Merge staging-next into staging

lib/systems/architectures.nix

···
   };
 
   # a superior CPU has all the features of an inferior and is able to build and test code for it
-  inferiors = {
-    # x86_64 Generic
-    default = [ ];
-    x86-64 = [ ];
-    x86-64-v2 = [ "x86-64" ];
-    x86-64-v3 = [ "x86-64-v2" ] ++ inferiors.x86-64-v2;
-    x86-64-v4 = [ "x86-64-v3" ] ++ inferiors.x86-64-v3;
+  inferiors =
+    let
+      withInferiors = archs: lib.unique (archs ++ lib.flatten (lib.attrVals archs inferiors));
+    in
+    {
+      # x86_64 Generic
+      default = [ ];
+      x86-64 = [ ];
+      x86-64-v2 = [ "x86-64" ];
+      x86-64-v3 = [ "x86-64-v2" ] ++ inferiors.x86-64-v2;
+      x86-64-v4 = [ "x86-64-v3" ] ++ inferiors.x86-64-v3;
 
-    # x86_64 Intel
-    # https://gcc.gnu.org/onlinedocs/gcc/x86-Options.html
-    nehalem = [ "x86-64-v2" ] ++ inferiors.x86-64-v2;
-    westmere = [ "nehalem" ] ++ inferiors.nehalem;
-    sandybridge = [ "westmere" ] ++ inferiors.westmere;
-    ivybridge = [ "sandybridge" ] ++ inferiors.sandybridge;
+      # x86_64 Intel
+      # https://gcc.gnu.org/onlinedocs/gcc/x86-Options.html
+      nehalem = [ "x86-64-v2" ] ++ inferiors.x86-64-v2;
+      westmere = [ "nehalem" ] ++ inferiors.nehalem;
+      sandybridge = [ "westmere" ] ++ inferiors.westmere;
+      ivybridge = [ "sandybridge" ] ++ inferiors.sandybridge;
+
+      haswell = lib.unique (
+        [
+          "ivybridge"
+          "x86-64-v3"
+        ]
+        ++ inferiors.ivybridge
+        ++ inferiors.x86-64-v3
+      );
+      broadwell = [ "haswell" ] ++ inferiors.haswell;
+      skylake = [ "broadwell" ] ++ inferiors.broadwell;
+
+      skylake-avx512 = lib.unique (
+        [
+          "skylake"
+          "x86-64-v4"
+        ]
+        ++ inferiors.skylake
+        ++ inferiors.x86-64-v4
+      );
+      cannonlake = [ "skylake-avx512" ] ++ inferiors.skylake-avx512;
+      icelake-client = [ "cannonlake" ] ++ inferiors.cannonlake;
+      icelake-server = [ "icelake-client" ] ++ inferiors.icelake-client;
+      cascadelake = [ "cannonlake" ] ++ inferiors.cannonlake;
+      cooperlake = [ "cascadelake" ] ++ inferiors.cascadelake;
+      tigerlake = [ "icelake-server" ] ++ inferiors.icelake-server;
+      sapphirerapids = [ "tigerlake" ] ++ inferiors.tigerlake;
+      emeraldrapids = [ "sapphirerapids" ] ++ inferiors.sapphirerapids;
+
+      alderlake = [ "skylake" ] ++ inferiors.skylake;
+      sierraforest = [ "alderlake" ] ++ inferiors.alderlake;
 
-    haswell = lib.unique (
-      [
-        "ivybridge"
-        "x86-64-v3"
-      ]
-      ++ inferiors.ivybridge
-      ++ inferiors.x86-64-v3
-    );
-    broadwell = [ "haswell" ] ++ inferiors.haswell;
-    skylake = [ "broadwell" ] ++ inferiors.broadwell;
+      # x86_64 AMD
+      # TODO: fill in specific CPU architecture inferiors
+      btver1 = [ "x86-64" ];
+      btver2 = [ "x86-64-v2" ] ++ inferiors.x86-64-v2;
+      bdver1 = [ "x86-64-v2" ] ++ inferiors.x86-64-v2;
+      bdver2 = [ "x86-64-v2" ] ++ inferiors.x86-64-v2;
+      bdver3 = [ "x86-64-v2" ] ++ inferiors.x86-64-v2;
+      bdver4 = [ "x86-64-v3" ] ++ inferiors.x86-64-v3;
+      # Regarding `skylake` as inferior of `znver1`, there are reports of
+      # successful usage by Gentoo users and Phoronix benchmarking of different
+      # `-march` targets.
+      #
+      # The GCC documentation on extensions used and wikichip documentation
+      # regarding supperted extensions on znver1 and skylake was used to create
+      # this partial order.
+      #
+      # Note:
+      #
+      # - The successors of `skylake` (`cannonlake`, `icelake`, etc) use `avx512`
+      #   which no current AMD Zen michroarch support.
+      # - `znver1` uses `ABM`, `CLZERO`, `CX16`, `MWAITX`, and `SSE4A` which no
+      #   current Intel microarch support.
+      #
+      # https://www.phoronix.com/scan.php?page=article&item=amd-znver3-gcc11&num=1
+      # https://gcc.gnu.org/onlinedocs/gcc/x86-Options.html
+      # https://en.wikichip.org/wiki/amd/microarchitectures/zen
+      # https://en.wikichip.org/wiki/intel/microarchitectures/skylake
+      znver1 = [ "skylake" ] ++ inferiors.skylake; # Includes haswell and x86-64-v3
+      znver2 = [ "znver1" ] ++ inferiors.znver1;
+      znver3 = [ "znver2" ] ++ inferiors.znver2;
+      znver4 = lib.unique (
+        [
+          "znver3"
+          "x86-64-v4"
+        ]
+        ++ inferiors.znver3
+        ++ inferiors.x86-64-v4
+      );
+      znver5 = [ "znver4" ] ++ inferiors.znver4;
 
-    skylake-avx512 = lib.unique (
-      [
-        "skylake"
-        "x86-64-v4"
-      ]
-      ++ inferiors.skylake
-      ++ inferiors.x86-64-v4
-    );
-    cannonlake = [ "skylake-avx512" ] ++ inferiors.skylake-avx512;
-    icelake-client = [ "cannonlake" ] ++ inferiors.cannonlake;
-    icelake-server = [ "icelake-client" ] ++ inferiors.icelake-client;
-    cascadelake = [ "cannonlake" ] ++ inferiors.cannonlake;
-    cooperlake = [ "cascadelake" ] ++ inferiors.cascadelake;
-    tigerlake = [ "icelake-server" ] ++ inferiors.icelake-server;
-    sapphirerapids = [ "tigerlake" ] ++ inferiors.tigerlake;
-    emeraldrapids = [ "sapphirerapids" ] ++ inferiors.sapphirerapids;
+      # ARM64 (AArch64)
+      armv8-a = [ ];
+      "armv8.1-a" = [ "armv8-a" ];
+      "armv8.2-a" = [ "armv8.1-a" ] ++ inferiors."armv8.1-a";
+      "armv8.3-a" = [ "armv8.2-a" ] ++ inferiors."armv8.2-a";
+      "armv8.4-a" = [ "armv8.3-a" ] ++ inferiors."armv8.3-a";
+      "armv8.5-a" = [ "armv8.4-a" ] ++ inferiors."armv8.4-a";
+      "armv8.6-a" = [ "armv8.5-a" ] ++ inferiors."armv8.5-a";
+      "armv8.7-a" = [ "armv8.6-a" ] ++ inferiors."armv8.6-a";
+      "armv8.8-a" = [ "armv8.7-a" ] ++ inferiors."armv8.7-a";
+      "armv8.9-a" = [ "armv8.8-a" ] ++ inferiors."armv8.8-a";
+      armv9-a = [ "armv8.5-a" ] ++ inferiors."armv8.5-a";
+      "armv9.1-a" = [
+        "armv9-a"
+        "armv8.6-a"
+      ] ++ inferiors."armv8.6-a";
+      "armv9.2-a" = lib.unique (
+        [
+          "armv9.1-a"
+          "armv8.7-a"
+        ]
+        ++ inferiors."armv9.1-a"
+        ++ inferiors."armv8.7-a"
+      );
+      "armv9.3-a" = lib.unique (
+        [
+          "armv9.2-a"
+          "armv8.8-a"
+        ]
+        ++ inferiors."armv9.2-a"
+        ++ inferiors."armv8.8-a"
+      );
+      "armv9.4-a" = [ "armv9.3-a" ] ++ inferiors."armv9.3-a";
 
-    # CX16 does not exist on alderlake, while it does on nearly all other intel CPUs
-    alderlake = [ ];
-    sierraforest = [ "alderlake" ] ++ inferiors.alderlake;
+      # ARM
+      cortex-a53 = [ "armv8-a" ];
+      cortex-a72 = [ "armv8-a" ];
+      cortex-a55 = [
+        "armv8.2-a"
+        "cortex-a53"
+        "cortex-a72"
+      ] ++ inferiors."armv8.2-a";
+      cortex-a76 = [
+        "armv8.2-a"
+        "cortex-a53"
+        "cortex-a72"
+      ] ++ inferiors."armv8.2-a";
 
-    # x86_64 AMD
-    # TODO: fill this (need testing)
-    btver1 = [ ];
-    btver2 = [ ];
-    bdver1 = [ ];
-    bdver2 = [ ];
-    bdver3 = [ ];
-    bdver4 = [ ];
-    # Regarding `skylake` as inferior of `znver1`, there are reports of
-    # successful usage by Gentoo users and Phoronix benchmarking of different
-    # `-march` targets.
-    #
-    # The GCC documentation on extensions used and wikichip documentation
-    # regarding supperted extensions on znver1 and skylake was used to create
-    # this partial order.
-    #
-    # Note:
-    #
-    # - The successors of `skylake` (`cannonlake`, `icelake`, etc) use `avx512`
-    #   which no current AMD Zen michroarch support.
-    # - `znver1` uses `ABM`, `CLZERO`, `CX16`, `MWAITX`, and `SSE4A` which no
-    #   current Intel microarch support.
-    #
-    # https://www.phoronix.com/scan.php?page=article&item=amd-znver3-gcc11&num=1
-    # https://gcc.gnu.org/onlinedocs/gcc/x86-Options.html
-    # https://en.wikichip.org/wiki/amd/microarchitectures/zen
-    # https://en.wikichip.org/wiki/intel/microarchitectures/skylake
-    znver1 = [ "skylake" ] ++ inferiors.skylake; # Includes haswell and x86-64-v3
-    znver2 = [ "znver1" ] ++ inferiors.znver1;
-    znver3 = [ "znver2" ] ++ inferiors.znver2;
-    znver4 = lib.unique (
-      [
-        "znver3"
-        "x86-64-v4"
-      ]
-      ++ inferiors.znver3
-      ++ inferiors.x86-64-v4
-    );
-    znver5 = [ "znver4" ] ++ inferiors.znver4;
+      # Ampere
+      ampere1 = withInferiors [
+        "armv8.6-a"
+        "cortex-a55"
+        "cortex-a76"
+      ];
+      ampere1a = [ "ampere1" ] ++ inferiors.ampere1;
+      ampere1b = [ "ampere1a" ] ++ inferiors.ampere1a;
 
-    # other
-    armv5te = [ ];
-    armv6 = [ ];
-    armv7-a = [ ];
-    armv8-a = [ ];
-    mips32 = [ ];
-    loongson2f = [ ];
-  };
+      # other
+      armv5te = [ ];
+      armv6 = [ ];
+      armv7-a = [ ];
+      mips32 = [ ];
+      loongson2f = [ ];
+    };
 
   predicates =
     let

nixos/doc/manual/release-notes/rl-2505.section.md

···
 
 - [nostr-rs-relay](https://git.sr.ht/~gheartsfield/nostr-rs-relay/), This is a nostr relay, written in Rust. Available as [services.nostr-rs-relay](options.html#opt-services.nostr-rs-relay.enable).
 
+- [haven](https://github.com/bitvora/haven), is a high availability vault for events on nostr. Available as [services.haven](options.html#opt-services.haven.enable).
+
 - [strfry](https://github.com/hoytech/strfry), a relay for the nostr protocol. Available as [services.strfry](options.html#opt-services.strfry.enable).
 
 - [Prometheus Node Cert Exporter](https://github.com/amimof/node-cert-exporter), a prometheus exporter to check for SSL cert expiry. Available under [services.prometheus.exporters.node-cert](#opt-services.prometheus.exporters.node-cert.enable).

nixos/modules/module-list.nix

···
   ./services/web-apps/guacamole-client.nix
   ./services/web-apps/guacamole-server.nix
   ./services/web-apps/hatsu.nix
+  ./services/web-apps/haven.nix
   ./services/web-apps/healthchecks.nix
   ./services/web-apps/hedgedoc.nix
   ./services/web-apps/hledger-web.nix

nixos/modules/services/security/paretosecurity.nix

···
 
   config = lib.mkIf config.services.paretosecurity.enable {
     environment.systemPackages = [ config.services.paretosecurity.package ];
+    systemd.packages = [ config.services.paretosecurity.package ];
 
-    systemd.sockets."paretosecurity" = {
-      wantedBy = [ "sockets.target" ];
-      socketConfig = {
-        ListenStream = "/var/run/paretosecurity.sock";
-        SocketMode = "0666";
+    # In traditional Linux distributions, systemd would read the [Install] section from
+    # unit files and automatically create the appropriate symlinks to enable services.
+    # However, in NixOS, due to its immutable nature and the way the Nix store works,
+    # the [Install] sections are not processed during system activation. Instead, we
+    # must explicitly tell NixOS which units to enable by specifying their target
+    # dependencies here. This creates the necessary symlinks in the proper locations.
+    systemd.sockets.paretosecurity.wantedBy = [ "sockets.target" ];
+
+    # Enable the tray icon and timer services if the trayIcon option is enabled
+    systemd.user = lib.mkIf config.services.paretosecurity.trayIcon {
+      services.paretosecurity-trayicon = {
+        wantedBy = [ "graphical-session.target" ];
       };
-    };
-
-    systemd.services."paretosecurity" = {
-      serviceConfig = {
-        ExecStart = "${config.services.paretosecurity.package}/bin/paretosecurity helper";
-        User = "root";
-        Group = "root";
-        StandardInput = "socket";
-        Type = "oneshot";
-        RemainAfterExit = "no";
-        StartLimitInterval = "1s";
-        StartLimitBurst = 100;
-        ProtectSystem = "full";
-        ProtectHome = true;
-        StandardOutput = "journal";
-        StandardError = "journal";
+      services.paretosecurity-user = {
+        wantedBy = [ "graphical-session.target" ];
       };
-    };
-
-    systemd.user.services."paretosecurity-trayicon" = lib.mkIf config.services.paretosecurity.trayIcon {
-      wantedBy = [ "graphical-session.target" ];
-      serviceConfig = {
-        ExecStart = "${config.services.paretosecurity.package}/bin/paretosecurity trayicon";
+      timers.paretosecurity-user = {
+        wantedBy = [ "timers.target" ];
       };
     };
-
   };
 }

nixos/modules/services/web-apps/haven.nix

···
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  # Load default values from package. See https://github.com/bitvora/haven/blob/master/.env.example
+  defaultSettings = builtins.fromTOML (builtins.readFile "${cfg.package}/share/haven/.env.example");
+
+  import_relays_file = "${pkgs.writeText "import_relays.json" (builtins.toJSON cfg.importRelays)}";
+  blastr_relays_file = "${pkgs.writeText "blastr_relays.json" (builtins.toJSON cfg.blastrRelays)}";
+
+  mergedSettings = cfg.settings // {
+    IMPORT_SEED_RELAYS_FILE = import_relays_file;
+    BLASTR_RELAYS_FILE = blastr_relays_file;
+  };
+
+  cfg = config.services.haven;
+in
+{
+  options.services.haven = {
+    enable = lib.mkEnableOption "haven";
+
+    package = lib.mkPackageOption pkgs "haven" { };
+
+    blastrRelays = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = "List of relay configurations for blastr";
+      example = lib.literalExpression ''
+        [
+          "relay.example.com"
+        ]
+      '';
+    };
+
+    importRelays = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = "List of relay configurations for importing historical events";
+      example = lib.literalExpression ''
+        [
+          "relay.example.com"
+        ]
+      '';
+    };
+
+    settings = lib.mkOption {
+      default = defaultSettings;
+      defaultText = "See https://github.com/bitvora/haven/blob/master/.env.example";
+      apply = lib.recursiveUpdate defaultSettings;
+      description = "See https://github.com/bitvora/haven for documentation.";
+      example = lib.literalExpression ''
+        {
+          RELAY_URL = "relay.example.com";
+          OWNER_NPUB = "npub1...";
+        }
+      '';
+    };
+
+    environmentFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = ''
+        Path to a file containing sensitive environment variables. See https://github.com/bitvora/haven for documentation.
+        The file should contain environment-variable assignments like:
+        S3_SECRET_KEY=mysecretkey
+        S3_ACCESS_KEY_ID=myaccesskey
+      '';
+      example = "/var/lib/haven/secrets.env";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.users.haven = {
+      description = "Haven daemon user";
+      group = "haven";
+      isSystemUser = true;
+    };
+
+    users.groups.haven = { };
+
+    systemd.services.haven = {
+      description = "haven";
+      wants = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      environment = lib.attrsets.mapAttrs (
+        name: value: if builtins.isBool value then if value then "true" else "false" else toString value
+      ) mergedSettings;
+
+      serviceConfig = {
+        ExecStart = "${cfg.package}/bin/haven";
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
+        User = "haven";
+        Group = "haven";
+        Restart = "on-failure";
+
+        RuntimeDirectory = "haven";
+        StateDirectory = "haven";
+        WorkingDirectory = "/var/lib/haven";
+
+        # Create symlink to templates in the working directory
+        ExecStartPre = "+${pkgs.coreutils}/bin/ln -sfT ${cfg.package}/share/haven/templates /var/lib/haven/templates";
+
+        PrivateTmp = true;
+        PrivateUsers = true;
+        PrivateDevices = true;
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        NoNewPrivileges = true;
+        MemoryDenyWriteExecute = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        ProtectClock = true;
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        ProtectControlGroups = true;
+        LockPersonality = true;
+        RestrictSUIDSGID = true;
+        RemoveIPC = true;
+        RestrictRealtime = true;
+        ProtectHostname = true;
+        CapabilityBoundingSet = "";
+        SystemCallFilter = [
+          "@system-service"
+        ];
+        SystemCallArchitectures = "native";
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [
+    felixzieger
+  ];
+}

nixos/modules/system/boot/systemd/tmpfiles.nix

···
       inherit elemType placeholder;
     };
 
+  escapeArgument = lib.strings.escapeC [
+    "\t"
+    "\n"
+    "\r"
+    " "
+    "\\"
+  ];
+
   settingsOption = {
     description = ''
       Declare systemd-tmpfiles rules to create, delete, and clean up volatile
···
 
   # generates a single entry for a tmpfiles.d rule
   settingsEntryToRule = path: entry: ''
-    '${entry.type}' '${path}' '${entry.mode}' '${entry.user}' '${entry.group}' '${entry.age}' ${entry.argument}
+    '${entry.type}' '${path}' '${entry.mode}' '${entry.user}' '${entry.group}' '${entry.age}' ${escapeArgument entry.argument}
   '';
 
   # generates a list of tmpfiles.d rules from the attrs (paths) under tmpfiles.settings.<name>
···
           "boot.initrd.systemd.storePaths will lead to errors in the future."
           "Found these problematic files: ${lib.concatStringsSep ", " paths}"
         ]
-      );
+      )
+      ++ (lib.flatten (
+        lib.mapAttrsToList (
+          name: paths:
+          lib.mapAttrsToList (
+            path: entries:
+            lib.mapAttrsToList (
+              type': entry:
+              lib.optional (lib.match ''.*\\([nrt]|x[0-9A-Fa-f]{2}).*'' entry.argument != null) (
+                lib.concatStringsSep " " [
+                  "The argument option of ${name}.${type'}.${path} appears to"
+                  "contain escape sequences, which will be escaped again."
+                  "Unescape them if this is not intended: \"${entry.argument}\""
+                ]
+              )
+            ) entries
+          ) paths
+        ) cfg.settings
+      ));
 
     systemd.additionalUpstreamSystemUnits = [
       "systemd-tmpfiles-clean.service"

nixos/tests/all-tests.nix

···
   buildbot = runTest ./buildbot.nix;
   buildkite-agents = handleTest ./buildkite-agents.nix { };
   c2fmzq = handleTest ./c2fmzq.nix { };
-  caddy = handleTest ./caddy.nix { };
+  caddy = runTest ./caddy.nix;
   cadvisor = handleTestOn [ "x86_64-linux" ] ./cadvisor.nix { };
   cage = handleTest ./cage.nix { };
   cagebreak = handleTest ./cagebreak.nix { };
···
   enlightenment = handleTest ./enlightenment.nix { };
   env = handleTest ./env.nix { };
   envfs = handleTest ./envfs.nix { };
-  envoy = handleTest ./envoy.nix { };
+  envoy = runTest {
+    imports = [ ./envoy.nix ];
+    _module.args.envoyPackage = pkgs.envoy;
+  };
+  envoy-bin = runTest {
+    imports = [ ./envoy.nix ];
+    _module.args.envoyPackage = pkgs.envoy-bin;
+  };
   ergo = handleTest ./ergo.nix { };
   ergochat = handleTest ./ergochat.nix { };
   eris-server = handleTest ./eris-server.nix { };

nixos/tests/caddy.nix

···
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "caddy";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        Br1ght0ne
-        stepbrobd
-      ];
-    };
+{ pkgs, ... }:
+{
+  name = "caddy";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      Br1ght0ne
+      stepbrobd
+    ];
+  };
+
+  nodes = {
+    webserver =
+      { pkgs, ... }:
+      {
+        services.caddy.enable = true;
+        services.caddy.extraConfig = ''
+          http://localhost {
+            encode gzip
+
+            file_server
+            root * ${
+              pkgs.runCommand "testdir" { } ''
+                mkdir "$out"
+                echo hello world > "$out/example.html"
+              ''
+            }
+          }
+        '';
+        services.caddy.enableReload = true;
 
-    nodes = {
-      webserver =
-        { pkgs, ... }:
-        {
-          services.caddy.enable = true;
+        specialisation.config-reload.configuration = {
           services.caddy.extraConfig = ''
-            http://localhost {
-              encode gzip
-
-              file_server
-              root * ${
-                pkgs.runCommand "testdir" { } ''
-                  mkdir "$out"
-                  echo hello world > "$out/example.html"
-                ''
-              }
+            http://localhost:8080 {
             }
           '';
-          services.caddy.enableReload = true;
-
-          specialisation.config-reload.configuration = {
-            services.caddy.extraConfig = ''
-              http://localhost:8080 {
-              }
-            '';
+        };
+        specialisation.multiple-configs.configuration = {
+          services.caddy.virtualHosts = {
+            "http://localhost:8080" = { };
+            "http://localhost:8081" = { };
           };
-          specialisation.multiple-configs.configuration = {
-            services.caddy.virtualHosts = {
-              "http://localhost:8080" = { };
-              "http://localhost:8081" = { };
-            };
+        };
+        specialisation.multiple-hostnames.configuration = {
+          services.caddy.virtualHosts = {
+            "http://localhost:8080 http://localhost:8081" = { };
           };
-          specialisation.multiple-hostnames.configuration = {
-            services.caddy.virtualHosts = {
-              "http://localhost:8080 http://localhost:8081" = { };
+        };
+        specialisation.rfc42.configuration = {
+          services.caddy.settings = {
+            apps.http.servers.default = {
+              listen = [ ":80" ];
+              routes = [
+                {
+                  handle = [
+                    {
+                      body = "hello world";
+                      handler = "static_response";
+                      status_code = 200;
+                    }
+                  ];
+                }
+              ];
             };
           };
-          specialisation.rfc42.configuration = {
-            services.caddy.settings = {
-              apps.http.servers.default = {
-                listen = [ ":80" ];
-                routes = [
-                  {
-                    handle = [
-                      {
-                        body = "hello world";
-                        handler = "static_response";
-                        status_code = 200;
-                      }
-                    ];
-                  }
-                ];
-              };
+        };
+        specialisation.explicit-config-file.configuration = {
+          services.caddy.configFile = pkgs.writeText "Caddyfile" ''
+            localhost:80
+
+            respond "hello world"
+          '';
+        };
+        specialisation.with-plugins.configuration = {
+          services.caddy = {
+            package = pkgs.caddy.withPlugins {
+              plugins = [ "github.com/caddyserver/replace-response@v0.0.0-20241211194404-3865845790a7" ];
+              hash = "sha256-WPmJPnyOrAnuJxvn3ywswqvLGV8SZzzn3gU1Tbtpao4=";
             };
-          };
-          specialisation.explicit-config-file.configuration = {
-            services.caddy.configFile = pkgs.writeText "Caddyfile" ''
-              localhost:80
+            configFile = pkgs.writeText "Caddyfile" ''
+              {
+                order replace after encode
+              }
 
-              respond "hello world"
+              localhost:80 {
+                respond "hello world"
+                replace world caddy
+              }
             '';
           };
-          specialisation.with-plugins.configuration = {
-            services.caddy = {
-              package = pkgs.caddy.withPlugins {
-                plugins = [ "github.com/caddyserver/replace-response@v0.0.0-20241211194404-3865845790a7" ];
-                hash = "sha256-WPmJPnyOrAnuJxvn3ywswqvLGV8SZzzn3gU1Tbtpao4=";
-              };
-              configFile = pkgs.writeText "Caddyfile" ''
-                {
-                  order replace after encode
-                }
-
-                localhost:80 {
-                  respond "hello world"
-                  replace world caddy
-                }
-              '';
-            };
-          };
         };
-    };
+      };
+  };
 
-    testScript =
-      { nodes, ... }:
-      let
-        explicitConfigFile = "${nodes.webserver.system.build.toplevel}/specialisation/explicit-config-file";
-        justReloadSystem = "${nodes.webserver.system.build.toplevel}/specialisation/config-reload";
-        multipleConfigs = "${nodes.webserver.system.build.toplevel}/specialisation/multiple-configs";
-        multipleHostnames = "${nodes.webserver.system.build.toplevel}/specialisation/multiple-hostnames";
-        rfc42Config = "${nodes.webserver.system.build.toplevel}/specialisation/rfc42";
-        withPluginsConfig = "${nodes.webserver.system.build.toplevel}/specialisation/with-plugins";
-      in
-      ''
-        url = "http://localhost/example.html"
-        webserver.wait_for_unit("caddy")
-        webserver.wait_for_open_port(80)
+  testScript =
+    { nodes, ... }:
+    let
+      explicitConfigFile = "${nodes.webserver.system.build.toplevel}/specialisation/explicit-config-file";
+      justReloadSystem = "${nodes.webserver.system.build.toplevel}/specialisation/config-reload";
+      multipleConfigs = "${nodes.webserver.system.build.toplevel}/specialisation/multiple-configs";
+      multipleHostnames = "${nodes.webserver.system.build.toplevel}/specialisation/multiple-hostnames";
+      rfc42Config = "${nodes.webserver.system.build.toplevel}/specialisation/rfc42";
+      withPluginsConfig = "${nodes.webserver.system.build.toplevel}/specialisation/with-plugins";
+    in
+    ''
+      url = "http://localhost/example.html"
+      webserver.wait_for_unit("caddy")
+      webserver.wait_for_open_port(80)
 
 
-        with subtest("config is reloaded on nixos-rebuild switch"):
-            webserver.succeed(
-                "${justReloadSystem}/bin/switch-to-configuration test >&2"
-            )
-            webserver.wait_for_open_port(8080)
-            webserver.fail("journalctl -u caddy | grep -q -i stopped")
-            webserver.succeed("journalctl -u caddy | grep -q -i reloaded")
+      with subtest("config is reloaded on nixos-rebuild switch"):
+          webserver.succeed(
+              "${justReloadSystem}/bin/switch-to-configuration test >&2"
+          )
+          webserver.wait_for_open_port(8080)
+          webserver.fail("journalctl -u caddy | grep -q -i stopped")
+          webserver.succeed("journalctl -u caddy | grep -q -i reloaded")
 
-        with subtest("multiple configs are correctly merged"):
-            webserver.succeed(
-                "${multipleConfigs}/bin/switch-to-configuration test >&2"
-            )
-            webserver.wait_for_open_port(8080)
-            webserver.wait_for_open_port(8081)
+      with subtest("multiple configs are correctly merged"):
+          webserver.succeed(
+              "${multipleConfigs}/bin/switch-to-configuration test >&2"
+          )
+          webserver.wait_for_open_port(8080)
+          webserver.wait_for_open_port(8081)
 
-        with subtest("a virtual host with multiple hostnames works"):
-            webserver.succeed(
-                "${multipleHostnames}/bin/switch-to-configuration test >&2"
-            )
-            webserver.wait_for_open_port(8080)
-            webserver.wait_for_open_port(8081)
+      with subtest("a virtual host with multiple hostnames works"):
+          webserver.succeed(
+              "${multipleHostnames}/bin/switch-to-configuration test >&2"
+          )
+          webserver.wait_for_open_port(8080)
+          webserver.wait_for_open_port(8081)
 
-        with subtest("rfc42 settings config"):
-            webserver.succeed(
-                "${rfc42Config}/bin/switch-to-configuration test >&2"
-            )
-            webserver.wait_for_open_port(80)
-            webserver.succeed("curl http://localhost | grep hello")
+      with subtest("rfc42 settings config"):
+          webserver.succeed(
+              "${rfc42Config}/bin/switch-to-configuration test >&2"
+          )
+          webserver.wait_for_open_port(80)
+          webserver.succeed("curl http://localhost | grep hello")
 
-        with subtest("explicit configFile"):
-            webserver.succeed(
-                "${explicitConfigFile}/bin/switch-to-configuration test >&2"
-            )
-            webserver.wait_for_open_port(80)
-            webserver.succeed("curl http://localhost | grep hello")
+      with subtest("explicit configFile"):
+          webserver.succeed(
+              "${explicitConfigFile}/bin/switch-to-configuration test >&2"
+          )
+          webserver.wait_for_open_port(80)
+          webserver.succeed("curl http://localhost | grep hello")
 
-        with subtest("plugins are correctled installed and configurable"):
-            webserver.succeed(
-                "${withPluginsConfig}/bin/switch-to-configuration test >&2"
-            )
-            webserver.wait_for_open_port(80)
-            webserver.succeed("curl http://localhost | grep caddy")
-      '';
-  }
-)
+      with subtest("plugins are correctled installed and configurable"):
+          webserver.succeed(
+              "${withPluginsConfig}/bin/switch-to-configuration test >&2"
+          )
+          webserver.wait_for_open_port(80)
+          webserver.succeed("curl http://localhost | grep caddy")
+    '';
+}

nixos/tests/envoy.nix

···
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "envoy";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ cameronnemo ];
-    };
+{ envoyPackage, lib, ... }:
+{
+  name = envoyPackage.pname;
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.envoy.enable = true;
-        services.envoy.settings = {
-          admin = {
-            access_log_path = "/dev/null";
-            address = {
-              socket_address = {
-                protocol = "TCP";
-                address = "127.0.0.1";
-                port_value = 80;
-              };
-            };
-          };
-          static_resources = {
-            listeners = [ ];
-            clusters = [ ];
+  meta = with lib.maintainers; {
+    maintainers = [ cameronnemo ];
+  };
+
+  nodes.machine = {
+    services.envoy.enable = true;
+    services.envoy.package = envoyPackage;
+    services.envoy.settings = {
+      admin = {
+        access_log_path = "/dev/null";
+        address = {
+          socket_address = {
+            protocol = "TCP";
+            address = "127.0.0.1";
+            port_value = 80;
           };
         };
-        specialisation = {
-          withoutConfigValidation.configuration =
-            { ... }:
-            {
-              services.envoy = {
-                requireValidConfig = false;
-                settings.admin.access_log_path = lib.mkForce "/var/log/envoy/access.log";
-              };
-            };
-        };
       };
+      static_resources = {
+        listeners = [ ];
+        clusters = [ ];
+      };
+    };
+    specialisation = {
+      withoutConfigValidation.configuration =
+        { ... }:
+        {
+          services.envoy = {
+            requireValidConfig = false;
+            settings.admin.access_log_path = lib.mkForce "/var/log/envoy/access.log";
+          };
+        };
+    };
+  };
 
-    testScript =
-      { nodes, ... }:
-      let
-        specialisations = "${nodes.machine.system.build.toplevel}/specialisation";
-      in
-      ''
-        machine.start()
+  testScript =
+    { nodes, ... }:
+    let
+      specialisations = "${nodes.machine.system.build.toplevel}/specialisation";
+    in
+    ''
+      machine.start()
 
-        with subtest("envoy.service starts and responds with ready"):
-          machine.wait_for_unit("envoy.service")
-          machine.wait_for_open_port(80)
-          machine.wait_until_succeeds("curl -fsS localhost:80/ready")
+      with subtest("envoy.service starts and responds with ready"):
+        machine.wait_for_unit("envoy.service")
+        machine.wait_for_open_port(80)
+        machine.wait_until_succeeds("curl -fsS localhost:80/ready")
 
-        with subtest("envoy.service works with config path not available at eval time"):
-          machine.succeed('${specialisations}/withoutConfigValidation/bin/switch-to-configuration test')
-          machine.wait_for_unit("envoy.service")
-          machine.wait_for_open_port(80)
-          machine.wait_until_succeeds("curl -fsS localhost:80/ready")
-          machine.succeed('test -f /var/log/envoy/access.log')
-      '';
-  }
-)
+      with subtest("envoy.service works with config path not available at eval time"):
+        machine.succeed('${specialisations}/withoutConfigValidation/bin/switch-to-configuration test')
+        machine.wait_for_unit("envoy.service")
+        machine.wait_for_open_port(80)
+        machine.wait_until_succeeds("curl -fsS localhost:80/ready")
+        machine.succeed('test -f /var/log/envoy/access.log')
+    '';
+}

nixos/tests/paretosecurity.nix

···
   meta.maintainers = [ lib.maintainers.zupo ];
 
   nodes.terminal =
-    { config, pkgs, ... }:
+    {
+      config,
+      pkgs,
+      lib,
+      ...
+    }:
+    let
+      # Create a patched version of the package that points to the local dashboard
+      # for easier testing
+      patchedPareto = pkgs.paretosecurity.overrideAttrs (oldAttrs: {
+        postPatch = ''
+          substituteInPlace team/report.go \
+            --replace-warn 'const reportURL = "https://dash.paretosecurity.com"' \
+                           'const reportURL = "http://dashboard"'
+        '';
+      });
+    in
     {
       imports = [ ./common/user-account.nix ];
 
-      services.paretosecurity.enable = true;
+      services.paretosecurity = {
+        enable = true;
+        package = patchedPareto;
+      };
+
+    };
+
+  nodes.dashboard =
+    { config, pkgs, ... }:
+    {
+      networking.firewall.allowedTCPPorts = [ 80 ];
+
+      services.nginx = {
+        enable = true;
+        virtualHosts."dashboard" = {
+          locations."/api/v1/team/".extraConfig = ''
+            add_header Content-Type application/json;
+            return 200 '{"message": "Linked device."}';
+          '';
+        };
+      };
     };
 
   nodes.xfce =
···
   enableOCR = true;
 
   testScript = ''
+    # Test setup
+    terminal.succeed("su - alice -c 'mkdir -p /home/alice/.config'")
+    for m in [terminal, dashboard]:
+      m.systemctl("start network-online.target")
+      m.wait_for_unit("network-online.target")
+
+    # Test 1: Test the systemd socket is installed & enabled
+    terminal.succeed('systemctl is-enabled paretosecurity.socket')
+
+    # Test 2: Test running checks
     terminal.succeed(
-      "su -- alice -c 'paretosecurity check"
+      "su - alice -c 'paretosecurity check"
       # Disable some checks that need intricate test setup so that this test
       # remains simple and fast. Tests for all checks and edge cases available
       # at https://github.com/ParetoSecurity/agent/tree/main/test/integration
···
       + " --skip 21830a4e-84f1-48fe-9c5b-beab436b2cdb"  # Disk encryption
       + " --skip 44e4754a-0b42-4964-9cc2-b88b2023cb1e"  # Pareto Security is up to date
       + " --skip f962c423-fdf5-428a-a57a-827abc9b253e"  # Password manager installed
+      + " --skip 2e46c89a-5461-4865-a92e-3b799c12034a"  # Firewall is enabled
       + "'"
     )
 
+    # Test 3: Test linking
+    terminal.succeed("su - alice -c 'paretosecurity link"
+    + " paretosecurity://enrollTeam/?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9."
+    + "eyJ0b2tlbiI6ImR1bW15LXRva2VuIiwidGVhbUlEIjoiZHVtbXktdGVhbS1pZCIsImlhdCI6"
+    + "MTcwMDAwMDAwMCwiZXhwIjoxOTAwMDAwMDAwfQ.WgnL6_S0EBJHwF1wEVUG8GtIcoVvK5IjWbZpUeZr4Qw'")
+
+    config = terminal.succeed("cat /home/alice/.config/pareto.toml")
+    assert 'AuthToken = "dummy-token"' in config
+    assert 'TeamID = "dummy-team-id"' in config
+
+    # Test 4: Test the tray icon
     xfce.wait_for_x()
+    for unit in [
+        'paretosecurity-trayicon',
+        'paretosecurity-user',
+        'paretosecurity-user.timer'
+    ]:
+        status, out = xfce.systemctl("is-enabled " + unit, "alice")
+        assert status == 0, f"Unit {unit} is not enabled (status: {status}): {out}"
     xfce.succeed("xdotool mousemove 850 10")
     xfce.wait_for_text("Pareto Security")
     xfce.succeed("xdotool click 1")

pkgs/applications/editors/vim/plugins/generated.nix

···
     meta.hydraPlatforms = [ ];
   };
 
+  jule-nvim = buildVimPlugin {
+    pname = "jule.nvim";
+    version = "2025-02-22";
+    src = fetchFromGitHub {
+      owner = "julelang";
+      repo = "jule.nvim";
+      rev = "11c983f900dc84dca4ae6bcb54a937a1ceba4038";
+      sha256 = "0gajpcg7g3885696aljq7zky8cd0bfsjr7n2fad3d2yf0i999fif";
+    };
+    meta.homepage = "https://github.com/julelang/jule.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   julia-vim = buildVimPlugin {
     pname = "julia-vim";
     version = "2024-05-25";

pkgs/applications/editors/vim/plugins/vim-plugin-names

···
 https://github.com/vito-c/jq.vim/,,
 https://github.com/neoclide/jsonc.vim/,,
 https://github.com/Myzel394/jsonfly.nvim/,HEAD,
+https://github.com/julelang/jule.nvim/,HEAD,
+https://github.com/julelang/jule.nvim/,HEAD,
 https://github.com/JuliaEditorSupport/julia-vim/,,
 https://github.com/GCBallesteros/jupytext.nvim/,HEAD,
 https://github.com/rebelot/kanagawa.nvim/,,

pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix

···
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-eeLALUmJoIJfLKbX7MWQFIexfid7eOPTK0UE1sgd5jA=";
+          hash = "sha256-s3peDZApzSfemXRqRjf5fYQGHVf1DAP7XG4NuOqiGcY=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-DftuIxJpP3zcfsoCam4FoqO2PSS/xPTmdefjhWAJqc0=";
+          hash = "sha256-WutwGOcXoREk6oUdFjhsKcrf64CG4GSn9JgGWiQe9l8=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-TiZTp19fcDYPvJnx7F/i96JD8gcE+t1irZstnuagchQ=";
+          hash = "sha256-377T8cfY4jHX+iJjdDScMP+wX6UZCYLasl16ngwfq6U=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-oXKAxgZ1IH+qiw9E/96J7rmvSHgLPwLZItLpFRjh7c0=";
+          hash = "sha256-fufJ9NV73skhwBFe2vCLjh5ykQagXfO0VAdHGPhfOQ4=";
         };
       };
     in
     {
       name = "visualjj";
       publisher = "visualjj";
-      version = "0.14.1";
+      version = "0.14.2";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/networking/browsers/librewolf/src.json

···
 {
-  "packageVersion": "136.0.4-1",
+  "packageVersion": "137.0-1",
   "source": {
-    "rev": "136.0.4-1",
-    "hash": "sha256-ymW9vj4CariMaswrMQRKYEvTofFRjc50gF9EmTuhsRA="
+    "rev": "137.0-1",
+    "hash": "sha256-xynkPKn4JDLVdDEYjmBvEKIHoW83Xackpx/+rnXci5g="
   },
   "firefox": {
-    "version": "136.0.4",
-    "hash": "sha512-wiUqpi0BXO1lNMsqwHH2gImZe0ZpAIPMHv9LrTBq5shlQ3Ge0tNfb5c790Rn1qBKukYNMJwG3qQl52xyDjROKA=="
+    "version": "137.0",
+    "hash": "sha512-gaLAzBT/wuSeSTeebCq1bPtuE7ZmZqZPOr/0SkO7Ln3BcnTTJdHCCvBi1Av/gGPXiNSy+TGnpkbbiwcgTKa0gQ=="
   }
 }

pkgs/applications/version-management/gitlint/default.nix pkgs/by-name/gi/gitlint/package.nix

···
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
   gitMinimal,
-  python3,
+  versionCheckHook,
+  nix-update-script,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "gitlint";
   version = "0.19.1";
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jorisroovers";
···
   # simplify the dependency handling
   sourceRoot = "${src.name}/gitlint-core";
 
-  nativeBuildInputs = with python3.pkgs; [
+  build-system = with python3Packages; [
     hatch-vcs
     hatchling
   ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3Packages; [
     arrow
     click
     sh
   ];
 
-  nativeCheckInputs = with python3.pkgs; [
+  nativeCheckInputs = [
     gitMinimal
-    pytestCheckHook
+    python3Packages.pytestCheckHook
+    versionCheckHook
   ];
+  versionCheckProgramArg = "--version";
 
   pythonImportsCheck = [
     "gitlint"
   ];
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "Linting for your git commit messages";
     homepage = "https://jorisroovers.com/gitlint/";
     changelog = "https://github.com/jorisroovers/gitlint/releases/tag/v${version}";
-    license = licenses.mit;
-    maintainers = with maintainers; [
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
       ethancedwards8
       fab
       matthiasbeyer

pkgs/by-name/ar/arandr/gzip-timestamp-fix.patch

···
+--- setup.py	2025-04-01 11:24:54.530984662 +0000
++++ setup.py	2025-04-01 13:54:46.961341548 +0000
+ 
+@@ -111,9 +111,11 @@
+                 info('compressing man page to %s', gzfile)
+ 
+                 if not self.dry_run:
+-                    compressed = gzip.open(gzfile, 'w', 9)
+-                    compressed.write(manpage)
+-                    compressed.close()
++                    with open(gzfile, 'wb') as file:
++                        with gzip.GzipFile(fileobj=file, mode='wb', filename='', mtime=0, compresslevel=9) as compressed:
++                            compressed.write(manpage)
++                            compressed.close()
++                            file.close()

pkgs/by-name/ar/arandr/package.nix

···
 {
   lib,
   fetchurl,
+  fetchFromGitLab,
   python3Packages,
   gobject-introspection,
   gsettings-desktop-schemas,
···
   pname = "arandr";
   version = "0.1.11";
 
-  src = fetchurl {
-    url = "https://christian.amsuess.com/tools/arandr/files/${pname}-${version}.tar.gz";
-    hash = "sha256-5Mu+Npi7gSs5V3CHAXS+AJS7rrOREFqBH5X0LrGCrgI=";
+  src = fetchFromGitLab {
+    owner = "arandr";
+    repo = "arandr";
+    tag = version;
+    hash = "sha256-nQtfOKAnWKsy2DmvtRGJa4+Y9uGgX41BeHpd9m4d9YA=";
   };
+
+  # patch to set mtime=0 on setup.py
+  patches = [ ./gzip-timestamp-fix.patch ];
+  patchFlags = [ "-p0" ];
 
   preBuild = ''
     rm -rf data/po/*

pkgs/by-name/az/azure-cli/extensions-manual.nix

···
 
   containerapp = mkAzExtension rec {
     pname = "containerapp";
-    version = "1.1.0b3";
+    version = "1.1.0b4";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/containerapp-${version}-py2.py3-none-any.whl";
-    hash = "sha256-BPChKCEU89/+KWIlt4ocU37gLwyDUfGBO3QCqkFQhjI=";
+    hash = "sha256-d2pqanDERA54NGQwzO1S2D+WM1q5w1dmKjYbEdbknik=";
     description = "Microsoft Azure Command-Line Tools Containerapp Extension";
     propagatedBuildInputs = with python3Packages; [
       docker

pkgs/by-name/ba/balena-cli/package.nix

···
 in
 buildNpmPackage' rec {
   pname = "balena-cli";
-  version = "21.1.0";
+  version = "21.1.3";
 
   src = fetchFromGitHub {
     owner = "balena-io";
     repo = "balena-cli";
     rev = "v${version}";
-    hash = "sha256-STixd/xJikV9qt2aG3smyLPEwG7fLYrN3jfVTwBxJrI=";
+    hash = "sha256-44r0dbcX/KRmfucNy4p/OMrKFC2J8P9eQpwTOTOmwS4=";
   };
 
-  npmDepsHash = "sha256-dyUWQoR0EweHdNc5NN+qW2OdbCIspTQ1C/QsesnlvRU=";
+  npmDepsHash = "sha256-wEshPXXpFVOYzaqh6c5z47OccBEWMP5aarZP42PYgzk=";
 
   postPatch = ''
     ln -s npm-shrinkwrap.json package-lock.json

pkgs/by-name/cl/claude-code/package-lock.json

···
   "packages": {
     "": {
       "dependencies": {
-        "@anthropic-ai/claude-code": "^0.2.57"
+        "@anthropic-ai/claude-code": "^0.2.59"
       }
     },
     "node_modules/@anthropic-ai/claude-code": {
-      "version": "0.2.57",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-0.2.57.tgz",
-      "integrity": "sha512-/NS22ojBphLj0zhEWV26WIcLS1JcMT809tmkiwHrb1D9fGJccbbfkLyMI7eg7TAmgnXUINWxlwmMIExdOsRXfQ==",
+      "version": "0.2.59",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-0.2.59.tgz",
+      "integrity": "sha512-hcUHEiPUmkgU00J4/1dlLgWvf5ZkWOjMpUrXhMq2o143LOElKuTGxPGt2RtmFHKk6DesFZcV/gabZYkcTqraBw==",
       "hasInstallScript": true,
       "license": "SEE LICENSE IN README.md",
       "bin": {

pkgs/by-name/cl/claude-code/package.nix

···
 
 buildNpmPackage rec {
   pname = "claude-code";
-  version = "0.2.57";
+  version = "0.2.59";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";
-    hash = "sha256-GCsw/QNcziytx15zwSQMY9JkKHnJb2KN2nwvkc7scy8=";
+    hash = "sha256-XHHWmDw9qBM4fQ975wSk12hJnr4+1H4AhlNc+IBV3qs=";
   };
 
-  npmDepsHash = "sha256-GcYiQLcqWCAHL7FkD7M0YQV9ksgn8fo2Sb68x5/dA8k=";
+  npmDepsHash = "sha256-KorQlEB90EDE+NIxyUh1apqCDzgrCpwcaOy2mt2mz1s=";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json

pkgs/by-name/cp/cpplint/package.nix

···
 
 python3Packages.buildPythonApplication rec {
   pname = "cpplint";
-  version = "2.0.0";
+  version = "2.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cpplint";
     repo = "cpplint";
     tag = version;
-    hash = "sha256-076363ZwcriPb+Fn9S5jay8oL+LlBTNh+IqQRCAndRo=";
+    hash = "sha256-IM1XznnpdL1Piei9kKR1nCwfs7TVgLcTgMI4r+cQXLg=";
   };
 
+  # We use pytest-cov-stub instead
   postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace-fail "pytest-cov" "" \
-      --replace-fail "--cov-fail-under=90 --cov=cpplint" ""
+    substituteInPlace pyproject.toml \
+      --replace-fail '"pytest-cov",' ""
   '';
 
   build-system = with python3Packages; [
···
 
   nativeCheckInputs = with python3Packages; [
     parameterized
+    pytest-cov-stub
+    pytest-timeout
     pytestCheckHook
-    pytest-timeout
     testfixtures
     versionCheckHook
   ];
-  versionCheckProgramArg = [ "--version" ];
+  versionCheckProgramArg = "--version";
 
   meta = {
     homepage = "https://github.com/cpplint/cpplint";

pkgs/by-name/de/der-ascii/package.nix

···
 
 buildGoModule rec {
   pname = "der-ascii";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-yUHVPBUW1Csn3W5K9S2TWOq4aovzpaBK8BC0t8zkj3g=";
+    sha256 = "sha256-xGzxq5AHvzLUOp9VUcI9JMwrCpVIrpDvenWUOEBP6pA=";
   };
   vendorHash = null;
 

pkgs/by-name/el/element-call/package.nix

···
   fetchYarnDeps,
   yarnConfigHook,
   yarnBuildHook,
-  yarnInstallHook,
   nodejs,
 }:
 
-let
-  inherit (stdenv.hostPlatform) system;
-  throwSystem = throw "Unsupported system: ${system}";
-  offlineCacheHash =
-    {
-      x86_64-linux = "sha256-bjWPoci9j3LZnOfDgmRVqQp1L2tXBwHQOryn+p5B1Mc=";
-      aarch64-linux = "sha256-bjWPoci9j3LZnOfDgmRVqQp1L2tXBwHQOryn+p5B1Mc=";
-      x86_64-darwin = "sha256-bjWPoci9j3LZnOfDgmRVqQp1L2tXBwHQOryn+p5B1Mc=";
-      aarch64-darwin = "sha256-bjWPoci9j3LZnOfDgmRVqQp1L2tXBwHQOryn+p5B1Mc=";
-    }
-    .${system} or throwSystem;
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "element-call";
-  version = "0.7.1";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "element-call";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-HmkFr2DroN1uNNH2pnRwE7vsJsEPLYU6yhroiuR/E6Q=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-BugR5aXDxIQ9WOhaqXEoo0FdZHnYSvoqDoRJLDd4PUk=";
   };
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = offlineCacheHash;
+    hash = "sha256-7dUSt1k/5N6BaYrT272J6xxDGgloAsDw1dCFh327Itc=";
   };
 
   nativeBuildInputs = [
···
   '';
 
   meta = with lib; {
+    changelog = "https://github.com/element-hq/element-call/releases/tag/${finalAttrs.src.tag}";
     homepage = "https://github.com/element-hq/element-call";
     description = "Group calls powered by Matrix";
     license = licenses.asl20;
     maintainers = with maintainers; [ kilimnik ];
-    mainProgram = "element-call";
   };
 })

pkgs/by-name/en/ente-desktop/package.nix

···
   fetchFromGitHub,
   fetchYarnDeps,
   nodejs,
-  electron_34,
+  electron_35,
   yarnConfigHook,
   copyDesktopItems,
   vips,
···
   imagemagick,
 }:
 let
-  electron = electron_34;
+  electron = electron_35;
 in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ente-desktop";
-  version = "1.7.10";
+  version = "1.7.11";
 
   src = fetchFromGitHub {
     owner = "ente-io";
···
       "web"
     ];
     tag = "photosd-v${finalAttrs.version}";
-    hash = "sha256-iH9fbeUOd/8oVVQbMCSlWyruQZKgSjexNrOuS7szJ9w=";
+    hash = "sha256-yEfJEe+/PnRr9in7+9l54LQqCFkGqDRhqzcsNaEZmhI=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/desktop";
···
   offlineCache = fetchYarnDeps {
     name = "ente-desktop-${finalAttrs.version}-offline-cache";
     inherit (finalAttrs) src sourceRoot;
-    hash = "sha256-kiL2XQPPN9VkDa3rzO1rLwUZVTbwEz0zeqpgpWOSy7Y=";
+    hash = "sha256-Cq/4OOgGp6qg2ge5NK5jcYCvS/uF5l9nLLWIslpGRDc=";
   };
   webOfflineCache = fetchYarnDeps {
     name = "ente-desktop-${finalAttrs.version}-web-offline-cache";
     inherit (finalAttrs) src;
     sourceRoot = "${finalAttrs.src.name}/web";
-    hash = "sha256-7epwOEWi5lZNo6Z7Rf+QZtGvVCZxk5bXU2aN+9KDYCc=";
+    hash = "sha256-yoCOU4cxxHiWu1+/vGwM9VWRroymr6JTbRHomKRJhU4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/en/ente-web/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ente-web";
-  version = "0.9.99";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "ente-io";
···
     sparseCheckout = [ "web" ];
     tag = "photos-v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-/dWnaVll/kaKHTJ5gH18BR6JG5E6pF7/j+SgvE66b7M=";
+    hash = "sha256-hK5CO4FTjh2MNT8pztV/GO7ifOGv1hw32flXrmcUAfk=";
   };
   sourceRoot = "${finalAttrs.src.name}/web";
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/web/yarn.lock";
-    hash = "sha256-Wu0/YHqkqzrmA5hpVk0CX/W1wJUh8uZSjABuc+DPxMA=";
+    hash = "sha256-n/+HETnwtnpFlfDLA0znCzro5YhNsISweR820QXJFUQ=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/en/envoy-bin/package.nix

···
+{
+  lib,
+  stdenv,
+  autoPatchelfHook,
+  fetchurl,
+  makeWrapper,
+  nixosTests,
+  versionCheckHook,
+}:
+let
+  version = "1.33.2";
+  inherit (stdenv.hostPlatform) system;
+  throwSystem = throw "envoy-bin is not available for ${system}.";
+
+  plat =
+    {
+      aarch64-linux = "aarch_64";
+      x86_64-linux = "x86_64";
+    }
+    .${system} or throwSystem;
+
+  hash =
+    {
+      aarch64-linux = "sha256-gew2iaghIu/wymgMSBdvTTUbb5iBp5zJ2QeKb7Swtqg=";
+      x86_64-linux = "sha256-vS/4fF78lf14gNcQkV9XPBqrTZxV2NqIbc2R30P610E=";
+    }
+    .${system} or throwSystem;
+in
+stdenv.mkDerivation {
+  pname = "envoy-bin";
+  inherit version;
+
+  src = fetchurl {
+    url = "https://github.com/envoyproxy/envoy/releases/download/v${version}/envoy-${version}-linux-${plat}";
+    inherit hash;
+  };
+
+  nativeBuildInputs = [ autoPatchelfHook ];
+  buildInputs = [ makeWrapper ];
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    install -m755 $src $out/bin/envoy
+    runHook postInstall
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+  versionCheckProgram = "${placeholder "out"}/bin/envoy";
+  versionCheckProgramArg = "--version";
+
+  passthru = {
+    tests.envoy-bin = nixosTests.envoy-bin;
+
+    updateScript = ./update.sh;
+  };
+
+  meta = {
+    homepage = "https://envoyproxy.io";
+    changelog = "https://github.com/envoyproxy/envoy/releases/tag/v${version}";
+    description = "Cloud-native edge and service proxy";
+    license = lib.licenses.asl20;
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    maintainers = with lib.maintainers; [
+      adamcstephens
+    ];
+    mainProgram = "envoy";
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
+  };
+}

pkgs/by-name/en/envoy-bin/update.sh

···
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnused gawk nix-prefetch common-updater-scripts jq
+
+set -euo pipefail
+
+ROOT="$(dirname "$(readlink -f "$0")")"
+NIX_DRV="$ROOT/package.nix"
+if [ ! -f "$NIX_DRV" ]; then
+    echo "ERROR: cannot find package.nix in $ROOT"
+    exit 1
+fi
+
+fetch_arch() {
+    VER="$1"
+    ARCH="$2"
+    URL="https://github.com/envoyproxy/envoy/releases/download/v${VER}/envoy-${VER}-linux-${ARCH}"
+    nix hash convert --to sri --hash-algo sha256 "$(nix-prefetch-url --type sha256 "$URL")"
+}
+
+replace_hash() {
+    sed -i "s#$1 = \"sha256-.\{44\}\"#$1 = \"$2\"#" "$NIX_DRV"
+}
+
+VER=$(list-git-tags --url=https://github.com/envoyproxy/envoy | rg 'v[0-9\.]*$' | sed -e 's/^v//' | sort -V | tail -n 1)
+
+LINUX_X64_HASH=$(fetch_arch "$VER" "x86_64")
+LINUX_AARCH64_HASH=$(fetch_arch "$VER" "aarch_64")
+
+sed -i "s/version = \".*\"/version = \"$VER\"/" "$NIX_DRV"
+
+replace_hash "x86_64-linux" "$LINUX_X64_HASH"
+replace_hash "aarch64-linux" "$LINUX_AARCH64_HASH"

pkgs/by-name/fe/feedbackd/package.nix

···
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "feedbackd";
-  version = "0.8.0";
+  version = "0.8.1";
 
   outputs = [
     "out"
···
     owner = "Librem5";
     repo = "feedbackd";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Hn850+bRSNDe8ZgDRu52N7AR/yLNbV6zGROBYtetOZg=";
+    hash = "sha256-J2BNDF9TyW+srW0pGbGt4/Uw4KPVf/Ke+HJVBldmfCA=";
   };
 
   depsBuildBuild = [

pkgs/by-name/fl/fluent-bit/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fluent-bit";
-  version = "3.2.9";
+  # FIXME: We are deliberately on 3.2.6 as 3.2.7 and above are causing segfaults (https://github.com/fluent/fluent-bit/issues/10139)
+  version = "3.2.6";
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-10L+w9SLfblE9Ok9lvZdU1i63NRtw/pT5ePk+zJwvHQ=";
+    hash = "sha256-S0sb954n17z+zrVNkYd6yiV01aNbOLJLOV+34PRkSXQ=";
   };
 
   # The source build documentation covers some dependencies and CMake options.

pkgs/by-name/ge/gerrit/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "gerrit";
-  version = "3.11.1";
+  version = "3.11.2";
 
   src = fetchurl {
     url = "https://gerrit-releases.storage.googleapis.com/gerrit-${version}.war";
-    hash = "sha256-7gJyvFOisukzd2Vmqci7CiJqegYQSYQZvnSvR+Y9HM4=";
+    hash = "sha256-F3kWGIA7RvbPMAs9U9tAmraHpxbkW/TQ6R9XXVBaLXs=";
   };
 
   buildCommand = ''

pkgs/by-name/ha/haven/package.nix

···
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "haven";
+  version = "1.0.5";
+
+  src = fetchFromGitHub {
+    owner = "bitvora";
+    repo = "haven";
+    tag = "v${version}";
+    hash = "sha256-rSycrHW53TgqbsfgaRn3492EWtpu440GtbegozqnzMQ=";
+  };
+
+  vendorHash = "sha256-5d6C2sNG8aCaC+z+hyLgOiEPWP/NmAcRRbRVC4KuCEw=";
+
+  postInstall = ''
+    mkdir -p $out/share/haven
+    cp -r $src/templates $out/share/haven/
+    cp $src/.env.example $out/share/haven/.env.example
+  '';
+
+  meta = {
+    description = "High Availability Vault for Events on Nostr";
+    homepage = "https://github.com/bitvora/haven";
+    changelog = "https://github.com/bitvora/haven/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ felixzieger ];
+    mainProgram = "haven";
+  };
+}

pkgs/by-name/kt/ktor-cli/package.nix

···
 
 buildGoModule rec {
   pname = "ktor-cli";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "ktorio";
     repo = "ktor-cli";
     tag = version;
-    hash = "sha256-TGwkGm1Rsg82f6FJeTnhyvfS2MRMe5+DTdxTsOwwb1Q=";
+    hash = "sha256-DZEEaTz55vIBU8Byl51cEWgXu2Wjmctz/9XBAKX8VKY=";
   };
 
   subPackages = "cmd/ktor";
 
-  vendorHash = "sha256-ITYNSq2hs0QcOZZShkwtjZVcSyGY1uCmhgoZ0l9nPP0=";
+  vendorHash = "sha256-Cv/Jq4dWVzotfCCclrwufmC0I2pgPe/YHKWqcLzjt2E=";
 
   ldflags = [
     "-s"

pkgs/by-name/la/ladybird/package.nix

···
   cacert,
   unicode-emoji,
   unicode-character-database,
+  unicode-idna,
+  publicsuffix-list,
   cmake,
   ninja,
   pkg-config,
···
 }:
 
 let
-  unicode-idna = fetchurl {
-    url = "https://www.unicode.org/Public/idna/${unicode-character-database.version}/IdnaMappingTable.txt";
-    hash = "sha256-QCy9KF8flS/NCDS2NUHVT2nT2PG4+Fmb9xoaFJNfgsQ=";
-  };
   adobe-icc-profiles = fetchurl {
     url = "https://download.adobe.com/pub/adobe/iccprofiles/win/AdobeICCProfilesCS4Win_end-user.zip";
     hash = "sha256-kgQ7fDyloloPaXXQzcV9tgpn3Lnr37FbFiZzEb61j5Q=";
     name = "adobe-icc-profiles.zip";
   };
-  public_suffix_commit = "9094af5c6cb260e69137c043c01be18fee01a540";
-  public-suffix-list = fetchurl {
-    url = "https://raw.githubusercontent.com/publicsuffix/list/${public_suffix_commit}/public_suffix_list.dat";
-    hash = "sha256-0szHUz1T0MXOQ9tcXoKY2F/bI3s7hsYCjURqywZsf1w=";
-  };
   # Note: The cacert version is synthetic and must match the version in the package's CMake
   cacert_version = "2023-12-12";
 in
···
     cp -r ${unicode-character-database}/share/unicode build/Caches/UCD
     chmod +w build/Caches/UCD
     cp ${unicode-emoji}/share/unicode/emoji/emoji-test.txt build/Caches/UCD
-    cp ${unicode-idna} build/Caches/UCD/IdnaMappingTable.txt
+    cp ${unicode-idna}/share/unicode/idna/IdnaMappingTable.txt build/Caches/UCD
     echo -n ${unicode-character-database.version} > build/Caches/UCD/version.txt
     chmod -w build/Caches/UCD
 
···
     echo -n ${cacert_version} > build/Caches/CACERT/version.txt
 
     mkdir build/Caches/PublicSuffix
-    cp ${public-suffix-list} build/Caches/PublicSuffix/public_suffix_list.dat
+    cp ${publicsuffix-list}/share/publicsuffix/public_suffix_list.dat build/Caches/PublicSuffix
 
     mkdir build/Caches/AdobeICCProfiles
     cp ${adobe-icc-profiles} build/Caches/AdobeICCProfiles/adobe-icc-profiles.zip

pkgs/by-name/lk/lk-jwt-service/package.nix

···
   fetchFromGitHub,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "lk-jwt-service";
-  version = "0.2.1";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "lk-jwt-service";
-    tag = "v${version}";
-    hash = "sha256-R4YqmHp0i+RpJJkENJPZJDNCVg+O+70JMoCR8ZlesyM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ONL2qKBXL2FtTv5Eao61qPKWP2h9t3KyoHlS5nAHMGA=";
   };
 
-  vendorHash = "sha256-evzltyQZCBQ4/k641sQrmUvw6yIBWFEic/WUa/WX5xE=";
+  vendorHash = "sha256-47eJO1Ai78RuhlEPn/J1cd+YSqvmfUD8cuPZIqsdxvI=";
 
   meta = with lib; {
+    changelog = "https://github.com/element-hq/lk-jwt-service/releases/tag/${finalAttrs.src.tag}";
     description = "Minimal service to issue LiveKit JWTs for MatrixRTC";
     homepage = "https://github.com/element-hq/lk-jwt-service";
     license = licenses.agpl3Plus;
     maintainers = with maintainers; [ kilimnik ];
     mainProgram = "lk-jwt-service";
   };
-}
+})

pkgs/by-name/m4/m4ri/package.nix

···
 }:
 
 stdenv.mkDerivation rec {
-  version = "20240729";
+  version = "20250128";
   pname = "m4ri";
 
   src = fetchFromGitHub {
     owner = "malb";
     repo = "m4ri";
-    # 20240729 has a broken m4ri.pc file, fixed in the next commit.
-    # TODO: remove if on update
-    rev =
-      if version == "20240729" then "775189bfea96ffaeab460513413fcf4fbcd64392" else "release-${version}";
-    hash = "sha256-untwo0go8O8zNO0EyZ4n/n7mngSXLr3Z/FSkXA8ptnU=";
+    rev = version;
+    hash = "sha256-YoCTI4dLy95xuRJyNugIzGxE40B9pCWxRQtsyS/1Pds=";
   };
-
-  # based on the list in m4/m4_ax_ext.m4
-  configureFlags = builtins.map (s: "ax_cv_have_${s}_cpu_ext=no") (
-    [
-      "sha"
-      "xop"
-    ]
-    ++ lib.optional (!stdenv.hostPlatform.sse3Support) "sse3"
-    ++ lib.optional (!stdenv.hostPlatform.ssse3Support) "ssse3"
-    ++ lib.optional (!stdenv.hostPlatform.sse4_1Support) "sse41"
-    ++ lib.optional (!stdenv.hostPlatform.sse4_2Support) "sse42"
-    ++ lib.optional (!stdenv.hostPlatform.sse4_aSupport) "sse4a"
-    ++ lib.optional (!stdenv.hostPlatform.aesSupport) "aes"
-    ++ lib.optional (!stdenv.hostPlatform.avxSupport) "avx"
-    ++ lib.optional (!stdenv.hostPlatform.fmaSupport) "fma3"
-    ++ lib.optional (!stdenv.hostPlatform.fma4Support) "fma4"
-    ++ lib.optional (!stdenv.hostPlatform.avx2Support) "avx2"
-    ++ lib.optionals (!stdenv.hostPlatform.avx512Support) [
-      "avx512f"
-      "avx512cd"
-      "avx512pf"
-      "avx512er"
-      "avx512vl"
-      "avx512bw"
-      "avx512dq"
-      "avx512ifma"
-      "avx512vbmi"
-    ]
-  );
 
   doCheck = true;
 

pkgs/by-name/m4/m4rie/package.nix

···
 {
   lib,
   stdenv,
-  fetchFromBitbucket,
+  fetchFromGitHub,
   autoreconfHook,
+  pkg-config,
   m4ri,
 }:
 
 stdenv.mkDerivation rec {
-  version = "20250103";
+  version = "20250128";
   pname = "m4rie";
 
-  src = fetchFromBitbucket {
+  src = fetchFromGitHub {
     owner = "malb";
     repo = "m4rie";
-    rev = "release-${version}";
-    hash = "sha256-CbzDLSqdtQ+CLKoKycznKzD3VCa+gfuh8TLvRC1fVz0=";
+    rev = version;
+    hash = "sha256-tw6ZX8hKfr9wQLF2nuO1dSkkTYZX6pzNWMlWfzLqQNE=";
   };
 
   doCheck = true;
···
   makeFlags = [ ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ "CFLAGS=-O0" ];
   nativeBuildInputs = [
     autoreconfHook
+    pkg-config
   ];
 
   meta = with lib; {

pkgs/by-name/mi/miniflux/package.nix

···
 
 buildGoModule rec {
   pname = "miniflux";
-  version = "2.2.6";
+  version = "2.2.7";
 
   src = fetchFromGitHub {
     owner = "miniflux";
     repo = "v2";
     tag = version;
-    hash = "sha256-N0WAdfxToVF93ICGpDstQig3aGz2lAzJz1nf4tSvxAY=";
+    hash = "sha256-1W+sFXvM5qOYxpbRBkZIvombchv2oYkcFuq7/ETGjfs=";
   };
 
-  vendorHash = "sha256-AG3NNqwpaTctvgOEZ2SarsMK4SRgzWxf+j9N4wwKKB4=";
+  vendorHash = "sha256-bulQrLtA61RMZVhTtupTJUUTWJGWXcmpGaNUAoXEfYE=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/mu/museum/package.nix

···
 
 buildGoModule rec {
   pname = "museum";
-  version = "0.9.99";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "ente-io";
     repo = "ente";
     sparseCheckout = [ "server" ];
     rev = "photos-v${version}";
-    hash = "sha256-+EL81zSOjoBfew8LRl0awWXgc2r8KDBBCYBBtDU1s5g=";
+    hash = "sha256-niEySdGebd9SRRha2dYLsAary3to/9tgV5KePg2LdyE=";
   };
 
   vendorHash = "sha256-px4pMqeH73Fe06va4+n6hklIUDMbPmAQNKKRIhwv6ec=";

pkgs/by-name/pa/paretosecurity/package.nix

···
 
 buildGoModule rec {
   pname = "paretosecurity";
-  version = "0.0.91";
+  version = "0.0.96";
 
   src = fetchFromGitHub {
     owner = "ParetoSecurity";
     repo = "agent";
     rev = version;
-    hash = "sha256-/kGwV96Jp7U08jh/wPQMcoV48zQe9ixY7gpNdtFyOkk=";
+    hash = "sha256-SyeIGSDvrnOvyOJ0zC8CulpaMa+iZeRaMTJUSydz2tw=";
   };
 
-  vendorHash = "sha256-kGrYoN0dGcSuQW47Y4LUFdHQYAoY74NOM1LLPdhmLhc=";
+  vendorHash = "sha256-O/OF3Y6HiiikMxf657k9eIM7UfkicIImAUxVVf/TgR8=";
   proxyVendor = true;
 
-  subPackages = [
-    "cmd/paretosecurity"
-  ];
-
   ldflags = [
     "-s"
     "-X=github.com/ParetoSecurity/agent/shared.Version=${version}"
···
     "-X=github.com/ParetoSecurity/agent/shared.Date=1970-01-01T00:00:00Z"
   ];
 
+  postInstall = ''
+    # Install global systemd files
+    install -Dm400 ${src}/apt/paretosecurity.socket $out/lib/systemd/system/paretosecurity.socket
+    install -Dm400 ${src}/apt/paretosecurity.service $out/lib/systemd/system/paretosecurity.service
+    substituteInPlace $out/lib/systemd/system/paretosecurity.service \
+        --replace-fail "/usr/bin/paretosecurity" "$out/bin/paretosecurity"
+
+    # Install user systemd files
+    install -Dm444 ${src}/apt/paretosecurity-user.timer $out/lib/systemd/user/paretosecurity-user.timer
+    install -Dm444 ${src}/apt/paretosecurity-user.service $out/lib/systemd/user/paretosecurity-user.service
+    substituteInPlace $out/lib/systemd/user/paretosecurity-user.service \
+        --replace-fail "/usr/bin/paretosecurity" "$out/bin/paretosecurity"
+    install -Dm444 ${src}/apt/paretosecurity-trayicon.service $out/lib/systemd/user/paretosecurity-trayicon.service
+    substituteInPlace $out/lib/systemd/user/paretosecurity-trayicon.service \
+        --replace-fail "/usr/bin/paretosecurity" "$out/bin/paretosecurity"
+  '';
+
   passthru.tests = {
     version = testers.testVersion {
       version = "${version}";
···
       settings such as if you have disk encryption and firewall enabled.
 
       If you use the `services.paretosecurity` NixOS module, you also get a
-      root helper, so that you can run the checker in userspace. Some checks
+      root helper that allows you to run the checker in userspace. Some checks
       require root permissions, and the checker asks the helper to run those.
 
       Additionally, if you enable `services.paretosecurity.trayIcon`, you get a
       little Vilfredo Pareto living in your systray showing your the current
-      status of checks.
+      status of checks. This will also enable a systemd timer to update the
+      status of checks once per hour.
 
       Finally, you can run `paretosecurity link` to configure the agent
       to send the status of checks to https://dash.paretosecurity.com to make

pkgs/by-name/ro/routino/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "routino";
-  version = "3.4.1";
+  version = "3.4.2";
 
   src = fetchurl {
     url = "https://routino.org/download/routino-${version}.tgz";
-    hash = "sha256-C6qNKljRdV0ProbgSxfrZLgZH+Pl8kcpKmTb83GLhSs=";
+    hash = "sha256-Dms1u/KuS6qFYcslKfsvIFPx0ApdyWtKK/XlgW+kToI=";
   };
 
   patchFlags = [ "-p0" ];

pkgs/by-name/ru/ruffle/package.nix

···
 {
+  lib,
+  stdenvNoCC,
+  rustPlatform,
+  withRuffleTools ? false,
+  fetchFromGitHub,
+  jre_minimal,
+  pkg-config,
+  wrapGAppsHook3,
+  darwin,
   alsa-lib,
-  fetchFromGitHub,
-  makeWrapper,
+  gtk3,
   openssl,
-  pkg-config,
-  python3,
-  rustPlatform,
-  stdenvNoCC,
-  lib,
   wayland,
-  xorg,
   vulkan-loader,
   udev,
-  jre_minimal,
-  cairo,
-  gtk3,
-  wrapGAppsHook3,
-  gsettings-desktop-schemas,
-  glib,
   libxkbcommon,
   openh264,
-  darwin,
+  writeShellApplication,
+  curl,
+  jq,
+  nix-update,
 }:
-let
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruffle";
-  version = "nightly-2025-01-25";
-  # TODO: Remove overridden derivation once ruffle accepts upstream openh264-2.5.0
-  openh264-241 =
-    if stdenvNoCC.hostPlatform.isLinux then
-      openh264.overrideAttrs (_: rec {
-        version = "2.4.1";
-        src = fetchFromGitHub {
-          owner = "cisco";
-          repo = "openh264";
-          tag = "v${version}";
-          hash = "sha256-ai7lcGcQQqpsLGSwHkSs7YAoEfGCIbxdClO6JpGA+MI=";
-        };
-        postPatch = null;
-      })
-    else
-      null;
-in
-rustPlatform.buildRustPackage {
-  inherit pname version;
+  version = "0-nightly-2025-03-28";
 
   src = fetchFromGitHub {
     owner = "ruffle-rs";
-    repo = pname;
-    tag = version;
-    hash = "sha256-JLh0tatP70rYo2QXLKu6M9jJ1gFpY76sYaUJqW9U4E0=";
+    repo = "ruffle";
+    tag = lib.strings.removePrefix "0-" finalAttrs.version;
+    hash = "sha256-p2EEoHXseIXms4Xjyi3aNWCU0W9slXkeqrCrPvq1BjI=";
   };
 
-  patches = [ ./remove-deterministic-feature.patch ];
-
   useFetchCargoVendor = true;
-  cargoHash = "sha256-PbNp/V+xmU6Lo24a6pd9XoT/LQmINztjOHKoikG9N4Y=";
+  cargoHash = "sha256-RcCIt6xVZaQA7eSgKngHtsGafHFwv1bISK0XKWoNWtI=";
+  cargoBuildFlags = lib.optional withRuffleTools "--workspace";
+
+  env =
+    let
+      tag = lib.strings.removePrefix "0-" finalAttrs.version;
+      versionDate = lib.strings.removePrefix "0-nightly-" finalAttrs.version;
+    in
+    {
+      VERGEN_IDEMPOTENT = "1";
+      VERGEN_GIT_SHA = tag;
+      VERGEN_GIT_COMMIT_DATE = versionDate;
+      VERGEN_GIT_COMMIT_TIMESTAMP = "${versionDate}T00:00:00Z";
+    };
 
   nativeBuildInputs =
     [ jre_minimal ]
     ++ lib.optionals stdenvNoCC.hostPlatform.isLinux [
-      glib
-      gsettings-desktop-schemas
-      makeWrapper
       pkg-config
-      python3
       wrapGAppsHook3
     ]
     ++ lib.optionals stdenvNoCC.hostPlatform.isDarwin [ rustPlatform.bindgenHook ];
···
   buildInputs =
     lib.optionals stdenvNoCC.hostPlatform.isLinux [
       alsa-lib
-      cairo
       gtk3
       openssl
       wayland
-      xorg.libX11
-      xorg.libXcursor
-      xorg.libXi
-      xorg.libxcb
-      xorg.libXrender
       vulkan-loader
       udev
     ]
     ++ lib.optionals stdenvNoCC.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.AppKit ];
 
-  cargoBuildFlags = [ "--workspace" ];
-
   postInstall =
     ''
-      # Namespace binaries with "ruffle_"
-      mv $out/bin/exporter $out/bin/ruffle_exporter
-      mv $out/bin/mocket $out/bin/ruffle_mocket
-      mv $out/bin/stub-report $out/bin/ruffle_stub-report
-      mv $out/bin/build_playerglobal $out/bin/ruffle_build_playerglobal
-
-      # This name is too specific
       mv $out/bin/ruffle_desktop $out/bin/ruffle
+      install -Dm644 LICENSE.md -t $out/share/doc/ruffle
+      install -Dm644 README.md -t $out/share/doc/ruffle
     ''
     + lib.optionalString stdenvNoCC.hostPlatform.isLinux ''
       install -Dm644 desktop/packages/linux/rs.ruffle.Ruffle.desktop \
···
 
       install -Dm644 desktop/packages/linux/rs.ruffle.Ruffle.metainfo.xml \
                      -t $out/share/metainfo/
-
-      rm $out/bin/ruffle_web_safari
     '';
 
+  # Prevents ruffle from downloading openh264 at runtime for Linux
+  openh264-241 =
+    if stdenvNoCC.hostPlatform.isLinux then
+      openh264.overrideAttrs (_: rec {
+        version = "2.4.1";
+        src = fetchFromGitHub {
+          owner = "cisco";
+          repo = "openh264";
+          tag = "v${version}";
+          hash = "sha256-ai7lcGcQQqpsLGSwHkSs7YAoEfGCIbxdClO6JpGA+MI=";
+        };
+        postPatch = null;
+      })
+    else
+      null;
+
   preFixup = lib.optionalString stdenvNoCC.hostPlatform.isLinux ''
-    patchelf $out/bin/ruffle \
-      --add-needed libxkbcommon-x11.so \
-      --add-needed libwayland-client.so \
-      --add-needed libopenh264.so \
-      --add-rpath ${libxkbcommon}/lib:${wayland}/lib:${openh264-241}/lib
+    gappsWrapperArgs+=(--prefix LD_LIBRARY_PATH : ${
+      lib.makeLibraryPath [
+        libxkbcommon
+        finalAttrs.openh264-241
+        vulkan-loader
+        wayland
+      ]
+    })
   '';
 
-  dontWrapGApps = true;
-
-  postFixup = lib.optionalString stdenvNoCC.hostPlatform.isLinux ''
-    vulkanWrapperArgs+=(
-      --prefix LD_LIBRARY_PATH ':' ${vulkan-loader}/lib
-    )
-
-    wrapProgram $out/bin/ruffle_exporter \
-      "''${vulkanWrapperArgs[@]}"
-
-    wrapProgram $out/bin/ruffle \
-      "''${vulkanWrapperArgs[@]}" \
-      "''${gappsWrapperArgs[@]}"
-  '';
+  passthru = {
+    updateScript = lib.getExe (writeShellApplication {
+      name = "ruffle-update";
+      runtimeInputs = [
+        curl
+        jq
+        nix-update
+      ];
+      text = ''
+        version="$( \
+          curl https://api.github.com/repos/ruffle-rs/ruffle/releases?per_page=1 | \
+          jq -r ".[0].tag_name" \
+        )"
+        exec nix-update --version "0-$version" ruffle
+      '';
+    });
+  };
 
   meta = {
     description = "Cross platform Adobe Flash Player emulator";
···
       and 3 programs with machine-native performance thanks to being
       written in the Rust programming language.
 
-      This package for ruffle also includes the `exporter` and
-      `scanner` utilities which allow for generating screenshots as
-      PNGs and parsing `.swf` files in bulk respectively.
+      Additionally, overriding the `withRuffleTools` input to
+      `true` will build all the available packages in the ruffle
+      project, including the `exporter` and `scanner` utilities.
     '';
     homepage = "https://ruffle.rs/";
     downloadPage = "https://ruffle.rs/downloads";
-    changelog = "https://github.com/ruffle-rs/ruffle/releases/tag/${version}";
+    changelog = "https://github.com/ruffle-rs/ruffle/releases/tag/${lib.strings.removePrefix "0-" finalAttrs.version}";
     license = [
       lib.licenses.mit
       lib.licenses.asl20
···
     mainProgram = "ruffle";
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
-}
+})

pkgs/by-name/ru/ruffle/remove-deterministic-feature.patch

···
-diff --git a/exporter/Cargo.toml b/exporter/Cargo.toml
-index 93066a30d..0f8b71ae4 100644
---- a/exporter/Cargo.toml
-+++ b/exporter/Cargo.toml
-@@ -13,7 +13,7 @@ workspace = true
- [dependencies]
- clap = { workspace = true }
- futures = { workspace = true }
--ruffle_core = { path = "../core", features = ["deterministic", "default_font"] }
-+ruffle_core = { path = "../core", features = ["default_font"] }
- ruffle_render_wgpu = { path = "../render/wgpu", features = ["clap"] }
- image = { workspace = true, features = ["png"] }
- walkdir = { workspace = true }
-diff --git a/scanner/Cargo.toml b/scanner/Cargo.toml
-index 59781ba79..40cf54c24 100644
---- a/scanner/Cargo.toml
-+++ b/scanner/Cargo.toml
-@@ -12,7 +12,7 @@ workspace = true
-
- [dependencies]
- clap = { workspace = true }
--ruffle_core = { path = "../core", features = ["deterministic"] }
-+ruffle_core = { path = "../core" }
- log = { workspace = true }
- walkdir = { workspace = true }
- serde = { workspace = true, features = ["derive"] }
-diff --git a/tests/Cargo.toml b/tests/Cargo.toml
-index 26bfc9a89..b7342b662 100644
---- a/tests/Cargo.toml
-+++ b/tests/Cargo.toml
-@@ -27,7 +27,7 @@ ruffle_render_wgpu = { path = "../render/wgpu", optional = true }
- regex = "1.11.1"
-
- [dev-dependencies]
--ruffle_core = { path = "../core", features = ["deterministic", "timeline_debug", "avm_debug", "audio", "mp3", "aac", "default_font", "test_only_as3"] }
-+ruffle_core = { path = "../core", features = ["timeline_debug", "avm_debug", "audio", "mp3", "aac", "default_font", "test_only_as3"] }
- ruffle_test_framework = { path = "framework" }
- libtest-mimic = "0.8.1"
- walkdir = { workspace = true }
-diff --git a/tests/framework/Cargo.toml b/tests/framework/Cargo.toml
-index ffc59e25b..639028578 100644
---- a/tests/framework/Cargo.toml
-+++ b/tests/framework/Cargo.toml
-@@ -11,7 +11,7 @@ version.workspace = true
- workspace = true
-
- [dependencies]
--ruffle_core = { path = "../../core", features = ["deterministic", "timeline_debug", "avm_debug", "audio", "mp3", "aac", "default_font", "serde"] }
-+ruffle_core = { path = "../../core", features = ["timeline_debug", "avm_debug", "audio", "mp3", "aac", "default_font", "serde"] }
- ruffle_render = { path = "../../render", features = ["serde"] }
- ruffle_input_format = { path = "../input-format" }
- ruffle_socket_format = { path = "../socket-format" }

pkgs/by-name/sa/sage/sage-src.nix

···
 # all get the same sources with the same patches applied.
 
 stdenv.mkDerivation rec {
-  version = "10.6.rc1";
+  version = "10.6";
   pname = "sage-src";
 
   src = fetchFromGitHub {
     owner = "sagemath";
     repo = "sage";
     rev = version;
-    hash = "sha256-fhCKe0mz3Rwz+HQJWkMj6/0gbvpVW1/ENCMNWkK5ngQ=";
+    hash = "sha256-ZDYFq2lJXjnADFdX6y7sskaF0rkT5EIcdN8/bs00TlQ=";
   };
 
   # contains essential files (e.g., setup.cfg) generated by the bootstrap script.
···
   configure-src = fetchurl {
     # the hash below is the tagged commit's _parent_. it can also be found by looking for
     # the "configure" asset at https://github.com/sagemath/sage/releases/tag/${version}
-    url = "mirror://sageupstream/configure/configure-8dab37468c9feb4a5a1fcc22bbccc12321aaa475.tar.gz";
-    hash = "sha256-WqaUbmqZ7qwrgp8hRjOO7vhTejE0tCiQeMhBcJLsqvI=";
+    url = "mirror://sageupstream/configure/configure-10741006a4794b7db82942db55b97033d5905431.tar.gz";
+    hash = "sha256-7LqY+vwBlyukDfcRtuR99vpC3hcBo8WRUuJjiFFq9xk=";
   };
 
   # Patches needed because of particularities of nix or the way this is packaged.

pkgs/by-name/ta/tailwindcss_4/package.nix

···
   makeWrapper,
 }:
 let
-  version = "4.1.0";
+  version = "4.1.1";
   inherit (stdenv.hostPlatform) system;
   throwSystem = throw "tailwindcss has not been packaged for ${system} yet.";
 
···
 
   hash =
     {
-      aarch64-darwin = "sha256-g9Gj/LN4tEJRrNjAjtfhX+5l35PoL0O/aydCP1vSuTs=";
-      aarch64-linux = "sha256-85HVxqx9GPqfa6CgSBi42sW9LbmqKrKqjHyENjrb4HM=";
-      x86_64-darwin = "sha256-i4jtB/5K3jp7ujcj2Yk2JntEDnC1hHWohgvWxuV29OA=";
-      x86_64-linux = "sha256-hTek5N0YFtYAzMF/XrGolxxuDwvOanABe/8p5385RNk=";
+      aarch64-darwin = "sha256-moydWSkhoHmxd+4zeWwgneUNHOlJ9yqPXlGHhCQmYXA=";
+      aarch64-linux = "sha256-zTW+fGIkpwWRYMRJjZRJmO4YI5J6gOXOKUfq9KtGxKI=";
+      x86_64-darwin = "sha256-JPnnUj30uQVvj+dnq7+fG4Trt7ArLVPsP4G1RVUeZAA=";
+      x86_64-linux = "sha256-jIW4NmIW7dk3iTS0JY5V7PF9LfnWIVEDcYOUP0nWp1Y=";
     }
     .${system} or throwSystem;
 in

pkgs/by-name/tt/ttfb/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "ttfb";
-  version = "1.14.0";
+  version = "1.15.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-TElRWWPTwigyLikda7FdDh0tSC67XdPDg/Gu5aVQlAw=";
+    hash = "sha256-OOVqCWeF5cHMweEGWYIiWWWsw1QlNDFgnia05Qxo7uo=";
   };
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
···
   ];
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-NXwSqTshaC5hnyruSQFgFQRqRTmINMnMZsaisuudqvY=";
+  cargoHash = "sha256-4Nsg5/66enMgAfPrUQHuhOTTwG2OWyyvKMHIhPnlHko=";
 
   # The bin feature activates all dependencies of the binary. Otherwise,
   # only the library is build.

pkgs/by-name/un/unicode-idna/package.nix

···
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "unicode-idna";
+  version = "16.0.0";
+
+  src = fetchurl {
+    url = "https://www.unicode.org/Public/idna/${finalAttrs.version}/IdnaMappingTable.txt";
+    hash = "sha256-bbLvTtNfOz3nTrwuAEBKlgf3bUmfV2uNQEPPFPHtF1w=";
+  };
+
+  dontUnpack = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/unicode/idna
+    cp -r $src $out/share/unicode/idna/IdnaMappingTable.txt
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "unicode IDNA compatible processing data";
+    homepage = "http://www.unicode.org/reports/tr46/";
+    license = lib.licenses.unicode-dfs-2016;
+    maintainers = with lib.maintainers; [ jopejoe1 ];
+    platforms = lib.platforms.all;
+  };
+})

pkgs/by-name/ve/vectorcode/package.nix

···
   python3Packages,
   fetchFromGitHub,
   versionCheckHook,
+
+  lspSupport ? true,
 }:
 
 python3Packages.buildPythonApplication rec {
···
     pdm-backend
   ];
 
-  dependencies = with python3Packages; [
-    chromadb
-    httpx
-    numpy
-    pathspec
-    psutil
-    pygments
-    sentence-transformers
-    shtab
-    tabulate
-    transformers
-    tree-sitter
-    tree-sitter-language-pack
-  ];
+  dependencies =
+    with python3Packages;
+    [
+      chromadb
+      httpx
+      numpy
+      pathspec
+      psutil
+      pygments
+      sentence-transformers
+      shtab
+      tabulate
+      transformers
+      tree-sitter
+      tree-sitter-language-pack
+    ]
+    ++ lib.optionals lspSupport optional-dependencies.lsp;
 
   optional-dependencies = with python3Packages; {
     intel = [

pkgs/by-name/vs/vsce/package.nix

···
   nix-update-script,
 }:
 
-buildNpmPackage rec {
+buildNpmPackage (finalAttrs: {
   pname = "vsce";
-  version = "3.3.0";
+  version = "3.3.2";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "vscode-vsce";
-    rev = "v${version}";
-    hash = "sha256-z2OxVK/zbKr1AvWO74aoZHU/e3GPCF0QMINdNhbzNXc=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-6Rls+t1NkU1bZuT8ZWpKYeGmAdMpNFuYGfdZhtszZQ8=";
   };
 
-  npmDepsHash = "sha256-RIurea4cdH47q9axGtNTIZMeDOAqqdjovaE34A7M2uI=";
+  npmDepsHash = "sha256-HZkzH5flOPiTUvFW/DOi5n034RAvMoU9lRvB6Omdb2M=";
 
   postPatch = ''
-    substituteInPlace package.json --replace-fail '"version": "0.0.0"' '"version": "${version}"'
+    substituteInPlace package.json --replace-fail '"version": "0.0.0"' '"version": "${finalAttrs.version}"'
   '';
 
   nativeBuildInputs = [
···
     license = lib.licenses.mit;
     mainProgram = "vsce";
   };
-}
+})

pkgs/by-name/xe/xercesc/package.nix

···
   lib,
   fetchurl,
   curl,
+  icu,
 }:
 
 stdenv.mkDerivation rec {
···
 
   buildInputs = [
     curl
+    icu
   ];
 
   configureFlags = [
     # Disable SSE2 extensions on platforms for which they are not enabled by default
     "--disable-sse2"
     "--enable-netaccessor-curl"
+    "--enable-transcoder-icu"
   ];
 
   enableParallelBuilding = true;

pkgs/development/compilers/llvm/common/default.nix

···
     }
     // lib.optionalAttrs (lib.versionAtLeast metadata.release_version "16") {
       mlir = callPackage ./mlir { };
-      libclc = callPackage ./libclc.nix { };
+      libclc = callPackage ./libclc { };
     }
     // lib.optionalAttrs (lib.versionAtLeast metadata.release_version "19") {
       bolt = callPackage ./bolt {

pkgs/development/compilers/llvm/common/libclc.nix pkgs/development/compilers/llvm/common/libclc/default.nix

···
     ln -s "${lib.getExe' buildLlvmTools.clang.cc "clang"}" "$out"/bin
   '';
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libclc";
   inherit version;
 
-  src = runCommand "${pname}-src-${version}" { inherit (monorepoSrc) passthru; } (
+  src = runCommand "libclc-src-${version}" { inherit (monorepoSrc) passthru; } (
     ''
       mkdir -p "$out"
     ''
···
       cp -r ${monorepoSrc}/cmake "$out"
     ''
     + ''
-      cp -r ${monorepoSrc}/${pname} "$out"
+      cp -r ${monorepoSrc}/libclc "$out"
     ''
   );
 
-  sourceRoot = "${src.name}/${pname}";
+  sourceRoot = "${finalAttrs.src.name}/libclc";
 
   outputs = [
     "out"
···
   ];
 
   patches =
-    [ ./libclc/libclc-gnu-install-dirs.patch ]
+    [ ./libclc-gnu-install-dirs.patch ]
     # LLVM 19 changes how host tools are looked up.
     # Need to remove NO_DEFAULT_PATH and the PATHS arguments for find_program
     # so CMake can actually find the tools in nativeBuildInputs.
···
     license = licenses.mit;
     platforms = platforms.all;
   };
-}
+})

pkgs/development/compilers/llvm/default.nix

···
     "17.0.6".officialRelease.sha256 = "sha256-8MEDLLhocshmxoEBRSKlJ/GzJ8nfuzQ8qn0X/vLA+ag=";
     "18.1.8".officialRelease.sha256 = "sha256-iiZKMRo/WxJaBXct9GdAcAT3cz9d9pnAcO1mmR6oPNE=";
     "19.1.7".officialRelease.sha256 = "sha256-cZAB5vZjeTsXt9QHbP5xluWNQnAHByHtHnAhVDV0E6I=";
-    "20.1.1".officialRelease.sha256 = "sha256-hDFYi5wAUDQ8xfjvbGFi05KdawrN9lwrrSC8AcTpCEE=";
+    "20.1.2".officialRelease.sha256 = "sha256-t30Jh8ckp5qD6XDxtvnSaYiAWbEi6L6hAWh6tN8JjtY=";
     "21.0.0-git".gitRelease = {
-      rev = "b32cf756994cbab83e50b9d84df03d5ee03f31f8";
-      rev-version = "21.0.0-unstable-2025-03-23";
-      sha256 = "sha256-6PuKOT8TozoOcN1muWt08jHGLMQTogtMOQIFa8TTQoY=";
+      rev = "65734de9b93bef5b3211298b4fcc5dc79d18d31e";
+      rev-version = "21.0.0-unstable-2025-03-30";
+      sha256 = "sha256-v7/Goj8lc+8AUX/nJeqRcaudZAQoAwBZ9FtrDYX87ns=";
     };
   } // llvmVersions;
 

pkgs/development/python-modules/certbot-dns-google/default.nix

···
   acme,
   certbot,
   google-api-python-client,
-  oauth2client,
+  google-auth,
   pytestCheckHook,
-  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "certbot-dns-google";
-  format = "setuptools";
-
   inherit (certbot) src version;
-  disabled = pythonOlder "3.6";
+  pyproject = true;
 
   sourceRoot = "${src.name}/certbot-dns-google";
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     acme
     certbot
     google-api-python-client
-    oauth2client
+    google-auth
   ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
   pytestFlagsArray = [
     "-p no:cacheprovider"
-    # https://github.com/certbot/certbot/issues/9988
-    "-Wignore::DeprecationWarning"
   ];
 
   meta = certbot.meta // {

pkgs/development/python-modules/google-api-python-client/default.nix

···
   google-api-core,
   httplib2,
   uritemplate,
-  oauth2client,
   setuptools,
   pythonOlder,
 }:
···
     google-api-core
     httplib2
     uritemplate
-    oauth2client
   ];
 
   # No tests included in archive

pkgs/development/python-modules/google-auth/default.nix

···
   freezegun,
   grpcio,
   mock,
-  oauth2client,
   pyasn1-modules,
   pyjwt,
   pyopenssl,
···
     requests = [ requests ];
   };
 
-  nativeCheckInputs =
-    [
-      aioresponses
-      flask
-      freezegun
-      grpcio
-      mock
-    ]
-    ++ lib.optionals (pythonOlder "3.13") [
-      oauth2client
-    ]
-    ++ [
-      pytest-asyncio
-      pytest-localserver
-      pytestCheckHook
-      responses
-    ]
-    ++ lib.flatten (lib.attrValues optional-dependencies);
+  nativeCheckInputs = [
+    aioresponses
+    flask
+    freezegun
+    grpcio
+    mock
+    pytest-asyncio
+    pytest-localserver
+    pytestCheckHook
+    responses
+  ] ++ lib.flatten (lib.attrValues optional-dependencies);
 
   pythonImportsCheck = [
     "google.auth"

pkgs/development/python-modules/pathy/default.nix

···
   pythonImportsCheck = [ "pathy" ];
 
   meta = with lib; {
+    # https://github.com/justindujardin/pathy/issues/113
+    broken = pathlib-abc.version != "0.1.1";
     description = "Path interface for local and cloud bucket storage";
     mainProgram = "pathy";
     homepage = "https://github.com/justindujardin/pathy";

pkgs/development/python-modules/types-pytz/default.nix

···
 
 buildPythonPackage rec {
   pname = "types-pytz";
-  version = "2025.1.0.20250318";
+  version = "2025.2.0.20250326";
   pyproject = true;
 
   src = fetchPypi {
     pname = "types_pytz";
     inherit version;
-    hash = "sha256-l+DjUYTG/hTjpQFFEgV/LFe7DGWC1jwc/MSAn4IYBEk=";
+    hash = "sha256-3toC3iT1JwZvyNahnihKs/OucWpCtK22tA515AjAjTY=";
   };
 
   build-system = [ setuptools ];

pkgs/development/tools/parsing/tree-sitter/grammars/default.nix

···
   tree-sitter-elm = lib.importJSON ./tree-sitter-elm.json;
   tree-sitter-embedded-template = lib.importJSON ./tree-sitter-embedded-template.json;
   tree-sitter-erlang = lib.importJSON ./tree-sitter-erlang.json;
+  tree-sitter-factor = lib.importJSON ./tree-sitter-factor.json;
   tree-sitter-fennel = lib.importJSON ./tree-sitter-fennel.json;
   tree-sitter-fish = lib.importJSON ./tree-sitter-fish.json;
   tree-sitter-fortran = lib.importJSON ./tree-sitter-fortran.json;

pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-factor.json

···
+{
+  "url": "https://github.com/erochest/tree-sitter-factor",
+  "rev": "554d8b705df61864eb41a0ecf3741e94eb9f0c54",
+  "date": "2025-01-11T21:45:26-05:00",
+  "path": "/nix/store/yvyrq221kqwjq19hw6lf8xzxj6z080d8-tree-sitter-factor",
+  "sha256": "14yciinyczi7h8dny0cgk5ghlfwjlgz1zqndwrk260n1994k5bb7",
+  "hash": "sha256-Z60ySUrBAiNm5s3iH/6jkjsKX5mPAW8bgid+5m2MzJM=",
+  "fetchLFS": false,
+  "fetchSubmodules": false,
+  "deepClone": false,
+  "leaveDotGit": false
+}

pkgs/development/tools/parsing/tree-sitter/update.nix

···
       orga = "MunifTanjim";
       repo = "tree-sitter-lua";
     };
+    "tree-sitter-factor" = {
+      orga = "erochest";
+      repo = "tree-sitter-factor";
+    };
     "tree-sitter-fennel" = {
       orga = "travonted";
       repo = "tree-sitter-fennel";

pkgs/os-specific/linux/kernel/zen-kernels.nix

···
     };
     # ./update-zen.py lqx
     lqx = {
-      version = "6.13.8"; # lqx
+      version = "6.14.0"; # lqx
       suffix = "lqx1"; # lqx
-      sha256 = "0r61imcqlqndmjxgzjjb2p4g2kfxdndm32qzai2jcg21910c2j2m"; # lqx
+      sha256 = "1py2zg8wr5azr88ixm04v3nvlfihk7iimzc7sdjgz2mb0ji5kxjc"; # lqx
       isLqx = true;
     };
   };

pkgs/top-level/all-packages.nix

···
     pythonPackages = python3Packages;
   };
 
-  gitlint = python3Packages.callPackage ../applications/version-management/gitlint { };
-
   gitmux = callPackage ../applications/version-management/gitmux { };
 
   gittyup = libsForQt5.callPackage ../applications/version-management/gittyup { };