Merge remote-tracking branch 'origin/master' into staging-next

2025-06-14 23:38:13 +03:00 · 2025-06-14 23:38:13 +03:00 · d07e701d48
commit d07e701d48
parent c464db46c7 26be80f33b
157 changed files with 2609 additions and 1197 deletions
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@ -96,7 +96,7 @@ jobs:
                    name == '12.approved-by: package-maintainer'
                  )

-                const approvals =
+                const approvals = new Set(
                  (await github.paginate(github.rest.pulls.listReviews, {
                    owner: context.repo.owner,
                    repo: context.repo.repo,
@ -104,15 +104,16 @@ jobs:
                  }))
                  .filter(review => review.state == 'APPROVED')
                  .map(review => review.user.id)
-
-                const maintainers = Object.keys(
-                  JSON.parse(await readFile('comparison/maintainers.json', 'utf-8'))
                )

+                const maintainers = new Set(Object.keys(
+                  JSON.parse(await readFile('comparison/maintainers.json', 'utf-8'))
+                ))
+
                // And the labels that should be there
                const after = JSON.parse(await readFile('comparison/changed-paths.json', 'utf-8')).labels
-                if (approvals.length > 0) after.push(`12.approvals: ${approvals.length > 2 ? '3+' : approvals.length}`)
-                if (maintainers.some(id => approvals.includes(id))) after.push('12.approved-by: package-maintainer')
+                if (approvals.size > 0) after.push(`12.approvals: ${approvals.size > 2 ? '3+' : approvals.size}`)
+                if (Array.from(maintainers).some(m => approvals.has(m))) after.push('12.approved-by: package-maintainer')

                // Remove the ones not needed anymore
                await Promise.all(
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@ -29,7 +29,8 @@

 - New hardening flags, `strictflexarrays1` and `strictflexarrays3` were made available, corresponding to the gcc/clang options `-fstrict-flex-arrays=1` and `-fstrict-flex-arrays=3` respectively.

- `vmalert` now supports multiple instances with the option `services.vmalert.instances."".enable`
+- `gramps` has been updated to 6.0.0
+  Upstream recommends [backing up your Family Trees](https://gramps-project.org/wiki/index.php/Gramps_6.0_Wiki_Manual_-_Manage_Family_Trees#Backing_up_a_Family_Tree) before upgrading.

 ## Nixpkgs Library {#sec-nixpkgs-release-25.11-lib}

--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -26358,10 +26358,11 @@
    name = "Danny Wilson";
  };
  vizid = {
-    email = "vizid1337@gmail.com";
+    email = "mail@vizqq.cc";
    github = "ViZiD";
    githubId = 7444430;
    name = "Radik Islamov";
+    keys = [ { fingerprint = "5779 01B8 C620 E064 4212  C6FC F396 46E8 0C71 08E7"; } ];
  };
  vji = {
    email = "mail@viktor.im";
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@ -42,12 +42,21 @@

 - The Pocket ID module ([`services.pocket-id`][#opt-services.pocket-id.enable]) and package (`pocket-id`) has been updated to 1.0.0. Some environment variables have been changed or removed, see the [migration guide](https://pocket-id.org/docs/setup/migrate-to-v1/).

+- The `yeahwm` package and `services.xserver.windowManager.yeahwm` module were removed due to the package being broken and unmaintained upstream.
+
 - The `services.siproxd` module has been removed as `siproxd` is unmaintained and broken with libosip 5.x.

 - `renovate` was updated to v40. See the [upstream release notes](https://github.com/renovatebot/renovate/releases/tag/40.0.0) for breaking changes.

 - The `boot.readOnlyNixStore` has been removed. Control over bind mount options on `/nix/store` is now offered by the `boot.nixStoreMountOpts` option.

+- The Postfix module has been updated and likely requires configuration changes:
+  - The `services.postfix.sslCert` and `sslKey` options were removed and you now need to configure
+    - [services.postfix.config.smtpd_tls_chain_files](#opt-services.postfix.config.smtpd_tls_chain_files) for server certificates,
+    - [services.postfix.config.smtp_tls_chain_files](#opt-services.postfix.config) for client certificates.
+
+- `vmalert` now supports multiple instances with the option `services.vmalert.instances."".enable`
+
 ## Other Notable Changes {#sec-release-25.11-notable-changes}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@ -5,6 +5,10 @@
  ...
 }:
 let
+  inherit (lib)
+    mkOption
+    types
+    ;

  cfg = config.services.postfix;
  user = cfg.user;
@ -47,7 +51,11 @@ let
          );
      mkEntry = name: value: "${escape name} =${mkVal value}";
    in
-    lib.concatStringsSep "\n" (lib.mapAttrsToList mkEntry cfg.config) + "\n" + cfg.extraConfig;
+    lib.concatStringsSep "\n" (
+      lib.mapAttrsToList mkEntry (lib.filterAttrsRecursive (_: value: value != null) cfg.config)
+    )
+    + "\n"
+    + cfg.extraConfig;

  masterCfOptions =
    {
@ -564,16 +572,60 @@ in
      };

      config = lib.mkOption {
-        type =
-          with lib.types;
-          attrsOf (oneOf [
-            bool
-            int
-            str
-            (listOf str)
-          ]);
+        type = lib.types.submodule {
+          freeformType =
+            with types;
+            attrsOf (
+              nullOr (oneOf [
+                bool
+                int
+                str
+                (listOf str)
+              ])
+            );
+          options = {
+            smtpd_tls_chain_files = mkOption {
+              type = with types; listOf path;
+              default = [ ];
+              example = [
+                "/var/lib/acme/mail.example.com/privkey.pem"
+                "/var/lib/acme/mail.example.com/fullchain.pem"
+              ];
+              description = ''
+                List of paths to the server private keys and certificates.
+
+                ::: {.caution}
+                The order of items matters and a private key must always be followed by the corresponding certificate.
+                :::
+
+                <https://www.postfix.org/postconf.5.html#smtpd_tls_chain_files>
+              '';
+            };
+
+            smtpd_tls_security_level = mkOption {
+              type = types.enum [
+                "none"
+                "may"
+                "encrypt"
+              ];
+              default = if config.services.postfix.config.smtpd_tls_chain_files != [ ] then "may" else "none";
+              defaultText = lib.literalExpression ''
+                if config.services.postfix.config.smtpd_tls_chain_files != [ ] then "may" else "none"
+              '';
+              example = "may";
+              description = ''
+                The server TLS security level. Enable TLS by configuring at least `may`.
+
+                <https://www.postfix.org/postconf.5.html#smtpd_tls_security_level>
+              '';
+            };
+          };
+        };
+
        description = ''
          The main.cf configuration file as key value set.
+
+          Null values will not be rendered.
        '';
        example = {
          mail_owner = "postfix";
@ -599,18 +651,6 @@ in
        '';
      };

-      sslCert = lib.mkOption {
-        type = lib.types.str;
-        default = "";
-        description = "SSL certificate to use.";
-      };
-
-      sslKey = lib.mkOption {
-        type = lib.types.str;
-        default = "";
-        description = "SSL key to use.";
-      };
-
      recipientDelimiter = lib.mkOption {
        type = lib.types.str;
        default = "";
@ -974,18 +1014,6 @@ in
          // lib.optionalAttrs (cfg.tlsTrustedAuthorities != "") {
            smtp_tls_CAfile = cfg.tlsTrustedAuthorities;
            smtp_tls_security_level = lib.mkDefault "may";
-          }
-          // lib.optionalAttrs (cfg.sslCert != "") {
-            smtp_tls_cert_file = cfg.sslCert;
-            smtp_tls_key_file = cfg.sslKey;
-
-            smtp_tls_security_level = lib.mkDefault "may";
-
-            smtpd_tls_cert_file = cfg.sslCert;
-            smtpd_tls_key_file = cfg.sslKey;
-
-            smtpd_tls_security_level = lib.mkDefault "may";
-
          };

        services.postfix.masterConfig =
@ -1150,6 +1178,12 @@ in
    (lib.mkRemovedOptionModule [ "services" "postfix" "sslCACert" ]
      "services.postfix.sslCACert was replaced by services.postfix.tlsTrustedAuthorities. In case you intend that your server should validate requested client certificates use services.postfix.extraConfig."
    )
+    (lib.mkRemovedOptionModule [ "services" "postfix" "sslCert" ]
+      "services.postfix.sslCert was removed. Use services.postfix.config.smtpd_tls_chain_files for the server certificate, or services.postfix.config.smtp_tls_chain_files for the client certificate."
+    )
+    (lib.mkRemovedOptionModule [ "services" "postfix" "sslKey" ]
+      "services.postfix.sslKey was removed. Use services.postfix.config.smtpd_tls_chain_files for server private key, or services.postfix.config.smtp_tls_chain_files for the client private key."
+    )

    (lib.mkChangedOptionModule
      [ "services" "postfix" "useDane" ]
--- a/nixos/modules/services/x11/window-managers/default.nix
+++ b/nixos/modules/services/x11/window-managers/default.nix
@ -46,7 +46,6 @@ in
    ./wmderland.nix
    ./wmii.nix
    ./xmonad.nix
-    ./yeahwm.nix
    ./qtile.nix
    ./none.nix
  ];
--- a/nixos/modules/services/x11/window-managers/yeahwm.nix
+++ b/nixos/modules/services/x11/window-managers/yeahwm.nix
@ -1,30 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-with lib;
-
-let
-  cfg = config.services.xserver.windowManager.yeahwm;
-in
-{
-  ###### interface
-  options = {
-    services.xserver.windowManager.yeahwm.enable = mkEnableOption "yeahwm";
-  };
-
-  ###### implementation
-  config = mkIf cfg.enable {
-    services.xserver.windowManager.session = singleton {
-      name = "yeahwm";
-      start = ''
-        ${pkgs.yeahwm}/bin/yeahwm &
-        waitPID=$!
-      '';
-    };
-    environment.systemPackages = [ pkgs.yeahwm ];
-  };
-}
--- a/nixos/tests/postfix.nix
+++ b/nixos/tests/postfix.nix
@ -14,8 +14,10 @@ import ./make-test-python.nix {
        enableSubmission = true;
        enableSubmissions = true;
        tlsTrustedAuthorities = "${certs.ca.cert}";
-        sslCert = "${certs.${domain}.cert}";
-        sslKey = "${certs.${domain}.key}";
+        config.smtpd_tls_chain_files = [
+          certs.${domain}.key
+          certs.${domain}.cert
+        ];
        submissionsOptions = {
          smtpd_sasl_auth_enable = "yes";
          smtpd_client_restrictions = "permit";
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -1343,8 +1343,8 @@ let
        mktplcRef = {
          name = "composer-php-vscode";
          publisher = "devsense";
-          version = "1.58.17223";
-          hash = "sha256-eobPtePHqW0+2PgMN6ydJWMLQJ14FsevKbhZzaXYxqc=";
+          version = "1.59.17466";
+          hash = "sha256-efgwdF1bRE4sngayKq0fcFWDNtvkX+tgEKbF3RyYY68=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/DEVSENSE.composer-php-vscode/changelog";
@ -1352,7 +1352,7 @@ let
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=DEVSENSE.composer-php-vscode";
          homepage = "https://github.com/DEVSENSE/phptools-docs";
          license = lib.licenses.unfree;
-          maintainers = [ lib.maintainers.drupol ];
+          maintainers = [ ];
        };
      };

@ -1402,7 +1402,7 @@ let
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=DEVSENSE.phptools-vscode";
          homepage = "https://github.com/DEVSENSE/phptools-docs";
          license = lib.licenses.unfree;
-          maintainers = [ lib.maintainers.drupol ];
+          maintainers = [ ];
          platforms = [
            "x86_64-linux"
            "x86_64-darwin"
@ -1425,7 +1425,7 @@ let
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=DEVSENSE.profiler-php-vscode";
          homepage = "https://github.com/DEVSENSE/phptools-docs";
          license = lib.licenses.unfree;
-          maintainers = [ lib.maintainers.drupol ];
+          maintainers = [ ];
        };
      };

@ -2777,8 +2777,8 @@ let
        mktplcRef = {
          name = "language-julia";
          publisher = "julialang";
-          version = "1.141.2";
-          hash = "sha256-i5mY037rs65BKiQLvUbu9Lup2ljhZI0owqjZ0AUsXMw=";
+          version = "1.144.2";
+          hash = "sha256-9OFMQc5Y+979wYkd3qyuLuw7bRBMcsTQ9uSd2ea5cxk=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/julialang.language-julia/changelog";
--- a/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix
+++ b/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix
@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "dosbox-pure";
-  version = "0-unstable-2025-06-03";
+  version = "0-unstable-2025-06-14";

  src = fetchFromGitHub {
    owner = "schellingb";
    repo = "dosbox-pure";
-    rev = "ee1ff009d8edf87c668bc5d1aa6d6f1320b8b654";
-    hash = "sha256-3vIw73T47gTS2A9PBJuZGBNlDiXPNabsj4YopXLMMIY=";
+    rev = "bdabec1651380f3f736eecff8d859090ae822f9b";
+    hash = "sha256-plUeFjkUSbWKs/TZHqQLR5MtOgWLNZLUg7QedtR+/Vo=";
  };

  hardeningDisable = [ "format" ];
--- a/pkgs/applications/emulators/libretro/cores/gambatte.nix
+++ b/pkgs/applications/emulators/libretro/cores/gambatte.nix
@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "gambatte";
-  version = "0-unstable-2025-05-16";
+  version = "0-unstable-2025-06-13";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "gambatte-libretro";
-    rev = "0b95f252ba9cdb366b4d87e6236b0a63f4305cba";
-    hash = "sha256-EcTd5ihZcdQ2LJNy8jcD4g6+PhR1Jialjd3xa6tZMew=";
+    rev = "811b1f7a56c16f8588caada36d7a3f9a56cb16d4";
+    hash = "sha256-pPLUvlwRoVMRcCGyxqot2QAanKmQWknk5uF4rRZ41zY=";
  };

  meta = {
--- a/pkgs/applications/emulators/libretro/cores/play.nix
+++ b/pkgs/applications/emulators/libretro/cores/play.nix
@ -14,13 +14,13 @@
 }:
 mkLibretroCore {
  core = "play";
-  version = "0-unstable-2025-05-23";
+  version = "0-unstable-2025-06-13";

  src = fetchFromGitHub {
    owner = "jpd002";
    repo = "Play-";
-    rev = "0bd77c19fbbdb83e98988fc5b7944dbeee9eee3e";
-    hash = "sha256-L99pyfhuMf40MXMAFz/aGmp+i7LjosubQXQZd4XzkHY=";
+    rev = "011be1b24fcafd4e5c2262538bd37dfe42a2cd05";
+    hash = "sha256-fcIDh5ydfbwwdlP0KcGNekjUt+uiDe/spzPLOwvLeUI=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
@ -10,13 +10,13 @@
 buildMozillaMach rec {
  pname = "firefox-devedition";
  binaryName = pname;
-  version = "140.0b4";
+  version = "140.0b9";
  applicationName = "Firefox Developer Edition";
  requireSigning = false;
  branding = "browser/branding/aurora";
  src = fetchurl {
    url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "bc71e5183b7f527f006b82ba729cb9556a0c756059025392d31ace1e3e49c0a48f5f7c8b64615353c7ae72ab67eb77212f3b573ea06a278f806328093d1424a4";
+    sha512 = "c653824a5be5e376f53bd73589760af6bb74d7ee66f6557ec9fda4e3d795a851f49d73c063abac69aa6663f7f8b3c76b9487d0c067e33bd1c2be7733b9356325";
  };

  meta = {
--- a/pkgs/by-name/am/amazon-cloudwatch-agent/package.nix
+++ b/pkgs/by-name/am/amazon-cloudwatch-agent/package.nix
@ -11,13 +11,13 @@

 buildGoModule rec {
  pname = "amazon-cloudwatch-agent";
-  version = "1.300056.0";
+  version = "1.300056.1";

  src = fetchFromGitHub {
    owner = "aws";
    repo = "amazon-cloudwatch-agent";
    tag = "v${version}";
-    hash = "sha256-SqXu9CjkSXN0pQwmm+oc2u/MihsfgNWFl++PUn49ohA=";
+    hash = "sha256-toal+jvPXxe+SPurFHUBqi2YzImaRshp0sDE6yZ0bkE=";
  };

  vendorHash = "sha256-UU8o2kCRCY0FdoqsBovTsu42DFy7VD1kdI+tOA3l/Ac=";
--- a/pkgs/by-name/am/amazon-ec2-net-utils/package.nix
+++ b/pkgs/by-name/am/amazon-ec2-net-utils/package.nix
@ -18,13 +18,13 @@

 stdenv.mkDerivation rec {
  pname = "amazon-ec2-net-utils";
-  version = "2.5.5";
+  version = "2.6.0";

  src = fetchFromGitHub {
    owner = "amazonlinux";
    repo = "amazon-ec2-net-utils";
    tag = "v${version}";
-    hash = "sha256-FHPJeyXrnf0+aeh1YqFXWz7qreLs6FHpZuPArt/nkIo=";
+    hash = "sha256-PtnRgNmVrIGndLjYjXWWx85z4oxjn637iZqXd6OSiQg=";
  };

  strictDeps = true;
--- a/pkgs/by-name/an/antonio-font/package.nix
+++ b/pkgs/by-name/an/antonio-font/package.nix
@ -0,0 +1,42 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+}:
+
+stdenv.mkDerivation {
+  pname = "antonio";
+  version = "0-unstable-2013-11-21";
+
+  src = fetchFromGitHub {
+    owner = "vernnobile";
+    repo = "antonioFont";
+    rev = "4b3e07ab5647a613931153a09067a785f54b980a";
+    hash = "sha256-/mlVAEMkhmj6NUcAa9HHtpWw4lS5ze9IXw9IsrHd2J0=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/share/fonts/truetype
+    cp $src/{Bold,Light,Regular}/*.ttf $out/share/fonts/truetype
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "https://github.com/vernnobile/antonioFont";
+    description = "condensed, sans serif font for larger display, headline & banner use, based on Anton";
+    longDescription = ''
+      Antonio is a ‘refined’ version of the Anton Font. Anton is a single
+      weight web font, designed specifically for larger display, headline and
+      ‘banner’ use (see Google’s PR for the Chromebook notebooks that used
+      Anton, big and bright).
+
+      Antonio extends the Anton design to include more weights and introduces
+      refinements to the design that makes it also suitable for use in smaller
+      headings, menus and ‘buttons’ etc.
+    '';
+    license = lib.licenses.ofl; # in fontinfo.plist files
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ toastal ];
+  };
+}
--- a/pkgs/by-name/ba/bacon/package.nix
+++ b/pkgs/by-name/ba/bacon/package.nix
@ -27,17 +27,17 @@ in

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "bacon";
-  version = "3.15.0";
+  version = "3.16.0";

  src = fetchFromGitHub {
    owner = "Canop";
    repo = "bacon";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-8f+EphnooB/9KY9M+mi8xBUX/cH7EvoyHlD/4RjgeaA=";
+    hash = "sha256-+gcH527HaYQsyCqULWhEgz8DNwK8vIWJjVSZhcGme74=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-48QDMJrxm+9psSeCRG7rsNPwxv+FKLrkLMvIvwsV3GQ=";
+  cargoHash = "sha256-kr6c5n9A6Cjv3CPdIS9XkelauK/uBsTDt5iowWmAZn4=";

  buildFeatures = lib.optionals withSound [
    "sound"
--- a/pkgs/by-name/br/brave/package.nix
+++ b/pkgs/by-name/br/brave/package.nix
@ -3,24 +3,24 @@

 let
  pname = "brave";
-  version = "1.79.119";
+  version = "1.79.123";

  allArchives = {
    aarch64-linux = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-tz3pCToOqsO6SAu5NeUSmO0aRe31qw0sK2OxtkrYGlo=";
+      hash = "sha256-SINatcbj6EEvvd1St1hLOMrWXA06DZtbSiaecA8hQ5s=";
    };
    x86_64-linux = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-8uX8byw/rp+yj6Y2qBemEHGwt4CQepWjVD8F9KuJZbI=";
+      hash = "sha256-XWw8Kn245KPpJxhSRz6xmFwijJSU5vMgpDUNRyRMf0M=";
    };
    aarch64-darwin = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-ynLMWSWywJbmURBH60Nf7TJFERPNNzcI/wdW8AFk7ZA=";
+      hash = "sha256-8QZVd1//302jqO24Masz6KEogYCkfUxuQ2HpEeuaujY=";
    };
    x86_64-darwin = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-x64.zip";
-      hash = "sha256-ERhKzzabN3NiJQMaTLxdtHCbPMDbPifG56aBmAgke5o=";
+      hash = "sha256-IB+08osAXOenRDCSvebRxZlNYsFRoh3g0JwGfXUy1kU=";
    };
  };

--- a/pkgs/by-name/co/coder/package.nix
+++ b/pkgs/by-name/co/coder/package.nix
@ -15,21 +15,21 @@ let

  channels = {
    stable = {
-      version = "2.20.3";
+      version = "2.22.1";
      hash = {
-        x86_64-linux = "sha256-+s/xoiN7LYIMZU8n0pT3Zx6c48t+WYbWIAG73D1MkNE=";
-        x86_64-darwin = "sha256-3T/Szjcfiau5k4fixz33jQDYQj+bmWxh6lztY+S+BKg=";
-        aarch64-linux = "sha256-XJt22ZbSVRKyA3+VLh+hcy3hPSPg1witUahj6cLLshg=";
-        aarch64-darwin = "sha256-v6efJ41ayxe/YaaM2g0KOo+Dk4jf+xbeLuLj4o09vKY=";
+        x86_64-linux = "sha256-Jr0vv0ib8FPm4QiClXyJ8eWyF+0bdcn1BHmOb5BeGKo=";
+        x86_64-darwin = "sha256-rniO5/53B47Q5lOtP3nAImQNdiaHeUNb5D1aBlVoEz0=";
+        aarch64-linux = "sha256-9X5Wriyavcplf0ep7y1wvgnC9mg+3gKnzShyjC3yhp0=";
+        aarch64-darwin = "sha256-y/3cA5ImlXEIBh1z0ADsCtvK2E7X6URPC1miWZpeIMY=";
      };
    };
    mainline = {
-      version = "2.21.3";
+      version = "2.23.0";
      hash = {
-        x86_64-linux = "sha256-n5RBXjjjUfgo1xYT1atiI3M65/kQJNHkQ8q0jPifRFg=";
-        x86_64-darwin = "sha256-xajUFNvv/r0ZqT1zkCwthXFWoxnP3oqcBuSap0DJ9og=";
-        aarch64-linux = "sha256-ICIwkyu4lVXlsDzd0urvdw7u98PLPClnZn27qBMz4gs=";
-        aarch64-darwin = "sha256-hFu3Q2jbxAIfLbatV4lh6Rn7B5kX4QnO24meMiouAk8=";
+        x86_64-linux = "sha256-/0Zy0cHocahRrLRi/+LK296gP5dZENguciX+h9ByKME=";
+        x86_64-darwin = "sha256-AIC5AB0rae5CSDVeJa2urrxh+4eBUTX8fhOSYc4fX58=";
+        aarch64-linux = "sha256-vUfFEpMGeXdE/h9if/8PuL2t2kWJAQd8Bg6/m3N+JD0=";
+        aarch64-darwin = "sha256-aGio0fhvycape2vPYrAhniirdSbjSzbZtfFIdhl1gNk=";
      };
    };
  };
--- a/pkgs/by-name/co/container/package.nix
+++ b/pkgs/by-name/co/container/package.nix
@ -0,0 +1,68 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  libarchive,
+  xar,
+  installShellFiles,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "container";
+  version = "0.1.0";
+
+  src = fetchurl {
+    url = "https://github.com/apple/container/releases/download/${finalAttrs.version}/container-${finalAttrs.version}-installer-signed.pkg";
+    hash = "sha256-no+3kTlKb1NbN7YUdBMrU+vgpKNRwqjzo313RYBpfqE=";
+  };
+
+  nativeBuildInputs = [
+    libarchive
+    xar
+    installShellFiles
+  ];
+
+  dontUnpack = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    xar -xf $src Payload
+    bsdtar --extract --file Payload --directory $out
+
+    runHook postInstall
+  '';
+
+  postInstall = lib.optionalString (stdenvNoCC.buildPlatform.canExecute stdenvNoCC.hostPlatform) ''
+    installShellCompletion --cmd ${finalAttrs.meta.mainProgram} \
+      --bash <($out/bin/${finalAttrs.meta.mainProgram} --generate-completion-script bash) \
+      --fish <($out/bin/${finalAttrs.meta.mainProgram} --generate-completion-script fish) \
+      --zsh <($out/bin/${finalAttrs.meta.mainProgram} --generate-completion-script zsh)
+  '';
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Creating and running Linux containers using lightweight virtual machines on a Mac";
+    homepage = "https://github.com/apple/container";
+    changelog = "https://github.com/apple/container/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    mainProgram = "container";
+    maintainers = with lib.maintainers; [
+      xiaoxiangmoe
+    ];
+    platforms = [ "aarch64-darwin" ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
--- a/pkgs/by-name/cr/crowdsec-firewall-bouncer/package.nix
+++ b/pkgs/by-name/cr/crowdsec-firewall-bouncer/package.nix
@ -0,0 +1,55 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+buildGoModule (finalAttrs: {
+  pname = "crowdsec-firewall-bouncer";
+  version = "0.0.33";
+
+  src = fetchFromGitHub {
+    owner = "crowdsecurity";
+    repo = "cs-firewall-bouncer";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-4fxxAW2sXGNxjsc75fd499ciuN8tjGqlpRIaHYUXwQ0=";
+  };
+
+  vendorHash = "sha256-Bhp6Z2UlCJ32vdc3uINCGleZFP2WeUn/XK+Q29szUzQ=";
+
+  ldflags = [
+    "-X github.com/crowdsecurity/go-cs-lib/version.Version=v${finalAttrs.version}"
+  ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  versionCheckProgram = "${placeholder "out"}/bin/cs-firewall-bouncer";
+  versionCheckProgramArg = "-version";
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script {
+      extraArgs = [ "--version-regex=^v(\\d+\\.\\d+\\.\\d+)$" ];
+    };
+  };
+
+  meta = {
+    homepage = "https://crowdsec.net/";
+    downloadPage = "https://github.com/crowdsecurity/cs-firewall-bouncer";
+    changelog = "https://github.com/crowdsecurity/cs-firewall-bouncer/releases/tag/v${finalAttrs.version}";
+    description = "Crowdsec bouncer written in golang for firewalls";
+    longDescription = ''
+      CrowdSec Remediation Component written in golang for firewalls.
+
+      crowdsec-firewall-bouncer will fetch new and old decisions from a
+      CrowdSec API and add them to a blocklist used by supported firewalls.
+    '';
+    license = lib.licenses.mit;
+    mainProgram = "cs-firewall-bouncer";
+    maintainers = with lib.maintainers; [
+      tornax
+      jk
+    ];
+  };
+})
--- a/pkgs/by-name/de/deark/package.nix
+++ b/pkgs/by-name/de/deark/package.nix
@ -0,0 +1,72 @@
+{
+  fetchFromGitHub,
+  stdenv,
+  lib,
+  help2man,
+  installShellFiles,
+}:
+stdenv.mkDerivation rec {
+  pname = "deark";
+  version = "1.7.0";
+
+  src = fetchFromGitHub {
+    owner = "jsummers";
+    repo = "deark";
+    tag = "v${version}";
+    hash = "sha256-dyX41gWZnZ/07Vyxo1x4Y8neGHS5ev+YyBJ0cUH+gKY=";
+  };
+
+  nativeBuildInputs = [
+    help2man
+    installShellFiles
+  ];
+  postBuild = ''
+    make man
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 deark $out/bin/deark
+    installManPage deark.1
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Utility for file format and metadata analysis, data extraction, decompression, and image format decoding";
+    longDescription = ''
+      Deark is a portable command-line utility that can decode certain
+      types of files, and either convert them to a more-modern or
+      more-readable format, or extract embedded files from them.
+    '';
+    homepage = "https://entropymine.com/deark/";
+    downloadPage = "https://github.com/jsummers/deark/";
+    # cf. READMEs under "foreign" folder for details
+    license = with lib.licenses; [
+      mit
+      # deark itself + modifications to foreign code, sans foreign code
+      # ozunreduce.h (dual-licensed: MIT is one option)
+      free
+      # miniz*.h (MIT-style, predates standardized licenses)
+      # ozunreduce.h (dual-licensed: public domain is one option)
+      # dskdcmps.h (public domain)
+      # uncompface.h ("Permission is given to distribute these sources, as long as the
+      #                copyright messages are not removed, and no monies are exchanged"
+      #                + waiver of liability)
+      unfreeRedistributable
+      # lzhuf.* (no copywrite notice, predates standardized licenses,
+      #          widely distributed & intent appears to be free use)
+      # "By necessity, Deark contains knowledge about how to decode various
+      # third-party file formats. This knowledge includes data structures,
+      # algorithms, tables, color palettes, etc. The author(s) of Deark
+      # make no intellectual property claims to this essential knowledge,
+      # but they cannot guarantee that no one else will attempt to do so.
+      # Deark contains VGA and CGA bitmapped fonts, which have no known
+      # copyright claims."
+    ];
+    maintainers = with lib.maintainers; [ zacharyweiss ];
+    mainProgram = "deark";
+    platforms = lib.platforms.unix;
+  };
+}
--- a/pkgs/by-name/ed/edk2/package.nix
+++ b/pkgs/by-name/ed/edk2/package.nix
@ -31,187 +31,184 @@ let
      throw "Unsupported architecture";

  buildType = if stdenv.hostPlatform.isDarwin then "CLANGPDB" else "GCC5";
-
-  edk2 = stdenv.mkDerivation {
-    pname = "edk2";
-    version = "202505";
-
-    srcWithVendoring = fetchFromGitHub {
-      owner = "tianocore";
-      repo = "edk2";
-      tag = "edk2-stable${edk2.version}";
-      fetchSubmodules = true;
-      hash = "sha256-VuiEqVpG/k7pfy0cOC6XmY+8NBtU/OHdDB9Y52tyNe8=";
-    };
-
-    src = applyPatches {
-      name = "edk2-${edk2.version}-unvendored-src";
-      src = edk2.srcWithVendoring;
-
-      patches = [
-        # pass targetPrefix as an env var
-        (fetchpatch {
-          url = "https://src.fedoraproject.org/rpms/edk2/raw/08f2354cd280b4ce5a7888aa85cf520e042955c3/f/0021-Tweak-the-tools_def-to-support-cross-compiling.patch";
-          hash = "sha256-E1/fiFNVx0aB1kOej2DJ2DlBIs9tAAcxoedym2Zhjxw=";
-        })
-        # https://github.com/tianocore/edk2/pull/5658
-        (fetchpatch {
-          name = "fix-cross-compilation-antlr-dlg.patch";
-          url = "https://github.com/tianocore/edk2/commit/a34ff4a8f69a7b8a52b9b299153a8fac702c7df1.patch";
-          hash = "sha256-u+niqwjuLV5tNPykW4xhb7PW2XvUmXhx5uvftG1UIbU=";
-        })
-      ];
-
-      postPatch = ''
-        # de-vendor OpenSSL
-        rm -r CryptoPkg/Library/OpensslLib/openssl
-        mkdir -p CryptoPkg/Library/OpensslLib/openssl
-        (
-        cd CryptoPkg/Library/OpensslLib/openssl
-        tar --strip-components=1 -xf ${buildPackages.openssl.src}
-
-        # Apply OpenSSL patches.
-        ${lib.pipe buildPackages.openssl.patches [
-          (builtins.filter (
-            patch:
-            !builtins.elem (baseNameOf patch) [
-              # Exclude patches not required in this context.
-              "nix-ssl-cert-file.patch"
-              "openssl-disable-kernel-detection.patch"
-              "use-etc-ssl-certs-darwin.patch"
-              "use-etc-ssl-certs.patch"
-            ]
-          ))
-          (map (patch: "patch -p1 < ${patch}\n"))
-          lib.concatStrings
-        ]}
-        )
-
-        # enable compilation using Clang
-        # https://bugzilla.tianocore.org/show_bug.cgi?id=4620
-        substituteInPlace BaseTools/Conf/tools_def.template --replace-fail \
-          'DEFINE CLANGPDB_WARNING_OVERRIDES    = ' \
-          'DEFINE CLANGPDB_WARNING_OVERRIDES    = -Wno-unneeded-internal-declaration '
-      '';
-    };
-
-    nativeBuildInputs = [ pythonEnv ];
-    depsBuildBuild = [
-      buildPackages.stdenv.cc
-      buildPackages.bash
-    ];
-    depsHostHost = [ libuuid ];
-    strictDeps = true;
-
-    # trick taken from https://src.fedoraproject.org/rpms/edk2/blob/08f2354cd280b4ce5a7888aa85cf520e042955c3/f/edk2.spec#_319
-    ${"GCC5_${targetArch}_PREFIX"} = stdenv.cc.targetPrefix;
-
-    makeFlags = [ "-C BaseTools" ];
-
-    env.NIX_CFLAGS_COMPILE =
-      "-Wno-return-type"
-      + lib.optionalString (stdenv.cc.isGNU) " -Wno-error=stringop-truncation"
-      + lib.optionalString (stdenv.hostPlatform.isDarwin) " -Wno-error=macro-redefined";
-
-    hardeningDisable = [
-      "format"
-      "fortify"
-    ];
-
-    installPhase = ''
-      mkdir -vp $out
-      mv -v BaseTools $out
-      mv -v edksetup.sh $out
-      # patchShebangs fails to see these when cross compiling
-      for i in $out/BaseTools/BinWrappers/PosixLike/*; do
-        chmod +x "$i"
-        patchShebangs --build "$i"
-      done
-    '';
-
-    enableParallelBuilding = true;
-
-    meta = {
-      description = "Intel EFI development kit";
-      homepage = "https://github.com/tianocore/tianocore.github.io/wiki/EDK-II/";
-      changelog = "https://github.com/tianocore/edk2/releases/tag/edk2-stable${edk2.version}";
-      license = lib.licenses.bsd2;
-      platforms = with lib.platforms; aarch64 ++ arm ++ i686 ++ x86_64 ++ loongarch64 ++ riscv64;
-      maintainers = [ lib.maintainers.mjoerg ];
-    };
-
-    passthru = {
-      # exercise a channel blocker
-      tests = {
-        systemdBootExtraEntries = nixosTests.systemd-boot.extraEntries;
-        uefiUsb = nixosTests.boot.uefiCdrom;
-      };
-
-      updateScript = writeScript "update-edk2" ''
-        #!/usr/bin/env nix-shell
-        #!nix-shell -i bash -p common-updater-scripts coreutils gnused
-        set -eu -o pipefail
-        version="$(list-git-tags --url="${edk2.srcWithVendoring.url}" |
-                   sed -E --quiet 's/^edk2-stable([0-9]{6})$/\1/p' |
-                   sort --reverse --numeric-sort |
-                   head -n 1)"
-        if [[ "x$UPDATE_NIX_OLD_VERSION" != "x$version" ]]; then
-            update-source-version --source-key=srcWithVendoring \
-                "$UPDATE_NIX_ATTR_PATH" "$version"
-        fi
-      '';
-
-      mkDerivation =
-        projectDscPath: attrsOrFun:
-        stdenv.mkDerivation (
-          finalAttrs:
-          let
-            attrs = lib.toFunction attrsOrFun finalAttrs;
-          in
-          {
-            inherit (edk2) src;
-
-            depsBuildBuild = [ buildPackages.stdenv.cc ] ++ attrs.depsBuildBuild or [ ];
-            nativeBuildInputs = [
-              bc
-              pythonEnv
-            ] ++ attrs.nativeBuildInputs or [ ];
-            strictDeps = true;
-
-            ${"GCC5_${targetArch}_PREFIX"} = stdenv.cc.targetPrefix;
-
-            prePatch = ''
-              rm -rf BaseTools
-              ln -sv ${buildPackages.edk2}/BaseTools BaseTools
-            '';
-
-            configurePhase = ''
-              runHook preConfigure
-              export WORKSPACE="$PWD"
-              . ${buildPackages.edk2}/edksetup.sh BaseTools
-              runHook postConfigure
-            '';
-
-            buildPhase = ''
-              runHook preBuild
-              build -a ${targetArch} -b ${attrs.buildConfig or "RELEASE"} -t ${buildType} -p ${projectDscPath} -n $NIX_BUILD_CORES $buildFlags
-              runHook postBuild
-            '';
-
-            installPhase = ''
-              runHook preInstall
-              mv -v Build/*/* $out
-              runHook postInstall
-            '';
-          }
-          // removeAttrs attrs [
-            "nativeBuildInputs"
-            "depsBuildBuild"
-          ]
-        );
-    };
-  };
-
 in

-edk2
+stdenv.mkDerivation (finalAttrs: {
+  pname = "edk2";
+  version = "202505";
+
+  srcWithVendoring = fetchFromGitHub {
+    owner = "tianocore";
+    repo = "edk2";
+    tag = "edk2-stable${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-VuiEqVpG/k7pfy0cOC6XmY+8NBtU/OHdDB9Y52tyNe8=";
+  };
+
+  src = applyPatches {
+    name = "edk2-${finalAttrs.version}-unvendored-src";
+    src = finalAttrs.srcWithVendoring;
+
+    patches = [
+      # pass targetPrefix as an env var
+      (fetchpatch {
+        url = "https://src.fedoraproject.org/rpms/edk2/raw/08f2354cd280b4ce5a7888aa85cf520e042955c3/f/0021-Tweak-the-tools_def-to-support-cross-compiling.patch";
+        hash = "sha256-E1/fiFNVx0aB1kOej2DJ2DlBIs9tAAcxoedym2Zhjxw=";
+      })
+      # https://github.com/tianocore/edk2/pull/5658
+      (fetchpatch {
+        name = "fix-cross-compilation-antlr-dlg.patch";
+        url = "https://github.com/tianocore/edk2/commit/a34ff4a8f69a7b8a52b9b299153a8fac702c7df1.patch";
+        hash = "sha256-u+niqwjuLV5tNPykW4xhb7PW2XvUmXhx5uvftG1UIbU=";
+      })
+    ];
+
+    postPatch = ''
+      # de-vendor OpenSSL
+      rm -r CryptoPkg/Library/OpensslLib/openssl
+      mkdir -p CryptoPkg/Library/OpensslLib/openssl
+      (
+      cd CryptoPkg/Library/OpensslLib/openssl
+      tar --strip-components=1 -xf ${buildPackages.openssl.src}
+
+      # Apply OpenSSL patches.
+      ${lib.pipe buildPackages.openssl.patches [
+        (builtins.filter (
+          patch:
+          !builtins.elem (baseNameOf patch) [
+            # Exclude patches not required in this context.
+            "nix-ssl-cert-file.patch"
+            "openssl-disable-kernel-detection.patch"
+            "use-etc-ssl-certs-darwin.patch"
+            "use-etc-ssl-certs.patch"
+          ]
+        ))
+        (map (patch: "patch -p1 < ${patch}\n"))
+        lib.concatStrings
+      ]}
+      )
+
+      # enable compilation using Clang
+      # https://bugzilla.tianocore.org/show_bug.cgi?id=4620
+      substituteInPlace BaseTools/Conf/tools_def.template --replace-fail \
+        'DEFINE CLANGPDB_WARNING_OVERRIDES    = ' \
+        'DEFINE CLANGPDB_WARNING_OVERRIDES    = -Wno-unneeded-internal-declaration '
+    '';
+  };
+
+  nativeBuildInputs = [ pythonEnv ];
+  depsBuildBuild = [
+    buildPackages.stdenv.cc
+    buildPackages.bash
+  ];
+  depsHostHost = [ libuuid ];
+  strictDeps = true;
+
+  # trick taken from https://src.fedoraproject.org/rpms/edk2/blob/08f2354cd280b4ce5a7888aa85cf520e042955c3/f/edk2.spec#_319
+  ${"GCC5_${targetArch}_PREFIX"} = stdenv.cc.targetPrefix;
+
+  makeFlags = [ "-C BaseTools" ];
+
+  env.NIX_CFLAGS_COMPILE =
+    "-Wno-return-type"
+    + lib.optionalString (stdenv.cc.isGNU) " -Wno-error=stringop-truncation"
+    + lib.optionalString (stdenv.hostPlatform.isDarwin) " -Wno-error=macro-redefined";
+
+  hardeningDisable = [
+    "format"
+    "fortify"
+  ];
+
+  installPhase = ''
+    mkdir -vp $out
+    mv -v BaseTools $out
+    mv -v edksetup.sh $out
+    # patchShebangs fails to see these when cross compiling
+    for i in $out/BaseTools/BinWrappers/PosixLike/*; do
+      chmod +x "$i"
+      patchShebangs --build "$i"
+    done
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = {
+    description = "Intel EFI development kit";
+    homepage = "https://github.com/tianocore/tianocore.github.io/wiki/EDK-II/";
+    changelog = "https://github.com/tianocore/edk2/releases/tag/edk2-stable${finalAttrs.version}";
+    license = lib.licenses.bsd2;
+    platforms = with lib.platforms; aarch64 ++ arm ++ i686 ++ x86_64 ++ loongarch64 ++ riscv64;
+    maintainers = [ lib.maintainers.mjoerg ];
+  };
+
+  passthru = {
+    # exercise a channel blocker
+    tests = {
+      systemdBootExtraEntries = nixosTests.systemd-boot.extraEntries;
+      uefiUsb = nixosTests.boot.uefiCdrom;
+    };
+
+    updateScript = writeScript "update-edk2" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts coreutils gnused
+      set -eu -o pipefail
+      version="$(list-git-tags --url="${finalAttrs.srcWithVendoring.url}" |
+                 sed -E --quiet 's/^edk2-stable([0-9]{6})$/\1/p' |
+                 sort --reverse --numeric-sort |
+                 head -n 1)"
+      if [[ "x$UPDATE_NIX_OLD_VERSION" != "x$version" ]]; then
+          update-source-version --source-key=srcWithVendoring \
+              "$UPDATE_NIX_ATTR_PATH" "$version"
+      fi
+    '';
+
+    mkDerivation =
+      projectDscPath: attrsOrFun:
+      stdenv.mkDerivation (
+        finalAttrsInner:
+        let
+          attrs = lib.toFunction attrsOrFun finalAttrsInner;
+        in
+        {
+          inherit (finalAttrs) src;
+
+          depsBuildBuild = [ buildPackages.stdenv.cc ] ++ attrs.depsBuildBuild or [ ];
+          nativeBuildInputs = [
+            bc
+            pythonEnv
+          ] ++ attrs.nativeBuildInputs or [ ];
+          strictDeps = true;
+
+          ${"GCC5_${targetArch}_PREFIX"} = stdenv.cc.targetPrefix;
+
+          prePatch = ''
+            rm -rf BaseTools
+            ln -sv ${buildPackages.edk2}/BaseTools BaseTools
+          '';
+
+          configurePhase = ''
+            runHook preConfigure
+            export WORKSPACE="$PWD"
+            . ${buildPackages.edk2}/edksetup.sh BaseTools
+            runHook postConfigure
+          '';
+
+          buildPhase = ''
+            runHook preBuild
+            build -a ${targetArch} -b ${attrs.buildConfig or "RELEASE"} -t ${buildType} -p ${projectDscPath} -n $NIX_BUILD_CORES $buildFlags
+            runHook postBuild
+          '';
+
+          installPhase = ''
+            runHook preInstall
+            mv -v Build/*/* $out
+            runHook postInstall
+          '';
+        }
+        // removeAttrs attrs [
+          "nativeBuildInputs"
+          "depsBuildBuild"
+        ]
+      );
+  };
+})
--- a/pkgs/by-name/gh/ghostfolio/package.nix
+++ b/pkgs/by-name/gh/ghostfolio/package.nix
@ -11,13 +11,13 @@

 buildNpmPackage rec {
  pname = "ghostfolio";
-  version = "2.165.0";
+  version = "2.170.0";

  src = fetchFromGitHub {
    owner = "ghostfolio";
    repo = "ghostfolio";
    tag = version;
-    hash = "sha256-3pgYRwTsfHbooW1oEw2LTH1DXYrru7F7XPmWPQs1x0o=";
+    hash = "sha256-zXT0gSHixUeFaNA0y1JDtR5rrIBQTwlpWPeg9fR4Sf8=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@ -27,7 +27,7 @@ buildNpmPackage rec {
    '';
  };

-  npmDepsHash = "sha256-x/F9fcQBmK6+xL0N38HIBUi+vkvZ3p8rxxqxpnm7p68=";
+  npmDepsHash = "sha256-92MSin46MURmOPFOCobB2646/zl84LTNVwdYQG8Talo=";

  nativeBuildInputs = [
    prisma
--- a/pkgs/by-name/gl/glpi-agent/package.nix
+++ b/pkgs/by-name/gl/glpi-agent/package.nix
@ -15,13 +15,13 @@

 perlPackages.buildPerlPackage rec {
  pname = "glpi-agent";
-  version = "1.14";
+  version = "1.15";

  src = fetchFromGitHub {
    owner = "glpi-project";
    repo = "glpi-agent";
    tag = version;
-    hash = "sha256-6q+JcTFZlZjtMaQKUvCwE9Sjw9662ZXl78kha0tEFv4=";
+    hash = "sha256-+zHTlxfkZ1x21ePZUni7lbRJQ/NUDeoZnvOzM+yzG3M=";
  };

  postPatch = ''
--- a/pkgs/by-name/go/goperf/package.nix
+++ b/pkgs/by-name/go/goperf/package.nix
@ -9,15 +9,15 @@

 buildGoModule rec {
  pname = "goperf";
-  version = "0-unstable-2025-05-05";
+  version = "0-unstable-2025-06-05";

  src = fetchgit {
    url = "https://go.googlesource.com/perf";
-    rev = "a54a20dddd9743f7ac60d2d506e561eaeafd4831";
-    hash = "sha256-+d8s9kEzBJ/21U2x8ZuiGdQrspFIJEmrjxmzNahC/V0=";
+    rev = "b481878a17bef398145703a878ff39e5bedae345";
+    hash = "sha256-jaMJhBf6uE7pKhGYU5RiHl2DpOBhZLqmZvIYZuYFGP4=";
  };

-  vendorHash = "sha256-nqK6xMKYe4uMXvcqopTAV66qklWUq1TzsP8V67TGJJU=";
+  vendorHash = "sha256-r0GYVYgBoTE5Dpma5xqp7llBF9+QDgD/PfL+P01LImA=";

  passthru.updateScript = writeShellScript "update-goperf" ''
    export UPDATE_NIX_ATTR_PATH=goperf
--- a/pkgs/by-name/gr/gramps/package.nix
+++ b/pkgs/by-name/gr/gramps/package.nix
@ -22,21 +22,16 @@
  ghostscript,
 }:

-let
-  inherit (python3Packages) buildPythonApplication pythonOlder;
-in
-buildPythonApplication rec {
-  version = "5.2.4";
+python3Packages.buildPythonApplication rec {
+  version = "6.0.1";
  pname = "gramps";
  pyproject = true;

-  disabled = pythonOlder "3.8";
-
  src = fetchFromGitHub {
    owner = "gramps-project";
    repo = "gramps";
    tag = "v${version}";
-    hash = "sha256-Jue5V4pzfd1MaZwEhkGam+MhNjaisio7byMBPgGmiFg=";
+    hash = "sha256-EKiC7zFIAXwKXun8jixanVmBI5XyQlxBcN5rxbqdq9k=";
  };

  patches = [
@ -46,12 +41,23 @@ buildPythonApplication rec {
    ./disable-gtk-warning-dialog.patch
  ];

+  build-system = [
+    python3Packages.setuptools
+  ];
+
+  dependencies = with python3Packages; [
+    berkeleydb
+    orjson
+    pyicu
+    pygobject3
+    pycairo
+  ];
+
  nativeBuildInputs = [
    wrapGAppsHook3
    intltool
    gettext
    gobject-introspection
-    python3Packages.setuptools
  ];

  nativeCheckInputs =
@ -83,13 +89,6 @@ buildPythonApplication rec {
    # Ghostscript support
    ++ lib.optional enableGhostscript ghostscript;

-  propagatedBuildInputs = with python3Packages; [
-    berkeleydb
-    pyicu
-    pygobject3
-    pycairo
-  ];
-
  preCheck = ''
    export HOME=$(mktemp -d)
    mkdir .git # Make gramps think that it's not in an installed state
--- a/pkgs/by-name/gr/groonga/package.nix
+++ b/pkgs/by-name/gr/groonga/package.nix
@ -23,11 +23,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "groonga";
-  version = "15.0.4";
+  version = "15.1.1";

  src = fetchurl {
    url = "https://packages.groonga.org/source/groonga/groonga-${finalAttrs.version}.tar.gz";
-    hash = "sha256-ESPUEBpV6hg8KQeSzjklPgf4R0DlYdpwxp9M6YdTV/Q=";
+    hash = "sha256-KxUTKUjqfNfpyOcm0uLTkPmSfvvBRTbgvqmS4F248HA=";
  };

  patches = [
--- a/pkgs/by-name/hu/hugo/package.nix
+++ b/pkgs/by-name/hu/hugo/package.nix
@ -11,16 +11,16 @@

 buildGoModule (finalAttrs: {
  pname = "hugo";
-  version = "0.147.7";
+  version = "0.147.8";

  src = fetchFromGitHub {
    owner = "gohugoio";
    repo = "hugo";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-4TIdxujzlRc3y2yUzrJg2IhzWE4ZuqySRHqlhlHuzpc=";
+    hash = "sha256-h8fgV6fWhYrqbG/FPGCPYDnQshz1L8ulxPon+Xnw4lY=";
  };

-  vendorHash = "sha256-ejdBxm0OL3J97SLXtt++Z/1feUlN/yu6vsw+CQt1PX8=";
+  vendorHash = "sha256-VHql1iznNp2qL+qA+M1tSKCf823qozWW8PSyHihFU8A=";

  checkFlags =
    let
--- a/pkgs/by-name/io/ioquake3/package.nix
+++ b/pkgs/by-name/io/ioquake3/package.nix
@ -19,9 +19,10 @@
  freetype,
  mumble,
  unstableGitUpdater,
+  bc,
 }:

-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
  pname = "ioquake3";
  version = "0-unstable-2025-05-15";

@ -37,6 +38,7 @@ stdenv.mkDerivation {
    makeBinaryWrapper
    pkg-config
    which
+    bc
  ];

  buildInputs = [
@ -59,23 +61,57 @@ stdenv.mkDerivation {
    cp ${./Makefile.local} ./Makefile.local
  '';

+  preBuild = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace Makefile \
+      --replace-fail \
+        "-I/Library/Frameworks/SDL2.framework/Headers" \
+        "-I${lib.getDev SDL2}/include/SDL2" \
+      --replace-fail \
+        "CLIENT_LIBS += -framework SDL2" \
+        "CLIENT_LIBS += -L${lib.getLib SDL2}/lib -lSDL2" \
+      --replace-fail \
+        "RENDERER_LIBS += -framework SDL2" \
+        "RENDERER_LIBS += -L${lib.getLib SDL2}/lib -lSDL2" \
+      --replace-fail \
+        "-I/System/Library/Frameworks/OpenAL.framework/Headers" \
+        "-I${lib.getDev openal}/include/AL" \
+      --replace-fail \
+        "CLIENT_LIBS += -framework OpenAL" \
+        "CLIENT_LIBS += -L${lib.getLib openal}/lib -lopenal" \
+      --replace-fail \
+        "TOOLS_CC = gcc" \
+        "TOOLS_CC = clang"
+  '';
+
+  postBuild = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    echo "Building Application Bundle for Darwin / macOS"
+    # The following script works without extensive patching (see preBuild), as the regular buil already
+    # built all the c code and libraries.
+    ./make-macosx.sh ${stdenv.hostPlatform.darwinArch}
+  '';
+
  installTargets = [ "copyfiles" ];

  installFlags = [ "COPYDIR=$(out)/share/ioquake3" ];

-  postInstall = ''
-    install -Dm644 misc/quake3.svg $out/share/icons/hicolor/scalable/apps/ioquake3.svg
+  postInstall =
+    ''
+      install -Dm644 misc/quake3.svg $out/share/icons/hicolor/scalable/apps/ioquake3.svg

-    makeWrapper $out/share/ioquake3/ioquake3.* $out/bin/ioquake3
-    makeWrapper $out/share/ioquake3/ioq3ded.* $out/bin/ioq3ded
-  '';
+      makeWrapper $out/share/ioquake3/ioquake3.* $out/bin/ioquake3
+      makeWrapper $out/share/ioquake3/ioq3ded.* $out/bin/ioq3ded
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      mkdir -p $out/Applications
+      mv build/release-darwin-${stdenv.hostPlatform.darwinArch}/ioquake3.app $out/Applications/
+    '';

  desktopItems = [
    (makeDesktopItem {
      name = "IOQuake3";
      exec = "ioquake3";
      icon = "ioquake3";
-      comment = "A fast-paced 3D first-person shooter, a community effort to continue supporting/developing id's Quake III Arena";
+      comment = finalAttrs.meta.description;
      desktopName = "ioquake3";
      categories = [
        "Game"
@ -96,6 +132,6 @@ stdenv.mkDerivation {
      drupol
      rvolosatovs
    ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
  };
-}
+})
--- a/pkgs/by-name/je/jellyfin-ffmpeg/package.nix
+++ b/pkgs/by-name/je/jellyfin-ffmpeg/package.nix
@ -5,7 +5,7 @@
 }:

 let
-  version = "7.1.1-3";
+  version = "7.1.1-4";
 in

 (ffmpeg_7-full.override {
@ -14,7 +14,7 @@ in
    owner = "jellyfin";
    repo = "jellyfin-ffmpeg";
    rev = "v${version}";
-    hash = "sha256-pJLIhXDPDRhEqzmc1bXViSTSnRifFhMlixkEbGA0GRE=";
+    hash = "sha256-7KHo+kVZl/fkXiChFJ5L+WhuFPx0oqQG+/CQQwTH+/4=";
  };
 }).overrideAttrs
  (old: {
--- a/pkgs/by-name/ku/kubevpn/package.nix
+++ b/pkgs/by-name/ku/kubevpn/package.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "kubevpn";
-  version = "2.7.12";
+  version = "2.7.15";

  src = fetchFromGitHub {
    owner = "KubeNetworks";
    repo = "kubevpn";
    rev = "v${version}";
-    hash = "sha256-Tf0hhhabSP4MxXMb046dBzcjF7T+cmhcCF/1+ZNo1fM=";
+    hash = "sha256-gM92h0gC4GB41KEg0ykecV3Fc0u5wa6DSCAv9VA5Jqc=";
  };

  vendorHash = null;
--- a/pkgs/by-name/le/legends-of-equestria/package.nix
+++ b/pkgs/by-name/le/legends-of-equestria/package.nix
@ -9,6 +9,7 @@
  makeDesktopItem,
  copyDesktopItems,
  libgcc,
+  cairo,
  dbus,
  xorg_sys_opengl,
  systemd,
@ -17,6 +18,7 @@
  pulseaudio,
  libsndfile,
  flac,
+  glib,
  libvorbis,
  libopus,
  mpg123,
@ -24,26 +26,28 @@
  libGL,
  vulkan-loader,
  libasyncns,
+  pango,
  xorg,
+  wayland,
 }:

 let
  pname = "legends-of-equestria";
-  version = "2024.06.02";
+  version = "2025.02.001";
  description = "Free-to-play MMORPG";

  srcOptions = {
    x86_64-linux = {
-      url = "https://mega.nz/file/Z3oAGYDa#01EfQICR4k5BK56hWFckYKsfgdV36KoU91TvSBwKgxY";
-      outputHash = "vpVIaRPrZih+ydWszsBF/JgO0AXh2rF/yOpBuI+V0m4=";
+      url = "https://mega.nz/file/w6pxUQJS#5r_oxsCqLyIUya8fbIATPtKAbsacXkD-bVArjjOBu3w";
+      outputHash = "k5kASgZwCoKVtHDEFjegAl31KZlrkNse4Baph1l/SUc=";
    };
    x86_64-darwin = {
-      url = "https://mega.nz/file/p6JQUDYC#lBRUK7lmxMHh4OvEyKjfl0W1mOL2VVzAH9rXL5ViiN0";
-      outputHash = "bvFg4wjltiilCP1oKfgUWThcEq8tzCIP3W/eAd3SxFo=";
+      url = "https://mega.nz/file/wyoHSZTK#ig1laiSWijTxnN_tS2m5di1Mdly8zDHP1euLVFqG_ug";
+      outputHash = "pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo=";
    };
    aarch64-darwin = {
-      url = "https://mega.nz/file/cvxSzZ4b#eJHLvVHz_zxBiRxGMCBcsl1gV6M6ebQf2tQbNpEqCvk";
-      outputHash = "1aZGuOgXTLFxwF2FcYEwKA/LRT26uiXupBoqmzq9pFM=";
+      url = "https://mega.nz/file/EihRWKgb#KDtmmzLWVKW5uxkKkBEVE0yJioYPkOqutWwwMLhbedA";
+      outputHash = "pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo=";
    };
  };

@ -106,9 +110,17 @@ stdenv.mkDerivation {
      '';

  dontBuild = true;
-  buildInputs = [
-    libgcc
-  ];
+  buildInputs =
+    [
+      libgcc
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      cairo
+      dbus
+      glib
+      pango
+      wayland
+    ];
  nativeBuildInputs =
    [
      makeWrapper
@ -125,8 +137,9 @@ stdenv.mkDerivation {

        loeHome=$out/lib/${pname}
        mkdir -p $loeHome
-        cp -r Linux/* $loeHome
+        cp -r LoE/* $loeHome

+        chmod +x $loeHome/LoE.x86_64
        makeWrapper $loeHome/LoE.x86_64 $out/bin/LoE \
          --suffix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeDeps}"

--- a/pkgs/by-name/le/legends-of-equestria/update.sh
+++ b/pkgs/by-name/le/legends-of-equestria/update.sh
@ -21,7 +21,7 @@ findHash() {
    echo "unzipping to $(pwd)/out..." >&2
    unzip -q -d out download/*.zip

-    nix-hash --to-sri --type sha256 $(nix-hash --type sha256 out)
+    nix --extra-experimental-features nix-command hash path --sri out

    cd "$oldpwd"
 }
--- a/pkgs/by-name/le/lesstif/c-missing_xm_h.patch
+++ b/pkgs/by-name/le/lesstif/c-missing_xm_h.patch
@ -1,11 +0,0 @@
--- lesstif2-0.94.4.orig/include/Motif-2.1/Xm/XmStrDefs.h
-+++ lesstif2-0.94.4/include/Motif-2.1/Xm/XmStrDefs.h
-@@ -28,6 +28,8 @@
- 
- #include <X11/StringDefs.h>
- 
-+#include <Xm/Xm.h>
-+
- #ifdef __cplusplus
- extern "C" {
- #endif
--- a/pkgs/by-name/le/lesstif/c-render_table_crash.patch
+++ b/pkgs/by-name/le/lesstif/c-render_table_crash.patch
@ -1,11 +0,0 @@
--- lesstif2-0.95.0.orig/lib/Xm-2.1/RenderTable.c
-+++ lesstif2-0.95.0/lib/Xm-2.1/RenderTable.c
-@@ -465,7 +465,7 @@
- 	DEBUGOUT(_LtDebug(__FILE__, w, "_XmRenderTableFinaliseTag(%s)\n", tag));
- #if 1
- 	/* Experimental start */
-	if (r->dpy == 0)
-+	if (r->dpy == 0  &&  w)
- 		r->dpy = XtDisplay(w);
- 	/* Experimental end */
- #endif
--- a/pkgs/by-name/le/lesstif/c-xpmpipethrough.patch
+++ b/pkgs/by-name/le/lesstif/c-xpmpipethrough.patch
@ -1,381 +0,0 @@
-Index: lesstif2-0.95.0/lib/Xm-2.1/XpmRdFToI.c
-===================================================================
--- lesstif2-0.95.0.orig/lib/Xm-2.1/XpmRdFToI.c	2004-11-18 22:00:58.000000000 +0100
-+++ lesstif2-0.95.0/lib/Xm-2.1/XpmRdFToI.c	2006-07-11 11:13:29.000000000 +0200
-@@ -44,11 +44,15 @@
-    DebugUtil.h! */
- #include <stdio.h>
- #include <string.h>
-+#include <errno.h>
- 
- #include <ctype.h>
- #ifdef HAVE_SYS_TYPES_H
- #include <sys/types.h>
- #endif
-+#ifdef HAVE_SYS_WAIT_H
-+#include <sys/wait.h>
-+#endif
- #ifdef HAVE_SYS_STAT_H
- #include <sys/stat.h>
- #endif
-@@ -87,16 +91,6 @@
-  	    strcpy(dst, src); \
- 	else return (XpmFileInvalid); }
- #endif
-#include <sys/stat.h>
-#if !defined(NO_ZPIPE) && defined(WIN32)
-# define popen _popen
-# define pclose _pclose
-# if defined(STAT_ZFILE)
-#  include <io.h>
-#  define stat _stat
-#  define fstat _fstat
-# endif
-#endif
- 
- LFUNC(OpenReadFile, int, (char *filename, xpmData *mdata));
- LFUNC(xpmDataClose, void, (xpmData *mdata));
-@@ -173,90 +167,131 @@
- }
- #endif /* CXPMPROG */
- 
-/*
- * open the given file to be read as an xpmData which is returned.
- */
- #ifndef NO_ZPIPE
-	FILE *s_popen(char *cmd, const char *type);
-#else
-#	define s_popen popen
-+/* Do not depend on errno after read_through */
-+FILE*
-+xpmPipeThrough(fd, cmd, arg1, mode)
-+    int fd;
-+    const char* cmd;
-+    const char* arg1;
-+    const char* mode;
-+{
-+    FILE* fp;
-+    int status, fds[2], in = 0, out = 1;
-+    pid_t pid;
-+    if ( 'w' == *mode )
-+	out = 0, in = 1;
-+    if ( pipe(fds) < 0 )
-+	return NULL;
-+    pid = fork();
-+    if ( pid < 0 )
-+	goto fail1;
-+    if ( 0 == pid )
-+    {
-+	close(fds[in]);
-+	if ( dup2(fds[out], out) < 0 )
-+	    goto err;
-+	close(fds[out]);
-+	if ( dup2(fd, in) < 0 )
-+	    goto err;
-+	close(fd);
-+	pid = fork();
-+	if ( pid < 0 )
-+	    goto err;
-+	if ( 0 == pid )
-+	{
-+	    execlp(cmd, cmd, arg1, NULL);
-+	    perror(cmd);
-+	    goto err;
-+	}
-+	_exit(0);
-+    err:
-+	_exit(1);
-+    }
-+    close(fds[out]);
-+    /* calling process: wait for first child */
-+    while ( waitpid(pid, &status, 0) < 0 && EINTR == errno )
-+	;
-+    if ( WIFSIGNALED(status) ||
-+	 (WIFEXITED(status) && WEXITSTATUS(status) != 0) )
-+	goto fail2;
-+    fp = fdopen(fds[in], mode);
-+    if ( !fp )
-+	goto fail2;
-+    close(fd); /* still open in 2nd child */
-+    return fp;
-+fail1:
-+    close(fds[out]);
-+fail2:
-+    close(fds[in]);
-+    return NULL;
-+}
- #endif
- 
-+/*
-+ * open the given file to be read as an xpmData which is returned.
-+ */
- static int
- OpenReadFile(filename, mdata)
-     char *filename;
-     xpmData *mdata;
- {
-#ifndef NO_ZPIPE
-    char buf[BUFSIZ];
-# ifdef STAT_ZFILE
-    char *compressfile;
-    struct stat status;
-# endif
-#endif
-
-     if (!filename) {
- 	mdata->stream.file = (stdin);
- 	mdata->type = XPMFILE;
-     } else {
-#ifndef NO_ZPIPE
-	size_t len = strlen(filename);
-
-	if(len == 0                        ||
-	   filename[len-1] == '/')
-		return(XpmOpenFailed);
-	if ((len > 2) && !strcmp(".Z", filename + (len - 2))) {
-	    mdata->type = XPMPIPE;
-	    snprintf(buf, sizeof(buf), "uncompress -c \"%s\"", filename);
-	    if (!(mdata->stream.file = s_popen(buf, "r")))
-		return (XpmOpenFailed);
-
-	} else if ((len > 3) && !strcmp(".gz", filename + (len - 3))) {
-	    mdata->type = XPMPIPE;
-	    snprintf(buf, sizeof(buf), "gunzip -qc \"%s\"", filename);
-	    if (!(mdata->stream.file = s_popen(buf, "r")))
-		return (XpmOpenFailed);
-
-	} else {
-# ifdef STAT_ZFILE
-	    if (!(compressfile = (char *) XpmMalloc(len + 4)))
-+	int fd = open(filename, O_RDONLY);
-+#if defined(NO_ZPIPE)
-+	if ( fd < 0 )
-+	    return XpmOpenFailed;
-+#else
-+	const char* ext = NULL;
-+	if ( fd >= 0 )
-+	    ext = strrchr(filename, '.');
-+#ifdef STAT_ZFILE /* searching for z-files if the given name not found */
-+	else
-+	{
-+	    size_t len = strlen(filename);
-+	    char *compressfile = (char *) XpmMalloc(len + 4);
-+	    if ( !compressfile )
- 		return (XpmNoMemory);
-
-	    snprintf(compressfile, len+4, "%s.Z", filename);
-	    if (!stat(compressfile, &status)) {
-		snprintf(buf, sizeof(buf), "uncompress -c \"%s\"", compressfile);
-		if (!(mdata->stream.file = s_popen(buf, "r"))) {
-+	    strcpy(compressfile, filename);
-+	    strcpy(compressfile + len, ext = ".Z");
-+	    fd = open(compressfile, O_RDONLY);
-+	    if ( fd < 0 )
-+	    {
-+		strcpy(compressfile + len, ext = ".gz");
-+		fd = open(compressfile, O_RDONLY);
-+		if ( fd < 0 )
-+		{
- 		    XpmFree(compressfile);
-		    return (XpmOpenFailed);
-		}
-		mdata->type = XPMPIPE;
-	    } else {
-		snprintf(compressfile, len+4, "%s.gz", filename);
-		if (!stat(compressfile, &status)) {
-		    snprintf(buf, sizeof(buf), "gunzip -c \"%s\"", compressfile);
-		    if (!(mdata->stream.file = s_popen(buf, "r"))) {
-			XpmFree(compressfile);
-			return (XpmOpenFailed);
-		    }
-		    mdata->type = XPMPIPE;
-		} else {
-# endif
-#endif
-		    if (!(mdata->stream.file = fopen(filename, "r"))) {
-#if !defined(NO_ZPIPE) && defined(STAT_ZFILE)
-			XpmFree(compressfile);
-#endif
-			return (XpmOpenFailed);
-		    }
-		    mdata->type = XPMFILE;
-#ifndef NO_ZPIPE
-# ifdef STAT_ZFILE
-+		    return XpmOpenFailed;
- 		}
- 	    }
- 	    XpmFree(compressfile);
-# endif
- 	}
- #endif
-+	if ( ext && !strcmp(ext, ".Z") )
-+	{
-+	    mdata->type = XPMPIPE;
-+	    mdata->stream.file = xpmPipeThrough(fd, "uncompress", "-c", "r");
-+	}
-+	else if ( ext && !strcmp(ext, ".gz") )
-+	{
-+	    mdata->type = XPMPIPE;
-+	    mdata->stream.file = xpmPipeThrough(fd, "gunzip", "-qc", "r");
-+	}
-+	else
-+#endif /* z-files */
-+	{
-+	    mdata->type = XPMFILE;
-+	    mdata->stream.file = fdopen(fd, "r");
-+	}
-+	if (!mdata->stream.file)
-+	{
-+	    close(fd);
-+	    return (XpmOpenFailed);
-+	}
-     }
-     mdata->CommentLength = 0;
- #ifdef CXPMPROG
-@@ -273,15 +308,6 @@
- xpmDataClose(mdata)
-     xpmData *mdata;
- {
-    switch (mdata->type) {
-    case XPMFILE:
-	if (mdata->stream.file != (stdin))
-	    fclose(mdata->stream.file);
-	break;
-#ifndef NO_ZPIPE
-    case XPMPIPE:
-+    if (mdata->stream.file != (stdin))
- 	fclose(mdata->stream.file);
-	break;
-#endif
-    }
- }
-Index: lesstif2-0.95.0/lib/Xm-2.1/XpmWrFFrI.c
-===================================================================
--- lesstif2-0.95.0.orig/lib/Xm-2.1/XpmWrFFrI.c	2005-04-13 20:03:27.000000000 +0200
-+++ lesstif2-0.95.0/lib/Xm-2.1/XpmWrFFrI.c	2006-07-11 11:13:29.000000000 +0200
-@@ -50,11 +50,15 @@
-    DebugUtil.h! */
- #include <stdio.h>
- #include <string.h>
-+#include <errno.h>
- 
- #include <ctype.h>
- #ifdef HAVE_SYS_TYPES_H
- #include <sys/types.h>
- #endif
-+#ifdef HAVE_SYS_WAIT_H
-+#include <sys/wait.h>
-+#endif
- #ifdef HAVE_SYS_STAT_H
- #include <sys/stat.h>
- #endif
-@@ -94,11 +98,6 @@
- 	else return (XpmFileInvalid); }
- #endif
- 
-#if !defined(NO_ZPIPE) && defined(WIN32)
-# define popen _popen
-# define pclose _pclose
-#endif
-
- /* MS Windows define a function called WriteFile @#%#&!!! */
- LFUNC(xpmWriteFile, int, (FILE *file, XpmImage *image, char *name,
- 			  XpmInfo *info));
-@@ -354,58 +353,48 @@
-     fprintf(file, ",\n\"XPMENDEXT\"");
- }
- 
-+
-+#ifndef NO_ZPIPE
-+FUNC(xpmPipeThrough, FILE*, (int fd,
-+			     const char* cmd,
-+			     const char* arg1,
-+			     const char* mode));
-+#endif
-+
- /*
-  * open the given file to be written as an xpmData which is returned
-  */
-#ifndef NO_ZPIPE
-	FILE *s_popen(char *cmd, const char *type);
-#else
-#	define s_popen popen
-#endif
- static int
- OpenWriteFile(filename, mdata)
-     char *filename;
-     xpmData *mdata;
- {
-#ifndef NO_ZPIPE
-    char buf[BUFSIZ];
-
-#endif
-
-     if (!filename) {
- 	mdata->stream.file = (stdout);
- 	mdata->type = XPMFILE;
-     } else {
- #ifndef NO_ZPIPE
-	size_t len = strlen(filename);
-
-	if(len == 0                        ||
-	   filename[0] == '/'              ||
-	   strstr(filename, "../") != NULL ||
-	   filename[len-1] == '/')
-		return(XpmOpenFailed);
-
-+	size_t len;
-+#endif
-+	int fd = open(filename, O_WRONLY|O_CREAT|O_TRUNC, 0644);
-+	if ( fd < 0 )
-+	    return(XpmOpenFailed);
-+#ifndef NO_ZPIPE
-+	len = strlen(filename);
- 	if (len > 2 && !strcmp(".Z", filename + (len - 2))) {
-	    snprintf(buf, sizeof(buf), "compress > \"%s\"", filename);
-	    if (!(mdata->stream.file = s_popen(buf, "w")))
-		return (XpmOpenFailed);
-
-+	    mdata->stream.file = xpmPipeThrough(fd, "compress", NULL, "w");
- 	    mdata->type = XPMPIPE;
- 	} else if (len > 3 && !strcmp(".gz", filename + (len - 3))) {
-	    snprintf(buf, sizeof(buf), "gzip -q > \"%s\"", filename);
-	    if (!(mdata->stream.file = s_popen(buf, "w")))
-		return (XpmOpenFailed);
-
-+	    mdata->stream.file = xpmPipeThrough(fd, "gzip", "-q", "w");
- 	    mdata->type = XPMPIPE;
-	} else {
-+	} else
- #endif
-	    if (!(mdata->stream.file = fopen(filename, "w")))
-		return (XpmOpenFailed);
-
-+	{
-+	    mdata->stream.file = fdopen(fd, "w");
- 	    mdata->type = XPMFILE;
-#ifndef NO_ZPIPE
- 	}
-#endif
-+	if (!mdata->stream.file)
-+	    return (XpmOpenFailed);
-     }
-     return (XpmSuccess);
- }
-@@ -417,15 +406,6 @@
- xpmDataClose(mdata)
-     xpmData *mdata;
- {
-    switch (mdata->type) {
-    case XPMFILE:
-	if (mdata->stream.file != (stdout))
-	    fclose(mdata->stream.file);
-	break;
-#ifndef NO_ZPIPE
-    case XPMPIPE:
-+    if (mdata->stream.file != (stdout))
- 	fclose(mdata->stream.file);
-	break;
-#endif
-    }
- }
--- a/pkgs/by-name/le/lesstif/package.nix
+++ b/pkgs/by-name/le/lesstif/package.nix
@ -1,54 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  freetype,
-  fontconfig,
-  libICE,
-  libX11,
-  libXp,
-  libXau,
-  libXext,
-  libXt,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "lesstif";
-  version = "0.95.2";
-  src = fetchurl {
-    url = "mirror://sourceforge/lesstif/${pname}-${version}.tar.bz2";
-    sha256 = "1qzpxjjf7ri1jzv71mvq5m9g8hfaj5yzwp30rwxlm6n2b24a6jpb";
-  };
-  buildInputs = [
-    freetype
-    fontconfig
-    libICE
-    libX11
-    libXext
-    libXt
-  ];
-  propagatedBuildInputs = [
-    libXau
-    libXp
-  ];
-
-  # These patches fix a number of later issues - in particular the
-  # render_table_crash shows up in 'arb'. The same patches appear
-  # in Debian, so we assume they have been sent upstream.
-  #
-  patches = [
-    ./c-missing_xm_h.patch
-    ./c-render_table_crash.patch
-    ./c-xpmpipethrough.patch
-  ];
-
-  meta = with lib; {
-    description = "Open source clone of the Motif widget set";
-    homepage = "https://lesstif.sourceforge.net";
-    platforms = platforms.unix;
-    license = with licenses; [
-      gpl2
-      lgpl2
-    ];
-  };
-}
--- a/pkgs/by-name/li/libflowmanager/package.nix
+++ b/pkgs/by-name/li/libflowmanager/package.nix
@ -0,0 +1,44 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  pkg-config,
+  bison,
+  flex,
+  libtrace,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libflowmanager";
+  version = "3.0.0-3";
+
+  src = fetchFromGitHub {
+    owner = "LibtraceTeam";
+    repo = "libflowmanager";
+    tag = finalAttrs.version;
+    hash = "sha256-lQo8F4w+tu0DZgt0pnbEpwcL6buVbAuFoxtwGFXuGX4=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    bison
+    flex
+  ];
+  buildInputs = [ libtrace ];
+
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version-regex=^([0-9.-]+)$" ]; };
+
+  meta = {
+    description = "Library for assigning network packets to flows based on the standard 5-tuple";
+    homepage = "https://github.com/LibtraceTeam/libflowmanager";
+    changelog = "https://github.com/LibtraceTeam/libflowmanager/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.lgpl3Plus;
+    maintainers = with lib.maintainers; [ felbinger ];
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/by-name/li/libprotoident/package.nix
+++ b/pkgs/by-name/li/libprotoident/package.nix
@ -0,0 +1,48 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  pkg-config,
+  bison,
+  flex,
+  libtrace,
+  libflowmanager,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libprotoident";
+  version = "2.0.15-2";
+
+  src = fetchFromGitHub {
+    owner = "LibtraceTeam";
+    repo = "libprotoident";
+    tag = finalAttrs.version;
+    hash = "sha256-XiZ/UqF11eeeGudNXJqtTfPn5xWvHPKPrgqV7iHii0M=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    bison
+    flex
+  ];
+  buildInputs = [
+    libtrace
+    libflowmanager
+  ];
+
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version-regex=^([0-9.-]+)$" ]; };
+
+  meta = {
+    description = "Network traffic classification library that requires minimal application payload";
+    homepage = "https://github.com/LibtraceTeam/libprotoident";
+    changelog = "https://github.com/LibtraceTeam/libprotoident/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.lgpl3Plus;
+    maintainers = with lib.maintainers; [ felbinger ];
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/by-name/li/libtrace/package.nix
+++ b/pkgs/by-name/li/libtrace/package.nix
@ -0,0 +1,54 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  pkg-config,
+  bison,
+  flex,
+  zlib,
+  bzip2,
+  xz,
+  libpcap,
+  wandio,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libtrace";
+  version = "4.0.28-1";
+
+  src = fetchFromGitHub {
+    owner = "LibtraceTeam";
+    repo = "libtrace";
+    tag = finalAttrs.version;
+    hash = "sha256-impZrZOOORsQaUz04pkCXGxJkXGaCBcJD390hm74peA=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    bison
+    flex
+  ];
+  buildInputs = [
+    zlib
+    bzip2
+    xz
+    libpcap
+    wandio
+  ];
+
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version-regex=^([0-9.-]+)$" ]; };
+
+  meta = {
+    description = "C Library for working with network packet traces";
+    homepage = "https://github.com/LibtraceTeam/libtrace";
+    changelog = "https://github.com/LibtraceTeam/libtrace/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.lgpl3Only;
+    maintainers = with lib.maintainers; [ felbinger ];
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/by-name/li/lightwalletd/package.nix
+++ b/pkgs/by-name/li/lightwalletd/package.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "lightwalletd";
-  version = "0.4.16";
+  version = "0.4.18";

  src = fetchFromGitHub {
    owner = "zcash";
    repo = "lightwalletd";
    rev = "v${version}";
-    hash = "sha256-M9xfV2T8L+nssrJj29QmPiErNMpfpT8BY/30Vj8wPjY=";
+    hash = "sha256-YmSQjfqwTZC3NkPH6k7gwHcaYRURive5rc0MVOKWCi8=";
  };

-  vendorHash = "sha256-z5Hs+CkPswWhz+Ya5MyHKA3MZzQkvS7WOxNckElkg6U=";
+  vendorHash = "sha256-jAsX+BhVYbD/joCMT2vdDdRLqZOG9AfXmbRPJcJcQEw=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/mo/mold/package.nix
+++ b/pkgs/by-name/mo/mold/package.nix
@ -26,13 +26,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "mold";
-  version = "2.40.0";
+  version = "2.40.1";

  src = fetchFromGitHub {
    owner = "rui314";
    repo = "mold";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-8EqAgdlvg7BSCTmMubqbq2t77xGcUI2RWEw2iuK5UXo=";
+    hash = "sha256-161ATZkgoipFMRcI4x4TNqxbyWxM75Cmo/rL4Hn1JFQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/mo/monkeysAudio/package.nix
+++ b/pkgs/by-name/mo/monkeysAudio/package.nix
@ -6,12 +6,12 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "11.14";
+  version = "11.17";
  pname = "monkeys-audio";

  src = fetchzip {
    url = "https://monkeysaudio.com/files/MAC_${builtins.concatStringsSep "" (lib.strings.splitString "." finalAttrs.version)}_SDK.zip";
-    hash = "sha256-1JfAbC8Hs+t2rHiHK7jrKcS8AM0yg/G7tZME3lvAnWg=";
+    hash = "sha256-GPuor0A9NsObRr66HUYXCQJmM2EW87FyeMJiwB/K6Vc=";
    stripRoot = false;
  };

--- a/pkgs/by-name/mo/moon/package.nix
+++ b/pkgs/by-name/mo/moon/package.nix
@ -13,16 +13,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "moon";
-  version = "1.36.2";
+  version = "1.37.1";

  src = fetchFromGitHub {
    owner = "moonrepo";
    repo = "moon";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-CE9qhLIXQ72Ym8u1S4JzQ9NSbDSstQcAR4eQFn1lA0s=";
+    hash = "sha256-qPrrVk+rVEtLPJxhvgYCQ2CczwfGp/Pv1Ck+/FlimwI=";
  };

-  cargoHash = "sha256-i3lUyq3e+UL7I35FapprLWUoDoG9SmUorQmeoUfpC/k=";
+  cargoHash = "sha256-PEmCrE7GcH09buX5p+UoDgqdBCoY5mqmLxm+hNaz3Yo=";

  env = {
    RUSTFLAGS = "-C strip=symbols";
--- a/pkgs/by-name/ne/neomutt/package.nix
+++ b/pkgs/by-name/ne/neomutt/package.nix
@ -9,6 +9,7 @@
  ncurses,
  perl,
  cyrus_sasl,
+  gitUpdater,
  gss,
  gpgme,
  libkrb5,
@ -42,13 +43,13 @@ assert lib.warnIf (

 stdenv.mkDerivation (finalAttrs: {
  pname = "neomutt";
-  version = "20250113";
+  version = "20250510";

  src = fetchFromGitHub {
    owner = "neomutt";
    repo = "neomutt";
    tag = finalAttrs.version;
-    hash = "sha256-30uagr4Z748U34yaTpw0lqxifuMlQRqccuZHKpbkXVE=";
+    hash = "sha256-62J7qyHC3hSgEgTA2zB+BQtZb+5BUXjQEOB3vGZGSNw=";
  };

  buildInputs =
@ -163,6 +164,7 @@ stdenv.mkDerivation (finalAttrs: {
      rev = "8e97688693ca47ea1055f3d15055a4f4ecc5c832";
      hash = "sha256-tx5Y819rNDxOpjg3B/Y2lPcqJDArAxVwjbYarVmJ79k=";
    };
+    updateScript = gitUpdater { };
  };

  checkTarget = "test";
--- a/pkgs/by-name/ne/netcap/ndpi_4_0.nix
+++ b/pkgs/by-name/ne/netcap/ndpi_4_0.nix
@ -0,0 +1,32 @@
+{
+  ndpi,
+  fetchFromGitHub,
+  lib,
+  stdenv,
+  autoreconfHook,
+  autoconf,
+  automake,
+  fixDarwinDylibNames,
+}:
+
+ndpi.overrideAttrs (
+  finalAttrs: prevAttrs: {
+    version = "4.0";
+
+    src = fetchFromGitHub {
+      inherit (prevAttrs.src) owner repo;
+      tag = finalAttrs.version;
+      hash = "sha256-vWx6IVyxPJBgOkXpHdnvstvDGJbAtndFPtowpjLd32o=";
+    };
+
+    configureScript = "./autogen.sh";
+
+    nativeBuildInputs =
+      lib.remove autoreconfHook prevAttrs.nativeBuildInputs
+      ++ [
+        autoconf
+        automake
+      ]
+      ++ lib.optionals stdenv.hostPlatform.isDarwin [ fixDarwinDylibNames ];
+  }
+)
--- a/pkgs/by-name/ne/netcap/package.nix
+++ b/pkgs/by-name/ne/netcap/package.nix
@ -0,0 +1,92 @@
+{
+  lib,
+  callPackage,
+  buildGoModule,
+  fetchFromGitHub,
+  withDpi ? true,
+  libpcap,
+  libprotoident,
+  libflowmanager,
+  libtrace,
+  versionCheckHook,
+  nix-update-script,
+}:
+let
+  ndpi = callPackage ./ndpi_4_0.nix { };
+in
+buildGoModule (finalAttrs: {
+  pname = "netcap";
+  version = "0.6.11";
+
+  src = fetchFromGitHub {
+    owner = "dreadl0ck";
+    repo = "netcap";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-SCBKOIC/s+rfrVWmryp9EBp7ARpZZcxymsnZWtEHrhk=";
+  };
+
+  vendorHash = "sha256-MvHrJLhcFA0fEgK+YT0rwI6wIwTGMcLWQt6AYkx1eZM=";
+
+  subPackages = [ "cmd" ];
+
+  buildInputs =
+    [
+      libpcap
+    ]
+    ++ lib.optionals withDpi [
+      ndpi
+      libprotoident
+      libflowmanager
+      libtrace
+    ];
+
+  ldflags = [
+    "-s -w"
+  ];
+
+  tags = lib.optionals (!withDpi) [
+    "nodpi"
+  ];
+
+  CGO_LDFLAGS = lib.optionalString withDpi ''
+    -L${ndpi}/lib -lndpi
+    -L${libprotoident}/lib -lndpi
+  '';
+
+  CGO_CFLAGS = lib.optionalString withDpi ''
+    -I${ndpi}/include
+    -I${libprotoident}/include
+  '';
+
+  postInstall = ''
+    mv $out/bin/cmd $out/bin/net
+  '';
+
+  checkFlags =
+    let
+      skippedTests = [
+        # couldn't open packet socket: operation not permitted
+        "TestCaptureLive"
+        # requires local test data
+        "TestCapturePCAP"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/net";
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Framework for secure and scalable network traffic analysis";
+    homepage = "https://netcap.io";
+    downloadPage = "https://github.com/dreadl0ck/netcap";
+    changelog = "https://github.com/dreadl0ck/netcap/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ felbinger ];
+    mainProgram = "net";
+  };
+})
--- a/pkgs/by-name/nn/nng/package.nix
+++ b/pkgs/by-name/nn/nng/package.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "nng";
-  version = "1.10.1";
+  version = "1.11";

  src = fetchFromGitHub {
    owner = "nanomsg";
    repo = "nng";
    rev = "v${version}";
-    hash = "sha256-BBYfJ2j2IQkbluR3HQjEh1zFWPgOVX6kfyI0jG741Y4=";
+    hash = "sha256-yH/iK/DuVff2qby/wk6jJ9Tsmxrl9eMrb9bOxCzvmdA=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@ -49,7 +49,7 @@ buildGoModule (finalAttrs: {

  meta = {
    description = "Powerful terminal-based AI assistant providing intelligent coding assistance";
-    homepage = "https://github.com/opencode-ai/opencode";
+    homepage = "https://github.com/sst/opencode";
    changelog = "https://github.com/sst/opencode/releases/tag/v${finalAttrs.version}";
    mainProgram = "opencode";
    license = lib.licenses.mit;
--- a/pkgs/by-name/ph/phpunit/package.nix
+++ b/pkgs/by-name/ph/phpunit/package.nix
@ -10,16 +10,16 @@

 php.buildComposerProject2 (finalAttrs: {
  pname = "phpunit";
-  version = "12.1.6";
+  version = "12.2.2";

  src = fetchFromGitHub {
    owner = "sebastianbergmann";
    repo = "phpunit";
    tag = finalAttrs.version;
-    hash = "sha256-LfAG35k2cjwVJ0baaKfKP6VewHUihx4QnTDsfJihqs8=";
+    hash = "sha256-CcN+2EuniPvCB0WXKI4IOOWUfguOlVq7lSdYzBNccfs=";
  };

-  vendorHash = "sha256-ktWbLgexvz85mGnwvyfS2hXd9u7T0yqCr9MYUjSxRkU=";
+  vendorHash = "sha256-GLQNRoxwdGm4MWaxyqM4Va5qZgEXFO4AB8IMQL2TAws=";

  passthru = {
    updateScript = nix-update-script { };
--- a/pkgs/by-name/pi/pihole-web/package.nix
+++ b/pkgs/by-name/pi/pihole-web/package.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "pihole-web";
-  version = "6.1";
+  version = "6.2.1";

  src = fetchFromGitHub {
    owner = "pi-hole";
    repo = "web";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-+h4cPDsTAKR8MM+Za0mp2nOX1cHW8LRlFmLqvrBHfbs=";
+    hash = "sha256-pfKWOb+DJSRy9r2igx8voRpAPHKshVqYMoxOwoBWZLA=";
  };

  propagatedBuildInputs = [
@ -39,6 +39,8 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Pi-hole web dashboard displaying stats and more";
+    homepage = "https://github.com/pi-hole/web";
+    changelog = "https://github.com/pi-hole/FTL/releases/tag/v${finalAttrs.version}";
    longDescription = ''
      Pi-hole's Web interface (based off of AdminLTE) provides a central
      location to manage your Pi-hole and review the statistics generated by
--- a/pkgs/by-name/po/postgres-lsp/package.nix
+++ b/pkgs/by-name/po/postgres-lsp/package.nix
@ -6,18 +6,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "postgres-lsp";
-  version = "0.7.0";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "supabase-community";
    repo = "postgres-language-server";
    tag = finalAttrs.version;
-    hash = "sha256-78DUSoJwh310TAO0a8usa6+IwZhDdOCNys9fEAky3VY=";
+    hash = "sha256-H97FC4GmUktLFhLjrgHHwmX+qu014nIw2ccVIc54GiQ=";
    fetchSubmodules = true;
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-IxVuxDauxH3AzXirJ3Zq8QLSdUL3H3j/oSGqfNs0J20=";
+  cargoHash = "sha256-P5Q6VMy5DsMDA9r28lRH4MA8ZlXN0gRVe/ICeDfvBuQ=";

  nativeBuildInputs = [
    rustPlatform.bindgenHook
--- a/pkgs/by-name/pr/protonplus/package.nix
+++ b/pkgs/by-name/pr/protonplus/package.nix
@ -20,13 +20,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "protonplus";
-  version = "0.4.31";
+  version = "0.4.32";

  src = fetchFromGitHub {
    owner = "Vysp3r";
    repo = "protonplus";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-5UwgRvApKjMML5lx/UF7YHsXts4nQlg3GheAykN1f3E=";
+    hash = "sha256-5oabE5BR5PFDpxLu9Q9s0E18Aq45TQZA/+QFubfwiu0=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ra/rattler-build/package.nix
+++ b/pkgs/by-name/ra/rattler-build/package.nix
@ -14,17 +14,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rattler-build";
-  version = "0.42.1";
+  version = "0.43.1";

  src = fetchFromGitHub {
    owner = "prefix-dev";
    repo = "rattler-build";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-HeqE4FqkRBQNtJlirkLo6aVBo4S6QpKD8o6/B2DEya8=";
+    hash = "sha256-thpo6tD2qWs3FruqujoLd0WLuSDidI3/wdIDOlyEioU=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-/R4m3uApdFHJe2fJbdox2awO0Qbt496C1gTz7B0Owso=";
+  cargoHash = "sha256-eXsZ0tO1yR5A67GiQQHYv+i4tip7QDLa1oERkVJVQwk=";

  doCheck = false; # test requires network access

--- a/pkgs/by-name/re/readest/package.nix
+++ b/pkgs/by-name/re/readest/package.nix
@ -20,13 +20,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "readest";
-  version = "0.9.55";
+  version = "0.9.57";

  src = fetchFromGitHub {
    owner = "readest";
    repo = "readest";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-S6S2oC+e6sDBPuuivV7tG4OwYCJQaFtsQ09Vt2vzmgc=";
+    hash = "sha256-w4DhxjhejJ2Nh/3+/bEBJx3nRyAhr5lyzoPb/AFbVPc=";
    fetchSubmodules = true;
  };

@ -39,14 +39,14 @@ rustPlatform.buildRustPackage (finalAttrs: {

  pnpmDeps = pnpm_9.fetchDeps {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-XbXMtGYywK9GPOMYFdUoklYJ3memJOkUZrw0slzjifw=";
+    hash = "sha256-ejA0bUAB1CuPZMPA1a4XlbHR6CTrvKf/rPHolYjpcW8=";
  };

  pnpmRoot = "../..";

  useFetchCargoVendor = true;

-  cargoHash = "sha256-5DIagAKSq427kwZTH/QKY3vbb+TmFscKSANoSkEJMGg=";
+  cargoHash = "sha256-9y/ZR+vbjp56F/EuX7tAp3W1/jwFLYlnBKfyLNx0/Qg=";

  cargoRoot = "../..";

--- a/pkgs/by-name/rp/rpi-imager/lsblkCheckFix.patch
+++ b/pkgs/by-name/rp/rpi-imager/lsblkCheckFix.patch
@ -1,16 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 170ce7a..063a137 100644
--- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -332,11 +332,6 @@ else()
-         if (NOT LSBLK)
-             message(FATAL_ERROR "Unable to locate lsblk (used for disk enumeration)")
-         endif()
-
-        execute_process(COMMAND "${LSBLK}" "--json" OUTPUT_QUIET RESULT_VARIABLE ret)
-        if (ret EQUAL "1")
-            message(FATAL_ERROR "util-linux package too old. lsblk does not support --json (used for disk enumeration)")
-        endif()
-     endif()
-
-     configure_file(
--- a/pkgs/by-name/rp/rpi-imager/package.nix
+++ b/pkgs/by-name/rp/rpi-imager/package.nix
@ -12,18 +12,20 @@
  util-linux,
  xz,
  gnutls,
+  zstd,
+  libtasn1,
  enableTelemetry ? false,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "rpi-imager";
-  version = "1.9.0";
+  version = "1.9.4";

  src = fetchFromGitHub {
    owner = "raspberrypi";
    repo = "rpi-imager";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-7rkoOKG0yMSIgQjqBBFUMgX/4szHn2NXoBR+5PnKlH4=";
+    hash = "sha256-Ih7FeAKTKSvuwsrMgKQ0VEUYHHT6L99shxfAIjAzErk=";
  };

  sourceRoot = "${finalAttrs.src.name}/src";
@ -31,12 +33,13 @@ stdenv.mkDerivation (finalAttrs: {
  # By default, the builder checks for JSON support in lsblk by running "lsblk --json",
  # but that throws an error, as /sys/dev doesn't exist in the sandbox.
  # This patch removes the check.
-  patches = [ ./lsblkCheckFix.patch ];
+  # remove-vendoring.patch from
+  # https://gitlab.archlinux.org/archlinux/packaging/packages/rpi-imager/-/raw/main/remove-vendoring.patch
+  patches = [ ./remove-vendoring-and-lsblk-check.patch ];

-  # avoid duplicate path prefixes
  postPatch = ''
-    substituteInPlace dependencies/xz-5.6.2/CMakeLists.txt \
-      --replace-fail '\''${D}/' ""
+    substituteInPlace ../debian/org.raspberrypi.rpi-imager.desktop \
+      --replace-fail "/usr/bin/" ""
  '';

  nativeBuildInputs = [
@ -56,16 +59,23 @@ stdenv.mkDerivation (finalAttrs: {
      qt6.qttools
      xz
      gnutls
+      zstd
+      libtasn1
    ]
    ++ lib.optionals stdenv.hostPlatform.isLinux [
      qt6.qtwayland
    ];

-  # Disable telemetry and update check.
-  cmakeFlags = lib.optionals (!enableTelemetry) [
-    "-DENABLE_CHECK_VERSION=OFF"
-    "-DENABLE_TELEMETRY=OFF"
-  ];
+  cmakeFlags =
+    # Disable vendoring
+    [
+      (lib.cmakeBool "ENABLE_VENDORING" false)
+    ]
+    # Disable telemetry and update check.
+    ++ lib.optionals (!enableTelemetry) [
+      (lib.cmakeBool "ENABLE_CHECK_VERSION" false)
+      (lib.cmakeBool "ENABLE_TELEMETRY" false)
+    ];

  passthru = {
    tests.version = testers.testVersion {
--- a/pkgs/by-name/rp/rpi-imager/remove-vendoring-and-lsblk-check.patch
+++ b/pkgs/by-name/rp/rpi-imager/remove-vendoring-and-lsblk-check.patch
@ -0,0 +1,575 @@
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -4,6 +4,7 @@
+ cmake_minimum_required(VERSION 3.22)
+ OPTION (ENABLE_CHECK_VERSION "Check for version updates" ON)
+ OPTION (ENABLE_TELEMETRY "Enable sending telemetry" ON)
+OPTION (ENABLE_VENDORING "Use vendored dependencies" ON)
+ 
+ # We use FetchContent_Populate() instead of FetchContent_MakeAvailable() to allow EXCLUDE_FROM_ALL
+ # This prevents the dependencies from being built by default, which is our desired behavior
+@@ -58,410 +59,156 @@ if (APPLE)
+     endforeach()
+ endif(APPLE)
+ 
+## Preferentially build the bundled code. Full vendoring is to follow in a later version.
+
+ # Bundled code will occasionally use identical options - eg, BUILD_TESTING.
+ set(BUILD_TESTING OFF)
+ set(BUILD_STATIC_LIBS ON)
+ set(BUILD_SHARED_LIBS OFF)
+ 
+-include(FetchContent)
+-
+-# Bundled liblzma
+-set(LIBLZMA_VERSION "5.8.1")
+-FetchContent_Declare(xz
+-    GIT_REPOSITORY https://github.com/tukaani-project/xz.git
+-    GIT_TAG v${LIBLZMA_VERSION}
+-    ${USE_OVERRIDE_FIND_PACKAGE}
+-)
+-set(XZ_MICROLZMA_DECODER OFF CACHE BOOL "" FORCE)
+-set(XZ_MICROLZMA_ENCODER OFF CACHE BOOL "" FORCE)
+-set(XZ_LZIP_DECODER OFF CACHE BOOL "" FORCE)
+-set(XZ_ENABLE_SANDBOX OFF CACHE BOOL "" FORCE)
+-set(XZ_BUILD_SHARED_LIBS OFF CACHE BOOL "" FORCE)
+-set(XZ_ENABLE_DOXYGEN OFF CACHE BOOL "" FORCE)
+-set(XZ_DECODERS
+-    lzma1
+-    lzma2
+-    delta
+-)
+-set(XZ_ENCODERS
+-    lzma1
+-    lzma2
+-    delta
+-)
+-set(CREATE_LZMA_SYMLINKS OFF CACHE BOOL "" FORCE)
+-set(CREATE_XZ_SYMLINKS OFF CACHE BOOL "" FORCE)
+-FetchContent_GetProperties(xz)
+-if(NOT xz_POPULATED)
+-    FetchContent_Populate(xz)
+-    add_subdirectory(${xz_SOURCE_DIR} ${xz_BINARY_DIR} EXCLUDE_FROM_ALL)
+-endif()
+-unset(XZ_MICROLZMA_DECODER)
+-unset(XZ_MICROLZMA_ENCODER)
+-unset(XZ_LZIP_DECODER)
+-unset(XZ_ENABLE_SANDBOX)
+-unset(XZ_BUILD_SHARED_LIBS)
+-unset(XZ_ENABLE_DOXYGEN)
+-unset(CREATE_LZMA_SYMLINKS)
+-unset(CREATE_XZ_SYMLINKS)
+-set(LIBLZMA_FOUND true CACHE BOOL "" FORCE)
+-set(LIBLZMA_INCLUDE_DIR ${xz_SOURCE_DIR}/src/liblzma/api CACHE PATH "" FORCE)
+-set(LIBLZMA_INCLUDE_DIRS ${xz_SOURCE_DIR}/src/liblzma/api CACHE PATH "" FORCE)
+-set(LIBLZMA_LIBRARY liblzma CACHE FILEPATH "" FORCE)
+-set(LIBLZMA_LIBRARIES ${xz_BINARY_DIR}/liblzma.a CACHE FILEPATH "" FORCE)
+-set(LIBLZMA_HAS_AUTO_DECODER true CACHE BOOL "" FORCE)
+-set(LIBLZMA_HAS_EASY_ENCODER true CACHE BOOL "" FORCE)
+-set(LIBLZMA_HAS_LZMA_PRESET true CACHE BOOL "" FORCE)
+-
+-# Bundled zstd
+-set(ZSTD_VERSION "1.5.7")
+-FetchContent_Declare(zstd
+-    GIT_REPOSITORY https://github.com/facebook/zstd.git
+-    GIT_TAG v${ZSTD_VERSION}
+-    SOURCE_SUBDIR build/cmake
+-    ${USE_OVERRIDE_FIND_PACKAGE}
+-)
+-set(ZSTD_BUILD_PROGRAMS OFF CACHE BOOL "" FORCE)
+-set(ZSTD_BUILD_SHARED OFF CACHE BOOL "" FORCE)
+-set(ZSTD_BUILD_STATIC ON CACHE BOOL "" FORCE)
+-set(ZSTD_BUILD_TESTS OFF CACHE BOOL "" FORCE)
+-set(ZSTD_BUILD_DICTBUILDER OFF CACHE BOOL "" FORCE)
+-FetchContent_GetProperties(zstd)
+-if(NOT zstd_POPULATED)
+-    FetchContent_Populate(zstd)
+-    add_subdirectory(${zstd_SOURCE_DIR}/build/cmake ${zstd_BINARY_DIR} EXCLUDE_FROM_ALL)
+-endif()
+-unset(ZSTD_BUILD_PROGRAMS)
+-unset(ZSTD_BUILD_SHARED)
+-unset(ZSTD_BUILD_STATIC)
+-unset(ZSTD_BUILD_TESTS)
+-unset(ZSTD_BUILD_DICTBUILDER)
+-set(ZSTD_FOUND true CACHE BOOL "" FORCE)
+-set(Zstd_VERSION ${ZSTD_VERSION} CACHE STRING "" FORCE)
+-set(Zstd_INCLUDE_DIR ${CMAKE_CURRENT_BINARY_DIR}/_deps/zstd-src/lib CACHE PATH "" FORCE)
+-set(ZSTD_INCLUDE_DIR ${CMAKE_CURRENT_BINARY_DIR}/_deps/zstd-src/lib CACHE PATH "" FORCE)
+-set(Zstd_INCLUDE_DIRS ${CMAKE_CURRENT_BINARY_DIR}/_deps/zstd-src/lib CACHE PATH "" FORCE)
+-set(ZSTD_INCLUDE_DIRS ${CMAKE_CURRENT_BINARY_DIR}/_deps/zstd-src/lib CACHE PATH "" FORCE)
+-set(Zstd_LIBRARIES libzstd_static CACHE FILEPATH "" FORCE)
+-set(ZSTD_LIBRARIES libzstd_static CACHE FILEPATH "" FORCE)
+-set(ZSTD_LIBRARY ${CMAKE_CURRENT_BINARY_DIR}/_deps/zstd-build/lib/libzstd.a CACHE FILEPATH "" FORCE)
+-
+-# Remote nghttp2
+-set(NGHTTP2_VERSION "1.65.0")
+-FetchContent_Declare(nghttp2
+-    GIT_REPOSITORY https://github.com/nghttp2/nghttp2.git
+-    GIT_TAG        v${NGHTTP2_VERSION}
+-    ${USE_OVERRIDE_FIND_PACKAGE}
+-)
+-set(BUILD_EXAMPLES OFF)
+-set(ENABLE_LIB_ONLY ON)
+-set(ENABLE_FAILMALLOC OFF)
+-FetchContent_GetProperties(nghttp2)
+-if(NOT nghttp2_POPULATED)
+-    FetchContent_Populate(nghttp2)
+-    add_subdirectory(${nghttp2_SOURCE_DIR} ${nghttp2_BINARY_DIR} EXCLUDE_FROM_ALL)
+-endif()
+-unset(ENABLE_LIB_ONLY)
+-unset(ENABLE_FAILMALLOC)
+-unset(BUILD_EXAMPLES)
+-set(NGHTTP2_LIBRARIES nghttp2_static CACHE FILEPATH "" FORCE)
+-set(NGHTTP2_LIBRARY nghttp2_static CACHE FILEPATH "" FORCE)
+-set(NGHTTP2_INCLUDE_DIR ${nghttp2_SOURCE_DIR}/lib CACHE PATH "" FORCE)
+-set(NGHTTP2_INCLUDE_DIRS ${nghttp2_SOURCE_DIR}/lib CACHE PATH "" FORCE)
+-set(NGHTTP2_FOUND true CACHE BOOL "" FORCE)
+-
+-
+-# Bundled zlib
+-set(ZLIB_VERSION "1.4.1.1")
+-set(ZLIB_BUILD_EXAMPLES OFF CACHE BOOL "" FORCE)
+-set(ZLIB_BUILD_SHARED OFF CACHE BOOL "" FORCE)
+-set(ZLIB_BUILD_STATIC ON CACHE BOOL "" FORCE)
+-set(ZLIB_BUILD_TESTS OFF CACHE BOOL "" FORCE)
+-set(SKIP_INSTALL_ALL ON CACHE BOOL "" FORCE)
+-FetchContent_Declare(zlib
+-    GIT_REPOSITORY https://github.com/madler/zlib.git
+-    GIT_TAG 5a82f71ed1dfc0bec044d9702463dbdf84ea3b71 # v1.4.1.1, as of 27/05/2025
+-    ${USE_OVERRIDE_FIND_PACKAGE}
+-)
+-FetchContent_GetProperties(zlib)
+-if(NOT zlib_POPULATED)
+-    FetchContent_Populate(zlib)
+-    add_subdirectory(${zlib_SOURCE_DIR} ${zlib_BINARY_DIR} EXCLUDE_FROM_ALL)
+-endif()
+-unset(ZLIB_BUILD_EXAMPLES)
+-unset(ZLIB_BUILD_SHARED)
+-unset(ZLIB_BUILD_STATIC)
+-unset(ZLIB_BUILD_TESTS)
+-unset(SKIP_INSTALL_ALL)
+-# Set zlib variables that libarchive's CMake will use
+-set(ZLIB_USE_STATIC_LIBS ON CACHE BOOL "" FORCE) # This is to help FindZlib.cmake find the static library over the shared one
+-set(ZLIB_ROOT ${zlib_SOURCE_DIR} CACHE PATH "" FORCE)
+-
+-# On Windows with MinGW, zlib builds with .a extension, not .lib
+-# Set the correct library path before find_package
+-if (WIN32 AND CMAKE_COMPILER_IS_GNUCXX)
+-    set(ZLIB_LIBRARY ${zlib_BINARY_DIR}/libzlibstatic.a CACHE FILEPATH "" FORCE)
+-    set(ZLIB_LIBRARIES ${zlib_BINARY_DIR}/libzlibstatic.a CACHE STRING "" FORCE)
+-else()
+-    set(ZLIB_LIBRARY ${zlib_BINARY_DIR}/libz.a CACHE FILEPATH "" FORCE)
+-    set(ZLIB_LIBRARIES ${zlib_BINARY_DIR}/libz.a CACHE STRING "" FORCE)
+-endif()
+-
+-# Since we're building zlib ourselves with EXCLUDE_FROM_ALL, we don't need find_package
+-# Instead, we'll create the ZLIB::ZLIB target manually and set all required variables
+-set(ZLIB_INCLUDE_DIR ${zlib_SOURCE_DIR} CACHE PATH "" FORCE)
+-set(ZLIB_INCLUDE_DIRS ${zlib_SOURCE_DIR} CACHE PATH "" FORCE)
+-
+-# Create ZLIB::ZLIB target manually since we're not using find_package
+-# Set zlib variables that other packages expect
+-set(ZLIB_FOUND TRUE CACHE BOOL "" FORCE)
+-add_library(ZLIB::ZLIB STATIC IMPORTED)
+-if (WIN32 AND CMAKE_COMPILER_IS_GNUCXX)
+-    set_target_properties(ZLIB::ZLIB PROPERTIES
+-        IMPORTED_LOCATION "${zlib_BINARY_DIR}/libzlibstatic.a"
+-        INTERFACE_INCLUDE_DIRECTORIES "${zlib_SOURCE_DIR};${zlib_BINARY_DIR}"
+-    )
+-    add_dependencies(ZLIB::ZLIB zlibstatic)
+-else()
+-    set_target_properties(ZLIB::ZLIB PROPERTIES
+-        IMPORTED_LOCATION "${zlib_BINARY_DIR}/libz.a"
+-        INTERFACE_INCLUDE_DIRECTORIES "${zlib_SOURCE_DIR};${zlib_BINARY_DIR}"
+if(ENABLE_VENDORING)
+    # Bundled liblzma
+    set(XZ_MICROLZMA_DECODER OFF)
+    set(XZ_MICROLZMA_ENCODER OFF)
+    set(XZ_LZIP_DECODER OFF)
+    set(XZ_ENABLE_SANDBOX OFF)
+    set(XZ_BUILD_SHARED_LIBS OFF)
+    set(XZ_ENABLE_DOXYGEN OFF)
+    set(XZ_DECODERS
+        lzma1
+        lzma2
+        delta
+     )
+-    add_dependencies(ZLIB::ZLIB zlibstatic)
+-endif()
+-
+-# Debug output
+-message(STATUS "ZLIB_LIBRARY set to: ${ZLIB_LIBRARY}")
+-message(STATUS "ZLIB_LIBRARIES set to: ${ZLIB_LIBRARIES}")
+-message(STATUS "ZLIB_INCLUDE_DIRS set to: ${ZLIB_INCLUDE_DIRS}")
+-
+-# Bundled libarchive
+-
+-set(ENABLE_WERROR OFF CACHE BOOL "")
+-set(ENABLE_INSTALL OFF CACHE BOOL "")
+-set(ENABLE_TEST OFF CACHE BOOL "")
+-set(ENABLE_CNG OFF CACHE BOOL "")
+-set(ENABLE_MBEDTLS OFF CACHE BOOL "")
+-set(ENABLE_NETTLE OFF CACHE BOOL "")
+-set(ENABLE_OPENSSL OFF CACHE BOOL "")
+-# Configure libarchive with explicit zlib support
+-set(ENABLE_ZLIB ON CACHE BOOL "")
+-set(ENABLE_BZip2 OFF CACHE BOOL "")
+-set(ENABLE_LZ4 OFF CACHE BOOL "")
+-set(ENABLE_LZO OFF CACHE BOOL "")
+-set(ENABLE_LIBB2 OFF CACHE BOOL "")
+-set(ENABLE_LIBXML2 OFF CACHE BOOL "")
+-set(ENABLE_EXPAT OFF CACHE BOOL "")
+-set(ENABLE_PCREPOSIX OFF CACHE BOOL "")
+-set(ENABLE_PCRE2POSIX OFF CACHE BOOL "")
+-set(ENABLE_LIBGCC OFF CACHE BOOL "")
+-set(ENABLE_TAR OFF CACHE BOOL "")
+-set(ENABLE_CPIO OFF CACHE BOOL "")
+-set(ENABLE_CAT OFF CACHE BOOL "")
+-set(BUILD_SHARED_LIBS OFF CACHE BOOL "")
+-set(ARCHIVE_BUILD_STATIC_LIBS ON CACHE BOOL "")
+-set(ARCHIVE_BUILD_EXAMPLES OFF CACHE BOOL "")
+-set(ENABLE_ZSTD ON CACHE BOOL "")
+-set(POSIX_REGEX_LIB "libc" CACHE STRING "" FORCE)
+-set(LIBARCHIVE_VERSION "3.8.0")
+-
+-# Create a patch script to fix ZSTD detection in libarchive
+-set(LIBARCHIVE_PATCH_FILE "${CMAKE_CURRENT_BINARY_DIR}/libarchive_zstd_patch.cmake")
+-file(WRITE ${LIBARCHIVE_PATCH_FILE} "
+-# Read the original CMakeLists.txt
+-file(READ \"\${CMAKE_CURRENT_SOURCE_DIR}/CMakeLists.txt\" CONTENT)
+-
+-# Find the start and end of the ZSTD section
+-string(FIND \"\${CONTENT}\" \"IF(ZSTD_FOUND)\" ZSTD_START)
+-string(FIND \"\${CONTENT}\" \"MARK_AS_ADVANCED(CLEAR ZSTD_INCLUDE_DIR)\" ZSTD_END)
+-
+-if(ZSTD_START GREATER -1 AND ZSTD_END GREATER -1)
+-    # Calculate positions
+-    math(EXPR ZSTD_END \"\${ZSTD_END} + 40\") # Length of \"MARK_AS_ADVANCED(CLEAR ZSTD_INCLUDE_DIR)\"
+-    
+-    # Extract parts before and after the ZSTD section
+-    string(SUBSTRING \"\${CONTENT}\" 0 \${ZSTD_START} BEFORE_ZSTD)
+-    string(SUBSTRING \"\${CONTENT}\" \${ZSTD_END} -1 AFTER_ZSTD)
+-    
+-    # Create the new ZSTD section
+-    set(NEW_ZSTD_SECTION \"IF(ZSTD_FOUND)
+-  SET(HAVE_ZSTD_H 1)
+-  INCLUDE_DIRECTORIES(\\\${ZSTD_INCLUDE_DIR})
+-  LIST(APPEND ADDITIONAL_LIBS \\\${ZSTD_LIBRARY})
+-  
+-  # Check if ZSTD variables were provided externally (indicating static build)
+-  get_property(ZSTD_LIB_IS_CACHE CACHE ZSTD_LIBRARY PROPERTY TYPE)
+-  get_property(ZSTD_INC_IS_CACHE CACHE ZSTD_INCLUDE_DIR PROPERTY TYPE)
+-  if(ZSTD_LIB_IS_CACHE AND ZSTD_INC_IS_CACHE)
+-    # Skip function checks for static builds and assume all functions are available
+-    message(STATUS \\\"Using provided ZSTD library: \\\${ZSTD_LIBRARY}\\\")
+-    SET(HAVE_LIBZSTD 1)
+-    SET(HAVE_ZSTD_compressStream 1)
+-    SET(HAVE_ZSTD_minCLevel 1)
+-  else()
+-    # Original function checks for dynamic builds
+-    CMAKE_PUSH_CHECK_STATE()
+-    SET(CMAKE_REQUIRED_LIBRARIES \\\${ZSTD_LIBRARY})
+-    SET(CMAKE_REQUIRED_INCLUDES \\\${ZSTD_INCLUDE_DIR})
+-    CHECK_FUNCTION_EXISTS(ZSTD_decompressStream HAVE_LIBZSTD)
+-    CHECK_FUNCTION_EXISTS(ZSTD_compressStream HAVE_ZSTD_compressStream)
+-    CHECK_FUNCTION_EXISTS(ZSTD_minCLevel HAVE_ZSTD_minCLevel)
+-    CMAKE_POP_CHECK_STATE()
+-  endif()
+-ENDIF(ZSTD_FOUND)
+-MARK_AS_ADVANCED(CLEAR ZSTD_INCLUDE_DIR)\")
+-    
+-    # Combine the parts
+-    set(NEW_CONTENT \"\${BEFORE_ZSTD}\${NEW_ZSTD_SECTION}\")
+-    
+-    # Write the modified content back
+-    file(WRITE \"\${CMAKE_CURRENT_SOURCE_DIR}/CMakeLists.txt\" \"\${NEW_CONTENT}\${AFTER_ZSTD}\")
+-    message(STATUS \"Patched libarchive CMakeLists.txt for static ZSTD support\")
+-else()
+-    message(WARNING \"Could not find ZSTD section in libarchive CMakeLists.txt\")
+-endif()
+-")
+-
+-FetchContent_Declare(libarchive
+-    GIT_REPOSITORY https://github.com/libarchive/libarchive.git
+-    GIT_TAG v${LIBARCHIVE_VERSION}
+-    PATCH_COMMAND ${CMAKE_COMMAND} -P ${LIBARCHIVE_PATCH_FILE}
+-    ${USE_OVERRIDE_FIND_PACKAGE}
+-)
+-FetchContent_GetProperties(libarchive)
+-if(NOT libarchive_POPULATED)
+-    FetchContent_Populate(libarchive)
+-    add_subdirectory(${libarchive_SOURCE_DIR} ${libarchive_BINARY_DIR} EXCLUDE_FROM_ALL)
+-endif()
+-
+-# Ensure libarchive is built after zlib
+-if (TARGET archive_static AND TARGET ZLIB::ZLIB)
+-    add_dependencies(archive_static ZLIB::ZLIB)
+-endif()
+-
+-unset(POSIX_REGEX_LIB)
+-unset(ENABLE_WERROR)
+-unset(ENABLE_INSTALL)
+-unset(ENABLE_TEST)
+-unset(ENABLE_CNG)
+-unset(ENABLE_MBEDTLS)
+-unset(ENABLE_NETTLE)
+-unset(ENABLE_OPENSSL)
+-unset(ENABLE_ZLIB)
+-unset(ENABLE_BZip2)
+-unset(ENABLE_LZ4)
+-unset(ENABLE_LZO)
+-unset(ENABLE_LIBB2)
+-unset(ENABLE_LIBXML2)
+-unset(ENABLE_EXPAT)
+-unset(ENABLE_PCREPOSIX)
+-unset(ENABLE_PCRE2POSIX)
+-unset(ENABLE_LIBGCC)
+-unset(ENABLE_TAR)
+-unset(ENABLE_CPIO)
+-unset(ENABLE_CAT)
+-unset(ARCHIVE_BUILD_SHARED_LIBS)
+-unset(ENABLE_ZSTD)
+-set(LibArchive_FOUND true CACHE BOOL "" FORCE)
+-set(LibArchive_LIBRARIES archive_static CACHE FILEPATH "" FORCE)
+-set(LibArchive_INCLUDE_DIR ${libarchive_SOURCE_DIR}/libarchive CACHE PATH "" FORCE)
+-set(LibArchive_INCLUDE_DIRS ${libarchive_SOURCE_DIR}/libarchive CACHE PATH "" FORCE)
+-
+-# Bundled libcurl
+-set(CURL_VERSION "8.13.0")
+-string(REPLACE "." "_" CURL_TAG ${CURL_VERSION})
+-FetchContent_Declare(curl
+-    GIT_REPOSITORY https://github.com/curl/curl.git
+-    GIT_TAG curl-${CURL_TAG}
+-    ${USE_OVERRIDE_FIND_PACKAGE}
+-)
+-set(BUILD_CURL_EXE OFF CACHE BOOL "" FORCE)
+-set(BUILD_LIBCURL_DOCS OFF CACHE BOOL "" FORCE)
+-set(BUILD_MISC_DOCS OFF CACHE BOOL "" FORCE)
+-set(ENABLE_CURL_MANUAL OFF CACHE BOOL "" FORCE)
+-set(BUILD_EXAMPLES OFF CACHE BOOL "" FORCE)
+-set(CURL_USE_LIBPSL OFF CACHE BOOL "" FORCE)
+-set(CURL_USE_LIBSSH2 OFF CACHE BOOL "" FORCE)
+-set(CURL_DISABLE_ALTSVC ON CACHE BOOL "" FORCE)
+-set(CURL_DISABLE_KERBEROS_AUTH ON CACHE BOOL "" FORCE)
+-set(CURL_DISABLE_DICT ON CACHE BOOL "" FORCE)
+-set(CURL_DISABLE_DISABLE_FORM_API ON CACHE BOOL "" FORCE)
+-set(CURL_DISABLE_FTP ON CACHE BOOL "" FORCE)
+-set(CURL_DISABLE_GOPHER ON CACHE BOOL "" FORCE)
+-set(CURL_DISABLE_IMAP ON CACHE BOOL "" FORCE)
+-set(CURL_DISABLE_LDAP ON CACHE BOOL "" FORCE)
+-set(CURL_DISABLE_LDAPS ON CACHE BOOL "" FORCE)
+-set(CURL_DISABLE_MQTT ON CACHE BOOL "" FORCE)
+-set(CURL_DISABLE_NETRC ON CACHE BOOL "" FORCE)
+-set(CURL_DISABLE_POP3 ON CACHE BOOL "" FORCE)
+-set(CURL_DISABLE_RTSP ON CACHE BOOL "" FORCE)
+-set(CURL_DISABLE_SMTP ON CACHE BOOL "" FORCE)
+-set(CURL_DISABLE_TELNET ON CACHE BOOL "" FORCE)
+-set(CURL_DISABLE_TFTP ON CACHE BOOL "" FORCE)
+-set(CURL_ZSTD ON)
+-set(CURL_ENABLE_EXPORT_TARGET OFF CACHE BOOL "" FORCE)
+-set(CURL_DISABLE_INSTALL ON)
+-if (APPLE)
+-    # TODO: SecureTransport is a deprecated API in macOS, supporting
+-    #       only up to TLS v1.2. cURL has not implemented the replacement,
+-    #       Network.framework, and so we will need to select an alternative.
+-    #       Best recommendation: Libressl, as used by Apple in the curl binary
+-    #       on macOS.
+-    set(CURL_USE_SECTRANSP ON)
+-    set(CURL_DEFAULT_SSL_BACKEND "secure-transport")
+-    set(USE_APPLE_IDN ON)
+-else()
+-    if (WIN32)
+-        set(CURL_USE_SCHANNEL ON)
+-        set(CURL_DEFAULT_SSL_BACKEND "schannel")
+-    else ()
+-        set(CURL_USE_GNUTLS ON)
+-        set(CURL_DEFAULT_SSL_BACKEND "gnutls")
+-    endif(WIN32)
+-endif(APPLE)
+-
+-FetchContent_GetProperties(curl)
+-if(NOT curl_POPULATED)
+-    FetchContent_Populate(curl)
+-    add_subdirectory(${curl_SOURCE_DIR} ${curl_BINARY_DIR} EXCLUDE_FROM_ALL)
+    set(XZ_ENCODERS "")
+    set(CREATE_LZMA_SYMLINKS OFF)
+    set(CREATE_XZ_SYMLINKS OFF)
+    add_subdirectory(dependencies/xz-5.8.1)
+    set(LIBLZMA_FOUND true)
+    set(LIBLZMA_INCLUDE_DIR ${CMAKE_CURRENT_LIST_DIR}/dependencies/xz-5.8.1/src/liblzma/api FORCE)
+    set(LIBLZMA_INCLUDE_DIRS ${CMAKE_CURRENT_LIST_DIR}/dependencies/xz-5.8.1/src/liblzma/api FORCE)
+    set(LIBLZMA_LIBRARY liblzma)
+    set(LIBLZMA_LIBRARIES liblzma)
+
+    # Bundled zstd
+    set(ZSTD_BUILD_PROGRAMS OFF CACHE BOOL "" FORCE)
+    set(ZSTD_BUILD_SHARED OFF CACHE BOOL "" FORCE)
+    set(ZSTD_BUILD_TESTS OFF CACHE BOOL "" FORCE)
+    set(ZSTD_BUILD_DICTBUILDER OFF CACHE BOOL "" FORCE)
+    add_subdirectory(dependencies/zstd-1.5.7/build/cmake)
+    set(Zstd_FOUND true)
+    set(ZSTD_FOUND true)
+    set(Zstd_VERSION "1.5.7")
+    set(ZSTD_VERSION "1.5.7")
+    set(Zstd_INCLUDE_DIR ${CMAKE_CURRENT_LIST_DIR}/dependencies/zstd-1.5.7/lib)
+    set(ZSTD_INCLUDE_DIR ${CMAKE_CURRENT_LIST_DIR}/dependencies/zstd-1.5.7/lib)
+    set(Zstd_INCLUDE_DIRS ${CMAKE_CURRENT_LIST_DIR}/dependencies/zstd-1.5.7/lib)
+    set(ZSTD_INCLUDE_DIRS ${CMAKE_CURRENT_LIST_DIR}/dependencies/zstd-1.5.7/lib)
+    set(Zstd_LIBRARIES libzstd_static)
+    set(ZSTD_LIBRARIES libzstd_static)
+    set(ZSTD_LIBRARY libzstd_static)
+
+    # Bundled zlib
+    set(ZLIB_BUILD_EXAMPLES OFF)
+    set(SKIP_INSTALL_ALL ON)
+    add_subdirectory(dependencies/zlib-1.4.1.1)
+    set(ZLIB_FOUND TRUE)
+    set(ZLIB_INCLUDE_DIR ${CMAKE_CURRENT_LIST_DIR}/dependencies/zlib-1.4.1.1 CACHE PATH "zlib include dir")
+    set(ZLIB_INCLUDE_DIRS ${CMAKE_CURRENT_LIST_DIR}/dependencies/zlib-1.4.1.1 CACHE PATH "zlib include dir")
+    set(ZLIB_LIBRARY zlibstatic)
+    set(ZLIB_LIBRARIES zlibstatic)
+
+    # Bundled libarchive
+    set(ARCHIVE_ENABLE_WERROR OFF CACHE BOOL "")
+    set(ARCHIVE_ENABLE_INSTALL OFF CACHE BOOL "")
+    set(ARCHIVE_ENABLE_TEST OFF CACHE BOOL "")
+    set(ARCHIVE_ENABLE_CNG OFF CACHE BOOL "")
+    set(ARCHIVE_ENABLE_MBEDTLS OFF CACHE BOOL "")
+    set(ARCHIVE_ENABLE_NETTLE OFF CACHE BOOL "")
+    set(ARCHIVE_ENABLE_OPENSSL OFF CACHE BOOL "")
+    set(ARCHIVE_ENABLE_BZip2 OFF CACHE BOOL "")
+    set(ARCHIVE_ENABLE_LZ4 OFF CACHE BOOL "")
+    set(ARCHIVE_ENABLE_LZO OFF CACHE BOOL "")
+    set(ARCHIVE_ENABLE_LIBB2 OFF CACHE BOOL "")
+    set(ARCHIVE_ENABLE_LIBXML2 OFF CACHE BOOL "")
+    set(ARCHIVE_ENABLE_EXPAT OFF CACHE BOOL "")
+    set(ARCHIVE_ENABLE_PCREPOSIX OFF CACHE BOOL "")
+    set(ARCHIVE_ENABLE_PCRE2POSIX OFF CACHE BOOL "")
+    set(ARCHIVE_ENABLE_LIBGCC OFF CACHE BOOL "")
+    set(ARCHIVE_ENABLE_TAR OFF CACHE BOOL "")
+    set(ARCHIVE_ENABLE_CPIO OFF CACHE BOOL "")
+    set(ARCHIVE_ENABLE_CAT OFF CACHE BOOL "")
+    set(ARCHIVE_BUILD_SHARED_LIBS OFF CACHE BOOL "")
+    add_subdirectory(dependencies/libarchive-3.7.7)
+    set(LibArchive_FOUND true)
+    set(LibArchive_LIBRARIES archive_static)
+    set(LibArchive_INCLUDE_DIR ${CMAKE_CURRENT_LIST_DIR}/dependencies/libarchive-3.7.8/libarchive)
+
+    # Bundled libcurl
+    set(CMAKE_CURL_INCLUDES)
+    set(BUILD_CURL_EXE OFF CACHE BOOL "" FORCE)
+    set(BUILD_LIBCURL_DOCS OFF CACHE BOOL "" FORCE)
+    set(ENABLE_CURL_MANUAL OFF CACHE BOOL "" FORCE)
+    set(CURL_USE_LIBPSL OFF)
+    set(CURL_USE_LIBSSH2 OFF)
+    set(CURL_DISABLE_ALTSVC ON)
+    set(CURL_DISABLE_KERBEROS_AUTH ON)
+    set(CURL_DISABLE_DICT ON)
+    set(CURL_DISABLE_DISABLE_FORM_API ON)
+    set(CURL_DISABLE_FTP ON)
+    set(CURL_DISABLE_GOPHER ON)
+    set(CURL_DISABLE_IMAP ON)
+    set(CURL_DISABLE_LDAP ON)
+    set(CURL_DISABLE_LDAPS ON)
+    set(CURL_DISABLE_MQTT ON)
+    set(CURL_DISABLE_NETRC ON)
+    set(CURL_DISABLE_POP3 ON)
+    set(CURL_DISABLE_RTSP ON)
+    set(CURL_DISABLE_SMTP ON)
+    set(CURL_DISABLE_TELNET ON)
+    set(CURL_DISABLE_TFTP ON)
+    set(CURL_ZSTD ON)
+    set(CURL_ENABLE_EXPORT_TARGET OFF CACHE BOOL "" FORCE)
+    set(CURL_DISABLE_INSTALL ON)
+    if (APPLE)
+        # TODO: SecureTransport is a deprecated API in macOS, supporting
+        #       only up to TLS v1.2. cURL has not implemented the replacement,
+        #       Network.framework, and so we will need to select an alternative.
+        #       Best recommendation: Libressl, as used by Apple in the curl binary
+        #       on macOS.
+        set(CURL_USE_SECTRANSP ON)
+        set(CURL_DEFAULT_SSL_BACKEND "secure-transport")
+        set(USE_APPLE_IDN ON)
+    else()
+        if (WIN32)
+            set(CURL_USE_SCHANNEL ON)
+            set(CURL_DEFAULT_SSL_BACKEND "schannel")
+        else ()
+            set(CURL_USE_GNUTLS ON)
+            set(CURL_DEFAULT_SSL_BACKEND "gnutls")
+        endif(WIN32)
+    endif(APPLE)
+
+    add_subdirectory(dependencies/curl-8.13.0)
+    set(CURL_FOUND true)
+    set(CURL_LIBRARIES libcurl_static)
+    set(CURL_INCLUDE_DIR ${CMAKE_CURRENT_LIST_DIR}/dependencies/curl-8.13.0/include)
+    set(CURL_INCLUDE_DIRS ${CMAKE_CURRENT_LIST_DIR}/dependencies/curl-8.13.0/include)
+
+elseif (NOT ENABLE_VENDORING AND UNIX)
+    # Find the libraries that were subject to vendoring in the system instead,
+    # To keep the possibility of delivery via Linux distro packages
+    find_package(ZLIB)
+    if(ZLIB_FOUND)
+        set(EXTRALIBS ${EXTRALIBS} ZLIB::ZLIB)
+    endif()
+    find_package(LibLZMA)
+    if(LIBLZMA_FOUND)
+        set(EXTRALIBS ${EXTRALIBS} LibLZMA::LibLZMA)
+    endif()
+    find_package(CURL 8.13.0 REQUIRED)
+    find_package(LibArchive 3.7.8 REQUIRED)
+ endif()
+ 
+-unset(BUILD_CURL_EXE)
+-unset(BUILD_LIBCURL_DOCS)
+-unset(BUILD_MISC_DOCS)
+-unset(ENABLE_CURL_MANUAL)
+-unset(BUILD_EXAMPLES)
+-unset(CURL_USE_LIBPSL)
+-unset(CURL_USE_LIBSSH2)
+-unset(CURL_DISABLE_ALTSVC)
+-unset(CURL_DISABLE_KERBEROS_AUTH)
+-unset(CURL_DISABLE_DICT)
+-unset(CURL_DISABLE_DISABLE_FORM_API)
+-unset(CURL_DISABLE_FTP)
+-unset(CURL_DISABLE_GOPHER)
+-unset(CURL_DISABLE_IMAP)
+-unset(CURL_DISABLE_LDAP)
+-unset(CURL_DISABLE_LDAPS)
+-unset(CURL_DISABLE_MQTT)
+-unset(CURL_DISABLE_NETRC)
+-unset(CURL_DISABLE_POP3)
+-unset(CURL_DISABLE_RTSP)
+-unset(CURL_DISABLE_SMTP)
+-unset(CURL_DISABLE_TELNET)
+-unset(CURL_DISABLE_TFTP)
+-unset(CURL_ZSTD)
+-unset(CURL_ENABLE_EXPORT_TARGET)
+-unset(CURL_DISABLE_INSTALL)
+-unset(CURL_USE_SECTRANSP)
+-unset(CURL_DEFAULT_SSL_BACKEND)
+-unset(USE_APPLE_IDN)
+-unset(CURL_USE_SCHANNEL)
+-unset(CURL_USE_GNUTLS)
+-
+-set(CURL_FOUND true CACHE BOOL "" FORCE)
+-set(CURL_LIBRARIES libcurl_static CACHE FILEPATH "" FORCE)
+-set(CURL_INCLUDE_DIR ${curl_SOURCE_DIR}/include CACHE PATH "" FORCE)
+-set(CURL_INCLUDE_DIRS ${curl_SOURCE_DIR}/include CACHE PATH "" FORCE)
+-
+ # Adding headers explicity so they are displayed in Qt Creator
+ set(HEADERS config.h imagewriter.h networkaccessmanagerfactory.h nan.h drivelistitem.h drivelistmodel.h drivelistmodelpollthread.h driveformatthread.h powersaveblocker.h cli.h
+     devicewrapper.h devicewrapperblockcacheentry.h devicewrapperpartition.h devicewrapperstructs.h devicewrapperfatpartition.h wlancredentials.h
+@@ -928,11 +675,6 @@ else()
+         if (NOT LSBLK)
+             message(FATAL_ERROR "Unable to locate lsblk (used for disk enumeration)")
+         endif()
+-
+-        execute_process(COMMAND "${LSBLK}" "--json" OUTPUT_QUIET RESULT_VARIABLE ret)
+-        if (ret EQUAL "1")
+-            message(FATAL_ERROR "util-linux package too old. lsblk does not support --json (used for disk enumeration)")
+-        endif()
+     endif()
+ 
+     install(TARGETS ${PROJECT_NAME} DESTINATION bin)
--- a/pkgs/by-name/sa/salt/package.nix
+++ b/pkgs/by-name/sa/salt/package.nix
@ -12,12 +12,12 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "salt";
-  version = "3007.1";
+  version = "3007.4";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-uTOsTLPksRGLRtraVcnMa9xvD5S0ySh3rsRLJcaijJo=";
+    hash = "sha256-T7e2RVlJaGUX3IlafFpC2SLgD9riXalUn3N+LiEB9K8=";
  };

  patches = [
--- a/pkgs/by-name/se/seagoat/package.nix
+++ b/pkgs/by-name/se/seagoat/package.nix
@ -14,14 +14,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "seagoat";
-  version = "1.0.6";
+  version = "1.0.8";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "kantord";
    repo = "SeaGOAT";
    tag = "v${version}";
-    hash = "sha256-7GUCWg82zBe5a4HV6t8NCuGR93KX2vMlvHA6fh9TPuE=";
+    hash = "sha256-Br51c0RkZtRRazzomLFB6TKqDr5U/en+zDy6SmvWII4=";
  };

  build-system = [ python3Packages.poetry-core ];
--- a/pkgs/by-name/se/sentry-native/package.nix
+++ b/pkgs/by-name/se/sentry-native/package.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "sentry-native";
-  version = "0.8.5";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "getsentry";
    repo = "sentry-native";
    tag = version;
-    hash = "sha256-mWyBejc5i5yt2AX062o+sACR3P4wtGfzbJJQTItAXYU=";
+    hash = "sha256-PFWCC0eaHnwRZ+i2n0O17kTg9jXlgIuzgTB53Dn40iQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/st/steampipe/package.nix
+++ b/pkgs/by-name/st/steampipe/package.nix
@ -11,7 +11,7 @@

 buildGoModule rec {
  pname = "steampipe";
-  version = "1.1.3";
+  version = "1.1.4";

  env.CGO_ENABLED = 0;

@ -19,10 +19,10 @@ buildGoModule rec {
    owner = "turbot";
    repo = "steampipe";
    tag = "v${version}";
-    hash = "sha256-XLUL4RFhLlxBUYrfDr1YCWqUyr7+NY+etSldahVE1a8=";
+    hash = "sha256-kK06lYUQZGvRZs1WN/dVXc1BDRNFbQUfxpzTl1l5PBU=";
  };

-  vendorHash = "sha256-OxC5Gtxy2ipyGkoZHm/0bt1QLuyZUxRt4WHuX8ddF/M=";
+  vendorHash = "sha256-3SQH3TG7DwhaAPesNCIRZLEXqsLWhtWfuWYgQUqSp2o=";
  proxyVendor = true;

  postPatch = ''
--- a/pkgs/by-name/su/sudachidict/package.nix
+++ b/pkgs/by-name/su/sudachidict/package.nix
@ -7,20 +7,20 @@

 let
  pname = "sudachidict";
-  version = "20241021";
+  version = "20250129";

  srcs = {
    core = fetchzip {
      url = "https://github.com/WorksApplications/SudachiDict/releases/download/v${version}/sudachi-dictionary-${version}-core.zip";
-      hash = "sha256-wLcRhR4TCazRxDMKXYZ8T5Vn+rnY6aJmwExIpTIAyeE=";
+      hash = "sha256-aoUS+PM/gBGBU8HJqJB9Pbw7FNCWu8sp81DamtlFsXc=";
    };
    small = fetchzip {
      url = "https://github.com/WorksApplications/SudachiDict/releases/download/v${version}/sudachi-dictionary-${version}-small.zip";
-      hash = "sha256-Qhp9seFCnLnLLWoQ2izDVKcdca+xZE1s+SCqfj0d3sU=";
+      hash = "sha256-+50hcgXmtVZ7rFCInmSjoGGJCLOnax9UcqN5CmQcgGI=";
    };
    full = fetchzip {
      url = "https://github.com/WorksApplications/SudachiDict/releases/download/v${version}/sudachi-dictionary-${version}-full.zip";
-      hash = "sha256-8nlUDGHUKrZ0ZFEnnL4rHiu2ybyW25G6Bm6vF4smxWE=";
+      hash = "sha256-2dKHI3TKF3aIWdN2lhcCbjRdJOH91rJNsdC7o0Wdlj0=";
    };
  };
 in
@ -47,6 +47,7 @@ lib.checkListOfEnum "${pname}: dict-type" [ "core" "full" "small" ] [ dict-type

    passthru = {
      dict-type = dict-type;
+      updateScript = ./update.sh;
    };

    meta = {
--- a/pkgs/by-name/su/sudachidict/update.sh
+++ b/pkgs/by-name/su/sudachidict/update.sh
@ -0,0 +1,27 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq nix-update
+
+set -euo pipefail
+
+pushd "$(dirname "$0")" >/dev/null
+
+ORG="WorksApplications"
+REPO="SudachiDict"
+VERSION="$(curl -s "https://api.github.com/repos/$ORG/$REPO/releases/latest" | jq -r '.tag_name' | sed 's/^v//')"
+
+sed -i "s/version = \"[0-9]*\";/version = \"$VERSION\";/" package.nix
+
+DICT_TYPES=("core" "small" "full")
+
+for TYPE in "${DICT_TYPES[@]}"; do
+  URL="https://github.com/$ORG/$REPO/releases/download/v$VERSION/sudachi-dictionary-$VERSION-$TYPE.zip"
+
+  PLAIN_HASH=$(nix-prefetch-url --type sha256 "$URL" --unpack)
+  HASH=$(nix hash convert --hash-algo sha256 --to sri "$PLAIN_HASH")
+
+  sed -i -E "/(${TYPE} = fetchzip \{|^ *url = .*${TYPE}\.zip\";\$)/,/^ *hash = / s|hash = \"[^\"]*\"|hash = \"$HASH\"|" package.nix
+done
+
+popd >/dev/null
+
+nix-update "python3Packages.sudachidict-core" --version=skip
--- a/pkgs/by-name/te/tenv/package.nix
+++ b/pkgs/by-name/te/tenv/package.nix
@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "tenv";
-  version = "4.6.2";
+  version = "4.7.0";

  src = fetchFromGitHub {
    owner = "tofuutils";
    repo = "tenv";
    tag = "v${version}";
-    hash = "sha256-oYAl388/PBIL7LxOWUCZLHYfOKkkB/BEaTKpTN8rp5U=";
+    hash = "sha256-2ZtXmbrA68lGYvaclkZK1pjiw7AipdIImDzgrrxcz+4=";
  };

-  vendorHash = "sha256-5aWf5O25cudtIny159t3Mllp2wV0C+JxWe7RDkYOxVM=";
+  vendorHash = "sha256-acJNxu7M3YOBcQ3KY9qL9vpBoaYIZRUtIDuvkLgATTc=";

  excludedPackages = [ "tools" ];

--- a/pkgs/by-name/tr/tryton/package.nix
+++ b/pkgs/by-name/tr/tryton/package.nix
@ -20,12 +20,12 @@

 python3Packages.buildPythonApplication rec {
  pname = "tryton";
-  version = "7.6.1";
+  version = "7.6.2";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-IvLLxExQobugFkdByuKIK59jILALj3SniCcQp+OyZ3c=";
+    hash = "sha256-nnXq29ostjbpWmHLbpifzIFB8vBc7O3XRDq4Odp4HNk=";
  };

  build-system = [ python3Packages.setuptools ];
--- a/pkgs/by-name/uk/ukmm/package.nix
+++ b/pkgs/by-name/uk/ukmm/package.nix
@ -9,6 +9,8 @@
  libglvnd,
  libxkbcommon,
  openssl,
+  makeDesktopItem,
+  copyDesktopItems,
  nix-update-script,
 }:

@ -30,6 +32,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    cmake
    pkg-config
    wrapGAppsHook3
+    copyDesktopItems
  ];

  buildInputs = [
@ -70,6 +73,25 @@ rustPlatform.buildRustPackage (finalAttrs: {

  passthru.updateScript = nix-update-script { };

+  postInstall = ''
+    install -Dm444 assets/ukmm.png  $out/share/icons/hicolor/256x256/apps/ukmm.png
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "ukmm";
+      exec = "ukmm %u";
+      mimeTypes = [ "x-scheme-handler/bcml" ];
+      icon = "ukmm";
+      desktopName = "UKMM";
+      categories = [
+        "Game"
+        "Utility"
+      ];
+      comment = "Breath of the Wild Mod Manager";
+    })
+  ];
+
  meta = with lib; {
    description = "New mod manager for The Legend of Zelda: Breath of the Wild";
    homepage = "https://github.com/NiceneNerd/ukmm";
--- a/pkgs/by-name/up/upsies/package.nix
+++ b/pkgs/by-name/up/upsies/package.nix
@ -0,0 +1,101 @@
+{
+  lib,
+  fetchFromGitea,
+  fetchpatch,
+  ffmpeg-headless,
+  mediainfo,
+  oxipng,
+  python3Packages,
+}:
+let
+  # Taken from `docker/alpine/Dockerfile`
+  runtimeDeps = [
+    ffmpeg-headless
+    mediainfo
+    oxipng
+  ];
+in
+python3Packages.buildPythonApplication rec {
+  pname = "upsies";
+  version = "2025.04.21";
+  pyproject = true;
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "plotski";
+    repo = "upsies";
+    tag = "v${version}";
+    hash = "sha256-gjv0HOFV1VdfhVejGbV2+bMxP9BPfB3/3p6nOAYMS34=";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "use-pytest-timeout.patch";
+      url = "https://codeberg.org/plotski/upsies/commit/db6b564f8575c913a6fbabb61d5326a073c9b52c.patch";
+      hash = "sha256-UeUrZ6ogUSS0FvyNQwwwp8q+FArEK61o+Y2Uh7mrPtw=";
+      revert = true;
+    })
+  ];
+
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  dependencies = with python3Packages; [
+    aiobtclientapi
+    async-lru
+    beautifulsoup4
+    countryguess
+    guessit
+    httpx
+    langcodes
+    natsort
+    packaging
+    prompt-toolkit
+    pydantic
+    pyimgbox
+    pyparsebluray
+    pyxdg
+    term-image
+    torf
+    unidecode
+  ];
+
+  nativeCheckInputs =
+    with python3Packages;
+    [
+      pytest-asyncio
+      pytest-mock
+      pytest-timeout
+      pytest-httpserver
+      pytestCheckHook
+      trustme
+    ]
+    ++ runtimeDeps;
+
+  disabledTestPaths = [
+    # DNS resolution errors in the sandbox on some of the tests
+    "tests/utils_test/http_test/http_test.py"
+    "tests/utils_test/http_test/http_tls_test.py"
+  ];
+
+  preCheck = ''
+    # `utils.is_running_in_development_environment` expects it in tests
+    export VIRTUAL_ENV=1
+  '';
+
+  makeWrapperArgs = [
+    "--suffix"
+    "PATH"
+    ":"
+    (lib.makeBinPath runtimeDeps)
+  ];
+
+  meta = with lib; {
+    description = "a toolkit for collecting, generating, normalizing and sharing video metadata";
+    homepage = "https://upsies.readthedocs.io/";
+    license = with licenses; [ gpl3Plus ];
+    mainProgram = "upsies";
+    maintainers = with maintainers; [ ambroisie ];
+  };
+}
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@ -18,17 +18,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "uv";
-  version = "0.7.12";
+  version = "0.7.13";

  src = fetchFromGitHub {
    owner = "astral-sh";
    repo = "uv";
    tag = finalAttrs.version;
-    hash = "sha256-0ZgsGADMTjVgKUKriBkq0AEldpFxmo/5MPLoShzREO4=";
+    hash = "sha256-/K8zTExK6G/Rrh/4g2CLS4rBbQovb6DvAL8puS7eM5w=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-uvJQlTJrD5ZEbZykllBm/7LLdqOYFvkdNEZpSyVqct0=";
+  cargoHash = "sha256-GsjBTqV7GO1NNI/3EMXN0S0TwPvdtP/PTTv6NbGa9a4=";

  buildInputs = [
    rust-jemalloc-sys
--- a/pkgs/by-name/wa/wandio/package.nix
+++ b/pkgs/by-name/wa/wandio/package.nix
@ -0,0 +1,42 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  zlib,
+  bzip2,
+  xz,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "wandio";
+  version = "4.2.6-1";
+
+  src = fetchFromGitHub {
+    owner = "LibtraceTeam";
+    repo = "wandio";
+    tag = finalAttrs.version;
+    hash = "sha256-fYSAmuTgik8YeonHQc+GHRQ1lEuWxlE17npVsMpBlOE=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [
+    zlib
+    bzip2
+    xz
+  ];
+
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version-regex=^([0-9.-]+)$" ]; };
+
+  meta = {
+    description = "C library for simple and efficient file IO";
+    homepage = "https://github.com/LibtraceTeam/wandio";
+    changelog = "https://github.com/LibtraceTeam/wandio/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.lgpl3Only;
+    maintainers = with lib.maintainers; [ felbinger ];
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/by-name/ya/yazi/plugins/mactag/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/mactag/default.nix
@ -15,7 +15,7 @@ mkYaziPlugin {
  };

  meta = {
-    description = "Previewing archive contents with mactag";
+    description = "Bring macOS's awesome tagging feature to Yazi";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ khaneliman ];
    platforms = lib.platforms.darwin;
--- a/pkgs/by-name/ya/yazi/plugins/mime-ext/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/mime-ext/default.nix
@ -15,7 +15,7 @@ mkYaziPlugin {
  };

  meta = {
-    description = "Previewing archive contents with mime-ext";
+    description = "Mime-type provider based on a file extension database, replacing the builtin file to speed up mime-type retrieval at the expense of accuracy";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ khaneliman ];
  };
--- a/pkgs/by-name/ya/yazi/plugins/mount/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/mount/default.nix
@ -15,7 +15,7 @@ mkYaziPlugin {
  };

  meta = {
-    description = "Previewing archive contents with mount";
+    description = "Mount manager for Yazi";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ khaneliman ];
  };
--- a/pkgs/by-name/ya/yazi/plugins/no-status/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/no-status/default.nix
@ -15,7 +15,7 @@ mkYaziPlugin {
  };

  meta = {
-    description = "Previewing archive contents with no-status";
+    description = "Remove the status bar";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ khaneliman ];
  };
--- a/pkgs/by-name/ya/yazi/plugins/smart-enter/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/smart-enter/default.nix
@ -15,7 +15,7 @@ mkYaziPlugin {
  };

  meta = {
-    description = "Previewing archive contents with smart-enter";
+    description = "Open files or enter directories all in one key";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ khaneliman ];
  };
--- a/pkgs/by-name/ya/yazi/plugins/smart-filter/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/smart-filter/default.nix
@ -15,7 +15,7 @@ mkYaziPlugin {
  };

  meta = {
-    description = "Previewing archive contents with smart-filter";
+    description = "Yazi plugin that makes filters smarter";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ khaneliman ];
  };
--- a/pkgs/by-name/ya/yazi/plugins/smart-paste/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/smart-paste/default.nix
@ -15,7 +15,7 @@ mkYaziPlugin {
  };

  meta = {
-    description = "Previewing archive contents with smart-filter";
+    description = "Paste files into the hovered directory or to the CWD if hovering over a file";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ khaneliman ];
  };
--- a/pkgs/by-name/ya/yazi/plugins/toggle-pane/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/toggle-pane/default.nix
@ -15,7 +15,7 @@ mkYaziPlugin {
  };

  meta = {
-    description = "Previewing archive contents with toggle-pane";
+    description = "Toggle the show, hide, and maximize states for different panes";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ khaneliman ];
  };
--- a/pkgs/by-name/ya/yazi/plugins/vcs-files/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/vcs-files/default.nix
@ -15,7 +15,7 @@ mkYaziPlugin {
  };

  meta = {
-    description = "Previewing archive contents with vcs-files";
+    description = "Show Git file changes in Yazi";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ khaneliman ];
  };
--- a/pkgs/by-name/ye/yeahwm/package.nix
+++ b/pkgs/by-name/ye/yeahwm/package.nix
@ -1,90 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  installShellFiles,
-  lesstif,
-  libX11,
-  libXext,
-  libXinerama,
-  libXmu,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "yeahwm";
-  version = "0.3.5";
-
-  src = fetchurl {
-    url = "http://phrat.de/yeahwm_${finalAttrs.version}.tar.gz";
-    hash = "sha256-ySzpiEjIuI2bZ8Eo4wcQlEwEpkVDECVFNcECsrb87gU=";
-  };
-
-  nativeBuildInputs = [
-    installShellFiles
-  ];
-
-  buildInputs = [
-    lesstif
-    libX11
-    libXext
-    libXinerama
-    libXmu
-  ];
-
-  strictDeps = true;
-
-  preBuild =
-    let
-      includes = builtins.concatStringsSep " " (
-        builtins.map (l: "-I${lib.getDev l}/include") finalAttrs.buildInputs
-      );
-      ldpath = builtins.concatStringsSep " " (
-        builtins.map (l: "-L${lib.getLib l}/lib") finalAttrs.buildInputs
-      );
-    in
-    ''
-      makeFlagsArray+=( CC="${stdenv.cc}/bin/cc" \
-                        XROOT="${libX11}" \
-                        INCLUDES="${includes}" \
-                        LDPATH="${ldpath}" \
-                        prefix="${placeholder "out"}" )
-    '';
-
-  # Workaround build failure on -fno-common toolchains like upstream gcc-10.
-  # Otherwise build fails as:
-  #   ld: screen.o:(.bss+0x40): multiple definition of `fg'; client.o:(.bss+0x40): first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
-
-  postInstall = ''
-    installManPage yeahwm.1
-  '';
-
-  meta = {
-    homepage = "http://phrat.de/index.html";
-    description = "X window manager based on evilwm and aewm";
-    longDescription = ''
-      YeahWM is a h* window manager for X based on evilwm and aewm.
-
-      Features
-      - Sloppy Focus.
-      - BeOS-like tabbed titles, which can be repositioned.
-      - Support for Xinerama.
-      - Simple Appearance.
-      - Good keyboard control.
-      - Creative usage of the mouse.
-      - Respects aspect size hints.
-      - Solid resize and move operations.
-      - Virtual Desktops.
-      - "Magic" Screen edges for desktop switching.
-      - Snapping to other windows and screen borders when moving windows.
-      - Small binary size(ca. 23kb).
-      - Little resource usage.
-      - It's slick.
-    '';
-    changelog = "http://phrat.de/README";
-    license = lib.licenses.isc;
-    mainProgram = "yeahwm";
-    maintainers = with lib.maintainers; [ ];
-    inherit (libX11.meta) platforms;
-  };
-})
--- a/pkgs/by-name/yo/yourkit-java/package.nix
+++ b/pkgs/by-name/yo/yourkit-java/package.nix
@ -10,7 +10,7 @@
 let
  vPath = v: lib.elemAt (lib.splitString "-" v) 0;

-  version = "2025.3-b135";
+  version = "2025.3-b147";

  arches = {
    aarch64-linux = "arm64";
@ -20,8 +20,8 @@ let
  arch = arches.${stdenvNoCC.targetPlatform.system} or (throw "Unsupported system");

  hashes = {
-    arm64 = "sha256-ljpT3m4+enGpmiNGLIM/Gj/H9stfwQG3Xbj35EyhBDY=";
-    x64 = "sha256-61TXQ2GiI0CdRH/4nRE+D0uYcR/Sq23fgmTUWhj75QM=";
+    arm64 = "sha256-uyoticzh7jeBp0B+tKI6q6N+aoJUS3yfhUxTgCtVwR4=";
+    x64 = "sha256-kiINiOHlvunNRS+Wpr+2tE4vkgZXMiED8itTuP03wzk=";
  };

  desktopItem = makeDesktopItem {
--- a/pkgs/by-name/ze/zet/package.nix
+++ b/pkgs/by-name/ze/zet/package.nix
@ -2,45 +2,35 @@
  lib,
  rustPlatform,
  fetchFromGitHub,
-  fetchpatch2,
 }:

-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
  pname = "zet";
-  version = "1.0.0";
+  version = "2.0.1";

  src = fetchFromGitHub {
    owner = "yarrow";
    repo = "zet";
-    rev = "v${version}";
-    hash = "sha256-IjM+jSb+kdML0zZGuz9+9wrFzQCujn/bg9/vaTzMtUs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-WnB2kxfWdWZCRqlSUL0cV4l9dIUr+cm7QCXF6F1ktt0=";
  };

-  patches = [
-    # fix unused_qualifications lint with rust 1.78+
-    # https://github.com/yarrow/zet/commit/b6a0c67f6ac76fb7bf8234951678b77fbac12d76
-    (fetchpatch2 {
-      url = "https://github.com/yarrow/zet/commit/b6a0c67f6ac76fb7bf8234951678b77fbac12d76.patch?full_index=1";
-      hash = "sha256-HojhKM7UJh5xpD9a18Wh0hiiUDOE+jK0BKGYozYjMBc=";
-    })
-  ];
-
  useFetchCargoVendor = true;
-  cargoHash = "sha256-1nuYdaQ6p0tnd7a7/H8wVtzOCGr0pCTcsT+Q0X9/DGc=";
+  cargoHash = "sha256-EIj2BUVS1tbY+kxUnpu1C+0+n68gTFZbp45f5UNidtY=";

  # tests fail with `--release`
  # https://github.com/yarrow/zet/pull/7
  checkType = "debug";

-  meta = with lib; {
+  meta = {
    description = "CLI utility to find the union, intersection, set difference, etc of files considered as sets of lines";
    mainProgram = "zet";
    homepage = "https://github.com/yarrow/zet";
-    changelog = "https://github.com/yarrow/zet/blob/${src.rev}/CHANGELOG.md";
-    license = with licenses; [
+    changelog = "https://github.com/yarrow/zet/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = with lib.licenses; [
      asl20
      mit
    ];
-    maintainers = with maintainers; [ figsoda ];
+    maintainers = with lib.maintainers; [ figsoda ];
  };
-}
+})
--- a/pkgs/by-name/zx/zxtune/package.nix
+++ b/pkgs/by-name/zx/zxtune/package.nix
@ -48,7 +48,7 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "zxtune";
-  version = "5090";
+  version = "5100";

  outputs = [ "out" ];

@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
    owner = "zxtune";
    repo = "zxtune";
    rev = "r${version}";
-    hash = "sha256-2k1I3wGnUSMgwzxXY3SKhS8nBtrFU8zH9VaFwdWYgOU=";
+    hash = "sha256-SNHnpLAbiHCo11V090EY/vLH4seoZWpMHMMBLGkr88E=";
  };

  passthru.updateScript = nix-update-script {
--- a/pkgs/development/interpreters/octave/build-octave-package.nix
+++ b/pkgs/development/interpreters/octave/build-octave-package.nix
@ -9,6 +9,7 @@
  stdenv,
  config,
  octave,
+  callPackage,
  texinfo,
  computeRequiredOctavePackages,
  writeRequiredOctavePackagesHook,
@ -64,13 +65,6 @@ let
    writeRequiredOctavePackagesHook
  ] ++ nativeBuildInputs;

-  passthru' = {
-    updateScript = [
-      ../../../../maintainers/scripts/update-octave-packages
-      (builtins.unsafeGetAttrPos "pname" octave.pkgs.${attrs.pname}).file
-    ];
-  } // passthru;
-
  # This step is required because when
  # a = { test = [ "a" "b" ]; }; b = { test = [ "c" "d" ]; };
  # (a // b).test = [ "c" "d" ];
@ -81,9 +75,9 @@ let
    "nativeBuildInputs"
    "passthru"
  ];
-
 in
 stdenv.mkDerivation (
+  finalAttrs:
  {
    packageName = "${fullLibName}";
    # The name of the octave package ends up being
@ -136,7 +130,22 @@ stdenv.mkDerivation (
    # together with Octave.
    dontInstall = true;

-    passthru = passthru';
+    passthru =
+      {
+        updateScript = [
+          ../../../../maintainers/scripts/update-octave-packages
+          (builtins.unsafeGetAttrPos "pname" octave.pkgs.${attrs.pname}).file
+        ];
+      }
+      // passthru
+      // {
+        tests = {
+          testOctaveBuildEnv = (octave.withPackages (os: [ finalAttrs.finalPackage ])).overrideAttrs (old: {
+            name = "${finalAttrs.name}-pkg-install";
+          });
+          testOctavePkgTests = callPackage ./run-pkg-test.nix { } finalAttrs.finalPackage;
+        } // passthru.tests or { };
+      };

    inherit meta;
  }
--- a/pkgs/development/interpreters/octave/run-pkg-test.nix
+++ b/pkgs/development/interpreters/octave/run-pkg-test.nix
@ -0,0 +1,25 @@
+{
+  octave,
+  runCommand,
+}:
+package:
+
+runCommand "${package.name}-pkg-test"
+  {
+    nativeBuildInputs = [
+      (octave.withPackages (os: [ package ]))
+    ];
+  }
+  ''
+    { octave-cli --eval 'pkg test ${package.pname}' || touch FAILED_ERRCODE; } \
+      |& tee >( grep --quiet '^Failure Summary:$' && touch FAILED_OUTPUT || : ; cat >/dev/null )
+    if [[ -f FAILED_ERRCODE ]]; then
+      echo >&2 "octave-cli returned with non-zero exit code."
+      false
+    elif [[ -f FAILED_OUTPUT ]]; then
+      echo >&2 "Test failures detected in output."
+      false
+    else
+      touch $out
+    fi
+  ''
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@ -434,8 +434,8 @@ in
  };

  ruby_3_4 = generic {
-    version = rubyVersion "3" "4" "3" "";
-    hash = "sha256-VaTNHcvlyifPZeiak1pILCuyKEgyk5JmVRwOxotDf0Y=";
+    version = rubyVersion "3" "4" "4" "";
+    hash = "sha256-oFl7/fMS4BDv0e/6qNfx14MxRv3BeVDKqBWP+j3L+oU=";
    cargoHash = "sha256-5Tp8Kth0yO89/LIcU8K01z6DdZRr8MAA0DPKqDEjIt0=";
  };
 }
--- a/pkgs/development/libraries/c-blosc/2.nix
+++ b/pkgs/development/libraries/c-blosc/2.nix
@ -14,13 +14,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "c-blosc2";
-  version = "2.17.1";
+  version = "2.18.0";

  src = fetchFromGitHub {
    owner = "Blosc";
    repo = "c-blosc2";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-VxMErhuk160/0jF6pl6/YKAwaswnfBKnmOD5ZgcU2U4=";
+    sha256 = "sha256-HYWohyI4IJX4jyTTwbSHJFI3p3PFrUGU6l0TEIP4Esc=";
  };

  # https://github.com/NixOS/nixpkgs/issues/144170
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@ -101,6 +101,14 @@ let
      USE_OPENMP = !stdenv.hostPlatform.isMusl;
    };

+    x86_64-windows = {
+      BINARY = 64;
+      TARGET = setTarget "ATHLON";
+      DYNAMIC_ARCH = setDynamicArch true;
+      NO_AVX512 = !enableAVX512;
+      USE_OPENMP = false;
+    };
+
    powerpc64le-linux = {
      BINARY = 64;
      TARGET = setTarget "POWER5";
@ -280,6 +288,9 @@ stdenv.mkDerivation rec {

          # Setup symlinks for blas / lapack
    ''
+    + lib.optionalString stdenv.hostPlatform.isMinGW ''
+      ln -s $out/bin/*.dll $out/lib
+    ''
    + lib.optionalString enableShared ''
      ln -s $out/lib/libopenblas${shlibExt} $out/lib/libblas${shlibExt}
      ln -s $out/lib/libopenblas${shlibExt} $out/lib/libcblas${shlibExt}
--- a/pkgs/development/python-modules/aiobtclientapi/default.nix
+++ b/pkgs/development/python-modules/aiobtclientapi/default.nix
@ -0,0 +1,62 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitea,
+  aiobtclientrpc,
+  async-timeout,
+  httpx,
+  torf,
+  pytest-asyncio,
+  pytest-mock,
+  pytestCheckHook,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "aiobtclientapi";
+  version = "1.1.3";
+  pyproject = true;
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "plotski";
+    repo = "aiobtclientapi";
+    tag = "v${version}";
+    hash = "sha256-ZpUaMsJs1vdVGQOid7aJ+SJKaCbTtHfSw7cOwPTL0ss=";
+  };
+
+  pythonRelaxDeps = [
+    "async-timeout"
+  ];
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    aiobtclientrpc
+    async-timeout
+    httpx
+    torf
+  ];
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytest-mock
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "aiobtclientapi" ];
+
+  disabledTestPaths = [
+    # AttributeError
+    "tests/clients_test/rtorrent_test/rtorrent_api_test.py"
+  ];
+
+  meta = {
+    description = "Asynchronous high-level communication with BitTorrent clients";
+    homepage = "https://aiobtclientapi.readthedocs.io";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ ambroisie ];
+  };
+}
--- a/pkgs/development/python-modules/aiobtclientrpc/default.nix
+++ b/pkgs/development/python-modules/aiobtclientrpc/default.nix
@ -0,0 +1,75 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitea,
+  async-timeout,
+  httpx,
+  httpx-socks,
+  proxy-py,
+  pytest-asyncio,
+  pytest-mock,
+  pytestCheckHook,
+  python-socks,
+  rencode,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "aiobtclientrpc";
+  version = "5.0.1";
+  pyproject = true;
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "plotski";
+    repo = "aiobtclientrpc";
+    tag = "v${version}";
+    hash = "sha256-2nBrIMlYUI4PwirkiSJSkw5zw2Kc/KoVRyIIYYx4iYs=";
+  };
+
+  pythonRelaxDeps = [
+    "async-timeout"
+  ];
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    async-timeout
+    httpx
+    httpx-socks
+    python-socks
+    rencode
+  ] ++ python-socks.optional-dependencies.asyncio;
+
+  nativeCheckInputs = [
+    proxy-py
+    pytest-asyncio
+    pytest-mock
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # Missing lambda parameter
+    "test_add_event_handler_with_autoremove"
+    # Try to use `htpasswd` and `nginx` with hard-coded paths
+    "test_authentication_error[rtorrent_http]"
+    "test_api_as_context_manager[rtorrent_http]"
+    "test_add_and_remove_torrents[rtorrent_http-paused]"
+    "test_add_and_remove_torrents[rtorrent_http-started]"
+    "test_proxy[rtorrent_http-http_proxy]"
+    "test_timeout[rtorrent_http]"
+    "test_event_subscriptions_survive_reconnecting[rtorrent_http]"
+    "test_waiting_for_event[rtorrent_http]"
+  ];
+
+  pythonImportsCheck = [ "aiobtclientrpc" ];
+
+  meta = {
+    description = "Asynchronous low-level communication with BitTorrent clients";
+    homepage = "https://aiobtclientrpc.readthedocs.io";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ ambroisie ];
+  };
+}
--- a/pkgs/development/python-modules/aiomealie/default.nix
+++ b/pkgs/development/python-modules/aiomealie/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "aiomealie";
-  version = "0.9.5";
+  version = "0.9.6";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "joostlek";
    repo = "python-mealie";
    tag = "v${version}";
-    hash = "sha256-hcHXX95d9T/jJMqHkikWN8ZdM5MRxJxhH575U3KDXxY=";
+    hash = "sha256-jjqukg8x5CDatEcmEAEdWtRrIa/6+iaiFYGRYUg40Dg=";
  };

  build-system = [ poetry-core ];
--- a/pkgs/development/python-modules/bayesian-optimization/default.nix
+++ b/pkgs/development/python-modules/bayesian-optimization/default.nix
@ -23,14 +23,14 @@

 buildPythonPackage rec {
  pname = "bayesian-optimization";
-  version = "2.0.3";
+  version = "2.0.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "bayesian-optimization";
    repo = "BayesianOptimization";
    tag = "v${version}";
-    hash = "sha256-vT8MlfAdzIKj6uyQedYngP6rCkIZwS8EdtKs4+8l9CA=";
+    hash = "sha256-F1+M5znfI7lHGJRRTgmQxrLTYZmLc90Q0TCvpRoSVTU=";
  };

  build-system = [ poetry-core ];
@ -57,7 +57,7 @@ buildPythonPackage rec {
  meta = {
    description = "Python implementation of global optimization with gaussian processes";
    homepage = "https://github.com/bayesian-optimization/BayesianOptimization";
-    changelog = "https://github.com/bayesian-optimization/BayesianOptimization/releases/tag/v${version}";
+    changelog = "https://github.com/bayesian-optimization/BayesianOptimization/releases/tag/${src.tag}";
    license = lib.licenses.mit;
    maintainers = [ lib.maintainers.juliendehos ];
  };
--- a/pkgs/development/python-modules/bc-detect-secrets/default.nix
+++ b/pkgs/development/python-modules/bc-detect-secrets/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "bc-detect-secrets";
-  version = "1.5.43";
+  version = "1.5.44";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "bridgecrewio";
    repo = "detect-secrets";
    tag = version;
-    hash = "sha256-A9qDkAi414wJ7cuAwr1r6FgIa1tOJb+EkAGsvFrw/Fo=";
+    hash = "sha256-cEhZo/HfCp6Cpx2zEX7THQQJH264NJvoCRrM+ci3RrE=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/bump-my-version/default.nix
+++ b/pkgs/development/python-modules/bump-my-version/default.nix
@ -22,8 +22,7 @@
  mercurial,
  gitMinimal,
  freezegun,
-  pre-commit,
-  pytest-cov,
+  pytest-cov-stub,
  pytest-localserver,
  pytest-mock,
  pytestCheckHook,
@ -32,14 +31,14 @@

 buildPythonPackage rec {
  pname = "bump-my-version";
-  version = "1.1.4";
+  version = "1.2.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "callowayproject";
    repo = "bump-my-version";
    tag = version;
-    hash = "sha256-oV7ije2q9eBimHxMDJauSJ81xQvwlfcfJw5rgZBHGUg=";
+    hash = "sha256-SxNh6JyoObpIwdoCgz79YIdx2cM6m95xwV7dD8d61Cc=";
  };

  build-system = [
@ -70,8 +69,7 @@ buildPythonPackage rec {
    mercurial
    gitMinimal
    freezegun
-    pre-commit
-    pytest-cov
+    pytest-cov-stub
    pytest-localserver
    pytest-mock
    pytestCheckHook
@ -93,7 +91,7 @@ buildPythonPackage rec {
      by the correct increment and optionally commit and tag the changes.
    '';
    homepage = "https://github.com/callowayproject/bump-my-version";
-    changelog = "https://github.com/callowayproject/bump-my-version/tag/${src.tag}";
+    changelog = "https://github.com/callowayproject/bump-my-version/releases/tag/${src.tag}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ daspk04 ];
    mainProgram = "bump-my-version";
--- a/pkgs/development/python-modules/cogapp/default.nix
+++ b/pkgs/development/python-modules/cogapp/default.nix
@ -1,29 +1,34 @@
 {
  lib,
  buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
  setuptools,
+  pytestCheckHook,
 }:

 buildPythonPackage rec {
  pname = "cogapp";
-  version = "3.4.1";
+  version = "3.5.0";
  pyproject = true;

-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-qAbV254xihotP86YgAgXkWjn2xPl5VsZt5dj+budKYI=";
+  src = fetchFromGitHub {
+    owner = "nedbat";
+    repo = "cog";
+    tag = "v${version}";
+    hash = "sha256-jmHAHBzUw8VLCudT8slisCJ7yOUTVrrLiUbEiiTcfew=";
  };

-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];

-  # there are no tests
-  doCheck = false;
+  pythonImportsCheck = [ "cogapp" ];

-  meta = with lib; {
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  meta = {
    description = "Code generator for executing Python snippets in source files";
    homepage = "https://nedbatchelder.com/code/cog";
-    license = licenses.mit;
-    maintainers = with maintainers; [ lovek323 ];
+    changelog = "https://github.com/nedbat/cog/blob/v${version}/CHANGELOG.rst";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ lovek323 ];
  };
 }
--- a/pkgs/development/python-modules/coiled/default.nix
+++ b/pkgs/development/python-modules/coiled/default.nix
@ -39,12 +39,12 @@

 buildPythonPackage rec {
  pname = "coiled";
-  version = "1.100.0";
+  version = "1.101.1";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-kB5kWIFQPxTcozVqfjMt58b9tAx9upTga4NdfplbbtI=";
+    hash = "sha256-7+uRvyK+PbQ8jHFQhi0+jkwSvUzAMOVAeCZMIUaujeM=";
  };

  build-system = [
--- a/pkgs/development/python-modules/countryguess/default.nix
+++ b/pkgs/development/python-modules/countryguess/default.nix
@ -0,0 +1,40 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitea,
+  pytest-mock,
+  pytestCheckHook,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "countryguess";
+  version = "0.4.5";
+  pyproject = true;
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "plotski";
+    repo = "countryguess";
+    tag = "v${version}";
+    hash = "sha256-JzhkXHitleQ2UIxdem8PYR5QhKGmkyfHmxG6VDP7pB0=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  nativeCheckInputs = [
+    pytest-mock
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "countryguess" ];
+
+  meta = {
+    description = "Fuzzy lookup of country information";
+    homepage = "https://codeberg.org/plotski/countryguess";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ ambroisie ];
+  };
+}
--- a/pkgs/development/python-modules/cyclopts/default.nix
+++ b/pkgs/development/python-modules/cyclopts/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "cyclopts";
-  version = "3.16.2";
+  version = "3.19.0";
  pyproject = true;

  disabled = pythonOlder "3.12";
@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "BrianPugh";
    repo = "cyclopts";
    tag = "v${version}";
-    hash = "sha256-rwlJk19DLmiD7gAbknrRgcw+t3+mEfqth5P+aQB7eMM=";
+    hash = "sha256-WqBb4G4tAhgOISRRjauJhIT9imoNiF9pnp9QzY9tVZI=";
  };

  build-system = [
--- a/pkgs/development/python-modules/django-app-helper/default.nix
+++ b/pkgs/development/python-modules/django-app-helper/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "django-app-helper";
-  version = "3.3.4";
+  version = "3.3.5";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "nephila";
    repo = "django-app-helper";
    tag = version;
-    hash = "sha256-4nFg8B1uxGJVY1jcGr0e2Oi14lqXcFOi0HJ+ogE2ikg=";
+    hash = "sha256-gnTEzmQ4h4FWc2+s68VW/yVAkKFdj4U2VMkJKTAnQOM=";
  };

  build-system = [ setuptools ];
@ -56,7 +56,7 @@ buildPythonPackage rec {
  meta = {
    description = "Helper for Django applications development";
    homepage = "https://django-app-helper.readthedocs.io";
-    changelog = "https://github.com/nephila/django-app-helper/releases/tag/${version}";
+    changelog = "https://github.com/nephila/django-app-helper/releases/tag/${src.tag}";
    license = lib.licenses.gpl2Only;
    maintainers = [ lib.maintainers.onny ];
  };
--- a/Show More
+++ b/Show More