Merge remote-tracking branch 'origin/master' into staging-next

Conflicts: pkgs/applications/virtualization/crosvm/default.nix pkgs/by-name/as/ast-grep/package.nix pkgs/by-name/ca/cargo-mobile2/package.nix pkgs/by-name/cl/clang-tidy-sarif/package.nix pkgs/by-name/gg/gg-jj/package.nix pkgs/by-name/gi/git-warp-time/package.nix pkgs/by-name/je/jellyfin-rpc/package.nix pkgs/by-name/ne/netbox2netshot/package.nix pkgs/by-name/sy/sydbox/package.nix pkgs/by-name/te/television/package.nix pkgs/development/python-modules/tinytuya/default.nix
2025-01-31 10:23:31 +01:00 · 2025-01-31 10:23:31 +01:00 · dffcaaaa64
commit dffcaaaa64
parent 864b2a12b9 4e5fe0f593
198 changed files with 4546 additions and 1421 deletions
--- a/doc/redirects.json
+++ b/doc/redirects.json
@ -827,6 +827,12 @@
  "set-source-date-epoch-to-latest.sh": [
    "index.html#set-source-date-epoch-to-latest.sh"
  ],
+  "add-bin-to-path.sh": [
+    "index.html#add-bin-to-path.sh"
+  ],
+  "writable-tmpdir-as-home.sh": [
+    "index.html#writable-tmpdir-as-home.sh"
+  ],
  "bintools-wrapper": [
    "index.html#bintools-wrapper"
  ],
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@ -1389,6 +1389,31 @@ The check for reflexivity is direct and does not account for transitivity, so th

 This sets `SOURCE_DATE_EPOCH` to the modification time of the most recent file.

+### `add-bin-to-path.sh` {#add-bin-to-path.sh}
+
+This setup hook checks if the `bin/` directory exists in the `$out` output path
+and, if so, adds it to the `PATH` environment variable. This ensures that
+executables located in `$out/bin` are accessible.
+
+This hook is particularly useful during testing, as it allows packages to locate their executables without requiring manual modifications to the `PATH`.
+
+**Note**: This hook is specifically designed for the `$out/bin` directory only
+and does not handle and support other paths like `$sourceRoot/bin`. It may not
+work as intended in cases with multiple outputs or when binaries are located in
+directories like `sbin/`. These caveats should be considered when using this
+hook, as they might introduce unexpected behavior in some specific cases.
+
+### `writable-tmpdir-as-home.sh` {#writable-tmpdir-as-home.sh}
+
+This setup hook ensures that the directory specified by the `HOME` environment
+variable is writable. If it is not, the hook assigns `HOME` to a writable
+directory (in `.home` in `$NIX_BUILD_TOP`). This adjustment is necessary for
+certain packages that require write access to a home directory. This hook can
+be added to any phase.
+
+By setting `HOME` to a writable directory, this setup hook prevents failures in
+packages that attempt to write to the home directory.
+
 ### Bintools Wrapper and hook {#bintools-wrapper}

 The Bintools Wrapper wraps the binary utilities for a bunch of miscellaneous purposes. These are GNU Binutils when targeting Linux, and a mix of cctools and GNU binutils for Darwin. \[The “Bintools” name is supposed to be a compromise between “Binutils” and “cctools” not denoting any specific implementation.\] Specifically, the underlying bintools package, and a C standard library (glibc or Darwin’s libSystem, just for the dynamic loader) are all fed in, and dependency finding, hardening (see below), and purity checks for each are handled by the Bintools Wrapper. Packages typically depend on CC Wrapper, which in turn (at run time) depends on the Bintools Wrapper.
--- a/pkgs/applications/graphics/epick/default.nix
+++ b/pkgs/applications/graphics/epick/default.nix
@ -24,7 +24,8 @@ rustPlatform.buildRustPackage rec {
    sha256 = "sha256-gjqAQrGJ9KFdzn2a3fOgu0VJ9zrX5stsbzriOGJaD/4=";
  };

-  cargoHash = "sha256-OQZPOiMTpoWabxHa3TJG8L3zq8WxMeFttw8xggSXsMA=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-r/0aNzU8jm2AqiZWq4plxXY/H7qKVC8nEI9BwOUKCdA=";

  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [
    pkg-config
--- a/pkgs/applications/misc/pagefind/default.nix
+++ b/pkgs/applications/misc/pagefind/default.nix
@ -41,7 +41,8 @@ rustPlatform.buildRustPackage rec {
    hash = "sha256-NIEiXwuy8zuUDxPsD4Hiq3x4cOG3VM+slfNIBSJU2Mk=";
  };

-  cargoHash = "sha256-dfE4pfArW9hTPi7LCC9l274dNd1r0RAh50cciUGnv58=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-e1JSK8RnBPGcAmgxJZ7DaYhMMaUqO412S9YvaqXll3E=";

  env.npmDeps_web_js = fetchNpmDeps {
    name = "npm-deps-web-js";
@ -58,10 +59,10 @@ rustPlatform.buildRustPackage rec {
    src = "${src}/pagefind_ui/modular";
    hash = "sha256-O0RqZUsRFtByxMQdwNGNcN38Rh+sDqqNo9YlBcrnsF4=";
  };
-  env.cargoDeps_web = rustPlatform.fetchCargoTarball {
+  env.cargoDeps_web = rustPlatform.fetchCargoVendor {
    name = "cargo-deps-web";
    src = "${src}/pagefind_web/";
-    hash = "sha256-vDkVXyDePKgYTYE5ZTLLfOHwPYfgaqP9p5/fKCQQi0g=";
+    hash = "sha256-xFVMWX3q3za1w8v58Eysk6vclPd4qpCuQMjMcwwHoh0=";
  };

  postPatch = ''
@ -81,8 +82,9 @@ rustPlatform.buildRustPackage rec {

    # patch a build-time dependency download
    (
-      cd $cargoDepsCopy/lindera-unidic
-      oldHash=$(sha256sum build.rs | cut -d " " -f 1)
+      realpath $cargoDepsCopy/* | grep lindera-unidic # debug for when version number changes
+      cd $cargoDepsCopy/lindera-unidic-0.32.2
+      #oldHash=$(sha256sum build.rs | cut -d " " -f 1)

      # serve lindera-unidic on localhost vacant port
      httplz_port="${
@ -101,8 +103,9 @@ rustPlatform.buildRustPackage rec {
          "https://dlwqk3ibdg1xh.cloudfront.net/unidic-mecab-2.1.2.tar.gz" \
          "http://localhost:$httplz_port/unidic-mecab-2.1.2.tar.gz"

-      newHash=$(sha256sum build.rs | cut -d " " -f 1)
-      substituteInPlace .cargo-checksum.json --replace-fail $oldHash $newHash
+      # not needed with useFetchCargoVendor=true, but kept in case it is required again
+      #newHash=$(sha256sum build.rs | cut -d " " -f 1)
+      #substituteInPlace .cargo-checksum.json --replace-fail $oldHash $newHash
    )
  '';

--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -45,11 +45,11 @@
    "vendorHash": "sha256-3AlXMOpL5kctTSnA2V1RsMxRb9roELs1p5TL0uJFR4M="
  },
  "alicloud": {
-    "hash": "sha256-xHR2Yuyh5hxbTuu1QqkKSIJX2SyqsRaoa7GtOSFzLFA=",
+    "hash": "sha256-ZOcG5xfVJN3RFLtFyQr87feEQ1MoRtgPLt03bjbC1gc=",
    "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
    "owner": "aliyun",
    "repo": "terraform-provider-alicloud",
-    "rev": "v1.239.0",
+    "rev": "v1.242.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -117,13 +117,13 @@
    "vendorHash": null
  },
  "aws": {
-    "hash": "sha256-731RvOhO1GyIx8ohIEVsWv8ZC3ksm4WQu7bUQagwv9Q=",
+    "hash": "sha256-G4frE2m7kjxiGSjIKbWltkTZ9Lba0CTgsOE+13+2bbo=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
    "owner": "hashicorp",
    "repo": "terraform-provider-aws",
-    "rev": "v5.80.0",
+    "rev": "v5.84.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-P7ykNhpFoPTINX3eo61/x/9Ts2Z9dscY/P5fQNRsmVo="
+    "vendorHash": "sha256-u4xQyCDOZEczAqxgkxaKeS0Gy+PbIyYWtTxdPRiXMCw="
  },
  "azuread": {
    "hash": "sha256-UV6jgVS8tzWiEBC/C/U7/2bGZ1sqk2MnS8xNRBuL+C8=",
@ -135,11 +135,11 @@
    "vendorHash": null
  },
  "azurerm": {
-    "hash": "sha256-qN4Kl3Ud3Grcxs2Y5Mx6qxs3RnljT8+9TxC8l3xQjuw=",
+    "hash": "sha256-99SWoCpiXp2R673CAfPbKPSzhT2huVBRHcZN4XlUJJI=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/azurerm",
    "owner": "hashicorp",
    "repo": "terraform-provider-azurerm",
-    "rev": "v4.14.0",
+    "rev": "v4.16.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -198,13 +198,13 @@
    "vendorHash": "sha256-/dOiXO2aPkuZaFiwv/6AXJdIADgx8T7eOwvJfBBoqg8="
  },
  "btp": {
-    "hash": "sha256-71i7iRTAsSZnq72ew4cEcDGFbsRPKWvEJ7y6onN1V68=",
+    "hash": "sha256-uyZ4HR9HVLHxGtRE4DTeNlG7RsYcmIxsZMxs5hQbJSc=",
    "homepage": "https://registry.terraform.io/providers/SAP/btp",
    "owner": "SAP",
    "repo": "terraform-provider-btp",
-    "rev": "v1.8.0",
+    "rev": "v1.9.0",
    "spdx": "Apache-2.0",
-    "vendorHash": "sha256-A6/YN/iFxdfGjYO8Pum5nWysGmEeLaxgFPe8zaoPfjA="
+    "vendorHash": "sha256-RnFY5fAkEV69nuFMcivCb232r/3sqqcgdMU/WYuK+yI="
  },
  "buildkite": {
    "hash": "sha256-xz9gYf13tNU3J7nQscuIRU41CGjYc6qMXnLltAaPQac=",
@ -252,13 +252,13 @@
    "vendorHash": "sha256-QErIw/HQ4BMWmM0xEnYsOY0Vcfj50o6mnIWML4nK/SU="
  },
  "cloudflare": {
-    "hash": "sha256-RC8/tw01yNxeqOlmLzzagRgxQm+o+4ztJ/7KWyBPJ+I=",
+    "hash": "sha256-ne+G7tn09sDWVoU9JezCJxIn3F/bHXBp9QIDd0UhH9c=",
    "homepage": "https://registry.terraform.io/providers/cloudflare/cloudflare",
    "owner": "cloudflare",
    "repo": "terraform-provider-cloudflare",
-    "rev": "v4.48.0",
+    "rev": "v4.51.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-tznAR/SRtJJdxm17f8ej5Lt8BCVlCW3zkrBX94ErbjQ="
+    "vendorHash": "sha256-jZLkDnZpguVEZpbXG/IhgeyyvRLOVWBacoFTs7H8js0="
  },
  "cloudfoundry": {
    "hash": "sha256-1nYncJLVU/f9WD6Quh9IieIXgixPzbPk4zbtI1zmf9g=",
@ -498,22 +498,22 @@
    "vendorHash": null
  },
  "gitlab": {
-    "hash": "sha256-f+4eWx6CqQhqNyQUBsi0BR+J4N0yloZw01o8NffNYFE=",
+    "hash": "sha256-Fh1FYP5dBA7bJMOpYrASQC+3RMLx6O62ty+i0114fV4=",
    "homepage": "https://registry.terraform.io/providers/gitlabhq/gitlab",
    "owner": "gitlabhq",
    "repo": "terraform-provider-gitlab",
-    "rev": "v17.6.1",
+    "rev": "v17.8.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-C7BJR8H1HP6TycbbXsY/xRhSzOmCpodN6vr/lzgXe+A="
+    "vendorHash": "sha256-RoMknYUy73fiLrexhpM94qZ7l1F68o5/vfg8RXRtvHw="
  },
  "google": {
-    "hash": "sha256-swyE5pSVu5X5V6pfgJkpz7PmB1lk5l6OHoVetFfQHXU=",
+    "hash": "sha256-cRxUE6Ztys60AL4vHL4eBGlIfDtAxyFFhL7nh2LC7xo=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google",
    "owner": "hashicorp",
    "repo": "terraform-provider-google",
-    "rev": "v6.13.0",
+    "rev": "v6.17.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-JUaXSF+UJCTHbr+Xq2zLpNuJVTW89gwEeFEXs44g5J4="
+    "vendorHash": "sha256-NTUwfD1f6qtv0KKwzuxzMMCXgV7MgolbBWbwo9UxOaA="
  },
  "google-beta": {
    "hash": "sha256-O8pDsBTfr8Ep2pZmb2btKVuNrKx6PxLczmwTwwdJZ/c=",
@ -831,13 +831,13 @@
    "vendorHash": "sha256-a9v1nVG3NiuyHwJGhIKKKXFDp4/Cb533EJxrfqK9h/A="
  },
  "mongodbatlas": {
-    "hash": "sha256-0CIHc3cIdhxX2T8dkccOLVFCgY3c1kz6vxlzmEN8YK0=",
+    "hash": "sha256-bngDZUqemOjmRTQC0UnQG2IvjuqjORrZ3Agr1K0T+TE=",
    "homepage": "https://registry.terraform.io/providers/mongodb/mongodbatlas",
    "owner": "mongodb",
    "repo": "terraform-provider-mongodbatlas",
-    "rev": "v1.22.0",
+    "rev": "v1.25.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-jHm6fDk8zjrZcWKHOKhhFmRICBwx/d7BD4Ycy8gcQWU="
+    "vendorHash": "sha256-Dzd+0kGTK+8RITL/R4BRjJhD5sZKWSrprqNZQ/4Cm9E="
  },
  "namecheap": {
    "hash": "sha256-fHH9sHI1mqQ9q9nX9DHJ0qfEfmDB4/2uzyVvUuIAF18=",
@ -1165,13 +1165,13 @@
    "vendorHash": "sha256-F1AuO/dkldEDRvkwrbq2EjByxjg3K2rohZAM4DzKPUw="
  },
  "snowflake": {
-    "hash": "sha256-ImQcECv0fRGbOQvoG8rwQAb4jV7Ly72c6r6TlCMWdA0=",
+    "hash": "sha256-PzZ5vLAyJYT5UZ6C5mTzyoJTcru9JXu/Xy+cPJu4IB0=",
    "homepage": "https://registry.terraform.io/providers/Snowflake-Labs/snowflake",
    "owner": "Snowflake-Labs",
    "repo": "terraform-provider-snowflake",
-    "rev": "v0.99.0",
+    "rev": "v1.0.2",
    "spdx": "MIT",
-    "vendorHash": "sha256-ZHwHYUk2JntdWWH4sqU63Ud/Zb86YNLTrPmJrwcuWDQ="
+    "vendorHash": "sha256-Nf3MBMjsGDOdxTrhHo72NxIXx2xYCU/SEmYGHO6C/3s="
  },
  "sops": {
    "hash": "sha256-MdsWKV98kWpZpTK5qC7x6vN6cODxeeiVVc+gtlh1s88=",
--- a/pkgs/applications/science/math/wxmaxima/default.nix
+++ b/pkgs/applications/science/math/wxmaxima/default.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "wxmaxima";
-  version = "24.11.0";
+  version = "25.01.0";

  src = fetchFromGitHub {
    owner = "wxMaxima-developers";
    repo = "wxmaxima";
    rev = "Version-${finalAttrs.version}";
-    hash = "sha256-3tGMkxp7nadD+LNluIiyPf55Daf7N1MPTH62U8/GxuA=";
+    hash = "sha256-XFlEBmKxpi7NnUxVXV2F+zQKrvR4r93aLtHOoVZ7SPw=";
  };

  buildInputs = [
--- a/pkgs/applications/video/kodi/addons/urllib3/default.nix
+++ b/pkgs/applications/video/kodi/addons/urllib3/default.nix
@ -9,11 +9,11 @@
 buildKodiAddon rec {
  pname = "urllib3";
  namespace = "script.module.urllib3";
-  version = "2.1.0";
+  version = "2.2.3";

  src = fetchzip {
    url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-UCvkeguxytPoP1gIIt8N79TVs98ATzsfrRSabtbgnGc=";
+    sha256 = "sha256-xapFA51ENjkB3IldUey5WqXAjMij66dNqILQjKD/VkA=";
  };

  passthru = {
--- a/pkgs/applications/video/kodi/addons/visualization-projectm/default.nix
+++ b/pkgs/applications/video/kodi/addons/visualization-projectm/default.nix
@ -3,13 +3,13 @@
 buildKodiBinaryAddon rec {
  pname = "visualization-projectm";
  namespace = "visualization.projectm";
-  version = "21.0.2";
+  version = "21.0.3";

  src = fetchFromGitHub {
    owner = "xbmc";
    repo = namespace;
    rev = "${version}-${rel}";
-    hash = "sha256-M+sHws9wp0sp1PnYXCLMZ9w48tJkG159XkyNvzHJNYo=";
+    hash = "sha256-J3RtVl+hO8DspLyF2KAVMLDIJBiEb0bKosKhJyKy9hk=";
  };

  extraBuildInputs = [ pkg-config libGL projectm ];
--- a/pkgs/applications/video/mpv/scripts/autosubsync-mpv.nix
+++ b/pkgs/applications/video/mpv/scripts/autosubsync-mpv.nix
@ -2,7 +2,7 @@
  lib,
  fetchFromGitHub,
  buildLua,
-  alass,
+  ffsubsync,
 }:

 buildLua {
@ -20,9 +20,9 @@ buildLua {
  patchPhase = ''
    runHook prePatch
    substituteInPlace autosubsync.lua                                            \
-      --replace-warn 'alass_path = ""' 'alass_path = "${alass}/bin/alass-cli"'   \
-      --replace-warn 'audio_subsync_tool = "ask"' 'audio_subsync_tool = "alass"' \
-      --replace-warn 'altsub_subsync_tool = "ask"' 'altsub_subsync_tool = "alass"'
+      --replace-warn 'ffsubsync_path = ""' 'ffsubsync_path = "${lib.getExe ffsubsync}"'   \
+      --replace-warn 'audio_subsync_tool = "ask"' 'audio_subsync_tool = "ffsubsync"' \
+      --replace-warn 'altsub_subsync_tool = "ask"' 'altsub_subsync_tool = "ffsubsync"'
    runHook postPatch
  '';

--- a/pkgs/applications/video/mpv/scripts/modernz.nix
+++ b/pkgs/applications/video/mpv/scripts/modernz.nix
@ -7,14 +7,14 @@
 }:
 buildLua (finalAttrs: {
  pname = "modernx";
-  version = "0.2.4";
+  version = "0.2.5";

  scriptPath = "modernz.lua";
  src = fetchFromGitHub {
    owner = "Samillion";
    repo = "ModernZ";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-njFVAxrO5mGaf5zSA4EZN31SakWcroBZuGXYvTnqi68=";
+    hash = "sha256-7qzN9GiZbqzQMY2a0+CgXWirv7FUwIQbmH7ZzknlHlU=";
  };

  postInstall = ''
--- a/pkgs/applications/virtualization/crosvm/default.nix
+++ b/pkgs/applications/virtualization/crosvm/default.nix
@ -2,7 +2,6 @@
  lib,
  rustPlatform,
  fetchgit,
-  fetchpatch,
  pkg-config,
  protobuf,
  python3,
@ -14,33 +13,27 @@
  virglrenderer,
  wayland,
  wayland-protocols,
+  writeShellScript,
+  unstableGitUpdater,
+  nix-update,
  pkgsCross,
 }:

 rustPlatform.buildRustPackage rec {
  pname = "crosvm";
-  version = "130.0";
+  version = "0-unstable-2025-01-21";

  src = fetchgit {
    url = "https://chromium.googlesource.com/chromiumos/platform/crosvm";
-    rev = "9d42f918373f962b7d035ff52a1629e184cb496e";
-    hash = "sha256-h8nAZ4kTidblKNvugEEZUorBthjGi0FmImcBwYy4EHQ=";
+    rev = "c93c22f1da264919ba551db84d43d4a11ea55d8d";
+    hash = "sha256-edhg1ZtlbzsqvmeVO/AddMfmFBcicxTWV5VvZZ25v6U=";
    fetchSubmodules = true;
  };

-  patches = [
-    (fetchpatch {
-      name = "cross-domain.patch";
-      url = "https://chromium.googlesource.com/chromiumos/platform/crosvm/+/60053cdf0b360a03084292b39120365fff65d410%5E%21/?format=TEXT";
-      decode = "base64 -d";
-      hash = "sha256-U5eOxuAtVLjJ+8h16lmbJYNxsP/AOEv/1ec4WlUxP2E=";
-    })
-  ];
-
  separateDebugInfo = true;

  useFetchCargoVendor = true;
-  cargoHash = "sha256-NrRHLDRr5spB/qRvZungNL7qFTdYS32lynJNoY0EjDQ=";
+  cargoHash = "sha256-/0HXHCfaNixT+lKkGlB90bokNrCFQANHSkSKII2pHuU=";

  nativeBuildInputs = [
    pkg-config
@ -70,7 +63,15 @@ rustPlatform.buildRustPackage rec {
  buildFeatures = [ "virgl_renderer" ];

  passthru = {
-    updateScript = ./update.py;
+    updateScript = writeShellScript "update-crosvm.sh" ''
+      set -ue
+      ${lib.escapeShellArgs (unstableGitUpdater {
+        url = "https://chromium.googlesource.com/crosvm/crosvm.git";
+        hardcodeZeroVersion = true;
+      })}
+      exec ${lib.getExe nix-update} --version=skip
+    '';
+
    tests = {
      musl = pkgsCross.musl64.crosvm;
    };
--- a/pkgs/applications/virtualization/crosvm/update.py
+++ b/pkgs/applications/virtualization/crosvm/update.py
@ -1,57 +0,0 @@
-#! /usr/bin/env nix-shell
-#! nix-shell -p common-updater-scripts nix-update python3
-#! nix-shell -i python
-
-import csv
-import json
-import re
-import shlex
-import subprocess
-from os.path import abspath, dirname, splitext
-from urllib.request import urlopen
-
-# CrOS version numbers look like this:
-# [<chrome-major-version>.]<tip-build>.<branch-build>.<branch-branch-build>
-#
-# As far as I can tell, branches are where internal Google
-# modifications are added to turn Chromium OS into Chrome OS, and
-# branch branches are used for fixes for specific devices.  So for
-# Chromium OS they will always be 0.  This is a best guess, and is not
-# documented.
-with urlopen('https://chromiumdash.appspot.com/cros/download_serving_builds_csv?deviceCategory=ChromeOS') as resp:
-    reader = csv.reader(map(bytes.decode, resp))
-    header = reader.__next__()
-    cr_stable_index = header.index('cr_stable')
-    cros_stable_index = header.index('cros_stable')
-    chrome_version = []
-    platform_version = []
-
-    for line in reader:
-        if line[cr_stable_index] == "no update":
-            continue
-        this_chrome_version = list(map(int, line[cr_stable_index].split('.')))
-        this_platform_version = list(map(int, line[cros_stable_index].split('.')))
-        chrome_version = max(chrome_version, this_chrome_version)
-        platform_version = max(platform_version, this_platform_version)
-
-chrome_major_version = chrome_version[0]
-chromeos_tip_build = platform_version[0]
-release_branch = f'release-R{chrome_major_version}-{chromeos_tip_build}.B'
-
-# Determine the git revision.
-with urlopen(f'https://chromium.googlesource.com/chromiumos/platform/crosvm/+/refs/heads/{release_branch}?format=JSON') as resp:
-    resp.readline() # Remove )]}' header
-    rev = json.load(resp)['commit']
-
-# Determine the patch version by counting the commits that have been
-# added to the release branch since it forked off the chromeos branch.
-with urlopen(f'https://chromium.googlesource.com/chromiumos/platform/crosvm/+log/refs/heads/chromeos..{rev}?format=JSON') as resp:
-    resp.readline() # Remove )]}' header
-    branch_commits = json.load(resp)['log']
-    version = f'{chrome_major_version}.{len(branch_commits)}'
-
-# Update the version, git revision, and hash in crosvm's default.nix.
-subprocess.run(['update-source-version', 'crosvm', f'--rev={rev}', version])
-
-# Update cargoHash.
-subprocess.run(['nix-update', '--version=skip', 'crosvm'])
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@ -294,11 +294,11 @@ rec {
  };

  docker_27 = callPackage dockerGen rec {
-    version = "27.5.0";
+    version = "27.5.1";
    cliRev = "v${version}";
-    cliHash = "sha256-PbdT1CL8jSHHPV2iygTXNwoY0qcNF2XUDEAHHsM4fPM=";
+    cliHash = "sha256-7laxRfssh2aGfJeZI0PsJ/MCiy2npigSmCa1SUlWY4s=";
    mobyRev = "v${version}";
-    mobyHash = "sha256-OSkI8F8bUjsCUT/pRWWbfTq9Fno5z35hW9OnLXHrIiQ=";
+    mobyHash = "sha256-q+VCJZ93jvPJQE0xn89prH/6spsarVY3VUEmgwyMxU4=";
    runcRev = "v1.2.3";
    runcHash = "sha256-SdeCmPttMXQdIn3kGWsIM3dfhQCx1C5bMyAM889VVUc=";
    containerdRev = "v1.7.24";
--- a/pkgs/build-support/setup-hooks/add-bin-to-path.sh
+++ b/pkgs/build-support/setup-hooks/add-bin-to-path.sh
@ -0,0 +1,15 @@
+# shellcheck shell=bash
+# This setup hook add $out/bin to the PATH environment variable.
+
+export PATH
+
+addBinToPath () {
+    # shellcheck disable=SC2154
+    if [ -d "$out/bin" ]; then
+        PATH="$out/bin:$PATH"
+        export PATH
+    fi
+}
+
+# shellcheck disable=SC2154
+addEnvHooks "$targetOffset" addBinToPath
--- a/pkgs/build-support/setup-hooks/writable-tmpdir-as-home.sh
+++ b/pkgs/build-support/setup-hooks/writable-tmpdir-as-home.sh
@ -0,0 +1,15 @@
+# shellcheck shell=bash
+# This setup hook set the HOME environment variable to a writable directory.
+
+export HOME
+
+writableTmpDirAsHome () {
+    if [ ! -w "$HOME" ]; then
+        HOME="$NIX_BUILD_TOP/.home"
+        mkdir -p "$HOME"
+        export HOME
+    fi
+}
+
+# shellcheck disable=SC2154
+addEnvHooks "$targetOffset" writableTmpDirAsHome
--- a/pkgs/by-name/ad/ada/package.nix
+++ b/pkgs/by-name/ad/ada/package.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "ada";
-  version = "2.9.2";
+  version = "3.0.0";

  src = fetchFromGitHub {
    owner = "ada-url";
    repo = "ada";
    rev = "v${version}";
-    hash = "sha256-VWFxupmgc+fq9aj/02uMEsiwhP+9PWMSleoIoyKVe3c=";
+    hash = "sha256-6heohik9MlIvDTSWe8U6/mdHuSHaEv4rkGwaz0LH8NU=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/al/alass/package.nix
+++ b/pkgs/by-name/al/alass/package.nix
@ -1,35 +0,0 @@
-{
-  lib,
-  fetchFromGitHub,
-  rustPlatform,
-  makeWrapper,
-  ffmpeg,
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "alass";
-  version = "2.0.0";
-
-  src = fetchFromGitHub {
-    owner = "kaegi";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-q1IV9TtmznpR7RO75iN0p16nmTja5ADWqFj58EOPWvU=";
-  };
-
-  cargoHash = "sha256-6swIoVp1B4CMvaGvq868LTKkzpI6zFKJNgUVqjdyH20=";
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  postInstall = ''
-    wrapProgram "$out/bin/alass-cli" --prefix PATH : "${lib.makeBinPath [ ffmpeg ]}"
-  '';
-
-  meta = with lib; {
-    description = "Automatic Language-Agnostic Subtitles Synchronization";
-    homepage = "https://github.com/kaegi/alass";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ erictapen ];
-    mainProgram = "alass-cli";
-  };
-}
--- a/pkgs/by-name/an/ankama-launcher/package.nix
+++ b/pkgs/by-name/an/ankama-launcher/package.nix
@ -5,15 +5,15 @@
 }:
 let
  pname = "ankama-launcher";
-  version = "3.12.30";
+  version = "3.12.31";

  # The original URL for the launcher is:
  # https://launcher.cdn.ankama.com/installers/production/Ankama%20Launcher-Setup-x86_64.AppImage
  # As it does not encode the version, we use the wayback machine (web.archive.org) to get a fixed URL.
  # To update the client, head to web.archive.org and create a new snapshot of the download page.
  src = fetchurl {
-    url = "https://web.archive.org/web/20250118114812/https://launcher.cdn.ankama.com/installers/production/Ankama%20Launcher-Setup-x86_64.AppImage";
-    hash = "sha256-qgWhC/xWUQpIoCNZcRxBPGpbNTFGysIF2N9a1MsxCFk=";
+    url = "https://web.archive.org/web/20250131072647/https://launcher.cdn.ankama.com/installers/production/Ankama%20Launcher-Setup-x86_64.AppImage";
+    hash = "sha256-ntKuvkY3G00vzWyYnJfz9TifowH2pS9FMeEDDJZMPR8=";
  };

  appimageContents = appimageTools.extract { inherit pname version src; };
--- a/pkgs/by-name/ar/arc-browser/package.nix
+++ b/pkgs/by-name/ar/arc-browser/package.nix
@ -10,11 +10,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "arc-browser";
-  version = "1.78.1-57736";
+  version = "1.79.0-57949";

  src = fetchurl {
    url = "https://releases.arc.net/release/Arc-${finalAttrs.version}.dmg";
-    hash = "sha256-n81GMJ1Lhx8z/wwicyEKCbJM7WVi0mepSbefSXMuM3g=";
+    hash = "sha256-qGcqtBLy83/5PtDxaB3aD5fCeSGQ1/63EpLCA26TDgM=";
  };

  nativeBuildInputs = [ undmg ];
--- a/pkgs/by-name/ar/argocd/package.nix
+++ b/pkgs/by-name/ar/argocd/package.nix
@ -8,17 +8,17 @@

 buildGoModule rec {
  pname = "argocd";
-  version = "2.13.3";
+  version = "2.13.4";

  src = fetchFromGitHub {
    owner = "argoproj";
    repo = "argo-cd";
    rev = "v${version}";
-    hash = "sha256-1z3tTXHVJ3e3g+DAoEGb8P6e4iEe1tiaM+7IPyuQp7U=";
+    hash = "sha256-LBA6GFMBY1zW7h94DBokxA/9dx5/tCSRe+rYQCOgSgo=";
  };

  proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-p+9Q9VOdN7v7iK5oaO5f+B1iyOwVdk672zQsYsrb398=";
+  vendorHash = "sha256-HN0kxDG1DCl6lwmf44lMZmAZ2ban4iT8EIQ03dvZ6X0=";

  # Set target as ./cmd per cli-local
  # https://github.com/argoproj/argo-cd/blob/master/Makefile#L227
--- a/pkgs/by-name/as/ast-grep/package.nix
+++ b/pkgs/by-name/as/ast-grep/package.nix
@ -12,25 +12,20 @@

 rustPlatform.buildRustPackage rec {
  pname = "ast-grep";
-  version = "0.33.1";
+  version = "0.34.3";

  src = fetchFromGitHub {
    owner = "ast-grep";
    repo = "ast-grep";
    tag = version;
-    hash = "sha256-p7SJhkCoo4jBDyr+Z2+qxjUwWXWpVMuXd2/DDOM7Z/Q=";
+    hash = "sha256-r82BDCncRUSmIBQFwsrKDwKEKmvGm/lKtz1rYC47Ems=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-l2fvQqkyAsLGm+KStc2CaTeLrxvNmQgNFd79pLiCk/Y=";
+  cargoHash = "sha256-hxIeRkKPuLftAYAsdk2Hq1+ittGeWDIl9Rryi7MLg90=";

  nativeBuildInputs = [ installShellFiles ];

-  # error: linker `aarch64-linux-gnu-gcc` not found
-  postPatch = ''
-    rm .cargo/config.toml
-  '';
-
  cargoBuildFlags = [
    "--package ast-grep --bin ast-grep"
  ] ++ lib.optionals enableLegacySg [ "--package ast-grep --bin sg" ];
@ -53,21 +48,6 @@ rustPlatform.buildRustPackage rec {
    ''
  );

-  checkFlags =
-    [
-      # disable flaky test
-      "--skip=test::test_load_parser_mac"
-
-      # BUG: Broke by 0.12.1 update (https://github.com/NixOS/nixpkgs/pull/257385)
-      # Please check if this is fixed in future updates of the package
-      "--skip=verify::test_case::tests::test_unmatching_id"
-    ]
-    ++ lib.optionals (with stdenv.hostPlatform; (isDarwin && isx86_64) || (isLinux && isAarch64)) [
-      # x86_64-darwin: source/benches/fixtures/json-mac.so\' (no such file), \'/private/tmp/nix-build-.../source/benches/fixtures/json-mac.so\' (mach-o file, but is an incompatible architecture (have \'arm64\', need \'x86_64h\' or \'x86_64\'))" })
-      # aarch64-linux: /build/source/benches/fixtures/json-linux.so: cannot open shared object file: No such file or directory"
-      "--skip=test::test_load_parser"
-      "--skip=test::test_register_lang"
-    ];
  nativeInstallCheckInputs = [
    versionCheckHook
  ];
--- a/pkgs/by-name/ba/bazecor/package.nix
+++ b/pkgs/by-name/ba/bazecor/package.nix
@ -6,12 +6,12 @@
 }:
 let
  pname = "bazecor";
-  version = "1.6.2";
+  version = "1.6.3";
  src = appimageTools.extract {
    inherit pname version;
    src = fetchurl {
      url = "https://github.com/Dygmalab/Bazecor/releases/download/v${version}/Bazecor-${version}-x64.AppImage";
-      hash = "sha256-FfowCbnhGI0sglFvxf7ActUJC9Lsj97Ui08nObBnjoE=";
+      hash = "sha256-wlPuQGfMq3rHWHMZ30xm5MGWu/ddnajz7GM3QUSrZPo=";
    };

    # Workaround for https://github.com/Dygmalab/Bazecor/issues/370
--- a/pkgs/by-name/be/berglas/package.nix
+++ b/pkgs/by-name/be/berglas/package.nix
@ -35,16 +35,16 @@ in

 buildGoModule rec {
  pname = "berglas";
-  version = "2.0.6";
+  version = "2.0.7";

  src = fetchFromGitHub {
    owner = "GoogleCloudPlatform";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-aTUMEn/QkPzvAyUvMxyqLl6KWFHs+dQK0VDqYv36AGM=";
+    sha256 = "sha256-bW8D8g4FPx0i4iPP7Pvm0UpaJFNsECR3kuHEZn8NLx0=";
  };

-  vendorHash = "sha256-n/NOAmOOoZMFZGreUGNgrZ3XGbhmI52KtgakcJ/SJIc=";
+  vendorHash = "sha256-+ncl/6BJ7J2cby29I1IvkUgbiyDP+co/+Cyyh/V8A1I=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/br/brave/package.nix
+++ b/pkgs/by-name/br/brave/package.nix
@ -3,24 +3,24 @@

 let
  pname = "brave";
-  version = "1.74.48";
+  version = "1.74.50";

  allArchives = {
    aarch64-linux = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-rZl4ftEAXI3q5NYlusR1yFIS0scTc3ZT7O5W9OyHHiQ=";
+      hash = "sha256-vit57iZLBp1wP4SK8nqqZRaCHlxwgMRo2MXHVvw8apk=";
    };
    x86_64-linux = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-qNP3wsqys8iY/GQtDBL2OW8+jc2sZ20CfethR+L3c3E=";
+      hash = "sha256-XnaDaJaqjPOXSXaShia6Ooyn/DegU0vC0XefjBoX6zE=";
    };
    aarch64-darwin = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-KCiPsXf24gOW3gBC1Ajiw6dtdZHHewMj8GTC1pAGiks=";
+      hash = "sha256-9fke4rkaXWO5e9GBF+hdiDUjST8OsYJQ8tHxE5kJAcc=";
    };
    x86_64-darwin = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-x64.zip";
-      hash = "sha256-GWVP/qucLc5KbaaK2GSjrp9hslczJ+vFqbNmIo7iWK0=";
+      hash = "sha256-TwBmR7LlGZlpgIDJ2ShAS5uHwTh8dHvRONJln7Z9rgs=";
    };
  };

--- a/pkgs/by-name/bu/buf/package.nix
+++ b/pkgs/by-name/bu/buf/package.nix
@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "buf";
-  version = "1.49.0";
+  version = "1.50.0";

  src = fetchFromGitHub {
    owner = "bufbuild";
    repo = "buf";
    rev = "v${version}";
-    hash = "sha256-fYCMVR3meuSrTCkM2SfKeh03k4a3n4RHMhWgQ7FsIAU=";
+    hash = "sha256-XRz6hju80NWi87NgVM/JzRNDIJeJSpZPVVEOoxvQAwc=";
  };

-  vendorHash = "sha256-jfpB1QVc5xjJ9uYDcyVmK6fDqnNLV1goEBYX3oEDQQw=";
+  vendorHash = "sha256-7+fHUpYTAy/wBZKq58riNsZ29KnHUG0fWRUYfFhCaOY=";

  patches = [
    # Skip a test that requires networking to be available to work.
--- a/pkgs/by-name/c2/c2fmzq/package.nix
+++ b/pkgs/by-name/c2/c2fmzq/package.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "c2FmZQ";
-  version = "0.4.25";
+  version = "0.4.27";

  src = fetchFromGitHub {
    owner = "c2FmZQ";
    repo = "c2FmZQ";
    rev = "v${version}";
-    hash = "sha256-1c2C+BVgf7NumOoCCMfGFpn1qwQ2V4524aG5yZO98vI=";
+    hash = "sha256-PGZN6+DJWMoBREqvqub9t1XxvtuhgFTFwerOu/v8xTI=";
  };

  ldflags = [
@ -23,7 +23,7 @@ buildGoModule rec {

  sourceRoot = "${src.name}/c2FmZQ";

-  vendorHash = "sha256-9eWLg0+HkpwUC+De62Izh3vadV3dnwPpf8ksH8KwGqQ=";
+  vendorHash = "sha256-zKELnKHwNlXnKsIPr51Ec0bBEOYVMWs/8oQU5zJ+z/s=";

  subPackages = [
    "c2FmZQ-client"
--- a/pkgs/by-name/ca/cables/package.nix
+++ b/pkgs/by-name/ca/cables/package.nix
@ -7,12 +7,12 @@

 let
  pname = "cables";
-  version = "0.5.0";
+  version = "0.5.2";
  name = "${pname}-${version}";

  src = fetchurl {
    url = "https://github.com/cables-gl/cables_electron/releases/download/v${version}/cables-${version}-linux-x64.AppImage";
-    sha256 = "sha256-rwnCIIPQ7a+SDehtl72Q3K3igJmVcOyhKUb9lpW7Zvo=";
+    sha256 = "sha256-TJRhuruNo8LtLm0IS0KJRo4upgYowOtvMviHmfsVltc=";
  };

  appimageContents = appimageTools.extract {
--- a/pkgs/by-name/ca/cargo-aoc/package.nix
+++ b/pkgs/by-name/ca/cargo-aoc/package.nix
@ -2,9 +2,8 @@
  lib,
  rustPlatform,
  fetchCrate,
-  testers,
+  versionCheckHook,
  nix-update-script,
-  cargo-aoc,
 }:
 rustPlatform.buildRustPackage rec {
  pname = "cargo-aoc";
@ -18,10 +17,11 @@ rustPlatform.buildRustPackage rec {
  useFetchCargoVendor = true;
  cargoHash = "sha256-q0kpo6DNR+8129+vJSLoOC/bUYjlfaB77YTht6+kT00=";

-  passthru = {
-    tests.version = testers.testVersion { package = cargo-aoc; };
-    updateScript = nix-update-script { };
-  };
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };

  meta = {
    description = "Simple CLI tool that aims to be a helper for Advent of Code";
--- a/pkgs/by-name/ca/cargo-mobile2/package.nix
+++ b/pkgs/by-name/ca/cargo-mobile2/package.nix
@ -13,7 +13,7 @@
 let
  inherit (darwin.apple_sdk.frameworks) CoreServices;
  pname = "cargo-mobile2";
-  version = "0.17.4";
+  version = "0.17.5";
 in
 rustPlatform.buildRustPackage {
  inherit pname version;
@ -21,7 +21,7 @@ rustPlatform.buildRustPackage {
    owner = "tauri-apps";
    repo = pname;
    rev = "cargo-mobile2-v${version}";
-    hash = "sha256-1lrimBdJwur5b4wB8hZVUtJEbgXoib0ytzjzhkqNE6c=";
+    hash = "sha256-eaKj2S1qiG6qQd7yG4RrK/a+1IsgBybodSTfERDvGE4=";
  };

  # Manually specify the sourceRoot since this crate depends on other crates in the workspace. Relevant info at
@ -29,7 +29,7 @@ rustPlatform.buildRustPackage {
  # sourceRoot = "${src.name}/tooling/cli";

  useFetchCargoVendor = true;
-  cargoHash = "sha256-ay3mB3FahVCx43ZnLSRwk9QR8R7KROCZSf+zfVqQKTY=";
+  cargoHash = "sha256-IW/2Xp52TlqYtvXZqSDv9/Uv9B/thM360ecbbWLXPNE=";

  preBuild = ''
    mkdir -p $out/share/
--- a/pkgs/by-name/ch/chainsaw/package.nix
+++ b/pkgs/by-name/ch/chainsaw/package.nix
@ -17,7 +17,8 @@ rustPlatform.buildRustPackage rec {
    hash = "sha256-ErDIfLhzCiFm3dZzr6ThjYCplfDKbALAqcu8c0gREH4=";
  };

-  cargoHash = "sha256-WuPfYxI61wsQyOKqPF7/a3Hx9vMBCkTkoXsZczgeKpg=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-LTvCExHQnQIbGGeh4bK6b3r9XXOxREMTOlRQv+BjKrM=";

  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
    darwin.apple_sdk.frameworks.CoreFoundation
--- a/pkgs/by-name/cl/clang-tidy-sarif/package.nix
+++ b/pkgs/by-name/cl/clang-tidy-sarif/package.nix
@ -7,15 +7,15 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "clang-tidy-sarif";
-  version = "0.6.6";
+  version = "0.7.0";

  src = fetchCrate {
    inherit pname version;
-    hash = "sha256-rZnGueaqK7h8tWwwWacvFBvJwE1li2wN9iB4DJRHJ8U=";
+    hash = "sha256-DFen1QYQxArNfc0CXNtP0nZEvbCxqTH5KS3q3FcfDPs=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-dEOApNGFKoyYkaoJJqYnOxsntmYCfzSgTS2PQldI0oc=";
+  cargoHash = "sha256-AfkiK91vXaw4oWvfYlV3C0M/cGf4ZThALB/cANcZmFQ=";

  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;
--- a/pkgs/by-name/cl/clash-verge-rev/package.nix
+++ b/pkgs/by-name/cl/clash-verge-rev/package.nix
@ -30,7 +30,7 @@ let
    hash = "sha256-kZf5O3n0xmNUN0G4hAWQDN9Oj9K7PtLpv6jnhh1C5Hg=";
  };

-  service-cargo-hash = "sha256-uo/2QBsZzoTdwRiW0Kr7GGiQCpQH4lW4h5XHqWd5sTU=";
+  service-cargo-hash = "sha256-Sof0jnU5+IGWMmbqVqJmhUzDO6CRlFpwwzYx9Z5tZbk=";

  service = callPackage ./service.nix {
    inherit
--- a/pkgs/by-name/cl/clash-verge-rev/service.nix
+++ b/pkgs/by-name/cl/clash-verge-rev/service.nix
@ -27,5 +27,6 @@ rustPlatform.buildRustPackage {
    OPENSSL_NO_VENDOR = 1;
  };

+  useFetchCargoVendor = true;
  cargoHash = service-cargo-hash;
 }
--- a/pkgs/by-name/cl/clock-rs/package.nix
+++ b/pkgs/by-name/cl/clock-rs/package.nix
@ -15,7 +15,8 @@ rustPlatform.buildRustPackage rec {
    sha256 = "06spnadlgy7902bqhhi6019ay5y55qfrarsfidp938icali9q5pi";
  };

-  cargoHash = "sha256-ir/IwhREheMSdElLYqp3/zHE54BMAK5/7f5/wyTd1yc=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-3XIPrKt6oYugIo5erBE/od55AvBGEZe46l8DMXhhzF4=";

  meta = {
    description = "Modern, digital clock that effortlessly runs in your terminal";
--- a/pkgs/by-name/cl/clorinde/package.nix
+++ b/pkgs/by-name/cl/clorinde/package.nix
@ -8,17 +8,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "clorinde";
-  version = "0.11.2";
+  version = "0.11.3";

  src = fetchFromGitHub {
    owner = "halcyonnouveau";
    repo = "clorinde";
    tag = "clorinde-v${version}";
-    hash = "sha256-Nqf0NNjE3gu+75tjMKAY3Wn75PiPwpnXgXtzdhqx7u8=";
+    hash = "sha256-03lKEAPJTxIXLNF2jVuD6DHJDqTkqCt1Vc+A1/E1CP4=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-ssyx72o/eTcFClLyl4QJ71okqKU2k6SZVH0eGEFzIjs=";
+  cargoHash = "sha256-a/MH1jG3w7zgUQnlLRtZyn+MM7vdlydq/u4XSGPGgSA=";

  cargoBuildFlags = [ "--package=clorinde" ];

--- a/pkgs/by-name/cl/cloudflare-dynamic-dns/package.nix
+++ b/pkgs/by-name/cl/cloudflare-dynamic-dns/package.nix
@ -7,16 +7,16 @@
 }:
 buildGoModule rec {
  pname = "cloudflare-dynamic-dns";
-  version = "4.3.14";
+  version = "4.3.15";

  src = fetchFromGitHub {
    owner = "zebradil";
    repo = "cloudflare-dynamic-dns";
    tag = version;
-    hash = "sha256-inxDeATTu2nbKUQ1hUMuVE4Pnn9nY74HnjMg56n5tCg=";
+    hash = "sha256-COGGHvl6MlRd3mdQYmkMAw6J+G+usC10LHtoFGqzaXQ=";
  };

-  vendorHash = "sha256-i/hPoBurDv/ya7JCnpmx3NHVcNzakdM65DDueBr5Hh4=";
+  vendorHash = "sha256-l/V1L2tsSD1aVXdJf+Kx9fsZjYqBZ3XDgWiUN6l+nE4=";

  subPackages = ".";

--- a/pkgs/by-name/de/decasify/package.nix
+++ b/pkgs/by-name/de/decasify/package.nix
@ -21,10 +21,11 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-HTUAb/yL3H4B/n/Ecd/fDpnTYiqwco/E07sa6pFIIU4=";
  };

-  cargoDeps = rustPlatform.fetchCargoTarball {
+  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
+    dontConfigure = true;
    nativeBuildInputs = [ zstd ];
-    hash = "sha256-bD8MYufI87j//7dIAnCzmp4yoOaT81Zv1i7rjWpjPlc=";
+    hash = "sha256-TywF5nh3ptA4a/wUSlSd7fzcuX4cA2OHT1MbcnjfMq0=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/di/distrobox/package.nix
+++ b/pkgs/by-name/di/distrobox/package.nix
@ -8,13 +8,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "distrobox";
-  version = "1.8.0";
+  version = "1.8.1";

  src = fetchFromGitHub {
    owner = "89luca89";
    repo = "distrobox";
    rev = finalAttrs.version;
-    hash = "sha256-e9oSTk+UlkrkRSipqjjMqwtxEvEZffVBmlSTmsIT7cU=";
+    hash = "sha256-SwSb3UETvimRtbcmD9f6A57MpnHP6p9trW+OBQW5ZyY=";
  };

  dontConfigure = true;
--- a/pkgs/by-name/ea/easyeffects/0001-Revert-Merge-pull-request-3340-from-violetmage-viole.patch
+++ b/pkgs/by-name/ea/easyeffects/0001-Revert-Merge-pull-request-3340-from-violetmage-viole.patch
@ -1,229 +0,0 @@
-From a2f524ffe163e1a15dc8a4b6f21964092ec8e0a7 Mon Sep 17 00:00:00 2001
-From: Sofi <sofi+git@mailbox.org>
-Date: Sat, 28 Sep 2024 00:31:11 +0200
-Subject: [PATCH] Revert "Merge pull request #3340 from
- violetmage/violetmage-spectrum-avsync"
-
-This reverts commit d40ff638e2f0db00579e1f30a9880b7d35f137fd, reversing
-changes made to ee0fe4a8da57ef84a39600ad02280ddc98d9de31.
---
- ...thub.wwmm.easyeffects.spectrum.gschema.xml |  5 --
- data/ui/preferences_spectrum.ui               | 21 -----
- include/spectrum.hpp                          |  5 --
- src/preferences_spectrum.cpp                  |  7 +-
- src/spectrum.cpp                              | 86 +++----------------
- 5 files changed, 14 insertions(+), 110 deletions(-)
-
-diff --git a/data/schemas/com.github.wwmm.easyeffects.spectrum.gschema.xml b/data/schemas/com.github.wwmm.easyeffects.spectrum.gschema.xml
-index 340da382e..1260810f3 100644
--- a/data/schemas/com.github.wwmm.easyeffects.spectrum.gschema.xml
-+++ b/data/schemas/com.github.wwmm.easyeffects.spectrum.gschema.xml
-@@ -49,10 +49,5 @@
-             <range min="120" max="22000" />
-             <default>20000</default>
-         </key>
-
-        <key name="avsync-delay" type="i">
-            <range min="0" max="1000" />
-            <default>0</default>
-        </key>
-     </schema>
- </schemalist>
-\ No newline at end of file
-diff --git a/data/ui/preferences_spectrum.ui b/data/ui/preferences_spectrum.ui
-index 2eae7b8ab..97535d518 100644
--- a/data/ui/preferences_spectrum.ui
-+++ b/data/ui/preferences_spectrum.ui
-@@ -18,27 +18,6 @@
-                         </child>
-                     </object>
-                 </child>
-
-                <child>
-                    <object class="AdwActionRow">
-                        <property name="title" translatable="yes">Compensating Delay (ms)</property>
-
-                        <child>
-                            <object class="GtkSpinButton" id="avsync_delay">
-                                <property name="valign">center</property>
-                                <property name="digits">0</property>
-                                <property name="adjustment">
-                                    <object class="GtkAdjustment">
-                                        <property name="lower">0</property>
-                                        <property name="upper">1000</property>
-                                        <property name="step-increment">1</property>
-                                        <property name="page-increment">10</property>
-                                    </object>
-                                </property>
-                            </object>
-                        </child>
-                    </object>
-                </child>
-             </object>
-         </child>
- 
-diff --git a/include/spectrum.hpp b/include/spectrum.hpp
-index 546ceec59..af49dd9e5 100644
--- a/include/spectrum.hpp
-+++ b/include/spectrum.hpp
-@@ -65,11 +65,6 @@ class Spectrum : public PluginBase {
- 
-   std::array<float, n_bands> real_input;
-   std::array<double, n_bands / 2U + 1U> output;
-  
-  std::vector<float> left_delayed_vector;
-  std::vector<float> right_delayed_vector;
-  std::span<float> left_delayed;
-  std::span<float> right_delayed;
- 
-   std::array<float, n_bands> latest_samples_mono;
- 
-diff --git a/src/preferences_spectrum.cpp b/src/preferences_spectrum.cpp
-index 2902a8ee4..151960bef 100644
--- a/src/preferences_spectrum.cpp
-+++ b/src/preferences_spectrum.cpp
-@@ -49,7 +49,7 @@ struct _PreferencesSpectrum {
- 
-   GtkDropDown* type;
- 
-  GtkSpinButton *n_points, *height, *line_width, *minimum_frequency, *maximum_frequency, *avsync_delay;
-+  GtkSpinButton *n_points, *height, *line_width, *minimum_frequency, *maximum_frequency;
- 
-   GSettings* settings;
- 
-@@ -119,7 +119,6 @@ void preferences_spectrum_class_init(PreferencesSpectrumClass* klass) {
-   gtk_widget_class_bind_template_child(widget_class, PreferencesSpectrum, axis_color_button);
-   gtk_widget_class_bind_template_child(widget_class, PreferencesSpectrum, minimum_frequency);
-   gtk_widget_class_bind_template_child(widget_class, PreferencesSpectrum, maximum_frequency);
-  gtk_widget_class_bind_template_child(widget_class, PreferencesSpectrum, avsync_delay);
- 
-   gtk_widget_class_bind_template_callback(widget_class, on_spectrum_color_set);
-   gtk_widget_class_bind_template_callback(widget_class, on_spectrum_axis_color_set);
-@@ -193,9 +192,9 @@ void preferences_spectrum_init(PreferencesSpectrum* self) {
-   // spectrum section gsettings bindings
- 
-   gsettings_bind_widgets<"show", "fill", "rounded-corners", "show-bar-border", "dynamic-y-scale", "n-points", "height",
-                         "line-width", "minimum-frequency", "maximum-frequency", "avsync-delay">(
-+                         "line-width", "minimum-frequency", "maximum-frequency">(
-       self->settings, self->show, self->fill, self->rounded_corners, self->show_bar_border, self->dynamic_y_scale,
-      self->n_points, self->height, self->line_width, self->minimum_frequency, self->maximum_frequency, self->avsync_delay);
-+      self->n_points, self->height, self->line_width, self->minimum_frequency, self->maximum_frequency);
- 
-   ui::gsettings_bind_enum_to_combo_widget(self->settings, "type", self->type);
- 
-diff --git a/src/spectrum.cpp b/src/spectrum.cpp
-index 28f7ff4da..1075a358f 100644
--- a/src/spectrum.cpp
-+++ b/src/spectrum.cpp
-@@ -55,30 +55,6 @@ Spectrum::Spectrum(const std::string& tag,
- 
-   plan = fftwf_plan_dft_r2c_1d(static_cast<int>(n_bands), real_input.data(), complex_output, FFTW_ESTIMATE);
- 
-
-
-  lv2_wrapper = std::make_unique<lv2::Lv2Wrapper>("http://lsp-plug.in/plugins/lv2/comp_delay_x2_stereo");
-
-  package_installed = lv2_wrapper->found_plugin;
-
-  if (!package_installed) {
-    util::debug(log_tag + "http://lsp-plug.in/plugins/lv2/comp_delay_x2_stereo is not installed, spectrum will not have A/V sync compensation");
-  }
-
-  lv2_wrapper->set_control_port_value("mode_l", 2);
-  lv2_wrapper->set_control_port_value("mode_r", 2);
-
-  lv2_wrapper->set_control_port_value("dry_l", 0.0F);
-  lv2_wrapper->set_control_port_value("dry_r", 0.0F);
-
-  lv2_wrapper->set_control_port_value("wet_l", static_cast<float>(util::db_to_linear(0.0F)));
-  lv2_wrapper->set_control_port_value("wet_r", static_cast<float>(util::db_to_linear(0.0F)));
-
-  lv2_wrapper->bind_key_int<"time_l", "avsync-delay">(settings);
-  lv2_wrapper->bind_key_int<"time_r", "avsync-delay">(settings);
-
-
-
-   g_signal_connect(settings, "changed::show", G_CALLBACK(+[](GSettings* settings, char* key, gpointer user_data) {
-                      auto* self = static_cast<Spectrum*>(user_data);
- 
-@@ -106,19 +82,6 @@ Spectrum::~Spectrum() {
- void Spectrum::setup() {
-   std::ranges::fill(real_input, 0.0F);
-   std::ranges::fill(latest_samples_mono, 0.0F);
-
-  left_delayed_vector.resize(n_samples, 0.0F);
-  right_delayed_vector.resize(n_samples, 0.0F);
-
-  left_delayed = std::span<float>(left_delayed_vector);
-  right_delayed = std::span<float>(right_delayed_vector);
-
-  lv2_wrapper->set_n_samples(n_samples);
-
-  if (lv2_wrapper->get_rate() != rate) {
-    util::debug(log_tag + " creating instance of comp delay x2 stereo for spectrum A/V sync");
-    lv2_wrapper->create_instance(rate);
-  }
- }
- 
- void Spectrum::process(std::span<float>& left_in,
-@@ -132,46 +95,19 @@ void Spectrum::process(std::span<float>& left_in,
-     return;
-   }
- 
-  // delay the visualization of the spectrum by the reported latency
-  // of the output device, so that the spectrum is visually in sync
-  // with the audio as experienced by the user. (A/V sync)
-  if ( lv2_wrapper->found_plugin && lv2_wrapper->has_instance() ) {
-    lv2_wrapper->connect_data_ports(left_in, right_in, left_delayed, right_delayed);
-    lv2_wrapper->run();
-+  if (n_samples < n_bands) {
-+    // Drop the oldest quantum.
-+    std::memmove(&latest_samples_mono[0], &latest_samples_mono[n_samples],
-+        (n_bands - n_samples) * sizeof(float));
- 
-    // Downmix the latest n_bands samples from the delayed signal.
-    if (n_samples < n_bands) {
-      // Drop the oldest quantum.
-      std::memmove(&latest_samples_mono[0], &latest_samples_mono[n_samples],
-          (n_bands - n_samples) * sizeof(float));
-
-      // Copy the new quantum.
-      for (size_t n = 0; n < n_samples; n++) {
-        latest_samples_mono[n_bands - n_samples + n] = 0.5F * (left_delayed[n] + right_delayed[n]);
-      }
-    } else {
-      // Copy the latest n_bands samples.
-      for (size_t n = 0; n < n_bands; n++)
-        latest_samples_mono[n] = 0.5F * (left_delayed[n_samples - n_bands + n] +
-                                        right_delayed[n_samples - n_bands + n]);
-    }
-+    // Copy the new quantum.
-+    for (size_t n = 0; n < n_samples; n++)
-+      latest_samples_mono[n_bands - n_samples + n] = 0.5F * (left_in[n] + right_in[n]);
-   } else {
-    // Downmix the latest n_bands samples from the non-delayed signal.
-    if (n_samples < n_bands) {
-      // Drop the oldest quantum.
-      std::memmove(&latest_samples_mono[0], &latest_samples_mono[n_samples],
-          (n_bands - n_samples) * sizeof(float));
-
-      // Copy the new quantum.
-      for (size_t n = 0; n < n_samples; n++) {
-        latest_samples_mono[n_bands - n_samples + n] = 0.5F * (left_in[n] + right_in[n]);
-      }
-    } else {
-      // Copy the latest n_bands samples.
-      for (size_t n = 0; n < n_bands; n++)
-        latest_samples_mono[n] = 0.5F * (left_in[n_samples - n_bands + n] +
-                                        right_in[n_samples - n_bands + n]);
-    }
-+    // Copy the latest n_bands samples.
-+    for (size_t n = 0; n < n_bands; n++)
-+      latest_samples_mono[n] = 0.5F * (left_in[n_samples - n_bands + n] +
-+                                       right_in[n_samples - n_bands + n]);
-   }
- 
-   /*
-- 
-2.46.0
-
--- a/pkgs/by-name/ea/easyeffects/package.nix
+++ b/pkgs/by-name/ea/easyeffects/package.nix
@ -1,11 +1,11 @@
 {
  lib,
  stdenv,
-  fetchFromGitHub,
  appstream-glib,
  calf,
  deepfilternet,
  desktop-file-utils,
+  fetchFromGitHub,
  fftw,
  fftwFloat,
  fmt_9,
@ -45,15 +45,16 @@ let
  # Fix crashes with speexdsp effects
  speexdsp' = speexdsp.override { withFftw3 = false; };
 in
+
 stdenv.mkDerivation rec {
  pname = "easyeffects";
-  version = "7.1.9";
+  version = "7.2.3";

  src = fetchFromGitHub {
    owner = "wwmm";
    repo = "easyeffects";
    tag = "v${version}";
-    hash = "sha256-It+kldlhThWF9y/rTgKt9QlIouH1cQcCtSHQTsaGjfo=";
+    hash = "sha256-bTyPStOQusIho8x6RI+2Z+4wHSG9ERjo4NuvLUILIm8=";
  };

  nativeBuildInputs = [
@ -102,6 +103,7 @@ stdenv.mkDerivation rec {
        mda_lv2 # loudness
        zam-plugins # maximizer
      ];
+
      ladspaPlugins = [
        deepfilternet # deep noise remover
        rubberband # pitch shifting
@ -114,11 +116,6 @@ stdenv.mkDerivation rec {
      )
    '';

-  patches = [
-    # Remove when lsp-plugins is >= 1.2.17. (https://github.com/wwmm/easyeffects/issues/3394)
-    ./0001-Revert-Merge-pull-request-3340-from-violetmage-viole.patch
-  ];
-
  separateDebugInfo = true;

  passthru = {
--- a/pkgs/by-name/el/element-desktop/seshat/default.nix
+++ b/pkgs/by-name/el/element-desktop/seshat/default.nix
@ -29,6 +29,8 @@ rustPlatform.buildRustPackage rec {

  sourceRoot = "${src.name}/seshat-node/native";

+  useFetchCargoVendor = true;
+
  nativeBuildInputs = [
    nodejs
    python3
--- a/pkgs/by-name/el/element-desktop/seshat/pin.json
+++ b/pkgs/by-name/el/element-desktop/seshat/pin.json
@ -2,5 +2,5 @@
  "version": "2.3.3",
  "srcHash": "sha256-HmKHWFoO8TQ9S/RcJnJ3h85/2uSkqGrgLnX82hkux4Q=",
  "yarnHash": "1cbkv8ap7f8vxl5brzqb86d2dyxg555sz67cldrp0vgnk8sq6ibp",
-  "cargoHash": "sha256-WsgTbQ91aZZV5sIuFVjsccdiXivjtAUC1Zs/4uNk1zU="
+  "cargoHash": "sha256-klrFk0gpqQu/9MzLEYMNqEBETZMXtZJX67Sm5ZqyHfE=="
 }
--- a/pkgs/by-name/el/elmerfem/package.nix
+++ b/pkgs/by-name/el/elmerfem/package.nix
@ -58,6 +58,8 @@ stdenv.mkDerivation rec {

  storepath = placeholder "out";

+  NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+
  cmakeFlags = [
    "-DELMER_INSTALL_LIB_DIR=${storepath}/lib"
    "-DWITH_OpenMP:BOOLEAN=TRUE"
--- a/pkgs/by-name/er/ergochat/package.nix
+++ b/pkgs/by-name/er/ergochat/package.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "ergo";
-  version = "2.14.0";
+  version = "2.15.0";

  src = fetchFromGitHub {
    owner = "ergochat";
    repo = "ergo";
    rev = "v${version}";
-    sha256 = "sha256-vXspI0BkwpS9w7PQpj+U3REQcSPaPJAfIBRj62loQzQ=";
+    sha256 = "sha256-8qZ5pnbCYN/j8B5cS456HVK2hDGqJwrPo1k4oagJrqU=";
  };

  vendorHash = null;
--- a/pkgs/by-name/fa/factorio/versions.json
+++ b/pkgs/by-name/fa/factorio/versions.json
@ -3,25 +3,25 @@
    "alpha": {
      "experimental": {
        "candidateHashFilenames": [
-          "factorio_linux_2.0.28.tar.xz"
+          "factorio_linux_2.0.32.tar.xz"
        ],
-        "name": "factorio_alpha_x64-2.0.28.tar.xz",
+        "name": "factorio_alpha_x64-2.0.32.tar.xz",
        "needsAuth": true,
-        "sha256": "d3acf17e4ca56e3332e920a015d5ca53aea73088460c8b2f67e04b04e7b912bb",
+        "sha256": "4c3434986bbe7d10e02b742d36ecad36f13b7c125204bf2ad34f17b804cf611f",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.28/alpha/linux64",
-        "version": "2.0.28"
+        "url": "https://factorio.com/get-download/2.0.32/alpha/linux64",
+        "version": "2.0.32"
      },
      "stable": {
        "candidateHashFilenames": [
-          "factorio_linux_2.0.28.tar.xz"
+          "factorio_linux_2.0.32.tar.xz"
        ],
-        "name": "factorio_alpha_x64-2.0.28.tar.xz",
+        "name": "factorio_alpha_x64-2.0.32.tar.xz",
        "needsAuth": true,
-        "sha256": "d3acf17e4ca56e3332e920a015d5ca53aea73088460c8b2f67e04b04e7b912bb",
+        "sha256": "4c3434986bbe7d10e02b742d36ecad36f13b7c125204bf2ad34f17b804cf611f",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.28/alpha/linux64",
-        "version": "2.0.28"
+        "url": "https://factorio.com/get-download/2.0.32/alpha/linux64",
+        "version": "2.0.32"
      }
    },
    "demo": {
@ -50,51 +50,51 @@
    "expansion": {
      "experimental": {
        "candidateHashFilenames": [
-          "factorio-space-age_linux_2.0.28.tar.xz"
+          "factorio-space-age_linux_2.0.32.tar.xz"
        ],
-        "name": "factorio_expansion_x64-2.0.28.tar.xz",
+        "name": "factorio_expansion_x64-2.0.32.tar.xz",
        "needsAuth": true,
-        "sha256": "e3eee33c439abaffa305dd5c86edea97fbaa2a2b34c368cae3595c1d5d22739e",
+        "sha256": "51b1cad9d665015e200ea0f69619454ebf0f60557d1f78c857c4526dad2e3d77",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.28/expansion/linux64",
-        "version": "2.0.28"
+        "url": "https://factorio.com/get-download/2.0.32/expansion/linux64",
+        "version": "2.0.32"
      },
      "stable": {
        "candidateHashFilenames": [
-          "factorio-space-age_linux_2.0.28.tar.xz"
+          "factorio-space-age_linux_2.0.32.tar.xz"
        ],
-        "name": "factorio_expansion_x64-2.0.28.tar.xz",
+        "name": "factorio_expansion_x64-2.0.32.tar.xz",
        "needsAuth": true,
-        "sha256": "e3eee33c439abaffa305dd5c86edea97fbaa2a2b34c368cae3595c1d5d22739e",
+        "sha256": "51b1cad9d665015e200ea0f69619454ebf0f60557d1f78c857c4526dad2e3d77",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.28/expansion/linux64",
-        "version": "2.0.28"
+        "url": "https://factorio.com/get-download/2.0.32/expansion/linux64",
+        "version": "2.0.32"
      }
    },
    "headless": {
      "experimental": {
        "candidateHashFilenames": [
-          "factorio-headless_linux_2.0.28.tar.xz",
-          "factorio_headless_x64_2.0.28.tar.xz"
+          "factorio-headless_linux_2.0.32.tar.xz",
+          "factorio_headless_x64_2.0.32.tar.xz"
        ],
-        "name": "factorio_headless_x64-2.0.28.tar.xz",
+        "name": "factorio_headless_x64-2.0.32.tar.xz",
        "needsAuth": false,
-        "sha256": "ea9937b6adc7a18e17a4e1e64992ec389407497b36e68280bb14fcdd4c884dd3",
+        "sha256": "2a6102ae42dcc5e8fe923bd68bcd326a569e35912acde121301e5d4d2d856417",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.28/headless/linux64",
-        "version": "2.0.28"
+        "url": "https://factorio.com/get-download/2.0.32/headless/linux64",
+        "version": "2.0.32"
      },
      "stable": {
        "candidateHashFilenames": [
-          "factorio-headless_linux_2.0.28.tar.xz",
-          "factorio_headless_x64_2.0.28.tar.xz"
+          "factorio-headless_linux_2.0.32.tar.xz",
+          "factorio_headless_x64_2.0.32.tar.xz"
        ],
-        "name": "factorio_headless_x64-2.0.28.tar.xz",
+        "name": "factorio_headless_x64-2.0.32.tar.xz",
        "needsAuth": false,
-        "sha256": "ea9937b6adc7a18e17a4e1e64992ec389407497b36e68280bb14fcdd4c884dd3",
+        "sha256": "2a6102ae42dcc5e8fe923bd68bcd326a569e35912acde121301e5d4d2d856417",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.28/headless/linux64",
-        "version": "2.0.28"
+        "url": "https://factorio.com/get-download/2.0.32/headless/linux64",
+        "version": "2.0.32"
      }
    }
  }
--- a/pkgs/by-name/gg/gg-jj/native-tls.patch
+++ b/pkgs/by-name/gg/gg-jj/native-tls.patch
@ -0,0 +1,351 @@
+diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock
+index 37a1a2d..45640a1 100644
+--- a/src-tauri/Cargo.lock
+++ b/src-tauri/Cargo.lock
+@@ -778,9 +778,9 @@ dependencies = [
+  "bitflags 2.6.0",
+  "block",
+  "cocoa-foundation",
+- "core-foundation",
+ "core-foundation 0.10.0",
+  "core-graphics",
+- "foreign-types",
+ "foreign-types 0.5.0",
+  "libc",
+  "objc",
+ ]
+@@ -793,7 +793,7 @@ checksum = "e14045fb83be07b5acf1c0884b2180461635b433455fa35d1cd6f17f1450679d"
+ dependencies = [
+  "bitflags 2.6.0",
+  "block",
+- "core-foundation",
+ "core-foundation 0.10.0",
+  "core-graphics-types",
+  "libc",
+  "objc",
+@@ -873,6 +873,16 @@ dependencies = [
+  "version_check",
+ ]
+ 
+[[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+ [[package]]
+ name = "core-foundation"
+ version = "0.10.0"
+@@ -896,9 +906,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "fa95a34622365fa5bbf40b20b75dba8dfa8c94c734aea8ac9a5ca38af14316f1"
+ dependencies = [
+  "bitflags 2.6.0",
+- "core-foundation",
+ "core-foundation 0.10.0",
+  "core-graphics-types",
+- "foreign-types",
+ "foreign-types 0.5.0",
+  "libc",
+ ]
+ 
+@@ -909,7 +919,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "3d44a101f213f6c4cdc1853d4b78aef6db6bdfa3468798cc1d9912f4735013eb"
+ dependencies = [
+  "bitflags 2.6.0",
+- "core-foundation",
+ "core-foundation 0.10.0",
+  "libc",
+ ]
+ 
+@@ -1435,6 +1445,15 @@ version = "0.1.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "f81ec6369c545a7d40e4589b5597581fa1c441fe1cce96dd1de43159910a36a2"
+ 
+[[package]]
+name = "foreign-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
+dependencies = [
+ "foreign-types-shared 0.1.1",
+]
+
+ [[package]]
+ name = "foreign-types"
+ version = "0.5.0"
+@@ -1442,7 +1461,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "d737d9aa519fb7b749cbc3b962edcf310a8dd1f4b67c91c4f83975dbdd17d965"
+ dependencies = [
+  "foreign-types-macros",
+- "foreign-types-shared",
+ "foreign-types-shared 0.3.1",
+ ]
+ 
+ [[package]]
+@@ -1456,6 +1475,12 @@ dependencies = [
+  "syn 2.0.87",
+ ]
+ 
+[[package]]
+name = "foreign-types-shared"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
+
+ [[package]]
+ name = "foreign-types-shared"
+ version = "0.3.1"
+@@ -2779,6 +2804,22 @@ dependencies = [
+  "want",
+ ]
+ 
+[[package]]
+name = "hyper-tls"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
+dependencies = [
+ "bytes",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "native-tls",
+ "tokio",
+ "tokio-native-tls",
+ "tower-service",
+]
+
+ [[package]]
+ name = "hyper-util"
+ version = "0.1.10"
+@@ -3418,9 +3459,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "libc"
+-version = "0.2.163"
+version = "0.2.164"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "1fdaeca4cf44ed4ac623e86ef41f056e848dbeab7ec043ecb7326ba300b36fd0"
+checksum = "433bfe06b8c75da9b2e3fbea6e5329ff87748f0b144ef75306e674c3f6f7c13f"
+ 
+ [[package]]
+ name = "libgit2-sys"
+@@ -3453,7 +3494,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "4979f22fdb869068da03c9f7528f8297c6fd2606bc3a4affe42e6a823fdb8da4"
+ dependencies = [
+  "cfg-if",
+- "windows-targets 0.52.6",
+ "windows-targets 0.48.5",
+ ]
+ 
+ [[package]]
+@@ -3688,6 +3729,23 @@ dependencies = [
+  "windows-sys 0.59.0",
+ ]
+ 
+[[package]]
+name = "native-tls"
+version = "0.2.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0dab59f8e050d5df8e4dd87d9206fb6f65a483e20ac9fda365ade4fab353196c"
+dependencies = [
+ "libc",
+ "log",
+ "openssl",
+ "openssl-probe",
+ "openssl-sys",
+ "schannel",
+ "security-framework",
+ "security-framework-sys",
+ "tempfile",
+]
+
+ [[package]]
+ name = "ndk"
+ version = "0.9.0"
+@@ -4065,6 +4123,32 @@ dependencies = [
+  "pathdiff",
+ ]
+ 
+[[package]]
+name = "openssl"
+version = "0.10.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f5e534d133a060a3c19daec1eb3e98ec6f4685978834f2dbadfe2ec215bab64e"
+dependencies = [
+ "bitflags 2.6.0",
+ "cfg-if",
+ "foreign-types 0.3.2",
+ "libc",
+ "once_cell",
+ "openssl-macros",
+ "openssl-sys",
+]
+
+[[package]]
+name = "openssl-macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.87",
+]
+
+ [[package]]
+ name = "openssl-probe"
+ version = "0.1.5"
+@@ -4854,19 +4938,23 @@ dependencies = [
+  "http-body",
+  "http-body-util",
+  "hyper",
+ "hyper-tls",
+  "hyper-util",
+  "ipnet",
+  "js-sys",
+  "log",
+  "mime",
+ "native-tls",
+  "once_cell",
+  "percent-encoding",
+  "pin-project-lite",
+ "rustls-pemfile",
+  "serde",
+  "serde_json",
+  "serde_urlencoded",
+  "sync_wrapper",
+  "tokio",
+ "tokio-native-tls",
+  "tokio-util 0.7.12",
+  "tower-service",
+  "url",
+@@ -5000,6 +5088,21 @@ dependencies = [
+  "windows-sys 0.52.0",
+ ]
+ 
+[[package]]
+name = "rustls-pemfile"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16f1201b3c9a7ee8039bcadc17b7e605e2945b27eee7631788c1bd2b0643674b"
+
+ [[package]]
+ name = "rustversion"
+ version = "1.0.18"
+@@ -5027,6 +5130,15 @@ version = "0.1.4"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "088c5d71572124929ea7549a8ce98e1a6fd33d0a38367b09027b382e67c033db"
+ 
+[[package]]
+name = "schannel"
+version = "0.1.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01227be5826fa0690321a2ba6c5cd57a19cf3f6a09e76973b58e61de6ab9d1c1"
+dependencies = [
+ "windows-sys 0.59.0",
+]
+
+ [[package]]
+ name = "schemars"
+ version = "0.8.21"
+@@ -5089,6 +5201,29 @@ version = "4.1.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "1c107b6f4780854c8b126e228ea8869f4d7b71260f962fefb57b996b8959ba6b"
+ 
+[[package]]
+name = "security-framework"
+version = "2.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
+dependencies = [
+ "bitflags 2.6.0",
+ "core-foundation 0.9.4",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa39c7303dc58b5543c94d22c1766b0d31f2ee58306363ea622b10bbc075eaa2"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+ [[package]]
+ name = "selectors"
+ version = "0.22.0"
+@@ -5436,7 +5571,7 @@ dependencies = [
+  "bytemuck",
+  "cfg_aliases",
+  "core-graphics",
+- "foreign-types",
+ "foreign-types 0.5.0",
+  "js-sys",
+  "log",
+  "objc2",
+@@ -5631,7 +5766,7 @@ checksum = "6682a07cf5bab0b8a2bd20d0a542917ab928b5edb75ebd4eda6b05cbaab872da"
+ dependencies = [
+  "bitflags 2.6.0",
+  "cocoa",
+- "core-foundation",
+ "core-foundation 0.10.0",
+  "core-graphics",
+  "crossbeam-channel",
+  "dispatch",
+@@ -6208,6 +6343,16 @@ dependencies = [
+  "syn 2.0.87",
+ ]
+ 
+[[package]]
+name = "tokio-native-tls"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbae76ab933c85776efabc971569dd6119c580d8f5d448769dec1764bf796ef2"
+dependencies = [
+ "native-tls",
+ "tokio",
+]
+
+ [[package]]
+ name = "tokio-util"
+ version = "0.6.10"
+@@ -7006,7 +7151,7 @@ version = "0.1.9"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
+ dependencies = [
+- "windows-sys 0.59.0",
+ "windows-sys 0.48.0",
+ ]
+ 
+ [[package]]
+diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
+index 550b0cf..9b711a4 100644
+--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
+@@ -14,7 +14,7 @@ zip = "0.6"
+ assert_matches = "1.5"
+ 
+ [dependencies]
+-tauri = { version = "2.0.0", features = [] }
+tauri = { version = "2.0.0", features = ["native-tls"] }
+ tauri-codegen = "2.0.0"
+ tauri-macros = "2.0.0"
+ tauri-plugin = "2.0.0"
--- a/pkgs/by-name/gg/gg-jj/package.nix
+++ b/pkgs/by-name/gg/gg-jj/package.nix
@ -32,22 +32,23 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-iQxPJgMxBtyindkNdQkehwPf7ZgWCI09PToqs2y1Hfw=";
  };

+  patches = [ ./native-tls.patch ];
  cargoRoot = "src-tauri";
  buildAndTestSubdir = "src-tauri";

  # FIXME: Switch back to cargoHash when https://github.com/NixOS/nixpkgs/issues/356811 is fixed
  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) pname version src;
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      patches
+      ;
+    # Tries to apply patches inside cargoRoot.
+    prePatch = "pushd ..";
+    postPatch = "popd";
    sourceRoot = "${finalAttrs.src.name}/${finalAttrs.cargoRoot}";
-    hash = "sha256-IyU8dqtQbKcoymTOP01givB1968MUNas2znqsdbcqdw=";
-
-    nativeBuildInputs = [ yq ];
-
-    # Work around https://github.com/rust-lang/cargo/issues/10801
-    # See https://discourse.nixos.org/t/rust-tauri-v2-error-no-matching-package-found/56751/4
-    preBuild = ''
-      tomlq -it '.dependencies.tauri.features += ["native-tls"]' Cargo.toml
-    '';
+    hash = "sha256-zEYU5l57VxVKKhoGfa77kT05vwoLyAu9eyt7C9dhAGM=";
  };

  npmDeps = fetchNpmDeps {
--- a/pkgs/by-name/gh/gh/package.nix
+++ b/pkgs/by-name/gh/gh/package.nix
@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "gh";
-  version = "2.65.0";
+  version = "2.66.0";

  src = fetchFromGitHub {
    owner = "cli";
    repo = "cli";
    tag = "v${version}";
-    hash = "sha256-Rg6GAItG0OFDCK7rEuJs6i4QWHK3sveIh6UQVlA37mg=";
+    hash = "sha256-6IxXbi0vWb/AT64q5aZiV1wuz5viksXdxonLfJlu3y0=";
  };

-  vendorHash = "sha256-MVjZUT1OEMAJZVsbCRg/ds57QgyiL9rLRfIo4HHHSmU=";
+  vendorHash = "sha256-gLFPr6b9zkkvmhcljnuB23MAMa9xELsUHtcP8xTfWFE=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/gh/ghostty/deps.nix
+++ b/pkgs/by-name/gh/ghostty/deps.nix
@ -15,7 +15,10 @@ with lib;

 let
  unpackZigArtifact =
-    { name, artifact }:
+    {
+      name,
+      artifact,
+    }:
    runCommandLocal name
      {
        nativeBuildInputs = [ zig ];
@ -89,11 +92,11 @@ let
 in
 linkFarm name [
  {
-    name = "12206029de146b685739f69b10a6f08baee86b3d0a5f9a659fa2b2b66c9602078bbf";
+    name = "1220ebf88622c4d502dc59e71347e4d28c47e033f11b59aff774ae5787565c40999c";
    path = fetchZigArtifact {
      name = "libxev";
-      url = "https://github.com/mitchellh/libxev/archive/db6a52bafadf00360e675fefa7926e8e6c0e9931.tar.gz";
-      hash = "sha256-4GT5wkfkZnIjNv20yDiWEzHAhbIiwHHJfS7A4u/LoNQ=";
+      url = "https://github.com/mitchellh/libxev/archive/31eed4e337fed7b0149319e5cdbb62b848c24fbd.tar.gz";
+      hash = "sha256-VHP90NTytIZ8UZsYRKOOxN490/I6yv6ec40sP8y5MJ8=";
    };
  }
  {
@ -144,38 +147,6 @@ linkFarm name [
      hash = "sha256-EhV2bmTY/OMYN1wEul35gD0hQgS/Al262jO3pVr0O+c=";
    };
  }
-  {
-    name = "1220e17e64ef0ef561b3e4b9f3a96a2494285f2ec31c097721bf8c8677ec4415c634";
-    path = fetchZigArtifact {
-      name = "zig_objc";
-      url = "https://github.com/mitchellh/zig-objc/archive/9b8ba849b0f58fe207ecd6ab7c147af55b17556e.tar.gz";
-      hash = "sha256-H+HIbh2T23uzrsg9/1/vl9Ir1HCAa2pzeTx6zktJH9Q=";
-    };
-  }
-  {
-    name = "12205a66d423259567764fa0fc60c82be35365c21aeb76c5a7dc99698401f4f6fefc";
-    path = fetchZigArtifact {
-      name = "zig_js";
-      url = "https://github.com/mitchellh/zig-js/archive/d0b8b0a57c52fbc89f9d9fecba75ca29da7dd7d1.tar.gz";
-      hash = "sha256-fyNeCVbC9UAaKJY6JhAZlT0A479M/AKYMPIWEZbDWD0=";
-    };
-  }
-  {
-    name = "12207831bce7d4abce57b5a98e8f3635811cfefd160bca022eb91fe905d36a02cf25";
-    path = fetchZigArtifact {
-      name = "ziglyph";
-      url = "https://deps.files.ghostty.org/ziglyph-b89d43d1e3fb01b6074bc1f7fc980324b04d26a5.tar.gz";
-      hash = "sha256-cse98+Ft8QUjX+P88yyYfaxJOJGQ9M7Ymw7jFxDz89k=";
-    };
-  }
-  {
-    name = "1220cc25b537556a42b0948437c791214c229efb78b551c80b1e9b18d70bf0498620";
-    path = fetchZigArtifact {
-      name = "iterm2_themes";
-      url = "https://github.com/mbadolato/iTerm2-Color-Schemes/archive/e030599a6a6e19fcd1ea047c7714021170129d56.tar.gz";
-      hash = "sha256-hFGjD0rNfZ7Qd7uJZgVn+FmIVXunbjLT+E1BoXhXoJE=";
-    };
-  }
  {
    name = "12200df4ebeaed45de26cb2c9f3b6f3746d8013b604e035dae658f86f586c8c91d2f";
    path = fetchZigArtifact {
@ -200,6 +171,46 @@ linkFarm name [
      hash = "sha256-2x9hT7bYq9KJYWLVOf21a+QvTG/F7HWT+YK15IMRzNY=";
    };
  }
+  {
+    name = "12201f0d542e7541cf492a001d4d0d0155c92f58212fbcb0d224e95edeba06b5416a";
+    path = fetchZigArtifact {
+      name = "z2d";
+      url = "git+https://github.com/vancluever/z2d?ref=v0.4.0#4638bb02a9dc41cc2fb811f092811f6a951c752a";
+      hash = "sha256-YpWXn1J3JKQSCrWB25mAfzd1/T56QstEZnhPzBwxgoM=";
+    };
+  }
+  {
+    name = "1220e17e64ef0ef561b3e4b9f3a96a2494285f2ec31c097721bf8c8677ec4415c634";
+    path = fetchZigArtifact {
+      name = "zig_objc";
+      url = "https://github.com/mitchellh/zig-objc/archive/9b8ba849b0f58fe207ecd6ab7c147af55b17556e.tar.gz";
+      hash = "sha256-H+HIbh2T23uzrsg9/1/vl9Ir1HCAa2pzeTx6zktJH9Q=";
+    };
+  }
+  {
+    name = "12205a66d423259567764fa0fc60c82be35365c21aeb76c5a7dc99698401f4f6fefc";
+    path = fetchZigArtifact {
+      name = "zig_js";
+      url = "https://github.com/mitchellh/zig-js/archive/d0b8b0a57c52fbc89f9d9fecba75ca29da7dd7d1.tar.gz";
+      hash = "sha256-fyNeCVbC9UAaKJY6JhAZlT0A479M/AKYMPIWEZbDWD0=";
+    };
+  }
+  {
+    name = "12207831bce7d4abce57b5a98e8f3635811cfefd160bca022eb91fe905d36a02cf25";
+    path = fetchZigArtifact {
+      name = "ziglyph";
+      url = "https://deps.files.ghostty.org/ziglyph-b89d43d1e3fb01b6074bc1f7fc980324b04d26a5.tar.gz";
+      hash = "sha256-cse98+Ft8QUjX+P88yyYfaxJOJGQ9M7Ymw7jFxDz89k=";
+    };
+  }
+  {
+    name = "12209ca054cb1919fa276e328967f10b253f7537c4136eb48f3332b0f7cf661cad38";
+    path = fetchZigArtifact {
+      name = "zig_wayland";
+      url = "https://codeberg.org/ifreund/zig-wayland/archive/fbfe3b4ac0b472a27b1f1a67405436c58cbee12d.tar.gz";
+      hash = "sha256-RtAystqK/GRYIquTK1KfD7rRSCrfuzAvCD1Z9DE1ldc=";
+    };
+  }
  {
    name = "1220edc3b8d8bedbb50555947987e5e8e2f93871ca3c8e8d4cc8f1377c15b5dd35e8";
    path = fetchZigArtifact {
@ -217,11 +228,35 @@ linkFarm name [
    };
  }
  {
-    name = "12201f0d542e7541cf492a001d4d0d0155c92f58212fbcb0d224e95edeba06b5416a";
+    name = "12202cdac858abc52413a6c6711d5026d2d3c8e13f95ca2c327eade0736298bb021f";
    path = fetchZigArtifact {
-      name = "z2d";
-      url = "git+https://github.com/vancluever/z2d?ref=v0.4.0#4638bb02a9dc41cc2fb811f092811f6a951c752a";
-      hash = "sha256-YpWXn1J3JKQSCrWB25mAfzd1/T56QstEZnhPzBwxgoM=";
+      name = "wayland";
+      url = "https://deps.files.ghostty.org/wayland-9cb3d7aa9dc995ffafdbdef7ab86a949d0fb0e7d.tar.gz";
+      hash = "sha256-m9G72jdG30KH2yQhNBcBJ46OnekzuX0i2uIOyczkpLk=";
+    };
+  }
+  {
+    name = "12201a57c6ce0001aa034fa80fba3e1cd2253c560a45748f4f4dd21ff23b491cddef";
+    path = fetchZigArtifact {
+      name = "wayland_protocols";
+      url = "https://deps.files.ghostty.org/wayland-protocols-258d8f88f2c8c25a830c6316f87d23ce1a0f12d9.tar.gz";
+      hash = "sha256-XO3K3egbdeYPI+XoO13SuOtO+5+Peb16NH0UiusFMPg=";
+    };
+  }
+  {
+    name = "12207e0851c12acdeee0991e893e0132fc87bb763969a585dc16ecca33e88334c566";
+    path = fetchZigArtifact {
+      name = "plasma_wayland_protocols";
+      url = "git+https://github.com/KDE/plasma-wayland-protocols?ref=main#db525e8f9da548cffa2ac77618dd0fbe7f511b86";
+      hash = "sha256-iWRv3+OfmHxmeCJ8m0ChjgZX6mwXlcFmK8P/Vt8gDj4=";
+    };
+  }
+  {
+    name = "12204fc99743d8232e691ac22e058519bfc6ea92de4a11c6dba59b117531c847cd6a";
+    path = fetchZigArtifact {
+      name = "iterm2_themes";
+      url = "https://github.com/mbadolato/iTerm2-Color-Schemes/archive/0e23daf59234fc892cba949562d7bf69204594bb.tar.gz";
+      hash = "sha256-KswGCFqD1TOBkvaqtRcFOm96TbIqhqUEOg1u1ye/f0s=";
    };
  }
  {
@ -321,11 +356,19 @@ linkFarm name [
    };
  }
  {
-    name = "12200984439edc817fbcbbaff564020e5104a0d04a2d0f53080700827052de700462";
+    name = "122037b39d577ec2db3fd7b2130e7b69ef6cc1807d68607a7c232c958315d381b5cd";
    path = fetchZigArtifact {
      name = "wuffs";
-      url = "https://github.com/google/wuffs/archive/refs/tags/v0.4.0-alpha.8.tar.gz";
-      hash = "sha256-P3fpKYaiOpZffe2uNDkC43MFntV38Cl2XpHFF50r80Q=";
+      url = "https://github.com/google/wuffs/archive/refs/tags/v0.4.0-alpha.9.tar.gz";
+      hash = "sha256-nkzSCr6W5sTG7enDBXEIhgEm574uLD41UVR2wlC+HBM=";
+    };
+  }
+  {
+    name = "12207ff340169c7d40c570b4b6a97db614fe47e0d83b5801a932dcd44917424c8806";
+    path = fetchZigArtifact {
+      name = "pixels";
+      url = "git+https://github.com/make-github-pseudonymous-again/pixels?ref=main#d843c2714d32e15b48b8d7eeb480295af537f877";
+      hash = "sha256-kXYGO0qn2PfyOYCrRA49BHIgTzdmKhI8SNO1ZKfUYEE=";
    };
  }
  {
--- a/pkgs/by-name/gh/ghostty/package.nix
+++ b/pkgs/by-name/gh/ghostty/package.nix
@ -44,7 +44,7 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "ghostty";
-  version = "1.0.1";
+  version = "1.1.0";
  outputs = [
    "out"
    "man"
@ -57,7 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "ghostty-org";
    repo = "ghostty";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-BiXFNeoL+BYpiqzCuDIrZGQ6JVI8cBOXerJH48CbnxU=";
+    hash = "sha256-a2A/mt2xS19YEQB+cTPdew/a7xCnGWNvIOdO9QNqxm0=";
  };

  deps = callPackage ./deps.nix {
--- a/pkgs/by-name/gi/git-lfs/package.nix
+++ b/pkgs/by-name/gi/git-lfs/package.nix
@ -12,13 +12,13 @@

 buildGoModule rec {
  pname = "git-lfs";
-  version = "3.6.0";
+  version = "3.6.1";

  src = fetchFromGitHub {
    owner = "git-lfs";
    repo = "git-lfs";
    tag = "v${version}";
-    hash = "sha256-PpNdbvtDAZDT43yyEkUvnhfUTAMM+mYImb3dVbAVPic=";
+    hash = "sha256-zZ9VYWVV+8G3gojj1m74syvsYM1mX0YT4hKnpkdMAQk=";
  };

  vendorHash = "sha256-JT0r/hs7ZRtsYh4aXy+v8BjwiLvRJ10e4yRirqmWVW0=";
--- a/pkgs/by-name/gi/git-warp-time/package.nix
+++ b/pkgs/by-name/gi/git-warp-time/package.nix
@ -24,10 +24,11 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-bt94Y1EIcLzz1v2Nwyde63y6FWD+iaFkoEYoQpWVWGY=";
  };

-  cargoDeps = rustPlatform.fetchCargoTarball {
+  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
+    dontConfigure = true;
    nativeBuildInputs = [ zstd ];
-    hash = "sha256-qUhMTuvli4hUyHrFWmyaB1Rc/DS9Epae9S/mp6c9LSw=";
+    hash = "sha256-FNt9spOFOSbOgpZnxLl3aIvU6lnIJHaVMoAKxl4lzhU=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/gi/gitleaks/package.nix
+++ b/pkgs/by-name/gi/gitleaks/package.nix
@ -10,13 +10,13 @@

 buildGoModule rec {
  pname = "gitleaks";
-  version = "8.23.2";
+  version = "8.23.3";

  src = fetchFromGitHub {
    owner = "zricethezav";
    repo = "gitleaks";
    tag = "v${version}";
-    hash = "sha256-lwjGoDMNRgYDHI+8IjOD8sWJMUgv/Bg3pUzrUrcYiR4=";
+    hash = "sha256-K1TjgpV6e3R5QJGglU47G/eNRDexIpPcy0x5+XmkqrQ=";
  };

  vendorHash = "sha256-hq3v//fhCUOvKPBZ/+YrLIc4nDLxR9Yc+MeIXY7TArA=";
--- a/pkgs/by-name/go/go-ethereum/package.nix
+++ b/pkgs/by-name/go/go-ethereum/package.nix
@ -18,13 +18,13 @@ let
 in
 buildGoModule rec {
  pname = "go-ethereum";
-  version = "1.14.12";
+  version = "1.14.13";

  src = fetchFromGitHub {
    owner = "ethereum";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-s1BSFTjqro3gFyKphU8FdpjViKyyZc0bt1m+lzkAcBU=";
+    hash = "sha256-oJe+V11WArXVmoIC7nYN6oKc0VoHtRtelidyb3v6skI=";
  };

  proxyVendor = true;
--- a/pkgs/by-name/ht/httplib/package.nix
+++ b/pkgs/by-name/ht/httplib/package.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "httplib";
-  version = "0.18.4";
+  version = "0.18.5";

  src = fetchFromGitHub {
    owner = "yhirose";
    repo = "cpp-httplib";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-gXtp59zEk98n+/+p2YPi91QYNne8ANp+2r2lc4AAQnU=";
+    hash = "sha256-d5b6WsqR9oTiWq9wED+7Ts0kjURutxAJVXbm1okNg8k=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/hy/hyprland-protocols/package.nix
+++ b/pkgs/by-name/hy/hyprland-protocols/package.nix
@ -7,13 +7,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "hyprland-protocols";
-  version = "0.6.0";
+  version = "0.6.1";

  src = fetchFromGitHub {
    owner = "hyprwm";
    repo = "hyprland-protocols";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-mIQ3/axCZ4g8ySwWRbW4fJcyC9v55uAii3cqlJRtW8g=";
+    hash = "sha256-laKgI3mr2qz6tas/q3tuGPxMdsGhBi/w+HO+hO2f1AY=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/hy/hyprlock/package.nix
+++ b/pkgs/by-name/hy/hyprlock/package.nix
@ -64,6 +64,14 @@ gcc14Stdenv.mkDerivation (finalAttrs: {
    wayland-protocols
  ];

+  # Install hyprlock config in location upstream looks
+  # https://github.com/hyprwm/hyprlock/blob/c976b6a1d135d3743556dc225c80e24918ef1fd5/src/config/ConfigManager.cpp#L185-L191
+  # https://github.com/hyprwm/hyprutils/blob/6a8bc9d2a4451df12f5179dc0b1d2d46518a90ab/src/path/Path.cpp#L71-L72
+  postInstall = ''
+    mkdir -p $out/etc/xdg/hypr
+    ln -s $out/share/hypr/hyprlock.conf $out/etc/xdg/hypr/hyprlock.conf
+  '';
+
  passthru.updateScript = nix-update-script { };

  meta = {
--- a/pkgs/by-name/im/immich/sources.json
+++ b/pkgs/by-name/im/immich/sources.json
@ -1,26 +1,26 @@
 {
-  "version": "1.125.6",
-  "hash": "sha256-8rVpXo4pASKA5UTUGh3yHd5J7JPQe0kYOPQ/0hMED24=",
+  "version": "1.125.7",
+  "hash": "sha256-xXxLSfJgdBprDloJwjqLssux/M9+sOyyrzoqGp/dfOM=",
  "components": {
    "cli": {
-      "npmDepsHash": "sha256-DqyA/J90+PsjWiwXyGML0gJqYL8jBRR99SxoG0acxqY=",
-      "version": "2.2.47"
+      "npmDepsHash": "sha256-rAL+0GxC/GrgWwc5Z0hsJwInpQ/Afk+O2Pwz+I8vtk0=",
+      "version": "2.2.48"
    },
    "server": {
-      "npmDepsHash": "sha256-4+G4mIxABb2Rr9HqbfzB2B7gwBLMlwZTDnH11Oi7kMc=",
-      "version": "1.125.6"
+      "npmDepsHash": "sha256-s20zBaB/uBDZe60OKtZkHte5AaYtsaKQtkObEl7SXDU=",
+      "version": "1.125.7"
    },
    "web": {
-      "npmDepsHash": "sha256-iMFKWgYlCCdjGnnYx0vB5Vl4+d4ftPjPRenHQDPePSU=",
-      "version": "1.125.6"
+      "npmDepsHash": "sha256-1zwtrFcs7mW2wMIQSwPU/CT3XxHZoIeh5KC/vZEPL4E=",
+      "version": "1.125.7"
    },
    "open-api/typescript-sdk": {
-      "npmDepsHash": "sha256-nZTg6PmuMDqCFOoz+3INyRUMdbUKAqvkl+EHVkPZXoQ=",
-      "version": "1.125.6"
+      "npmDepsHash": "sha256-vjgalQXHOllSCkVAG6bm0jVM68V20WIFgV9L/mCkklU=",
+      "version": "1.125.7"
    },
    "geonames": {
-      "timestamp": "20250128052059",
-      "hash": "sha256-QnDkaqJbOpaROXZRtr1nLJxtd70YULEuNqLlwgN/9lY="
+      "timestamp": "20250129185843",
+      "hash": "sha256-poOvoBprzlEe4WDOdcO0TnIcwUp5xuKScumHMJ8YgO8="
    }
  }
 }
--- a/pkgs/by-name/is/isd/package.nix
+++ b/pkgs/by-name/is/isd/package.nix
@ -0,0 +1,62 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "isd";
+  version = "0.2.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "isd-project";
+    repo = "isd";
+    tag = "v${version}";
+    hash = "sha256-YOQoI9PB096C/wNF9y5nrXkpJGbO6cXQ2U6I2Ece2PM=";
+  };
+
+  build-system = with python3Packages; [
+    hatchling
+  ];
+
+  dependencies = with python3Packages; [
+    pfzy
+    pydantic
+    pydantic-settings
+    pyyaml
+    textual
+    types-pyyaml
+    xdg-base-dirs
+  ];
+
+  pythonRelaxDeps = [
+    "pydantic"
+    "pydantic-settings"
+    "types-pyyaml"
+  ];
+
+  pythonImportsCheck = [
+    "isd"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "TUI to interactively work with systemd units";
+    longDescription = ''
+      isd (interactive systemd) is a TUI offering fuzzy search for systemd
+      units, auto-refreshing previews, smart `sudo` handling, and a fully
+      customizable interface for power-users and newcomers alike.
+    '';
+    homepage = "https://github.com/isd-project/isd";
+    changelog = "https://github.com/isd-project/isd/releases/tag/v${version}";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "isd";
+    maintainers = with lib.maintainers; [
+      gepbird
+    ];
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/by-name/jb/jbig2enc/package.nix
+++ b/pkgs/by-name/jb/jbig2enc/package.nix
@ -2,7 +2,6 @@
  lib,
  stdenv,
  fetchFromGitHub,
-  fetchpatch,
  leptonica,
  zlib,
  libwebp,
@ -10,18 +9,19 @@
  libjpeg,
  libpng,
  libtiff,
+  python3,
  autoreconfHook,
 }:

 stdenv.mkDerivation rec {
  pname = "jbig2enc";
-  version = "0.29";
+  version = "0.30";

  src = fetchFromGitHub {
    owner = "agl";
    repo = "jbig2enc";
    rev = version;
-    hash = "sha256-IAL4egXgaGmCilzcryjuvOoHhahyrfGWY68GBfXXgAM=";
+    hash = "sha256-B19l2NdMq+wWKQ5f/y5aoPiBtQnn6sqpaIoyIq+ugTg=";
  };

  nativeBuildInputs = [ autoreconfHook ];
@ -34,20 +34,13 @@ stdenv.mkDerivation rec {
    libjpeg
    libpng
    libtiff
-  ];
-
-  patches = [
-    (fetchpatch {
-      name = "fix-build-leptonica-1.83.patch";
-      url = "https://github.com/agl/jbig2enc/commit/ea050190466f5336c69c6a11baa1cb686677fcab.patch";
-      hash = "sha256-+kScjFgDEU9F7VOUNAhm2XBjGm49fzAH8hYhmTm8xv8=";
-    })
+    python3
  ];

  # We don't want to install this Python 2 script
-  postInstall = ''
-    rm "$out/bin/pdf.py"
-  '';
+  #postInstall = ''
+  #  rm "$out/bin/pdf.py"
+  #'';

  # This is necessary, because the resulting library has
  # /tmp/nix-build-jbig2enc/src/.libs before /nix/store/jbig2enc/lib
--- a/pkgs/by-name/je/jellyfin-rpc/package.nix
+++ b/pkgs/by-name/je/jellyfin-rpc/package.nix
@ -8,17 +8,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "jellyfin-rpc";
-  version = "1.3.0";
+  version = "1.3.1";

  src = fetchFromGitHub {
    owner = "Radiicall";
    repo = "jellyfin-rpc";
    tag = version;
-    hash = "sha256-sr82lTOr6RUvYD0CVZMyyRAFjai1oLnRWIszuu7/jE0=";
+    hash = "sha256-cEHJJXMfXKDPKah2wDAdcO0SXO4ZPL/SqFbxONmI57M=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-fpd+KYKrKy6zS2YeNaUX5J+wtfzAiq7tMXRKSlZ9r7U=";
+  cargoHash = "sha256-CWl/hVtwv2Q4/GwJJGTHCxnMxj8ZR9wPmLTlai0MyBA=";

  nativeInstallCheckInputs = [
    versionCheckHook
--- a/pkgs/by-name/li/libargon2/package.nix
+++ b/pkgs/by-name/li/libargon2/package.nix
@ -39,6 +39,7 @@ stdenv.mkDerivation rec {
    ]
    ++ lib.optionals stdenv.hostPlatform.isStatic [
      "LIBRARIES=$(LIB_ST)"
+      "LINKED_LIB_EXT="
    ];

  meta = with lib; {
--- a/pkgs/by-name/li/libnvidia-container/package.nix
+++ b/pkgs/by-name/li/libnvidia-container/package.nix
@ -101,6 +101,15 @@ stdenv.mkDerivation rec {
      --replace-fail ldconfig true
  '';

+  # Recreate library symlinks which ldconfig would have created
+  postFixup = ''
+    for lib in libnvidia-container libnvidia-container-go; do
+      rm -f "$out/lib/$lib.so"
+      ln -s "$out/lib/$lib.so.${version}" "$out/lib/$lib.so.1"
+      ln -s "$out/lib/$lib.so.1" "$out/lib/$lib.so"
+    done
+  '';
+
  enableParallelBuilding = true;

  preBuild = ''
--- a/pkgs/by-name/li/libxls/package.nix
+++ b/pkgs/by-name/li/libxls/package.nix
@ -9,23 +9,15 @@

 stdenv.mkDerivation rec {
  pname = "libxls";
-  version = "1.6.2";
+  version = "1.6.3";

  src = fetchFromGitHub {
    owner = "libxls";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-vjmYByk+IDBon8xGR1+oNaEQTiJK+IVpDXsG1IyVNoY=";
+    hash = "sha256-KbITHQ9s2RUeo8zR53R9s4WUM6z8zzddz1k47So0Mlw=";
  };

-  patches = [
-    # Fix cross-compilation
-    (fetchpatch {
-      url = "https://github.com/libxls/libxls/commit/007e63c1f5e19bc73292f267c85d7dd14e9ecb38.patch";
-      sha256 = "sha256-PjPHuXth4Yaq9nVfk5MYJMRo5B0R6YA1KEqgwfjF3PM=";
-    })
-  ];
-
  nativeBuildInputs = [
    autoreconfHook
    autoconf-archive
@ -40,13 +32,5 @@ stdenv.mkDerivation rec {
    maintainers = with maintainers; [ abbradar ];
    mainProgram = "xls2csv";
    platforms = platforms.unix;
-    knownVulnerabilities = [
-      "CVE-2023-38851"
-      "CVE-2023-38852"
-      "CVE-2023-38853"
-      "CVE-2023-38854"
-      "CVE-2023-38855"
-      "CVE-2023-38856"
-    ];
  };
 }
--- a/pkgs/by-name/li/licensor/package.nix
+++ b/pkgs/by-name/li/licensor/package.nix
@ -1,32 +0,0 @@
-{
-  lib,
-  fetchFromGitHub,
-  rustPlatform,
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "licensor";
-  version = "unstable-2021-02-03";
-
-  src = fetchFromGitHub {
-    owner = "raftario";
-    repo = pname;
-    rev = "1897882a708ec6ed65a9569ae0e07d6ea576c652";
-    sha256 = "0x0lkfrj7jka0p6nx6i9syz0bnzya5z9np9cw09zm1c9njv9mm32";
-  };
-
-  cargoHash = "sha256-gEOMOb2VRx0cFnzmfKBh9W1FoI4Nr7/PW4GQnldoxsA=";
-
-  # https://github.com/raftario/licensor/issues/67
-  postPatch = ''
-    sed "/Copyright (c) 2021/s/2021/$(date +%Y)/" -i tests/integration.rs
-  '';
-
-  meta = with lib; {
-    description = "Write licenses to stdout";
-    homepage = "https://github.com/raftario/licensor";
-    license = licenses.mit;
-    maintainers = with maintainers; [ Br1ght0ne ];
-    mainProgram = "licensor";
-  };
-}
--- a/pkgs/by-name/lp/lpac/lpac-version.patch
+++ b/pkgs/by-name/lp/lpac/lpac-version.patch
@ -0,0 +1,13 @@
+diff --git a/cmake/git-version.cmake b/cmake/git-version.cmake
+index be226fd..1451ff6 100644
+--- a/cmake/git-version.cmake
+++ b/cmake/git-version.cmake
+@@ -15,6 +15,8 @@ if(GIT_EXECUTABLE)
+   endif()
+ endif()
+ 
+set(LPAC_VERSION "$ENV{LPAC_VERSION}")
+
+ # Final fallback: Just use a bogus version string that is semantically older
+ # than anything else and spit out a warning to the developer.
+ if(NOT DEFINED LPAC_VERSION)
--- a/pkgs/by-name/lp/lpac/package.nix
+++ b/pkgs/by-name/lp/lpac/package.nix
@ -0,0 +1,59 @@
+{
+  stdenv,
+  fetchFromGitHub,
+  lib,
+  cmake,
+  pkg-config,
+  pcsclite,
+  curl,
+  withDrivers ? true,
+  withLibeuicc ? true,
+  nix-update-script,
+}:
+
+let
+  inherit (lib) optional;
+in
+stdenv.mkDerivation (finalAttrs: {
+
+  pname = "lpac";
+  version = "2.2.1";
+
+  src = fetchFromGitHub {
+    owner = "estkme-group";
+    repo = "lpac";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-dxoYuX3dNj4piXQBqU4w1ICeyOGid35c+6ZITQiN6wA=";
+  };
+
+  env.LPAC_VERSION = finalAttrs.version;
+
+  patches = [ ./lpac-version.patch ];
+
+  cmakeFlags =
+    optional withDrivers "-DLPAC_DYNAMIC_DRIVERS=on"
+    ++ optional withLibeuicc "-DLPAC_DYNAMIC_LIBEUICC=on";
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    curl
+    pcsclite
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { attrPath = finalAttrs.pname; };
+  };
+
+  meta = {
+    description = "C-based eUICC LPA";
+    homepage = "https://github.com/estkme-group/lpac";
+    mainProgram = "lpac";
+    license = [ lib.licenses.agpl3Plus ] ++ optional withLibeuicc lib.licenses.lgpl21Plus;
+    maintainers = with lib.maintainers; [ sarcasticadmin ];
+    platforms = lib.platforms.all;
+  };
+})
--- a/pkgs/applications/audio/lsp-plugins/default.nix
+++ b/pkgs/applications/audio/lsp-plugins/default.nix
@ -1,28 +1,27 @@
 {
  lib,
  stdenv,
-  fetchurl,
-  pkg-config,
-  makeWrapper,
-  libsndfile,
-  jack2,
-  libGLU,
-  libGL,
-  lv2,
  cairo,
+  fetchurl,
+  gst_all_1,
+  jack2,
  ladspaH,
-  php,
+  libGL,
+  libGLU,
  libXrandr,
+  libsndfile,
+  lv2,
+  php82,
+  pkg-config,
 }:

-stdenv.mkDerivation rec {
-  pname = "lsp-plugins";
-  version = "1.2.16";
+let
+  php = php82;
+in

-  src = fetchurl {
-    url = "https://github.com/lsp-plugins/lsp-plugins/releases/download/${version}/lsp-plugins-src-${version}.tar.gz";
-    sha256 = "sha256-w2BUIF44z78syLroQk2asVXA5bt9P9POiuwxpnlkc8o=";
-  };
+stdenv.mkDerivation (finalAttrs: {
+  pname = "lsp-plugins";
+  version = "1.2.20";

  outputs = [
    "out"
@ -30,39 +29,57 @@ stdenv.mkDerivation rec {
    "doc"
  ];

+  src = fetchurl {
+    url = "https://github.com/lsp-plugins/lsp-plugins/releases/download/${finalAttrs.version}/lsp-plugins-src-${finalAttrs.version}.tar.gz";
+    hash = "sha256-yohg3Ka/see8q6NCwVPl/F06AlyR22akQz43gp+1kck=";
+  };
+
+  # By default, GStreamer plugins are installed right alongside GStreamer itself
+  # We can't do that in Nixpkgs, so lets install it to $out/lib like other plugins
+  postPatch = ''
+    substituteInPlace modules/lsp-plugin-fw/src/Makefile \
+      --replace-fail '$(shell pkg-config --variable=pluginsdir gstreamer-1.0)' '$(LIBDIR)/gstreamer-1.0'
+  '';
+
  nativeBuildInputs = [
+    php
    pkg-config
-    (php.withExtensions (_: [ ]))
-    makeWrapper
  ];
+
  buildInputs = [
-    jack2
-    libsndfile
-    libGLU
-    libGL
-    lv2
    cairo
+    gst_all_1.gst-plugins-base
+    gst_all_1.gstreamer
+    jack2
    ladspaH
+    libGL
+    libGLU
    libXrandr
+    libsndfile
+    lv2
  ];

  makeFlags = [
-    "PREFIX=${placeholder "out"}"
    "ETCDIR=${placeholder "out"}/etc"
+    "PREFIX=${placeholder "out"}"
    "SHAREDDIR=${placeholder "out"}/share"
  ];

  env.NIX_CFLAGS_COMPILE = "-DLSP_NO_EXPERIMENTAL";

  configurePhase = ''
-    make config PREFIX=${placeholder "out"}
+    runHook preConfigure
+
+    make $makeFlags config
+
+    runHook postConfigure
  '';

  doCheck = true;

  enableParallelBuilding = true;

-  meta = with lib; {
+  meta = {
    description = "Collection of open-source audio plugins";
    longDescription = ''
      Compatible with the following formats:
@ -123,11 +140,12 @@ stdenv.mkDerivation rec {
      - Trigger
    '';
    homepage = "https://lsp-plug.in";
-    maintainers = with maintainers; [
+    changelog = "https://github.com/lsp-plugins/lsp-plugins/releases/tag/${finalAttrs.version}";
+    maintainers = with lib.maintainers; [
      magnetophon
      PowerUser64
    ];
-    license = licenses.gpl2;
-    platforms = platforms.linux;
+    license = lib.licenses.gpl2;
+    platforms = lib.platforms.linux;
  };
-}
+})
--- a/pkgs/by-name/lu/luci-go/package.nix
+++ b/pkgs/by-name/lu/luci-go/package.nix
@ -0,0 +1,50 @@
+{
+  buildGoModule,
+  fetchFromGitiles,
+  lib,
+}:
+let
+  commit = "500493c154652d6986a34b341e98df244ae1ad0d";
+  git-repo = "https://chromium.googlesource.com/infra/luci/luci-go";
+in
+buildGoModule {
+  pname = "luci-go";
+  version = "0-unstable-2024-10-31";
+
+  src = fetchFromGitiles {
+    url = git-repo;
+    rev = commit;
+    hash = "sha256-HP4Aizt5FJA3IAlqs7gylw8/xUbBwsmReGaR8jIkmrk=";
+  };
+
+  vendorHash = "sha256-FMqbEls6MivPeReZTADrfcAvxo8o0Gy7bq9xG6WN38k=";
+
+  checkFlags =
+    let
+      skippedTests = [
+        # require network access
+        "TestDownloadInputs"
+        "TestInstallCipd"
+        "TestIsLocalAddr"
+        "TestGenerateSignedURL"
+
+        # require filesystem access
+        "TestPythonBasic"
+        "TestPythonFromPath"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+
+  meta = {
+    description = "LUCI services and tools in Go";
+    longDescription = ''
+      LUCI services and tools in Go. This is part of Chromium infra and
+      provides facilities useful for packaging software from the Chromium
+      ecosystem.
+    '';
+    homepage = "${git-repo}/";
+    changelog = "${git-repo}/+log?s=${commit}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ gm6k ];
+  };
+}
--- a/pkgs/by-name/ma/makeBinaryWrapper/package.nix
+++ b/pkgs/by-name/ma/makeBinaryWrapper/package.nix
@ -16,6 +16,9 @@ makeSetupHook {
  substitutions = {
    cc = "${cc}/bin/${cc.targetPrefix}cc ${
      lib.escapeShellArgs (map (s: "-fsanitize=${s}") sanitizers)
+      + lib.optionalString (
+        cc.isClang && !cc.stdenv.hostPlatform.isDarwin
+      ) "--ld-path=${cc.targetPrefix}ld"
    }";
  };

--- a/pkgs/by-name/ma/mattermostLatest/package.nix
+++ b/pkgs/by-name/ma/mattermostLatest/package.nix
@ -11,8 +11,8 @@ mattermost.override {
    # and make sure the version regex is up to date here.
    # Ensure you also check ../mattermost/package.nix for ESR releases.
    regex = "^v(10\\.[0-9]+\\.[0-9]+)$";
-    version = "10.4.1";
-    srcHash = "sha256-e7uT30tWhJpEQzlcDUY2huFcupDbe4l8B19Dgub2pg0=";
+    version = "10.4.2";
+    srcHash = "sha256-R/LiExICunQeL7UPeqjKhMvCHMdibcPTnpTbGYQnbgI=";
    vendorHash = "sha256-AcemUxcBoytE/ZoXqaIlxkzAnmGV/C1laDqziMuE+XE=";
    npmDepsHash = "sha256-HABPwdhtev9DZLhWJQsyU4g2ZueYgsX+tUduMsc74YY=";
    lockfileOverlay = ''
--- a/pkgs/by-name/me/memtier-benchmark/package.nix
+++ b/pkgs/by-name/me/memtier-benchmark/package.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "memtier-benchmark";
-  version = "2.1.3";
+  version = "2.1.4";

  src = fetchFromGitHub {
    owner = "redislabs";
    repo = "memtier_benchmark";
    tag = version;
-    sha256 = "sha256-3q+NOdmbOiRq+pUxy3d1UdpUxHsv2XfnScDIfB+xyhk=";
+    sha256 = "sha256-dZUJjilfzl8u/KdBS1iKaAwOXWYAIMDi55ZAYtyuuOI=";
  };

  patchPhase = ''
--- a/pkgs/by-name/mi/mirrord/manifest.json
+++ b/pkgs/by-name/mi/mirrord/manifest.json
@ -1,13 +1,13 @@
 {
-  "version": "3.129.0",
+  "version": "3.131.2",
  "assets": {
    "x86_64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.129.0/mirrord_linux_x86_64",
-      "hash": "sha256-kvyofs+kBXVJewdjloV/uwR8TMU3jhUbMF+wl7uyl/0="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.131.2/mirrord_linux_x86_64",
+      "hash": "sha256-S5esVEqssMZJdxlR8MMVgMbsZkgewD69cNT/lI1LerE="
    },
    "aarch64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.129.0/mirrord_linux_aarch64",
-      "hash": "sha256-Lk5s2puKkz4hK0I2aQJzfQ5w66ERUtCK1plO52f2OZQ="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.131.2/mirrord_linux_aarch64",
+      "hash": "sha256-2SC/6Q43AhUjx2i3kwCLHIMEnxp23qbUuFXYKZBLin8="
    }
  }
 }
--- a/pkgs/by-name/mu/muffet/package.nix
+++ b/pkgs/by-name/mu/muffet/package.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "muffet";
-  version = "2.10.6";
+  version = "2.10.7";

  src = fetchFromGitHub {
    owner = "raviqqe";
    repo = "muffet";
    rev = "v${version}";
-    hash = "sha256-9dra/LhtSIWN2pjNEJMITz/GzyWRtXTyQBqBxRhjARc=";
+    hash = "sha256-txIH3FqKQ6IWN19aABmLAJicmXi6NK7VpH6NDMtAGUE=";
  };

-  vendorHash = "sha256-MYU8zgqI05oBep/dehs59S3JcrThrgLEzIgrIr/Tr4Y=";
+  vendorHash = "sha256-IbpTQdJ6OssyzwS2H4iNgJybC9rvvlW6UYkihNkBYOE=";

  meta = with lib; {
    description = "Website link checker which scrapes and inspects all pages in a website recursively";
--- a/pkgs/by-name/my/mysql-workbench/package.nix
+++ b/pkgs/by-name/my/mysql-workbench/package.nix
@ -50,11 +50,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "mysql-workbench";
-  version = "8.0.40";
+  version = "8.0.41";

  src = fetchurl {
    url = "https://cdn.mysql.com/Downloads/MySQLGUITools/mysql-workbench-community-${finalAttrs.version}-src.tar.gz";
-    hash = "sha256-/CrjHgZ3IFFvUB1IxeURme8Z6BoZx0b03MWk8QCe0Sg=";
+    hash = "sha256-H/u1nwizZ9pCEu9JPXRcKshxjvc/efcZ//6ankHcGGk=";
  };

  patches = [
--- a/pkgs/by-name/na/nautilus-python/package.nix
+++ b/pkgs/by-name/na/nautilus-python/package.nix
@ -46,6 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
    gtk-doc
    docbook-xsl-nons
    docbook_xml_dtd_412
+    python3.pythonOnBuildForHost
  ];

  buildInputs = [
--- a/pkgs/by-name/ne/netbox2netshot/package.nix
+++ b/pkgs/by-name/ne/netbox2netshot/package.nix
@ -10,17 +10,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "netbox2netshot";
-  version = "0.1.13";
+  version = "0.2.0";

  src = fetchFromGitHub {
    owner = "scaleway";
    repo = "netbox2netshot";
    rev = version;
-    hash = "sha256-zi/on31uYSW3XhIZzKMkxIj0QZxUzoOcpRR8w5LFH90=";
+    hash = "sha256-4Leg7MaLSos2RjmxB6yVzxGju6OzNrChXdw5htppuZU=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-/tvRITLa6O0zNM5eNORN2eaDUrrT/ds87phzFz2WcX8=";
+  cargoHash = "sha256-XjHOlpYSOwSXxbGp/xZVVcBGhprg4hh61L5dhVE5ODM=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/nn/nng/package.nix
+++ b/pkgs/by-name/nn/nng/package.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "nng";
-  version = "1.10";
+  version = "1.10.1";

  src = fetchFromGitHub {
    owner = "nanomsg";
    repo = "nng";
    rev = "v${version}";
-    hash = "sha256-HQQx65itnDPX/luN2JtU03R7o+jzmGXJPOh4ffodxzA=";
+    hash = "sha256-BBYfJ2j2IQkbluR3HQjEh1zFWPgOVX6kfyI0jG741Y4=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/no/notion-app/info.json
+++ b/pkgs/by-name/no/notion-app/info.json
@ -1,12 +1,12 @@
 {
  "x86_64-darwin": {
-    "version": "4.2.0",
-    "url": "https://desktop-release.notion-static.com/Notion-4.2.0.zip",
-    "hash": "sha512-FLptPNEtS9fTevSeGC00hDtpgSks+8JtEKRTtWlYPtI0vpA1KqixBdv2OaNSK1W7Krlsl25RpTOl8cJdQxcv4Q=="
+    "version": "4.3.0",
+    "url": "https://desktop-release.notion-static.com/Notion-4.3.0.zip",
+    "hash": "sha512-shh85dNtzDrUGXbjODdtxpDlgQlF76a/PWDiuLrbx/GUn5xTVZkCCfTGEkSBInfjzJ0Z4iNJ/WlAXPvTGFJLiw=="
  },
  "aarch64-darwin": {
-    "version": "4.2.0",
-    "url": "https://desktop-release.notion-static.com/Notion-arm64-4.2.0.zip",
-    "hash": "sha512-cxfO3Bm7ZzAQMi0Pdwd3nvQlRPjn4w7j0ojYUCcn660YsBtoVkpNhiuqg9pbWzY0Umh+/8Zig9CGXKjjP94Iww=="
+    "version": "4.3.0",
+    "url": "https://desktop-release.notion-static.com/Notion-arm64-4.3.0.zip",
+    "hash": "sha512-LcHKB1nVc2VnfrtLKlkBfxlFvTTIlACIazNOMr4ZjHj8N7Trg1oai5wdH/sA+mKFhHiWH5fzHk8QIuCLwjMK4A=="
  }
 }
--- a/pkgs/by-name/ny/nyan/package.nix
+++ b/pkgs/by-name/ny/nyan/package.nix
@ -0,0 +1,51 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  clang,
+  cmake,
+  flex,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "nyan";
+  version = "0.3.1";
+
+  src = fetchFromGitHub {
+    owner = "SFTtech";
+    repo = "nyan";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-BtvMZaQutcPqTSCN5gxYUU3CQTyCns1ldkcnjwJOFa8=";
+  };
+
+  nativeBuildInputs = [
+    clang
+    cmake
+  ];
+
+  buildInputs = [
+    flex
+  ];
+
+  nativeInstallCheckHooks = [
+    versionCheckHook
+  ];
+  versionCheckProgram = "${placeholder "out"}/bin/nyancat";
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Typesafe hierarchical key-value database";
+    homepage = "https://openage.sft.mx";
+    changelog = "https://github.com/SFTtech/nyan/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.lgpl3Plus;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+    mainProgram = "nyancat";
+  };
+})
--- a/pkgs/by-name/oa/oathkeeper/package.nix
+++ b/pkgs/by-name/oa/oathkeeper/package.nix
@ -5,7 +5,7 @@
 }:
 let
  pname = "oathkeeper";
-  version = "0.40.8";
+  version = "0.40.9";
  commit = "c75695837f170334b526359f28967aa33d61bce6";
 in
 buildGoModule {
@ -15,10 +15,10 @@ buildGoModule {
    owner = "ory";
    repo = "oathkeeper";
    rev = "v${version}";
-    hash = "sha256-syrOb8COZKgiW64Xlg+g+fu1y84jsKQ5QBFTrCl4Tys=";
+    hash = "sha256-R7xKhKF7mhS/vmSpOj+QDL0OBBWnh42X2Kr3TDQxVIo=";
  };

-  vendorHash = "sha256-w6W02BHuDcZyh92CAli8XS9m7/fTYBulVsgYPow+yM4=";
+  vendorHash = "sha256-qETVUpxckZGa41Ll+SZTGcDlImsCvbvGQBcIwuIzSY8=";

  tags = [
    "sqlite"
--- a/pkgs/by-name/ob/obsidian/package.nix
+++ b/pkgs/by-name/ob/obsidian/package.nix
@ -13,7 +13,7 @@
 }:
 let
  pname = "obsidian";
-  version = "1.7.7";
+  version = "1.8.3";
  appname = "Obsidian";
  meta = with lib; {
    description = "Powerful knowledge base that works on top of a local folder of plain text Markdown files";
@ -37,9 +37,9 @@ let
    url = "https://github.com/obsidianmd/obsidian-releases/releases/download/v${version}/${filename}";
    hash =
      if stdenv.hostPlatform.isDarwin then
-        "sha256-vzYMTH1yaKxw1AwJOXVdzvKyQTkCMmx7NPPP/99xgMQ="
+        "sha256-SqeCnS2Ncz8y1F+YAzAfBlsAgSaaMfmMcCjke9/UbXQ="
      else
-        "sha256-6IHqBvZx2yxQAvADi3Ok5Le3ip2/c6qafQ3FSpPT0po=";
+        "sha256-t5iZOA/cFJpn9OtbutQ6gJ6SVkG0QljnJZ931YnGc54=";
  };

  icon = fetchurl {
--- a/pkgs/by-name/og/ogen/package.nix
+++ b/pkgs/by-name/og/ogen/package.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "ogen";
-  version = "1.4.1";
+  version = "1.9.0";

  src = fetchFromGitHub {
    owner = "ogen-go";
    repo = "ogen";
    tag = "v${version}";
-    hash = "sha256-SwJY9VQafclAxEQ/cbRJALvMLlnSIItIOz92XzuCoCk=";
+    hash = "sha256-clskb5DA1dNVKjKgtYakvshRrkeoqiwYX4QKAqSdKnE=";
  };

-  vendorHash = "sha256-IxG7y0Zy0DerCh5DRdSWSaD643BG/8Wj2wuYvkn+XzE=";
+  vendorHash = "sha256-Ud1fg2wv+EM6h8dRO4R5SABOhPldF7uc9VwEw2/B6No=";

  patches = [ ./modify-version-handling.patch ];

--- a/pkgs/by-name/or/orz/package.nix
+++ b/pkgs/by-name/or/orz/package.nix
@ -7,16 +7,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "orz";
-  version = "1.6.2";
+  version = "1.6.2-unstable-2024-11-08";

  src = fetchFromGitHub {
    owner = "richox";
    repo = "orz";
-    rev = "v${version}";
-    hash = "sha256-Yro+iXlg18Pj/AkU4IjvgA88xctK65yStfTilz+IRs0=";
+    rev = "c828a50f18a309d4715741056db74941e6a98867";
+    hash = "sha256-PVso4ufBwxhF1yhzIkIwSbRJdnH9h8gn3nreWQJDMn4=";
  };

-  cargoHash = "sha256-aUsRbIajBP6esjW7Wj7mqIkbYUCbZ2GgxjRXMPTnHYg=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-vbhK4jHNhCI1nFv2pVOtjlxQe+b7NMP14z2Tk+no8Vs=";

  outputs = [
    "out"
--- a/pkgs/by-name/ov/ovn/package.nix
+++ b/pkgs/by-name/ov/ovn/package.nix
@ -47,14 +47,16 @@ stdenv.mkDerivation rec {
  preConfigure = ''
    pushd ovs
    ./boot.sh
-    ./configure
+    ./configure --with-dbdir=/var/lib/openvswitch
    make -j $NIX_BUILD_CORES
    popd
  '';

  configureFlags = [
    "--localstatedir=/var"
+    "--sharedstatedir=/var"
    "--with-dbdir=/var/lib/ovn"
+    "--sbindir=$(out)/bin"
    "--enable-ssl"
  ];

@ -71,14 +73,20 @@ stdenv.mkDerivation rec {
  postInstall = ''
    mkdir -vp $out/share/openvswitch/scripts
    mkdir -vp $out/etc/ovn
-    cp ovs/ovsdb/ovsdb-client $out/share/openvswitch/scripts
-    cp ovs/ovsdb/ovsdb-server $out/share/openvswitch/scripts
-    cp ovs/ovsdb/ovsdb-tool $out/share/openvswitch/scripts
-    cp ovs/utilities/ovs-appctl $out/share/openvswitch/scripts
-    cp ovs/utilities/ovs-vsctl $out/share/openvswitch/scripts
+    cp ovs/ovsdb/ovsdb-client $out/bin
+    cp ovs/ovsdb/ovsdb-server $out/bin
+    cp ovs/ovsdb/ovsdb-tool $out/bin
+    cp ovs/vswitchd/ovs-vswitchd $out/bin
+    cp ovs/utilities/ovs-appctl $out/bin
+    cp ovs/utilities/ovs-vsctl $out/bin
+    cp ovs/utilities/ovs-ctl $out/share/openvswitch/scripts
    cp ovs/utilities/ovs-lib $out/share/openvswitch/scripts
-    sed -i "s#/usr/local/bin#$out/share/openvswitch/scripts#g" $out/share/openvswitch/scripts/ovs-lib
-    sed -i "s#/usr/local/sbin#$out/share/openvswitch/scripts#g" $out/share/openvswitch/scripts/ovs-lib
+    cp ovs/utilities/ovs-kmod-ctl $out/share/openvswitch/scripts
+    cp ovs/vswitchd/vswitch.ovsschema $out/share/openvswitch
+    sed -i "s#/usr/local/etc#/var/lib#g" $out/share/openvswitch/scripts/ovs-lib
+    sed -i "s#/usr/local/bin#$out/bin#g" $out/share/openvswitch/scripts/ovs-lib
+    sed -i "s#/usr/local/sbin#$out/bin#g" $out/share/openvswitch/scripts/ovs-lib
+    sed -i "s#/usr/local/share#$out/share#g" $out/share/openvswitch/scripts/ovs-lib
    sed -i '/chown -R $INSTALL_USER:$INSTALL_GROUP $ovn_etcdir/d' $out/share/ovn/scripts/ovn-ctl
  '';

--- a/pkgs/by-name/pe/petsc/package.nix
+++ b/pkgs/by-name/pe/petsc/package.nix
@ -29,11 +29,11 @@ assert petsc-withp4est -> p4est.mpiSupport;

 stdenv.mkDerivation rec {
  pname = "petsc";
-  version = "3.21.3";
+  version = "3.21.4";

  src = fetchzip {
    url = "https://web.cels.anl.gov/projects/petsc/download/release-snapshots/petsc-${version}.tar.gz";
-    hash = "sha256-dxHa8JUJCN4zRIXMCx7gcvbzFH2SPtkJ377ssIevjgU=";
+    hash = "sha256-l7v+ASBL9FLbBmBGTRWDwBihjwLe3uLz+GwXtn8u7e0=";
  };

  strictDeps = true;
--- a/pkgs/by-name/pf/pflotran/make.patch
+++ b/pkgs/by-name/pf/pflotran/make.patch
@ -0,0 +1,45 @@
+diff --git a/src/pflotran/makefile b/src/pflotran/makefile
+index 17587c91d..7caf73e8c 100644
+--- a/src/pflotran/makefile
+++ b/src/pflotran/makefile
+@@ -51,7 +51,7 @@ PETSC_MAKE_STOP_ON_ERROR=
+ # so that PFLOTRAN will be built with the same options as 
+ # the petsc configured in $PETSC_DIR/$PETSC_ARCH
+ 
+-MYFLAGS = -I. 
+MYFLAGS = -I. -L@HDF5_FORTRAN_LIBS@ -I@HDF5_FORTRAN_INCLUDE@
+ 
+ ###############################################################################
+ # Preprocessor flags for special PFLOTRAN features/hacks
+@@ -183,7 +183,7 @@ ifdef ug_mpi_scatter_ghost
+ endif
+ 
+ ifdef have_hdf5
+-LIBS +=  -L${HDF5_LIB} -lhdf5_fortran -lhdf5 -lz 
+LIBS +=  -L${HDF5_LIB} -lhdf5 -lhdf5_fortran -lhdf5_hl_fortran -lhdf5_f90cstub -lz
+ endif
+ 
+ # Set this accordingly on your platform
+@@ -273,7 +273,7 @@ pflotran_rxn_obj = ${pflotran_src}pflotran_rxn.o
+ 
+ # PFLOTRAN executable
+ pflotran : $(pflotran_obj)
+-	${FLINKER} -o pflotran $(pflotran_obj) ${PETSC_LIB} ${LIBS} 
+	${FLINKER} -o pflotran $(pflotran_obj) ${PETSC_LIB} ${LIBS} -lhdf5 -lhdf5_fortran -lhdf5_hl_fortran -lhdf5_f90cstub
+ 
+ # PFLOTRAN as a library
+ libpflotran.a : $(pflotran_obj)
+@@ -286,11 +286,11 @@ libpflotranchem.a : $(chem_obj) $(shared_mode_aux_obj) $(util_obj)
+ # object files lists below.... This is a workaround.
+ pflotran_rxn : libpflotranchem.a $(pflotran_rxn_obj)
+ 	${FLINKER} -o $@ $(pflotran_rxn_obj) $(chem_obj) $(shared_mode_aux_obj) \
+-	$(util_obj) ${PETSC_LIB} ${LIBS} 
+	$(util_obj) ${PETSC_LIB} ${LIBS} -lhdf5 -lhdf5_fortran -lhdf5_hl_fortran -lhdf5_f90cstub
+ 
+ # PFLOTRAN derivative test
+ pflotran_derivative : $(pflotran_base_obj) pflotran_derivative.o
+-	${FLINKER} -o pflotran_derivative $(pflotran_base_obj) pflotran_derivative.o ${PETSC_LIB} ${LIBS} 
+	${FLINKER} -o pflotran_derivative $(pflotran_base_obj) pflotran_derivative.o ${PETSC_LIB} ${LIBS} -lhdf5 -lhdf5_fortran -lhdf5_hl_fortran -lhdf5_f90cstub
+ 
+ $(SRC_DIR)/pflotran_provenance.F90 : FORCE
+ ifeq ($(UPDATE_PROVENANCE),1)
--- a/pkgs/by-name/pf/pflotran/package.nix
+++ b/pkgs/by-name/pf/pflotran/package.nix
@ -0,0 +1,68 @@
+{
+  stdenv,
+  lib,
+  fetchFromBitbucket,
+  gfortran,
+  mpi,
+  petsc,
+  blas,
+  lapack,
+  parmetis,
+  hdf5,
+  mpiCheckPhaseHook,
+  python3,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "PFLOTRAN";
+  version = "6.0.1";
+
+  src = fetchFromBitbucket {
+    owner = "pflotran";
+    repo = "pflotran";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-AZXzay6GWbnxONB8Slg8gV0KN1CxGCXbJ45ZeWL1034=";
+  };
+
+  patches = [ ./make.patch ];
+
+  nativeBuildInputs = [ gfortran ];
+
+  buildInputs = [
+    petsc
+    blas
+    lapack
+    hdf5
+    parmetis
+  ];
+
+  propagatedBuildInputs = [ mpi ];
+  propagatedUserEnvPkgs = [ mpi ];
+  passthru = { inherit mpi; };
+
+  enableParallelBuilding = true;
+
+  /*
+    Pflotran does not use a "real" autotools configure script, but a simple bash
+    script, that is merely named configure. Consequently, many common mechanism
+    don't work. Thus, we need to help make to figure out some include and library
+    paths.
+  */
+  preConfigure = ''
+    substituteInPlace src/pflotran/makefile \
+      --subst-var-by "HDF5_FORTRAN_LIBS" "${lib.getLib hdf5}/lib" \
+      --subst-var-by "HDF5_FORTRAN_INCLUDE" "${lib.getDev hdf5}/include"
+  '';
+
+  configureFlags = [
+    "--with-petsc-dir=${petsc}"
+    "--with-petsc-arch=linux-gnu-c-release"
+  ];
+
+  meta = with lib; {
+    description = "Parallel, multi-physics simulation code for subsurface flow and transport";
+    homepage = "https://pflotran.org/";
+    license = licenses.lgpl3Only;
+    maintainers = [ maintainers.sheepforce ];
+  };
+})
--- a/pkgs/by-name/ph/phrase-cli/package.nix
+++ b/pkgs/by-name/ph/phrase-cli/package.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "phrase-cli";
-  version = "2.35.5";
+  version = "2.35.6";

  src = fetchFromGitHub {
    owner = "phrase";
    repo = "phrase-cli";
    rev = version;
-    sha256 = "sha256-hPaZquiOcvRfWXG9nCKTvy7sPMueH/G/ikmdo87/0pg=";
+    sha256 = "sha256-oTiADsEck/TZpXlC7/HEBSyd68QAjUq76AGeawIPhS0=";
  };

-  vendorHash = "sha256-2IgEkRgHxFagNQ7qgT2GchukALxjkCkkcGlyzQTJUDQ=";
+  vendorHash = "sha256-wIlntsf3PaRLWYZiI17ZdXidBV7LwAZdibUIX8yqATo=";

  ldflags = [ "-X=github.com/phrase/phrase-cli/cmd.PHRASE_CLIENT_VERSION=${version}" ];

--- a/pkgs/by-name/po/poetry/plugins/poetry-plugin-shell.nix
+++ b/pkgs/by-name/po/poetry/plugins/poetry-plugin-shell.nix
@ -2,6 +2,7 @@
  buildPythonPackage,
  fetchFromGitHub,
  lib,
+  stdenv,
  pexpect,
  poetry,
  poetry-core,
@ -9,6 +10,7 @@
  pytest-xdist,
  pytestCheckHook,
  shellingham,
+  darwin,
 }:

 buildPythonPackage rec {
@ -34,11 +36,15 @@ buildPythonPackage rec {
    shellingham
  ];

-  nativeCheckInputs = [
-    pytest-mock
-    pytest-xdist
-    pytestCheckHook
-  ];
+  nativeCheckInputs =
+    [
+      pytest-mock
+      pytest-xdist
+      pytestCheckHook
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      darwin.ps
+    ];

  meta = {
    changelog = "https://github.com/python-poetry/poetry-plugin-shell/blob/${src.tag}/CHANGELOG.md";
--- a/pkgs/by-name/po/poetry/unwrapped.nix
+++ b/pkgs/by-name/po/poetry/unwrapped.nix
@ -32,7 +32,6 @@
  httpretty,
  pytest-mock,
  pytest-xdist,
-  darwin,
 }:

 buildPythonPackage rec {
@ -110,17 +109,13 @@ buildPythonPackage rec {
      --zsh <($out/bin/poetry completions zsh) \
  '';

-  nativeCheckInputs =
-    [
-      deepdiff
-      pytestCheckHook
-      httpretty
-      pytest-mock
-      pytest-xdist
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.ps
-    ];
+  nativeCheckInputs = [
+    deepdiff
+    pytestCheckHook
+    httpretty
+    pytest-mock
+    pytest-xdist
+  ];

  preCheck = (
    ''
--- a/pkgs/by-name/ra/rattler-build/package.nix
+++ b/pkgs/by-name/ra/rattler-build/package.nix
@ -14,17 +14,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "rattler-build";
-  version = "0.34.1";
+  version = "0.35.6";

  src = fetchFromGitHub {
    owner = "prefix-dev";
    repo = "rattler-build";
    tag = "v${version}";
-    hash = "sha256-HDRQveWOJKGBWxN7ZyIECo1HBfz+vSaLW7ueSok+d64=";
+    hash = "sha256-aCOHvJVGAxk0Lnpm772yLAuOmqgXE4RQB6s5YgmPOTw=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-b44bL/xVUwBdqwr/jawZbyV+yHsGR3hREm4nvHDMCWA=";
+  cargoHash = "sha256-wldCQ2VD7jGir2shN1mjGdWU/04ZdAtHEmDPnDwdgCc=";

  doCheck = false; # test requires network access

--- a/pkgs/by-name/re/recordbox/Cargo.lock
+++ b/pkgs/by-name/re/recordbox/Cargo.lock
--- a/pkgs/by-name/re/recordbox/package.nix
+++ b/pkgs/by-name/re/recordbox/package.nix
@ -24,14 +24,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "recordbox";
-  version = "0.9.0";
+  version = "0.9.2";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "edestcroix";
    repo = "Recordbox";
    rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-KfIlh9ORqjJ5V8mNOx7Q9jsYg4OJDX6q+ht+eckxMRU=";
+    hash = "sha256-Vt/uOueDKBjCVgFg6gMnOvbvR37udJ6J3BjE0LaL4Gw=";
  };

  # Patch in our Cargo.lock and ensure AppStream tests don't use the network
@ -96,7 +96,7 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  passthru = {
-    updateScript = nix-update-script { };
+    updateScript = nix-update-script { extraArgs = [ "--generate-lockfile" ]; };
  };

  meta = {
--- a/pkgs/by-name/ro/roogle/package.nix
+++ b/pkgs/by-name/ro/roogle/package.nix
@ -6,21 +6,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "roogle";
-  version = "0.1.4";
+  version = "1.0.2";

  src = fetchFromGitHub {
    owner = "hkmatsumoto";
    repo = pname;
    rev = version;
-    sha256 = "1h0agialbvhhiijkdnr47y7babq432limdl6ag2rmjfs7yishn4r";
+    sha256 = "sha256-oeQwRcDn4X/CL+O4APmGv9T19c9oD5tCBRz4K41K1Zg=";
  };

-  cargoHash = "sha256-CzFfFKTmBUAafk8PkkWmUkRIyO+yEhmCfN1zsLRq4Iw=";
-
-  postInstall = ''
-    mkdir -p $out/share/roogle
-    cp -r assets $out/share/roogle
-  '';
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-lmRo6Q67hJ3hv0jQt6epiNOckRv0rA0a0DNEKIdDoUE=";

  meta = with lib; {
    description = "Rust API search engine which allows you to search functions by names and type signatures";
--- a/pkgs/by-name/ru/ruff/package.nix
+++ b/pkgs/by-name/ru/ruff/package.nix
@ -17,17 +17,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "ruff";
-  version = "0.9.3";
+  version = "0.9.4";

  src = fetchFromGitHub {
    owner = "astral-sh";
    repo = "ruff";
    tag = version;
-    hash = "sha256-V05GUo5nA6RhVWD7mn94GF3/93In3cnljd2G3hPeBZ0=";
+    hash = "sha256-HUCquxp8U6ZoHNSuUSu56EyiaSRRA8qUMYu6nNibt6w=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-FpybUZZ5qjo87fYbUAnK+w4cUPx4UWGzexL92cEnIFU=";
+  cargoHash = "sha256-EiIN97I72Iam7STjZhHnvVktJXJocnVomjVp8a8t+fM=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/ru/rustdesk-flutter/package.nix
+++ b/pkgs/by-name/ru/rustdesk-flutter/package.nix
@ -38,7 +38,8 @@ let
      hash = "sha256-SbwqWapJbt6+RoqRKi+wkSH1D+Wz7JmnVbfcfKkjt8Q=";
    };

-    cargoHash = "sha256-dDyiptG9TKes+fXx2atwx697SWH7Rltx6xVubtTn7FM=";
+    useFetchCargoVendor = true;
+    cargoHash = "sha256-4khuq/DK4sP98AMHyr/lEo1OJdqLujOIi8IgbKBY60Y=";
    cargoBuildFlags = [
      "--package"
      "flutter_rust_bridge_codegen"
--- a/pkgs/by-name/ru/rustywind/package.nix
+++ b/pkgs/by-name/ru/rustywind/package.nix
@ -14,10 +14,11 @@ rustPlatform.buildRustPackage rec {
    owner = "avencera";
    repo = "rustywind";
    rev = "v${version}";
-    hash = "sha256-NRIWjmKjteJibqnOjkkUY9eKIM65H7NaRX8rn1MdXmY=";
+    hash = "sha256-4VpSf6ukeDbz8pRxsDt38MxMDgavAOqgzIof/3AaJ04=";
  };

-  cargoHash = "sha256-yUODUAhWtRGCj3U9nBlw3+5dNv6vGHXmJzUd8hGKnu0=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-zpSsDxUhQinKtjWuDeINenKedYKhPyW5u4bglmSgVdk=";

  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
    darwin.apple_sdk.frameworks.Security
--- a/pkgs/by-name/sa/samply/Cargo.lock
+++ b/pkgs/by-name/sa/samply/Cargo.lock
--- a/pkgs/by-name/sa/samply/package.nix
+++ b/pkgs/by-name/sa/samply/package.nix
@ -17,7 +17,9 @@ rustPlatform.buildRustPackage rec {
    hash = "sha256-7bf1lDIZGhRpvnn8rHNwzH2GBY8CwtYCjuRAUTQgbsA=";
  };

-  cargoHash = "sha256-QGvtKx+l6+UxdlziHnF63geAvW55RRlatK2/J8LR0Ck=";
+  # Can't use fetchCargoVendor:
+  # https://github.com/NixOS/nixpkgs/issues/377986
+  cargoLock.lockFile = ./Cargo.lock;

  # the dependencies linux-perf-data and linux-perf-event-reader contains both README.md and Readme.md,
  # which causes a hash mismatch on systems with a case-insensitive filesystem
--- a/Show More
+++ b/Show More