "ancwrd1";
    repo = "snx-rs";
    tag = "v${version}";
-    hash = "sha256-dGK+52sOyJs4P3SfTdjPPSbBgSyVGFHcNw45Jed6aVo=";
+    hash = "sha256-FVrj26pQthy6gY6UWXD4ACvy0/PPLXM0zrGOIjXl07U=";
  };

  passthru.updateScript = nix-update-script { };
@ -48,7 +48,7 @@ rustPlatform.buildRustPackage rec {
  ];

  useFetchCargoVendor = true;
-  cargoHash = "sha256-9yZ8TSWy+S1sNS4cnJvEi7Ttt8zqF4PkxR5/FzVg4Ds=";
+  cargoHash = "sha256-ZzVTl1IVTAut+7o9QXaPDk8QCemRt2EoYX/Wi0RXJ3U=";

  doInstallCheck = true;
  versionCheckProgram = "${placeholder "out"}/bin/snx-rs";
--- a/pkgs/by-name/st/stevenblack-blocklist/package.nix
+++ b/pkgs/by-name/st/stevenblack-blocklist/package.nix
@ -6,13 +6,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "stevenblack-blocklist";
-  version = "3.15.45";
+  version = "3.15.48";

  src = fetchFromGitHub {
    owner = "StevenBlack";
    repo = "hosts";
    tag = finalAttrs.version;
-    hash = "sha256-ONPW+AAFSeG808KUyGpvIYrnKrCu9WLoLkrxsaYPD5o=";
+    hash = "sha256-nUwtgfOf/JialxNHwTT9JAYZtdGZevVPKLwpLrU8T5A=";
  };

  outputs = [
--- a/pkgs/by-name/ta/task-master-ai/package.nix
+++ b/pkgs/by-name/ta/task-master-ai/package.nix
@ -2,6 +2,7 @@
  lib,
  buildNpmPackage,
  fetchFromGitHub,
+  nodejs,
  nix-update-script,
 }:
 buildNpmPackage (finalAttrs: {
@ -19,6 +20,8 @@ buildNpmPackage (finalAttrs: {

  dontNpmBuild = true;

+  makeWrapperArgs = [ "--prefix PATH : ${lib.makeBinPath [ nodejs ]}" ];
+
  passthru.updateScript = nix-update-script { };

  meta = with lib; {
--- a/pkgs/by-name/to/tombi/package.nix
+++ b/pkgs/by-name/to/tombi/package.nix
@ -7,19 +7,19 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "tombi";
-  version = "0.4.9";
+  version = "0.4.13";

  src = fetchFromGitHub {
    owner = "tombi-toml";
    repo = "tombi";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-2516aT6zaI5bntjjJ/p/yk0gWW6fzixQx5ESs29aS6Q=";
+    hash = "sha256-DYr9RtWV2Fs1YGQ5V00eACLerJSsm34mPYdmVWRKXSQ=";
  };

  # Tests relies on the presence of network
  doCheck = false;
  cargoBuildFlags = [ "--package tombi-cli" ];
-  cargoHash = "sha256-cVj0dL9vGVm3WPQ5IA2LDxDLHia5T+pLi6rTQxAqoC4=";
+  cargoHash = "sha256-JyYA/Bu1gcj7s5hxx9LOcrN28Klhz3Qy1SbGoWEiwnA=";

  postPatch = ''
    substituteInPlace Cargo.toml \
--- a/pkgs/by-name/un/uncover/package.nix
+++ b/pkgs/by-name/un/uncover/package.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "uncover";
-  version = "1.0.10";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "projectdiscovery";
    repo = "uncover";
    tag = "v${version}";
-    hash = "sha256-q8ecgTY2uDo4O+/CqK9aYnYb4oArDIvga9C/tG9IooE=";
+    hash = "sha256-BRh25lvk3Zut5M6dedLuSET4514R9j0fUHmamw4rp5U=";
  };

-  vendorHash = "sha256-Pm3CFHdp0VHZ5tRrjnpXXaIwQFu7EXyVgo/K9OOqHBI=";
+  vendorHash = "sha256-6TvPKp/P0v/ZJRGRICp77C/8FHupyr9Hy2+zlYc2HIU=";

  subPackages = [ "cmd/uncover" ];

--- a/pkgs/by-name/wl/wlr-which-key/package.nix
+++ b/pkgs/by-name/wl/wlr-which-key/package.nix
@ -11,17 +11,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "wlr-which-key";
-  version = "1.1.0";
+  version = "1.2.0";

  src = fetchFromGitHub {
    owner = "MaxVerevkin";
    repo = "wlr-which-key";
    rev = "v${version}";
-    hash = "sha256-BEf1qpy0bVPi5nmu3UUiv8k0bJvE5VFB5Zqb5lS0+t4=";
+    hash = "sha256-P7DtSTyAfgACEfpnxYXhQ+Rvdw4rg2hFllCN1mEGfJQ=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-409PW1Ya38imGqtrVqOI50yJa49/RjB68yGQZSvyYd0=";
+  cargoHash = "sha256-yH05tpJiEDP0qEhDY3dpf2cxYeJYVOvOQyfcgg2vPQk=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/wo/worldpainter/package.nix
+++ b/pkgs/by-name/wo/worldpainter/package.nix
@ -10,11 +10,11 @@
 }:
 stdenv.mkDerivation rec {
  pname = "worldpainter";
-  version = "2.24.1";
+  version = "2.24.2";

  src = fetchurl {
    url = "https://www.worldpainter.net/files/${pname}_${version}.tar.gz";
-    hash = "sha256-I7bf+BKaHSsR08stLtJu+wY5ek8cj+SjRVwu+RwqEq0=";
+    hash = "sha256-tY4K8yNPRrNU4u5rpPy/sPyOh2NhvlbqXbj8WNLVRq4=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/ocaml-modules/dolmen/linol-common-migration.patch
+++ b/pkgs/development/ocaml-modules/dolmen/linol-common-migration.patch
@ -0,0 +1,137 @@
+diff --git i/src/lsp/diagnostic.ml w/src/lsp/diagnostic.ml
+index 149cde11..bd93298a 100644
+--- i/src/lsp/diagnostic.ml
+++ w/src/lsp/diagnostic.ml
+@@ -1,13 +1,12 @@
+-
+ (* This file is free software, part of dolmen. See file "LICENSE" for more information *)
+ 
+-type t = Lsp.Types.Diagnostic.t
+type t = Linol__.Common_.Lsp.Types.Diagnostic.t
+ 
+ let lsp_pos line character =
+-  Lsp.Types.Position.create ~line ~character
+  Linol__.Common_.Lsp.Types.Position.create ~line ~character
+ 
+ let lsp_range start end_ =
+-  Lsp.Types.Range.create ~start ~end_
+  Linol__.Common_.Lsp.Types.Range.create ~start ~end_
+ 
+ let start_pos = lsp_pos 1 1
+ let start_range = lsp_range start_pos start_pos
+@@ -23,17 +22,15 @@ let range_of_loc = function
+         (lsp_pos (l.stop_line - 1) l.stop_column)
+ 
+ let warn ?loc message =
+-  Lsp.Types.Diagnostic.create ()
+  Linol__.Common_.Lsp.Types.Diagnostic.create ()
+     ~range:(range_of_loc loc)
+     ~severity:Warning
+     ~source:"dolmenls"
+     ~message
+ 
+ let error ?loc message =
+-  Lsp.Types.Diagnostic.create ()
+  Linol__.Common_.Lsp.Types.Diagnostic.create ()
+     ~range:(range_of_loc loc)
+     ~severity:Error
+     ~source:"dolmenls"
+     ~message
+-
+-
+diff --git i/src/lsp/main.ml w/src/lsp/main.ml
+index 8d6fc760..b52dd25c 100644
+--- i/src/lsp/main.ml
+++ w/src/lsp/main.ml
+@@ -3,7 +3,7 @@
+ 
+ let run () =
+   let s = new Server.dolmen_lsp_server in
+-  let server = Linol_lwt.Jsonrpc2.create_stdio s in
+  let server = Linol_lwt.Jsonrpc2.create_stdio ~env:() s in
+   let task = Linol_lwt.Jsonrpc2.run server in
+   match Linol_lwt.run task with
+   | () -> ()
+diff --git i/src/lsp/server.ml w/src/lsp/server.ml
+index e895cc6a..a01ed9fb 100644
+--- i/src/lsp/server.ml
+++ w/src/lsp/server.ml
+@@ -44,25 +44,28 @@ class dolmen_lsp_server =
+   object(self)
+     inherit Linol_lwt.Jsonrpc2.server
+ 
+    method spawn_query_handler f = Linol_lwt.spawn f
+
+     (* one env per document *)
+-    val buffers: (Lsp.Types.DocumentUri.t, State.t) Hashtbl.t = Hashtbl.create 32
+    val buffers: (Linol__.Common_.Lsp.Types.DocumentUri.t, State.t) Hashtbl.t = Hashtbl.create 32
+ 
+     (* A list of include statements of the prelude files *)
+     val mutable prelude = []
+ 
+     method! config_sync_opts =
+       (* configure how sync happens *)
+-      let change = Lsp.Types.TextDocumentSyncKind.Incremental in
+-      (* Lsp.Types.TextDocumentSyncKind.Full *)
+-      Lsp.Types.TextDocumentSyncOptions.create ~openClose:true ~change
+-        ~save:(Lsp.Types.SaveOptions.create ~includeText:false ())
+      let change = Linol__.Common_.Lsp.Types.TextDocumentSyncKind.Incremental in
+      (* Linol__.Common_.Lsp.Types.TextDocumentSyncKind.Full *)
+      Linol__.Common_.Lsp.Types.TextDocumentSyncOptions.create ~openClose:true ~change
+        ~save:(`SaveOptions (Linol__.Common_.Lsp.Types.SaveOptions.create ~includeText:false ()))
+         ()
+ 
+     method private _on_doc
+         ~(notify_back:Linol_lwt.Jsonrpc2.notify_back)
+-        (uri:Lsp.Types.DocumentUri.t) (contents:string) =
+        (uri:Linol__.Common_.Lsp.Types.DocumentUri.t) (contents:string) =
+       (* TODO: unescape uri/translate it to a correct path ? *)
+-      match Loop.process prelude (preprocess_uri uri) (Some contents) with
+      let uri_path = Linol__.Common_.Lsp.Uri.to_path uri in
+      match Loop.process prelude (preprocess_uri uri_path) (Some contents) with
+       | Ok state ->
+         let diags = State.get State.diagnostics state in
+         Hashtbl.replace buffers uri state;
+@@ -79,9 +82,9 @@ class dolmen_lsp_server =
+       self#_on_doc ~notify_back d.uri new_content
+ 
+     method! on_notification_unhandled
+-        ~notify_back:_ (n:Lsp.Client_notification.t) =
+        ~notify_back:_ (n:Linol__.Common_.Lsp.Client_notification.t) =
+       match n with
+-      | Lsp.Client_notification.ChangeConfiguration { settings; } ->
+      | Linol__.Common_.Lsp.Client_notification.ChangeConfiguration { settings; } ->
+         begin try
+             prelude <- mk_prelude (parse_settings settings);
+             Linol_lwt.Jsonrpc2.IO.return ()
+@@ -89,7 +92,7 @@ class dolmen_lsp_server =
+             Linol_lwt.Jsonrpc2.IO.failwith s
+         end
+       | _ ->
+-        Lwt.return ()
+        Linol_lwt.Jsonrpc2.IO.return ()
+ 
+     method on_notif_doc_did_close ~notify_back d =
+       Hashtbl.remove buffers d.uri;
+diff --git i/src/lsp/state.ml w/src/lsp/state.ml
+index f3e89640..3f8a36ab 100644
+--- i/src/lsp/state.ml
+++ w/src/lsp/state.ml
+@@ -45,7 +45,7 @@ let warn ?file:_ ?loc t warn payload =
+   in
+   Format.kfprintf (fun _ ->
+       let msg = Format.flush_str_formatter () in
+-      let d = Diagnostic.warn ~loc msg in
+      let d = Diagnostic.warn ~loc (`String msg) in
+       add_diag d t) Format.str_formatter "%a"
+     Dolmen_loop.Report.Warning.print (warn, payload)
+ 
+@@ -67,7 +67,7 @@ let error ?file:_ ?loc t err payload =
+   (* Print the error message *)
+   Format.kfprintf (fun _ ->
+       let msg = Format.flush_str_formatter () in
+-      let d = Diagnostic.error ~loc msg in
+      let d = Diagnostic.error ~loc (`String msg) in
+       add_diag d t) Format.str_formatter "%a"
+     Dolmen_loop.Report.Error.print (err, payload)
+ 
--- a/pkgs/development/ocaml-modules/dolmen/linol-lwt-6.patch
+++ b/pkgs/development/ocaml-modules/dolmen/linol-lwt-6.patch
@ -1,43 +0,0 @@
-diff --git a/src/lsp/main.ml b/src/lsp/main.ml
-index 8d6fc760..b52dd25c 100644
--- a/src/lsp/main.ml
-+++ b/src/lsp/main.ml
-@@ -3,7 +3,7 @@
- 
- let run () =
-   let s = new Server.dolmen_lsp_server in
-  let server = Linol_lwt.Jsonrpc2.create_stdio s in
-+  let server = Linol_lwt.Jsonrpc2.create_stdio ~env:() s in
-   let task = Linol_lwt.Jsonrpc2.run server in
-   match Linol_lwt.run task with
-   | () -> ()
-diff --git a/src/lsp/server.ml b/src/lsp/server.ml
-index e895cc6a..c9a3f237 100644
--- a/src/lsp/server.ml
-+++ b/src/lsp/server.ml
-@@ -44,6 +44,8 @@ class dolmen_lsp_server =
-   object(self)
-     inherit Linol_lwt.Jsonrpc2.server
- 
-+    method spawn_query_handler _ = ()
-+
-     (* one env per document *)
-     val buffers: (Lsp.Types.DocumentUri.t, State.t) Hashtbl.t = Hashtbl.create 32
- 
-@@ -55,14 +57,14 @@ class dolmen_lsp_server =
-       let change = Lsp.Types.TextDocumentSyncKind.Incremental in
-       (* Lsp.Types.TextDocumentSyncKind.Full *)
-       Lsp.Types.TextDocumentSyncOptions.create ~openClose:true ~change
-        ~save:(Lsp.Types.SaveOptions.create ~includeText:false ())
-+        ~save:(`SaveOptions (Lsp.Types.SaveOptions.create ~includeText:false ()))
-         ()
- 
-     method private _on_doc
-         ~(notify_back:Linol_lwt.Jsonrpc2.notify_back)
-         (uri:Lsp.Types.DocumentUri.t) (contents:string) =
-       (* TODO: unescape uri/translate it to a correct path ? *)
-      match Loop.process prelude (preprocess_uri uri) (Some contents) with
-+      match Loop.process prelude (preprocess_uri (Lsp.Types.DocumentUri.to_string uri)) (Some contents) with
-       | Ok state ->
-         let diags = State.get State.diagnostics state in
-         Hashtbl.replace buffers uri state;
--- a/pkgs/development/ocaml-modules/dolmen/lsp.nix
+++ b/pkgs/development/ocaml-modules/dolmen/lsp.nix
@ -7,14 +7,14 @@
  linol,
  linol-lwt,
  logs,
-# lsp, # transitive dependency from linol
+  lsp,
 }:

 buildDunePackage {
  pname = "dolmen_lsp";
  inherit (dolmen) src version;

-  patches = [ ./linol-lwt-6.patch ];
+  patches = [ ./linol-common-migration.patch ];

  buildInputs = [
    dolmen
@ -23,7 +23,7 @@ buildDunePackage {
    linol
    linol-lwt
    logs
-    # lsp # transitive dependency from linol
+    lsp
  ];

  meta = dolmen.meta // {
--- a/pkgs/development/ocaml-modules/linol/default.nix
+++ b/pkgs/development/ocaml-modules/linol/default.nix
@ -1,37 +1,43 @@
 {
  lib,
-  fetchurl,
+  fetchFromGitHub,
  buildDunePackage,
-  yojson,
  logs,
-  lsp,
  ppx_yojson_conv_lib,
  trace,
+  uutf,
+  yojson,
 }:

 buildDunePackage rec {
  pname = "linol";
-  version = "0.6";
+  version = "0.10";

  minimalOCamlVersion = "4.14";

-  src = fetchurl {
-    url = "https://github.com/c-cube/linol/releases/download/v${version}/linol-${version}.tbz";
-    hash = "sha256-MwEisPJdzZN1VRnssotvExNMYOQdffS+Y2B8ZSUDVfo=";
+  src = fetchFromGitHub {
+    owner = "c-cube";
+    repo = "linol";
+    tag = "v${version}";
+    hash = "sha256-G/5nTJd+MxPgNObKW2Hmmwn4HejQ81c3f4oVXjpNSZg=";
  };

  propagatedBuildInputs = [
-    yojson
    logs
-    (lsp.override { version = "1.18.0"; })
    ppx_yojson_conv_lib
    trace
+    uutf
+    yojson
  ];

-  meta = with lib; {
+  meta = {
    description = "LSP server library";
-    license = licenses.mit;
-    maintainers = [ maintainers.ulrikstrid ];
    homepage = "https://github.com/c-cube/linol";
+    changelog = "https://raw.githubusercontent.com/c-cube/linol/refs/tags/v${version}/CHANGES.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      stepbrobd
+      ulrikstrid
+    ];
  };
 }
--- a/pkgs/development/ocaml-modules/linol/eio.nix
+++ b/pkgs/development/ocaml-modules/linol/eio.nix
@ -0,0 +1,21 @@
+{
+  buildDunePackage,
+  eio,
+  linol,
+  yojson,
+}:
+
+buildDunePackage {
+  pname = "linol-eio";
+  inherit (linol) version src;
+
+  propagatedBuildInputs = [
+    eio
+    linol
+    yojson
+  ];
+
+  meta = linol.meta // {
+    description = "LSP server library (with Eio for concurrency)";
+  };
+}
--- a/pkgs/development/ocaml-modules/linol/lwt.nix
+++ b/pkgs/development/ocaml-modules/linol/lwt.nix
@ -1,7 +1,6 @@
 {
  buildDunePackage,
  linol,
-  jsonrpc,
  lwt,
  yojson,
 }:
@ -12,7 +11,6 @@ buildDunePackage {

  propagatedBuildInputs = [
    linol
-    jsonrpc
    lwt
    yojson
  ];
--- a/pkgs/development/python-modules/influxdb3-python/default.nix
+++ b/pkgs/development/python-modules/influxdb3-python/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "influxdb3-python";
-  version = "0.13.0";
+  version = "0.14.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "InfluxCommunity";
    repo = "influxdb3-python";
    tag = "v${version}";
-    hash = "sha256-QYf1XUmnP0nPo5F1nFwVCw7W2CdUCgp7vJNV+QM4pPE=";
+    hash = "sha256-gCLH1MtLYggB3t/+B062w31go5mGf0GELZWhO0DnZy8=";
  };

  postPatch = ''
@ -65,7 +65,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Python module that provides a simple and convenient way to interact with InfluxDB 3.0";
    homepage = "https://github.com/InfluxCommunity/influxdb3-python";
-    changelog = "https://github.com/InfluxCommunity/influxdb3-python/releases/tag/v${version}";
+    changelog = "https://github.com/InfluxCommunity/influxdb3-python/releases/tag/${src.tag}";
    license = licenses.asl20;
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/itables/default.nix
+++ b/pkgs/development/python-modules/itables/default.nix
@ -22,7 +22,7 @@

 buildPythonPackage rec {
  pname = "itables";
-  version = "2.4.0";
+  version = "2.4.2";

  # itables has 4 different node packages, each with their own
  # package-lock.json, and partially depending on each other.
@ -30,7 +30,7 @@ buildPythonPackage rec {
  # the source tarball from pypi, which includes the javascript bundle already.
  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-S5HASUVfqTny+Vu15MYSSrEffCaJuL7UhDOc3eudVWI=";
+    hash = "sha256-1Qbw0SNTea6kTSoE/BZ46nZL266Mq8OBQb8+pdgLK6I=";
  };

  pyproject = true;
--- a/pkgs/development/python-modules/kmapper/default.nix
+++ b/pkgs/development/python-modules/kmapper/default.nix
@ -2,17 +2,24 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+
+  # build-system
  setuptools,
-  scikit-learn,
-  numpy,
-  scipy,
+
+  # dependencies
  jinja2,
-  pytestCheckHook,
-  networkx,
-  matplotlib,
+  numpy,
+  scikit-learn,
+  scipy,
+
+  # tests
+  anywidget,
  igraph,
-  plotly,
  ipywidgets,
+  matplotlib,
+  networkx,
+  plotly,
+  pytestCheckHook,
 }:

 buildPythonPackage rec {
@ -30,27 +37,29 @@ buildPythonPackage rec {
  build-system = [ setuptools ];

  dependencies = [
-    scikit-learn
-    numpy
-    scipy
    jinja2
+    numpy
+    scikit-learn
+    scipy
  ];

  pythonImportsCheck = [ "kmapper" ];

  nativeCheckInputs = [
-    pytestCheckHook
-    networkx
-    matplotlib
+    anywidget
    igraph
-    plotly
    ipywidgets
+    matplotlib
+    networkx
+    plotly
+    pytestCheckHook
  ];

-  meta = with lib; {
+  meta = {
    description = "Python implementation of Mapper algorithm for Topological Data Analysis";
    homepage = "https://kepler-mapper.scikit-tda.org/";
-    license = licenses.mit;
+    changelog = "https://github.com/scikit-tda/kepler-mapper/releases/tag/v${version}";
+    license = lib.licenses.mit;
    maintainers = [ ];
  };
 }
--- a/pkgs/development/python-modules/mcstatus/default.nix
+++ b/pkgs/development/python-modules/mcstatus/default.nix
@ -14,14 +14,14 @@

 buildPythonPackage rec {
  pname = "mcstatus";
-  version = "12.0.1";
+  version = "12.0.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "py-mine";
    repo = "mcstatus";
    tag = "v${version}";
-    hash = "sha256-FSXELbEQYUUu2maWBFb5Fj7Y3zXqwmFQRAu+nNco0lQ=";
+    hash = "sha256-DWIpN7oBbb/F5aER0v0qhcQsDoa/EfizjHgy/BE2P6E=";
  };

  build-system = [ hatchling ];
@ -55,7 +55,7 @@ buildPythonPackage rec {
    description = "Python library for checking the status of Minecraft servers";
    mainProgram = "mcstatus";
    homepage = "https://github.com/py-mine/mcstatus";
-    changelog = "https://github.com/py-mine/mcstatus/releases/tag/v${version}";
+    changelog = "https://github.com/py-mine/mcstatus/releases/tag/${src.tag}";
    license = with lib.licenses; [ asl20 ];
    maintainers = with lib.maintainers; [
      fab
--- a/pkgs/development/python-modules/meilisearch/default.nix
+++ b/pkgs/development/python-modules/meilisearch/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "meilisearch";
-  version = "0.35";
+  version = "0.36.0";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "meilisearch";
    repo = "meilisearch-python";
    tag = "v${version}";
-    hash = "sha256-/Y02+XaImJfZj/6+mkUR31LA9HkVXelFdcJok3/Ui+g=";
+    hash = "sha256-S6l/nH+UWLgNUOkRVjLptKhWeYrlN1KL8jSfyBHMI3s=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/plotly/default.nix
+++ b/pkgs/development/python-modules/plotly/default.nix
@ -38,14 +38,14 @@

 buildPythonPackage rec {
  pname = "plotly";
-  version = "6.1.0";
+  version = "6.1.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "plotly";
    repo = "plotly.py";
    tag = "v${version}";
-    hash = "sha256-B5wjZTnL/T+zRbPd3tVSekDbYnKBvIdIpXhc3sUvT3E=";
+    hash = "sha256-+vIq//pDLaaTmRGW+oytho3TfMmLCtuIoHeFenLVcek=";
  };

  postPatch = ''
@ -103,11 +103,28 @@ buildPythonPackage rec {
    "test_acceptance_named"
  ];

+  __darwinAllowLocalNetworking = true;
+
  disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
-    # requires local networking
-    "plotly/tests/test_io/test_renderers.py"
    # fails to launch kaleido subprocess
-    "plotly/tests/test_optional/test_kaleido"
+    "tests/test_optional/test_kaleido"
+    # numpy2 related error, RecursionError
+    # See: https://github.com/plotly/plotly.py/issues/4852
+    "tests/test_plotly_utils/validators/test_angle_validator.py"
+    "tests/test_plotly_utils/validators/test_any_validator.py"
+    "tests/test_plotly_utils/validators/test_color_validator.py"
+    "tests/test_plotly_utils/validators/test_colorlist_validator.py"
+    "tests/test_plotly_utils/validators/test_colorscale_validator.py"
+    "tests/test_plotly_utils/validators/test_dataarray_validator.py"
+    "tests/test_plotly_utils/validators/test_enumerated_validator.py"
+    "tests/test_plotly_utils/validators/test_fig_deepcopy.py"
+    "tests/test_plotly_utils/validators/test_flaglist_validator.py"
+    "tests/test_plotly_utils/validators/test_infoarray_validator.py"
+    "tests/test_plotly_utils/validators/test_integer_validator.py"
+    "tests/test_plotly_utils/validators/test_number_validator.py"
+    "tests/test_plotly_utils/validators/test_pandas_series_input.py"
+    "tests/test_plotly_utils/validators/test_string_validator.py"
+    "tests/test_plotly_utils/validators/test_xarray_input.py"
  ];

  pythonImportsCheck = [ "plotly" ];
--- a/pkgs/development/python-modules/translation-finder/default.nix
+++ b/pkgs/development/python-modules/translation-finder/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "translation-finder";
-  version = "2.19";
+  version = "2.22";

  pyproject = true;

@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "WeblateOrg";
    repo = "translation-finder";
    tag = version;
-    hash = "sha256-Hc1KxmzlFqCLHSAgFF8cgxH0dTdUnBV/2T2ZkfzVvSw=";
+    hash = "sha256-1OQCSWsslJVuBjBsasWGMIpt/k8ey4nKLfbIS5LlCw4=";
  };

  build-system = [ setuptools ];
@ -37,8 +37,9 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Translation file finder for Weblate";
    homepage = "https://github.com/WeblateOrg/translation-finder";
-    changelog = "https://github.com/WeblateOrg/translation-finder/blob/${version}/CHANGES.rst";
+    changelog = "https://github.com/WeblateOrg/translation-finder/blob/${src.tag}/CHANGES.rst";
    license = licenses.gpl3Only;
+    mainProgram = "weblate-discover";
    maintainers = with maintainers; [ erictapen ];
  };

--- a/pkgs/development/ruby-modules/gem-config/default.nix
+++ b/pkgs/development/ruby-modules/gem-config/default.nix
@ -492,10 +492,11 @@ in
          dontBuilt = true;
          installPhase = ''
            cp -R ext/fast_mmaped_file_rs $out
+            rm $out/Cargo.lock
            cp Cargo.lock $out
          '';
        };
-        hash = "sha256-KVbmDAa9EFwTUTHPF/8ZzycbieMhAuiidiz5rqGIKOo=";
+        hash = "sha256-mukk+tWWeG62q4GcDzkk8TyxVsDjShz30wEj82cElt4=";
      };

      nativeBuildInputs = [
--- a/pkgs/games/sgt-puzzles/default.nix
+++ b/pkgs/games/sgt-puzzles/default.nix
@ -18,11 +18,11 @@

 stdenv.mkDerivation rec {
  pname = "sgt-puzzles";
-  version = "20250523.7fa0305";
+  version = "20250615.b589c5e";

  src = fetchurl {
    url = "http://www.chiark.greenend.org.uk/~sgtatham/puzzles/puzzles-${version}.tar.gz";
-    hash = "sha256-knUhiDMF0pchXzCVCntKiXYVJW8HXBoAMH+a9O652bk=";
+    hash = "sha256-pasxe+87XQy2pTI1Lrk4zekry1pgJIlwLF7kmGxceKQ=";
  };

  sgt-puzzles-menu = fetchurl {
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -9676,7 +9676,9 @@ with pkgs;
    hdf5 = hdf5.override { usev110Api = true; };
  };

-  vllm = with python3Packages; toPythonApplication vllm;
+  # Temporarily use python 3.12
+  # See: https://github.com/vllm-project/vllm/issues/12083
+  vllm = with python312Packages; toPythonApplication vllm;

  vte-gtk4 = vte.override {
    gtkVersion = "4";
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@ -1042,6 +1042,8 @@ let

        linol = callPackage ../development/ocaml-modules/linol { };

+        linol-eio = callPackage ../development/ocaml-modules/linol/eio.nix { };
+
        linol-lwt = callPackage ../development/ocaml-modules/linol/lwt.nix { };

        llvm = callPackage ../development/ocaml-modules/llvm {