Merge master into staging-next

2025-04-16 15:38:16 +00:00 · 2025-04-08 18:04:25 +00:00 · 2025-04-08 18:04:25 +00:00 · a72dfbca8f
commit a72dfbca8f
parent 7a14f3c857 0f8029409e
86 changed files with 1371 additions and 558 deletions
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@ -75,6 +75,8 @@

 - [MaryTTS](https://github.com/marytts/marytts), an open-source, multilingual text-to-speech synthesis system written in pure Java. Available as [services.marytts](options.html#opt-services.marytts).

+- [Reposilite](https://reposilite.com), a lightweight and easy-to-use repository manager for Maven-based artifacts in the JVM ecosystem. Available as [services.reposilite](options.html#opt-services.reposilite).
+
 - [networking.modemmanager](options.html#opt-networking.modemmanager) has been split out of [networking.networkmanager](options.html#opt-networking.networkmanager). NetworkManager still enables ModemManager by default, but options exist now to run NetworkManager without ModemManager.

 - [Routinator 3000](https://nlnetlabs.nl/projects/routing/routinator/), a full-featured RPKI Relying Party software package that runs as a service which periodically downloads and verifies RPKI data.
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1610,6 +1610,7 @@
  ./services/web-apps/pretix.nix
  ./services/web-apps/privatebin.nix
  ./services/web-apps/prosody-filer.nix
+  ./services/web-apps/reposilite.nix
  ./services/web-apps/rimgo.nix
  ./services/web-apps/rutorrent.nix
  ./services/web-apps/screego.nix
--- a/nixos/modules/services/security/cfssl.nix
+++ b/nixos/modules/services/security/cfssl.nix
@ -164,6 +164,12 @@ in
      ];
      description = "Log level (0 = DEBUG, 5 = FATAL).";
    };
+
+    disable = lib.mkOption {
+      default = null;
+      type = lib.types.nullOr lib.types.commas;
+      description = "Endpoints to disable (comma-separated list)";
+    };
  };

  config = lib.mkIf cfg.enable {
@ -218,6 +224,7 @@ in
              (opt "tls-remote-ca" tlsRemoteCa)
              (opt "db-config" dbConfig)
              (opt "loglevel" (toString logLevel))
+              (opt "disable" disable)
            ];
        }
        (lib.mkIf (cfg.dataDir == options.services.cfssl.dataDir.default) {
--- a/nixos/modules/services/web-apps/reposilite.nix
+++ b/nixos/modules/services/web-apps/reposilite.nix
@ -0,0 +1,439 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.reposilite;
+  format = pkgs.formats.cdn { };
+  configFile = format.generate "reposilite.cdn" cfg.settings;
+
+  useEmbeddedDb = cfg.database.type == "sqlite" || cfg.database.type == "h2";
+  useMySQL = cfg.database.type == "mariadb" || cfg.database.type == "mysql";
+  usePostgres = cfg.database.type == "postgresql";
+
+  # db password is appended at runtime by the service script (if needed)
+  dbString =
+    if useEmbeddedDb then
+      "${cfg.database.type} ${cfg.database.path}"
+    else
+      "${cfg.database.type} ${cfg.database.host}:${builtins.toString cfg.database.port} ${cfg.database.dbname} ${cfg.database.user} $(<${cfg.database.passwordFile})";
+
+  certDir = config.security.acme.certs.${cfg.useACMEHost}.directory;
+
+  databaseModule = {
+    options = {
+      type = lib.mkOption {
+        type = lib.types.enum [
+          "h2"
+          "mariadb"
+          "mysql"
+          "postgresql"
+          "sqlite"
+        ];
+        description = ''
+          Database engine to use.
+        '';
+        default = "sqlite";
+      };
+
+      path = lib.mkOption {
+        type = lib.types.str;
+        description = ''
+          Path to the embedded database file. Set to `--temporary` to use an in-memory database.
+        '';
+        default = "reposilite.db";
+      };
+
+      host = lib.mkOption {
+        type = lib.types.str;
+        description = ''
+          Database host address.
+        '';
+        default = "127.0.0.1";
+      };
+
+      port = lib.mkOption {
+        type = lib.types.port;
+        description = ''
+          Database TCP port.
+        '';
+        defaultText = lib.literalExpression ''
+          if type == "postgresql" then 5432 else 3306
+        '';
+        default = if usePostgres then config.services.postgresql.settings.port else 3306;
+      };
+
+      dbname = lib.mkOption {
+        type = lib.types.str;
+        description = ''
+          Database name.
+        '';
+        default = "reposilite";
+      };
+
+      user = lib.mkOption {
+        type = lib.types.str;
+        description = ''
+          Database user.
+        '';
+        default = "reposilite";
+      };
+
+      passwordFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
+        description = ''
+          Path to the file containing the password for the database connection.
+          This file must be readable by {option}`services.reposilite.user`.
+        '';
+        default = null;
+      };
+    };
+  };
+
+  settingsModule = {
+    freeformType = format.type;
+    options = {
+      hostname = lib.mkOption {
+        type = lib.types.str;
+        description = ''
+          The hostname to bind to. Set to `0.0.0.0` to accept connections from everywhere, or `127.0.0.1` to restrict to localhost."
+        '';
+        default = "0.0.0.0";
+        example = "127.0.0.1";
+      };
+
+      port = lib.mkOption {
+        type = lib.types.port;
+        description = ''
+          The TCP port to bind to.
+        '';
+        default = 3000;
+      };
+
+      database = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        description = ''
+          Database connection string. Please use {option}`services.reposilite.database` instead.
+          See https://reposilite.com/guide/general#local-configuration for valid values.
+        '';
+        default = null;
+      };
+
+      sslEnabled = lib.mkOption {
+        type = lib.types.bool;
+        description = ''
+          Whether to listen for encrypted connections on {option}`settings.sslPort`.
+        '';
+        default = false;
+      };
+
+      sslPort = lib.mkOption {
+        type = lib.types.port; # cant be null
+        description = "SSL port to bind to. SSL needs to be enabled explicitly via {option}`settings.enableSsl`.";
+        default = 443;
+      };
+
+      keyPath = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        description = ''
+          Path to the .jsk KeyStore or paths to the PKCS#8 certificate and private key, separated by a space (see example).
+          You can use `''${WORKING_DIRECTORY}` to refer to paths relative to Reposilite's working directory.
+          If you are using a Java KeyStore, don't forget to specify the password via the {var}`REPOSILITE_LOCAL_KEYPASSWORD` environment variable.
+          See https://reposilite.com/guide/ssl for more information on how to set SSL up.
+        '';
+        default = null;
+        example = "\${WORKING_DIRECTORY}/cert.pem \${WORKING_DIRECTORY}/key.pem";
+      };
+
+      keyPassword = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        description = ''
+          Plaintext password used to unlock the Java KeyStore set in {option}`services.reposilite.settings.keyPath`.
+          WARNING: this option is insecure and should not be used to store the password.
+          Consider using {option}`services.reposilite.keyPasswordFile` instead.
+        '';
+        default = null;
+      };
+
+      enforceSsl = lib.mkOption {
+        type = lib.types.bool;
+        description = ''
+          Whether to redirect all traffic to SSL.
+        '';
+        default = false;
+      };
+
+      webThreadPool = lib.mkOption {
+        type = lib.types.ints.between 5 65535;
+        description = ''
+          Maximum amount of threads used by the core thread pool. (min: 5)
+          The web thread pool handles the first few steps of incoming HTTP connections, tasks are redirected as soon as possible to the IO thread pool.
+        '';
+        default = 16;
+      };
+
+      ioThreadPool = lib.mkOption {
+        type = lib.types.ints.between 2 65535;
+        description = ''
+          The IO thread pool handles all tasks that may benefit from non-blocking IO. (min: 2)
+          Because most tasks are redirected to IO thread pool, it might be a good idea to keep it at least equal to web thread pool.
+        '';
+        default = 8;
+      };
+
+      databaseThreadPool = lib.mkOption {
+        type = lib.types.ints.positive;
+        description = ''
+          Maximum amount of concurrent connections to the database. (one per thread)
+          Embedded databases (sqlite, h2) do not support truly concurrent connections, so the value will always be `1` if they are used.
+        '';
+        default = 1;
+      };
+
+      compressionStrategy = lib.mkOption {
+        type = lib.types.enum [
+          "none"
+          "gzip"
+        ];
+        description = ''
+          Compression algorithm used by this instance of Reposilite.
+          `none` reduces usage of CPU & memory, but requires transfering more data.
+        '';
+        default = "none";
+      };
+
+      idleTimeout = lib.mkOption {
+        type = lib.types.ints.unsigned;
+        description = ''
+          Default idle timeout used by Jetty.
+        '';
+        default = 30000;
+      };
+
+      bypassExternalCache = lib.mkOption {
+        type = lib.types.bool;
+        description = ''
+          Add cache bypass headers to responses from /api/* to avoid issues with proxies such as Cloudflare.
+        '';
+        default = true;
+      };
+
+      cachedLogSize = lib.mkOption {
+        type = lib.types.ints.unsigned;
+        description = ''
+          Amount of messages stored in the cache logger.
+        '';
+        default = 50;
+      };
+
+      defaultFrontend = lib.mkOption {
+        type = lib.types.bool;
+        description = ''
+          Whether to enable the default included frontend with a dashboard.
+        '';
+        default = true;
+      };
+
+      basePath = lib.mkOption {
+        type = lib.types.str;
+        description = ''
+          Custom base path for this Reposilite instance.
+          It is not recommended changing this, you should instead prioritize using a different subdomain.
+        '';
+        default = "/";
+      };
+
+      debugEnabled = lib.mkOption {
+        type = lib.types.bool;
+        description = ''
+          Whether to enable debug mode.
+        '';
+        default = false;
+      };
+    };
+  };
+in
+{
+  options.services.reposilite = {
+    enable = lib.mkEnableOption "Reposilite";
+    package = lib.mkPackageOption pkgs "reposilite" { } // {
+      apply =
+        pkg:
+        pkg.override (old: {
+          plugins = (old.plugins or [ ]) ++ cfg.plugins;
+        });
+    };
+
+    plugins = lib.mkOption {
+      type = lib.types.listOf lib.types.package;
+      description = ''
+        List of plugins to add to Reposilite.
+      '';
+      default = [ ];
+      example = "with reposilitePlugins; [ checksum groovy ]";
+    };
+
+    database = lib.mkOption {
+      description = "Database options.";
+      default = { };
+      type = lib.types.submodule databaseModule;
+    };
+
+    keyPasswordFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      description = ''
+        Path the the file containing the password used to unlock the Java KeyStore file specified in {option}`services.reposilite.settings.keyPath`.
+        This file must be readable my {option}`services.reposilite.user`.
+      '';
+      default = null;
+    };
+
+    useACMEHost = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      description = ''
+        Host of an existing Let's Encrypt certificate to use for SSL.
+        Make sure that the certificate directory is readable by the `reposilite` user or group, for example via {option}`security.acme.certs.<cert>.group`.
+        *Note that this option does not create any certificates, nor it does add subdomains to existing ones – you will need to create them manually using {option}`security.acme.certs`*
+      '';
+      default = null;
+    };
+
+    settings = lib.mkOption {
+      description = "Configuration written to the reposilite.cdn file";
+      default = { };
+      type = lib.types.submodule settingsModule;
+    };
+
+    workingDirectory = lib.mkOption {
+      type = lib.types.path;
+      description = ''
+        Working directory for Reposilite.
+      '';
+      default = "/var/lib/reposilite";
+    };
+
+    extraArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      description = ''
+        Extra arguments/parameters passed to the Reposilite. Can be used for first token generation.
+      '';
+      default = [ ];
+      example = lib.literalExpression ''[ "--token" "name:tempsecrettoken" ]'';
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      description = ''
+        The user to run Reposilite under.
+      '';
+      default = "reposilite";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      description = ''
+        The group to run Reposilite under.
+      '';
+      default = "reposilite";
+    };
+
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
+      description = ''
+        Whether to open the firewall ports for Reposilite. If SSL is enabled, its port will be opened too.
+      '';
+      default = false;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.settings.sslEnabled -> cfg.settings.keyPath != null;
+        message = ''
+          Reposilite was configured to enable SSL, but no valid paths to certificate files were provided via `settings.keyPath`.
+          Read more about SSL certificates here: https://reposilite.com/guide/ssl
+        '';
+      }
+      {
+        assertion = cfg.settings.enforceSsl -> cfg.settings.sslEnabled;
+        message = "You cannot enforce SSL if SSL is not enabled.";
+      }
+      {
+        assertion = !useEmbeddedDb -> cfg.database.passwordFile != null;
+        message = "You need to set `services.reposilite.database.passwordFile` when using MySQL or Postgres.";
+      }
+    ];
+
+    services.reposilite.settings.keyPath = lib.mkIf (
+      cfg.useACMEHost != null
+    ) "${certDir}/fullchain.pem ${certDir}/key.pem";
+
+    environment.systemPackages = [ cfg.package ];
+
+    users = {
+      groups.${cfg.group} = lib.mkIf (cfg.group == "reposilite") { };
+      users.${cfg.user} = lib.mkIf (cfg.user == "reposilite") {
+        isSystemUser = true;
+        group = cfg.group;
+      };
+    };
+
+    networking.firewall = lib.mkIf cfg.openFirewall (
+      lib.mkMerge [
+        {
+          allowedTCPPorts = [ cfg.settings.port ];
+        }
+        (lib.mkIf cfg.settings.sslEnabled {
+          allowedTCPPorts = [ cfg.settings.sslPort ];
+        })
+      ]
+    );
+
+    systemd.services.reposilite = {
+      enable = true;
+      wantedBy = [ "multi-user.target" ];
+      after =
+        [ "network.target" ]
+        ++ (lib.optional useMySQL "mysql.service")
+        ++ (lib.optional usePostgres "postgresql.service");
+
+      script =
+        lib.optionalString (cfg.keyPasswordFile != null && cfg.settings.keyPassword == null) ''
+          export REPOSILITE_LOCAL_KEYPASSWORD="$(<${cfg.keyPasswordFile})"
+        ''
+        + ''
+          export REPOSILITE_LOCAL_DATABASE="${dbString}"
+
+          ${lib.getExe cfg.package} --local-configuration ${configFile} --local-configuration-mode none --working-directory ${cfg.workingDirectory} ${lib.escapeShellArgs cfg.extraArgs}
+        '';
+
+      serviceConfig = lib.mkMerge [
+        (lib.mkIf (builtins.dirOf cfg.workingDirectory == "/var/lib") {
+          StateDirectory = builtins.baseNameOf cfg.workingDirectory;
+          StateDirectoryMode = "700";
+        })
+        {
+          Type = "exec";
+          Restart = "on-failure";
+
+          User = cfg.user;
+          Group = cfg.group;
+          WorkingDirectory = cfg.workingDirectory;
+
+          # TODO better hardening
+          LimitNOFILE = "1048576";
+          PrivateTmp = true;
+          PrivateDevices = true;
+          ProtectHome = true;
+          ProtectSystem = "strict";
+          AmbientCapabilities = "CAP_NET_BIND_SERVICE";
+        }
+      ];
+    };
+  };
+
+  meta.maintainers = [ lib.maintainers.uku3lig ];
+}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -1148,6 +1148,7 @@ in
  redmine = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./redmine.nix { };
  renovate = handleTest ./renovate.nix { };
  replace-dependencies = handleTest ./replace-dependencies { };
+  reposilite = runTest ./reposilite.nix;
  restartByActivationScript = handleTest ./restart-by-activation-script.nix { };
  restic-rest-server = handleTest ./restic-rest-server.nix { };
  restic = handleTest ./restic.nix { };
--- a/nixos/tests/envfs.nix
+++ b/nixos/tests/envfs.nix
@ -25,8 +25,6 @@ import ./make-test-python.nix (
          "PATH= /usr/bin/env --version",
          "PATH= test -e /usr/bin/sh",
          "PATH= test -e /usr/bin/env",
-          # no stat
-          "! test -e /usr/bin/cp",
          # also picks up PATH that was set after execve
          "! /usr/bin/hello",
          "PATH=${pkgs.hello}/bin /usr/bin/hello",
--- a/nixos/tests/reposilite.nix
+++ b/nixos/tests/reposilite.nix
@ -0,0 +1,53 @@
+{ lib, ... }:
+{
+  name = "reposilite";
+
+  nodes = {
+    machine =
+      { pkgs, ... }:
+      {
+        services = {
+          mysql = {
+            enable = true;
+            package = pkgs.mariadb;
+            ensureDatabases = [ "reposilite" ];
+            initialScript = pkgs.writeText "reposilite-test-db-init" ''
+              CREATE USER 'reposilite'@'localhost' IDENTIFIED BY 'ReposiliteDBPass';
+              GRANT ALL PRIVILEGES ON reposilite.* TO 'reposilite'@'localhost';
+              FLUSH PRIVILEGES;
+            '';
+          };
+
+          reposilite = {
+            enable = true;
+            plugins = with pkgs.reposilitePlugins; [
+              checksum
+              groovy
+            ];
+            extraArgs = [
+              "--token"
+              "test:SuperSecretTestToken"
+            ];
+            database = {
+              type = "mariadb";
+              passwordFile = "/run/reposiliteDbPass";
+            };
+            settings.port = 8080;
+          };
+        };
+      };
+  };
+
+  testScript = ''
+    machine.start()
+
+    machine.execute("echo \"ReposiliteDBPass\" > /run/reposiliteDbPass && chmod 600 /run/reposiliteDbPass && chown reposilite:reposilite /run/reposiliteDbPass")
+    machine.wait_for_unit("reposilite.service")
+    machine.wait_for_open_port(8080)
+
+    machine.fail("curl -Sf localhost:8080/api/auth/me")
+    machine.succeed("curl -Sfu test:SuperSecretTestToken localhost:8080/api/auth/me")
+  '';
+
+  meta.maintainers = [ lib.maintainers.uku3lig ];
+}
--- a/pkgs/applications/audio/calf/default.nix
+++ b/pkgs/applications/audio/calf/default.nix
@ -17,13 +17,13 @@
 }:
 stdenv.mkDerivation rec {
  pname = "calf";
-  version = "0.90.4";
+  version = "0.90.6";

  src = fetchFromGitHub {
    owner = "calf-studio-gear";
    repo = "calf";
    tag = version;
-    hash = "sha256-E9H2YG1HAhIN+zJxDKIJTkJapbNz8h9dfd5YfZp9Zp0=";
+    hash = "sha256-rcMuQFig6BrnyGFyvYaAHmOvabEHGl+1lMNfffLHn1w=";
  };

  outputs = [
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@ -82,9 +82,9 @@ let
        pname
        jdk
        extraWrapperArgs
-        extraLdPath
        extraBuildInputs
        ;
+      extraLdPath = extraLdPath ++ lib.optionals (stdenv.hostPlatform.isLinux) [ libGL ];
      src =
        if fromSource then
          communitySources."${pname}"
@ -336,7 +336,6 @@ rec {
        libICE
        libSM
        libX11
-        libGL
      ];
    }).overrideAttrs
      (attrs: {
@ -378,7 +377,6 @@ rec {
          libxcrypt-legacy
          fontconfig
          xorg.libX11
-          libGL
        ]
        ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
          expat
--- a/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix
+++ b/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix
@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "mednafen-pce-fast";
-  version = "0-unstable-2025-03-07";
+  version = "0-unstable-2025-03-28";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "beetle-pce-fast-libretro";
-    rev = "9f2b7943db1fb784daf0948b0b493bc7f76919f8";
-    hash = "sha256-fwrfZ0Z/DAtDRuBqxCS11/qNoomAtUgEOf4eOLk9vO0=";
+    rev = "4ee33ff536f14295c178a037f9b5d5a960ce3c6f";
+    hash = "sha256-ZL+aV469RHp5SSBFmK0q+1h2MdcM1q+TZu5Rrv/N0DU=";
  };

  makefile = "Makefile";
--- a/pkgs/applications/emulators/libretro/cores/bsnes.nix
+++ b/pkgs/applications/emulators/libretro/cores/bsnes.nix
@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "bsnes";
-  version = "0-unstable-2025-03-07";
+  version = "0-unstable-2025-04-04";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "bsnes-libretro";
-    rev = "ec353ea2502be9b71f3d9830b7a7b66ee69e254c";
-    hash = "sha256-9QRKEIi1JHd503KN9+DKxLMJMJWyNu9vomPAmlbb/zw=";
+    rev = "8d89089d35bedc257dc13bebd3790f70417311a5";
+    hash = "sha256-0n2N2Ks8MIy7dcuj2SESjDNxma7RRhAgOxQ5sC3XJTM=";
  };

  makefile = "Makefile";
--- a/pkgs/applications/emulators/libretro/cores/mame2003.nix
+++ b/pkgs/applications/emulators/libretro/cores/mame2003.nix
@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "mame2003";
-  version = "0-unstable-2025-03-18";
+  version = "0-unstable-2025-04-02";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "mame2003-libretro";
-    rev = "8565eec2e963b78f07a5a1f4b74df1271f3ece13";
-    hash = "sha256-pChPUwKIOtP4nl9ReqlrgxOJ/qcO6m2SnHhx3Y+hktM=";
+    rev = "a0547e84a8f58856551ca2d252f05f56212810a4";
+    hash = "sha256-POpKNpPOyOp/EkrUTa2esOJAaWoJvuijDToF6/V41uU=";
  };

  # Fix build with GCC 14
--- a/pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix
+++ b/pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix
@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "pcsx-rearmed";
-  version = "0-unstable-2025-03-26";
+  version = "0-unstable-2025-03-30";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "pcsx_rearmed";
-    rev = "4b0894f55fb7244b522fb720f41363e86f2085fe";
-    hash = "sha256-748TR87fO1BLBWwDAJxkEBr327g64RUTdBvvMu6lSEI=";
+    rev = "6091efb4d64ed745495455ba82352ec82f55cb4f";
+    hash = "sha256-9FyD3a6FE7xtt/UGvRNfopvQPgAg/0QGrJ1NNMEIsyg=";
  };

  dontConfigure = true;
--- a/pkgs/applications/emulators/libretro/cores/picodrive.nix
+++ b/pkgs/applications/emulators/libretro/cores/picodrive.nix
@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "picodrive";
-  version = "0-unstable-2025-03-25";
+  version = "0-unstable-2025-04-03";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "picodrive";
-    rev = "752c266491ae8775dab9a98dbd94472f42b9b16f";
-    hash = "sha256-l9qYOUyQzyleWeQv74rEOEwOk6iyH43WVIUHcC6Aw2Y=";
+    rev = "1a08d73159820bb31941d8c5ed6242a74bd4b332";
+    hash = "sha256-849XeceXoPHpOMlxVtHgL2TYQTHibUbGs0oHBEiCzvw=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/emulators/libretro/cores/play.nix
+++ b/pkgs/applications/emulators/libretro/cores/play.nix
@ -14,13 +14,13 @@
 }:
 mkLibretroCore {
  core = "play";
-  version = "0-unstable-2025-03-25";
+  version = "0-unstable-2025-04-04";

  src = fetchFromGitHub {
    owner = "jpd002";
    repo = "Play-";
-    rev = "01d094c0c3ed723b0747079afddfd319001f01d4";
-    hash = "sha256-o8tfYg88spRZBDokc/dkRsVvvfGejYVnDQfvQ1BBRps=";
+    rev = "225e37d0dc7b8a7bb6dc3534b992373477f9923d";
+    hash = "sha256-bY4RwJyS4R/vjae2UCi4SnIW04IzoQyMOYsW4f+UQg8=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/emulators/libretro/cores/scummvm.nix
+++ b/pkgs/applications/emulators/libretro/cores/scummvm.nix
@ -25,13 +25,13 @@ let
 in
 mkLibretroCore {
  core = "scummvm";
-  version = "0-unstable-2025-03-09";
+  version = "0-unstable-2025-04-05";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "scummvm";
-    rev = "8e9d265d81661dcffe0bc326e07e50af5d1d224a";
-    hash = "sha256-BdBQoj358uL7VNPZozRA4oEG5KS09rkucd80vQgkaDo=";
+    rev = "9d31b31c179fd4a43f7cfc383a3435a9070c6aa8";
+    hash = "sha256-E5e30Iowwr8pnryncnzlPjBhpIEuKqAHxHk+HwagEnE=";
  };

  extraBuildInputs = [
--- a/pkgs/applications/emulators/wine/sources.nix
+++ b/pkgs/applications/emulators/wine/sources.nix
@ -115,9 +115,9 @@ rec {

  unstable = fetchurl rec {
    # NOTE: Don't forget to change the hash for staging as well.
-    version = "10.4";
+    version = "10.5";
    url = "https://dl.winehq.org/wine/source/10.x/wine-${version}.tar.xz";
-    hash = "sha256-oJAZzlxCuga6kexCPUnY8qmo6sTBqSMMc+HRGWOdXpI=";
+    hash = "sha256-wDbsHvR2dHdKX5lFgwIuni62j+j8GLOox55oWzvsibw=";
    inherit (stable) patches;

    ## see http://wiki.winehq.org/Gecko
@ -163,7 +163,7 @@ rec {
  staging = fetchFromGitLab rec {
    # https://gitlab.winehq.org/wine/wine-staging
    inherit (unstable) version;
-    hash = "sha256-LteUANxr+w1N9r6LNztjRfr3yXtJnUMi0uayTRtFoSU=";
+    hash = "sha256-rXA/55rwQSJR247E4H7cQdTtXRmjomRbls7THV3jfcE=";
    domain = "gitlab.winehq.org";
    owner = "wine";
    repo = "wine-staging";
--- a/pkgs/applications/misc/plover/default.nix
+++ b/pkgs/applications/misc/plover/default.nix
@ -1,5 +1,6 @@
 {
  lib,
+  config,
  fetchFromGitHub,
  python3Packages,
  wmctrl,
@ -8,8 +9,6 @@
 }:

 {
-  stable = throw "plover.stable was removed because it used Python 2. Use plover.dev instead."; # added 2022-06-05
-
  dev =
    with python3Packages;
    mkDerivationWith buildPythonPackage rec {
@ -58,3 +57,6 @@
      '';
    };
 }
+// lib.optionalAttrs config.allowAliases {
+  stable = throw "plover.stable was removed because it used Python 2. Use plover.dev instead."; # added 2022-06-05
+}
--- a/pkgs/by-name/al/alive2/package.nix
+++ b/pkgs/by-name/al/alive2/package.nix
@ -24,17 +24,19 @@ clangStdenv.mkDerivation (finalAttrs: {

  nativeBuildInputs = [
    cmake
+    ninja
+    re2c
  ];
  buildInputs = [
-    re2c
    z3
    hiredis
    llvm_18
-    ninja
  ];
+  strictDeps = true;

  postPatch = ''
    substituteInPlace CMakeLists.txt \
+      --replace-fail '-Werror' "" \
      --replace-fail 'find_package(Git REQUIRED)' ""
  '';

--- a/pkgs/by-name/an/anyrun/package.nix
+++ b/pkgs/by-name/an/anyrun/package.nix
@ -17,13 +17,13 @@

 rustPlatform.buildRustPackage {
  pname = "anyrun";
-  version = "0-unstable-2024-12-27";
+  version = "0-unstable-2025-04-04";

  src = fetchFromGitHub {
    owner = "kirottu";
    repo = "anyrun";
-    rev = "06017e753c8886d5296768dca80745ee09402a2d";
-    hash = "sha256-jU88Q9tP4vuvWYGQcmOdFwI9e2uMPVYJHbXdiklIH9o=";
+    rev = "786f539d69d5abcefa68978dbaa964ac14536a00";
+    hash = "sha256-f+oXT9b3xuBDmm4v4nDqJvlHabxxZRB6+pay4Ub/NvA=";
  };

  useFetchCargoVendor = true;
--- a/pkgs/by-name/ap/appflowy/package.nix
+++ b/pkgs/by-name/ap/appflowy/package.nix
@ -17,11 +17,11 @@ let
    rec {
      x86_64-linux = {
        urlSuffix = "linux-x86_64.tar.gz";
-        hash = "sha256-e0G7J2BRRC+2MMqpvu5BNnimS7RRTjRBgo/j1T9iYWU=";
+        hash = "sha256-WUAyGx7RcLlQsYpfcbV69k1ESaif5VraxUFAslMi5lo=";
      };
      x86_64-darwin = {
        urlSuffix = "macos-universal.zip";
-        hash = "sha256-A9BCdYxeWPjCOZ/L0wYTVuqybLHfc1vsWWxAY7IJohw=";
+        hash = "sha256-fB6DCp2+7T9ozHuMdsv6IwwIyD6+t7LxVWMj9lDJ5Fw=";
      };
      aarch64-darwin = x86_64-darwin;
    }
@ -30,7 +30,7 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "appflowy";
-  version = "0.8.7";
+  version = "0.8.8";

  src = fetchzip {
    url = "https://github.com/AppFlowy-IO/appflowy/releases/download/${finalAttrs.version}/AppFlowy-${finalAttrs.version}-${dist.urlSuffix}";
--- a/pkgs/by-name/ba/backgroundremover/package.nix
+++ b/pkgs/by-name/ba/backgroundremover/package.nix
@ -11,7 +11,7 @@ let
  p = python3.pkgs;
  self = p.buildPythonApplication rec {
    pname = "backgroundremover";
-    version = "0.2.9";
+    version = "0.3.0";
    pyproject = true;

    build-system = [
@ -22,7 +22,7 @@ let
      owner = "nadermx";
      repo = "backgroundremover";
      rev = "v${version}";
-      hash = "sha256-tQ8J3xamOzPPSbFMxIDYKv1TzK1AVwF/DWXdZlrlYvM=";
+      hash = "sha256-fWazMDjc+EoXvO7Iq+zwtJaMEU64ajpO6JtlvU5T0nc=";
    };

    models = runCommand "background-remover-models" { } ''
--- a/pkgs/by-name/bi/bird2/package.nix
+++ b/pkgs/by-name/bi/bird2/package.nix
@ -11,11 +11,11 @@

 stdenv.mkDerivation rec {
  pname = "bird";
-  version = "2.16.1";
+  version = "2.17";

  src = fetchurl {
    url = "https://bird.network.cz/download/bird-${version}.tar.gz";
-    hash = "sha256-9uWcvMrKYmaK6gIGhyS9QnuexEnH4PD8VoFQOYjHNbQ=";
+    hash = "sha256-ebvMd8Y+nht6EKSDichvT3WwU/097Ejjxsvg3xuoHrM=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/bl/blockbench/package.nix
+++ b/pkgs/by-name/bl/blockbench/package.nix
@ -12,13 +12,13 @@

 buildNpmPackage rec {
  pname = "blockbench";
-  version = "4.12.2";
+  version = "4.12.4";

  src = fetchFromGitHub {
    owner = "JannisX11";
    repo = "blockbench";
    tag = "v${version}";
-    hash = "sha256-/OdSV/wTrs6roiPiSQCqCLrlWtkB11gm3DM7r7B4HUU=";
+    hash = "sha256-tg2ICxliTmahO3twKgC4LSVyiX9K2jfA7lCcSCkzcbQ=";
  };

  nativeBuildInputs =
@ -28,7 +28,7 @@ buildNpmPackage rec {
      copyDesktopItems
    ];

-  npmDepsHash = "sha256-ZM3hFMHuKl5BW1+10czESDknc9jIZ024mUSUdNHF3EM=";
+  npmDepsHash = "sha256-a5OjCVHPeaBEYTFIUOnc9We677oCGwAvwMv8f1QRk9Q=";

  env.ELECTRON_SKIP_BINARY_DOWNLOAD = 1;

@ -66,7 +66,7 @@ buildNpmPackage rec {

      for size in 16 32 48 64 128 256 512; do
        mkdir -p $out/share/icons/hicolor/"$size"x"$size"/apps
-        magick convert -resize "$size"x"$size" icon.png $out/share/icons/hicolor/"$size"x"$size"/apps/blockbench.png
+        magick icon.png -resize "$size"x"$size" $out/share/icons/hicolor/"$size"x"$size"/apps/blockbench.png
      done

      makeWrapper ${lib.getExe electron} $out/bin/blockbench \
--- a/pkgs/by-name/bu/burpsuite/package.nix
+++ b/pkgs/by-name/bu/burpsuite/package.nix
@ -9,20 +9,20 @@
 }:

 let
-  version = "2025.1.5";
+  version = "2025.2.3";

  product =
    if proEdition then
      {
        productName = "pro";
        productDesktop = "Burp Suite Professional Edition";
-        hash = "sha256-QTYeiM2hyZpvSu5oE2wrNrF3qFkp4JJnQftOg3BJqZA=";
+        hash = "sha256-eVtqlZHW1w10tUKlqdwFSbx2kJW5hEtfyq7MuBsNS4Q=";
      }
    else
      {
        productName = "community";
        productDesktop = "Burp Suite Community Edition";
-        hash = "sha256-vIcBRsylS+ftSq5x0HDe6Zb8dtVUtWw6hENBITYmzyQ=";
+        hash = "sha256-XWAaNAdPVxKS7/9uYWpAdbzHt+xNqpKCIOH7dVcUyaI=";
      };

  src = fetchurl {
@ -109,6 +109,7 @@ buildFHSEnv {
    hydraPlatforms = [ ];
    maintainers = with maintainers; [
      bennofs
+      blackzeshi
      fab
    ];
    mainProgram = "burpsuite";
--- a/pkgs/by-name/ch/chafa/package.nix
+++ b/pkgs/by-name/ch/chafa/package.nix
@ -16,7 +16,6 @@
  docbook_xml_dtd_412,
  docbook_xsl,
  glib,
-  Foundation,
 }:

 stdenv.mkDerivation rec {
--- a/pkgs/by-name/ch/chafa/xmlcatalog_patch.patch
+++ b/pkgs/by-name/ch/chafa/xmlcatalog_patch.patch
--- a/pkgs/by-name/cl/claude-code/package-lock.json
+++ b/pkgs/by-name/cl/claude-code/package-lock.json
@ -5,13 +5,13 @@
  "packages": {
    "": {
      "dependencies": {
-        "@anthropic-ai/claude-code": "^0.2.62"
+        "@anthropic-ai/claude-code": "^0.2.65"
      }
    },
    "node_modules/@anthropic-ai/claude-code": {
-      "version": "0.2.62",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-0.2.62.tgz",
-      "integrity": "sha512-Mod9/kbqKy344lm5YmDJLn8dR3HYlA2zGCQy4exU7hmECNqg3KlTAz8u4O4YdiRMxXeUJ3Izi9YSJUT7oZOKdg==",
+      "version": "0.2.65",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-0.2.65.tgz",
+      "integrity": "sha512-LCxFb/WeHoHfVhQfEQGbGlFURYCm5Brcff4GHD+lVX2N3GtexLTcf0iXElAYz3S2vlWX9km8nGVfB/Yd/ieVUw==",
      "hasInstallScript": true,
      "license": "SEE LICENSE IN README.md",
      "bin": {
--- a/pkgs/by-name/cl/claude-code/package.nix
+++ b/pkgs/by-name/cl/claude-code/package.nix
@ -6,14 +6,14 @@

 buildNpmPackage rec {
  pname = "claude-code";
-  version = "0.2.62";
+  version = "0.2.65";

  src = fetchzip {
    url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";
-    hash = "sha256-O6jkpx3OxEh/npZjyJb+osoeJrG+HZ6NRB9T4EMkdf8=";
+    hash = "sha256-4YFdDEpKi7agSqJUetcItqElec5VD0uQARwDSsh1S8o=";
  };

-  npmDepsHash = "sha256-tVA4VbPaPc+KwZzUK0QI9In3QSXXoELaNM2U65wxGGA=";
+  npmDepsHash = "sha256-157BP/8DfEBE2dhOYj3CGzlV7M2EE44L0Zr0qwAQoQw=";

  postPatch = ''
    cp ${./package-lock.json} package-lock.json
@ -24,8 +24,7 @@ buildNpmPackage rec {
  AUTHORIZED = "1";

  # `claude-code` tries to auto-update by default, this disables that functionality.
-  # Note that the `DISABLE_AUTOUPDATER` environment variable is not documented, so this trick may
-  # not continue to work.
+  # https://docs.anthropic.com/en/docs/agents-and-tools/claude-code/overview#environment-variables
  postInstall = ''
    wrapProgram $out/bin/claude \
      --set DISABLE_AUTOUPDATER 1
--- a/pkgs/by-name/co/cosmic-bg/package.nix
+++ b/pkgs/by-name/co/cosmic-bg/package.nix
@ -1,72 +1,64 @@
 {
  lib,
  stdenv,
-  stdenvAdapters,
  fetchFromGitHub,
  rustPlatform,
  libcosmicAppHook,
  just,
  nasm,
  nix-update-script,
-
-  withMoldLinker ? stdenv.targetPlatform.isLinux,
 }:

-rustPlatform.buildRustPackage.override
-  { stdenv = if withMoldLinker then stdenvAdapters.useMoldLinker stdenv else stdenv; }
-  (finalAttrs: {
-    pname = "cosmic-bg";
-    version = "1.0.0-alpha.6";
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "cosmic-bg";
+  version = "1.0.0-alpha.6";

-    src = fetchFromGitHub {
-      owner = "pop-os";
-      repo = "cosmic-bg";
-      tag = "epoch-${finalAttrs.version}";
-      hash = "sha256-4b4laUXTnAbdngLVh8/dD144m9QrGReSEjRZoNR6Iks=";
-    };
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = "cosmic-bg";
+    tag = "epoch-${finalAttrs.version}";
+    hash = "sha256-4b4laUXTnAbdngLVh8/dD144m9QrGReSEjRZoNR6Iks=";
+  };

-    useFetchCargoVendor = true;
-    cargoHash = "sha256-GLXooTjcGq4MsBNnlpHBBUJGNs5UjKMQJGJuj9UO2wk=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-GLXooTjcGq4MsBNnlpHBBUJGNs5UjKMQJGJuj9UO2wk=";

-    nativeBuildInputs = [
-      just
-      libcosmicAppHook
-      nasm
+  nativeBuildInputs = [
+    just
+    libcosmicAppHook
+    nasm
+  ];
+
+  dontUseJustBuild = true;
+  dontUseJustCheck = true;
+
+  justFlags = [
+    "--set"
+    "prefix"
+    (placeholder "out")
+    "--set"
+    "bin-src"
+    "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-bg"
+  ];
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version"
+      "unstable"
+      "--version-regex"
+      "epoch-(.*)"
    ];
+  };

-    dontUseJustBuild = true;
-    dontUseJustCheck = true;
-
-    justFlags = [
-      "--set"
-      "prefix"
-      (placeholder "out")
-      "--set"
-      "bin-src"
-      "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-bg"
+  meta = {
+    homepage = "https://github.com/pop-os/cosmic-bg";
+    description = "Applies Background for the COSMIC Desktop Environment";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [
+      nyabinary
+      HeitorAugustoLN
    ];
-
-    env."CARGO_TARGET_${stdenv.hostPlatform.rust.cargoEnvVarTarget}_RUSTFLAGS" =
-      lib.optionalString withMoldLinker "-C link-arg=-fuse-ld=mold";
-
-    passthru.updateScript = nix-update-script {
-      extraArgs = [
-        "--version"
-        "unstable"
-        "--version-regex"
-        "epoch-(.*)"
-      ];
-    };
-
-    meta = {
-      homepage = "https://github.com/pop-os/cosmic-bg";
-      description = "Applies Background for the COSMIC Desktop Environment";
-      license = lib.licenses.mpl20;
-      maintainers = with lib.maintainers; [
-        nyabinary
-        HeitorAugustoLN
-      ];
-      platforms = lib.platforms.linux;
-      mainProgram = "cosmic-bg";
-    };
-  })
+    platforms = lib.platforms.linux;
+    mainProgram = "cosmic-bg";
+  };
+})
--- a/pkgs/by-name/co/cosmic-launcher/package.nix
+++ b/pkgs/by-name/co/cosmic-launcher/package.nix
@ -1,70 +1,64 @@
 {
  lib,
  stdenv,
-  stdenvAdapters,
  fetchFromGitHub,
  rustPlatform,
  just,
  libcosmicAppHook,
  nix-update-script,
-
-  withMoldLinker ? stdenv.targetPlatform.isLinux,
 }:

-rustPlatform.buildRustPackage.override
-  { stdenv = if withMoldLinker then stdenvAdapters.useMoldLinker stdenv else stdenv; }
-  (finalAttrs: {
-    pname = "cosmic-launcher";
-    version = "1.0.0-alpha.6";
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "cosmic-launcher";
+  version = "1.0.0-alpha.6";

-    src = fetchFromGitHub {
-      owner = "pop-os";
-      repo = "cosmic-launcher";
-      tag = "epoch-${finalAttrs.version}";
-      hash = "sha256-BtYnL+qkM/aw+Air5yOKH098V+TQByM5mh1DX7v+v+s=";
-    };
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = "cosmic-launcher";
+    tag = "epoch-${finalAttrs.version}";
+    hash = "sha256-BtYnL+qkM/aw+Air5yOKH098V+TQByM5mh1DX7v+v+s=";
+  };

-    useFetchCargoVendor = true;
-    cargoHash = "sha256-g7Qr3C8jQg65KehXAhftdXCpEukag0w12ClvZFkxfqs=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-g7Qr3C8jQg65KehXAhftdXCpEukag0w12ClvZFkxfqs=";

-    nativeBuildInputs = [
-      just
-      libcosmicAppHook
+  nativeBuildInputs = [
+    just
+    libcosmicAppHook
+  ];
+
+  dontUseJustBuild = true;
+  dontUseJustCheck = true;
+
+  justFlags = [
+    "--set"
+    "prefix"
+    (placeholder "out")
+    "--set"
+    "bin-src"
+    "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-launcher"
+  ];
+
+  env."CARGO_TARGET_${stdenv.hostPlatform.rust.cargoEnvVarTarget}_RUSTFLAGS" = "--cfg tokio_unstable";
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version"
+      "unstable"
+      "--version-regex"
+      "epoch-(.*)"
    ];
+  };

-    dontUseJustBuild = true;
-    dontUseJustCheck = true;
-
-    justFlags = [
-      "--set"
-      "prefix"
-      (placeholder "out")
-      "--set"
-      "bin-src"
-      "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-launcher"
+  meta = {
+    homepage = "https://github.com/pop-os/cosmic-launcher";
+    description = "Launcher for the COSMIC Desktop Environment";
+    mainProgram = "cosmic-launcher";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [
+      nyabinary
+      HeitorAugustoLN
    ];
-
-    env."CARGO_TARGET_${stdenv.hostPlatform.rust.cargoEnvVarTarget}_RUSTFLAGS" =
-      "--cfg tokio_unstable${lib.optionalString withMoldLinker " -C link-arg=-fuse-ld=mold"}";
-
-    passthru.updateScript = nix-update-script {
-      extraArgs = [
-        "--version"
-        "unstable"
-        "--version-regex"
-        "epoch-(.*)"
-      ];
-    };
-
-    meta = {
-      homepage = "https://github.com/pop-os/cosmic-launcher";
-      description = "Launcher for the COSMIC Desktop Environment";
-      mainProgram = "cosmic-launcher";
-      license = lib.licenses.gpl3Only;
-      maintainers = with lib.maintainers; [
-        nyabinary
-        HeitorAugustoLN
-      ];
-      platforms = lib.platforms.linux;
-    };
-  })
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/co/cosmic-randr/package.nix
+++ b/pkgs/by-name/co/cosmic-randr/package.nix
@ -1,73 +1,65 @@
 {
  lib,
  stdenv,
-  stdenvAdapters,
  fetchFromGitHub,
  rustPlatform,
  just,
  pkg-config,
  wayland,
  nix-update-script,
-
-  withMoldLinker ? stdenv.targetPlatform.isLinux,
 }:

-rustPlatform.buildRustPackage.override
-  { stdenv = if withMoldLinker then stdenvAdapters.useMoldLinker stdenv else stdenv; }
-  (finalAttrs: {
-    pname = "cosmic-randr";
-    version = "1.0.0-alpha.6";
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "cosmic-randr";
+  version = "1.0.0-alpha.6";

-    src = fetchFromGitHub {
-      owner = "pop-os";
-      repo = "cosmic-randr";
-      tag = "epoch-${finalAttrs.version}";
-      hash = "sha256-Sqxe+vKonsK9MmJGtbrZHE7frfrjkHXysm0WQt7WSU4=";
-    };
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = "cosmic-randr";
+    tag = "epoch-${finalAttrs.version}";
+    hash = "sha256-Sqxe+vKonsK9MmJGtbrZHE7frfrjkHXysm0WQt7WSU4=";
+  };

-    useFetchCargoVendor = true;
-    cargoHash = "sha256-UQ/fhjUiniVeHRQYulYko4OxcWB6UhFuxH1dVAfAzIY=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-UQ/fhjUiniVeHRQYulYko4OxcWB6UhFuxH1dVAfAzIY=";

-    nativeBuildInputs = [
-      just
-      pkg-config
+  nativeBuildInputs = [
+    just
+    pkg-config
+  ];
+
+  buildInputs = [ wayland ];
+
+  dontUseJustBuild = true;
+  dontUseJustCheck = true;
+
+  justFlags = [
+    "--set"
+    "prefix"
+    (placeholder "out")
+    "--set"
+    "bin-src"
+    "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-randr"
+  ];
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version"
+      "unstable"
+      "--version-regex"
+      "epoch-(.*)"
    ];
+  };

-    buildInputs = [ wayland ];
-
-    dontUseJustBuild = true;
-    dontUseJustCheck = true;
-
-    justFlags = [
-      "--set"
-      "prefix"
-      (placeholder "out")
-      "--set"
-      "bin-src"
-      "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-randr"
+  meta = {
+    homepage = "https://github.com/pop-os/cosmic-randr";
+    description = "Library and utility for displaying and configuring Wayland outputs";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [
+      nyabinary
+      HeitorAugustoLN
    ];
-
-    env."CARGO_TARGET_${stdenv.hostPlatform.rust.cargoEnvVarTarget}_RUSTFLAGS" =
-      lib.optionalString withMoldLinker "-C link-arg=-fuse-ld=mold";
-
-    passthru.updateScript = nix-update-script {
-      extraArgs = [
-        "--version"
-        "unstable"
-        "--version-regex"
-        "epoch-(.*)"
-      ];
-    };
-
-    meta = {
-      homepage = "https://github.com/pop-os/cosmic-randr";
-      description = "Library and utility for displaying and configuring Wayland outputs";
-      license = lib.licenses.mpl20;
-      maintainers = with lib.maintainers; [
-        nyabinary
-        HeitorAugustoLN
-      ];
-      platforms = lib.platforms.linux;
-      mainProgram = "cosmic-randr";
-    };
-  })
+    platforms = lib.platforms.linux;
+    mainProgram = "cosmic-randr";
+  };
+})
--- a/pkgs/by-name/co/cosmic-settings/package.nix
+++ b/pkgs/by-name/co/cosmic-settings/package.nix
@ -1,7 +1,6 @@
 {
  lib,
  stdenv,
-  stdenvAdapters,
  fetchFromGitHub,
  rustPlatform,
  cmake,
@ -19,90 +18,83 @@
  cosmic-randr,
  xkeyboard_config,
  nix-update-script,
-
-  withMoldLinker ? stdenv.targetPlatform.isLinux,
 }:
 let
  libcosmicAppHook' = (libcosmicAppHook.__spliced.buildHost or libcosmicAppHook).override {
    includeSettings = false;
  };
 in
-rustPlatform.buildRustPackage.override
-  { stdenv = if withMoldLinker then stdenvAdapters.useMoldLinker stdenv else stdenv; }
-  (finalAttrs: {
-    pname = "cosmic-settings";
-    version = "1.0.0-alpha.6";
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "cosmic-settings";
+  version = "1.0.0-alpha.6";

-    src = fetchFromGitHub {
-      owner = "pop-os";
-      repo = "cosmic-settings";
-      tag = "epoch-${finalAttrs.version}";
-      hash = "sha256-UKg3TIpyaqtynk6wLFFPpv69F74hmqfMVPra2+iFbvE=";
-    };
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = "cosmic-settings";
+    tag = "epoch-${finalAttrs.version}";
+    hash = "sha256-UKg3TIpyaqtynk6wLFFPpv69F74hmqfMVPra2+iFbvE=";
+  };

-    useFetchCargoVendor = true;
-    cargoHash = "sha256-mf/Cw3/RLrCYgsk7JKCU2+oPn1VPbD+4JzkUmbd47m8=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-mf/Cw3/RLrCYgsk7JKCU2+oPn1VPbD+4JzkUmbd47m8=";

-    nativeBuildInputs = [
-      cmake
-      just
-      libcosmicAppHook'
-      pkg-config
-      rustPlatform.bindgenHook
-      util-linux
+  nativeBuildInputs = [
+    cmake
+    just
+    libcosmicAppHook'
+    pkg-config
+    rustPlatform.bindgenHook
+    util-linux
+  ];
+
+  buildInputs = [
+    expat
+    fontconfig
+    freetype
+    libinput
+    pipewire
+    pulseaudio
+    udev
+  ];
+
+  dontUseJustBuild = true;
+  dontUseJustCheck = true;
+
+  justFlags = [
+    "--set"
+    "prefix"
+    (placeholder "out")
+    "--set"
+    "bin-src"
+    "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-settings"
+  ];
+
+  preFixup = ''
+    libcosmicAppWrapperArgs+=(
+      --prefix PATH : ${lib.makeBinPath [ cosmic-randr ]}
+      --set-default X11_BASE_RULES_XML ${xkeyboard_config}/share/X11/xkb/rules/base.xml
+      --set-default X11_BASE_EXTRA_RULES_XML ${xkeyboard_config}/share/X11/xkb/rules/extra.xml
+    )
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version"
+      "unstable"
+      "--version-regex"
+      "epoch-(.*)"
    ];
+  };

-    buildInputs = [
-      expat
-      fontconfig
-      freetype
-      libinput
-      pipewire
-      pulseaudio
-      udev
+  meta = {
+    description = "Settings for the COSMIC Desktop Environment";
+    homepage = "https://github.com/pop-os/cosmic-settings";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "cosmic-settings";
+    maintainers = with lib.maintainers; [
+      nyabinary
+      HeitorAugustoLN
    ];
-
-    dontUseJustBuild = true;
-    dontUseJustCheck = true;
-
-    justFlags = [
-      "--set"
-      "prefix"
-      (placeholder "out")
-      "--set"
-      "bin-src"
-      "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-settings"
-    ];
-
-    env."CARGO_TARGET_${stdenv.hostPlatform.rust.cargoEnvVarTarget}_RUSTFLAGS" =
-      lib.optionalString withMoldLinker "-C link-arg=-fuse-ld=mold";
-
-    preFixup = ''
-      libcosmicAppWrapperArgs+=(
-        --prefix PATH : ${lib.makeBinPath [ cosmic-randr ]}
-        --set-default X11_BASE_RULES_XML ${xkeyboard_config}/share/X11/xkb/rules/base.xml
-        --set-default X11_BASE_EXTRA_RULES_XML ${xkeyboard_config}/share/X11/xkb/rules/extra.xml
-      )
-    '';
-
-    passthru.updateScript = nix-update-script {
-      extraArgs = [
-        "--version"
-        "unstable"
-        "--version-regex"
-        "epoch-(.*)"
-      ];
-    };
-
-    meta = {
-      description = "Settings for the COSMIC Desktop Environment";
-      homepage = "https://github.com/pop-os/cosmic-settings";
-      license = lib.licenses.gpl3Only;
-      mainProgram = "cosmic-settings";
-      maintainers = with lib.maintainers; [
-        nyabinary
-        HeitorAugustoLN
-      ];
-      platforms = lib.platforms.linux;
-    };
-  })
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/db/dbeaver-bin/package.nix
+++ b/pkgs/by-name/db/dbeaver-bin/package.nix
@ -17,7 +17,7 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "dbeaver-bin";
-  version = "25.0.1";
+  version = "25.0.2";

  src =
    let
@ -30,10 +30,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
        aarch64-darwin = "macos-aarch64.dmg";
      };
      hash = selectSystem {
-        x86_64-linux = "sha256-p4bVQxP5dazNPSGJN6tu2rsowLf5VPJN30W+q8HiUNM=";
-        aarch64-linux = "sha256-3vrJOqC5szOWcj/oDg3uc1BND5vfbMRR+MNTDcG4vk8=";
-        x86_64-darwin = "sha256-bu67Tz8awAQ69inY2s330g2qPan2tRLWImeYx9HB3tU=";
-        aarch64-darwin = "sha256-3TnswzRm3l7egoZttaOBSfO0aGasD56dOndMZ0howDI=";
+        x86_64-linux = "sha256-UmTy4Flxz/zIh3cLxRi7EhNDf0Ojc7fuzCbRKIE/+CQ=";
+        aarch64-linux = "sha256-I+V/2kfdxGx8zNkH98b2685IQPbVPSe9++qS4QEg0LU=";
+        x86_64-darwin = "sha256-8Qf69OHXPiqdMs//f1jbKbyKoll+oX+P+l3mpdOvraI=";
+        aarch64-darwin = "sha256-bGxn8y9hvJyqj1/i5tScufO5/ZjdlOlPChmeL+DWwoY=";
      };
    in
    fetchurl {
@ -89,10 +89,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
          }"

        mkdir -p $out/share/icons/hicolor/256x256/apps
-        # for some reason it's missing from the aarch64 build
-        if [ -e $out/opt/dbeaver/dbeaver.png ]; then
-          ln -s $out/opt/dbeaver/dbeaver.png $out/share/icons/hicolor/256x256/apps/dbeaver.png
-        fi
+        ln -s $out/opt/dbeaver/dbeaver.png $out/share/icons/hicolor/256x256/apps/dbeaver.png

        mkdir -p $out/share/applications
        ln -s $out/opt/dbeaver/dbeaver-ce.desktop $out/share/applications/dbeaver.desktop
--- a/pkgs/by-name/dp/dprint/plugins/default.nix
+++ b/pkgs/by-name/dp/dprint/plugins/default.nix
@ -13,7 +13,12 @@ let
      maintainers ? [ lib.maintainers.phanirithvij ],
    }:
    fetchurl {
-      inherit hash url;
+      inherit
+        hash
+        url
+        pname
+        version
+        ;
      name = "${pname}-${version}.wasm";
      meta = {
        inherit
--- a/pkgs/by-name/ej/ejabberd/package.nix
+++ b/pkgs/by-name/ej/ejabberd/package.nix
@ -53,21 +53,21 @@ let

  provider_asn1 = buildRebar3 {
    name = "provider_asn1";
-    version = "0.3.0";
+    version = "0.4.1";
    src = fetchHex {
      pkg = "provider_asn1";
-      version = "0.3.0";
-      sha256 = "sha256-MuelWYZi01rBut8jM6a5alMZizPGZoBE/LveSRu/+wU=";
+      version = "0.4.1";
+      sha256 = "sha256-HqR6IyJyJinvbPJJlhJE14yEiBbNmTGOmR0hqonrOR0=";
    };
    beamDeps = [ ];
  };
  rebar3_hex = buildRebar3 {
    name = "rebar3_hex";
-    version = "7.0.7";
+    version = "7.0.8";
    src = fetchHex {
      pkg = "rebar3_hex";
-      version = "7.0.7";
-      sha256 = "sha256-1S2igSwiInATUgULZ1E6e2dK6YI5gvRffHRfF1Gg5Ok=";
+      version = "7.0.8";
+      sha256 = "sha256-aEY0EEZwRHp6AAuE1pSfm5RjBjU+PaaJuKp7fvXRiBc=";
    };
    beamDeps = [ ];
  };
@ -141,7 +141,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "ejabberd";
-  version = "24.12";
+  version = "25.03";

  nativeBuildInputs = [
    makeWrapper
@ -170,17 +170,9 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "processone";
    repo = "ejabberd";
    tag = finalAttrs.version;
-    hash = "sha256-9TyIgsinUpUbirwqg61EYnPB/OyE5vhl3MBMRihqAtE=";
+    hash = "sha256-VEH1V8v2wQ9qf6Xcj00xHw30tWo0s9AhPyoB7d5B8k8=";
  };

-  patches = [
-    # Fix json_encode_with_kv_list used in mod_matrix_gw
-    (fetchpatch2 {
-      url = "https://github.com/processone/ejabberd/commit/056635119c8b9f169f1c59cccbf81faab88a6712.patch?full_index=1";
-      hash = "sha256-53NMT/SwPtaeo8zaJ1JHW6HUZrxkITi731UOdsFAlJ4=";
-    })
-  ];
-
  passthru.tests = {
    inherit (nixosTests) ejabberd;
  };
--- a/pkgs/by-name/ej/ejabberd/rebar-deps.nix
+++ b/pkgs/by-name/ej/ejabberd/rebar-deps.nix
@ -44,21 +44,21 @@ let
    };
    yconf = builder {
      name = "yconf";
-      version = "1.0.17";
+      version = "1.0.18";
      src = fetchHex {
        pkg = "yconf";
-        version = "1.0.17";
-        sha256 = "sha256-3SiSkjJBRJpGzIRXuewPsUAwcAc1pYhZVWd8c1w0GiU=";
+        version = "1.0.18";
+        sha256 = "sha256-+pUOxlA/ktZBf7jMHZgkA/BBaX6OG79NRYj7kZuVYuo=";
      };
      beamDeps = [ fast_yaml ];
    };
    xmpp = builder {
      name = "xmpp";
-      version = "1.9.1";
+      version = "1.10.0";
      src = fetchHex {
        pkg = "xmpp";
-        version = "1.9.1";
-        sha256 = "sha256-0rFDGvbkwaTIv5DK8MwRzesEe4MjuH6dfkgm1JEyddw=";
+        version = "1.10.0";
+        sha256 = "sha256-zurkO4/pdknY+FRrP38rOOz8kxwM3Vx0Rf+z+A/LfYU=";
      };
      beamDeps = [
        ezlib
@ -71,11 +71,11 @@ let
    };
    stun = builder {
      name = "stun";
-      version = "1.2.15";
+      version = "1.2.17";
      src = fetchHex {
        pkg = "stun";
-        version = "1.2.15";
-        sha256 = "sha256-9tilQaKf0T8s5li2dsDMZhJiuW4EW1Le8WRLdevA7e8=";
+        version = "1.2.17";
+        sha256 = "sha256-azGCRMIehSSpquOsmgXNgjTumUwcLIFd5o0wYIatdo0=";
      };
      beamDeps = [
        fast_tls
@ -84,11 +84,11 @@ let
    };
    stringprep = builder {
      name = "stringprep";
-      version = "1.0.30";
+      version = "1.0.31";
      src = fetchHex {
        pkg = "stringprep";
-        version = "1.0.30";
-        sha256 = "sha256-9vybM4SgOHeDD4my84WAyvP0onRIpKMz1qjDl1wiC5o=";
+        version = "1.0.31";
+        sha256 = "sha256-6WmciOjbFrOkHw5FrGh0pNqBpuSFSnfXbt5tCbCONTA=";
      };
      beamDeps = [ p1_utils ];
    };
@ -117,18 +117,18 @@ let
      version = "1.0.26";
      src = fetchHex {
        pkg = "p1_utils";
-        version = "1.0.26";
-        sha256 = "sha256-0DeejBFWuYvWT4Epwd4CL8yk8v23SGznO/DtLDN2sEw=";
+        version = "1.0.27";
+        sha256 = "sha256-8a+UKwpivPoNWfvjBnm+T/614kGgxJ7V8JTbL1uA9eA=";
      };
      beamDeps = [ ];
    };
    p1_pgsql = builder {
      name = "p1_pgsql";
-      version = "1.1.29";
+      version = "1.1.32";
      src = fetchHex {
        pkg = "p1_pgsql";
-        version = "1.1.29";
-        sha256 = "sha256-pv9Y6LF0mT84ldo+piEan50MVNGm4ouzIdo7PNaLOME=";
+        version = "1.1.32";
+        sha256 = "sha256-JosB6PTrdcIRoxSVolwoFcVJrszi8N8aFhxuCizeBh4=";
      };
      beamDeps = [ xmpp ];
    };
@ -144,11 +144,11 @@ let
    };
    p1_mysql = builder {
      name = "p1_mysql";
-      version = "1.0.25";
+      version = "1.0.26";
      src = fetchHex {
        pkg = "p1_mysql";
-        version = "1.0.25";
-        sha256 = "sha256-5hh/+ulbcmCY6I8+5vI0SsJZziwm4O5AOwX+7zQa5DQ=";
+        version = "1.0.26";
+        sha256 = "sha256-6hOAg/LFRxm5z1Sdv1gCooiwAZ6j5USbNUx0zAP6/ew=";
      };
      beamDeps = [ ];
    };
@ -250,11 +250,11 @@ let
    };
    esip = builder {
      name = "esip";
-      version = "1.0.56";
+      version = "1.0.57";
      src = fetchHex {
        pkg = "esip";
-        version = "1.0.56";
-        sha256 = "sha256-nvNmDO+TtiP3No3NXHn05wQ1hjGQnm3UZOM1N4gV2h8=";
+        version = "1.0.57";
+        sha256 = "sha256-GcNX4YF7HgR5LvNZv5AEAPPm0OWt6Sn9cviOqbRK8u0=";
      };
      beamDeps = [
        fast_tls
@ -284,11 +284,11 @@ let
    };
    eimp = builder {
      name = "eimp";
-      version = "1.0.23";
+      version = "1.0.24";
      src = fetchHex {
        pkg = "eimp";
-        version = "1.0.23";
-        sha256 = "sha256-kHx4ACPLKJPk/Evb5qTwLDVZE4Yqxn8OzCZgXoFrYoo=";
+        version = "1.0.24";
+        sha256 = "sha256-fWFDLrikVlnAvkdfROde62UXQ6pkod6K33hc2tgZYa0=";
      };
      beamDeps = [ p1_utils ];
    };
--- a/pkgs/by-name/en/envfs/package.nix
+++ b/pkgs/by-name/en/envfs/package.nix
@ -1,34 +1,42 @@
 {
-  rustPlatform,
  lib,
  fetchFromGitHub,
+  rustPlatform,
  nixosTests,
+  nix-update-script,
 }:
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
  pname = "envfs";
-  version = "1.0.6";
+  version = "1.1.0";
+
  src = fetchFromGitHub {
    owner = "Mic92";
    repo = "envfs";
-    rev = version;
-    hash = "sha256-kOfnKguvJQHW/AfQOetxVefjoEj7ec5ew6fumhOwP08=";
+    rev = finalAttrs.version;
+    hash = "sha256-bpATdm/lB+zomPYGCxA7omWK/SKPIaqr94J+fjMaXfE=";
  };
-  useFetchCargoVendor = true;
-  cargoHash = "sha256-VvdvYxNBzwJJy09npC30VaOzOU9Fwi++qon9Od4juHE=";

-  passthru.tests = {
-    envfs = nixosTests.envfs;
-  };
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-nMUdAFRHJZDwvLASBVykzzkwk3HxslDehqqm1U99qYg=";

  postInstall = ''
    ln -s envfs $out/bin/mount.envfs
    ln -s envfs $out/bin/mount.fuse.envfs
  '';
-  meta = with lib; {
+
+  passthru = {
+    tests = {
+      envfs = nixosTests.envfs;
+    };
+
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
    description = "Fuse filesystem that returns symlinks to executables based on the PATH of the requesting process";
    homepage = "https://github.com/Mic92/envfs";
-    license = licenses.mit;
-    maintainers = with maintainers; [ mic92 ];
-    platforms = platforms.linux;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ mic92 ];
+    platforms = lib.platforms.linux;
  };
-}
+})
--- a/pkgs/by-name/gr/grafana-alloy/package.nix
+++ b/pkgs/by-name/gr/grafana-alloy/package.nix
@ -146,7 +146,6 @@ buildGoModule rec {
    maintainers = with maintainers; [
      azahi
      flokli
-      emilylange
      hbjydev
    ];
    platforms = lib.platforms.unix;
--- a/pkgs/by-name/he/heynote/package.nix
+++ b/pkgs/by-name/he/heynote/package.nix
@ -7,11 +7,11 @@
 }:
 let
  pname = "heynote";
-  version = "2.1.3";
+  version = "2.1.4";

  src = fetchurl {
    url = "https://github.com/heyman/heynote/releases/download/v${version}/Heynote_${version}_x86_64.AppImage";
-    sha256 = "sha256-O8loDE2GzXQofh3iNQeP5OAWh7i0QCSxl4I++ERcjbU=";
+    sha256 = "sha256-nei4akpXA5MWpQSL/oIcwfNILTKE3lwSi1ij68FMMtQ=";
  };

  appimageContents = appimageTools.extractType2 {
--- a/pkgs/by-name/hm/hmcl/package.nix
+++ b/pkgs/by-name/hm/hmcl/package.nix
@ -21,7 +21,7 @@
 }:

 let
-  version = "3.6.11";
+  version = "3.6.12";
  icon = fetchurl {
    url = "https://github.com/huanghongxun/HMCL/raw/release-${version}/HMCLauncher/HMCL/HMCL.ico";
    hash = "sha256-+EYL33VAzKHOMp9iXoJaSGZfv+ymDDYIx6i/1o47Dmc=";
@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://github.com/huanghongxun/HMCL/releases/download/release-${version}/HMCL-${version}.jar";
-    hash = "sha256-ZQNJm7xbOdVSnxtx4krOnM9QBsxibFXo8wx1fCn1gJA=";
+    hash = "sha256-ofrG7CVZIODJoHE6owR9P7viBlChamYF5PEpFeeOH4E=";
  };

  dontUnpack = true;
--- a/pkgs/by-name/ho/homer/0001-build-enable-specifying-custom-sass-compiler-path-by.patch
+++ b/pkgs/by-name/ho/homer/0001-build-enable-specifying-custom-sass-compiler-path-by.patch
@ -12,21 +12,20 @@ Signed-off-by: Christoph Heiss <christoph@c8h4.io>
 3 files changed, 41 insertions(+), 16 deletions(-)
 create mode 100644 patches/sass-embedded.patch

-diff --git a/package.json b/package.json
-index 87e57b9..723e0b6 100644
--- a/package.json
-+++ b/package.json
-@@ -28,5 +28,10 @@
-     "vite-plugin-pwa": "^0.21.1"
-   },
+diff --git i/package.json w/package.json
+index 897b42e..7a91a85 100644
+--- i/package.json
+++ w/package.json
+@@ -32,6 +32,9 @@
   "license": "Apache-2.0",
-  "packageManager": "pnpm@9.15.4+sha512.b2dc20e2fc72b3e18848459b37359a32064663e5627a51e4c74b2c29dd8e8e0491483c3abb40789cfd578bf362fb6ba8261b05f0387d76792ed6e23ea3b1b6a0"
-+  "packageManager": "pnpm@9.15.4+sha512.b2dc20e2fc72b3e18848459b37359a32064663e5627a51e4c74b2c29dd8e8e0491483c3abb40789cfd578bf362fb6ba8261b05f0387d76792ed6e23ea3b1b6a0",
-+  "pnpm": {
+   "packageManager": "pnpm@10.4.1+sha512.c753b6c3ad7afa13af388fa6d808035a008e30ea9993f58c6663e2bc5ff21679aa834db094987129aa4d488b86df57f7b634981b2f827cdcacc698cc0cfb88af",
+   "pnpm": {
+-    "neverBuiltDependencies": []
+    "neverBuiltDependencies": [],
 +    "patchedDependencies": {
 +      "sass-embedded": "patches/sass-embedded.patch"
 +    }
-+  }
+   }
 }
 diff --git a/patches/sass-embedded.patch b/patches/sass-embedded.patch
 new file mode 100644
@ -49,10 +48,10 @@ index 0000000..f941a8e
 +     const platform = process.platform === 'linux' && isLinuxMusl(process.execPath)
 +         ? 'linux-musl'
 +         : process.platform;
-diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
-index f347757..d054bea 100644
--- a/pnpm-lock.yaml
-+++ b/pnpm-lock.yaml
+diff --git i/pnpm-lock.yaml w/pnpm-lock.yaml
+index 5df58fb..bb27c4b 100644
+--- i/pnpm-lock.yaml
+++ w/pnpm-lock.yaml
@@ -4,6 +4,11 @@ settings:
   autoInstallPeers: true
   excludeLinksFromLockfile: false
@ -65,80 +64,79 @@ index f347757..d054bea 100644
 importers:

   .:
-@@ -26,7 +31,7 @@ importers:
-     devDependencies:
+@@ -29,7 +34,7 @@ importers:
+         version: 9.21.0
       '@vitejs/plugin-vue':
         specifier: ^5.2.1
-        version: 5.2.1(vite@6.0.11(sass-embedded@1.83.4)(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0))(vue@3.5.13)
-+        version: 5.2.1(vite@6.0.11(sass-embedded@1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0))(vue@3.5.13)
+-        version: 5.2.1(vite@6.1.3(sass-embedded@1.85.0)(terser@5.39.0)(yaml@2.7.0))(vue@3.5.13)
+        version: 5.2.1(vite@6.1.3(sass-embedded@1.85.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(terser@5.39.0)(yaml@2.7.0))(vue@3.5.13)
       '@vue/eslint-config-prettier':
         specifier: ^10.2.0
-         version: 10.2.0(eslint@9.19.0)(prettier@3.4.2)
-@@ -44,13 +49,13 @@ importers:
-         version: 3.4.2
+         version: 10.2.0(eslint@9.21.0)(prettier@3.5.2)
+@@ -50,13 +55,13 @@ importers:
+         version: 3.5.2
       sass-embedded:
-         specifier: ^1.83.4
-        version: 1.83.4
-+        version: 1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi)
+         specifier: ^1.85.0
+-        version: 1.85.0
+        version: 1.85.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi)
       vite:
-         specifier: ^6.0.11
-        version: 6.0.11(sass-embedded@1.83.4)(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0)
-+        version: 6.0.11(sass-embedded@1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0)
+         specifier: ^6.1.3
+-        version: 6.1.3(sass-embedded@1.85.0)(terser@5.39.0)(yaml@2.7.0)
+        version: 6.1.3(sass-embedded@1.85.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(terser@5.39.0)(yaml@2.7.0)
       vite-plugin-pwa:
         specifier: ^0.21.1
-        version: 0.21.1(vite@6.0.11(sass-embedded@1.83.4)(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0))(workbox-build@7.1.0)(workbox-window@7.1.0)
-+        version: 0.21.1(vite@6.0.11(sass-embedded@1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0))(workbox-build@7.1.0)(workbox-window@7.1.0)
+-        version: 0.21.1(vite@6.1.3(sass-embedded@1.85.0)(terser@5.39.0)(yaml@2.7.0))(workbox-build@7.3.0)(workbox-window@7.3.0)
+        version: 0.21.1(vite@6.1.3(sass-embedded@1.85.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(terser@5.39.0)(yaml@2.7.0))(workbox-build@7.3.0)(workbox-window@7.3.0)

 packages:

-@@ -3683,9 +3688,9 @@ snapshots:
+@@ -3477,9 +3482,9 @@ snapshots:

   '@types/trusted-types@2.0.7': {}

-  '@vitejs/plugin-vue@5.2.1(vite@6.0.11(sass-embedded@1.83.4)(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0))(vue@3.5.13)':
-+  '@vitejs/plugin-vue@5.2.1(vite@6.0.11(sass-embedded@1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0))(vue@3.5.13)':
+-  '@vitejs/plugin-vue@5.2.1(vite@6.1.3(sass-embedded@1.85.0)(terser@5.39.0)(yaml@2.7.0))(vue@3.5.13)':
+  '@vitejs/plugin-vue@5.2.1(vite@6.1.3(sass-embedded@1.85.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(terser@5.39.0)(yaml@2.7.0))(vue@3.5.13)':
     dependencies:
-      vite: 6.0.11(sass-embedded@1.83.4)(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0)
-+      vite: 6.0.11(sass-embedded@1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0)
+-      vite: 6.1.3(sass-embedded@1.85.0)(terser@5.39.0)(yaml@2.7.0)
+      vite: 6.1.3(sass-embedded@1.85.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(terser@5.39.0)(yaml@2.7.0)
       vue: 3.5.13

   '@vue/compiler-core@3.5.13':
-@@ -4965,7 +4970,7 @@ snapshots:
-   sass-embedded-win32-x64@1.83.4:
+@@ -4702,7 +4707,7 @@ snapshots:
+   sass-embedded-win32-x64@1.85.0:
     optional: true

-  sass-embedded@1.83.4:
-+  sass-embedded@1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi):
+-  sass-embedded@1.85.0:
+  sass-embedded@1.85.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi):
     dependencies:
-       '@bufbuild/protobuf': 2.2.0
+       '@bufbuild/protobuf': 2.2.3
       buffer-builder: 0.2.0
-@@ -5286,18 +5291,18 @@ snapshots:
+@@ -5001,25 +5006,25 @@ snapshots:

   varint@6.0.0: {}

-  vite-plugin-pwa@0.21.1(vite@6.0.11(sass-embedded@1.83.4)(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0))(workbox-build@7.1.0)(workbox-window@7.1.0):
-+  vite-plugin-pwa@0.21.1(vite@6.0.11(sass-embedded@1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0))(workbox-build@7.1.0)(workbox-window@7.1.0):
+-  vite-plugin-pwa@0.21.1(vite@6.1.3(sass-embedded@1.85.0)(terser@5.39.0)(yaml@2.7.0))(workbox-build@7.3.0)(workbox-window@7.3.0):
+  vite-plugin-pwa@0.21.1(vite@6.1.3(sass-embedded@1.85.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(terser@5.39.0)(yaml@2.7.0))(workbox-build@7.3.0)(workbox-window@7.3.0):
     dependencies:
-       debug: 4.3.7
+       debug: 4.4.0
       pretty-bytes: 6.1.1
-       tinyglobby: 0.2.10
-      vite: 6.0.11(sass-embedded@1.83.4)(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0)
-+      vite: 6.0.11(sass-embedded@1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0)
-       workbox-build: 7.1.0
-       workbox-window: 7.1.0
+       tinyglobby: 0.2.12
+-      vite: 6.1.3(sass-embedded@1.85.0)(terser@5.39.0)(yaml@2.7.0)
+      vite: 6.1.3(sass-embedded@1.85.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(terser@5.39.0)(yaml@2.7.0)
+       workbox-build: 7.3.0
+       workbox-window: 7.3.0
     transitivePeerDependencies:
       - supports-color

-  vite@6.0.11(sass-embedded@1.83.4)(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0):
-+  vite@6.0.11(sass-embedded@1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.37.0)(yaml@2.7.0):
+-  vite@6.1.3(sass-embedded@1.85.0)(terser@5.39.0)(yaml@2.7.0):
+  vite@6.1.3(sass-embedded@1.85.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(terser@5.39.0)(yaml@2.7.0):
     dependencies:
       esbuild: 0.24.2
-       postcss: 8.5.1
-@@ -5305,7 +5310,7 @@ snapshots:
+       postcss: 8.5.3
+       rollup: 4.38.0
     optionalDependencies:
       fsevents: 2.3.3
-       sass: 1.79.5
-      sass-embedded: 1.83.4
-+      sass-embedded: 1.83.4(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi)
-       terser: 5.37.0
+-      sass-embedded: 1.85.0
+      sass-embedded: 1.85.0(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi)
+       terser: 5.39.0
       yaml: 2.7.0
--- a/pkgs/by-name/ho/homer/package.nix
+++ b/pkgs/by-name/ho/homer/package.nix
@ -10,12 +10,12 @@
 }:
 stdenvNoCC.mkDerivation rec {
  pname = "homer";
-  version = "25.02.1";
+  version = "25.04.1";
  src = fetchFromGitHub {
    owner = "bastienwirtz";
    repo = "homer";
    rev = "v${version}";
-    hash = "sha256-Fh6qV2eU7VRskbPun7OcJmqgjILVE8w5lV70xH6znmc=";
+    hash = "sha256-hvDrFGv6Mht9whA2lJbDLQnP2LkOiCo3NtjMpWr/q6A=";
  };

  pnpmDeps = pnpm_9.fetchDeps {
@ -25,7 +25,7 @@ stdenvNoCC.mkDerivation rec {
      src
      patches
      ;
-    hash = "sha256-qeMmPI2B5FW82qLVtbREDjQh76THMCOZRQCM0DgvCqI=";
+    hash = "sha256-y1R+rlaOtFOHHAgEHPBl40536U10Ft0iUSfGcfXS08Y=";
  };

  # Enables specifying a custom Sass compiler binary path via `SASS_EMBEDDED_BIN_PATH` environment variable.
--- a/pkgs/by-name/ho/hours/package.nix
+++ b/pkgs/by-name/ho/hours/package.nix
@ -0,0 +1,34 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+  stdenv,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "hours";
+  version = "0.5.0";
+
+  src = fetchFromGitHub {
+    owner = "dhth";
+    repo = "hours";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-B9M02THTCrr7ylbbflpkpTFMuoIwV2O0PQKOKbyxYPg=";
+  };
+
+  vendorHash = "sha256-5lhn0iTLmXUsaedvtyaL3qWLosmQaQVq5StMDl7pXXI=";
+
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "No-frills time tracking toolkit for command line nerds";
+    homepage = "https://github.com/dhth/hours";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.ilarvne ];
+    platforms = lib.platforms.unix;
+    mainProgram = "hours";
+  };
+})
--- a/pkgs/by-name/hy/hyprlock/package.nix
+++ b/pkgs/by-name/hy/hyprlock/package.nix
@ -28,13 +28,13 @@

 gcc14Stdenv.mkDerivation (finalAttrs: {
  pname = "hyprlock";
-  version = "0.7.0";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "hyprwm";
    repo = "hyprlock";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-U+8HOPgfrNkFEadoyB9GXSPPFW/Uytvb3TxyqW3JOw4=";
+    hash = "sha256-KTRgq+0rMBz31AAjrDvQprPHbVobCwIo9+gkcUujglw=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/hy/hyprutils/package.nix
+++ b/pkgs/by-name/hy/hyprutils/package.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "hyprutils";
-  version = "0.5.2";
+  version = "0.6.0";

  src = fetchFromGitHub {
    owner = "hyprwm";
    repo = "hyprutils";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-EV3945SnjOCuRVbGRghsWx/9D89FyshnSO1Q6/TuQ14=";
+    hash = "sha256-/6IAEWyb8gC/NKZElxiHChkouiUOrVYNq9YqG0Pzm4Y=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/kc/kclvm/package.nix
+++ b/pkgs/by-name/kc/kclvm/package.nix
@ -10,19 +10,19 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "kclvm";
-  version = "0.10.0";
+  version = "0.11.1";

  src = fetchFromGitHub {
    owner = "kcl-lang";
    repo = "kcl";
    rev = "v${version}";
-    hash = "sha256-OMPo2cT0ngwHuGghVSfGoDgf+FThj2GsZ3Myb1wSxQM=";
+    hash = "sha256-14yFGa8y8w3wbCmx0JOSN0TShXLZZpTdVynEfUKkjuE=";
  };

  sourceRoot = "${src.name}/kclvm";

  useFetchCargoVendor = true;
-  cargoHash = "sha256-xQgCiNt0lUvB5XmVB45l0GuIiVp5Jm6dZY7396Rsnqw=";
+  cargoHash = "sha256-o7YFyqRWAMjq23mcAqDrcN4infdBgp1KNvviYOLR35s=";

  buildInputs =
    [ rustc ]
--- a/pkgs/by-name/li/libphidget22/package.nix
+++ b/pkgs/by-name/li/libphidget22/package.nix
@ -7,7 +7,7 @@
 }:
 let
  # This package should be updated together with libphidget22extra
-  version = "1.21.20241122";
+  version = "1.22.20250324";
 in
 stdenv.mkDerivation {
  pname = "libphidget22";
@ -15,7 +15,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "https://www.phidgets.com/downloads/phidget22/libraries/linux/libphidget22/libphidget22-${version}.tar.gz";
-    hash = "sha256-6Sib9CSaPUbAdyHfoSgQ6g4oik7+pjb7g79QftSeVIk=";
+    hash = "sha256-FR/+b4z73LtGQdT4gypre9SZmZSiWzP/Q+00uia1lhA=";
  };

  nativeBuildInputs = [ automake ];
--- a/pkgs/by-name/li/libphidget22extra/package.nix
+++ b/pkgs/by-name/li/libphidget22extra/package.nix
@ -9,7 +9,7 @@
 let

  # This package should be updated together with libphidget22
-  version = "1.21.20241122";
+  version = "1.22.20250324";
 in
 stdenv.mkDerivation {
  pname = "libphidget22extra";
@ -17,7 +17,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "https://www.phidgets.com/downloads/phidget22/libraries/linux/libphidget22extra/libphidget22extra-${version}.tar.gz";
-    hash = "sha256-l8lwEpdR87U2pb0jOAkrI/157B+87QvSVtAtOfedaBo=";
+    hash = "sha256-8FTd/hyqzZKWN68FAxrV1N0pPglNAbZ/aRH4V6hEgBM=";
  };

  nativeBuildInputs = [ automake ];
--- a/pkgs/by-name/mq/mqttui/package.nix
+++ b/pkgs/by-name/mq/mqttui/package.nix
@ -8,17 +8,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "mqttui";
-  version = "0.22.0";
+  version = "0.22.1";

  src = fetchFromGitHub {
    owner = "EdJoPaTo";
    repo = "mqttui";
    tag = "v${version}";
-    hash = "sha256-q4C4YAs8Q1jHA5P2OApkFZnYM4/aZGxnE8Pd6Hmwd1I=";
+    hash = "sha256-wKqIDKng4pfqDuYtqFRh3UIeZQ4QzzFlLkQn5MXcVlU=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-pn4wmlMW8p6IAHrYjmvmZxNMjIJwJ2MYRsANz4D6xCU=";
+  cargoHash = "sha256-gk5nA6np7dK4+j26aySNWfMZ9t/+7nZRaPsnhlDEnes=";

  buildInputs = lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.Security;

--- a/pkgs/by-name/na/nano/package.nix
+++ b/pkgs/by-name/na/nano/package.nix
@ -46,11 +46,15 @@ stdenv.mkDerivation rec {
    "info"
  ];

-  configureFlags = [
-    "--sysconfdir=/etc"
-    (lib.enableFeature enableNls "nls")
-    (lib.enableFeature enableTiny "tiny")
-  ];
+  configureFlags =
+    [
+      "--sysconfdir=/etc"
+      (lib.enableFeature enableNls "nls")
+      (lib.enableFeature enableTiny "tiny")
+    ]
+    ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+      "gl_cv_func_strcasecmp_works=yes"
+    ];

  postInstall =
    if enableTiny then
@ -61,6 +65,7 @@ stdenv.mkDerivation rec {
      '';

  enableParallelBuilding = true;
+  strictDeps = true;

  passthru = {
    tests = {
--- a/pkgs/by-name/nu/nuclei/package.nix
+++ b/pkgs/by-name/nu/nuclei/package.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "nuclei";
-  version = "3.4.1";
+  version = "3.4.2";

  src = fetchFromGitHub {
    owner = "projectdiscovery";
    repo = "nuclei";
    tag = "v${version}";
-    hash = "sha256-ZSmyhNbZotNiqoXl4E+Pjap5zewPlwcTlPihcm4v6Qs=";
+    hash = "sha256-p3coR11+1xFQF3flIxfEP6HqQOD7+gHuT0ysOSKQyzc=";
  };

-  vendorHash = "sha256-tTFEDTUM3ldH3/NtqYx4LyEazp7o5qZ6ionu01Vxwrw=";
+  vendorHash = "sha256-cT8ZDp1GSdlgMr0i23i2WAVRmSbhwZZa/RKNPezr9l0=";

  proxyVendor = true; # hash mismatch between Linux and Darwin

--- a/pkgs/by-name/op/openct/package.nix
+++ b/pkgs/by-name/op/openct/package.nix
@ -3,28 +3,34 @@
  stdenv,
  fetchFromGitHub,
  autoreconfHook,
-  pkg-config,
-  pcsclite,
-  libusb-compat-0_1,
  doxygen,
  libxslt,
+  pkg-config,
+  pcsclite,
+  libtool,
+  libusb-compat-0_1,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "openct";
  version = "0.6.20";

  src = fetchFromGitHub {
    owner = "OpenSC";
    repo = "openct";
-    rev = "${pname}-${version}";
-    sha256 = "09wxq0jxdxhci3zr7jd3zcxjkl3j0r1v00k3q8gqrg9gighh8nk2";
+    rev = "openct-${finalAttrs.version}";
+    hash = "sha256-YloE4YsvvYwfwmMCsEMGctApO/ujyZP/iAz21iXAnSc=";
  };

  postPatch = ''
-    sed -i 's,$(DESTDIR),$(out),g' etc/Makefile.am
+    substituteInPlace etc/Makefile.am \
+      --replace-fail "DESTDIR" "out"
  '';

+  # unbreak build on GCC 14, remove when https://github.com/OpenSC/openct/pull/12
+  # (or equivalent) is merged and released
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
+
  configureFlags = [
    "--enable-api-doc"
    "--enable-usb"
@ -35,24 +41,29 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [
    autoreconfHook
+    doxygen
+    libxslt # xsltproc
    pkg-config
  ];
+
  buildInputs = [
    pcsclite
+    libtool # libltdl
    libusb-compat-0_1
-    doxygen
-    libxslt
  ];

+  strictDeps = true;
+
  preInstall = ''
    mkdir -p $out/etc
  '';

-  meta = with lib; {
-    broken = stdenv.hostPlatform.isDarwin;
+  meta = {
    homepage = "https://github.com/OpenSC/openct/";
-    license = licenses.lgpl21;
    description = "Drivers for several smart card readers";
-    platforms = platforms.all;
+    license = lib.licenses.lgpl21;
+    maintainers = [ ];
+    platforms = lib.platforms.all;
+    broken = stdenv.hostPlatform.isDarwin;
  };
-}
+})
--- a/pkgs/by-name/os/osm2pgsql/package.nix
+++ b/pkgs/by-name/os/osm2pgsql/package.nix
@ -25,13 +25,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "osm2pgsql";
-  version = "2.0.1";
+  version = "2.1.0";

  src = fetchFromGitHub {
    owner = "osm2pgsql-dev";
    repo = "osm2pgsql";
    rev = finalAttrs.version;
-    hash = "sha256-+EFvYloLm/cDOflqj6ZIgjFoljKhYBVIKxD8L9j2Hj4=";
+    hash = "sha256-YKlw/YIRogu0AbkRA3kZ4j4tbbVYbgVcLVYifYarmjE=";
  };

  postPatch = ''
--- a/pkgs/by-name/os/osv-scanner/package.nix
+++ b/pkgs/by-name/os/osv-scanner/package.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "osv-scanner";
-  version = "2.0.0";
+  version = "2.0.1";

  src = fetchFromGitHub {
    owner = "google";
    repo = "osv-scanner";
    tag = "v${version}";
-    hash = "sha256-iYbCCGZDTUbyW1XvQIpLZEtuzwUhTBAf3EfAwRX9qYU=";
+    hash = "sha256-jE1nzpUpt2WbaG6MQfji8k5qML7bi9mGSVFzQM3+DKQ=";
  };

-  vendorHash = "sha256-saD4RehZrKSC5V3A5r5prlq+080BFbhEp1Jo1rCbSHI=";
+  vendorHash = "sha256-E5u4BmsB/jSsGehtNFJEMja9T5YYKDqgwT7askcaAjA=";

  subPackages = [
    "cmd/osv-scanner"
--- a/pkgs/by-name/pi/picolibc/package.nix
+++ b/pkgs/by-name/pi/picolibc/package.nix
@ -0,0 +1,226 @@
+{
+  stdenv,
+  fetchFromGitHub,
+  lib,
+  meson,
+  ninja,
+  nix-update-script,
+  pkgsCross,
+
+  # General Build Options
+  # https://github.com/picolibc/picolibc/blob/e57b766cb5d80f23c20d05ab067001d85910f927/meson_options.txt#L40-L57
+  multilib ? true,
+  sanitize-bounds ? false,
+  sanitize-trap-on-error ? false,
+  profile ? false,
+  analyzer ? false,
+  assert-verbose ? true,
+  fast-strcmp ? true,
+
+  # Testing options
+  # https://github.com/picolibc/picolibc/blob/e57b766cb5d80f23c20d05ab067001d85910f927/meson_options.txt#L75
+  picolib ? stdenv.hostPlatform.isNone,
+  semihost ? stdenv.hostPlatform.isNone,
+
+  # Stdio Options
+  # https://github.com/picolibc/picolibc/blob/e57b766cb5d80f23c20d05ab067001d85910f927/meson_options.txt#L114
+  tinystdio ? true,
+  io-c99-formats ? true,
+  io-long-long ? false,
+  io-pos-args ? false,
+  io-long-double ? false,
+
+  # Tinystdio options
+  # https://github.com/picolibc/picolibc/blob/e57b766cb5d80f23c20d05ab067001d85910f927/meson_options.txt#L129
+  io-float-exact ? true,
+  atomic-ungetc ? true,
+  posix-console ? !stdenv.hostPlatform.isNone,
+  format-default ? "double",
+  printf-aliases ? true,
+  io-percent-b ? false,
+  printf-small-ultoa ? true,
+  printf-percent-n ? false,
+  minimal-io-long-long ? false,
+  fast-bufio ? false,
+  io-wchar ? false,
+
+  # Internaltionalization options
+  # https://github.com/picolibc/picolibc/blob/e57b766cb5d80f23c20d05ab067001d85910f927/meson_options.txt#L181
+  mb-capable ? false,
+  mb-extended-charsets ? false,
+  mb-ucs-charsets ? "auto",
+  mb-iso-charsets ? "auto",
+  mb-jis-charsets ? "auto",
+  mb-windows-charsets ? "auto",
+
+  # Startup/shutdown options
+  # https://github.com/picolibc/picolibc/blob/e57b766cb5d80f23c20d05ab067001d85910f927/meson_options.txt#L198
+  picocrt ? stdenv.hostPlatform.isNone,
+  picocrt-enable-mmu ? true,
+  picocrt-lib ? true,
+  picoexit ? true,
+  initfini-array ? true,
+  crt-runtime-size ? false,
+
+  # Legacy (non-picoexit) startup/shutdown options
+  # https://github.com/picolibc/picolibc/blob/e57b766cb5d80f23c20d05ab067001d85910f927/meson_options.txt#L217
+  newlib-atexit-dynamic-alloc ? false,
+  newlib-global-atexit ? !stdenv.hostPlatform.isNone,
+  newlib-register-fini ? false,
+
+  # Malloc options
+  # https://github.com/picolibc/picolibc/blob/e57b766cb5d80f23c20d05ab067001d85910f927/meson_options.txt#L228
+  newlib-nano-malloc ? true,
+  nano-malloc-clear-freed ? false,
+
+  # Locking options
+  # https://github.com/picolibc/picolibc/blob/e57b766cb5d80f23c20d05ab067001d85910f927/meson_options.txt#L237
+  single-thread ? false,
+
+  # TLS storage options
+  # https://github.com/picolibc/picolibc/blob/e57b766cb5d80f23c20d05ab067001d85910f927/meson_options.txt#L244
+  thread-local-storage ? "picolibc",
+  tls-model ? if stdenv.hostPlatform.isNone then "local-exec" else "global-dynamic",
+  newlib-global-errno ? false,
+  errno-function ? if stdenv.hostPlatform.isNone then "false" else "auto",
+  tls-rp2040 ? false,
+
+  # Math options
+  # https://github.com/picolibc/picolibc/blob/e57b766cb5d80f23c20d05ab067001d85910f927/meson_options.txt#L261
+  want-math-errno ? false,
+}:
+let
+  inherit (lib.strings) mesonBool mesonOption;
+
+  canExecute = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "picolibc";
+  version = "1.8.9";
+  strictDeps = true;
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchFromGitHub {
+    owner = "picolibc";
+    repo = finalAttrs.pname;
+    tag = finalAttrs.version;
+    hash = "sha256-W1zK9mLMfi5pbOpbSLxiB2qKdiyNjOSQu96NM94/fcY=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+  ];
+
+  # Default values taken from
+  # Build fails without using them.
+  # https://github.com/picolibc/picolibc/blob/e57b766cb5d80f23c20d05ab067001d85910f927/doc/os.md?plain=1#L183
+  mesonFlags =
+    [
+      (mesonBool "multilib" multilib)
+      (mesonBool "sanitize-bounds" sanitize-bounds)
+      (mesonBool "sanitize-trap-on-error" sanitize-trap-on-error)
+      (mesonBool "profile" profile)
+      (mesonBool "analyzer" analyzer)
+      (mesonBool "assert-verbose" assert-verbose)
+      (mesonBool "fast-strcmp" fast-strcmp)
+
+      # Testing options
+      (mesonBool "picolib" picolib)
+      (mesonBool "semihost" semihost)
+      (mesonBool "use-stdlib" true)
+
+      # Install options
+      (mesonOption "specsdir" "${placeholder "dev"}/lib")
+
+      (mesonBool "tinystdio" tinystdio)
+      (mesonBool "io-c99-formats" io-c99-formats)
+      (mesonBool "io-long-long" io-long-long)
+      (mesonBool "io-pos-args" io-pos-args)
+      (mesonBool "io-long-double" io-long-double)
+
+      (mesonBool "io-float-exact" io-float-exact)
+      (mesonBool "atomic-ungetc" atomic-ungetc)
+      (mesonBool "posix-console" posix-console)
+      (mesonOption "format-default" format-default)
+      (mesonBool "printf-aliases" printf-aliases)
+      (mesonBool "io-percent-b" io-percent-b)
+      (mesonBool "printf-small-ultoa" printf-small-ultoa)
+      (mesonBool "printf-percent-n" printf-percent-n)
+      (mesonBool "minimal-io-long-long" minimal-io-long-long)
+      (mesonBool "fast-bufio" fast-bufio)
+      (mesonBool "io-wchar" io-wchar)
+
+      (mesonBool "mb-capable" mb-capable)
+      (mesonBool "mb-extended-charsets" mb-extended-charsets)
+      (mesonOption "mb-ucs-charsets" mb-ucs-charsets)
+      (mesonOption "mb-iso-charsets" mb-iso-charsets)
+      (mesonOption "mb-jis-charsets" mb-jis-charsets)
+      (mesonOption "mb-windows-charsets" mb-windows-charsets)
+
+      (mesonBool "picocrt" picocrt)
+      (mesonBool "picocrt-enable-mmu" picocrt-enable-mmu)
+      (mesonBool "picocrt-lib" picocrt-lib)
+      (mesonBool "picoexit" picoexit)
+      (mesonBool "newlib-initfini-array" initfini-array)
+      (mesonBool "crt-runtime-size" crt-runtime-size)
+
+      (mesonBool "newlib-atexit-dynamic-alloc" newlib-atexit-dynamic-alloc)
+      (mesonBool "newlib-global-atexit" newlib-global-atexit)
+      (mesonBool "newlib-register-fini" newlib-register-fini)
+
+      (mesonBool "newlib-nano-malloc" newlib-nano-malloc)
+      (mesonBool "nano-malloc-clear-freed" nano-malloc-clear-freed)
+
+      (mesonBool "newlib-multithread" (!single-thread))
+
+      (mesonOption "thread-local-storage" thread-local-storage)
+      (mesonOption "tls-model" tls-model)
+      (mesonBool "newlib-global-errno" newlib-global-errno)
+      (mesonOption "errno-function" errno-function)
+      (mesonBool "tls-rp2040" tls-rp2040)
+
+      (mesonBool "want-math-errno" want-math-errno)
+    ]
+    ++ lib.optionals finalAttrs.doCheck [
+      (mesonBool "tests" true)
+      # Something is broken with this and I'm not sure what.
+      (mesonOption "tests-cdefs" "false")
+    ];
+
+  doCheck = canExecute;
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests = {
+      arm = pkgsCross.arm-embedded.picolibc;
+    };
+  };
+
+  meta =
+    let
+      inherit (lib) licenses maintainers;
+    in
+    {
+      description = "C library designed for embedded 32- and 64- bit systems";
+      longDescription = ''
+        Picolibc is library offering standard C library APIs that targets
+        small embedded systems with limited RAM. Picolibc was formed by blending
+        code from [Newlib](http://sourceware.org/newlib/) and
+        [AVR Libc](https://www.nongnu.org/avr-libc/).
+      '';
+      homepage = "https://keithp.com/picolibc/";
+      changelog = "https://github.com/picolibc/picolibc/releases/tag/${finalAttrs.version}";
+      license = [
+        licenses.bsd2
+        licenses.bsd3
+      ];
+      maintainers = [ maintainers.RossSmyth ];
+      # https://github.com/picolibc/picolibc/tree/db4d0fe5952d5ecd714781e3212d4086d970735a?tab=readme-ov-file#supported-architectures
+      platforms = lib.platforms.all;
+    };
+})
--- a/pkgs/by-name/pr/primecount/package.nix
+++ b/pkgs/by-name/pr/primecount/package.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "primecount";
-  version = "7.15";
+  version = "7.16";

  src = fetchFromGitHub {
    owner = "kimwalisch";
    repo = "primecount";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-UE+BEYynZGMBi3hjNX51I9cD/I1bbmfj9bO9r8UwwD0=";
+    hash = "sha256-wmq2AmpmDNJE7AEbn+sFbmLYR/ewdVQeEyWkmq16U9o=";
  };

  outputs = [
--- a/pkgs/by-name/ps/ps3-disc-dumper/package.nix
+++ b/pkgs/by-name/ps/ps3-disc-dumper/package.nix
@ -27,12 +27,6 @@ buildDotnetModule rec {
  projectFile = "UI.Avalonia/UI.Avalonia.csproj";
  nugetDeps = ./deps.json;

-  preConfigureNuGet = ''
-    # This should really be in the upstream nuget.config
-    dotnet nuget add source https://api.nuget.org/v3/index.json \
-      -n nuget.org --configfile nuget.config
-  '';
-
  runtimeDeps = [
    zlib
    openssl
--- a/pkgs/by-name/qu/quesoglc/package.nix
+++ b/pkgs/by-name/qu/quesoglc/package.nix
@ -10,13 +10,15 @@
  fribidi,
  libX11,
 }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "quesoglc";
  version = "0.7.2";
+
  src = fetchurl {
-    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "0cf9ljdzii5d4i2m23gdmf3kn521ljcldzq69lsdywjid3pg5zjl";
+    url = "mirror://sourceforge/quesoglc/quesoglc-${finalAttrs.version}.tar.bz2";
+    hash = "sha256-VP7y7mhRct80TQb/RpmkQRQ7h6vtDVFFJK3E+JukyTE=";
  };
+
  buildInputs = [
    libGLU
    libGL
@ -26,8 +28,18 @@ stdenv.mkDerivation rec {
    fribidi
    libX11
  ];
+
+  # required for cross builds
+  configureFlags = [
+    "ac_cv_func_malloc_0_nonnull=yes"
+    "ac_cv_func_realloc_0_nonnull=yes"
+    "ac_cv_func_memcmp_working=yes"
+  ];
+
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
+
  # FIXME: Configure fails to use system glew.
-  meta = with lib; {
+  meta = {
    description = "Free implementation of the OpenGL Character Renderer";
    longDescription = ''
      QuesoGLC is a free (as in free speech) implementation of the OpenGL
@ -36,8 +48,8 @@ stdenv.mkDerivation rec {
      platform that supports both FreeType and the OpenGL API.
    '';
    homepage = "https://quesoglc.sourceforge.net/";
-    license = licenses.lgpl21Plus;
-    maintainers = with maintainers; [ astsmtl ];
-    platforms = platforms.linux;
+    license = lib.licenses.lgpl21Plus;
+    maintainers = with lib.maintainers; [ astsmtl ];
+    platforms = lib.platforms.linux;
  };
-}
+})
--- a/pkgs/by-name/re/recyclarr/package.nix
+++ b/pkgs/by-name/re/recyclarr/package.nix
@ -1,22 +1,12 @@
 {
  lib,
  openssl,
-  writeText,
  git,
  buildDotnetModule,
  dotnetCorePackages,
  fetchFromGitHub,
  testers,
 }:
-let
-  nuget-config = writeText "nuget.config" ''
-    <configuration>
-      <packageSources>
-        <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
-      </packageSources>
-    </configuration>
-  '';
-in
 buildDotnetModule (finalAttrs: {
  pname = "recyclarr";
  version = "7.4.1";
@ -47,8 +37,6 @@ buildDotnetModule (finalAttrs: {

  enableParallelBuilding = false;

-  dotnetRestoreFlags = [ "--configfile=${nuget-config}" ];
-
  doCheck = false;

  dotnet-sdk = dotnetCorePackages.sdk_9_0;
--- a/pkgs/by-name/re/redpanda-client/package.nix
+++ b/pkgs/by-name/re/redpanda-client/package.nix
@ -7,12 +7,12 @@
  stdenv,
 }:
 let
-  version = "24.3.8";
+  version = "25.1.1";
  src = fetchFromGitHub {
    owner = "redpanda-data";
    repo = "redpanda";
    rev = "v${version}";
-    sha256 = "sha256-7ufF1OXFtT+OZY6UiDDiaohe4witVPEaO9zZaM6wldA=";
+    sha256 = "sha256-HjcgyDEm6m6/ab75GLFy6B5hu3Q7CQDIjxVnTVfCgbA=";
  };
 in
 buildGoModule rec {
@ -20,7 +20,7 @@ buildGoModule rec {
  inherit doCheck src version;
  modRoot = "./src/go/rpk";
  runVend = false;
-  vendorHash = "sha256-MdfCc3XdoMv3nnyaCbqU7mwJSgtusw9wVWjYqqJJmHA=";
+  vendorHash = "sha256-syAv40Coxy4uRQ6n20ikL7BTdP81N6Un1VKHpICv458=";

  ldflags = [
    ''-X "github.com/redpanda-data/redpanda/src/go/rpk/pkg/cli/cmd/version.version=${version}"''
--- a/pkgs/by-name/re/reposilite/package.nix
+++ b/pkgs/by-name/re/reposilite/package.nix
@ -5,6 +5,7 @@
  jre_headless,
  linkFarm,
  makeWrapper,
+  nixosTests,
  plugins ? [ ],
 }:
 let
@ -41,7 +42,10 @@ stdenv.mkDerivation (finalAttrs: {
    runHook postInstall
  '';

-  passthru.updateScript = ./update.sh;
+  passthru = {
+    tests = nixosTests.reposilite;
+    updateScript = ./update.sh;
+  };

  meta = {
    description = "Lightweight and easy-to-use repository management software dedicated for the Maven based artifacts in the JVM ecosystem";
--- a/pkgs/by-name/si/sile/package.nix
+++ b/pkgs/by-name/si/sile/package.nix
@ -29,18 +29,18 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "sile";
-  version = "0.15.9";
+  version = "0.15.10";

  src = fetchurl {
    url = "https://github.com/sile-typesetter/sile/releases/download/v${finalAttrs.version}/sile-${finalAttrs.version}.tar.zst";
-    hash = "sha256-+9pZUDszPYJmFgHbZH0aKtZ6qLcJjh73jG2CFoRKxWc=";
+    hash = "sha256-sPABtKfIpamGNWELnCnkVagHeuHq/1KoT364/aLHDu0=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
    dontConfigure = true;
    nativeBuildInputs = [ zstd ];
-    hash = "sha256-FdUrivumG5R69CwZedpkBzds5PcZr4zSsA6QW/+rDBM=";
+    hash = "sha256-57NcGm46aggPO+/54P1arCSPV3BHlAWwmWIzbpkT2js=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/so/source-meta-json-schema/package.nix
+++ b/pkgs/by-name/so/source-meta-json-schema/package.nix
@ -5,7 +5,7 @@
  cmake,
 }:
 let
-  version = "7.0.3";
+  version = "8.0.0";
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "source-meta-json-schema";
@ -15,7 +15,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "sourcemeta";
    repo = "jsonschema";
    rev = "v${version}";
-    hash = "sha256-x/bRLeH76zqcHxYodVrJYtb8CO35D3ZWYxHvvZ3Jg9A=";
+    hash = "sha256-EH+wi8MAgAxTy7OPQK/faX6OVY38/Z5fXhaK92xKkyA=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/st/stac-validator/package.nix
+++ b/pkgs/by-name/st/stac-validator/package.nix
@ -6,7 +6,7 @@

 python3Packages.buildPythonPackage rec {
  pname = "stac-validator";
-  version = "3.5.0";
+  version = "3.6.0";
  pyproject = true;
  disabled = python3Packages.pythonOlder "3.8";

@ -14,7 +14,7 @@ python3Packages.buildPythonPackage rec {
    owner = "stac-utils";
    repo = "stac-validator";
    tag = "v${version}";
-    hash = "sha256-/MConEN+fcY3JKqP/24k0l/m2FHNhIqG7k42ldSPZ1U=";
+    hash = "sha256-j29Bo8n+/85fzJtif0eWYxDP86k9n4Osl9/piWmTxSs=";
  };

  build-system = [ python3Packages.setuptools ];
--- a/pkgs/by-name/st/stripe-cli/package.nix
+++ b/pkgs/by-name/st/stripe-cli/package.nix
@ -8,15 +8,15 @@

 buildGoModule rec {
  pname = "stripe-cli";
-  version = "1.25.1";
+  version = "1.26.0";

  src = fetchFromGitHub {
    owner = "stripe";
    repo = "stripe-cli";
    rev = "v${version}";
-    hash = "sha256-WlLrWMDOwpSoHUixkJbCoewt/4UgnTbwIMBD5p5SI3c=";
+    hash = "sha256-gnV7BPHtbv6wFcgVUhKfIrskfAZIyZq6LtQwQYAkFCQ=";
  };
-  vendorHash = "sha256-dWLrJ866R+yPEYs4vc8SRADZXC1xCO7sDosHbU1G63o=";
+  vendorHash = "sha256-T8vrEbR240ihkLDG4vu0s+MxKJ5nOLm0aseDgK9EPPE=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/un/unshield/package.nix
+++ b/pkgs/by-name/un/unshield/package.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "unshield";
-  version = "1.5.1";
+  version = "1.6.2";

  src = fetchFromGitHub {
    owner = "twogood";
    repo = "unshield";
    rev = version;
-    sha256 = "1p2inn93svm83kr5p0j1al0rx47f1zykmagxsblgy04gi942iza3";
+    sha256 = "sha256-CYlrPwNPneJIwvQCnzyfi6MZiXoflMDfUDCRL79+yBk=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/vp/vpl-gpu-rt/package.nix
+++ b/pkgs/by-name/vp/vpl-gpu-rt/package.nix
@ -10,7 +10,7 @@

 stdenv.mkDerivation rec {
  pname = "vpl-gpu-rt";
-  version = "25.1.4";
+  version = "25.2.0";

  outputs = [
    "out"
@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
    owner = "intel";
    repo = "vpl-gpu-rt";
    rev = "intel-onevpl-${version}";
-    hash = "sha256-pu9iEAhQE7eHmrjzsyWtIecT79vcZyr5QfPq/Ce3Xxg=";
+    hash = "sha256-fQAnyUh9xuWsR8+yLtDdalJhW6kmBj1GBF20UZM7M6w=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/wx/wxGTK32/package.nix
+++ b/pkgs/by-name/wx/wxGTK32/package.nix
@ -4,6 +4,7 @@
  curl,
  expat,
  fetchFromGitHub,
+  gspell,
  gst_all_1,
  gtk3,
  libGL,
@ -12,9 +13,12 @@
  libXinerama,
  libXtst,
  libXxf86vm,
+  libnotify,
  libpng,
+  libsecret,
  libtiff,
  libjpeg_turbo,
+  libxkbcommon,
  zlib,
  pcre2,
  pkg-config,
@ -66,11 +70,15 @@ stdenv.mkDerivation rec {
    ]
    ++ lib.optionals stdenv.hostPlatform.isLinux [
      curl
+      gspell # wxTextCtrl spell checking
      gtk3
      libSM
      libXinerama
      libXtst
      libXxf86vm
+      libnotify # wxNotificationMessage backend
+      libsecret # wxSecretStore backend
+      libxkbcommon # proper key codes in key events
      xorgproto
    ]
    ++ lib.optional withMesa libGLU
@ -142,7 +150,10 @@ stdenv.mkDerivation rec {
      database support, HTML viewing and printing, and much more.
    '';
    license = licenses.wxWindows;
-    maintainers = with maintainers; [ tfmoraes ];
+    maintainers = with maintainers; [
+      tfmoraes
+      fliegendewurst
+    ];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/by-name/ya/yazi-unwrapped/package.nix
+++ b/pkgs/by-name/ya/yazi-unwrapped/package.nix
@ -10,18 +10,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "yazi";
-  version = "25.3.2";
+  version = "25.4.8";

  srcs = builtins.attrValues finalAttrs.passthru.srcs;

  sourceRoot = finalAttrs.passthru.srcs.code_src.name;

  useFetchCargoVendor = true;
-  cargoHash = "sha256-3uQ+DDEzi4mo8yTv21ftoSjjFqjQfWMzjUczP6dasO4=";
+  cargoHash = "sha256-RqAolwIQqJQo9cVZ1uA0D+6yAmQKN2a7Uk3f4b/FjHU=";

  env.YAZI_GEN_COMPLETIONS = true;
  env.VERGEN_GIT_SHA = "Nixpkgs";
-  env.VERGEN_BUILD_DATE = "2025-03-02";
+  env.VERGEN_BUILD_DATE = "2025-04-08";

  nativeBuildInputs = [ installShellFiles ];
  buildInputs = [ rust-jemalloc-sys ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Foundation ];
@ -44,7 +44,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      owner = "sxyazi";
      repo = "yazi";
      tag = "v${finalAttrs.version}";
-      hash = "sha256-xx/SGINyvbXZh0J8LgG2/jjFT1l6krNOzM5JAsRtxGE=";
+      hash = "sha256-oxO7nT4AZJilxA2DliYk57NETHu78xQ8nFdV+UwyKHE=";
    };

    man_src = fetchFromGitHub {
--- a/pkgs/by-name/ya/yazi/package.nix
+++ b/pkgs/by-name/ya/yazi/package.nix
@ -16,6 +16,7 @@
    zoxide
    imagemagick
    chafa
+    resvg
  ],

  # deps
@ -33,6 +34,7 @@
  zoxide,
  imagemagick,
  chafa,
+  resvg,

  settings ? { },
  plugins ? { },
--- a/pkgs/development/compilers/dotnet/dotnet-sdk-setup-hook.sh
+++ b/pkgs/development/compilers/dotnet/dotnet-sdk-setup-hook.sh
@ -85,6 +85,7 @@ configureNuget() {
    rootConfig=$(find . -maxdepth 1 -iname nuget.config -print -quit)
    if [[ -z $rootConfig ]]; then
        dotnet new nugetconfig
+        rootConfig=nuget.config
    fi

    (
@ -100,6 +101,12 @@ configureNuget() {
            -i /configuration/packageSources/__new -t attr -n value -v "$nugetSource"
            -r /configuration/packageSources/__new -v add)

+        if [[ -n ${keepNugetConfig-} ]] &&
+            ! @xmlstarlet@/bin/xmlstarlet select -t -i "/configuration/packageSources/clear" -nl "$rootConfig" &&
+            ! @xmlstarlet@/bin/xmlstarlet select -t -i "/configuration/packageSources/add[@value='https://api.nuget.org/v3/index.json' or @key='nuget.org']" -nl "$rootConfig"; then
+            dotnet nuget add source https://api.nuget.org/v3/index.json --name nuget.org --configfile "$rootConfig"
+        fi
+
        if [[ -z ${keepNugetConfig-} ]]; then
            xmlConfigArgs+=(-d '//configuration/*')
            xmlRootConfigArgs+=("${xmlSourceConfigArgs[@]}")
--- a/pkgs/development/compilers/factor-lang/0.100.nix
+++ b/pkgs/development/compilers/factor-lang/0.100.nix
@ -0,0 +1,9 @@
+{ callPackage, fetchurl }:
+
+callPackage ./unwrapped.nix (rec {
+  version = "0.100";
+  src = fetchurl {
+    url = "https://downloads.factorcode.org/releases/${version}/factor-src-${version}.zip";
+    hash = "sha256-ei1x6mgEoDVe1mKfoWSGC9RgZCONovAPYfIdAlOGi+0=";
+  };
+})
--- a/pkgs/development/compilers/factor-lang/0.99.nix
+++ b/pkgs/development/compilers/factor-lang/0.99.nix
@ -0,0 +1,9 @@
+{ callPackage, fetchurl }:
+
+callPackage ./unwrapped.nix (rec {
+  version = "0.99";
+  src = fetchurl {
+    url = "https://downloads.factorcode.org/releases/${version}/factor-src-${version}.zip";
+    sha256 = "f5626bb3119bd77de9ac3392fdbe188bffc26557fab3ea34f7ca21e372a8443e";
+  };
+})
--- a/pkgs/development/compilers/factor-lang/unwrapped.nix
+++ b/pkgs/development/compilers/factor-lang/unwrapped.nix
@ -8,16 +8,16 @@
  ncurses,
  tzdata,
  unzip,
+
+  # Version-specific attributes
+  version,
+  src,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "factor-lang";
-  version = "0.99";

-  src = fetchurl {
-    url = "https://downloads.factorcode.org/releases/${finalAttrs.version}/factor-src-${finalAttrs.version}.zip";
-    sha256 = "f5626bb3119bd77de9ac3392fdbe188bffc26557fab3ea34f7ca21e372a8443e";
-  };
+  inherit src version;

  patches = [
    # Use full path to image while bootstrapping
--- a/pkgs/development/perl-modules/ImageExifTool/default.nix
+++ b/pkgs/development/perl-modules/ImageExifTool/default.nix
@ -11,11 +11,11 @@

 buildPerlPackage rec {
  pname = "Image-ExifTool";
-  version = "13.00";
+  version = "13.25";

  src = fetchurl {
    url = "https://exiftool.org/Image-ExifTool-${version}.tar.gz";
-    hash = "sha256-SJV4jzT4NHZfhr5KWtWjJDP1ctdXFg7Ne2Eur17TfoQ=";
+    hash = "sha256-HNVVFEhGooKYeDvr86tFIjUnPHg1hBCBPj1Ok8ZTsfo=";
  };

  nativeBuildInputs = lib.optional stdenv.hostPlatform.isDarwin shortenPerlShebang;
--- a/pkgs/development/python-modules/img2pdf/default.nix
+++ b/pkgs/development/python-modules/img2pdf/default.nix
@ -2,6 +2,7 @@
  lib,
  buildPythonPackage,
  fetchFromGitea,
+  fetchpatch,
  replaceVars,
  colord,
  setuptools,
@ -34,6 +35,11 @@ buildPythonPackage rec {
  };

  patches = [
+    (fetchpatch {
+      name = "exiftool-13.23-compat.patch";
+      url = "https://gitlab.mister-muffin.de/josch/img2pdf/commit/59132f20f8a40f6ed4e5cd2a3719bf55473ba4d7.patch";
+      hash = "sha256-A36YSZ6kBFzEa2lSKIVHRg9r6Oi8FGkOnmt2YxlkwWw=";
+    })
    (replaceVars ./default-icc-profile.patch {
      srgbProfile =
        if stdenv.hostPlatform.isDarwin then
--- a/pkgs/development/python-modules/mat2/default.nix
+++ b/pkgs/development/python-modules/mat2/default.nix
@ -4,6 +4,7 @@
  buildPythonPackage,
  pytestCheckHook,
  fetchFromGitLab,
+  fetchpatch,
  replaceVars,
  bubblewrap,
  exiftool,
@ -36,6 +37,11 @@ buildPythonPackage rec {

  patches =
    [
+      (fetchpatch {
+        name = "exiftool-13.25-compat.patch";
+        url = "https://0xacab.org/jvoisin/mat2/-/commit/473903b70e1b269a6110242a9c098a10c18554e2.patch";
+        hash = "sha256-vxxjAFwiTDlcTT3ZlfhOG4rlzBJS+LhLoA++8y2hEok=";
+      })
      # hardcode paths to some binaries
      (replaceVars ./paths.patch {
        exiftool = lib.getExe exiftool;
--- a/pkgs/development/python-modules/pipdeptree/default.nix
+++ b/pkgs/development/python-modules/pipdeptree/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "pipdeptree";
-  version = "2.25.1";
+  version = "2.26.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "tox-dev";
    repo = "pipdeptree";
    tag = version;
-    hash = "sha256-vZPxpbR8O3XIyGcp2rn4skjy2xMQb6+5BHc4tjO84tw=";
+    hash = "sha256-Nq+xXzi5PeDDNTtkTaMTWO4HpxkjSUptE4jwfjBoauY=";
  };

  postPatch = ''
@ -66,7 +66,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Command line utility to show dependency tree of packages";
    homepage = "https://github.com/tox-dev/pipdeptree";
-    changelog = "https://github.com/tox-dev/pipdeptree/releases/tag/${version}";
+    changelog = "https://github.com/tox-dev/pipdeptree/releases/tag/${src.tag}";
    license = licenses.mit;
    maintainers = with maintainers; [ charlesbaynham ];
    mainProgram = "pipdeptree";
--- a/pkgs/development/python-modules/simsimd/default.nix
+++ b/pkgs/development/python-modules/simsimd/default.nix
@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "simsimd";
-  version = "6.4.0";
+  version = "6.4.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "ashvardanian";
    repo = "simsimd";
    tag = "v${version}";
-    hash = "sha256-o9GhLfFuH3mTE4V6DGyGwU7o3EfP4iEoxUfFvR5gtLc=";
+    hash = "sha256-4t3uCxQG0zSa2JLKE1d2G3OQLr+8E3ZDNnTf9LAYXsk=";
  };

  build-system = [
@ -44,7 +44,11 @@ buildPythonPackage rec {
    changelog = "https://github.com/ashvardanian/SimSIMD/releases/tag/${src.tag}";
    description = "Portable mixed-precision BLAS-like vector math library for x86 and ARM";
    homepage = "https://github.com/ashvardanian/simsimd";
-    license = lib.licenses.asl20;
+    license = with lib.licenses; [
+      asl20
+      # or
+      bsd3
+    ];
    maintainers = with lib.maintainers; [ dotlambda ];
  };
 }
--- a/pkgs/development/tools/database/surrealdb-migrations/default.nix
+++ b/pkgs/development/tools/database/surrealdb-migrations/default.nix
@ -11,7 +11,7 @@

 let
  pname = "surrealdb-migrations";
-  version = "2.2.0";
+  version = "2.2.1";
 in
 rustPlatform.buildRustPackage rec {
  inherit pname version;
@ -20,11 +20,11 @@ rustPlatform.buildRustPackage rec {
    owner = "Odonno";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-OiH3O74tJQFAW+ZyyspvOXUMcWkqjpd4GVU4cKn1jBg=";
+    hash = "sha256-MeHNBtzl2bNJFGKtM1o9mGnX0vbmnpUPc18ecqG6J+8=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-dx5fGtKE0wfjQgTi5HBce6Afmc+0rJA24IRhrBirZbo=";
+  cargoHash = "sha256-l59RbKohfPsAp/70UaT/bhy5Z4orVf7fuJgU+0fuyk4=";

  buildInputs = [ ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];

--- a/pkgs/development/tools/haskell/vaultenv/default.nix
+++ b/pkgs/development/tools/haskell/vaultenv/default.nix
@ -32,13 +32,13 @@
 }:
 mkDerivation rec {
  pname = "vaultenv";
-  version = "0.17.0";
+  version = "0.18.0";

  src = fetchFromGitHub {
    owner = "channable";
    repo = "vaultenv";
    rev = "v${version}";
-    hash = "sha256-Jb+Y/Cbapw2ZCXMwXMw1hsy0vT/K8mM/A/Z1all7y+A=";
+    hash = "sha256-Qb9GMAFjQBsPItwkiWSMWv8WJyc5hOz9Yrq5PPOFVQo=";
  };

  buildTools = [ hpack ];
--- a/pkgs/games/starsector/default.nix
+++ b/pkgs/games/starsector/default.nix
@ -14,11 +14,11 @@

 stdenv.mkDerivation rec {
  pname = "starsector";
-  version = "0.98a-RC5";
+  version = "0.98a-RC7";

  src = fetchzip {
    url = "https://f005.backblazeb2.com/file/fractalsoftworks/release/starsector_linux-${version}.zip";
-    sha256 = "sha256-otssjDpc4FjhTjS2A/JttlglJtMNVyDfhyTv9X+NiX0=";
+    sha256 = "sha256-qA4/9AvRWBOIbNKA9U8U7PoPmIwz8wgJZyYFln7LZHw=";
  };

  nativeBuildInputs = [
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -3070,10 +3070,6 @@ with pkgs;

  cffconvert = python3Packages.toPythonApplication python3Packages.cffconvert;

-  chafa = callPackage ../tools/misc/chafa {
-    inherit (darwin.apple_sdk.frameworks) Foundation;
-  };
-
  ckb-next = libsForQt5.callPackage ../tools/misc/ckb-next { };

  clamav = callPackage ../tools/security/clamav {
@ -9260,8 +9256,17 @@ with pkgs;
    inherit (darwin.apple_sdk.frameworks) Carbon OpenGL;
  };

-  factorPackages = callPackage ./factor-packages.nix { };
-  factor-lang = factorPackages.factor-lang;
+  factorPackages-0_99 = callPackage ./factor-packages.nix {
+    factor-unwrapped = callPackage ../development/compilers/factor-lang/0.99.nix { };
+  };
+  factorPackages-0_100 = callPackage ./factor-packages.nix {
+    factor-unwrapped = callPackage ../development/compilers/factor-lang/0.100.nix { };
+  };
+  factorPackages = factorPackages-0_100;
+
+  factor-lang-0_99 = factorPackages-0_99.factor-lang;
+  factor-lang-0_100 = factorPackages-0_100.factor-lang;
+  factor-lang = factor-lang-0_100;

  far2l = callPackage ../applications/misc/far2l {
    inherit (darwin.apple_sdk.frameworks)
--- a/pkgs/top-level/factor-packages.nix
+++ b/pkgs/top-level/factor-packages.nix
@ -1,6 +1,7 @@
 {
  lib,
  pkgs,
+  factor-unwrapped,
  overrides ? (self: super: { }),
 }:

@ -17,7 +18,7 @@ let
          { };
      buildFactorVocab = callPackage ../development/compilers/factor-lang/mk-vocab.nix { };

-      factor-unwrapped = callPackage ../development/compilers/factor-lang/unwrapped.nix { };
+      inherit factor-unwrapped;

      factor-lang = callPackage ../development/compilers/factor-lang/wrapper.nix { };
      factor-no-gui = callPackage ../development/compilers/factor-lang/wrapper.nix {
--- a/pkgs/top-level/java-packages.nix
+++ b/pkgs/top-level/java-packages.nix
@ -57,16 +57,24 @@ with pkgs;

      temurin-bin = recurseIntoAttrs (
        let
-          temurinLinux = callPackage ../development/compilers/temurin-bin/jdk-linux.nix { };
-          temurinDarwin = callPackage ../development/compilers/temurin-bin/jdk-darwin.nix { };
+          temurinLinux = import ../development/compilers/temurin-bin/jdk-linux.nix {
+            inherit (pkgs) lib callPackage stdenv;
+          };
+          temurinDarwin = import ../development/compilers/temurin-bin/jdk-darwin.nix {
+            inherit (pkgs) lib callPackage;
+          };
        in
        lib.mapAttrs (name: drv: mkLinuxDarwin drv temurinDarwin.${name}) temurinLinux
      );

      semeru-bin = recurseIntoAttrs (
        let
-          semeruLinux = callPackage ../development/compilers/semeru-bin/jdk-linux.nix { };
-          semeruDarwin = callPackage ../development/compilers/semeru-bin/jdk-darwin.nix { };
+          semeruLinux = import ../development/compilers/semeru-bin/jdk-linux.nix {
+            inherit (pkgs) lib callPackage;
+          };
+          semeruDarwin = import ../development/compilers/semeru-bin/jdk-darwin.nix {
+            inherit (pkgs) lib callPackage;
+          };
        in
        lib.mapAttrs (name: drv: mkLinuxDarwin drv semeruDarwin.${name}) semeruLinux
      );