Merge staging-next into staging

doc/release-notes/rl-2505.section.md

···
 
 - `nodePackages.meshcommander` has been removed, as the package was deprecated by Intel.
 
-- The default version of `z3` has been updated from 4.8 to 4.13. There are still a few packages that need specific older versions; those will continue to be maintained as long as other packages depend on them but may be removed in the future.
+- The default version of `z3` has been updated from 4.8 to 4.14, and all old versions have been dropped. Note that `fstar` still depends on specific versions, and maintains them as overrides.
 
 - `prometheus` has been updated from 2.55.0 to 3.1.0.
   Read the [release blog post](https://prometheus.io/blog/2024/11/14/prometheus-3-0/) and

nixos/doc/manual/release-notes/rl-2505.section.md

···
 
 - [GlitchTip](https://glitchtip.com/), an open source Sentry API compatible error tracking platform. Available as [services.glitchtip](#opt-services.glitchtip.enable).
 
+- [`yarr`](https://github.com/nkanaev/yarr), a small, web-based feed aggregator and RSS reader. Available as [services.yarr](#opt-services.yarr.enable).
+
 - [Stash](https://github.com/stashapp/stash), An organizer for your adult videos/images, written in Go. Available as [services.stash](#opt-services.stash.enable).
 
 - [vsmartcard-vpcd](https://frankmorgner.github.io/vsmartcard/virtualsmartcard/README.html), a virtual smart card driver. Available as [services.vsmartcard-vpcd](#opt-services.vsmartcard-vpcd.enable).

nixos/modules/module-list.nix

···
   ./services/misc/weechat.nix
   ./services/misc/workout-tracker.nix
   ./services/misc/xmrig.nix
+  ./services/misc/yarr.nix
   ./services/misc/ytdl-sub.nix
   ./services/misc/zoneminder.nix
   ./services/misc/zookeeper.nix

nixos/modules/services/misc/yarr.nix

···
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    types
+    mkIf
+    mkOption
+    mkEnableOption
+    mkPackageOption
+    optionalString
+    ;
+
+  cfg = config.services.yarr;
+in
+{
+  meta.maintainers = with lib.maintainers; [ christoph-heiss ];
+
+  options.services.yarr = {
+    enable = mkEnableOption "Yet another rss reader";
+
+    package = mkPackageOption pkgs "yarr" { };
+
+    environmentFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        Environment file for specifying additional settings such as secrets.
+
+        See `yarr -help` for all available options.
+      '';
+    };
+
+    address = mkOption {
+      type = types.str;
+      default = "localhost";
+      description = "Address to run server on.";
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 7070;
+      description = "Port to run server on.";
+    };
+
+    baseUrl = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = "Base path of the service url.";
+    };
+
+    authFilePath = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = "Path to a file containing username:password. `null` means no authentication required to use the service.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.yarr = {
+      description = "Yet another rss reader";
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      environment.XDG_CONFIG_HOME = "/var/lib/yarr/.config";
+
+      serviceConfig = {
+        Type = "simple";
+        Restart = "on-failure";
+
+        StateDirectory = "yarr";
+        StateDirectoryMode = "0700";
+        WorkingDirectory = "/var/lib/yarr";
+        EnvironmentFile = cfg.environmentFile;
+
+        LoadCredential = mkIf (cfg.authFilePath != null) "authfile:${cfg.authFilePath}";
+
+        DynamicUser = true;
+        DevicePolicy = "closed";
+        LockPersonality = "yes";
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = "AF_INET AF_INET6";
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        UMask = "0077";
+
+        ExecStart = ''
+          ${lib.getExe cfg.package} \
+            -db storage.db \
+            -addr "${cfg.address}:${toString cfg.port}" \
+            ${optionalString (cfg.baseUrl != null) "-base ${cfg.baseUrl}"} \
+            ${optionalString (cfg.authFilePath != null) "-auth-file /run/credentials/yarr.service/authfile"}
+        '';
+      };
+    };
+  };
+}

nixos/tests/all-tests.nix

···
   xterm = runTest ./xterm.nix;
   xxh = runTest ./xxh.nix;
   yabar = runTest ./yabar.nix;
+  yarr = runTest ./yarr.nix;
   ydotool = handleTest ./ydotool.nix { };
   yggdrasil = runTest ./yggdrasil.nix;
   your_spotify = runTest ./your_spotify.nix;

nixos/tests/armagetronad.nix

···
           self.node.wait_for_text(text)
           self.send(*keys)
 
-      Server = namedtuple('Server', ('node', 'name', 'address', 'port', 'welcome', 'attacker', 'victim', 'coredump_delay'))
+      Server = namedtuple('Server', ('node', 'name', 'address', 'port', 'welcome', 'player1', 'player2'))
 
       # Clients and their in-game names
       clients = (
···
 
       # Server configs.
       servers = (
-        Server(server, 'high-rubber', 'server', 4534, 'NixOS Smoke Test Server', 'SmOoThIcE', 'Arduino', 8),
-        Server(server, 'sty', 'server', 4535, 'NixOS Smoke Test sty+ct+ap Server', 'Arduino', 'SmOoThIcE', 8),
-        Server(server, 'trunk', 'server', 4536, 'NixOS Smoke Test 0.4 Server', 'Arduino', 'SmOoThIcE', 8)
+        Server(server, 'high-rubber', 'server', 4534, 'NixOS Smoke Test Server', 'SmOoThIcE', 'Arduino'),
+        Server(server, 'sty', 'server', 4535, 'NixOS Smoke Test sty+ct+ap Server', 'Arduino', 'SmOoThIcE'),
+        Server(server, 'trunk', 'server', 4536, 'NixOS Smoke Test 0.4 Server', 'Arduino', 'SmOoThIcE')
       )
 
       """
···
           client.node.screenshot(f"screen_{client.name}_{screenshot_idx}")
         return screenshot_idx + 1
 
-      # Wait for the servers to come up.
-      start_all()
-      for srv in servers:
-        srv.node.wait_for_unit(f"armagetronad-{srv.name}")
-        srv.node.wait_until_succeeds(f"ss --numeric --udp --listening | grep -q {srv.port}")
-
-      # Make sure console commands work through the named pipe we created.
-      for srv in servers:
-        srv.node.succeed(
-          f"echo 'say Testing!' >> /var/lib/armagetronad/{srv.name}/input"
-        )
-        srv.node.succeed(
-          f"echo 'say Testing again!' >> /var/lib/armagetronad/{srv.name}/input"
-        )
-        srv.node.wait_until_succeeds(
-          f"journalctl -u armagetronad-{srv.name} -e | grep -q 'Admin: Testing!'"
-        )
-        srv.node.wait_until_succeeds(
-          f"journalctl -u armagetronad-{srv.name} -e | grep -q 'Admin: Testing again!'"
-        )
-
       """
       Sets up a client, waiting for the given barrier on completion.
       """
       def client_setup(client, servers, barrier):
         client.node.wait_for_x()
 
-        # Configure Armagetron.
+        # Configure Armagetron so we skip the tutorial.
         client.node.succeed(
           run("mkdir -p ~/.armagetronad/var"),
-          run(f"echo 'PLAYER_1 {client.name}' >> ~/.armagetronad/var/autoexec.cfg")
+          run(f"echo 'PLAYER_1 {client.name}' >> ~/.armagetronad/var/autoexec.cfg"),
+          run("echo 'FIRST_USE 0' >> ~/.armagetronad/var/autoexec.cfg")
         )
         for idx, srv in enumerate(servers):
           client.node.succeed(
···
             run(f"echo 'BOOKMARK_{idx+1}_PORT {srv.port}' >> ~/.armagetronad/var/autoexec.cfg")
           )
 
-        # Start Armagetron.
-        client.node.succeed(run("ulimit -c unlimited; armagetronad >&2 & disown"))
+        # Start Armagetron. Use the recording mode since it skips the splashscreen.
+        client.node.succeed(run("cd; ulimit -c unlimited; armagetronad --record test.aarec >&2 & disown"))
         client.node.wait_until_succeeds(
           run(
             "${xdo "create_new_win-select_main_window" ''
···
           )
         )
 
-        # Get through the tutorial.
-        client.send_on('Language Settings', 'ret')
-        client.send_on('First Setup', 'ret')
-        client.send_on('Welcome to Armagetron Advanced', 'ret')
-        client.send_on('round 1', 'esc')
-        client.send_on('Menu', 'up', 'up', 'ret')
-        client.send_on('We hope you', 'ret')
+        # Get into the multiplayer menu.
         client.send_on('Armagetron Advanced', 'ret')
         client.send_on('Play Game', 'ret')
 
···
 
         barrier.wait()
 
+      # Start everything.
+      start_all()
+
       # Get to the Server Bookmarks screen on both clients. This takes a while so do it asynchronously.
-      barrier = threading.Barrier(len(clients) + 1, timeout=240)
+      barrier = threading.Barrier(len(clients) + 1, timeout=600)
       for client in clients:
         threading.Thread(target=client_setup, args=(client, servers, barrier)).start()
+
+      # Wait for the servers to come up.
+      for srv in servers:
+        srv.node.wait_for_unit(f"armagetronad-{srv.name}")
+        srv.node.wait_until_succeeds(f"ss --numeric --udp --listening | grep -q {srv.port}")
+
+      # Make sure console commands work through the named pipe we created.
+      for srv in servers:
+        srv.node.succeed(
+          f"echo 'say Testing!' >> /var/lib/armagetronad/{srv.name}/input"
+        )
+        srv.node.succeed(
+          f"echo 'say Testing again!' >> /var/lib/armagetronad/{srv.name}/input"
+        )
+        srv.node.wait_until_succeeds(
+          f"journalctl -u armagetronad-{srv.name} -e | grep -q 'Admin: Testing!'"
+        )
+        srv.node.wait_until_succeeds(
+          f"journalctl -u armagetronad-{srv.name} -e | grep -q 'Admin: Testing again!'"
+        )
+
+      # Wait for the client setup to complete.
       barrier.wait()
 
       # Main testing loop. Iterates through each server bookmark and connects to them in sequence.
···
           f"journalctl -u armagetronad-{srv.name} -e | grep -q 'Go (round 1 of 10)'"
         )
 
-        # Wait a bit
-        srv.node.sleep(srv.coredump_delay)
-
-        # Turn the attacker player's lightcycle left
-        attacker = next(client for client in clients if client.name == srv.attacker)
-        victim = next(client for client in clients if client.name == srv.victim)
-        attacker.send('left')
-        screenshot_idx = take_screenshots(screenshot_idx)
-
-        # Wait for coredump.
+        # Wait for the players to die by running into the wall.
+        player1 = next(client for client in clients if client.name == srv.player1)
+        player2 = next(client for client in clients if client.name == srv.player2)
+        srv.node.wait_until_succeeds(
+          f"journalctl -u armagetronad-{srv.name} -e | grep -q '{player1.name}.*lost 4 points'"
+        )
         srv.node.wait_until_succeeds(
-          f"journalctl -u armagetronad-{srv.name} -e | grep -q '{attacker.name} core dumped {victim.name}'"
+          f"journalctl -u armagetronad-{srv.name} -e | grep -q '{player2.name}.*lost 4 points'"
         )
         screenshot_idx = take_screenshots(screenshot_idx)
 

nixos/tests/yarr.nix

···
+{ lib, pkgs, ... }:
+
+{
+  name = "yarr";
+  meta.maintainers = with lib.maintainers; [ christoph-heiss ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.yarr.enable = true;
+    };
+
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("yarr.service")
+    machine.wait_for_open_port(7070)
+    machine.succeed("curl -sSf http://localhost:7070 | grep '<title>yarr!</title>'")
+  '';
+}

pkgs/applications/editors/texmacs/default.nix

···
   qtbase,
   qtsvg,
   qtmacextras,
+  fetchpatch,
   ghostscriptX ? null,
   extraFonts ? false,
   chineseFonts ? false,
···
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       qtmacextras
     ];
+
+  patches = [
+    (fetchpatch {
+      name = "fix-compile-clang-19.5.patch";
+      url = "https://github.com/texmacs/texmacs/commit/e72783b023f22eaa0456d2e4cc76ae509d963672.patch";
+      hash = "sha256-oJCiXWTY89BdxwbgtFvfThid0WM83+TAUThSihfr0oA=";
+    })
+  ];
 
   cmakeFlags = lib.optionals stdenv.hostPlatform.isDarwin [
     (lib.cmakeFeature "TEXMACS_GUI" "Qt")

pkgs/applications/editors/vim/plugins/generated.nix

···
     meta.hydraPlatforms = [ ];
   };
 
+  unimpaired-which-key-nvim = buildVimPlugin {
+    pname = "unimpaired-which-key.nvim";
+    version = "2024-08-16";
+    src = fetchFromGitHub {
+      owner = "afreakk";
+      repo = "unimpaired-which-key.nvim";
+      rev = "c35f413a631e2d2a29778cc390e4d2da28fc2727";
+      sha256 = "11skr474c9drq25823rx1jxcv5d57si0085zw60nq3wxmx999cg3";
+    };
+    meta.homepage = "https://github.com/afreakk/unimpaired-which-key.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   unison = buildVimPlugin {
     pname = "unison";
     version = "2025-04-18";

pkgs/applications/editors/vim/plugins/non-generated/sonarlint-nvim/default.nix

···
     hash = "sha256-EUwuIFFe4tmw8u6RqEvOLL0Yi8J5cLBQx7ICxnmkT4k=";
   };
 
-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
 
   meta = {
     homepage = "https://gitlab.com/schrieveslaach/sonarlint.nvim";

pkgs/applications/editors/vim/plugins/vim-plugin-names

···
 https://github.com/SirVer/ultisnips/,,
 https://github.com/mbbill/undotree/,,
 https://github.com/chrisbra/unicode.vim/,,
+https://github.com/afreakk/unimpaired-which-key.nvim/,HEAD,
 https://github.com/tummetott/unimpaired.nvim/,HEAD,
 https://github.com/unisonweb/unison/,,
 https://github.com/Shougo/unite.vim/,,

pkgs/applications/misc/syncthingtray/default.nix

···
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.7.5";
+  version = "1.7.6";
   pname = "syncthingtray";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = "syncthingtray";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-/1X+wbVwLu0+SOMaVDJejBA+Z3szgs8IDtAZ9Yj7hXs=";
+    hash = "sha256-vJIHDp91T9oMtUT7bsSCxj6XkvT4bLMol9wEr19Wkig=";
   };
 
   buildInputs =

pkgs/applications/science/biology/mrtrix/default.nix

···
   fetchFromGitHub,
   python,
   makeWrapper,
-  eigen,
+  eigen_3_4_0,
   fftw,
   libtiff,
   libpng,
···
   libXext,
   less,
   withGui ? true,
-  fetchFromGitLab,
-  fetchpatch,
 }:
 
-let
-  # reverts 'eigen: 3.4.0 -> 3.4.0-unstable-2022-05-19'
-  # https://github.com/NixOS/nixpkgs/commit/d298f046edabc84b56bd788e11eaf7ed72f8171c
-  eigen' = (
-    eigen.overrideAttrs (old: rec {
-      version = "3.4.0";
-      src = fetchFromGitLab {
-        owner = "libeigen";
-        repo = "eigen";
-        tag = version;
-        hash = "sha256-1/4xMetKMDOgZgzz3WMxfHUEpmdAm52RqZvz6i0mLEw=";
-      };
-      patches = (old.patches or [ ]) ++ [
-        # Fixes e.g. onnxruntime on aarch64-darwin:
-        # https://hydra.nixos.org/build/248915128/nixlog/1,
-        # originally suggested in https://github.com/NixOS/nixpkgs/pull/258392.
-        #
-        # The patch is from
-        # ["Fix vectorized reductions for Eigen::half"](https://gitlab.com/libeigen/eigen/-/merge_requests/699)
-        # which is two years old,
-        # but Eigen hasn't had a release in two years either:
-        # https://gitlab.com/libeigen/eigen/-/issues/2699.
-        (fetchpatch {
-          url = "https://gitlab.com/libeigen/eigen/-/commit/d0e3791b1a0e2db9edd5f1d1befdb2ac5a40efe0.patch";
-          hash = "sha256-8qiNpuYehnoiGiqy0c3Mcb45pwrmc6W4rzCxoLDSvj0=";
-        })
-      ];
-    })
-  );
-in
-
 stdenv.mkDerivation rec {
   pname = "mrtrix";
   version = "3.0.4-unstable-2025-04-09";
···
   buildInputs =
     [
       ants
-      eigen'
+      eigen_3_4_0
       python
       fftw
       libtiff
···
 
   configurePhase = ''
     runHook preConfigure
-    export EIGEN_CFLAGS="-isystem ${eigen'}/include/eigen3"
+    export EIGEN_CFLAGS="-isystem ${eigen_3_4_0}/include/eigen3"
     unset LD  # similar to https://github.com/MRtrix3/mrtrix3/issues/1519
     ./configure ${lib.optionalString (!withGui) "-nogui"};
     runHook postConfigure

pkgs/applications/science/logic/z3/4-8-5-typos.diff

···
-diff --git a/src/util/lp/lp_core_solver_base.h b/src/util/lp/lp_core_solver_base.h
-index 4c17df2..4c3c311 100644
---- a/src/util/lp/lp_core_solver_base.h
-+++ b/src/util/lp/lp_core_solver_base.h
-@@ -600,8 +600,6 @@ public:
-            out << " \n";
-     }
- 
--    bool column_is_free(unsigned j) const { return this->m_column_type[j] == free; }
--
-     bool column_has_upper_bound(unsigned j) const {
-         switch(m_column_types[j]) {
-         case column_type::free_column:
-diff --git a/src/util/lp/static_matrix_def.h b/src/util/lp/static_matrix_def.h
-index 7949573..2f1cb42 100644
---- a/src/util/lp/static_matrix_def.h
-+++ b/src/util/lp/static_matrix_def.h
-@@ -86,7 +86,7 @@ static_matrix<T, X>::static_matrix(static_matrix const &A, unsigned * /* basis *
-     init_row_columns(m, m);
-     while (m--) {
-         for (auto & col : A.m_columns[m]){
--            set(col.var(), m, A.get_value_of_column_cell(col));
-+            set(col.var(), m, A.get_column_cell(col));
-         }
-     }
- }

pkgs/applications/science/logic/z3/default.nix

···
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchpatch,
-  python,
-  fixDarwinDylibNames,
-  javaBindings ? false,
-  ocamlBindings ? false,
-  pythonBindings ? true,
-  jdk ? null,
-  ocaml ? null,
-  findlib ? null,
-  zarith ? null,
-  writeScript,
-  replaceVars,
-}:
-
-assert javaBindings -> jdk != null;
-assert ocamlBindings -> ocaml != null && findlib != null && zarith != null;
-
-let
-  common =
-    {
-      version,
-      sha256,
-      patches ? [ ],
-      tag ? "z3",
-      doCheck ? true,
-    }:
-    stdenv.mkDerivation rec {
-      pname = "z3";
-      inherit version sha256 patches;
-      src = fetchFromGitHub {
-        owner = "Z3Prover";
-        repo = "z3";
-        rev = "${tag}-${version}";
-        sha256 = sha256;
-      };
-
-      strictDeps = true;
-
-      nativeBuildInputs =
-        [ python ]
-        ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames
-        ++ lib.optional javaBindings jdk
-        ++ lib.optionals ocamlBindings [
-          ocaml
-          findlib
-        ];
-      propagatedBuildInputs = [ python.pkgs.setuptools ] ++ lib.optionals ocamlBindings [ zarith ];
-      enableParallelBuilding = true;
-
-      postPatch =
-        lib.optionalString ocamlBindings ''
-          export OCAMLFIND_DESTDIR=$ocaml/lib/ocaml/${ocaml.version}/site-lib
-          mkdir -p $OCAMLFIND_DESTDIR/stublibs
-        ''
-        +
-          lib.optionalString
-            ((lib.versionAtLeast python.version "3.12") && (lib.versionOlder version "4.8.14"))
-            ''
-              # See https://github.com/Z3Prover/z3/pull/5729. This is a specialization of this patch for 4.8.5.
-              for file in scripts/mk_util.py src/api/python/CMakeLists.txt; do
-                substituteInPlace "$file" \
-                  --replace-fail "distutils.sysconfig.get_python_lib()" "sysconfig.get_path('purelib')" \
-                  --replace-fail "distutils.sysconfig" "sysconfig"
-              done
-            '';
-
-      configurePhase =
-        lib.concatStringsSep " " (
-          [ "${python.pythonOnBuildForHost.interpreter} scripts/mk_make.py --prefix=$out" ]
-          ++ lib.optional javaBindings "--java"
-          ++ lib.optional ocamlBindings "--ml"
-          ++ lib.optional pythonBindings "--python --pypkgdir=$out/${python.sitePackages}"
-        )
-        + "\n"
-        + "cd build";
-
-      inherit doCheck;
-      checkPhase = ''
-        make -j $NIX_BUILD_CORES test
-        ./test-z3 -a
-      '';
-
-      postInstall =
-        ''
-          mkdir -p $dev $lib
-          mv $out/lib $lib/lib
-          mv $out/include $dev/include
-        ''
-        + lib.optionalString pythonBindings ''
-          mkdir -p $python/lib
-          mv $lib/lib/python* $python/lib/
-          ln -sf $lib/lib/libz3${stdenv.hostPlatform.extensions.sharedLibrary} $python/${python.sitePackages}/z3/lib/libz3${stdenv.hostPlatform.extensions.sharedLibrary}
-        ''
-        + lib.optionalString javaBindings ''
-          mkdir -p $java/share/java
-          mv com.microsoft.z3.jar $java/share/java
-          moveToOutput "lib/libz3java.${stdenv.hostPlatform.extensions.sharedLibrary}" "$java"
-        '';
-
-      doInstallCheck = true;
-      installCheckPhase = ''
-        $out/bin/z3 -version 2>&1 | grep -F "Z3 version $version"
-      '';
-
-      outputs =
-        [
-          "out"
-          "lib"
-          "dev"
-          "python"
-        ]
-        ++ lib.optional javaBindings "java"
-        ++ lib.optional ocamlBindings "ocaml";
-
-      meta = with lib; {
-        description = "High-performance theorem prover and SMT solver";
-        mainProgram = "z3";
-        homepage = "https://github.com/Z3Prover/z3";
-        changelog = "https://github.com/Z3Prover/z3/releases/tag/z3-${version}";
-        license = licenses.mit;
-        platforms = platforms.unix;
-        maintainers = with maintainers; [
-          thoughtpolice
-          ttuegel
-          numinit
-        ];
-      };
-    };
-
-  static-matrix-def-patch = fetchpatch {
-    # clang / gcc fixes. fixes typos in some member names
-    name = "gcc-15-fixes.patch";
-    url = "https://github.com/Z3Prover/z3/commit/2ce89e5f491fa817d02d8fdce8c62798beab258b.patch";
-    includes = [ "src/math/lp/static_matrix_def.h" ];
-    hash = "sha256-rEH+UzylzyhBdtx65uf8QYj5xwuXOyG6bV/4jgKkXGo=";
-  };
-
-  static-matrix-patch = fetchpatch {
-    # clang / gcc fixes. fixes typos in some member names
-    name = "gcc-15-fixes.patch";
-    url = "https://github.com/Z3Prover/z3/commit/2ce89e5f491fa817d02d8fdce8c62798beab258b.patch";
-    includes = [ "src/@dir@/lp/static_matrix.h" ];
-    stripLen = 3;
-    extraPrefix = "src/@dir@/";
-    hash = "sha256-+H1/VJPyI0yq4M/61ay8SRCa6OaoJ/5i+I3zVTAPUVo=";
-  };
-
-  # replace @dir@ in the path of the given list of patches
-  fixupPatches = dir: map (patch: replaceVars patch { inherit dir; });
-in
-{
-  z3_4_14 = common {
-    version = "4.14.1";
-    sha256 = "sha256-pTsDzf6Frk4mYAgF81wlR5Kb1x56joFggO5Fa3G2s70=";
-  };
-  z3_4_13 = common {
-    version = "4.13.4";
-    sha256 = "sha256-8hWXCr6IuNVKkOegEmWooo5jkdmln9nU7wI8T882BSE=";
-  };
-  z3_4_12 = common {
-    version = "4.12.6";
-    sha256 = "sha256-X4wfPWVSswENV0zXJp/5u9SQwGJWocLKJ/CNv57Bt+E=";
-    patches =
-      fixupPatches "math" [
-        ./lower-bound-typo.diff
-        static-matrix-patch
-      ]
-      ++ [
-        static-matrix-def-patch
-      ];
-  };
-  z3_4_11 = common {
-    version = "4.11.2";
-    sha256 = "sha256-OO0wtCvSKwGxnKvu+AfXe4mEzv4nofa7A00BjX+KVjc=";
-    patches =
-      fixupPatches "math" [
-        ./lower-bound-typo.diff
-        static-matrix-patch
-        ./tail-matrix.diff
-      ]
-      ++ [
-        static-matrix-def-patch
-      ];
-  };
-  z3_4_8 = common {
-    version = "4.8.17";
-    sha256 = "sha256-BSwjgOU9EgCcm18Zx0P9mnoPc9ZeYsJwEu0ffnACa+8=";
-    patches =
-      fixupPatches "math" [
-        ./lower-bound-typo.diff
-        static-matrix-patch
-        ./tail-matrix.diff
-      ]
-      ++ [
-        static-matrix-def-patch
-      ];
-  };
-  z3_4_8_5 = common {
-    tag = "Z3";
-    version = "4.8.5";
-    sha256 = "sha256-ytG5O9HczbIVJAiIGZfUXC/MuYH7d7yLApaeTRlKXoc=";
-    patches =
-      fixupPatches "util" [
-        ./lower-bound-typo.diff
-        static-matrix-patch
-        ./tail-matrix.diff
-      ]
-      ++ [
-        ./4-8-5-typos.diff
-      ];
-  };
-}

pkgs/applications/science/logic/z3/lower-bound-typo.diff

···
-diff --git a/src/@dir@/lp/column_info.h b/src/@dir@/lp/column_info.h
-index 1dc0c60..9cbeea6 100644
---- a/src/@dir@/lp/column_info.h
-+++ b/src/@dir@/lp/column_info.h
-@@ -47,7 +47,7 @@ public:
-             m_lower_bound_is_strict == c.m_lower_bound_is_strict &&
-             m_upper_bound_is_set == c.m_upper_bound_is_set&&
-             m_upper_bound_is_strict == c.m_upper_bound_is_strict&&
--            (!m_lower_bound_is_set || m_lower_bound == c.m_low_bound) &&
-+            (!m_lower_bound_is_set || m_lower_bound == c.m_lower_bound) &&
-             (!m_upper_bound_is_set || m_upper_bound == c.m_upper_bound) &&
-             m_cost == c.m_cost &&
-             m_is_fixed == c.m_is_fixed &&

pkgs/applications/science/logic/z3/tail-matrix.diff

···
-diff --git a/src/@dir@/lp/tail_matrix.h b/src/@dir@/lp/tail_matrix.h
-index 2047e8c..c84340e 100644
---- a/src/@dir@/lp/tail_matrix.h
-+++ b/src/@dir@/lp/tail_matrix.h
-@@ -43,7 +43,6 @@ public:
-         const tail_matrix & m_A;
-         unsigned m_row;
-         ref_row(const tail_matrix& m, unsigned row): m_A(m), m_row(row) {}
--        T operator[](unsigned j) const { return m_A.get_elem(m_row, j);}
-     };
-     ref_row operator[](unsigned i) const { return ref_row(*this, i);}
- };

pkgs/applications/science/logic/z3/tptp.nix pkgs/by-name/z3/z3-tptp/package.nix

···
   meta = {
     inherit (z3.meta) license homepage platforms;
     description = "TPTP wrapper for Z3 prover";
-    maintainers = [ lib.maintainers.raskin ];
+    maintainers = z3.meta.maintainers ++ [ lib.maintainers.raskin ];
   };
 }

pkgs/by-name/ar/ares-cli/package.nix

···
 }:
 buildNpmPackage rec {
   pname = "ares-cli";
-  version = "3.2.0";
+  version = "3.2.1";
   src = fetchFromGitHub {
     owner = "webos-tools";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-tSnmIDDDEhhQBrjZ5bujmCaYpetTjpdCGUjKomue+Bc=";
+    hash = "sha256-L8suZDtXVchVyvp7KCv0UaceJqqGBdfopd5tZzwj3MY=";
   };
 
   postPatch = ''
···
   '';
 
   dontNpmBuild = true;
-  npmDepsHash = "sha256-eTuAi+32pK8rGQ5UDWesDFvlkjWj/ERevD+aYXYYr0Q=";
+  npmDepsHash = "sha256-ATIxe/sulfOpz5KiWauDAPZrlfUOFyiTa+5ECFbVd+0=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/ca/cargo-sonar/package.nix

···
+{
+  lib,
+  rustPlatform,
+  fetchFromGitLab,
+  versionCheckHook,
+  nix-update-script,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "cargo-sonar";
+  version = "1.3.0";
+
+  src = fetchFromGitLab {
+    owner = "woshilapin";
+    repo = "cargo-sonar";
+    tag = finalAttrs.version;
+    hash = "sha256-f319hi6mrnlHTvsn7kN2wFHyamXtplLZ8A6TN0+H3jY=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-KLw6kAR2pF5RFhRDfsL093K+jk3oiSHLZ2CQvrBuhWY=";
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Utility to produce some Sonar-compatible format from different Rust tools like cargo-clippy cargo-audit or cargo-outdated";
+    mainProgram = "cargo-sonar";
+    homepage = "https://gitlab.com/woshilapin/cargo-sonar";
+    license = [ lib.licenses.mit ];
+    maintainers = [ lib.maintainers.jonboh ];
+  };
+})

pkgs/by-name/cu/curv/package.nix

···
   lib,
   stdenv,
   fetchFromGitea,
-  fetchFromGitLab,
-  fetchpatch,
   cmake,
   git,
   pkg-config,
   boost,
-  eigen,
+  eigen_3_4_0,
   glm,
   libGL,
   libpng,
···
   buildInputs =
     [
       boost
-      # https://codeberg.org/doug-moen/curv/issues/228
-      # reverts 'eigen: 3.4.0 -> 3.4.0-unstable-2022-05-19'
-      # https://github.com/nixos/nixpkgs/commit/d298f046edabc84b56bd788e11eaf7ed72f8171c
-      (eigen.overrideAttrs (old: rec {
-        version = "3.4.0";
-        src = fetchFromGitLab {
-          owner = "libeigen";
-          repo = "eigen";
-          rev = version;
-          hash = "sha256-1/4xMetKMDOgZgzz3WMxfHUEpmdAm52RqZvz6i0mLEw=";
-        };
-        patches = (old.patches or [ ]) ++ [
-          # Fixes e.g. onnxruntime on aarch64-darwin:
-          # https://hydra.nixos.org/build/248915128/nixlog/1,
-          # originally suggested in https://github.com/NixOS/nixpkgs/pull/258392.
-          #
-          # The patch is from
-          # ["Fix vectorized reductions for Eigen::half"](https://gitlab.com/libeigen/eigen/-/merge_requests/699)
-          # which is two years old,
-          # but Eigen hasn't had a release in two years either:
-          # https://gitlab.com/libeigen/eigen/-/issues/2699.
-          (fetchpatch {
-            url = "https://gitlab.com/libeigen/eigen/-/commit/d0e3791b1a0e2db9edd5f1d1befdb2ac5a40efe0.patch";
-            hash = "sha256-8qiNpuYehnoiGiqy0c3Mcb45pwrmc6W4rzCxoLDSvj0=";
-          })
-        ];
-      }))
+      eigen_3_4_0
       glm
       libGL
       libpng

pkgs/by-name/ei/eigen_3_4_0/include-dir.patch

···
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -1,5 +1,5 @@
+ # cmake_minimum_require must be the first command of the file
+-cmake_minimum_required(VERSION 3.5.0)
++cmake_minimum_required(VERSION 3.7.0)
+ 
+ project(Eigen3)
+ 
+@@ -443,7 +443,7 @@ set(PKGCONFIG_INSTALL_DIR
+     CACHE PATH "The directory relative to CMAKE_INSTALL_PREFIX where eigen3.pc is installed"
+     )
+ 
+-foreach(var INCLUDE_INSTALL_DIR CMAKEPACKAGE_INSTALL_DIR PKGCONFIG_INSTALL_DIR)
++foreach(var CMAKEPACKAGE_INSTALL_DIR PKGCONFIG_INSTALL_DIR)
+   # If an absolute path is specified, make it relative to "{CMAKE_INSTALL_PREFIX}".
+   if(IS_ABSOLUTE "${${var}}")
+     file(RELATIVE_PATH "${var}" "${CMAKE_INSTALL_PREFIX}" "${${var}}")
+@@ -466,13 +466,6 @@ install(FILES
+   DESTINATION ${INCLUDE_INSTALL_DIR} COMPONENT Devel
+   )
+ 
+-if(EIGEN_BUILD_PKGCONFIG)
+-    configure_file(eigen3.pc.in eigen3.pc @ONLY)
+-    install(FILES ${CMAKE_CURRENT_BINARY_DIR}/eigen3.pc
+-        DESTINATION ${PKGCONFIG_INSTALL_DIR}
+-        )
+-endif()
+-
+ install(DIRECTORY Eigen DESTINATION ${INCLUDE_INSTALL_DIR} COMPONENT Devel)
+ 
+ 
+@@ -593,8 +586,15 @@ set ( EIGEN_VERSION_MAJOR  ${EIGEN_WORLD_VERSION} )
+ set ( EIGEN_VERSION_MINOR  ${EIGEN_MAJOR_VERSION} )
+ set ( EIGEN_VERSION_PATCH  ${EIGEN_MINOR_VERSION} )
+ set ( EIGEN_DEFINITIONS "")
+-set ( EIGEN_INCLUDE_DIR "${CMAKE_INSTALL_PREFIX}/${INCLUDE_INSTALL_DIR}" )
+ set ( EIGEN_ROOT_DIR ${CMAKE_INSTALL_PREFIX} )
++GNUInstallDirs_get_absolute_install_dir(EIGEN_INCLUDE_DIR INCLUDE_INSTALL_DIR)
++
++if(EIGEN_BUILD_PKGCONFIG)
++    configure_file(eigen3.pc.in eigen3.pc @ONLY)
++    install(FILES ${CMAKE_CURRENT_BINARY_DIR}/eigen3.pc
++        DESTINATION ${PKGCONFIG_INSTALL_DIR}
++        )
++endif()
+ 
+ include (CMakePackageConfigHelpers)
+ 
+--- a/eigen3.pc.in
++++ b/eigen3.pc.in
+@@ -6,4 +6,4 @@ Description: A C++ template library for linear algebra: vectors, matrices, and r
+ Requires:
+ Version: @EIGEN_VERSION_NUMBER@
+ Libs:
+-Cflags: -I${prefix}/@INCLUDE_INSTALL_DIR@
++Cflags: -I@EIGEN_INCLUDE_DIR@

pkgs/by-name/ei/eigen_3_4_0/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  fetchpatch,
+  cmake,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "eigen";
+  version = "3.4.0";
+
+  src = fetchFromGitLab {
+    owner = "libeigen";
+    repo = "eigen";
+    rev = version;
+    hash = "sha256-1/4xMetKMDOgZgzz3WMxfHUEpmdAm52RqZvz6i0mLEw=";
+  };
+
+  patches = [
+    ./include-dir.patch
+    # Fixes e.g. onnxruntime on aarch64-darwin:
+    # https://hydra.nixos.org/build/248915128/nixlog/1,
+    # originally suggested in https://github.com/NixOS/nixpkgs/pull/258392.
+    #
+    # The patch is from
+    # ["Fix vectorized reductions for Eigen::half"](https://gitlab.com/libeigen/eigen/-/merge_requests/699)
+    # which is two years old,
+    # but Eigen hasn't had a release in two years either:
+    # https://gitlab.com/libeigen/eigen/-/issues/2699.
+    (fetchpatch {
+      url = "https://gitlab.com/libeigen/eigen/-/commit/d0e3791b1a0e2db9edd5f1d1befdb2ac5a40efe0.patch";
+      hash = "sha256-8qiNpuYehnoiGiqy0c3Mcb45pwrmc6W4rzCxoLDSvj0=";
+    })
+  ];
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = with lib; {
+    homepage = "https://eigen.tuxfamily.org";
+    description = "C++ template library for linear algebra: vectors, matrices, and related algorithms";
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [
+      sander
+      raskin
+      pbsds
+    ];
+    platforms = platforms.unix;
+  };
+}

pkgs/by-name/fx/fx-cast-bridge/bump-nan.patch

···
+diff --git a/package-lock.json b/package-lock.json
+index c856a73..59d3cc5 100644
+--- a/package-lock.json
++++ b/package-lock.json
+@@ -1240,9 +1240,10 @@
+             }
+         },
+         "node_modules/nan": {
+-            "version": "2.15.0",
+-            "resolved": "https://registry.npmjs.org/nan/-/nan-2.15.0.tgz",
+-            "integrity": "sha512-8ZtvEnA2c5aYCZYd1cvgdnU6cqwixRoYg70xPLWUws5ORTa/lnw+u4amixRS/Ac5U5mQVgp9pnlSUnbNWFaWZQ=="
++            "version": "2.22.2",
++            "resolved": "https://registry.npmjs.org/nan/-/nan-2.22.2.tgz",
++            "integrity": "sha512-DANghxFkS1plDdRsX0X9pm0Z6SJNN6gBdtXfanwoZ8hooC5gosGFSBGRYHUVPz1asKA/kMRqDRdHrluZ61SpBQ==",
++            "license": "MIT"
+         },
+         "node_modules/napi-build-utils": {
+             "version": "1.0.2",
+@@ -3189,9 +3190,9 @@
+             "dev": true
+         },
+         "nan": {
+-            "version": "2.15.0",
+-            "resolved": "https://registry.npmjs.org/nan/-/nan-2.15.0.tgz",
+-            "integrity": "sha512-8ZtvEnA2c5aYCZYd1cvgdnU6cqwixRoYg70xPLWUws5ORTa/lnw+u4amixRS/Ac5U5mQVgp9pnlSUnbNWFaWZQ=="
++            "version": "2.22.2",
++            "resolved": "https://registry.npmjs.org/nan/-/nan-2.22.2.tgz",
++            "integrity": "sha512-DANghxFkS1plDdRsX0X9pm0Z6SJNN6gBdtXfanwoZ8hooC5gosGFSBGRYHUVPz1asKA/kMRqDRdHrluZ61SpBQ=="
+         },
+         "napi-build-utils": {
+             "version": "1.0.2",

pkgs/by-name/fx/fx-cast-bridge/package.nix

···
   buildNpmPackage,
   fetchFromGitHub,
   avahi-compat,
-  nodejs_18,
+  nodejs_22,
   python3,
   stdenv,
 }:
···
   pname = "fx-cast-bridge";
   version = "0.3.1";
 
-  nodejs = nodejs_18;
+  nodejs = nodejs_22;
 
   src = fetchFromGitHub {
     owner = "hensm";
···
     rev = "v${version}";
     hash = "sha256-hB4NVJW2exHoKsMp0CKzHerYgj8aR77rV+ZsCoWA1Dg=";
   };
+
   sourceRoot = "${src.name}/app";
-  npmDepsHash = "sha256-GLrDRZqKcX1PDGREx+MLZ1TEjr88r9nz4TvZ9nvo40g=";
+
+  patches = [
+    # to support later versions of nodejs
+    # generated by running `npm update nan --ignore-scripts` in the ./app dir
+    ./bump-nan.patch
+  ];
+
+  npmDepsHash = "sha256-23EZC9v4ODu3k+O9NDVhOdGJ/FfaiTVWtTrK8liAevk=";
 
   nativeBuildInputs = [ python3 ];
   buildInputs = [ avahi-compat ];
 
   postPatch = ''
     substituteInPlace bin/lib/paths.js \
-      --replace "../../../" "../../"
+      --replace-fail "../../../" "../../"
   '';
 
   dontNpmInstall = true;
···
     mkdir -p $out/{bin,lib/mozilla/native-messaging-hosts}
 
     substituteInPlace dist/app/fx_cast_bridge.json \
-      --replace "$(realpath dist/app/fx_cast_bridge.sh)" "$out/bin/fx_cast_bridge"
+      --replace-fail "$(realpath dist/app/fx_cast_bridge.sh)" "$out/bin/fx_cast_bridge"
     mv dist/app/fx_cast_bridge.json $out/lib/mozilla/native-messaging-hosts
 
     rm dist/app/fx_cast_bridge.sh

pkgs/by-name/gi/git-town/package.nix

···
 
 buildGoModule rec {
   pname = "git-town";
-  version = "18.1.0";
+  version = "19.0.0";
 
   src = fetchFromGitHub {
     owner = "git-town";
     repo = "git-town";
     tag = "v${version}";
-    hash = "sha256-dx19gzHhCCcdlI80CYhbfKHRS0AQB0DnHphV2mqmI/Y=";
+    hash = "sha256-To+WtPkMbVDuUBaOkemua9i7WOs/X214YunWtbKt02Y=";
   };
 
   vendorHash = null;

pkgs/by-name/ks/kstars/package.nix

···
   lib,
   stdenv,
   fetchurl,
-  fetchFromGitLab,
-  fetchpatch,
   cfitsio,
   cmake,
   curl,
-  eigen,
+  eigen_3_4_0,
   gsl,
   indi-full,
   kdePackages,
···
   zlib,
 }:
 
-let
-  # reverts 'eigen: 3.4.0 -> 3.4.0-unstable-2022-05-19'
-  # https://github.com/nixos/nixpkgs/commit/d298f046edabc84b56bd788e11eaf7ed72f8171c
-  eigen' = eigen.overrideAttrs (old: rec {
-    version = "3.4.0";
-    src = fetchFromGitLab {
-      owner = "libeigen";
-      repo = "eigen";
-      rev = version;
-      hash = "sha256-1/4xMetKMDOgZgzz3WMxfHUEpmdAm52RqZvz6i0mLEw=";
-    };
-    patches = (old.patches or [ ]) ++ [
-      # Fixes e.g. onnxruntime on aarch64-darwin:
-      # https://hydra.nixos.org/build/248915128/nixlog/1,
-      # originally suggested in https://github.com/NixOS/nixpkgs/pull/258392.
-      #
-      # The patch is from
-      # ["Fix vectorized reductions for Eigen::half"](https://gitlab.com/libeigen/eigen/-/merge_requests/699)
-      # which is two years old,
-      # but Eigen hasn't had a release in two years either:
-      # https://gitlab.com/libeigen/eigen/-/issues/2699.
-      (fetchpatch {
-        url = "https://gitlab.com/libeigen/eigen/-/commit/d0e3791b1a0e2db9edd5f1d1befdb2ac5a40efe0.patch";
-        hash = "sha256-8qiNpuYehnoiGiqy0c3Mcb45pwrmc6W4rzCxoLDSvj0=";
-      })
-    ];
-  });
-in
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "kstars";
   version = "3.7.5";
···
     breeze-icons
     cfitsio
     curl
-    eigen'
+    eigen_3_4_0
     gsl
     indi-full
     kconfig

pkgs/by-name/li/libblake3/package.nix

···
   fetchFromGitHub,
   tbb_2021_11,
 
-  # Until we have a release with
-  # https://github.com/BLAKE3-team/BLAKE3/pull/461 and similar, or those
-  # PRs are patched onto this current release. Even then, I think we
-  # still need to disable for MinGW build because
-  # https://github.com/BLAKE3-team/BLAKE3/issues/467
-  useTBB ? false,
+  useTBB ? true,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libblake3";
-  version = "1.8.0";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "BLAKE3-team";
     repo = "BLAKE3";
     tag = finalAttrs.version;
-    hash = "sha256-Krh0yVNZKL6Mb0McqWTIMNownsgM3MUEX2IP+F/fu+k=";
+    hash = "sha256-IABVErXWYQFXZcwsFKfQhm3ox7UZUcW5uzVrGwsSp94=";
   };
 
   sourceRoot = finalAttrs.src.name + "/c";

pkgs/by-name/li/librenms/package.nix

···
 in
 phpPackage.buildComposerProject2 rec {
   pname = "librenms";
-  version = "25.3.0";
+  version = "25.4.0";
 
   src = fetchFromGitHub {
     owner = "librenms";
     repo = pname;
     tag = version;
-    sha256 = "sha256-iCcBP/BDHdTxlzgDGZzBdT0tFL26oCvMI+q2UuEg5jw=";
+    sha256 = "sha256-t+RupwKnUtQd3A0VzWhCXNzc+TnVnDMaMJ6Jcgp+Sfg=";
   };
 
-  vendorHash = "sha256-0YBXORA647IfR0Fes2q4lbJsgrkpcvRj1aIHJ/Te/zU=";
+  vendorHash = "sha256-t/3wBSXJJHqbGR1iKF4zC2Ia99gXNlanabR/iPPlHqw=";
 
   php = phpPackage;
 

pkgs/by-name/ll/lls/package.nix

···
 }:
 rustPlatform.buildRustPackage rec {
   pname = "lls";
-  version = "0.4.1";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "jcaesar";
     repo = "lls";
     tag = "v${version}";
-    hash = "sha256-OszKEWrpXEyi+0ayTzqy6O+cMZ/AVmesN3QJWCAHF7Q=";
+    hash = "sha256-eFGyrGtH57a5iRWHWqt1h58QMdmPf2rPqHnuVj5u6PQ=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-GIAGy0yLV7hRUk7cMEKxjmXJxpZSNyMXICEGr4vfIxc=";
+  cargoHash = "sha256-TY7s0sIeW+FgxqbbYvK3uZ2RwPLVKKhLq3DOurer+Gc=";
 
   meta = with lib; {
     description = "Tool to list listening sockets";

pkgs/by-name/mo/mongodb-atlas-cli/package.nix

···
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+  nix-update-script,
+  testers,
+  mongodb-atlas-cli,
+}:
+
+buildGoModule rec {
+  pname = "mongodb-atlas-cli";
+  version = "1.42.0";
+
+  vendorHash = "sha256-5kCaQ4bBRiGjRh65Tx3g5SlwAb+/S8o+z/2x8IqSXDM=";
+
+  src = fetchFromGitHub {
+    owner = "mongodb";
+    repo = "mongodb-atlas-cli";
+    rev = "refs/tags/atlascli/v${version}";
+    sha256 = "sha256-7umwluhPNhY/AGmVhxITLeoAGJPglRP+1PuXOM6TmBA=";
+  };
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/mongodb/mongodb-atlas-cli/atlascli/internal/version.GitCommit=${src.rev}"
+    "-X github.com/mongodb/mongodb-atlas-cli/atlascli/internal/version.Version=v${version}"
+  ];
+
+  postInstall = ''
+    installShellCompletion --cmd atlas \
+      --bash <($out/bin/atlas completion bash) \
+      --fish <($out/bin/atlas completion fish) \
+      --zsh <($out/bin/atlas completion zsh)
+  '';
+
+  passthru = {
+    updateScript = nix-update-script {
+      extraArgs = [ "--version-regex=atlascli/v(.+)" ];
+    };
+    tests.version = testers.testVersion {
+      package = mongodb-atlas-cli;
+      version = "v${version}";
+    };
+  };
+
+  meta = {
+    homepage = "https://www.mongodb.com/try/download/shell";
+    description = "CLI utility to manage MongoDB Atlas from the terminal";
+    maintainers = with lib.maintainers; [ aduh95 ];
+    license = lib.licenses.asl20;
+    mainProgram = "atlas";
+  };
+}

pkgs/by-name/mu/mupen64plus/package.nix

···
     sha256 = "sha256-KX4XGAzXanuOqAnRob4smO1cc1LccWllqA3rWYsh4TE=";
   };
 
+  patches = [
+    # Remove unused SDL2 header that erroneously adds libX11 dependency
+    ./remove-unused-header.patch
+  ];
+
   nativeBuildInputs = [
     pkg-config
     nasm

pkgs/by-name/mu/mupen64plus/remove-unused-header.patch

···
+From d737386a5422f798dcb196bc58a99808a0843317 Mon Sep 17 00:00:00 2001
+From: Marcin Serwin <[e-mail]>
+Date: Sun, 20 Apr 2025 21:33:00 +0200
+Subject: [PATCH] Remove unused SDL_syswm header
+
+---
+ src/main/eventloop.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/source/mupen64plus-core/src/main/eventloop.c b/source/mupen64plus-core/src/main/eventloop.c
+index 6625638b4..eb0fd1919 100644
+--- a/source/mupen64plus-core/src/main/eventloop.c
++++ b/source/mupen64plus-core/src/main/eventloop.c
+@@ -21,7 +21,6 @@
+  * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
+ 
+ #include <SDL.h>
+-#include <SDL_syswm.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <string.h>

pkgs/by-name/ne/netbox_4_1/package.nix

···
 in
 py.pkgs.buildPythonApplication rec {
   pname = "netbox";
-  version = "4.1.7";
+  version = "4.1.11";
 
   format = "other";
 
···
     owner = "netbox-community";
     repo = "netbox";
     tag = "v${version}";
-    hash = "sha256-0AyIXSiNsAHELM8Ry/bcm7sd7K+ApeoEguiEm8ecAU0=";
+    hash = "sha256-Nd8HWXn7v0llmg934KGtS5+Tj2RvBhJDuXEvB2Pg3nQ=";
   };
 
   patches = [

pkgs/by-name/ne/netbox_4_2/package.nix

···
 in
 py.pkgs.buildPythonApplication rec {
   pname = "netbox";
-  version = "4.2.6";
+  version = "4.2.7";
 
   format = "other";
 
···
     owner = "netbox-community";
     repo = "netbox";
     tag = "v${version}";
-    hash = "sha256-SOGVMaqAYc+DeyeF5ZQ4TQr9RIhWH23Lwth3h0Y3Dtg=";
+    hash = "sha256-SZES80hdoP+k6o5ablMnwaFrsVGE8Baew44eX2ZCk/Y=";
   };
 
   patches = [

pkgs/by-name/ob/obsidian/package.nix

···
 }:
 let
   pname = "obsidian";
-  version = "1.8.9";
+  version = "1.8.10";
   appname = "Obsidian";
   meta = with lib; {
     description = "Powerful knowledge base that works on top of a local folder of plain text Markdown files";
···
     url = "https://github.com/obsidianmd/obsidian-releases/releases/download/v${version}/${filename}";
     hash =
       if stdenv.hostPlatform.isDarwin then
-        "sha256-OPK5GI0P52zk7EF8Gk5i15N/WddbNjS47YNy55o2A8k="
+        "sha256-3BiPbT1ME75WpR/mTDl8/TI+yq6+WMU+RaZXykUG8yE="
       else
-        "sha256-XVq0nQiyT2HvKQpzJIvhghsGgg4ye7uqZcyA1nH4O/o=";
+        "sha256-xZoi4Z9JMM/FEPfvjBXEag3pT/uJH9dvFp8qHnTFNKE=";
   };
 
   icon = fetchurl {

pkgs/by-name/ov/ovftool/package.nix

···
 {
   autoPatchelfHook,
   c-ares,
+  curl,
   darwin,
   expat,
   fetchurl,
   glibc,
   icu60,
+  jq,
   lib,
   libiconv,
   libredirect,
   libxcrypt-legacy,
   libxml2,
   makeWrapper,
+  openssl,
   stdenv,
   unzip,
   xercesc,
   zlib,
+  acceptBroadcomEula ? false,
 }:
 
 let
+  # Returns the base URL for the given tool ID.
+  mkBaseUrl = toolId: "https://developer.broadcom.com/tools/${toolId}/latest";
+  ovftoolId = "open-virtualization-format-ovf-tool";
 
-  ovftoolSystems =
+  # Use browser devtools to figure out how this works.
+  fetchFromBroadcom =
+    {
+      fileName,
+      version,
+      toolId ? ovftoolId,
+      artifactId ? 21342,
+      fileType ? "Download",
+      source ? "",
+      hash ? "",
+    }:
     let
-      baseUrl = "https://vdc-download.vmware.com/vmwb-repository/dcr-public";
+      requestJson = builtins.toJSON {
+        inherit
+          fileName
+          artifactId
+          fileType
+          source
+          ;
+      };
     in
-    {
-      "i686-linux" = rec {
-        name = "VMware-ovftool-${version}-lin.i386.zip";
-        # As of 2024-02-20 the "Zip of OVF Tool for 32-bit Linux" download link
-        # on the v4.6.2 page links to v4.6.0.
-        version = "4.6.0-21452615";
-        url = "${baseUrl}/7254abb2-434d-4f5d-83e2-9311ced9752e/57e666a2-874c-48fe-b1d2-4b6381f7fe97/${name}";
-        hash = "sha256-qEOr/3SW643G5ZQQNJTelZbUxB8HmxPd5uD+Gqsoxz0=";
-      };
-      "x86_64-linux" = rec {
-        name = "VMware-ovftool-${version}-lin.x86_64.zip";
-        version = "4.6.2-22220919";
-        url = "${baseUrl}/8a93ce23-4f88-4ae8-b067-ae174291e98f/c609234d-59f2-4758-a113-0ec5bbe4b120/${name}";
-        hash = "sha256-3B1cUDldoTqLsbSARj2abM65nv+Ot0z/Fa35/klJXEY=";
-      };
-      "x86_64-darwin" = rec {
-        name = "VMware-ovftool-${version}-mac.x64.zip";
-        version = "4.6.2-22220919";
-        url = "${baseUrl}/91091b23-280a-487a-a048-0c2594303c92/dc666e23-104f-4b9b-be11-6d88dcf3ab98/${name}";
-        hash = "sha256-AZufZ0wxt5DYjnpahDfy36W8i7kjIfEkW6MoELSx11k=";
-      };
+    fetchurl {
+      name = fileName;
+      url =
+        (mkBaseUrl toolId)
+        + "?p_p_id=SDK_AND_TOOL_DETAILS_INSTANCE_iwlk&p_p_lifecycle=2&p_p_resource_id=documentDownloadArtifact";
+      curlOptsList = [
+        "--json"
+        requestJson
+      ];
+      downloadToTemp = true;
+      nativeBuildInputs = [ jq ];
+      postFetch = ''
+        # Try again with the new URL
+        urls="$(jq -r 'if (.success == true) then .data.downloadUrl else error(. | tostring) end' < "$downloadedFile" || exit $?)" \
+          downloadToTemp="" \
+          curlOptsList="" \
+          curlOpts="" \
+          postFetch="" \
+          exec "$SHELL" "''${BASH_ARGV[@]}"
+      '';
+      inherit hash;
     };
 
-  ovftoolSystem = ovftoolSystems.${stdenv.system} or (throw "unsupported system ${stdenv.system}");
+  ovftoolSystems = {
+    "x86_64-linux" = rec {
+      version = "4.6.3-24031167";
+      fileName = "VMware-ovftool-${version}-lin.x86_64.zip";
+      hash = "sha256-NEwwgmEh/mrZkMMhI+Kq+SYdd3MJ0+IBLdUhd1+kPow=";
+    };
+    "x86_64-darwin" = rec {
+      version = "4.6.3-24031167";
+      fileName = "VMware-ovftool-${version}-mac.x64.zip";
+      hash = "sha256-vhACcc4tjaQhvKwZyWkgpaKaoC+coWGl1zfSIC6WebM=";
+    };
+  };
 
+  ovftoolSystem = ovftoolSystems.${stdenv.system} or (throw "unsupported system ${stdenv.system}");
 in
-stdenv.mkDerivation {
+stdenv.mkDerivation (final: {
   pname = "ovftool";
   inherit (ovftoolSystem) version;
 
-  src = fetchurl {
-    inherit (ovftoolSystem) name url hash;
-  };
+  src =
+    if acceptBroadcomEula then
+      fetchFromBroadcom {
+        inherit (ovftoolSystem) fileName version hash;
+      }
+    else
+      throw ''
+        See the following URL for terms of using this software:
+        ${mkBaseUrl ovftoolId}
+
+        Use `${final.pname}.override { acceptBroadcomEula = true; }` if you accept Broadcom's terms
+        and would like to use this package.
+      '';
 
   buildInputs =
     [
···
       libxcrypt-legacy
       xercesc
       zlib
+      curl
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       glibc
+      openssl
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libxml2
···
       # with the addition of a libexec directory and a Nix-style binary wrapper.
 
       # Almost all libs in the package appear to be VMware proprietary except for
-      # libgoogleurl and libcurl. The rest of the libraries that the installer
-      # extracts are omitted here, and provided in buildInputs. Since libcurl
-      # depends on VMware's OpenSSL, both libs are still used.
+      # libgoogleurl and libcurl.
+      #
       # FIXME: Replace libgoogleurl? Possibly from Chromium?
-      # FIXME: Tell VMware to use a modern version of OpenSSL. As of ovftool
-      # v4.6.2 ovftool uses openssl-1.0.2zh which in seems to be the extended
+      # FIXME: Tell VMware to use a modern version of OpenSSL on macOS. As of ovftool
+      # v4.6.3 ovftool uses openssl-1.0.2zj which in seems to be the extended
       # support LTS release: https://www.openssl.org/support/contracts.html
 
       # Install all libs that are not patched in preFixup.
···
       install -m 644 -t "$out/lib" \
     ''
     + lib.optionalString stdenv.hostPlatform.isLinux ''
-      libcrypto.so.1.0.2 \
-      libcurl.so.4 \
       libgoogleurl.so.59 \
-      libssl.so.1.0.2 \
       libssoclient.so \
       libvim-types.so \
       libvmacore.so \
       libvmomi.so
     ''
+    # macOS still relies on OpenSSL 1.0.2 as of v4.6.3, but Linux is in the clear
     + lib.optionalString stdenv.hostPlatform.isDarwin ''
       lib/libcrypto.1.0.2.dylib \
-      lib/libcurl.4.dylib \
       lib/libgoogleurl.59.0.30.45.2.dylib \
       lib/libssl.1.0.2.dylib \
       lib/libssoclient.dylib \
···
       install -m 644 -t "$out/share/licenses" \
         "vmware.eula" \
         "vmware-eula.rtf" \
+        "README.txt" \
         "open_source_licenses.txt"
 
       # Install Docs
···
       change_args+=(-change @loader_path/lib/libicuuc.60.2.dylib ${icu60}/lib/libicuuc.60.2.dylib)
       change_args+=(-change @loader_path/lib/libxerces-c-3.2.dylib ${xercesc}/lib/libxerces-c-3.2.dylib)
 
+      # lolwut
+      change_args+=(-change @GOBUILD_CAYMAN_CURL_ROOT@/apple_mac64/lib/libcurl.4.dylib ${curl.out}/lib/libcurl.4.dylib)
+
       # Patch binary
       install_name_tool "''${change_args[@]}" "$out/libexec/ovftool"
+      otool -L "$out/libexec/ovftool"
 
       # Additional patches for ovftool dylibs
       change_args+=(-change /usr/lib/libresolv.9.dylib ${lib.getLib darwin.libresolv}/lib/libresolv.9.dylib)
···
       change_args+=(-change @loader_path/libicuuc.60.2.dylib ${icu60}/lib/libicuuc.60.2.dylib)
       change_args+=(-change @loader_path/libxerces-c-3.2.dylib ${xercesc}/lib/libxerces-c-3.2.dylib)
 
-      # Add new abolute paths for other libs to all libs
+      # Add new absolute paths for other libs to all libs
       for lib in $out/lib/*.dylib; do
         libname=$(basename $lib)
         change_args+=(-change "@loader_path/$libname" "$out/lib/$libname")
···
         libname=$(basename $lib)
         install_name_tool -id "$libname" "$lib"
         install_name_tool "''${change_args[@]}" "$lib"
+        otool -L "$lib"
       done
     '';
 
···
     (allow file-read* (subpath "/System/Library/TextEncodings"))
   '';
 
-  doInstallCheck = true;
+  # Seems to get stuck and return 255, but works outside the sandbox
+  doInstallCheck = !stdenv.hostPlatform.isDarwin;
 
   postInstallCheck =
     lib.optionalString stdenv.hostPlatform.isDarwin ''
       export HOME=$TMPDIR
       # Construct a dummy /etc/passwd file - ovftool attempts to determine the
       # user's "real" home using this
-      DUMMY_PASSWD="$(realpath $HOME/dummy-passwd)"
+      DUMMY_PASSWD="$HOME/dummy-passwd"
       cat > $DUMMY_PASSWD <<EOF
       $(whoami)::$(id -u):$(id -g)::$HOME:$SHELL
       EOF
       export DYLD_INSERT_LIBRARIES="${libredirect}/lib/libredirect.dylib"
-      export NIX_REDIRECTS="/etc/passwd=$DUMMY_PASSWD"
+      export NIX_REDIRECTS="/etc/passwd=$(realpath "$DUMMY_PASSWD")"
     ''
     + ''
       mkdir -p ovftool-check && cd ovftool-check
 
       ovftool_with_args="$out/bin/ovftool --X:logToConsole"
 
+      # There are non-fatal warnings if we don't provide this, due to the sandbox.
+      export LC_ALL=C
+
       # `installCheckPhase.ova` is a NixOS 22.11 image (doesn't actually matter)
       # with a 1 MiB root disk that's all zero. Make sure that it converts
       # properly.
 
+      set -x
       $ovftool_with_args --schemaValidate ${./installCheckPhase.ova}
       $ovftool_with_args --sourceType=OVA --targetType=OVF ${./installCheckPhase.ova} nixos.ovf
 
···
       test -f nixos-disk1.vmdk
 
       $ovftool_with_args --schemaValidate nixos.ovf
+      set +x
     '';
 
   meta = with lib; {
···
     ];
     platforms = builtins.attrNames ovftoolSystems;
     mainProgram = "ovftool";
-    knownVulnerabilities = [
-      "The bundled version of openssl 1.0.2zh in ovftool has open vulnerabilities."
+    knownVulnerabilities = lib.optionals (stdenv.isDarwin) [
+      "The bundled version of openssl 1.0.2zj in ovftool for Darwin has open vulnerabilities."
+      "https://openssl-library.org/news/vulnerabilities-1.0.2/"
       "CVE-2024-0727"
-      "CVE-2023-5678"
-      "CVE-2023-3817"
-      "CVE-2009-3767"
-      "CVE-2009-3766"
-      "CVE-2009-3765"
-      "CVE-2009-1390"
+      "CVE-2024-5535"
+      "CVE-2024-9143"
+      "CVE-2024-13176"
     ];
   };
-}
+})

pkgs/by-name/pf/pferd/package.nix

···
 }:
 python3Packages.buildPythonApplication rec {
   pname = "pferd";
-  version = "3.7.0";
+  version = "3.8.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "Garmelon";
     repo = "PFERD";
     tag = "v${version}";
-    sha256 = "sha256-4+LlnGv/i9zDf+HeW86PJ6XsPMEkJ0JzhLr14MJ4WKM=";
+    sha256 = "sha256-pbMT6KqqITDBPGgLGq4gmCmasby4lhuZzq02ixnDeSI=";
   };
 
   nativeBuildInputs = with python3Packages; [

pkgs/by-name/qw/qwertone/package.nix

···
+{
+  lib,
+  rustPlatform,
+  fetchFromGitLab,
+  wrapGAppsHook3,
+  pkg-config,
+  alsa-lib,
+  atk,
+  gtk3,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "qwertone";
+  version = "0.5.0";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.com";
+    owner = "azymohliad";
+    repo = "qwertone";
+    tag = "v${version}";
+    hash = "sha256-GD7iFDAaS6D7DGPvK+Cof4rVbUwPX9aCI1jfc0XTxn8=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-5hrjmX+eUPrj48Ii1YHPZFPMvynowSwSArcNnUOw4hc=";
+
+  nativeBuildInputs = [
+    wrapGAppsHook3
+    pkg-config
+  ];
+
+  buildInputs = [
+    alsa-lib
+    atk
+    gtk3
+  ];
+
+  meta = {
+    description = "Simple music synthesizer app based on usual qwerty-keyboard for input";
+    mainProgram = "qwertone";
+    homepage = "https://gitlab.com/azymohliad/qwertone";
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ linsui ];
+  };
+}

pkgs/by-name/re/reddit-tui/package.nix

···
 }:
 buildGoModule (finalAttrs: {
   pname = "reddit-tui";
-  version = "0.3.4";
+  version = "0.3.5";
   src = fetchFromGitHub {
     owner = "tonymajestro";
     repo = "reddit-tui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FlGprSbt1/jTRe2p/aXt5f5aZAxnQlb6M70wvUdE9qk=";
+    hash = "sha256-M6GYfsKKvqVlDzEndaX92Zo5wwqVgrYGUKtbs94Krz4=";
   };
-  vendorHash = "sha256-H2ukIIi30b8kGOjESXJGv/VW5pPgfxG2c3H6S4jRAA4=";
+  vendorHash = "sha256-Yqo80adzA9gtSD3qzM+fObzRt3WbcMATQef0g7/z2Dw=";
   doCheck = false;
 
   passthru.updateScript = nix-update-script { };

pkgs/by-name/re/redisinsight/package.nix

···
 {
   lib,
   stdenv,
+
   fetchFromGitHub,
-  makeWrapper,
+  fetchYarnDeps,
   makeDesktopItem,
+
   copyDesktopItems,
-  fixup-yarn-lock,
-  yarn,
-  nodejs_18,
-  python3,
-  fetchYarnDeps,
+  dart-sass,
+  makeWrapper,
+  nodejs_20,
+  pkg-config,
+  yarnConfigHook,
+
   electron,
-  nest-cli,
-  libsass,
-  buildPackages,
-  pkg-config,
+  libsecret,
   sqlite,
-  xdg-utils,
 }:
 
 let
-  nodejs = nodejs_18;
+  nodejs = nodejs_20;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "redisinsight";
-  version = "2.48.0";
+  version = "2.68.0";
 
   src = fetchFromGitHub {
     owner = "RedisInsight";
     repo = "RedisInsight";
     rev = finalAttrs.version;
-    hash = "sha256-ek0Fp8v6j+mZPK2cEuFNrBgInXdYIKBBUg0UD1I51Sg=";
+    hash = "sha256-rXp3C/Ui3vMBscsxlwU9fRF1bmvMrvXLtmJfGzfh1Rk=";
   };
 
-  offlineCache = fetchYarnDeps {
-    yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-ohtU1h6wrg7asXDxTt1Jlzx9GaS3zDrGQD9P9tgzCOE=";
+  patches = [
+    # the `file:` specifier doesn't seem to be supported with fetchYarnDeps
+    # upstream uses it to point the cpu-features dependency to a stub package
+    # so it's safe to remove
+    ./remove-cpu-features.patch
+  ];
+
+  baseOfflineCache = fetchYarnDeps {
+    name = "redisinsight-${finalAttrs.version}-base-offline-cache";
+    inherit (finalAttrs) src patches;
+    hash = "sha256-ORVftwl/8Yrug2MeqWfZTsHNTRJlpKGn2P7JCHUf3do=";
   };
 
-  feOfflineCache = fetchYarnDeps {
-    yarnLock = finalAttrs.src + "/redisinsight/yarn.lock";
-    hash = "sha256-9xbIdDeLUEk4eNeK7RTwidqDGinA8SPfcumqml66kTw=";
+  innerOfflineCache = fetchYarnDeps {
+    name = "redisinsight-${finalAttrs.version}-inner-offline-cache";
+    inherit (finalAttrs) src patches;
+    postPatch = "cd redisinsight";
+    hash = "sha256-yFfkpWV/GD2CcAzb0D3lNZwmqzEN6Bi1MjPyRwClaQ0=";
   };
 
   apiOfflineCache = fetchYarnDeps {
-    yarnLock = finalAttrs.src + "/redisinsight/api/yarn.lock";
-    hash = "sha256-4zbffuneTceMEyKb8atTXTFhTv0DhrsRMdepZWgoxMQ=";
+    name = "redisinsight-${finalAttrs.version}-api-offline-cache";
+    inherit (finalAttrs) src patches;
+    postPatch = "cd redisinsight/api";
+    hash = "sha256-go7IR1UsW8TrWjaFSlC6/biUvb9cHo3PgJa16tF0XHo=";
   };
 
   nativeBuildInputs = [
-    yarn
-    fixup-yarn-lock
+    copyDesktopItems
+    makeWrapper
     nodejs
-    makeWrapper
-    (python3.withPackages (ps: [ ps.setuptools ]))
-    nest-cli
-    libsass
+    (nodejs.python.withPackages (ps: [ ps.setuptools ]))
     pkg-config
-    copyDesktopItems
+    yarnConfigHook
   ];
 
   buildInputs = [
-    sqlite
-    xdg-utils
+    sqlite # for `sqlite3` node module
+    libsecret # for `keytar` node module
   ];
 
-  configurePhase = ''
-    runHook preConfigure
-
-    export HOME=$(mktemp -d)
-    yarn config --offline set yarn-offline-mirror ${finalAttrs.offlineCache}
-    fixup-yarn-lock yarn.lock
-    yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
+  postPatch = ''
+    substituteInPlace redisinsight/api/config/default.ts \
+      --replace-fail "process['resourcesPath']" "\"$out/share/redisinsight\""
 
-    yarn config --offline set yarn-offline-mirror ${finalAttrs.feOfflineCache}
-    fixup-yarn-lock redisinsight/yarn.lock
-    yarn --offline --cwd redisinsight/ --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
+    # has irrelevant files
+    rm -r resources/app
+  '';
 
-    yarn config --offline set yarn-offline-mirror ${finalAttrs.apiOfflineCache}
-    fixup-yarn-lock redisinsight/api/yarn.lock
-    yarn --offline --cwd redisinsight/api/ --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
-
-    patchShebangs node_modules/
-    patchShebangs redisinsight/node_modules/
-    patchShebangs redisinsight/api/node_modules/
-
-    mkdir -p "$HOME/.node-gyp/${nodejs.version}"
-    echo 9 >"$HOME/.node-gyp/${nodejs.version}/installVersion"
-    ln -sfv "${nodejs}/include" "$HOME/.node-gyp/${nodejs.version}"
-    export npm_config_nodedir=${nodejs}
-
-    # Build the sqlite3 package.
-    pushd redisinsight
-    npm_config_node_gyp="${buildPackages.nodejs}/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js" npm rebuild --verbose --sqlite=${sqlite.dev} sqlite3
-    popd
+  # will run yarnConfigHook manually later
+  dontYarnInstallDeps = true;
 
-    # Build node-sass
-    LIBSASS_EXT=auto npm rebuild --verbose node-sass
+  configurePhase = ''
+    runHook preConfigure
 
-    substituteInPlace redisinsight/api/config/default.ts \
-      --replace-fail "process['resourcesPath']" "\"$out/share/redisinsight\"" \
+    yarnOfflineCache="$baseOfflineCache" yarnConfigHook
+    cd redisinsight
+    yarnOfflineCache="$innerOfflineCache" yarnConfigHook
+    cd api
+    yarnOfflineCache="$apiOfflineCache" yarnConfigHook
+    cd ../..
 
-    # has irrelevant files
-    rm -r resources/app
+    export npm_config_nodedir=${electron.headers}
+    export npm_config_sqlite=${lib.getDev sqlite}
+    export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+    npm rebuild --verbose --no-progress
+    cd redisinsight
+    npm rebuild --verbose --no-progress
+    cd api
+    npm rebuild --verbose --no-progress
+    cd ../..
 
     runHook postConfigure
   '';
···
   buildPhase = ''
     runHook preBuild
 
-    yarn config --offline set yarn-offline-mirror ${finalAttrs.offlineCache}
+    # force the sass npm dependency to use our own sass binary instead of the bundled one
+    substituteInPlace node_modules/sass/dist/lib/src/compiler-path.js \
+      --replace-fail 'compilerCommand = (() => {' 'compilerCommand = (() => { return ["${lib.getExe dart-sass}"];'
 
     yarn --offline build:prod
 
+    # TODO: Generate defaults. Currently broken because it requires network access.
+    # yarn --offline --cwd=redisinsight/api build:defaults
+
     yarn --offline electron-builder \
       --dir \
       -c.electronDist=${electron.dist} \
-      -c.electronVersion=${electron.version}
+      -c.electronVersion=${electron.version} \
+      -c.npmRebuild=false # we've already rebuilt the native libs using the electron headers
 
     runHook postBuild
   '';
···
   ];
 
   meta = {
-    description = "RedisInsight Redis client powered by Electron";
+    description = "Developer GUI for Redis";
     homepage = "https://github.com/RedisInsight/RedisInsight";
     license = lib.licenses.sspl;
     maintainers = with lib.maintainers; [

pkgs/by-name/re/redisinsight/remove-cpu-features.patch

···
+diff --git a/redisinsight/api/package.json b/redisinsight/api/package.json
+index 4a24ac8..fab339c 100644
+--- a/redisinsight/api/package.json
++++ b/redisinsight/api/package.json
+@@ -49,7 +49,6 @@
+     "@nestjs/platform-socket.io/socket.io": "^4.8.0",
+     "@nestjs/cli/**/braces": "^3.0.3",
+     "**/semver": "^7.5.2",
+-    "**/cpu-features": "file:./stubs/cpu-features",
+     "**/cross-spawn": "^7.0.5",
+     "**/redis-parser": "3.0.0",
+     "winston-daily-rotate-file/**/file-stream-rotator": "^1.0.0"
+diff --git a/redisinsight/api/yarn.lock b/redisinsight/api/yarn.lock
+index e0e8495..dfed1ae 100644
+--- a/redisinsight/api/yarn.lock
++++ b/redisinsight/api/yarn.lock
+@@ -3223,9 +3223,6 @@ cosmiconfig@^8.2.0:
+     parse-json "^5.2.0"
+     path-type "^4.0.0"
+ 
+-"cpu-features@file:./stubs/cpu-features", cpu-features@~0.0.9:
+-  version "1.0.0"
+-
+ create-jest@^29.7.0:
+   version "29.7.0"
+   resolved "https://registry.yarnpkg.com/create-jest/-/create-jest-29.7.0.tgz#a355c5b3cb1e1af02ba177fe7afd7feee49a5320"
+@@ -7969,7 +7966,6 @@ ssh2@^1.15.0:
+     asn1 "^0.2.6"
+     bcrypt-pbkdf "^1.0.2"
+   optionalDependencies:
+-    cpu-features "~0.0.9"
+     nan "^2.18.0"
+ 
+ ssri@^8.0.0, ssri@^8.0.1:
+diff --git a/redisinsight/package.json b/redisinsight/package.json
+index 8649be7..354ed42 100644
+--- a/redisinsight/package.json
++++ b/redisinsight/package.json
+@@ -16,8 +16,7 @@
+   },
+   "resolutions": {
+     "**/semver": "^7.5.2",
+-    "sqlite3/**/tar": "^6.2.1",
+-    "**/cpu-features": "file:./api/stubs/cpu-features"
++    "sqlite3/**/tar": "^6.2.1"
+   },
+   "dependencies": {
+     "keytar": "^7.9.0",
+diff --git a/redisinsight/yarn.lock b/redisinsight/yarn.lock
+index 7a063ce..22f37a7 100644
+--- a/redisinsight/yarn.lock
++++ b/redisinsight/yarn.lock
+@@ -183,9 +183,6 @@ console-control-strings@^1.1.0:
+   resolved "https://registry.yarnpkg.com/console-control-strings/-/console-control-strings-1.1.0.tgz#3d7cf4464db6446ea644bf4b39507f9851008e8e"
+   integrity sha512-ty/fTekppD2fIwRvnZAVdeOiGd1c7YXEixbgJTNzqcxJWKQnjJ/V1bNEEE6hygpM3WjwHFUVK6HTjWSzV4a8sQ==
+ 
+-"cpu-features@file:./api/stubs/cpu-features", cpu-features@~0.0.10:
+-  version "1.0.0"
+-
+ debug@4, debug@^4.3.3:
+   version "4.3.4"
+   resolved "https://registry.yarnpkg.com/debug/-/debug-4.3.4.tgz#1319f6579357f2338d3337d2cdd4914bb5dcc865"
+@@ -807,7 +804,6 @@ ssh2@^1.15.0:
+     asn1 "^0.2.6"
+     bcrypt-pbkdf "^1.0.2"
+   optionalDependencies:
+-    cpu-features "~0.0.10"
+     nan "^2.20.0"
+ 
+ ssri@^8.0.0, ssri@^8.0.1:

pkgs/by-name/rs/rspamd/package.nix

···
   pkg-config,
   sqlite,
   ragel,
+  fasttext,
   icu,
   vectorscan,
   jemalloc,
···
       pcre
       sqlite
       ragel
+      fasttext
       icu
       jemalloc
       libsodium
···
     "-DDBDIR=/var/lib/rspamd"
     "-DLOGDIR=/var/log/rspamd"
     "-DLOCAL_CONFDIR=/etc/rspamd"
+    "-DENABLE_BLAS=${if withBlas then "ON" else "OFF"}"
+    "-DENABLE_FASTTEXT=ON"
     "-DENABLE_JEMALLOC=ON"
     "-DSYSTEM_DOCTEST=ON"
     "-DSYSTEM_FMT=ON"

pkgs/by-name/sp/splash/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "splash";
-  version = "3.11.2";
+  version = "3.11.3";
 
   src = fetchFromGitHub {
     owner = "danieljprice";
     repo = "splash";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-YB0cgxpRlya8/7fYxPKWBCovHvE/N7HY/7nwKnzYiJc=";
+    hash = "sha256-deuQTCDSLzScd9lFxv83Y8gX7D7WZtikIUfMxbmH2m8=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/to/tone/deps.json

···
   },
   {
     "pname": "CliWrap",
-    "version": "3.7.0",
-    "hash": "sha256-hXClLGuhscCrcBaymrp57Prh4m8Qe0vdE4S2ErIM13w="
+    "version": "3.7.1",
+    "hash": "sha256-e0snh/9Ai6/Gw5ycQox2H5nGrPhKfT2sH9dQNjbrrCI="
   },
   {
     "pname": "CSharp.OperationResult",
···
   },
   {
     "pname": "HtmlAgilityPack",
-    "version": "1.11.71",
-    "hash": "sha256-ddNrIXTfiu8gwrUs/5xYDjpD0sOth90kut6qCgxGUSE="
+    "version": "1.11.72",
+    "hash": "sha256-MRt7yj6+/ORmr2WBERpQ+1gMRzIaPFKddHoB4zZmv2k="
   },
   {
     "pname": "Jint",
···
   },
   {
     "pname": "Microsoft.Extensions.Configuration",
-    "version": "9.0.0",
-    "hash": "sha256-uBLeb4z60y8z7NelHs9uT3cLD6wODkdwyfJm6/YZLDM="
+    "version": "9.0.1",
+    "hash": "sha256-QKWRIGi8RaZjheuW9gMouXa3oaL/nMwlmg28/xxEvgs="
   },
   {
     "pname": "Microsoft.Extensions.Configuration.Abstractions",
···
     "hash": "sha256-xtG2USC9Qm0f2Nn6jkcklpyEDT3hcEZOxOwTc0ep7uc="
   },
   {
+    "pname": "Microsoft.Extensions.Configuration.Abstractions",
+    "version": "9.0.1",
+    "hash": "sha256-r3iWP+kwKo4Aib8SGo91kKWR5WusLrbFHUAw5uKQeNA="
+  },
+  {
     "pname": "Microsoft.Extensions.Configuration.Binder",
     "version": "9.0.0",
     "hash": "sha256-6ajYWcNOQX2WqftgnoUmVtyvC1kkPOtTCif4AiKEffU="
   },
   {
+    "pname": "Microsoft.Extensions.Configuration.Binder",
+    "version": "9.0.1",
+    "hash": "sha256-uq6i0gTobSTqaNm/0XZuv8GGjFpnvgwXnCCPWl9FP9g="
+  },
+  {
     "pname": "Microsoft.Extensions.Configuration.EnvironmentVariables",
-    "version": "9.0.0",
-    "hash": "sha256-tDJx2prYZpr0RKSwmJfsK9FlUGwaDmyuSz2kqQxsWoI="
+    "version": "9.0.1",
+    "hash": "sha256-NS38eSGrEMQf1CgwwcLtmjMNmcLB6ssOWwU4EZw2zBk="
   },
   {
     "pname": "Microsoft.Extensions.Configuration.FileExtensions",
-    "version": "9.0.0",
-    "hash": "sha256-PsLo6mrLGYfbi96rfCG8YS1APXkUXBG4hLstpT60I4s="
+    "version": "9.0.1",
+    "hash": "sha256-xEgobzCPSB+8NbAcjOjES1oYKBdwk5hVdfENL2XPWbk="
   },
   {
     "pname": "Microsoft.Extensions.Configuration.Json",
-    "version": "9.0.0",
-    "hash": "sha256-qQn7Ol0CvPYuyecYWYBkPpTMdocO7I6n+jXQI2udzLI="
+    "version": "9.0.1",
+    "hash": "sha256-8mqWcbJk8FOonELQPaxmAQAkVEz8OrHqn/4sl8SDigM="
   },
   {
     "pname": "Microsoft.Extensions.DependencyInjection",
-    "version": "9.0.0",
-    "hash": "sha256-dAH52PPlTLn7X+1aI/7npdrDzMEFPMXRv4isV1a+14k="
+    "version": "9.0.1",
+    "hash": "sha256-Kt9fczXVeOIlvwuxXdQDKRfIZKClay0ESGUIAJpYiOw="
   },
   {
     "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
···
     "hash": "sha256-CncVwkKZ5CsIG2O0+OM9qXuYXh3p6UGyueTHSLDVL+c="
   },
   {
+    "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
+    "version": "9.0.1",
+    "hash": "sha256-2tWVTPHsw1NG2zO0zsxvi1GybryqeE1V00ZRE66YZB4="
+  },
+  {
     "pname": "Microsoft.Extensions.DependencyModel",
     "version": "9.0.0",
     "hash": "sha256-xirwlMWM0hBqgTneQOGkZ8l45mHT08XuSSRIbprgq94="
   },
   {
     "pname": "Microsoft.Extensions.Diagnostics",
-    "version": "9.0.0",
-    "hash": "sha256-JMbhtjdcWRlrcrbgPlowfj26+pM+MYhnPIaYKnv9byU="
+    "version": "9.0.1",
+    "hash": "sha256-WOuWbkV9IxXnIN2xpqeoovoD3rbMpwAXSJlYKSI4dUI="
   },
   {
     "pname": "Microsoft.Extensions.Diagnostics.Abstractions",
-    "version": "9.0.0",
-    "hash": "sha256-wG1LcET+MPRjUdz3HIOTHVEnbG/INFJUqzPErCM79eY="
+    "version": "9.0.1",
+    "hash": "sha256-/JkeyAQ//lfuHrWbq8ZFrHZiLvIXSnBj0MG0rU8eggQ="
   },
   {
     "pname": "Microsoft.Extensions.FileProviders.Abstractions",
-    "version": "9.0.0",
-    "hash": "sha256-mVfLjZ8VrnOQR/uQjv74P2uEG+rgW72jfiGdSZhIfDc="
+    "version": "9.0.1",
+    "hash": "sha256-ZVnTUbr2eIVFHdtTG9H1kR4DzgpDiMFzRcNx0brHf3o="
   },
   {
     "pname": "Microsoft.Extensions.FileProviders.Physical",
-    "version": "9.0.0",
-    "hash": "sha256-IzFpjKHmF1L3eVbFLUZa2N5aH3oJkJ7KE1duGIS7DP8="
+    "version": "9.0.1",
+    "hash": "sha256-GKyzSDYPl5Y0AAHufaULu8BLKWQU1ofAUJt4YENVaXU="
   },
   {
     "pname": "Microsoft.Extensions.FileSystemGlobbing",
-    "version": "9.0.0",
-    "hash": "sha256-eBLa8pW/y/hRj+JbEr340zbHRABIeFlcdqE0jf5/Uhc="
+    "version": "9.0.1",
+    "hash": "sha256-eoJViA7yWsT9gD/oY5WJHaEWHDibek6uClj8woyteHM="
   },
   {
     "pname": "Microsoft.Extensions.Http",
-    "version": "9.0.0",
-    "hash": "sha256-MsStH3oUfyBbcSEoxm+rfxFBKI/rtB5PZrSGvtDjVe0="
+    "version": "9.0.1",
+    "hash": "sha256-MvQon3jJ/wIhXCLFuI2s0tW4+bh0jUAu6H5I5R8WjaQ="
   },
   {
     "pname": "Microsoft.Extensions.Logging",
···
     "hash": "sha256-kR16c+N8nQrWeYLajqnXPg7RiXjZMSFLnKLEs4VfjcM="
   },
   {
+    "pname": "Microsoft.Extensions.Logging",
+    "version": "9.0.1",
+    "hash": "sha256-IjszwetJ/r1NvwVyh+/SlavabNt9UXf3ZSGP9gGwnkk="
+  },
+  {
     "pname": "Microsoft.Extensions.Logging.Abstractions",
     "version": "9.0.0",
     "hash": "sha256-iBTs9twjWXFeERt4CErkIIcoJZU1jrd1RWCI8V5j7KU="
   },
   {
+    "pname": "Microsoft.Extensions.Logging.Abstractions",
+    "version": "9.0.1",
+    "hash": "sha256-aFZeUno9yLLbvtrj53gA7oD41vxZZYkrJhlOghpMEjo="
+  },
+  {
     "pname": "Microsoft.Extensions.Options",
     "version": "9.0.0",
     "hash": "sha256-DT5euAQY/ItB5LPI8WIp6Dnd0lSvBRP35vFkOXC68ck="
   },
   {
+    "pname": "Microsoft.Extensions.Options",
+    "version": "9.0.1",
+    "hash": "sha256-wOKd/0+kRK3WrGA2HmS/KNYUTUwXHmTAD5IsClTFA10="
+  },
+  {
     "pname": "Microsoft.Extensions.Options.ConfigurationExtensions",
-    "version": "9.0.0",
-    "hash": "sha256-r1Z3sEVSIjeH2UKj+KMj86har68g/zybSqoSjESBcoA="
+    "version": "9.0.1",
+    "hash": "sha256-pzc49CPyBlSoyflWvW6J+xqk2RXEVfPczcDiR0Aj9xA="
   },
   {
     "pname": "Microsoft.Extensions.Primitives",
···
     "hash": "sha256-ZNLusK1CRuq5BZYZMDqaz04PIKScE2Z7sS2tehU7EJs="
   },
   {
+    "pname": "Microsoft.Extensions.Primitives",
+    "version": "9.0.1",
+    "hash": "sha256-tdbtoC7eQGW5yh66FWCJQqmFJkNJD+9e6DDKTs7YAjs="
+  },
+  {
     "pname": "Newtonsoft.Json",
     "version": "13.0.3",
     "hash": "sha256-hy/BieY4qxBWVVsDqqOPaLy1QobiIapkbrESm6v2PHc="
···
   },
   {
     "pname": "Sandreas.AudioMetadata",
-    "version": "0.2.7",
-    "hash": "sha256-GYD+nAURuU99/3JH/4QTthhzAVsau/qpcvih4eiJxtk="
+    "version": "0.2.8",
+    "hash": "sha256-fxzUNFUC/HesKbucrFkOcfqzZfvGqSe3Kr3ZrUzJEic="
   },
   {
     "pname": "Sandreas.Files",
···
     "hash": "sha256-sar9rhft1ivDMj1kU683+4KxUPUZL+Fb++ewMA6RD4Q="
   },
   {
-    "pname": "System.CodeDom",
+    "pname": "System.Diagnostics.DiagnosticSource",
     "version": "9.0.0",
-    "hash": "sha256-578lcBgswW0eM16r0EnJzfGodPx86RxxFoZHc2PSzsw="
+    "hash": "sha256-1VzO9i8Uq2KlTw1wnCCrEdABPZuB2JBD5gBsMTFTSvE="
   },
   {
     "pname": "System.Diagnostics.DiagnosticSource",
-    "version": "9.0.0",
-    "hash": "sha256-1VzO9i8Uq2KlTw1wnCCrEdABPZuB2JBD5gBsMTFTSvE="
+    "version": "9.0.1",
+    "hash": "sha256-nIIvVK+5uyOhAuU2sERNADK4N/A/x0MilBH/EAr1gOA="
   },
   {
     "pname": "System.IO.Abstractions",
···
     "hash": "sha256-vb0NrPjfEao3kfZ0tavp2J/29XnsQTJgXv3/qaAwwz0="
   },
   {
-    "pname": "System.Management",
-    "version": "9.0.0",
-    "hash": "sha256-UyLO5dgNVC7rBT1S6o/Ix6EQGlVTSWUQtVC+/cyTkfQ="
+    "pname": "System.IO.Pipelines",
+    "version": "9.0.1",
+    "hash": "sha256-CnmDanknCGbNnoDjgZw62M/Grg8IMTJDa8x3P07UR2A="
   },
   {
     "pname": "System.Text.Encodings.Web",
···
     "hash": "sha256-WGaUklQEJywoGR2jtCEs5bxdvYu5SHaQchd6s4RE5x0="
   },
   {
+    "pname": "System.Text.Encodings.Web",
+    "version": "9.0.1",
+    "hash": "sha256-iuAVcTiiZQLCZjDfDqdLLPHqZdZqvFabwLFHiVYdRJo="
+  },
+  {
     "pname": "System.Text.Json",
     "version": "9.0.0",
     "hash": "sha256-aM5Dh4okLnDv940zmoFAzRmqZre83uQBtGOImJpoIqk="
   },
   {
+    "pname": "System.Text.Json",
+    "version": "9.0.1",
+    "hash": "sha256-2dqE+Mx5eJZ8db74ofUiUXHOSxDCmXw5n9VC9w4fUr0="
+  },
+  {
     "pname": "TestableIO.System.IO.Abstractions",
     "version": "19.0.1",
     "hash": "sha256-rSvRFL0Gntmw/9d3/2bZF1pIlgReN7GIa+cLb9bjYgc="
···
   },
   {
     "pname": "z440.atl.core",
-    "version": "6.11.0",
-    "hash": "sha256-V1r1ftZ/Ud0pw/qwnqpJodRaGi9FyG3uIy3ykJUvxjg="
+    "version": "6.14.0",
+    "hash": "sha256-H9Z9a+Vfn1P3u5ClwRB3x1ooXvUQbayyPrRvIiop9aU="
   }
 ]

pkgs/by-name/to/tone/package.nix

···
 
 buildDotnetModule rec {
   pname = "tone";
-  version = "0.2.4";
+  version = "0.2.5";
 
   src = fetchFromGitHub {
     owner = "sandreas";
     repo = "tone";
     tag = "v${version}";
-    hash = "sha256-DX54NSlqAZzVQObm9qjUsYatjxjHKGcSLHH1kVD4Row=";
+    hash = "sha256-yqcxqwlCfVDTv5jkcneimlS5EgnDlB7ZvxPt53t9jbQ=";
   };
+
+  patchPhase = ''
+    substituteInPlace tone/Program.cs \
+      --replace-fail "@package_version@" ${version}
+  '';
 
   projectFile = "tone/tone.csproj";
   executables = [ "tone" ];

pkgs/by-name/ur/url-parser/package.nix

···
 
 buildGoModule rec {
   pname = "url-parser";
-  version = "2.1.4";
+  version = "2.1.5";
 
   src = fetchFromGitHub {
     owner = "thegeeklab";
     repo = "url-parser";
     tag = "v${version}";
-    hash = "sha256-GIJj4t6xDXfXMWfSpUR1iI1Ju/W/2REedgtyEFgbylE=";
+    hash = "sha256-Kwjub9qAfHhqNL3mRzlJws1wnwVPAJ3jPYh0s/cu7+8=";
   };
 
-  vendorHash = "sha256-gYkuSBgkDdAaJArsvTyZXkvYCKXkhic5XzLqPbbGVOw=";
+  vendorHash = "sha256-MR8SjQ8IrHC6hZTvmnqXvqJ6odo0+RIMDtMpYwY+iMs=";
 
   ldflags = [
     "-s"

pkgs/by-name/ya/yarr/package.nix

···
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
-  testers,
-  yarr,
+  versionCheckHook,
+  nix-update-script,
+  nixosTests,
 }:
 
 buildGoModule rec {
   pname = "yarr";
-  version = "2.4";
+  version = "2.5";
 
   src = fetchFromGitHub {
     owner = "nkanaev";
     repo = "yarr";
     rev = "v${version}";
-    hash = "sha256-ZMQ+IX8dZuxyxQhD/eWAe4bGGCVcaCeVgF+Wqs79G+k=";
+    hash = "sha256-yII0KV4AKIS1Tfhvj588O631JDArnr0/30rNynTSwzk=";
   };
 
   vendorHash = null;
-
-  subPackages = [ "src" ];
 
   ldflags = [
     "-s"
···
 
   tags = [
     "sqlite_foreign_keys"
-    "release"
+    "sqlite_json"
   ];
 
-  postInstall = ''
-    mv $out/bin/{src,yarr}
-  '';
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
 
-  passthru.tests.version = testers.testVersion {
-    package = yarr;
-    version = "v${version}";
+  passthru = {
+    updateScript = nix-update-script { };
+    tests = lib.optionalAttrs stdenv.hostPlatform.isLinux nixosTests.yarr;
   };
 
   meta = with lib; {
···
     homepage = "https://github.com/nkanaev/yarr";
     changelog = "https://github.com/nkanaev/yarr/blob/v${version}/doc/changelog.txt";
     license = licenses.mit;
-    maintainers = with maintainers; [ sikmir ];
+    maintainers = with maintainers; [
+      sikmir
+      christoph-heiss
+    ];
   };
 }

pkgs/by-name/yo/your_spotify/package.nix

···
 
     mkdir -p $out/share/your_spotify
     cp -r node_modules $out/share/your_spotify/node_modules
+    rm $out/share/your_spotify/node_modules/@your_spotify/{client,dev,server}
     cp -r ./apps/server/{lib,package.json} $out
     mkdir -p $out/bin
     makeWrapper ${lib.escapeShellArg (lib.getExe nodejs)} "$out/bin/your_spotify_migrate" \

pkgs/by-name/z3/z3/package.nix

···
+{
+  z3_4_14,
+  ...
+}@args:
+
+z3_4_14.override args

pkgs/by-name/z3/z3_4_14/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  python3,
+  fixDarwinDylibNames,
+  nix-update-script,
+  javaBindings ? false,
+  ocamlBindings ? false,
+  pythonBindings ? true,
+  jdk ? null,
+  ocaml ? null,
+  findlib ? null,
+  zarith ? null,
+  versionInfo ? {
+    regex = "^v(4\\.14\\.[0-9]+)$";
+    version = "4.14.1";
+    hash = "sha256-pTsDzf6Frk4mYAgF81wlR5Kb1x56joFggO5Fa3G2s70=";
+  },
+  ...
+}:
+
+assert javaBindings -> jdk != null;
+assert ocamlBindings -> ocaml != null && findlib != null && zarith != null;
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "z3";
+  inherit (versionInfo) version;
+
+  src = fetchFromGitHub {
+    owner = "Z3Prover";
+    repo = "z3";
+    rev = "z3-${finalAttrs.version}";
+    inherit (versionInfo) hash;
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs =
+    [ python3 ]
+    ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames
+    ++ lib.optional javaBindings jdk
+    ++ lib.optionals ocamlBindings [
+      ocaml
+      findlib
+    ];
+  propagatedBuildInputs = [ python3.pkgs.setuptools ] ++ lib.optionals ocamlBindings [ zarith ];
+  enableParallelBuilding = true;
+
+  postPatch = lib.optionalString ocamlBindings ''
+    export OCAMLFIND_DESTDIR=$ocaml/lib/ocaml/${ocaml.version}/site-lib
+    mkdir -p $OCAMLFIND_DESTDIR/stublibs
+  '';
+
+  configurePhase =
+    lib.concatStringsSep " " (
+      [ "${python3.pythonOnBuildForHost.interpreter} scripts/mk_make.py --prefix=$out" ]
+      ++ lib.optional javaBindings "--java"
+      ++ lib.optional ocamlBindings "--ml"
+      ++ lib.optional pythonBindings "--python --pypkgdir=$out/${python3.sitePackages}"
+    )
+    + "\n"
+    + "cd build";
+
+  doCheck = true;
+  checkPhase = ''
+    make -j $NIX_BUILD_CORES test
+    ./test-z3 -a
+  '';
+
+  postInstall =
+    ''
+      mkdir -p $dev $lib
+      mv $out/lib $lib/lib
+      mv $out/include $dev/include
+    ''
+    + lib.optionalString pythonBindings ''
+      mkdir -p $python/lib
+      mv $lib/lib/python* $python/lib/
+      ln -sf $lib/lib/libz3${stdenv.hostPlatform.extensions.sharedLibrary} $python/${python3.sitePackages}/z3/lib/libz3${stdenv.hostPlatform.extensions.sharedLibrary}
+    ''
+    + lib.optionalString javaBindings ''
+      mkdir -p $java/share/java
+      mv com.microsoft.z3.jar $java/share/java
+      moveToOutput "lib/libz3java.${stdenv.hostPlatform.extensions.sharedLibrary}" "$java"
+    '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/z3 -version 2>&1 | grep -F "Z3 version $version"
+  '';
+
+  outputs =
+    [
+      "out"
+      "lib"
+      "dev"
+      "python"
+    ]
+    ++ lib.optional javaBindings "java"
+    ++ lib.optional ocamlBindings "ocaml";
+
+  passthru = {
+    updateScript = nix-update-script {
+      extraArgs =
+        [
+          "--version-regex"
+          versionInfo.regex
+        ]
+        ++ lib.optionals (versionInfo.autoUpdate or null != null) [
+          "--override-filename"
+          versionInfo.autoUpdate
+        ];
+    };
+  };
+
+  meta = {
+    description = "High-performance theorem prover and SMT solver";
+    mainProgram = "z3";
+    homepage = "https://github.com/Z3Prover/z3";
+    changelog = "https://github.com/Z3Prover/z3/releases/tag/z3-${finalAttrs.version}";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [
+      thoughtpolice
+      ttuegel
+      numinit
+    ];
+  };
+})

pkgs/development/libraries/libfive/default.nix

···
   stdenv,
   wrapQtAppsHook,
   fetchFromGitHub,
-  fetchFromGitLab,
-  fetchpatch,
   unstableGitUpdater,
   cmake,
   ninja,
   pkg-config,
-  eigen,
+  eigen_3_4_0,
   zlib,
   libpng,
   boost,
···
     python.pkgs.pythonImportsCheckHook
   ];
   buildInputs = [
-    # reverts 'eigen: 3.4.0 -> 3.4.0-unstable-2022-05-19'
-    # https://github.com/nixos/nixpkgs/commit/d298f046edabc84b56bd788e11eaf7ed72f8171c
-    (eigen.overrideAttrs (old: rec {
-      version = "3.4.0";
-      src = fetchFromGitLab {
-        owner = "libeigen";
-        repo = "eigen";
-        rev = version;
-        hash = "sha256-1/4xMetKMDOgZgzz3WMxfHUEpmdAm52RqZvz6i0mLEw=";
-      };
-      patches = (old.patches or [ ]) ++ [
-        # Fixes e.g. onnxruntime on aarch64-darwin:
-        # https://hydra.nixos.org/build/248915128/nixlog/1,
-        # originally suggested in https://github.com/NixOS/nixpkgs/pull/258392.
-        #
-        # The patch is from
-        # ["Fix vectorized reductions for Eigen::half"](https://gitlab.com/libeigen/eigen/-/merge_requests/699)
-        # which is two years old,
-        # but Eigen hasn't had a release in two years either:
-        # https://gitlab.com/libeigen/eigen/-/issues/2699.
-        (fetchpatch {
-          url = "https://gitlab.com/libeigen/eigen/-/commit/d0e3791b1a0e2db9edd5f1d1befdb2ac5a40efe0.patch";
-          hash = "sha256-8qiNpuYehnoiGiqy0c3Mcb45pwrmc6W4rzCxoLDSvj0=";
-        })
-      ];
-    }))
+    eigen_3_4_0
     zlib
     libpng
     boost

pkgs/development/python-modules/azure-mgmt-netapp/default.nix

···
 
 buildPythonPackage rec {
   pname = "azure-mgmt-netapp";
-  version = "13.4.0";
+  version = "13.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
···
   src = fetchPypi {
     pname = "azure_mgmt_netapp";
     inherit version;
-    hash = "sha256-w095/AskU8P+jNAnkL+a8Fe6SqhP3Wd22I6GCjeRL6I=";
+    hash = "sha256-StCIk/lM+SceJVjw5CDwheg6avcSep1VYXLwi96UXJE=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/bleak-esphome/default.nix

···
 
 buildPythonPackage rec {
   pname = "bleak-esphome";
-  version = "2.12.0";
+  version = "2.13.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bluetooth-devices";
     repo = "bleak-esphome";
     tag = "v${version}";
-    hash = "sha256-dR4KuaJWrWTVDWY11E/MRF12jCvOlC8c2flDOnkPjxw=";
+    hash = "sha256-ziUSqIox5tWp64EJ+Hacy1Wbh8NMpH/GUY9TUaN7Y3M=";
   };
 
   postPatch = ''
···
   meta = with lib; {
     description = "Bleak backend of ESPHome";
     homepage = "https://github.com/bluetooth-devices/bleak-esphome";
-    changelog = "https://github.com/bluetooth-devices/bleak-esphome/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/bluetooth-devices/bleak-esphome/blob/${src.tag}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };

pkgs/development/python-modules/cf-xarray/default.nix

···
 
 buildPythonPackage rec {
   pname = "cf-xarray";
-  version = "0.10.4";
+  version = "0.10.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "xarray-contrib";
     repo = "cf-xarray";
     tag = "v${version}";
-    hash = "sha256-OlPoCFTeLTrYEUONu5PMZyfkQiHoqF/2Bj4OkUOCei8=";
+    hash = "sha256-ty7gPBs2vp0mVnn914F84Dg4+DLCBLl7aHMqqrXx9So=";
   };
 
   build-system = [

pkgs/development/python-modules/coinmetrics-api-client/default.nix

···
 
 buildPythonPackage rec {
   pname = "coinmetrics-api-client";
-  version = "2025.3.12.17";
+  version = "2025.4.15.13";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
···
   src = fetchPypi {
     inherit version;
     pname = "coinmetrics_api_client";
-    hash = "sha256-vmmsslR+4fhNqkzvXB87ilc6vQ+b9PdMlj6LEV7ms7A=";
+    hash = "sha256-Wyst1/7CN4ZfkzvAkoUSDlSNECgwlx+11yQEzfddcJQ=";
   };
 
   pythonRelaxDeps = [ "typer" ];

pkgs/development/python-modules/dask-image/default.nix

···
   postPatch = ''
     substituteInPlace dask_image/ndinterp/__init__.py \
       --replace-fail "out_bounds.ptp(axis=1)" "np.ptp(out_bounds, axis=1)"
+
+    substituteInPlace tests/test_dask_image/test_imread/test_core.py \
+      --replace-fail "fh.save(" "fh.write("
   '';
 
   build-system = [
···
     # AttributeError: 'str' object has no attribute 'start'
     "test_find_objects"
     "test_3d_find_objects"
+
     # AssertionError (comparing slices)
     "test_find_objects_with_empty_chunks"
   ];

pkgs/development/python-modules/gdsfactory/default.nix

···
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pytestCheckHook,
+
+  # build-system
   flit-core,
+
+  # dependencies
   jinja2,
   loguru,
   matplotlib,
···
   ipykernel,
   attrs,
   graphviz,
+  pyglet,
+  typing-extensions,
+
   # tests
   jsondiff,
   jsonschema,
   pytest-regressions,
+  pytestCheckHook,
 }:
 buildPythonPackage rec {
   pname = "gdsfactory";
-  version = "8.18.1";
+  version = "9.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "gdsfactory";
     repo = "gdsfactory";
-    rev = "v${version}";
-    hash = "sha256-wDz8QpRgu40FB8+otnGsHVn2e6/SWXIZgA1aeMqMhPQ=";
+    tag = "v${version}";
+    hash = "sha256-z8zKPbWLl554MZq6/Iy3ecvwWiRpy57VYji8xHR+JBo=";
   };
 
   build-system = [ flit-core ];
···
     ipykernel
     attrs
     graphviz
+    pyglet
+    typing-extensions
   ];
 
   nativeCheckInputs = [
     jsondiff
     jsonschema
-    pytestCheckHook
     pytest-regressions
+    pytestCheckHook
   ];
 
   pythonRelaxDeps = [
···
 
   pythonImportsCheck = [ "gdsfactory" ];
 
-  meta = with lib; {
+  meta = {
     description = "Python library to generate GDS layouts";
     homepage = "https://github.com/gdsfactory/gdsfactory";
-    license = licenses.mit;
-    maintainers = with maintainers; [ fbeffa ];
+    changelog = "https://github.com/gdsfactory/gdsfactory/blob/v${version}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fbeffa ];
   };
 }

pkgs/development/python-modules/google-cloud-org-policy/default.nix

···
 
 buildPythonPackage rec {
   pname = "google-cloud-org-policy";
-  version = "1.13.1";
+  version = "1.14.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
···
   src = fetchPypi {
     pname = "google_cloud_org_policy";
     inherit version;
-    hash = "sha256-2yPr1sgmxMnQwk6Z1T9i2MFPeAxjb40r4IqNoAd7WZk=";
+    hash = "sha256-TId9QgosUStFTmLqzSVXy7x09zTAeZRuMOYfYnkbMZw=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/google-generativeai/default.nix

···
 
 buildPythonPackage rec {
   pname = "google-generativeai";
-  version = "0.8.4";
+  version = "0.8.5";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
···
     owner = "google";
     repo = "generative-ai-python";
     tag = "v${version}";
-    hash = "sha256-Snsp6hP1BKNLSFGbcotdhmluTuuBPZBcLkNY8mtOl6o=";
+    hash = "sha256-wc35JSc98xvepI7Gpe5jSJ+c8n7WLKa96axoWVcH7UM=";
   };
 
   pythonRelaxDeps = [ "google-ai-generativelanguage" ];
···
   meta = with lib; {
     description = "Python client library for Google's large language model PaLM API";
     homepage = "https://github.com/google/generative-ai-python";
-    changelog = "https://github.com/google/generative-ai-python/releases/tag/v${version}";
+    changelog = "https://github.com/google/generative-ai-python/releases/tag/${src.tag}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };

pkgs/development/python-modules/holidays/default.nix

···
 
 buildPythonPackage rec {
   pname = "holidays";
-  version = "0.70";
+  version = "0.71";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
···
     owner = "vacanza";
     repo = "python-holidays";
     tag = "v${version}";
-    hash = "sha256-0YjkuGJZbueoFerHKSHjIGn+NwFrz7rJRnrFLx28v6w=";
+    hash = "sha256-umfwSIi9Vu3fDvSVbq3cbQZ83q925VwxVPHedzrcqag=";
   };
 
   build-system = [

pkgs/development/python-modules/kfactory/default.nix

···
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pytestCheckHook,
+
+  # build-system
   setuptools,
   setuptools-scm,
-  klayout,
+
+  # dependencies
   aenum,
   cachetools,
   gitpython,
+  klayout,
   loguru,
+  numpy,
   pydantic,
   pydantic-settings,
   rectangle-packer,
   requests,
+  ruamel-yaml,
   ruamel-yaml-string,
   scipy,
   tomli,
   toolz,
   typer,
-  numpy,
-  ruamel-yaml,
+
+  # tests
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "kfactory";
-  version = "0.21.7";
+  version = "1.4.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "gdsfactory";
     repo = "kfactory";
-    rev = "v${version}";
-    sha256 = "sha256-VLhAJ5rOBKEO1FDCnlaseA+SmrMSoyS+BaEzjdHm59Y=";
+    tag = "v${version}";
+    hash = "sha256-/dhlAcrqQP/YeKGhnBAVMEy80X3yShn65ywoZMRU/ZM=";
   };
 
   build-system = [
···
 
   nativeCheckInputs = [ pytestCheckHook ];
 
-  # https://github.com/gdsfactory/kfactory/issues/511
   disabledTestPaths = [
+    # https://github.com/gdsfactory/kfactory/issues/511
     "tests/test_pdk.py"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "KLayout API implementation of gdsfactory";
     homepage = "https://github.com/gdsfactory/kfactory";
-    license = licenses.mit;
-    maintainers = with maintainers; [ fbeffa ];
+    changelog = "https://github.com/gdsfactory/kfactory/blob/v${version}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fbeffa ];
   };
 }

pkgs/development/python-modules/lacuscore/default.nix

···
 
 buildPythonPackage rec {
   pname = "lacuscore";
-  version = "1.13.9";
+  version = "1.14.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
···
     owner = "ail-project";
     repo = "LacusCore";
     tag = "v${version}";
-    hash = "sha256-knAM4cdevww4/dheOw7AnGtegXuMiXt9R0Tmw1wNV80=";
+    hash = "sha256-szcvg4jfJ84kHYWjPBwecfvfsc258SS0OIuYle1lC1g=";
   };
 
   pythonRelaxDeps = [

pkgs/development/python-modules/lib4package/default.nix

···
 
 buildPythonPackage rec {
   pname = "lib4package";
-  version = "0.3.1";
+  version = "0.3.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "anthonyharrison";
     repo = "lib4package";
     tag = "v${version}";
-    hash = "sha256-ZU5Lne2/xBgaFrTumWpZsuL9ckqdACrb0iRraWo+Rk0=";
+    hash = "sha256-AxAnSxm8eEnfi63SedWIdUvad1bD4g0rqBk4W/DQGHY=";
   };
 
   build-system = [
···
   ];
 
   meta = {
-    changelog = "https://github.com/anthonyharrison/lib4package/releases/tag/v${version}";
+    changelog = "https://github.com/anthonyharrison/lib4package/releases/tag/${src.tag}";
     description = "Utility for handling package metadata to include in Software Bill of Materials (SBOMs";
     homepage = "https://github.com/anthonyharrison/lib4package";
     license = lib.licenses.asl20;

pkgs/development/python-modules/mcpadapt/default.nix

···
 
 buildPythonPackage rec {
   pname = "mcpadapt";
-  version = "0.1.0";
+  version = "0.1.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "grll";
     repo = "mcpadapt";
     tag = "v${version}";
-    hash = "sha256-hSmE53LfpLAZosVWHqy3795UPqqLdknMVfWrIxAxWBM=";
+    hash = "sha256-9TMVg70kj25bSNvgVxeFNsY6YnBg+9KswOfcv4Y2SqA=";
   };
 
   build-system = [ hatchling ];

pkgs/development/python-modules/metaflow/default.nix

···
 
 buildPythonPackage rec {
   pname = "metaflow";
-  version = "2.15.7";
+  version = "2.15.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Netflix";
     repo = "metaflow";
     tag = version;
-    hash = "sha256-D7BwlDmsj2/RiZ//3cyw6Wti+6P2PwRmn0xsvPkyI54=";
+    hash = "sha256-so9bmMD0IgUP9FJCyVZa6rCp1iHhbHfB92KScW/ltQU=";
   };
 
   build-system = [

pkgs/development/python-modules/model-checker/default.nix

···
 
 buildPythonPackage rec {
   pname = "model-checker";
-  version = "0.9.17";
+  version = "0.9.18";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
···
   src = fetchPypi {
     pname = "model_checker";
     inherit version;
-    hash = "sha256-MD0w45a8c1sXUVfM5/pAZZ/WbM1bFGwBVQ37bch+Fcw=";
+    hash = "sha256-soOwym5oZZMLOOWTF14ZLcFX0RQcGnvC1Eg+k8qUMbo=";
   };
 
   # z3 does not provide a dist-info, so python-runtime-deps-check will fail

pkgs/development/python-modules/mypy-boto3/default.nix

···
       "sha256-4eY2gziQLvX2t39e201UitkV/Cs0E2RSP4yAG6/OdbI=";
 
   mypy-boto3-arc-zonal-shift =
-    buildMypyBoto3Package "arc-zonal-shift" "1.37.21"
-      "sha256-m88NXN/OxX65E92CnQoIZ9+Uq/D1idXzq3NvYQqEilM=";
+    buildMypyBoto3Package "arc-zonal-shift" "1.37.38"
+      "sha256-tCBeOSdgTbAYXxRfA9mH7ON5aAeXxbz3jNuRRoNxj5Q=";
 
   mypy-boto3-athena =
     buildMypyBoto3Package "athena" "1.37.0"
···
       "sha256-qGK4daMp3zODuppGz335Or5hpggK6uTkbQqfXOKq6eM=";
 
   mypy-boto3-budgets =
-    buildMypyBoto3Package "budgets" "1.37.0"
-      "sha256-M1WWs/HMcN0L9qK2eu4x+JmZsvbEbmxZzQBkjU5gfh4=";
+    buildMypyBoto3Package "budgets" "1.37.38"
+      "sha256-WdJfpMdYkmqNyh+YDnMJZ+q0gUC83e/L9lEnHsCQfrk=";
 
   mypy-boto3-ce =
     buildMypyBoto3Package "ce" "1.37.30"
···
       "sha256-MNUVaGlc2+UUEePFnslKpti//rJddHW4NZ8yZdOuQBU=";
 
   mypy-boto3-firehose =
-    buildMypyBoto3Package "firehose" "1.37.0"
-      "sha256-+OaeV4txp25XN9UB9GSLc9me9Isha918q2Hn3gyAPHM=";
+    buildMypyBoto3Package "firehose" "1.37.38"
+      "sha256-yJ0qwf+3vVS7l4tXqCPC44vvCTXJrDDQ5q5cArRSjqM=";
 
   mypy-boto3-fis =
     buildMypyBoto3Package "fis" "1.37.0"
···
       "sha256-g/KoroOmWZgWPfC0HMgLGQrGpr9QWEirTL3S9t7iMjs=";
 
   mypy-boto3-mediatailor =
-    buildMypyBoto3Package "mediatailor" "1.37.21"
-      "sha256-SssQmTozr5f/uwsbwmMZpkXKG4SWG43IkEmehVG53Lw=";
+    buildMypyBoto3Package "mediatailor" "1.37.38"
+      "sha256-TobCXyGJhfpcRO8s6n6tl/gXxEHo4m8DXR5k1IkzWdw=";
 
   mypy-boto3-medical-imaging =
     buildMypyBoto3Package "medical-imaging" "1.37.0"

pkgs/development/python-modules/notus-scanner/default.nix

···
 
 buildPythonPackage rec {
   pname = "notus-scanner";
-  version = "22.6.5";
+  version = "22.7.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
···
     owner = "greenbone";
     repo = "notus-scanner";
     tag = "v${version}";
-    hash = "sha256-PPwQjZIKSQ1OmyYJ8ErkqdbHZfH4iHPMiDdKZ3imBwo=";
+    hash = "sha256-iTcGo33GRf+CihSRuK1GFXOpYL6TT8e3CRyK2/AA38U=";
   };
 
   pythonRelaxDeps = [
···
   meta = with lib; {
     description = "Helper to create results from local security checks";
     homepage = "https://github.com/greenbone/notus-scanner";
-    changelog = "https://github.com/greenbone/notus-scanner/releases/tag/v${version}";
+    changelog = "https://github.com/greenbone/notus-scanner/releases/tag/${src.tag}";
     license = with licenses; [ agpl3Plus ];
     maintainers = with maintainers; [ fab ];
   };

pkgs/development/python-modules/okta/default.nix

···
 
 buildPythonPackage rec {
   pname = "okta";
-  version = "2.9.11";
+  version = "2.9.12";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Ca+xjr1aqCX7MmEb7MXD63Dhib/8hggnudj32pjiTyw=";
+    hash = "sha256-pu5UEVgys6glBnWCIozj2dubQvnF75KCA6fxeujx/pA=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/oracledb/default.nix

···
 
 buildPythonPackage rec {
   pname = "oracledb";
-  version = "3.0.0";
+  version = "3.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ZNyG7lwDL+vFVnmLBuewAO9oKLsCUghPat2srTNj24U=";
+    hash = "sha256-94z3RSEo+lZKmBnSE1c6fJPjsFOysu9QXxg85+R7Hns=";
   };
 
   build-system = [

pkgs/development/python-modules/playwrightcapture/default.nix

···
   beautifulsoup4,
   buildPythonPackage,
   dateparser,
+  dnspython,
   fetchFromGitHub,
   playwright-stealth,
   playwright,
···
 
 buildPythonPackage rec {
   pname = "playwrightcapture";
-  version = "1.28.6";
+  version = "1.29.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
···
     owner = "Lookyloo";
     repo = "PlaywrightCapture";
     tag = "v${version}";
-    hash = "sha256-f1XCNDc2oNJ/EM8S12nCSYtQh7nUi4UROEzTuOH41Ds=";
+    hash = "sha256-p2EprahxHqq4jL7bdnq1+BK3IPea5tZLu/X4N+kZLSY=";
   };
 
   pythonRelaxDeps = [
···
     aiohttp-socks
     beautifulsoup4
     dateparser
+    dnspython
     playwright
     playwright-stealth
     puremagic

pkgs/development/python-modules/posthog/default.nix

···
 
 buildPythonPackage rec {
   pname = "posthog";
-  version = "3.23.0";
+  version = "3.25.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PostHog";
     repo = "posthog-python";
     tag = "v${version}";
-    hash = "sha256-+nmCmO1vPnNgZJdZSWwapeFfckNXEcdc/129yaLygf8=";
+    hash = "sha256-DETcD6VJseQelGhSYKqXpIxsQxB3/5RY2wWB9pxhI68=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/pydantic-compat/default.nix

···
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  git,
   hatch-vcs,
   hatchling,
+  gitMinimal,
   importlib-metadata,
   pydantic,
   pytestCheckHook,
-  pythonOlder,
 }:
 
 buildPythonPackage rec {
···
   version = "0.1.2";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchFromGitHub {
     owner = "pyapp-kit";
     repo = "pydantic-compat";
     tag = "v${version}";
-    hash = "sha256-YJUfWu+nyGlwpJpxYghCKzj3CasdAaqYoNVCcfo/7YE=";
     leaveDotGit = true;
+    hash = "sha256-YJUfWu+nyGlwpJpxYghCKzj3CasdAaqYoNVCcfo/7YE=";
   };
 
-  nativeBuildInputs = [
-    git
+  build-system = [
     hatch-vcs
     hatchling
   ];
 
-  propagatedBuildInputs = [
+  nativeBuildInputs = [
+    gitMinimal
+  ];
+
+  dependencies = [
     importlib-metadata
     pydantic
   ];
 
+  pythonImportsCheck = [ "pydantic_compat" ];
+
   nativeCheckInputs = [ pytestCheckHook ];
 
-  pythonImportsCheck = [ "pydantic_compat" ];
+  pytestFlagsArray = [
+    "-W"
+    # pydantic.warnings.PydanticDeprecatedSince211: Accessing this attribute on the instance is
+    # deprecated, and will be removed in Pydantic V3. Instead, you should access this attribute from
+    # the model class. Deprecated in Pydantic V2.11 to be removed in V3.0.
+    "ignore::pydantic.warnings.PydanticDeprecatedSince211"
+  ];
 
-  meta = with lib; {
+  meta = {
     description = "Compatibility layer for pydantic v1/v2";
     homepage = "https://github.com/pyapp-kit/pydantic-compat";
     changelog = "https://github.com/pyapp-kit/pydantic-compat/releases/tag/v${version}";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ fab ];
   };
 }

pkgs/development/python-modules/pyexploitdb/default.nix

···
 
 buildPythonPackage rec {
   pname = "pyexploitdb";
-  version = "0.2.76";
+  version = "0.2.77";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
···
   src = fetchPypi {
     pname = "pyExploitDb";
     inherit version;
-    hash = "sha256-HcedkHQVatxyoVHRxivTd5vPxs4zMkLC2X27cmmAcMo=";
+    hash = "sha256-x6RY+9jmZ/+7Q18FRmfoVgSqhCN8h7Kp0kMayY3xec8=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/pylutron/default.nix

···
 
 buildPythonPackage rec {
   pname = "pylutron";
-  version = "0.2.16";
+  version = "0.2.18";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-SuG5x8GWTsCOve3jj1hrtsm37yNRHVFuFjapQafHTbA=";
+    hash = "sha256-7ZnNfa4POUTMi9sDGMyR6gu9Xpg+j/JmyWVnBBSnRSE=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/pyschlage/default.nix

···
 
 buildPythonPackage rec {
   pname = "pyschlage";
-  version = "2024.11.0";
+  version = "2025.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
···
     owner = "dknowles2";
     repo = "pyschlage";
     tag = version;
-    hash = "sha256-ftoBchKK3I0kzw70MPaAlo/M2YLUx8OFwMNkJQ3itbo=";
+    hash = "sha256-RgPobb9RhM+eFX3Y+wSKlDQ6SddnGKlNTG1nIeEVDFs=";
   };
 
   build-system = [

pkgs/development/python-modules/reflex/default.nix

···
 
 buildPythonPackage rec {
   pname = "reflex";
-  version = "0.7.7";
+  version = "0.7.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "reflex-dev";
     repo = "reflex";
     tag = "v${version}";
-    hash = "sha256-27sgU9ugSkStDOg64W1RgiqmlbOzrdxg7kz2AztfERA=";
+    hash = "sha256-/Kf1V1goGaoYarhJ9wlZ2lf6e3BUH/F7UJqoPEnMnk0=";
   };
 
   # 'rich' is also somehow checked when building the wheel,

pkgs/development/python-modules/rioxarray/default.nix

···
 {
   lib,
   buildPythonPackage,
-  pythonOlder,
   fetchFromGitHub,
 
   # build-system
   setuptools,
+
   # dependencies
   numpy,
   packaging,
   pyproj,
   rasterio,
   xarray,
+
   # tests
   dask,
   netcdf4,
···
 
 buildPythonPackage rec {
   pname = "rioxarray";
-  version = "0.18.2";
+  version = "0.19.0";
   pyproject = true;
-  disabled = pythonOlder "3.10";
 
   src = fetchFromGitHub {
     owner = "corteva";
     repo = "rioxarray";
     tag = version;
-    hash = "sha256-HNtMLY83e6MQakIlmsJohmhjDWiM5/hqq25qSY1dPBw=";
+    hash = "sha256-tNcBuMyBVDVPbmujfn4WauquutOEn727lxcR19hfyuE=";
   };
 
   build-system = [ setuptools ];
···
   ];
 
   disabledTests =
-    [ "test_clip_geojson__no_drop" ]
-    ++ lib.optionals
-      (stdenv.hostPlatform.system == "aarch64-linux" || stdenv.hostPlatform.system == "aarch64-darwin")
-      [
-        # numerical errors
-        "test_clip_geojson"
-        "test_open_rasterio_mask_chunk_clip"
-      ];
+    [
+      # AssertionError: assert 535727386 == 535691205
+      "test_clip_geojson__no_drop"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isAarch64 [
+      # numerical errors
+      "test_clip_geojson"
+      "test_open_rasterio_mask_chunk_clip"
+    ];
 
   pythonImportsCheck = [ "rioxarray" ];
 
   meta = {
-    description = "geospatial xarray extension powered by rasterio";
+    description = "Geospatial xarray extension powered by rasterio";
     homepage = "https://corteva.github.io/rioxarray/";
-    changelog = "https://github.com/corteva/rioxarray/releases/tag/${src.tag}";
+    changelog = "https://github.com/corteva/rioxarray/releases/tag/${version}";
     license = lib.licenses.asl20;
     maintainers = lib.teams.geospatial.members;
   };

pkgs/development/python-modules/tencentcloud-sdk-python/default.nix

···
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1362";
+  version = "3.0.1363";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
···
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = version;
-    hash = "sha256-twAjyHTHEy1FNH0yBRrvb8va2pau4HpeunN1oGiTNzY=";
+    hash = "sha256-VcPedb0qTAzZQpHBAcJtZZhBcGasMcBxH9MQ5tnHcks=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/venstarcolortouch/default.nix

···
 
 buildPythonPackage rec {
   pname = "venstarcolortouch";
-  version = "0.19";
+  version = "0.20";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-QjcoF46GrBH7ExGQno8xDgtOSGNxhAP+NycJb22hL+E=";
+    hash = "sha256-HX1GPhLksD7T0jbnGxk85CgF8bnPXWrUnbOgCKsmeT0=";
   };
 
   propagatedBuildInputs = [ requests ];

pkgs/games/armagetronad/default.nix

···
       # https://gitlab.com/armagetronad/armagetronad/-/commits/trunk/?ref_type=heads
       ${unstableVersionMajor} =
         let
-          rev = "391a74625c1222dd180f069f1b61c3e069a3ba8c";
-          hash = "sha256-fUY0dBj85k0QhnAoDzyBmmKmRh9oCYC6r6X4ukt7/L0=";
+          rev = "1830e09888597b372fad192b0d246aefe555540c";
+          hash = "sha256-svVcg2AMk2GHmg1Szny10KCLZQ6Cly1RrSVNGmf7Fdg=";
         in
         dedicatedServer: {
           version = "${unstableVersionMajor}-${builtins.substring 0 8 rev}";

pkgs/servers/monitoring/grafana/default.nix

···
 in
 buildGoModule rec {
   pname = "grafana";
-  version = "11.6.0";
+  version = "11.6.0+security-01";
 
   subPackages = [
     "pkg/cmd/grafana"
···
     owner = "grafana";
     repo = "grafana";
     rev = "v${version}";
-    hash = "sha256-oXotHi79XBhxD/qYC7QDQwn7jiX0wKWe/RXZS5DwN9o=";
+    hash = "sha256-JG4Dr0CGDYHH6hBAAtdHPO8Vy9U/bg4GPzX6biZk028=";
   };
 
   # borrowed from: https://github.com/NixOS/nixpkgs/blob/d70d9425f49f9aba3c49e2c389fe6d42bac8c5b0/pkgs/development/tools/analysis/snyk/default.nix#L20-L22
···
 
   postPatch = patchGoVersion;
 
-  vendorHash = "sha256-cYE43OAagPHFhWsUJLMcJVfsJj6d0vUqzjbAviYSuSc=";
+  vendorHash = "sha256-Ziohfy9fMVmYnk9c0iRNi4wJZd2E8vCP+ozsTM0eLTA=";
 
   proxyVendor = true;
 

pkgs/servers/osrm-backend/boost187-compat.patch

···
-diff --git a/include/server/server.hpp b/include/server/server.hpp
-index 34b8982e67a..02b0dda050d 100644
---- a/include/server/server.hpp
-+++ b/include/server/server.hpp
-@@ -53,8 +53,7 @@ class Server
-         const auto port_string = std::to_string(port);
- 
-         boost::asio::ip::tcp::resolver resolver(io_context);
--        boost::asio::ip::tcp::resolver::query query(address, port_string);
--        boost::asio::ip::tcp::endpoint endpoint = *resolver.resolve(query);
-+        boost::asio::ip::tcp::endpoint endpoint = *resolver.resolve(address, port_string).begin();
- 
-         acceptor.open(endpoint.protocol());
- #ifdef SO_REUSEPORT

pkgs/servers/osrm-backend/default.nix pkgs/by-name/os/osrm-backend/package.nix

···
   boost,
   lua,
   luabind,
-  tbb,
+  tbb_2022_0,
   expat,
   nixosTests,
 }:
 
-stdenv.mkDerivation {
+let
+  tbb = tbb_2022_0;
+in
+stdenv.mkDerivation rec {
   pname = "osrm-backend";
-  version = "5.27.1-unstable-2024-11-03";
+  version = "6.0.0";
 
   src = fetchFromGitHub {
     owner = "Project-OSRM";
     repo = "osrm-backend";
-    rev = "3614af7f6429ee35c3f2e836513b784a74664ab6";
-    hash = "sha256-iix++G49cC13wZGZIpXu1SWGtVAcqpuX3GhsIaETzUU=";
+    tag = "V${version}";
+    hash = "sha256-R2Sx+DbT6gROI8X1fkxqOGbMqgmsnNiw2rUX6gSZuTs=";
   };
-
-  patches = [
-    # Taken from https://github.com/Project-OSRM/osrm-backend/pull/7073.
-    ./boost187-compat.patch
-  ];
 
   nativeBuildInputs = [
     cmake
···
   };
 
   meta = {
-    homepage = "https://github.com/Project-OSRM/osrm-backend/wiki";
+    homepage = "https://project-osrm.org/";
     description = "Open Source Routing Machine computes shortest paths in a graph. It was designed to run well with map data from the Openstreetmap Project";
-    changelog = "https://github.com/Project-OSRM/osrm-backend/blob/master/CHANGELOG.md";
+    changelog = "https://github.com/Project-OSRM/osrm-backend/blob/${src.tag}/CHANGELOG.md";
     license = lib.licenses.bsd2;
     maintainers = with lib.maintainers; [ erictapen ];
     platforms = lib.platforms.unix;

pkgs/servers/web-apps/wordpress/packages/default.nix

···
     }
     // lib.mapAttrs (
       type: pkgs:
-      lib.makeExtensible (
-        _:
-        lib.mapAttrs (
-          pname: data:
-          self.mkOfficialWordpressDerivation {
-            type = lib.removeSuffix "s" type;
-            inherit pname data;
-            license = sourceJson.${type}.${pname};
-          }
-        ) pkgs
+      lib.recurseIntoAttrs (
+        lib.makeExtensible (
+          _:
+          lib.mapAttrs (
+            pname: data:
+            self.mkOfficialWordpressDerivation {
+              type = lib.removeSuffix "s" type;
+              inherit pname data;
+              license = sourceJson.${type}.${pname};
+            }
+          ) pkgs
+        )
       )
     ) generatedJson;
 

pkgs/tools/package-management/lix/common-nix-eval-jobs.nix

···
   # point 'nix edit' and ofborg at the file that defines the attribute,
   # not this common file.
   pos = builtins.unsafeGetAttrPos "version" args;
+
+  # Since this package is intimately tied to a specific Nix release, we
+  # propagate the Nix used for building it to make it easier for users
+  # downstream to reference it.
+  passthru = {
+    nix = lix;
+  };
+
   meta = {
     description = "Hydra's builtin `hydra-eval-jobs` as a standalone tool";
     mainProgram = "nix-eval-jobs";

pkgs/tools/package-management/lix/default.nix

···
   editline,
   ncurses,
   clangStdenv,
+  nix-fast-build,
 
   storeDir ? "/nix/store",
   stateDir ? "/nix/var",
···
 
         nix-eval-jobs = self.callPackage (callPackage ./common-nix-eval-jobs.nix nix-eval-jobs-args) {
           stdenv = lixStdenv;
+        };
+
+        nix-fast-build = nix-fast-build.override {
+          inherit (self) nix-eval-jobs;
         };
       }
     );

pkgs/tools/security/cnspec/default.nix

···
 
 buildGoModule rec {
   pname = "cnspec";
-  version = "11.50.0";
+  version = "11.51.1";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     tag = "v${version}";
-    hash = "sha256-Ope7bPXTNMWuRlGWBuqjp31xCH6bjbgu6Hjf9sSQB+0=";
+    hash = "sha256-iTS8+ZmJWHRA6VSwei9mIWPqZHshb8JniXSXl+hGyPg=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-EChYXDMsk40NyOHTZNMEbfcTu3vqoFgR4n8PXTlerV0=";
+  vendorHash = "sha256-TbIXNPMygNXqX2TCbkZOhXpdoz/cjZD5uoItgmYf7wk=";
 
   subPackages = [ "apps/cnspec" ];
 

pkgs/tools/security/trufflehog/default.nix

···
 
 buildGoModule rec {
   pname = "trufflehog";
-  version = "3.88.24";
+  version = "3.88.25";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     tag = "v${version}";
-    hash = "sha256-50IKxJAuR8IMcKArnIE8BHlssKSGthfFVc+h+M/+204=";
+    hash = "sha256-yAGeB2+FGtdL5zbJkYL96RPf+jBoCSPz1OpFV9tsGdk=";
   };
 
-  vendorHash = "sha256-eyAHR9tx9Fvih/KZZX8FtcDZyMn93X6b08iADEyIiZw=";
+  vendorHash = "sha256-uNJmM1xVaSaAGolb1ArRkr3iQ8Yar2MEY8/G0AhGAuU=";
 
   nativeBuildInputs = [ makeWrapper ];
 

pkgs/top-level/all-packages.nix

···
     stdenv = if stdenv.hostPlatform.isDarwin then gccStdenv else stdenv;
   };
 
-  eigen = callPackage ../development/libraries/eigen { };
-
-  eigen2 = callPackage ../development/libraries/eigen/2.0.nix { };
-
   vapoursynth-editor = libsForQt5.callPackage ../by-name/va/vapoursynth/editor.nix { };
 
   vmmlib = callPackage ../development/libraries/vmmlib { };
···
   opensmtpd = callPackage ../servers/mail/opensmtpd { };
   opensmtpd-extras = callPackage ../servers/mail/opensmtpd/extras.nix { };
   opensmtpd-filter-rspamd = callPackage ../servers/mail/opensmtpd/filter-rspamd.nix { };
-  osrm-backend = callPackage ../servers/osrm-backend {
-    tbb = tbb_2021_11;
-  };
 
   system-sendmail = lowPrio (callPackage ../servers/mail/system-sendmail { });
 
···
     gmp-static = gmp.override { withStatic = true; };
   };
 
-  inherit (callPackages ../applications/science/logic/z3 { python = python3; })
-    z3_4_14
-    z3_4_13
-    z3_4_12
-    z3_4_11
-    z3_4_8
-    z3_4_8_5
-    ;
-  z3 = z3_4_13;
-  z3-tptp = callPackage ../applications/science/logic/z3/tptp.nix { };
-
   tlaplus = callPackage ../applications/science/logic/tlaplus {
     jre = jre8; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731
   };
···
     wordpress_6_7
     ;
 
-  wordpressPackages = (
+  wordpressPackages = recurseIntoAttrs (
     callPackage ../servers/web-apps/wordpress/packages {
       plugins = lib.importJSON ../servers/web-apps/wordpress/packages/plugins.json;
       themes = lib.importJSON ../servers/web-apps/wordpress/packages/themes.json;

pkgs/top-level/python-packages.nix

···
 
   yubico-client = callPackage ../development/python-modules/yubico-client { };
 
-  z3-solver =
-    (toPythonModule (
-      (pkgs.z3.override { inherit python; }).overrideAttrs (_: {
-        pname = "z3-solver";
-      })
-    )).python;
+  z3-solver = (toPythonModule (pkgs.z3.override { python3 = python; })).python;
 
   z3c-checkversions = callPackage ../development/python-modules/z3c-checkversions { };