Merge staging-next into staging

2025-06-22 18:06:41 +00:00 · 2025-06-22 18:06:41 +00:00 · b68b849d07
commit b68b849d07
parent bf0680d24a 25afd7e4fe
131 changed files with 1364 additions and 734 deletions
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@ -194,19 +194,15 @@ jobs:
                    expectedHash: artifact.digest
                  })

-                  // Get all currently set labels that we manage
-                  const before =
+                  // Create a map (Label -> Boolean) of all currently set labels.
+                  // Each label is set to True and can be disabled later.
+                  const before = Object.fromEntries(
                    (await github.paginate(github.rest.issues.listLabelsOnIssue, {
                      ...context.repo,
                      issue_number: pull_request.number
                    }))
-                    .map(({ name }) => name)
-                    .filter(name =>
-                      name.startsWith('10.rebuild') ||
-                      name == '11.by: package-maintainer' ||
-                      name.startsWith('12.approvals:') ||
-                      name == '12.approved-by: package-maintainer'
-                    )
+                    .map(({ name }) => [name, true])
+                  )

                  const approvals = new Set(
                    (await github.paginate(github.rest.pulls.listReviews, {
@ -221,35 +217,43 @@ jobs:
                    JSON.parse(await readFile(`${pull_request.number}/maintainers.json`, 'utf-8'))
                  ).map(m => Number.parseInt(m, 10)))

-                  // And the labels that should be there
-                  const after = JSON.parse(await readFile(`${pull_request.number}/changed-paths.json`, 'utf-8')).labels
-                  if (approvals.size > 0) after.push(`12.approvals: ${approvals.size > 2 ? '3+' : approvals.size}`)
-                  if (Array.from(maintainers).some(m => approvals.has(m))) after.push('12.approved-by: package-maintainer')
+                  const evalLabels = JSON.parse(await readFile(`${pull_request.number}/changed-paths.json`, 'utf-8')).labels

-                  if (context.eventName == 'pull_request') {
-                    core.info('Skipping labeling on a pull_request event (no privileges).')
-                    return
-                  }
-
-                  // Remove the ones not needed anymore
-                  await Promise.all(
-                    before.filter(name => !after.includes(name))
-                    .map(name => github.rest.issues.removeLabel({
-                      ...context.repo,
-                      issue_number: pull_request.number,
-                      name
-                    }))
+                  // Manage the labels
+                  const after = Object.assign(
+                    {},
+                    before,
+                    // Ignore `evalLabels` if it's an array.
+                    // This can happen for older eval runs, before we switched to objects.
+                    // The old eval labels would have been set by the eval run,
+                    // so now they'll be present in `before`.
+                    // TODO: Simplify once old eval results have expired (~2025-10)
+                    (Array.isArray(evalLabels) ? undefined : evalLabels),
+                    {
+                      '12.approvals: 1': approvals.size == 1,
+                      '12.approvals: 2': approvals.size == 2,
+                      '12.approvals: 3+': approvals.size >= 3,
+                      '12.approved-by: package-maintainer': Array.from(maintainers).some(m => approvals.has(m)),
+                      '12.first-time contribution':
+                        [ 'NONE', 'FIRST_TIMER', 'FIRST_TIME_CONTRIBUTOR' ].includes(pull_request.author_association),
+                    }
                  )

-                  // And add the ones that aren't set already
-                  const added = after.filter(name => !before.includes(name))
-                  if (added.length > 0) {
-                    await github.rest.issues.addLabels({
-                      ...context.repo,
-                      issue_number: pull_request.number,
-                      labels: added
-                    })
-                  }
+                  // No need for an API request, if all labels are the same.
+                  const hasChanges = Object.keys(after).some(name => (before[name] ?? false) != after[name])
+                  if (log('Has changes', hasChanges, !hasChanges))
+                    return;
+
+                  // Skipping labeling on a pull_request event, because we have no privileges.
+                  const labels = Object.entries(after).filter(([,value]) => value).map(([name]) => name)
+                  if (log('Set labels', labels, context.eventName == 'pull_request'))
+                    return;
+
+                  await github.rest.issues.setLabels({
+                    ...context.repo,
+                    issue_number: pull_request.number,
+                    labels
+                  })
                } catch (cause) {
                  throw new Error(`Labeling PR #${pull_request.number} failed.`, { cause })
                }
--- a/ci/eval/compare/default.nix
+++ b/ci/eval/compare/default.nix
@ -31,10 +31,10 @@ let
            changed: ["package2", "package3"],
            removed: ["package4"],
          },
-          labels: [
-            "10.rebuild-darwin: 1-10",
-            "10.rebuild-linux: 1-10"
-          ],
+          labels: {
+            "10.rebuild-darwin: 1-10": true,
+            "10.rebuild-linux: 1-10": true
+          },
          rebuildsByKernel: {
            darwin: ["package1", "package2"],
            linux: ["package1", "package2", "package3"]
@ -97,19 +97,21 @@ let
          rebuildCountByKernel
          ;
        labels =
-          (getLabels rebuildCountByKernel)
-          # Adds "10.rebuild-*-stdenv" label if the "stdenv" attribute was changed
-          ++ lib.mapAttrsToList (kernel: _: "10.rebuild-${kernel}-stdenv") (
-            lib.filterAttrs (_: lib.elem "stdenv") rebuildsByKernel
-          )
-          # Adds the "11.by: package-maintainer" label if all of the packages directly
-          # changed are maintained by the PR's author. (https://github.com/NixOS/ofborg/blob/df400f44502d4a4a80fa283d33f2e55a4e43ee90/ofborg/src/tagger.rs#L83-L88)
-          ++ lib.optional (
-            maintainers ? ${githubAuthorId}
-            && lib.all (lib.flip lib.elem maintainers.${githubAuthorId}) (
-              lib.flatten (lib.attrValues maintainers)
-            )
-          ) "11.by: package-maintainer";
+          getLabels rebuildCountByKernel
+          # Sets "10.rebuild-*-stdenv" label to whether the "stdenv" attribute was changed.
+          // lib.mapAttrs' (
+            kernel: rebuilds: lib.nameValuePair "10.rebuild-${kernel}-stdenv" (lib.elem "stdenv" rebuilds)
+          ) rebuildsByKernel
+          # Set the "11.by: package-maintainer" label to whether all packages directly
+          # changed are maintained by the PR's author.
+          # (https://github.com/NixOS/ofborg/blob/df400f44502d4a4a80fa283d33f2e55a4e43ee90/ofborg/src/tagger.rs#L83-L88)
+          // {
+            "11.by: package-maintainer" =
+              maintainers ? ${githubAuthorId}
+              && lib.all (lib.flip lib.elem maintainers.${githubAuthorId}) (
+                lib.flatten (lib.attrValues maintainers)
+              );
+          };
      }
    );

--- a/ci/eval/compare/utils.nix
+++ b/ci/eval/compare/utils.nix
@ -151,7 +151,7 @@ rec {
    lib.genAttrs [ "linux" "darwin" ] filterKernel;

  /*
-    Maps an attrs of `kernel - rebuild counts` mappings to a list of labels
+    Maps an attrs of `kernel - rebuild counts` mappings to an attrs of labels

    Turns
      {
@ -159,54 +159,37 @@ rec {
        darwin = 1;
      }
    into
-      [
-        "10.rebuild-darwin: 1"
-        "10.rebuild-darwin: 1-10"
-        "10.rebuild-linux: 11-100"
-      ]
+      {
+        "10.rebuild-darwin: 1" = true;
+        "10.rebuild-darwin: 1-10" = true;
+        "10.rebuild-darwin: 11-100" = false;
+        # [...]
+        "10.rebuild-darwin: 1" = false;
+        "10.rebuild-darwin: 1-10" = false;
+        "10.rebuild-linux: 11-100" = true;
+        # [...]
+      }
  */
  getLabels =
    rebuildCountByKernel:
-    lib.concatLists (
+    lib.mergeAttrsList (
      lib.mapAttrsToList (
        kernel: rebuildCount:
        let
-          numbers =
-            if rebuildCount == 0 then
-              [ "0" ]
-            else if rebuildCount == 1 then
-              [
-                "1"
-                "1-10"
-              ]
-            else if rebuildCount <= 10 then
-              [ "1-10" ]
-            else if rebuildCount <= 100 then
-              [ "11-100" ]
-            else if rebuildCount <= 500 then
-              [ "101-500" ]
-            else if rebuildCount <= 1000 then
-              [
-                "501-1000"
-                "501+"
-              ]
-            else if rebuildCount <= 2500 then
-              [
-                "1001-2500"
-                "501+"
-              ]
-            else if rebuildCount <= 5000 then
-              [
-                "2501-5000"
-                "501+"
-              ]
-            else
-              [
-                "5001+"
-                "501+"
-              ];
+          range = from: to: from <= rebuildCount && (rebuildCount <= to || to == null);
        in
-        lib.forEach numbers (number: "10.rebuild-${kernel}: ${number}")
+        lib.mapAttrs' (number: lib.nameValuePair "10.rebuild-${kernel}: ${number}") {
+          "0" = range 0 0;
+          "1" = range 1 1;
+          "1-10" = range 1 10;
+          "11-100" = range 11 100;
+          "101-500" = range 101 500;
+          "501-1000" = range 501 1000;
+          "501+" = range 501 null;
+          "1001-2500" = range 1001 2500;
+          "2501-5000" = range 2501 5000;
+          "5001+" = range 5001 null;
+        }
      ) rebuildCountByKernel
    );
 }
--- a/nixos/modules/services/finance/libeufin/common.nix
+++ b/nixos/modules/services/finance/libeufin/common.nix
@ -96,7 +96,9 @@ libeufinComponent:
            };
          in
          {
-            path = [ config.services.postgresql.package ];
+            path = [
+              (if cfg.createLocalDatabase then config.services.postgresql.package else pkgs.postgresql)
+            ];
            serviceConfig = {
              Type = "oneshot";
              DynamicUser = true;
--- a/nixos/modules/services/mail/roundcube.nix
+++ b/nixos/modules/services/mail/roundcube.nix
@ -272,7 +272,7 @@ in
    ];

    systemd.services.roundcube-setup = lib.mkMerge [
-      (lib.mkIf (cfg.database.host == "localhost") {
+      (lib.mkIf localDB {
        requires = [ "postgresql.service" ];
        after = [ "postgresql.service" ];
      })
@ -281,7 +281,9 @@ in
        after = [ "network-online.target" ];
        wantedBy = [ "multi-user.target" ];

-        path = [ config.services.postgresql.package ];
+        path = [
+          (if localDB then config.services.postgresql.package else pkgs.postgresql)
+        ];
        script =
          let
            psql = "${lib.optionalString (!localDB) "PGPASSFILE=${cfg.database.passwordFile}"} psql ${
--- a/nixos/modules/services/networking/seafile.nix
+++ b/nixos/modules/services/networking/seafile.nix
@ -84,7 +84,7 @@ in
      default = { };
      description = ''
        Configuration for ccnet, see
-        <https://manual.seafile.com/config/ccnet-conf/>
+        <https://manual.seafile.com/11.0/config/ccnet-conf/>
        for supported values.
      '';
    };
@ -122,7 +122,7 @@ in
      default = { };
      description = ''
        Configuration for seafile-server, see
-        <https://manual.seafile.com/config/seafile-conf/>
+        <https://manual.seafile.com/11.0/config/seafile-conf/>
        for supported values.
      '';
    };
@ -235,7 +235,7 @@ in
      type = types.lines;
      description = ''
        Extra config to append to `seahub_settings.py` file.
-        Refer to <https://manual.seafile.com/config/seahub_settings_py/>
+        Refer to <https://manual.seafile.com/11.0/config/seahub_settings_py/>
        for all available options.
      '';
    };
--- a/nixos/modules/services/web-apps/immich.nix
+++ b/nixos/modules/services/web-apps/immich.nix
@ -46,6 +46,9 @@ let
    mkOption
    mkEnableOption
    ;
+
+  postgresqlPackage =
+    if cfg.database.enable then config.services.postgresql.package else pkgs.postgresql;
 in
 {
  options.services.immich = {
@ -228,6 +231,11 @@ in
        assertion = !isPostgresUnixSocket -> cfg.secretsFile != null;
        message = "A secrets file containing at least the database password must be provided when unix sockets are not used.";
      }
+      {
+        # When removing this assertion, please adjust the nixosTests accordingly.
+        assertion = cfg.database.enable -> lib.versionOlder config.services.postgresql.package.version "17";
+        message = "Immich doesn't support PostgreSQL 17+, yet.";
+      }
    ];

    services.postgresql = mkIf cfg.database.enable {
@ -265,7 +273,7 @@ in
      in
      [
        ''
-          ${lib.getExe' config.services.postgresql.package "psql"} -d "${cfg.database.name}" -f "${sqlFile}"
+          ${lib.getExe' postgresqlPackage "psql"} -d "${cfg.database.name}" -f "${sqlFile}"
        ''
      ];

@ -333,7 +341,7 @@ in
      path = [
        # gzip and pg_dumpall are used by the backup service
        pkgs.gzip
-        config.services.postgresql.package
+        postgresqlPackage
      ];

      serviceConfig = commonServiceConfig // {
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@ -95,6 +95,7 @@ let
        ++ optional cfg.caching.apcu apcu
        ++ optional cfg.caching.redis redis
        ++ optional cfg.caching.memcached memcached
+        ++ optional (cfg.settings.log_type == "systemd") systemd
      )
      ++ cfg.phpExtraExtensions all; # Enabled by user
    extraConfig = toKeyValue cfg.phpOptions;
@ -859,7 +860,7 @@ in
            default = "syslog";
            description = ''
              Logging backend to use.
-              systemd requires the php-systemd package to be added to services.nextcloud.phpExtraExtensions.
+              systemd automatically adds the php-systemd extensions to services.nextcloud.phpExtraExtensions.
              See the [nextcloud documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/logging_configuration.html) for details.
            '';
          };
--- a/nixos/tests/alps.nix
+++ b/nixos/tests/alps.nix
@ -28,8 +28,10 @@ in
        enableSubmission = true;
        enableSubmissions = true;
        tlsTrustedAuthorities = "${certs.ca.cert}";
-        sslCert = "${certs.${domain}.cert}";
-        sslKey = "${certs.${domain}.key}";
+        config.smtpd_tls_chain_files = [
+          "${certs.${domain}.key}"
+          "${certs.${domain}.cert}"
+        ];
      };
      services.dovecot2 = {
        enable = true;
--- a/nixos/tests/matrix/synapse.nix
+++ b/nixos/tests/matrix/synapse.nix
@ -200,13 +200,7 @@ in

            # disable obsolete protocols, something old versions of twisted are still using
            smtpd_tls_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
-            smtp_tls_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
            smtpd_tls_mandatory_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
-            smtp_tls_mandatory_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
-            smtp_tls_chain_files = [
-              "${mailerCerts.${mailerDomain}.key}"
-              "${mailerCerts.${mailerDomain}.cert}"
-            ];
            smtpd_tls_chain_files = [
              "${mailerCerts.${mailerDomain}.key}"
              "${mailerCerts.${mailerDomain}.cert}"
--- a/nixos/tests/schleuder.nix
+++ b/nixos/tests/schleuder.nix
@ -12,8 +12,10 @@ import ./make-test-python.nix {
        enable = true;
        enableSubmission = true;
        tlsTrustedAuthorities = "${certs.ca.cert}";
-        sslCert = "${certs.${domain}.cert}";
-        sslKey = "${certs.${domain}.key}";
+        config.smtpd_tls_chain_files = [
+          "${certs.${domain}.key}"
+          "${certs.${domain}.cert}"
+        ];
        inherit domain;
        destination = [ domain ];
        localRecipients = [
--- a/nixos/tests/web-apps/immich-public-proxy.nix
+++ b/nixos/tests/web-apps/immich-public-proxy.nix
@ -30,6 +30,9 @@
        port = 8002;
        settings.ipp.responseHeaders."X-NixOS" = "Rules";
      };
+
+      # TODO: Remove when PostgreSQL 17 is supported.
+      services.postgresql.package = pkgs.postgresql_16;
    };

  testScript = ''
--- a/nixos/tests/web-apps/immich.nix
+++ b/nixos/tests/web-apps/immich.nix
@ -18,6 +18,9 @@
        enable = true;
        environment.IMMICH_LOG_LEVEL = "verbose";
      };
+
+      # TODO: Remove when PostgreSQL 17 is supported.
+      services.postgresql.package = pkgs.postgresql_16;
    };

  testScript = ''
--- a/pkgs/README.md
+++ b/pkgs/README.md
@ -521,6 +521,8 @@ When using the `patches` parameter to `mkDerivation`, make sure the patch name c
 >
 > See [Versioning](#versioning) for details on package versioning.

+The following describes two ways to include the patch. Regardless of how the patch is included, you _must_ ensure its purpose is clear and obvious. This enables other maintainers to more easily determine when old patches are no longer required. Typically, you can improve clarity with carefully considered filenames, attribute names, and/or comments; these should explain the patch's _intention_. Additionally, it may sometimes be helpful to clarify _how_ it resolves the issue. For example: _"fix gcc14 build by adding missing include"_.
+
 ### Fetching patches

 In the interest of keeping our maintenance burden and the size of Nixpkgs to a minimum, patches already merged upstream or published elsewhere _should_ be retrieved using `fetchpatch2`:
--- a/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix
@ -12,12 +12,12 @@
  pkgs,
 }:
 let
-  version = "0.0.25-unstable-2025-06-20";
+  version = "0.0.25-unstable-2025-06-21";
  src = fetchFromGitHub {
    owner = "yetone";
    repo = "avante.nvim";
-    rev = "060c0de2aa2ef7c9e6e100f3bd8ef92c085d0555";
-    hash = "sha256-g5GVTRy1RiNNYrVIQbHxOu1ihxlQk/kww3DEKJ6hF9Q=";
+    rev = "86743a1d7d6232a820709986e971b3c1de62d9a7";
+    hash = "sha256-7lLnC/tcl5yVM6zBIk41oJ3jhRTv8AqXwJdXF2yPjwk=";
  };
  avante-nvim-lib = rustPlatform.buildRustPackage {
    pname = "avante-nvim-lib";
--- a/pkgs/applications/editors/vim/plugins/non-generated/blink-cmp/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/blink-cmp/default.nix
@ -8,19 +8,19 @@
  gitMinimal,
 }:
 let
-  version = "1.3.1";
+  version = "1.4.1";
  src = fetchFromGitHub {
    owner = "Saghen";
    repo = "blink.cmp";
    tag = "v${version}";
-    hash = "sha256-ZMq7zXXP3QL73zNfgDNi7xipmrbNwBoFPzK4K0dr6Zs=";
+    hash = "sha256-0RmX/uANgU/di3Iu0V6Oe3jZj4ikzeegW/XQUZhPgRc=";
  };
  blink-fuzzy-lib = rustPlatform.buildRustPackage {
    inherit version src;
    pname = "blink-fuzzy-lib";

    useFetchCargoVendor = true;
-    cargoHash = "sha256-IDoDugtNWQovfSstbVMkKHLBXKa06lxRWmywu4zyS3M=";
+    cargoHash = "sha256-/8eiZyJEwPXAviwVMFTr+NKSwMwxdraKtrlXNU0cBM4=";

    nativeBuildInputs = [ gitMinimal ];

--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -2451,8 +2451,8 @@ let
        mktplcRef = {
          name = "vscode-vibrancy-continued";
          publisher = "illixion";
-          version = "1.1.53";
-          hash = "sha256-6yhyGMX1U9clMNkcQRjNfa+HpLvWVI1WvhTUyn4g3ZY=";
+          version = "1.1.54";
+          hash = "sha256-CzhDStBa/LB/bzgzrFCUEcVDeBluWJPblneUbHdIcRE=";
        };
        meta = {
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=illixion.vscode-vibrancy-continued";
--- a/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
@ -11,7 +11,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
    name = "tinymist";
    publisher = "myriad-dreamin";
    inherit (tinymist) version;
-    hash = "sha256-1mBzimFM/ntjL/d0YkoCds5MtXKwB52jzcHEWpx3Ggo=";
+    hash = "sha256-QhME94U4iVUSXGLlGqM+X8WbnnxGIVeKKJYEWWAMztg=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/veusz/default.nix
+++ b/pkgs/applications/graphics/veusz/default.nix
@ -2,25 +2,28 @@
  lib,
  python3Packages,
  fetchPypi,
-  libsForQt5,
+  qt6,
 }:

 python3Packages.buildPythonApplication rec {
  pname = "veusz";
-  version = "3.6.2";
+  version = "4.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "whcaxF5LMEJNj8NSYeLpnb5uJboRl+vCQ1WxBrJjldE=";
+    hash = "sha256-s7TaDnt+nEIAmAqiZf9aYPFWVtSX22Ruz8eMpxMRr0U=";
  };

  nativeBuildInputs = [
-    libsForQt5.wrapQtAppsHook
    python3Packages.sip
    python3Packages.tomli
+    qt6.qmake
+    qt6.wrapQtAppsHook
  ];

-  buildInputs = [ libsForQt5.qtbase ];
+  dontUseQmakeConfigure = true;
+
+  buildInputs = [ qt6.qtbase ];

  # veusz is a script and not an ELF-executable, so wrapQtAppsHook will not wrap
  # it automatically -> we have to do it explicitly
@ -33,7 +36,7 @@ python3Packages.buildPythonApplication rec {
  # really have a corresponding path, so patching the location of PyQt5 inplace
  postPatch = ''
    substituteInPlace pyqt_setuptools.py \
-      --replace "get_path('platlib')" "'${python3Packages.pyqt5}/${python3Packages.python.sitePackages}'"
+      --replace-fail "get_path('platlib')" "'${python3Packages.pyqt5}/${python3Packages.python.sitePackages}'"
    patchShebangs tests/runselftest.py
  '';

@ -45,9 +48,9 @@ python3Packages.buildPythonApplication rec {
    "--qt-libinfix="
  ];

-  propagatedBuildInputs = with python3Packages; [
+  dependencies = with python3Packages; [
    numpy
-    pyqt5
+    pyqt6
    # optional requirements:
    dbus-python
    h5py
@ -56,16 +59,20 @@ python3Packages.buildPythonApplication rec {
  ];

  installCheckPhase = ''
+    runHook preInstallCheck
+
    wrapQtApp "tests/runselftest.py"
    QT_QPA_PLATFORM=minimal tests/runselftest.py
+
+    runHook postInstallCheck
  '';

-  meta = with lib; {
+  meta = {
    description = "Scientific plotting and graphing program with a GUI";
    mainProgram = "veusz";
    homepage = "https://veusz.github.io/";
-    license = licenses.gpl2Plus;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ laikq ];
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ laikq ];
  };
 }
--- a/pkgs/applications/misc/maliit-framework/default.nix
+++ b/pkgs/applications/misc/maliit-framework/default.nix
@ -26,25 +26,17 @@
  wayland-scanner,
 }:

-mkDerivation rec {
+mkDerivation {
  pname = "maliit-framework";
-  version = "2.3.0";
+  version = "2.3.0-unstable-2024-06-24";

  src = fetchFromGitHub {
    owner = "maliit";
    repo = "framework";
-    tag = version;
-    sha256 = "sha256-q+hiupwlA0PfG+xtomCUp2zv6HQrGgmOd9CU193ucrY=";
+    rev = "ba6f7eda338a913f2c339eada3f0382e04f7dd67";
+    hash = "sha256-iwWLnstQMG8F6uE5rKF6t2X43sXQuR/rIho2RN/D9jE=";
  };

-  patches = [
-    # FIXME: backport GCC 12 build fix, remove for next release
-    (fetchpatch {
-      url = "https://github.com/maliit/framework/commit/86e55980e3025678882cb9c4c78614f86cdc1f04.diff";
-      hash = "sha256-5R+sCI05vJX5epu6hcDSWWzlZ8ns1wKEJ+u8xC6d8Xo=";
-    })
-  ];
-
  buildInputs = [
    at-spi2-atk
    at-spi2-core
--- a/pkgs/applications/misc/maliit-keyboard/default.nix
+++ b/pkgs/applications/misc/maliit-keyboard/default.nix
@ -8,7 +8,6 @@
  libchewing,
  libpinyin,
  maliit-framework,
-  presage,
  qtfeedback,
  qtmultimedia,
  qtquickcontrols2,
@ -19,15 +18,15 @@
  wrapGAppsHook3,
 }:

-mkDerivation rec {
+mkDerivation {
  pname = "maliit-keyboard";
-  version = "2.3.1";
+  version = "2.3.1-unstable-2024-09-04";

  src = fetchFromGitHub {
    owner = "maliit";
    repo = "keyboard";
-    rev = version;
-    sha256 = "sha256-XH3sKQuNMLgJi2aV+bnU2cflwkFIw4RYVfxzQiejCT0=";
+    rev = "cbb0bbfa67354df76c25dbc3b1ea99a376fd15bb";
+    sha256 = "sha256-6ITlV/RJkPDrnsFyeWYWaRTYTaY6NAbHDqpUZGGKyi4=";
  };

  postPatch = ''
@ -41,7 +40,6 @@ mkDerivation rec {
    libchewing
    libpinyin
    maliit-framework
-    presage
    qtfeedback
    qtmultimedia
    qtquickcontrols2
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -363,11 +363,11 @@
    "vendorHash": "sha256-quoFrJbB1vjz+MdV+jnr7FPACHuUe5Gx9POLubD2IaM="
  },
  "digitalocean": {
-    "hash": "sha256-uAke0Zds4MERYXz+Ie0pefoVY9HDQ1ewOAU/As03V6g=",
+    "hash": "sha256-XUwHBwxkOG4oK0W1IcvIWgov3AShMmeYPoc0gu6YEwY=",
    "homepage": "https://registry.terraform.io/providers/digitalocean/digitalocean",
    "owner": "digitalocean",
    "repo": "terraform-provider-digitalocean",
-    "rev": "v2.55.0",
+    "rev": "v2.57.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -489,13 +489,13 @@
    "vendorHash": "sha256-EiTWJ4bw8IwsRTD9Lt28Up2DXH0oVneO2IaO8VqWtkw="
  },
  "gitea": {
-    "hash": "sha256-pbh3ADR77iVwHQ3e7krSUU+rNfhdA8zYnxLbTdnRfaU=",
+    "hash": "sha256-A9jwUtLNT5ikB5iR5qaRHBiTXsmwvJXycpFxciZSeZg=",
    "homepage": "https://registry.terraform.io/providers/go-gitea/gitea",
    "owner": "go-gitea",
    "repo": "terraform-provider-gitea",
-    "rev": "v0.6.0",
+    "rev": "v0.7.0",
    "spdx": "MIT",
-    "vendorHash": "sha256-d8XoZzo2XS/wAPvdODAfK31qT1c+EoTbWlzzgYPiwq4="
+    "vendorHash": "sha256-/8h2bmesnFz3tav3+iDelZSjp1Z9lreexwcw0WdYekA="
  },
  "github": {
    "hash": "sha256-rmIoyGlkw2f56UwD0mfI5MiHPDFDuhtsoPmerIrJcGs=",
@ -516,11 +516,11 @@
    "vendorHash": "sha256-X0vbtUIKYzCeRD/BbMj3VPVAwx6d7gkbHV8j9JXlaFM="
  },
  "google": {
-    "hash": "sha256-HtPhwWobRBB89embUxtUwUabKmtQkeWtR0QEyb4iBYM=",
+    "hash": "sha256-i3gKrK5EcIQbVwJI7sfRam3H0mideGO1VgPuzL4l+Xw=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google",
    "owner": "hashicorp",
    "repo": "terraform-provider-google",
-    "rev": "v6.39.0",
+    "rev": "v6.40.0",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-YZI6zhxXU2aABARP6GcTMeU98F4+imbL1vKIEMzsJHM="
  },
@ -831,13 +831,13 @@
    "vendorHash": "sha256-ryAkyS70J4yZIsTLSXfeIX+bRsh+8XnOUliMJnMhMrU="
  },
  "minio": {
-    "hash": "sha256-loUcdsr5zFoOXIu0CLYKvutIVLYG0+DsuwPCxAeVMF8=",
+    "hash": "sha256-Eo9lps73bvyJIpRWRCQYz+Ck7IMk4nfK2jismILnaKo=",
    "homepage": "https://registry.terraform.io/providers/aminueza/minio",
    "owner": "aminueza",
    "repo": "terraform-provider-minio",
-    "rev": "v3.5.2",
+    "rev": "v3.5.3",
    "spdx": "AGPL-3.0",
-    "vendorHash": "sha256-7AU79r4OQbmrMI385KVIHon/4pWk6J9qnH+zQRrWtJI="
+    "vendorHash": "sha256-QWBzQXx/dzWZr9dn3LHy8RIvZL1EA9xYqi7Ppzvju7g="
  },
  "mongodbatlas": {
    "hash": "sha256-+JYvL6xGA2zIOg2fl8Bl7CYU4x9N4aVJpIl/6PYdyPU=",
@ -894,13 +894,13 @@
    "vendorHash": "sha256-U8eA/9og4LIedhPSEN9SyInLQuJSzvm0AeFhzC3oqyQ="
  },
  "ns1": {
-    "hash": "sha256-fR64hIM14Bc+7xn7lPfsfZnGew7bd1TAkORwwL6NBsw=",
+    "hash": "sha256-fRF2UsVpIWg0UGPAePEULxAjKi1TioYEeOeSxUuhvIc=",
    "homepage": "https://registry.terraform.io/providers/ns1-terraform/ns1",
    "owner": "ns1-terraform",
    "repo": "terraform-provider-ns1",
-    "rev": "v2.6.4",
+    "rev": "v2.6.5",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-YfbhYhFMdGYQlijaYoAdJFmsjric4Oi4no+sBCq5d6g="
+    "vendorHash": "sha256-9J8RrnF9k503YLmg5rBA8u8SqldhB5AF4+PVtUy8wX8="
  },
  "null": {
    "hash": "sha256-hPAcFWkeK1vjl1Cg/d7FaZpPhyU3pkU6VBIwxX2gEvA=",
@ -1012,11 +1012,11 @@
    "vendorHash": null
  },
  "pagerduty": {
-    "hash": "sha256-nCd2EQgLR1PNPBnWPSpRGxd3zwQ7dJy8fb3tWgGnbRc=",
+    "hash": "sha256-pU6IUnruM2Pi3nbRJpQ5Y8HuqFixRs8DTmTOxToVgWY=",
    "homepage": "https://registry.terraform.io/providers/PagerDuty/pagerduty",
    "owner": "PagerDuty",
    "repo": "terraform-provider-pagerduty",
-    "rev": "v3.26.0",
+    "rev": "v3.26.2",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -1111,11 +1111,11 @@
    "vendorHash": "sha256-xo0alLK3fccbKRG5bN1G7orDsP47I3ySAzpZ9O0f2Fg="
  },
  "rootly": {
-    "hash": "sha256-dnFQVvqvwu2K7Y5NEqwPrGiHKSOKQ4QKW8VSjarbij4=",
+    "hash": "sha256-wJ65YKJnFT1l9DkqtuvA9cwkt06OTCYYu9FolU5UosQ=",
    "homepage": "https://registry.terraform.io/providers/rootlyhq/rootly",
    "owner": "rootlyhq",
    "repo": "terraform-provider-rootly",
-    "rev": "v3.0.0",
+    "rev": "v3.2.0",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-EZbYkyeQdroVJj3a7T7MICU4MSimB+ZqI2Yg9PNUcV0="
  },
@ -1336,13 +1336,13 @@
    "vendorHash": null
  },
  "tfe": {
-    "hash": "sha256-w66HR1X/EUloz3W/6aBNvTsC5vWuAZytd2ej7DHVMU0=",
+    "hash": "sha256-8QYTVM9vxWg4jKlm7bUeeD7NjmkZZRu5KxK/7/+wN50=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/tfe",
    "owner": "hashicorp",
    "repo": "terraform-provider-tfe",
-    "rev": "v0.66.0",
+    "rev": "v0.67.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-z1gbeYR+UFl+sBgehLgBITc9VwxEV6bRpN9A/4Fp7Oc="
+    "vendorHash": "sha256-fw92xhRF60f3QRLBtSvdSwOtXY4QzgJlwb6zgi0OGjw="
  },
  "thunder": {
    "hash": "sha256-2i1DSOSt/vbFs0QCPogEBvADhLJFKbrQzwZ20ChCQMk=",
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@ -9,54 +9,54 @@ let
  versions =
    if stdenv.hostPlatform.isLinux then
      {
-        stable = "0.0.95";
-        ptb = "0.0.146";
-        canary = "0.0.687";
-        development = "0.0.75";
+        stable = "0.0.98";
+        ptb = "0.0.148";
+        canary = "0.0.702";
+        development = "0.0.81";
      }
    else
      {
-        stable = "0.0.347";
-        ptb = "0.0.174";
-        canary = "0.0.793";
-        development = "0.0.88";
+        stable = "0.0.350";
+        ptb = "0.0.179";
+        canary = "0.0.808";
+        development = "0.0.94";
      };
  version = versions.${branch};
  srcs = rec {
    x86_64-linux = {
      stable = fetchurl {
        url = "https://stable.dl2.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-8NpHTG3ojEr8LCRBE/urgH6xdAHLUhqz+A95obB75y4=";
+        hash = "sha256-JT3fIG5zj2tvVPN9hYxCUFInb78fuy8QeWeZClaYou8=";
      };
      ptb = fetchurl {
        url = "https://ptb.dl2.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-bcQsz6hhgtUD2j0MD3rEdFhsGJMQY1+yo19y/lLX+j8=";
+        hash = "sha256-VRhcnjbC42nFZ3DepKNX75pBl0GeDaSWM1SGXJpuQs0=";
      };
      canary = fetchurl {
        url = "https://canary.dl2.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-OaDN+Qklxieo9xlP8qVeCwWzPBe6bLXoFUkMOFCoqPg=";
+        hash = "sha256-OcRGqwf13yPnbDpYOyXZgEQN/zWshUXfaF5geiLetlc=";
      };
      development = fetchurl {
        url = "https://development.dl2.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-        hash = "sha256-wxbmdEzJu66CqJ87cdOKH5fhWKFvD/FBaeJVFxRCvlQ=";
+        hash = "sha256-njkuWtk+359feEYtWJSDukvbD5duXuRIr1m5cJVhNvs=";
      };
    };
    x86_64-darwin = {
      stable = fetchurl {
        url = "https://stable.dl2.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-X9c5ruehxEd8FIdaQigiz7WGnh851BMqdo7Cz1wEb7Q=";
+        hash = "sha256-Giz0bE16v2Q2jULcnZMI1AY8zyjZ03hw4KVpDPJOmCo=";
      };
      ptb = fetchurl {
        url = "https://ptb.dl2.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-/suI1rVJZE1z8wLfiD65p7IdBJsJnz8zX1A2xmMMDnc=";
+        hash = "sha256-tGE7HAcWLpGlv5oXO7NEELdRtNfbhlpQeNc5zB7ba1A=";
      };
      canary = fetchurl {
        url = "https://canary.dl2.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-/5jSp6dQiElzofpV7bRNPyUqRgq3Adzb8r40Nd8+Fn0=";
+        hash = "sha256-Cu7U70yzHgOAJjtEx85T3x9f1oquNz7VNsX53ISbzKg=";
      };
      development = fetchurl {
        url = "https://development.dl2.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-vjpbLg1YIXOSCwnuMwlXo7Sj8B28i812lJ3yV2NLMrE=";
+        hash = "sha256-+bmzdkOSMpKnLGEoeXmAJSv2UHzirOLe1HDHAdHG2U8=";
      };
    };
    aarch64-darwin = x86_64-darwin;
--- a/pkgs/applications/science/astronomy/calcmysky/default.nix
+++ b/pkgs/applications/science/astronomy/calcmysky/default.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "calcmysky";
-  version = "0.3.4";
+  version = "0.3.5";

  src = fetchFromGitHub {
    owner = "10110111";
    repo = "CalcMySky";
    tag = "v${version}";
-    hash = "sha256-r0F70ouRvUGRo7Zc7BOTe9ujRA5FN+1BdFPDtwIPly4=";
+    hash = "sha256-++011c4/IFf/5GKmFostTnxgfEdw3/GJf0e5frscCQ4=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/video/anilibria-winmaclinux/default.nix
+++ b/pkgs/applications/video/anilibria-winmaclinux/default.nix
@ -21,13 +21,13 @@

 mkDerivation rec {
  pname = "anilibria-winmaclinux";
-  version = "2.2.27";
+  version = "2.2.28";

  src = fetchFromGitHub {
    owner = "anilibria";
    repo = "anilibria-winmaclinux";
    rev = version;
-    hash = "sha256-wu4kJCs1Bo6yVGLJuzXSCtv2nXhzlwX6jDTa0gTwPsw=";
+    hash = "sha256-dBeIFmlhxfb7wT3zAK7ALYOqs0dFv2xg+455tCqjyEo=";
  };

  sourceRoot = "${src.name}/src";
--- a/pkgs/applications/video/mpv/scripts/eisa01.nix
+++ b/pkgs/applications/video/mpv/scripts/eisa01.nix
@ -12,13 +12,13 @@ let
    let
      self = {
        inherit pname;
-        version = "0-unstable-2025-05-14";
+        version = "25-09-2023-unstable-2025-06-21";

        src = fetchFromGitHub {
          owner = "Eisa01";
          repo = "mpv-scripts";
-          rev = "100fea81ae8560c6fb113b1f6bb20857a41a5705";
-          hash = "sha256-bMEKsHrJ+mgG7Vqpzj4TAr7Hehq2o2RuneowhrDCd5k=";
+          rev = "b9e63743a858766c9cc7a801d77313b0cecdb049";
+          hash = "sha256-ohUZH6m+5Sk3VKi9qqEgwhgn2DMOFIvvC41pMkV6oPw=";
          # avoid downloading screenshots and videos
          sparseCheckout = [
            "scripts/"
--- a/pkgs/by-name/aw/awsbck/package.nix
+++ b/pkgs/by-name/aw/awsbck/package.nix
@ -6,17 +6,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "awsbck";
-  version = "0.3.13";
+  version = "0.3.15";

  src = fetchFromGitHub {
    owner = "beeb";
    repo = "awsbck";
    rev = "v${version}";
-    hash = "sha256-7ykDkCA6c5MzaMWT+ZjNBhPOZO8UNYIP5sNwoFx1XT8=";
+    hash = "sha256-Sa+CCRfhZyMmbbPggeJ+tXYdrhmDwfiirgLdTEma05M=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-L7iWM5T/FRK+0KQROILg4Mns1+cwPPGKfe0H00FJrSo=";
+  cargoHash = "sha256-kCVMsA2tu8hxoe/JGd+a4Jcok3rM/yb/UWE4xhuPLoo=";

  # tests run in CI on the source repo
  doCheck = false;
--- a/pkgs/by-name/ba/balena-cli/package.nix
+++ b/pkgs/by-name/ba/balena-cli/package.nix
@ -22,16 +22,16 @@ let
 in
 buildNpmPackage' rec {
  pname = "balena-cli";
-  version = "22.1.0";
+  version = "22.1.1";

  src = fetchFromGitHub {
    owner = "balena-io";
    repo = "balena-cli";
    rev = "v${version}";
-    hash = "sha256-qL+hC3ydKJSzceJVbaLy+a2jpXMLsgGC++PEreZDF0k=";
+    hash = "sha256-KEYzYIrcJdpicu4L09UVAU25fC8bWbIYJOuSpCHU3K4=";
  };

-  npmDepsHash = "sha256-bLYKMWiXwvpMhnTHa0RPhzEpvtTFcWnqX8zXDNCY4uk=";
+  npmDepsHash = "sha256-jErFmkOQ3ySdLLXDh0Xl2tcWlfxnL2oob+x7QDuLJ8w=";

  postPatch = ''
    ln -s npm-shrinkwrap.json package-lock.json
--- a/pkgs/by-name/ba/bats/package.nix
+++ b/pkgs/by-name/ba/bats/package.nix
@ -28,13 +28,13 @@

 resholve.mkDerivation rec {
  pname = "bats";
-  version = "1.11.1";
+  version = "1.12.0";

  src = fetchFromGitHub {
    owner = "bats-core";
    repo = "bats-core";
    rev = "v${version}";
-    hash = "sha256-+qmCeLixfLak09XxgSe6ONcH1IoHGl5Au0s9JyNm95g=";
+    hash = "sha256-5VCkOzyaUOBW+HVVHDkH9oCWDI/MJW6yrLTQG60Ralk=";
  };

  patchPhase = ''
--- a/pkgs/by-name/be/berry/package.nix
+++ b/pkgs/by-name/be/berry/package.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "berry";
-  version = "0.1.12";
+  version = "0.1.13";

  src = fetchFromGitHub {
    owner = "JLErvin";
    repo = "berry";
    rev = finalAttrs.version;
-    hash = "sha256-xMJRiLNtwVRQf9HiCF3ClLKEmdDNxcY35IYxe+L7+Hk=";
+    hash = "sha256-BMK5kZVoYTUA7AFZc/IVv4rpbn893b/QYXySuPAz2Z8=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ca/camunda-modeler/package.nix
+++ b/pkgs/by-name/ca/camunda-modeler/package.nix
@ -10,11 +10,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "camunda-modeler";
-  version = "5.36.0";
+  version = "5.36.1";

  src = fetchurl {
    url = "https://github.com/camunda/camunda-modeler/releases/download/v${version}/camunda-modeler-${version}-linux-x64.tar.gz";
-    hash = "sha256-K4N6/OVPeYk1Xd5nkap/ZEIa24PiryPAKCJ8AP00ITw=";
+    hash = "sha256-m/g1QsllShsykCIxnW9szAtZvXd59lnfSmDJX7GEHho=";
  };
  sourceRoot = "camunda-modeler-${version}-linux-x64";

--- a/pkgs/by-name/ch/chirpstack-udp-forwarder/package.nix
+++ b/pkgs/by-name/ch/chirpstack-udp-forwarder/package.nix
@ -9,17 +9,17 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "chirpstack-udp-forwarder";
-  version = "4.1.10";
+  version = "4.2.0";

  src = fetchFromGitHub {
    owner = "chirpstack";
    repo = "chirpstack-udp-forwarder";
    rev = "v${version}";
-    hash = "sha256-71pzD1wF6oNgi2eP/f/buX/vWpZda5DpD2mN1F7n3lk=";
+    hash = "sha256-7xB85IOwOZ6cifw2TFWzNGNMPl8Pc9seqpSJdWdzStM=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-3RrFA/THO9fWfk41nVbFGFv/VeFOcdN2mWgshC5PODw=";
+  cargoHash = "sha256-ECq6Gfn52ZjS48h479XgTQnZHYSjnJK/T9j5NTlcxz4=";

  nativeBuildInputs = [ protobuf ];

--- a/pkgs/by-name/cr/crcpp/package.nix
+++ b/pkgs/by-name/cr/crcpp/package.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "crcpp";
-  version = "1.2.0.0";
+  version = "1.2.1.0";

  src = fetchFromGitHub {
    owner = "d-bahr";
    repo = "CRCpp";
    rev = "release-${version}";
-    sha256 = "sha256-OY8MF8fwr6k+ZSA/p1U+9GnTFoMSnUZxKVez+mda2tA=";
+    sha256 = "sha256-9oAG2MCeSsgA9x1mSU+xiKHUlUuPndIqQJnkrItgsAA=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/dr/drogon/package.nix
+++ b/pkgs/by-name/dr/drogon/package.nix
@ -24,13 +24,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "drogon";
-  version = "1.9.10";
+  version = "1.9.11";

  src = fetchFromGitHub {
    owner = "drogonframework";
    repo = "drogon";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-a6IsJZ6fR0CkR06eDksvwvMCXQk+7tTXIFbE+qmfeZI=";
+    hash = "sha256-eFOYmqfyb/yp83HRa0hWSMuROozR/nfnEp7k5yx8hj0=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/en/enzyme/package.nix
+++ b/pkgs/by-name/en/enzyme/package.nix
@ -7,13 +7,13 @@
 }:
 llvmPackages.stdenv.mkDerivation rec {
  pname = "enzyme";
-  version = "0.0.182";
+  version = "0.0.183";

  src = fetchFromGitHub {
    owner = "EnzymeAD";
    repo = "Enzyme";
    rev = "v${version}";
-    hash = "sha256-OMLRUVLUeft5WpSj16v9DTkD/jUb0u7zH0yXP2oPUI0=";
+    hash = "sha256-fXkDT+4n8gXZ2AD+RBjHJ3tGPnZlUU7p62bdiOumaBY=";
  };

  postPatch = ''
--- a/pkgs/by-name/fi/fittrackee/package.nix
+++ b/pkgs/by-name/fi/fittrackee/package.nix
@ -8,14 +8,14 @@
 }:
 python3Packages.buildPythonApplication rec {
  pname = "fittrackee";
-  version = "0.10.2";
+  version = "0.10.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "SamR1";
    repo = "FitTrackee";
    tag = "v${version}";
-    hash = "sha256-ZCQ4Ft2TSjS62DmGDpQ7gG5Spnf82v82i5nnZtg1UmA=";
+    hash = "sha256-rJ3/JtbzYwsMRk5OZKczr/BDwfDU4NH48JdYWC5/fNk=";
  };

  build-system = [
--- a/pkgs/by-name/fr/freetds/package.nix
+++ b/pkgs/by-name/fr/freetds/package.nix
@ -15,11 +15,11 @@ assert odbcSupport -> unixODBC != null;

 stdenv.mkDerivation rec {
  pname = "freetds";
-  version = "1.5.2";
+  version = "1.5.3";

  src = fetchurl {
    url = "https://www.freetds.org/files/stable/${pname}-${version}.tar.bz2";
-    hash = "sha256-cQCnI77xwIZvChLHCBtBBEeVnIucx1ABlsXF1kBCwFY=";
+    hash = "sha256-XLZsRqYKg7iihV5GYUi2+ieWLH/R3LP25dCrF+xf9t0=";
  };

  buildInputs = [
--- a/pkgs/by-name/gg/gg-jj/package.nix
+++ b/pkgs/by-name/gg/gg-jj/package.nix
@ -17,24 +17,24 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "gg";
-  version = "0.27.0";
+  version = "0.29.0";

  src = fetchFromGitHub {
    owner = "gulbanana";
    repo = "gg";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-vmzALX1x7VfdnwN05bCwbnTL+HfFVyNiKFoT74tFuu8=";
+    hash = "sha256-RFNROdPfJksxK5tOP1LOlV/di8AyeJbxwaIoWaZEaVU=";
  };

  cargoRoot = "src-tauri";

  buildAndTestSubdir = "src-tauri";

-  cargoHash = "sha256-esStQ55+T4uLbHbg7P7hqS6kIpXIMxouRSFkTo6dvAU=";
+  cargoHash = "sha256-AdatJNDqIoRHfaf81iFhOs2JGLIxy7agFJj96bFPj00=";

  npmDeps = fetchNpmDeps {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-yFDGH33maCndH4vgyMfNg0+c5jCOeoIAWUJgAPHXwsM=";
+    hash = "sha256-izCl3pE15ocEGYOYCUR1iTR+82nDB06Ed4YOGRGByfI=";
  };

  nativeBuildInputs =
--- a/pkgs/by-name/go/go-containerregistry/package.nix
+++ b/pkgs/by-name/go/go-containerregistry/package.nix
@ -14,13 +14,13 @@ in

 buildGoModule rec {
  pname = "go-containerregistry";
-  version = "0.20.5";
+  version = "0.20.6";

  src = fetchFromGitHub {
    owner = "google";
    repo = "go-containerregistry";
    rev = "v${version}";
-    sha256 = "sha256-t1OQpXn87OInOmqRx/oFrWkbVmE3nJX/OXH/13cq4CU=";
+    sha256 = "sha256-fmn2SPmYecyKY7HMPjPKvovRS/Ez+SwDe+1maccq4Hc=";
  };
  vendorHash = null;

--- a/pkgs/by-name/go/google-alloydb-auth-proxy/package.nix
+++ b/pkgs/by-name/go/google-alloydb-auth-proxy/package.nix
@ -7,18 +7,18 @@

 buildGoModule rec {
  pname = "google-alloydb-auth-proxy";
-  version = "1.13.2";
+  version = "1.13.3";

  src = fetchFromGitHub {
    owner = "GoogleCloudPlatform";
    repo = "alloydb-auth-proxy";
    tag = "v${version}";
-    hash = "sha256-rM++wipem+CWUbaOxh3BHlNEET7zdUHjPQN8uzZXoGM=";
+    hash = "sha256-NqsIx3+dlDY/WPZJloezZDdFrs/IQ3aqcTKYBD9k3Hk=";
  };

  subPackages = [ "." ];

-  vendorHash = "sha256-/VxLZoJPr0Mb5ZdyiUF7Yb4BgFef19Vj8Fkydcm7XU8=";
+  vendorHash = "sha256-aRnrn9D561OMlfMQiPwTSUyflozU5D/zzApoITiAH7E=";

  checkFlags = [
    "-short"
--- a/pkgs/by-name/go/goose-cli/package.nix
+++ b/pkgs/by-name/go/goose-cli/package.nix
@ -27,17 +27,17 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "goose-cli";
-  version = "1.0.28";
+  version = "1.0.29";

  src = fetchFromGitHub {
    owner = "block";
    repo = "goose";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ExFVgG05jlcz3nP6n94324sgXbIHpj8L30oNuqKyfto=";
+    hash = "sha256-R4hMGW9YKsvWEvSzZKkq5JTzBXGK2rXyOPB6vzMKbs0=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-sW4rWLElTPVzD+KCOrikEFcoIRGujMz+wHOWlYBpi0o=";
+  cargoHash = "sha256-EEivL+6XQyC9FkGnXwOYviwpY8lk7iaEJ1vbQMk2Rao=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/go/gore/package.nix
+++ b/pkgs/by-name/go/gore/package.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "gore";
-  version = "0.6.0";
+  version = "0.6.1";

  src = fetchFromGitHub {
    owner = "motemen";
    repo = "gore";
    rev = "v${version}";
-    sha256 = "sha256-7mhfegSSRE9FnKz+tWYMEtEKc+hayPQE8EEOEu33CjU=";
+    sha256 = "sha256-EPySMj+mQxTJbGheAtzKvQq23DLljPR6COrmytu1x/Q=";
  };

-  vendorHash = "sha256-0eCRDlcqZf+RAbs8oBRr+cd7ncWX6fXk/9jd8/GnAiw=";
+  vendorHash = "sha256-W9hMxANySY31X2USbs4o5HssxQfK/ihJ+vCQ/PTyTDc=";

  doCheck = false;

--- a/pkgs/by-name/go/gotenberg/package.nix
+++ b/pkgs/by-name/go/gotenberg/package.nix
@ -24,21 +24,19 @@ let
 in
 buildGoModule rec {
  pname = "gotenberg";
-  version = "8.16.0";
+  version = "8.20.1";

  src = fetchFromGitHub {
    owner = "gotenberg";
    repo = "gotenberg";
    tag = "v${version}";
-    hash = "sha256-m8aDhfcUa3QFr+7hzlQFL2wPfcx5RE+3dl5RHzWwau0=";
+    hash = "sha256-3+6bdO6rFSyRtRQjXBPefwjuX0AMuGzHNAQas7HNNRE=";
  };

-  vendorHash = "sha256-EM+Rpo4Zf+aqA56aFeuQ0tbvpTgZhmfv+B7qYI6PXWc=";
+  vendorHash = "sha256-qZ4cgVZAmjIwXhtQ7DlAZAZxyXP89ZWafsSUPQE0dxE=";

  postPatch = ''
    find ./pkg -name '*_test.go' -exec sed -i -e 's#/tests#${src}#g' {} \;
-    substituteInPlace pkg/gotenberg/fs_test.go \
-      --replace-fail "/tmp" "/build"
  '';

  nativeBuildInputs = [ makeBinaryWrapper ];
--- a/pkgs/by-name/gr/gramps/package.nix
+++ b/pkgs/by-name/gr/gramps/package.nix
@ -23,7 +23,7 @@
 }:

 python3Packages.buildPythonApplication rec {
-  version = "6.0.2";
+  version = "6.0.3";
  pname = "gramps";
  pyproject = true;

@ -31,7 +31,7 @@ python3Packages.buildPythonApplication rec {
    owner = "gramps-project";
    repo = "gramps";
    tag = "v${version}";
-    hash = "sha256-ivOa45NNw6h+QxPvN+2fOoQOU6t+HYslR4t9vA+xTic=";
+    hash = "sha256-dmokrAN6ZC7guMYHifNifL9rXqZPW+Z5LudQhIUxMs8=";
  };

  patches = [
--- a/pkgs/by-name/ha/hamrs-pro/package.nix
+++ b/pkgs/by-name/ha/hamrs-pro/package.nix
@ -8,29 +8,29 @@

 let
  pname = "hamrs-pro";
-  version = "2.39.0";
+  version = "2.40.0";

  throwSystem = throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}";

  srcs = {
    x86_64-linux = fetchurl {
      url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-linux-x86_64.AppImage";
-      hash = "sha256-cLjsJlSfwmpzB7Ef/oSMbrRr4PEklpnOHouiAs/X0Gg=";
+      hash = "sha256-DUqaF8DQu+iSpC6nnHT7l7kurN/L9yAhKOF47khkoDw=";
    };

    aarch64-linux = fetchurl {
      url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-linux-arm64.AppImage";
-      hash = "sha256-MisWOfSpeh48W9/3+lZVYzDoU2ZvGb8sMmLE1qfStSo=";
+      hash = "sha256-YloMNPvtprJzQ5/w0I9n7DtQLqyuzgVnQ60Yf6ueOjk=";
    };

    x86_64-darwin = fetchurl {
      url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-mac-x64.dmg";
-      hash = "sha256-lThk5DRva93/IxfCfr3f3VKUCaLnrAH7L/I1BBc0whE=";
+      hash = "sha256-wgCXf6vTWZtlRjZCJYb5xYuWk7bpqiCDxVCTWR2ASxc=";
    };

    aarch64-darwin = fetchurl {
      url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-mac-arm64.dmg";
-      hash = "sha256-xZqC0enG/b7LSE8OzhVWPR1Rz50gjaAWDxT6UFdO3Wc=";
+      hash = "sha256-WOWIjeQtOGwpa/vR8n/irzU491C5sb0VUKn1vBckpvs=";
    };
  };

--- a/pkgs/by-name/he/helm-ls/package.nix
+++ b/pkgs/by-name/he/helm-ls/package.nix
@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "helm-ls";
-  version = "0.4.0";
+  version = "0.4.1";

  src = fetchFromGitHub {
    owner = "mrjosh";
    repo = "helm-ls";
    rev = "v${version}";
-    hash = "sha256-yiPHIr1jzzk4WFjGJjeroHJWY8zP3ArrJVzb4+dPm7I=";
+    hash = "sha256-z+gSD7kcDxgJPoYQ7HjokJONjgAAuIIkg1VGyV3v01k=";
  };

  vendorHash = "sha256-w/BWPbpSYum0SU8PJj76XiLUjTWO4zNQY+khuLRK0O8=";
--- a/pkgs/by-name/ho/hoppscotch/package.nix
+++ b/pkgs/by-name/ho/hoppscotch/package.nix
@ -8,22 +8,22 @@

 let
  pname = "hoppscotch";
-  version = "25.5.1-0";
+  version = "25.5.3-0";

  src =
    fetchurl
      {
        aarch64-darwin = {
          url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_mac_aarch64.dmg";
-          hash = "sha256-03WSc4/udaShc9te7Xv09gCgMv9i2/WvK55mpj4AK5k=";
+          hash = "sha256-EhwTQ52xUCLSApV2vNo4AqnAznaDaSWDt339pmwJvYU=";
        };
        x86_64-darwin = {
          url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_mac_x64.dmg";
-          hash = "sha256-1D/ZW+KxbmJtt62uQOdZZwiKk+6r1hhviwe7CZxaXns=";
+          hash = "sha256-A0Ss6JLcHaH5p7TQ67TVAAre+nt82hxVgZZgFvoBWzA=";
        };
        x86_64-linux = {
          url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_linux_x64.AppImage";
-          hash = "sha256-REj9VtAggS6PcGSh3K+GByxhUk6elKoHsSck42U9IdA=";
+          hash = "sha256-r+gi/vVkVY0QIqunnrDOk6k+Fa/6UOMMGxYdnj4SnIA=";
        };
      }
      .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
--- a/pkgs/by-name/hy/hyprpanel/package.nix
+++ b/pkgs/by-name/hy/hyprpanel/package.nix
@ -0,0 +1,127 @@
+{
+  lib,
+  config,
+  ags,
+  astal,
+  bluez,
+  bluez-tools,
+  brightnessctl,
+  btop,
+  dart-sass,
+  fetchFromGitHub,
+  glib,
+  glib-networking,
+  gnome-bluetooth,
+  gpu-screen-recorder,
+  gpustat,
+  grimblast,
+  gtksourceview3,
+  gvfs,
+  hyprpicker,
+  libgtop,
+  libnotify,
+  libsoup_3,
+  matugen,
+  networkmanager,
+  nix-update-script,
+  python3,
+  pywal,
+  stdenv,
+  swww,
+  upower,
+  wireplumber,
+  wl-clipboard,
+  writeShellScript,
+
+  enableCuda ? config.cudaSupport,
+}:
+ags.bundle {
+  pname = "hyprpanel";
+  version = "0-unstable-2025-06-20";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "Jas-SinghFSU";
+    repo = "HyprPanel";
+    rev = "d563cdb1f6499d981901336bd0f86303ab95c4a5";
+    hash = "sha256-oREAoOQeAExqWMkw2r3BJfiaflh7QwHFkp8Qm0qDu6o=";
+  };
+
+  # keep in sync with https://github.com/Jas-SinghFSU/HyprPanel/blob/master/flake.nix#L42
+  dependencies = [
+    astal.apps
+    astal.battery
+    astal.bluetooth
+    astal.cava
+    astal.hyprland
+    astal.mpris
+    astal.network
+    astal.notifd
+    astal.powerprofiles
+    astal.tray
+    astal.wireplumber
+
+    bluez
+    bluez-tools
+    brightnessctl
+    btop
+    dart-sass
+    glib
+    gnome-bluetooth
+    grimblast
+    gtksourceview3
+    gvfs
+    hyprpicker
+    libgtop
+    libnotify
+    libsoup_3
+    matugen
+    networkmanager
+    pywal
+    swww
+    upower
+    wireplumber
+    wl-clipboard
+    (python3.withPackages (
+      ps:
+      with ps;
+      [
+        dbus-python
+        pygobject3
+      ]
+      ++ lib.optional enableCuda gpustat
+    ))
+  ] ++ (lib.optionals (stdenv.hostPlatform.system == "x86_64-linux") [ gpu-screen-recorder ]);
+
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+
+  postFixup =
+    let
+      script = writeShellScript "hyprpanel" ''
+        export GIO_EXTRA_MODULES='${glib-networking}/lib/gio/modules'
+        if [ "$#" -eq 0 ]; then
+          exec @out@/bin/.hyprpanel
+        else
+          exec ${astal.io}/bin/astal -i hyprpanel "$*"
+        fi
+      '';
+    in
+    # bash
+    ''
+      mv "$out/bin/hyprpanel" "$out/bin/.hyprpanel"
+      cp '${script}' "$out/bin/hyprpanel"
+      substituteInPlace "$out/bin/hyprpanel" \
+        --replace-fail '@out@' "$out"
+    '';
+
+  meta = {
+    description = "Bar/Panel for Hyprland with extensive customizability";
+    homepage = "https://github.com/Jas-SinghFSU/HyprPanel";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ perchun ];
+    mainProgram = "hyprpanel";
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/by-name/in/intentrace/package.nix
+++ b/pkgs/by-name/in/intentrace/package.nix
@ -5,7 +5,7 @@
 }:

 let
-  version = "0.10.3";
+  version = "0.10.4";
 in
 rustPlatform.buildRustPackage {
  inherit version;
@ -15,11 +15,11 @@ rustPlatform.buildRustPackage {
    owner = "sectordistrict";
    repo = "intentrace";
    tag = "v${version}";
-    hash = "sha256-mCMARX6y9thgYJpDRFnWGZJupdk+EhVaBGbwABYYjNA=";
+    hash = "sha256-zVRH6uLdBXI6VTu/R3pTNCjfx25089bYYTJZdvZIFck=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-BZ+P6UT9bBuAX9zyZCA+fI2pUtV8b98oPcQDwJV5HC8=";
+  cargoHash = "sha256-1n0fXOPVktqY/H/fPCgl0rA9xZM8QRXvZQgTadfwymo=";

  meta = {
    description = "Prettified Linux syscall tracing tool (like strace)";
--- a/pkgs/by-name/io/ioq3-scion/package.nix
+++ b/pkgs/by-name/io/ioq3-scion/package.nix
@ -7,7 +7,7 @@
 }:
 ioquake3.overrideAttrs (old: {
  pname = "ioq3-scion";
-  version = "unstable-2024-03-03";
+  version = "unstable-2024-12-14";
  buildInputs = old.buildInputs ++ [
    pan-bindings
    libsodium
@ -15,8 +15,8 @@ ioquake3.overrideAttrs (old: {
  src = fetchFromGitHub {
    owner = "lschulz";
    repo = "ioq3-scion";
-    rev = "9f06abd5030c51cd4582ba3d24ba87531e3eadbc";
-    hash = "sha256-+zoSlNT+oqozQFnhA26PiMo1NnzJJY/r4tcm2wOCBP0=";
+    rev = "a21c257b9ad1d897f6c31883511c3f422317aa0a";
+    hash = "sha256-CBy3Av/mkFojXr0tAXPRWKwLeQJPebazXQ4wzKEmx0I=";
  };
  meta = {
    description = "ioquake3 with support for path aware networking";
--- a/pkgs/by-name/is/istioctl/package.nix
+++ b/pkgs/by-name/is/istioctl/package.nix
@ -7,15 +7,15 @@

 buildGoModule rec {
  pname = "istioctl";
-  version = "1.26.1";
+  version = "1.26.2";

  src = fetchFromGitHub {
    owner = "istio";
    repo = "istio";
    rev = version;
-    hash = "sha256-+sLObdWGl4wTLzqA4EImRDB6R6Ted9hEJKs0CPYkFxA=";
+    hash = "sha256-6wKcDVlLRyr5EuVUFtPPC2Z3+J/6tgXp+ER14wq4eec=";
  };
-  vendorHash = "sha256-K3fUJexe/mTViRX5UEhJM5sPQ/J5fWjMIJUovpaUV+w=";
+  vendorHash = "sha256-BOqlu5OLtcOcT82TmZvo5hCcVdcI6ZRvcKn5ULQXOc4=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/jf/jfrog-cli/package.nix
+++ b/pkgs/by-name/jf/jfrog-cli/package.nix
@ -8,17 +8,17 @@

 buildGoModule rec {
  pname = "jfrog-cli";
-  version = "2.76.1";
+  version = "2.77.0";

  src = fetchFromGitHub {
    owner = "jfrog";
    repo = "jfrog-cli";
    tag = "v${version}";
-    hash = "sha256-d8TL6sJIXooMnQ2UMonNcsZ68VrnlfzcM0BhxwOaVa0=";
+    hash = "sha256-CUmx2hQppay8S+zBs4XEXle8pF5mVXPyCJhtYyZ1N8M=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-Bz2xlx1AlCR8xY8KO2cVguyUsoQiQO60XAs5T6S9Ays=";
+  vendorHash = "sha256-TmOzexlojVF+9WqbEVzKFfbdgjGVzyBgeKjFEX5UobI=";

  checkFlags = "-skip=^TestReleaseBundle";

--- a/pkgs/by-name/jq/jq-lsp/package.nix
+++ b/pkgs/by-name/jq/jq-lsp/package.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "jq-lsp";
-  version = "0.1.12";
+  version = "0.1.13";

  src = fetchFromGitHub {
    owner = "wader";
    repo = "jq-lsp";
    tag = "v${version}";
-    hash = "sha256-rq6AZsRwCWCIqLH78mOAA2tWa66ys78hRCxnNSXxegc=";
+    hash = "sha256-Oa9MuE6nUaxAlKeFnx4qjPldDfmLrbBraFkUsp5K5gY=";
  };

  vendorHash = "sha256-8sZGnoP7l09ZzLJqq8TUCquTOPF0qiwZcFhojUnnEIY=";
--- a/pkgs/by-name/kd/kdlfmt/package.nix
+++ b/pkgs/by-name/kd/kdlfmt/package.nix
@ -2,28 +2,50 @@
  lib,
  rustPlatform,
  fetchFromGitHub,
+  stdenv,
+  installShellFiles,
+  versionCheckHook,
+  nix-update-script,
 }:

-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
  pname = "kdlfmt";
-  version = "0.1.0";
+  version = "0.1.2";

  src = fetchFromGitHub {
    owner = "hougesen";
    repo = "kdlfmt";
-    rev = "v${version}";
-    hash = "sha256-qc2wU/borl3h2fop6Sav0zCrg8WdvHrB3uMA72uwPis=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-xDv93cxCEaBybexleyTtcCCKHy2OL3z/BG2gJ7uqIrU=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-xoOnFJqDucg3fUDx5XbXsZT4rSjZhzt5rNbH+DZ1kGA=";
+  cargoHash = "sha256-TwZ/0G3lTCoj01e/qGFRxJCfe4spOpG/55GKhoI0img=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd kdlfmt \
+      --bash <($out/bin/kdlfmt completions bash) \
+      --fish <($out/bin/kdlfmt completions fish) \
+      --zsh <($out/bin/kdlfmt completions zsh)
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };

  meta = {
    description = "Formatter for kdl documents";
-    homepage = "https://github.com/hougesen/kdlfmt.git";
-    changelog = "https://github.com/hougesen/kdlfmt/blob/v${version}/CHANGELOG.md";
+    homepage = "https://github.com/hougesen/kdlfmt";
+    changelog = "https://github.com/hougesen/kdlfmt/blob/v${finalAttrs.version}/CHANGELOG.md";
    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ airrnot ];
+    maintainers = with lib.maintainers; [
+      airrnot
+      defelo
+    ];
    mainProgram = "kdlfmt";
  };
-}
+})
--- a/pkgs/by-name/ko/kor/package.nix
+++ b/pkgs/by-name/ko/kor/package.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "kor";
-  version = "0.6.1";
+  version = "0.6.2";

  src = fetchFromGitHub {
    owner = "yonahd";
    repo = "kor";
    rev = "v${version}";
-    hash = "sha256-jqP2GsqliltjabbHDcRseMz7TOWl9YofAG/4Y7ADub8=";
+    hash = "sha256-/UeZBFLSAR6hnXGQyOV6Y7O7PaG7tXelyqS6SeFN+3M=";
  };

-  vendorHash = "sha256-HZS1PPlra1uGBuerGs5X9poRzn7EGhTopKaC9tkhjlo=";
+  vendorHash = "sha256-VJ5Idm5p+8li5T7h0ueLIYwXKJqe6uUZ3dL5U61BPFg=";

  preCheck = ''
    HOME=$(mktemp -d)
--- a/pkgs/by-name/kr/krillinai/package.nix
+++ b/pkgs/by-name/kr/krillinai/package.nix
@ -11,16 +11,16 @@

 buildGoModule (finalAttrs: {
  pname = "krillinai";
-  version = "1.2.1-hotfix-2";
+  version = "1.2.2";

  src = fetchFromGitHub {
    owner = "krillinai";
    repo = "KrillinAI";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Dw30Lsf4pHMDlrLmdoU+4v5SJfzx5UId6v/OocrsiS4=";
+    hash = "sha256-RHlQeTFeG23LjLwczSGIghH3XPFTR6ZVDFk2KlRQGoA=";
  };

-  vendorHash = "sha256-14YNdIfylUpcWqHhrpgmjxBHYRXaoR59jb1QdTckuLY=";
+  vendorHash = "sha256-PN0ntMoPG24j3DrwuIiYHo71QmSU7u/A9iZ5OruIV/w=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/by-name/ku/kubeseal/package.nix
+++ b/pkgs/by-name/ku/kubeseal/package.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "kubeseal";
-  version = "0.29.0";
+  version = "0.30.0";

  src = fetchFromGitHub {
    owner = "bitnami-labs";
    repo = "sealed-secrets";
    rev = "v${version}";
-    sha256 = "sha256-unPqjheT8/2gVQAwvzOvHtG4qTqggf9o0M5iLwl1eh4=";
+    sha256 = "sha256-lcRrLzM+/F5PRcLbrUjAjoOp35TRlte00QuWjKk1PrY=";
  };

-  vendorHash = "sha256-4BseFdfJjR8Th+NJ82dYsz9Dym1hzDa4kB4bpy71q7Q=";
+  vendorHash = "sha256-JpPfj8xZ1jmawazQ9LmkuxC5L2xIdLp4E43TpD+p71o=";

  subPackages = [ "cmd/kubeseal" ];

--- a/pkgs/by-name/le/leetgo/package.nix
+++ b/pkgs/by-name/le/leetgo/package.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "leetgo";
-  version = "1.4.13";
+  version = "1.4.14";

  src = fetchFromGitHub {
    owner = "j178";
    repo = "leetgo";
    rev = "v${version}";
-    hash = "sha256-KEfRsaBsMCKO66HW71gNzHzZkun1yo6a05YqAvafomM=";
+    hash = "sha256-RRKQlCGVE8/RS1jPZBmzDXrv0dTW1zKR5mugByfIzsU=";
  };

-  vendorHash = "sha256-pdGsvwEppmcsWyXxkcDut0F2Ak1nO42Hnd36tnysE9w=";
+  vendorHash = "sha256-VNJe+F/lbW+9fX6Fie91LLSs5H4Rn+kmHhsMd5mbYtA=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/li/libcava/package.nix
+++ b/pkgs/by-name/li/libcava/package.nix
@ -8,13 +8,13 @@
 cava.overrideAttrs (old: rec {
  pname = "libcava";
  # fork may not be updated when we update upstream
-  version = "0.10.3";
+  version = "0.10.4";

  src = fetchFromGitHub {
    owner = "LukashonakV";
    repo = "cava";
    tag = version;
-    hash = "sha256-ZDFbI69ECsUTjbhlw2kHRufZbQMu+FQSMmncCJ5pagg=";
+    hash = "sha256-9eTDqM+O1tA/3bEfd1apm8LbEcR9CVgELTIspSVPMKM=";
  };

  nativeBuildInputs = old.nativeBuildInputs ++ [
--- a/pkgs/by-name/ma/maa-assistant-arknights/pin.json
+++ b/pkgs/by-name/ma/maa-assistant-arknights/pin.json
@ -1,10 +1,10 @@
 {
  "stable": {
-    "version": "5.16.10",
-    "hash": "sha256-H3RW2SikKCYhmDsoID5Kye9qq6lAbuu8tedzCHuybis="
+    "version": "5.18.1",
+    "hash": "sha256-B4klaET6YT955p606aSky5tePGhpinRCqc3gMB+uaZY="
  },
  "beta": {
-    "version": "5.17.0-beta.1",
-    "hash": "sha256-qBfy7M5jqf4aPT5kcdzLm6HFZKn8KfYeZVaZvfY9rAg="
+    "version": "5.18.1",
+    "hash": "sha256-B4klaET6YT955p606aSky5tePGhpinRCqc3gMB+uaZY="
  }
 }
--- a/pkgs/by-name/mx/mxt-app/package.nix
+++ b/pkgs/by-name/mx/mxt-app/package.nix
@ -7,14 +7,14 @@
 }:

 stdenv.mkDerivation rec {
-  version = "1.44";
+  version = "1.45";
  pname = "mxt-app";

  src = fetchFromGitHub {
    owner = "atmel-maxtouch";
    repo = "mxt-app";
    rev = "v${version}";
-    sha256 = "sha256-JE8rI1dkbrPXCbJI9cK/w5ugndPj6rO0hpyfwiSqmLc=";
+    sha256 = "sha256-kMVNakIzqGvT2+7plNsiqPdQ+0zuS7gh+YywF0hA1H4=";
  };

  nativeBuildInputs = [ autoreconfHook ];
--- a/pkgs/by-name/na/namespace-cli/package.nix
+++ b/pkgs/by-name/na/namespace-cli/package.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "namespace-cli";
-  version = "0.0.421";
+  version = "0.0.425";

  src = fetchFromGitHub {
    owner = "namespacelabs";
    repo = "foundation";
    rev = "v${version}";
-    hash = "sha256-4Gsj4BlPCjSRY/b6UeSaTwTFw9xFTvK1u08cIwPjPaY=";
+    hash = "sha256-HO6aSZg6M0OE5OLzKOIJLtDEz9Ow16xlw+dQfsFm/Qs=";
  };

-  vendorHash = "sha256-hPZmNH4bhIds+Ps0pQCjYPfvVBaX8e3Bq/onq91Fzq8=";
+  vendorHash = "sha256-Xmd8OTW/1MfRWItcx/a13BV993aVWnsvkcTwr/ROS4w=";

  subPackages = [
    "cmd/nsc"
--- a/pkgs/by-name/nb/nb/package.nix
+++ b/pkgs/by-name/nb/nb/package.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "nb";
-  version = "7.20.0";
+  version = "7.20.1";

  src = fetchFromGitHub {
    owner = "xwmx";
    repo = "nb";
    rev = version;
-    hash = "sha256-lK7jAECLAL/VX3K7AZEwxkQCRRn2ggRNBAeNPv5x35I=";
+    hash = "sha256-926M5Tg1XWZR++neCou/uy1RtLeIbqHdA1vHaJv/e9o=";
  };

  nativeBuildInputs = [ installShellFiles ];
--- a/pkgs/by-name/ne/nextcloud-whiteboard-server/package.nix
+++ b/pkgs/by-name/ne/nextcloud-whiteboard-server/package.nix
@ -8,16 +8,16 @@
 }:
 buildNpmPackage rec {
  pname = "nextcloud-whiteboard-server";
-  version = "1.0.5";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "nextcloud";
    repo = "whiteboard";
    tag = "v${version}";
-    hash = "sha256-WdaAMSID8MekVL6nA8YRWUiiI+pi1WgC0nN3dDAJHf8=";
+    hash = "sha256-zqJL/eeTl1cekLlJess2IH8piEZpn2ubTB2NRsj8OjQ=";
  };

-  npmDepsHash = "sha256-T27oZdvITj9ZCEvd13fDZE3CS35XezgVmQ4iCeN75UA=";
+  npmDepsHash = "sha256-GdoVwBU/uSk1g+7R2kg8tExAXagdVelaj6xii+NRf/w=";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/init.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/init.py
@ -5,7 +5,6 @@ import os
 import sys
 from pathlib import Path
 from subprocess import CalledProcessError, run
-from textwrap import dedent
 from typing import Final, assert_never

 from . import nix, tmpdir
@ -338,29 +337,6 @@ def validate_image_variant(image_variant: str, variants: ImageVariants) -> None:
        )


-def validate_nixos_config(path_to_config: Path) -> None:
-    if not (path_to_config / "nixos-version").exists() and not os.environ.get(
-        "NIXOS_REBUILD_I_UNDERSTAND_THE_CONSEQUENCES_PLEASE_BREAK_MY_SYSTEM"
-    ):
-        msg = dedent(
-            # the lowercase for the first letter below is proposital
-            f"""
-                your NixOS configuration path seems to be missing essential files.
-                To avoid corrupting your current NixOS installation, the activation will abort.
-
-                This could be caused by Nix bug: https://github.com/NixOS/nix/issues/13367.
-                This is the evaluated NixOS configuration path: {path_to_config}.
-                Change the directory to somewhere else (e.g., `cd $HOME`) before trying again.
-
-                If you think this is a mistake, you can set the environment variable
-                NIXOS_REBUILD_I_UNDERSTAND_THE_CONSEQUENCES_PLEASE_BREAK_MY_SYSTEM to 1
-                and re-run the command to continue.
-                Please open an issue if this is the case.
-            """
-        ).strip()
-        raise NixOSRebuildError(msg)
-
-
 def execute(argv: list[str]) -> None:
    args, args_groups = parse_args(argv)

@ -514,7 +490,6 @@ def execute(argv: list[str]) -> None:
                    copy_flags=copy_flags,
                )
                if action in (Action.SWITCH, Action.BOOT):
-                    validate_nixos_config(path_to_config)
                    nix.set_profile(
                        profile,
                        path_to_config,
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@ -9,6 +9,7 @@ from importlib.resources import files
 from pathlib import Path
 from string import Template
 from subprocess import PIPE, CalledProcessError
+from textwrap import dedent
 from typing import Final, Literal

 from . import tmpdir
@ -613,6 +614,33 @@ def set_profile(
    sudo: bool,
 ) -> None:
    "Set a path as the current active Nix profile."
+    if not os.environ.get(
+        "NIXOS_REBUILD_I_UNDERSTAND_THE_CONSEQUENCES_PLEASE_BREAK_MY_SYSTEM"
+    ):
+        r = run_wrapper(
+            ["test", "-f", path_to_config / "nixos-version"],
+            remote=target_host,
+            check=False,
+        )
+        if r.returncode:
+            msg = dedent(
+                # the lowercase for the first letter below is proposital
+                f"""
+                    your NixOS configuration path seems to be missing essential files.
+                    To avoid corrupting your current NixOS installation, the activation will abort.
+
+                    This could be caused by Nix bug: https://github.com/NixOS/nix/issues/13367.
+                    This is the evaluated NixOS configuration path: {path_to_config}.
+                    Change the directory to somewhere else (e.g., `cd $HOME`) before trying again.
+
+                    If you think this is a mistake, you can set the environment variable
+                    NIXOS_REBUILD_I_UNDERSTAND_THE_CONSEQUENCES_PLEASE_BREAK_MY_SYSTEM to 1
+                    and re-run the command to continue.
+                    Please open an issue if this is the case.
+                """
+            ).strip()
+            raise NixOSRebuildError(msg)
+
    run_wrapper(
        ["nix-env", "-p", profile.path, "--set", path_to_config],
        remote=target_host,
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@ -674,6 +674,8 @@ def test_rollback_temporary_profile(tmp_path: Path) -> None:
 def test_set_profile(mock_run: Mock) -> None:
    profile_path = Path("/path/to/profile")
    config_path = Path("/path/to/config")
+    mock_run.return_value = CompletedProcess([], 0)
+
    n.set_profile(
        m.Profile("system", profile_path),
        config_path,
@ -687,6 +689,19 @@ def test_set_profile(mock_run: Mock) -> None:
        sudo=False,
    )

+    mock_run.return_value = CompletedProcess([], 1)
+
+    with pytest.raises(m.NixOSRebuildError) as e:
+        n.set_profile(
+            m.Profile("system", profile_path),
+            config_path,
+            target_host=None,
+            sudo=False,
+        )
+    assert str(e.value).startswith(
+        "error: your NixOS configuration path seems to be missing essential files."
+    )
+

@patch(get_qualified_name(n.run_wrapper, n), autospec=True)
 def test_switch_to_configuration_without_systemd_run(
--- a/pkgs/by-name/op/openhue-cli/package.nix
+++ b/pkgs/by-name/op/openhue-cli/package.nix
@ -0,0 +1,61 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "openhue-cli";
+  version = "0.18";
+
+  src = fetchFromGitHub {
+    owner = "openhue";
+    repo = "openhue-cli";
+    tag = finalAttrs.version;
+    hash = "sha256-LSaHE3gdjpNea6o+D/JGvHtwvG13LbHv2pDcZhlIoEE=";
+    leaveDotGit = true;
+    postFetch = ''
+      cd "$out"
+      git rev-parse HEAD > $out/COMMIT
+      find "$out" -name .git -print0 | xargs -0 rm -rf
+    '';
+  };
+
+  vendorHash = "sha256-lqIzmtFtkfrJSrpic79Is0yGpnLUysPQLn2lp/Mh+u4=";
+
+  env.CGO_ENABLED = 0;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${finalAttrs.version}"
+  ];
+
+  preBuild = ''
+    ldflags+=" -X main.commit=$(cat COMMIT)"
+  '';
+
+  postInstall = ''
+    mv $out/bin/openhue-cli $out/bin/openhue
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+  versionCheckProgram = "${placeholder "out"}/bin/openhue";
+  versionCheckProgramArg = "version";
+  versionCheckKeepEnvironment = [ "HOME" ];
+
+  meta = {
+    changelog = "https://github.com/openhue/openhue-cli/releases/tag/${finalAttrs.version}";
+    description = "CLI for interacting with Philips Hue smart lighting systems";
+    homepage = "https://github.com/openhue/openhue-cli";
+    mainProgram = "openhue";
+    maintainers = with lib.maintainers; [ madeddie ];
+    license = lib.licenses.asl20;
+  };
+})
--- a/pkgs/by-name/op/openlist/frontend.nix
+++ b/pkgs/by-name/op/openlist/frontend.nix
@ -0,0 +1,62 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  fetchzip,
+
+  nodejs,
+  pnpm_10,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "openlist-frontend";
+  version = "4.0.1";
+
+  src = fetchFromGitHub {
+    owner = "OpenListTeam";
+    repo = "OpenList-Frontend";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-WflnK/DXg2kmTcOD97jiZP8kb/cEdW7SrVnNQLrWKjA=";
+  };
+
+  i18n = fetchzip {
+    url = "https://github.com/OpenListTeam/OpenList-Frontend/releases/download/v${finalAttrs.version}/i18n.tar.gz";
+    hash = "sha256-zms4x4C1CW39o/8uVm5gbasKCJQx6Oh3h66BHF1vnWY=";
+    stripRoot = false;
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    pnpm_10.configHook
+  ];
+
+  pnpmDeps = pnpm_10.fetchDeps {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-PTZ+Vhg3hNnORnulkzuVg6TF/jY0PvUWYja9z7S4GdM=";
+  };
+
+  buildPhase = ''
+    runHook preBuild
+
+    cp -r ${finalAttrs.i18n}/* src/lang/
+    pnpm build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    cp -r dist $out
+    echo -n "v${finalAttrs.version}" > $out/VERSION
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Frontend of OpenList";
+    homepage = "https://github.com/OpenListTeam/OpenList-Frontend";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ moraxyc ];
+  };
+})
--- a/pkgs/by-name/op/openlist/package.nix
+++ b/pkgs/by-name/op/openlist/package.nix
@ -0,0 +1,103 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  callPackage,
+  buildPackages,
+  installShellFiles,
+  versionCheckHook,
+  fuse,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "openlist";
+  version = "4.0.1";
+
+  src = fetchFromGitHub {
+    owner = "OpenListTeam";
+    repo = "OpenList";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-PqCGA2DAfZvDqdnQzqlmz2vlybYokJe+Ybzp5BcJDGU=";
+    # populate values that require us to use git. By doing this in postFetch we
+    # can delete .git afterwards and maintain better reproducibility of the src.
+    leaveDotGit = true;
+    postFetch = ''
+      cd "$out"
+      git rev-parse HEAD > $out/COMMIT
+      # '0000-00-00T00:00:00Z'
+      date -u -d "@$(git log -1 --pretty=%ct)" "+%Y-%m-%dT%H:%M:%SZ" > $out/SOURCE_DATE_EPOCH
+      find "$out" -name .git -print0 | xargs -0 rm -rf
+    '';
+  };
+
+  frontend = callPackage ./frontend.nix { };
+
+  proxyVendor = true;
+  vendorHash = "sha256-e1glgNp5aYl1cEuLdMMLa8sE9lSuiLVdPCX9pek5grE=";
+
+  buildInputs = [ fuse ];
+
+  tags = [ "jsoniter" ];
+
+  ldflags = [
+    "-s"
+    "-X \"github.com/OpenListTeam/OpenList/internal/conf.GitAuthor=The OpenList Projects Contributors <noreply@openlist.team>\""
+    "-X github.com/OpenListTeam/OpenList/internal/conf.Version=${finalAttrs.version}"
+    "-X github.com/OpenListTeam/OpenList/internal/conf.WebVersion=${finalAttrs.frontend.version}"
+  ];
+
+  preConfigure = ''
+    rm -rf public/dist
+    cp -r ${finalAttrs.frontend} public/dist
+  '';
+
+  preBuild = ''
+    ldflags+=" -X \"github.com/OpenListTeam/OpenList/internal/conf.BuiltAt=$(<SOURCE_DATE_EPOCH)\""
+    ldflags+=" -X github.com/OpenListTeam/OpenList/internal/conf.GitCommit=$(<COMMIT)"
+  '';
+
+  checkFlags =
+    let
+      # Skip tests that require network access
+      skippedTests = [
+        "TestHTTPAll"
+        "TestWebsocketAll"
+        "TestWebsocketCaller"
+        "TestDownloadOrder"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) (
+    let
+      emulator = stdenv.hostPlatform.emulator buildPackages;
+    in
+    ''
+      installShellCompletion --cmd OpenList \
+        --bash <(${emulator} $out/bin/OpenList completion bash) \
+        --fish <(${emulator} $out/bin/OpenList completion fish) \
+        --zsh <(${emulator} $out/bin/OpenList completion zsh)
+
+      mkdir $out/share/powershell/ -p
+      ${emulator} $out/bin/OpenList completion powershell > $out/share/powershell/OpenList.Completion.ps1
+    ''
+  );
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/OpenList";
+  versionCheckProgramArg = "version";
+
+  passthru.updateScript = lib.getExe (callPackage ./update.nix { });
+
+  meta = {
+    description = "AList Fork to Anti Trust Crisis";
+    homepage = "https://github.com/OpenListTeam/OpenList";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ moraxyc ];
+    mainProgram = "OpenList";
+  };
+})
--- a/pkgs/by-name/op/openlist/update.nix
+++ b/pkgs/by-name/op/openlist/update.nix
@ -0,0 +1,47 @@
+{
+  writeShellApplication,
+  nix,
+  nix-update,
+  curl,
+  common-updater-scripts,
+  jq,
+}:
+
+writeShellApplication {
+  name = "update-openlist";
+  runtimeInputs = [
+    curl
+    jq
+    nix
+    common-updater-scripts
+    nix-update
+  ];
+
+  text = ''
+    # get old info
+    oldVersion=$(nix-instantiate --eval --strict -A "openlist.version" | jq -e -r)
+
+    get_latest_release() {
+        local repo=$1
+        curl --fail ''${GITHUB_TOKEN:+ -H "Authorization: bearer $GITHUB_TOKEN"} \
+             -s "https://api.github.com/repos/OpenListTeam/$repo/releases/latest" | jq -r ".tag_name"
+    }
+
+    version=$(get_latest_release "OpenList")
+    version="''${version#v}"
+    frontendVersion=$(get_latest_release "OpenList-Frontend")
+    frontendVersion="''${frontendVersion#v}"
+
+    if [[ "$oldVersion" == "$version" ]]; then
+        echo "Already up to date!"
+        exit 0
+    fi
+
+    nix-update openlist.frontend --version="$frontendVersion"
+    update-source-version openlist.frontend "$frontendVersion" \
+      --source-key=i18n --ignore-same-version \
+      --file=pkgs/by-name/op/openlist/frontend.nix
+
+    nix-update openlist --version="$version"
+  '';
+}
--- a/pkgs/by-name/ot/otel-desktop-viewer/package.nix
+++ b/pkgs/by-name/ot/otel-desktop-viewer/package.nix
@ -2,49 +2,60 @@
  lib,
  buildGoModule,
  fetchFromGitHub,
-  testers,
-  otel-desktop-viewer,
+  fetchpatch,
  stdenv,
-  apple-sdk_12,
+  apple-sdk,
+  versionCheckHook,
+  nix-update-script,
+  ...
 }:

-buildGoModule rec {
+buildGoModule (finalAttrs: {
  pname = "otel-desktop-viewer";
-  version = "0.1.4";
+  version = "0.2.2";

  src = fetchFromGitHub {
    owner = "CtrlSpice";
    repo = "otel-desktop-viewer";
-    rev = "v${version}";
-    hash = "sha256-kMgcco4X7X9WoCCH8iZz5qGr/1dWPSeQOpruTSUnonI=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-qvMpebhbg/OnheZIZBoiitGYUUMdTghSwEapblE0DkA=";
  };

-  # https://github.com/CtrlSpice/otel-desktop-viewer/issues/139
-  patches = [ ./version-0.1.4.patch ];
-
-  subPackages = [ "..." ];
-
-  vendorHash = "sha256-pH16DCYeW8mdnkkRi0zqioovZu9slVc3gAdhMYu2y98=";
+  # NOTE: This project uses Go workspaces, but 'buildGoModule' does not support
+  # them at the time of writing; trying to build with 'env.GOWORK = "off"'
+  # fails with the following error message:
+  #
+  #     main module (github.com/CtrlSpice/otel-desktop-viewer) does not contain package github.com/CtrlSpice/otel-desktop-viewer/desktopexporter
+  #
+  # cf. https://github.com/NixOS/nixpkgs/issues/203039
+  proxyVendor = true;
+  vendorHash = "sha256-1TH9JQDnvhi+b3LDCAooMKgYhPudM7NCNCc+WXtcv/4=";

  ldflags = [
    "-s"
    "-w"
+    "-X main.version=${finalAttrs.version}"
  ];

-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin apple-sdk_12;
+  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk ];

-  passthru.tests.version = testers.testVersion {
-    inherit version;
-    package = otel-desktop-viewer;
-    command = "otel-desktop-viewer --version";
-  };
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+  versionCheckProgram = "${placeholder "out"}/bin/${finalAttrs.meta.mainProgram}";
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = nix-update-script { };

  meta = {
-    changelog = "https://github.com/CtrlSpice/otel-desktop-viewer/releases/tag/v${version}";
+    changelog = "https://github.com/CtrlSpice/otel-desktop-viewer/releases/tag/v${finalAttrs.version}";
    description = "Receive & visualize OpenTelemtry traces locally within one CLI tool";
    homepage = "https://github.com/CtrlSpice/otel-desktop-viewer";
    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ gaelreyrol ];
+    maintainers = with lib.maintainers; [
+      gaelreyrol
+      jkachmar
+      lf-
+    ];
    mainProgram = "otel-desktop-viewer";
  };
-}
+})
--- a/pkgs/by-name/pa/pan-bindings/package.nix
+++ b/pkgs/by-name/pa/pan-bindings/package.nix
@ -9,19 +9,19 @@
 }:

 let
-  version = "unstable-2024-03-03";
+  version = "unstable-2025-06-15";
  src = fetchFromGitHub {
    owner = "lschulz";
    repo = "pan-bindings";
-    rev = "4361d30f1c5145a70651c259f2d56369725b0d15";
-    hash = "sha256-0WxrgXTCM+BwGcjjWBBKiZawje2yxB5RRac6Sk5t3qc=";
+    rev = "708d7f36a0a32816b2b0d8e2e5a4d79f2144f406";
+    hash = "sha256-wGHa8NV8M+9dHvn8UqejderyA1UgYQUcTOKocRFhg6U=";
  };
  goDeps = (
    buildGoModule {
      name = "pan-bindings-goDeps";
      inherit src version;
      modRoot = "go";
-      vendorHash = "sha256-7EitdEJTRtiM29qmVnZUM6w68vCBI8mxZhCA7SnAxLA=";
+      vendorHash = "sha256-3MybV76pHDnKgN2ENRgsyAvynXQctv0fJcRGzesmlww=";
    }
  );
 in
--- a/pkgs/by-name/pi/pigment/package.nix
+++ b/pkgs/by-name/pi/pigment/package.nix
@ -0,0 +1,69 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  ninja,
+  meson,
+  pkg-config,
+  wrapGAppsHook4,
+  glib,
+  desktop-file-utils,
+  appstream-glib,
+  gobject-introspection,
+  gtk4,
+  libadwaita,
+  nix-update-script,
+}:
+let
+  version = "0.5.0";
+in
+python3Packages.buildPythonApplication {
+  pname = "pigment";
+  inherit version;
+  pyproject = false;
+
+  src = fetchFromGitHub {
+    owner = "Jeffser";
+    repo = "Pigment";
+    tag = version;
+    hash = "sha256-VwqCv2IPxPKT/6PDk8sosAIZlyu8zl5HDQEaIRWlJKg=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook4
+    glib
+    desktop-file-utils
+    appstream-glib
+    gobject-introspection
+  ];
+
+  pythonPath = with python3Packages; [
+    pygobject3
+    colorthief
+    pydbus
+  ];
+
+  buildInputs = [
+    gtk4
+    libadwaita
+  ];
+
+  dontWrapGApps = true;
+  makeWrapperArgs = [ "\${gappsWrapperArgs[@]}" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Extract color palettes from your images";
+    homepage = "https://jeffser.com/pigment/";
+    downloadPage = "https://github.com/Jeffser/Pigment";
+    changelog = "https://github.com/Jeffser/Pigment/releases/tag/v${version}";
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "pigment";
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.awwpotato ];
+  };
+}
--- a/pkgs/by-name/pr/presage/fixed-cppunit-detection.patch
+++ b/pkgs/by-name/pr/presage/fixed-cppunit-detection.patch
@ -1,46 +0,0 @@
-From 5624aa156c551ab2b81bb86279844397ed690653 Mon Sep 17 00:00:00 2001
-From: Matteo Vescovi <matteo.vescovi@yahoo.co.uk>
-Date: Sun, 21 Jan 2018 17:17:12 +0000
-Subject: [PATCH] Fixed cppunit detection.
-
---
- configure.ac | 16 +++++++++++-----
- 1 file changed, 11 insertions(+), 5 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index a02e9f1..1538a51 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -204,10 +204,16 @@ AM_CONDITIONAL([USE_SQLITE], [test "x$use_sqlite" = "xyes"])
- dnl ==================
- dnl Checks for CppUnit
- dnl ==================
-AM_PATH_CPPUNIT([1.9.6],
-                [],
-                [AC_MSG_WARN([CppUnit not found. Unit tests will not be built. CppUnit can be obtained from http://cppunit.sourceforge.net.])])
-AM_CONDITIONAL([HAVE_CPPUNIT], [test "$CPPUNIT_LIBS"])
-+PKG_CHECK_MODULES([CPPUNIT],
-+                  [cppunit >= 1.9],
-+                  [have_cppunit=yes],
-+                  [AM_PATH_CPPUNIT([1.9],
-+                                   [have_cppunit=yes],
-+                                   [AC_MSG_WARN([CppUnit not found. Unit tests will not be built. CppUnit can be obtained from http://cppunit.sourceforge.net.])])
-+                  ])
-+AC_SUBST([CPPUNIT_CFLAGS])
-+AC_SUBST([CPPUNIT_LIBS])
-+AM_CONDITIONAL([HAVE_CPPUNIT], [test "x$have_cppunit" = "xyes"])
- 
- 
- dnl ============================
-@@ -592,7 +598,7 @@ then
- else
-     build_demo_application="no"
- fi
-if test "$CPPUNIT_LIBS"
-+if test "x$have_cppunit" = "xyes"
- then
-     build_unit_tests="yes"
- else
-- 
-2.31.1
-
--- a/pkgs/by-name/pr/presage/package.nix
+++ b/pkgs/by-name/pr/presage/package.nix
@ -1,77 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  fetchpatch,
-  autoreconfHook,
-  dbus,
-  doxygen,
-  fontconfig,
-  gettext,
-  graphviz,
-  help2man,
-  pkg-config,
-  sqlite,
-  tinyxml,
-  cppunit,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "presage";
-  version = "0.9.1";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/presage/presage/${version}/presage-${version}.tar.gz";
-    sha256 = "0rm3b3zaf6bd7hia0lr1wyvi1rrvxkn7hg05r5r1saj0a3ingmay";
-  };
-
-  patches = [
-    (fetchpatch {
-      name = "gcc6.patch";
-      url = "https://git.alpinelinux.org/aports/plain/community/presage/gcc6.patch?id=40e2044c9ecb36eacb3a1fd043f09548d210dc01";
-      sha256 = "0243nx1ygggmsly7057vndb4pkjxg9rpay5gyqqrq9jjzjzh63dj";
-    })
-    ./fixed-cppunit-detection.patch
-    # fix gcc11 build
-    (fetchpatch {
-      name = "presage-0.9.1-gcc11.patch";
-      url = "https://build.opensuse.org/public/source/openSUSE:Factory/presage/presage-0.9.1-gcc11.patch?rev=3f8b4b19c99276296d6ea595cc6c431f";
-      sha256 = "sha256-pLrIFXvJHRvv4x9gBIfal4Y68lByDE3XE2NZNiAXe9k=";
-    })
-  ];
-
-  nativeBuildInputs = [
-    autoreconfHook
-    doxygen
-    fontconfig
-    gettext
-    graphviz
-    help2man
-    pkg-config
-  ];
-
-  preBuild = ''
-    export FONTCONFIG_FILE=${fontconfig.out}/etc/fonts/fonts.conf
-  '';
-
-  buildInputs = [
-    dbus
-    sqlite
-    tinyxml
-  ];
-
-  nativeCheckInputs = [
-    cppunit
-  ];
-
-  doCheck = true;
-
-  checkTarget = "check";
-
-  meta = with lib; {
-    description = "Intelligent predictive text entry system";
-    homepage = "https://presage.sourceforge.io/";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ dotlambda ];
-  };
-}
--- a/pkgs/by-name/pr/pretix/package.nix
+++ b/pkgs/by-name/pr/pretix/package.nix
@ -259,6 +259,11 @@ python.pkgs.buildPythonApplication rec {
    "test_same_day_spanish"
    "test_same_month_spanish"
    "test_same_year_spanish"
+
+    # broken with fakeredis>=2.27.0
+    "test_waitinglist_cache_separation"
+    "test_waitinglist_item_active"
+    "test_waitinglist_variation_active"
  ];

  preCheck = ''
--- a/pkgs/by-name/qd/qdirstat/package.nix
+++ b/pkgs/by-name/qd/qdirstat/package.nix
@ -8,6 +8,7 @@
  bash,
  makeWrapper,
  perlPackages,
+  util-linux,
 }:

 stdenv.mkDerivation rec {
@ -32,26 +33,21 @@ stdenv.mkDerivation rec {

  postPatch = ''
    substituteInPlace scripts/scripts.pro \
-      --replace /bin/true ${coreutils}/bin/true
-
-    for i in src/SysUtil.cpp src/FileSizeStatsWindow.cpp
-    do
-      substituteInPlace $i \
-        --replace /usr/bin/xdg-open ${xdg-utils}/bin/xdg-open
-    done
-    for i in src/Cleanup.cpp src/cleanup-config-page.ui
-    do
-      substituteInPlace $i \
-        --replace /bin/bash ${bash}/bin/bash \
-        --replace /bin/sh ${bash}/bin/sh
-    done
+      --replace-fail /bin/true ${coreutils}/bin/true
+    substituteInPlace src/SysUtil.cpp src/FileSizeStatsWindow.cpp \
+      --replace-fail /usr/bin/xdg-open ${xdg-utils}/bin/xdg-open
+    substituteInPlace src/Cleanup.cpp src/cleanup-config-page.ui \
+      --replace-fail /bin/bash ${bash}/bin/bash \
+      --replace-fail /bin/sh ${bash}/bin/sh
+    substituteInPlace src/MountPoints.cpp \
+      --replace-fail /bin/lsblk ${util-linux}/bin/lsblk
    substituteInPlace src/StdCleanup.cpp \
-      --replace /bin/bash ${bash}/bin/bash
+      --replace-fail /bin/bash ${bash}/bin/bash
  '';

  qmakeFlags = [ "INSTALL_PREFIX=${placeholder "out"}" ];

-  postInstall = ''
+  postFixup = ''
    wrapProgram $out/bin/qdirstat-cache-writer \
      --set PERL5LIB "${perlPackages.makePerlPath [ perlPackages.URI ]}"
  '';
--- a/pkgs/by-name/re/renode-dts2repl/package.nix
+++ b/pkgs/by-name/re/renode-dts2repl/package.nix
@ -7,14 +7,14 @@

 python3.pkgs.buildPythonApplication {
  pname = "renode-dts2repl";
-  version = "0-unstable-2025-06-09";
+  version = "0-unstable-2025-06-16";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "antmicro";
    repo = "dts2repl";
-    rev = "f7419099a1678a1de3e20324b67c5e2baff24be6";
-    hash = "sha256-RG/3UZkuivou+jedyfqcORr0y6DY5EUnPwC6IPPC+aU=";
+    rev = "65232f0be8d171650e050690ade02c50755241c4";
+    hash = "sha256-v/RzEXRie3O37DVVY7bX09rnXMLH7L99o8sWPOPnDOw=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/se/seafile-server/package.nix
+++ b/pkgs/by-name/se/seafile-server/package.nix
@ -39,8 +39,7 @@ let
 in
 stdenv.mkDerivation {
  pname = "seafile-server";
-  version = "11.0.12";
-
+  version = "11.0.12"; # Doc links match Seafile 11.0 in seafile.nix – update if version changes.
  src = fetchFromGitHub {
    owner = "haiwen";
    repo = "seafile-server";
--- a/pkgs/by-name/se/sesh/package.nix
+++ b/pkgs/by-name/se/sesh/package.nix
@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
  pname = "sesh";
-  version = "2.15.0";
+  version = "2.16.0";

  src = fetchFromGitHub {
    owner = "joshmedeski";
    repo = "sesh";
    rev = "v${version}";
-    hash = "sha256-D//yt8DVy7DMX38qfmVa5UbGIgjzsGXQoscrhcgPzh4=";
+    hash = "sha256-3kD7t3lgkxrK53cL+5i9DB5w1hIYA4J/MiauLZ1Z7KQ=";
  };

  vendorHash = "sha256-r6n0xZbOvqDU63d3WrXenvV4x81iRgpOS2h73xSlVBI=";
--- a/pkgs/by-name/si/simpleDBus/package.nix
+++ b/pkgs/by-name/si/simpleDBus/package.nix
@ -10,13 +10,13 @@
 stdenv.mkDerivation (finalAttrs: {
  pname = "simpleDBus";

-  version = "0.10.1";
+  version = "0.10.2";

  src = fetchFromGitHub {
    owner = "OpenBluetoothToolbox";
    repo = "SimpleBLE";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-SFQs0f36xW0PibK1P1rTCWOA7pp3kY6659xLOBeZt6A=";
+    hash = "sha256-Qi78o3WJ28Gp1OsCyFHhd/7F4/jWLzGjPRwT5qSqqtM=";
  };

  outputs = [
--- a/pkgs/by-name/sl/slumber/package.nix
+++ b/pkgs/by-name/sl/slumber/package.nix
@ -6,17 +6,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "slumber";
-  version = "3.1.3";
+  version = "3.2.0";

  src = fetchFromGitHub {
    owner = "LucasPickering";
    repo = "slumber";
    tag = "v${version}";
-    hash = "sha256-HSC0G0Ll8geBwd4eBhk5demL2likhMZqlkYGcbzNOck=";
+    hash = "sha256-FR+XHgL/DfVFeEbAT1h1nwBnJkG7jnHfd+JRLVTY0LE=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-5i4lfW21QJzVReUGdgeymI1tBX367qBu8yveVFtgORI=";
+  cargoHash = "sha256-qRqdNCeVb7dD91q6gEK1c5rQ8LhcwJ5hwn1TfSPseO4=";

  meta = {
    description = "Terminal-based HTTP/REST client";
--- a/pkgs/by-name/sn/snyk/package.nix
+++ b/pkgs/by-name/sn/snyk/package.nix
@ -8,7 +8,7 @@
 }:

 let
-  version = "1.1297.1";
+  version = "1.1297.2";
 in
 buildNpmPackage {
  pname = "snyk";
@ -18,7 +18,7 @@ buildNpmPackage {
    owner = "snyk";
    repo = "cli";
    tag = "v${version}";
-    hash = "sha256-/wA6bBjgz3KhTBw/JJpLM5UkRNHehVdm6ubpq92N4IY=";
+    hash = "sha256-guDCwLvl5cYzeZJbwOQvzCuBtXo3PNrvOimS2GmQwaY=";
  };

  npmDepsHash = "sha256-SzrBhY7iWGlIPNB+5ROdaxAlQSetSKc3MPBp+4nNh+o=";
--- a/pkgs/by-name/su/subfinder/package.nix
+++ b/pkgs/by-name/su/subfinder/package.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "subfinder";
-  version = "2.7.1";
+  version = "2.8.0";

  src = fetchFromGitHub {
    owner = "projectdiscovery";
    repo = "subfinder";
    tag = "v${version}";
-    hash = "sha256-pbrW95CrRRQok6MfA0ujjLiXTr1VFUswc/gK9WhU6qI=";
+    hash = "sha256-HfQz0tLBKt16IrtxOT3lX28FcVG05X1hICw5Xq/dQJw=";
  };

-  vendorHash = "sha256-v+AyeQoeTTPI7C1WysCu8adX6cBk06JudPigCIWNFGQ=";
+  vendorHash = "sha256-3bHIrjA5Bbl6prF+ttEs+N2Sa4AMZDtRk3ysoIitsdY=";

  modRoot = "./v2";

--- a/pkgs/by-name/tc/tcld/package.nix
+++ b/pkgs/by-name/tc/tcld/package.nix
@ -4,25 +4,46 @@
  lib,
  stdenvNoCC,
  installShellFiles,
+  versionCheckHook,
  nix-update-script,
  ...
 }:

 buildGoModule (finalAttrs: {
  pname = "tcld";
-  version = "0.40.0";
+  version = "0.41.0";
  src = fetchFromGitHub {
    owner = "temporalio";
    repo = "tcld";
    rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-bIJSvop1T3yiLs/LTgFxIMmObfkVfvvnONyY4Bsjj8g=";
+    hash = "sha256-Jnm6l9Jj1mi9esDS6teKTEMhq7V1QD/dTl3qFhKsW4o=";
+    # Populate values from the git repository; by doing this in 'postFetch' we
+    # can delete '.git' afterwards and the 'src' should stay reproducible.
+    leaveDotGit = true;
+    postFetch = ''
+      cd "$out"
+      # Replicate 'COMMIT' and 'DATE' variables from upstream's Makefile.
+      git rev-parse --short=12 HEAD > $out/COMMIT
+      git log -1 --format=%cd --date=iso-strict > $out/SOURCE_DATE_EPOCH
+      find "$out" -name .git -exec rm -rf '{}' '+'
+    '';
  };
+
  vendorHash = "sha256-GOko8nboj7eN4W84dqP3yLD6jK7GA0bANV0Tj+1GpgY=";
-  ldFlags = [
+
+  subPackages = [ "cmd/tcld" ];
+  ldflags = [
    "-s"
    "-w"
+    "-X=github.com/temporalio/tcld/app.version=${finalAttrs.version}"
  ];

+  # ldflags based on metadata from git.
+  preBuild = ''
+    ldflags+=" -X=github.com/temporalio/tcld/app.date=$(cat SOURCE_DATE_EPOCH)"
+    ldflags+=" -X=github.com/temporalio/tcld/app.commit=$(cat COMMIT)"
+  '';
+
  # FIXME: Remove after https://github.com/temporalio/tcld/pull/447 lands.
  patches = [ ./compgen.patch ];

@ -36,12 +57,19 @@ buildGoModule (finalAttrs: {
    installShellCompletion --cmd tcld --zsh ${./zsh_autocomplete}
  '';

+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+  versionCheckProgram = "${placeholder "out"}/bin/${finalAttrs.meta.mainProgram}";
+  versionCheckProgramArg = "version";
+
  passthru.updateScript = nix-update-script { };

  meta = {
    description = "Temporal cloud cli";
    homepage = "https://www.github.com/temporalio/tcld";
+    changelog = "https://github.com/temporalio/tcld/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.mit;
    teams = [ lib.teams.mercury ];
+    mainProgram = "tcld";
  };
 })
--- a/pkgs/by-name/te/termius/package.nix
+++ b/pkgs/by-name/te/termius/package.nix
@ -16,8 +16,8 @@

 stdenv.mkDerivation rec {
  pname = "termius";
-  version = "9.21.2";
-  revision = "227";
+  version = "9.22.1";
+  revision = "229";

  src = fetchurl {
    # find the latest version with
@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
    # and the sha512 with
    # curl -H 'X-Ubuntu-Series: 16' https://api.snapcraft.io/api/v1/snaps/details/termius-app | jq '.download_sha512' -r
    url = "https://api.snapcraft.io/api/v1/snaps/download/WkTBXwoX81rBe3s3OTt3EiiLKBx2QhuS_${revision}.snap";
-    hash = "sha512-xiTxJJa9OpwNZW3x6TbmY+8lE/61417OLfOWdK9UMbUyqOtbhD3pSVq9M/uG13gvUndOkEoM2bbci/gKG+J0xw==";
+    hash = "sha512-RT/vtrtwxFWcZL2x87rHdj9AdvxNP6rAQj2pLL2DvzyDOLyp5eFo9uoTvrrHPlCLz6wevJj7moTmQig68uCmpQ==";
  };

  desktopItem = makeDesktopItem {
--- a/pkgs/by-name/ti/tigerbeetle/package.nix
+++ b/pkgs/by-name/ti/tigerbeetle/package.nix
@ -10,14 +10,14 @@ let
  platform =
    if stdenvNoCC.hostPlatform.isDarwin then "universal-macos" else stdenvNoCC.hostPlatform.system;
  hash = builtins.getAttr platform {
-    "universal-macos" = "sha256-47glX5O8MALXv8JFrbIGaj6LKJyRuZcR8yapwKmzWbc=";
-    "x86_64-linux" = "sha256-5HIxbswZV94Tem8LUVtGcx8cb00J5qGLBsNZR077Bm4=";
-    "aarch64-linux" = "sha256-wXiSL3hJ6yulrGagb5TflJSWujAQqpUGZtz+GJWcy0M=";
+    "universal-macos" = "sha256-muEoLk6pL0hobpdzalXs/SjlB+eRJgbt7rPHbgs0IZo=";
+    "x86_64-linux" = "sha256-TP7pqXZceqboMuQGkO2/yyPH4K2YWEpNIzREKQDY2is=";
+    "aarch64-linux" = "sha256-GGbCJVqBud+Fh1aasEEupmRF3B/sYntBkC8B5mGxnWI=";
  };
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "tigerbeetle";
-  version = "0.16.44";
+  version = "0.16.45";

  src = fetchzip {
    url = "https://github.com/tigerbeetle/tigerbeetle/releases/download/${finalAttrs.version}/tigerbeetle-${platform}.zip";
--- a/pkgs/by-name/ti/tinymist/package.nix
+++ b/pkgs/by-name/ti/tinymist/package.nix
@ -15,17 +15,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
  pname = "tinymist";
  # Please update the corresponding vscode extension when updating
  # this derivation.
-  version = "0.13.12";
+  version = "0.13.14";

  src = fetchFromGitHub {
    owner = "Myriad-Dreamin";
    repo = "tinymist";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-5uokMl+ZgDKVoxnQ/her/Aq6c69Gv0ngZuTDH0jcyoE=";
+    hash = "sha256-CTZhMbXLL13ybKFC34LArE/OXGfrAnXKXM79DP8ct60=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-GJJXTVm7hLmMaRJnpmslrpKNHnyhgo/6ZWXU//xl1Vc=";
+  cargoHash = "sha256-aD50+awwVds9zwW5hM0Hgxv8NGV7J63BOSpU9907O+k=";

  nativeBuildInputs = [
    installShellFiles
@ -37,6 +37,7 @@ rustPlatform.buildRustPackage (finalAttrs: {

    # Require internet access
    "--skip=docs::package::tests::cetz"
+    "--skip=docs::package::tests::fletcher"
    "--skip=docs::package::tests::tidy"
    "--skip=docs::package::tests::touying"

--- a/pkgs/by-name/ur/url-parser/package.nix
+++ b/pkgs/by-name/ur/url-parser/package.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "url-parser";
-  version = "2.1.6";
+  version = "2.1.7";

  src = fetchFromGitHub {
    owner = "thegeeklab";
    repo = "url-parser";
    tag = "v${version}";
-    hash = "sha256-pmsF2wYEjJ8//sUvkW0psj4ULOjwp8s3hzxVKXCM0Ok=";
+    hash = "sha256-EJ1FVFv0MF9BoOtY6+JKgTeu3RBBlUWB79C6+Geb0cY=";
  };

-  vendorHash = "sha256-873EOiS57LKZDehtDZyc3ACEXhUFOtIX6v+D2LUarwE=";
+  vendorHash = "sha256-GhBSVbzZ3UqFroLimi5VbTVO6DhEMVAd6iyhGwO6HK0=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/v2/v2rayn/deps.json
+++ b/pkgs/by-name/v2/v2rayn/deps.json
@ -11,13 +11,13 @@
  },
  {
    "pname": "Avalonia",
-    "version": "11.3.0",
-    "hash": "sha256-Hot4dWkrP5x+JzaP2/7E1QOOiXfPGhkvK1nzBacHvzg="
+    "version": "11.3.1",
+    "hash": "sha256-732wl4/JmvYFS26NLvPD7T/V3J3JZUDy6Xwj5p1TNyE="
  },
  {
    "pname": "Avalonia.Angle.Windows.Natives",
-    "version": "2.1.22045.20230930",
-    "hash": "sha256-RxPcWUT3b/+R3Tu5E5ftpr5ppCLZrhm+OTsi0SwW3pc="
+    "version": "2.1.25547.20250602",
+    "hash": "sha256-LE/lENAHptmz6t3T/AoJwnhpda+xs7PqriNGzdcfg8M="
  },
  {
    "pname": "Avalonia.BuildServices",
@ -31,38 +31,38 @@
  },
  {
    "pname": "Avalonia.Controls.ColorPicker",
-    "version": "11.3.0",
-    "hash": "sha256-ee3iLrn8OdWH6Mg01p93wYMMCPXS25VM/uZeQWEr+k0="
+    "version": "11.3.1",
+    "hash": "sha256-95sAkALievpuwLtCl7+6PgwNyxx9DAi/vVvQUFT7Qqs="
  },
  {
    "pname": "Avalonia.Controls.DataGrid",
-    "version": "11.3.0",
-    "hash": "sha256-McFggedX7zb9b0FytFeuh+3nPdFqoKm2JMl2VZDs/BQ="
+    "version": "11.3.1",
+    "hash": "sha256-UcfsSNYCd9zO75hyLevVe59/esHgNmcjJOproy3nhNM="
  },
  {
    "pname": "Avalonia.Desktop",
-    "version": "11.3.0",
-    "hash": "sha256-XZXmsKrYCOEWzFUbnwNKvEz5OCD/1lAPi+wM4BiMB7I="
+    "version": "11.3.1",
+    "hash": "sha256-H6SLCi3by9bFF1YR12PnNZSmtC44UQPKr+5+8LvqC90="
  },
  {
    "pname": "Avalonia.Diagnostics",
-    "version": "11.3.0",
-    "hash": "sha256-jO8Fs9kfNGsoZ87zQCxPdn0tyWHcEdgBRIpzkZ0ceM0="
+    "version": "11.3.1",
+    "hash": "sha256-zDX3BfqUFUQ+p1ZWdHuhnV0n5B9RfiEtB8m0Px5AhsI="
  },
  {
    "pname": "Avalonia.FreeDesktop",
-    "version": "11.3.0",
-    "hash": "sha256-nWIW3aDPI/00/k52BNU4n43sS3ymuw+e97EBSsjjtU4="
+    "version": "11.3.1",
+    "hash": "sha256-Iph1SQazNNr9liox0LR7ITidAEEWhp8Mg9Zn4MZVkRQ="
  },
  {
    "pname": "Avalonia.Native",
-    "version": "11.3.0",
-    "hash": "sha256-l6gcCeGd422mLQgVLp2sxh4/+vZxOPoMrxyfjGyhYLs="
+    "version": "11.3.1",
+    "hash": "sha256-jNzqmHm58bbPGs/ogp6gFvinbN81Psg+sg+Z5UsbcDs="
  },
  {
    "pname": "Avalonia.ReactiveUI",
-    "version": "11.3.0",
-    "hash": "sha256-yY/xpe4Te6DLa1HZCWZgIGpdKeZqvknRtpkpBTrZhmU="
+    "version": "11.3.1",
+    "hash": "sha256-m7AFSxwvfz9LAueu0AFC+C7jHrB+lysBmpBh7bhpmUs="
  },
  {
    "pname": "Avalonia.Remote.Protocol",
@ -76,33 +76,33 @@
  },
  {
    "pname": "Avalonia.Remote.Protocol",
-    "version": "11.3.0",
-    "hash": "sha256-7ytabxzTbPLR3vBCCb7Z6dYRZZVvqiDpvxweOYAqi7I="
+    "version": "11.3.1",
+    "hash": "sha256-evkhJOxKjsR+jNLrXRcrhqjFdlrxYMMMRBJ6FK08vMM="
  },
  {
    "pname": "Avalonia.Skia",
-    "version": "11.3.0",
-    "hash": "sha256-p+mWsyrYsC9PPhNjOxPZwarGuwmIjxaQ4Ml/2XiEuEc="
+    "version": "11.3.1",
+    "hash": "sha256-zN09CcuSqtLcQrTCQOoPJrhLd4LioZqt/Qi4sDp/cJI="
  },
  {
    "pname": "Avalonia.Themes.Simple",
-    "version": "11.3.0",
-    "hash": "sha256-F2DMHskmrJw/KqpYLHGEEuQMVP8T4fXgq5q3tfwFqG0="
+    "version": "11.3.1",
+    "hash": "sha256-U9btigJeFcuOu7T3ryyJJesffnZo1JBb9pWkF0PFu9s="
  },
  {
    "pname": "Avalonia.Win32",
-    "version": "11.3.0",
-    "hash": "sha256-Ltf6EuL6aIG+YSqOqD/ecdqUDsuwhNuh+XilIn7pmlE="
+    "version": "11.3.1",
+    "hash": "sha256-w3+8luJByeIchiVQ0wsq0olDabX/DndigyBEuK8Ty04="
  },
  {
    "pname": "Avalonia.X11",
-    "version": "11.3.0",
-    "hash": "sha256-QOprHb0HjsggEMWOW7/U8pqlD8M4m97FeTMWlriYHaU="
+    "version": "11.3.1",
+    "hash": "sha256-0iUFrDM+10T3OiOeGSEiqQ6EzEucQL3shZUNqOiqkyQ="
  },
  {
    "pname": "CliWrap",
-    "version": "3.8.2",
-    "hash": "sha256-sZQqu03sJL0LlnLssXVXHTen9marNbC/G15mAKjhFJU="
+    "version": "3.9.0",
+    "hash": "sha256-WC1bX8uy+8VZkrV6eK8nJ24Uy81Bj4Aao27OsP1sGyE="
  },
  {
    "pname": "DialogHost.Avalonia",
@ -116,8 +116,8 @@
  },
  {
    "pname": "DynamicData",
-    "version": "9.1.2",
-    "hash": "sha256-rDbtd7Fw/rhq6s9G4p/rltZ3EIR5r1RcMXsAEe7nZjw="
+    "version": "9.3.2",
+    "hash": "sha256-00fzA28aU48l52TsrDSJ9ucljYOunmH7s2qPyR3YjRA="
  },
  {
    "pname": "Fody",
@ -126,28 +126,28 @@
  },
  {
    "pname": "HarfBuzzSharp",
-    "version": "7.3.0.3",
-    "hash": "sha256-1vDIcG1aVwVABOfzV09eAAbZLFJqibip9LaIx5k+JxM="
+    "version": "8.3.1.1",
+    "hash": "sha256-614yv6bK9ynhdUnvW4wIkgpBe2sqTh28U9cDZzdhPc0="
  },
  {
    "pname": "HarfBuzzSharp.NativeAssets.Linux",
-    "version": "7.3.0.3",
-    "hash": "sha256-HW5r16wdlgDMbE/IfE5AQGDVFJ6TS6oipldfMztx+LM="
+    "version": "8.3.1.1",
+    "hash": "sha256-sBbez6fc9axVcsBbIHbpQh/MM5NHlMJgSu6FyuZzVyU="
  },
  {
    "pname": "HarfBuzzSharp.NativeAssets.macOS",
-    "version": "7.3.0.3",
-    "hash": "sha256-UpAVfRIYY8Wh8xD4wFjrXHiJcvlBLuc2Xdm15RwQ76w="
+    "version": "8.3.1.1",
+    "hash": "sha256-hK20KbX2OpewIO5qG5gWw5Ih6GoLcIDgFOqCJIjXR/Q="
  },
  {
    "pname": "HarfBuzzSharp.NativeAssets.WebAssembly",
-    "version": "7.3.0.3",
-    "hash": "sha256-jHrU70rOADAcsVfVfozU33t/5B5Tk0CurRTf4fVQe3I="
+    "version": "8.3.1.1",
+    "hash": "sha256-mLKoLqI47ZHXqTMLwP1UCm7faDptUfQukNvdq6w/xxw="
  },
  {
    "pname": "HarfBuzzSharp.NativeAssets.Win32",
-    "version": "7.3.0.3",
-    "hash": "sha256-v/PeEfleJcx9tsEQAo5+7Q0XPNgBqiSLNnB2nnAGp+I="
+    "version": "8.3.1.1",
+    "hash": "sha256-Um4iwLdz9XtaDSAsthNZdev6dMiy7OBoHOrorMrMYyo="
  },
  {
    "pname": "MessageBox.Avalonia",
@ -186,8 +186,8 @@
  },
  {
    "pname": "ReactiveUI",
-    "version": "20.2.45",
-    "hash": "sha256-7JzWD40/iNnp7+wuG/qEJoVXQz0T7qipq5NWJFxJ6VM="
+    "version": "20.3.1",
+    "hash": "sha256-1eCZ5M+zkVmlPYuK1gBDCdyCGlYbXIfX+h6Vz0hu8e4="
  },
  {
    "pname": "ReactiveUI.Fody",
@ -196,13 +196,13 @@
  },
  {
    "pname": "Semi.Avalonia",
-    "version": "11.2.1.7",
-    "hash": "sha256-LFlgdRcqNR+ZV9Hkyuw7LhaFWKwCuXWRWYM+9sQRBDU="
+    "version": "11.2.1.8",
+    "hash": "sha256-1P3hr634woqLtNrWOiJWzizwh0AMWt9Y7J1SXHIkv5M="
  },
  {
    "pname": "Semi.Avalonia.DataGrid",
-    "version": "11.2.1.7",
-    "hash": "sha256-EWfzKeM5gMoJHx7L9+kAeGtaaY6HeG+NwAxv08rOv6E="
+    "version": "11.2.1.8",
+    "hash": "sha256-OKb+vlKSf9e0vL5mGNzSEr62k1Zy/mS4kXWGHZHcBq0="
  },
  {
    "pname": "SkiaSharp",
@ -294,11 +294,6 @@
    "version": "8.0.0",
    "hash": "sha256-LdpB1s4vQzsOODaxiKstLks57X9DTD5D6cPx8DE1wwE="
  },
-  {
-    "pname": "System.IO.Pipelines",
-    "version": "9.0.2",
-    "hash": "sha256-uxM7J0Q/dzEsD0NGcVBsOmdHiOEawZ5GNUKBwpdiPyE="
-  },
  {
    "pname": "System.Memory",
    "version": "4.5.3",
@ -319,16 +314,6 @@
    "version": "5.0.0",
    "hash": "sha256-CBOQwl9veFkrKK2oU8JFFEiKIh/p+aJO+q9Tc2Q/89Y="
  },
-  {
-    "pname": "System.Text.Encodings.Web",
-    "version": "9.0.2",
-    "hash": "sha256-tZhc/Xe+SF9bCplthph2QmQakWxKVjMfQJZzD1Xbpg8="
-  },
-  {
-    "pname": "System.Text.Json",
-    "version": "9.0.2",
-    "hash": "sha256-kftKUuGgZtF4APmp77U79ws76mEIi+R9+DSVGikA5y8="
-  },
  {
    "pname": "TaskScheduler",
    "version": "2.12.1",
--- a/pkgs/by-name/v2/v2rayn/package.nix
+++ b/pkgs/by-name/v2/v2rayn/package.nix
@ -21,13 +21,13 @@

 buildDotnetModule rec {
  pname = "v2rayn";
-  version = "7.12.5";
+  version = "7.12.7";

  src = fetchFromGitHub {
    owner = "2dust";
    repo = "v2rayN";
    tag = version;
-    hash = "sha256-gXVriD9g4Coc0B0yN5AlfNre9C9l8V5wv4q3KgKRsF0=";
+    hash = "sha256-pYkUbctdN3qaGxI5DbreoOGmXyIVrpHqYlN3BFRCcZ8=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/va/vaults/not-found-flatpak-info.patch
+++ b/pkgs/by-name/va/vaults/not-found-flatpak-info.patch
@ -1,11 +0,0 @@
--- a/src/global_config_manager.rs
-+++ b/src/global_config_manager.rs
-@@ -100,7 +100,7 @@
-         let object: Self = glib::Object::new();
- 
-         *object.imp().flatpak_info.borrow_mut() =
-            Ini::load_from_file("/.flatpak-info").expect("Could not load .flatpak-info");
-+            Ini::load_from_file("/.flatpak-info").unwrap_or_else(|_| Ini::new());
- 
-         match user_config_dir().as_os_str().to_str() {
-             Some(user_config_directory) => {
--- a/pkgs/by-name/va/vaults/package.nix
+++ b/pkgs/by-name/va/vaults/package.nix
@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  replaceVars,
  appstream-glib,
  desktop-file-utils,
  meson,
@ -18,45 +19,39 @@
  wayland,
  gocryptfs,
  cryfs,
+  fuse,
+  util-linux,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "vaults";
-  version = "0.9.0";
+  version = "0.10.0";

  src = fetchFromGitHub {
    owner = "mpobaschnig";
    repo = "vaults";
-    tag = version;
-    hash = "sha256-PczDj6G05H6XbkMQBr4e1qgW5s8GswEA9f3BRxsAWv0=";
+    tag = finalAttrs.version;
+    hash = "sha256-B4CNEghMfP+r0poyhE102zC1Yd2U5ocV1MCMEVEMjEY=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
-    hash = "sha256-j0A6HlApV0l7LuB7ISHp+k/bSH5Icdv+aNQ9juCCO9I=";
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-my4CxFIEN19juo/ya2vlkejQTaZsyoYLtFTR7iCT9s0=";
  };

-  patches = [ ./not-found-flatpak-info.patch ];
+  patches = [
+    (replaceVars ./remove_flatpak_dependency.patch {
+      cryfs = lib.getExe' cryfs "cryfs";
+      gocryptfs = lib.getExe' gocryptfs "gocryptfs";
+      fusermount = lib.getExe' fuse "fusermount";
+      umount = lib.getExe' util-linux "umount";
+    })
+  ];

  postPatch = ''
    patchShebangs build-aux
  '';

-  makeFlags = [
-    "PREFIX=${placeholder "out"}"
-  ];
-
-  preFixup = ''
-    gappsWrapperArgs+=(
-      --prefix PATH : "${
-        lib.makeBinPath [
-          gocryptfs
-          cryfs
-        ]
-      }"
-    )
-  '';
-
  nativeBuildInputs = [
    desktop-file-utils
    meson
@ -82,7 +77,7 @@ stdenv.mkDerivation rec {
  meta = {
    description = "GTK frontend for encrypted vaults supporting gocryptfs and CryFS for encryption";
    homepage = "https://mpobaschnig.github.io/vaults/";
-    changelog = "https://github.com/mpobaschnig/vaults/releases/tag/${version}";
+    changelog = "https://github.com/mpobaschnig/vaults/releases/tag/${finalAttrs.version}";
    license = lib.licenses.gpl3Plus;
    maintainers = with lib.maintainers; [
      benneti
@ -91,4 +86,4 @@ stdenv.mkDerivation rec {
    mainProgram = "vaults";
    platforms = lib.platforms.linux;
  };
-}
+})
--- a/pkgs/by-name/va/vaults/remove_flatpak_dependency.patch
+++ b/pkgs/by-name/va/vaults/remove_flatpak_dependency.patch
@ -0,0 +1,139 @@
+diff --git a/src/backend/cryfs.rs b/src/backend/cryfs.rs
+index 089bf03..157c72a 100644
+--- a/src/backend/cryfs.rs
+++ b/src/backend/cryfs.rs
+@@ -35,13 +35,7 @@ fn get_binary_path(vault_config: &VaultConfig) -> String {
+         }
+     }
+ 
+-    let global_config = GlobalConfigManager::instance().get_flatpak_info();
+-    let instance_path = global_config
+-        .section(Some("Instance"))
+-        .unwrap()
+-        .get("app-path")
+-        .unwrap();
+-    let cryfs_instance_path = instance_path.to_owned() + "/bin/cryfs";
+    let cryfs_instance_path = "@cryfs@".to_string();
+     log::info!("CryFS binary path: {}", cryfs_instance_path);
+     cryfs_instance_path
+ }
+@@ -49,9 +43,7 @@ fn get_binary_path(vault_config: &VaultConfig) -> String {
+ pub fn is_available(vault_config: &VaultConfig) -> Result<bool, BackendError> {
+     log::trace!("is_available({:?})", vault_config);
+ 
+-    let output = Command::new("flatpak-spawn")
+-        .arg("--host")
+-        .arg(get_binary_path(vault_config))
+    let output = Command::new(get_binary_path(vault_config))
+         .arg("--version")
+         .output()?;
+     log::debug!("CryFS output: {:?}", output);
+@@ -64,9 +56,7 @@ pub fn is_available(vault_config: &VaultConfig) -> Result<bool, BackendError> {
+ pub fn init(vault_config: &VaultConfig, password: String) -> Result<(), BackendError> {
+     log::trace!("init({:?}, password: <redacted>)", vault_config);
+ 
+-    let mut child = Command::new("flatpak-spawn")
+-        .arg("--host")
+-        .arg(get_binary_path(vault_config))
+    let mut child = Command::new(get_binary_path(vault_config))
+         .env("CRYFS_FRONTEND", "noninteractive")
+         .stdin(Stdio::piped())
+         .stdout(Stdio::piped())
+@@ -106,9 +96,7 @@ pub fn init(vault_config: &VaultConfig, password: String) -> Result<(), BackendE
+ pub fn open(vault_config: &VaultConfig, password: String) -> Result<(), BackendError> {
+     log::trace!("open({:?}, password: <redacted>)", vault_config);
+ 
+-    let mut child = Command::new("flatpak-spawn")
+-        .arg("--host")
+-        .arg(get_binary_path(vault_config))
+    let mut child = Command::new(get_binary_path(vault_config))
+         .env("CRYFS_FRONTEND", "noninteractive")
+         .stdin(Stdio::piped())
+         .stdout(Stdio::piped())
+@@ -143,9 +131,7 @@ pub fn open(vault_config: &VaultConfig, password: String) -> Result<(), BackendE
+ pub fn close(vault_config: &VaultConfig) -> Result<(), BackendError> {
+     log::trace!("close({:?})", vault_config);
+ 
+-    let child = Command::new("flatpak-spawn")
+-        .arg("--host")
+-        .arg("fusermount")
+    let child = Command::new("@fusermount@")
+         .arg("-u")
+         .stdout(Stdio::piped())
+         .arg(&vault_config.mount_directory)
+diff --git a/src/backend/gocryptfs.rs b/src/backend/gocryptfs.rs
+index 9638f3a..ffa8f44 100644
+--- a/src/backend/gocryptfs.rs
+++ b/src/backend/gocryptfs.rs
+@@ -35,13 +35,7 @@ fn get_binary_path(vault_config: &VaultConfig) -> String {
+         }
+     }
+ 
+-    let global_config = GlobalConfigManager::instance().get_flatpak_info();
+-    let instance_path = global_config
+-        .section(Some("Instance"))
+-        .unwrap()
+-        .get("app-path")
+-        .unwrap();
+-    let gocryptfs_instance_path = instance_path.to_owned() + "/bin/gocryptfs";
+    let gocryptfs_instance_path = "@gocryptfs@".to_string();
+     log::info!("gocryptfs binary path: {}", gocryptfs_instance_path);
+     gocryptfs_instance_path
+ }
+@@ -49,9 +43,7 @@ fn get_binary_path(vault_config: &VaultConfig) -> String {
+ pub fn is_available(vault_config: &VaultConfig) -> Result<bool, BackendError> {
+     log::trace!("is_available({:?})", vault_config);
+ 
+-    let output = Command::new("flatpak-spawn")
+-        .arg("--host")
+-        .arg(get_binary_path(vault_config))
+    let output = Command::new(get_binary_path(vault_config))
+         .arg("--version")
+         .output()?;
+     log::debug!("gocryptfs output: {:?}", output);
+@@ -64,9 +56,7 @@ pub fn is_available(vault_config: &VaultConfig) -> Result<bool, BackendError> {
+ pub fn init(vault_config: &VaultConfig, password: String) -> Result<(), BackendError> {
+     log::trace!("init({:?}, password: <redacted>)", vault_config);
+ 
+-    let mut child = Command::new("flatpak-spawn")
+-        .arg("--host")
+-        .arg(get_binary_path(vault_config))
+    let mut child = Command::new(get_binary_path(vault_config))
+         .stdin(Stdio::piped())
+         .stdout(Stdio::piped())
+         .arg("--init")
+@@ -104,9 +94,7 @@ pub fn init(vault_config: &VaultConfig, password: String) -> Result<(), BackendE
+ pub fn open(vault_config: &VaultConfig, password: String) -> Result<(), BackendError> {
+     log::trace!("open({:?}, password: <redacted>)", vault_config);
+ 
+-    let mut child = Command::new("flatpak-spawn")
+-        .arg("--host")
+-        .arg(get_binary_path(vault_config))
+    let mut child = Command::new(get_binary_path(vault_config))
+         .stdin(Stdio::piped())
+         .stdout(Stdio::piped())
+         .arg("-q")
+@@ -142,9 +130,7 @@ pub fn open(vault_config: &VaultConfig, password: String) -> Result<(), BackendE
+ pub fn close(vault_config: &VaultConfig) -> Result<(), BackendError> {
+     log::trace!("close({:?}, password: <redacted>)", vault_config);
+ 
+-    let child = Command::new("flatpak-spawn")
+-        .arg("--host")
+-        .arg("umount")
+    let child = Command::new("@umount@")
+         .stdout(Stdio::piped())
+         .arg(&vault_config.mount_directory)
+         .spawn()?;
+diff --git a/src/global_config_manager.rs b/src/global_config_manager.rs
+index 619bb18..cea9ac3 100644
+--- a/src/global_config_manager.rs
+++ b/src/global_config_manager.rs
+@@ -102,7 +102,7 @@ impl GlobalConfigManager {
+         let object: Self = glib::Object::new();
+ 
+         *object.imp().flatpak_info.borrow_mut() =
+-            Ini::load_from_file("/.flatpak-info").expect("Could not load .flatpak-info");
+            Ini::load_from_file("/.flatpak-info").unwrap_or_else(|_| Ini::new());
+ 
+         match user_config_dir().as_os_str().to_str() {
+             Some(user_config_directory) => {
--- a/pkgs/by-name/ve/venera/package.nix
+++ b/pkgs/by-name/ve/venera/package.nix
@ -14,13 +14,13 @@

 flutter332.buildFlutterApplication rec {
  pname = "venera";
-  version = "1.4.4";
+  version = "1.4.5";

  src = fetchFromGitHub {
    owner = "venera-app";
    repo = "venera";
    tag = "v${version}";
-    hash = "sha256-ZJ5TMoBamXHU/pU790/6HHJwNqVsXpZ1OttPR/JSydY=";
+    hash = "sha256-yg7VwR1IGswyqkyuvTZnVVLI4YKnfcea+VemWLOUXto=";
  };

  pubspecLock = lib.importJSON ./pubspec.lock.json;
--- a/pkgs/by-name/ve/venera/pubspec.lock.json
+++ b/pkgs/by-name/ve/venera/pubspec.lock.json
@ -1379,6 +1379,6 @@
  },
  "sdks": {
    "dart": ">=3.8.0 <4.0.0",
-    "flutter": ">=3.32.0"
+    "flutter": ">=3.32.4"
  }
 }
--- a/pkgs/by-name/vk/vkd3d-proton/sources.nix
+++ b/pkgs/by-name/vk/vkd3d-proton/sources.nix
@ -5,12 +5,12 @@
    let
      self = {
        pname = "vkd3d-proton";
-        version = "2.13";
+        version = "2.14.1";

        src = fetchFromGitHub {
          owner = "HansKristian-Work";
          repo = "vkd3d-proton";
-          rev = "v${self.version}";
+          tag = "v${self.version}";
          fetchSubmodules = true;
          #
          # Some files are filled by using Git commands; it requires deepClone.
@ -31,7 +31,7 @@
            git describe --always --tags --dirty=+ > .nixpkgs-auxfiles/vkd3d_version
            find $out -name .git -print0 | xargs -0 rm -fr
          '';
-          hash = "sha256-dJYQ6pJdfRQwr8OrxxpWG6YMfeTXqzTrHXDd5Ecxbi8=";
+          hash = "sha256-8YA/I5UL6G5v4uZE2qKqXzHWeZxg67jm20rONKocvvE=";
        };
      };
    in
--- a/pkgs/by-name/vu/vunnel/package.nix
+++ b/pkgs/by-name/vu/vunnel/package.nix
@ -7,14 +7,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "vunnel";
-  version = "0.33.0";
+  version = "0.34.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "anchore";
    repo = "vunnel";
    tag = "v${version}";
-    hash = "sha256-NmU+84hgKryn1zX7vk0ixy2msxeqwGwuTm1H44Lue7I=";
+    hash = "sha256-+ZWrFODJNhQeB/Zn+3fwuuH4Huu542/imwcv7qEiZes=";
    leaveDotGit = true;
  };

--- a/pkgs/by-name/wa/waybar/package.nix
+++ b/pkgs/by-name/wa/waybar/package.nix
@ -71,18 +71,21 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "waybar";
-  version = "0.12.0";
+  version = "0.12.0-unstable-2025-06-13";

  src = fetchFromGitHub {
    owner = "Alexays";
    repo = "Waybar";
-    tag = finalAttrs.version;
-    hash = "sha256-VpT3ePqmo75Ni6/02KFGV6ltnpiV70/ovG/p1f2wKkU=";
+    # TODO: switch back to using tag when a new version is released which
+    # includes the fixes for issues like
+    # https://github.com/Alexays/Waybar/issues/3956
+    rev = "2c482a29173ffcc03c3e4859808eaef6c9014a1f";
+    hash = "sha256-29g4SN3Yr4q7zxYS3dU48i634jVsXHBwUUeALPAHZGM=";
  };

  postUnpack = lib.optional cavaSupport ''
    pushd "$sourceRoot"
-    cp -R --no-preserve=mode,ownership ${libcava.src} subprojects/cava-0.10.3
+    cp -R --no-preserve=mode,ownership ${libcava.src} subprojects/cava-0.10.4
    patchShebangs .
    popd
  '';
@ -188,7 +191,9 @@ stdenv.mkDerivation (finalAttrs: {
    versionCheckHook
  ];
  versionCheckProgramArg = "--version";
-  doInstallCheck = true;
+
+  # TODO: re-enable after bump to next release.
+  doInstallCheck = false;

  passthru = {
    updateScript = nix-update-script { };
--- a/Show More
+++ b/Show More