Merge staging-next into staging

2025-06-13 18:06:39 +00:00 · 2025-06-13 18:06:39 +00:00 · a087d7cfab
commit a087d7cfab
parent 936b62dd8e 78742e6d53
139 changed files with 5738 additions and 4022 deletions
--- a/.github/workflows/README.md
+++ b/.github/workflows/README.md
@ -18,3 +18,25 @@ Some architectural notes about key decisions and concepts in our workflows:
 - **head commit**: The HEAD commit in the pull request's branch. Same as `github.event.pull_request.head.sha`.
 - **merge commit**: The temporary "test merge commit" that GitHub Actions creates and updates for the pull request. Same as `refs/pull/${{ github.event.pull_request.number }}/merge`.
 - **target commit**: The base branch's parent of the "test merge commit" to compare against.
+
+## Concurrency Groups
+
+We use [GitHub's Concurrency Groups](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/control-the-concurrency-of-workflows-and-jobs) to cancel older jobs on pushes to Pull Requests.
+When two workflows are in the same group, a newer workflow cancels an older workflow.
+Thus, it is important how to construct the group keys:
+
+- Because we want to run jobs for different events at same time, we add `github.event_name` to the key. This is the case for the `pull_request` which runs on changes to the workflow files to test the new files and the same workflow from the base branch run via `pull_request_event`.
+
+- We don't want workflows of different Pull Requests to cancel each other, so we include `github.event.pull_request.number`. The [GitHub docs](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/control-the-concurrency-of-workflows-and-jobs#example-using-a-fallback-value) show using `github.head_ref` for this purpose, but this doesn't work well with forks: Different users could have the same head branch name in their forks and run CI for their PRs at the same time.
+
+- Sometimes, there is no `pull_request.number`. That's the case for `push` or `workflow_run` events. To ensure non-PR runs are never cancelled, we add a fallback of `github.run_id`. This is a unique value for each workflow run.
+
+- Of course, we run multiple workflows at the same time, so we add `github.workflow` to the key. Otherwise workflows would cancel each other.
+
+- There is a special case for reusable workflows called via `workflow_call` - they will have `github.workflow` set to their parent workflow's name. Thus, they would cancel each other. That's why we additionally hardcode the name of the workflow as well.
+
+This results in a key with the following semantics:
+
+```
+<running-workflow>-<triggering-workflow>-<triggered-event>-<pull-request/fallback>
+```
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@ -10,7 +10,7 @@ on:
    types: [closed, labeled]

 concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
+  group: backport-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

 permissions:
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@ -7,7 +7,7 @@ on:
  pull_request_target:

 concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
+  group: build-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

 permissions: {}
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@ -7,7 +7,7 @@ on:
  pull_request_target:

 concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
+  group: check-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

 permissions: {}
--- a/.github/workflows/codeowners-v2.yml
+++ b/.github/workflows/codeowners-v2.yml
@ -30,7 +30,7 @@ on:
    types: [opened, ready_for_review, synchronize, reopened]

 concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
+  group: codeowners-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

 permissions: {}
--- a/.github/workflows/dismissed-review.yml
+++ b/.github/workflows/dismissed-review.yml
@ -7,7 +7,7 @@ on:
    types: [completed]

 concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
+  group: dismissed-review-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

 permissions:
--- a/.github/workflows/edited.yml
+++ b/.github/workflows/edited.yml
@ -17,7 +17,7 @@ on:
    types: [edited]

 concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
+  group: edited-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

 permissions: {}
--- a/.github/workflows/eval-aliases.yml
+++ b/.github/workflows/eval-aliases.yml
@ -7,7 +7,7 @@ on:
  pull_request_target:

 concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
+  group: eval-aliases-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

 permissions: {}
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@ -17,7 +17,7 @@ on:
      - python-updates

 concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
+  group: eval-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

 permissions: {}
@ -256,8 +256,6 @@ jobs:
    permissions:
      issues: write
      pull-requests: write
-    with:
-      caller: ${{ github.workflow }}

  reviewers:
    name: Reviewers
@ -268,5 +266,3 @@ jobs:
    if: needs.prepare.outputs.targetSha
    uses: ./.github/workflows/reviewers.yml
    secrets: inherit
-    with:
-      caller: ${{ github.workflow }}
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@ -7,11 +7,6 @@ name: "Label PR"

 on:
  workflow_call:
-    inputs:
-      caller:
-        description: Name of the calling workflow.
-        required: true
-        type: string
  workflow_run:
    workflows:
      - Review dismissed
@ -19,7 +14,7 @@ on:
    types: [completed]

 concurrency:
-  group: ${{ inputs.caller }}-${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
+  group: labels-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

 permissions:
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@ -7,7 +7,7 @@ on:
  pull_request_target:

 concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
+  group: lint-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

 permissions: {}
--- a/.github/workflows/reviewers.yml
+++ b/.github/workflows/reviewers.yml
@ -10,14 +10,9 @@ on:
  pull_request_target:
    types: [ready_for_review]
  workflow_call:
-    inputs:
-      caller:
-        description: Name of the calling workflow.
-        required: true
-        type: string

 concurrency:
-  group: ${{ inputs.caller }}-${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
+  group: reviewers-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

 permissions: {}
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -2787,6 +2787,13 @@
    githubId = 68944906;
    name = "Nikita";
  };
+  bandithedoge = {
+    email = "bandithedoge@protonmail.com";
+    matrix = "@bandithedoge:matrix.org";
+    github = "bandithedoge";
+    githubId = 26331682;
+    name = "Mikołaj Lercher";
+  };
  bandresen = {
    email = "bandresen@gmail.com";
    github = "bennyandresen";
@ -8028,12 +8035,6 @@
    githubId = 8073;
    name = "Francois-Rene Rideau";
  };
-  farlion = {
-    email = "florian.peter@gmx.at";
-    github = "workflow";
-    githubId = 1276854;
-    name = "Florian Peter";
-  };
  farnoy = {
    email = "jakub@okonski.org";
    github = "farnoy";
@ -17190,6 +17191,13 @@
    githubId = 110892040;
    name = "Mykyta Polchanov";
  };
+  myzel394 = {
+    email = "github.7a2op@simplelogin.co";
+    github = "Myzel394";
+    githubId = 50424412;
+    matrix = "@myzel394:matrix.org";
+    name = "Myzel394";
+  };
  mzabani = {
    email = "mzabani@gmail.com";
    github = "mzabani";
@ -26964,6 +26972,13 @@
    githubId = 1595132;
    name = "Kranium Gikos Mendoza";
  };
+  workflow = {
+    email = "4farlion@gmail.com";
+    github = "workflow";
+    githubId = 1276854;
+    name = "Florian Peter";
+    keys = [ { fingerprint = "C349 3C74 E232 A1EE E005  1678 2457 5DB9 3F6C EC16"; } ];
+  };
  worldofpeace = {
    email = "worldofpeace@protonmail.ch";
    github = "worldofpeace";
--- a/nixos/modules/services/x11/window-managers/qtile.nix
+++ b/nixos/modules/services/x11/window-managers/qtile.nix
@ -25,7 +25,7 @@ in
  options.services.xserver.windowManager.qtile = {
    enable = mkEnableOption "qtile";

-    package = mkPackageOption pkgs "qtile-unwrapped" { };
+    package = mkPackageOption pkgs [ "python3" "pkgs" "qtile" ] { };

    configFile = mkOption {
      type = with types; nullOr path;
@ -65,8 +65,8 @@ in

  config = mkIf cfg.enable {
    services = {
-      xserver.windowManager.qtile.finalPackage = pkgs.python3.pkgs.qtile.override {
-        extraPackages = cfg.extraPackages pkgs.python3.pkgs;
+      xserver.windowManager.qtile.finalPackage = cfg.package.override {
+        extraPackages = cfg.extraPackages cfg.package.pythonModule.pkgs;
      };
      displayManager.sessionPackages = [ cfg.finalPackage ];
    };
--- a/nixos/modules/virtualisation/incus.nix
+++ b/nixos/modules/virtualisation/incus.nix
@ -348,12 +348,14 @@ in

          profile incusd ${lib.getExe' config.virtualisation.incus.package "incusd"} flags=(unconfined) {
            userns,
-            </var/lib/incus/security/apparmor/cache>
-            </var/lib/incus/security/apparmor/profiles>
+
+            include "/var/lib/incus/security/apparmor/cache"

            # Site-specific additions and overrides. See local/README for details.
            include if exists <local/incusd>
          }
+
+          include "/var/lib/incus/security/apparmor/profiles"
        '';
      };
      includes."abstractions/base" =
--- a/nixos/tests/incus/incus-tests.nix
+++ b/nixos/tests/incus/incus-tests.nix
@ -221,6 +221,14 @@ import ../make-test-python.nix (
            machine.succeed("incus storage show default")

      ''
+      + lib.optionalString appArmor ''
+        with subtest("Verify AppArmor service is started without issue"):
+            # restart AppArmor service since the Incus AppArmor folders are
+            # created after AA service is started
+            machine.systemctl("restart apparmor.service")
+            machine.succeed("systemctl --no-pager -l status apparmor.service")
+            machine.wait_for_unit("apparmor.service")
+      ''
      + lib.optionalString instanceContainer (
        lib.foldl (
          acc: variant:
--- a/nixos/tests/paretosecurity.nix
+++ b/nixos/tests/paretosecurity.nix
@ -19,20 +19,20 @@
            oldAttrs.postPatch or ""
            + ''
              substituteInPlace team/report.go \
-                --replace-warn 'const reportURL = "https://dash.paretosecurity.com"' \
-                               'const reportURL = "http://dashboard"'
+                --replace-warn 'const reportURL = "https://cloud.paretosecurity.com"' \
+                               'const reportURL = "http://cloud"'
            '';
        });
      };

    };

-  nodes.dashboard = {
+  nodes.cloud = {
    networking.firewall.allowedTCPPorts = [ 80 ];

    services.nginx = {
      enable = true;
-      virtualHosts."dashboard" = {
+      virtualHosts."cloud" = {
        locations."/api/v1/team/".extraConfig = ''
          add_header Content-Type application/json;
          return 200 '{"message": "Linked device."}';
@ -72,7 +72,7 @@
  testScript = ''
    # Test setup
    terminal.succeed("su - alice -c 'mkdir -p /home/alice/.config'")
-    for m in [terminal, dashboard]:
+    for m in [terminal, cloud]:
      m.systemctl("start network-online.target")
      m.wait_for_unit("network-online.target")

--- a/pkgs/applications/editors/jetbrains/patches/no-download.patch
+++ b/pkgs/applications/editors/jetbrains/patches/no-download.patch
@ -35,10 +35,10 @@
   suspend fun downloadMavenTelemetryDependencies(communityRoot: BuildDependenciesCommunityRoot): Path =
 --- a/platform/build-scripts/downloader/src/org/jetbrains/intellij/build/dependencies/BuildDependenciesDownloader.kt
 +++ b/platform/build-scripts/downloader/src/org/jetbrains/intellij/build/dependencies/BuildDependenciesDownloader.kt
-@@ -70,7 +70,7 @@
-                              version: String,
-                              classifier: String?,
-                              packaging: String): URI {
+@@ -68,7 +68,7 @@
+     classifier: String?,
+     packaging: String,
+   ): URI {
 -    val base = mavenRepository.trim('/')
 +    val base = mavenRepository.trimEnd('/')
     val groupStr = groupId.replace('.', '/')
@ -46,11 +46,11 @@
     return URI.create("${base}/${groupStr}/${artifactId}/${version}/${artifactId}-${version}${classifierStr}.${packaging}")
 --- a/platform/build-scripts/downloader/src/org/jetbrains/intellij/build/dependencies/JdkDownloader.kt
 +++ b/platform/build-scripts/downloader/src/org/jetbrains/intellij/build/dependencies/JdkDownloader.kt
-@@ -55,11 +55,7 @@
-     variation: String? = null,
+@@ -59,11 +59,7 @@
     infoLog: (String) -> Unit,
   ): Path {
-    val jdkUrl = getUrl(communityRoot = communityRoot, os = os, arch = arch, jdkBuildNumber = jdkBuildNumber, variation = variation)
+     val effectiveVariation = if (isMusl) null else variation
+-    val jdkUrl = getUrl(communityRoot = communityRoot, os = os, arch = arch, isMusl = isMusl, jdkBuildNumber = jdkBuildNumber, variation = effectiveVariation)
 -    val jdkArchive = downloadFileToCacheLocation(url = jdkUrl.toString(), communityRoot = communityRoot)
 -    val jdkExtracted = BuildDependenciesDownloader.extractFileToCacheLocation(communityRoot = communityRoot,
 -                                                                              archiveFile = jdkArchive,
--- a/pkgs/applications/editors/jetbrains/readme.md
+++ b/pkgs/applications/editors/jetbrains/readme.md
@ -24,17 +24,14 @@ The jdk is in `pkgs/development/compilers/jetbrains-jdk`.
 ## How to update stuff:
 - Run ./bin/update_bin.py, this will update binary IDEs and plugins, and automatically commit them
 - Source builds need a bit more effort, as they **aren't automated at the moment**:
-   - Find the build of the stable release you want to target (usually different for pycharm and idea, should have three components)
-   - Build number is available on JetBrains website:
-     - IDEA: https://www.jetbrains.com/idea/download/other.html
-     - PyCharm: https://www.jetbrains.com/pycharm/download/other.html
-   - Update the `version` & `buildNumber` fields in source/ides.json
-   - Empty the `ideaHash`, `androidHash`, `jpsHash` and `restarterHash` (only `ideaHash` and `restarterHash` changes on a regular basis) fields and try to build to get the new hashes
+   - Run ./source/update.py ./source/ides.json ./bin/versions.json. This will update the source version to the version of their corresponding binary packages.
   - Run these commands respectively:
     - `nix build .#jetbrains.idea-community-src.src.src && ./source/build_maven.py source/idea_maven_artefacts.json result/` for IDEA
     - `nix build .#jetbrains.pycharm-community-src.src.src && ./source/build_maven.py source/pycharm_maven_artefacts.json result/` for PyCharm
   - Update `brokenPlugins` timestamp and hash (from https://web.archive.org/web/*/https://plugins.jetbrains.com/files/brokenPlugins.json)
   - Do a test build
+     - Notice that sometimes a newer Kotlin version is required to build from source, if build fails, first check the recommended Kotlin version in `.idea/kotlinc.xml` in the IDEA source root
+     - Feel free to update the Kotlin version to a compatible one
   - If it succeeds, make a commit
   - Run ./plugins/update_plugins.py, this will update plugins and automatically commit them
   - make a PR/merge
--- a/pkgs/applications/editors/jetbrains/source/build.nix
+++ b/pkgs/applications/editors/jetbrains/source/build.nix
@ -12,6 +12,7 @@

  ant,
  cmake,
+  fsnotifier,
  glib,
  glibc,
  jetbrains,
@ -30,14 +31,16 @@
  jpsHash,
  restarterHash,
  mvnDeps,
+  repositories,
+  kotlin-jps-plugin,
 }:

 let
-  kotlin_2_0_21 = kotlin.overrideAttrs (oldAttrs: {
-    version = "2.0.21";
+  kotlin' = kotlin.overrideAttrs (oldAttrs: {
+    version = "2.1.10";
    src = fetchurl {
      url = oldAttrs.src.url;
-      sha256 = "sha256-A1LApFvSL4D2sm5IXNBNqAR7ql3lSGUoH7n4mkp7zyo=";
+      sha256 = "sha256-xuniY2iJgo4ZyIEdWriQhiU4yJ3CoxAZVt/uPCqLprE=";
    };
  });

@ -111,24 +114,6 @@ let
    '';
  };

-  fsnotifier = stdenv.mkDerivation {
-    pname = "fsnotifier";
-    version = buildNumber;
-    inherit src;
-    sourceRoot = "${src.name}/native/fsNotifier/linux";
-    buildPhase = ''
-      runHook preBuild
-      $CC -O2 -Wall -Wextra -Wpedantic -D "VERSION=\"${buildNumber}\"" -std=c11 main.c inotify.c util.c -o fsnotifier
-      runHook postBuild
-    '';
-    installPhase = ''
-      runHook preInstall
-      mkdir -p $out/bin
-      mv fsnotifier $out/bin
-      runHook postInstall
-    '';
-  };
-
  restarter = rustPlatform.buildRustPackage {
    pname = "restarter";
    version = buildNumber;
@ -175,7 +160,7 @@ let
      jbr
    ];
    patches = [ ../patches/kotlinc-path.patch ];
-    postPatch = "sed -i 's|KOTLIN_PATH_HERE|${kotlin_2_0_21}|' src/main/java/org/jetbrains/jpsBootstrap/KotlinCompiler.kt";
+    postPatch = "sed -i 's|KOTLIN_PATH_HERE|${kotlin'}|' src/main/java/org/jetbrains/jpsBootstrap/KotlinCompiler.kt";
    buildPhase = ''
      runHook preInstall

@ -200,19 +185,7 @@ let
  mkRepoEntry = entry: {
    name = ".m2/repository/" + entry.path;
    path = fetchurl {
-      urls = [
-        "https://cache-redirector.jetbrains.com/repo1.maven.org/maven2/${entry.url}"
-        "https://cache-redirector.jetbrains.com/packages.jetbrains.team/maven/p/ij/intellij-dependencies/${entry.url}"
-        "https://cache-redirector.jetbrains.com/maven.pkg.jetbrains.space/kotlin/p/kotlin/kotlin-ide-plugin-dependencies/${entry.url}"
-        "https://cache-redirector.jetbrains.com/packages.jetbrains.team/maven/p/grazi/grazie-platform-public/${entry.url}"
-        "https://cache-redirector.jetbrains.com/dl.google.com/dl/android/maven2/${entry.url}"
-        "https://packages.jetbrains.team/maven/p/kpm/public/${entry.url}"
-        "https://packages.jetbrains.team/maven/p/ki/maven/${entry.url}"
-        "https://packages.jetbrains.team/maven/p/dpgpv/maven/${entry.url}"
-        "https://cache-redirector.jetbrains.com/download.jetbrains.com/teamcity-repository/${entry.url}"
-        "https://cache-redirector.jetbrains.com/maven.pkg.jetbrains.space/kotlin/p/kotlin/kotlin-ide-plugin-dependencies/${entry.url}"
-        "https://cache-redirector.jetbrains.com/maven.pkg.jetbrains.space/public/p/compose/dev/${entry.url}"
-      ];
+      urls = builtins.map (url: "${url}/${entry.url}") repositories;
      sha256 = entry.hash;
    };
  };
@ -223,7 +196,7 @@ let
      repoUrl = "https://cache-redirector.jetbrains.com/maven.pkg.jetbrains.space/kotlin/p/kotlin/kotlin-ide-plugin-dependencies";
      groupId = builtins.replaceStrings [ "." ] [ "/" ] "org.jetbrains.kotlin";
      artefactId = "kotlin-jps-plugin-classpath";
-      version = "2.0.21-RC";
+      version = kotlin-jps-plugin.version;
    in
    fetchurl {
      url =
@ -239,7 +212,7 @@ let
        + "-"
        + version
        + ".jar";
-      hash = "sha256-jFjxP1LGjrvc1x2XqF5gg/SeKdSFNefxABBlrYl81zA=";
+      hash = kotlin-jps-plugin.hash;
    };

  targetClass =
@ -260,8 +233,8 @@ let
  };

  brokenPlugins = fetchurl {
-    url = "https://web.archive.org/web/20250224030717if_/https://downloads.marketplace.jetbrains.com/files/brokenPlugins.json";
-    hash = "sha256-wQO+qmFfBn32F//bs/a5Q/H4Kpc171jKA9EMmeatc6w=";
+    url = "https://web.archive.org/web/20250509141038/https://downloads.marketplace.jetbrains.com/files/brokenPlugins.json";
+    hash = "sha256-FzYANZSTasCdVEu9jLF1+2PEH8SadUddaIaec5vhKH8=";
  };

 in
@ -291,7 +264,7 @@ stdenvNoCC.mkDerivation rec {
    substituteInPlace \
      platform/build-scripts/src/org/jetbrains/intellij/build/kotlin/KotlinCompilerDependencyDownloader.kt \
      --replace-fail 'JPS_PLUGIN_CLASSPATH_HERE' '${kotlin-jps-plugin-classpath}' \
-      --replace-fail 'KOTLIN_PATH_HERE' '${kotlin_2_0_21}'
+      --replace-fail 'KOTLIN_PATH_HERE' '${kotlin'}'
    substituteInPlace \
      platform/build-scripts/downloader/src/org/jetbrains/intellij/build/dependencies/JdkDownloader.kt \
      --replace-fail 'JDK_PATH_HERE' '${jbr}/lib/openjdk'
@ -316,7 +289,7 @@ stdenvNoCC.mkDerivation rec {
    export JPS_BOOTSTRAP_COMMUNITY_HOME=/build/source
    jps-bootstrap \
      -Dbuild.number=${buildNumber} \
-      -Djps.kotlin.home=${kotlin_2_0_21} \
+      -Djps.kotlin.home=${kotlin'} \
      -Dintellij.build.target.os=linux \
      -Dintellij.build.target.arch=x64 \
      -Dintellij.build.skip.build.steps=mac_artifacts,mac_dmg,mac_sit,windows_exe_installer,windows_sign,repair_utility_bundle_step,sources_archive \
@ -332,7 +305,7 @@ stdenvNoCC.mkDerivation rec {
    runHook preBuild

    java \
-      -Djps.kotlin.home=${kotlin_2_0_21} \
+      -Djps.kotlin.home=${kotlin'} \
      "@java_argfile"

    runHook postBuild
--- a/pkgs/applications/editors/jetbrains/source/idea_maven_artefacts.json
+++ b/pkgs/applications/editors/jetbrains/source/idea_maven_artefacts.json
--- a/pkgs/applications/editors/jetbrains/source/ides.json
+++ b/pkgs/applications/editors/jetbrains/source/ides.json
@ -1,22 +1,52 @@
 {
  "idea-community": {
-    "version": "2024.3.1.1",
-    "buildNumber": "243.22562.218",
+    "version": "2025.1.1.1",
+    "buildNumber": "251.25410.129",
    "buildType": "idea",
-    "ideaHash": "sha256-QKFUg6C+ZVgPrgd6jwWSkBVMHAF30ja0Uqezy9syo5k=",
-    "androidHash": "sha256-2ZLTh3mwrIWOqn1UHqAVibG5JvfvxinqDna/EGxd0Ds=",
-    "jpsHash": "sha256-p3AEHULhVECIicyhCYNkxeQoMAorrbvoIj7jcqxYD2s=",
+    "ideaHash": "sha256-9YatnO+9Pcrlx7EXmq4wMVdeR3DzJF2fsQOvRWH11tk=",
+    "androidHash": "sha256-ueMdEkXt/x5WIex163iwTlOm5bvZNluNO7SNxs+bPYs=",
+    "jpsHash": "sha256-aOYCwDSso0X/7f5tWfP+veoQhCvd6tEDk9lq4YX/cb0=",
    "restarterHash": "sha256-acCmC58URd6p9uKZrm0qWgdZkqu9yqCs23v8qgxV2Ag=",
-    "mvnDeps": "idea_maven_artefacts.json"
+    "mvnDeps": "idea_maven_artefacts.json",
+    "repositories": [
+      "https://cache-redirector.jetbrains.com/repo1.maven.org/maven2",
+      "https://cache-redirector.jetbrains.com/packages.jetbrains.team/maven/p/ij/intellij-dependencies",
+      "https://cache-redirector.jetbrains.com/dl.google.com/dl/android/maven2",
+      "https://cache-redirector.jetbrains.com/download.jetbrains.com/teamcity-repository",
+      "https://cache-redirector.jetbrains.com/maven.pkg.jetbrains.space/kotlin/p/kotlin/kotlin-ide-plugin-dependencies",
+      "https://cache-redirector.jetbrains.com/packages.jetbrains.team/maven/p/grazi/grazie-platform-public",
+      "https://cache-redirector.jetbrains.com/packages.jetbrains.team/maven/p/kpm/public",
+      "https://cache-redirector.jetbrains.com/packages.jetbrains.team/maven/p/ki/maven",
+      "https://cache-redirector.jetbrains.com/maven.pkg.jetbrains.space/public/p/compose/dev"
+    ],
+    "kotlin-jps-plugin": {
+      "version": "2.1.10",
+      "hash": "sha256-Bu5eCHxls6EoIgzadiEY31plAcxZ6DA2a10CXAtPqV4="
+    }
  },
  "pycharm-community": {
-    "version": "2024.3.1.1",
-    "buildNumber": "243.22562.220",
+    "version": "2025.1.1.1",
+    "buildNumber": "251.25410.159",
    "buildType": "pycharm",
-    "ideaHash": "sha256-QKFUg6C+ZVgPrgd6jwWSkBVMHAF30ja0Uqezy9syo5k=",
-    "androidHash": "sha256-2ZLTh3mwrIWOqn1UHqAVibG5JvfvxinqDna/EGxd0Ds=",
-    "jpsHash": "sha256-p3AEHULhVECIicyhCYNkxeQoMAorrbvoIj7jcqxYD2s=",
+    "ideaHash": "sha256-0VHoFk9/xKei4jvkEvl+9KiJwCoVPKh7g5EBSXQ+Ios=",
+    "androidHash": "sha256-af1RJeU7BJTtYTvZRNcH77/Tn4j4lLsRRJUGS80rM4U=",
+    "jpsHash": "sha256-aOYCwDSso0X/7f5tWfP+veoQhCvd6tEDk9lq4YX/cb0=",
    "restarterHash": "sha256-acCmC58URd6p9uKZrm0qWgdZkqu9yqCs23v8qgxV2Ag=",
-    "mvnDeps": "pycharm_maven_artefacts.json"
+    "mvnDeps": "pycharm_maven_artefacts.json",
+    "repositories": [
+      "https://cache-redirector.jetbrains.com/repo1.maven.org/maven2",
+      "https://cache-redirector.jetbrains.com/packages.jetbrains.team/maven/p/ij/intellij-dependencies",
+      "https://cache-redirector.jetbrains.com/dl.google.com/dl/android/maven2",
+      "https://cache-redirector.jetbrains.com/download.jetbrains.com/teamcity-repository",
+      "https://cache-redirector.jetbrains.com/maven.pkg.jetbrains.space/kotlin/p/kotlin/kotlin-ide-plugin-dependencies",
+      "https://cache-redirector.jetbrains.com/packages.jetbrains.team/maven/p/grazi/grazie-platform-public",
+      "https://cache-redirector.jetbrains.com/packages.jetbrains.team/maven/p/kpm/public",
+      "https://cache-redirector.jetbrains.com/packages.jetbrains.team/maven/p/ki/maven",
+      "https://cache-redirector.jetbrains.com/maven.pkg.jetbrains.space/public/p/compose/dev"
+    ],
+    "kotlin-jps-plugin": {
+      "version": "2.1.10",
+      "hash": "sha256-Bu5eCHxls6EoIgzadiEY31plAcxZ6DA2a10CXAtPqV4="
+    }
  }
 }
--- a/pkgs/applications/editors/jetbrains/source/pycharm_maven_artefacts.json
+++ b/pkgs/applications/editors/jetbrains/source/pycharm_maven_artefacts.json
--- a/pkgs/applications/editors/jetbrains/source/update.py
+++ b/pkgs/applications/editors/jetbrains/source/update.py
@ -0,0 +1,138 @@
+#!/usr/bin/env nix-shell
+# ! nix-shell -i python3 -p python3 python3.pkgs.xmltodict
+import os
+import subprocess
+import pprint
+from argparse import ArgumentParser
+from xmltodict import parse
+from json import dump, loads
+from sys import stdout
+
+def convert_hash_to_sri(base32: str) -> str:
+    result = subprocess.run(["nix-hash", "--to-sri", "--type", "sha256", base32], capture_output=True, check=True, text=True)
+    return result.stdout.strip()
+
+
+def ensure_is_list(x):
+    if type(x) != list:
+        return [x]
+    return x
+
+
+def jar_repositories(root_path: str) -> list[str]:
+    repositories = []
+    file_contents = parse(open(root_path + "/.idea/jarRepositories.xml").read())
+    component = file_contents['project']['component']
+    if component['@name'] != 'RemoteRepositoriesConfiguration':
+        return repositories
+    options = component['remote-repository']
+    for option in ensure_is_list(options):
+        for item in option['option']:
+            if item['@name'] == 'url':
+                repositories.append(item['@value'])
+
+    return repositories
+
+
+def kotlin_jps_plugin_info(root_path: str) -> (str, str):
+    file_contents = parse(open(root_path + "/.idea/kotlinc.xml").read())
+    components = file_contents['project']['component']
+    for component in components:
+        if component['@name'] != 'KotlinJpsPluginSettings':
+            continue
+
+        option = component['option']
+        version = option['@value']
+
+        print(f"* Prefetching Kotlin JPS Plugin version {version}...")
+        prefetch = subprocess.run(["nix-prefetch-url", "--type", "sha256", f"https://cache-redirector.jetbrains.com/maven.pkg.jetbrains.space/kotlin/p/kotlin/kotlin-ide-plugin-dependencies/org/jetbrains/kotlin/kotlin-jps-plugin-classpath/{version}/kotlin-jps-plugin-classpath-{version}.jar"], capture_output=True, check=True, text=True)
+
+        return (version, convert_hash_to_sri(prefetch.stdout.strip()))
+
+
+def requested_kotlinc_version(root_path: str) -> str:
+    file_contents = parse(open(root_path + "/.idea/kotlinc.xml").read())
+    components = file_contents['project']['component']
+    for component in components:
+        if component['@name'] != 'KotlinJpsPluginSettings':
+            continue
+
+        option = component['option']
+        version = option['@value']
+
+        return version
+
+
+def prefetch_intellij_community(variant: str, buildNumber: str) -> (str, str):
+    print("* Prefetching IntelliJ community source code...")
+    prefetch = subprocess.run(["nix-prefetch-url", "--print-path", "--unpack", "--name", "source", "--type", "sha256", f"https://github.com/jetbrains/intellij-community/archive/{variant}/{buildNumber}.tar.gz"], capture_output=True, check=True, text=True)
+    parts = prefetch.stdout.strip().split()
+
+    hash = convert_hash_to_sri(parts[0])
+    outPath = parts[1]
+
+    return (hash, outPath)
+
+
+def prefetch_android(variant: str, buildNumber: str) -> str:
+    print("* Prefetching Android plugin source code...")
+    prefetch = subprocess.run(["nix-prefetch-url", "--unpack", "--name", "source", "--type", "sha256", f"https://github.com/jetbrains/android/archive/{variant}/{buildNumber}.tar.gz"], capture_output=True, check=True, text=True)
+    return convert_hash_to_sri(prefetch.stdout.strip())
+
+
+def get_args() -> (str, str):
+    parser = ArgumentParser(
+        description="Updates the IDEA / PyCharm source build infomations"
+    )
+    parser.add_argument("out", help="File to output json to")
+    parser.add_argument("path", help="Path to the bin/versions.json file")
+    args = parser.parse_args()
+    return args.path, args.out
+
+
+def main():
+    versions_path, out = get_args()
+    versions = loads(open(versions_path).read())
+    idea_data = versions['x86_64-linux']['idea-community']
+    pycharm_data = versions['x86_64-linux']['pycharm-community']
+
+    result = { 'idea-community': {}, 'pycharm-community': {} }
+    result['idea-community']['version'] = idea_data['version']
+    result['idea-community']['buildNumber'] = idea_data['build_number']
+    result['idea-community']['buildType'] = 'idea'
+    result['pycharm-community']['version'] = pycharm_data['version']
+    result['pycharm-community']['buildNumber'] = pycharm_data['build_number']
+    result['pycharm-community']['buildType'] = 'pycharm'
+    print('Fetching IDEA info...')
+    result['idea-community']['ideaHash'], ideaOutPath = prefetch_intellij_community('idea', result['idea-community']['buildNumber'])
+    result['idea-community']['androidHash'] = prefetch_android('idea', result['idea-community']['buildNumber'])
+    result['idea-community']['jpsHash'] = ''
+    result['idea-community']['restarterHash'] = ''
+    result['idea-community']['mvnDeps'] = 'idea_maven_artefacts.json'
+    result['idea-community']['repositories'] = jar_repositories(ideaOutPath)
+    result['idea-community']['kotlin-jps-plugin'] = {}
+    result['idea-community']['kotlin-jps-plugin']['version'], result['idea-community']['kotlin-jps-plugin']['hash'] = kotlin_jps_plugin_info(ideaOutPath)
+    kotlinc_version = requested_kotlinc_version(ideaOutPath)
+    print(f"* Prefetched IDEA Community requested Kotlin compiler {kotlinc_version}")
+    print('Fetching PyCharm info...')
+    result['pycharm-community']['ideaHash'], pycharmOutPath = prefetch_intellij_community('pycharm', result['pycharm-community']['buildNumber'])
+    result['pycharm-community']['androidHash'] = prefetch_android('pycharm', result['pycharm-community']['buildNumber'])
+    result['pycharm-community']['jpsHash'] = ''
+    result['pycharm-community']['restarterHash'] = ''
+    result['pycharm-community']['mvnDeps'] = 'pycharm_maven_artefacts.json'
+    result['pycharm-community']['repositories'] = jar_repositories(pycharmOutPath)
+    result['pycharm-community']['kotlin-jps-plugin'] = {}
+    result['pycharm-community']['kotlin-jps-plugin']['version'], result['pycharm-community']['kotlin-jps-plugin']['hash'] = kotlin_jps_plugin_info(pycharmOutPath)
+    kotlinc_version = requested_kotlinc_version(pycharmOutPath)
+    print(f"* Prefetched PyCharm Community requested Kotlin compiler {kotlinc_version}")
+
+    if out == "stdout":
+        dump(result, stdout, indent=2)
+    else:
+        file = open(out, "w")
+        dump(result, file, indent=2)
+        file.write("\n")
+
+
+if __name__ == '__main__':
+    main()
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -6612,20 +6612,6 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

-  jsonfly-nvim = buildVimPlugin {
-    pname = "jsonfly.nvim";
-    version = "2024-09-30";
-    src = fetchFromGitHub {
-      owner = "Myzel394";
-      repo = "jsonfly.nvim";
-      rev = "d713d9ef38115ab09b4a2828dac67b2b3f7d35c4";
-      sha256 = "12nafsy2s01ci679sj6s980kx4lgd7zyqng7xv3gbf2r2xvj3prr";
-      fetchSubmodules = true;
-    };
-    meta.homepage = "https://github.com/Myzel394/jsonfly.nvim/";
-    meta.hydraPlatforms = [ ];
-  };
-
  jule-nvim = buildVimPlugin {
    pname = "jule.nvim";
    version = "2025-02-22";
--- a/pkgs/applications/editors/vim/plugins/non-generated/jsonfly-nvim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/jsonfly-nvim/default.nix
@ -0,0 +1,27 @@
+{
+  lib,
+  fetchFromGitea,
+  vimUtils,
+  nix-update-script,
+}:
+vimUtils.buildVimPlugin {
+  pname = "jsonfly.nvim";
+  version = "0-unstable-2025-06-07";
+
+  src = fetchFromGitea {
+    domain = "git.myzel394.app";
+    owner = "Myzel394";
+    repo = "jsonfly.nvim";
+    rev = "db4394d856059d99d82ea2c75d033721e9dcb1fc";
+    hash = "sha256-PmYm+vZ0XONoHUo08haBozbXRpN+/LAlr6Fyg7anTNw=";
+  };
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Search blazingly fast for JSON / XML / YAML keys via Telescope";
+    homepage = "https://git.myzel394.app/Myzel394/jsonfly.nvim";
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ myzel394 ];
+  };
+}
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -3899,7 +3899,7 @@ in

  vim-textobj-entire = super.vim-textobj-entire.overrideAttrs {
    dependencies = [ self.vim-textobj-user ];
-    meta.maintainers = with lib.maintainers; [ farlion ];
+    meta.maintainers = with lib.maintainers; [ workflow ];
  };

  vim-tpipeline = super.vim-tpipeline.overrideAttrs {
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -506,7 +506,6 @@ https://github.com/nanotech/jellybeans.vim/,,
 https://github.com/HiPhish/jinja.vim/,HEAD,
 https://github.com/vito-c/jq.vim/,,
 https://github.com/neoclide/jsonc.vim/,,
-https://github.com/Myzel394/jsonfly.nvim/,HEAD,
 https://github.com/julelang/jule.nvim/,HEAD,
 https://github.com/julelang/jule.nvim/,HEAD,
 https://github.com/JuliaEditorSupport/julia-vim/,,
--- a/pkgs/applications/editors/vscode/generic.nix
+++ b/pkgs/applications/editors/vscode/generic.nix
@ -53,6 +53,7 @@
  useVSCodeRipgrep ? false,
  ripgrep,
  hasVsceSign ? false,
+  patchVSCodePath ? true,
 }:

 stdenv.mkDerivation (
@ -262,9 +263,13 @@ stdenv.mkDerivation (
            mkdir -p "$out/share/pixmaps"
            cp "$out/lib/${libraryName}/resources/app/resources/linux/code.png" "$out/share/pixmaps/${iconName}.png"

+          ''
+          + (lib.optionalString patchVSCodePath ''
            # Override the previously determined VSCODE_PATH with the one we know to be correct
            sed -i "/ELECTRON=/iVSCODE_PATH='$out/lib/${libraryName}'" "$out/bin/${executableName}"
            grep -q "VSCODE_PATH='$out/lib/${libraryName}'" "$out/bin/${executableName}" # check if sed succeeded
+          '')
+          + ''

            # Remove native encryption code, as it derives the key from the executable path which does not work for us.
            # The credentials should be stored in a secure keychain already, so the benefit of this is questionable
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@ -36,22 +36,22 @@ let

  sha256 =
    {
-      x86_64-linux = "0kd4nb8b17j7ii5lhq4cih62pghb4j9gylgz9yqippxivzzkq6dd";
-      x86_64-darwin = "1y96sp3lkm32fnhjak2js11m9qf8155gglp9g83ynv9d8sdy14ya";
-      aarch64-linux = "162wac7s0l4pq6r6sh32lh69j90rna430z57ksb6g9w8spqzqnv4";
-      aarch64-darwin = "1rqq131f1hs2z14ddh7sp6flwsgb58r8nw1ydbcclcmzi3vbdgr9";
-      armv7l-linux = "06czqpzwlrx98bv2vmawjxxmzw9z6bcfxikp7nxhi8qp8nsjfvgy";
+      x86_64-linux = "1zc64d1n84kzwmwh8m3j897di5955qlm7glnpjvl8g7q70b4rdax";
+      x86_64-darwin = "04ycsad1khxjmiph9fk9449w942m8gmq65amwkf8jxqzn0rybh76";
+      aarch64-linux = "0lhqmp59vccs35fksgvdgvw82b0mr9b2wlyafxlwb8pk2q0l0xga";
+      aarch64-darwin = "1axzsk6xqlzs3j9irjxp5f4fbdxyi4fffhdk89h45q3zkw8m9m4i";
+      armv7l-linux = "1rv3a8xj7iv1d8mfikpj58n398ww5cndbyvgy5328nj7dh6azrsw";
    }
    .${system} or throwSystem;
 in
 callPackage ./generic.nix rec {
  # Please backport all compatible updates to the stable release.
  # This is important for the extension ecosystem.
-  version = "1.100.3";
+  version = "1.101.0";
  pname = "vscode" + lib.optionalString isInsiders "-insiders";

  # This is used for VS Code - Remote SSH test
-  rev = "258e40fedc6cb8edf399a463ce3a9d32e7e1f6f3";
+  rev = "dfaf44141ea9deb3b4096f7cd6d24e00c147a4b1";

  executableName = "code" + lib.optionalString isInsiders "-insiders";
  longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders";
@ -75,7 +75,7 @@ callPackage ./generic.nix rec {
    src = fetchurl {
      name = "vscode-server-${rev}.tar.gz";
      url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-      sha256 = "0bd04p4i5hkkccglw5x3vxf4vbq9hj83gdwfnaps5yskcqizhw77";
+      sha256 = "0rjd4f54k58k97gxvnivwj52aha5s8prws1izvmg43vphhfvk014";
    };
    stdenv = stdenvNoCC;
  };
--- a/pkgs/applications/graphics/sane/backends/default.nix
+++ b/pkgs/applications/graphics/sane/backends/default.nix
@ -43,13 +43,13 @@

 stdenv.mkDerivation rec {
  pname = "sane-backends";
-  version = "1.3.1";
+  version = "1.4.0";

  src = fetchFromGitLab {
    owner = "sane-project";
    repo = "backends";
    rev = "refs/tags/${version}";
-    hash = "sha256-4mwPGeRsyzngDxBQ8/48mK+VR9LYV6082xr8lTrUZrk=";
+    hash = "sha256-e7Wjda+CobYatblvVCGkMAO2aWrdSCp7q+qIEGnGDCY=";
  };

  postPatch = ''
--- a/pkgs/applications/misc/organicmaps/default.nix
+++ b/pkgs/applications/misc/organicmaps/default.nix
@ -33,13 +33,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "organicmaps";
-  version = "2025.05.20-5";
+  version = "2025.06.12-3";

  src = fetchFromGitHub {
    owner = "organicmaps";
    repo = "organicmaps";
    tag = "${finalAttrs.version}-android";
-    hash = "sha256-cqcFI5cXREOeHusPkXsMwdCopzpea50mZQ/+ogLlemk=";
+    hash = "sha256-hOSa3soCDvRHUMKg+IYtzBdzJ9S5X5z3+Ynd5JJgLTs=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/am/amiri/package.nix
+++ b/pkgs/by-name/am/amiri/package.nix
@ -6,11 +6,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "amiri";
-  version = "1.002";
+  version = "1.003";

  src = fetchzip {
    url = "https://github.com/alif-type/amiri/releases/download/${version}/Amiri-${version}.zip";
-    hash = "sha256-Ln2AFiQ5hX4w1yu5NCF28S0hmfWUhEINi1YJVV/Gngo=";
+    hash = "sha256-BsYPMBlRdzlkvyleZIxGDuGjmqhDlEJ4udj8zoKUSzA=";
  };

  installPhase = ''
--- a/pkgs/by-name/au/authentik/package.nix
+++ b/pkgs/by-name/au/authentik/package.nix
@ -159,17 +159,8 @@ let
  python = python312.override {
    self = python;
    packageOverrides = final: prev: {
-      django = final.django_5;
-
-      django-tenants = prev.django-tenants.overrideAttrs {
-        version = "3.7.0-unstable-2025-03-14";
-        src = fetchFromGitHub {
-          owner = "rissson";
-          repo = "django-tenants";
-          rev = "156e53a6f5902d74b73dd9d0192fffaa2587a740";
-          hash = "sha256-xmhfPgCmcFr5axVV65fCq/AcV8ApRVvFVEpq3cQSVqo=";
-        };
-      };
+      # https://github.com/goauthentik/authentik/pull/14709
+      django = final.django_5_1;

      # Running authentik currently requires a custom version.
      # Look in `pyproject.toml` for changes to the rev in the `[tool.uv.sources]` section.
--- a/pkgs/by-name/au/auto-editor/package.nix
+++ b/pkgs/by-name/au/auto-editor/package.nix
@ -2,40 +2,30 @@
  lib,
  python3Packages,
  fetchFromGitHub,
-  replaceVars,
  yt-dlp,
 }:

 python3Packages.buildPythonApplication rec {
  pname = "auto-editor";
-  version = "26.2.0";
+  version = "28.0.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "WyattBlue";
    repo = "auto-editor";
    tag = version;
-    hash = "sha256-BYpt/EelCChhphfuTcqI/VIVis6dnt0J4FcNhWeiiyY=";
+    hash = "sha256-9U3hDVtSuOdiGnEsKs0InV9v0UrlI3qKaBqfCtVTD0E=";
  };

-  patches = [
-    (replaceVars ./set-exe-paths.patch {
-      yt_dlp = lib.getExe yt-dlp;
-    })
-  ];
-
  postPatch = ''
-    # pyav is a fork of av, but has since mostly been un-forked
-    substituteInPlace pyproject.toml \
-        --replace-fail '"pyav==14.*"' '"av"'
+    substituteInPlace auto_editor/__main__.py \
+      --replace-fail '"yt-dlp"' '"${lib.getExe yt-dlp}"'
  '';

-  build-system = with python3Packages; [
-    setuptools
-  ];
+  build-system = with python3Packages; [ setuptools ];

  dependencies = with python3Packages; [
-    av
+    basswood-av
    numpy
  ];

--- a/pkgs/by-name/au/auto-editor/set-exe-paths.patch
+++ b/pkgs/by-name/au/auto-editor/set-exe-paths.patch
@ -1,13 +0,0 @@
-diff --git a/auto_editor/utils/types.py b/auto_editor/utils/types.py
-index 931cc33..b0aecbc 100644
--- a/auto_editor/utils/types.py
-+++ b/auto_editor/utils/types.py
-@@ -191,7 +191,7 @@ def resolution(val: str | None) -> tuple[int, int] | None:
- 
- @dataclass(slots=True)
- class Args:
-    yt_dlp_location: str = "yt-dlp"
-+    yt_dlp_location: str = "@yt_dlp@"
-     download_format: str | None = None
-     output_format: str | None = None
-     yt_dlp_extras: str | None = None
--- a/pkgs/by-name/ca/catalyst/package.nix
+++ b/pkgs/by-name/ca/catalyst/package.nix
@ -0,0 +1,111 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  cmake,
+  gfortran,
+  mpi,
+  python3Packages,
+  ctestCheckHook,
+  mpiCheckPhaseHook,
+  mpiSupport ? true,
+  pythonSupport ? false,
+  fortranSupport ? false,
+
+  # passthru.tests
+  testers,
+  catalyst,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "catalyst";
+  version = "2.0.0";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.kitware.com";
+    owner = "paraview";
+    repo = "catalyst";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-uPb7vgJpKquZVmSMxeWDVMiNkUdYv3oVVKu7t4+zkbs=";
+  };
+
+  nativeBuildInputs =
+    [
+      cmake
+    ]
+    ++ lib.optionals pythonSupport [
+      python3Packages.python
+      python3Packages.pythonImportsCheckHook
+    ]
+    ++ lib.optionals fortranSupport [
+      gfortran
+    ];
+
+  propagatedBuildInputs =
+    # create meta package providing dist-info for python3Pacakges.catalyst that common cmake build does not do
+    lib.optional pythonSupport (
+      python3Packages.mkPythonMetaPackage {
+        inherit (finalAttrs) pname version meta;
+        dependencies =
+          with python3Packages;
+          [
+            numpy
+          ]
+          ++ lib.optional mpiSupport (mpi4py.override { inherit mpi; });
+      }
+    )
+    ++ lib.optional mpiSupport mpi;
+
+  cmakeFlags = [
+    (lib.cmakeFeature "CMAKE_INSTALL_BINDIR" "bin")
+    (lib.cmakeFeature "CMAKE_INSTALL_LIBDIR" "lib")
+    (lib.cmakeFeature "CMAKE_INSTALL_INCLUDEDIR" "include")
+    (lib.cmakeBool "CATALYST_USE_MPI" mpiSupport)
+    (lib.cmakeBool "CATALYST_WRAP_PYTHON" pythonSupport)
+    (lib.cmakeBool "CATALYST_WRAP_FORTRAN" fortranSupport)
+    (lib.cmakeBool "CATALYST_BUILD_TESTING" finalAttrs.finalPackage.doCheck)
+  ];
+
+  postInstall = lib.optionalString pythonSupport ''
+    python -m compileall -s $out $out/${python3Packages.python.sitePackages}
+  '';
+
+  doCheck = true;
+
+  preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    export DYLD_LIBRARY_PATH=$PWD/lib:$DYLD_LIBRARY_PATH
+  '';
+
+  __darwinAllowLocalNetworking = mpiSupport;
+
+  nativeCheckInputs = [ ctestCheckHook ] ++ lib.optional mpiSupport mpiCheckPhaseHook;
+
+  disabledTests = lib.optionals fortranSupport [
+    # unexpected fortran binding symbol *__iso_c_binding_C_ptr
+    "catalyst-abi-nm"
+  ];
+
+  pythonImportsCheck = [ "catalyst" ];
+
+  passthru.tests = {
+    cmake-config = testers.hasCmakeConfigModules {
+      moduleNames = [ "catalyst" ];
+      package = finalAttrs.finalPackage;
+    };
+    serial = catalyst.override { mpiSupport = false; };
+    fortran = catalyst.override { fortranSupport = true; };
+  };
+
+  meta = {
+    description = "In situ visualization and analysis library";
+    homepage = "https://kitware.github.io/paraview-catalyst";
+    downloadPage = "https://gitlab.kitware.com/paraview/catalyst";
+    license = with lib.licenses; [
+      bsd3
+      # vendored conduit
+      bsd3Lbnl
+    ];
+    maintainers = with lib.maintainers; [ qbisi ];
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/by-name/co/code-cursor/package.nix
+++ b/pkgs/by-name/co/code-cursor/package.nix
@ -1,57 +1,18 @@
 {
  lib,
-  stdenvNoCC,
+  stdenv,
+  callPackage,
+  vscode-generic,
  fetchurl,
-
-  # build
  appimageTools,
-
-  # linux dependencies
-  alsa-lib,
-  at-spi2-atk,
-  autoPatchelfHook,
-  cairo,
-  cups,
-  curlWithGnuTls,
-  egl-wayland,
-  expat,
-  fontconfig,
-  freetype,
-  ffmpeg,
-  glib,
-  glibc,
-  glibcLocales,
-  gtk3,
-  libappindicator-gtk3,
-  libdrm,
-  libgbm,
-  libGL,
-  libnotify,
-  libva-minimal,
-  libxkbcommon,
-  libxkbfile,
-  makeWrapper,
-  nspr,
-  nss,
-  pango,
-  pciutils,
-  pulseaudio,
-  vivaldi-ffmpeg-codecs,
-  vulkan-loader,
-  wayland,
-
-  # linux installation
-  rsync,
-  commandLineArgs ? "",
-
-  # darwin build
  undmg,
+  commandLineArgs ? "",
+  useVSCodeRipgrep ? stdenv.hostPlatform.isDarwin,
 }:
-let
-  pname = "cursor";
-  version = "1.0.0";

-  inherit (stdenvNoCC) hostPlatform;
+let
+  inherit (stdenv) hostPlatform;
+  finalCommandLineArgs = "--update=false " + commandLineArgs;

  sources = {
    x86_64-linux = fetchurl {
@ -73,115 +34,47 @@ let
  };

  source = sources.${hostPlatform.system};
-
-  # Linux -- build from AppImage
-  appimageContents = appimageTools.extractType2 {
-    inherit version pname;
-    src = source;
-  };
-
-  wrappedAppimage = appimageTools.wrapType2 {
-    inherit version pname;
-    src = source;
-  };
-
 in
-stdenvNoCC.mkDerivation {
-  inherit pname version;
+(callPackage vscode-generic rec {
+  inherit useVSCodeRipgrep;
+  commandLineArgs = finalCommandLineArgs;

-  src = if hostPlatform.isLinux then wrappedAppimage else source;
+  version = "1.0.0";
+  pname = "cursor";

-  nativeBuildInputs =
-    lib.optionals hostPlatform.isLinux [
-      autoPatchelfHook
-      glibcLocales
-      makeWrapper
-      rsync
-    ]
-    ++ lib.optionals hostPlatform.isDarwin [ undmg ];
+  # You can find the current VSCode version in the About dialog:
+  # workbench.action.showAboutDialog (Help: About)
+  vscodeVersion = "1.96.2";

-  buildInputs = lib.optionals hostPlatform.isLinux [
-    alsa-lib
-    at-spi2-atk
-    cairo
-    cups
-    curlWithGnuTls
-    egl-wayland
-    expat
-    ffmpeg
-    glib
-    gtk3
-    libdrm
-    libgbm
-    libGL
-    libva-minimal
-    libxkbcommon
-    libxkbfile
-    nspr
-    nss
-    pango
-    pulseaudio
-    vivaldi-ffmpeg-codecs
-    vulkan-loader
-    wayland
-  ];
+  executableName = "cursor";
+  longName = "Cursor";
+  shortName = "cursor";
+  libraryName = "cursor";
+  iconName = "cursor";

-  runtimeDependencies = lib.optionals hostPlatform.isLinux [
-    egl-wayland
-    ffmpeg
-    glibc
-    libappindicator-gtk3
-    libnotify
-    libxkbfile
-    pciutils
-    pulseaudio
-    wayland
-    fontconfig
-    freetype
-  ];
+  src =
+    if hostPlatform.isLinux then
+      appimageTools.extract {
+        inherit pname version;
+        src = source;
+      }
+    else
+      source;

-  sourceRoot = lib.optionalString hostPlatform.isDarwin ".";
+  sourceRoot =
+    if hostPlatform.isLinux then "${pname}-${version}-extracted/usr/share/cursor" else "Cursor.app";

-  # Don't break code signing
-  dontUpdateAutotoolsGnuConfigScripts = hostPlatform.isDarwin;
-  dontConfigure = hostPlatform.isDarwin;
-  dontFixup = hostPlatform.isDarwin;
+  tests = { };

-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/
+  updateScript = ./update.sh;

-    ${lib.optionalString hostPlatform.isLinux ''
-      cp -r bin $out/bin
-      # mkdir -p $out/share/cursor
-      # cp -ar ${appimageContents}/usr/share $out/
+  # Editing the `cursor` binary within the app bundle causes the bundle's signature
+  # to be invalidated, which prevents launching starting with macOS Ventura, because Cursor is notarized.
+  # See https://eclecticlight.co/2022/06/17/app-security-changes-coming-in-ventura/ for more information.
+  dontFixup = stdenv.hostPlatform.isDarwin;

-      rsync -a -q ${appimageContents}/usr/share $out/ --exclude "*.so"
-
-      # Fix the desktop file to point to the correct location
-      substituteInPlace $out/share/applications/cursor.desktop --replace-fail "/usr/share/cursor/cursor" "$out/bin/cursor"
-
-      wrapProgram $out/bin/cursor \
-        --add-flags "--update=false" \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}} --no-update" \
-        --add-flags ${lib.escapeShellArg commandLineArgs}
-    ''}
-
-    ${lib.optionalString hostPlatform.isDarwin ''
-      APP_DIR="$out/Applications"
-      mkdir -p "$APP_DIR"
-      cp -Rp Cursor.app "$APP_DIR"
-      mkdir -p "$out/bin"
-      ln -s "$APP_DIR/Cursor.app/Contents/Resources/app/bin/cursor" "$out/bin/cursor"
-    ''}
-
-    runHook postInstall
-  '';
-
-  passthru = {
-    inherit sources;
-    updateScript = ./update.sh;
-  };
+  # Cursor has no wrapper script.
+  patchVSCodePath = false;

  meta = {
    description = "AI-powered code editor built on vscode";
@ -193,7 +86,26 @@ stdenvNoCC.mkDerivation {
      aspauldingcode
      prince213
    ];
-    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    platforms = [
+      "aarch64-linux"
+      "x86_64-linux"
+    ] ++ lib.platforms.darwin;
    mainProgram = "cursor";
  };
-}
+}).overrideAttrs
+  (oldAttrs: {
+    nativeBuildInputs =
+      (oldAttrs.nativeBuildInputs or [ ])
+      ++ lib.optionals hostPlatform.isDarwin [ undmg ];
+
+    preInstall =
+      (oldAttrs.preInstall or "")
+      + lib.optionalString hostPlatform.isLinux ''
+        mkdir -p bin
+        ln -s ../cursor bin/cursor
+      '';
+
+    passthru = (oldAttrs.passthru or { }) // {
+      inherit sources;
+    };
+  })
--- a/pkgs/by-name/do/doclifter/package.nix
+++ b/pkgs/by-name/do/doclifter/package.nix
@ -18,8 +18,10 @@ stdenv.mkDerivation (finalAttrs: {

  postPatch = ''
    substituteInPlace manlifter \
-      --replace-fail '/usr/bin/env python2' '/usr/bin/env python3'
-    2to3 -w manlifter
+      --replace-fail '/usr/bin/env python2' '/usr/bin/env python3' \
+      --replace-fail 'import thread, threading, Queue' 'import _thread, threading, queue' \
+      --replace-fail 'thread.get_ident' '_thread.get_ident' \
+      --replace-fail 'Queue.Queue' 'queue.Queue'
  '';

  nativeBuildInputs = [
--- a/pkgs/by-name/fr/fractal/package.nix
+++ b/pkgs/by-name/fr/fractal/package.nix
@ -28,21 +28,21 @@
  glycin-loaders,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "fractal";
-  version = "11.1";
+  version = "11.2";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "World";
    repo = "fractal";
-    tag = version;
-    hash = "sha256-G8vJvoOVVQ9cPnwoxNoKrQwGNxnA78HG285iSy6lSjk=";
+    tag = finalAttrs.version;
+    hash = "sha256-UE0TRC9DeP+fl85fzuQ8/3ioIPdeSqsJWnW1olB1gmo=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit src;
-    hash = "sha256-yxo1ZSOqjh2lrdmiCrKQGFHpSPRgye64rFNZpghZqI0=";
+    inherit (finalAttrs) src;
+    hash = "sha256-I+1pGZWxn9Q/CL8D6VxsaO3H4EdBek4wyykvNgCNRZI=";
  };

  patches = [
@ -109,11 +109,11 @@ stdenv.mkDerivation rec {

  meta = {
    description = "Matrix group messaging app";
-    homepage = "https://gitlab.gnome.org/GNOME/fractal";
-    changelog = "https://gitlab.gnome.org/World/fractal/-/releases/${version}";
+    homepage = "https://gitlab.gnome.org/World/fractal";
+    changelog = "https://gitlab.gnome.org/World/fractal/-/releases/${finalAttrs.version}";
    license = lib.licenses.gpl3Plus;
    teams = [ lib.teams.gnome ];
    platforms = lib.platforms.linux;
    mainProgram = "fractal";
  };
-}
+})
--- a/pkgs/by-name/gi/gitaly/package.nix
+++ b/pkgs/by-name/gi/gitaly/package.nix
@ -7,7 +7,7 @@
 }:

 let
-  version = "18.0.1";
+  version = "18.0.2";
  package_version = "v${lib.versions.major version}";
  gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";

@ -21,7 +21,7 @@ let
      owner = "gitlab-org";
      repo = "gitaly";
      rev = "v${version}";
-      hash = "sha256-yVDe5X/WGkfWdSEWEZZqjykZNz0mJ52tPHLabGDThOk=";
+      hash = "sha256-Phzg0GAKBMfXPqzlMfLZQbKeqZzMKw1YdEDdzSs+IkE=";
    };

    vendorHash = "sha256-PXONynRY5ZLQO2yQdtljDmLhVBIgfEYmyez9pIm9vtw=";
--- a/pkgs/by-name/gi/gitlab-container-registry/package.nix
+++ b/pkgs/by-name/gi/gitlab-container-registry/package.nix
@ -6,7 +6,7 @@

 buildGoModule rec {
  pname = "gitlab-container-registry";
-  version = "4.22.0";
+  version = "4.23.1";
  rev = "v${version}-gitlab";

  # nixpkgs-update: no auto update
@ -14,10 +14,10 @@ buildGoModule rec {
    owner = "gitlab-org";
    repo = "container-registry";
    inherit rev;
-    hash = "sha256-r7IVX4xH/K+tfoEKfO9HITHUZT6yfBP2Zr6EPZQUxfw=";
+    hash = "sha256-eCuSuQXtzd2jLJf9G8DO1KGXdT8bYGe9tcKw6BZNiiI=";
  };

-  vendorHash = "sha256-e7EIScdd0k5iFTDutFotNkKj1rKtBqfEexdkpjSHAoE=";
+  vendorHash = "sha256-OrdlQp+USRf+Yc7UDjIncDpbuRu5ui6TUoYY2MMc8Ro=";

  checkFlags =
    let
--- a/pkgs/by-name/gi/gitlab-pages/package.nix
+++ b/pkgs/by-name/gi/gitlab-pages/package.nix
@ -6,14 +6,14 @@

 buildGoModule rec {
  pname = "gitlab-pages";
-  version = "18.0.1";
+  version = "18.0.2";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-pages";
    rev = "v${version}";
-    hash = "sha256-EslNXyCzGpsJAG3SOQF56xbU2vhVVo4qdtfFtf9qqW0=";
+    hash = "sha256-zWWQZBN2J69YnjGhhQdB5wv4plC5ikk+kq6EfNPW6ZM=";
  };

  vendorHash = "sha256-BjCwPt1duDINHP7L0qT2KNTjOZ62bWgVij88ztjjyPg=";
--- a/pkgs/by-name/gi/gitlab/data.json
+++ b/pkgs/by-name/gi/gitlab/data.json
@ -1,15 +1,15 @@
 {
-  "version": "18.0.1",
-  "repo_hash": "0d4bpk0fip34cjgp7a1pcfa0q7vkn8vz1ig41zgxncgwbr5lik1h",
+  "version": "18.0.2",
+  "repo_hash": "03sqn21bnsdjs518akbmanyh96p8h4dyhpy4vqwcx1dc8lwnidki",
  "yarn_hash": "0vv09y1pjcm2723jh842pgnmnrf4yqk7558v57dp08rxrqnsni5x",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v18.0.1-ee",
+  "rev": "v18.0.2-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "18.0.1",
-    "GITLAB_PAGES_VERSION": "18.0.1",
+    "GITALY_SERVER_VERSION": "18.0.2",
+    "GITLAB_PAGES_VERSION": "18.0.2",
    "GITLAB_SHELL_VERSION": "14.42.0",
    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.5.1",
-    "GITLAB_WORKHORSE_VERSION": "18.0.1"
+    "GITLAB_WORKHORSE_VERSION": "18.0.2"
  }
 }
--- a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
@ -10,7 +10,7 @@ in
 buildGoModule rec {
  pname = "gitlab-workhorse";

-  version = "18.0.1";
+  version = "18.0.2";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
--- a/pkgs/by-name/ic/icloudpd/package.nix
+++ b/pkgs/by-name/ic/icloudpd/package.nix
@ -9,14 +9,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "icloudpd";
-  version = "1.28.0";
+  version = "1.28.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "icloud-photos-downloader";
    repo = "icloud_photos_downloader";
    tag = "v${version}";
-    hash = "sha256-t2S/WfjNdCgCqaoXtmIu6Gb8tsccRw1Jn8iyjbSukzY=";
+    hash = "sha256-e3bv5IVVXKiAnxZAbx8JniGJaPJuT+FYAH1PwhU8q60=";
  };

  pythonRelaxDeps = true;
@ -72,7 +72,7 @@ python3Packages.buildPythonApplication rec {

  preBuild = ''
    substituteInPlace pyproject.toml \
-      --replace-fail "setuptools==75.6.0" "setuptools" \
+      --replace-fail "setuptools==80.9.0" "setuptools" \
      --replace-fail "wheel==0.45.1" "wheel"

    substituteInPlace src/foundation/__init__.py \
--- a/pkgs/by-name/ku/kubeone/package.nix
+++ b/pkgs/by-name/ku/kubeone/package.nix
@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "kubeone";
-  version = "1.10.0";
+  version = "1.10.1";

  src = fetchFromGitHub {
    owner = "kubermatic";
    repo = "kubeone";
    rev = "v${version}";
-    hash = "sha256-lBeIhsPiEHGSvEhMNjSr5bv/jp2xbbd3wIgaaRARiI8=";
+    hash = "sha256-bRl2Yrg3fidytCt3stjTyNx7IdMpADgVzpd/7btQgY8=";
  };

  vendorHash = "sha256-Ltrs86I5CAjx21BZZrG+UD5/YdLbaFwJqRQLvGwOA9E=";
--- a/pkgs/by-name/li/libsystemtap/package.nix
+++ b/pkgs/by-name/li/libsystemtap/package.nix
@ -41,6 +41,6 @@ stdenv.mkDerivation {
    license = licenses.bsd3;
    platforms = elfutils.meta.platforms or platforms.unix;
    badPlatforms = elfutils.meta.badPlatforms or [ ];
-    maintainers = [ lib.maintainers.farlion ];
+    maintainers = [ lib.maintainers.workflow ];
  };
 }
--- a/pkgs/by-name/li/linux-firmware/package.nix
+++ b/pkgs/by-name/li/linux-firmware/package.nix
@ -22,11 +22,11 @@ let
 in
 stdenvNoCC.mkDerivation rec {
  pname = "linux-firmware";
-  version = "20250509";
+  version = "20250613";

  src = fetchzip {
-    url = "https://cdn.kernel.org/pub/linux/kernel/firmware/linux-firmware-${version}.tar.xz ";
-    hash = "sha256-0FrhgJQyCeRCa3s0vu8UOoN0ZgVCahTQsSH0o6G6hhY=";
+    url = "https://cdn.kernel.org/pub/linux/kernel/firmware/linux-firmware-${version}.tar.xz";
+    hash = "sha256-qygwQNl99oeHiCksaPqxxeH+H7hqRjbqN++Hf9X+gzs=";
  };

  postUnpack = ''
--- a/pkgs/by-name/mp/mpris-scrobbler/package.nix
+++ b/pkgs/by-name/mp/mpris-scrobbler/package.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "mpris-scrobbler";
-  version = "0.5.6";
+  version = "0.5.7";

  src = fetchFromGitHub {
    owner = "mariusor";
    repo = "mpris-scrobbler";
    rev = "v${version}";
-    sha256 = "sha256-qjd/8Ro4wERvp8RDxyZiqWqVKwA0CX1LaoZAquw9asA=";
+    sha256 = "sha256-Ro2Eop4CGvcT1hiCYxxmECFp5oefmAnBT9twnVfpsvY=";
  };

  postPatch =
--- a/pkgs/by-name/mp/mps/package.nix
+++ b/pkgs/by-name/mp/mps/package.nix
@ -4,35 +4,64 @@
  fetchFromGitHub,
  autoreconfHook,
  sqlite,
+  xcbuildHook,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "mps";
  version = "1.118.0";

  src = fetchFromGitHub {
    owner = "Ravenbrook";
    repo = "mps";
-    tag = "release-${version}";
+    tag = "release-${finalAttrs.version}";
    hash = "sha256-3ql3jWLccgnQHKf23B1en+nJ9rxqmHcWd7aBr93YER0=";
  };

-  postPatch = ''
+  sourceRoot = lib.optionalString stdenv.hostPlatform.isDarwin "${finalAttrs.src.name}/code";
+
+  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
    # Disable -Werror to avoid biuld failure on fresh toolchains like
    # gcc-13.
-    substituteInPlace code/gc.gmk --replace-fail '-Werror ' ' '
-    substituteInPlace code/gp.gmk --replace-fail '-Werror ' ' '
-    substituteInPlace code/ll.gmk --replace-fail '-Werror ' ' '
+    substituteInPlace code/gc.gmk \
+      --replace-fail "-Werror " " "
+    substituteInPlace code/gp.gmk \
+      --replace-fail "-Werror " " "
+    substituteInPlace code/ll.gmk \
+      --replace-fail "-Werror " " "
  '';

-  nativeBuildInputs = [ autoreconfHook ];
+  nativeBuildInputs =
+    (lib.optionals stdenv.hostPlatform.isLinux [ autoreconfHook ])
+    ++ (lib.optionals stdenv.hostPlatform.isDarwin [ xcbuildHook ]);
+
  buildInputs = [ sqlite ];

+  xcbuildFlags = lib.optionals stdenv.hostPlatform.isDarwin [
+    "-configuration"
+    "Release"
+    "-project"
+    "mps.xcodeproj"
+    # "-scheme"
+    # "mps"
+    "OTHER_CFLAGS='-Wno-error=unused-but-set-variable'"
+  ];
+
+  installPhase = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    runHook preInstall
+
+    install -Dm644 Products/Release/libmps.a $out/lib/libmps.a
+    mkdir $out/include
+    cp mps*.h $out/include/
+
+    runHook postInstall
+  '';
+
  meta = {
    description = "Flexible memory management and garbage collection library";
    homepage = "https://www.ravenbrook.com/project/mps";
    license = lib.licenses.sleepycat;
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
    maintainers = [ lib.maintainers.thoughtpolice ];
  };
-}
+})
--- a/pkgs/by-name/mu/mujoco/mujoco-system-deps-dont-fetch.patch
+++ b/pkgs/by-name/mu/mujoco/mujoco-system-deps-dont-fetch.patch
@ -1,8 +1,8 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index aaac4e38..fe4e9932 100644
+index 3cab120d..abc526b1 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -120,7 +120,7 @@ target_link_libraries(
+@@ -128,7 +128,7 @@ target_link_libraries(
           lodepng
           qhullstatic_r
           tinyobjloader
@ -12,7 +12,7 @@ index aaac4e38..fe4e9932 100644
 
 set_target_properties(
 diff --git a/cmake/MujocoDependencies.cmake b/cmake/MujocoDependencies.cmake
-index 23e4e71e..33081e00 100644
+index 78522705..7c64e22a 100644
 --- a/cmake/MujocoDependencies.cmake
 +++ b/cmake/MujocoDependencies.cmake
@@ -93,28 +93,36 @@ set(BUILD_SHARED_LIBS
@ -292,17 +292,7 @@ index 23e4e71e..33081e00 100644
     TARGETS
     absl::core_headers
     EXCLUDE_FROM_ALL
-@@ -268,6 +310,9 @@ if(MUJOCO_BUILD_TESTS)
-       CACHE BOOL "Build tests." FORCE
-   )
- 
-+  option(MUJOCO_USE_SYSTEM_gtest "Use installed gtest version." OFF)
-+  mark_as_advanced(MUJOCO_USE_SYSTEM_gtest)
-+
-   # Avoid linking errors on Windows by dynamically linking to the C runtime.
-   set(gtest_force_shared_crt
-       ON
-@@ -276,22 +321,20 @@ if(MUJOCO_BUILD_TESTS)
+@@ -276,22 +318,20 @@ if(MUJOCO_BUILD_TESTS)
 
   findorfetch(
     USE_SYSTEM_PACKAGE
@ -331,7 +321,7 @@ index 23e4e71e..33081e00 100644
   set(BENCHMARK_EXTRA_FETCH_ARGS "")
   if(WIN32 AND NOT MSVC)
     set(BENCHMARK_EXTRA_FETCH_ARGS
-@@ -310,15 +353,11 @@ if(MUJOCO_BUILD_TESTS)
+@@ -310,15 +350,11 @@ if(MUJOCO_BUILD_TESTS)
 
   findorfetch(
     USE_SYSTEM_PACKAGE
@ -348,7 +338,7 @@ index 23e4e71e..33081e00 100644
     TARGETS
     benchmark::benchmark
     benchmark::benchmark_main
-@@ -328,15 +367,18 @@ if(MUJOCO_BUILD_TESTS)
+@@ -328,15 +364,18 @@ if(MUJOCO_BUILD_TESTS)
 endif()
 
 if(MUJOCO_TEST_PYTHON_UTIL)
@ -372,7 +362,7 @@ index 23e4e71e..33081e00 100644
     )
 
     FetchContent_GetProperties(Eigen3)
-@@ -348,6 +390,19 @@ if(MUJOCO_TEST_PYTHON_UTIL)
+@@ -348,6 +387,19 @@ if(MUJOCO_TEST_PYTHON_UTIL)
       set_target_properties(
         Eigen3::Eigen PROPERTIES INTERFACE_INCLUDE_DIRECTORIES "${eigen3_SOURCE_DIR}"
       )
@ -393,17 +383,17 @@ index 23e4e71e..33081e00 100644
   endif()
 endif()
 diff --git a/plugin/sdf/CMakeLists.txt b/plugin/sdf/CMakeLists.txt
-index 3e216fc4..e7e3a1eb 100644
+index 8b834971..25021fa1 100644
 --- a/plugin/sdf/CMakeLists.txt
 +++ b/plugin/sdf/CMakeLists.txt
@@ -37,7 +37,7 @@ set(MUJOCO_SDF_SRCS
- add_library(sdf SHARED)
- target_sources(sdf PRIVATE ${MUJOCO_SDF_SRCS})
- target_include_directories(sdf PRIVATE ${MUJOCO_SDF_INCLUDE})
-target_link_libraries(sdf PRIVATE mujoco SdfLib)
-+target_link_libraries(sdf PRIVATE mujoco SdfLib::SdfLib)
+ add_library(sdf_plugin SHARED)
+ target_sources(sdf_plugin PRIVATE ${MUJOCO_SDF_SRCS})
+ target_include_directories(sdf_plugin PRIVATE ${MUJOCO_SDF_INCLUDE})
+-target_link_libraries(sdf_plugin PRIVATE mujoco SdfLib)
+target_link_libraries(sdf_plugin PRIVATE mujoco SdfLib::SdfLib)
 target_compile_options(
-   sdf
+   sdf_plugin
   PRIVATE ${AVX_COMPILE_OPTIONS}
 diff --git a/python/mujoco/util/CMakeLists.txt b/python/mujoco/util/CMakeLists.txt
 index 666a3725..d89bb499 100644
@ -469,7 +459,7 @@ index 5141406c..75ff7884 100644
   glfw
   EXCLUDE_FROM_ALL
 diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt
-index 0f92803d..da9dce4c 100644
+index a286a1c6..982f2e68 100644
 --- a/test/CMakeLists.txt
 +++ b/test/CMakeLists.txt
@@ -81,8 +81,8 @@ target_link_libraries(
--- a/pkgs/by-name/mu/mujoco/package.nix
+++ b/pkgs/by-name/mu/mujoco/package.nix
@ -18,8 +18,8 @@ let
    abseil-cpp = fetchFromGitHub {
      owner = "abseil";
      repo = "abseil-cpp";
-      rev = "d9e4955c65cd4367dd6bf46f4ccb8cd3d100540b";
-      hash = "sha256-QTywqQCkyGFpdbtDBvUwz9bGXxbJs/qoFKF6zYAZUmQ=";
+      rev = "bc257a88f7c1939f24e0379f14a3589e926c950c";
+      hash = "sha256-Tuw1Py+LQdXS+bizXsduPjjEU5YIAVFvL+iJ+w8JoSU=";
    };
    benchmark = fetchFromGitHub {
      owner = "google";
@ -36,26 +36,26 @@ let
    eigen3 = fetchFromGitLab {
      owner = "libeigen";
      repo = "eigen";
-      rev = "464c1d097891a1462ab28bf8bb763c1683883892";
-      hash = "sha256-OJyfUyiR8PFSaWltx6Ig0RCB+LxPxrPtc0GUfu2dKrk=";
+      rev = "d0b490ee091629068e0c11953419eb089f9e6bb2";
+      hash = "sha256-EmpuOQxshAFa0d6Ddzz6dy21nxHhSn+6Aiz18/o8VUU=";
    };
    googletest = fetchFromGitHub {
      owner = "google";
      repo = "googletest";
-      rev = "6910c9d9165801d8827d628cb72eb7ea9dd538c5";
-      hash = "sha256-01PK9LxqHno89gypd7ze5gDP4V3en2J5g6JZRqohDB0=";
+      rev = "52eb8108c5bdec04579160ae17225d66034bd723";
+      hash = "sha256-HIHMxAUR4bjmFLoltJeIAVSulVQ6kVuIT2Ku+lwAx/4=";
    };
    lodepng = fetchFromGitHub {
      owner = "lvandeve";
      repo = "lodepng";
-      rev = "b4ed2cd7ecf61d29076169b49199371456d4f90b";
-      hash = "sha256-5cCkdj/izP4e99BKfs/Mnwu9aatYXjlyxzzYiMD/y1M=";
+      rev = "17d08dd26cac4d63f43af217ebd70318bfb8189c";
+      hash = "sha256-vnw52G0lY68471dzH7NXc++bTbLRsITSxGYXOTicA5w=";
    };
    qhull = fetchFromGitHub {
      owner = "qhull";
      repo = "qhull";
-      rev = "0c8fc90d2037588024d9964515c1e684f6007ecc";
-      hash = "sha256-Ptzxad3ewmKJbbcmrBT+os4b4SR976zlCG9F0nq0x94=";
+      rev = "c7bee59d068a69f427b1273e71cdc5bc455a5bdd";
+      hash = "sha256-RnuaRrWMQ1rFfb/nxE0ukIoBf2AMG5pRyFmKmvsJ/U8=";
    };
    tinyobjloader = fetchFromGitHub {
      owner = "tinyobjloader";
@ -132,7 +132,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "mujoco";
-  version = "3.3.2";
+  version = "3.3.3";

  # Bumping version? Make sure to look though the MuJoCo's commit
  # history for bumped dependency pins!
@ -140,7 +140,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "google-deepmind";
    repo = "mujoco";
    tag = finalAttrs.version;
-    hash = "sha256-ftohDFsQv6/N82QjPONiQV/Hr7Eb1h2pFDwHaOOhJE0=";
+    hash = "sha256-yU3ckVtgGqLPyu7Jd3L6ZiHELKbGe9AUdCcmXLAxtpo=";
  };

  patches = [ ./mujoco-system-deps-dont-fetch.patch ];
--- a/pkgs/by-name/na/nano/package.nix
+++ b/pkgs/by-name/na/nano/package.nix
@ -31,11 +31,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "nano";
-  version = "8.4";
+  version = "8.5";

  src = fetchurl {
    url = "mirror://gnu/nano/${pname}-${version}.tar.xz";
-    hash = "sha256-WtKSIrvVViTYfqZ3kosxBqdDEU1sb5tB82yXviqOYo0=";
+    hash = "sha256-AAsBHTOcFBr5ZG1DKI9UMl/1xujTnW5IK3h7vGZUwmo=";
  };

  nativeBuildInputs = [ texinfo ] ++ lib.optional enableNls gettext;
--- a/pkgs/by-name/nb/nbfc-linux/package.nix
+++ b/pkgs/by-name/nb/nbfc-linux/package.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "nbfc-linux";
-  version = "0.3.18";
+  version = "0.3.19";

  src = fetchFromGitHub {
    owner = "nbfc-linux";
    repo = "nbfc-linux";
    tag = "${finalAttrs.version}";
-    hash = "sha256-6TyAhPt/692nd3pQVvcJEarXmUsByPiCXt1TuQBDTMQ=";
+    hash = "sha256-ARUhm1K3A0bzVRen6VO3KvomkPl1S7vx2+tmg2ZtL8s=";
  };

  nativeBuildInputs = [ autoreconfHook ];
--- a/pkgs/by-name/ni/nixos-option/nixos-option.sh
+++ b/pkgs/by-name/ni/nixos-option/nixos-option.sh
@ -89,6 +89,10 @@ done
 # `--no-flake`
 # /etc/nixos/flake.nix (if exists)

+if [[ -n "${NIXOS_CONFIG:-}" ]] || nix-instantiate --find-file nixos-config >/dev/null 2>&1; then
+  no_flake=true
+fi
+
 if [[ -z "$flake" ]] && [[ -e /etc/nixos/flake.nix ]] && [[ "$no_flake" == "false" ]]; then
  flake="$(dirname "$(realpath /etc/nixos/flake.nix)")"
 fi
--- a/pkgs/by-name/ni/nixpkgs-review/package.nix
+++ b/pkgs/by-name/ni/nixpkgs-review/package.nix
@ -18,14 +18,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "nixpkgs-review";
-  version = "3.3.0";
+  version = "3.4.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Mic92";
    repo = "nixpkgs-review";
    tag = version;
-    hash = "sha256-Ey07yahJQv5ppf8TiwIt1Cn4xo4QMZ5v+CsJRDelWNY=";
+    hash = "sha256-qVGaIq05vJA5HmCauASvMiUUg+58v4GOp6NMY9fIGLo=";
  };

  build-system = [
--- a/pkgs/by-name/nu/nugget-doom/package.nix
+++ b/pkgs/by-name/nu/nugget-doom/package.nix
@ -0,0 +1,57 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  python3,
+  SDL2,
+  SDL2_net,
+  alsa-lib,
+  fluidsynth,
+  libebur128,
+  libsndfile,
+  libxmp,
+  openal,
+  yyjson,
+  nix-update-script,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "nugget-doom";
+  version = "4.3.0";
+
+  src = fetchFromGitHub {
+    owner = "MrAlaux";
+    repo = "Nugget-Doom";
+    tag = "nugget-doom-${finalAttrs.version}";
+    hash = "sha256-T85UwCl75/RPOscfcRVlF3HhjlDVM2+W1L002UGNLZU=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    python3
+  ];
+
+  buildInputs = [
+    SDL2
+    SDL2_net
+    alsa-lib
+    fluidsynth
+    libebur128
+    libsndfile
+    libxmp
+    openal
+    yyjson
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Doom source port forked from Woof! with additional features";
+    homepage = "https://github.com/MrAlaux/Nugget-Doom";
+    changelog = "https://github.com/fabiangreffrath/woof/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ bandithedoge ];
+    mainProgram = "nugget-doom";
+    platforms = with lib.platforms; linux ++ darwin ++ windows;
+  };
+})
--- a/pkgs/by-name/on/oneanime/package.nix
+++ b/pkgs/by-name/on/oneanime/package.nix
@ -60,13 +60,13 @@ let
 in
 flutter329.buildFlutterApplication rec {
  pname = "oneanime";
-  version = "1.4.0";
+  version = "1.4.1";

  src = fetchFromGitHub {
    owner = "Predidit";
    repo = "oneAnime";
    tag = version;
-    hash = "sha256-1rNnJF16YEj6akq4jtIzI2skl/qxYgi/VQSeo1J87JM=";
+    hash = "sha256-VZdqbdKxzfGlS27WUSvSR2x7wU8uYMkWRU9QvxW22uQ=";
  };

  pubspecLock = lib.importJSON ./pubspec.lock.json;
--- a/pkgs/by-name/on/oneanime/pubspec.lock.json
+++ b/pkgs/by-name/on/oneanime/pubspec.lock.json
@ -40,31 +40,31 @@
      "dependency": "transitive",
      "description": {
        "name": "archive",
-        "sha256": "6199c74e3db4fbfbd04f66d739e72fe11c8a8957d5f219f1f4482dbde6420b5a",
+        "sha256": "2fde1607386ab523f7a36bb3e7edb43bd58e6edaf2ffb29d8a6d578b297fdbbd",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "4.0.2"
+      "version": "4.0.7"
    },
    "args": {
      "dependency": "transitive",
      "description": {
        "name": "args",
-        "sha256": "bf9f5caeea8d8fe6721a9c358dd8a5c1947b27f1cfaa18b39c301273594919e6",
+        "sha256": "d0481093c50b1da8910eb0bb301626d4d8eb7284aa739614d2b394ee09e3ea04",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.6.0"
+      "version": "2.7.0"
    },
    "async": {
      "dependency": "transitive",
      "description": {
        "name": "async",
-        "sha256": "d2872f9c19731c2e5f10444b14686eb7cc85c76274bd6c16e1816bff9a3bab63",
+        "sha256": "758e6d74e971c3e5aceb4110bfd6698efc7f501675bcfe0c775459a8140750eb",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.12.0"
+      "version": "2.13.0"
    },
    "audio_video_progress_bar": {
      "dependency": "direct main",
@ -80,11 +80,11 @@
      "dependency": "transitive",
      "description": {
        "name": "auto_injector",
-        "sha256": "d2e204bc46d7349795364884d07ba79fe6a0f3a84a651b70dcbb68d82dcebab0",
+        "sha256": "ad7a95d7c381363d48b54e00cb680f024fd97009067244454e9b4850337608e8",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.0.5"
+      "version": "2.1.0"
    },
    "boolean_selector": {
      "dependency": "transitive",
@ -170,11 +170,11 @@
      "dependency": "transitive",
      "description": {
        "name": "built_value",
-        "sha256": "28a712df2576b63c6c005c465989a348604960c0958d28be5303ba9baa841ac2",
+        "sha256": "ea90e81dc4a25a043d9bee692d20ed6d1c4a1662a28c03a96417446c093ed6b4",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "8.9.3"
+      "version": "8.9.5"
    },
    "canvas_danmaku": {
      "dependency": "direct main",
@ -250,11 +250,11 @@
      "dependency": "direct main",
      "description": {
        "name": "connectivity_plus",
-        "sha256": "04bf81bb0b77de31557b58d052b24b3eee33f09a6e7a8c68a3e247c7df19ec27",
+        "sha256": "051849e2bd7c7b3bc5844ea0d096609ddc3a859890ec3a9ac4a65a2620cc1f99",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "6.1.3"
+      "version": "6.1.4"
    },
    "connectivity_plus_platform_interface": {
      "dependency": "transitive",
@ -390,31 +390,31 @@
      "dependency": "transitive",
      "description": {
        "name": "dio_web_adapter",
-        "sha256": "e485c7a39ff2b384fa1d7e09b4e25f755804de8384358049124830b04fc4f93a",
+        "sha256": "7586e476d70caecaf1686d21eee7247ea43ef5c345eab9e0cc3583ff13378d78",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.1.0"
+      "version": "2.1.1"
    },
    "fake_async": {
      "dependency": "transitive",
      "description": {
        "name": "fake_async",
-        "sha256": "6a95e56b2449df2273fd8c45a662d6947ce1ebb7aafe80e550a3f68297f3cacc",
+        "sha256": "5368f224a74523e8d2e7399ea1638b37aecfca824a3cc4dfdf77bf1fa905ac44",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.3.2"
+      "version": "1.3.3"
    },
    "ffi": {
      "dependency": "direct main",
      "description": {
        "name": "ffi",
-        "sha256": "16ed7b077ef01ad6170a3d0c57caa4a112a38d7a2ed5602e0aca9ca6f3d98da6",
+        "sha256": "289279317b4b16eb2bb7e271abccd4bf84ec9bdcbe999e278a94b804f5630418",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.1.3"
+      "version": "2.1.4"
    },
    "ffigen": {
      "dependency": "direct dev",
@ -511,33 +511,32 @@
    "flutter_open_chinese_convert": {
      "dependency": "direct main",
      "description": {
-        "path": ".",
-        "ref": "master",
-        "resolved-ref": "6cfb0f57852bfbba0652b076e5eb5c47b888d5ae",
-        "url": "https://github.com/Predidit/flutter_open_chinese_convert.git"
+        "name": "flutter_open_chinese_convert",
+        "sha256": "04561ced3dc66a28c394934186a4224a34f2c8912881d489015f0784f2cf8c70",
+        "url": "https://pub.dev"
      },
-      "source": "git",
-      "version": "0.5.1"
+      "source": "hosted",
+      "version": "0.6.0"
    },
    "flutter_plugin_android_lifecycle": {
      "dependency": "transitive",
      "description": {
        "name": "flutter_plugin_android_lifecycle",
-        "sha256": "615a505aef59b151b46bbeef55b36ce2b6ed299d160c51d84281946f0aa0ce0e",
+        "sha256": "f948e346c12f8d5480d2825e03de228d0eb8c3a737e4cdaa122267b89c022b5e",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.0.24"
+      "version": "2.0.28"
    },
    "flutter_smart_dialog": {
      "dependency": "direct main",
      "description": {
        "name": "flutter_smart_dialog",
-        "sha256": "030eac9f61c79d6c11a9da75f3df86b64060493bfc7f723fe59181a63b981f70",
+        "sha256": "a3aaf690b2737ee6b2c7e7a983bc685e5f118e5de7e2042d2e0b7db26eb074f2",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "4.9.8+6"
+      "version": "4.9.8+7"
    },
    "flutter_test": {
      "dependency": "direct dev",
@ -625,21 +624,21 @@
      "dependency": "direct main",
      "description": {
        "name": "html",
-        "sha256": "1fc58edeaec4307368c60d59b7e15b9d658b57d7f3125098b6294153c75337ec",
+        "sha256": "6d1264f2dffa1b1101c25a91dff0dc2daee4c18e87cd8538729773c073dbf602",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.15.5"
+      "version": "0.15.6"
    },
    "http": {
      "dependency": "transitive",
      "description": {
        "name": "http",
-        "sha256": "fe7ab022b76f3034adc518fb6ea04a82387620e19977665ea18d30a1cf43442f",
+        "sha256": "2c11f3f94c687ee9bad77c171151672986360b2b001d109814ee7140b2cf261b",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.3.0"
+      "version": "1.4.0"
    },
    "http_multi_server": {
      "dependency": "transitive",
@ -665,21 +664,21 @@
      "dependency": "transitive",
      "description": {
        "name": "image",
-        "sha256": "8346ad4b5173924b5ddddab782fc7d8a6300178c8b1dc427775405a01701c4a6",
+        "sha256": "4e973fcf4caae1a4be2fa0a13157aa38a8f9cb049db6529aa00b4d71abc4d928",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "4.5.2"
+      "version": "4.5.4"
    },
    "intl": {
      "dependency": "transitive",
      "description": {
        "name": "intl",
-        "sha256": "d6f56758b7d3014a48af9701c085700aac781a92a87a62b1333b46d8879661cf",
+        "sha256": "3df61194eb431efc39c4ceba583b95633a403f46c9fd341e550ce0bfa50e9aa5",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.19.0"
+      "version": "0.20.2"
    },
    "io": {
      "dependency": "transitive",
@ -725,11 +724,11 @@
      "dependency": "transitive",
      "description": {
        "name": "leak_tracker",
-        "sha256": "c35baad643ba394b40aac41080300150a4f08fd0fd6a10378f8f7c6bc161acec",
+        "sha256": "6bb818ecbdffe216e81182c2f0714a2e62b593f4a4f13098713ff1685dfb6ab0",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "10.0.8"
+      "version": "10.0.9"
    },
    "leak_tracker_flutter_testing": {
      "dependency": "transitive",
@ -806,7 +805,7 @@
      "description": {
        "path": "media_kit",
        "ref": "main",
-        "resolved-ref": "aef901f6abc9192aa74bf05036c2f520cebf3259",
+        "resolved-ref": "ad84c59faa2b871926cb31516bdeec65d7676884",
        "url": "https://github.com/Predidit/media-kit.git"
      },
      "source": "git",
@ -817,7 +816,7 @@
      "description": {
        "path": "libs/android/media_kit_libs_android_video",
        "ref": "main",
-        "resolved-ref": "aef901f6abc9192aa74bf05036c2f520cebf3259",
+        "resolved-ref": "ad84c59faa2b871926cb31516bdeec65d7676884",
        "url": "https://github.com/Predidit/media-kit.git"
      },
      "source": "git",
@ -828,7 +827,7 @@
      "description": {
        "path": "libs/ios/media_kit_libs_ios_video",
        "ref": "main",
-        "resolved-ref": "aef901f6abc9192aa74bf05036c2f520cebf3259",
+        "resolved-ref": "ad84c59faa2b871926cb31516bdeec65d7676884",
        "url": "https://github.com/Predidit/media-kit.git"
      },
      "source": "git",
@ -839,7 +838,7 @@
      "description": {
        "path": "libs/linux/media_kit_libs_linux",
        "ref": "main",
-        "resolved-ref": "aef901f6abc9192aa74bf05036c2f520cebf3259",
+        "resolved-ref": "ad84c59faa2b871926cb31516bdeec65d7676884",
        "url": "https://github.com/Predidit/media-kit.git"
      },
      "source": "git",
@ -850,7 +849,7 @@
      "description": {
        "path": "libs/macos/media_kit_libs_macos_video",
        "ref": "main",
-        "resolved-ref": "aef901f6abc9192aa74bf05036c2f520cebf3259",
+        "resolved-ref": "ad84c59faa2b871926cb31516bdeec65d7676884",
        "url": "https://github.com/Predidit/media-kit.git"
      },
      "source": "git",
@ -861,7 +860,7 @@
      "description": {
        "path": "libs/universal/media_kit_libs_video",
        "ref": "main",
-        "resolved-ref": "aef901f6abc9192aa74bf05036c2f520cebf3259",
+        "resolved-ref": "ad84c59faa2b871926cb31516bdeec65d7676884",
        "url": "https://github.com/Predidit/media-kit.git"
      },
      "source": "git",
@ -872,7 +871,7 @@
      "description": {
        "path": "libs/windows/media_kit_libs_windows_video",
        "ref": "main",
-        "resolved-ref": "aef901f6abc9192aa74bf05036c2f520cebf3259",
+        "resolved-ref": "ad84c59faa2b871926cb31516bdeec65d7676884",
        "url": "https://github.com/Predidit/media-kit.git"
      },
      "source": "git",
@ -883,7 +882,7 @@
      "description": {
        "path": "media_kit_video",
        "ref": "main",
-        "resolved-ref": "aef901f6abc9192aa74bf05036c2f520cebf3259",
+        "resolved-ref": "ad84c59faa2b871926cb31516bdeec65d7676884",
        "url": "https://github.com/Predidit/media-kit.git"
      },
      "source": "git",
@ -963,11 +962,11 @@
      "dependency": "transitive",
      "description": {
        "name": "package_config",
-        "sha256": "92d4488434b520a62570293fbd33bb556c7d49230791c1b4bbd973baf6d2dc67",
+        "sha256": "f096c55ebb7deb7e384101542bfba8c52696c1b56fca2eb62827989ef2353bbc",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.1.1"
+      "version": "2.2.0"
    },
    "package_info_plus": {
      "dependency": "transitive",
@ -1013,11 +1012,11 @@
      "dependency": "transitive",
      "description": {
        "name": "path_provider_android",
-        "sha256": "4adf4fd5423ec60a29506c76581bc05854c55e3a0b72d35bb28d661c9686edf2",
+        "sha256": "d0d310befe2c8ab9e7f393288ccbb11b60c019c6b5afc21973eeee4dda2b35e9",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.2.15"
+      "version": "2.2.17"
    },
    "path_provider_foundation": {
      "dependency": "transitive",
@ -1103,31 +1102,31 @@
      "dependency": "transitive",
      "description": {
        "name": "posix",
-        "sha256": "a0117dc2167805aa9125b82eee515cc891819bac2f538c83646d355b16f58b9a",
+        "sha256": "f0d7856b6ca1887cfa6d1d394056a296ae33489db914e365e2044fdada449e62",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "6.0.1"
+      "version": "6.0.2"
    },
    "provider": {
      "dependency": "direct main",
      "description": {
        "name": "provider",
-        "sha256": "c8a055ee5ce3fd98d6fc872478b03823ffdb448699c6ebdbbc71d59b596fd48c",
+        "sha256": "4abbd070a04e9ddc287673bf5a030c7ca8b685ff70218720abab8b092f53dd84",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "6.1.2"
+      "version": "6.1.5"
    },
    "pub_semver": {
      "dependency": "transitive",
      "description": {
        "name": "pub_semver",
-        "sha256": "7b3cfbf654f3edd0c6298ecd5be782ce997ddf0e00531b9464b55245185bbbbd",
+        "sha256": "5bfcf68ca79ef689f8990d1160781b4bad40a3bd5e5218ad4076ddb7f4081585",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.1.5"
+      "version": "2.2.0"
    },
    "pubspec_parse": {
      "dependency": "transitive",
@ -1173,21 +1172,21 @@
      "dependency": "direct main",
      "description": {
        "name": "screen_brightness",
-        "sha256": "99b898dae860ebe55fc872d8e300c6eafff3ee4ccb09301b90adb3f241f29874",
+        "sha256": "46d1b448729c1ed67c812f2c97d7fa8308809d91031c7ecdeb216ca65f7660de",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.1.1"
+      "version": "2.1.3"
    },
    "screen_brightness_android": {
      "dependency": "transitive",
      "description": {
        "name": "screen_brightness_android",
-        "sha256": "ff9141bed547db02233e7dd88f990ab01973a0c8a8c04ddb855c7b072f33409a",
+        "sha256": "6ba1b5812f66c64e9e4892be2d36ecd34210f4e0da8bdec6a2ea34f1aa42683e",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.1.0"
+      "version": "2.1.1"
    },
    "screen_brightness_ios": {
      "dependency": "transitive",
@ -1209,6 +1208,16 @@
      "source": "hosted",
      "version": "2.1.1"
    },
+    "screen_brightness_ohos": {
+      "dependency": "transitive",
+      "description": {
+        "name": "screen_brightness_ohos",
+        "sha256": "61e313e46eaee3f83dd4e85a2a91f8a81be02c154bc9e60830a7c0fd76dac286",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.1.0"
+    },
    "screen_brightness_platform_interface": {
      "dependency": "transitive",
      "description": {
@ -1293,21 +1302,21 @@
      "dependency": "transitive",
      "description": {
        "name": "shared_preferences",
-        "sha256": "846849e3e9b68f3ef4b60c60cf4b3e02e9321bc7f4d8c4692cf87ffa82fc8a3a",
+        "sha256": "6e8bf70b7fef813df4e9a36f658ac46d107db4b4cfe1048b477d4e453a8159f5",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.5.2"
+      "version": "2.5.3"
    },
    "shared_preferences_android": {
      "dependency": "transitive",
      "description": {
        "name": "shared_preferences_android",
-        "sha256": "ea86be7b7114f9e94fddfbb52649e59a03d6627ccd2387ebddcd6624719e9f16",
+        "sha256": "20cbd561f743a342c76c151d6ddb93a9ce6005751e7aa458baad3858bfbfb6ac",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.4.5"
+      "version": "2.4.10"
    },
    "shared_preferences_foundation": {
      "dependency": "transitive",
@ -1343,11 +1352,11 @@
      "dependency": "transitive",
      "description": {
        "name": "shared_preferences_web",
-        "sha256": "d2ca4132d3946fec2184261726b355836a82c33d7d5b67af32692aff18a4684e",
+        "sha256": "c49bd060261c9a3f0ff445892695d6212ff603ef3115edbb448509d407600019",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.4.2"
+      "version": "2.4.3"
    },
    "shared_preferences_windows": {
      "dependency": "transitive",
@ -1589,21 +1598,21 @@
      "dependency": "transitive",
      "description": {
        "name": "url_launcher_android",
-        "sha256": "6fc2f56536ee873eeb867ad176ae15f304ccccc357848b351f6f0d8d4a40d193",
+        "sha256": "8582d7f6fe14d2652b4c45c9b6c14c0b678c2af2d083a11b604caeba51930d79",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "6.3.14"
+      "version": "6.3.16"
    },
    "url_launcher_ios": {
      "dependency": "transitive",
      "description": {
        "name": "url_launcher_ios",
-        "sha256": "16a513b6c12bb419304e72ea0ae2ab4fed569920d1c7cb850263fe3acc824626",
+        "sha256": "7f2022359d4c099eea7df3fdf739f7d3d3b9faf3166fb1dd390775176e0b76cb",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "6.3.2"
+      "version": "6.3.3"
    },
    "url_launcher_linux": {
      "dependency": "transitive",
@ -1639,11 +1648,11 @@
      "dependency": "transitive",
      "description": {
        "name": "url_launcher_web",
-        "sha256": "3ba963161bd0fe395917ba881d320b9c4f6dd3c4a233da62ab18a5025c85f1e9",
+        "sha256": "4bd2b7b4dc4d4d0b94e5babfffbca8eac1a126c7f3d6ecbc1a11013faa3abba2",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.4.0"
+      "version": "2.4.1"
    },
    "url_launcher_windows": {
      "dependency": "transitive",
@ -1679,11 +1688,11 @@
      "dependency": "transitive",
      "description": {
        "name": "vm_service",
-        "sha256": "0968250880a6c5fe7edc067ed0a13d4bae1577fe2771dcf3010d52c4a9d3ca14",
+        "sha256": "ddfa8d30d89985b96407efce8acbdd124701f96741f2d981ca860662f1c0dc02",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "14.3.1"
+      "version": "15.0.0"
    },
    "volume_controller": {
      "dependency": "transitive",
@ -1699,21 +1708,21 @@
      "dependency": "transitive",
      "description": {
        "name": "wakelock_plus",
-        "sha256": "b90fbcc8d7bdf3b883ea9706d9d76b9978cb1dfa4351fcc8014d6ec31a493354",
+        "sha256": "a474e314c3e8fb5adef1f9ae2d247e57467ad557fa7483a2b895bc1b421c5678",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.2.11"
+      "version": "1.3.2"
    },
    "wakelock_plus_platform_interface": {
      "dependency": "transitive",
      "description": {
        "name": "wakelock_plus_platform_interface",
-        "sha256": "70e780bc99796e1db82fe764b1e7dcb89a86f1e5b3afb1db354de50f2e41eb7a",
+        "sha256": "e10444072e50dbc4999d7316fd303f7ea53d31c824aa5eb05d7ccbdd98985207",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.2.2"
+      "version": "1.2.3"
    },
    "watcher": {
      "dependency": "transitive",
@ -1729,41 +1738,41 @@
      "dependency": "transitive",
      "description": {
        "name": "web",
-        "sha256": "cd3543bd5798f6ad290ea73d210f423502e71900302dde696f8bff84bf89a1cb",
+        "sha256": "868d88a33d8a87b18ffc05f9f030ba328ffefba92d6c127917a2ba740f9cfe4a",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.1.0"
+      "version": "1.1.1"
    },
    "web_socket": {
      "dependency": "transitive",
      "description": {
        "name": "web_socket",
-        "sha256": "3c12d96c0c9a4eec095246debcea7b86c0324f22df69893d538fcc6f1b8cce83",
+        "sha256": "34d64019aa8e36bf9842ac014bb5d2f5586ca73df5e4d9bf5c936975cae6982c",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.1.6"
+      "version": "1.0.1"
    },
    "web_socket_channel": {
      "dependency": "transitive",
      "description": {
        "name": "web_socket_channel",
-        "sha256": "0b8e2457400d8a859b7b2030786835a28a8e80836ef64402abef392ff4f1d0e5",
+        "sha256": "d645757fb0f4773d602444000a8131ff5d48c9e47adfe9772652dd1a4f2d45c8",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.0.2"
+      "version": "3.0.3"
    },
    "win32": {
      "dependency": "transitive",
      "description": {
        "name": "win32",
-        "sha256": "daf97c9d80197ed7b619040e86c8ab9a9dad285e7671ee7390f9180cc828a51e",
+        "sha256": "329edf97fdd893e0f1e3b9e88d6a0e627128cc17cc316a8d67fda8f1451178ba",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "5.10.1"
+      "version": "5.13.0"
    },
    "win32_registry": {
      "dependency": "transitive",
@ -1828,6 +1837,6 @@
  },
  "sdks": {
    "dart": ">=3.7.0 <4.0.0",
-    "flutter": ">=3.29.2"
+    "flutter": ">=3.32.2"
  }
 }
--- a/pkgs/by-name/op/openlinkhub/package.nix
+++ b/pkgs/by-name/op/openlinkhub/package.nix
@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "openlinkhub";
-  version = "0.5.6";
+  version = "0.5.7";

  src = fetchFromGitHub {
    owner = "jurkovic-nikola";
    repo = "OpenLinkHub";
    tag = version;
-    hash = "sha256-iN58bC4do0rT+s8ezisaQo2/DWk5fK1mri0iduyz2EE=";
+    hash = "sha256-WXurXrwqdX7rIPlVakodBaswakZFeTxczJ+j7AlIuOM=";
  };

  proxyVendor = true;
--- a/pkgs/by-name/pa/paperless-ngx/package.nix
+++ b/pkgs/by-name/pa/paperless-ngx/package.nix
@ -38,7 +38,7 @@ let
  python = python3.override {
    self = python;
    packageOverrides = final: prev: {
-      django = prev.django_5;
+      django = prev.django_5_1;

      # tesseract5 may be overwritten in the paperless module and we need to propagate that to make the closure reduction effective
      ocrmypdf = prev.ocrmypdf.override { tesseract = tesseract5; };
--- a/pkgs/by-name/pa/parca-agent/package.nix
+++ b/pkgs/by-name/pa/parca-agent/package.nix
@ -8,18 +8,18 @@

 buildGoModule rec {
  pname = "parca-agent";
-  version = "0.39.0";
+  version = "0.39.1";

  src = fetchFromGitHub {
    owner = "parca-dev";
    repo = "parca-agent";
    tag = "v${version}";
-    hash = "sha256-ZdMQ0cyLihMhqXVN98t0Bhg2I4NUxBPcSl2KJU5P0vQ=";
+    hash = "sha256-Ss6ZWoEUSNM5m3BUwLcIuhFbfMHHDdfSjxvnGzNPYM4=";
    fetchSubmodules = true;
  };

  proxyVendor = true;
-  vendorHash = "sha256-Qm5ezWjMTYrhulHS5ALs4yrCInhqsxRc9RvCh9vv3GE=";
+  vendorHash = "sha256-+yCa5t6bBKOnUjoAQ1QqbK9xLwhNj5vyFeJD71AsNcI=";

  buildInputs = [
    stdenv.cc.libc.static
--- a/pkgs/by-name/pa/paretosecurity/package.nix
+++ b/pkgs/by-name/pa/paretosecurity/package.nix
@ -17,16 +17,16 @@ buildGoModule (finalAttrs: {
    webkitgtk_4_1
  ];
  pname = "paretosecurity";
-  version = "0.2.31";
+  version = "0.2.34";

  src = fetchFromGitHub {
    owner = "ParetoSecurity";
    repo = "agent";
    rev = finalAttrs.version;
-    hash = "sha256-dYQNSzovWCX7sj7VjgBc5GHz+5dKLTiB5pvbVSLMyqY=";
+    hash = "sha256-tTFdgLpu7RRWx2B2VMROqs1HgG0qMbfUOS5KNLQFHQw=";
  };

-  vendorHash = "sha256-PhuHRs0PjIJqY3ZBC4ga7zFxgf57xfPjJ3VIDaA61F0=";
+  vendorHash = "sha256-RAKYaNi+MXUfNnEJmZF5g9jFBDOPIVBOZWtqZp2FwWY=";
  proxyVendor = true;

  # Skip building the Windows installer
--- a/pkgs/by-name/pa/pay-respects/package.nix
+++ b/pkgs/by-name/pa/pay-respects/package.nix
@ -6,18 +6,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "pay-respects";
-  version = "0.7.6";
+  version = "0.7.8";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "iff";
    repo = "pay-respects";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-+50MKpZgJqjuUvJeFFv8fMILkJ3cOAN7R7kmlR+98II=";
+    hash = "sha256-73uGxcJCWUVwr1ddNjZTRJwx8OfnAPwtp80v1xpUEhA=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-TJP+GPkXwPvnBwiF0SCkn8NGz/xyrYjbUZKCbUUSqHQ=";
+  cargoHash = "sha256-VSv0BpIICkYyCIfGDfK7wfKQssWF13hCh6IW375CI/c=";

  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;
--- a/pkgs/by-name/pe/peergos/package.nix
+++ b/pkgs/by-name/pe/peergos/package.nix
@ -41,12 +41,12 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "peergos";
-  version = "1.2.0";
+  version = "1.5.0";
  src = fetchFromGitHub {
    owner = "Peergos";
    repo = "web-ui";
    rev = "v${version}";
-    hash = "sha256-X5yXTCHKGrdvuoKc5nFbn4CWunNsyoJI+EZLpknLAyA=";
+    hash = "sha256-wvOhxHK5UkVD6mu39y5wpFcf69kadKFqt6WumSnzqmQ=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/pr/pretalx/package.nix
+++ b/pkgs/by-name/pr/pretalx/package.nix
@ -12,7 +12,7 @@ let
  python = python3.override {
    self = python;
    packageOverrides = final: prev: {
-      django = prev.django_5;
+      django = prev.django_5_1;

      django-extensions = prev.django-extensions.overridePythonAttrs {
        # Compat issues with Django 5.1
--- a/pkgs/by-name/sw/swiften/package.nix
+++ b/pkgs/by-name/sw/swiften/package.nix
@ -8,6 +8,7 @@
  zlib,
  fetchurl,
  fetchpatch,
+  python312,
  openssl,
  # pin Boost 1.86 due to use of boost/asio/io_service.hpp
  boost186,
@ -39,6 +40,7 @@ stdenv.mkDerivation rec {
  ];

  nativeBuildInputs = [
+    python312 # 2to3
    scons
  ];

--- a/pkgs/by-name/ta/tandoor-recipes/package.nix
+++ b/pkgs/by-name/ta/tandoor-recipes/package.nix
@ -36,12 +36,12 @@ python.pkgs.buildPythonPackage {
    django-annoying
    django-cleanup
    django-crispy-forms
-    django-crispy-bootstrap4
    django-tables2
    djangorestframework
    drf-writable-nested
    django-oauth-toolkit
    bleach
+    crispy-bootstrap4
    gunicorn
    lxml
    markdown
--- a/pkgs/by-name/te/teapot/package.nix
+++ b/pkgs/by-name/te/teapot/package.nix
@ -7,15 +7,14 @@
  ncurses,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "teapot";
  version = "2.3.0";

  src = fetchFromGitHub {
-    name = "${pname}-${version}";
    owner = "museoa";
-    repo = pname;
-    rev = version;
+    repo = "teapot";
+    tag = finalAttrs.version;
    hash = "sha256-38XFjRzOGasr030f+mRYT+ptlabpnVJfa+1s7ZAjS+k=";
  };

@ -47,8 +46,7 @@ stdenv.mkDerivation rec {
    "-DENABLE_HELP=OFF"
  ];

-  meta = with lib; {
-    inherit (src.meta) homepage;
+  meta = {
    description = "Table Editor And Planner, Or: Teapot";
    longDescription = ''
      Teapot is a compact spreadsheet software originally written by Michael
@ -71,11 +69,13 @@ stdenv.mkDerivation rec {
      spreadsheets still inherit from the days of VisiCalc on ancient CP/M
      systems.
    '';
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ ];
-    platforms = platforms.unix;
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ ];
+    platforms = lib.platforms.unix;
    mainProgram = "teapot";
+    homepage = "https://github.com/museoa/teapot";
+    changelog = "https://github.com/museoa/teapot/releases/tag/${finalAttrs.version}";
  };
-}
+})
 # TODO: patch/fix FLTK building
 # TODO: add documentation
--- a/pkgs/by-name/te/testssl/package.nix
+++ b/pkgs/by-name/te/testssl/package.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "testssl.sh";
-  version = "3.2.0";
+  version = "3.2.1";

  src = fetchFromGitHub {
    owner = "drwetter";
    repo = "testssl.sh";
    rev = "v${version}";
-    sha256 = "sha256-h/Z++Osrog8svIiUF53Cj7KYfKLnimueyp4N3/6bSiE=";
+    sha256 = "sha256-jVrEgTgAvu/N0Ijdl4Lya05Q/af7jGTlJBNiYt1X3tI=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/to/todoman/package.nix
+++ b/pkgs/by-name/to/todoman/package.nix
@ -51,6 +51,24 @@ python3.pkgs.buildPythonApplication rec {
    pytz
  ];

+  outputs = [
+    "out"
+    "doc"
+    "man"
+  ];
+
+  sphinxBuilders = [
+    "singlehtml"
+    "man"
+  ];
+
+  preInstallSphinx = ''
+    # remove invalid outputs for manpages
+    rm .sphinx/man/man/_static/jquery.js
+    rm .sphinx/man/man/_static/_sphinx_javascript_frameworks_compat.js
+    rmdir .sphinx/man/man/_static/
+  '';
+
  postInstall = ''
    installShellCompletion --bash contrib/completion/bash/_todo
    substituteInPlace contrib/completion/zsh/_todo --replace "jq " "${lib.getExe jq} "
--- a/pkgs/by-name/to/topgrade/package.nix
+++ b/pkgs/by-name/to/topgrade/package.nix
@ -8,17 +8,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "topgrade";
-  version = "16.0.3";
+  version = "16.0.4";

  src = fetchFromGitHub {
    owner = "topgrade-rs";
    repo = "topgrade";
    rev = "v${version}";
-    hash = "sha256-TLeShvDdVqFBIStdRlgF1Zmi8FwS9pmeQ9qOu63nq/E=";
+    hash = "sha256-b/xzmC49ETGtcf9ekrSkq75cKxSL4ZrvKPkparwz6zU=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-Tu4exuUhsk9hGDreQWkPrYvokZh0z6DQSQnREO40Qwc=";
+  cargoHash = "sha256-d6jX+3ZcCswhKy5SsSpvXZL9el70+OyIa7lYQ3B/o8M=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/by-name/wa/way-displays/package.nix
+++ b/pkgs/by-name/wa/way-displays/package.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "way-displays";
-  version = "1.14.0";
+  version = "1.14.1";

  src = fetchFromGitHub {
    owner = "alex-courtis";
    repo = "way-displays";
    rev = version;
-    sha256 = "sha256-HIm5cHi9yX9IHDrxqYzxwefuZtOCu5TJzf3j0aiSC5g=";
+    sha256 = "sha256-IW9LolTZaPn2W8IZ166RebQRIug0CyFz/Prgr34wNwM=";
  };

  strictDeps = true;
--- a/pkgs/by-name/we/weblate/package.nix
+++ b/pkgs/by-name/we/weblate/package.nix
@ -16,7 +16,8 @@
 let
  python = python3.override {
    packageOverrides = final: prev: {
-      django = prev.django_5;
+      # https://github.com/django-crispy-forms/crispy-bootstrap3/issues/12
+      django = prev.django_5_1;
      djangorestframework = prev.djangorestframework.overridePythonAttrs (old: {
        # https://github.com/encode/django-rest-framework/discussions/9342
        disabledTests = (old.disabledTests or [ ]) ++ [ "test_invalid_inputs" ];
@ -81,7 +82,7 @@ python.pkgs.buildPythonApplication rec {
      celery
      certifi
      charset-normalizer
-      django-crispy-bootstrap3
+      crispy-bootstrap3
      cryptography
      cssselect
      cython
--- a/pkgs/by-name/wh/whois/package.nix
+++ b/pkgs/by-name/wh/whois/package.nix
@ -11,14 +11,14 @@
 }:

 stdenv.mkDerivation rec {
-  version = "5.6.1";
+  version = "5.6.2";
  pname = "whois";

  src = fetchFromGitHub {
    owner = "rfc1036";
    repo = "whois";
    rev = "v${version}";
-    hash = "sha256-2DDZBERslsnkfFDyz7IXEhvUqfKfRvmIelougkTjPYU=";
+    hash = "sha256-SUpbPxEAFXNlncUgmbMt7ZjaX45hzffca8keBRpcXcM=";
  };

  patches = [
--- a/pkgs/by-name/yo/yodl/package.nix
+++ b/pkgs/by-name/yo/yodl/package.nix
@ -5,55 +5,94 @@
  perl,
  icmake,
  util-linux,
+  bash,
+  versionCheckHook,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "yodl";
-  version = "4.03.03";
-
-  nativeBuildInputs = [ icmake ];
-
-  buildInputs = [ perl ];
+  version = "4.05.00";

  src = fetchFromGitLab {
-    hash = "sha256-MeD/jjhwoiWTb/G8pHrnEEX22h+entPr9MhJ6WHO3DM=";
-    rev = version;
-    repo = "yodl";
    owner = "fbb-git";
+    repo = "yodl";
+    tag = finalAttrs.version;
+    hash = "sha256-QnEjMHuZHj+iPlmiPsAcaNF8RRd/Ld59PA1neuzo1Go=";
  };

  setSourceRoot = ''
    sourceRoot=$(echo */yodl)
  '';

-  preConfigure = ''
+  postPatch = ''
+    for header in media/media.h stack/stack.h message/message.h symbol/symbol.ih symbol/sysp.c hashitem/hashitem.h args/args.h ostream/ostream.h; do
+      sed -i '1i#include <stdbool.h>' "$header"
+    done
    patchShebangs ./build
    patchShebangs scripts/
-    substituteInPlace INSTALL.im --replace /usr $out
-    substituteInPlace macros/rawmacros/startdoc.pl --replace /usr/bin/perl ${perl}/bin/perl
-    substituteInPlace scripts/yodl2whatever.in --replace getopt ${util-linux}/bin/getopt
+    substituteInPlace INSTALL.im \
+      --replace-fail "/usr" "$out"
+    substituteInPlace macros/rawmacros/startdoc.pl \
+      --replace-fail "/usr/bin/perl" "${lib.getExe perl}"
+    substituteInPlace scripts/yodl2whatever.in \
+      --replace-fail "getopt" "${lib.getExe' util-linux "getopt"}"
+    substituteInPlace icmake/stdcpp \
+      --replace-fail "printf << \"    \" << file << '\n';" 'printf("    " + file + "\n");'
  '';

+  nativeBuildInputs = [
+    icmake
+    perl
+    bash
+  ];
+
  # Set TERM because icmbuild calls tput.
-  TERM = "xterm";
+  env.TERM = "xterm";

  buildPhase = ''
+    runHook preBuild
+
+    CXXFLAGS+=' --std=c++20'
+    export CXXFLAGS
    ./build programs
    ./build macros
    ./build man
+    ./build html
+
+    runHook postBuild
  '';

  installPhase = ''
+    runHook preInstall
+
    ./build install programs
    ./build install macros
    ./build install man
+    # dangling symlinks
+    rm $out/share/man/man1/yodl2xml.1
+    rm $out/share/man/man1/yodl2txt.1
+    rm $out/share/man/man1/yodl2man.1
+    rm $out/share/man/man1/yodl2latex.1
+    rm $out/share/man/man1/yodl2html.1
+    rm $out/share/man/man1/yodl2whatever.1
+    ./build install manual
+
+    runHook postInstall
  '';

-  meta = with lib; {
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  meta = {
+    changelog = "https://gitlab.com/fbb-git/yodl/-/blob/${finalAttrs.src.tag}/yodl/changelog";
    description = "Package that implements a pre-document language and tools to process it";
    homepage = "https://fbb-git.gitlab.io/yodl/";
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ pSub ];
-    platforms = platforms.linux;
+    mainProgram = "yodl";
+    license = lib.licenses.agpl3Only; # Upstream did not clarify the license used. https://gitlab.com/fbb-git/yodl/-/issues/4
+    maintainers = with lib.maintainers; [ pSub ];
+    platforms = lib.platforms.linux;
  };
-}
+})
--- a/pkgs/by-name/yu/yubikey-manager/package.nix
+++ b/pkgs/by-name/yu/yubikey-manager/package.nix
@ -9,14 +9,14 @@

 python3Packages.buildPythonPackage rec {
  pname = "yubikey-manager";
-  version = "5.7.0";
+  version = "5.7.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Yubico";
    repo = "yubikey-manager";
    tag = version;
-    hash = "sha256-G93fg2tgIo9u8FjIBBgd74qbYKiqfQo+sAV965bUipk=";
+    hash = "sha256-dgOi9gJ7jO3+EjZQjHfx+KDsBtj6b4JWR3Bp9xWM6FI=";
  };

  postPatch = ''
--- a/pkgs/desktops/gnome/extensions/impatience/default.nix
+++ b/pkgs/desktops/gnome/extensions/impatience/default.nix
@ -5,15 +5,15 @@
  glib,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
  pname = "gnome-shell-extension-impatience";
-  version = "0.5.2";
+  version = "0.5.2-unstable-2025-02-24";

  src = fetchFromGitHub {
    owner = "timbertson";
    repo = "gnome-shell-impatience";
-    tag = "version-${version}";
-    hash = "sha256-Z+tpmmGbC1rgV4U1w6qM3g85FwpRvzHbBCmFCfcmc60=";
+    rev = "527295a35b352596fed1fc07799f1e0792a77040"; # shows gnome 48 support
+    hash = "sha256-9xfZcKJpBttSP2IbGtjo4UxFEnADgQjyV3vx0jSg8nI=";
  };

  buildInputs = [
--- a/pkgs/development/beam-modules/erlfmt/default.nix
+++ b/pkgs/development/beam-modules/erlfmt/default.nix
@ -6,13 +6,13 @@

 rebar3Relx rec {
  pname = "erlfmt";
-  version = "1.6.2";
+  version = "1.7.0";
  releaseType = "escript";

  src = fetchFromGitHub {
    owner = "WhatsApp";
    repo = "erlfmt";
-    hash = "sha256-tBgDCMPYXaAHODQ2KOH1kXmd4O31Os65ZinoU3Bmgdw=";
+    hash = "sha256-bljqWqpzAPP7+cVA3F+vXoUzUFzD4zXpUl/4XmMypB4=";
    tag = "v${version}";
  };

--- a/pkgs/development/python-modules/basswood-av/default.nix
+++ b/pkgs/development/python-modules/basswood-av/default.nix
@ -0,0 +1,49 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  pkg-config,
+  cython,
+  ffmpeg,
+}:
+
+let
+  cython' = cython.overrideAttrs (oldAttrs: rec {
+    version = "3.1.0";
+    src = oldAttrs.src.override {
+      tag = version;
+      hash = "sha256-3/C0+ygGgNvw75ZN02Q70TLFa1U4jVgWQDG5FGWErTg=";
+    };
+  });
+in
+buildPythonPackage rec {
+  pname = "basswood-av";
+  version = "15.2.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "basswood-io";
+    repo = "BasswoodAV";
+    tag = version;
+    hash = "sha256-GWNMPiNk8nSSm45EaRm1Te0PpCNPSYf62WbPYFY/9H8=";
+  };
+
+  build-system = [
+    setuptools
+    cython'
+  ];
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ ffmpeg ];
+
+  pythonImportsCheck = [ "bv" ];
+
+  meta = {
+    description = "Python bindings for ffmpeg libraries";
+    homepage = "https://github.com/basswood-io/BasswoodAV";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ emaryn ];
+  };
+}
--- a/pkgs/development/python-modules/brax/default.nix
+++ b/pkgs/development/python-modules/brax/default.nix
@ -86,11 +86,20 @@ buildPythonPackage rec {
    transforms3d
  ];

-  disabledTests = lib.optionals stdenv.hostPlatform.isAarch64 [
-    # Flaky:
-    # AssertionError: Array(-0.00135638, dtype=float32) != 0.0 within 0.001 delta (Array(0.00135638, dtype=float32) difference)
-    "test_pendulum_period2"
-  ];
+  disabledTests =
+    [
+      # Broken after mujoco was updated to 3.3.3:
+      # TypeError: Data.init() got an unexpected keyword argument 'contact'
+      # Reported upstream: https://github.com/google/brax/issues/618
+      "test_pendulum"
+      "test_pipeline_ant"
+      "test_pipeline_init_with_ctrl"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isAarch64 [
+      # Flaky:
+      # AssertionError: Array(-0.00135638, dtype=float32) != 0.0 within 0.001 delta (Array(0.00135638, dtype=float32) difference)
+      "test_pendulum_period2"
+    ];

  disabledTestPaths = [
    # ValueError: matmul: Input operand 1 has a mismatch in its core dimension
--- a/pkgs/development/python-modules/bx-py-utils/default.nix
+++ b/pkgs/development/python-modules/bx-py-utils/default.nix
@ -4,10 +4,10 @@
  buildPythonPackage,
  pythonOlder,
  fetchFromGitHub,
-  setuptools-scm,
  beautifulsoup4,
  boto3,
  freezegun,
+  hatchling,
  lxml,
  openpyxl,
  parameterized,
@ -19,7 +19,7 @@

 buildPythonPackage rec {
  pname = "bx-py-utils";
-  version = "108";
+  version = "109";

  disabled = pythonOlder "3.10";

@ -29,14 +29,14 @@ buildPythonPackage rec {
    owner = "boxine";
    repo = "bx_py_utils";
    tag = "v${version}";
-    hash = "sha256-VMGP5yl+7kiZ3Ww4ESJPHABDCMZG1VsVDgVoLnGU5r4=";
+    hash = "sha256-y1R48nGeTCpcBAzU3kqNQumRToKvQx9qst1kXPWDIlk=";
  };

  postPatch = ''
    rm bx_py_utils_tests/publish.py
  '';

-  build-system = [ setuptools-scm ];
+  build-system = [ hatchling ];

  pythonImportsCheck = [
    "bx_py_utils.anonymize"
@ -76,15 +76,17 @@ buildPythonPackage rec {
    # too closely affected by bs4 updates
    "test_pretty_format_html"
    "test_assert_html_snapshot_by_css_selector"
+    # test accesses the internet
+    "test_happy_path"
+    # test assumes a virtual environment
+    "test_code_style"
  ];

-  disabledTestPaths =
-    [ "bx_py_utils_tests/tests/test_project_setup.py" ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      # processify() doesn't work under darwin
-      # https://github.com/boxine/bx_py_utils/issues/80
-      "bx_py_utils_tests/tests/test_processify.py"
-    ];
+  disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
+    # processify() doesn't work under darwin
+    # https://github.com/boxine/bx_py_utils/issues/80
+    "bx_py_utils_tests/tests/test_processify.py"
+  ];

  meta = {
    description = "Various Python utility functions";
--- a/pkgs/development/python-modules/chromadb/default.nix
+++ b/pkgs/development/python-modules/chromadb/default.nix
@ -255,7 +255,7 @@ buildPythonPackage rec {
      # we have to update both the python hash and the cargo one,
      # so use nix-update-script
      extraArgs = [
-        "--versionRegex"
+        "--version-regex"
        "([0-9].+)"
      ];
    };
--- a/pkgs/development/python-modules/copier/default.nix
+++ b/pkgs/development/python-modules/copier/default.nix
@ -12,6 +12,7 @@
  lib,
  mkdocs-material,
  mkdocs-mermaid2-plugin,
+  nix-update-script,
  mkdocstrings,
  packaging,
  pathspec,
@ -71,6 +72,8 @@ buildPythonPackage rec {

  makeWrapperArgs = [ "--suffix PATH : ${lib.makeBinPath [ git ]}" ];

+  passthru.updateScript = nix-update-script { };
+
  meta = {
    description = "Library and command-line utility for rendering projects templates";
    homepage = "https://copier.readthedocs.io";
--- a/pkgs/development/python-modules/django-crispy-bootstrap3/default.nix
+++ b/pkgs/development/python-modules/django-crispy-bootstrap3/default.nix
@ -10,7 +10,7 @@
 }:

 buildPythonPackage rec {
-  pname = "django-crispy-bootstrap3";
+  pname = "crispy-bootstrap3";
  version = "2024.1";
  pyproject = true;

--- a/pkgs/development/python-modules/django-crispy-bootstrap4/default.nix
+++ b/pkgs/development/python-modules/django-crispy-bootstrap4/default.nix
@ -10,7 +10,7 @@
 }:

 buildPythonPackage rec {
-  pname = "django-crispy-bootstrap4";
+  pname = "crispy-bootstrap4";
  version = "2024.10";
  pyproject = true;

--- a/pkgs/development/python-modules/django-crispy-bootstrap5/default.nix
+++ b/pkgs/development/python-modules/django-crispy-bootstrap5/default.nix
@ -10,7 +10,7 @@
 }:

 buildPythonPackage rec {
-  pname = "django-crispy-bootstrap5";
+  pname = "crispy-bootstrap5";
  version = "2025.6";
  pyproject = true;

--- a/pkgs/development/python-modules/django-apscheduler/default.nix
+++ b/pkgs/development/python-modules/django-apscheduler/default.nix
@ -5,7 +5,7 @@
  setuptools,
  wheel,
  # dependencies
-  django_5,
+  django,
  apscheduler,
  # tests
  pytestCheckHook,
@ -31,7 +31,7 @@ buildPythonPackage rec {
  ];

  dependencies = [
-    django_5
+    django
    apscheduler
  ];

--- a/pkgs/development/python-modules/django-postgres-partition/default.nix
+++ b/pkgs/development/python-modules/django-postgres-partition/default.nix
@ -3,7 +3,7 @@
  buildPythonPackage,
  fetchPypi,
  setuptools,
-  django_5_2,
+  django,
  psycopg,
  python-dateutil,
 }:
@ -21,8 +21,12 @@ buildPythonPackage rec {

  build-system = [ setuptools ];

+  pythonRelaxDeps = [
+    "django"
+  ];
+
  dependencies = [
-    django_5_2
+    django
    psycopg
    python-dateutil
  ];
--- a/pkgs/development/python-modules/google-cloud-bigtable/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigtable/default.nix
@ -25,13 +25,13 @@

 buildPythonPackage rec {
  pname = "google-cloud-bigtable";
-  version = "2.30.1";
+  version = "2.31.0";

  src = fetchFromGitHub {
    owner = "googleapis";
    repo = "python-bigtable";
    tag = "v${version}";
-    hash = "sha256-TciCYpnwfIIvOexp4Ing6grZ7ufFonwP2G26UzlNaJ4=";
+    hash = "sha256-ihS58yuLnxT9h4TilejP+WImzSZTWO7tOyjIRenmvpA=";
  };

  pyproject = true;
@ -73,7 +73,7 @@ buildPythonPackage rec {
  meta = {
    description = "Google Cloud Bigtable API client library";
    homepage = "https://github.com/googleapis/python-bigtable";
-    changelog = "https://github.com/googleapis/python-bigtable/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/googleapis/python-bigtable/blob/${src.tag}/CHANGELOG.md";
    license = lib.licenses.asl20;
    maintainers = [ lib.maintainers.sarahec ];
  };
--- a/pkgs/development/python-modules/google-cloud-netapp/default.nix
+++ b/pkgs/development/python-modules/google-cloud-netapp/default.nix
@ -2,10 +2,10 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+  gitUpdater,
  google-api-core,
  google-auth,
  mock,
-  nix-update-script,
  proto-plus,
  protobuf,
  pytest-asyncio,
@ -47,11 +47,8 @@ buildPythonPackage rec {
    "google.cloud.netapp_v1"
  ];

-  passthru.updateScript = nix-update-script {
-    extraArgs = [
-      "--version-regex"
-      "google-cloud-netapp-v([0-9.]+)"
-    ];
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "google-cloud-netapp-v";
  };

  meta = {
--- a/pkgs/development/python-modules/google-geo-type/default.nix
+++ b/pkgs/development/python-modules/google-geo-type/default.nix
@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "google-geo-type";
-  version = "0.3.12";
+  version = "0.3.13";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "googleapis";
    repo = "google-cloud-python";
    tag = "google-geo-type-v${version}";
-    hash = "sha256-5PzidE1CWN+pt7+gcAtbuXyL/pq6cnn0MCRkBfmeUSw=";
+    hash = "sha256-VYkgkVrUgBiUEFF2J8ZFrh2Sw7h653stYxNcpYfRAj4=";
  };

  sourceRoot = "${src.name}/packages/google-geo-type";
--- a/pkgs/development/python-modules/langchain-anthropic/default.nix
+++ b/pkgs/development/python-modules/langchain-anthropic/default.nix
@ -2,7 +2,6 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
-  nix-update-script,

  # build-system
  pdm-backend,
@ -16,6 +15,9 @@
  langchain-tests,
  pytest-asyncio,
  pytestCheckHook,
+
+  # passthru
+  gitUpdater,
 }:

 buildPythonPackage rec {
@ -58,15 +60,12 @@ buildPythonPackage rec {

  pythonImportsCheck = [ "langchain_anthropic" ];

-  passthru.updateScript = nix-update-script {
-    extraArgs = [
-      "--version-regex"
-      "langchain-anthropic==([0-9.]+)"
-    ];
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "langchain-anthropic==";
  };

  meta = {
-    changelog = "https://github.com/langchain-ai/langchain-anthropic/releases/tag/langchain-anthropic==${version}";
+    changelog = "https://github.com/langchain-ai/langchain-anthropic/releases/tag/${src.tag}";
    description = "Build LangChain applications with Anthropic";
    homepage = "https://github.com/langchain-ai/langchain/tree/master/libs/partners/anthropic";
    license = lib.licenses.mit;
--- a/pkgs/development/python-modules/langchain-aws/default.nix
+++ b/pkgs/development/python-modules/langchain-aws/default.nix
@ -2,7 +2,6 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
-  nix-update-script,

  # build-system
  poetry-core,
@ -18,6 +17,9 @@
  pytest-asyncio,
  pytest-cov-stub,
  pytestCheckHook,
+
+  # passthru
+  gitUpdater,
 }:

 buildPythonPackage rec {
@ -69,15 +71,12 @@ buildPythonPackage rec {

  pythonImportsCheck = [ "langchain_aws" ];

-  passthru.updateScript = nix-update-script {
-    extraArgs = [
-      "--version-regex"
-      "langchain-aws==([0-9.]+)"
-    ];
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "langchain-aws==";
  };

  meta = {
-    changelog = "https://github.com/langchain-ai/langchain-aws/releases/tag/v${version}";
+    changelog = "https://github.com/langchain-ai/langchain-aws/releases/tag/${src.tag}";
    description = "Build LangChain application on AWS";
    homepage = "https://github.com/langchain-ai/langchain-aws/";
    license = lib.licenses.mit;
--- a/pkgs/development/python-modules/langchain-azure-dynamic-sessions/default.nix
+++ b/pkgs/development/python-modules/langchain-azure-dynamic-sessions/default.nix
@ -2,7 +2,6 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
-  nix-update-script,

  # build-system
  poetry-core,
@ -24,6 +23,9 @@
  responses,
  syrupy,
  toml,
+
+  # passthru
+  gitUpdater,
 }:

 buildPythonPackage rec {
@ -72,17 +74,14 @@ buildPythonPackage rec {

  pythonImportsCheck = [ "langchain_azure_dynamic_sessions" ];

-  passthru.updateScript = nix-update-script {
-    extraArgs = [
-      "--version-regex"
-      "^langchain-azure-dynamic-sessions==([0-9.]+)$"
-    ];
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "langchain-azure-dynamic-sessions==";
  };

  meta = {
    description = "Integration package connecting Azure Container Apps dynamic sessions and LangChain";
    homepage = "https://github.com/langchain-ai/langchain/tree/master/libs/partners/azure-dynamic-sessions";
-    changelog = "https://github.com/langchain-ai/langchain/releases/tag/langchain-azure-dynamic-sessions==${version}";
+    changelog = "https://github.com/langchain-ai/langchain/releases/tag/${src.tag}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [
      natsukium
--- a/pkgs/development/python-modules/langchain-chroma/default.nix
+++ b/pkgs/development/python-modules/langchain-chroma/default.nix
@ -2,14 +2,22 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
-  nix-update-script,
+
+  # build-system
+  pdm-backend,
+
+  # dependencies
  chromadb,
  langchain-core,
-  langchain-tests,
  numpy,
-  pdm-backend,
+
+  # tests
+  langchain-tests,
  pytestCheckHook,
  pytest-asyncio,
+
+  # passthru
+  gitUpdater,
 }:

 buildPythonPackage rec {
@ -56,15 +64,12 @@ buildPythonPackage rec {
    "test_chroma_update_document"
  ];

-  passthru.updateScript = nix-update-script {
-    extraArgs = [
-      "--version-regex"
-      "langchain-chroma==([0-9.]+)"
-    ];
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "langchain-chroma==";
  };

  meta = {
-    changelog = "https://github.com/langchain-ai/langchain/releases/tag/langchain-chroma==${version}";
+    changelog = "https://github.com/langchain-ai/langchain/releases/tag/${src.tag}";
    description = "Integration package connecting Chroma and LangChain";
    homepage = "https://github.com/langchain-ai/langchain/tree/master/libs/partners/chroma";
    license = lib.licenses.mit;
--- a/pkgs/development/python-modules/langchain-community/default.nix
+++ b/pkgs/development/python-modules/langchain-community/default.nix
@ -2,7 +2,6 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
-  nix-update-script,

  # build-system
  pdm-backend,
@ -36,6 +35,9 @@
  responses,
  syrupy,
  toml,
+
+  # passthru
+  gitUpdater,
 }:

 buildPythonPackage rec {
@ -121,17 +123,14 @@ buildPythonPackage rec {
    "tests/unit_tests/document_loaders/test_gitbook.py"
  ];

-  passthru.updateScript = nix-update-script {
-    extraArgs = [
-      "--version-regex"
-      "libs/community/v([0-9.]+)"
-    ];
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "libs/community/v";
  };

  meta = {
    description = "Community contributed LangChain integrations";
    homepage = "https://github.com/langchain-ai/langchain-community";
-    changelog = "https://github.com/langchain-ai/langchain-community/releases/tag/libs%2Fcommunity%2fv${version}";
+    changelog = "https://github.com/langchain-ai/langchain-community/releases/tag/${src.tag}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [
      natsukium
--- a/pkgs/development/python-modules/langchain-core/default.nix
+++ b/pkgs/development/python-modules/langchain-core/default.nix
@ -31,7 +31,7 @@
  syrupy,

  # passthru
-  nix-update-script,
+  gitUpdater,
 }:

 buildPythonPackage rec {
@ -91,11 +91,8 @@ buildPythonPackage rec {
      doCheck = true;
    });

-    updateScript = nix-update-script {
-      extraArgs = [
-        "--version-regex"
-        "langchain-core==([0-9.]+)"
-      ];
+    updateScript = gitUpdater {
+      rev-prefix = "langchain-core==";
    };
  };

@ -143,7 +140,7 @@ buildPythonPackage rec {
  meta = {
    description = "Building applications with LLMs through composability";
    homepage = "https://github.com/langchain-ai/langchain/tree/master/libs/core";
-    changelog = "https://github.com/langchain-ai/langchain/releases/tag/v${version}";
+    changelog = "https://github.com/langchain-ai/langchain/releases/tag/${src.tag}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [
      natsukium
--- a/pkgs/development/python-modules/langchain-core/update.sh
+++ b/pkgs/development/python-modules/langchain-core/update.sh
@ -1,52 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p common-updater-scripts jq
-
-set -euo pipefail
-
-declare -ar packages=(
-    langchain
-    langchain-anthropic
-    langchain-azure-dynamic-sessions
-    langchain-chroma
-    langchain-community
-    langchain-core
-    langchain-deepseek
-    langchain-fireworks
-    langchain-groq
-    langchain-huggingface
-    langchain-mistralai
-    langchain-mongodb
-    langchain-ollama
-    langchain-openai
-    langchain-perplexity
-    langchain-tests
-    langchain-text-splitters
-    langchain-xai
-)
-
-tags=$(git ls-remote --tags --refs "https://github.com/langchain-ai/langchain" | cut --delimiter=/ --field=3-)
-
-# Will be printed as JSON at the end to list what  needs updating
-updates=""
-
-for package in ${packages[@]}
-do
-    pyPackage="python3Packages.$package"
-    oldVersion="$(nix-instantiate --eval -E "with import ./. {}; lib.getVersion $pyPackage" | tr -d '"')"
-    newVersion=$(echo "$tags" | grep -Po "(?<=$package==)\d+\.\d+\.\d+$" | sort --version-sort --reverse | head -1 )
-    if [[ "$newVersion" != "$oldVersion" ]]; then
-        update-source-version $pyPackage "$newVersion"
-        updates+="{
-    \"attrPath\": \"$pyPackage\",
-    \"oldVersion\": \"$oldVersion\",
-    \"newVersion\": \"$newVersion\",
-    \"files\": [
-        \"$PWD/pkgs/development/python-modules/${package}/default.nix\"
-    ]
-},"
-    fi
-done
-# Remove trailing comma
-updates=${updates%,}
-# Print the updates in JSON format
-echo "[ $updates ]"
--- a/Show More
+++ b/Show More