Merge staging-next into staging

nixos/doc/manual/release-notes/rl-2505.section.md

···
 
 - The behavior of the `networking.nat.externalIP` and `networking.nat.externalIPv6` options has been changed. `networking.nat.forwardPorts` now only forwards packets destined for the specified IP addresses.
 
+- `gitlab` has been updated from 17.x to 18.x and requires `postgresql` >= 16, as stated in the [documentation](https://docs.gitlab.com/18.0/install/requirements/#postgresql). Check the [upgrade guide](#module-services-postgres-upgrading) in the NixOS manual on how to upgrade your PostgreSQL installation.
+
 - `services.gitlab` now requires the setting of `activeRecordPrimaryKeyFile`, `activeRecordDeterministicKeyFile`, `activeRecordSaltFile` as GitLab introduced Rails ActiveRecord encryption.
 
 - `python3Packages.bpycv` has been removed due to being incompatible with Blender 4 and unmaintained.

nixos/modules/services/accessibility/orca.nix

···
 
   config = mkIf cfg.enable {
     environment.systemPackages = [ cfg.package ];
+    systemd.services.display-manager.path = [ cfg.package ];
     services.speechd.enable = true;
   };
 }

nixos/modules/services/misc/gitlab.nix

···
         message = "services.gitlab.secrets.activeRecordSaltFile must be set!";
       }
       {
-        assertion = versionAtLeast postgresqlPackage.version "14.9";
-        message = "PostgreSQL >= 14.9 is required to run GitLab 17. Follow the instructions in the manual section for upgrading PostgreSQL here: https://nixos.org/manual/nixos/stable/index.html#module-services-postgres-upgrading";
+        assertion = versionAtLeast postgresqlPackage.version "16";
+        message = "PostgreSQL >= 16 is required to run GitLab 18. Follow the instructions in the manual section for upgrading PostgreSQL here: https://nixos.org/manual/nixos/stable/index.html#module-services-postgres-upgrading";
       }
     ];
 

nixos/tests/brscan5.nix

···
       print(scanimage)
       assert """device `brother5:net1;dev0' is a Brother b ADS-1200""" in scanimage
       assert """device `brother5:net1;dev1' is a Brother a ADS-1200""" in scanimage
+
+      # Confirm systemd-udevd no longer logs errors about SYSFS
+      logs = machine.succeed('journalctl --unit systemd-udevd')
+      assert "Invalid key 'SYSFS'" not in logs
     '';
   }
 )

nixos/tests/tusd/default.nix

···
     client.succeed("${pkgs.coreutils}/bin/truncate --size=100M file-100M.bin")
 
     # Upload it.
+    client.wait_for_unit("network.target")
     client.succeed("${./tus-curl-upload.sh} file-100M.bin http://server:${toString port}/files/")
 
     print("Upload succeeded")

nixos/tests/vector/dnstap.nix

···
       unbound.wait_for_file("${dnstapSocket}")
       unbound.succeed("test 770 -eq $(stat -c '%a' ${dnstapSocket})")
 
+      dnsclient.systemctl("start network-online.target")
       dnsclient.wait_for_unit("network-online.target")
       dnsclient.succeed(
         "dig @unbound test.local"

pkgs/applications/misc/organicmaps/default.nix

···
   icu,
   freetype,
   pugixml,
+  xorg,
   nix-update-script,
 }:
 
···
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "organicmaps";
-  version = "2025.03.02-7";
+  version = "2025.05.20-5";
 
   src = fetchFromGitHub {
     owner = "organicmaps";
     repo = "organicmaps";
     tag = "${finalAttrs.version}-android";
-    hash = "sha256-5WX+YDgu8Ll5+rZWWxfbNW0pBFz+2XWkw/ahM14Ml08=";
+    hash = "sha256-cqcFI5cXREOeHusPkXsMwdCopzpea50mZQ/+ogLlemk=";
     fetchSubmodules = true;
   };
 
···
     icu
     freetype
     pugixml
+    xorg.libXrandr
+    xorg.libXinerama
+    xorg.libXcursor
   ];
 
   # Yes, this is PRE configure. The configure phase uses cmake
···
     };
   };
 
-  meta = with lib; {
+  meta = {
     # darwin: "invalid application of 'sizeof' to a function type"
     broken = stdenv.hostPlatform.isDarwin;
     homepage = "https://organicmaps.app/";
     description = "Detailed Offline Maps for Travellers, Tourists, Hikers and Cyclists";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ fgaz ];
-    platforms = platforms.all;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fgaz ];
+    platforms = lib.platforms.all;
     mainProgram = "OMaps";
   };
 })

pkgs/applications/version-management/gitlab/data.json

···
-{
-  "version": "17.11.2",
-  "repo_hash": "1jaxqchqag6q0c4vmrpwnmflv72b2xpskba9b0m4y6w6sy7hqx7q",
-  "yarn_hash": "0z06jaxqbg2wnq7yhpkba0cpxp4w4iy2cxla8nhc6kgx49xk179v",
-  "owner": "gitlab-org",
-  "repo": "gitlab",
-  "rev": "v17.11.2-ee",
-  "passthru": {
-    "GITALY_SERVER_VERSION": "17.11.2",
-    "GITLAB_PAGES_VERSION": "17.11.2",
-    "GITLAB_SHELL_VERSION": "14.41.0",
-    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.5.0",
-    "GITLAB_WORKHORSE_VERSION": "17.11.2"
-  }
-}

pkgs/applications/version-management/gitlab/default.nix pkgs/by-name/gi/gitlab/package.nix

···
               cp Cargo.lock $out
             '';
           };
-          hash = "sha256-Jr3lS3gQI/jojWIUxEBp7a950mcOvnbjlRIFXvfGays=";
+          hash = "sha256-73uliXjZNT8Ok98ai2rY+b0jYqxoQH3qW5YS+Ap6KK0=";
         };
 
         dontBuild = false;

pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix

···
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "17.11.2";
+  version = "18.0.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
···
 
   sourceRoot = "${src.name}/workhorse";
 
-  vendorHash = "sha256-76JO/oayqhv36WM7zC/a85l8CK1orsMuMksBYbmDN1o=";
+  vendorHash = "sha256-tLlxsUCoSGvUpJnS0GsNobk2IuSEgs3R4UDUmNf+HrA=";
   buildInputs = [ git ];
   ldflags = [ "-X main.Version=${version}" ];
   doCheck = false;

pkgs/applications/version-management/gitlab/rubyEnv/Gemfile pkgs/by-name/gi/gitlab/rubyEnv/Gemfile

···
 # frozen_string_literal: true
 
-def next?
-  File.basename(__FILE__) == "Gemfile.next"
-end
-
 source 'https://rubygems.org'
 
 if ENV.fetch('BUNDLER_CHECKSUM_VERIFICATION_OPT_IN', 'false') != 'false' # this verification is still experimental
···
 #
 # See https://docs.gitlab.com/ee/development/gemfile.html#upgrade-rails for guidelines when upgrading Rails
 
-if next?
-  gem 'rails', '~> 7.1.5.1', feature_category: :shared
-else
-  gem 'rails', '~> 7.0.8.7', feature_category: :shared
-end
+gem 'rails', '~> 7.1.5.1', feature_category: :shared
 
 gem 'activerecord-gitlab', path: 'gems/activerecord-gitlab', feature_category: :shared
 # This can be dropped after upgrading to Rails 7.2: https://github.com/rails/rails/pull/49674
···
 gem 'declarative_policy', '~> 1.1.0', feature_category: :shared
 
 # For source code paths mapping
-gem 'coverband', '6.1.4', require: false, feature_category: :shared
+gem 'coverband', '6.1.5', require: false, feature_category: :shared
 
 # Authentication libraries
 gem 'devise', '~> 4.9.3', feature_category: :system_access
···
 # Files attachments
 gem 'carrierwave', '~> 1.3', feature_category: :shared
 gem 'mini_magick', '~> 4.12', feature_category: :shared
+
+# PDF generation
+gem 'prawn', feature_category: :vulnerability_management
+gem 'prawn-svg', feature_category: :vulnerability_management
 
 # for backups
 gem 'fog-aws', '~> 3.26', feature_category: :shared
···
 gem 'elasticsearch-model', '~> 7.2', feature_category: :global_search
 gem 'elasticsearch-rails', '~> 7.2', require: 'elasticsearch/rails/instrumentation', feature_category: :global_search
 gem 'elasticsearch-api', '7.17.11', feature_category: :global_search
-gem 'aws-sdk-core', '~> 3.215.0', feature_category: :global_search
+gem 'aws-sdk-core', '~> 3.223.0', feature_category: :global_search
 gem 'aws-sdk-cloudformation', '~> 1', feature_category: :global_search
-gem 'aws-sdk-s3', '~> 1.177.0', feature_category: :global_search
+gem 'aws-sdk-s3', '~> 1.185.0', feature_category: :global_search
 gem 'faraday-typhoeus', '~> 1.1', feature_category: :global_search
 gem 'faraday_middleware-aws-sigv4', '~> 1.0.1', feature_category: :global_search
 # Used with Elasticsearch to support http keep-alive connections
···
 gem 'rouge', '~> 4.5.0', feature_category: :shared
 gem 'truncato', '~> 0.7.13', feature_category: :team_planning
 gem 'nokogiri', '~> 1.18', feature_category: :shared
-gem 'gitlab-glfm-markdown', '~> 0.0.29', feature_category: :markdown
+gem 'gitlab-glfm-markdown', '~> 0.0.30', feature_category: :markdown
 gem 'tanuki_emoji', '~> 0.13', feature_category: :markdown
 gem 'unicode-emoji', '~> 4.0', feature_category: :markdown
 
···
 
 # Misc
 
-gem 'semver_dialects', '~> 3.6', feature_category: :software_composition_analysis
+gem 'semver_dialects', '~> 3.7', feature_category: :software_composition_analysis
 gem 'version_sorter', '~> 2.3', feature_category: :shared
 gem 'csv_builder', path: 'gems/csv_builder', feature_category: :shared
 
···
 gem 'rack-attack', '~> 6.7.0', feature_category: :shared
 
 # Sentry integration
-gem 'sentry-ruby', '~> 5.22.0', feature_category: :observability
-gem 'sentry-rails', '~> 5.22.0', feature_category: :observability
-gem 'sentry-sidekiq', '~> 5.22.0', feature_category: :observability
+gem 'sentry-ruby', '~> 5.23.0', feature_category: :observability
+gem 'sentry-rails', '~> 5.23.0', feature_category: :observability
+gem 'sentry-sidekiq', '~> 5.23.0', feature_category: :observability
 
 # PostgreSQL query parsing
 #
···
 gem 'snowplow-tracker', '~> 0.8.0', feature_category: :product_analytics
 
 # Metrics
-gem 'webrick', '~> 1.8.1', require: false, feature_category: :shared
+gem 'webrick', '~> 1.9.0', require: false, feature_category: :shared
 gem 'prometheus-client-mmap', '~> 1.2.9', require: 'prometheus/client', feature_category: :shared
 
 # Event-driven reactor for Ruby
···
 group :development do
   gem 'lefthook', '~> 1.11.0', require: false, feature_category: :tooling
   gem 'rubocop', feature_category: :tooling
-  gem 'solargraph', '~> 0.47.2', require: false, feature_category: :shared
+
+  gem 'solargraph', '~> 0.54.0', require: false, feature_category: :shared
+  gem 'solargraph-rspec', '~> 0.5.1', require: false, feature_category: :shared
 
   gem 'letter_opener_web', '~> 3.0.0', feature_category: :shared
   gem 'lookbook', '~> 2.3', feature_category: :shared
···
 end
 
 group :development, :test do
-  gem 'deprecation_toolkit', '~> 1.5.1', require: false, feature_category: :shared
+  gem 'deprecation_toolkit', '~> 2.2.3', require: false, feature_category: :shared
   gem 'bullet', '~> 7.2.0', feature_category: :shared
-  gem 'parser', '= 3.3.7.1', feature_category: :shared
+  gem 'parser', '= 3.3.8.0', feature_category: :shared
   gem 'pry-byebug', feature_category: :shared
   gem 'pry-rails', '~> 0.3.9', feature_category: :shared
   gem 'pry-shell', '~> 0.6.4', feature_category: :shared
···
   gem 'influxdb-client', '~> 3.1', require: false, feature_category: :tooling
 
   gem 'knapsack', '~> 4.0.0', feature_category: :tooling
-  gem 'crystalball', '~> 0.7.0', require: false, feature_category: :tooling
+  gem 'gitlab-crystalball', '~> 0.7.2', require: false, feature_category: :tooling
   gem 'test_file_finder', '~> 0.3.1', feature_category: :tooling
 
   gem 'simple_po_parser', '~> 1.1.6', require: false, feature_category: :shared
···
 end
 
 group :development, :test, :danger do
-  gem 'gitlab-dangerfiles', '~> 4.8.0', require: false, feature_category: :tooling
+  gem 'gitlab-dangerfiles', '~> 4.9.0', require: false, feature_category: :tooling
 end
 
 group :development, :test, :coverage do
···
   gem 'rspec_junit_formatter', feature_category: :shared
   gem 'guard-rspec', feature_category: :shared
   gem 'axe-core-rspec', '~> 4.10.0', feature_category: :tooling
+  gem 'state_machines-rspec', '~> 0.6', feature_category: :shared
 
   # Moved in `test` because https://gitlab.com/gitlab-org/gitlab/-/issues/217527
   gem 'derailed_benchmarks', require: false, feature_category: :shared
 
-  gem 'gitlab_quality-test_tooling', '~> 2.8.0', require: false, feature_category: :tooling
+  gem 'gitlab_quality-test_tooling', '~> 2.10.0', require: false, feature_category: :tooling
 end
 
 gem 'octokit', '~> 9.0', feature_category: :importers
···
 gem 'gitaly', '~> 17.8.0', feature_category: :gitaly
 
 # KAS GRPC protocol definitions
-gem 'gitlab-kas-grpc', '~> 17.9.0.pre.rc2', feature_category: :deployment_management
+gem 'gitlab-kas-grpc', '~> 17.11.0', feature_category: :deployment_management
 
 # Lock the version before issues below are resolved:
 # https://gitlab.com/gitlab-org/gitlab/-/issues/473169#note_2028352939
···
 gem 'grape_logging', '~> 1.8', '>= 1.8.4', feature_category: :api
 
 # DNS Lookup
-gem 'gitlab-net-dns', '~> 0.10.0', feature_category: :shared
+gem 'gitlab-net-dns', '~> 0.12.0', feature_category: :shared
 
 # Countries list
 gem 'countries', '~> 4.0.0', feature_category: :shared
···
 
 # JSON
 gem 'jsonb_accessor', '~> 1.4', feature_category: :shared
-gem 'json', '~> 2.10.0', feature_category: :shared
+gem 'json', '~> 2.11.0', feature_category: :shared
 gem 'json_schemer', '~> 2.3.0', feature_category: :shared
 gem 'oj', '~> 3.16.0', '>=3.16.10', feature_category: :shared
 gem 'oj-introspect', '~> 0.8', feature_category: :shared
···
 
 gem 'ipynbdiff', path: 'gems/ipynbdiff', require: 'ipynb_diff', feature_category: :shared
 
-gem 'ed25519', '~> 1.3.0', feature_category: :shared
+gem 'ed25519', '~> 1.4.0', feature_category: :shared
 
 # Error Tracking OpenAPI client
 # See https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/development/rake_tasks.md#update-openapi-client-for-error-tracking-feature
···
 gem 'arr-pm', '~> 0.0.12', feature_category: :package_registry
 
 # Remote Development
-gem 'devfile', '~> 0.4.3', feature_category: :workspaces
+gem 'devfile', '~> 0.4.4', feature_category: :workspaces
 
 # Apple plist parsing
 gem 'CFPropertyList', '~> 3.0.0', feature_category: :mobile_devops
···
 
 gem 'gitlab-sdk', '~> 0.3.0', feature_category: :application_instrumentation
 
-gem 'paper_trail', '~> 15.0', feature_category: :shared
+gem 'paper_trail', '~> 16.0', feature_category: :shared
 
 gem "i18n_data", "~> 0.13.1", feature_category: :system_access
 
-gem "gitlab-cloud-connector", "~> 1.5", require: 'gitlab/cloud_connector', feature_category: :cloud_connector
+gem "gitlab-cloud-connector", "~> 1.11", require: 'gitlab/cloud_connector', feature_category: :cloud_connector

pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock

···
       activerecord (>= 7)
       activesupport (>= 7)
       addressable (~> 2.8)
+      bigdecimal (~> 3.1)
       concurrent-ruby (~> 1.1)
       faraday (~> 2)
       google-cloud-storage_transfer (~> 1.2.0)
···
       jwt (~> 2.5)
       logger (~> 1.5)
       minitest (~> 5.11.0)
+      mutex_m (~> 0.3)
       parallel (~> 1.19)
       pg (~> 1.5.6)
       rack (~> 2.2.9)
···
       base64 (~> 0.2.0)
       faraday (>= 1.0, < 3.0.0)
       faraday-retry (>= 1.0, < 3.0.0)
-    actioncable (7.0.8.7)
-      actionpack (= 7.0.8.7)
-      activesupport (= 7.0.8.7)
+    actioncable (7.1.5.1)
+      actionpack (= 7.1.5.1)
+      activesupport (= 7.1.5.1)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
-    actionmailbox (7.0.8.7)
-      actionpack (= 7.0.8.7)
-      activejob (= 7.0.8.7)
-      activerecord (= 7.0.8.7)
-      activestorage (= 7.0.8.7)
-      activesupport (= 7.0.8.7)
+      zeitwerk (~> 2.6)
+    actionmailbox (7.1.5.1)
+      actionpack (= 7.1.5.1)
+      activejob (= 7.1.5.1)
+      activerecord (= 7.1.5.1)
+      activestorage (= 7.1.5.1)
+      activesupport (= 7.1.5.1)
       mail (>= 2.7.1)
       net-imap
       net-pop
       net-smtp
-    actionmailer (7.0.8.7)
-      actionpack (= 7.0.8.7)
-      actionview (= 7.0.8.7)
-      activejob (= 7.0.8.7)
-      activesupport (= 7.0.8.7)
+    actionmailer (7.1.5.1)
+      actionpack (= 7.1.5.1)
+      actionview (= 7.1.5.1)
+      activejob (= 7.1.5.1)
+      activesupport (= 7.1.5.1)
       mail (~> 2.5, >= 2.5.4)
       net-imap
       net-pop
       net-smtp
-      rails-dom-testing (~> 2.0)
-    actionpack (7.0.8.7)
-      actionview (= 7.0.8.7)
-      activesupport (= 7.0.8.7)
-      rack (~> 2.0, >= 2.2.4)
+      rails-dom-testing (~> 2.2)
+    actionpack (7.1.5.1)
+      actionview (= 7.1.5.1)
+      activesupport (= 7.1.5.1)
+      nokogiri (>= 1.8.5)
+      racc
+      rack (>= 2.2.4)
+      rack-session (>= 1.0.1)
       rack-test (>= 0.6.3)
-      rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actiontext (7.0.8.7)
-      actionpack (= 7.0.8.7)
-      activerecord (= 7.0.8.7)
-      activestorage (= 7.0.8.7)
-      activesupport (= 7.0.8.7)
+      rails-dom-testing (~> 2.2)
+      rails-html-sanitizer (~> 1.6)
+    actiontext (7.1.5.1)
+      actionpack (= 7.1.5.1)
+      activerecord (= 7.1.5.1)
+      activestorage (= 7.1.5.1)
+      activesupport (= 7.1.5.1)
       globalid (>= 0.6.0)
       nokogiri (>= 1.8.5)
-    actionview (7.0.8.7)
-      activesupport (= 7.0.8.7)
+    actionview (7.1.5.1)
+      activesupport (= 7.1.5.1)
       builder (~> 3.1)
-      erubi (~> 1.4)
-      rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activejob (7.0.8.7)
-      activesupport (= 7.0.8.7)
+      erubi (~> 1.11)
+      rails-dom-testing (~> 2.2)
+      rails-html-sanitizer (~> 1.6)
+    activejob (7.1.5.1)
+      activesupport (= 7.1.5.1)
       globalid (>= 0.3.6)
-    activemodel (7.0.8.7)
-      activesupport (= 7.0.8.7)
-    activerecord (7.0.8.7)
-      activemodel (= 7.0.8.7)
-      activesupport (= 7.0.8.7)
+    activemodel (7.1.5.1)
+      activesupport (= 7.1.5.1)
+    activerecord (7.1.5.1)
+      activemodel (= 7.1.5.1)
+      activesupport (= 7.1.5.1)
+      timeout (>= 0.4.0)
     activerecord-explain-analyze (0.1.0)
       activerecord (>= 4)
       pg
-    activestorage (7.0.8.7)
-      actionpack (= 7.0.8.7)
-      activejob (= 7.0.8.7)
-      activerecord (= 7.0.8.7)
-      activesupport (= 7.0.8.7)
+    activestorage (7.1.5.1)
+      actionpack (= 7.1.5.1)
+      activejob (= 7.1.5.1)
+      activerecord (= 7.1.5.1)
+      activesupport (= 7.1.5.1)
       marcel (~> 1.0)
-      mini_mime (>= 1.1.0)
-    activesupport (7.0.8.7)
+    activesupport (7.1.5.1)
+      base64
+      benchmark (>= 0.3)
+      bigdecimal
       concurrent-ruby (~> 1.0, >= 1.0.2)
+      connection_pool (>= 2.2.5)
+      drb
       i18n (>= 1.6, < 2)
+      logger (>= 1.4.2)
       minitest (>= 5.1)
+      mutex_m
+      securerandom (>= 0.3)
       tzinfo (~> 2.0)
     addressable (2.8.7)
       public_suffix (>= 2.0.2, < 7.0)
···
     aws-sdk-cloudformation (1.41.0)
       aws-sdk-core (~> 3, >= 3.99.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-core (3.215.0)
+    aws-sdk-core (3.223.0)
       aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.992.0)
       aws-sigv4 (~> 1.9)
+      base64
       jmespath (~> 1, >= 1.6.1)
+      logger
     aws-sdk-kms (1.76.0)
       aws-sdk-core (~> 3, >= 3.188.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.177.0)
-      aws-sdk-core (~> 3, >= 3.210.0)
+    aws-sdk-s3 (1.185.0)
+      aws-sdk-core (~> 3, >= 3.216.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.5)
     aws-sigv4 (1.9.1)
       aws-eventstream (~> 1, >= 1.0.2)
-    axe-core-api (4.10.2)
+    axe-core-api (4.10.3)
       dumb_delegator
       ostruct
       virtus
-    axe-core-rspec (4.10.2)
-      axe-core-api (= 4.10.2)
+    axe-core-rspec (4.10.3)
+      axe-core-api (= 4.10.3)
       dumb_delegator
       ostruct
       virtus
···
     base64 (0.2.0)
     batch-loader (2.0.5)
     bcrypt (3.1.20)
-    benchmark (0.2.0)
+    benchmark (0.4.0)
     benchmark-ips (2.14.0)
     benchmark-malloc (0.2.0)
     benchmark-memory (0.2.0)
···
     bullet (7.2.0)
       activesupport (>= 3.0.0)
       uniform_notifier (~> 1.11)
-    byebug (11.1.3)
+    byebug (12.0.0)
     capybara (3.40.0)
       addressable
       matrix
···
     colored2 (3.1.2)
     commonmarker (0.23.11)
     concurrent-ruby (1.2.3)
-    connection_pool (2.5.0)
+    connection_pool (2.5.3)
     console (1.29.2)
       fiber-annotation
       fiber-local (~> 1.1)
···
     countries (4.0.1)
       i18n_data (~> 0.13.0)
       sixarm_ruby_unaccent (~> 1.1)
-    coverband (6.1.4)
+    coverband (6.1.5)
+      base64
       redis (>= 3.0)
     crack (0.4.3)
       safe_yaml (~> 1.0.0)
     crass (1.0.6)
     creole (0.5.0)
-    crystalball (0.7.0)
-      git
     css_parser (1.14.0)
       addressable
     cssbundling-rails (1.4.3)
···
       html-pipeline (~> 2.0)
     declarative (0.0.20)
     declarative_policy (1.1.0)
-    deprecation_toolkit (1.5.1)
-      activesupport (>= 4.2)
+    deprecation_toolkit (2.2.3)
+      activesupport (>= 6.1)
     derailed_benchmarks (2.2.1)
       base64
       benchmark-ips (~> 2)
···
       thor (>= 0.19, < 2)
     descendants_tracker (0.0.4)
       thread_safe (~> 0.3, >= 0.3.1)
-    devfile (0.4.3)
+    devfile (0.4.4)
     device_detector (1.0.0)
     devise (4.9.4)
       bcrypt (~> 3.0)
···
     docile (1.4.0)
     domain_name (0.5.20190701)
       unf (>= 0.0.5, < 1.0.0)
-    doorkeeper (5.8.1)
+    doorkeeper (5.8.2)
       railties (>= 5)
     doorkeeper-device_authorization_grant (1.0.3)
       doorkeeper (~> 5.5)
···
       zeitwerk (~> 2.6)
     dumb_delegator (1.0.0)
     duo_api (1.4.0)
-    e2mmap (0.1.0)
-    ed25519 (1.3.0)
+    ed25519 (1.4.0)
     elasticsearch (7.17.11)
       elasticsearch-api (= 7.17.11)
       elasticsearch-transport (= 7.17.11)
···
       aws-sigv4 (~> 1.0)
       faraday (>= 2.0, < 3)
     fast_blank (1.0.1)
-    fast_gettext (2.3.0)
+    fast_gettext (4.1.0)
+      prime
+      racc
     ffaker (2.24.0)
-    ffi (1.17.1)
+    ffi (1.17.2)
     ffi-compiler (1.0.1)
       ffi (>= 1.0.0)
       rake
···
       multi_json (~> 1.10)
     fog-local (0.8.0)
       fog-core (>= 1.27, < 3.0)
-    fog-xml (0.1.3)
+    fog-xml (0.1.5)
       fog-core
       nokogiri (>= 1.5.11, < 2.0.0)
     formatador (0.2.5)
···
       terminal-table (>= 1.5.1)
     gitlab-chronic (0.10.6)
       numerizer (~> 0.2)
-    gitlab-cloud-connector (1.6.0)
+    gitlab-cloud-connector (1.12.0)
       activesupport (~> 7.0)
       jwt (~> 2.9.3)
-    gitlab-dangerfiles (4.8.1)
+    gitlab-crystalball (0.7.2)
+      git (< 4)
+    gitlab-dangerfiles (4.9.1)
       danger (>= 9.3.0)
       danger-gitlab (>= 8.0.0)
       rake (~> 13.0)
···
       mime-types
       net-http-persistent (~> 4.0)
       nokogiri (~> 1, >= 1.10.8)
-    gitlab-glfm-markdown (0.0.29)
+    gitlab-glfm-markdown (0.0.30)
       rb_sys (~> 0.9.109)
-    gitlab-kas-grpc (17.9.1)
+    gitlab-kas-grpc (17.11.2)
       grpc (~> 1.0)
     gitlab-labkit (0.37.0)
       actionpack (>= 5.0.0, < 8.1.0)
···
       redis (>= 5, < 6)
       redis-namespace (>= 1.8.2)
     gitlab-markup (2.0.0)
-    gitlab-net-dns (0.10.0)
+    gitlab-net-dns (0.12.0)
+      logger
     gitlab-sdk (0.3.1)
       activesupport (>= 5.2.0)
       rake (~> 13.0)
       snowplow-tracker (~> 0.8.0)
-    gitlab-secret_detection (0.23.0)
+    gitlab-secret_detection (0.26.1)
       grpc (~> 1.63.0)
-      grpc-tools (~> 1.63)
       grpc_reflection (~> 0.1)
       parallel (~> 1)
       re2 (~> 2.7)
···
       omniauth (>= 1.3, < 3)
       pyu-ruby-sasl (>= 0.0.3.3, < 0.1)
       rubyntlm (~> 0.5)
-    gitlab_quality-test_tooling (2.8.0)
-      activesupport (>= 7.0, < 7.2)
+    gitlab_quality-test_tooling (2.10.0)
+      activesupport (>= 7.0, < 7.3)
       amatch (~> 0.4.1)
       fog-google (~> 1.24, >= 1.24.1)
       gitlab (>= 4.19, < 6.0)
···
     google-cloud-storage_transfer-v1 (0.8.0)
       gapic-common (>= 0.20.0, < 2.a)
       google-cloud-errors (~> 1.0)
-    google-protobuf (3.25.6)
+    google-protobuf (3.25.7)
     googleapis-common-protos (1.4.0)
       google-protobuf (~> 3.14)
       googleapis-common-protos-types (~> 1.2)
       grpc (~> 1.27)
-    googleapis-common-protos-types (1.18.0)
+    googleapis-common-protos-types (1.19.0)
       google-protobuf (>= 3.18, < 5.a)
     googleauth (1.8.1)
       faraday (>= 0.17.3, < 3.a)
···
       google-protobuf (~> 3.18)
       googleapis-common-protos (~> 1.4)
       grpc (~> 1.41)
-    grpc-tools (1.69.0)
     grpc_reflection (0.1.1)
       grpc
     gssapi (1.3.1)
···
     haml (5.2.2)
       temple (>= 0.8.0)
       tilt
-    haml_lint (0.61.0)
+    haml_lint (0.62.0)
       haml (>= 5.0)
       parallel (~> 1.10)
       rainbow
···
       csv
     invisible_captcha (2.1.0)
       rails (>= 5.2)
+    io-console (0.8.0)
     io-event (1.9.0)
     ipaddress (0.8.3)
+    irb (1.15.1)
+      pp (>= 0.6.0)
+      rdoc (>= 4.0.0)
+      reline (>= 0.4.2)
     jaeger-client (1.1.0)
       opentracing (~> 0.3)
       thrift
-    jaro_winkler (1.5.6)
+    jaro_winkler (1.6.0)
     jira-ruby (2.3.0)
       activesupport
       atlassian-jwt
···
       character_set (~> 1.4)
       regexp_parser (~> 2.5)
       regexp_property_values (~> 1.0)
-    json (2.10.2)
+    json (2.11.3)
     json-jwt (1.16.6)
       activesupport (>= 4.2)
       aes_key_wrap
···
     language_server-protocol (3.17.0.3)
     launchy (2.5.2)
       addressable (~> 2.8)
-    lefthook (1.11.2)
+    lefthook (1.11.5)
     letter_opener (1.10.0)
       launchy (>= 2.2, < 4)
     letter_opener_web (3.0.0)
···
       tomlrb (>= 1.3, < 2.1)
       with_env (= 1.1.0)
       xml-simple (~> 1.1.9)
-    licensee (9.17.1)
+    licensee (9.18.0)
       dotenv (>= 2, < 4)
       octokit (>= 4.20, < 10.0)
-      reverse_markdown (>= 1, < 3)
+      reverse_markdown (>= 1, < 4)
       rugged (>= 0.24, < 2.0)
       thor (>= 0.19, < 2.0)
     listen (3.7.1)
···
     mixlib-cli (2.1.8)
     mixlib-config (3.0.27)
       tomlrb
-    mixlib-log (3.0.9)
+    mixlib-log (3.2.3)
+      ffi (>= 1.15.5)
     mixlib-shellout (3.2.7)
       chef-utils
     mize (0.6.1)
···
     nio4r (2.7.0)
     nkf (0.2.0)
     no_proxy_fix (0.1.2)
-    nokogiri (1.18.7)
+    nokogiri (1.18.8)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
     notiffany (0.1.3)
···
       rack (>= 1.2, < 4)
       snaky_hash (~> 2.0)
       version_gem (~> 1.1)
+    observer (0.1.2)
     octokit (9.2.0)
       faraday (>= 1, < 3)
       sawyer (~> 0.9)
···
       diff-lcs (~> 1.5)
       expgen (~> 0.1)
       rainbow (~> 3.1.1)
-    paper_trail (15.1.0)
+    paper_trail (16.0.0)
       activerecord (>= 6.1)
       request_store (~> 1.4)
     parallel (1.26.3)
-    parser (3.3.7.1)
+    parser (3.3.8.0)
       ast (~> 2.4.1)
       racc
     parslet (1.8.2)
     pastel (0.8.0)
       tty-color (~> 0.5)
+    pdf-core (0.10.0)
     peek (1.1.0)
       railties (>= 4.0.0)
     pg (1.5.9)
···
       google-protobuf (>= 3.25.3)
     plist (3.7.0)
     png_quantizator (0.2.1)
+    pp (0.6.2)
+      prettyprint
+    prawn (2.5.0)
+      matrix (~> 0.4)
+      pdf-core (~> 0.10.0)
+      ttfunk (~> 1.8)
+    prawn-svg (0.37.0)
+      css_parser (~> 1.6)
+      matrix (~> 0.4.2)
+      prawn (>= 0.11.1, < 3)
+      rexml (>= 3.3.9, < 4)
     premailer (1.23.0)
       addressable
       css_parser (>= 1.12.0)
···
       actionmailer (>= 3)
       net-smtp
       premailer (~> 1.7, >= 1.7.9)
+    prettyprint (0.2.0)
     prime (0.1.3)
       forwardable
       singleton
···
     pry (0.14.2)
       coderay (~> 1.1)
       method_source (~> 1.0)
-    pry-byebug (3.10.1)
-      byebug (~> 11.0)
-      pry (>= 0.13, < 0.15)
+    pry-byebug (3.11.0)
+      byebug (~> 12.0)
+      pry (>= 0.13, < 0.16)
     pry-rails (0.3.11)
       pry (>= 0.13.0)
     pry-shell (0.6.4)
       pry (>= 0.13.0)
       tty-markdown
       tty-prompt
+    psych (5.2.3)
+      date
+      stringio
     public_suffix (6.0.1)
     puma (6.5.0)
       nio4r (~> 2.0)
···
     rack-test (2.1.0)
       rack (>= 1.3)
     rack-timeout (0.7.0)
-    rails (7.0.8.7)
-      actioncable (= 7.0.8.7)
-      actionmailbox (= 7.0.8.7)
-      actionmailer (= 7.0.8.7)
-      actionpack (= 7.0.8.7)
-      actiontext (= 7.0.8.7)
-      actionview (= 7.0.8.7)
-      activejob (= 7.0.8.7)
-      activemodel (= 7.0.8.7)
-      activerecord (= 7.0.8.7)
-      activestorage (= 7.0.8.7)
-      activesupport (= 7.0.8.7)
+    rackup (1.0.1)
+      rack (< 3)
+      webrick
+    rails (7.1.5.1)
+      actioncable (= 7.1.5.1)
+      actionmailbox (= 7.1.5.1)
+      actionmailer (= 7.1.5.1)
+      actionpack (= 7.1.5.1)
+      actiontext (= 7.1.5.1)
+      actionview (= 7.1.5.1)
+      activejob (= 7.1.5.1)
+      activemodel (= 7.1.5.1)
+      activerecord (= 7.1.5.1)
+      activestorage (= 7.1.5.1)
+      activesupport (= 7.1.5.1)
       bundler (>= 1.15.0)
-      railties (= 7.0.8.7)
+      railties (= 7.1.5.1)
     rails-controller-testing (1.0.5)
       actionpack (>= 5.0.1.rc1)
       actionview (>= 5.0.1.rc1)
       activesupport (>= 5.0.1.rc1)
-    rails-dom-testing (2.0.3)
-      activesupport (>= 4.2.0)
+    rails-dom-testing (2.2.0)
+      activesupport (>= 5.0.0)
+      minitest
       nokogiri (>= 1.6)
     rails-html-sanitizer (1.6.1)
       loofah (~> 2.21)
···
     rails-i18n (7.0.10)
       i18n (>= 0.7, < 2)
       railties (>= 6.0.0, < 8)
-    railties (7.0.8.7)
-      actionpack (= 7.0.8.7)
-      activesupport (= 7.0.8.7)
-      method_source
+    railties (7.1.5.1)
+      actionpack (= 7.1.5.1)
+      activesupport (= 7.1.5.1)
+      irb
+      rackup (>= 1.0.0)
       rake (>= 12.2)
-      thor (~> 1.0)
-      zeitwerk (~> 2.5)
+      thor (~> 1.0, >= 1.2.2)
+      zeitwerk (~> 2.6)
     rainbow (3.1.1)
     rake (13.0.6)
     rake-compiler-dock (1.9.1)
···
       msgpack (>= 0.4.3)
       optimist (>= 3.0.0)
     rchardet (1.8.0)
+    rdoc (6.13.0)
+      psych (>= 4.0.0)
     re2 (2.15.0)
       mini_portile2 (~> 2.8.7)
     recaptcha (5.12.3)
···
       redis (>= 4, < 6)
     regexp_parser (2.10.0)
     regexp_property_values (1.0.0)
+    reline (0.6.0)
+      io-console (~> 0.5)
     representable (3.2.0)
       declarative (< 0.1.0)
       trailblazer-option (>= 0.1.1, < 0.2.0)
···
       mime-types (>= 1.16, < 4.0)
       netrc (~> 0.8)
     retriable (3.1.2)
-    reverse_markdown (1.4.0)
+    reverse_markdown (3.0.0)
       nokogiri
     rexml (3.4.1)
     rinku (2.0.0)
···
     ruby-fogbugz (0.3.0)
       crack (~> 0.4)
       multipart-post (~> 2.0)
-    ruby-lsp (0.23.13)
+    ruby-lsp (0.23.15)
       language_server-protocol (~> 3.17.0)
       prism (>= 1.2, < 2.0)
       rbs (>= 3, < 4)
···
       addressable (>= 2.3.5)
       faraday (>= 0.17.3, < 3)
     sd_notify (0.1.1)
+    securerandom (0.4.1)
     seed-fu (2.3.9)
       activerecord (>= 3.1)
       activesupport (>= 3.1)
···
       rexml (~> 3.2, >= 3.2.5)
       rubyzip (>= 1.2.2, < 3.0)
       websocket (~> 1.0)
-    semver_dialects (3.6.0)
+    semver_dialects (3.7.0)
       deb_version (~> 1.0.1)
       pastel (~> 0.8.0)
       thor (~> 1.3)
       tty-command (~> 0.10.1)
-    sentry-rails (5.22.1)
+    sentry-rails (5.23.0)
       railties (>= 5.0)
-      sentry-ruby (~> 5.22.1)
-    sentry-ruby (5.22.1)
+      sentry-ruby (~> 5.23.0)
+    sentry-ruby (5.23.0)
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.0.2)
-    sentry-sidekiq (5.22.1)
-      sentry-ruby (~> 5.22.1)
+    sentry-sidekiq (5.23.0)
+      sentry-ruby (~> 5.23.0)
       sidekiq (>= 3.0)
     shellany (0.0.1)
     shoulda-matchers (6.4.0)
···
       hashie
       version_gem (~> 1.1)
     snowplow-tracker (0.8.0)
-    solargraph (0.47.2)
+    solargraph (0.54.2)
       backport (~> 1.2)
-      benchmark
-      bundler (>= 1.17.2)
+      benchmark (~> 0.4)
+      bundler (~> 2.0)
       diff-lcs (~> 1.4)
-      e2mmap
-      jaro_winkler (~> 1.5)
+      jaro_winkler (~> 1.6)
       kramdown (~> 2.3)
       kramdown-parser-gfm (~> 1.1)
+      logger (~> 1.6)
+      observer (~> 0.1)
+      ostruct (~> 0.6)
       parser (~> 3.0)
-      reverse_markdown (>= 1.0.5, < 3)
-      rubocop (>= 0.52)
+      rbs (~> 3.3)
+      reverse_markdown (~> 3.0)
+      rubocop (~> 1.38)
       thor (~> 1.0)
       tilt (~> 2.0)
       yard (~> 0.9, >= 0.9.24)
+      yard-solargraph (~> 0.1)
+    solargraph-rspec (0.5.1)
+      solargraph (~> 0.52, >= 0.52.0)
     sorbet-runtime (0.5.11647)
     spamcheck (1.3.3)
       grpc (~> 1.63)
···
     state_machines-activerecord (0.8.0)
       activerecord (>= 5.1)
       state_machines-activemodel (>= 0.8.0)
+    state_machines-rspec (0.6.0)
+      activesupport
+      rspec (~> 3.3)
+      state_machines
+    stringio (3.1.7)
     strings (0.2.1)
       strings-ansi (~> 0.2)
       unicode-display_width (>= 1.5, < 3.0)
···
     truncato (0.7.13)
       htmlentities (~> 4.3.1)
       nokogiri (>= 1.7.0, <= 2.0)
+    ttfunk (1.8.0)
+      bigdecimal (~> 3.1)
     tty-color (0.6.0)
     tty-command (0.10.1)
       pastel (~> 0.8)
···
     vite_rails (3.0.19)
       railties (>= 5.1, < 9)
       vite_ruby (~> 3.0, >= 3.2.2)
-    vite_ruby (3.9.1)
+    vite_ruby (3.9.2)
       dry-cli (>= 0.7, < 2)
       logger (~> 1.6)
       mutex_m
···
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
-    webrick (1.8.2)
+    webrick (1.9.1)
     websocket (1.2.10)
     websocket-driver (0.7.6)
       websocket-extensions (>= 0.1.0)
···
       nokogiri (~> 1.8)
     yajl-ruby (1.4.3)
     yard (0.9.37)
+    yard-solargraph (0.1.0)
+      yard (~> 0.9)
     zeitwerk (2.6.7)
 
 PLATFORMS
···
   attr_encrypted (~> 3.2.4)!
   awesome_print
   aws-sdk-cloudformation (~> 1)
-  aws-sdk-core (~> 3.215.0)
-  aws-sdk-s3 (~> 1.177.0)
+  aws-sdk-core (~> 3.223.0)
+  aws-sdk-s3 (~> 1.185.0)
   axe-core-rspec (~> 4.10.0)
   babosa (~> 2.0)
   base32 (~> 0.3.0)
···
   concurrent-ruby (~> 1.1)
   connection_pool (~> 2.4)
   countries (~> 4.0.0)
-  coverband (= 6.1.4)
+  coverband (= 6.1.5)
   creole (~> 0.5.0)
-  crystalball (~> 0.7.0)
   cssbundling-rails (= 1.4.3)
   csv_builder!
   cvss-suite (~> 3.3.0)
   database_cleaner-active_record (~> 2.2.0)
   deckar01-task_list (= 2.3.4)
   declarative_policy (~> 1.1.0)
-  deprecation_toolkit (~> 1.5.1)
+  deprecation_toolkit (~> 2.2.3)
   derailed_benchmarks
-  devfile (~> 0.4.3)
+  devfile (~> 0.4.4)
   device_detector
   devise (~> 4.9.3)
   devise-pbkdf2-encryptable (~> 0.0.0)!
···
   doorkeeper-openid_connect (~> 1.8.10)
   drb (~> 2.2)
   duo_api (~> 1.3)
-  ed25519 (~> 1.3.0)
+  ed25519 (~> 1.4.0)
   elasticsearch-api (= 7.17.11)
   elasticsearch-model (~> 7.2)
   elasticsearch-rails (~> 7.2)
···
   gitlab-active-context!
   gitlab-backup-cli!
   gitlab-chronic (~> 0.10.5)
-  gitlab-cloud-connector (~> 1.5)
-  gitlab-dangerfiles (~> 4.8.0)
+  gitlab-cloud-connector (~> 1.11)
+  gitlab-crystalball (~> 0.7.2)
+  gitlab-dangerfiles (~> 4.9.0)
   gitlab-duo-workflow-service-client (~> 0.1)!
   gitlab-experiment (~> 0.9.1)
   gitlab-fog-azure-rm (~> 2.2.0)
-  gitlab-glfm-markdown (~> 0.0.29)
+  gitlab-glfm-markdown (~> 0.0.30)
   gitlab-housekeeper!
   gitlab-http!
-  gitlab-kas-grpc (~> 17.9.0.pre.rc2)
+  gitlab-kas-grpc (~> 17.11.0)
   gitlab-labkit (~> 0.37.0)
   gitlab-license (~> 2.6)
   gitlab-mail_room (~> 0.0.24)
   gitlab-markup (~> 2.0.0)
-  gitlab-net-dns (~> 0.10.0)
+  gitlab-net-dns (~> 0.12.0)
   gitlab-rspec!
   gitlab-rspec_flaky!
   gitlab-safe_request_store!
···
   gitlab-utils!
   gitlab_chronic_duration (~> 0.12)
   gitlab_omniauth-ldap (~> 2.2.0)
-  gitlab_quality-test_tooling (~> 2.8.0)
+  gitlab_quality-test_tooling (~> 2.10.0)
   gon (~> 6.4.0)
   google-apis-androidpublisher_v3 (~> 0.34.0)
   google-apis-cloudbilling_v1 (~> 0.22.0)
···
   ipynbdiff!
   jira-ruby (~> 2.3.0)
   js_regex (~> 3.8)
-  json (~> 2.10.0)
+  json (~> 2.11.0)
   json_schemer (~> 2.3.0)
   jsonb_accessor (~> 1.4)
   jwt (~> 2.9.3)
···
   org-ruby (~> 0.9.12)
   os (~> 1.1, >= 1.1.4)
   pact (~> 1.64)
-  paper_trail (~> 15.0)
+  paper_trail (~> 16.0)
   parallel (~> 1.19)
-  parser (= 3.3.7.1)
+  parser (= 3.3.8.0)
   parslet (~> 1.8)
   peek (~> 1.1)
   pg (~> 1.5.6)
   pg_query (~> 6.1.0)
   png_quantizator (~> 0.2.1)
+  prawn
+  prawn-svg
   premailer-rails (~> 1.12.0)
   prometheus-client-mmap (~> 1.2.9)
   pry-byebug
···
   rack-oauth2 (~> 2.2.1)
   rack-proxy (~> 0.7.7)
   rack-timeout (~> 0.7.0)
-  rails (~> 7.0.8.7)
+  rails (~> 7.1.5.1)
   rails-controller-testing
   rails-i18n (~> 7.0, >= 7.0.9)
   rainbow (~> 3.0)
···
   sd_notify (~> 0.1.0)
   seed-fu (~> 2.3.7)
   selenium-webdriver (~> 4.21, >= 4.21.1)
-  semver_dialects (~> 3.6)
-  sentry-rails (~> 5.22.0)
-  sentry-ruby (~> 5.22.0)
-  sentry-sidekiq (~> 5.22.0)
+  semver_dialects (~> 3.7)
+  sentry-rails (~> 5.23.0)
+  sentry-ruby (~> 5.23.0)
+  sentry-sidekiq (~> 5.23.0)
   shoulda-matchers (~> 6.4.0)
   sidekiq (~> 7.3.9)
   sidekiq-cron (~> 1.12.0)
···
   simplecov-lcov (~> 0.8.0)
   slack-messenger (~> 2.3.5)
   snowplow-tracker (~> 0.8.0)
-  solargraph (~> 0.47.2)
+  solargraph (~> 0.54.0)
+  solargraph-rspec (~> 0.5.1)
   spamcheck (~> 1.3.0)
   spring (~> 4.3.0)
   spring-commands-rspec (~> 1.0.4)
···
   ssh_data (~> 1.3)
   stackprof (~> 0.2.26)
   state_machines-activerecord (~> 0.8.0)
+  state_machines-rspec (~> 0.6)
   sys-filesystem (~> 1.4.3)
   tanuki_emoji (~> 0.13)
   telesignenterprise (~> 2.2)
···
   warning (~> 1.5.0)
   webauthn (~> 3.0)
   webmock (~> 3.25.0)
-  webrick (~> 1.8.1)
+  webrick (~> 1.9.0)
   wikicloth (= 0.8.1)
   yajl-ruby (~> 1.4.3)
   yard (~> 0.9)

pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix

···
       "activesupport"
       "nio4r"
       "websocket-driver"
+      "zeitwerk"
     ];
     groups = [
       "default"
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0qpiw9n8sswisvji91ra290wiihgl30kg3zkpffx0byz84w52d20";
+      sha256 = "03dai8z2dxb2cf29hp6md7bhysyipxvw2qnm2bj98yyrnaskfikn";
       type = "gem";
     };
-    version = "7.0.8.7";
+    version = "7.1.5.1";
   };
   actionmailbox = {
     dependencies = [
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1hn1d8fshkfijsmwflnvn2ys9i8k3rbkk7h6qsgwspg8v2iyl3ll";
+      sha256 = "02inlpsmjz8rz159ljhzac1dvzq5k1pnmmx2pf4gmrj3zs4hbhn3";
       type = "gem";
     };
-    version = "7.0.8.7";
+    version = "7.1.5.1";
   };
   actionmailer = {
     dependencies = [
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "054dv081ysp86im4hxcwwlmkl2zidnmy34mw4acghjkpz2igks4b";
+      sha256 = "0ncplhcrxldj6jvbaw9g8ik4cznjlf3lyfzgrwy0jfxjh3cdc4xj";
       type = "gem";
     };
-    version = "7.0.8.7";
+    version = "7.1.5.1";
   };
   actionpack = {
     dependencies = [
       "actionview"
       "activesupport"
+      "nokogiri"
+      "racc"
       "rack"
+      "rack-session"
       "rack-test"
       "rails-dom-testing"
       "rails-html-sanitizer"
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0b2y7wy6gx59zb88v1fqiyxdkafrsfma67sx5394yjlhhzbb3rj0";
+      sha256 = "066p70mngqk8m7qp3wq2frbl1w8imdcrdxb06cxwq5izykcn7hib";
       type = "gem";
     };
-    version = "7.0.8.7";
+    version = "7.1.5.1";
   };
   actiontext = {
     dependencies = [
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1818spc73y96n94jssh77z2w4dnz84sn83ywrk5cicnmjzdx4xfb";
+      sha256 = "1v7psa946frm79x04vywnd0h069jgxy5xghm7y5sgijvmp7n3qmq";
       type = "gem";
     };
-    version = "7.0.8.7";
+    version = "7.1.5.1";
   };
   actionview = {
     dependencies = [
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1vbziywvidi7gy69hqxsrcxh6n8i4x2w75qam1fzw0qrqv4mp5xy";
+      sha256 = "1apnqjfwbvyhf7svlamal1pvy2x78fk42lqbnllqwy816lhrlmcc";
       type = "gem";
     };
-    version = "7.0.8.7";
+    version = "7.1.5.1";
   };
   activejob = {
     dependencies = [
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "081a32z17976kgf7a51blh7fsxsm3p8qj02p8wx8cd7fx8xdpx7g";
+      sha256 = "0rspwfvhxs5by6im90rrjp2sy1wzdpcgb9xm0qfljk3zhmn3fcvn";
       type = "gem";
     };
-    version = "7.0.8.7";
+    version = "7.1.5.1";
   };
   activemodel = {
     dependencies = [ "activesupport" ];
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "10qaykhcs15wgyy9fd886mwdkf3iwsib0h6fcnwqa7jw0nxh8fzi";
+      sha256 = "1wci45aas8g909zby9j91m87ff5j28qwl0i7izzbszsahmk78wkl";
       type = "gem";
     };
-    version = "7.0.8.7";
+    version = "7.1.5.1";
   };
   activerecord = {
     dependencies = [
       "activemodel"
       "activesupport"
+      "timeout"
     ];
     groups = [
       "default"
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0nm4y9fy19l65c18v3k8s3x2npp7kcn8ds2y5i38x8aq1r8whkzr";
+      sha256 = "1qzij5xmsqqxsc9v9kil68aif5bvly06vqf4pnjrnfzkkdhd22pl";
       type = "gem";
     };
-    version = "7.0.8.7";
+    version = "7.1.5.1";
   };
   activerecord-explain-analyze = {
     dependencies = [
···
       "activerecord"
       "activesupport"
       "marcel"
-      "mini_mime"
     ];
     groups = [
       "default"
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1xcy76cwskwfm39lr4cg7bmknc8j0vymp55h8hzrhl1sfdriwhfa";
+      sha256 = "0qzz8dxwj70zys1lmqk1x0sl4rb7ddw6v2bgmpm6dijqd03qnsxf";
       type = "gem";
     };
-    version = "7.0.8.7";
+    version = "7.1.5.1";
   };
   activesupport = {
     dependencies = [
+      "base64"
+      "benchmark"
+      "bigdecimal"
       "concurrent-ruby"
+      "connection_pool"
+      "drb"
       "i18n"
+      "logger"
       "minitest"
+      "mutex_m"
+      "securerandom"
       "tzinfo"
     ];
     groups = [
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1zq4f834my1z6yh05rfr1dzl3i8padh33j092zlal979blvh4iyz";
+      sha256 = "1f6gqyl49hdabid5jkrfq0127gd396srsgpy7p5ni61v8wp4h34z";
       type = "gem";
     };
-    version = "7.0.8.7";
+    version = "7.1.5.1";
   };
   addressable = {
     dependencies = [ "public_suffix" ];
···
       "aws-eventstream"
       "aws-partitions"
       "aws-sigv4"
+      "base64"
       "jmespath"
+      "logger"
     ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0jafdv62q1cd8yvn6cl876bnz5vp6b4x2gnggsl0j4lyfkxnhh91";
+      sha256 = "0xwcimg5i93ansmmww7ap8k6xxyijkxa8p896bxj9kc7cw8hkhyq";
       type = "gem";
     };
-    version = "3.215.0";
+    version = "3.223.0";
   };
   aws-sdk-kms = {
     dependencies = [
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "10ziy8zslfjs0ihls7wiq6zvsncq89azh36rshmlylry1hhxjbxz";
+      sha256 = "1ix5g1qnp7m0f8jk0bx0b5csx8p7zrxhnvkqc7jsyp9a3c4vnpky";
       type = "gem";
     };
-    version = "1.177.0";
+    version = "1.185.0";
   };
   aws-sigv4 = {
     dependencies = [ "aws-eventstream" ];
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "12djmxdbmbwk3r3ni8r73945plsr6wmw7yzw72gk42iq86ha0kn8";
+      sha256 = "0j017xf6dzi5w5hfikjh138n91b5vkaxjm41dvqh86033knz643f";
       type = "gem";
     };
-    version = "4.10.2";
+    version = "4.10.3";
   };
   axe-core-rspec = {
     dependencies = [
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0xgp28gk45v25l6l1d4clm1gq7brcwh9nma51wbsl3p40xcbw0p3";
+      sha256 = "0zjj06kwk57d3g18sfkam8r6fcrp2c3wj8m93l7ws3rd3q8x08fa";
       type = "gem";
     };
-    version = "4.10.2";
+    version = "4.10.3";
   };
   axiom-types = {
     dependencies = [
···
     groups = [
       "default"
       "development"
+      "monorepo"
+      "test"
     ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0xwcnbwnbqq8jp92mvawn6y69cb53wsz84wwmk9vsfk1jjvqfw2z";
+      sha256 = "0jl71qcgamm96dzyqk695j24qszhcc7liw74qc83fpjljp2gh4hg";
       type = "gem";
     };
-    version = "0.2.0";
+    version = "0.4.0";
   };
   benchmark-ips = {
     groups = [
···
       "development"
       "test"
     ];
-    platforms = [
-      {
-        engine = "maglev";
-      }
-      {
-        engine = "ruby";
-      }
-    ];
+    platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0nx3yjf4xzdgb8jkmk2344081gqr22pgjqnmjg2q64mj5d6r9194";
+      sha256 = "07hsr9zzl2mvf5gk65va4smdizlk9rsiz8wwxik0p96cj79518fl";
       type = "gem";
     };
-    version = "11.1.3";
+    version = "12.0.0";
   };
   capybara = {
     dependencies = [
···
     version = "1.2.3";
   };
   connection_pool = {
-    groups = [ "default" ];
+    groups = [
+      "default"
+      "development"
+      "monorepo"
+      "test"
+    ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1z7bag6zb2vwi7wp2bkdkmk7swkj6zfnbsnc949qq0wfsgw94fr3";
+      sha256 = "0nrhsk7b3sjqbyl1cah6ibf1kvi3v93a7wf4637d355hp614mmyg";
       type = "gem";
     };
-    version = "2.5.0";
+    version = "2.5.3";
   };
   console = {
     dependencies = [
···
     version = "4.0.1";
   };
   coverband = {
-    dependencies = [ "redis" ];
+    dependencies = [
+      "base64"
+      "redis"
+    ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1j0p1qsnnx0xhx43y7xskxwpcsv3yw5wj79qf7naf3nhdn73kkv5";
+      sha256 = "09c21zxv7lsq5ih5rp214y38hcjm3pg5n3as1mqc2w0gn3lkn5s5";
       type = "gem";
     };
-    version = "6.1.4";
+    version = "6.1.5";
   };
   crack = {
     dependencies = [ "safe_yaml" ];
···
     };
     version = "0.5.0";
   };
-  crystalball = {
-    dependencies = [ "git" ];
-    groups = [
-      "development"
-      "test"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1why2py76hv2m7i3a1im3zi5zcjcvz2l1nvshzndlwah58vrywkf";
-      type = "gem";
-    };
-    version = "0.7.0";
-  };
   css_parser = {
     dependencies = [ "addressable" ];
     groups = [
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1fh4d98irhph3ri7c2rrvvmmjd4z14702r8baq9flh5f34dap8d8";
+      sha256 = "0k8j50avgs2pgv20wvrzr77g9yvhi5sa9yh93n72nyd4hhbd28cb";
       type = "gem";
     };
-    version = "1.5.1";
+    version = "2.2.3";
   };
   derailed_benchmarks = {
     dependencies = [
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1zblvpxzb8qp17dn7sjnfqs6iw3yyzv2cwvnhzrzgxj8k0d0ddjs";
+      sha256 = "1dcj3r8gh4y4cks1qk5qhj89ggk6z8kmk3hq9nlvnm9pnb7m9fbs";
       type = "gem";
     };
-    version = "0.4.3";
+    version = "0.4.4";
   };
   device_detector = {
     groups = [ "default" ];
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0v6jjb1259y8dq97ibchc20jqjgk3z7zn12ggv5wzn2mcz1z6m3d";
+      sha256 = "1lsh9lzrglqlwm9icmn0ggrwjc9iy9308f9m59z1w2srmyp0fgd7";
       type = "gem";
     };
-    version = "5.8.1";
+    version = "5.8.2";
   };
   doorkeeper-device_authorization_grant = {
     dependencies = [ "doorkeeper" ];
···
     };
     version = "1.4.0";
   };
-  e2mmap = {
-    groups = [
-      "default"
-      "development"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0n8gxjb63dck3vrmsdcqqll7xs7f3wk78mw8w0gdk9wp5nx6pvj5";
-      type = "gem";
-    };
-    version = "0.1.0";
-  };
   ed25519 = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0zb2dr2ihb1qiknn5iaj1ha1w9p7lj9yq5waasndlfadz225ajji";
+      sha256 = "01n5rbyws1ijwc5dw7s88xx3zzacxx9k97qn8x11b6k8k18pzs8n";
       type = "gem";
     };
-    version = "1.3.0";
+    version = "1.4.0";
   };
   elasticsearch = {
     dependencies = [
···
     version = "1.0.1";
   };
   fast_gettext = {
+    dependencies = [
+      "prime"
+      "racc"
+    ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "112gsrqah2w03kgi9mjsn6hl74mrwckphf223h36iayc4djf4lq2";
+      sha256 = "0qr73k69pk5sjgkysrfar0sghrx0shz7kkfjcab200fnfqk62swf";
       type = "gem";
     };
-    version = "2.3.0";
+    version = "4.1.0";
   };
   ffaker = {
     groups = [ "default" ];
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0fgwn1grxf4zxmyqmb9i4z2hr111585n9jnk17y6y7hhs7dv1xi6";
+      sha256 = "19kdyjg3kv7x0ad4xsd4swy5izsbb1vl1rpb6qqcqisr5s23awi9";
       type = "gem";
     };
-    version = "1.17.1";
+    version = "1.17.2";
   };
   ffi-compiler = {
     dependencies = [
···
       "fog-core"
       "nokogiri"
     ];
-    groups = [ "default" ];
+    groups = [
+      "default"
+      "test"
+    ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "043lwdw2wsi6d55ifk0w3izi5l1d1h0alwyr3fixic7b94kc812n";
+      sha256 = "1miv6zgglx4vddw2c17mpf6l36qn0abq7ngrxb9isih10yhzxfaj";
       type = "gem";
     };
-    version = "0.1.3";
+    version = "0.1.5";
   };
   formatador = {
     groups = [ "default" ];
···
       "activerecord"
       "activesupport"
       "addressable"
+      "bigdecimal"
       "concurrent-ruby"
       "faraday"
       "google-cloud-storage_transfer"
···
       "jwt"
       "logger"
       "minitest"
+      "mutex_m"
       "parallel"
       "pg"
       "rack"
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0karz59rpw7vz4ckxc37gjs7lgb6zsa1pvsr57wzqfbpppgx5swa";
+      sha256 = "1bshayyh9pb2rgb9qc82dc9fr1xkf4kxj10rd0lkjqxnbh7ppsxi";
       type = "gem";
     };
-    version = "1.6.0";
+    version = "1.12.0";
+  };
+  gitlab-crystalball = {
+    dependencies = [ "git" ];
+    groups = [
+      "development"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "16mlrsd4lyvp9faqrnd7nmrl485wzrj2vp6y72x7f8wmsmqpivf4";
+      type = "gem";
+    };
+    version = "0.7.2";
   };
   gitlab-dangerfiles = {
     dependencies = [
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "007kxhbfi5kv7m4w9pvbrkfqwb8yp8shp8i77mj2l59qjqf35bdv";
+      sha256 = "1cpiznkzlvsbanfcvnqdf0lxrzjd3i592d0j766xmr55mkc1jsr9";
       type = "gem";
     };
-    version = "4.8.1";
+    version = "4.9.1";
   };
   gitlab-duo-workflow-service-client = {
     dependencies = [ "grpc" ];
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "09mjdrgjyad1l2lcaiy62486hnajpv9mgyxcv6vrhga0dncqm6m1";
+      sha256 = "0rh0bij1nk0c6agqg39p5qwhc93fdgriwqwnshgrkn66kwzs7ppk";
       type = "gem";
     };
-    version = "0.0.29";
+    version = "0.0.30";
   };
   gitlab-housekeeper = {
     dependencies = [
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0n59m8jy9nl2adr27dgqbbrg8w9bwgjvg1jzinmwwhf7d4b0qj7x";
+      sha256 = "075fasc3mv2l87l34cw5pw1vyf2ad254gsa9jpl4cqv3rx6hbfgj";
       type = "gem";
     };
-    version = "17.9.1";
+    version = "17.11.2";
   };
   gitlab-labkit = {
     dependencies = [
···
     version = "2.0.0";
   };
   gitlab-net-dns = {
+    dependencies = [ "logger" ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0vkw1537wh37n57cygh7p2vb9fz4phbz2cg6njvq0545ihyn3d3k";
+      sha256 = "19xmqvmv34gydymqv5m6aiync1xmycisqg4k0rrsglfllnqgnjmn";
       type = "gem";
     };
-    version = "0.10.0";
+    version = "0.12.0";
   };
   gitlab-rspec = {
     dependencies = [
···
   gitlab-secret_detection = {
     dependencies = [
       "grpc"
-      "grpc-tools"
       "grpc_reflection"
       "parallel"
       "re2"
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1rv3r1wj5pnwjbkw3333y7kxj1hzzq0vnf6xdjj95n8m5b9krpck";
+      sha256 = "1gip6bgsh6b284sjlz24ljydshsa9p5ikizwrmb82gnsc46dcsmk";
       type = "gem";
     };
-    version = "0.23.0";
+    version = "0.26.1";
   };
   gitlab-security_report_schemas = {
     dependencies = [
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1c9wdinaf1z4qdynighcxxpkfarkizzh9slg2y77240mdsrgkyr9";
+      sha256 = "05shhi6g3y8fp6h1accxzfi58py8d4rvv3bd17f1p6453pviirb8";
       type = "gem";
     };
-    version = "2.8.0";
+    version = "2.10.0";
   };
   globalid = {
     dependencies = [ "activesupport" ];
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0g0h7rwiivx93jddfws5pdkcpnhma3694k2jfv2i1k80qkrqnrmv";
+      sha256 = "1afriizkvwwcyh0s0j1x9d9045pn4f767gpj5q49hicsqz8flq58";
       type = "gem";
     };
-    version = "3.25.6";
+    version = "3.25.7";
   };
   googleapis-common-protos = {
     dependencies = [
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "17smfrcmklx2f3ld6ai8l3vz9i8m96cj72zdyygnpy1iykf1j398";
+      sha256 = "152nfvcnj1i1gsphhs7mhxzd0wa9pjdjb0xhgb2bry16ag57djxf";
       type = "gem";
     };
-    version = "1.18.0";
+    version = "1.19.0";
   };
   googleauth = {
     dependencies = [
···
     };
     version = "1.5.0";
   };
-  grpc-tools = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "19r3ky3l593prhmk8ixdc4w1rbiyqzfw4dd0gk9ds1f38vhgrhyx";
-      type = "gem";
-    };
-    version = "1.69.0";
-  };
   grpc_reflection = {
     dependencies = [ "grpc" ];
     groups = [ "default" ];
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "08yn3z438hgh186iyvkqrhcy0fzzaky8j4h1hlbzzlfam49ckmx8";
+      sha256 = "0qggmfrqx1f90xkkxn9afqk33bzx1vmj0gfdi6yvjj18d3p2w9p5";
       type = "gem";
     };
-    version = "0.61.0";
+    version = "0.62.0";
   };
   hamlit = {
     dependencies = [
···
     };
     version = "2.1.0";
   };
+  io-console = {
+    groups = [
+      "default"
+      "development"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "18pgvl7lfjpichdfh1g50rpz0zpaqrpr52ybn9liv1v9pjn9ysnd";
+      type = "gem";
+    };
+    version = "0.8.0";
+  };
   io-event = {
     groups = [ "default" ];
     platforms = [ ];
···
     };
     version = "0.4.8";
   };
+  irb = {
+    dependencies = [
+      "pp"
+      "rdoc"
+      "reline"
+    ];
+    groups = [
+      "default"
+      "development"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1478m97wiy6nwg6lnl0szy39p46acsvrhax552vsh1s2mi2sgg6r";
+      type = "gem";
+    };
+    version = "1.15.1";
+  };
   jaeger-client = {
     dependencies = [
       "opentracing"
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "10fd3i92897blalxfkgc0jjv0qqx31v7cm7j2b6a3b97an0bfz80";
+      sha256 = "09645h5an19zc1i7wlmixszj8xxqb2zc8qlf8dmx39bxpas1l24b";
       type = "gem";
     };
-    version = "1.5.6";
+    version = "1.6.0";
   };
   jira-ruby = {
     dependencies = [
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "01lbdaizhkxmrw4y8j3wpvsryvnvzmg0pfs56c52laq2jgdfmq1l";
+      sha256 = "1hfcz73wszgqprg2pr83qjbyfb0k93frbdvyhgmw0ryyl9cgc44s";
       type = "gem";
     };
-    version = "2.10.2";
+    version = "2.11.3";
   };
   json-jwt = {
     dependencies = [
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1hnx5s38myd0dgs7frm75ikvyl0g14pg1z7zjryp55j9p9dkrkab";
+      sha256 = "09m8m65iyk8d1y0g52srl7994c80f8ai33z8flbzhsjqr2wy17rh";
       type = "gem";
     };
-    version = "1.11.2";
+    version = "1.11.5";
   };
   letter_opener = {
     dependencies = [ "launchy" ];
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "16h8yhk4z2wk2lc0l0m7z2pbbk6mfljhy6hp11dx6lw8dp325q0b";
+      sha256 = "0xyzk7gzi91l6xlwfvf2z0963jwd2csf987yk0ffbr5p9ycdp0ry";
       type = "gem";
     };
-    version = "9.17.1";
+    version = "9.18.0";
   };
   listen = {
     dependencies = [
···
     version = "3.0.27";
   };
   mixlib-log = {
+    dependencies = [ "ffi" ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0n5dm5iz90ijvjn59jfm8gb8hgsvbj0f1kpzbl38b02z0z4a4v7x";
+      sha256 = "0s57cq8qx3823pcfzizshp8vagvp3f87r0lksknj18r26nl3y79a";
       type = "gem";
     };
-    version = "3.0.9";
+    version = "3.2.3";
   };
   mixlib-shellout = {
     dependencies = [ "chef-utils" ];
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0cgv8vzp7kl20ip8qdzmrbr1vaaw4mjjy4mksg8k13z4xxfzyqvb";
+      sha256 = "0rb306hbky6cxfyc8vrwpvl40fdapjvhsk62h08gg9wwbn3n8x4c";
       type = "gem";
     };
-    version = "1.18.7";
+    version = "1.18.8";
   };
   notiffany = {
     dependencies = [
···
     };
     version = "2.0.9";
   };
+  observer = {
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1b2h1642jy1xrgyakyzz6bkq43gwp8yvxrs8sww12rms65qi18yq";
+      type = "gem";
+    };
+    version = "0.1.2";
+  };
   octokit = {
     dependencies = [
       "faraday"
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1yd9kdyyg1wisxi9mx01ar9s6h50x9k2av95xam58v6jx6bwvg0d";
+      sha256 = "1781qpj1mip1llq3jfbf0q7gk4mshar33afg6610qncb3gxz1fg9";
       type = "gem";
     };
-    version = "15.1.0";
+    version = "16.0.0";
   };
   parallel = {
     groups = [
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "18dcwrcnddvi8gl3hmbsb2cj1l7afxk2lh3jmhj90l95h1hn3gkx";
+      sha256 = "0i9w8msil4snx5w11ix9b0wf52vjc3r49khy3ddgl1xk890kcxi4";
       type = "gem";
     };
-    version = "3.3.7.1";
+    version = "3.3.8.0";
   };
   parslet = {
     groups = [
···
       type = "gem";
     };
     version = "0.8.0";
+  };
+  pdf-core = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "14ffyc016pznyir87dcm2gyavwcppdyf87hyjhzixh3340g10p8a";
+      type = "gem";
+    };
+    version = "0.10.0";
   };
   peek = {
     dependencies = [ "railties" ];
···
     };
     version = "0.2.1";
   };
+  pp = {
+    dependencies = [ "prettyprint" ];
+    groups = [
+      "default"
+      "development"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1zxnfxjni0r9l2x42fyq0sqpnaf5nakjbap8irgik4kg1h9c6zll";
+      type = "gem";
+    };
+    version = "0.6.2";
+  };
+  prawn = {
+    dependencies = [
+      "matrix"
+      "pdf-core"
+      "ttfunk"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1diwqjchmymhj4ihp4xaad2mjc8q8bmibbbxwfd5pgrh9wxhxqpl";
+      type = "gem";
+    };
+    version = "2.5.0";
+  };
+  prawn-svg = {
+    dependencies = [
+      "css_parser"
+      "matrix"
+      "prawn"
+      "rexml"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0c18drdsms06h5c5hmhdi7sbck72f2sp3sbgwyr7frq65h1xs6r7";
+      type = "gem";
+    };
+    version = "0.37.0";
+  };
   premailer = {
     dependencies = [
       "addressable"
···
     };
     version = "1.12.0";
   };
+  prettyprint = {
+    groups = [
+      "default"
+      "development"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "14zicq3plqi217w6xahv7b8f7aj5kpxv1j1w98344ix9h5ay3j9b";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
   prime = {
     dependencies = [
       "forwardable"
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1y41al94ks07166qbp2200yzyr5y60hm7xaiw4lxpgsm4b1pbyf8";
+      sha256 = "0wpa3jd46h44rjz3hjwl5c0zfx3jav4a64nm8h0g1iwv61yvn2hb";
       type = "gem";
     };
-    version = "3.10.1";
+    version = "3.11.0";
   };
   pry-rails = {
     dependencies = [ "pry" ];
···
       type = "gem";
     };
     version = "0.6.4";
+  };
+  psych = {
+    dependencies = [
+      "date"
+      "stringio"
+    ];
+    groups = [
+      "default"
+      "development"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1vjrx3yd596zzi42dcaq5xw7hil1921r769dlbz08iniaawlp9c4";
+      type = "gem";
+    };
+    version = "5.2.3";
   };
   public_suffix = {
     groups = [
···
     };
     version = "0.7.0";
   };
+  rackup = {
+    dependencies = [
+      "rack"
+      "webrick"
+    ];
+    groups = [
+      "default"
+      "development"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0jf2ncj2nx56vh96hh2nh6h4r530nccxh87z7c2f37wq515611ms";
+      type = "gem";
+    };
+    version = "1.0.1";
+  };
   rails = {
     dependencies = [
       "actioncable"
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1vfd2l3m1802vq7gdqpvd3mkcfhxacpsxixqpx4n6x0mv56ysrsy";
+      sha256 = "0148c00v3hks98rymdiilhjm0i8qw5fla4gww0fb94k3ggns5bh5";
       type = "gem";
     };
-    version = "7.0.8.7";
+    version = "7.1.5.1";
   };
   rails-controller-testing = {
     dependencies = [
···
   rails-dom-testing = {
     dependencies = [
       "activesupport"
+      "minitest"
       "nokogiri"
     ];
     groups = [
       "default"
       "development"
+      "monorepo"
       "test"
     ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1lfq2a7kp2x64dzzi5p4cjcbiv62vxh9lyqk2f0rqq3fkzrw8h5i";
+      sha256 = "0fx9dx1ag0s1lr6lfr34lbx5i1bvn3bhyf3w3mx6h7yz90p725g5";
       type = "gem";
     };
-    version = "2.0.3";
+    version = "2.2.0";
   };
   rails-html-sanitizer = {
     dependencies = [
···
     dependencies = [
       "actionpack"
       "activesupport"
-      "method_source"
+      "irb"
+      "rackup"
       "rake"
       "thor"
       "zeitwerk"
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0pshckc6b9h2ikl3svk47iv0nq6v908h3q9ndlblpg021cl8bf8s";
+      sha256 = "1yz28fq55drl4c2dwgap96xcjf6qns2ghc3c3gffzm6yw9i5bq8b";
       type = "gem";
     };
-    version = "7.0.8.7";
+    version = "7.1.5.1";
   };
   rainbow = {
     groups = [
···
     };
     version = "1.8.0";
   };
+  rdoc = {
+    dependencies = [ "psych" ];
+    groups = [
+      "default"
+      "development"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0a83bsmd444pbhga3icwh8c7gm917m1fabq38dy1pn9ywjd17hij";
+      type = "gem";
+    };
+    version = "6.13.0";
+  };
   re2 = {
     dependencies = [ "mini_portile2" ];
     groups = [ "default" ];
···
     };
     version = "1.0.0";
   };
+  reline = {
+    dependencies = [ "io-console" ];
+    groups = [
+      "default"
+      "development"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1lirwlw59apc8m1wjk85y2xidiv0fkxjn6f7p84yqmmyvish6qjp";
+      type = "gem";
+    };
+    version = "0.6.0";
+  };
   representable = {
     dependencies = [
       "declarative"
···
   };
   reverse_markdown = {
     dependencies = [ "nokogiri" ];
-    groups = [ "default" ];
+    groups = [
+      "default"
+      "development"
+    ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0w786j869fjhjf72waj0hc9i4ghi45b78a2am27kij4sa2hmsc53";
+      sha256 = "195c7yra7amggqj7rir0yr09r4v29c2hgkbkb21mj0jsfs3868mb";
       type = "gem";
     };
-    version = "1.4.0";
+    version = "3.0.0";
   };
   rexml = {
     groups = [
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0j4zcp7nncrr6sn0m3scnqsxcf7j2v82pxcd7p3436m70ncmm1x1";
+      sha256 = "17z0hi70s201gxw251hgv4r9zmfky2jlmp3pwma7hixsfpkx6gay";
       type = "gem";
     };
-    version = "0.23.13";
+    version = "0.23.15";
   };
   ruby-lsp-rails = {
     dependencies = [ "ruby-lsp" ];
···
     };
     version = "0.1.1";
   };
+  securerandom = {
+    groups = [
+      "default"
+      "development"
+      "monorepo"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1cd0iriqfsf1z91qg271sm88xjnfd92b832z49p1nd542ka96lfc";
+      type = "gem";
+    };
+    version = "0.4.1";
+  };
   seed-fu = {
     dependencies = [
       "activerecord"
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "18vkhjy290kf6cvwq03whfih29wyl7q003kx4qa82x3cgh1pi2mv";
+      sha256 = "07nx840hc07a1igzw7zbg1c3wp71sfflv7c6jivwxj7pcr9b0431";
       type = "gem";
     };
-    version = "3.6.0";
+    version = "3.7.0";
   };
   sentry-rails = {
     dependencies = [
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1drz5lm7s2m55pmxdbpbcxlpvgaj3rchm14nrzl2s80fvh47c8i3";
+      sha256 = "1i6y53hkif95091m2pq07gx3l30f85fmkj6phblc2hz3hlybqb4d";
       type = "gem";
     };
-    version = "5.22.1";
+    version = "5.23.0";
   };
   sentry-ruby = {
     dependencies = [
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "129jbd6zvfn59djs455hflk2nhf0sccnvp23vsiwd957dpbvsxzd";
+      sha256 = "1k45ydlbl99c9ivbafzw8lpm9diiw4m7z55szi87l9kalpwv52wf";
       type = "gem";
     };
-    version = "5.22.1";
+    version = "5.23.0";
   };
   sentry-sidekiq = {
     dependencies = [
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "129ahag27akxqha2dldvvzkbxi3zcrca9naifak3xqaqbs8kyymx";
+      sha256 = "060wbm1xckmlnx3j8mlf7vgmxv6wsh75nq5smj2y2wspl89n9p1l";
       type = "gem";
     };
-    version = "5.22.1";
+    version = "5.23.0";
   };
   shellany = {
     groups = [
···
       "backport"
       "benchmark"
       "diff-lcs"
-      "e2mmap"
       "jaro_winkler"
       "kramdown"
       "kramdown-parser-gfm"
+      "logger"
+      "observer"
+      "ostruct"
       "parser"
+      "rbs"
       "reverse_markdown"
       "rubocop"
       "thor"
       "tilt"
       "yard"
+      "yard-solargraph"
     ];
     groups = [ "development" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0smcpi3x87chkdqdclhgh36xlbwm7r44r58m3k1w4mcikdwlpjl7";
+      sha256 = "0mkc1fxz4anv7fcq9jn26dc5ppwriand778f9dklzrpgq9pga8py";
       type = "gem";
     };
-    version = "0.47.2";
+    version = "0.54.2";
+  };
+  solargraph-rspec = {
+    dependencies = [ "solargraph" ];
+    groups = [ "development" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1kpsdfkj6yvd5ndhj5vbll4591lwg4gjrf5c61ffj8vvy4j93z0d";
+      type = "gem";
+    };
+    version = "0.5.1";
   };
   sorbet-runtime = {
     groups = [
···
     };
     version = "0.8.0";
   };
+  state_machines-rspec = {
+    dependencies = [
+      "activesupport"
+      "rspec"
+      "state_machines"
+    ];
+    groups = [ "test" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1gf0wlgkpdwwyxg810p1clpba6gmcl7jwvhlg5zwkl2pvx2pm99b";
+      type = "gem";
+    };
+    version = "0.6.0";
+  };
+  stringio = {
+    groups = [
+      "default"
+      "development"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1yh78pg6lm28c3k0pfd2ipskii1fsraq46m6zjs5yc9a4k5vfy2v";
+      type = "gem";
+    };
+    version = "3.1.7";
+  };
   strings = {
     dependencies = [
       "strings-ansi"
···
     };
     version = "0.7.13";
   };
+  ttfunk = {
+    dependencies = [ "bigdecimal" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1ji0kn8jkf1rpskv3ijzxvqwixg4p6sk8kg0vmwyjinci7jcgjx7";
+      type = "gem";
+    };
+    version = "1.8.0";
+  };
   tty-color = {
     groups = [
       "default"
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1i2ckb29ffjj431amnk0sr5h9vbs00139irs7bqh51jpl55lln74";
+      sha256 = "0wj9ia0s7vywn66pf2jn49pfsy5h5rncjjwhaymwq32r3f2pq2p1";
       type = "gem";
     };
-    version = "3.9.1";
+    version = "3.9.2";
   };
   vmstat = {
     groups = [ "default" ];
···
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "089gy5494j560b242vi173wnbj2913hwlwnjkpzld58r96ilc5s3";
+      sha256 = "12d9n8hll67j737ym2zw4v23cn4vxyfkb6vyv1rzpwv6y6a3qbdl";
       type = "gem";
     };
-    version = "1.8.2";
+    version = "1.9.1";
   };
   websocket = {
     groups = [
···
       type = "gem";
     };
     version = "0.9.37";
+  };
+  yard-solargraph = {
+    dependencies = [ "yard" ];
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "03lklm47k6k294ww97x6zpvlqlyjm5q8jidrixhil622r4cld6m1";
+      type = "gem";
+    };
+    version = "0.1.0";
   };
   zeitwerk = {
     groups = [

pkgs/applications/version-management/gitlab/update.py

···
-#!/usr/bin/env nix-shell
-#! nix-shell -I nixpkgs=../../../.. -i python3 -p bundix bundler nix-update nix python3 python3Packages.requests python3Packages.click python3Packages.click-log python3Packages.packaging prefetch-yarn-deps git
-
-import click
-import click_log
-import re
-import logging
-import subprocess
-import json
-import pathlib
-import tempfile
-from packaging.version import Version
-from typing import Iterable
-
-import requests
-
-NIXPKGS_PATH = pathlib.Path(__file__).parent / "../../../../"
-GITLAB_DIR = pathlib.Path(__file__).parent
-
-logger = logging.getLogger(__name__)
-click_log.basic_config(logger)
-
-
-class GitLabRepo:
-    version_regex = re.compile(r"^v\d+\.\d+\.\d+(\-rc\d+)?(\-ee)?(\-gitlab)?")
-
-    def __init__(self, owner: str = "gitlab-org", repo: str = "gitlab"):
-        self.owner = owner
-        self.repo = repo
-
-    @property
-    def url(self):
-        return f"https://gitlab.com/{self.owner}/{self.repo}"
-
-    @property
-    def tags(self) -> Iterable[str]:
-        """Returns a sorted list of repository tags"""
-        r = requests.get(self.url + "/refs?sort=updated_desc&ref=master").json()
-        tags = r.get("Tags", [])
-
-        # filter out versions not matching version_regex
-        versions = list(filter(self.version_regex.match, tags))
-
-        # sort, but ignore v, -ee and -gitlab for sorting comparisons
-        versions.sort(
-            key=lambda x: Version(
-                x.replace("v", "").replace("-ee", "").replace("-gitlab", "")
-            ),
-            reverse=True,
-        )
-        return versions
-    def get_git_hash(self, rev: str):
-        return (
-            subprocess.check_output(
-                [
-                    "nix-prefetch-url",
-                    "--unpack",
-                    f"https://gitlab.com/{self.owner}/{self.repo}/-/archive/{rev}/{self.repo}-{rev}.tar.gz",
-                ]
-            )
-            .decode("utf-8")
-            .strip()
-        )
-
-    def get_yarn_hash(self, rev: str):
-        with tempfile.TemporaryDirectory() as tmp_dir:
-            with open(tmp_dir + "/yarn.lock", "w") as f:
-                f.write(self.get_file("yarn.lock", rev))
-            return (
-                subprocess.check_output(["prefetch-yarn-deps", tmp_dir + "/yarn.lock"])
-                .decode("utf-8")
-                .strip()
-            )
-
-    @staticmethod
-    def rev2version(tag: str) -> str:
-        """
-        normalize a tag to a version number.
-        This obviously isn't very smart if we don't pass something that looks like a tag
-        :param tag: the tag to normalize
-        :return: a normalized version number
-        """
-        # strip v prefix
-        version = re.sub(r"^v", "", tag)
-        # strip -ee and -gitlab suffixes
-        return re.sub(r"-(ee|gitlab)$", "", version)
-
-    def get_file(self, filepath, rev):
-        """
-        returns file contents at a given rev
-        :param filepath: the path to the file, relative to the repo root
-        :param rev: the rev to fetch at
-        :return:
-        """
-        return requests.get(self.url + f"/raw/{rev}/{filepath}").text
-
-    def get_data(self, rev):
-        version = self.rev2version(rev)
-
-        passthru = {
-            v: self.get_file(v, rev).strip()
-            for v in [
-                "GITALY_SERVER_VERSION",
-                "GITLAB_PAGES_VERSION",
-                "GITLAB_SHELL_VERSION",
-                "GITLAB_ELASTICSEARCH_INDEXER_VERSION",
-            ]
-        }
-        passthru["GITLAB_WORKHORSE_VERSION"] = version
-
-        return dict(
-            version=self.rev2version(rev),
-            repo_hash=self.get_git_hash(rev),
-            yarn_hash=self.get_yarn_hash(rev),
-            owner=self.owner,
-            repo=self.repo,
-            rev=rev,
-            passthru=passthru,
-        )
-
-
-def _get_data_json():
-    data_file_path = pathlib.Path(__file__).parent / "data.json"
-    with open(data_file_path, "r") as f:
-        return json.load(f)
-
-
-def _call_nix_update(pkg, version):
-    """calls nix-update from nixpkgs root dir"""
-    return subprocess.check_output(
-        ["nix-update", pkg, "--version", version], cwd=NIXPKGS_PATH
-    )
-
-
-@click_log.simple_verbosity_option(logger)
[e-mail]()
-def cli():
-    pass
-
-
[e-mail]("update-data")
[e-mail]("--rev", default="latest", help="The rev to use (vX.Y.Z-ee), or 'latest'")
-def update_data(rev: str):
-    """Update data.json"""
-    logger.info("Updating data.json")
-
-    repo = GitLabRepo()
-    if rev == "latest":
-        # filter out pre and rc releases
-        rev = next(filter(lambda x: not ("rc" in x or x.endswith("pre")), repo.tags))
-
-    data_file_path = pathlib.Path(__file__).parent / "data.json"
-
-    data = repo.get_data(rev)
-
-    with open(data_file_path.as_posix(), "w") as f:
-        json.dump(data, f, indent=2)
-        f.write("\n")
-
-
[e-mail]("update-rubyenv")
-def update_rubyenv():
-    """Update rubyEnv"""
-    logger.info("Updating gitlab")
-    repo = GitLabRepo()
-    rubyenv_dir = pathlib.Path(__file__).parent / "rubyEnv"
-
-    # load rev from data.json
-    data = _get_data_json()
-    rev = data["rev"]
-    version = data["version"]
-
-    for fn in ["Gemfile.lock", "Gemfile"]:
-        with open(rubyenv_dir / fn, "w") as f:
-            f.write(repo.get_file(fn, rev))
-
-    # update to 1.2.9 to include https://gitlab.com/gitlab-org/ruby/gems/prometheus-client-mmap/-/commit/5d77f3f3e048834250589b416c6b3d4bba65a570
-    subprocess.check_output(
-        ["sed", "-i", "s:'prometheus-client-mmap', '~> 1.2.8':'prometheus-client-mmap', '~> 1.2.9':g", "Gemfile"],
-        cwd=rubyenv_dir,
-    )
-
-    # Un-vendor sidekiq
-    #
-    # The sidekiq dependency was vendored to maintain compatibility with Redis 6.0 (as
-    # stated in this [comment]) but unfortunately, it seems to cause a crash in the
-    # application, as noted in this [upstream issue].
-    #
-    # We can safely swap out the dependency, as our Redis release in nixpkgs is >= 7.0.
-    #
-    # [comment]: https://gitlab.com/gitlab-org/gitlab/-/issues/468435#note_1979750600
-    # [upstream issue]: https://gitlab.com/gitlab-org/gitlab/-/issues/468435
-    subprocess.check_output(
-        ["sed", "-i", "s|gem 'sidekiq', path: 'vendor/gems/sidekiq', require: 'sidekiq'|gem 'sidekiq', '~> 7.3.9'|g", "Gemfile"],
-        cwd=rubyenv_dir,
-    )
-
-    # Fetch vendored dependencies temporarily in order to build the gemset.nix
-    subprocess.check_output(["mkdir", "-p", "vendor/gems", "gems"], cwd=rubyenv_dir)
-    subprocess.check_output(
-        [
-            "sh",
-            "-c",
-            f"curl -L https://gitlab.com/gitlab-org/gitlab/-/archive/v{version}-ee/gitlab-v{version}-ee.tar.bz2?path=vendor/gems | tar -xj --strip-components=3",
-        ],
-        cwd=f"{rubyenv_dir}/vendor/gems",
-    )
-    subprocess.check_output(
-        [
-            "sh",
-            "-c",
-            f"curl -L https://gitlab.com/gitlab-org/gitlab/-/archive/v{version}-ee/gitlab-v{version}-ee.tar.bz2?path=gems | tar -xj --strip-components=2",
-        ],
-        cwd=f"{rubyenv_dir}/gems",
-    )
-
-    # Undo our gemset.nix patches so that bundix runs through
-    subprocess.check_output(
-        ["sed", "-i", "-e", "s|\\${src}/||g", "gemset.nix"], cwd=rubyenv_dir
-    )
-    subprocess.check_output(
-        ["sed", "-i", "-e", "s|^src:[[:space:]]||g", "gemset.nix"], cwd=rubyenv_dir
-    )
-
-    subprocess.check_output(["bundle", "lock"], cwd=rubyenv_dir)
-    subprocess.check_output(["bundix"], cwd=rubyenv_dir)
-
-    subprocess.check_output(
-        [
-            "sed",
-            "-i",
-            "-e",
-            "1c\\src: {",
-            "-e",
-            's:path = \\(vendor/[^;]*\\);:path = "${src}/\\1";:g',
-            "-e",
-            's:path = \\(gems/[^;]*\\);:path = "${src}/\\1";:g',
-            "gemset.nix",
-        ],
-        cwd=rubyenv_dir,
-    )
-    subprocess.check_output(["rm", "-rf", "vendor", "gems"], cwd=rubyenv_dir)
-
-    # Reformat gemset.nix
-    subprocess.check_output(["nix-shell", "--run", "treefmt pkgs/applications/version-management/gitlab"], cwd=NIXPKGS_PATH)
-
-
[e-mail]("update-gitaly")
-def update_gitaly():
-    """Update gitaly"""
-    logger.info("Updating gitaly")
-    data = _get_data_json()
-    gitaly_server_version = data['passthru']['GITALY_SERVER_VERSION']
-    repo = GitLabRepo(repo="gitaly")
-    gitaly_dir = pathlib.Path(__file__).parent / 'gitaly'
-
-    makefile = repo.get_file("Makefile", f"v{gitaly_server_version}")
-    makefile += "\nprint-%:;@echo $($*)\n"
-
-    git_version = subprocess.run(["make", "-f", "-", "print-GIT_VERSION"], check=True, input=makefile, text=True, capture_output=True).stdout.strip()
-
-    _call_nix_update("gitaly", gitaly_server_version)
-    _call_nix_update("gitaly.git", git_version)
-
-
[e-mail]("update-gitlab-pages")
-def update_gitlab_pages():
-    """Update gitlab-pages"""
-    logger.info("Updating gitlab-pages")
-    data = _get_data_json()
-    gitlab_pages_version = data["passthru"]["GITLAB_PAGES_VERSION"]
-    _call_nix_update("gitlab-pages", gitlab_pages_version)
-
-
-def get_container_registry_version() -> str:
-    """Returns the version attribute of gitlab-container-registry"""
-    return subprocess.check_output(
-        [
-            "nix",
-            "--experimental-features",
-            "nix-command",
-            "eval",
-            "-f",
-            ".",
-            "--raw",
-            "gitlab-container-registry.version",
-        ],
-        cwd=NIXPKGS_PATH,
-    ).decode("utf-8")
-
-
[e-mail]("update-gitlab-shell")
-def update_gitlab_shell():
-    """Update gitlab-shell"""
-    logger.info("Updating gitlab-shell")
-    data = _get_data_json()
-    gitlab_shell_version = data["passthru"]["GITLAB_SHELL_VERSION"]
-    _call_nix_update("gitlab-shell", gitlab_shell_version)
-
-
[e-mail]("update-gitlab-workhorse")
-def update_gitlab_workhorse():
-    """Update gitlab-workhorse"""
-    logger.info("Updating gitlab-workhorse")
-    data = _get_data_json()
-    gitlab_workhorse_version = data["passthru"]["GITLAB_WORKHORSE_VERSION"]
-    _call_nix_update("gitlab-workhorse", gitlab_workhorse_version)
-
-
[e-mail]("update-gitlab-container-registry")
[e-mail]("--rev", default="latest", help="The rev to use (vX.Y.Z-ee), or 'latest'")
[e-mail](
-    "--commit", is_flag=True, default=False, help="Commit the changes for you"
-)
-def update_gitlab_container_registry(rev: str, commit: bool):
-    """Update gitlab-container-registry"""
-    logger.info("Updading gitlab-container-registry")
-    repo = GitLabRepo(repo="container-registry")
-    old_container_registry_version = get_container_registry_version()
-
-    if rev == "latest":
-        rev = next(filter(lambda x: not ("rc" in x or x.endswith("pre")), repo.tags))
-
-    version = repo.rev2version(rev)
-    _call_nix_update("gitlab-container-registry", version)
-    if commit:
-        new_container_registry_version = get_container_registry_version()
-        commit_container_registry(
-            old_container_registry_version, new_container_registry_version
-        )
-
-
[e-mail]('update-gitlab-elasticsearch-indexer')
-def update_gitlab_elasticsearch_indexer():
-    """Update gitlab-elasticsearch-indexer"""
-    data = _get_data_json()
-    gitlab_elasticsearch_indexer_version = data['passthru']['GITLAB_ELASTICSEARCH_INDEXER_VERSION']
-    _call_nix_update('gitlab-elasticsearch-indexer', gitlab_elasticsearch_indexer_version)
-
-
[e-mail]("update-all")
[e-mail]("--rev", default="latest", help="The rev to use (vX.Y.Z-ee), or 'latest'")
[e-mail](
-    "--commit", is_flag=True, default=False, help="Commit the changes for you"
-)
[e-mail]_context
-def update_all(ctx, rev: str, commit: bool):
-    """Update all gitlab components to the latest stable release"""
-    old_data_json = _get_data_json()
-    old_container_registry_version = get_container_registry_version()
-
-    ctx.invoke(update_data, rev=rev)
-
-    new_data_json = _get_data_json()
-
-    ctx.invoke(update_rubyenv)
-    ctx.invoke(update_gitaly)
-    ctx.invoke(update_gitlab_pages)
-    ctx.invoke(update_gitlab_shell)
-    ctx.invoke(update_gitlab_workhorse)
-    ctx.invoke(update_gitlab_elasticsearch_indexer)
-    if commit:
-        commit_gitlab(
-            old_data_json["version"], new_data_json["version"], new_data_json["rev"]
-        )
-
-    ctx.invoke(update_gitlab_container_registry)
-    if commit:
-        new_container_registry_version = get_container_registry_version()
-        commit_container_registry(
-            old_container_registry_version, new_container_registry_version
-        )
-
-
-def commit_gitlab(old_version: str, new_version: str, new_rev: str) -> None:
-    """Commits the gitlab changes for you"""
-    subprocess.run(
-        [
-            "git",
-            "add",
-            "pkgs/applications/version-management/gitlab",
-            "pkgs/by-name/gi/gitaly",
-            "pkgs/by-name/gi/gitlab-elasticsearch-indexer",
-            "pkgs/by-name/gi/gitlab-pages",
-        ],
-        cwd=NIXPKGS_PATH,
-    )
-    subprocess.run(
-        [
-            "git",
-            "commit",
-            "--message",
-            f"""gitlab: {old_version} -> {new_version}\n\nhttps://gitlab.com/gitlab-org/gitlab/-/blob/{new_rev}/CHANGELOG.md""",
-        ],
-        cwd=NIXPKGS_PATH,
-    )
-
-
-def commit_container_registry(old_version: str, new_version: str) -> None:
-    """Commits the gitlab-container-registry changes for you"""
-    subprocess.run(
-        [
-            "git",
-            "add",
-            "pkgs/by-name/gi/gitlab-container-registry"
-        ],
-        cwd=NIXPKGS_PATH,
-    )
-    subprocess.run(
-        [
-            "git",
-            "commit",
-            "--message",
-            f"gitlab-container-registry: {old_version} -> {new_version}\n\nhttps://gitlab.com/gitlab-org/container-registry/-/blob/v{new_version}-gitlab/CHANGELOG.md",
-        ],
-        cwd=NIXPKGS_PATH,
-    )
-
-
-if __name__ == "__main__":
-    cli()

pkgs/applications/video/obs-studio/plugins/obs-vkcapture.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "obs-vkcapture";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "nowrep";
     repo = "obs-vkcapture";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-RIDsT6eL6bUfqPiyPlecnZHu5OorcJb3Xal8pjdOpAA=";
+    hash = "sha256-ghfRST7J3bipQnOZnYMtmDggET+Etq/ngHs+zQ0bm1w=";
   };
 
   cmakeFlags = lib.optionals stdenv.hostPlatform.isi686 [

pkgs/build-support/rust/test/import-cargo-lock/basic-dynamic/default.nix

···
-{ lib, rustPlatform }:
-let
-  fs = lib.fileset;
-in
+{ rustPlatform }:
+
 rustPlatform.buildRustPackage {
   pname = "basic-dynamic";
   version = "0.1.0";
 
-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./Cargo.toml
-      ./Cargo.lock
-      ./src
-    ];
-  };
+  src = ./package;
 
-  cargoLock.lockFileContents = builtins.readFile ./Cargo.lock;
+  cargoLock.lockFileContents = builtins.readFile ./package/Cargo.lock;
 
   doInstallCheck = true;
 

pkgs/build-support/rust/test/import-cargo-lock/basic-sparse/default.nix

···
-{ lib, rustPlatform }:
-let
-  fs = lib.fileset;
-in
+{ rustPlatform }:
+
 rustPlatform.buildRustPackage {
   pname = "basic-sparse";
   version = "0.1.0";
 
-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./.cargo/config.toml
-      ./Cargo.toml
-      ./Cargo.lock
-      ./src
-    ];
-  };
+  src = ./package;
 
   cargoLock = {
-    lockFile = ./Cargo.lock;
+    lockFile = ./package/Cargo.lock;
     extraRegistries = {
       "sparse+https://index.crates.io/" = "https://static.crates.io/crates";
     };

pkgs/build-support/rust/test/import-cargo-lock/basic/default.nix

···
 { lib, rustPlatform }:
-let
-  fs = lib.fileset;
-in
+
 rustPlatform.buildRustPackage {
   pname = "basic";
   version = "0.1.0";
 
-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./Cargo.toml
-      ./Cargo.lock
-      ./src
-    ];
-  };
+  src = ./package;
 
   cargoLock = {
-    lockFile = ./Cargo.lock;
+    lockFile = ./package/Cargo.lock;
   };
 
   doInstallCheck = true;

pkgs/build-support/rust/test/import-cargo-lock/git-dependency-branch/default.nix

···
-{ lib, rustPlatform }:
-let
-  fs = lib.fileset;
-in
+{ rustPlatform }:
+
 rustPlatform.buildRustPackage {
   pname = "git-dependency-branch";
   version = "0.1.0";
 
-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./Cargo.toml
-      ./Cargo.lock
-      ./src
-    ];
-  };
+  src = ./package;
 
   cargoLock = {
-    lockFile = ./Cargo.lock;
+    lockFile = ./package/Cargo.lock;
     outputHashes = {
       "rand-0.8.4" = "1ilk9wvfw3mdm57g199ys8f5nrgdrh0n3a4c8b7nz6lgnqvfrv6z";
     };

pkgs/build-support/rust/test/import-cargo-lock/git-dependency-rev-non-workspace-nested-crate/default.nix

···
   pkg-config,
   openssl,
   zlib,
-  lib,
 }:
-let
-  fs = lib.fileset;
-in
+
 rustPlatform.buildRustPackage {
   pname = "git-dependency-rev-non-workspace-nested-crate";
   version = "0.1.0";
 
-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./Cargo.toml
-      ./Cargo.lock
-      ./src
-    ];
-  };
+  src = ./package;
 
   nativeBuildInputs = [
     pkg-config
···
   ];
 
   cargoLock = {
-    lockFile = ./Cargo.lock;
+    lockFile = ./package/Cargo.lock;
     outputHashes = {
       "cargo-test-macro-0.1.0" = "1yy1y1d523xdzwg1gc77pigbcwsbawmy4b7vw8v21m7q957sk0c4";
     };

pkgs/build-support/rust/test/import-cargo-lock/git-dependency-rev/default.nix

···
-{ lib, rustPlatform }:
-let
-  fs = lib.fileset;
-in
+{ rustPlatform }:
+
 rustPlatform.buildRustPackage {
   pname = "git-dependency-rev";
   version = "0.1.0";
 
-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./Cargo.toml
-      ./Cargo.lock
-      ./src
-    ];
-  };
+  src = ./package;
 
   cargoLock = {
-    lockFile = ./Cargo.lock;
+    lockFile = ./package/Cargo.lock;
     outputHashes = {
       "rand-0.8.3" = "0l3p174bpwia61vcvxz5mw65a13ri3wy94z04xrnyy5lzciykz4f";
     };

pkgs/build-support/rust/test/import-cargo-lock/git-dependency-tag/default.nix

···
-{ lib, rustPlatform }:
-let
-  fs = lib.fileset;
-in
+{ rustPlatform }:
+
 rustPlatform.buildRustPackage {
   pname = "git-dependency-tag";
   version = "0.1.0";
 
-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./Cargo.toml
-      ./Cargo.lock
-      ./src
-    ];
-  };
+  src = ./package;
 
   cargoLock = {
-    lockFile = ./Cargo.lock;
+    lockFile = ./package/Cargo.lock;
     outputHashes = {
       "rand-0.8.3" = "0l3p174bpwia61vcvxz5mw65a13ri3wy94z04xrnyy5lzciykz4f";
     };

pkgs/build-support/rust/test/import-cargo-lock/git-dependency/default.nix

···
-{ lib, rustPlatform }:
-let
-  fs = lib.fileset;
-in
+{ rustPlatform }:
+
 rustPlatform.buildRustPackage {
   pname = "git-dependency";
   version = "0.1.0";
 
-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./Cargo.toml
-      ./Cargo.lock
-      ./src
-    ];
-  };
+  src = ./package;
 
   cargoLock = {
-    lockFile = ./Cargo.lock;
+    lockFile = ./package/Cargo.lock;
     outputHashes = {
       "rand-0.8.3" = "0ya2hia3cn31qa8894s3av2s8j5bjwb6yq92k0jsnlx7jid0jwqa";
     };

pkgs/build-support/rust/test/import-cargo-lock/v1/default.nix

···
-{ lib, rustPlatform }:
-let
-  fs = lib.fileset;
-in
+{ rustPlatform }:
+
 rustPlatform.buildRustPackage {
   pname = "v1";
   version = "0.1.0";
 
-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./Cargo.toml
-      ./Cargo.lock
-      ./src
-    ];
-  };
+  src = ./package;
 
   cargoLock = {
-    lockFile = ./Cargo.lock;
+    lockFile = ./package/Cargo.lock;
   };
 
   doInstallCheck = true;

pkgs/build-support/writers/test.nix

···
     );
   };
 
-  data = {
+  data = recurseIntoAttrs {
     json = expectDataEqual {
       file = writeJSON "data.json" { hello = "world"; };
       expected = ''

pkgs/by-name/al/aliyun-cli/package.nix

···
 
 buildGoModule rec {
   pname = "aliyun-cli";
-  version = "3.0.273";
+  version = "3.0.277";
 
   src = fetchFromGitHub {
     owner = "aliyun";
     repo = "aliyun-cli";
     tag = "v${version}";
-    hash = "sha256-Zmi+izG8gHZrtSaLR9sE9F0W55+PEj25lBKueIwY8iY=";
+    hash = "sha256-4HWSebmMys3yzj2H3JC7hAayl9xQeVBQWCEGlZSudUc=";
     fetchSubmodules = true;
   };
 
-  vendorHash = "sha256-K6et/P1GKoZeEsfB5LMBqfBx+YoVMMC87YLNKOkL30g=";
+  vendorHash = "sha256-cyE7yuwYUR/vv1w/b7QaiSoyX2XiUy5vNdodu+9PIl8=";
 
   subPackages = [ "main" ];
 

pkgs/by-name/ar/ares/darwin-build-fixes.patch

···
 diff --git a/cmake/macos/compilerconfig.cmake b/cmake/macos/compilerconfig.cmake
-index 99272c662..50f94db37 100644
+index f0c900f28..4da64f0b3 100644
 --- a/cmake/macos/compilerconfig.cmake
 +++ b/cmake/macos/compilerconfig.cmake
-@@ -27,7 +27,7 @@ message(DEBUG "macOS SDK Path: ${CMAKE_OSX_SYSROOT}")
- string(REGEX MATCH ".+/SDKs/MacOSX([0-9]+\\.[0-9])+\\.sdk$" _ ${CMAKE_OSX_SYSROOT})
- set(_ares_macos_current_sdk ${CMAKE_MATCH_1})
- message(DEBUG "macOS SDK version: ${_ares_macos_current_sdk}")
--if(_ares_macos_current_sdk VERSION_LESS _ares_macos_minimum_sdk)
-+if(FALSE)
-   message(
-     FATAL_ERROR
-     "Your macOS SDK version (${_ares_macos_current_sdk}) is too low. "
+@@ -25,7 +25,7 @@ function(check_sdk_requirements)
+   set(ares_macos_minimum_sdk 11.1) # Minimum tested SDK
+   set(ares_macos_minimum_xcode 12.4) # Sync with SDK
+   execute_process(
+-    COMMAND xcrun --sdk macosx --show-sdk-platform-version
++    COMMAND echo @sdkVersion@
+     OUTPUT_VARIABLE ares_macos_current_sdk
+     RESULT_VARIABLE result
+     OUTPUT_STRIP_TRAILING_WHITESPACE
 diff --git a/cmake/macos/helpers.cmake b/cmake/macos/helpers.cmake
-index 864a629f0..f455345bf 100644
+index 3777ac98a..07ff17009 100644
 --- a/cmake/macos/helpers.cmake
 +++ b/cmake/macos/helpers.cmake
 @@ -35,7 +35,6 @@ function(ares_configure_executable target)
···
  
      install(TARGETS ${target} BUNDLE DESTINATION "." COMPONENT Application)
    endif()
+diff --git a/ruby/cmake/os-macos.cmake b/ruby/cmake/os-macos.cmake
+index 39c339428..dafb58c66 100644
+--- a/ruby/cmake/os-macos.cmake
++++ b/ruby/cmake/os-macos.cmake
+@@ -43,7 +43,7 @@ target_link_libraries(
+ if(SDL_FOUND)
+   target_link_libraries(
+     ruby
+-    PRIVATE "$<LINK_LIBRARY:WEAK_FRAMEWORK,SDL::SDL>"
++    PRIVATE "$<LINK_LIBRARY:WEAK_LIBRARY,SDL::SDL>"
+   )
+ endif()
+ 

pkgs/by-name/ar/ares/package.nix

···
 {
   lib,
-  SDL2,
   alsa-lib,
   apple-sdk_14,
   cmake,
···
   moltenvk,
   openal,
   pkg-config,
+  replaceVars,
+  sdl3,
   stdenv,
   udev,
   vulkan-loader,
···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ares";
-  version = "143";
+  version = "144";
 
   src = fetchFromGitHub {
     owner = "ares-emulator";
     repo = "ares";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uuFKbS7WvxkTyyQfuQ6iKPvRt+54zUPdjUlQ/ohBAr8=";
+    hash = "sha256-BpVyPdtsIUstLVf/HGO6vcAlLgJP5SgJbZtqEV/uJ2g=";
   };
 
   nativeBuildInputs =
···
 
   buildInputs =
     [
-      SDL2
+      sdl3
       libao
       librashader
       vulkan-loader
···
     ];
 
   patches = [
-    ./darwin-build-fixes.patch
+    (replaceVars ./darwin-build-fixes.patch {
+      sdkVersion = apple-sdk_14.version;
+    })
   ];
 
   cmakeFlags = [

pkgs/by-name/au/auth0-cli/package.nix

···
 
 buildGoModule rec {
   pname = "auth0-cli";
-  version = "1.12.0";
+  version = "1.13.0";
 
   src = fetchFromGitHub {
     owner = "auth0";
     repo = "auth0-cli";
     tag = "v${version}";
-    hash = "sha256-T3AJYDPdVkFYsvZUIdqndaxsJmsoJeeyr0316rafg7Q=";
+    hash = "sha256-RcRJBW8FgCi9Lxz/KARql7ArozqYgttpQ9IXIKzvo6s=";
   };
 
-  vendorHash = "sha256-/F3GNGCfsa9LM1F+eYJ+okqqjIuKfxHDT90ZS9gsJzs=";
+  vendorHash = "sha256-6y2iGxaromnMYIU2rnvwmQwn8f1PdihB4DH9r5sRT68=";
 
   ldflags = [
     "-s"

pkgs/by-name/ba/bamtools/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bamtools";
-  version = "2.5.2";
+  version = "2.5.3";
 
   src = fetchFromGitHub {
     owner = "pezmaster31";
     repo = "bamtools";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-l2DmA4P1kPneTCL9YVACE6LcQHT0F+mufPyM69VkksE=";
+    hash = "sha256-3kIa407YgBpulh2koQQFK/RLmGEZvEvTnZyWKm+pngg=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/be/bento/package.nix

···
 
 buildGoModule rec {
   pname = "bento";
-  version = "1.6.1";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "warpstreamlabs";
     repo = "bento";
     tag = "v${version}";
-    hash = "sha256-T13r41ygQNmEBCwTKyCocQbGcyJSQ8lvmRllbxU512Y=";
+    hash = "sha256-pV7Fd+Ir+ZqteM0In/NiZrAyvPFS+oOnONhGVeBzA2g=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-/DXdPL98Y4peF3USV9/J4sT/TUTRp3Cds500kxb18QA=";
+  vendorHash = "sha256-ow/XOO8Xc72v6Ue9VHjnPuq+HlqE4YZHw+gJB4x7sKk=";
 
   subPackages = [
     "cmd/bento"

pkgs/by-name/br/brscan5/package.nix

···
       # driver is hardcoded to look in /opt/brother/scanner/brscan5/models for model metadata.
       # patch it to look in /etc/opt/brother/scanner/models instead, so nixos environment.etc can make it available
       printf '/etc/opt/brother/scanner/models\x00' | dd of=opt/brother/scanner/brscan5/libsane-brother5.so.1.0.7 bs=1 seek=${toString patchOffsetBytes} conv=notrunc
+
+      # remove deprecated SYSFS udev rule
+      sed -i -e '/^SYSFS/d' opt/brother/scanner/brscan5/udev-rules/*.rules
     '';
 
   installPhase = ''

pkgs/by-name/ci/circleci-cli/package.nix

···
 
 buildGoModule rec {
   pname = "circleci-cli";
-  version = "0.1.31632";
+  version = "0.1.31792";
 
   src = fetchFromGitHub {
     owner = "CircleCI-Public";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-3ufazu7DuUFp3aBxQ5MPlndECHSjvEIscYjlvE3j9G8=";
+    sha256 = "sha256-0D0jCBE027zEQI/3iX4nF5ut8PS+nKuKhNf5+buazb8=";
   };
 
   vendorHash = "sha256-H7q373HL6M6ETkXEY5tAwN32rx0eMkqRAAZ4kQf9rKk=";

pkgs/by-name/cl/clash-verge-rev/unwrapped.nix

···
     openssl
     webkitgtk_4_1
   ];
+
+  # make sure the .desktop file name does not contain whitespace,
+  # so that the service can register it as an auto-start item
+  postInstall = ''
+    mv $out/share/applications/Clash\ Verge.desktop $out/share/applications/clash-verge.desktop
+  '';
 }

pkgs/by-name/cn/cnquery/package.nix

···
 
 buildGoModule rec {
   pname = "cnquery";
-  version = "11.53.2";
+  version = "11.54.0";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnquery";
     tag = "v${version}";
-    hash = "sha256-nqzlwBGsqGFh6yeqEWXE6MJyyiHwFh8ehaJjDbl+yd0=";
+    hash = "sha256-w9O3uEgzSe7e6+ij3AGVOVmDemDY8D1I4UcGXKb1B3E=";
   };
 
   subPackages = [ "apps/cnquery" ];
 
-  vendorHash = "sha256-CNbpMNT9OX7lAbLugS4vUcOHhtqEQcYFYaTe+HjewdA=";
+  vendorHash = "sha256-iGWdx4bgc4TFZ6opc/W9FfXkn6Xgff8pQjOl5SczgSE=";
 
   ldflags = [
     "-w"

pkgs/by-name/co/cotp/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "cotp";
-  version = "1.9.4";
+  version = "1.9.5";
 
   src = fetchFromGitHub {
     owner = "replydev";
     repo = "cotp";
     rev = "v${version}";
-    hash = "sha256-O9qss8vxsGyBWaCTt3trjnFVol5ib/G7IZIj742A/XI=";
+    hash = "sha256-Jv5BT7P/OXLkkfrEf+8x2IrACMhqr3zpbcKX8I/TzDc=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Y8kGOeDKjdG+5zuA1mDx4h5IbKETjZU+SiFWiUv3xkw=";
+  cargoHash = "sha256-9iZyi3TPnqRpt+SRI3t7kwwiGpwUjQ0BrLZQY3X383o=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libxcb ];
 

pkgs/by-name/cp/cpm-cmake/package.nix

···
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cpm-cmake";
-  version = "0.41.0";
+  version = "0.42.0";
 
   src = fetchFromGitHub {
     owner = "cpm-cmake";
     repo = "cpm.cmake";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-sQHDZD2/BBlBXlPeY094dNkJNw+CF00FBvezYA5zxXg=";
+    hash = "sha256-IA13qA/b+owlrqbVAkhd4rS98/XB5RNONiJaPwjDm+A=";
   };
 
   postPatch = ''

pkgs/by-name/ct/ctlptl/package.nix

···
 
 buildGoModule rec {
   pname = "ctlptl";
-  version = "0.8.40";
+  version = "0.8.41";
 
   src = fetchFromGitHub {
     owner = "tilt-dev";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-O6oAkYzkBUecwAcLjPIR7D/k4REWND8TWdstPNVJ0MU=";
+    hash = "sha256-PjTgXjA3lP4tzkcnWt711DJtu5/2zR+a2yyYmzf5WvE=";
   };
 
-  vendorHash = "sha256-1BrohvN3Eefuy2y7pjdwhzFQG9YLr9X/CLbOeTBZkjY=";
+  vendorHash = "sha256-EYpPZvAhKsKguvDousIs9BTD8fnCcZql3IktKf92wxs=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/de/dependabot-cli/package.nix

···
 }:
 let
   pname = "dependabot-cli";
-  version = "1.63.0";
+  version = "1.64.0";
 
   # vv Also update this vv
   tag = "nixpkgs-dependabot-cli-${version}";
···
     owner = "dependabot";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-lk0AEFQYemr4wP7JXx5mPzzo2VzSJvygPP5vtUvPaxs=";
+    hash = "sha256-NcmDYCXdhMY1KFz3if0XlX4EisQFr0YhJItllXnOfaA=";
   };
 
   vendorHash = "sha256-pnB1SkuEGm0KfkDfjnoff5fZRsAgD5w2H4UwsD3Jlbo=";

pkgs/by-name/er/ergochat/package.nix

···
 
 buildGoModule rec {
   pname = "ergo";
-  version = "2.15.0";
+  version = "2.16.0";
 
   src = fetchFromGitHub {
     owner = "ergochat";
     repo = "ergo";
     rev = "v${version}";
-    sha256 = "sha256-8qZ5pnbCYN/j8B5cS456HVK2hDGqJwrPo1k4oagJrqU=";
+    sha256 = "sha256-AUXuH7YjC/yG5Ocs+kAOF8bAR4UVgfx96VDSHEqmqgg=";
   };
 
   vendorHash = null;

pkgs/by-name/gi/git-who/package.nix

···
 }:
 buildGoModule rec {
   pname = "git-who";
-  version = "0.7";
+  version = "1.0";
 
   src = fetchFromGitHub {
     owner = "sinclairtarget";
     repo = "git-who";
     rev = "v${version}";
-    hash = "sha256-64Hb2+ZCXJis19V0WDyZ0SHZX99Dqxr3UGQTQZSCAp8=";
+    hash = "sha256-xJHFPf3w+6jh6vPTg4ggq652lANZkBBkKsmkvWx48ZU=";
   };
 
   vendorHash = "sha256-e2P7szjtAn4EFTy+eGi/9cYf/Raw/7O+PbYEOD8i3Hs=";

pkgs/by-name/gi/gitaly/git.nix

···
 
 stdenv.mkDerivation rec {
   pname = "gitaly-git";
-  version = "2.48.1.gl1";
+  version = "2.49.0.gl2";
 
   # `src` attribute for nix-update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "git";
     rev = "v${version}";
-    hash = "sha256-j7yKImeRerdsYtSMrAU4y5vAJ2BT5wnJxURbDIwVot4=";
+    hash = "sha256-1y94T5UBG7s76ENsUmaXRXngSKmqIAT0nq1u+QjSWaY=";
   };
 
   # we actually use the gitaly build system

pkgs/by-name/gi/gitaly/package.nix

···
 }:
 
 let
-  version = "17.11.2";
+  version = "18.0.0";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
···
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-Ihw3Mezfz9H19oGM7X9B50aUbyh1JjDOmVU5ZNoiWug=";
+      hash = "sha256-IhFKEBYCEORLPEplPDRdV61kY5ZgFAxJmfmoG9Q58ec=";
     };
 
-    vendorHash = "sha256-ExqgxukFKXq/Z//hGSoDevfpJiNbVHhind63os1/3Fk=";
+    vendorHash = "sha256-PXONynRY5ZLQO2yQdtljDmLhVBIgfEYmyez9pIm9vtw=";
 
     ldflags = [
       "-X ${gitaly_package}/internal/version.version=${version}"

pkgs/by-name/gi/gitlab-elasticsearch-indexer/package.nix

···
 
 buildGoModule rec {
   pname = "gitlab-elasticsearch-indexer";
-  version = "5.5.0";
+  version = "5.5.1";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-elasticsearch-indexer";
     rev = "v${version}";
-    hash = "sha256-b2kXp77pb9MXMRJsbDdNOXub8eZbZkHRwu/Ru0Voi60=";
+    hash = "sha256-N2H9jLpsP39nKrokWwphAspQwXcL3stAdvNVItIHFyo=";
   };
 
-  vendorHash = "sha256-9T8LbMROLcQYm9cT32Uc6Cuxwt9OYj3WzSYFgSQg1HQ=";
+  vendorHash = "sha256-Go02W09799Vu9v7y+P7z1gj7ijG3No5AVprRrmspPZE=";
 
   buildInputs = [ icu ];
   nativeBuildInputs = [ pkg-config ];

pkgs/by-name/gi/gitlab-pages/package.nix

···
 
 buildGoModule rec {
   pname = "gitlab-pages";
-  version = "17.11.2";
+  version = "18.0.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${version}";
-    hash = "sha256-tnswEoocMZXBrS+5toV8IOVs8HcNrTG320ebQqB3XiQ=";
+    hash = "sha256-c2y11lMeHBi62Ql63HGolF454GkFp7UCErHGk5Bvgvw=";
   };
 
-  vendorHash = "sha256-jCuLRXr7WHGxbXVg2JB1vp9WiNaLgsIJ6GJSS4QrlwY=";
+  vendorHash = "sha256-BjCwPt1duDINHP7L0qT2KNTjOZ62bWgVij88ztjjyPg=";
   subPackages = [ "." ];
 
   meta = with lib; {

pkgs/by-name/gi/gitlab/data.json

···
+{
+  "version": "18.0.0",
+  "repo_hash": "03x2ypyn7kkald6pzvzh19cmlr6km9fdssw823565rd1kikywb87",
+  "yarn_hash": "0vv09y1pjcm2723jh842pgnmnrf4yqk7558v57dp08rxrqnsni5x",
+  "owner": "gitlab-org",
+  "repo": "gitlab",
+  "rev": "v18.0.0-ee",
+  "passthru": {
+    "GITALY_SERVER_VERSION": "18.0.0",
+    "GITLAB_PAGES_VERSION": "18.0.0",
+    "GITLAB_SHELL_VERSION": "14.41.0",
+    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.5.1",
+    "GITLAB_WORKHORSE_VERSION": "18.0.0"
+  }
+}

pkgs/by-name/gi/gitlab/update.py

···
+#!/usr/bin/env nix-shell
+#! nix-shell -I nixpkgs=../../../.. -i python3 -p bundix bundler nix-update nix python3 python3Packages.requests python3Packages.click python3Packages.click-log python3Packages.packaging prefetch-yarn-deps git
+
+import click
+import click_log
+import re
+import logging
+import subprocess
+import json
+import pathlib
+import tempfile
+from packaging.version import Version
+from typing import Iterable
+
+import requests
+
+NIXPKGS_PATH = pathlib.Path(__file__).parent / "../../../../"
+GITLAB_DIR = pathlib.Path(__file__).parent
+
+logger = logging.getLogger(__name__)
+click_log.basic_config(logger)
+
+
+class GitLabRepo:
+    version_regex = re.compile(r"^v\d+\.\d+\.\d+(\-rc\d+)?(\-ee)?(\-gitlab)?")
+
+    def __init__(self, owner: str = "gitlab-org", repo: str = "gitlab"):
+        self.owner = owner
+        self.repo = repo
+
+    @property
+    def url(self):
+        return f"https://gitlab.com/{self.owner}/{self.repo}"
+
+    @property
+    def tags(self) -> Iterable[str]:
+        """Returns a sorted list of repository tags"""
+        r = requests.get(self.url + "/refs?sort=updated_desc&ref=master").json()
+        tags = r.get("Tags", [])
+
+        # filter out versions not matching version_regex
+        versions = list(filter(self.version_regex.match, tags))
+
+        # sort, but ignore v, -ee and -gitlab for sorting comparisons
+        versions.sort(
+            key=lambda x: Version(
+                x.replace("v", "").replace("-ee", "").replace("-gitlab", "")
+            ),
+            reverse=True,
+        )
+        return versions
+    def get_git_hash(self, rev: str):
+        return (
+            subprocess.check_output(
+                [
+                    "nix-prefetch-url",
+                    "--unpack",
+                    f"https://gitlab.com/{self.owner}/{self.repo}/-/archive/{rev}/{self.repo}-{rev}.tar.gz",
+                ]
+            )
+            .decode("utf-8")
+            .strip()
+        )
+
+    def get_yarn_hash(self, rev: str):
+        with tempfile.TemporaryDirectory() as tmp_dir:
+            with open(tmp_dir + "/yarn.lock", "w") as f:
+                f.write(self.get_file("yarn.lock", rev))
+            return (
+                subprocess.check_output(["prefetch-yarn-deps", tmp_dir + "/yarn.lock"])
+                .decode("utf-8")
+                .strip()
+            )
+
+    @staticmethod
+    def rev2version(tag: str) -> str:
+        """
+        normalize a tag to a version number.
+        This obviously isn't very smart if we don't pass something that looks like a tag
+        :param tag: the tag to normalize
+        :return: a normalized version number
+        """
+        # strip v prefix
+        version = re.sub(r"^v", "", tag)
+        # strip -ee and -gitlab suffixes
+        return re.sub(r"-(ee|gitlab)$", "", version)
+
+    def get_file(self, filepath, rev):
+        """
+        returns file contents at a given rev
+        :param filepath: the path to the file, relative to the repo root
+        :param rev: the rev to fetch at
+        :return:
+        """
+        return requests.get(self.url + f"/raw/{rev}/{filepath}").text
+
+    def get_data(self, rev):
+        version = self.rev2version(rev)
+
+        passthru = {
+            v: self.get_file(v, rev).strip()
+            for v in [
+                "GITALY_SERVER_VERSION",
+                "GITLAB_PAGES_VERSION",
+                "GITLAB_SHELL_VERSION",
+                "GITLAB_ELASTICSEARCH_INDEXER_VERSION",
+            ]
+        }
+        passthru["GITLAB_WORKHORSE_VERSION"] = version
+
+        return dict(
+            version=self.rev2version(rev),
+            repo_hash=self.get_git_hash(rev),
+            yarn_hash=self.get_yarn_hash(rev),
+            owner=self.owner,
+            repo=self.repo,
+            rev=rev,
+            passthru=passthru,
+        )
+
+
+def _get_data_json():
+    data_file_path = pathlib.Path(__file__).parent / "data.json"
+    with open(data_file_path, "r") as f:
+        return json.load(f)
+
+
+def _call_nix_update(pkg, version):
+    """calls nix-update from nixpkgs root dir"""
+    return subprocess.check_output(
+        ["nix-update", pkg, "--version", version], cwd=NIXPKGS_PATH
+    )
+
+
+@click_log.simple_verbosity_option(logger)
[e-mail]()
+def cli():
+    pass
+
+
[e-mail]("update-data")
[e-mail]("--rev", default="latest", help="The rev to use (vX.Y.Z-ee), or 'latest'")
+def update_data(rev: str):
+    """Update data.json"""
+    logger.info("Updating data.json")
+
+    repo = GitLabRepo()
+    if rev == "latest":
+        # filter out pre and rc releases
+        rev = next(filter(lambda x: not ("rc" in x or x.endswith("pre")), repo.tags))
+
+    data_file_path = pathlib.Path(__file__).parent / "data.json"
+
+    data = repo.get_data(rev)
+
+    with open(data_file_path.as_posix(), "w") as f:
+        json.dump(data, f, indent=2)
+        f.write("\n")
+
+
[e-mail]("update-rubyenv")
+def update_rubyenv():
+    """Update rubyEnv"""
+    logger.info("Updating gitlab")
+    repo = GitLabRepo()
+    rubyenv_dir = pathlib.Path(__file__).parent / "rubyEnv"
+
+    # load rev from data.json
+    data = _get_data_json()
+    rev = data["rev"]
+    version = data["version"]
+
+    for fn in ["Gemfile.lock", "Gemfile"]:
+        with open(rubyenv_dir / fn, "w") as f:
+            f.write(repo.get_file(fn, rev))
+
+    # update to 1.2.9 to include https://gitlab.com/gitlab-org/ruby/gems/prometheus-client-mmap/-/commit/5d77f3f3e048834250589b416c6b3d4bba65a570
+    subprocess.check_output(
+        ["sed", "-i", "s:'prometheus-client-mmap', '~> 1.2.8':'prometheus-client-mmap', '~> 1.2.9':g", "Gemfile"],
+        cwd=rubyenv_dir,
+    )
+
+    # Un-vendor sidekiq
+    #
+    # The sidekiq dependency was vendored to maintain compatibility with Redis 6.0 (as
+    # stated in this [comment]) but unfortunately, it seems to cause a crash in the
+    # application, as noted in this [upstream issue].
+    #
+    # We can safely swap out the dependency, as our Redis release in nixpkgs is >= 7.0.
+    #
+    # [comment]: https://gitlab.com/gitlab-org/gitlab/-/issues/468435#note_1979750600
+    # [upstream issue]: https://gitlab.com/gitlab-org/gitlab/-/issues/468435
+    subprocess.check_output(
+        ["sed", "-i", "s|gem 'sidekiq', path: 'vendor/gems/sidekiq', require: 'sidekiq'|gem 'sidekiq', '~> 7.3.9'|g", "Gemfile"],
+        cwd=rubyenv_dir,
+    )
+
+    # Fetch vendored dependencies temporarily in order to build the gemset.nix
+    subprocess.check_output(["mkdir", "-p", "vendor/gems", "gems"], cwd=rubyenv_dir)
+    subprocess.check_output(
+        [
+            "sh",
+            "-c",
+            f"curl -L https://gitlab.com/gitlab-org/gitlab/-/archive/v{version}-ee/gitlab-v{version}-ee.tar.bz2?path=vendor/gems | tar -xj --strip-components=3",
+        ],
+        cwd=f"{rubyenv_dir}/vendor/gems",
+    )
+    subprocess.check_output(
+        [
+            "sh",
+            "-c",
+            f"curl -L https://gitlab.com/gitlab-org/gitlab/-/archive/v{version}-ee/gitlab-v{version}-ee.tar.bz2?path=gems | tar -xj --strip-components=2",
+        ],
+        cwd=f"{rubyenv_dir}/gems",
+    )
+
+    # Undo our gemset.nix patches so that bundix runs through
+    subprocess.check_output(
+        ["sed", "-i", "-e", "s|\\${src}/||g", "gemset.nix"], cwd=rubyenv_dir
+    )
+    subprocess.check_output(
+        ["sed", "-i", "-e", "s|^src:[[:space:]]||g", "gemset.nix"], cwd=rubyenv_dir
+    )
+
+    subprocess.check_output(["bundle", "lock"], cwd=rubyenv_dir)
+    subprocess.check_output(["bundix"], cwd=rubyenv_dir)
+
+    subprocess.check_output(
+        [
+            "sed",
+            "-i",
+            "-e",
+            "1c\\src: {",
+            "-e",
+            's:path = \\(vendor/[^;]*\\);:path = "${src}/\\1";:g',
+            "-e",
+            's:path = \\(gems/[^;]*\\);:path = "${src}/\\1";:g',
+            "gemset.nix",
+        ],
+        cwd=rubyenv_dir,
+    )
+    subprocess.check_output(["rm", "-rf", "vendor", "gems"], cwd=rubyenv_dir)
+
+    # Reformat gemset.nix
+    subprocess.check_output(["nix-shell", "--run", "treefmt pkgs/by-name/gi/gitlab"], cwd=NIXPKGS_PATH)
+
+
[e-mail]("update-gitaly")
+def update_gitaly():
+    """Update gitaly"""
+    logger.info("Updating gitaly")
+    data = _get_data_json()
+    gitaly_server_version = data['passthru']['GITALY_SERVER_VERSION']
+    repo = GitLabRepo(repo="gitaly")
+    gitaly_dir = pathlib.Path(__file__).parent / 'gitaly'
+
+    makefile = repo.get_file("Makefile", f"v{gitaly_server_version}")
+    makefile += "\nprint-%:;@echo $($*)\n"
+
+    git_version = subprocess.run(["make", "-f", "-", "print-GIT_VERSION"], check=True, input=makefile, text=True, capture_output=True).stdout.strip()
+
+    _call_nix_update("gitaly", gitaly_server_version)
+    _call_nix_update("gitaly.git", git_version)
+
+
[e-mail]("update-gitlab-pages")
+def update_gitlab_pages():
+    """Update gitlab-pages"""
+    logger.info("Updating gitlab-pages")
+    data = _get_data_json()
+    gitlab_pages_version = data["passthru"]["GITLAB_PAGES_VERSION"]
+    _call_nix_update("gitlab-pages", gitlab_pages_version)
+
+
+def get_container_registry_version() -> str:
+    """Returns the version attribute of gitlab-container-registry"""
+    return subprocess.check_output(
+        [
+            "nix",
+            "--experimental-features",
+            "nix-command",
+            "eval",
+            "-f",
+            ".",
+            "--raw",
+            "gitlab-container-registry.version",
+        ],
+        cwd=NIXPKGS_PATH,
+    ).decode("utf-8")
+
+
[e-mail]("update-gitlab-shell")
+def update_gitlab_shell():
+    """Update gitlab-shell"""
+    logger.info("Updating gitlab-shell")
+    data = _get_data_json()
+    gitlab_shell_version = data["passthru"]["GITLAB_SHELL_VERSION"]
+    _call_nix_update("gitlab-shell", gitlab_shell_version)
+
+
[e-mail]("update-gitlab-workhorse")
+def update_gitlab_workhorse():
+    """Update gitlab-workhorse"""
+    logger.info("Updating gitlab-workhorse")
+    data = _get_data_json()
+    gitlab_workhorse_version = data["passthru"]["GITLAB_WORKHORSE_VERSION"]
+    _call_nix_update("gitlab-workhorse", gitlab_workhorse_version)
+
+
[e-mail]("update-gitlab-container-registry")
[e-mail]("--rev", default="latest", help="The rev to use (vX.Y.Z-ee), or 'latest'")
[e-mail](
+    "--commit", is_flag=True, default=False, help="Commit the changes for you"
+)
+def update_gitlab_container_registry(rev: str, commit: bool):
+    """Update gitlab-container-registry"""
+    logger.info("Updading gitlab-container-registry")
+    repo = GitLabRepo(repo="container-registry")
+    old_container_registry_version = get_container_registry_version()
+
+    if rev == "latest":
+        rev = next(filter(lambda x: not ("rc" in x or x.endswith("pre")), repo.tags))
+
+    version = repo.rev2version(rev)
+    _call_nix_update("gitlab-container-registry", version)
+    if commit:
+        new_container_registry_version = get_container_registry_version()
+        commit_container_registry(
+            old_container_registry_version, new_container_registry_version
+        )
+
+
[e-mail]('update-gitlab-elasticsearch-indexer')
+def update_gitlab_elasticsearch_indexer():
+    """Update gitlab-elasticsearch-indexer"""
+    data = _get_data_json()
+    gitlab_elasticsearch_indexer_version = data['passthru']['GITLAB_ELASTICSEARCH_INDEXER_VERSION']
+    _call_nix_update('gitlab-elasticsearch-indexer', gitlab_elasticsearch_indexer_version)
+
+
[e-mail]("update-all")
[e-mail]("--rev", default="latest", help="The rev to use (vX.Y.Z-ee), or 'latest'")
[e-mail](
+    "--commit", is_flag=True, default=False, help="Commit the changes for you"
+)
[e-mail]_context
+def update_all(ctx, rev: str, commit: bool):
+    """Update all gitlab components to the latest stable release"""
+    old_data_json = _get_data_json()
+    old_container_registry_version = get_container_registry_version()
+
+    ctx.invoke(update_data, rev=rev)
+
+    new_data_json = _get_data_json()
+
+    ctx.invoke(update_rubyenv)
+    ctx.invoke(update_gitaly)
+    ctx.invoke(update_gitlab_pages)
+    ctx.invoke(update_gitlab_shell)
+    ctx.invoke(update_gitlab_workhorse)
+    ctx.invoke(update_gitlab_elasticsearch_indexer)
+    if commit:
+        commit_gitlab(
+            old_data_json["version"], new_data_json["version"], new_data_json["rev"]
+        )
+
+    ctx.invoke(update_gitlab_container_registry)
+    if commit:
+        new_container_registry_version = get_container_registry_version()
+        commit_container_registry(
+            old_container_registry_version, new_container_registry_version
+        )
+
+
+def commit_gitlab(old_version: str, new_version: str, new_rev: str) -> None:
+    """Commits the gitlab changes for you"""
+    subprocess.run(
+        [
+            "git",
+            "add",
+            "pkgs/by-name/gi/gitlab",
+            "pkgs/by-name/gi/gitaly",
+            "pkgs/by-name/gi/gitlab-elasticsearch-indexer",
+            "pkgs/by-name/gi/gitlab-pages",
+        ],
+        cwd=NIXPKGS_PATH,
+    )
+    subprocess.run(
+        [
+            "git",
+            "commit",
+            "--message",
+            f"""gitlab: {old_version} -> {new_version}\n\nhttps://gitlab.com/gitlab-org/gitlab/-/blob/{new_rev}/CHANGELOG.md""",
+        ],
+        cwd=NIXPKGS_PATH,
+    )
+
+
+def commit_container_registry(old_version: str, new_version: str) -> None:
+    """Commits the gitlab-container-registry changes for you"""
+    subprocess.run(
+        [
+            "git",
+            "add",
+            "pkgs/by-name/gi/gitlab-container-registry"
+        ],
+        cwd=NIXPKGS_PATH,
+    )
+    subprocess.run(
+        [
+            "git",
+            "commit",
+            "--message",
+            f"gitlab-container-registry: {old_version} -> {new_version}\n\nhttps://gitlab.com/gitlab-org/container-registry/-/blob/v{new_version}-gitlab/CHANGELOG.md",
+        ],
+        cwd=NIXPKGS_PATH,
+    )
+
+
+if __name__ == "__main__":
+    cli()

pkgs/by-name/go/goverter/package.nix

···
 }:
 buildGoModule rec {
   pname = "goverter";
-  version = "1.8.2";
+  version = "1.8.3";
 
   src = fetchFromGitHub {
     owner = "jmattheis";
     repo = "goverter";
     tag = "v${version}";
-    hash = "sha256-f+rTEbr4Cr5PjXZg+E2235opxbakoYkJqEGRtyWrngE=";
+    hash = "sha256-ytW52raI4MV6cX/ThR6p9hohtngwBYuvSrtOfjnqwXc=";
   };
 
   vendorHash = "sha256-YOtcidMhtQqw/KxY1R3L3XnrhayGQBvHkRdbvYyCQFM=";

pkgs/by-name/h2/h2o/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "h2o";
-  version = "2.3.0.20250430";
+  version = "2.3.0.20250519";
 
   src = fetchFromGitHub {
     owner = "h2o";
     repo = "h2o";
-    rev = "f1918a5b9f75f4da9db801b442886cb13b3c7bcd";
-    sha256 = "sha256-sfOkyEhlLGmXjYqRoI/8pD6/NBY7q6K9y2vS7qwJmrw=";
+    rev = "87e2aa634f2c0d9f3d9429f7a3cf273f98db0058";
+    sha256 = "sha256-/9YnaOqvYmFme4/mFq8Sx78FMDyGwnErEW45qPVELjU=";
   };
 
   outputs = [

pkgs/by-name/ha/hadolint-sarif/package.nix

···
 }:
 rustPlatform.buildRustPackage rec {
   pname = "hadolint-sarif";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-HPGVqAk1bXzeblTc4AnCLsHB60CKFV8ImO+MFqM10YI=";
+    hash = "sha256-7xvo194lCQpDtLgwX6rZEkwG3hYTp5czjw4GrEaivsI=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-1nl5Myr8o1gyvkpsdMVLjZqnLkULOmxUOT0NmVe+0Oo=";
+  cargoHash = "sha256-R4fGlo65/suNozEzRaQ3k6Ys4CMBheT2+rHZZZuIstM=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;

pkgs/by-name/he/heimdall-proxy/package.nix

···
   lib,
 }:
 let
-  version = "0.16.1";
+  version = "0.16.2";
 in
 buildGoModule {
   pname = "heimdall-proxy";
···
     owner = "dadrus";
     repo = "heimdall";
     tag = "v${version}";
-    hash = "sha256-HP2YuipqqToTD44FreKtdJErtF4CWxnMf2JRmjgLuv0=";
+    hash = "sha256-RzRjcg9GocqXpBh8C34LrSLbSrJWd9y4+YEWJaAD8d0=";
   };
 
-  vendorHash = "sha256-9AOUgQEhOUzzT+qJLE7NlPqiQDQHJnLOT9JSwpetQXA=";
+  vendorHash = "sha256-GVUO5a6m85C7JRJ9WBTB7JDHRaiU2Nq3clWQUedKp98=";
 
   tags = [ "sqlite" ];
 

pkgs/by-name/in/intentrace/package.nix

···
 }:
 
 let
-  version = "0.9.7";
+  version = "0.9.8";
 in
 rustPlatform.buildRustPackage {
   inherit version;
···
     owner = "sectordistrict";
     repo = "intentrace";
     tag = "v${version}";
-    hash = "sha256-24w5EQ3LQ7OxuVaqoLlUrYi2TmSLAfWGLNrkPcxMQMM=";
+    hash = "sha256-5QARHw9Z4+wYrxaAuSt9WjGR6qvSWAFIMdNOzE6FqfU=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-pLGWXwpgTh/7SaDhs63jr+5Fpsiep1tfl9VlCEBrK1s=";
+  cargoHash = "sha256-m4kLpJeqAvDI8/1gjqRVkbOvyfcLfwi0y2iavvm25jw=";
 
   meta = {
     description = "Prettified Linux syscall tracing tool (like strace)";

pkgs/by-name/ip/ipfs-cluster/package.nix

···
 
 buildGoModule rec {
   pname = "ipfs-cluster";
-  version = "1.1.3";
+  version = "1.1.4";
 
   vendorHash = "sha256-VVejr6B7eDNNQF34PS/PaQ50mBNZgzJS50aNzbLJgCg=";
 
···
     owner = "ipfs-cluster";
     repo = "ipfs-cluster";
     rev = "v${version}";
-    hash = "sha256-C3bBtZsDcYy6I0wmaYIDwhmGJVNcWq+rCdi5WHUzvB8=";
+    hash = "sha256-mdLrLiRNudpQ8i0lvwoNAqhSWJ8VMEC1ZRxXHWHpqLY=";
   };
 
   meta = with lib; {

pkgs/by-name/ja/jai/package.nix

···
 let
   pname = "jai";
   minor = "2";
-  patch = "011";
+  patch = "012";
   version = "0.${minor}.${patch}";
   zipName = "jai-beta-${minor}-${patch}.zip";
   jai = stdenv.mkDerivation {
···
           nix-store --add-fixed sha256 ${zipName}
       '';
       name = zipName;
-      sha256 = "sha256-Du4rTA2g7hjlsUA/hvPY6O6L34e/MmnUN8rzi1jF/dY";
+      sha256 = "sha256-1cUEQ+C3qwo3v4E2ioH2NcIH864Cay2dxQT+Yo/fZJ8=";
     };
     nativeBuildInputs = [ unzip ];
     buildCommand = "unzip $src -d $out";

pkgs/by-name/ku/kubevpn/package.nix

···
 
 buildGoModule rec {
   pname = "kubevpn";
-  version = "2.7.5";
+  version = "2.7.11";
 
   src = fetchFromGitHub {
     owner = "KubeNetworks";
     repo = "kubevpn";
     rev = "v${version}";
-    hash = "sha256-WB3Qths9Lg48KfmRYg6O+fZIQ97n+Q7LgudT4Npqnl8=";
+    hash = "sha256-PqKgBJugibgG/4gGBINuFxWAxSYEKRpPXpofiOKmmIs=";
   };
 
   vendorHash = null;

pkgs/by-name/lo/lockbook-desktop/package.nix

···
 in
 rustPlatform.buildRustPackage rec {
   pname = "lockbook-desktop";
-  version = "0.9.22";
+  version = "0.9.23";
 
   src = fetchFromGitHub {
     owner = "lockbook";
     repo = "lockbook";
     tag = version;
-    hash = "sha256-akCtnPLJupoo7n3Vfyl37fjCmK4dHB0bt92rie6k0dQ=";
+    hash = "sha256-1SHAlhcQFuhwiYQReVOILX2T0gufNBojuy/E/EcECNw=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-xH3GIwh3zaLbpZqvzM+KM+K14fWj241RTwUM7dWRCKA=";
+  cargoHash = "sha256-TAa/HuRDwRr5GBObcQwxebTiBjRrWeq52HFYT9h6Rq4=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/ma/matrix-synapse-unwrapped/plugins/synapse-http-antispam.nix

···
 
 buildPythonPackage rec {
   pname = "synapse-http-antispam";
-  version = "0.3.0";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "maunium";
     repo = "synapse-http-antispam";
     tag = "v${version}";
-    hash = "sha256-wWm23+3o+/nx3xGkyShJm28mDPTbOhPbKgW3WfuB0Ng=";
+    hash = "sha256-YvgHIZ5Kr9WsX30QN8W5OJ4sxLB7EsLqUmCye3x+JQA=";
   };
 
   build-system = [ hatchling ];

pkgs/by-name/me/melonDS/package.nix

···
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "melonDS";
-  version = "1.0rc-unstable-2025-04-09";
+  version = "1.0rc-unstable-2025-05-15";
 
   src = fetchFromGitHub {
     owner = "melonDS-emu";
     repo = "melonDS";
-    rev = "9ed7e5803e55c5eeb29ec560c8659b38ed331749";
-    hash = "sha256-wLCaGnaMYaPjFzYTph16WTdE89j4MFaO4FuIQdH9R80=";
+    rev = "0e64a06c84f9b9428f8647c2aafde110c9d917f3";
+    hash = "sha256-T+AcpAITNALtZbuwY+oh4RnMgjCAi7n2HPyDjFqpQPI=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/mt/mt-st/package.nix

···
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitHub,
 }:
 
 stdenv.mkDerivation rec {
   pname = "mt-st";
-  version = "1.3";
+  version = "1.8";
 
-  src = fetchurl {
-    url = "https://github.com/iustin/mt-st/releases/download/mt-st-${version}/mt-st-${version}.tar.gz";
-    sha256 = "b552775326a327cdcc076c431c5cbc4f4e235ac7c41aa931ad83f94cccb9f6de";
+  src = fetchFromGitHub {
+    owner = "iustin";
+    repo = "mt-st";
+    tag = "v${version}";
+    hash = "sha256-Sl+/v+ko3K4npY/M49H1YDxqOMy923qcAkTohi5Xg70=";
   };
 
   installFlags = [
-    "PREFIX=$(out)"
-    "EXEC_PREFIX=$(out)"
+    "PREFIX="
+    "DESTDIR=$(out)"
+    "COMPLETIONINSTALLDIR=$(out)/share/bash-completion/completions"
   ];
 
   meta = {

pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py

···
 import sys
 from pathlib import Path
 from subprocess import CalledProcessError, run
-from typing import assert_never
+from typing import Final, assert_never
 
 from . import nix, tmpdir
 from .constants import EXECUTABLE, WITH_NIX_2_18, WITH_REEXEC, WITH_SHELL_FILES
···
 from .process import Remote, cleanup_ssh
 from .utils import Args, LogFormatter, tabulate
 
-logger = logging.getLogger()
+logger: Final = logging.getLogger()
 logger.setLevel(logging.INFO)
 
 

pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/constants.py

···
+from typing import Final
+
 # Build-time flags
 # Use strings to avoid breaking standalone (e.g.: `python -m nixos_rebuild`)
 # usage
-EXECUTABLE = "@executable@"
+EXECUTABLE: Final[str] = "@executable@"
 # Use either `== "true"` if the default (e.g.: `python -m nixos_rebuild`) is
 # `False` or `!= "false"` if the default is `True`
-WITH_NIX_2_18 = "@withNix218@" != "false"  # type: ignore
-WITH_REEXEC = "@withReexec@" == "true"  # type: ignore
-WITH_SHELL_FILES = "@withShellFiles@" == "true"  # type: ignore
+WITH_NIX_2_18: Final[bool] = "@withNix218@" != "false"
+WITH_REEXEC: Final[bool] = "@withReexec@" == "true"
+WITH_SHELL_FILES: Final[bool] = "@withShellFiles@" == "true"

pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py

···
     "--service-type=exec",
     "--unit=nixos-rebuild-switch-to-configuration",
 ]
-logger = logging.getLogger(__name__)
+logger: Final = logging.getLogger(__name__)
 
 
 def build(

pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py

···
 import atexit
 import logging
 import os
+import re
 import shlex
 import subprocess
 from collections.abc import Sequence
···
 
 from . import tmpdir
 
-logger = logging.getLogger(__name__)
+logger: Final = logging.getLogger(__name__)
 
 SSH_DEFAULT_OPTS: Final = [
     "-o",
···
     "-o",
     "ControlPersist=60",
 ]
+
+type Args = Sequence[str | bytes | os.PathLike[str] | os.PathLike[bytes]]
 
 
 @dataclass(frozen=True)
···
 
 
 def run_wrapper(
-    args: Sequence[str | bytes | os.PathLike[str] | os.PathLike[bytes]],
+    args: Args,
     *,
     check: bool = True,
     extra_env: dict[str, str] | None = None,
···
     "Wrapper around `subprocess.run` that supports extra functionality."
     env = None
     process_input = None
+    run_args = args
+
     if remote:
         if extra_env:
             extra_env_args = [f"{env}={value}" for env, value in extra_env.items()]
···
                 process_input = remote.sudo_password + "\n"
             else:
                 args = ["sudo", *args]
-        args = [
+        run_args = [
             "ssh",
             *remote.opts,
             *SSH_DEFAULT_OPTS,
···
         if extra_env:
             env = os.environ | extra_env
         if sudo:
-            args = ["sudo", *args]
+            run_args = ["sudo", *run_args]
 
     logger.debug(
         "calling run with args=%r, kwargs=%r, extra_env=%r",
-        args,
+        run_args,
         kwargs,
         extra_env,
     )
 
     try:
         r = subprocess.run(
-            args,
+            run_args,
             check=check,
             env=env,
             input=process_input,
-            # Hope nobody is using NixOS with non-UTF8 encodings, but "surrogateescape"
-            # should still work in those systems.
+            # Hope nobody is using NixOS with non-UTF8 encodings, but
+            # "surrogateescape" should still work in those systems.
             text=True,
             errors="surrogateescape",
             **kwargs,
         )
 
         if kwargs.get("capture_output") or kwargs.get("stderr") or kwargs.get("stdout"):
-            logger.debug("captured output stdout=%r, stderr=%r", r.stdout, r.stderr)
+            logger.debug(
+                "captured output with stdout=%r, stderr=%r", r.stdout, r.stderr
+            )
 
         return r
+    except KeyboardInterrupt:
+        # sudo commands are activation only and unlikely to be long running
+        if remote and not sudo:
+            _kill_long_running_ssh_process(args, remote)
+        raise
     except subprocess.CalledProcessError:
         if sudo and remote and remote.sudo_password is None:
             logger.error(
···
                 + "--ask-sudo-password?"
             )
         raise
+
+
+# SSH does not send the signals to the process when running without usage of
+# pseudo-TTY (that causes a whole other can of worms), so if the process is
+# long running (e.g.: a build) this will result in the underlying process
+# staying alive.
+# See: https://stackoverflow.com/a/44354466
+# Issue: https://github.com/NixOS/nixpkgs/issues/403269
+def _kill_long_running_ssh_process(args: Args, remote: Remote) -> None:
+    logger.info("cleaning-up remote process, please wait...")
+
+    # We need to escape both the shell and regex here (since pkill interprets
+    # its arguments as regex)
+    quoted_args = re.escape(shlex.join(str(a) for a in args))
+    logger.debug("killing remote process using pkill with args=%r", quoted_args)
+    cleanup_interrupted = False
+
+    try:
+        r = subprocess.run(
+            [
+                "ssh",
+                *remote.opts,
+                *SSH_DEFAULT_OPTS,
+                remote.host,
+                "--",
+                "pkill",
+                "--signal",
+                "SIGINT",
+                "--full",
+                "--",
+                quoted_args,
+            ],
+            check=False,
+            capture_output=True,
+            text=True,
+        )
+        logger.debug(
+            "remote pkill captured output with stdout=%r, stderr=%r, returncode=%s",
+            r.stdout,
+            r.stderr,
+            r.returncode,
+        )
+    except KeyboardInterrupt:
+        cleanup_interrupted = True
+        raise
+    finally:
+        if cleanup_interrupted or r.returncode:
+            logger.warning(
+                "could not clean-up remote process, the command %s may still be running in host '%s'",
+                args,
+                remote.host,
+            )

pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py

···
     )
 
 
+@patch(get_qualified_name(p.subprocess.run), autospec=True)
+def test__kill_long_running_ssh_process(mock_run: Any) -> None:
+    p._kill_long_running_ssh_process(
+        [
+            "nix",
+            "--extra-experimental-features",
+            "nix-command flakes",
+            "build",
+            "/nix/store/la0c8nmpr9xfclla0n4f3qq9iwgdrq4g-nixos-system-sankyuu-nixos-25.05.20250424.f771eb4.drv^*",
+        ],
+        m.Remote("user@localhost", opts=[], sudo_password=None),
+    )
+    mock_run.assert_called_with(
+        [
+            "ssh",
+            *p.SSH_DEFAULT_OPTS,
+            "user@localhost",
+            "--",
+            "pkill",
+            "--signal",
+            "SIGINT",
+            "--full",
+            "--",
+            r"nix\ \-\-extra\-experimental\-features\ 'nix\-command\ flakes'\ build\ '/nix/store/la0c8nmpr9xfclla0n4f3qq9iwgdrq4g\-nixos\-system\-sankyuu\-nixos\-25\.05\.20250424\.f771eb4\.drv\^\*'",
+        ],
+        check=False,
+        capture_output=True,
+        text=True,
+    )
+
+
 def test_remote_from_name(monkeypatch: MonkeyPatch) -> None:
     monkeypatch.setenv("NIX_SSHOPTS", "")
     assert m.Remote.from_arg("user@localhost", None, False) == m.Remote(

pkgs/by-name/nu/nu_scripts/package.nix

···
 
 stdenvNoCC.mkDerivation {
   pname = "nu_scripts";
-  version = "0-unstable-2025-05-05";
+  version = "0-unstable-2025-05-15";
 
   src = fetchFromGitHub {
     owner = "nushell";
     repo = "nu_scripts";
-    rev = "4ecbb0e04e0a944145c86ec8bf3e4fc7ca3958a5";
-    hash = "sha256-ssqSZnc8YnCB/62eN9KQzf+cm686/NFKcj4M2sd0XxM=";
+    rev = "b2d512f6c67f68895a26136c6ce552281efbec6e";
+    hash = "sha256-iC5Qmyn9vDr4b1BWtJkC3pl2dOam2Se51+ENvRdXlvA=";
   };
 
   installPhase = ''

pkgs/by-name/nw/nwg-drawer/package.nix

···
 
 let
   pname = "nwg-drawer";
-  version = "0.6.5";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-drawer";
     rev = "v${version}";
-    hash = "sha256-fWh2htmLIM0IHRYOs8fzrjwq1IRLDJpWniY24BVFtFE=";
+    hash = "sha256-M0+4/lr79CYBy2+ysB1Wb1obD7B/Qi8MBwNhIsiIDak=";
   };
 
-  vendorHash = "sha256-iUFOWPr306CteR+5Cz/kE+XoG/qr3BBdM9duZm4TOU4=";
+  vendorHash = "sha256-1uZTZ7/p1l4Rue3mxlaMRSDfyARo94wR4KIKkQXBUMQ=";
 in
 buildGoModule {
   inherit

pkgs/by-name/op/openvpn3/package.nix

···
 stdenv.mkDerivation rec {
   pname = "openvpn3";
   # also update openvpn3-core
-  version = "24";
+  version = "24.1";
 
   src = fetchFromGitHub {
     owner = "OpenVPN";
     repo = "openvpn3-linux";
     tag = "v${version}";
-    hash = "sha256-e3NRLrznTEolTzMO+kGEh48MCrcEr8p7JG3hG889aK4=";
+    hash = "sha256-E6SBVPHmejXB18RuNCNq62yWOJslZfIjVbNUdRIk5Sw=";
     # `openvpn3-core` is a submodule.
     # TODO: make it into a separate package
     fetchSubmodules = true;

pkgs/by-name/or/ord/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "ord";
-  version = "0.23.1";
+  version = "0.23.2";
 
   src = fetchFromGitHub {
     owner = "ordinals";
     repo = "ord";
     rev = version;
-    hash = "sha256-jYu9NPvs7nwgiqMCvZlLQqoYESwjKAYlhJ9ehev70EY=";
+    hash = "sha256-p9WjZ8QsY5fvL91zPUKnK8p0ZJvAxzmPbN/UVWSNjqk=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-U5bGNgiy98PK2Le5BbzCOAajeEKb/zYTIID1uOE6p3c=";
+  cargoHash = "sha256-c3+yM7jJyIl2XpSOeqdeQP2OdRc7/t/epDTMoOa/66A=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/sa/sarif-fmt/package.nix

···
 }:
 rustPlatform.buildRustPackage rec {
   pname = "sarif-fmt";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-uQQ/UbmyPJbilxP2R+6KyBkf2dzGohN22xCCtU31y0s=";
+    hash = "sha256-Xc9uc//5wTBWJ89mcaC/4c8/xtTvnu8g2Aa1viUhluo=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-naABVC4z5tYfe/Y2Gw4wp2Ye9wIF0Wq7jqhelcRQY30=";
+  cargoHash = "sha256-h4g4+2yiqr3CTkSgv8fTHEVQwSunFfYFhIczSGA+M5U=";
 
   # `test_clippy` (the only test we enable) is broken on Darwin
   # because `--enable-profiler` is not enabled in rustc on Darwin

pkgs/by-name/sd/SDL2_classic/find-headers.patch

···
-diff --git a/sdl2-config.cmake.in b/sdl2-config.cmake.in
-index db864aab9..b94e16043 100644
---- a/sdl2-config.cmake.in
-+++ b/sdl2-config.cmake.in
-@@ -26,7 +26,9 @@ set_and_check(SDL2_EXEC_PREFIX    "${exec_prefix}")
- set_and_check(SDL2_BINDIR         "${bindir}")
- set_and_check(SDL2_INCLUDE_DIR    "${includedir}/SDL2")
- set_and_check(SDL2_LIBDIR         "${libdir}")
--set(SDL2_INCLUDE_DIRS             "${includedir};${SDL2_INCLUDE_DIR}")
-+
-+set(SDL2_INCLUDE_DIRS "${includedir};${SDL2_INCLUDE_DIR}" $ENV{SDL2_PATH})
-+separate_arguments(SDL2_INCLUDE_DIRS)
- 
- set(SDL2_LIBRARIES SDL2::SDL2)
- set(SDL2_STATIC_LIBRARIES SDL2::SDL2-static)
-diff --git a/sdl2-config.in b/sdl2-config.in
-index f6eca7668..c0cd94590 100644
---- a/sdl2-config.in
-+++ b/sdl2-config.in
-@@ -46,7 +46,11 @@ while test $# -gt 0; do
-       echo @SDL_VERSION@
-       ;;
-     --cflags)
--      echo -I@includedir@/SDL2 @SDL_CFLAGS@
-+      SDL_CFLAGS=""
-+      for i in @includedir@/SDL2 $SDL2_PATH; do
-+        SDL_CFLAGS="$SDL_CFLAGS -I$i"
-+      done
-+      echo $SDL_CFLAGS @SDL_CFLAGS@
-       ;;
- @ENABLE_SHARED_TRUE@    --libs)
- @ENABLE_SHARED_TRUE@      echo -L@libdir@ @SDL_RLD_FLAGS@ @SDL_LIBS@

pkgs/by-name/sd/SDL2_classic/package.nix

···
-{
-  lib,
-  stdenv,
-  config,
-  fetchFromGitHub,
-  nix-update-script,
-  pkg-config,
-  mesa,
-  libGLSupported ? lib.elem stdenv.hostPlatform.system mesa.meta.platforms,
-  openglSupport ? libGLSupported,
-  libGL,
-  alsaSupport ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAndroid,
-  alsa-lib,
-  x11Support ? !stdenv.hostPlatform.isWindows && !stdenv.hostPlatform.isAndroid,
-  libX11,
-  xorgproto,
-  libICE,
-  libXi,
-  libXScrnSaver,
-  libXcursor,
-  libXinerama,
-  libXext,
-  libXxf86vm,
-  libXrandr,
-  waylandSupport ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAndroid,
-  wayland,
-  wayland-protocols,
-  wayland-scanner,
-  drmSupport ? false,
-  libdrm,
-  libgbm,
-  libxkbcommon,
-  dbusSupport ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAndroid,
-  dbus,
-  udevSupport ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAndroid,
-  udev,
-  ibusSupport ? false,
-  ibus,
-  libdecorSupport ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAndroid,
-  libdecor,
-  pipewireSupport ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAndroid,
-  pipewire, # NOTE: must be built with SDL2 without pipewire support
-  pulseaudioSupport ?
-    config.pulseaudio or stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAndroid,
-  libpulseaudio,
-  audiofile,
-  libiconv,
-  withStatic ? stdenv.hostPlatform.isMinGW,
-  # passthru.tests
-  testers,
-  SDL2_classic_ttf,
-  SDL2_classic_mixer,
-  SDL2_classic_image,
-}:
-
-# NOTE: When editing this expression see if the same change applies to
-# SDL expression too
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "SDL2";
-  version = "2.32.6";
-
-  src = fetchFromGitHub {
-    owner = "libsdl-org";
-    repo = "SDL";
-    rev = "release-${finalAttrs.version}";
-    hash = "sha256-sXlW+ivDRCNMcZDzZEfOPGvFGU0aE4n/fO+Wxym6GGw=";
-  };
-  dontDisableStatic = if withStatic then 1 else 0;
-  outputs = [
-    "out"
-    "dev"
-  ];
-  outputBin = "dev"; # sdl-config
-
-  patches = [
-    # `sdl2-config --cflags` from Nixpkgs returns include path to just SDL2.
-    # On a normal distro this is enough for includes from all SDL2* packages to work,
-    # but on NixOS they're spread across different paths.
-    # This patch + the setup-hook will ensure that `sdl2-config --cflags` works correctly.
-    ./find-headers.patch
-  ];
-
-  postPatch = ''
-    # Fix running wayland-scanner for the build platform when cross-compiling.
-    # See comment here: https://github.com/libsdl-org/SDL/issues/4860#issuecomment-1119003545
-    substituteInPlace configure \
-      --replace '$(WAYLAND_SCANNER)' 'wayland-scanner'
-  '';
-
-  strictDeps = true;
-
-  depsBuildBuild = [ pkg-config ];
-
-  nativeBuildInputs =
-    [ pkg-config ]
-    ++ lib.optionals waylandSupport [
-      wayland
-      wayland-scanner
-    ];
-
-  dlopenPropagatedBuildInputs =
-    [ ]
-    # Propagated for #include <GLES/gl.h> in SDL_opengles.h.
-    ++ lib.optional (openglSupport && !stdenv.hostPlatform.isDarwin) libGL
-    # Propagated for #include <X11/Xlib.h> and <X11/Xatom.h> in SDL_syswm.h.
-    ++ lib.optionals x11Support [ libX11 ];
-
-  propagatedBuildInputs =
-    lib.optionals x11Support [ xorgproto ] ++ finalAttrs.dlopenPropagatedBuildInputs;
-
-  dlopenBuildInputs =
-    lib.optionals alsaSupport [
-      alsa-lib
-      audiofile
-    ]
-    ++ lib.optional dbusSupport dbus
-    ++ lib.optional libdecorSupport libdecor
-    ++ lib.optional pipewireSupport pipewire
-    ++ lib.optional pulseaudioSupport libpulseaudio
-    ++ lib.optional udevSupport udev
-    ++ lib.optionals waylandSupport [
-      wayland
-      libxkbcommon
-    ]
-    ++ lib.optionals x11Support [
-      libICE
-      libXi
-      libXScrnSaver
-      libXcursor
-      libXinerama
-      libXext
-      libXrandr
-      libXxf86vm
-    ]
-    ++ lib.optionals drmSupport [
-      libdrm
-      libgbm
-    ];
-
-  buildInputs =
-    [ libiconv ]
-    ++ finalAttrs.dlopenBuildInputs
-    ++ lib.optional ibusSupport ibus
-    ++ lib.optionals waylandSupport [ wayland-protocols ];
-
-  enableParallelBuilding = true;
-
-  configureFlags =
-    [ "--disable-oss" ]
-    ++ lib.optional (!x11Support) "--without-x"
-    ++ lib.optional alsaSupport "--with-alsa-prefix=${alsa-lib.out}/lib"
-    ++ lib.optional stdenv.hostPlatform.isWindows "--disable-video-opengles"
-    ++ lib.optional stdenv.hostPlatform.isDarwin "--disable-sdltest";
-
-  # We remove libtool .la files when static libs are requested,
-  # because they make the builds of downstream libs like `SDL_tff`
-  # fail with `cannot find -lXext, `-lXcursor` etc. linker errors
-  # because the `.la` files are not pruned if static libs exist
-  # (see https://github.com/NixOS/nixpkgs/commit/fd97db43bcb05e37f6bb77f363f1e1e239d9de53)
-  # and they also don't carry the necessary `-L` paths of their
-  # X11 dependencies.
-  # For static linking, it is better to rely on `pkg-config` `.pc`
-  # files.
-  postInstall = ''
-    if [ "$dontDisableStatic" -eq "1" ]; then
-      rm $out/lib/*.la
-    else
-      rm $out/lib/*.a
-    fi
-    moveToOutput bin/sdl2-config "$dev"
-  '';
-
-  # SDL is weird in that instead of just dynamically linking with
-  # libraries when you `--enable-*` (or when `configure` finds) them
-  # it `dlopen`s them at runtime. In principle, this means it can
-  # ignore any missing optional dependencies like alsa, pulseaudio,
-  # some x11 libs, wayland, etc if they are missing on the system
-  # and/or work with wide array of versions of said libraries. In
-  # nixpkgs, however, we don't need any of that. Moreover, since we
-  # don't have a global ld-cache we have to stuff all the propagated
-  # libraries into rpath by hand or else some applications that use
-  # SDL API that requires said libraries will fail to start.
-  #
-  # You can grep SDL sources with `grep -rE 'SDL_(NAME|.*_SYM)'` to
-  # list the symbols used in this way.
-  postFixup =
-    let
-      rpath = lib.makeLibraryPath (
-        finalAttrs.dlopenPropagatedBuildInputs ++ finalAttrs.dlopenBuildInputs
-      );
-    in
-    lib.optionalString (stdenv.hostPlatform.extensions.sharedLibrary == ".so") ''
-      for lib in $out/lib/*.so* ; do
-        if ! [[ -L "$lib" ]]; then
-          patchelf --set-rpath "$(patchelf --print-rpath $lib):${rpath}" "$lib"
-        fi
-      done
-    '';
-
-  setupHook = ./setup-hook.sh;
-
-  passthru = {
-    inherit openglSupport;
-    updateScript = nix-update-script {
-      extraArgs = [
-        "--version-regex"
-        "release-(2\\..*)"
-      ];
-    };
-    tests = {
-      pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      inherit
-        SDL2_classic_ttf
-        SDL2_classic_mixer
-        SDL2_classic_image
-        ;
-    };
-  };
-
-  meta = with lib; {
-    description = "Cross-platform multimedia library";
-    mainProgram = "sdl2-config";
-    homepage = "http://www.libsdl.org/";
-    changelog = "https://github.com/libsdl-org/SDL/releases/tag/release-${finalAttrs.version}";
-    license = licenses.zlib;
-    platforms = platforms.all;
-    teams = [ lib.teams.sdl ];
-    pkgConfigModules = [ "sdl2" ];
-  };
-})

pkgs/by-name/sd/SDL2_classic/setup-hook.sh

···
-addSDL2Path () {
-  if [ -e "$1/include/SDL2" ]; then
-    export SDL2_PATH="${SDL2_PATH-}${SDL2_PATH:+ }$1/include/SDL2"
-  fi
-}
-
-addEnvHooks "$hostOffset" addSDL2Path

pkgs/by-name/sd/SDL2_classic_image/package.nix

···
-{
-  SDL2_image,
-  SDL2_classic,
-  enableSTB ? true,
-}:
-
-(SDL2_image.override {
-  SDL2 = SDL2_classic;
-  inherit enableSTB;
-}).overrideAttrs
-  {
-    pname = "SDL2_classic_image";
-  }

pkgs/by-name/sd/SDL2_classic_mixer/package.nix

···
-{
-  SDL2_mixer,
-  SDL2_classic,
-}:
-
-(SDL2_mixer.override {
-  SDL2 = SDL2_classic;
-}).overrideAttrs
-  {
-    pname = "SDL2_classic_mixer";
-  }

pkgs/by-name/sd/SDL2_classic_ttf/package.nix

···
-{
-  SDL2_ttf,
-  SDL2_classic,
-}:
-
-(SDL2_ttf.override {
-  SDL2 = SDL2_classic;
-}).overrideAttrs
-  {
-    pname = "SDL2_classic_ttf";
-  }

pkgs/by-name/sh/shellcheck-sarif/package.nix

···
 }:
 rustPlatform.buildRustPackage rec {
   pname = "shellcheck-sarif";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-cgcvl/nlnJtYzTfxbJHJ967zFH8KtWTMZPKGVpH66z0=";
+    hash = "sha256-G69DiDl78vkPuLodsRTL7dbbIFtNNF/XWuLZpCHKJws=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-eJzhaLQCniVUmsFgvzLE9Aw1nUq+P9m9wjSH3l8vQxo=";
+  cargoHash = "sha256-ZA7l7fmQG1wjT8oLVp6w2okPlwfNGQw/7qrH3rRS+0o=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;

pkgs/by-name/si/sing-box/package.nix

···
 
 buildGoModule rec {
   pname = "sing-box";
-  version = "1.11.10";
+  version = "1.11.11";
 
   src = fetchFromGitHub {
     owner = "SagerNet";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-GcoAxfFH/eP97E7tN//LbNCSbEASfzDL5OYHyL54eh8=";
+    hash = "sha256-hdYYjKBXnTqScYTUCfMmXozDD8GtIorLXnsU2Fmwg/c=";
   };
 
-  vendorHash = "sha256-7VfAFkdI4XFkMp2GJIzPFSXyUWNwT3o+EN5gI8U/wIQ=";
+  vendorHash = "sha256-/0pwsZbMbyAFXCrukbNf2RmQjQJ1E/ZUwzrC+5NEZcc=";
 
   tags = [
     "with_quic"

pkgs/by-name/sq/sqldef/package.nix

···
 
 buildGoModule rec {
   pname = "sqldef";
-  version = "1.0.6";
+  version = "1.0.7";
 
   src = fetchFromGitHub {
     owner = "sqldef";
     repo = "sqldef";
     rev = "v${version}";
-    hash = "sha256-tCKJ0iX0cWWdw+RSH15KTVDEcrZhbfZg+dgt/swDSJE=";
+    hash = "sha256-FDJeRIrx2LS6TQAlm9Kj13O4fccnRG6mYcLwTrOGrOI=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-1LpDM4XYV2k7d8vFx97AuZSVpClTvNU5ezXnbhOkkP0=";
+  vendorHash = "sha256-SkYRt/w8/YC6LGoADVRdyYdQw/Lves1rd4tl8lYNSSs=";
 
   ldflags = [
     "-s"

pkgs/by-name/ts/tsukimi/package.nix

···
 }:
 stdenv.mkDerivation rec {
   pname = "tsukimi";
-  version = "0.20.0";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "tsukinaha";
     repo = "tsukimi";
     tag = "v${version}";
-    hash = "sha256-OxRxl/+JP3eqxc5b0pb6QbAAHrZgHrq1cawas2UrUro=";
+    hash = "sha256-FmxNOMYHoQK//v4ZGvJ6vIHKYgMfQm7LTwQV9iEFo0A=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src;
-    hash = "sha256-kt3otu5N3KAzJT992v80Mbgr0sOoPnonc1+pu5ANIxE=";
+    hash = "sha256-iH7vCZhCN2/gu2EC+YG/LUL9N/HMMnj7qHqXUdrlAh8=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/tu/tusd/package.nix

···
 
   vendorHash = "sha256-YununGyB72zE0tmqO3BREJeMTjCuy/1fhPHC5r8OLjg=";
 
+  ldflags = [
+    "-X github.com/tus/tusd/v2/cmd/tusd/cli.VersionName=v${version}"
+  ];
+
   # Tests need the path to the binary:
   # https://github.com/tus/tusd/blob/0e52ad650abed02ec961353bb0c3c8bc36650d2c/internal/e2e/e2e_test.go#L37
   preCheck = ''

pkgs/by-name/tw/twitch-dl/package.nix

···
 
 python3Packages.buildPythonApplication rec {
   pname = "twitch-dl";
-  version = "3.0.0";
+  version = "3.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ihabunek";
     repo = "twitch-dl";
     tag = version;
-    hash = "sha256-/TlJG6Mh8/Ax4bKKR/plhMMY2x6YXwcFP6zjClOPaD8=";
+    hash = "sha256-Nn/Nwd1KvrkR+uGp8HmRGeBC7E0/Y1EVMpJAp7UDj7Q=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ud/udevCheckHook/hook.sh

···
+# shellcheck shell=bash
+
+udevCheckHook() {
+    runHook preUdevCheck
+    echo Executing udevCheckPhase
+
+    # as per nixos/modules/services/hardware/udev.nix:
+    # - both /lib and /etc is valid paths for udev rules
+    # - udev rules are expected to be part of the $bin output
+    # However, not all udev rules are actually in $bin (some are in $lib or $out).
+    # This means we have to actually check all outputs here.
+    for output in $(getAllOutputNames); do
+        for path in etc lib ; do
+            if [ -d "${!output}/$path/udev/rules.d" ]; then
+                @udevadm@ verify --resolve-names=never --no-style "${!output}/$path/udev/rules.d"
+            fi
+        done
+    done
+
+    runHook postUdevCheck
+    echo Finished udevCheckPhase
+}
+
+if [[ -z "${dontUdevCheck-}" ]]; then
+    echo "Using udevCheckHook"
+    preInstallCheckHooks+=(udevCheckHook)
+fi

pkgs/by-name/ud/udevCheckHook/package.nix

···
+{
+  lib,
+  makeSetupHook,
+  systemdMinimal,
+}:
+
+makeSetupHook {
+  name = "udev-check-hook";
+  substitutions = {
+    udevadm = lib.getExe' systemdMinimal "udevadm";
+  };
+  meta = {
+    description = "check validity of udev rules in outputs";
+    maintainers = with lib.maintainers; [ grimmauld ];
+  };
+} ./hook.sh

pkgs/by-name/us/usacloud/package.nix

···
 
 buildGoModule rec {
   pname = "usacloud";
-  version = "1.14.1";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     owner = "sacloud";
     repo = "usacloud";
     tag = "v${version}";
-    hash = "sha256-bIVC0pa+54a/OpGKOM3LH7IMZnuYDvfGOMxcIwhHI7U=";
+    hash = "sha256-HrcUoRqjbP6E/C9PfFYw73XaA5ysNLYqsiifXVnlhe0=";
   };
 
-  vendorHash = "sha256-m89iw5nk34KkCh8vlnKcwoPQXprUKzETYQNzi2CtX4c=";
+  vendorHash = "sha256-OIS0QV0t4Y06/B8L48IlftWjzahptaa0PAcxEcRdDPo=";
 
   ldflags = [
     "-s"

pkgs/by-name/ve/vector/package.nix

···
 
 let
   pname = "vector";
-  version = "0.46.1";
+  version = "0.47.0";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
···
     owner = "vectordotdev";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ouPCBaG/wwjIyzXA5PgBRpAtOJ5IuOrS+k4p6/KRzzY=";
+    hash = "sha256-09CjhSckptXbbTzBneo5aQ76YwLPSacRlsMpexsw54c=";
   };
 
-  useFetchCargoVendor = true;
-  cargoHash = "sha256-Bl/dgkoF9Hx1hLt9+kZiyK42GNr+5UGJYy5QZOnHDV4=";
+  cargoHash = "sha256-9cCqdi65C4JCMP743nhrNmBlJsIFiNPGguyVEEJpGww=";
 
   nativeBuildInputs =
     [

pkgs/by-name/ve/veryl/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "veryl";
-  version = "0.15.0";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "veryl-lang";
     repo = "veryl";
     rev = "v${version}";
-    hash = "sha256-PeRz44agIKDPsgUhjPgm1Pn1oJb7Epyw0oj3xPCkj4k=";
+    hash = "sha256-KlW5GC5fgUnS6YAb01VEaKv48+yu8VqgAe/5QsilYjs=";
     fetchSubmodules = true;
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-PD1S9h4cGGgfRBB0iZzY7GRTeclRhwWLrxvNVEs8OJY=";
+  cargoHash = "sha256-HKDkV2eDjhfuky2ORdKwbyBa/kt1gEqK55AibKg5VYE=";
 
   nativeBuildInputs = [
     pkg-config
···
     "--skip=path::directory_target"
     "--skip=path::source_directory"
     "--skip=path::source_target"
+    "--skip=path::rootdir_directory_directory"
+    "--skip=path::rootdir_directory_target"
+    "--skip=path::rootdir_source_directory"
+    "--skip=path::rootdir_source_target"
+    "--skip=path::subdir_directory_directory"
+    "--skip=path::subdir_directory_target"
+    "--skip=path::subdir_source_directory"
+    "--skip=path::subdir_source_target"
   ];
 
   meta = {

pkgs/by-name/wa/wait4x/package.nix

···
 }:
 let
   pname = "wait4x";
-  version = "3.3.0";
+  version = "3.3.1";
 in
 buildGoModule {
   inherit pname version;
···
     owner = "wait4x";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-QmuBoUHOZf6VKrh00BXFxT2e+gJL1gyv9BnhGaWVAD0=";
+    hash = "sha256-3s+ug4KqFv1P55eqNfAB2jbSPVzySxlHmkDMuuVlJcQ=";
   };
 
-  vendorHash = "sha256-EqJDw88BqKfIUE/YoDNoI249covv5bzEcx9ykfUkik8=";
+  vendorHash = "sha256-dN7R2d7roA6H9wIz2sBaWctD8K6M8nbQbwPc3t/7rlk=";
 
   # Tests make network access
   doCheck = false;

pkgs/by-name/yt/ytdownloader/package.nix

···
 
 buildNpmPackage rec {
   pname = "ytDownloader";
-  version = "3.19.0";
+  version = "3.19.1";
 
   src = fetchFromGitHub {
     owner = "aandrew-me";
     repo = "ytDownloader";
     tag = "v${version}";
-    hash = "sha256-Oj462x1oyhaLFbVNr90hKmg0S+BZXUv1DyNdxsc2L7Y=";
+    hash = "sha256-EweQgKA0CNgiO7q+WTLsUJHpiuRJBQox2FEgjh6CHDQ=";
   };
 
-  npmDepsHash = "sha256-ZJdPfNndYOWzvJpgra16/tCuWTvPLd4ZhSFualJB00E=";
+  npmDepsHash = "sha256-moOxzvzBFNqEe2xd2jVyotxaSsIi+F7J6Dwvqp2Bs08=";
 
   nativeBuildInputs = [
     copyDesktopItems

pkgs/by-name/za/zarf/package.nix

···
 
 buildGoModule rec {
   pname = "zarf";
-  version = "0.41.0";
+  version = "0.54.0";
 
   src = fetchFromGitHub {
-    owner = "defenseunicorns";
+    owner = "zarf-dev";
     repo = "zarf";
     rev = "v${version}";
     hash = "sha256-rY9xWqJ+2Yfs6VRHTF89LmuEruAavDI7MgBm4UFEuBs=";
···
     "-s"
     "-w"
     "-X"
-    "github.com/defenseunicorns/zarf/src/config.CLIVersion=${src.rev}"
+    "github.com/zarf-dev/zarf/src/config.CLIVersion=${src.rev}"
     "-X"
     "k8s.io/component-base/version.gitVersion=v0.0.0+zarf${src.rev}"
     "-X"
···
   meta = with lib; {
     description = "DevSecOps for Air Gap & Limited-Connection Systems. https://zarf.dev";
     mainProgram = "zarf";
-    homepage = "https://github.com/defenseunicorns/zarf.git";
+    homepage = "https://zarf.dev";
     license = licenses.asl20;
     maintainers = with maintainers; [ ragingpastry ];
   };

pkgs/by-name/zk/zk/package.nix

···
 
 buildGoModule rec {
   pname = "zk";
-  version = "0.15.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "zk-org";
     repo = "zk";
     rev = "v${version}";
-    sha256 = "sha256-aFpn3luIp5tMp9jpBxVCmU+IU9eJg3/5UZFIklauFjI=";
+    sha256 = "sha256-h4q3GG4DPPEJk2G5JDbUhnHpqEdMAkGYSMs9TS5Goco=";
   };
 
   vendorHash = "sha256-2PlaIw7NaW4pAVIituSVWhssSBKjowLOLuBV/wz829I=";

pkgs/development/libraries/openssl/default.nix

···
         ++ lib.optional static "etc";
       setOutputFlags = false;
       separateDebugInfo =
-        !stdenv.hostPlatform.isDarwin && !(stdenv.hostPlatform.useLLVM or false) && stdenv.cc.isGNU;
+        !stdenv.hostPlatform.isDarwin
+        && !stdenv.hostPlatform.isAndroid
+        && !(stdenv.hostPlatform.useLLVM or false)
+        && stdenv.cc.isGNU;
 
       nativeBuildInputs =
         lib.optional (!stdenv.hostPlatform.isWindows) makeBinaryWrapper

pkgs/development/python-modules/albumentations/default.nix

···
 
 buildPythonPackage rec {
   pname = "albumentations";
-  version = "2.0.6";
+  version = "2.0.7";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
···
     owner = "albumentations-team";
     repo = "albumentations";
     tag = version;
-    hash = "sha256-n00WE8RwwLx/vHRkIrOhrampFPVkPhAkS6zZ4XjEHTk=";
+    hash = "sha256-3obvlYj+UwniEf+NokJDNqMysCGFXcJdI1Wckdfng2Y=";
   };
 
   patches = [
···
   meta = {
     description = "Fast image augmentation library and easy to use wrapper around other libraries";
     homepage = "https://github.com/albumentations-team/albumentations";
-    changelog = "https://github.com/albumentations-team/albumentations/releases/tag/${version}";
+    changelog = "https://github.com/albumentations-team/albumentations/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ natsukium ];
   };

pkgs/development/python-modules/apache-beam/default.nix

···
   yapf,
 
   # dependencies
-  cloudpickle,
   crcmod,
   dill,
   fastavro,
···
 
 buildPythonPackage rec {
   pname = "apache-beam";
-  version = "2.63.0";
+  version = "2.65.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "apache";
     repo = "beam";
     tag = "v${version}";
-    hash = "sha256-ixJstawgU3UGtNKVzkwMCLkdY7QKTbxNe6JJ7vG+vmA=";
+    hash = "sha256-vDW0PVNep+egIZBe4t8IPwLgsQDmoO4rrA4wUoAHzfg=";
   };
 
   pythonRelaxDeps = [
···
   ];
 
   dependencies = [
-    cloudpickle
     crcmod
     dill
     fastavro

pkgs/development/python-modules/commitizen/default.nix

···
 
 buildPythonPackage rec {
   pname = "commitizen";
-  version = "4.7.0";
+  version = "4.7.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
···
     owner = "commitizen-tools";
     repo = "commitizen";
     tag = "v${version}";
-    hash = "sha256-fCQtSzOUezd3UE8bktn2cw4qwnl2pM6L7bBgKKFq5AM=";
+    hash = "sha256-SSj9K1ujwi/KNzugB0mIo0VMOz3WbCQ6X07ztB0JJsU=";
   };
 
   pythonRelaxDeps = [

pkgs/development/python-modules/django-admin-sortable2/default.nix

···
 }:
 let
   pname = "django-admin-sortable2";
-  version = "2.2.6";
+  version = "2.2.8";
 
   src = fetchFromGitHub {
     owner = "jrief";
     repo = "django-admin-sortable2";
     tag = version;
-    hash = "sha256-MIxZ33Q8dHo102zvQqMiOlxtPjkenQQYTRyXJOHdCqE=";
+    hash = "sha256-T5dppM/o305GCg5uU7re/FdjhXFUyiH/DO2JTVf6Xgg=";
   };
 
   assets = buildNpmPackage {
···
   meta = {
     description = "Generic drag-and-drop ordering for objects in the Django admin interface";
     homepage = "https://github.com/jrief/django-admin-sortable2";
-    changelog = "https://github.com/jrief/django-admin-sortable2/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/jrief/django-admin-sortable2/blob/${src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ sephi ];
   };

pkgs/development/python-modules/fastbencode/default.nix

···
 
 buildPythonPackage rec {
   pname = "fastbencode";
-  version = "0.3.1";
+  version = "0.3.2";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-X+DLfRc2iRr2HSreQM6UiUHUbpCLFvU4P1XxJ4SNoZc=";
+    hash = "sha256-o0wyxQSw7J3hpJk0btJJMjWetGI0sotwl1pQ/fqhSrU=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/gspread/default.nix

···
 
 buildPythonPackage rec {
   pname = "gspread";
-  version = "6.2.0";
+  version = "6.2.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
···
     owner = "burnash";
     repo = "gspread";
     tag = "v${version}";
-    hash = "sha256-DTKSH8FtzOXlB7TzNqahDm8PY3ZarpZg8GYQ1kcdfdg=";
+    hash = "sha256-j7UNti5N8c1mjw+1qTPIRCWJ6M4Ur0P9sG1uJnp170M=";
   };
 
   nativeBuildInputs = [ flit-core ];

pkgs/development/python-modules/hyperscan/default.nix

···
 in
 buildPythonPackage rec {
   pname = "hyperscan";
-  version = "0.7.9";
+  version = "0.7.13";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "darvid";
     repo = "python-hyperscan";
     tag = "v${version}";
-    hash = "sha256-tf3dQgY0p+J6GIS8pB3+kvomNVYcbMJ+72T8IVbrnrU=";
+    hash = "sha256-l97UXuM37WK3XRSoIfQzobkM+3WYp6JUtemn/28mMNk=";
   };
 
   env.CMAKE_ARGS = "-DHS_SRC_ROOT=${pkgs.hyperscan.src} -DHS_BUILD_LIB_ROOT=${lib-deps}/lib";

pkgs/development/python-modules/jupyter-collaboration-ui/default.nix

···
   # no tests
   doCheck = false;
 
-  passthru.tests = jupyter-collaboration.tests;
+  passthru.tests = jupyter-collaboration;
 
   meta = {
     description = "JupyterLab/Jupyter Notebook 7+ extension providing user interface integration for real time collaboration";

pkgs/development/python-modules/jupyter-collaboration/default.nix

···
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
 
   # build-system
   hatchling,
···
   jupyter-collaboration-ui,
   jupyter-docprovider,
   jupyter-server-ydoc,
+  jupyterlab,
 
   # tests
-  callPackage,
+  dirty-equals,
+  httpx-ws,
+  pytest-jupyter,
+  pytest-timeout,
+  pytestCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage rec {
   pname = "jupyter-collaboration";
-  version = "3.1.0";
+  version = "4.0.2";
   pyproject = true;
 
-  src = fetchPypi {
-    pname = "jupyter_collaboration";
-    inherit version;
-    hash = "sha256-BDmG5vzdikFh342XFqk92q/smidKqbUDWEx6gORh7p8=";
+  src = fetchFromGitHub {
+    owner = "jupyterlab";
+    repo = "jupyter-collaboration";
+    tag = "v${version}";
+    hash = "sha256-BCvTtrlP45YC9G/m/e8Nvbls7AugIaQzO2Gect1EmGE=";
   };
 
+  sourceRoot = "${src.name}/projects/jupyter-collaboration";
+
   build-system = [ hatchling ];
 
   dependencies = [
     jupyter-collaboration-ui
     jupyter-docprovider
     jupyter-server-ydoc
+    jupyterlab
   ];
 
   pythonImportsCheck = [ "jupyter_collaboration" ];
 
-  # no tests
-  doCheck = false;
+  nativeCheckInputs = [
+    dirty-equals
+    httpx-ws
+    pytest-jupyter
+    pytest-timeout
+    pytestCheckHook
+    writableTmpDirAsHomeHook
+  ];
+
+  pytestFlagsArray = [
+    # pytest.PytestCacheWarning: could not create cache path /build/source/.pytest_cache/v/cache/nodeids: [Errno 13] Permission denied: '/build/source/pytest-cache-files-plraagdr'
+    "-p"
+    "no:cacheprovider"
+    "$src/tests"
+  ];
 
-  passthru.tests = callPackage ./test.nix { };
+  __darwinAllowLocalNetworking = true;
 
   meta = {
     description = "JupyterLab Extension enabling Real-Time Collaboration";

pkgs/development/python-modules/jupyter-collaboration/test.nix

···
-{
-  stdenvNoCC,
-  fetchFromGitHub,
-  jupyter-collaboration,
-  pytest-jupyter,
-  pytestCheckHook,
-  websockets,
-}:
-stdenvNoCC.mkDerivation (finalAttrs: {
-  pname = "jupyter-collaboration-test";
-  inherit (jupyter-collaboration) version;
-
-  src = fetchFromGitHub {
-    owner = "jupyterlab";
-    repo = "jupyter-collaboration";
-    rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-6hDYB1uC0WraB37s9EKLJF7jyFu0B3xLocuLYyKj4hs=";
-  };
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail "timeout = 300" ""
-  '';
-
-  installPhase = ''
-    touch $out
-  '';
-
-  env.HOME = "$TMPDIR";
-
-  doCheck = true;
-
-  nativeCheckInputs = [
-    jupyter-collaboration
-    pytest-jupyter
-    pytestCheckHook
-    websockets
-  ];
-})

pkgs/development/python-modules/jupyter-docprovider/default.nix

···
 
 buildPythonPackage rec {
   pname = "jupyter-docprovider";
-  version = "2.0.1";
+  version = "2.0.2";
   pyproject = true;
 
   src = fetchPypi {
     pname = "jupyter_docprovider";
     inherit version;
-    hash = "sha256-4pyF5HDQ7dP32R+O3QN8DWtvJpQxBBbjWXaRAfs10b4=";
+    hash = "sha256-vWgNlg6Ydw4va3DlEx3A/M9uE0t54GTrV1ljmlX44TU=";
   };
 
   postPatch = ''
···
   # no tests
   doCheck = false;
 
-  passthru.tests = jupyter-collaboration.tests;
+  passthru.tests = jupyter-collaboration;
 
   meta = {
     description = "JupyterLab/Jupyter Notebook 7+ extension integrating collaborative shared models";

pkgs/development/python-modules/jupyter-server-ydoc/default.nix

···
   # no tests
   doCheck = false;
 
-  passthru.tests = jupyter-collaboration.tests;
+  passthru.tests = jupyter-collaboration;
 
   meta = {
     description = "Jupyter-server extension integrating collaborative shared models";

pkgs/development/python-modules/langchain-community/default.nix

···
   disabledTests = [
     # requires bs4, aka BeautifulSoup
     "test_importable_all"
+    # flaky
+    "test_llm_caching_async"
   ];
 
   disabledTestPaths = [

pkgs/development/python-modules/mlxtend/0001-StackingCVClassifier-fit-ensure-compatibility-with-s.patch

···
+From 1fb59eb42f4bef229b953de313c7e78f0857ea42 Mon Sep 17 00:00:00 2001
+From: Philip Wilk <[e-mail]>
+Date: Sun, 23 Mar 2025 16:14:51 +0000
+Subject: [PATCH] StackingCVClassifier/fit: ensure compatibility with
+ *scikit-learn* versions 1.4 and above by dynamically selecting between
+ `fit_params` and `params`
+
+---
+ mlxtend/classifier/stacking_cv_classification.py | 5 ++++-
+ mlxtend/regressor/stacking_cv_regression.py      | 6 +++++-
+ 2 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/mlxtend/classifier/stacking_cv_classification.py b/mlxtend/classifier/stacking_cv_classification.py
+index 5bff6907..f4c45b8c 100644
+--- a/mlxtend/classifier/stacking_cv_classification.py
++++ b/mlxtend/classifier/stacking_cv_classification.py
+@@ -15,6 +15,7 @@ from sklearn.base import TransformerMixin, clone
+ from sklearn.model_selection import cross_val_predict
+ from sklearn.model_selection._split import check_cv
+ from sklearn.preprocessing import LabelEncoder
++from sklearn import __version__ as sklearn_version
+ 
+ from ..externals.estimator_checks import check_is_fitted
+ from ..externals.name_estimators import _name_estimators
+@@ -266,6 +267,8 @@ class StackingCVClassifier(
+             if self.verbose > 1:
+                 print(_name_estimators((model,))[0][1])
+ 
++            param_name = "fit_params" if sklearn_version < "1.4" else "params"
++
+             prediction = cross_val_predict(
+                 model,
+                 X,
+@@ -273,10 +276,10 @@ class StackingCVClassifier(
+                 groups=groups,
+                 cv=final_cv,
+                 n_jobs=self.n_jobs,
+-                fit_params=fit_params,
+                 verbose=self.verbose,
+                 pre_dispatch=self.pre_dispatch,
+                 method="predict_proba" if self.use_probas else "predict",
++                **{param_name: fit_params},
+             )
+ 
+             if not self.use_probas:
+diff --git a/mlxtend/regressor/stacking_cv_regression.py b/mlxtend/regressor/stacking_cv_regression.py
+index a1faf2ff..d2fb1c49 100644
+--- a/mlxtend/regressor/stacking_cv_regression.py
++++ b/mlxtend/regressor/stacking_cv_regression.py
+@@ -19,6 +19,7 @@ from sklearn.base import RegressorMixin, TransformerMixin, clone
+ from sklearn.model_selection import cross_val_predict
+ from sklearn.model_selection._split import check_cv
+ from sklearn.utils import check_X_y
++from sklearn import __version__ as sklearn_version
+ 
+ from ..externals.estimator_checks import check_is_fitted
+ from ..externals.name_estimators import _name_estimators
+@@ -211,6 +212,9 @@ class StackingCVRegressor(_BaseXComposition, RegressorMixin, TransformerMixin):
+             fit_params = None
+         else:
+             fit_params = dict(sample_weight=sample_weight)
++
++        param_name = "fit_params" if sklearn_version < "1.4" else "params"
++
+         meta_features = np.column_stack(
+             [
+                 cross_val_predict(
+@@ -221,8 +225,8 @@ class StackingCVRegressor(_BaseXComposition, RegressorMixin, TransformerMixin):
+                     cv=kfold,
+                     verbose=self.verbose,
+                     n_jobs=self.n_jobs,
+-                    fit_params=fit_params,
+                     pre_dispatch=self.pre_dispatch,
++                    **{param_name: fit_params},
+                 )
+                 for regr in self.regr_
+             ]
+-- 
+2.47.1
+

pkgs/development/python-modules/mlxtend/0001-fix-test-replace-np.float_-to-np.float64.patch

···
-From 360cb75317aecaf6b9abcf24f0577afef75c464e Mon Sep 17 00:00:00 2001
-From: wxt <[e-mail]>
-Date: Mon, 6 Jan 2025 20:41:27 +0800
-Subject: [PATCH] fix(test): replace np.float_ to np.float64
-
----
- mlxtend/_base/_regressor.py                     | 2 +-
- mlxtend/_base/tests/test_classifier.py          | 2 +-
- mlxtend/_base/tests/test_cluster.py             | 2 +-
- mlxtend/classifier/multilayerperceptron.py      | 2 +-
- mlxtend/classifier/softmax_regression.py        | 2 +-
- mlxtend/math/linalg.py                          | 2 +-
- mlxtend/plotting/tests/test_decision_regions.py | 2 +-
- 7 files changed, 7 insertions(+), 7 deletions(-)
-
-diff --git a/mlxtend/_base/_regressor.py b/mlxtend/_base/_regressor.py
-index e3d0a1d..1d3a5d6 100644
---- a/mlxtend/_base/_regressor.py
-+++ b/mlxtend/_base/_regressor.py
-@@ -16,7 +16,7 @@ class _Regressor(object):
-         pass
- 
-     def _check_target_array(self, y, allowed=None):
--        if not isinstance(y[0], (float, np.float_)):
-+        if not isinstance(y[0], (float, np.float64)):
-             raise AttributeError("y must be a float array.\nFound %s" % y.dtype)
- 
-     def fit(self, X, y, init_params=True):
-diff --git a/mlxtend/_base/tests/test_classifier.py b/mlxtend/_base/tests/test_classifier.py
-index f77f74d..1bbac6d 100644
---- a/mlxtend/_base/tests/test_classifier.py
-+++ b/mlxtend/_base/tests/test_classifier.py
-@@ -51,7 +51,7 @@ def test_check_labels_not_ok_1():
- 
- 
- def test_check_labels_integer_notok():
--    y = np.array([1.0, 2.0], dtype=np.float_)
-+    y = np.array([1.0, 2.0], dtype=np.float64)
-     cl = BlankClassifier(print_progress=0, random_seed=1)
-     with pytest.raises(AttributeError) as excinfo:
-         cl._check_target_array(y)
-diff --git a/mlxtend/_base/tests/test_cluster.py b/mlxtend/_base/tests/test_cluster.py
-index 6da1a9d..54c2526 100644
---- a/mlxtend/_base/tests/test_cluster.py
-+++ b/mlxtend/_base/tests/test_cluster.py
-@@ -51,7 +51,7 @@ def test_check_labels_not_ok_1():
- 
- 
- def test_check_labels_integer_notok():
--    y = np.array([1.0, 2.0], dtype=np.float_)
-+    y = np.array([1.0, 2.0], dtype=np.float64)
-     cl = BlankClassifier(print_progress=0, random_seed=1)
-     with pytest.raises(AttributeError) as excinfo:
-         cl._check_target_array(y)
-diff --git a/mlxtend/classifier/multilayerperceptron.py b/mlxtend/classifier/multilayerperceptron.py
-index 770dab9..05416c3 100644
---- a/mlxtend/classifier/multilayerperceptron.py
-+++ b/mlxtend/classifier/multilayerperceptron.py
-@@ -143,7 +143,7 @@ class MultiLayerPerceptron(
-                 prev_grad_b_out = np.zeros(shape=self.b_["out"].shape)
-                 prev_grad_w_out = np.zeros(shape=self.w_["out"].shape)
- 
--        y_enc = self._one_hot(y=y, n_labels=self.n_classes, dtype=np.float_)
-+        y_enc = self._one_hot(y=y, n_labels=self.n_classes, dtype=np.float64)
- 
-         self.init_time_ = time()
- 
-diff --git a/mlxtend/classifier/softmax_regression.py b/mlxtend/classifier/softmax_regression.py
-index 56444e5..173154e 100644
---- a/mlxtend/classifier/softmax_regression.py
-+++ b/mlxtend/classifier/softmax_regression.py
-@@ -141,7 +141,7 @@ class SoftmaxRegression(_BaseModel, _IterativeModel, _Classifier, _MultiClass):
-             )
-             self.cost_ = []
- 
--        y_enc = self._one_hot(y=y, n_labels=self.n_classes, dtype=np.float_)
-+        y_enc = self._one_hot(y=y, n_labels=self.n_classes, dtype=np.float64)
- 
-         self.init_time_ = time()
-         rgen = np.random.RandomState(self.random_seed)
-diff --git a/mlxtend/math/linalg.py b/mlxtend/math/linalg.py
-index 02600f1..ece4c3c 100644
---- a/mlxtend/math/linalg.py
-+++ b/mlxtend/math/linalg.py
-@@ -45,7 +45,7 @@ def vectorspace_orthonormalization(ary, eps=1e-13):  # method='gram-schmidt',
-     #   2c) Normalize if linearly independent,
-     #       and set to zero otherwise
- 
--    arr = ary.astype(np.float_).copy()
-+    arr = ary.astype(np.float64).copy()
- 
-     for i in range(arr.shape[1]):
-         for j in range(i):
-diff --git a/mlxtend/plotting/tests/test_decision_regions.py b/mlxtend/plotting/tests/test_decision_regions.py
-index fba2255..aad63ff 100644
---- a/mlxtend/plotting/tests/test_decision_regions.py
-+++ b/mlxtend/plotting/tests/test_decision_regions.py
-@@ -94,7 +94,7 @@ def test_y_int_ary():
-         "Try passing the array as y.astype(np.int_)",
-         plot_decision_regions,
-         X[:, :2],
--        y.astype(np.float_),
-+        y.astype(np.float64),
-         sr,
-     )
- 
--- 
-2.47.0
-

pkgs/development/python-modules/mlxtend/default.nix

···
 
 buildPythonPackage rec {
   pname = "mlxtend";
-  version = "0.23.3";
+  version = "0.23.4";
   pyproject = true;
 
   disabled = isPy27;
···
     owner = "rasbt";
     repo = "mlxtend";
     tag = "v${version}";
-    hash = "sha256-c6I0dwu4y/Td2G6m2WP/52W4noQUmQMDvpzXA9RZauo=";
+    hash = "sha256-xoAHYRmqN5SrEWlc18ntTZ6WAznBlVZdf+x5Yev3ysE=";
   };
 
   build-system = [ setuptools ];
···
   ];
 
   patches = [
-    # https://github.com/rasbt/mlxtend/pull/1119
-    ./0001-fix-test-replace-np.float_-to-np.float64.patch
+    # https://github.com/rasbt/mlxtend/issues/1117
+    ./0001-StackingCVClassifier-fit-ensure-compatibility-with-s.patch
   ];
 
   nativeCheckInputs = [ pytestCheckHook ];
···
     "mlxtend/evaluate/tests/test_feature_importance.py" # urlopen error
     "mlxtend/evaluate/tests/test_bias_variance_decomp.py" # keras.api._v2
     "mlxtend/evaluate/tests/test_bootstrap_point632.py" # keras.api._v2
+    # Failing tests, most likely an upstream issue. See https://github.com/rasbt/mlxtend/issues/1117
+    "mlxtend/classifier/tests/test_ensemble_vote_classifier.py"
+    "mlxtend/classifier/tests/test_stacking_classifier.py"
+    "mlxtend/classifier/tests/test_stacking_cv_classifier.py"
   ];
 
   meta = {

pkgs/development/python-modules/pyathena/default.nix

···
 
 buildPythonPackage rec {
   pname = "pyathena";
-  version = "3.13.0";
+  version = "3.14.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-kzyV/y3xuf3tOMkL1SwkUCvG/I/1eQneTBUG/xbTbLA=";
+    hash = "sha256-Dgst0gFmHsQwhScz83cIE7B1xbcSKcYslfCGtm3yuh0=";
   };
 
   build-system = [ hatchling ];

pkgs/development/python-modules/sectxt/default.nix

···
 
 buildPythonPackage rec {
   pname = "sectxt";
-  version = "0.9.6";
+  version = "0.9.7";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
···
     owner = "DigitalTrustCenter";
     repo = "sectxt";
     tag = version;
-    hash = "sha256-49YxhcOpi1wofKMRuNxt8esBtfaSoBrGu+yBCRFWZYY=";
+    hash = "sha256-CDVfT3ANb4ugLEvrSRTbkZMvZA6rcEwBu2c3pnjsza8=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/tensorflow-datasets/default.nix

···
   apache-beam,
   beautifulsoup4,
   click,
+  cloudpickle,
   datasets,
   ffmpeg,
   imagemagick,
···
     apache-beam
     beautifulsoup4
     click
+    cloudpickle
     datasets
     ffmpeg
     imagemagick
···
     # AttributeError: 'NoneType' object has no attribute 'Table'
     "--deselect=tensorflow_datasets/core/file_adapters_test.py::test_read_write"
     "--deselect=tensorflow_datasets/text/c4_wsrs/c4_wsrs_test.py::C4WSRSTest"
+  ];
+
+  disabledTests = [
+    # Since updating apache-beam to 2.65.0
+    # RuntimeError: Unable to pickle fn CallableWrapperDoFn...: maximum recursion depth exceeded
+    # https://github.com/tensorflow/datasets/issues/11055
+    "test_download_and_prepare_as_dataset"
   ];
 
   disabledTestPaths = [

pkgs/servers/sql/postgresql/ext/omnigres.nix

···
+{
+  brotli,
+  clang_18,
+  cmake,
+  fetchFromGitHub,
+  flex,
+  lib,
+  netcat,
+  perl,
+  pkg-config,
+  postgresql,
+  postgresqlBuildExtension,
+  postgresqlTestExtension,
+  python3,
+}:
+
+let
+  pgWithExtensions = postgresql.withPackages (ps: [ ps.plpython3 ]);
+in
+postgresqlBuildExtension (finalAttrs: {
+  pname = "omnigres";
+  version = "0-unstable-2025-05-16";
+
+  src = fetchFromGitHub {
+    owner = "omnigres";
+    repo = "omnigres";
+    rev = "84f14792d80fb6fd60b680b7825245a8e7c5583e";
+    hash = "sha256-jOlHXl7ANhMwOPizd5KH+wYZmBNNkkIa9jbXZR8Xu28=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    clang_18
+    cmake
+    flex
+    netcat
+    pkg-config
+    perl
+    python3
+  ];
+
+  buildInputs = postgresql.buildInputs ++ [
+    brotli
+  ];
+
+  cmakeFlags = [
+    "-DOPENSSL_CONFIGURED=1"
+    "-DPG_CONFIG=${pgWithExtensions.pg_config}/bin/pg_config"
+    "-DPostgreSQL_EXTENSION_DIR=${pgWithExtensions}/share/postgresql/extension/"
+    "-DPostgreSQL_PACKAGE_LIBRARY_DIR=${pgWithExtensions}/lib/"
+    "-DPostgreSQL_TARGET_EXTENSION_DIR=${builtins.placeholder "out"}/share/postgresql/extension/"
+    "-DPostgreSQL_TARGET_PACKAGE_LIBRARY_DIR=${builtins.placeholder "out"}/lib/"
+  ];
+
+  enableParallelBuilding = true;
+  doCheck = false;
+
+  preInstall = ''
+    patchShebangs script_omni*
+    mkdir -p $out/lib/
+    mkdir -p $out/share/postgresql/extension/
+  '';
+
+  # https://github.com/omnigres/omnigres?tab=readme-ov-file#building--using-extensions
+  installTargets = [ "install_extensions" ];
+
+  passthru.tests.extension = postgresqlTestExtension {
+    inherit (finalAttrs) finalPackage;
+    sql = ''
+      -- https://docs.omnigres.org/omni_id/identity_type/#usage
+      CREATE EXTENSION omni_id;
+
+      SELECT identity_type('user_id');
+    '';
+  };
+
+  meta = {
+    description = "Postgres as a Business Operating System";
+    homepage = "https://docs.omnigres.org";
+    maintainers = with lib.maintainers; [ mtrsk ];
+    platforms = postgresql.meta.platforms;
+    license = lib.licenses.asl20;
+    broken = lib.versionOlder postgresql.version "14";
+  };
+})

pkgs/test/config.nix

···
-{ lib, ... }:
+{
+  lib,
+  pkgs,
+  ...
+}:
 lib.recurseIntoAttrs {
 
   # https://github.com/NixOS/nixpkgs/issues/175196
···
   # Instead of `builtins.seq`, the list may be constructed based on actual package info.
   allowPkgsInPermittedInsecurePackages =
     let
-      pkgs = import ../.. {
+      pkgs' = import ../.. {
+        system = pkgs.stdenv.hostPlatform.system;
         config = {
-          permittedInsecurePackages = builtins.seq pkgs.glibc.version [ ];
+          permittedInsecurePackages = builtins.seq pkgs'.glibc.version [ ];
         };
       };
 
     in
-    pkgs.hello;
+    pkgs'.hello;
 
 }

pkgs/test/cross/default.nix

···
 
   mapMultiPlatformTest =
     crossSystemFun: test:
-    lib.mapAttrs (
-      name: system:
-      test rec {
-        crossPkgs = import pkgs.path {
-          localSystem = { inherit (pkgs.stdenv.hostPlatform) config; };
-          crossSystem = crossSystemFun system;
-        };
+    lib.dontRecurseIntoAttrs (
+      lib.mapAttrs (
+        name: system:
+        lib.recurseIntoAttrs (test rec {
+          crossPkgs = import pkgs.path {
+            localSystem = { inherit (pkgs.stdenv.hostPlatform) config; };
+            crossSystem = crossSystemFun system;
+          };
 
-        emulator = crossPkgs.stdenv.hostPlatform.emulator pkgs;
+          emulator = crossPkgs.stdenv.hostPlatform.emulator pkgs;
 
-        # Apply some transformation on windows to get dlls in the right
-        # place. Unfortunately mingw doesn’t seem to be able to do linking
-        # properly.
-        platformFun =
-          pkg:
-          if crossPkgs.stdenv.hostPlatform.isWindows then
-            pkgs.buildEnv {
-              name = "${pkg.name}-winlinks";
-              paths = [ pkg ] ++ pkg.buildInputs;
-            }
-          else
-            pkg;
-      }
-    ) testedSystems;
+          # Apply some transformation on windows to get dlls in the right
+          # place. Unfortunately mingw doesn’t seem to be able to do linking
+          # properly.
+          platformFun =
+            pkg:
+            if crossPkgs.stdenv.hostPlatform.isWindows then
+              pkgs.buildEnv {
+                name = "${pkg.name}-winlinks";
+                paths = [ pkg ] ++ pkg.buildInputs;
+              }
+            else
+              pkg;
+        })
+      ) testedSystems
+    );
 
   tests = {
 
···
 
 in
 {
-  gcc = (lib.mapAttrs (_: mapMultiPlatformTest (system: system // { useLLVM = false; })) tests);
-  llvm = (lib.mapAttrs (_: mapMultiPlatformTest (system: system // { useLLVM = true; })) tests);
+  gcc = lib.recurseIntoAttrs (
+    lib.mapAttrs (_: mapMultiPlatformTest (system: system // { useLLVM = false; })) tests
+  );
+  llvm = lib.recurseIntoAttrs (
+    lib.mapAttrs (_: mapMultiPlatformTest (system: system // { useLLVM = true; })) tests
+  );
 
   inherit mbuffer sanity;
 }

pkgs/test/default.nix

···
       };
 
       llvmTests = recurseIntoAttrs llvmTests;
-      inherit gccTests;
+      gccTests = recurseIntoAttrs gccTests;
     };
 
   devShellTools = callPackage ../build-support/dev-shell-tools/tests { };
 
   stdenv-inputs = callPackage ./stdenv-inputs { };
-  stdenv = callPackage ./stdenv { };
+  stdenv = recurseIntoAttrs (callPackage ./stdenv { });
 
   hardeningFlags = recurseIntoAttrs (callPackage ./cc-wrapper/hardening.nix { });
   hardeningFlags-gcc = recurseIntoAttrs (
···
 
   haskell = callPackage ./haskell { };
 
-  hooks = callPackage ./hooks { };
+  hooks = recurseIntoAttrs (callPackage ./hooks { });
 
   cc-multilib-gcc = callPackage ./cc-wrapper/multilib.nix { stdenv = gccMultiStdenv; };
   cc-multilib-clang = callPackage ./cc-wrapper/multilib.nix { stdenv = clangMultiStdenv; };
 
   compress-drv = callPackage ../build-support/compress-drv/test.nix { };
 
-  fetchurl = callPackages ../build-support/fetchurl/tests.nix { };
-  fetchtorrent = callPackages ../build-support/fetchtorrent/tests.nix { };
-  fetchpatch = callPackages ../build-support/fetchpatch/tests.nix { };
-  fetchpatch2 = callPackages ../build-support/fetchpatch/tests.nix { fetchpatch = fetchpatch2; };
-  fetchDebianPatch = callPackages ../build-support/fetchdebianpatch/tests.nix { };
-  fetchzip = callPackages ../build-support/fetchzip/tests.nix { };
-  fetchgit = callPackages ../build-support/fetchgit/tests.nix { };
-  fetchFirefoxAddon = callPackages ../build-support/fetchfirefoxaddon/tests.nix { };
-  fetchPypiLegacy = callPackages ../build-support/fetchpypilegacy/tests.nix { };
+  fetchurl = recurseIntoAttrs (callPackages ../build-support/fetchurl/tests.nix { });
+  fetchtorrent = recurseIntoAttrs (callPackages ../build-support/fetchtorrent/tests.nix { });
+  fetchpatch = recurseIntoAttrs (callPackages ../build-support/fetchpatch/tests.nix { });
+  fetchpatch2 = recurseIntoAttrs (
+    callPackages ../build-support/fetchpatch/tests.nix { fetchpatch = fetchpatch2; }
+  );
+  fetchDebianPatch = recurseIntoAttrs (callPackages ../build-support/fetchdebianpatch/tests.nix { });
+  fetchzip = recurseIntoAttrs (callPackages ../build-support/fetchzip/tests.nix { });
+  fetchgit = recurseIntoAttrs (callPackages ../build-support/fetchgit/tests.nix { });
+  fetchFirefoxAddon = recurseIntoAttrs (
+    callPackages ../build-support/fetchfirefoxaddon/tests.nix { }
+  );
+  fetchPypiLegacy = recurseIntoAttrs (callPackages ../build-support/fetchpypilegacy/tests.nix { });
 
-  install-shell-files = callPackage ./install-shell-files { };
+  install-shell-files = recurseIntoAttrs (callPackage ./install-shell-files { });
 
   checkpointBuildTools = callPackage ./checkpointBuild { };
 
···
 
   ld-library-path = callPackage ./ld-library-path { };
 
-  cross = callPackage ./cross { } // {
-    __attrsFailEvaluation = true;
-  };
+  cross = recurseIntoAttrs (callPackage ./cross { });
 
   php = recurseIntoAttrs (callPackages ./php { });
 
···
     __recurseIntoDerivationForReleaseJobs = true;
   };
 
-  buildRustCrate = callPackage ../build-support/rust/build-rust-crate/test { };
-  importCargoLock = callPackage ../build-support/rust/test/import-cargo-lock { };
+  buildRustCrate = recurseIntoAttrs (callPackage ../build-support/rust/build-rust-crate/test { });
+  importCargoLock = recurseIntoAttrs (callPackage ../build-support/rust/test/import-cargo-lock { });
 
   vim = callPackage ./vim { };
 
   nixos-functions = callPackage ./nixos-functions { };
 
-  nixosOptionsDoc = callPackage ../../nixos/lib/make-options-doc/tests.nix { };
+  nixosOptionsDoc = recurseIntoAttrs (callPackage ../../nixos/lib/make-options-doc/tests.nix { });
 
   overriding = callPackage ./overriding.nix { };
 
-  texlive = callPackage ./texlive { };
+  texlive = recurseIntoAttrs (callPackage ./texlive { });
 
   cuda = callPackage ./cuda { };
 
···
 
   dotnet = recurseIntoAttrs (callPackages ./dotnet { });
 
-  makeHardcodeGsettingsPatch = callPackage ./make-hardcode-gsettings-patch { };
+  makeHardcodeGsettingsPatch = recurseIntoAttrs (callPackage ./make-hardcode-gsettings-patch { });
 
   makeWrapper = callPackage ./make-wrapper { };
   makeBinaryWrapper = callPackage ./make-binary-wrapper {

pkgs/test/stdenv/default.nix

···
 in
 
 {
-  # Disable on Darwin due to assumptions with __bootPackages
-  __attrsFailEvaluation = stdenv.hostPlatform.isDarwin;
-
   # tests for hooks in `stdenv.defaultNativeBuildInputs`
   hooks = lib.recurseIntoAttrs (
     import ./hooks.nix {

pkgs/tools/system/uefitool/bundle-destination.patch

···
+---
+ UEFITool/CMakeLists.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/UEFITool/CMakeLists.txt b/UEFITool/CMakeLists.txt
+index aef60d0..98723ac 100644
+--- a/UEFITool/CMakeLists.txt
++++ b/UEFITool/CMakeLists.txt
+@@ -143,4 +143,4 @@ IF(UNIX AND (NOT APPLE) AND (NOT CYGWIN))
+  INSTALL(FILES uefitool.desktop DESTINATION share/applications)
+ ENDIF()
+ 
+-INSTALL(TARGETS UEFITool BUNDLE DESTINATION "/Applications" )
++INSTALL(TARGETS UEFITool BUNDLE DESTINATION "Applications" )
+-- 
+2.40.1
+

pkgs/tools/system/uefitool/common.nix pkgs/tools/system/uefitool/old-engine.nix

···
-{
-  version,
-  sha256,
-  installFiles,
-}:
 {
   lib,
   mkDerivation,
···
 }:
 
 mkDerivation rec {
-  passthru = {
-    inherit version;
-    inherit sha256;
-    inherit installFiles;
-  };
   pname = "uefitool";
-  inherit version;
+  version = "0.28.0";
 
   src = fetchFromGitHub {
-    inherit sha256;
+    hash = "sha256-StqrOMsKst2X2yQQ/Xl7iLAuA4QXEOyj2KtE7ZtoUNg=";
     owner = "LongSoft";
-    repo = pname;
-    rev = version;
+    repo = "uefitool";
+    tag = version;
   };
 
   buildInputs = [ qtbase ];
···
 
   installPhase = ''
     mkdir -p "$out"/bin
-    cp ${lib.concatStringsSep " " installFiles} "$out"/bin
+    cp UEFITool UEFIReplace/UEFIReplace UEFIPatch/UEFIPatch "$out"/bin
   '';
 
-  meta = with lib; {
+  meta = {
     description = "UEFI firmware image viewer and editor";
     homepage = "https://github.com/LongSoft/uefitool";
-    license = licenses.bsd2;
-    maintainers = [ ];
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ athre0z ];
     # uefitool supposedly works on other platforms, but their build script only works on linux in nixpkgs
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
+    mainProgram = "UEFITool";
   };
 }

pkgs/tools/system/uefitool/new-engine.nix

···
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  qtbase,
+  cmake,
+  wrapQtAppsHook,
+  zip,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "uefitool";
+  version = "A71";
+
+  src = fetchFromGitHub {
+    hash = "sha256-NRlrKm5+eED6oyvFRSEhn0EUbMsPJtuFAyv3vgY/IUI=";
+    owner = "LongSoft";
+    repo = "uefitool";
+    tag = finalAttrs.version;
+  };
+
+  buildInputs = [ qtbase ];
+  nativeBuildInputs = [
+    cmake
+    zip
+    wrapQtAppsHook
+  ];
+  patches = lib.optionals stdenv.isDarwin [ ./bundle-destination.patch ];
+
+  meta = {
+    description = "UEFI firmware image viewer and editor";
+    homepage = "https://github.com/LongSoft/uefitool";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ athre0z ];
+    platforms = lib.platforms.unix;
+    mainProgram = "uefitool";
+  };
+})

pkgs/tools/system/uefitool/variants.nix

···
-{ libsForQt5 }:
-let
-  common = opts: libsForQt5.callPackage (import ./common.nix opts) { };
-in
-rec {
-  new-engine = common {
-    version = "A62";
-    sha256 = "sha256-U89j0BV57luv1c9hoYJtisKLxFezuaGFokZ29/NJ0xg=";
-    installFiles = [
-      "build/UEFITool/UEFITool"
-      "build/UEFIFind/UEFIFind"
-      "build/UEFIExtract/UEFIExtract"
-    ];
-  };
-  old-engine = common rec {
-    version = "0.28.0";
-    sha256 = "1n2hd2dysi5bv2iyq40phh1jxc48gdwzs414vfbxvcharcwapnja";
-    installFiles = [
-      "UEFITool"
-      "UEFIReplace/UEFIReplace"
-      "UEFIPatch/UEFIPatch"
-    ];
-  };
+{ libsForQt5, qt6Packages }:
+{
+  new-engine = qt6Packages.callPackage ./new-engine.nix { };
+  old-engine = libsForQt5.callPackage ./old-engine.nix { };
 }

pkgs/top-level/aliases.nix

···
   SDL_gpu = throw "'SDL_gpu' has been removed due to lack of upstream maintenance and known users"; # Added 2025-03-15
   SDL_image_2_0 = throw "'SDL_image_2_0' has been removed in favor of the latest version"; # Added 2025-04-20
   SDL2_mixer_2_0 = throw "'SDL2_mixer_2_0' has been removed in favor of the latest version"; # Added 2025-04-27
+  SDL2_classic = throw "'SDL2_classic' has been removed. Consider upgrading to 'sdl2-compat', also available as 'SDL2'."; # Added 2025-05-20
+  SDL2_classic_image = throw "'SDL2_classic_image' has been removed as part of the deprecation of 'SDL2_classic'. Consider upgrading to 'SDL2_image' built with 'sdl2-compat'."; # Added 2025-05-20
   SDL2_classic_mixer_2_0 = throw "'SDL2_classic_mixer_2_0' has been removed in favor of the latest version"; # Added 2025-04-27
+  SDL2_classic_mixer = throw "'SDL2_classic_mixer' has been removed as part of the deprecation of 'SDL2_classic'. Consider upgrading to 'SDL2_mixer' built with 'sdl2-compat'."; # Added 2025-05-20
+  SDL2_classic_ttf = throw "'SDL2_classic_ttf' has been removed as part of the deprecation of 'SDL2_classic'. Consider upgrading to 'SDL2_ttf' built with 'sdl2-compat'."; # Added 2025-05-20
   s2n = throw "'s2n' has been renamed to/replaced by 's2n-tls'"; # Converted to throw 2024-10-17
   sandboxfs = throw "'sandboxfs' has been removed due to being unmaintained, consider using linux namespaces for sandboxing instead"; # Added 2024-06-06
   sane-backends-git = throw "'sane-backends-git' has been renamed to/replaced by 'sane-backends'"; # Converted to throw 2024-10-17

pkgs/top-level/all-packages.nix

···
 
   gibberish-detector = with python3Packages; toPythonApplication gibberish-detector;
 
-  gitlab = callPackage ../applications/version-management/gitlab { };
-  gitlab-ee = callPackage ../applications/version-management/gitlab {
+  gitlab-ee = callPackage ../by-name/gi/gitlab/package.nix {
     gitlabEnterprise = true;
   };
 
   gitlab-triage = callPackage ../applications/version-management/gitlab-triage { };
 
-  gitlab-workhorse = callPackage ../applications/version-management/gitlab/gitlab-workhorse { };
+  gitlab-workhorse = callPackage ../by-name/gi/gitlab/gitlab-workhorse { };
 
   gitqlient = libsForQt5.callPackage ../applications/version-management/gitqlient { };