Merge staging-next into staging

2026-09-30 03:39:59 +00:00 · 2025-03-01 12:05:46 +00:00
parent af6cd41916 ff5dbb2b2e
commit 1b30499dc1
57 changed files with 953 additions and 400 deletions
--- a/doc/release-notes/rl-2505.section.md
+++ b/doc/release-notes/rl-2505.section.md
@@ -12,6 +12,9 @@
  The hook can be disabled by providing `dontCheckForBrokenSymlinks = true;` as an argument to `mkDerivation`.
  For more information, [check the docs](https://nixos.org/manual/nixpkgs/unstable/#no-broken-symlinks.sh) or [see this PR](https://github.com/NixOS/nixpkgs/pull/370750).

+- The hand written `perlPackages.SearchXapian` bindings have been dropped in favor of the (mostly compatible)
+  `perlPackages.Xapian`.
+
 - The `nixLog*` family of functions made available through the standard environment have been rewritten to prefix messages with both the debug level and the function name of the caller.
  The `nixLog` function, which logs unconditionally, was also re-introduced and modified to prefix messages with the function name of the caller.
  For more information, [see this PR](https://github.com/NixOS/nixpkgs/pull/370742).
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1008,6 +1008,12 @@
    githubId = 217050;
    name = "Albert Chae";
  };
+  albertilagan = {
+    email = "me@albertilagan.dev";
+    github = "albertilagan";
+    githubId = 22500561;
+    name = "Albert Ilagan";
+  };
  albertodvp = {
    email = "alberto.fanton@protonmail.com";
    github = "albertodvp";
@@ -2547,6 +2553,12 @@
    github = "Baitinq";
    githubId = 30861839;
  };
+  bakito = {
+    email = "github@bakito.ch";
+    name = "Marc Brugger";
+    github = "bakito";
+    githubId = 2733215;
+  };
  baksa = {
    email = "baksa@pm.me";
    name = "Kryštof Baksa";
@@ -11966,6 +11978,12 @@
    githubId = 44864956;
    keys = [ { fingerprint = "3F87 0A7C A7B4 3731 2F13  6083 749F D4DF A2E9 4236"; } ];
  };
+  kaeeraa = {
+    name = "kaeeraa";
+    email = "kaeeraa@nebula-nook.ru";
+    github = "kaeeraa";
+    githubId = 99148867;
+  };
  kaiha = {
    email = "kai.harries@gmail.com";
    github = "KaiHa";
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -821,7 +821,6 @@
  ./services/misc/klipper.nix
  ./services/misc/languagetool.nix
  ./services/misc/leaps.nix
-  ./services/misc/lidarr.nix
  ./services/misc/lifecycled.nix
  ./services/misc/llama-cpp.nix
  ./services/misc/logkeys.nix
@@ -861,12 +860,9 @@
  ./services/misc/portunus.nix
  ./services/misc/preload.nix
  ./services/misc/private-gpt.nix
-  ./services/misc/prowlarr.nix
  ./services/misc/pufferpanel.nix
  ./services/misc/pykms.nix
-  ./services/misc/radarr.nix
  ./services/misc/radicle.nix
-  ./services/misc/readarr.nix
  ./services/misc/realmd.nix
  ./services/misc/rebuilderd.nix
  ./services/misc/recyclarr.nix
@@ -878,13 +874,18 @@
  ./services/misc/rshim.nix
  ./services/misc/safeeyes.nix
  ./services/misc/sdrplay.nix
+  ./services/misc/servarr/lidarr.nix
+  ./services/misc/servarr/prowlarr.nix
+  ./services/misc/servarr/radarr.nix
+  ./services/misc/servarr/readarr.nix
+  ./services/misc/servarr/sonarr.nix
+  ./services/misc/servarr/whisparr.nix
  ./services/misc/serviio.nix
  ./services/misc/sickbeard.nix
  ./services/misc/signald.nix
  ./services/misc/siproxd.nix
  ./services/misc/snapper.nix
  ./services/misc/soft-serve.nix
-  ./services/misc/sonarr.nix
  ./services/misc/sourcehut
  ./services/misc/spice-autorandr.nix
  ./services/misc/spice-vdagentd.nix
@@ -910,7 +911,6 @@
  ./services/misc/wastebin.nix
  ./services/misc/weechat.nix
  ./services/misc/workout-tracker.nix
-  ./services/misc/whisparr.nix
  ./services/misc/xmrig.nix
  ./services/misc/ytdl-sub.nix
  ./services/misc/zoneminder.nix
--- a/nixos/modules/services/mail/mailman.nix
+++ b/nixos/modules/services/mail/mailman.nix
@@ -447,7 +447,7 @@ in {
      enable = lib.mkDefault true;
      virtualHosts = lib.genAttrs cfg.webHosts (webHost: {
        locations = {
-          ${cfg.serve.virtualRoot}.extraConfig = "uwsgi_pass unix:/run/mailman-web.socket;";
+          ${cfg.serve.virtualRoot}.uwsgiPass = "unix:/run/mailman-web.socket";
          "${lib.removeSuffix "/" cfg.serve.virtualRoot}/static/".alias = webSettings.STATIC_ROOT + "/";
        };
      });
--- a/nixos/modules/services/misc/servarr/lidarr.nix
+++ b/nixos/modules/services/misc/servarr/lidarr.nix
@@ -6,6 +6,7 @@
 }:
 let
  cfg = config.services.lidarr;
+  servarr = import ./settings-options.nix { inherit lib pkgs; };
 in
 {
  options = {
@@ -28,6 +29,10 @@ in
        '';
      };

+      settings = servarr.mkServarrSettingsOptions "lidarr" 8686;
+
+      environmentFiles = servarr.mkServarrEnvironmentFiles "lidarr";
+
      user = lib.mkOption {
        type = lib.types.str;
        default = "lidarr";
@@ -56,18 +61,20 @@ in
      description = "Lidarr";
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
+      environment = servarr.mkServarrSettingsEnvVars "LIDARR" cfg.settings;

      serviceConfig = {
        Type = "simple";
        User = cfg.user;
        Group = cfg.group;
+        EnvironmentFile = cfg.environmentFiles;
        ExecStart = "${cfg.package}/bin/Lidarr -nobrowser -data='${cfg.dataDir}'";
        Restart = "on-failure";
      };
    };

    networking.firewall = lib.mkIf cfg.openFirewall {
-      allowedTCPPorts = [ 8686 ];
+      allowedTCPPorts = [ cfg.settings.server.port ];
    };

    users.users = lib.mkIf (cfg.user == "lidarr") {
--- a/nixos/modules/services/misc/servarr/prowlarr.nix
+++ b/nixos/modules/services/misc/servarr/prowlarr.nix
@@ -6,7 +6,7 @@
 }:
 let
  cfg = config.services.prowlarr;
-
+  servarr = import ./settings-options.nix { inherit lib pkgs; };
 in
 {
  options = {
@@ -20,6 +20,10 @@ in
        default = false;
        description = "Open ports in the firewall for the Prowlarr web interface.";
      };
+
+      settings = servarr.mkServarrSettingsOptions "prowlarr" 9696;
+
+      environmentFiles = servarr.mkServarrEnvironmentFiles "prowlarr";
    };
  };

@@ -28,19 +32,22 @@ in
      description = "Prowlarr";
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
+      environment = servarr.mkServarrSettingsEnvVars "PROWLARR" cfg.settings // {
+        HOME = "/var/empty";
+      };

      serviceConfig = {
        Type = "simple";
        DynamicUser = true;
        StateDirectory = "prowlarr";
+        EnvironmentFile = cfg.environmentFiles;
        ExecStart = "${lib.getExe cfg.package} -nobrowser -data=/var/lib/prowlarr";
        Restart = "on-failure";
      };
-      environment.HOME = "/var/empty";
    };

    networking.firewall = lib.mkIf cfg.openFirewall {
-      allowedTCPPorts = [ 9696 ];
+      allowedTCPPorts = [ cfg.settings.server.port ];
    };
  };
 }
--- a/nixos/modules/services/misc/servarr/radarr.nix
+++ b/nixos/modules/services/misc/servarr/radarr.nix
@@ -6,7 +6,7 @@
 }:
 let
  cfg = config.services.radarr;
-
+  servarr = import ./settings-options.nix { inherit lib pkgs; };
 in
 {
  options = {
@@ -27,6 +27,10 @@ in
        description = "Open ports in the firewall for the Radarr web interface.";
      };

+      settings = servarr.mkServarrSettingsOptions "radarr" 7878;
+
+      environmentFiles = servarr.mkServarrEnvironmentFiles "radarr";
+
      user = lib.mkOption {
        type = lib.types.str;
        default = "radarr";
@@ -51,18 +55,20 @@ in
      description = "Radarr";
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
+      environment = servarr.mkServarrSettingsEnvVars "RADARR" cfg.settings;

      serviceConfig = {
        Type = "simple";
        User = cfg.user;
        Group = cfg.group;
+        EnvironmentFile = cfg.environmentFiles;
        ExecStart = "${cfg.package}/bin/Radarr -nobrowser -data='${cfg.dataDir}'";
        Restart = "on-failure";
      };
    };

    networking.firewall = lib.mkIf cfg.openFirewall {
-      allowedTCPPorts = [ 7878 ];
+      allowedTCPPorts = [ cfg.settings.server.port ];
    };

    users.users = lib.mkIf (cfg.user == "radarr") {
--- a/nixos/modules/services/misc/servarr/readarr.nix
+++ b/nixos/modules/services/misc/servarr/readarr.nix
@@ -6,6 +6,7 @@
 }:
 let
  cfg = config.services.readarr;
+  servarr = import ./settings-options.nix { inherit lib pkgs; };
 in
 {
  options = {
@@ -28,6 +29,10 @@ in
        '';
      };

+      settings = servarr.mkServarrSettingsOptions "readarr" 8787;
+
+      environmentFiles = servarr.mkServarrEnvironmentFiles "readarr";
+
      user = lib.mkOption {
        type = lib.types.str;
        default = "readarr";
@@ -56,18 +61,20 @@ in
      description = "Readarr";
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
+      environment = servarr.mkServarrSettingsEnvVars "READARR" cfg.settings;

      serviceConfig = {
        Type = "simple";
        User = cfg.user;
        Group = cfg.group;
+        EnvironmentFile = cfg.environmentFiles;
        ExecStart = "${cfg.package}/bin/Readarr -nobrowser -data='${cfg.dataDir}'";
        Restart = "on-failure";
      };
    };

    networking.firewall = lib.mkIf cfg.openFirewall {
-      allowedTCPPorts = [ 8787 ];
+      allowedTCPPorts = [ cfg.settings.server.port ];
    };

    users.users = lib.mkIf (cfg.user == "readarr") {
--- a/nixos/modules/services/misc/servarr/settings-options.nix
+++ b/nixos/modules/services/misc/servarr/settings-options.nix
@@ -0,0 +1,88 @@
+{ lib, pkgs }:
+{
+  mkServarrSettingsOptions =
+    name: port:
+    lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = (pkgs.formats.ini { }).type;
+        options = {
+          update = {
+            mechanism = lib.mkOption {
+              type =
+                with lib.types;
+                nullOr (enum [
+                  "external"
+                  "builtIn"
+                  "script"
+                ]);
+              description = "which update mechanism to use";
+              default = "external";
+            };
+            automatically = lib.mkOption {
+              type = lib.types.bool;
+              description = "Automatically download and install updates.";
+              default = false;
+            };
+          };
+          server = {
+            port = lib.mkOption {
+              type = lib.types.int;
+              description = "Port Number";
+              default = port;
+            };
+          };
+          log = {
+            analyticsEnabled = lib.mkOption {
+              type = lib.types.bool;
+              description = "Send Anonymous Usage Data";
+              default = false;
+            };
+          };
+        };
+      };
+      example = lib.options.literalExpression ''
+        {
+          update.mechanism = "internal";
+          server = {
+            urlbase = "localhost";
+            port = ${toString port};
+            bindaddress = "*";
+          };
+        }
+      '';
+      default = { };
+      description = ''
+        Attribute set of arbitrary config options.
+        Please consult the documentation at the [wiki](https://wiki.servarr.com/useful-tools#using-environment-variables-for-config).
+
+        WARNING: this configuration is stored in the world-readable Nix store!
+        For secrets use [](#opt-services.${name}.environmentFiles).
+      '';
+    };
+
+  mkServarrEnvironmentFiles =
+    name:
+    lib.mkOption {
+      type = lib.types.listOf lib.types.path;
+      default = [ ];
+      description = ''
+        Environment file to pass secret configuration values.
+        Each line must follow the `${lib.toUpper name}__SECTION__KEY=value` pattern.
+        Please consult the documentation at the [wiki](https://wiki.servarr.com/useful-tools#using-environment-variables-for-config).
+      '';
+    };
+
+  mkServarrSettingsEnvVars =
+    name: settings:
+    lib.pipe settings [
+      (lib.mapAttrsRecursive (
+        path: value:
+        lib.optionalAttrs (value != null) {
+          name = lib.toUpper "${name}__${lib.concatStringsSep "__" path}";
+          value = toString (if lib.isBool value then lib.boolToString value else value);
+        }
+      ))
+      (lib.collect (x: lib.isString x.name or false && lib.isString x.value or false))
+      lib.listToAttrs
+    ];
+}
--- a/nixos/modules/services/misc/servarr/sonarr.nix
+++ b/nixos/modules/services/misc/servarr/sonarr.nix
@@ -7,6 +7,7 @@
 }:
 let
  cfg = config.services.sonarr;
+  servarr = import ./settings-options.nix { inherit lib pkgs; };
 in
 {
  options = {
@@ -27,6 +28,10 @@ in
        '';
      };

+      environmentFiles = servarr.mkServarrEnvironmentFiles "sonarr";
+
+      settings = servarr.mkServarrSettingsOptions "sonarr" 8989;
+
      user = lib.mkOption {
        type = lib.types.str;
        default = "sonarr";
@@ -52,11 +57,12 @@ in
      description = "Sonarr";
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
-
+      environment = servarr.mkServarrSettingsEnvVars "SONARR" cfg.settings;
      serviceConfig = {
        Type = "simple";
        User = cfg.user;
        Group = cfg.group;
+        EnvironmentFile = cfg.environmentFiles;
        ExecStart = utils.escapeSystemdExecArgs [
          (lib.getExe cfg.package)
          "-nobrowser"
@@ -67,7 +73,7 @@ in
    };

    networking.firewall = lib.mkIf cfg.openFirewall {
-      allowedTCPPorts = [ 8989 ];
+      allowedTCPPorts = [ cfg.settings.server.port ];
    };

    users.users = lib.mkIf (cfg.user == "sonarr") {
--- a/nixos/modules/services/misc/servarr/whisparr.nix
+++ b/nixos/modules/services/misc/servarr/whisparr.nix
@@ -7,6 +7,7 @@

 let
  cfg = config.services.whisparr;
+  servarr = import ./settings-options.nix { inherit lib pkgs; };
 in
 {
  options = {
@@ -27,6 +28,10 @@ in
        description = "Open ports in the firewall for the Whisparr web interface.";
      };

+      settings = servarr.mkServarrSettingsOptions "whisparr" 6969;
+
+      environmentFiles = servarr.mkServarrEnvironmentFiles "whisparr";
+
      user = lib.mkOption {
        type = lib.types.str;
        default = "whisparr";
@@ -48,17 +53,21 @@ in
      description = "Whisparr";
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
+      environment = servarr.mkServarrSettingsEnvVars "WHISPARR" cfg.settings;

      serviceConfig = {
        Type = "simple";
        User = cfg.user;
        Group = cfg.group;
+        EnvironmentFile = cfg.environmentFiles;
        ExecStart = "${lib.getExe cfg.package} -nobrowser -data='${cfg.dataDir}'";
        Restart = "on-failure";
      };
    };

-    networking.firewall = lib.mkIf cfg.openFirewall { allowedTCPPorts = [ 6969 ]; };
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.settings.server.port ];
+    };

    users.users = lib.mkIf (cfg.user == "whisparr") {
      whisparr = {
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -96,7 +96,7 @@ let
    REDIRECT_STATUS   = "200";
  };

-  recommendedProxyConfig = pkgs.writeText "nginx-recommended-proxy-headers.conf" ''
+  recommendedProxyConfig = pkgs.writeText "nginx-recommended-proxy_set_header-headers.conf" ''
    proxy_set_header        Host $host;
    proxy_set_header        X-Real-IP $remote_addr;
    proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -240,6 +240,14 @@ let
        include ${recommendedProxyConfig};
      ''}

+      ${optionalString cfg.recommendedUwsgiSettings ''
+        uwsgi_connect_timeout   ${cfg.uwsgiTimeout};
+        uwsgi_send_timeout      ${cfg.uwsgiTimeout};
+        uwsgi_read_timeout      ${cfg.uwsgiTimeout};
+        uwsgi_param             HTTP_CONNECTION "";
+        include ${cfg.package}/conf/uwsgi_params;
+      ''}
+
      ${optionalString (cfg.mapHashBucketSize != null) ''
        map_hash_bucket_size ${toString cfg.mapHashBucketSize};
      ''}
@@ -444,6 +452,13 @@ let
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
      ''}
+      ${optionalString (config.uwsgiPass != null && !cfg.uwsgiResolveWhileRunning)
+        "uwsgi_pass ${config.uwsgiPass};"
+      }
+      ${optionalString (config.uwsgiPass != null && cfg.uwsgiResolveWhileRunning) ''
+        set $nix_proxy_target "${config.uwsgiPass}";
+        uwsgi_pass $nix_proxy_target;
+      ''}
      ${concatStringsSep "\n"
        (mapAttrsToList (n: v: ''fastcgi_param ${n} "${v}";'')
          (optionalAttrs (config.fastcgiParams != {})
@@ -455,6 +470,7 @@ let
      ${optionalString (config.return != null) "return ${toString config.return};"}
      ${config.extraConfig}
      ${optionalString (config.proxyPass != null && config.recommendedProxySettings) "include ${recommendedProxyConfig};"}
+      ${optionalString (config.uwsgiPass != null && config.recommendedUwsgiSettings) "include ${cfg.package}/conf/uwsgi_params;"}
      ${mkBasicAuth "sublocation" config}
    }
  '') (sortProperties (mapAttrsToList (k: v: v // { location = k; }) locations)));
@@ -555,6 +571,23 @@ in
        '';
      };

+      recommendedUwsgiSettings = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          Whether to enable recommended uwsgi settings if a vhost does not specify the option manually.
+        '';
+      };
+
+      uwsgiTimeout = mkOption {
+        type = types.str;
+        default = "60s";
+        example = "20s";
+        description = ''
+          Change the uwsgi related timeouts in recommendedUwsgiSettings.
+        '';
+      };
+
      defaultListen = mkOption {
        type = with types; listOf (submodule {
          options = {
@@ -864,6 +897,16 @@ in
        '';
      };

+      uwsgiResolveWhileRunning = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Resolves domains of uwsgi targets at runtime
+          and not only at start, you have to set
+          services.nginx.resolver, too.
+        '';
+      };
+
      mapHashBucketSize = mkOption {
        type = types.nullOr (types.enum [ 32 64 128 ]);
        default = null;
@@ -1161,6 +1204,16 @@ in
        '';
      }

+      {
+        assertion = all (host:
+          all (location: !(location.proxyPass != null && location.uwsgiPass != null)) (attrValues host.locations))
+        (attrValues virtualHosts);
+        message = ''
+          Options services.nginx.service.virtualHosts.<name>.proxyPass and
+          services.nginx.virtualHosts.<name>.uwsgiPass are mutually exclusive.
+        '';
+      }
+
      {
        assertion = cfg.package.pname != "nginxQuic" && cfg.package.pname != "angieQuic" -> !(cfg.enableQuicBPF);
        message = ''
--- a/nixos/modules/services/web-servers/nginx/location-options.nix
+++ b/nixos/modules/services/web-servers/nginx/location-options.nix
@@ -53,6 +53,16 @@ with lib;
      '';
    };

+    uwsgiPass = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "unix:/run/example/example.sock";
+      description = ''
+        Adds uwsgi_pass directive and sets recommended proxy headers if
+        recommendedUwsgiSettings is enabled.
+      '';
+    };
+
    index = mkOption {
      type = types.nullOr types.str;
      default = null;
@@ -134,5 +144,14 @@ with lib;
        Enable recommended proxy settings.
      '';
    };
+
+    recommendedUwsgiSettings = mkOption {
+      type = types.bool;
+      default = config.services.nginx.recommendedUwsgiSettings;
+      defaultText = literalExpression "config.services.nginx.recommendedUwsgiSettings";
+      description = ''
+        Enable recommended uwsgi settings.
+      '';
+    };
  };
 }
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@@ -364,28 +364,10 @@ let
        apiKeyFile = pkgs.writeText "dummy-api-key" apikey;
      };
      metricProvider = {
-        services.sonarr.enable = true;
-        systemd.services.sonarr.serviceConfig.ExecStartPre =
-          let
-            sonarr_config = pkgs.writeText "config.xml" ''
-              <Config>
-                <LogLevel>info</LogLevel>
-                <EnableSsl>False</EnableSsl>
-                <Port>8989</Port>
-                <SslPort>9898</SslPort>
-                <UrlBase></UrlBase>
-                <BindAddress>*</BindAddress>
-                <ApiKey>${apikey}</ApiKey>
-                <AuthenticationMethod>None</AuthenticationMethod>
-                <UpdateMechanism>BuiltIn</UpdateMechanism>
-                <Branch>main</Branch>
-                <InstanceName>Sonarr</InstanceName>
-              </Config>
-            '';
-          in
-          [
-            ''${pkgs.coreutils}/bin/install -D -m 777 ${sonarr_config} -T /var/lib/sonarr/.config/NzbDrone/config.xml''
-          ];
+        services.sonarr = {
+          enable = true;
+          environmentFiles = [(pkgs.writeText "sonarr-env" "SONARR__AUTH__APIKEY=${apikey}")];
+        };
      };
      exporterTest = ''
        wait_for_unit("sonarr.service")
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -737,8 +737,8 @@ let
        mktplcRef = {
          name = "vscode-intelephense-client";
          publisher = "bmewburn";
-          version = "1.14.1";
-          hash = "sha256-h9ROZtTLY7/QbM6ftiZJCtHkEYSVkrMU9pgv4QyTrzg=";
+          version = "1.14.2";
+          hash = "sha256-T0uaJedhlH3s6QnCEZvNxU8ErYW4+L1VBz79hnhwSyU=";
        };
        meta = {
          description = "PHP code intelligence for Visual Studio Code";
@@ -1780,9 +1780,6 @@ let
        };
      };

-      equinusocio.vsc-material-theme = throw "'equinusocio.vsc-material-theme' has been removed due to security concerns. The extension contained potentially malicious code and was taken down."; # Added 2025-02-28
-      equinusocio.vsc-material-theme-icons = throw "'equinusocio.vsc-material-theme-icons' has been removed due to security concerns. The extension contained potentially malicious code and was taken down."; # Added 2025-02-28
-
      esbenp.prettier-vscode = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "prettier-vscode";
@@ -5690,6 +5687,8 @@ let
    _2gua = throw "_2gua is deprecated in favor of 2gua"; # Added 2024-05-29
    _4ops = throw "_4ops is deprecated in favor of 4ops"; # Added 2024-05-29
    Arjun.swagger-viewer = throw "Arjun.swagger-viewer is deprecated in favor of arjun.swagger-viewer"; # Added 2024-05-29
+    equinusocio.vsc-material-theme = throw "'equinusocio.vsc-material-theme' has been removed due to security concerns. The extension contained potentially malicious code and was taken down."; # Added 2025-02-28
+    equinusocio.vsc-material-theme-icons = throw "'equinusocio.vsc-material-theme-icons' has been removed due to security concerns. The extension contained potentially malicious code and was taken down."; # Added 2025-02-28
    jakebecker.elixir-ls = throw "jakebecker.elixir-ls is deprecated in favor of elixir-lsp.vscode-elixir-ls"; # Added 2024-05-29
    jpoissonnier.vscode-styled-components = throw "jpoissonnier.vscode-styled-components is deprecated in favor of styled-components.vscode-styled-components"; # Added 2024-05-29
    matklad.rust-analyzer = throw "matklad.rust-analyzer is deprecated in favor of rust-lang.rust-analyzer"; # Added 2024-05-29
--- a/pkgs/applications/misc/gpxsee/default.nix
+++ b/pkgs/applications/misc/gpxsee/default.nix
@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "gpxsee";
-  version = "13.35";
+  version = "13.36";

  src = fetchFromGitHub {
    owner = "tumic0";
    repo = "GPXSee";
    rev = finalAttrs.version;
-    hash = "sha256-TvDopZyrRx+604ARrOiy2OsswE8/K+W5LIhOitttt3U=";
+    hash = "sha256-yPDbQfsclpDvLsKt1mLBXWs+lY9qDVWfVWF7/RQkFso=";
  };

  buildInputs =
--- a/pkgs/build-support/php/builders/v2/build-composer-project.nix
+++ b/pkgs/build-support/php/builders/v2/build-composer-project.nix
@@ -3,100 +3,114 @@
  stdenvNoCC,
  lib,
  php,
-}:
+}@toplevel:

 let
  buildComposerProjectOverride =
-    finalAttrs: previousAttrs:
-
-    let
-      phpDrv = finalAttrs.php or php;
-      composer = finalAttrs.composer or phpDrv.packages.composer;
-    in
+    finalAttrs:
    {
-      composerLock = previousAttrs.composerLock or null;
-      composerNoDev = previousAttrs.composerNoDev or true;
-      composerNoPlugins = previousAttrs.composerNoPlugins or true;
-      composerNoScripts = previousAttrs.composerNoScripts or true;
-      composerStrictValidation = previousAttrs.composerStrictValidation or true;
-
-      nativeBuildInputs = (previousAttrs.nativeBuildInputs or [ ]) ++ [
+      php ? toplevel.php,
+      composer ? toplevel.php.packages.composer,
+      composerVendor ? null,
+      vendorHash ? null,
+      composerLock ? null,
+      composerNoDev ? true,
+      composerNoPlugins ? true,
+      composerNoScripts ? true,
+      composerStrictValidation ? true,
+      buildInputs ? [ ],
+      nativeBuildInputs ? [ ],
+      strictDeps ? true,
+      patches ? [ ],
+      doCheck ? true,
+      doInstallCheck ? true,
+      passthru ? { },
+      meta ? { },
+      ...
+    }@args:
+    {
+      inherit
+        patches
+        strictDeps
+        doCheck
+        doInstallCheck
+        ;
+      nativeBuildInputs = nativeBuildInputs ++ [
        composer
-        phpDrv
-        phpDrv.composerHooks2.composerInstallHook
+        php
+        php.composerHooks2.composerInstallHook
      ];

-      buildInputs = (previousAttrs.buildInputs or [ ]) ++ [ phpDrv ];
-
-      patches = previousAttrs.patches or [ ];
-      strictDeps = previousAttrs.strictDeps or true;
+      buildInputs = buildInputs ++ [ php ];

      # Should we keep these empty phases?
      configurePhase =
-        previousAttrs.configurePhase or ''
+        args.configurePhase or ''
          runHook preConfigure

          runHook postConfigure
        '';

      buildPhase =
-        previousAttrs.buildPhase or ''
+        args.buildPhase or ''
          runHook preBuild

          runHook postBuild
        '';

-      doCheck = previousAttrs.doCheck or true;
      checkPhase =
-        previousAttrs.checkPhase or ''
+        args.checkPhase or ''
          runHook preCheck

          runHook postCheck
        '';

      installPhase =
-        previousAttrs.installPhase or ''
+        args.installPhase or ''
          runHook preInstall

          runHook postInstall
        '';

-      doInstallCheck = previousAttrs.doInstallCheck or false;
      installCheckPhase =
-        previousAttrs.installCheckPhase or ''
+        args.installCheckPhase or ''
          runHook preInstallCheck

          runHook postInstallCheck
        '';

      composerVendor =
-        previousAttrs.composerVendor or (phpDrv.mkComposerVendor {
-          inherit composer;
+        args.composerVendor or (php.mkComposerVendor {
+          inherit
+            composer
+            composerLock
+            composerNoDev
+            composerNoPlugins
+            composerNoScripts
+            composerStrictValidation
+            vendorHash
+            ;
          inherit (finalAttrs)
            patches
            pname
            src
-            vendorHash
            version
            ;
-
-          composerLock = previousAttrs.composerLock or null;
-          composerNoDev = previousAttrs.composerNoDev or true;
-          composerNoPlugins = previousAttrs.composerNoPlugins or true;
-          composerNoScripts = previousAttrs.composerNoScripts or true;
-          composerStrictValidation = previousAttrs.composerStrictValidation or true;
        });

      # Projects providing a lockfile from upstream can be automatically updated.
-      passthru = previousAttrs.passthru or { } // {
+      passthru = passthru // {
        updateScript =
-          previousAttrs.passthru.updateScript
+          args.passthru.updateScript
            or (if finalAttrs.composerVendor.composerLock == null then nix-update-script { } else null);
      };

-      meta = previousAttrs.meta or { } // {
+      meta = meta // {
        platforms = lib.platforms.all;
      };
    };
 in
-args: (stdenvNoCC.mkDerivation args).overrideAttrs buildComposerProjectOverride
+lib.extendMkDerivation {
+  constructDrv = stdenvNoCC.mkDerivation;
+  extendDrvArgs = buildComposerProjectOverride;
+}
--- a/pkgs/build-support/php/builders/v2/build-composer-vendor.nix
+++ b/pkgs/build-support/php/builders/v2/build-composer-vendor.nix
@@ -2,86 +2,77 @@
  stdenvNoCC,
  lib,
  php,
-}:
+}@toplevel:

 let
  mkComposerVendorOverride =
-    /*
-      We cannot destruct finalAttrs since the attrset below is used to construct it
-      and Nix currently does not support lazy attribute names.
-      {
-      php ? null,
-      composer ? null,
-      composerLock ? "composer.lock",
-      src,
-      vendorHash,
-      ...
-      }@finalAttrs:
-    */
-    finalAttrs: previousAttrs:
-
-    let
-      phpDrv = finalAttrs.php or php;
-      composer = finalAttrs.composer or phpDrv.packages.composer;
-    in
-    assert (lib.assertMsg (previousAttrs ? src) "mkComposerVendor expects src argument.");
-    assert (lib.assertMsg (previousAttrs ? vendorHash) "mkComposerVendor expects vendorHash argument.");
-    assert (lib.assertMsg (previousAttrs ? version) "mkComposerVendor expects version argument.");
-    assert (lib.assertMsg (previousAttrs ? pname) "mkComposerVendor expects pname argument.");
+    finalAttrs:
    {
-      composerNoDev = previousAttrs.composerNoDev or true;
-      composerNoPlugins = previousAttrs.composerNoPlugins or true;
-      composerNoScripts = previousAttrs.composerNoScripts or true;
-      composerStrictValidation = previousAttrs.composerStrictValidation or true;
-
-      name = "${previousAttrs.pname}-composer-repository-${previousAttrs.version}";
+      php ? toplevel.php,
+      composer ? toplevel.php.packages.composer,
+      composerLock,
+      vendorHash ? null,
+      composerNoDev ? true,
+      composerNoPlugins ? true,
+      composerNoScripts ? true,
+      composerStrictValidation ? true,
+      buildInputs ? [ ],
+      nativeBuildInputs ? [ ],
+      dontPatchShebangs ? true,
+      strictDeps ? true,
+      doCheck ? true,
+      doInstallCheck ? false,
+      ...
+    }@args:
+    assert (lib.assertMsg (args ? src) "mkComposerVendor expects src argument.");
+    assert (lib.assertMsg (args ? vendorHash) "mkComposerVendor expects vendorHash argument.");
+    assert (lib.assertMsg (args ? version) "mkComposerVendor expects version argument.");
+    assert (lib.assertMsg (args ? pname) "mkComposerVendor expects pname argument.");
+    {
+      name = "${args.pname}-composer-vendor-${args.version}";

      # See https://github.com/NixOS/nix/issues/6660
-      dontPatchShebangs = previousAttrs.dontPatchShebangs or true;
+      inherit dontPatchShebangs;

-      nativeBuildInputs = (previousAttrs.nativeBuildInputs or [ ]) ++ [
+      inherit buildInputs strictDeps doCheck;
+
+      nativeBuildInputs = nativeBuildInputs ++ [
        composer
-        phpDrv
-        phpDrv.composerHooks2.composerVendorHook
+        php
+        php.composerHooks2.composerVendorHook
      ];

-      buildInputs = previousAttrs.buildInputs or [ ];
-
-      strictDeps = previousAttrs.strictDeps or true;
-
      # Should we keep these empty phases?
      configurePhase =
-        previousAttrs.configurePhase or ''
+        args.configurePhase or ''
          runHook preConfigure

          runHook postConfigure
        '';

      buildPhase =
-        previousAttrs.buildPhase or ''
+        args.buildPhase or ''
          runHook preBuild

          runHook postBuild
        '';

-      doCheck = previousAttrs.doCheck or true;
      checkPhase =
-        previousAttrs.checkPhase or ''
+        args.checkPhase or ''
          runHook preCheck

          runHook postCheck
        '';

      installPhase =
-        previousAttrs.installPhase or ''
+        args.installPhase or ''
          runHook preInstall

          runHook postInstall
        '';

-      doInstallCheck = previousAttrs.doInstallCheck or false;
      installCheckPhase =
-        previousAttrs.installCheckPhase or ''
+        args.installCheckPhase or ''
          runHook preInstallCheck

          runHook postInstallCheck
@@ -90,7 +81,10 @@ let
      outputHashMode = "recursive";
      outputHashAlgo =
        if (finalAttrs ? vendorHash && finalAttrs.vendorHash != "") then null else "sha256";
-      outputHash = finalAttrs.vendorHash or "";
+      outputHash = vendorHash;
    };
 in
-args: (stdenvNoCC.mkDerivation args).overrideAttrs mkComposerVendorOverride
+lib.extendMkDerivation {
+  constructDrv = stdenvNoCC.mkDerivation;
+  extendDrvArgs = mkComposerVendorOverride;
+}
--- a/pkgs/by-name/ay/ayugram-desktop/package.nix
+++ b/pkgs/by-name/ay/ayugram-desktop/package.nix
@@ -31,7 +31,10 @@ telegram-desktop.override {
        '';
        homepage = "https://github.com/AyuGram/AyuGramDesktop";
        changelog = "https://github.com/AyuGram/AyuGramDesktop/releases/tag/v${finalAttrs.version}";
-        maintainers = with lib.maintainers; [ ];
+        maintainers = with lib.maintainers; [
+          kaeeraa
+          s0me1newithhand7s
+        ];
      };
    }
  );
--- a/pkgs/by-name/az/azurehound/package.nix
+++ b/pkgs/by-name/az/azurehound/package.nix
@@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "azurehound";
-  version = "2.2.1";
+  version = "2.3.0";

  src = fetchFromGitHub {
    owner = "SpecterOps";
    repo = "AzureHound";
    tag = "v${version}";
-    hash = "sha256-DqoEtL0uyLsP/2PJdOpAmXryEZQDlyGWPQHThF+3gJA=";
+    hash = "sha256-BbwQ3u1SD4AjNjHzT6QB0x7QJAZ59m1DtvhjZapLIx4=";
  };

  vendorHash = "sha256-FG3207OTzkMEoSvQsTH7Ky9T3ur7glG7k0ERfd12SO0=";
--- a/pkgs/by-name/bu/buildkit/package.nix
+++ b/pkgs/by-name/bu/buildkit/package.nix
@@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "buildkit";
-  version = "0.19.0";
+  version = "0.20.0";

  src = fetchFromGitHub {
    owner = "moby";
    repo = "buildkit";
    rev = "v${version}";
-    hash = "sha256-TN6IJLQxbwhflNdnrPgcqzw2o6di+aHOqwa6efkyV0k=";
+    hash = "sha256-ApmAeR93szAqeOJR7h5MwtDPf6nrUy4vYKgFeRZlCXw=";
  };

  vendorHash = null;
--- a/pkgs/by-name/ca/cargo-sort/package.nix
+++ b/pkgs/by-name/ca/cargo-sort/package.nix
@@ -6,17 +6,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-sort";
-  version = "1.1.0";
+  version = "1.0.9";

  src = fetchFromGitHub {
    owner = "devinr528";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-AUtue1xkhrhlF7PtqsCQ9rdhV0/0i85DWrp7YL9SAYk=";
+    sha256 = "sha256-fqmyL4ZSz+nKfUIrcrfLRT9paEas5d00Y/kvEqyz2vw=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-yNHVhnJiawUrWncrIC8cAS25OYIZX7wVM9zMaupfTKM=";
+  cargoHash = "sha256-z5YT+6fU12WrByu3NZwodU9Y5489eCRrHUY+H/Hka+c=";

  meta = with lib; {
    description = "Tool to check that your Cargo.toml dependencies are sorted alphabetically";
--- a/pkgs/by-name/ch/changedetection-io/package.nix
+++ b/pkgs/by-name/ch/changedetection-io/package.nix
@@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "changedetection-io";
-  version = "0.49.1";
+  version = "0.49.3";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "dgtlmoon";
    repo = "changedetection.io";
    tag = version;
-    hash = "sha256-2DfuD7/LmJXJIbtEhwoDdANBfP7lIXpd7BWDuvd+ci8=";
+    hash = "sha256-QYghHpT78hlCZvliPsTdDE9bdSlr0kJn5xxwi3mnP/w=";
  };

  pythonRelaxDeps = true;
--- a/pkgs/by-name/db/dbeaver-bin/package.nix
+++ b/pkgs/by-name/db/dbeaver-bin/package.nix
@@ -17,7 +17,7 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "dbeaver-bin";
-  version = "24.3.4";
+  version = "24.3.5";

  src =
    let
@@ -30,10 +30,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
        aarch64-darwin = "macos-aarch64.dmg";
      };
      hash = selectSystem {
-        x86_64-linux = "sha256-t9yhOgcka7zRSP1QyZvnc3iefKn9gv+pjobFJongb3A=";
-        aarch64-linux = "sha256-JanACJPOgHqhjLt2BzR+H9ZHwA2uPIrmyluVkRBqAhY=";
-        x86_64-darwin = "sha256-6FFMRBj6Z4UhqENclixtcgOrrmcYuabBqeIFGEqRQEA=";
-        aarch64-darwin = "sha256-vBb1w7Y8ADvhpEx/bf4W5llNIlng6kfZEUKB5bzQ8TY=";
+        x86_64-linux = "sha256-Kt+CPPgeqKMxZZeWG3NjNKdlcQFyS9NvEaAQSI9c5CI=";
+        aarch64-linux = "sha256-9O0BhsrhVMpf3FMzqZeaNrCKdSscsOrLmo6Mq42aRLU=";
+        x86_64-darwin = "sha256-4uZrlgjHJz7zOgGn7mTRtz/qjlvzBglXAVcjf7SDmCs=";
+        aarch64-darwin = "sha256-Hm9215hcoNEc/amTQ9mBX2wl95aTCF1/T+5crctbaeA=";
      };
    in
    fetchurl {
--- a/pkgs/by-name/de/deck/package.nix
+++ b/pkgs/by-name/de/deck/package.nix
@@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "deck";
-  version = "1.44.1";
+  version = "1.45.0";

  src = fetchFromGitHub {
    owner = "Kong";
    repo = "deck";
    tag = "v${version}";
-    hash = "sha256-PXFbYxBlHLWcxzyWfbK+n7G/dt/MgbyC1gGy7sq0OtM=";
+    hash = "sha256-XIv1ql2PNhosFVlw9nfXcoTouTkIC3chtWLDjrsF0nY=";
  };

  nativeBuildInputs = [ installShellFiles ];
@@ -27,7 +27,7 @@ buildGoModule rec {
  ];

  proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-XBiOAVXuvhaJrhgvM2b/rdt/bmvMAp6ctgWzIgeaUGc=";
+  vendorHash = "sha256-bVHRzhie5OkuZ8MJ5LnXqr8R38exq5nwrU1w5gSfhVI=";

  postInstall = ''
    installShellCompletion --cmd deck \
--- a/pkgs/by-name/fc/fcitx5-mcbopomofo/package.nix
+++ b/pkgs/by-name/fc/fcitx5-mcbopomofo/package.nix
@@ -15,13 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "fcitx5-mcbopomofo";
-  version = "2.9.0";
+  version = "2.9.1";

  src = fetchFromGitHub {
    owner = "openvanilla";
    repo = "fcitx5-mcbopomofo";
    rev = version;
-    hash = "sha256-xW3nxAfhdW7S0UJNl/NKhB1vzm0mMd92cA5ksPn7+QI=";
+    hash = "sha256-fHDNhZhSVgVuZLfRA3eJErm1gwhUZJw+emCXfeO5HVo=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/gf/gfs2-utils/package.nix
+++ b/pkgs/by-name/gf/gfs2-utils/package.nix
@@ -15,11 +15,11 @@

 stdenv.mkDerivation rec {
  pname = "gfs2-utils";
-  version = "3.5.1";
+  version = "3.6.0";

  src = fetchurl {
    url = "https://pagure.io/gfs2-utils/archive/${version}/gfs2-utils-${version}.tar.gz";
-    hash = "sha256-ZWzNfYuhIxGmSAe454vRjAKp9Lq7EBBSY36P7qVgZnw=";
+    hash = "sha256-1+wgG8HEB3ic/hyLDY+JaPElqicHrSsS2AUBq6kh3sc=";
  };

  outputs = [
--- a/pkgs/by-name/he/heimdall-proxy/package.nix
+++ b/pkgs/by-name/he/heimdall-proxy/package.nix
@@ -0,0 +1,43 @@
+{
+  fetchFromGitHub,
+  buildGoModule,
+  lib,
+}:
+let
+  version = "0.15.5";
+in
+buildGoModule {
+  pname = "heimdall-proxy";
+
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "dadrus";
+    repo = "heimdall";
+    tag = "v${version}";
+    hash = "sha256-tVWdxhdHr8HvestvGbyfstSagzwIB35Uub+9X64tTAA=";
+  };
+
+  vendorHash = "sha256-DkqM/zkatYskXQl+MOWJX3PkZGHCqyXZ0v/EEJUS3cA=";
+
+  tags = [ "sqlite" ];
+
+  subPackages = [ "." ];
+
+  env.CGO_ENABLED = 0;
+
+  # Pass versioning information via ldflags
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/dadrus/heimdall/version.Version=${version}"
+  ];
+
+  meta = {
+    description = "A cloud native Identity Aware Proxy and Access Control Decision service";
+    homepage = "https://dadrus.github.io/heimdall";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ albertilagan ];
+    mainProgram = "heimdall-proxy";
+  };
+}
--- a/pkgs/by-name/im/immich/sources.json
+++ b/pkgs/by-name/im/immich/sources.json
@@ -1,26 +1,26 @@
 {
-  "version": "1.127.0",
-  "hash": "sha256-9lCMVQxMNNZgu9KTxNJfE4woZ+xLhS8JvfurtC/nf8c=",
+  "version": "1.128.0",
+  "hash": "sha256-g/lDI8/ap+CfoXH6dZKKt6xQJ79YqvWD44qW/HpOwFg=",
  "components": {
    "cli": {
-      "npmDepsHash": "sha256-iKKENhyGgAfpetYt4SPxvJZrxYWevMID0jjCou9t8X8=",
-      "version": "2.2.51"
+      "npmDepsHash": "sha256-hQlCvMkUJNUJ2QkXuQ6w7U/P3EjgYdd+qG40cKKeSzw=",
+      "version": "2.2.52"
    },
    "server": {
-      "npmDepsHash": "sha256-ZWRiQlXHXofUiyxNY74RL4IMIpv5XhNrR6g/GUcyaDA=",
-      "version": "1.127.0"
+      "npmDepsHash": "sha256-s5T/IAcpW3u7Gb37dCuIY8PR9CbR/gjye9PbQ+eLQeo=",
+      "version": "1.128.0"
    },
    "web": {
-      "npmDepsHash": "sha256-A7bhxO/l0x5UoFCSy48BbUZX4mOXsXQwSS3EQHnAsFE=",
-      "version": "1.127.0"
+      "npmDepsHash": "sha256-/CCemxeHiitcRF2r4RWSkHHZ5BU54SjShnv4AE0l7sM=",
+      "version": "1.128.0"
    },
    "open-api/typescript-sdk": {
-      "npmDepsHash": "sha256-14bcRhQi0VoodQl+GoK+uXFSqqDou7C2Rh50UoW71J8=",
-      "version": "1.127.0"
+      "npmDepsHash": "sha256-tLj6Wd8i1NGC5Udbd/Or4FK1IXHDMVXY6QZkkg1Ixys=",
+      "version": "1.128.0"
    },
    "geonames": {
-      "timestamp": "20250129185843",
-      "hash": "sha256-poOvoBprzlEe4WDOdcO0TnIcwUp5xuKScumHMJ8YgO8="
+      "timestamp": "20250228235146",
+      "hash": "sha256-ljkYXqotHYkJOWRYIGHUhEWN0hVb2ELBAsZnTxLm2tU="
    }
  }
 }
--- a/pkgs/by-name/jr/jreleaser-cli/package.nix
+++ b/pkgs/by-name/jr/jreleaser-cli/package.nix
@@ -7,11 +7,11 @@
 }:
 stdenv.mkDerivation rec {
  pname = "jreleaser-cli";
-  version = "1.16.0";
+  version = "1.17.0";

  src = fetchurl {
    url = "https://github.com/jreleaser/jreleaser/releases/download/v${version}/jreleaser-tool-provider-${version}.jar";
-    hash = "sha256-86FvsGitzJBGQUZ9cxtnxO/hfplnpLekxrS+k5ToeLM=";
+    hash = "sha256-V3RDSpoHLJxUImPf+8wQdfukFNftfsZI1L9k+sD4yZg=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/ku/kubexporter/package.nix
+++ b/pkgs/by-name/ku/kubexporter/package.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+buildGoModule rec {
+  pname = "kubexporter";
+  version = "0.6.3";
+
+  src = fetchFromGitHub {
+    owner = "bakito";
+    repo = "kubexporter";
+    tag = "v${version}";
+    hash = "sha256-9TtoACuX6dEcoWX246a5PofEIksB5KnxzRjdk/HV/Ww=";
+  };
+
+  vendorHash = "sha256-SWStAW5XkZGM57ZoxrVdxM7vtmZpSPkByrhFREHqfW0=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/bakito/kubexporter/version.Version=${version}"
+  ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Tool for exporting Kubernetes resources as YAML or JSON files";
+    homepage = "https://github.com/bakito/kubexporter";
+    changelog = "https://github.com/bakito/kubexporter/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ bakito ];
+    mainProgram = "kubexporter";
+  };
+}
--- a/pkgs/by-name/mu/mutt/package.nix
+++ b/pkgs/by-name/mu/mutt/package.nix
@@ -12,6 +12,7 @@
  gnupg,
  gpgme,
  libkrb5,
+  zlib,
  headerCache ? true,
  sslSupport ? true,
  saslSupport ? true,
@@ -61,7 +62,10 @@ stdenv.mkDerivation rec {
  ];

  buildInputs =
-    [ ncurses ]
+    [
+      ncurses
+      zlib
+    ]
    ++ lib.optional headerCache gdbm
    ++ lib.optional sslSupport openssl
    ++ lib.optional gssSupport libkrb5
--- a/pkgs/by-name/n-/n-m3u8dl-re/deps.json
+++ b/pkgs/by-name/n-/n-m3u8dl-re/deps.json
@@ -0,0 +1,17 @@
+[
+  {
+    "pname": "NiL.JS",
+    "version": "2.5.1684",
+    "hash": "sha256-lxFTYyuj0SuNzIQGq+rK9s0tAqxqQg8PBj/YdktJunw="
+  },
+  {
+    "pname": "Spectre.Console",
+    "version": "0.49.2-preview.0.50",
+    "hash": "sha256-ivFyHTfQxPf/RIin+aftmd+G4PcrqmJXmdu0u/RU6YA="
+  },
+  {
+    "pname": "System.CommandLine",
+    "version": "2.0.0-beta4.22272.1",
+    "hash": "sha256-zSO+CYnMH8deBHDI9DHhCPj79Ce3GOzHCyH1/TiHxcc="
+  }
+]
--- a/pkgs/by-name/n-/n-m3u8dl-re/package.nix
+++ b/pkgs/by-name/n-/n-m3u8dl-re/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildDotnetModule,
+  fetchFromGitHub,
+  dotnetCorePackages,
+}:
+buildDotnetModule rec {
+  pname = "n-m3u8dl-re";
+  version = "0.3.0-beta";
+  src = fetchFromGitHub {
+    owner = "nilaoda";
+    repo = "N_m3u8DL-RE";
+    tag = "v${version}";
+    sha256 = "sha256-AVLO7pxD1LCoogsJPPN5aoOmVBIm3Y/EVsiQWdYI6QU=";
+  };
+  patches = [
+    ./publish-fix.patch
+    ./reverse-arr.patch
+  ];
+
+  # from openutau/default.nix
+  # [...]/Microsoft.NET.Sdk/targets/Microsoft.NET.Sdk.targets(248,5): error MSB4018: The "GenerateDepsFile" task failed unexpectedly. [[...]/N_m3u8DL-RE.Common.csproj]
+  # [...]/Microsoft.NET.Sdk/targets/Microsoft.NET.Sdk.targets(248,5): error MSB4018: System.IO.IOException: The process cannot access the file '[...]/N_m3u8DL-RE.Common.deps.json' because it is being used by another process. [[...]/N_m3u8DL-RE.Common.csproj]
+  enableParallelBuilding = false;
+
+  projectFile = "src/N_m3u8DL-RE.sln";
+  nugetDeps = ./deps.json;
+
+  executables = [ "N_m3u8DL-RE" ];
+
+  dotnet-sdk = dotnetCorePackages.sdk_9_0;
+  dotnet-runtime = dotnetCorePackages.runtime_9_0;
+
+  postFixup = ''
+    ln -s $out/bin/N_m3u8DL-RE $out/bin/n-m3u8dl-re
+  '';
+
+  meta = {
+    description = "Cross-Platform, modern and powerful stream downloader for MPD/M3U8/ISM";
+    homepage = "https://github.com/nilaoda/N_m3u8DL-RE";
+    license = lib.licenses.mit;
+    mainProgram = "n-m3u8dl-re";
+    maintainers = with lib.maintainers; [ phanirithvij ];
+    platforms = lib.platforms.linux ++ lib.platforms.unix;
+  };
+}
--- a/pkgs/by-name/n-/n-m3u8dl-re/publish-fix.patch
+++ b/pkgs/by-name/n-/n-m3u8dl-re/publish-fix.patch
@@ -0,0 +1,10 @@
+--- a/src/N_m3u8DL-RE/Directory.Build.props
+++ b/src/N_m3u8DL-RE/Directory.Build.props
+@@ -9,7 +9,6 @@
+     <IlcTrimMetadata>true</IlcTrimMetadata>
+     <IlcGenerateStackTraceData>true</IlcGenerateStackTraceData>
+     <SatelliteResourceLanguages>zh-CN;zh-TW;en-US</SatelliteResourceLanguages>
+-    <PublishAot>true</PublishAot>
+     <StripSymbols>true</StripSymbols>
+     <ObjCopyName Condition="'$(RuntimeIdentifier)' == 'linux-arm64' or '$(RuntimeIdentifier)' == 'linux-musl-arm64'">aarch64-linux-gnu-objcopy</ObjCopyName>
+   </PropertyGroup>
--- a/pkgs/by-name/n-/n-m3u8dl-re/reverse-arr.patch
+++ b/pkgs/by-name/n-/n-m3u8dl-re/reverse-arr.patch
@@ -0,0 +1,42 @@
+diff --git a/src/N_m3u8DL-RE.Common/Entity/WebVttSub.cs b/src/N_m3u8DL-RE.Common/Entity/WebVttSub.cs
+index 6b6d284..b57fc24 100644
+--- a/src/N_m3u8DL-RE.Common/Entity/WebVttSub.cs
+++ b/src/N_m3u8DL-RE.Common/Entity/WebVttSub.cs
+@@ -201,7 +201,8 @@ public partial class WebVttSub
+             time += Convert.ToInt32(parts.Last().PadRight(3, '0'));
+             str = parts.First();
+         }
+-        var t = str.Split(':').Reverse().ToList();
+        var t = str.Split(':').ToList();
+        t.Reverse();
+         for (int i = 0; i < t.Count; i++)
+         {
+             time += (long)Math.Pow(60, i) * Convert.ToInt32(t[i]) * 1000;
+@@ -265,4 +266,4 @@ public partial class WebVttSub
+ 
+         return srt;
+     }
+-}
+\ No newline at end of file
+}
+diff --git a/src/N_m3u8DL-RE/Util/OtherUtil.cs b/src/N_m3u8DL-RE/Util/OtherUtil.cs
+index b2487f3..4eab23f 100644
+--- a/src/N_m3u8DL-RE/Util/OtherUtil.cs
+++ b/src/N_m3u8DL-RE/Util/OtherUtil.cs
+@@ -70,7 +70,8 @@ internal static partial class OtherUtil
+         var hours = -1;
+         var mins = -1;
+         var secs = -1;
+-        arr.Reverse().Select(i => Convert.ToInt32(i)).ToList().ForEach(item =>
+        arr.Reverse();
+        arr.Select(i => Convert.ToInt32(i)).ToList().ForEach(item =>
+         {
+             if (secs == -1) secs = item;
+             else if (mins == -1) mins = item;
+@@ -170,4 +171,4 @@ internal static partial class OtherUtil
+ 
+     [GeneratedRegex(@"^(?:(\d+)h)?(?:(\d+)m)?(?:(\d+)s)?$")]
+     private static partial Regex TimeStrRegex();
+-}
+\ No newline at end of file
+}
--- a/pkgs/by-name/na/nats-server/package.nix
+++ b/pkgs/by-name/na/nats-server/package.nix
@@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "nats-server";
-  version = "2.10.25";
+  version = "2.10.26";

  src = fetchFromGitHub {
    owner = "nats-io";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-cpAUyTnGEPPPA2RRJ+jYQgUSZuI8YJQ3s4uhHvoYDCg=";
+    hash = "sha256-jOfS1uHI8sTL7xTyIiK/M7bFFNLTZZ6+Xy5QErBe9VY=";
  };

-  vendorHash = "sha256-8wExTV9seztPnpgyckDZnGc5iF3oY453YX7aoRcZHaI=";
+  vendorHash = "sha256-9BkcN4XLQPc9Df6m/CssKYxUk1nKJHB5SRPMrsXd+lQ=";

  doCheck = false;

--- a/pkgs/by-name/nt/ntpd-rs/package.nix
+++ b/pkgs/by-name/nt/ntpd-rs/package.nix
@@ -13,17 +13,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "ntpd-rs";
-  version = "1.4.0";
+  version = "1.5.0";

  src = fetchFromGitHub {
    owner = "pendulum-project";
    repo = "ntpd-rs";
    tag = "v${version}";
-    hash = "sha256-usLtf4qwKkn+lEYSQWCa1ap9h/52YYMVFDkpFJVD00k=";
+    hash = "sha256-APQHxlsyUMA1N6FatQvotOokxNikOO22GGyXUMh3ABo=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-Zm7uRdgX9zgLeVdcSdp3z+NjyD9HB0GHX37qjgjSatI=";
+  cargoHash = "sha256-BiLYKOgmmqOesfl/8y4590Xo2Z4+u/Rn7CglNjQk2bU=";

  nativeBuildInputs = [
    pandoc
--- a/pkgs/by-name/pg/pgbouncer/package.nix
+++ b/pkgs/by-name/pg/pgbouncer/package.nix
@@ -12,11 +12,11 @@

 stdenv.mkDerivation rec {
  pname = "pgbouncer";
-  version = "1.23.1";
+  version = "1.24.0";

  src = fetchurl {
    url = "https://www.pgbouncer.org/downloads/files/${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-GWO0lyMdmlYKYtJm5KLq5ogatAGFPZPl0pLDdA7sUIQ=";
+    hash = "sha256-52rflBoxkaQW4iPAss2/cxWe74CioyMUr2+9guQaHUE=";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/by-name/pg/pgpool/package.nix
+++ b/pkgs/by-name/pg/pgpool/package.nix
@@ -10,12 +10,12 @@

 stdenv.mkDerivation rec {
  pname = "pgpool-II";
-  version = "4.5.5";
+  version = "4.6.0";

  src = fetchurl {
    url = "https://www.pgpool.net/mediawiki/download.php?f=pgpool-II-${version}.tar.gz";
    name = "pgpool-II-${version}.tar.gz";
-    hash = "sha256-lf/urrawzr6oA04w/Bkz/sc4SyJ61REwXqzMXQkP+Zg=";
+    hash = "sha256-9oplcUQtfqU7afOddJrUV3kLABgOGbAZ/ILiNbqwcyE=";
  };

  buildInputs = [
--- a/pkgs/by-name/pu/pulumi/package.nix
+++ b/pkgs/by-name/pu/pulumi/package.nix
@@ -1,133 +1,119 @@
 {
-  stdenv,
  lib,
-  buildGo122Module,
-  coreutils,
+  stdenv,
+  buildGoModule,
  fetchFromGitHub,
-  fetchpatch,
  installShellFiles,
  git,
+  buildPackages,
  # passthru
  runCommand,
  makeWrapper,
+  testers,
  pulumi,
  pulumiPackages,
 }:
-
-# Using go 1.22 as pulumi 3.122.0 will not build with 1.23.
-# Issue: https://github.com/NixOS/nixpkgs/issues/351955
-# Upgrading pulumi version should fix it, but requires more involved changes, so
-# this is a temporary workaround.
-# Upgrade: https://github.com/NixOS/nixpkgs/pull/352221
-buildGo122Module rec {
+buildGoModule rec {
  pname = "pulumi";
-  version = "3.122.0";
+  version = "3.152.0";

  src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-5KHptoQliqPtJ6J5u23ZgRZOdO77BJhZbdc3Cty9Myk=";
+    owner = "pulumi";
+    repo = "pulumi";
+    tag = "v${version}";
+    hash = "sha256-/cRWj7y6d5sNQRUXg9l7eDAOkUqNGXTzgpWDQdPP8zw=";
    # Some tests rely on checkout directory name
    name = "pulumi";
  };

-  vendorHash = "sha256-1UyYbmNNHlAeaW6M6AkaQ5Hs25ziHenSs4QjlnUQGjs=";
-
-  patches = [
-    # Fix a test failure, can be dropped in next release (3.100.0)
-    (fetchpatch {
-      url = "https://github.com/pulumi/pulumi/commit/6dba7192d134d3b6f7e26dee9205711ccc736fa7.patch";
-      hash = "sha256-QRN6XnIR2rrqJ4UFYNt/YmIlokTSkGUvnBO/Q9UN8X8=";
-      stripLen = 1;
-    })
-  ];
+  vendorHash = "sha256-JhIyivD+YpUUr9T8roNpINb3Tx8ZElHa+BrpJkyFx60=";

  sourceRoot = "${src.name}/pkg";

  nativeBuildInputs = [ installShellFiles ];

-  # Bundle release metadata
+  nativeCheckInputs = [ git ];
+
+  # https://github.com/pulumi/pulumi/blob/3ec1aa75d5bf7103b283f46297321a9a4b1a8a33/.goreleaser.yml#L20-L26
+  tags = [ "osusergo" ];
  ldflags = [
-    # Omit the symbol table and debug information.
    "-s"
-    # Omit the DWARF symbol table.
    "-w"
-  ] ++ importpathFlags;
-
-  importpathFlags = [
-    "-X github.com/pulumi/pulumi/pkg/v3/version.Version=v${version}"
+    "-X=github.com/pulumi/pulumi/sdk/v3/go/common/version.Version=v${version}"
  ];

-  nativeCheckInputs = [
-    git
+  excludedPackages = [
+    "util/generate"
+    "codegen/gen_program_test"
  ];

-  preCheck =
-    ''
-      # The tests require `version.Version` to be unset
-      ldflags=''${ldflags//"$importpathFlags"/}
+  # Required for user.Current implementation with osusergo on Darwin.
+  preCheck = ''
+    export HOME=$TMPDIR USER=nixbld
+  '';

-      # Create some placeholders for plugins used in tests. Otherwise, Pulumi
-      # tries to donwload them and fails, resulting in really long test runs
-      dummyPluginPath=$(mktemp -d)
-      for name in pulumi-{resource-pkg{A,B},-pkgB}; do
-        ln -s ${coreutils}/bin/true "$dummyPluginPath/$name"
-      done
+  checkFlags = [
+    # The tests require `version.Version` (i.e. ldflags) to be unset.
+    "-ldflags="
+    # Skip tests that fail in Nix sandbox.
+    "-skip=^${
+      lib.concatStringsSep "$|^" [
+        # Seems to require TTY.
+        "TestProgressEvents"

-      export PATH=$dummyPluginPath''${PATH:+:}$PATH
+        # Tries to clone repo: https://github.com/pulumi/test-repo.git
+        "TestValidateRelativeDirectory"
+        "TestRepoLookup"
+        "TestDSConfigureGit"

-      # Code generation tests also download dependencies from network
-      rm codegen/{docs,dotnet,go,nodejs,python,schema}/*_test.go
-      rm -R codegen/{dotnet,go,nodejs,python}/gen_program_test
-
-    ''
-    + lib.optionalString stdenv.hostPlatform.isDarwin ''
-      export PULUMI_HOME=$(mktemp -d)
-    '';
-
-  checkFlags =
-    let
-      disabledTests = [
-        # Flaky test
-        "TestPendingDeleteOrder"
        # Tries to clone repo: github.com/pulumi/templates.git
        "TestGenerateOnlyProjectCheck"
-        # Following tests give this error, not quite sure why:
-        #     Error Trace:    /build/pulumi/pkg/engine/lifecycletest/update_plan_test.go:273
-        # Error:          Received unexpected error:
-        #                 Unexpected diag message: <{%reset%}>using pulumi-resource-pkgA from $PATH at /build/tmp.bS8caxmTx7/pulumi-resource-pkgA<{%reset%}>
-        # Test:           TestUnplannedDelete
-        "TestExpectedDelete"
-        "TestPlannedInputOutputDifferences"
-        "TestPlannedUpdateChangedStack"
-        "TestExpectedCreate"
-        "TestUnplannedDelete"
-        # Following test gives this  error, not sure why:
-        # --- Expected
-        # +++ Actual
-        # @@ -1 +1 @@
-        # -gcp
-        # +aws
-        "TestPluginMapper_MappedNamesDifferFromPulumiName"
-        "TestProtect"
-      ];
-    in
-    [ "-skip=^${lib.concatStringsSep "$|^" disabledTests}$" ];
+        "TestPulumiNewSetsTemplateTag"
+        "TestPulumiPromptRuntimeOptions"
+
+        # Connects to https://pulumi-testing.vault.azure.net/…
+        "TestAzureCloudManager"
+        "TestAzureKeyEditProjectStack"
+        "TestAzureKeyVaultAutoFix15329"
+        "TestAzureKeyVaultExistingKey"
+        "TestAzureKeyVaultExistingKeyState"
+        "TestAzureKeyVaultExistingState"
+
+        # Requires pulumi-yaml
+        "TestProjectNameDefaults"
+        "TestProjectNameOverrides"
+
+        # Downloads pulumi-resource-random from Pulumi plugin registry.
+        "TestPluginInstallCancellation"
+
+        # Requires language-specific tooling and/or Internet access.
+        "TestGenerateProgram"
+        "TestGenerateProgramVersionSelection"
+        "TestGeneratePackage"
+        "TestGeneratePackageOne"
+        "TestGeneratePackageThree"
+        "TestGeneratePackageTwo"
+        "TestParseAndRenderDocs"
+        "TestImportResourceRef"
+      ]
+    }$"
+  ];

  # Allow tests that bind or connect to localhost on macOS.
  __darwinAllowLocalNetworking = true;

-  doInstallCheck = true;
-  installCheckPhase = ''
-    PULUMI_SKIP_UPDATE_CHECK=1 $out/bin/pulumi version | grep v${version} > /dev/null
-  '';
+  # Use pulumi from the previous stage if we can’t execute compiled binary.
+  pulumiExe =
+    if stdenv.buildPlatform.canExecute stdenv.hostPlatform then
+      "${placeholder "out"}/bin/pulumi"
+    else
+      "${buildPackages.pulumi}/bin/pulumi";

  postInstall = ''
-    installShellCompletion --cmd pulumi \
-      --bash <($out/bin/pulumi gen-completion bash) \
-      --fish <($out/bin/pulumi gen-completion fish) \
-      --zsh  <($out/bin/pulumi gen-completion zsh)
+    for shell in bash fish zsh; do
+      "$pulumiExe" gen-completion $shell >pulumi.$shell
+      installShellCompletion pulumi.$shell
+    done
  '';

  passthru = {
@@ -144,17 +130,25 @@ buildGo122Module rec {
            --suffix PATH : ${lib.makeBinPath (f pulumiPackages)} \
            --set LD_LIBRARY_PATH "${lib.getLib stdenv.cc.cc}/lib"
        '';
+    tests = {
+      version = testers.testVersion {
+        package = pulumi;
+        version = "v${version}";
+        command = "PULUMI_SKIP_UPDATE_CHECK=1 pulumi version";
+      };
+    };
  };

-  meta = with lib; {
-    homepage = "https://pulumi.io/";
+  meta = {
+    homepage = "https://www.pulumi.com";
    description = "Pulumi is a cloud development platform that makes creating cloud programs easy and productive";
-    sourceProvenance = [ sourceTypes.fromSource ];
-    license = licenses.asl20;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [
+    sourceProvenance = [ lib.sourceTypes.fromSource ];
+    license = lib.licenses.asl20;
+    mainProgram = "pulumi";
+    maintainers = with lib.maintainers; [
      trundle
      veehaitch
+      tie
    ];
  };
 }
--- a/pkgs/by-name/ra/rathole/0001-no-more-vergen.patch
+++ b/pkgs/by-name/ra/rathole/0001-no-more-vergen.patch
@@ -0,0 +1,22 @@
+diff --git a/Cargo.toml b/Cargo.toml
+index e7a944e..e6bae43 100644
+--- a/Cargo.toml
+++ b/Cargo.toml
+@@ -7,7 +7,6 @@ description = "A reverse proxy for NAT traversal"
+ license = "Apache-2.0"
+ repository = "https://github.com/rapiz1/rathole"
+ readme = "README.md"
+-build = "build.rs"
+ include = ["src/**/*", "LICENSE", "README.md", "build.rs"]
+ 
+ [features]
+@@ -130,9 +129,4 @@ p12 = { version = "0.6.3", optional = true }
+ openssl = { version = "0.10", features = ["vendored"], optional = true }
+ 
+ [build-dependencies]
+-vergen = { version = "7.4.2", default-features = false, features = [
+-    "build",
+-    "git",
+-    "cargo",
+-] }
+ anyhow = "1.0"
--- a/pkgs/by-name/ra/rathole/package.nix
+++ b/pkgs/by-name/ra/rathole/package.nix
@@ -3,13 +3,13 @@
  stdenv,
  fetchFromGitHub,
  rustPlatform,
+  rustc,
  pkg-config,
  openssl,
  nixosTests,
-  darwin,
 }:

-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage rec {
  pname = "rathole";
  version = "0.5.0-unstable-2024-06-06";

@@ -20,19 +20,48 @@ rustPlatform.buildRustPackage {
    hash = "sha256-C0/G4JOZ4pTAvcKZhRHsGvlLlwAyWBQ0rMScLvaLSuA=";
  };

+  # Get rid of git dependency on vergen. No reason to require libgit2-sys as
+  # well as libz-sys. Vendored c libraries for libgit2/zlib fail to build on
+  # darwin and using libs from nixpkgs seems excessive.
+  patches = [
+    ./0001-no-more-vergen.patch
+  ];
+
+  # Build script is only needed for vergen and does nothing when not in a git
+  # repo.
+  postPatch = ''
+    rm build.rs
+  '';
+
  useFetchCargoVendor = true;
  cargoHash = "sha256-IgPDe8kuWzJ6nF2DceUbN7fw0eGkoYhu1IGMdlSMFos=";

  nativeBuildInputs = [ pkg-config ];

-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (with darwin.apple_sdk.frameworks; [ CoreServices ]);
+  buildInputs = [
+    openssl
+  ];

  __darwinAllowLocalNetworking = true;

+  nativeCheckInputs = [ openssl ];
+  preCheck = ''
+    patchShebangs examples/tls/create_self_signed_cert.sh
+    (cd examples/tls && chmod +x create_self_signed_cert.sh && ./create_self_signed_cert.sh)
+  '';
+
+  env = {
+    VERGEN_BUILD_TIMESTAMP = "0";
+    VERGEN_BUILD_SEMVER = version;
+    VERGEN_GIT_COMMIT_TIMESTAMP = "0";
+    VERGEN_GIT_BRANCH = "main";
+    VERGEN_RUSTC_SEMVER = rustc.version;
+    VERGEN_RUSTC_CHANNEL = "stable";
+    VERGEN_CARGO_PROFILE = "release";
+    VERGEN_CARGO_FEATURES = "";
+    VERGEN_CARGO_TARGET_TRIPLE = "${stdenv.hostPlatform.rust.rustcTarget}";
+  };
+
  passthru.tests = {
    inherit (nixosTests) rathole;
  };
--- a/pkgs/by-name/sp/spades/package.nix
+++ b/pkgs/by-name/sp/spades/package.nix
@@ -4,7 +4,6 @@
  bzip2,
  cmake,
  fetchFromGitHub,
-  fetchpatch,
  ncurses,
  python3,
  readline,
@@ -12,28 +11,17 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "spades";
-  version = "4.0.0";
+  version = "4.1.0";

  src = fetchFromGitHub {
    owner = "ablab";
    repo = "spades";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-k2+ddJIgGE41KGZODovU9VdurbWerEtdqNrFDwyuFjo=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-JKtWlVf0nXXLgb6BxMgVVtEdjUOOYc0bPaFMDm5O6vg=";
  };

  sourceRoot = "${finalAttrs.src.name}/src";

-  patches = [
-    # https://github.com/ablab/spades/pull/1314
-    (fetchpatch {
-      name = "copytree.patch";
-      url = "https://github.com/ablab/spades/commit/af1f756a46c5da669897b841d4f753af1eaa9588.patch";
-      hash = "sha256-tkT7hb0TqsbLkcTs9u43nzvV8bVdh3G9VKYqFFLrQv8=";
-      stripLen = 3;
-      extraPrefix = "projects/";
-    })
-  ];
-
  cmakeFlags = [
    "-DZLIB_ENABLE_TESTS=OFF"
    "-DSPADES_BUILD_INTERNAL=OFF"
--- a/pkgs/by-name/xe/xen/package.nix
+++ b/pkgs/by-name/xe/xen/package.nix
@@ -12,6 +12,10 @@ buildXenPackage.override { inherit python3Packages; } {
      url = "https://lore.kernel.org/xen-devel/e2caa6648a0b6c429349a9826d8fbc4338222482.1733766758.git.andrii.sultanov@cloud.com/raw";
      hash = "sha256-JC1ueXuC1Jdi2gtUsjOHmTeEx56zjotMMLde5vBonxc=";
    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa467.patch";
+      hash = "sha256-O2IwfRo6BnXAO04xjKmOyrV6J6Q1mAVLHWNCxqIEQGU=";
+    })
  ];
  rev = "ccf400846780289ae779c62ef0c94757ff43bb60";
  hash = "sha256-s0eCBCd6ybl+kLtXCC6E1sk++w7txXn/B/Cg5acQFfY=";
--- a/pkgs/development/libraries/xapian/default.nix
+++ b/pkgs/development/libraries/xapian/default.nix
@@ -47,7 +47,7 @@ let

    passthru.tests = {
      inherit mu xapian-omega;
-      inherit (perlPackages) SearchXapian;
+      inherit (perlPackages) Xapian;
      python-xapian = python3.pkgs.xapian;
    };

--- a/pkgs/development/python-modules/checkdmarc/default.nix
+++ b/pkgs/development/python-modules/checkdmarc/default.nix
@@ -19,7 +19,7 @@

 buildPythonPackage rec {
  pname = "checkdmarc";
-  version = "5.7.8";
+  version = "5.8.1";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
    owner = "domainaware";
    repo = "checkdmarc";
    tag = version;
-    hash = "sha256-fqSRqiakwFk1Cfb79oOEBbPF/fbtumuV7M6Mjl09Vmw=";
+    hash = "sha256-mdEfVfqK277A8QUc8rpLxS2pfdyg4Z5XqWpWkh9mFLk=";
  };

  pythonRelaxDeps = [ "xmltodict" ];
@@ -69,7 +69,7 @@ buildPythonPackage rec {
    description = "Parser for SPF and DMARC DNS records";
    mainProgram = "checkdmarc";
    homepage = "https://github.com/domainaware/checkdmarc";
-    changelog = "https://github.com/domainaware/checkdmarc/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/domainaware/checkdmarc/blob/${src.tag}/CHANGELOG.md";
    license = licenses.asl20;
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/folium/default.nix
+++ b/pkgs/development/python-modules/folium/default.nix
@@ -21,7 +21,7 @@

 buildPythonPackage rec {
  pname = "folium";
-  version = "0.19.4";
+  version = "0.19.5";
  pyproject = true;

  disabled = pythonOlder "3.9";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
    owner = "python-visualization";
    repo = "folium";
    tag = "v${version}";
-    hash = "sha256-qTTJK12nHIhcMkPu4rb2IYWm96EjRafftacrlfeGqZg=";
+    hash = "sha256-jZrGJWSmQXQNlZYldeNSh5AhlTHow5gxCEkksEoKZ7E=";
  };

  build-system = [
--- a/pkgs/development/python-modules/pulumi/default.nix
+++ b/pkgs/development/python-modules/pulumi/default.nix
@@ -1,71 +1,96 @@
 {
  lib,
+  pkgs,
+  pulumiPackages,
  buildPythonPackage,
+  pythonOlder,
+  hatchling,
  protobuf,
-  dill,
  grpcio,
-  pulumi,
-  isPy27,
-  semver,
-  pip,
-  pytestCheckHook,
-  pyyaml,
+  dill,
  six,
+  semver,
+  pyyaml,
+  debugpy,
+  pip,
+  pytest,
+  pytest-asyncio,
+  pytest-timeout,
+  python,
 }:
-buildPythonPackage rec {
-  inherit (pulumi) version src;
+let
+  inherit (pkgs.pulumi) pname version src;
+  inherit (pulumiPackages) pulumi-language-python;
+  sourceRoot = "${src.name}/sdk/python";
+in
+buildPythonPackage {
+  inherit
+    pname
+    version
+    src
+    sourceRoot
+    ;

-  pname = "pulumi";
-  format = "setuptools";
+  outputs = [
+    "out"
+    "dev"
+  ];

-  disabled = isPy27;
+  pyproject = true;

-  propagatedBuildInputs = [
-    semver
+  disabled = pythonOlder "3.9";
+
+  build-system = [ hatchling ];
+
+  dependencies = [
    protobuf
-    dill
    grpcio
-    pyyaml
+    dill
    six
+    semver
+    pyyaml
+    debugpy
+    pip
+  ];
+
+  pythonRelaxDeps = [
+    "grpcio"
+    "pip"
+    "semver"
  ];

  nativeCheckInputs = [
-    pip
-    pulumi.pkgs.pulumi-language-python
-    pytestCheckHook
+    pytest
+    pytest-asyncio
+    pytest-timeout
+    pulumi-language-python
  ];

-  pytestFlagsArray = [ "test/" ];
-
-  sourceRoot = "${src.name}/sdk/python/lib";
-
-  # we apply the modifications done in the pulumi/sdk/python/Makefile
-  # but without the venv code
-  postPatch = ''
-    cp ../../README.md .
-    substituteInPlace setup.py \
-      --replace "3.0.0" "${version}" \
-      --replace "grpcio==1.56.2" "grpcio" \
-      --replace "semver~=2.13" "semver"
+  # https://github.com/pulumi/pulumi/blob/0acaf8060640fdd892abccf1ce7435cd6aae69fe/sdk/python/scripts/test_fast.sh#L10-L11
+  # https://github.com/pulumi/pulumi/blob/0acaf8060640fdd892abccf1ce7435cd6aae69fe/sdk/python/scripts/test_fast.sh#L16
+  installCheckPhase = ''
+    runHook preInstallCheck
+    ${python.executable} -m pytest --ignore=lib/test/automation lib/test
+    pushd lib/test_with_mocks
+    ${python.executable} -m pytest
+    popd
+    runHook postInstallCheck
  '';

  # Allow local networking in tests on Darwin
  __darwinAllowLocalNetworking = true;

-  # Verify that the version substitution works
-  preCheck = ''
-    pip show "${pname}" | grep "Version: ${version}" > /dev/null \
-      || (echo "ERROR: Version substitution seems to be broken"; exit 1)
-  '';
-
  pythonImportsCheck = [ "pulumi" ];

-  meta = with lib; {
+  meta = {
    description = "Modern Infrastructure as Code. Any cloud, any language";
-    homepage = "https://github.com/pulumi/pulumi";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ teto ];
+    homepage = "https://www.pulumi.com";
+    license = lib.licenses.asl20;
    # https://github.com/pulumi/pulumi/issues/16828
-    broken = versionAtLeast protobuf.version "5";
+    broken = lib.versionAtLeast protobuf.version "5";
+    maintainers = with lib.maintainers; [
+      teto
+      tie
+    ];
  };
 }
--- a/pkgs/development/python-modules/zwave-js-server-python/default.nix
+++ b/pkgs/development/python-modules/zwave-js-server-python/default.nix
@@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "zwave-js-server-python";
-  version = "0.60.0";
+  version = "0.60.1";
  pyproject = true;

  disabled = pythonOlder "3.11";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "home-assistant-libs";
    repo = "zwave-js-server-python";
    tag = version;
-    hash = "sha256-+TW+6NhbtANtXf5ITAs+Mz8I7iZk93YYdUkUhp4m7pw=";
+    hash = "sha256-YRC9DA77sLuTxw7YRbhYKxUOaBQaERTV4UWAwAEldhU=";
  };

  build-system = [ setuptools ];
@@ -41,7 +41,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Python wrapper for zwave-js-server";
    homepage = "https://github.com/home-assistant-libs/zwave-js-server-python";
-    changelog = "https://github.com/home-assistant-libs/zwave-js-server-python/releases/tag/${version}";
+    changelog = "https://github.com/home-assistant-libs/zwave-js-server-python/releases/tag/${src.tag}";
    license = with licenses; [ asl20 ];
    maintainers = with maintainers; [ fab ];
    mainProgram = "zwave-js-server-python";
--- a/pkgs/games/vcmi/default.nix
+++ b/pkgs/games/vcmi/default.nix
@@ -29,14 +29,14 @@

 stdenv.mkDerivation rec {
  pname = "vcmi";
-  version = "1.6.6";
+  version = "1.6.7";

  src = fetchFromGitHub {
    owner = "vcmi";
    repo = "vcmi";
    rev = version;
    fetchSubmodules = true;
-    hash = "sha256-JlRZMYS4w6yScpEehNDbtogzeBMq6zwE2Qfsuxmmib8=";
+    hash = "sha256-ImfEKVyuvl8VAsaq34DBe+fiAxf11Mr0jWVI51EsSRs=";
  };

  nativeBuildInputs = [
--- a/pkgs/servers/mail/public-inbox/default.nix
+++ b/pkgs/servers/mail/public-inbox/default.nix
@@ -38,7 +38,7 @@
  Plack,
  PlackMiddlewareReverseProxy,
  PlackTestExternalServer,
-  SearchXapian,
+  Xapian,
  TestSimple13,
  TimeDate,
  URI,
@@ -128,7 +128,7 @@ buildPerlPackage rec {
    ParseRecDescent
    Plack
    PlackMiddlewareReverseProxy
-    SearchXapian
+    Xapian
    TimeDate
    URI
    libgit2 # For Gcf2
--- a/pkgs/tools/admin/pulumi-packages/pulumi-language-go.nix
+++ b/pkgs/tools/admin/pulumi-packages/pulumi-language-go.nix
@@ -9,21 +9,32 @@ buildGoModule rec {

  sourceRoot = "${src.name}/sdk/go/pulumi-language-go";

-  vendorHash = "sha256-eHsTEb4Vff2bfADScLSkZiotSSnT1q0bexlUMaWgqbg=";
+  vendorHash = "sha256-mhwmHxZ+I/IdNGpEzXYJWPDKt7Gnun3HuXsjmFme6GI=";

  ldflags = [
    "-s"
    "-w"
-    "-X github.com/pulumi/pulumi/sdk/v3/go/common/version.Version=${version}"
+    "-X=github.com/pulumi/pulumi/sdk/v3/go/common/version.Version=${version}"
  ];

-  # go: inconsistent vendoring in ...
-  doCheck = false;
+  checkFlags = [
+    "-skip=^${
+      lib.concatStringsSep "$|^" [
+        "TestLanguage"
+        "TestPluginsAndDependencies_vendored"
+        "TestPluginsAndDependencies_subdir"
+        "TestPluginsAndDependencies_moduleMode"
+      ]
+    }$"
+  ];

-  meta = with lib; {
-    description = "Golang language host plugin for Pulumi";
+  meta = {
+    homepage = "https://www.pulumi.com/docs/iac/languages-sdks/go/";
+    description = "Language host for Pulumi programs written in Go";
+    license = lib.licenses.asl20;
    mainProgram = "pulumi-language-go";
-    homepage = "https://github.com/pulumi/pulumi/tree/master/sdk/go";
-    license = licenses.asl20;
+    maintainers = with lib.maintainers; [
+      tie
+    ];
  };
 }
--- a/pkgs/tools/admin/pulumi-packages/pulumi-language-nodejs.nix
+++ b/pkgs/tools/admin/pulumi-packages/pulumi-language-nodejs.nix
@@ -1,31 +1,57 @@
 {
+  lib,
  buildGoModule,
  pulumi,
+  bash,
  nodejs,
+  python3,
 }:
 buildGoModule rec {
-  inherit (pulumi) version src;
-
  pname = "pulumi-language-nodejs";
+  inherit (pulumi) version src;

  sourceRoot = "${src.name}/sdk/nodejs/cmd/pulumi-language-nodejs";

-  vendorHash = "sha256-L91qIud8dWx7dWWEcknKUSTJe+f4OBL8wBg6dKUWgkQ=";
-
-  postPatch = ''
-    # Gives github.com/pulumi/pulumi/pkg/v3: is replaced in go.mod, but not marked as replaced in vendor/modules.txt etc
-    substituteInPlace language_test.go \
-      --replace "TestLanguage" \
-                "SkipTestLanguage"
-  '';
+  vendorHash = "sha256-vmFoMxWK5sj3vsBVFAji0Pz2wtf1H3MJhbrkHshDOno=";

  ldflags = [
    "-s"
    "-w"
-    "-X github.com/pulumi/pulumi/sdk/v3/go/common/version.Version=${version}"
+    "-X=github.com/pulumi/pulumi/sdk/v3/go/common/version.Version=${version}"
+  ];
+
+  checkFlags = [
+    "-skip=^${
+      lib.concatStringsSep "$|^" [
+        "TestLanguage"
+        "TestGetProgramDependencies"
+      ]
+    }$"
  ];

  nativeCheckInputs = [
+    python3 # for TestNonblockingStdout
    nodejs
  ];
+
+  # For patchShebangsAuto (see scripts copied in postInstall).
+  buildInputs = [
+    bash
+  ];
+
+  postInstall = ''
+    cp -t "$out/bin" \
+      ../../dist/pulumi-resource-pulumi-nodejs \
+      ../../dist/pulumi-analyzer-policy
+  '';
+
+  meta = {
+    homepage = "https://www.pulumi.com/docs/iac/languages-sdks/javascript/";
+    description = "Language host for Pulumi programs written in TypeScript & JavaScript (Node.js)";
+    license = lib.licenses.asl20;
+    mainProgram = "pulumi-language-nodejs";
+    maintainers = with lib.maintainers; [
+      tie
+    ];
+  };
 }
--- a/pkgs/tools/admin/pulumi-packages/pulumi-language-python.nix
+++ b/pkgs/tools/admin/pulumi-packages/pulumi-language-python.nix
@@ -1,36 +1,57 @@
 {
+  lib,
  buildGoModule,
  pulumi,
+  bash,
  python3,
 }:
 buildGoModule rec {
-  inherit (pulumi) version src;
-
  pname = "pulumi-language-python";
+  inherit (pulumi) version src;

  sourceRoot = "${src.name}/sdk/python/cmd/pulumi-language-python";

-  vendorHash = "sha256-Q8nnYJJN5+W2luY8JQJj1X9KIk9ad511FBywr+0wBNg=";
-
-  postPatch = ''
-    substituteInPlace main_test.go \
-      --replace "TestDeterminePulumiPackages" \
-                "SkipTestDeterminePulumiPackages"
-  '';
+  vendorHash = "sha256-2K3EIG0xRcRRJES9h72Sk9V442T6dHZbYxz1uxxEKWI=";

  ldflags = [
    "-s"
    "-w"
-    "-X github.com/pulumi/pulumi/sdk/v3/go/common/version.Version=${version}"
+    "-X=github.com/pulumi/pulumi/sdk/v3/go/common/version.Version=${version}"
+  ];
+
+  checkFlags = [
+    "-skip=^${
+      lib.concatStringsSep "$|^" [
+        "TestLanguage"
+        "TestDeterminePulumiPackages"
+      ]
+    }$"
  ];

  nativeCheckInputs = [
    python3
  ];

+  # For patchShebangsAuto (see scripts copied in postInstall).
+  buildInputs = [
+    bash
+    python3
+  ];
+
  postInstall = ''
-    cp ../pulumi-language-python-exec           $out/bin
-    cp ../../dist/pulumi-resource-pulumi-python $out/bin
-    cp ../../dist/pulumi-analyzer-policy-python $out/bin
+    cp -t "$out/bin" \
+      ../pulumi-language-python-exec \
+      ../../dist/pulumi-resource-pulumi-python \
+      ../../dist/pulumi-analyzer-policy-python
  '';
+
+  meta = {
+    homepage = "https://www.pulumi.com/docs/iac/languages-sdks/python/";
+    description = "Language host for Pulumi programs written in Python";
+    license = lib.licenses.asl20;
+    mainProgram = "pulumi-language-python";
+    maintainers = with lib.maintainers; [
+      tie
+    ];
+  };
 }
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -22487,21 +22487,6 @@ with self; {
    };
  };

-  SearchXapian = buildPerlPackage {
-    pname = "Search-Xapian";
-    version = "1.2.25.5";
-    src = fetchurl {
-      url = "mirror://cpan/authors/id/O/OL/OLLY/Search-Xapian-1.2.25.5.tar.gz";
-      hash = "sha256-IE+9xxLWcR/6tmjB9M/AB7Y5qftkrX4ZyyD8EKkQuos=";
-    };
-    buildInputs = [ pkgs.xapian DevelLeak ];
-    meta = {
-      description = "Perl XS frontend to the Xapian C++ search library";
-      homepage = "https://xapian.org";
-      license = with lib.licenses; [ artistic1 gpl1Plus ];
-    };
-  };
-
  SeleniumRemoteDriver = buildPerlPackage {
    pname = "Selenium-Remote-Driver";
    version = "1.49";
@@ -28613,6 +28598,35 @@ with self; {
    };
  };

+  Xapian = buildPerlModule rec {
+    pname = "Xapian";
+    version = "1.4.27";
+    src = fetchurl {
+      url = "https://oligarchy.co.uk/xapian/${version}/xapian-bindings-${version}.tar.xz";
+      sha256 = "1fhq6rydjymmyn79cdza0j4rmlizrrwmf5mx276rlmwyh085wfxs";
+    };
+    buildInputs = [ pkgs.xapian ];
+    preConfigure = ''
+      # FIXME: doesn't work for cross
+      export PERL_LIB="$out/lib/perl5/site_perl/${perl.version}"
+      export PERL_ARCH="$PERL_LIB/$(perl -MConfig -e 'print $Config{archname}')"
+    '';
+    configureFlags = [
+      "--with-perl"
+    ];
+    outputs = [ "out" ]; # no "devdoc"
+    # Use default phases
+    buildPhase = null;
+    checkPhase = null;
+    checkTarget = "check";
+    installPhase = null;
+    meta = {
+      description = "Bindings allowing Xapian to be used from Perl";
+      homepage = "https://xapian.org";
+      license = [ lib.licenses.gpl2Plus ];
+    };
+  };
+
  XMLDescent = buildPerlModule {
    pname = "XML-Descent";
    version = "1.04";
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1468,7 +1468,7 @@ self: super: with self; {

  pueblo = callPackage ../development/python-modules/pueblo { };

-  pulumi = callPackage ../development/python-modules/pulumi { inherit (pkgs) pulumi; };
+  pulumi = callPackage ../development/python-modules/pulumi { };

  pulumi-aws = callPackage ../development/python-modules/pulumi-aws { };