Merge remote-tracking branch 'origin/master' into staging-next

maintainers/scripts/bootstrap-files/refresh-tarballs.bash

···
     riscv64-unknown-linux-gnu
     s390x-unknown-linux-gnu
     x86_64-unknown-freebsd
+    loongarch64-unknown-linux-gnu
 )
 
 is_cross() {
···
 
             # individual file entries
             cat <<EOF
-$attr = import <nix/fetchurl.nix> {
+  $attr = import <nix/fetchurl.nix> {
     url = "http://tarballs.nixos.org/${s3_prefix}/${nixpkgs_revision}/$fname";
     hash = "${sri}";$(
     [[ -n ${executable_nix} ]] && printf "\n    %s" "${executable_nix}"
     [[ -n ${name_nix} ]]       && printf "\n    %s" "${name_nix}"
     [[ -n ${unpack_nix} ]]     && printf "\n    %s" "${unpack_nix}"
     )
-};
+  };
 EOF
     done
     # footer

nixos/doc/manual/release-notes/rl-2505.section.md

···
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- Initial support for the [COSMIC DE](https://system76.com/cosmic), a Rust-based desktop environment by System76, makers of Pop!_OS. Toggle the greeter (login manager) using `services.displayManager.cosmic-greeter.enable` and the DE itself with `services.desktopManager.cosmic.enable`. Mostly stable but still experimental. Please report any issues to the [COSMIC DE tracker in Nixpkgs](https://github.com/NixOS/nixpkgs/issues/259641) instead of upstream.
+- NixOS now has initial support for the [**COSMIC DE**](https://system76.com/cosmic) which is currently at **Alpha 7**. COSMIC is a Rust-based Desktop Environment by System76, makers of Pop!_OS. Enable COSMIC by enabling the greeter (login manager) `services.displayManager.cosmic-greeter.enable` and the DE itself by enabling `services.desktopManager.cosmic.enable` options. The support in NixOS/nixpkgs is stable but still considered experimental because of the recent the addition. The COSMIC maintainers will be waiting for one more release of NixOS to determine if the experimental tag should be removed or not. Until then, please report any issues to the [COSMIC DE tracker in Nixpkgs](https://github.com/NixOS/nixpkgs/issues/259641) instead of upstream.
 
 - `services.dex` now restarts upon changes to the `.environmentFile` or entries in `.settings.staticClients[].secretFile` when the entry is a `path` type.
 
···
 - [GlitchTip](https://glitchtip.com/), an open source Sentry API compatible error tracking platform. Available as [services.glitchtip](#opt-services.glitchtip.enable).
 
 - [`yarr`](https://github.com/nkanaev/yarr), a small, web-based feed aggregator and RSS reader. Available as [services.yarr](#opt-services.yarr.enable).
+
+- [OliveTin](https://www.olivetin.app/), gives safe and simple access to predefined shell commands from a web interface. Available as [services.olivetin](#opt-services.olivetin.enable).
 
 - [Stash](https://github.com/stashapp/stash), An organizer for your adult videos/images, written in Go. Available as [services.stash](#opt-services.stash.enable).
 
···
   To get the necessary hash of the vendored dependencies, omit `hash`. The build will fail and tell you the correct value.
 
   Note that all provided plugins must have versions/tags (string after `@`), even if upstream repo does not tag each release. For untagged plugins, you can either create an empty Go project and run `go get <plugin>` and see changes in `go.mod` to get the pseudo-version number, or provide a commit hash in place of version/tag for the first run, and update the plugin string based on the error output.
+
+- `buildGoModule` now supports a self-referencing `finalAttrs:` parameter
+  containing the final arguments including overrides.
+  This allows packaging configuration to be overridden in a consistent manner by
+  providing an alternative to `rec {}` syntax.
 
 - KDE Partition Manager `partitionmanager`'s support for ReiserFS is removed.
   ReiserFS has not been actively maintained for many years. It has been marked as obsolete since Linux 6.6, and

nixos/modules/module-list.nix

···
   ./services/web-apps/mediagoblin.nix
   ./services/web-apps/open-web-calendar.nix
   ./services/web-apps/mobilizon.nix
+  ./services/web-apps/olivetin.nix
   ./services/web-apps/openwebrx.nix
   ./services/web-apps/outline.nix
   ./services/web-apps/pds.nix

nixos/modules/services/web-apps/olivetin.nix

···
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.services.olivetin;
+
+  settingsFormat = pkgs.formats.yaml { };
+in
+
+{
+  meta.maintainers = with lib.maintainers; [ defelo ];
+
+  options.services.olivetin = {
+    enable = lib.mkEnableOption "OliveTin";
+
+    package = lib.mkPackageOption pkgs "olivetin" { };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      description = "The user account under which OliveTin runs.";
+      default = "olivetin";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      description = "The group under which OliveTin runs.";
+      default = "olivetin";
+    };
+
+    path = lib.mkOption {
+      type =
+        with lib.types;
+        listOf (oneOf [
+          package
+          str
+        ]);
+      description = ''
+        Packages added to the service's {env}`PATH`.
+      '';
+      defaultText = lib.literalExpression ''
+        with pkgs; [ bash ]
+      '';
+    };
+
+    settings = lib.mkOption {
+      description = ''
+        Configuration of OliveTin. See <https://docs.olivetin.app/config.html> for more information.
+      '';
+      default = { };
+
+      type = lib.types.submodule {
+        freeformType = settingsFormat.type;
+
+        options = {
+          ListenAddressSingleHTTPFrontend = lib.mkOption {
+            type = lib.types.str;
+            description = ''
+              The address to listen on for the internal "microproxy" frontend.
+            '';
+            default = "127.0.0.1:8000";
+            example = "0.0.0.0:8000";
+          };
+        };
+      };
+    };
+
+    extraConfigFiles = lib.mkOption {
+      type = lib.types.listOf lib.types.path;
+      default = [ ];
+      example = [ "/run/secrets/olivetin.yaml" ];
+      description = ''
+        Config files to merge into the settings defined in [](#opt-services.olivetin.settings).
+        This is useful to avoid putting secrets into the nix store.
+        See <https://docs.olivetin.app/config.html> for more information.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.olivetin = {
+      path = with pkgs; [ bash ];
+    };
+
+    systemd.services.olivetin = {
+      description = "OliveTin";
+
+      wantedBy = [ "multi-user.target" ];
+
+      wants = [
+        "network-online.target"
+        "local-fs.target"
+      ];
+      after = [
+        "network-online.target"
+        "local-fs.target"
+      ];
+
+      inherit (cfg) path;
+
+      preStart = ''
+        tmp="$(mktemp -d)"
+        trap 'rm -rf "$tmp"' EXIT
+        cd "$tmp"
+
+        cp ${settingsFormat.generate "olivetin-config.yaml" cfg.settings} config.yaml
+        chmod +w config.yaml
+        for ((i=0; i < ${toString (lib.length cfg.extraConfigFiles)}; i++)); do
+          ${lib.getExe pkgs.yq} -yi '
+            def merge($y):
+              . as $x |
+              if ($x | type == "object") and ($y | type == "object") then
+                $x + $y + with_entries(select(.key | in($y)) | .key as $key | .value |= merge($y[$key]))
+              elif ($x | type == "array") and ($y | type == "array") then
+                $x + $y
+              else
+                $y
+              end;
+            merge($f | fromjson)
+          ' config.yaml --rawfile f <(${lib.getExe pkgs.yq} -c . "$CREDENTIALS_DIRECTORY/config-$i.yaml")
+        done
+        chmod -w config.yaml
+
+        mkdir -p /run/olivetin/config
+        mv config.yaml /run/olivetin/config/config.yaml
+      '';
+
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        RuntimeDirectory = "olivetin";
+        Restart = "always";
+
+        LoadCredential = lib.imap0 (i: path: "config-${toString i}.yaml:${path}") cfg.extraConfigFiles;
+
+        ExecStart = "${lib.getExe cfg.package} -configdir /run/olivetin/config";
+      };
+    };
+
+    users.users = lib.mkIf (cfg.user == "olivetin") {
+      olivetin = {
+        group = cfg.group;
+        isSystemUser = true;
+      };
+    };
+
+    users.groups = lib.mkIf (cfg.group == "olivetin") { olivetin = { }; };
+  };
+}

nixos/tests/all-tests.nix

···
   oddjobd = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./oddjobd.nix { };
   obs-studio = runTest ./obs-studio.nix;
   oh-my-zsh = handleTest ./oh-my-zsh.nix { };
+  olivetin = runTest ./olivetin.nix;
   ollama = runTest ./ollama.nix;
   ollama-cuda = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./ollama-cuda.nix;
   ollama-rocm = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./ollama-rocm.nix;

nixos/tests/olivetin.nix

···
+{ lib, ... }:
+
+{
+  name = "olivetin";
+  meta.maintainers = with lib.maintainers; [ defelo ];
+
+  nodes.machine = {
+    services.olivetin = {
+      enable = true;
+      settings = {
+        actions = [
+          {
+            id = "hello_world";
+            title = "Say Hello";
+            shell = "echo -n 'Hello World!' | tee /tmp/result";
+          }
+        ];
+      };
+      extraConfigFiles = [
+        (builtins.toFile "secrets.yaml" ''
+          actions:
+            - id: secret
+              title: Secret Action
+              shell: echo -n secret > /tmp/result2
+        '')
+      ];
+    };
+  };
+
+  interactive.nodes.machine = {
+    services.olivetin.settings.ListenAddressSingleHTTPFrontend = "0.0.0.0:8000";
+    networking.firewall.allowedTCPPorts = [ 8000 ];
+    virtualisation.forwardPorts = [
+      {
+        from = "host";
+        host.port = 8000;
+        guest.port = 8000;
+      }
+    ];
+  };
+
+  testScript = ''
+    import json
+
+    machine.wait_for_unit("olivetin.service")
+    machine.wait_for_open_port(8000)
+
+    response = json.loads(machine.succeed("curl http://localhost:8000/api/StartActionByGetAndWait/hello_world"))
+    assert response["logEntry"]["exitCode"] == 0
+    assert response["logEntry"]["output"] == "Hello World!"
+    assert machine.succeed("cat /tmp/result") == "Hello World!"
+
+    response = json.loads(machine.succeed("curl http://localhost:8000/api/StartActionByGetAndWait/secret"))
+    assert response["logEntry"]["exitCode"] == 0
+    assert machine.succeed("cat /tmp/result2") == "secret"
+  '';
+}

pkgs/applications/editors/android-studio/default.nix

···
     sha256Hash = "sha256-VNXErfb4PhljcJwGq863ldh/3i8fMdJirlwolEIk+fI=";
   };
   betaVersion = {
-    version = "2024.3.2.11"; # "Android Studio Meerkat Feature Drop | 2024.3.2 RC 2"
-    sha256Hash = "sha256-pE17kbLnsEMRtaQencKqckW3uke9IliLkoHP6q3NrQg=";
+    version = "2024.3.2.12"; # "Android Studio Meerkat Feature Drop | 2024.3.2 RC 3"
+    sha256Hash = "sha256-wmCPkYV88/OwuPqm10t3jT1x+cFRK+7Mgy683Au1P3g=";
   };
   latestVersion = {
-    version = "2025.1.1.6"; # "Android Studio Narwhal | 2025.1.1 Canary 6"
-    sha256Hash = "sha256-FUDb8/kyvO3M/NJp30VZCyNacJ90y/fawrDTFin7g6o=";
+    version = "2025.1.1.7"; # "Android Studio Narwhal | 2025.1.1 Canary 7"
+    sha256Hash = "sha256-RQOmTzmk0el8WXE3cnSBCnpginFk0bK45Aij7eil1uM=";
   };
 in
 {

pkgs/applications/editors/vim/plugins/generated.nix

···
     meta.hydraPlatforms = [ ];
   };
 
+  peek-nvim = buildVimPlugin {
+    pname = "peek.nvim";
+    version = "2024-04-09";
+    src = fetchFromGitHub {
+      owner = "toppair";
+      repo = "peek.nvim";
+      rev = "5820d937d5414baea5f586dc2a3d912a74636e5b";
+      sha256 = "01bdrk1h1xaq2bbbgwsrb2h2cc9j2d88kjcx2k3p8j8kgk20yql4";
+    };
+    meta.homepage = "https://github.com/toppair/peek.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   persisted-nvim = buildVimPlugin {
     pname = "persisted.nvim";
     version = "2025-03-30";

pkgs/applications/editors/vim/plugins/overrides.nix

···
     ];
   };
 
+  peek-nvim = super.peek-nvim.overrideAttrs {
+    runtimeDeps = [ deno ];
+  };
+
   persisted-nvim = super.persisted-nvim.overrideAttrs {
     nvimSkipModules = [
       # /lua/persisted/init.lua:44: attempt to index upvalue 'config' (a nil value)

pkgs/applications/editors/vim/plugins/vim-plugin-names

···
 https://github.com/lewis6991/pckr.nvim/,HEAD,
 https://github.com/tmsvg/pear-tree/,,
 https://github.com/steelsojka/pears.nvim/,,
+https://github.com/toppair/peek.nvim/,HEAD,
 https://github.com/olimorris/persisted.nvim/,HEAD,
 https://github.com/folke/persistence.nvim/,,
 https://github.com/Weissle/persistent-breakpoints.nvim/,,

pkgs/applications/emulators/mame/default.nix

···
 
   # Since the bug described in https://github.com/NixOS/nixpkgs/issues/135438,
   # it is not possible to use substituteAll
-  postPatch = ''
-    substituteInPlace src/emu/emuopts.cpp \
-      --subst-var-by mamePath "$out/opt/mame"
-  '';
+  postPatch =
+    ''
+      substituteInPlace src/emu/emuopts.cpp \
+        --subst-var-by mamePath "$out/opt/mame"
+    ''
+    # MAME's build system uses `sw_vers` to test whether it needs to link with
+    # the Metal framework or not. However:
+    # a) that would return the build system's version, not the target's, and
+    # b) it can't actually find `sw_vers` in $PATH, so it thinks it's on macOS
+    #    version 0, and doesn't link with Metal - causing missing symbol errors
+    #    when it gets to the link step, because other parts of the build system
+    #    _do_ use the correct target version number.
+    # This replaces the `sw_vers` call with the macOS version actually being
+    # targeted, so everything gets linked correctly.
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      for file in scripts/src/osd/{mac,sdl}.lua; do
+        substituteInPlace "$file" --replace-fail \
+          'backtick("sw_vers -productVersion")' \
+          "os.getenv('MACOSX_DEPLOYMENT_TARGET') or '$darwinMinVersion'"
+        done
+    '';
 
   desktopItems = [
     (makeDesktopItem {

pkgs/applications/networking/browsers/chromium/info.json

···
     }
   },
   "ungoogled-chromium": {
-    "version": "135.0.7049.95",
+    "version": "135.0.7049.114",
     "deps": {
       "depot_tools": {
         "rev": "85ec2718b5a29990c7eb67778348c9f76a00f392",
···
         "hash": "sha256-8NynNvLNCHxy8EYmsnPovKhXu9DcDcYBhg4A6d2QIfY="
       },
       "ungoogled-patches": {
-        "rev": "135.0.7049.95-1",
-        "hash": "sha256-kLLtJti5GIF9TT0cH8zvsxywJzD22X8u2bB/tqENSjo="
+        "rev": "135.0.7049.114-1",
+        "hash": "sha256-frUL7b+4CyrzBa5T1HzFseWHwFa2MPgkpkrFeASWyLA="
       },
       "npmHash": "sha256-wNrZaugdKJCyV1WchkKXzr/I1OW1AtjiC2p7qTZZOqU="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "de2eb485a1951079e63bdb57ce25544d2dc79c15",
-        "hash": "sha256-6ydyJWsDawt0bfYAFHotTB9ujmIYsqUUpNwB6q6RNQE=",
+        "rev": "63fd8a7d9d09e41ba37b84386c85d5f249f848f7",
+        "hash": "sha256-U6OJHocA6vI36QCU8UITUsVlentm210CwdThCwlDw5E=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {

pkgs/applications/office/softmaker/softmaker-office-nx.nix

···
   # overridable. This is useful when the upstream archive was replaced
   # and nixpkgs is not in sync yet.
   officeVersion ? {
-    version = "1222";
+    version = "1224";
     edition = "";
-    hash = "sha256-8ya9RYpd9G5SITYOpvhxjQE8ieV8TuAApkjNwCf9nHs=";
+    hash = "sha256-Y6x5E8WeI7Pf/wczWNKnHsCbXWW4Jdzo4ToBdzgmOF8=";
   },
 
   ...

pkgs/applications/office/softmaker/softmaker-office.nix

···
   # Softmaker Office or when the upstream archive was replaced and
   # nixpkgs is not in sync yet.
   officeVersion ? {
-    version = "1222";
+    version = "1224";
     edition = "2024";
-    hash = "sha256-eyYBK5ZxPcBakOvXUQZIU2aftyH6PXh/rtqC/1BJhg4=";
+    hash = "sha256-ix9R9Xlugvu5qmKAqC2DsZFhyJ+VVsD7MSpBv+4lmTY=";
   },
 
   ...

pkgs/by-name/al/alistral/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "alistral";
-  version = "0.5.6";
+  version = "0.5.8";
 
   src = fetchFromGitHub {
     owner = "RustyNova016";
     repo = "Alistral";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6p2KMFTdC04lEhNQiu88ALBPrpQUF9JhXDacntoq4lE=";
+    hash = "sha256-LSuNVfGus9kO1g4EfVCw6yWxudvYqBnM5mpJWH7MBCs=";
   };
 
   # remove if updating to rust 1.85
···
   '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-2pi2hfQTLs2HAlgp1DQCMFp/nMJQfcuQFhGlrsWgy5E=";
+  cargoHash = "sha256-lq+0R5g4MwVm8ESjKpz+aymjpqcaAE856XnBtYXYs8A=";
 
   env.RUSTC_BOOTSTRAP = 1;
 

pkgs/by-name/am/amazon-q-cli/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "amazon-q-cli";
-  version = "1.7.3";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "amazon-q-developer-cli";
     tag = "v${version}";
-    hash = "sha256-Hi0klNNxtWlZvcqobb8Y2hLsw/Pck1YQZB4AYBmcNKI=";
+    hash = "sha256-fOz9oz+xNwX2Bzl6szgQ9oai6lqP+EzbaCNzHPUT2cA=";
   };
 
   useFetchCargoVendor = true;
 
-  cargoHash = "sha256-XK6B2OTCnWMow3KHWU6OK1HsyQW7apcLoYRP7viTte0=";
+  cargoHash = "sha256-H9bCke3vQDuS6RDEg8dzeFiBWCex64A8KSRhfgyp8e8=";
 
   cargoBuildFlags = [
     "-p"

pkgs/by-name/bl/blender/package.nix

···
   opencolorio,
   openexr,
   openimagedenoise,
-  openimageio,
+  openimageio_2,
   openjpeg,
   openpgl,
   opensubdiv,
···
       libwebp
       opencolorio
       openexr
-      openimageio
+      openimageio_2
       openjpeg
       openpgl
       (opensubdiv.override { inherit cudaSupport; })

pkgs/by-name/br/brave/package.nix

···
 
 let
   pname = "brave";
-  version = "1.77.97";
+  version = "1.77.101";
 
   allArchives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-1MIcibP89EMCOK4A9lbXxGgwvMKCB+3UxrT+UYiwmtk=";
+      hash = "sha256-/JY1eBLw3xTxeAinctlpTSbwk6QibPdMVhZcBkbe7G4=";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-6JO67t5yR2psvlYhOMERnMgta+YYTIQx/zen7y3B1Ec=";
+      hash = "sha256-mRbRGCsvkrNVfwYrlfgGyU94dEezFTI/ittkbVynp7Q=";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-d2MQMf1twOhcAouIPpdjG5jB/tZ7FGi/lrRJZ/A/ibs=";
+      hash = "sha256-tn5HdMLoVRY1oLAYc/O2v2mVblb6KYud53yoHloEQ44=";
     };
     x86_64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-x64.zip";
-      hash = "sha256-vEF26I1+nqBERFdZEKLcDZBDru0RXcwytvblRuqL8/M=";
+      hash = "sha256-HJel3HVz5MoOWXGTEH8Gu+Fq2Xur7xHXeZTUmWcWksk=";
     };
   };
 

pkgs/by-name/br/brush/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "brush";
-  version = "0.2.16";
+  version = "0.2.17";
 
   src = fetchFromGitHub {
     owner = "reubeno";
     repo = "brush";
     tag = "brush-shell-v${version}";
-    hash = "sha256-ZQ1IiWkM888CWEtwWJ+dMjJO1sGvBTA8E6f9v9JLh/w=";
+    hash = "sha256-64xj9yu6OCNTnuymEd5ihdE0s8RWfrSMfTz9TlMQ6Sg=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Vg5efRierCc7sT+7b94/4i4+3L5CoOrDoeMx/Rzg5mE=";
+  cargoHash = "sha256-AIEgSUl3YFCa6FOgoZYpPc1qc2EOfpm1lZEQYlBgkGg=";
 
   nativeInstallCheckInputs = [
     versionCheckHook

pkgs/by-name/co/cosmic-applets/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-applets";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-applets";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-kRj2hEtE8FYky9Fn8hgHBo+UwWjOoS7/ROh9qz/0Vzs=";
+    hash = "sha256-DmU9Dlb8w3a8U+oSGwWARPh1SRbv/8TW7TO9SSvDe1U=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-jADtvhMzWdJydT1T14PSk4ggZpWIcXiOK0TW2llKeos=";
+  cargoHash = "sha256-wWs3B5hh2DP93i+4gGDTi+7NT4bj8ULJ+fT95sXxUdg=";
 
   nativeBuildInputs = [
     just

pkgs/by-name/co/cosmic-applibrary/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-applibrary";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-applibrary";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-hJOM5dZdLq6uYfhfspZzpbHgUOK/FWuIXuFPoisS8DU=";
+    hash = "sha256-2rGw4Jmr2rL9X1URA5wVPIZocuroS8yaQs42sJqiTbw=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-95jTSn0yYj2PNVtfumfD1rPf1yLXHUi60FBqENK8CSw=";
+  cargoHash = "sha256-+nkXcbAPcIkg+p4ct/E0bm5O0n1MGN43AaWPjw13t9s=";
 
   nativeBuildInputs = [
     just

pkgs/by-name/co/cosmic-bg/package.nix

···
   stdenv,
   fetchFromGitHub,
   rustPlatform,
-  fetchpatch,
   cosmic-wallpapers,
   libcosmicAppHook,
   just,
···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-bg";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-bg";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-4b4laUXTnAbdngLVh8/dD144m9QrGReSEjRZoNR6Iks=";
+    hash = "sha256-KMP7TmamtbycF/nKctjYozMJwVr9zdp4A8AWriswo2g=";
   };
-
-  patches = [
-    # TOOD: This is merged and will be included in the 7th Alpha release, remove it then.
-    (fetchpatch {
-      url = "https://github.com/pop-os/cosmic-bg/commit/6a824a7902d7cc72b5a3117b6486603a1795a1d6.patch";
-      hash = "sha256-jL0az87BlJU99lDF3jnE74I4m/NV6NViyYXTfZoBDM4=";
-    })
-  ];
 
   postPatch = ''
     substituteInPlace config/src/lib.rs data/v1/all \

pkgs/by-name/co/cosmic-comp/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-comp";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-comp";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-CygtVtzO8JJQv+G3yx/OCCy8BlPqyNqcmf3Mv1gFuT4=";
+    hash = "sha256-2AnGEUWumE1C4Mi5inN7enbxCdWCKbQdYpUvTK3jGQ4=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-bfVsfrxGi0Lq/YRddCVhfqXL8kPGL9p4bqSNPsmjx0o=";
+  cargoHash = "sha256-fj6TIBuZ5hrds4WMHRa2krXN5fivKriO2Q/FWdnlGaA=";
 
   separateDebugInfo = true;
 

pkgs/by-name/co/cosmic-edit/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-edit";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-edit";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-mKVZI/x8+LrwFHGnJOzOq/vFkGev7sM9xJQOTA7uZGA=";
+    hash = "sha256-mgUSkYtc+i9pXv0n3zLHwBXFxfeWlhbsFJKa7X+mI98=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-+b8pSSBUMs1EJDlldgR1UqLLH0sLU/djMOtE3JsDpkQ=";
+  cargoHash = "sha256-qfPLDgGeYGSO0ZKJooXRK0NnTqzJ6zq6RhBpTTUusQY=";
 
   # COSMIC applications now uses vergen for the About page
   # Update the COMMIT_DATE to match when the commit was made
-  env.VERGEN_GIT_COMMIT_DATE = "2025-02-20";
+  env.VERGEN_GIT_COMMIT_DATE = "2025-04-17";
   env.VERGEN_GIT_SHA = finalAttrs.src.tag;
 
   postPatch = ''

pkgs/by-name/co/cosmic-files/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-files";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-files";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-i1CVhfieexeiKPwp0y29QyrKspzEFkp1+zwIaM9D/Qc=";
+    hash = "sha256-bI5yTpqU2N6hFwI9wi4b9N5onY5iN+8YDM3bSgdYxjQ=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-I5WRuEogMwa0dB6wxhWDxivqhCdUugvsPrwUvjjDnt8=";
+  cargoHash = "sha256-7AOdSk9XIXFCDyCus3XgOK3ZBVa4CvX+NFM0jHf7Wbs=";
 
   env = {
-    VERGEN_GIT_COMMIT_DATE = "2025-02-21";
+    VERGEN_GIT_COMMIT_DATE = "2025-04-22";
     VERGEN_GIT_SHA = finalAttrs.src.tag;
   };
 
···
 
     defaultCargoTestFlags="$cargoTestFlags"
 
-    cargoTestFlags="$defaultCargoTestFlags --package cosmic-files"
+    # Some tests with the `compio` runtime expect io_uring support but that
+    # is disabled in the Nix sandbox and the tests fail because they can't
+    # run in the sandbox. Ideally, the `compio` crate should fallback to a
+    # non-io_uring runtime but for some reason, that doesn't happen.
+    cargoTestFlags="$defaultCargoTestFlags --package cosmic-files -- \
+      --skip operation::tests::copy_dir_to_same_location \
+      --skip operation::tests::copy_file_to_same_location \
+      --skip operation::tests::copy_file_with_diff_name_to_diff_dir \
+      --skip operation::tests::copy_file_with_extension_to_same_loc \
+      --skip operation::tests::copy_to_diff_dir_doesnt_dupe_files \
+      --skip operation::tests::copying_file_multiple_times_to_same_location"
     runHook cargoCheckHook
 
     cargoTestFlags="$defaultCargoTestFlags --package cosmic-files-applet"

pkgs/by-name/co/cosmic-greeter/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-greeter";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-greeter";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-K6kCBtlmFfav8UP4zorzDJBzHt4CoSaFFAufrW1DPrw=";
+    hash = "sha256-o9ZoRHi+k+HCSGfRz1lQFAeJMCqcTQEHf5rf9wn3qqY=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-nmkM/Jm2P5ftZFfzX+O1Fe6eobRbgBkajZsbyI67Zfw=";
+  cargoHash = "sha256-hUHkyz/avFu9g1FMdC+4vz6xM75CauurrarhouuVZXc=";
+
+  env.VERGEN_GIT_COMMIT_DATE = "2025-04-25";
+  env.VERGEN_GIT_SHA = finalAttrs.src.tag;
 
   cargoBuildFlags = [ "--all" ];
 

pkgs/by-name/co/cosmic-icons/package.nix

···
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cosmic-icons";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-icons";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-j5H2+BOWxq2jShN15QCvj9rY6OK+vlUbyR9R07Ka2rA=";
+    hash = "sha256-KDmEYeuiDTYvqg2XJK8pMDfsmROKtN+if5Qxz57H5xs=";
   };
 
   nativeBuildInputs = [ just ];

pkgs/by-name/co/cosmic-idle/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-idle";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-idle";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-hORU+iMvWA4XMSWmzir9EwjpLK5vOLR8BgMZz+aIZ4U=";
+    hash = "sha256-dRvcow+rZ4sJV6pBxRIw6SCmU3aXP9uVKtFEJ9vozzI=";
   };
 
   useFetchCargoVendor = true;

pkgs/by-name/co/cosmic-launcher/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-launcher";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-launcher";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-BtYnL+qkM/aw+Air5yOKH098V+TQByM5mh1DX7v+v+s=";
+    hash = "sha256-niMsDLVMUEr8VyubDm6RGgS7p22v5nH/F8cASJOszhs=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-g7Qr3C8jQg65KehXAhftdXCpEukag0w12ClvZFkxfqs=";
+  cargoHash = "sha256-Wh3vI42RBfXpI7mvPVUmGK3fITGi+EGyo+lG7VnZg3w=";
 
   nativeBuildInputs = [
     just

pkgs/by-name/co/cosmic-notifications/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-notifications";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-notifications";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-d6bAiRSO2opKSZfadyQYrU9oIrXwPNzO/g2E2RY6q04=";
+    hash = "sha256-xcGmcOoxHb7gj6fW7xPZ5R0MTkMVXNJgvr9d5LPy9kw=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-utip7E8NST88mPaKppkuOcdW+QkFoRqWy3a2McvMHo8=";
+  cargoHash = "sha256-7EDe1OjGS6Xl0N/BrZG8lzWO0pFbwiEp+kn6WyydJQM=";
 
   nativeBuildInputs = [
     just

pkgs/by-name/co/cosmic-osd/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-osd";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-osd";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-ezOeRgqI/GOWFknUVZI7ZLEy1GYaBI+/An83HWKL6ho=";
+    hash = "sha256-POjuxrNBajp4IOw7YwF2TS4OfoM8Hxo1fO48nkhKj8U=";
   };
 
   postPatch = ''
···
   '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-vYehF2RjPrTZiuGcRUe4XX3ftRo7f+SIoKizD/kOtR8=";
+  cargoHash = "sha256-kfExKggQo3MoTXw1JbKWjLu5kwYF0n7DzSQcG6e1+QQ=";
 
   nativeBuildInputs = [ libcosmicAppHook ];
 

pkgs/by-name/co/cosmic-panel/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-panel";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-panel";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-6lt9Rig1pM37B7+nRrR+eYke8umSfYlg8aLB45Q1X+4=";
+    hash = "sha256-QcrkfU6HNZ2tWfKsMdcv58HC/PE7b4T14AIep85TWOY=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-EIp9s42deMaB7BDe7RAqj2+CnTXjHCtZjS5Iq8l46A4=";
+  cargoHash = "sha256-qufOJeWPRjj4GgWNJmQfYaGKeYOQbkTeFzrUSi9QNnQ=";
 
   nativeBuildInputs = [
     just

pkgs/by-name/co/cosmic-player/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-player";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-player";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-Ebjj+C+yLCRomZy2W8mYDig1pv7aQcD3A9V2M53RM5U=";
+    hash = "sha256-/xf3IOFVpctfgaaNNq2HUzK/qHt7Qikcv0JKoPJboRU=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-p1ylYB6xuF0UrhUO+QbGIgxqvZeQ6+GIbSNijTDXyRE=";
+  cargoHash = "sha256-0RrtErTR2J5mn/Lfppk+5X8UUOC2LN65krAq1uz/O4M=";
 
   postPatch = ''
     substituteInPlace justfile --replace-fail '#!/usr/bin/env' "#!$(command -v env)"

pkgs/by-name/co/cosmic-randr/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-randr";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-randr";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-Sqxe+vKonsK9MmJGtbrZHE7frfrjkHXysm0WQt7WSU4=";
+    hash = "sha256-vCGbWsG/F3WhWVSy8Z3r4ZHpks/X/57/ZZXuw6BFl+c=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-UQ/fhjUiniVeHRQYulYko4OxcWB6UhFuxH1dVAfAzIY=";
+  cargoHash = "sha256-lW44Y7RhA1l+cCDwqSq9sbhWi+kONJ0zy1fUu8WPYw0=";
 
   nativeBuildInputs = [
     just

pkgs/by-name/co/cosmic-screenshot/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-screenshot";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-screenshot";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-/sGYF+XWmPraNGlBVUcN/nokDB9JwWViEAL9gVH3ZaI=";
+    hash = "sha256-VvU/9vYdoTvy3yzdeXrhKrtS9tUHMKnaSAeNTEKk5PA=";
   };
 
   useFetchCargoVendor = true;

pkgs/by-name/co/cosmic-session/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-session";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-session";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-2EKkVdZ7uNNJ/E/3knmeH3EBa+tkYmIxP3t9d6yacww=";
+    hash = "sha256-vozm4vcXV3RB9Pk6om1UNCfGh80vIVJvSwbzwGDQw3Y=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-iYObxjWJUKgZKGTkqtYgQK4758k0EYZGhIAM/oLxxso=";
+  cargoHash = "sha256-68budhhbt8wPY7sfDqwIs4MWB/NBXsswK6HbC2AnHqE=";
 
   postPatch = ''
     substituteInPlace data/start-cosmic \
···
     (placeholder "out")
     "--set"
     "cosmic_dconf_profile"
-    "cosmic"
+    "${placeholder "out"}/etc/dconf/profile/cosmic"
     "--set"
     "cargo-target-dir"
     "target/${stdenv.hostPlatform.rust.cargoShortTarget}"
   ];
 
   env.XDP_COSMIC = "${xdg-desktop-portal-cosmic}/libexec/xdg-desktop-portal-cosmic";
-
-  postInstall = ''
-    dconf_profile_dst=$out/etc/dconf/profile/cosmic
-    if [ ! -f $dconf_profile_dst ]; then
-        install -Dm0644 data/dconf/profile/cosmic $dconf_profile_dst
-    else
-        # future proofing
-        echo 'The Justfile is now correctly installing the dconf profile.'
-        echo 'Please remove the dconf profile from the `postInstall` phase.'
-        exit 1
-    fi
-  '';
 
   passthru = {
     providedSessions = [ "cosmic" ];

pkgs/by-name/co/cosmic-settings-daemon/package.nix

···
   pop-gtk-theme,
   adw-gtk3,
   pkg-config,
+  libpulseaudio,
   geoclue2-with-demo-agent,
   libinput,
   udev,
···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-settings-daemon";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-settings-daemon";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-DtwW6RxHnNh87Xu0NCULfUsHNzYU9tHtFKE9HO3rvME=";
+    hash = "sha256-vdhkE5CmgiGYg5TXxN7lLqxjv7apKEKvIscXFIzZfRc=";
   };
 
   postPatch = ''
···
   '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-lGzQBL9IXbPsaKeVHp34xkm5FnTxWvfw4wg3El4LZdA=";
+  cargoHash = "sha256-Dzv1SDeZFIa+LFQQ91lO7RBHldsjDnGf+R12Ln2WZwU=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     libinput
+    libpulseaudio
     udev
   ];
 

pkgs/by-name/co/cosmic-settings/package.nix

···
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   rustPlatform,
   cmake,
   just,
···
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-settings";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-settings";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-UKg3TIpyaqtynk6wLFFPpv69F74hmqfMVPra2+iFbvE=";
+    hash = "sha256-rrPgCXl4uD4Gvstgj9Sdv6rB/0d8wa56CdBjAkTLQG8=";
   };
 
-  patches = [
-    # TODO: This is merged and will be included in the 7th Alpha release, remove it then.
-    (fetchpatch {
-      url = "https://github.com/pop-os/cosmic-settings/commit/2e2898b31fabcb3f3b561e6c4cea2aca9de9b284.patch";
-      hash = "sha256-ZGJlGmR6lZB697uQ+ZsjvisNbPKBlBdRK/Ti541ZdlE=";
-    })
-  ];
-
   useFetchCargoVendor = true;
-  cargoHash = "sha256-mf/Cw3/RLrCYgsk7JKCU2+oPn1VPbD+4JzkUmbd47m8=";
+  cargoHash = "sha256-7Aoy/okgFSwDU6jMYzTGtwPbK82yMgL5bnKBfBUD3vA=";
 
   nativeBuildInputs = [
     cmake

pkgs/by-name/co/cosmic-store/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-store";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-store";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-ce7PaHBhRFUoujAS6j10XWbD2PxzK6XXIk/ENclT1iY=";
+    hash = "sha256-skNzkpcdGJkve7enlnnZxYxnScHFmyaCAy0xaMEEsE0=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-kPCE6F8/UsTJOmIjwxBLISk/Jhfljwa666WhXuKkkDE=";
+  cargoHash = "sha256-2iWJFPSvNQ6JwQwzowKYbgjog2gsjOUlReai/j0d3Do=";
 
   nativeBuildInputs = [
     just

pkgs/by-name/co/cosmic-term/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-term";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-term";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-sdeRkT6UcyBKIFnJZn3aGf8LZQimqVPqtXo7RtwUs5M=";
+    hash = "sha256-leCKdnlevfLiPJkloWCpOjkHaSf7+EYdobZRZ/Jis+4=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Qznkqp+zWpP/ok2xG7U5lYBW0qo4+ARnm8hgxU20ha0=";
+  cargoHash = "sha256-Re9t25tkwmrvXB9GmPSVG+QDUZmk5rwrrY2ntlB3Tdw=";
 
   # COSMIC applications now uses vergen for the About page
   # Update the COMMIT_DATE to match when the commit was made
   env = {
-    VERGEN_GIT_COMMIT_DATE = "2025-02-21";
+    VERGEN_GIT_COMMIT_DATE = "2025-04-20";
     VERGEN_GIT_SHA = finalAttrs.src.tag;
   };
 

pkgs/by-name/co/cosmic-wallpapers/package.nix

···
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cosmic-wallpapers";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
···
     tag = "epoch-${finalAttrs.version}";
     forceFetchGit = true;
     fetchLFS = true;
-    hash = "sha256-Exrps3DicL/G/g0kbSsCvoFhiJn1k3v8I09GhW7EwNM=";
+    hash = "sha256-XtNmV6fxKFlirXQvxxgAYSQveQs8RCTfcFd8SVdEXtE=";
   };
 
   patches = [

pkgs/by-name/co/cosmic-workspaces-epoch/package.nix

···
   stdenv,
   rustPlatform,
   fetchFromGitHub,
-  cosmic-wallpapers,
   libcosmicAppHook,
   pkg-config,
   libinput,
···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-workspaces-epoch";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-workspaces-epoch";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-3jivE0EaSddPxMYn9DDaYUMafPf60XeCwVeQegbt++c=";
+    hash = "sha256-d7KYZbq8O/t5V/gU+wwstp06vyfnmt6vRKo+54Dct+o=";
   };
 
-  postPatch = ''
-    # While the `kate-hazen-COSMIC-desktop-wallpaper.png` image is present
-    # in the `pop-wallpapers` package, we're using the Orion Nebula image
-    # from NASA available in the `cosmic-wallpapers` package. Mainly because
-    # the previous image was used in the GNOME shell extension and the
-    # Orion Nebula image is widely used in the Rust-based COSMIC DE's
-    # marketing materials. Another reason to use the Orion Nebula image
-    # is that it's actually the default wallpaper as configured by the
-    # `cosmic-bg` package's configuration in upstream [1] [2].
-    #
-    # [1]: https://github.com/pop-os/cosmic-bg/blob/epoch-1.0.0-alpha.6/config/src/lib.rs#L142
-    # [2]: https://github.com/pop-os/cosmic-bg/blob/epoch-1.0.0-alpha.6/data/v1/all#L3
-    substituteInPlace src/view/mod.rs \
-      --replace-fail '/usr/share/backgrounds/pop/kate-hazen-COSMIC-desktop-wallpaper.png' "${cosmic-wallpapers}/share/backgrounds/cosmic/orion_nebula_nasa_heic0601a.jpg"
-  '';
-
   useFetchCargoVendor = true;
-  cargoHash = "sha256-l5y9bOG/h24EfiAFfVKjtzYCzjxU2TI8wh6HBUwoVcE=";
+  cargoHash = "sha256-TjgnPuFUIDtxx9kpvN9hKiir3/ZVtCc0z1CE4UHre1Q=";
 
   separateDebugInfo = true;
 

pkgs/by-name/da/databricks-cli/package.nix

···
 
 buildGoModule (finalAttrs: {
   pname = "databricks-cli";
-  version = "0.247.1";
+  version = "0.249.0";
 
   src = fetchFromGitHub {
     owner = "databricks";
     repo = "cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-c9ZcqJuue5Nccuhpoxud0LevJD2jNPAYuIrBaEuUihY=";
+    hash = "sha256-DNa/ovllWJwsja8+QXP4Z38NE2uO99kHFQsXAEbKciQ=";
   };
 
   # Otherwise these tests fail asserting that the version is 0.0.0-dev
···
       --replace-fail "cli/0.0.0-dev" "cli/${finalAttrs.version}"
   '';
 
-  vendorHash = "sha256-c+fg2eJiuLr7UuWier7VFdLNFGDo0aCMo0q8/spnmSE=";
+  vendorHash = "sha256-Nj9oQryh3tsXUoIPunl5EXKkWeT76zGTsdFaK0UuNVY=";
 
   excludedPackages = [
     "bundle/internal"

pkgs/by-name/de/deno/package.nix

···
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "deno";
-  version = "2.2.11";
+  version = "2.2.12";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = "deno";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6mRu1B02bX7Ax0d7MgI1cGalIKOqFMN+xP8ii+pUJWE=";
+    hash = "sha256-/5KCwWyPdx/OKjoKgHZ8BAih7dh21VrbC+N1U74B/KI=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-YZ6O31R/1L7m25Z+6Xq6b44cRAX1jgRFPlhmoFVYFok=";
+  cargoHash = "sha256-3I1yplJjVH7Mf2wjwk8qSdbHTcR20QSJGF9MHtnu+q8=";
 
   postPatch = ''
     # Use patched nixpkgs libffi in order to fix https://github.com/libffi/libffi/pull/857

pkgs/by-name/de/devenv/package.nix

···
     src = fetchFromGitHub {
       owner = "domenkozar";
       repo = "nix";
-      rev = "f3f44b2baaf6c4c6e179de8cbb1cc6db031083cd";
-      hash = "sha256-E3j+3MoY8Y96mG1dUIiLFm2tZmNbRvSiyN7CrSKuAVg=";
+      rev = "090394819020afda8eae69e395b1accba9c0fab2";
+      hash = "sha256-eUYh7+PgqLXTt8/9IOxEuW2qyxADECmTic8QNhEwKSw=";
     };
     doCheck = false;
     doInstallCheck = false;
   });
 
-  version = "1.5.2";
+  version = "1.6";
 in
 rustPlatform.buildRustPackage {
   pname = "devenv";
···
     owner = "cachix";
     repo = "devenv";
     rev = "v${version}";
-    hash = "sha256-rXtUUxfQ34ukTy2OyHwuypnSgK95FRPGwJf69QnWMrc=";
+    hash = "sha256-ui6UwatBHN2WFvStGUHVOdBu72MsG/7b0GeyRdTCyEw=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-oiOh8m7MypViLbzy/13NpSiOwkfRwybUpDs91f+HbGA=";
+  cargoHash = "sha256-XS6F/Sp5peJdzAormYPjAA4SJfusMH6PRYIM3Tw5AUw=";
 
   buildAndTestSubdir = "devenv";
 

pkgs/by-name/do/docfd/package.nix

···
 
 ocamlPackages.buildDunePackage rec {
   pname = "docfd";
-  version = "10.1.3";
+  version = "10.2.0";
 
   minimalOCamlVersion = "5.1";
 
···
     owner = "darrenldl";
     repo = "docfd";
     rev = version;
-    hash = "sha256-ZD1nKl/hfidlTGdBnNINt2EmlUmFWaJjSvY3wkyJJcg=";
+    hash = "sha256-wVhsZTG8yEkxKA0ta3IDe7O/ER5RuBuFOPKHP8xS2GA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/do/docker-language-server/package.nix

···
 
 buildGoModule rec {
   pname = "docker-language-server";
-  version = "0.3.4";
+  version = "0.3.8";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "docker-language-server";
     tag = "v${version}";
-    hash = "sha256-st7ZsifOJy2se0dgJHtonMSQC1hO8z3yhPYJ4H5nqAk=";
+    hash = "sha256-irjIa+GC/4tEMoC8ZY/8n9J/Z5G/VesSj4xWqnOj6uY=";
   };
 
-  vendorHash = "sha256-Odyc1pGp52f8S2bXT7v4Rpk2H3vxr+DghsNcFUVU62k=";
+  vendorHash = "sha256-O1SQVKfnOkxWqJWamRkb8RMRsWriBZqH3oYSzIHX7Ug=";
 
   nativeCheckInputs = [
     docker

pkgs/by-name/dp/dprint/plugins/default.nix

···
-{ lib, fetchurl }:
+{
+  lib,
+  fetchurl,
+  stdenv,
+}:
 let
   mkDprintPlugin =
     {
···
       license ? lib.licenses.mit,
       maintainers ? [ lib.maintainers.phanirithvij ],
     }:
-    fetchurl {
-      inherit
-        hash
-        url
-        pname
-        version
-        ;
-      name = "${pname}-${version}.wasm";
+    stdenv.mkDerivation (finalAttrs: {
+      inherit pname version;
+      src = fetchurl { inherit url hash; };
+      dontUnpack = true;
       meta = {
-        inherit
-          description
-          license
-          maintainers
-          ;
+        inherit description license maintainers;
       };
+      /*
+        in the dprint configuration
+        dprint expects a plugin path to end with .wasm extension
+
+        for auto update with nixpkgs-update to work
+        we cannot have .wasm extension at the end in the nix store path
+      */
+      buildPhase = ''
+        mkdir -p $out
+        cp $src $out/plugin.wasm
+      '';
       passthru = {
         updateScript = ./update-plugins.py;
         inherit initConfig updateUrl;
       };
-    };
+    });
   inherit (lib)
     filterAttrs
+    isDerivation
     mapAttrs'
     nameValuePair
     removeSuffix
···
     name: _:
     nameValuePair (removeSuffix ".nix" name) (import (./. + "/${name}") { inherit mkDprintPlugin; })
   ) files;
+  # Expects a function that receives the dprint plugin set as an input
+  # and returns a list of plugins
+  # Example:
+  # pkgs.dprint-plugins.getPluginList (plugins: [
+  #   plugins.dprint-plugin-toml
+  #   (pkgs.callPackage ./dprint/plugins/sample.nix {})
+  # ]
+  getPluginList = cb: map (p: "${p}/plugin.wasm") (cb plugins);
 in
-plugins // { inherit mkDprintPlugin; }
+plugins // { inherit mkDprintPlugin getPluginList; }

pkgs/by-name/dp/dprint/plugins/update-plugins.py

···
 
 
 # get sri hash for a url, no unpack
-def nix_prefetch_url(url, name, algo="sha256"):
+def nix_prefetch_url(url, algo="sha256"):
     hash = (
-        subprocess.check_output(
-            ["nix-prefetch-url", "--type", algo, "--name", name, url]
-        )
+        subprocess.check_output(["nix-prefetch-url", "--type", algo, url])
         .decode("utf-8")
         .rstrip()
     )
···
     data = requests.get(p["updateUrl"]).json()
     p["url"] = data["url"]
     p["version"] = data["version"]
-    p["hash"] = nix_prefetch_url(data["url"], f"{name}-{data["version"]}.wasm")
+    p["hash"] = nix_prefetch_url(data["url"])
 
     write_plugin_derivation(p)
 
···
             pname = pname.replace("/", "-")
         drv_attrs = {
             "url": e["url"],
-            "hash": nix_prefetch_url(e["url"], f"{pname}-{e["version"]}.wasm"),
+            "hash": nix_prefetch_url(e["url"]),
             "updateUrl": update_url,
             "pname": pname,
             "version": e["version"],

pkgs/by-name/e1/e1s/package.nix

···
 }:
 let
   pname = "e1s";
-  version = "1.0.45";
+  version = "1.0.46";
 in
 buildGoModule {
   inherit pname version;
···
     owner = "keidarcy";
     repo = "e1s";
     tag = "v${version}";
-    hash = "sha256-1dbdIShEyQ9/1kXx0w4SiEu6c53WUj5+RtmIcwuhSRA=";
+    hash = "sha256-Wnj6HNxVdhnmGMtw+Da/LRxMkXBm+rWDUcHPOxFXDLU=";
   };
 
   vendorHash = "sha256-bBl4D7HNIiAym6BWSJ0x4LZnIEUMfECj6dDDVZIFrHA=";

pkgs/by-name/ed/eduvpn-client/package.nix

···
     setuptools
   ];
 
+  postInstall = ''
+    ln -s $out/${python3Packages.python.sitePackages}/eduvpn/data/share/ $out/share
+  '';
+
   checkInputs = with python3Packages; [
     pytestCheckHook
   ];

pkgs/by-name/ez/eza/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "eza";
-  version = "0.21.1";
+  version = "0.21.2";
 
   src = fetchFromGitHub {
     owner = "eza-community";
     repo = "eza";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HtukMHiTWWejbq+cpeyF4QmTaBP4yvvyVb/xaacHKwI=";
+    hash = "sha256-r8svNiz0hcK0QQ0LvkYKTc9gLOEDLylZss32g6sM/hY=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-T/ryAhBM0ECttDx3vMesLfTXfnHecM/0gpOCcg/o2kI=";
+  cargoHash = "sha256-akoRFvlwHUg8KzmxMGkJ//fIrX/+/yu6fHbxBjgwUZc=";
 
   nativeBuildInputs = [
     cmake

pkgs/by-name/fu/fulcio/package.nix

···
 
 buildGoModule rec {
   pname = "fulcio";
-  version = "1.7.0";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ymPczybHADTz4uiY8aLLre+Q8bBq/5L5MXJ26eBhi+U=";
+    hash = "sha256-UVUVT4RvNHvzIwV6azu2h1O9lnNu0PQnnkj4wbrY8BA=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
···
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorHash = "sha256-lfJCPE8FRAX+juXQ7CiwItbnd0kAheaEdWG0Bwoyz/Y=";
+  vendorHash = "sha256-lNPRejC7Z3OHDvhJGzPIlgqi7eXjlqgeECJO/13gGt4=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/gh/gh/package.nix

···
 
 buildGoModule rec {
   pname = "gh";
-  version = "2.71.0";
+  version = "2.71.2";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-Wx1C5xrjssF09ok9YYXsewDi5Tdi3Gepfnf1FueEpkI=";
+    hash = "sha256-n1qGJ5/X7wp4kgQqgcUomNvln2WavDJOjwxjVokfbiU=";
   };
 
   vendorHash = "sha256-69bGTUdVD/jebvmxYu0Mx7poSlbkXBAXUWLJ1CclXJU=";

pkgs/by-name/gp/gpupad/package.nix

···
   glslang,
   imath,
   ktx-tools,
-  openimageio,
+  openimageio_2,
   qt6Packages,
   spdlog,
   spirv-cross,
···
     glslang
     imath # needed for openimageio
     ktx-tools
-    openimageio
+    openimageio_2
     qt6Packages.qtbase
     qt6Packages.qtdeclarative
     qt6Packages.qtmultimedia

pkgs/by-name/ht/httpx/package.nix

···
 
 buildGoModule rec {
   pname = "httpx";
-  version = "1.6.10";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "httpx";
     tag = "v${version}";
-    hash = "sha256-lU5LtYFnWJu4yZTqdJFqLnaAUOQ3Nc2EaNPrvTxoW3Q=";
+    hash = "sha256-V4OTIUm7KSUSKgQczkOtIw8HlkLEMgvX53a4caQP5IU=";
   };
 
-  vendorHash = "sha256-+m0TPKIBCnRfswrMw9+w1r/pWaRmkI+s0RRbv5X5GBo=";
+  vendorHash = "sha256-lwk/ajywAJ969U5gpYQgIg8+u1xKARFH+HTk2+OgY4A=";
 
   subPackages = [ "cmd/httpx" ];
 

pkgs/by-name/hy/hyprls/package.nix

···
 
   meta = {
     description = "LSP server for Hyprland's configuration language";
-    homepage = "https://en.ewen.works/hyprls";
+    homepage = "https://gwen.works/hyprls";
     changelog = "https://github.com/hyprland-community/hyprls/releases/tag/v${version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ arthsmn ];

pkgs/by-name/im/immich-go/package.nix

···
 }:
 buildGoModule rec {
   pname = "immich-go";
-  version = "0.25.2";
+  version = "0.25.3";
 
   src = fetchFromGitHub {
     owner = "simulot";
     repo = "immich-go";
     tag = "v${version}";
-    hash = "sha256-YTijKTelSFDVYSx0XocOx2OqEDCtoIMGBLEH3uUbg20=";
+    hash = "sha256-l4D0tE0yB2eLy9QlB9kraOtCUfqVRhYyaMUb/Xvv82c=";
 
     # Inspired by: https://github.com/NixOS/nixpkgs/blob/f2d7a289c5a5ece8521dd082b81ac7e4a57c2c5c/pkgs/applications/graphics/pdfcpu/default.nix#L20-L32
     # The intention here is to write the information into files in the `src`'s
···
     '';
   };
 
-  vendorHash = "sha256-AC+nXaUvnppEIPDthfWDffeoh8hcsd3wDynmF34XBD8=";
+  vendorHash = "sha256-z9gS8i9GatDq4flomPcBUpf7b/6BJZ42lGOmpfpdmao=";
 
   # options used by upstream:
   # https://github.com/simulot/immich-go/blob/v0.25.0/.goreleaser.yaml
···
     ldflags+=" -X github.com/simulot/immich-go/Commit=$(cat COMMIT)"
     ldflags+=" -X github.com/simulot/immich-go/Date=$(cat SOURCE_DATE)"
   '';
+
+  __darwinAllowLocalNetworking = true;
 
   nativeCheckInputs = [
     writableTmpDirAsHomeHook

pkgs/by-name/je/jetbrains-toolbox/package.nix

···
 
 let
   pname = "jetbrains-toolbox";
-  version = "2.5.4.38621";
+  version = "2.6.1.40902";
 
-  passthru.updateScript = ./update.sh;
+  updateScript = ./update.sh;
 
   meta = {
     description = "Jetbrains Toolbox";
···
     attrs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   linux = appimageTools.wrapAppImage rec {
-    inherit
-      pname
-      version
-      passthru
-      meta
-      ;
+    inherit pname version meta;
+
+    source =
+      let
+        arch = selectSystem {
+          x86_64-linux = "";
+          aarch64-linux = "-arm64";
+        };
+      in
+      fetchzip {
+        url = "https://download.jetbrains.com/toolbox/jetbrains-toolbox-${version}${arch}.tar.gz";
+        hash = selectSystem {
+          x86_64-linux = "sha256-P4kv6ca6mGtl334HKNkdo9Iib/Cgu3ROrbQKlQqxUj4=";
+          aarch64-linux = "sha256-mG8GAVPi2I0A13rKhXoXxiRIHK1QOWPv4gZxfm0+DKs=";
+        };
+      };
 
     src = appimageTools.extractType2 {
       inherit pname version;
-      src =
-        let
-          arch = selectSystem {
-            x86_64-linux = "";
-            aarch64-linux = "-arm64";
-          };
-        in
-        fetchzip {
-          url = "https://download.jetbrains.com/toolbox/jetbrains-toolbox-${version}${arch}.tar.gz";
-          hash = selectSystem {
-            x86_64-linux = "sha256-rq0Hn9g+/u9C8vbEVH2mv62c1dvxr+t9tBhf26swQgI=";
-            aarch64-linux = "sha256-52wFejaKBSg/eeJu3NDGl1AdZLsJdi/838YeROD4Loc=";
-          };
-        }
-        + "/jetbrains-toolbox";
+      src = source + "/jetbrains-toolbox";
       postExtract = ''
         patchelf --add-rpath ${lib.makeLibraryPath [ icu ]} $out/jetbrains-toolbox
       '';
···
       wrapProgram $out/bin/jetbrains-toolbox \
         --append-flags "--update-failed"
     '';
+
+    passthru = {
+      src = source;
+      inherit updateScript;
+    };
   };
 
   darwin = stdenv.mkDerivation (finalAttrs: {
-    inherit
-      pname
-      version
-      passthru
-      meta
-      ;
+    inherit pname version meta;
 
     src =
       let
···
       fetchurl {
         url = "https://download.jetbrains.com/toolbox/jetbrains-toolbox-${finalAttrs.version}${arch}.dmg";
         hash = selectSystem {
-          x86_64-darwin = "sha256-y0zXQEqY5lj/e440dRtyBfaw8CwqqgzO3Ujreb37Z/I=";
-          aarch64-darwin = "sha256-9Bj5puG9NUHO53oXBRlB5DvX9jGTmrkDgjV2QPH9qg0=";
+          x86_64-darwin = "sha256-Dw1CqthgvKIlHrcQIoOpYbAG5c6uvq/UgzaO4n25YJY=";
+          aarch64-darwin = "sha256-b/z8Pq8h6n34junSMyxRS3Y/TQ3tu05Bh77xlvMvEtI=";
         };
       };
 
···
 
       runHook postInstall
     '';
+
+    passthru = {
+      inherit updateScript;
+    };
   });
 in
 if stdenv.hostPlatform.isDarwin then darwin else linux

pkgs/by-name/ko/koreader/package.nix

···
   luajit,
   sdcv,
   SDL2,
+  openssl,
   nix-update-script,
 }:
 let
···
 in
 stdenv.mkDerivation rec {
   pname = "koreader";
-  version = "2024.11";
+  version = "2025.04";
 
   src =
     {
       aarch64-linux = fetchurl {
         url = "https://github.com/koreader/koreader/releases/download/v${version}/koreader-${version}-arm64.deb";
-        hash = "sha256-uy+4+pNyz10xrGM0QF9q0y6UpQK1B9PGNqrcK6nENQY=";
+        hash = "sha256-bpKNP+1C0oHZEv6HGL4dBziv3RfCow882yV8JFLtDJ4=";
       };
       armv7l-linux = fetchurl {
         url = "https://github.com/koreader/koreader/releases/download/v${version}/koreader-${version}-armhf.deb";
-        hash = "sha256-lTc12qmoe0kGUhrStlGfDRw+cNJnX7F09/jKKc/1U9g=";
+        hash = "sha256-q3M33f0b5FAU/nmPfzsXu93mVZOhXMVgBbfwnieqkeM=";
       };
       x86_64-linux = fetchurl {
         url = "https://github.com/koreader/koreader/releases/download/v${version}/koreader-${version}-amd64.deb";
-        hash = "sha256-ibehFrOcJqhM+CMAcHDn3Xwy6CueB8kdnoYMMDe/2Js=";
+        hash = "sha256-ZZujk98YVvNJmffW2fDg+n+z1xgtkha7y1LasYEhCR4=";
       };
     }
     .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
···
   src_repo = fetchFromGitHub {
     repo = "koreader";
     owner = "koreader";
-    rev = "v${version}";
+    tag = "v${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-EI8UOQuwhJqcAp8QnLYhI0K+uV/7ZqxdHNk8mPkDWA0=";
+    hash = "sha256-Kt00AZARfQjGY8FzDcQB8UaowWW2+KWyXJzexFNmZmM=";
   };
 
   nativeBuildInputs = [
···
     luajit_lua52
     sdcv
     SDL2
+    openssl
   ];
 
   dontConfigure = true;
···
 
   installPhase = ''
     mkdir -p $out
+    dpkg-deb -x $src .
     cp -R usr/* $out/
+
+    # Link required binaries
     ln -sf ${luajit_lua52}/bin/luajit $out/lib/koreader/luajit
     ln -sf ${sdcv}/bin/sdcv $out/lib/koreader/sdcv
     ln -sf ${gnutar}/bin/tar $out/lib/koreader/tar
+
+    # Link SSL/network libraries
+    ln -sf ${openssl.out}/lib/libcrypto.so.3 $out/lib/koreader/libs/libcrypto.so.1.1
+    ln -sf ${openssl.out}/lib/libssl.so.3 $out/lib/koreader/libs/libssl.so.1.1
+
+    # Copy fonts
     find ${src_repo}/resources/fonts -type d -execdir cp -r '{}' $out/lib/koreader/fonts \;
+
+    # Remove broken symlinks
     find $out -xtype l -print -delete
-    wrapProgram $out/bin/koreader --prefix LD_LIBRARY_PATH : ${
+
+    wrapProgram $out/bin/koreader --prefix LD_LIBRARY_PATH : $out/lib/koreader/libs:${
       lib.makeLibraryPath [
         gtk3-x11
         SDL2
         glib
         stdenv.cc.cc
+        openssl.out
       ]
     }
   '';

pkgs/by-name/li/live555/package.nix

···
 {
-  lib,
+  buildPackages,
   cctools,
   fetchpatch,
   fetchurl,
+  lib,
+  live555,
   openssl,
+  runCommand,
   stdenv,
-  vlc,
 }:
+let
+  isStatic = stdenv.hostPlatform.isStatic;
+in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "live555";
···
     "PREFIX=${placeholder "out"}"
     "C_COMPILER=$(CC)"
     "CPLUSPLUS_COMPILER=$(CXX)"
-    "LIBRARY_LINK=$(AR) cr "
     "LINK=$(CXX) -o "
+    "LIBRARY_LINK=${if isStatic then "$(AR) cr " else "$(CC) -o "}"
   ];
 
   # Since NIX_CFLAGS_COMPILE affects both C and C++ toolchains, we set CXXFLAGS
···
     let
       platform =
         if stdenv.hostPlatform.isLinux then
-          "linux"
+          if isStatic then "linux" else "linux-with-shared-libraries"
         else if stdenv.hostPlatform.isDarwin then
           "macosx-catalina"
         else
···
       runHook postConfigure
     '';
 
-  passthru.tests = {
-    # Downstream dependency
-    inherit vlc;
-  };
+  doInstallCheck = true;
+  installCheckPhase = ''
+    if ! ($out/bin/openRTSP || :) 2>&1 | grep -q "Usage: "; then
+      echo "Executing example program failed" >&2
+      exit 1
+    else
+      echo "Example program executed successfully"
+    fi
+  '';
+
+  passthru.tests =
+    let
+      emulator = stdenv.hostPlatform.emulator buildPackages;
+    in
+    {
+      # The installCheck phase above cannot be ran in cross-compilation scenarios,
+      # therefore the passthru test
+      run-test-prog = runCommand "live555-run-test-prog" { } ''
+        if ! (${emulator} ${live555}/bin/openRTSP || :) 2>&1 | grep -q "Usage: "; then
+          echo "Executing example program failed" >&2
+          exit 1
+        else
+          echo "Example program executed successfully"
+          touch $out
+        fi
+      '';
+    };
 
   meta = {
     homepage = "http://www.live555.com/liveMedia/";

pkgs/by-name/ll/llama-cpp/package.nix

···
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "llama-cpp";
-  version = "5141";
+  version = "5186";
 
   src = fetchFromGitHub {
     owner = "ggml-org";
     repo = "llama.cpp";
     tag = "b${finalAttrs.version}";
-    hash = "sha256-qHjHsc2v4LB+GVYni97d3KVo5uJqpF7RQqG2rWXwpHY=";
+    hash = "sha256-f07FvHgRobUbei06kcKHJ1ulLCYARAvo64oWsDBwHO0=";
     leaveDotGit = true;
     postFetch = ''
       git -C "$out" rev-parse --short HEAD > $out/COMMIT

pkgs/by-name/lo/lockbook-desktop/package.nix

···
 in
 rustPlatform.buildRustPackage rec {
   pname = "lockbook-desktop";
-  version = "0.9.21";
+  version = "0.9.22";
 
   src = fetchFromGitHub {
     owner = "lockbook";
     repo = "lockbook";
     tag = version;
-    hash = "sha256-SRmfLxF78jR1a/37pU1TLM6nFpmYLRbHJzQIVQtM8/M=";
+    hash = "sha256-akCtnPLJupoo7n3Vfyl37fjCmK4dHB0bt92rie6k0dQ=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-faqbsxXF2AjDE+FMkD1PihacPAvQlD6nkczN4QdsCeM=";
+  cargoHash = "sha256-xH3GIwh3zaLbpZqvzM+KM+K14fWj241RTwUM7dWRCKA=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/lo/lockbook/package.nix

···
 }:
 rustPlatform.buildRustPackage rec {
   pname = "lockbook";
-  version = "0.9.21";
+  version = "0.9.22";
 
   src = fetchFromGitHub {
     owner = "lockbook";
     repo = "lockbook";
     tag = version;
-    hash = "sha256-SRmfLxF78jR1a/37pU1TLM6nFpmYLRbHJzQIVQtM8/M=";
+    hash = "sha256-akCtnPLJupoo7n3Vfyl37fjCmK4dHB0bt92rie6k0dQ=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-faqbsxXF2AjDE+FMkD1PihacPAvQlD6nkczN4QdsCeM=";
+  cargoHash = "sha256-xH3GIwh3zaLbpZqvzM+KM+K14fWj241RTwUM7dWRCKA=";
 
   doCheck = false; # there are no cli tests
   cargoBuildFlags = [

pkgs/by-name/lx/lx-music-desktop/electron-builder.patch

···
+diff --git a/build-config/build-pack.js b/build-config/build-pack.js
+index 569252c..ccaef34 100644
+--- a/build-config/build-pack.js
++++ b/build-config/build-pack.js
+@@ -1,7 +1,5 @@
+ /* eslint-disable no-template-curly-in-string */
+-
+ const builder = require('electron-builder')
+-const beforePack = require('./build-before-pack')
+ const afterPack = require('./build-after-pack')
+ 
+ /**
+@@ -11,8 +9,9 @@ const afterPack = require('./build-after-pack')
+ const options = {
+   appId: 'cn.toside.music.desktop',
+   productName: 'lx-music-desktop',
+-  beforePack,
+   afterPack,
++  electronVersion: "@electron_version@",
++  electronDist: "./electron-dist",
+   protocols: {
+     name: 'lx-music-protocol',
+     schemes: [

pkgs/by-name/lx/lx-music-desktop/package.nix

···
 {
   lib,
   stdenv,
-  fetchurl,
-  makeWrapper,
+  buildNpmPackage,
 
-  dpkg,
-  libGL,
-  systemd,
-  electron_32,
+  fetchFromGitHub,
+  replaceVars,
+
+  makeWrapper,
 
+  electron_34,
   commandLineArgs ? "",
 }:
 
 let
+  # if we want to use later electron, we'll need to bump the `node-abi` npm package version
+  electron = electron_34;
+in
+buildNpmPackage rec {
   pname = "lx-music-desktop";
   version = "2.10.0";
 
-  buildUrl =
-    version: arch:
-    "https://github.com/lyswhut/lx-music-desktop/releases/download/v${version}/lx-music-desktop_${version}_${arch}.deb";
-
-  srcs = {
-    x86_64-linux = fetchurl {
-      url = buildUrl version "amd64";
-      hash = "sha256-btNB8XFCJij1wUVZoWaa55vZn5n1gsKSMnEbQPTd9lg=";
-    };
-
-    aarch64-linux = fetchurl {
-      url = buildUrl version "arm64";
-      hash = "sha256-GVTzxTV7bM4AWZ+Xfb70fyedDMIa9eX/YwnGkm3WOsk=";
-    };
-
-    armv7l-linux = fetchurl {
-      url = buildUrl version "armv7l";
-      hash = "sha256-3zttIk+A4BpG0W196LzgTJ5WeqWvLjqPFz6e9RCGlJo=";
-    };
+  src = fetchFromGitHub {
+    owner = "lyswhut";
+    repo = "lx-music-desktop";
+    tag = "v${version}";
+    hash = "sha256-8IzQEGdaeoBbCsZSPhVowipeBr4YHGm/G28qGHtCY/s=";
   };
 
-  host = stdenv.hostPlatform.system;
-  src = srcs.${host} or (throw "Unsupported system: ${host}");
-
-  runtimeLibs = lib.makeLibraryPath [
-    libGL
-    stdenv.cc.cc
+  patches = [
+    # set electron version and dist dir
+    # disable before-pack: it would copy prebuilt libraries
+    (replaceVars ./electron-builder.patch {
+      electron_version = electron.version;
+    })
   ];
-in
-stdenv.mkDerivation {
-  inherit pname version src;
 
   nativeBuildInputs = [
-    dpkg
     makeWrapper
   ];
 
-  runtimeDependencies = map lib.getLib [
-    systemd
-  ];
+  npmDepsHash = "sha256-awD8gu1AnhUn5uT/dITXjMVWNAwABAmcEVZOKukbWrI=";
+
+  makeCacheWritable = true;
+
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+
+  # we haven't set up npm_config_nodedir at this point
+  # and electron-rebuild will rebuild the native libs later anyway
+  npmFlags = [ "--ignore-scripts" ];
+
+  preBuild = ''
+    # delete prebuilt libs
+    rm -r build-config/lib
+
+    # don't spam the build logs
+    substituteInPlace build-config/pack.js \
+      --replace-fail 'new Spinnies({' 'new Spinnies({disableSpins:true,'
+
+    # this directory is configured to be used in the patch
+    cp -r ${electron.dist} electron-dist
+    chmod -R u+w electron-dist
+
+    export npm_config_nodedir=${electron.headers}
+    export npm_config_build_from_source="true"
+
+    npm rebuild --no-progress --verbose
+  '';
+
+  npmBuildScript = "pack:dir";
 
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/bin $out/opt/lx-music-desktop
-    cp -r opt/lx-music-desktop/{resources,locales} $out/opt/lx-music-desktop
-    cp -r usr/share $out/share
-
-    substituteInPlace $out/share/applications/lx-music-desktop.desktop \
-        --replace-fail "/opt/lx-music-desktop/lx-music-desktop" "$out/bin/lx-music-desktop" \
+    mkdir -p "$out/opt/lx-music-desktop"
+    cp -r build/*-unpacked/{locales,resources{,.pak}} "$out/opt/lx-music-desktop"
+    rm "$out/opt/lx-music-desktop/resources/app-update.yml"
 
     runHook postInstall
   '';
 
   postFixup = ''
-    makeWrapper ${electron_32}/bin/electron $out/bin/lx-music-desktop \
+    makeWrapper ${lib.getExe electron} $out/bin/lx-music-desktop \
         --add-flags $out/opt/lx-music-desktop/resources/app.asar \
-        --prefix LD_LIBRARY_PATH : "${runtimeLibs}" \
         --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
-        --add-flags ${lib.escapeShellArg commandLineArgs} \
+        --add-flags ${lib.escapeShellArg commandLineArgs}
   '';
 
   meta = with lib; {
+    broken = stdenv.hostPlatform.isDarwin;
     description = "Music software based on Electron and Vue";
     homepage = "https://github.com/lyswhut/lx-music-desktop";
     changelog = "https://github.com/lyswhut/lx-music-desktop/releases/tag/v${version}";
     license = licenses.asl20;
-    platforms = [
-      "x86_64-linux"
-      "aarch64-linux"
-      "armv7l-linux"
-    ];
+    platforms = electron.meta.platforms;
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     mainProgram = "lx-music-desktop";
     maintainers = with maintainers; [ oosquare ];

pkgs/by-name/ly/LycheeSlicer/package.nix

···
 }:
 let
   pname = "LycheeSlicer";
-  version = "7.3.1";
+  version = "7.3.2";
 
   src = fetchurl {
     url = "https://mango-lychee.nyc3.cdn.digitaloceanspaces.com/LycheeSlicer-${version}.AppImage";
-    hash = "sha256-21ySVT2Un/WAWxvEAH5GfrumGbsSaeNVjaMsL9mYwsg=";
+    hash = "sha256-CmN4Q4gTGYeICIoLz0UuVlSyOstXW/yYVb4s1dT5EOc=";
   };
 
   desktopItem = makeDesktopItem {

pkgs/by-name/ma/mapcache/package.nix

···
   fcgi,
   gdal,
   geos,
+  gfortran,
   libgeotiff,
   libjpeg,
   libpng,
···
   zlib,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mapcache";
   version = "1.14.1";
 
   src = fetchFromGitHub {
     owner = "MapServer";
     repo = "mapcache";
-    rev = "rel-${lib.replaceStrings [ "." ] [ "-" ] version}";
+    tag = "rel-${lib.replaceStrings [ "." ] [ "-" ] finalAttrs.version}";
     hash = "sha256-AwdZdOEq9SZ5VzuBllg4U1gdVxZ9IVdqiDrn3QuRdCk=";
   };
 
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-  ];
+  nativeBuildInputs =
+    [
+      cmake
+      pkg-config
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # work around for `ld: file not found: @rpath/libquadmath.0.dylib`
+      gfortran.cc
+    ];
 
   buildInputs = [
     apacheHttpd
···
 
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-std=c99";
 
+  prePatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "include_directories(\''${TIFF_INCLUDE_DIR})" "" \
+      --replace-fail "target_link_libraries(mapcache \''${TIFF_LIBRARY})" "target_link_libraries(mapcache TIFF::TIFF)"
+  '';
+
   meta = {
     description = "Server that implements tile caching to speed up access to WMS layers";
     homepage = "https://mapserver.org/mapcache/";
···
     maintainers = lib.teams.geospatial.members;
     platforms = lib.platforms.unix;
   };
-}
+})

pkgs/by-name/ma/mattermostLatest/package.nix

···
     # and make sure the version regex is up to date here.
     # Ensure you also check ../mattermost/package.nix for ESR releases.
     regex = "^v(10\\.[0-9]+\\.[0-9]+)$";
-    version = "10.7.0";
-    srcHash = "sha256-T8lLF5AsJYALVijXOUxkSACa6h8W4HcqoML2+BPsEsY=";
+    version = "10.7.1";
+    srcHash = "sha256-pUVy/l6C3ygwX2JMQmHEpiHwYEUBl1/k37gq2fLM0Os=";
     vendorHash = "sha256-B2vfHszOVKbkN7h0tQGeGzLdeuxQDgaFv9QWkQgGCWs=";
     npmDepsHash = "sha256-ZMgsfdmGtU3PgdmiY0xMCHh8dAOAmEFNbKcxXKO7CJc=";
     lockfileOverlay = ''

pkgs/by-name/mi/miniflux/package.nix

···
 
 buildGoModule rec {
   pname = "miniflux";
-  version = "2.2.7";
+  version = "2.2.8";
 
   src = fetchFromGitHub {
     owner = "miniflux";
     repo = "v2";
     tag = version;
-    hash = "sha256-1W+sFXvM5qOYxpbRBkZIvombchv2oYkcFuq7/ETGjfs=";
+    hash = "sha256-AQ6HVRVlWt1D8fA4Z2FH7VIEKydDva7txwa/9Rfq0Ho=";
   };
 
-  vendorHash = "sha256-bulQrLtA61RMZVhTtupTJUUTWJGWXcmpGaNUAoXEfYE=";
+  vendorHash = "sha256-9I0/dyjanuV8oZystox9RY/gGx1SZuFRTghArv5aJ64=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/ol/olivetin/package.nix

···
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+  stdenvNoCC,
+  writableTmpDirAsHomeHook,
+  buf,
+  protoc-gen-go,
+  protoc-gen-go-grpc,
+  grpc-gateway,
+  buildNpmPackage,
+  installShellFiles,
+  versionCheckHook,
+  nixosTests,
+}:
+
+buildGoModule (
+  finalAttrs:
+
+  let
+    gen = stdenvNoCC.mkDerivation {
+      pname = "olivetin-gen";
+      inherit (finalAttrs) version src;
+
+      nativeBuildInputs = [
+        writableTmpDirAsHomeHook
+        buf
+        protoc-gen-go
+        protoc-gen-go-grpc
+        grpc-gateway
+      ];
+
+      buildPhase = ''
+        runHook preBuild
+
+        pushd proto
+        buf generate
+        popd
+
+        runHook postBuild
+      '';
+
+      installPhase = ''
+        runHook preInstall
+
+        cp -r service/gen $out
+
+        runHook postInstall
+      '';
+
+      outputHashMode = "recursive";
+      outputHash = "sha256-KygZ7NqkfhczYy1YMR824Om4NTq06+KHa/jvmsCty3s=";
+    };
+
+    webui = buildNpmPackage {
+      pname = "olivetin-webui";
+      inherit (finalAttrs) version src;
+
+      npmDepsHash = "sha256-VxIPjpsbxEPP15cu5Wvz0qeDGXTMb2tojdry8YaHMVI=";
+
+      sourceRoot = "${finalAttrs.src.name}/webui.dev";
+
+      buildPhase = ''
+        runHook preBuild
+
+        npx parcel build --public-url "."
+
+        runHook postBuild
+      '';
+
+      installPhase = ''
+        runHook preInstall
+
+        cp -r dist $out
+        cp -r *.png $out
+
+        runHook postInstall
+      '';
+    };
+  in
+
+  {
+    pname = "olivetin";
+    version = "2025.4.22";
+
+    src = fetchFromGitHub {
+      owner = "OliveTin";
+      repo = "OliveTin";
+      tag = finalAttrs.version;
+      hash = "sha256-dgoYGtBsyaCTgxCT/y7rU5B9pEvIU/yiLU2/pPm/vJU=";
+    };
+
+    modRoot = "service";
+
+    vendorHash = "sha256-yUW4BrC7Oqs+mvvZGp6oxdGQ9fxP5gQNacq6Pz5ZHAQ=";
+
+    ldflags = [
+      "-s"
+      "-w"
+      "-X main.version=${finalAttrs.version}"
+    ];
+
+    __darwinAllowLocalNetworking = true;
+
+    nativeBuildInputs = [ installShellFiles ];
+
+    preBuild = ''
+      ln -s ${gen} gen
+      substituteInPlace internal/config/config.go \
+        --replace-fail 'config.WebUIDir = "./webui"' 'config.WebUIDir = "${webui}"'
+      substituteInPlace internal/httpservers/webuiServer_test.go \
+        --replace-fail '"../webui/"' '"${webui}"'
+    '';
+
+    postInstall = ''
+      installManPage ../var/manpage/OliveTin.1.gz
+    '';
+
+    nativeInstallCheckInputs = [ versionCheckHook ];
+    versionCheckProgram = "${placeholder "out"}/bin/OliveTin";
+    versionCheckProgramArg = "-version";
+    doInstallCheck = true;
+
+    passthru = {
+      inherit gen webui;
+      tests = { inherit (nixosTests) olivetin; };
+      updateScript = ./update.sh;
+    };
+
+    meta = {
+      description = "Gives safe and simple access to predefined shell commands from a web interface";
+      homepage = "https://www.olivetin.app/";
+      downloadPage = "https://github.com/OliveTin/OliveTin";
+      changelog = "https://github.com/OliveTin/OliveTin/releases/tag/${finalAttrs.version}";
+      license = lib.licenses.agpl3Only;
+      maintainers = with lib.maintainers; [ defelo ];
+      mainProgram = "OliveTin";
+    };
+  }
+)

pkgs/by-name/ol/olivetin/update.sh

···
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix-update common-updater-scripts
+
+set -euo pipefail
+
+nix-update olivetin --src-only
+update-source-version olivetin --source-key=gen --ignore-same-version
+update-source-version olivetin --source-key=webui.npmDeps --ignore-same-version
+update-source-version olivetin --source-key=goModules --ignore-same-version

pkgs/by-name/op/openimageio/2.nix

···
+{ fetchFromGitHub, openimageio }:
+
+let
+  version = "2.5.17.0";
+in
+openimageio.overrideAttrs {
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "AcademySoftwareFoundation";
+    repo = "OpenImageIO";
+    tag = "v${version}";
+    hash = "sha256-d5LqRcqWj6E9jJYY/Pa5e7/MeuQGMjUo/hMCYRKsKeU=";
+  };
+}

pkgs/by-name/op/ophcrack/package.nix

···
   version = "3.8.0";
 
   src = fetchurl {
-    url = "mirror://ophcrack/ophcrack/${version}/ophcrack-${version}.tar.bz2";
+    url = "mirror://sourceforge/ophcrack/${version}/ophcrack-${version}.tar.bz2";
     hash = "sha256-BIpt9XmDo6WjGsfE7BLfFqpJ5lKilnbZPU75WdUK7uA=";
   };
 

pkgs/by-name/os/osu-lazer-bin/package.nix

···
 
 let
   pname = "osu-lazer-bin";
-  version = "2025.420.0";
+  version = "2025.424.0";
 
   src =
     {
       aarch64-darwin = fetchzip {
         url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Apple.Silicon.zip";
-        hash = "sha256-rFPh1mziEcbqBhxRAoV2qHKNQeWjWIrprx6tXnLoGLs=";
+        hash = "sha256-fgG3SnltGxOYHwos8BTngaW4YrRdpOdURxd73sz0t7o=";
         stripRoot = false;
       };
       x86_64-darwin = fetchzip {
         url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Intel.zip";
-        hash = "sha256-PlyJkN9ALSE8s2gPVkMXoZd+1FKqqFxIFPLkJkXwk0k=";
+        hash = "sha256-0K+uAH4f8JOfzG4J37aGaStpEkH5tdUfHEqsogMtN2I=";
         stripRoot = false;
       };
       x86_64-linux = fetchurl {
         url = "https://github.com/ppy/osu/releases/download/${version}/osu.AppImage";
-        hash = "sha256-yrVFep119E2PkRsyB0UPhZnjR7jXuhd9CktIgL98om4=";
+        hash = "sha256-8nOoSkNbzEFpDj0FivCYI20tZzT02YHcKZblfEfh+Zo=";
       };
     }
     .${stdenvNoCC.system} or (throw "osu-lazer-bin: ${stdenvNoCC.system} is unsupported.");

pkgs/by-name/os/osu-lazer/package.nix

···
 
 buildDotnetModule rec {
   pname = "osu-lazer";
-  version = "2025.420.0";
+  version = "2025.424.0";
 
   src = fetchFromGitHub {
     owner = "ppy";
     repo = "osu";
     tag = version;
-    hash = "sha256-yDWU4mQYR6a9eKTEEsxZ2UASvMuQzWi+HZbDmanhalA=";
+    hash = "sha256-+r7YeaNrUkoYoMzGqhqT+bqdO1UohvJRlAcAskF7vn4=";
   };
 
   projectFile = "osu.Desktop/osu.Desktop.csproj";

pkgs/by-name/po/pocket-id/package.nix

···
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "pocket-id";
-  version = "0.48.0";
+  version = "0.49.0";
 
   src = fetchFromGitHub {
     owner = "pocket-id";
     repo = "pocket-id";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ax5E3e3GUrQLVsQREUhjmORjXQgKrEBVa9ySJr5ZLUY=";
+    hash = "sha256-fyyeYArjhsS/R9VsZsRM3oO5fz8EUqjNIuvFJpGZbds=";
   };
 
   backend = buildGoModule {

pkgs/by-name/qq/qq/sources.nix

···
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2025-04-06
+# Last updated: 2025-04-25
 {
-  version = "3.2.16-2025.4.1";
-  amd64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.16_250401_amd64_01.deb";
-  arm64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.16_250401_arm64_01.deb";
-  arm64_hash = "sha256-av1Pu5ZXASc0Jmm0c7xxtmECIHAYWOo1NQOdI3fDmZA=";
-  amd64_hash = "sha256-f+7bo4zVSywnAE1WJPUjVLyFJQYlz56QVEah2uDSzP8=";
+  version = "3.2.17-2025.4.23";
+  amd64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.17_250423_amd64_01.deb";
+  arm64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.17_250423_arm64_01.deb";
+  arm64_hash = "sha256-BJ6WNswd9foQRD+SrJm854OiSVxREHJIv+VFe1NGnKE=";
+  amd64_hash = "sha256-l65Gci0wRcGuL7xqwnCng8hWdlbNC6pEaE8NaZpftM0=";
 }

pkgs/by-name/qu/quarkus/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "quarkus-cli";
-  version = "3.21.1";
+  version = "3.21.4";
 
   src = fetchurl {
     url = "https://github.com/quarkusio/quarkus/releases/download/${finalAttrs.version}/quarkus-cli-${finalAttrs.version}.tar.gz";
-    hash = "sha256-5RQsGznVMVR24v0hxIWKV+Hs6SR0g0tsY7tpgFp8sps=";
+    hash = "sha256-ksI55x1rmpIRfNNgajmAvprKU3OwL4EW8QpNV2eyPTc=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/re/rerun/package.nix

···
   # More information can be found in there README:
   # https://raw.githubusercontent.com/rerun-io/rerun/5a9794990c4903c088ad77174e65eb2573162d97/crates/utils/re_analytics/README.md
   buildWebViewerFeatures ? [
-    "grpc"
     "map_view"
   ],
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rerun";
-  version = "0.22.1";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "rerun-io";
     repo = "rerun";
-    tag = version;
-    hash = "sha256-J9Iy/KiDajDavL95qLcQBfUWpZ6OiUtldk+ZAGpSNWA=";
+    tag = finalAttrs.version;
+    hash = "sha256-ZMvX/9kz+tEiQ01GO7B+/wdxxkFkuExR9jA2KROIbgw=";
   };
 
   # The path in `build.rs` is wrong for some reason, so we patch it to make the passthru tests work
···
   '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-cGg8yi/jYKyle8dudHSNLPMnOtcgqlBQmu83h4B26NI=";
+  cargoHash = "sha256-2BMBfEunRRMX4++w0Fg9wTAeEmODtOTcruXCO9JKreo=";
 
   cargoBuildFlags = [ "--package rerun-cli" ];
   cargoTestFlags = [ "--package rerun-cli" ];
···
   meta = {
     description = "Visualize streams of multimodal data. Fast, easy to use, and simple to integrate.  Built in Rust using egui";
     homepage = "https://github.com/rerun-io/rerun";
-    changelog = "https://github.com/rerun-io/rerun/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/rerun-io/rerun/blob/${finalAttrs.version}/CHANGELOG.md";
     license = with lib.licenses; [
       asl20
       mit
···
     ];
     mainProgram = "rerun";
   };
-}
+})

pkgs/by-name/ru/ruff/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.11.6";
+  version = "0.11.7";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-Yi8eRA2xL+wumXXrq5c4NNtPORZ3BjEM5IowDEfsjwA=";
+    hash = "sha256-DXu9/DRwcffZtsql/Qk+6GyzhiYXUyW6R9FCAvLhn6o=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-rJNA6Lh3OnY60BZ8YnjP+7cSGftbCb69ISQyr7z523Q=";
+  cargoHash = "sha256-4TK7HEdSCvUGqsAH+dnPgMBYmT/0mOnvQXHr/PtcsT0=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/ru/rundeck-cli/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchurl,
+  makeWrapper,
+  jdk11,
+  unzip,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "rundeck-cli";
+  version = "2.0.8";
+
+  src = fetchurl {
+    url = "https://github.com/rundeck/rundeck-cli/releases/download/v${finalAttrs.version}/rundeck-cli-${finalAttrs.version}-all.jar";
+    hash = "sha256-mpy4oS7zCUdt4Q+KQPrGGbw6Gzmh1Msygl+NXDmFhDw=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jdk11 ];
+
+  dontUnpack = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/rundeck-cli
+    cp $src $out/share/rundeck-cli/rundeck-cli.jar
+
+    mkdir -p $out/bin
+    makeWrapper ${lib.getExe jdk11} $out/bin/rd \
+      --add-flags "-jar $out/share/rundeck-cli/rundeck-cli.jar"
+
+    runHook postInstall
+  '';
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgram = "${placeholder "out"}/bin/rd";
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "The official CLI tool for Rundeck";
+    longDescription = ''
+      The rd command provides command line access to the Rundeck HTTP API,
+      allowing you to access and control your Rundeck server from the
+      command line or shell scripts.
+    '';
+    homepage = "https://github.com/rundeck/rundeck-cli";
+    changelog = "https://github.com/rundeck/rundeck-cli/blob/v${finalAttrs.version}/docs/changes.md";
+    sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ liberodark ];
+    mainProgram = "rd";
+  };
+})

pkgs/by-name/ru/rundeck/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rundeck";
-  version = "5.10.0-20250312";
+  version = "5.11.1-20250415";
 
   src = fetchurl {
     url = "https://packagecloud.io/pagerduty/rundeck/packages/java/org.rundeck/rundeck-${finalAttrs.version}.war/artifacts/rundeck-${finalAttrs.version}.war/download?distro_version_id=167";
-    hash = "sha256-BwO7FM1LP0OrjG7opz4qqDuJQdtBmmFtZTtigV99ssE=";
+    hash = "sha256-WOxY2GGtll+2xkSbJUKOvgsr408nIvRcEuBULcawijc=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
···
     sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
     license = lib.licenses.asl20;
     platforms = lib.platforms.unix;
-    maintainers = [ lib.maintainers.liberodark ];
+    maintainers = with lib.maintainers; [ liberodark ];
     mainProgram = "rundeck";
   };
 })

pkgs/by-name/sd/SDL2_classic_image/package.nix

···
+{
+  SDL2_image,
+  SDL2_classic,
+  enableSTB ? true,
+}:
+
+(SDL2_image.override {
+  SDL2 = SDL2_classic;
+  inherit enableSTB;
+}).overrideAttrs
+  {
+    pname = "SDL2_classic_image";
+  }

pkgs/by-name/sd/SDL2_classic_mixer/package.nix

···
+{
+  SDL2_mixer,
+  SDL2_classic,
+}:
+
+(SDL2_mixer.override {
+  SDL2 = SDL2_classic;
+}).overrideAttrs
+  {
+    pname = "SDL2_classic_mixer";
+  }

pkgs/by-name/sd/SDL2_classic_mixer_2_0/package.nix

···
+{
+  SDL2_mixer_2_0,
+  SDL2_classic_mixer,
+}:
+
+SDL2_mixer_2_0.override {
+  SDL2_mixer = SDL2_classic_mixer;
+}

pkgs/by-name/sd/SDL2_classic_ttf/package.nix

···
+{
+  SDL2_ttf,
+  SDL2_classic,
+}:
+
+(SDL2_ttf.override {
+  SDL2 = SDL2_classic;
+}).overrideAttrs
+  {
+    pname = "SDL2_classic_ttf";
+  }

pkgs/by-name/sd/SDL2_image/package.nix

···
   SDL2,
   autoreconfHook,
   fetchurl,
-  giflib,
-  libXpm,
   libjpeg,
   libpng,
   libtiff,

pkgs/by-name/si/signal-desktop-bin/signal-desktop-darwin.nix

···
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "signal-desktop-bin";
-  version = "7.47.0";
+  version = "7.51.0";
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/signal-desktop-mac-universal-${finalAttrs.version}.dmg";
-    hash = "sha256-PP8D6D/DJiONJp0UNUSoy8zDwWGVWRRMsqfPTWQCgs8=";
+    hash = "sha256-dUcBvKbGVsEUxOSv8u/jjuvYjHar2+zbv+/ZRS85w1w=";
   };
   sourceRoot = ".";
 

pkgs/by-name/tr/trezor-suite/package.nix

···
 
 let
   pname = "trezor-suite";
-  version = "25.2.2";
+  version = "25.4.2";
 
   suffix =
     {
···
     hash =
       {
         # curl -Lfs https://github.com/trezor/trezor-suite/releases/download/v${version}/latest-linux{-arm64,}.yml | grep ^sha512 | sed 's/: /-/'
-        aarch64-linux = "sha512-9EWbYju0e3DdS8bnuMiD4Cdodz/LxbLyCItNEWSIi/UADxtH7smAbpAu4Awcgbb3o39x94Mf8rbqcxmIktDDhQ==";
-        x86_64-linux = "sha512-j8TI46Jr/Tc99Ri3aFY0z73HFY5AWpeAv/yJy8xsV8rNGWEwKlCvJzkrEUpvpFUBMoHgGw3PTQ7CYUQ5bmB/CA==";
+        aarch64-linux = "sha512-BqZjccLs1eHcHmmzyWa3L37KjKjHJFxEhk+BtAD52Z9Mg8wq2Qpz0+z5JrCOXdqLf+j5jfmAQae2HpQhQrqV3g==";
+        x86_64-linux = "sha512-P4+FQd5Uis1rCzCOCpNNAbGS70t/u7FYHkz2+ylF+yBHauARsyvLm1IbUKZyqCsruae0O8n2wIuIltpLImNtqA==";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };

pkgs/by-name/tu/turbo-unwrapped/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "turbo-unwrapped";
-  version = "2.5.0";
+  version = "2.5.1";
 
   src = fetchFromGitHub {
     owner = "vercel";
     repo = "turborepo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-crpEJdhO27cVXl4YnPmUwvJFAeezcxdS/vJPJ2m1VU8=";
+    hash = "sha256-qwTFD9lIHY5sBliB5ri5AOvW5Cr/nvM+u7e7JS0CAKQ=";
   };
 
   useFetchCargoVendor = true;

pkgs/by-name/we/werf/package.nix

···
 }:
 buildGoModule (finalAttrs: {
   pname = "werf";
-  version = "2.35.3";
+  version = "2.35.4";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ebbc8pKZ8QkxGq9MttpulBkQLXcjH25Zoq8owxIamKg=";
+    hash = "sha256-bp0KtTsKSBfCLwKfHseLKnGh9ub09+FC841y0I+KNtw=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-Bgi8Pd7lON0DTSzHKaHHbqdS9S/i01tJV/x5bgmiWCo=";
+  vendorHash = "sha256-vWjFdwcVbw8lxJl2mR54O8DpiwbGzyCy50Heu7NFLA8=";
 
   subPackages = [ "cmd/werf" ];
 
···
     [
       "-s"
       "-w"
-      "-X github.com/werf/werf/v2/pkg/werf.Version=${finalAttrs.src.rev}"
+      "-X github.com/werf/werf/v2/pkg/werf.Version=v${finalAttrs.version}"
     ]
     ++ lib.optionals (finalAttrs.env.CGO_ENABLED == 1) [
       "-extldflags=-static"
···
       Buildah.
     '';
     homepage = "https://werf.io";
-    changelog = "https://github.com/werf/werf/releases/tag/${finalAttrs.src.rev}";
+    changelog = "https://github.com/werf/werf/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.asl20;
     maintainers = [ lib.maintainers.azahi ];
     mainProgram = "werf";

pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix

···
   stdenv,
   rustPlatform,
   fetchFromGitHub,
-  fetchpatch,
   libcosmicAppHook,
   pkg-config,
   util-linux,
···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "xdg-desktop-portal-cosmic";
-  version = "1.0.0-alpha.6";
+  version = "1.0.0-alpha.7";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "xdg-desktop-portal-cosmic";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-ymBmnSEXGCNbLTIVzHP3tjKAG0bgvEFU1C8gnxiow98=";
+    hash = "sha256-7yfrjKHuYOWPMMkHdGZ+g0hynh2TtSf4h8zW13tTus4=";
   };
 
   env = {
-    VERGEN_GIT_COMMIT_DATE = "2025-02-20";
-    VERGEN_GIT_SHA = finalAttrs.src.rev;
+    VERGEN_GIT_COMMIT_DATE = "2025-04-08";
+    VERGEN_GIT_SHA = finalAttrs.src.tag;
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-FO/GIzv9XVu8SSV+JbOf98UX/XriRgqTthtzvRIWNjo=";
+  cargoHash = "sha256-fOaLeWtrjgBDSShC5OmBZKODNQn4bp/+iPZX5ZMQFqk=";
 
   separateDebugInfo = true;
 
···
   ];
 
   checkInputs = [ gst_all_1.gstreamer ];
-
-  # TODO: Remove this when updating to the next version
-  patches = [
-    (fetchpatch {
-      name = "cosmic-portal-fix-examples-after-ashpd-api-update.patch";
-      url = "https://github.com/pop-os/xdg-desktop-portal-cosmic/commit/df831ce7a48728aa9094fa1f30aed61cf1cc6ac3.diff?full_index=1";
-      hash = "sha256-yRrB3ds9TtN1OBZEZbnE6h2fkPyP4PP2IJ17n+0ugEo=";
-    })
-  ];
 
   postPatch = ''
     # While the `kate-hazen-COSMIC-desktop-wallpaper.png` image is present

pkgs/by-name/ya/yarn-berry/fetcher/fetch-yarn-berry-deps.nix

···
 
     outputHashMode = "recursive";
 
+    dontFixup = true; # fixup phase does the patching of the shebangs, and FODs must never contain nix store paths.
+
     passthru = {
       inherit berryVersion;
     };

pkgs/by-name/ya/yarn-berry/fetcher/yarn-berry-fetcher.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "yarn-berry-${toString berryVersion}-fetcher";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchFromGitLab {
     domain = "cyberchaos.dev";
     owner = "yuka";
     repo = "yarn-berry-fetcher";
-    tag = "1.0.0";
-    hash = "sha256-iMU/SadzrNv8pZSgp2fBwWVgrgZsnyPRsvs0ugvwyks=";
+    tag = "1.0.1";
+    hash = "sha256-v92+aeGmT151TvcW7FvuooF3g+opdZw7QHY+CcLweJE=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-ETFaCu+6Ar7tEeRCbTbesEqx9BdztSvPXB7Dc5KGIx0=";
+  cargoHash = "sha256-TR9FT95WAaiRvoYBXeT0U6agF94BAdMswNncYysESKo=";
 
   env.YARN_ZIP_SUPPORTED_CACHE_VERSION = berryCacheVersion;
   env.LIBZIP_SYS_USE_PKG_CONFIG = 1;

pkgs/by-name/yt/ytdownloader/package.nix

···
   fetchFromGitHub,
   copyDesktopItems,
   makeWrapper,
-  ffmpeg,
+  ffmpeg-headless,
   yt-dlp,
   makeDesktopItem,
   electron,
···
     makeWrapper
   ];
   buildInputs = [
-    ffmpeg
+    ffmpeg-headless
     yt-dlp
   ];
 
···
   # Also stop it from downloading ytdlp
   postPatch = ''
     substituteInPlace src/renderer.js \
-      --replace-fail $\{__dirname}/../ffmpeg '${lib.getExe ffmpeg}' \
+      --replace-fail $\{__dirname}/../ffmpeg '${lib.getExe ffmpeg-headless}' \
       --replace-fail 'path.join(os.homedir(), ".ytDownloader", "ytdlp")' '`${lib.getExe yt-dlp}`' \
       --replace-fail '!!localStorage.getItem("fullYtdlpBinPresent")' 'true'
     # Disable auto-updates
···
 
   postInstall = ''
     makeWrapper ${electron}/bin/electron $out/bin/ytdownloader \
-        --add-flags $out/lib/node_modules/ytdownloader/main.js
+        --add-flags $out/lib/node_modules/ytdownloader/main.js \
+        --prefix PATH : ${lib.makeBinPath [ ffmpeg-headless ]}
 
     install -Dm444 assets/images/icon.png $out/share/pixmaps/ytdownloader.png
   '';

pkgs/by-name/zs/zsh-wd/package.nix

···
 
 stdenvNoCC.mkDerivation rec {
   pname = "wd";
-  version = "0.9.3";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "mfaerevaag";
     repo = "wd";
     rev = "v${version}";
-    hash = "sha256-u1VrsSF+JqsvWOZfj5mSOknLra6Bxl9tR7fybyP476Y=";
+    hash = "sha256-/xOe7XFzQt+qVGf6kfsOPPM8szWYhnmx5Mq/QIw0y1c=";
   };
 
   nativeBuildInputs = [ installShellFiles ];

pkgs/data/fonts/nerd-fonts/manifests/checksums.json

···
 {
-  "0xProto.tar.xz": "d72bdd83f02a9071d4bb0acd38a37fe687a47bd29189e838edf847ed39b87e10",
-  "3270.tar.xz": "304010729a11da9bea9f2f1e35e84f4f2240cd8b0ec2a315ef3c1af0ba3af185",
-  "Agave.tar.xz": "2f7939592934ac02ed74e90556a7e13e95ca621b6e44df31db729ae6930f9cb4",
-  "AnonymousPro.tar.xz": "85798dd957cb18837c387ca7fd43044a62830a58860d24e7bd315fc10b5b94f6",
-  "Arimo.tar.xz": "4abbf467968a0f31bb3ad8da7ecd15117cdc8265a67a793e5b9ded6437654ce7",
-  "AurulentSansMono.tar.xz": "b1898e9bbfa1cbea8fd514b151ff4bb572d2562234e942408a9ef90dfb14075f",
-  "BigBlueTerminal.tar.xz": "44bf48101c6c31f6777a42430021681cf54c2f0699f1357a33c73c8788c5aa35",
-  "BitstreamVeraSansMono.tar.xz": "0e5c4ed24358be59a8f7268f3b7352d92f5f19894cdbc62e3c0d91af16250d95",
-  "CascadiaCode.tar.xz": "86ac1e16199fe9c3448a7882e4f3e90c11c27396fd4771c552661648e3d18f96",
-  "CascadiaMono.tar.xz": "29e494f00c6ec0bbbeba031cb69f30ebbe4cf46945d341e0347aab7073049bf0",
-  "CodeNewRoman.tar.xz": "b032b5521c070076148f986d861708ed142fe19f2014a9f248ca4d0a43e9cc8e",
-  "ComicShannsMono.tar.xz": "cb3667e107e265010566d05e544170b57eec3808f33b0c1790b3b1bd069690aa",
-  "CommitMono.tar.xz": "aa7f15a591374a04379223a0c224cd66a7c98938e52cda306311681cc51a1c22",
-  "Cousine.tar.xz": "c7ee3224ff34c69fadfe947d5a9bf349952206cf8e0708564f7cf3d49095d4d8",
-  "D2Coding.tar.xz": "cad0abe4898b6d9aa12d28c4383ea7260eadba951b6ed9d347a524efc234dd1b",
-  "DaddyTimeMono.tar.xz": "8a4b6f1fda69bad7dbf102059416998caa5a870fb413c49e88d64ac2912a93e5",
-  "DejaVuSansMono.tar.xz": "e02d9dcf740b6fe72288ece5ea235a78cdc3763502b2682d7659c7618d4400c5",
-  "DepartureMono.tar.xz": "45dca8cadd11f6eb289c13f66be3ad7fbd525504168d3c0931d57c8ad56be909",
-  "DroidSansMono.tar.xz": "1e2b79f888e4d07617857ddae0f82ffe07b65328fc0664e9a94bc0fac1aef888",
-  "EnvyCodeR.tar.xz": "be99355fc93e9c351a4c70d7713c8f4fe038a65ac72f7ac9cc5550bc52734b70",
-  "FantasqueSansMono.tar.xz": "947166571476762b8e9b87a6b0532f9eab29147dc9e5d15aad1b7983229328d7",
-  "FiraCode.tar.xz": "7c64c44d7e530b25faf23904e135e9d1ff0339a92ee64e35e7da9116aa48af67",
-  "FiraMono.tar.xz": "d23c8db9d53397606bcfe6593f576abb12dd8e3d0605062231e391e2719e92c0",
-  "GeistMono.tar.xz": "8c5cacfa8a1fe276ea4ebdbe3b542ce71a7144c04a811c9f210faa401b436b3b",
-  "Go-Mono.tar.xz": "d3d2a8ec7f30513e52412f8907ec4838fd5843323b9e2a5a841de6531aff9a3a",
-  "Gohu.tar.xz": "da43efcf1eb53dc1773938861a9f3fcb19b71065a6a5bb0295e6038e90545027",
-  "Hack.tar.xz": "f797524e4b99191a5f35614c6fe48e96f7b8872712e2943a2aaf59cda086e909",
-  "Hasklig.tar.xz": "9cb2f02337782dd5eb1711f9890edaeea3d59eca00dd7ea3810c237336883fe3",
-  "HeavyData.tar.xz": "a3473e58cf5a7469a511dfdba2935611945e5cbd2f17d09a361c1ce19a30df0f",
-  "Hermit.tar.xz": "fddd0ada8ab3266042d4f6ddb3dd7a9c652c15ac80eda35097c3914281e14db0",
-  "IBMPlexMono.tar.xz": "f7b420dae1361d347858c78d6d48e385bc644e32781cc21eb7dcc483c3682eb1",
-  "Inconsolata.tar.xz": "d843486d7bab95ccf06c6c17ef03773b2dc5b284602b3926356a668c49be565f",
-  "InconsolataGo.tar.xz": "105963a2025b4cb96798d1538f38aa65bd13a856cda9941ce25c139959eccd03",
-  "InconsolataLGC.tar.xz": "442501cffb407e11539fa9fb4714253d779dd0508c0257c42eec187f11a18b13",
-  "IntelOneMono.tar.xz": "0a5287b9e24a9adce148daea25c04242ae65f9bb04e3610c8374eaca7379ec20",
-  "Iosevka.tar.xz": "01b352cd732b36d24fb7b0f2b331ddc34c2a39155af6e7a42bddf2ee279bb25d",
-  "IosevkaTerm.tar.xz": "5ca2a43d1ed2a0098fbc9f87e7dc89c6a13d0399bcb82f09359fa141f9afb70b",
-  "IosevkaTermSlab.tar.xz": "c8e7e72b6652adb34e4f0af20e22d1eda06368db3a6ebab5194d1078944ea31a",
-  "JetBrainsMono.tar.xz": "7d171ea3884be22fc08bf1a1aee640a3dc93f031989c27f6f9ceb30a6a668de1",
-  "Lekton.tar.xz": "2f83aabdf69d1ae28e9b60ef3777e572aafc359f32c8eae7a6278337f1364014",
-  "LiberationMono.tar.xz": "cc2d9a78c88c91875d8fee10d7d5d67ee9f0687ef004fd61bee4e7a1ecef700b",
-  "Lilex.tar.xz": "1f4d1c13252f12e9b09e09f881ea21a77645e1eac3472604990b3a11deea78c1",
-  "MPlus.tar.xz": "55d7390e8b45fc19a028dd93d42aebf0fe55fd85321940d1be13a5f6fa592e76",
-  "MartianMono.tar.xz": "7cad96ae914fecff010fa438276a99daf984044ade8b473049b3b63f771a5603",
-  "Meslo.tar.xz": "6ad716ed719e2c97794abd5856a90c6131c406606b249debdc83b04ae11f4cb7",
-  "Monaspace.tar.xz": "faeb907827a2a07ae64c8fa1a5ca48cd9e60c9084a24c48d779a30cf6bd0693a",
-  "Monofur.tar.xz": "9dfad24a7debf0ca56db2465e8bd5a0a28435945c23e2a831bcd111785b57480",
-  "Monoid.tar.xz": "51765143936c5c5078249eb77f2dc862f0d9436328c4c698918b276637d5caee",
-  "Mononoki.tar.xz": "b9bff1032796daffef71610639685d28a4a5baf31cb4ca43dd53f3d14820f5cf",
-  "NerdFontsSymbolsOnly.tar.xz": "8b5ecbe2612cb37d75e2645f7644876bc38960574909b1c01c002d0e8d33deb3",
-  "Noto.tar.xz": "556a30d1dcdbf565946605f50657fa77105d95d150413492cfa7065263f56427",
-  "OpenDyslexic.tar.xz": "5cd679c82f992f4140f2ab4f6cb77b0080f71a3d7152fb8c91fe0c07f4dcce83",
-  "Overpass.tar.xz": "6dc50cddca27afa51bd2cce334d6b451d6ce56e6f955c06518ae5b9b1f99e9fc",
-  "ProFont.tar.xz": "960a9f36ea58ab07c2955b8cb37b4386626ae19b23d026095ef896a05842dadb",
-  "ProggyClean.tar.xz": "70e91ef90a6d6230f6870a978b856e6138dcff0b98efa9ba3e84c447dda638a2",
-  "Recursive.tar.xz": "2c9d0b6db82ef6acf71b235b5bd7b16f33cfbbba5ce08bfb1278f7dc6ec1eb20",
-  "RobotoMono.tar.xz": "fad79b182e2c27454276b45d9633c0800302da996168bc5cee0109fda2181ed3",
-  "ShareTechMono.tar.xz": "0f7fb196b3700caeee85ddad56efde174416d73afc651a79d38bd319c1587d43",
-  "SourceCodePro.tar.xz": "87834bca780558bbe3ff808e51c89e1c3d98140a2c1a0d3100e10e944456a63c",
-  "SpaceMono.tar.xz": "a2058cfc43eee5a170208c6e90fa77d8f0aa755e0d213e795f70781f7d807942",
-  "Terminus.tar.xz": "88b17b50aab7ee284f9a1ed395f96c20ab4d22640fde1fe0f80a31f1eacd6585",
-  "Tinos.tar.xz": "f763b82e01f06ebce5830c475306598734d2fc91ded1760fe925a826b3cba8ef",
-  "Ubuntu.tar.xz": "4ff08c04bec3ec86b60d75a987b5c09d7e5c434f006f426bcfdac80f6f66d938",
-  "UbuntuMono.tar.xz": "dc8a6aebd8950e59dd89a1c5f49be3914879691e2e1293c157b7f66291c09712",
-  "UbuntuSans.tar.xz": "3d0ed4bbadf13f9655c5e4a3bc089eef6db232fa3d4552144b1683adc9fad98d",
-  "VictorMono.tar.xz": "f61229287e333e575f134923fd46da32fe4e01120a2a74a17d2d9b7591a9b87e",
-  "ZedMono.tar.xz": "fa29af2373bbf6edda1c3c9a42655227748d1a9f7b2563bf4b79253618768318",
-  "iA-Writer.tar.xz": "50d885c7f03931323c5ea232c677b8963f8d1a196cfd8f2935e2ddcf535b5971"
+  "0xProto.tar.xz": "effaa4c257c1f25e6d2d50679e9b845eab36b346dea9ee26f4405da1a21e6428",
+  "3270.tar.xz": "6d9dd76987968e8a0b30d3ae4d18b8139d6ddf6cd53409272dbc596654ea38b1",
+  "AdwaitaMono.tar.xz": "39b7598b2ec30111d1ace82b274809e5d0930e241683c1c91f5b4c7e64a975cf",
+  "Agave.tar.xz": "fe4879b0cff2d33d7fb08d1c8ba4e0cad9f44843644fe284fda1e89addf9c4ab",
+  "AnonymousPro.tar.xz": "7ebace54eda35943062eaad9dd4f16de24390b672f31bff45475b82acb1955c0",
+  "Arimo.tar.xz": "006464de19502bd49a72265058811665b62b823509bbbd2e7181ba87046b6b08",
+  "AtkinsonHyperlegibleMono.tar.xz": "8643ab571f547c6af0352a08e617ba7303965b2882ab9f36d61e8d4680761a59",
+  "AurulentSansMono.tar.xz": "a0d642ace8f9d616a9c9cbbe46e188c60ddf7486b0cf2685a3558e06aba2c284",
+  "BigBlueTerminal.tar.xz": "9df627ec74a21f4da8df4821dba85cabcc452f95b636e8802eeaa2e6f3129e13",
+  "BitstreamVeraSansMono.tar.xz": "59162ab2d67d39827e497beda03fbe6327d3535d2ee3b1dd7050fdeafe1f9c36",
+  "CascadiaCode.tar.xz": "804b3d311665a059140466fe142cc76cf14ef0695b7c4d3a174f7f8fba46b6e3",
+  "CascadiaMono.tar.xz": "7c22db8c8460ef62abffbb6d5c7b212507de0798a4a762fa2a005a8bc4c90fc6",
+  "CodeNewRoman.tar.xz": "2db8def7863ea49b6ef69f353988d7e0f73a8646722e5946932740d76eb46b25",
+  "ComicShannsMono.tar.xz": "23d90d18dae663b7d0dcdb4edd2f5087eecb40b00f046a1f46a9abf3ecb47651",
+  "CommitMono.tar.xz": "44cdabae7708de3548fdd78ed59cdbb1fedbca18e16644047ed4a23623a530ca",
+  "Cousine.tar.xz": "63bc50fc2b88897096626cf9e835d4237ee0052f9bfd902dc1f5304c693c32e6",
+  "D2Coding.tar.xz": "5b4e8c53599ee79067a4439bfbf31bb3f1b40e93ac6493f718b48feaf972173d",
+  "DaddyTimeMono.tar.xz": "854c8cbf59e1fcc48f114408d93f63cad70c6ba8eefad5bf3071bd9dd8ef48f8",
+  "DejaVuSansMono.tar.xz": "0e58ff9c1f9378922b7f324fdba953929d88d61b36aedd80ee43964567b226cc",
+  "DepartureMono.tar.xz": "f099f71bc240fb59ffeaba50d26206b32df7e54051e49d6837a1702e4d3b4f3f",
+  "DroidSansMono.tar.xz": "43ad0a4e238ad078300d0aa2ebca5f7aaf6ff2cdb25c5cfe8191b79aab7d0af2",
+  "EnvyCodeR.tar.xz": "b631d34ab3e3e26aba7169b382d573d82bc6647d3ddae67e9ce28481f64715e7",
+  "FantasqueSansMono.tar.xz": "462b5490475fb8560dded4eb6cdd9cfd0049b800acee329094def095557d0ffd",
+  "FiraCode.tar.xz": "d83fb093e0e05a531cd6f19886a6ceb884a4fa5ea3b53cf099fc1f30c5b3e47d",
+  "FiraMono.tar.xz": "2e4adc97fefdfa2ad70a6e6e79bc0418acd401a305bcb5fcd848a84e03e35a74",
+  "GeistMono.tar.xz": "43ef3d73cadddea5be746e20c9f27fbaa59ceb106b8b26f7245ba2de2e46b1f6",
+  "Go-Mono.tar.xz": "81c879e6a86dd6e6cb94d7a73322bf39f06b3294a727effb5a5bb5c7f9274fd6",
+  "Gohu.tar.xz": "458b08f1216c18a46fc3e00701d6d171a4d536192b0885c041d8cc1befb6b44d",
+  "Hack.tar.xz": "1d00a1435638084174516975840854368a45ac30bb0bad2c0c49db713b5925f0",
+  "Hasklig.tar.xz": "e82418895a7036158baf9a425faea7de1fe332267b218341eec44c6b5071d1ad",
+  "HeavyData.tar.xz": "ed0d49911ae0caa1d625ae64832b49b4c94e90fa2ec0b1e5e7df440ccb28698b",
+  "Hermit.tar.xz": "206ae23c386dcb84a2dfaca678af36123fbaff1fb402326021973485018467f3",
+  "IBMPlexMono.tar.xz": "95e6ecaa5dfb9a96f27a6b6edc7be396fb6df30bc311a6f7e15cad56a30051c2",
+  "Inconsolata.tar.xz": "47df94d3826a9f3e94b4c596a78f5baaddfb27f25bdb7906c5cf65caf8962eb2",
+  "InconsolataGo.tar.xz": "0407ab5ddd9f6a9af5f178d5fa1732cbf8275c4fe6e03793adbe48bfd6c04884",
+  "InconsolataLGC.tar.xz": "59b5961b83f0fd64ef579099ca0209dd706d5025feac813c80fcc2d0648d717f",
+  "IntelOneMono.tar.xz": "9d55174210a512c6c9d0601532033d05d9e8817c760cb9ccca3c6c9c4ff6d7c1",
+  "Iosevka.tar.xz": "213ee24cda99ca84d0a8326de133e7e8b2baf9ba23659ce829f589f771d357d2",
+  "IosevkaTerm.tar.xz": "cad9da572d25e3413f7a15a319d2f3c9e7e915ee016baa99e0d88fc08cf5b781",
+  "IosevkaTermSlab.tar.xz": "8990ca82b481a02734cb96f46db789716735ca8f6c4bf89d800899a593a1f0ca",
+  "JetBrainsMono.tar.xz": "ef552a3e638f25125c6ad4c51176a6adcdce295ab1d2ffacf0db060caf8c1582",
+  "Lekton.tar.xz": "2a7fa12bf2b376307c9ca2501227b0d91dcae25c453ec095e5f768a2ca5b6fe9",
+  "LiberationMono.tar.xz": "64a9519dd6b75179a9363f9c8a0cefe2984ec8578394ced66e9d0fffd2be922f",
+  "Lilex.tar.xz": "1d011e82a59aec26bff5564ca90a8e51636364e5b7f79417708aa2c846c633b3",
+  "MPlus.tar.xz": "9c03e388d0ff2e0bc28be9bf6ab95f1e0260c5828b3159b18867a9e7a1f17f7b",
+  "MartianMono.tar.xz": "e12f5ca02756268e794d06d9cb2ada93d021ec915f5a43ec2cd77355022f3624",
+  "Meslo.tar.xz": "a57936d96aefb5cfff0660f3294210ee04705529af6cf811e2274b0923a03939",
+  "Monaspace.tar.xz": "5fdb97828e1a23fd28ea5ed0e7d15cdebb77ef079aaa48b93f1526764b40ef8c",
+  "Monofur.tar.xz": "539dc64f089b189c5f14ee60df6368742cc63ccc3be753bd3c8bfba7632fe068",
+  "Monoid.tar.xz": "5c6efd6fe2f2856d5294748dc751770d1c8889665f42687a0ac8f1b3a86a3299",
+  "Mononoki.tar.xz": "5c9b3035d45aabfe1fb3ce5e3028130043398cecc1409b20fe8273692192726e",
+  "NerdFontsSymbolsOnly.tar.xz": "7f8c090da3b0eaa7108646bf34cbbb6ed13d5358a72460522108b06c7ecd716a",
+  "Noto.tar.xz": "e28b31609d17fc50bdf9e6730c947a61b0e474af726c2c044c39bc78fcd9bfde",
+  "OpenDyslexic.tar.xz": "2155e95e9c7b12d785dc589033290a8caff07c11cf1697ec3ad0bda37e3b0433",
+  "Overpass.tar.xz": "4d6d7e8b91840bb2b18bc7ac427f979183e68b6b061db58b4139ad5679bdc36f",
+  "ProFont.tar.xz": "c6d595ac9f7e0d6ac87c4c57e26c7515c544e8e5ac553c5a215394d12b201a8f",
+  "ProggyClean.tar.xz": "910c51cb06ff3233daee1d045e606ed77c290ea25dd1a54378e0517601f4785c",
+  "Recursive.tar.xz": "a047ac2e724c1614ef4350af83f35cd1d044d8d20e6477c319172b860b19329a",
+  "RobotoMono.tar.xz": "4bc63bf0105c664e466e62cb2fd1c143b310877de93dc35b3b5d48e0e4cb6702",
+  "ShareTechMono.tar.xz": "11bb01a73894f932a3702551245aa0c57d121ebf59dd293fac5ceac81af822d1",
+  "SourceCodePro.tar.xz": "d52d97b66c4c5d6d9d99c88df55148faf39738f244485026f22f8e47407744f4",
+  "SpaceMono.tar.xz": "d159c6f13291723f1821d1064a7d3e0933d96297d55bab27d76861472af68111",
+  "Terminus.tar.xz": "e857b18a99701528f873275b6012792caf6e30c34c512ee92cda51520140054f",
+  "Tinos.tar.xz": "c54f03f38fbf897f34235bc5989500361251f61220cf63afedd730edd221714e",
+  "Ubuntu.tar.xz": "534bf0ffb311a993fd23666a7f3e4f4a0cfc0662abfa8b81594705cceefb69e3",
+  "UbuntuMono.tar.xz": "a13cf890ef10517c59e812ced167245f2db47d37d2b03c9fb43ddef023a3e776",
+  "UbuntuSans.tar.xz": "0a399b03565c577ae2da9f8362e6276b0adb13bac288e49fec085c517243e27b",
+  "VictorMono.tar.xz": "67bb8c729aedbe2e0258435c78e52bb1753618a1d3d7c0c94e6f1c47763a56a9",
+  "ZedMono.tar.xz": "7dfff6bb0e45143c33703c3fdf3ff77b00f3617fef29671c7ff6af166dcf31a0",
+  "iA-Writer.tar.xz": "0156f309d942d9066a83005dd42588719a1755fb78e345e5f22ff582da46211b"
 }

pkgs/data/fonts/nerd-fonts/manifests/fonts.json

···
     "folderName": "0xProto",
     "licenseId": "OFL-1.1-no-RFN",
     "patchedName": "0xProto",
-    "version": "2.201"
+    "version": "2.300"
   },
   {
     "caskName": "3270",
···
     "licenseId": "BSD-3-Clause",
     "patchedName": "3270",
     "version": "3.0.1"
+  },
+  {
+    "caskName": "adwaita-mono",
+    "description": "The monospace typeface for GNOME",
+    "folderName": "AdwaitaMono",
+    "licenseId": "OFL-1.1-no-RFN",
+    "patchedName": "AdwaitaMono",
+    "version": "32.4"
   },
   {
     "caskName": "agave",
···
     "version": "1.33"
   },
   {
+    "caskName": "atkynson-mono",
+    "description": "A monospaced font designed to improve legibility and readability for individuals with low vision",
+    "folderName": "AtkinsonHyperlegibleMono",
+    "licenseId": "OFL-1.1-RFN",
+    "patchedName": "AtkynsonMono",
+    "version": "2.001"
+  },
+  {
     "caskName": "aurulent-sans-mono",
     "description": "Sans serif, designed by Stephen G. Hartke which also created Verily Serif",
     "folderName": "AurulentSansMono",
···
     "folderName": "CascadiaCode",
     "licenseId": "OFL-1.1-RFN",
     "patchedName": "CaskaydiaCove",
-    "version": "2111.01"
+    "version": "2407.24"
   },
   {
     "caskName": "caskaydia-mono",
···
     "folderName": "CascadiaMono",
     "licenseId": "OFL-1.1-RFN",
     "patchedName": "CaskaydiaMono",
-    "version": "2111.01"
+    "version": "2407.24"
   },
   {
     "caskName": "code-new-roman",
···
     "licenseId": "OFL-1.1-no-RFN",
     "patchedName": "DaddyTimeMono",
     "version": "1.2.3"
-  },
-  {
-    "caskName": "departure-mono",
-    "description": "A monospaced pixel font with a lo-fi, techy vibe",
-    "folderName": "DepartureMono",
-    "licenseId": "OFL-1.1-no-RFN",
-    "patchedName": "DepartureMono",
-    "version": "1.422"
   },
   {
     "caskName": "dejavu-sans-mono",
···
     "version": "2.37"
   },
   {
+    "caskName": "departure-mono",
+    "description": "A monospaced pixel font with a lo-fi, techy vibe",
+    "folderName": "DepartureMono",
+    "licenseId": "OFL-1.1-no-RFN",
+    "patchedName": "DepartureMono",
+    "version": "1.422"
+  },
+  {
     "caskName": "droid-sans-mono",
     "description": "Good for small screens or font sizes",
     "folderName": "DroidSansMono",
···
     "folderName": "GeistMono",
     "licenseId": "OFL-1.1-no-RFN",
     "patchedName": "GeistMono",
-    "version": "1.2.0 (1.3.0)"
+    "version": "1.401"
   },
   {
     "caskName": "go-mono",
···
     "folderName": "InconsolataLGC",
     "licenseId": "OFL-1.1-no-RFN",
     "patchedName": "Inconsolata LGC",
-    "version": "1.5.2"
+    "version": "1.13"
   },
   {
     "caskName": "intone-mono",
···
     "folderName": "Iosevka",
     "licenseId": "OFL-1.1-no-RFN",
     "patchedName": "Iosevka",
-    "version": "29.0.4"
+    "version": "33.2.1"
   },
   {
     "caskName": "iosevka-term",
···
     "folderName": "IosevkaTerm",
     "licenseId": "OFL-1.1-no-RFN",
     "patchedName": "IosevkaTerm",
-    "version": "29.0.4"
+    "version": "33.2.1"
   },
   {
     "caskName": "iosevka-term-slab",
···
     "folderName": "IosevkaTermSlab",
     "licenseId": "OFL-1.1-no-RFN",
     "patchedName": "IosevkaTermSlab",
-    "version": "29.0.4"
+    "version": "33.2.1"
   },
   {
     "caskName": "jetbrains-mono",
···
     "folderName": "Lilex",
     "licenseId": "OFL-1.1-no-RFN",
     "patchedName": "Lilex",
-    "version": "2.400"
+    "version": "2.600"
   },
   {
     "caskName": "martian-mono",
···
     "folderName": "MartianMono",
     "licenseId": "OFL-1.1-no-RFN",
     "patchedName": "MartianMono",
-    "version": "1.0.0"
+    "version": "1.1.0"
   },
   {
     "caskName": "meslo-lg",
···
     "folderName": "Monaspace",
     "licenseId": "OFL-1.1-RFN",
     "patchedName": "Monaspice",
-    "version": "1.101"
+    "version": "1.200"
   },
   {
     "caskName": "monofur",
···
     "version": "1.6"
   },
   {
-    "caskName": "mplus",
+    "caskName": "m+",
     "description": "Multiple styles and weights, many glyph sets (e.g. Kana glyphs)",
     "folderName": "MPlus",
     "licenseId": "OFL-1.1-no-RFN",
     "patchedName": "M+",
-    "version": "2023/09"
+    "version": "1.007"
   },
   {
     "caskName": "noto",
···
     "folderName": "UbuntuSans",
     "licenseId": "LicenseRef-UbuntuFont",
     "patchedName": "UbuntuSans",
-    "version": "1.004"
+    "version": "1.006"
   },
   {
     "caskName": "victor-mono",

pkgs/data/fonts/nerd-fonts/manifests/release.json

···
 {
-  "tag_name": "v3.3.0"
+  "tag_name": "v3.4.0"
 }

pkgs/development/compilers/osl/default.nix

···
   libxml2,
   zlib,
   openexr,
-  openimageio,
+  openimageio_2,
   llvm,
   boost,
   flex,
···
 }:
 
 let
-
   boost_static = boost.override { enableStatic = true; };
-
 in
 stdenv.mkDerivation rec {
   pname = "openshadinglanguage";
···
       libclang
       llvm
       openexr
-      openimageio
+      openimageio_2
       partio
       pugixml
       python3.pkgs.pybind11

pkgs/development/interpreters/emilua/default.nix

···
   stdenv,
   meson,
   ninja,
-  fetchFromGitHub,
   fetchFromGitLab,
   re2c,
   gperf,
···
   emilua, # this package
 }:
 
-let
-  trial-protocol-wrap = fetchFromGitHub {
-    owner = "breese";
-    repo = "trial.protocol";
-    rev = "79149f604a49b8dfec57857ca28aaf508069b669";
-    sparseCheckout = [
-      "include"
-    ];
-    hash = "sha256-QpQ70KDcJyR67PtOowAF6w48GitMJ700B8HiEwDA5sU=";
-    postFetch = ''
-      rm $out/*.*
-      mkdir -p $out/lib/pkgconfig
-      cat > $out/lib/pkgconfig/trial-protocol.pc << EOF
-        Name: trial.protocol
-        Version: 0-unstable-2023-02-10
-        Description:  C++ header-only library with parsers and generators for network wire protocols
-        Requires:
-        Libs:
-        Cflags:
-      EOF
-    '';
-  };
-in
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "emilua";
-  version = "0.11.4";
+  version = "0.11.6";
 
   src = fetchFromGitLab {
     owner = "emilua";
     repo = "emilua";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CVEBFySsGT0f16Dim1Pw1GdDM0fWUKieRZyxHaDH3O4=";
+    hash = "sha256-r/WfRAr8AgnZGHxzcZVLg5MHDwcOTMWqOv/Qu/75Y1c=";
   };
 
   propagatedBuildInputs = [
···
     liburing
     openssl
     cereal
-    trial-protocol-wrap
   ];
 
   nativeBuildInputs = [

pkgs/development/libraries/embree/2.x.nix

···
   ispc,
   tbb,
   glfw,
-  openimageio,
+  openimageio_2,
   libjpeg,
   libpng,
   libpthreadstubs,
···
     ispc
     tbb
     glfw
-    openimageio
+    openimageio_2
     libjpeg
     libpng
     libX11

pkgs/development/libraries/embree/default.nix

···
   ispc,
   tbb,
   glfw,
-  openimageio,
+  openimageio_2,
   libjpeg,
   libpng,
   libpthreadstubs,
···
   buildInputs = [
     tbb
     glfw
-    openimageio
+    openimageio_2
     libjpeg
     libpng
     libX11

pkgs/development/libraries/ffmpeg/generic.nix

···
           hash = "sha256-sqUUSOPTPLwu2h8GbAw4SfEf+0oWioz52BcpW1n4v3Y=";
         })
       ]
+      ++ optionals (lib.versionOlder version "7" && stdenv.hostPlatform.isAarch32) [
+        (fetchpatch2 {
+          name = "binutils-2-43-compat.patch";
+          url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/654bd47716c4f36719fb0f3f7fd8386d5ed0b916";
+          hash = "sha256-OLiQHKBNp2p63ZmzBBI4GEGz3WSSP+rMd8ITfZSVRgY=";
+        })
+      ]
       ++ optionals (lib.versionAtLeast version "7.1" && lib.versionOlder version "7.1.1") [
         ./fix-fate-ffmpeg-spec-disposition-7.1.patch
       ]

pkgs/development/libraries/openimageio/default.nix pkgs/by-name/op/openimageio/package.nix

···
   fmt,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "openimageio";
-  version = "2.5.16.0";
+  version = "3.0.5.0";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "OpenImageIO";
-    rev = "v${version}";
-    hash = "sha256-hUCwlzQW5mJH5HYPbLWOcupc36nxM12CV0sakZhiGzo=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-CG2tb6jf7xmQnrLaTqEFKG3g4nkEwZoI44bXxdCRmrM=";
   };
-
-  # Workaround broken zlib version detection in CMake < 3.37.
-  postPatch = ''
-    substituteInPlace ./src/cmake/Config.cmake.in \
-      --replace " @ZLIB_VERSION@" ""
-  '';
 
   outputs = [
     "bin"
···
       --replace "\''${_IMPORT_PREFIX}/lib/lib" "$out/lib/lib"
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://openimageio.org";
     description = "Library and tools for reading and writing images";
-    license = licenses.bsd3;
-    maintainers = [ ];
-    platforms = platforms.unix;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ yzx9 ];
+    platforms = lib.platforms.unix;
   };
-}
+})

pkgs/development/python-modules/docling-ibm-models/default.nix

···
 
 buildPythonPackage rec {
   pname = "docling-ibm-models";
-  version = "3.4.1";
+  version = "3.4.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "docling-project";
     repo = "docling-ibm-models";
     tag = "v${version}";
-    hash = "sha256-IgKP+4en0N6xLBjzwmddDk8z5P3J1vo+UMW+65a01Ww=";
+    hash = "sha256-C3SRz4z5m/UjK+ZmpM94jLRr2xTwql7CdhFTj3HEOc0=";
   };
 
   build-system = [

pkgs/development/python-modules/materialx/default.nix

···
   libX11,
   libXt,
   libGL,
-  openimageio,
+  openimageio_2,
   imath,
   python,
   apple-sdk_14,
···
 
   buildInputs =
     [
-      openimageio
+      openimageio_2
       imath
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [

pkgs/development/python-modules/openusd/default.nix

···
   ninja,
   numpy,
   opencolorio,
-  openimageio,
+  openimageio_2,
   opensubdiv,
   osl,
   ptex,
···
       imath
       materialx
       opencolorio
-      openimageio
+      openimageio_2
       opensubdiv
       ptex
       tbb

pkgs/development/python-modules/pygame-ce/default.nix

···
     # No audio or video device in test environment
     export SDL_VIDEODRIVER=dummy
     export SDL_AUDIODRIVER=disk
+    # traceback for segfaults
+    export PYTHONFAULTHANDLER=1
   '';
 
   checkPhase = ''
···
     license = lib.licenses.lgpl21Plus;
     maintainers = [ lib.maintainers.pbsds ];
     platforms = lib.platforms.unix;
-    badPlatforms = [
-      # loading pygame.tests.font_test
-      # /nix/store/mrvg4qq09d51w5s95v15y4ym05q009fd-stdenv-darwin/setup: line 1771: 64131 Segmentation fault: 11
-      #
-      # https://github.com/NixOS/nixpkgs/issues/400378
-      lib.systems.inspect.patterns.isDarwin
-    ];
   };
 }

pkgs/development/python-modules/pygame/default.nix

···
   libpng,
   libX11,
   portmidi,
-  SDL2_image,
-  SDL2_mixer,
-  SDL2_ttf,
+  SDL2_classic_image,
+  SDL2_classic_mixer,
+  SDL2_classic_ttf,
 }:
 
 buildPythonPackage rec {
···
     libX11
     portmidi
     SDL2_classic
-    (SDL2_image.override { enableSTB = false; })
-    SDL2_mixer
-    SDL2_ttf
+    (SDL2_classic_image.override { enableSTB = false; })
+    SDL2_classic_mixer
+    SDL2_classic_ttf
   ];
 
   preConfigure = ''
···
     # No audio or video device in test environment
     export SDL_VIDEODRIVER=dummy
     export SDL_AUDIODRIVER=disk
+    # traceback for segfaults
+    export PYTHONFAULTHANDLER=1
 
     ${python.interpreter} -m pygame.tests -v \
       --exclude opengl,timing \
···
     license = lib.licenses.lgpl21Plus;
     maintainers = with lib.maintainers; [ emilytrau ];
     platforms = lib.platforms.unix;
-    badPlatforms = [
-      # Several tests segfault
-      # https://github.com/pygame/pygame/issues/4486
-      lib.systems.inspect.patterns.isDarwin
-    ];
   };
 }

pkgs/development/python-modules/pylance/default.nix

···
 
 buildPythonPackage rec {
   pname = "pylance";
-  version = "0.25.2";
+  version = "0.26.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lancedb";
     repo = "lance";
     tag = "v${version}";
-    hash = "sha256-Xds+qSVB7X4CrtrOrfIdOSfgn22CnUyCfKZh2e0hzRo=";
+    hash = "sha256-TMaDLlu6JtYlFyfh9zeHRg1ky4HKlKTr9kRPT9kxTcU=";
   };
 
   sourceRoot = "${src.name}/python";
···
       src
       sourceRoot
       ;
-    hash = "sha256-c+uQQmB6KScB5sS+HW1TMAwNsze7Ssog2bf0kQWQUWA=";
+    hash = "sha256-43zFySOd3yGMQ06oqKXBGV1XE282D1cQEdGrijMS22o=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/pyvista/default.nix

···
   numpy,
   pillow,
   pooch,
-  pythonOlder,
+  pythonAtLeast,
   scooby,
   setuptools,
   typing-extensions,
···
 
 buildPythonPackage rec {
   pname = "pyvista";
-  version = "0.44.2";
+  version = "0.45.0";
   pyproject = true;
-
-  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "pyvista";
     repo = "pyvista";
     tag = "v${version}";
-    hash = "sha256-ZQfI0lmh/cwE224yk6a2G3gLUCsBjCQqPI1y4zYj0FI=";
+    hash = "sha256-ruhG9HsD1PzTs/S6IDtuqIxg7UBmn67Ne2Y/H8y/9Cs=";
   };
 
   build-system = [ setuptools ];
···
   pythonImportsCheck = [ "pyvista" ];
 
   meta = with lib; {
+    broken = pythonAtLeast "3.13"; # segfault
     description = "Easier Pythonic interface to VTK";
     homepage = "https://pyvista.org";
-    changelog = "https://github.com/pyvista/pyvista/releases/tag/v${version}";
+    changelog = "https://github.com/pyvista/pyvista/releases/tag/${src.tag}";
     license = licenses.mit;
     maintainers = with maintainers; [ wegank ];
   };

pkgs/development/python-modules/rq/default.nix

···
   ];
   versionCheckProgramArg = "--version";
 
-  preCheck = ''
-    export PATH=$out/bin:$PATH
-  '';
-
   __darwinAllowLocalNetworking = true;
 
   disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [

pkgs/stdenv/linux/bootstrap-files/loongarch64-unknown-linux-gnu.nix

···
+# Autogenerated by maintainers/scripts/bootstrap-files/refresh-tarballs.bash as:
+# $ ./refresh-tarballs.bash --targets=loongarch64-unknown-linux-gnu
+#
+# Metadata:
+# - nixpkgs revision: bdcacf48f3b064c93a9064d1d545f75c60ca6c77
+# - hydra build: https://hydra.nixos.org/job/nixpkgs/cross-trunk/bootstrapTools.loongarch64-unknown-linux-gnu.build/latest
+# - resolved hydra build: https://hydra.nixos.org/build/295459473
+# - instantiated derivation: /nix/store/q7r692xs6kpsyipmkfamhj36va79wa5r-stdenv-bootstrap-tools-loongarch64-unknown-linux-gnu.drv
+# - output directory: /nix/store/gvjaqdhmvsqn821iypwj0cb8xq8yiii6-stdenv-bootstrap-tools-loongarch64-unknown-linux-gnu
+# - build time: Wed, 23 Apr 2025 12:35:42 +0000
+{
+  bootstrapTools = import <nix/fetchurl.nix> {
+    url = "http://tarballs.nixos.org/stdenv/loongarch64-unknown-linux-gnu/bdcacf48f3b064c93a9064d1d545f75c60ca6c77/bootstrap-tools.tar.xz";
+    hash = "sha256-Yx0YmbVElsbN0VKgPiKfm7+e3ed5JXu3vZv0kKIhER8=";
+  };
+  busybox = import <nix/fetchurl.nix> {
+    url = "http://tarballs.nixos.org/stdenv/loongarch64-unknown-linux-gnu/bdcacf48f3b064c93a9064d1d545f75c60ca6c77/busybox";
+    hash = "sha256-0UFp0zpeC8oTmS5/XJoMFnnOMTVTciQYmO/0JAi6uqk=";
+    executable = true;
+  };
+}

pkgs/stdenv/linux/default.nix

···
           powerpc64le-linux = import ./bootstrap-files/powerpc64le-unknown-linux-gnu.nix;
           riscv64-linux = import ./bootstrap-files/riscv64-unknown-linux-gnu.nix;
           s390x-linux = import ./bootstrap-files/s390x-unknown-linux-gnu.nix;
+          loongarch64-linux = import ./bootstrap-files/loongarch64-unknown-linux-gnu.nix;
         };
         musl = {
           aarch64-linux = import ./bootstrap-files/aarch64-unknown-linux-musl.nix;

pkgs/tools/package-management/nix/default.nix

···
         version = "2.28.2";
         hash = "sha256-yl+hlZ/VFHIZwPIDEs4ysOYgprW4VEORfSyvScF7Cwg=";
         self_attribute_name = "nix_2_28";
+        patches = [
+          # fixes user/system registries regression: https://github.com/NixOS/nix/issues/13050
+          ./patches/0001-Revert-Actually-ignore-system-user-registries-during.patch
+        ];
       };
 
       nixComponents_git = nixDependencies.callPackage ./modular/packages.nix rec {

pkgs/tools/package-management/nix/patches/0001-Revert-Actually-ignore-system-user-registries-during.patch

···
+From 8df4f5db3c71046f5deaeb913e5ec0d16f70b5a2 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <[e-mail]>
+Date: Thu, 24 Apr 2025 14:17:18 +0200
+Subject: [PATCH] Revert "Actually ignore system/user registries during
+ locking"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This reverts commit a08477975d90dc0d2c9f89d2a417bedb5b266931.
+
+Signed-off-by: Jörg Thalheim <[e-mail]>
+---
+ src/libflake/flake/flakeref.cc    | 2 +-
+ tests/functional/flakes/flakes.sh | 7 -------
+ 2 files changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/src/libflake/flake/flakeref.cc b/src/libflake/flake/flakeref.cc
+index 1580c2846..6e95eb767 100644
+--- a/src/libflake/flake/flakeref.cc
++++ b/src/libflake/flake/flakeref.cc
+@@ -39,7 +39,7 @@ FlakeRef FlakeRef::resolve(
+     ref<Store> store,
+     const fetchers::RegistryFilter & filter) const
+ {
+-    auto [input2, extraAttrs] = lookupInRegistries(store, input, filter);
++    auto [input2, extraAttrs] = lookupInRegistries(store, input);
+     return FlakeRef(std::move(input2), fetchers::maybeGetStrAttr(extraAttrs, "dir").value_or(subdir));
+ }
+ 
+diff --git a/tests/functional/flakes/flakes.sh b/tests/functional/flakes/flakes.sh
+index b67a0964a..d8c9f254d 100755
+--- a/tests/functional/flakes/flakes.sh
++++ b/tests/functional/flakes/flakes.sh
+@@ -220,13 +220,6 @@ nix store gc
+ nix registry list --flake-registry "file://$registry" --refresh | grepQuiet flake3
+ mv "$registry.tmp" "$registry"
+ 
+-# Ensure that locking ignores the user registry.
+-mkdir -p "$TEST_HOME/.config/nix"
+-ln -sfn "$registry" "$TEST_HOME/.config/nix/registry.json"
+-nix flake metadata flake1
+-expectStderr 1 nix flake update --flake-registry '' --flake "$flake3Dir" | grepQuiet "cannot find flake 'flake:flake1' in the flake registries"
+-rm "$TEST_HOME/.config/nix/registry.json"
+-
+ # Test whether flakes are registered as GC roots for offline use.
+ # FIXME: use tarballs rather than git.
+ rm -rf "$TEST_HOME/.cache"
+-- 
+2.49.0
+

pkgs/tools/security/ghidra/build.nix

···
   pname = "ghidra";
   version = "11.3.2";
 
+  isMacArm64 = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64;
+
   releaseName = "NIX";
   distroPrefix = "ghidra_${version}_${releaseName}";
   src = fetchFromGitHub {
···
     data = ./deps.json;
   };
 
-  gradleFlags = [ "-Dorg.gradle.java.home=${openjdk21}" ];
+  gradleFlags =
+    [ "-Dorg.gradle.java.home=${openjdk21}" ]
+    ++ lib.optionals isMacArm64 [
+      # For some reason I haven't been able to figure out yet, ghidra builds for
+      # arm64 seems to build the x64 binaries of the decompiler. These fail to
+      # build due to trying to link the x64 object files with arm64 stdc++
+      # library, which obviously fails.
+      #
+      # Those binaries are entirely unnecessary anyways, since we're targeting
+      # arm64 build here, so let's exclude them from the build.
+      "-x"
+      "Decompiler:linkSleighMac_x86_64Executable"
+      "-x"
+      "Decompiler:linkDecompileMac_x86_64Executable"
+    ];
 
   preBuild = ''
     export JAVA_TOOL_OPTIONS="-Duser.home=$NIX_BUILD_TOP/home"

pkgs/top-level/all-packages.nix

···
     inherit (darwin) DarwinTools;
   };
 
-  openimageio = callPackage ../development/libraries/openimageio { };
+  openimageio_2 = callPackage ../by-name/op/openimageio/2.nix { };
 
   open-music-kontrollers = lib.recurseIntoAttrs {
     eteroj = callPackage ../applications/audio/open-music-kontrollers/eteroj.nix { };