Merge staging-next into staging

2026-07-21 08:01:31 +00:00 · 2026-05-03 18:19:45 +00:00
parent eb74d8e595 101c0b26ff
commit 2021eaf5ce
65 changed files with 746 additions and 567 deletions
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,7 +1,26 @@
-**/deps.nix linguist-generated
+# node/js lock files
+**/package-lock.json linguist-generated
+**/yarn.nix linguist-generated
+**/yarn.lock linguist-generated
+
+# Rust lock files
+**/Cargo.lock linguist-generated
+pkgs/build-support/rust/**/Cargo.lock -linguist-generated
+
+# NuGet, Gradle and others
 **/deps.json linguist-generated
+
+# Ruby lock files
+**/gemset.nix linguist-generated
+**/Gemfile.lock linguist-generated
+
+# PHP lock files
+**/composer.lock linguist-generated
+
+# various package managers and tools
+**/deps.nix linguist-generated
 **/deps.toml linguist-generated
-**/node-packages.nix linguist-generated
+

 pkgs/applications/editors/emacs-modes/*-generated.nix linguist-generated
 pkgs/development/r-modules/*-packages.nix linguist-generated
--- a/lib/customisation.nix
+++ b/lib/customisation.nix
@@ -6,6 +6,8 @@ let
    unsafeGetAttrPos
    ;
  inherit (lib)
+    all
+    attrValues
    functionArgs
    isFunction
    mirrorFunctionArgs
@@ -19,8 +21,6 @@ let
    sortOn
    take
    length
-    filterAttrs
-    flip
    head
    pipe
    isDerivation
@@ -98,19 +98,18 @@ rec {
  */
  overrideDerivation =
    drv: f:
-    let
-      newDrv = derivation (drv.drvAttrs // (f drv));
-    in
-    flip (extendDerivation (seq drv.drvPath true)) newDrv (
+    (extendDerivation (seq drv.drvPath true)) (
      {
        meta = drv.meta or { };
-        passthru = if drv ? passthru then drv.passthru else { };
+        passthru = drv.passthru or { };
      }
      // (drv.passthru or { })
-      // optionalAttrs (drv ? __spliced) {
-        __spliced = { } // (mapAttrs (_: sDrv: overrideDerivation sDrv f) drv.__spliced);
+      // {
+        ${if drv ? __spliced then "__spliced" else null} = mapAttrs (
+          _: sDrv: overrideDerivation sDrv f
+        ) drv.__spliced;
      }
-    );
+    ) (derivation (drv.drvAttrs // (f drv)));

  /**
    `makeOverridable` takes a function from attribute set to attribute set and
@@ -155,73 +154,67 @@ rec {
    let
      # Creates a functor with the same arguments as f
      mirrorArgs = mirrorFunctionArgs f;
-      # Recover overrider and additional attributes for f
-      # When f is a callable attribute set,
-      # it may contain its own `f.override` and additional attributes.
-      # This helper function recovers those attributes and decorate the overrider.
-      recoverMetadata =
-        if isAttrs f then
-          fDecorated:
-          # Preserve additional attributes for f
-          f
-          // fDecorated
-          # Decorate f.override if presented
-          // lib.optionalAttrs (f ? override) {
-            override = fdrv: makeOverridable (f.override fdrv);
+
+      f' =
+        origArgs:
+        let
+          result = f origArgs;
+
+          # Re-call the function but with different arguments
+          overrideArgs = mirrorArgs (
+            /**
+                    Change the arguments with which a certain function is called.
+
+              In some cases, you may find a list of possible attributes to pass in this function's `__functionArgs` attribute, but it will not be complete for an original function like `args@{foo, ...}: ...`, which accepts arbitrary attributes.
+
+              This function was provided by `lib.makeOverridable`.
+            */
+            newArgs: makeOverridable f (origArgs // (if isFunction newArgs then newArgs origArgs else newArgs))
+          );
+        in
+        if isAttrs result then
+          result
+          // {
+            override = overrideArgs;
+            overrideDerivation =
+              fdrv: makeOverridable (mirrorArgs (args: overrideDerivation (f args) fdrv)) origArgs;
+            ${if result ? overrideAttrs then "overrideAttrs" else null} =
+              /**
+                Override the attributes that were passed to `mkDerivation` in order to generate this derivation.
+
+                This function is provided by `lib.makeOverridable`, and indirectly by `callPackage` among others, in order to make the combination of `override` and `overrideAttrs` work.
+                Specifically, it re-adds the `override` attribute to the result of `overrideAttrs`.
+
+                The real implementation of `overrideAttrs` is provided by `stdenv.mkDerivation`.
+              */
+              # NOTE: part of the above documentation had to be duplicated in `mkDerivation`'s `overrideAttrs`.
+              #       design/tech debt issue: https://github.com/NixOS/nixpkgs/issues/273815
+              fdrv: makeOverridable (mirrorArgs (args: (f args).overrideAttrs fdrv)) origArgs;
+          }
+        else if isFunction result then
+          # Transform the result into a functor while propagating its arguments
+          setFunctionArgs result (functionArgs result)
+          // {
+            override = overrideArgs;
          }
        else
-          id;
-      decorate = f': recoverMetadata (mirrorArgs f');
+          result;
    in
-    decorate (
-      origArgs:
-      let
-        result = f origArgs;
+    # Recover overrider and additional attributes for f
+    # When f is a callable attribute set,
+    # it may contain its own `f.override` and additional attributes.
+    # This recovers those attributes and decorates the overrider.
+    if isAttrs f then
+      # Preserve additional attributes for f
+      f
+      // (mirrorArgs f')
+      # Decorate f.override if presented
+      // {
+        ${if f ? override then "override" else null} = fdrv: makeOverridable (f.override fdrv);
+      }

-        # Changes the original arguments with (potentially a function that returns) a set of new attributes
-        overrideWith = newArgs: origArgs // (if isFunction newArgs then newArgs origArgs else newArgs);
-
-        # Re-call the function but with different arguments
-        overrideArgs = mirrorArgs (
-          /**
-            Change the arguments with which a certain function is called.
-
-            In some cases, you may find a list of possible attributes to pass in this function's `__functionArgs` attribute, but it will not be complete for an original function like `args@{foo, ...}: ...`, which accepts arbitrary attributes.
-
-            This function was provided by `lib.makeOverridable`.
-          */
-          newArgs: makeOverridable f (overrideWith newArgs)
-        );
-        # Change the result of the function call by applying g to it
-        overrideResult = g: makeOverridable (mirrorArgs (args: g (f args))) origArgs;
-      in
-      if isAttrs result then
-        result
-        // {
-          override = overrideArgs;
-          overrideDerivation = fdrv: overrideResult (x: overrideDerivation x fdrv);
-          ${if result ? overrideAttrs then "overrideAttrs" else null} =
-            /**
-              Override the attributes that were passed to `mkDerivation` in order to generate this derivation.
-
-              This function is provided by `lib.makeOverridable`, and indirectly by `callPackage` among others, in order to make the combination of `override` and `overrideAttrs` work.
-              Specifically, it re-adds the `override` attribute to the result of `overrideAttrs`.
-
-              The real implementation of `overrideAttrs` is provided by `stdenv.mkDerivation`.
-            */
-            # NOTE: part of the above documentation had to be duplicated in `mkDerivation`'s `overrideAttrs`.
-            #       design/tech debt issue: https://github.com/NixOS/nixpkgs/issues/273815
-            fdrv: overrideResult (x: x.overrideAttrs fdrv);
-        }
-      else if isFunction result then
-        # Transform the result into a functor while propagating its arguments
-        setFunctionArgs result (functionArgs result)
-        // {
-          override = overrideArgs;
-        }
-      else
-        result
-    );
+    else
+      mirrorArgs f';

  /**
    Call the package function in the file `fn` with the required
@@ -272,6 +265,46 @@ rec {
    ```
  */
  callPackageWith =
+    let
+      makeErrorMessage =
+        autoArgs: fn: args: fargs: unpassedArgs:
+        let
+          # The first missing arg
+          arg = head (
+            # Filter out the default args. We did a similar computation in the
+            # happy path, but we're okay recomputing it in an error case
+            filter (name: !fargs.${name}) (attrNames unpassedArgs)
+          );
+          # Get a list of suggested argument names for a given missing one
+          getSuggestions =
+            arg:
+            pipe (autoArgs // args) [
+              attrNames
+              # Only use ones that are at most 2 edits away. While mork would work,
+              # levenshteinAtMost is only fast for 2 or less.
+              (filter (levenshteinAtMost 2 arg))
+              # Put strings with shorter distance first
+              (sortOn (levenshtein arg))
+              # Only take the first couple results
+              (take 3)
+              # Quote all entries
+              (map (x: "\"" + x + "\""))
+            ];
+
+          prettySuggestions =
+            suggestions:
+            if suggestions == [ ] then
+              ""
+            else if length suggestions == 1 then
+              ", did you mean ${elemAt suggestions 0}?"
+            else
+              ", did you mean ${concatStringsSep ", " (lib.init suggestions)} or ${lib.last suggestions}?";
+
+          loc = unsafeGetAttrPos arg fargs;
+          loc' = if loc != null then loc.file + ":" + toString loc.line else "<unknown location>";
+        in
+        "lib.customisation.callPackageWith: Function called without required argument \"${arg}\" at ${loc'}${prettySuggestions (getSuggestions arg)}";
+    in
    autoArgs: fn: args:
    let
      f = if isFunction fn then fn else import fn;
@@ -281,62 +314,20 @@ rec {
      # This includes automatic ones and ones passed explicitly
      allArgs = intersectAttrs fargs autoArgs // args;

-      # a list of argument names that the function requires, but
-      # wouldn't be passed to it
-      missingArgs =
-        # Filter out arguments that have a default value
-        (
-          filterAttrs (name: value: !value)
-            # Filter out arguments that would be passed
-            (removeAttrs fargs (attrNames allArgs))
-        );
-
-      # Get a list of suggested argument names for a given missing one
-      getSuggestions =
-        arg:
-        pipe (autoArgs // args) [
-          attrNames
-          # Only use ones that are at most 2 edits away. While mork would work,
-          # levenshteinAtMost is only fast for 2 or less.
-          (filter (levenshteinAtMost 2 arg))
-          # Put strings with shorter distance first
-          (sortOn (levenshtein arg))
-          # Only take the first couple results
-          (take 3)
-          # Quote all entries
-          (map (x: "\"" + x + "\""))
-        ];
-
-      prettySuggestions =
-        suggestions:
-        if suggestions == [ ] then
-          ""
-        else if length suggestions == 1 then
-          ", did you mean ${elemAt suggestions 0}?"
-        else
-          ", did you mean ${concatStringsSep ", " (lib.init suggestions)} or ${lib.last suggestions}?";
-
-      errorForArg =
-        arg:
-        let
-          loc = unsafeGetAttrPos arg fargs;
-          loc' = if loc != null then loc.file + ":" + toString loc.line else "<unknown location>";
-        in
-        "Function called without required argument \"${arg}\" at "
-        + "${loc'}${prettySuggestions (getSuggestions arg)}";
-
-      # Only show the error for the first missing argument
-      error = errorForArg (head (attrNames missingArgs));
+      # arguments that weren't passed automatically to the function
+      unpassedArgs = removeAttrs fargs (attrNames allArgs);

    in
-    if missingArgs == { } then
+    # if nonempty, check if the function has defaults for those other args
+    if unpassedArgs == { } || all (value: value) (attrValues unpassedArgs) then
      makeOverridable f allArgs
-    # This needs to be an abort so it can't be caught with `builtins.tryEval`,
-    # which is used by nix-env and ofborg to filter out packages that don't evaluate.
-    # This way we're forced to fix such errors in Nixpkgs,
-    # which is especially relevant with allowAliases = false
    else
-      abort "lib.customisation.callPackageWith: ${error}";
+      # Only show the error for the first missing argument
+      # This needs to be an abort so it can't be caught with `builtins.tryEval`,
+      # which is used by nix-env and ofborg to filter out packages that don't evaluate.
+      # This way we're forced to fix such errors in Nixpkgs,
+      # which is especially relevant with allowAliases = false
+      abort (makeErrorMessage autoArgs fn args fargs unpassedArgs);

  /**
    Like `callPackage`, but for a function that returns an attribute
@@ -409,36 +400,28 @@ rec {
  extendDerivation =
    condition: passthru: drv:
    let
-      outputs = drv.outputs or [ "out" ];
-
      commonAttrs =
        drv // (listToAttrs outputsList) // { all = map (x: x.value) outputsList; } // passthru;

-      outputToAttrListElement = outputName: {
+      outputsList = map (outputName: {
        name = outputName;
-        value =
-          commonAttrs
-          // {
-            inherit (drv.${outputName}) type outputName;
-            outputSpecified = true;
-            drvPath =
-              assert condition;
-              drv.${outputName}.drvPath;
-            outPath =
-              assert condition;
-              drv.${outputName}.outPath;
-          }
-          //
-            # TODO: give the derivation control over the outputs.
-            #       `overrideAttrs` may not be the only attribute that needs
-            #       updating when switching outputs.
-            optionalAttrs (passthru ? overrideAttrs) {
-              # TODO: also add overrideAttrs when overrideAttrs is not custom, e.g. when not splicing.
-              overrideAttrs = f: (passthru.overrideAttrs f).${outputName};
-            };
-      };
-
-      outputsList = map outputToAttrListElement outputs;
+        value = commonAttrs // {
+          inherit (drv.${outputName}) type outputName;
+          outputSpecified = true;
+          drvPath =
+            assert condition;
+            drv.${outputName}.drvPath;
+          outPath =
+            assert condition;
+            drv.${outputName}.outPath;
+          # TODO: give the derivation control over the outputs.
+          #       `overrideAttrs` may not be the only attribute that needs
+          #       updating when switching outputs.
+          # TODO: also add overrideAttrs when overrideAttrs is not custom, e.g. when not splicing.
+          ${if passthru ? overrideAttrs then "overrideAttrs" else null} =
+            f: (passthru.overrideAttrs f).${outputName};
+        };
+      }) (drv.outputs or [ "out" ]);
    in
    commonAttrs
    // {
--- a/lib/meta.nix
+++ b/lib/meta.nix
@@ -367,7 +367,7 @@ rec {
  availableOn =
    platform: pkg:
    ((!pkg ? meta.platforms) || any (platformMatch platform) pkg.meta.platforms)
-    && all (elem: !platformMatch platform elem) (pkg.meta.badPlatforms or [ ]);
+    && ((!pkg ? meta.badPlatforms) || !(any (platformMatch platform) pkg.meta.badPlatforms));

  /**
    Mapping of SPDX ID to the attributes in lib.licenses.
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -145,6 +145,12 @@
    githubId = 67933444;
    keys = [ { fingerprint = "B39E B98E 8860 DAFB 0567  0073 A614 B7D2 5134 987A"; } ];
  };
+  _0xferrous = {
+    email = "0xferrous@proton.me";
+    github = "0xferrous";
+    githubId = 213212767;
+    name = "0xferrous";
+  };
  _0xgsvs = {
    email = "venkat.subrahmanyam.34@gmail.com";
    name = "0xgsvs";
--- a/nixos/lib/systemd-lib.nix
+++ b/nixos/lib/systemd-lib.nix
@@ -67,7 +67,9 @@ rec {
  mkPathSafeName = replaceStrings [ "@" ":" "\\" "[" "]" ] [ "-" "-" "-" "" "" ];

  # a type for options that take a unit name
-  unitNameType = types.strMatching "[a-zA-Z0-9@%:_.\\-]+[.](service|socket|device|mount|automount|swap|target|path|timer|scope|slice)";
+  # note: redundantly escaping backslash in the bracket expression makes the regex
+  # slightly more portable even though POSIX doesn't require it.
+  unitNameType = types.strMatching "[a-zA-Z0-9@%:_.\\\\-]+[.](service|socket|device|mount|automount|swap|target|path|timer|scope|slice)";

  makeUnit =
    name: unit:
--- a/nixos/modules/profiles/base.nix
+++ b/nixos/modules/profiles/base.nix
@@ -53,6 +53,9 @@
  # Include support for various filesystems and tools to create / manipulate them.
  boot.supportedFilesystems = lib.mkMerge [
    [
+      "ext2"
+      "ext3"
+      "ext4"
      "btrfs"
      "cifs"
      "f2fs"
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -15539,6 +15539,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  run-nvim = buildVimPlugin {
+    pname = "run.nvim";
+    version = "2.0.0";
+    src = fetchgit {
+      url = "https://codeberg.org/ssnoer/run.nvim";
+      tag = "v2.0.0";
+      hash = "sha256-MTxhhcD6lHLJCfwaivKF9reeUrMog/8I2kJarNWz5Kk=";
+    };
+    meta.homepage = "https://codeberg.org/ssnoer/run.nvim";
+    meta.license = lib.licenses.unfree;
+    meta.hydraPlatforms = [ ];
+  };
+
  runner-nvim = buildVimPlugin {
    pname = "runner-nvim";
    version = "0-unstable-2026-02-11";
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -3899,6 +3899,18 @@ assertNoAdditions {
    };
  });

+  run-nvim = super.run-nvim.overrideAttrs {
+    dependencies = [
+      self.telescope-nvim
+    ];
+
+    checkInputs = [
+      # Transitive depedency of telescope.nvim
+      # Issue: https://github.com/NixOS/nixpkgs/issues/394939
+      self.plenary-nvim
+    ];
+  };
+
  rust-tools-nvim = super.rust-tools-nvim.overrideAttrs {
    dependencies = [ self.nvim-lspconfig ];
  };
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -1108,6 +1108,7 @@ https://github.com/rose-pine/neovim/,main,rose-pine
 https://github.com/seblyng/roslyn.nvim/,,
 https://github.com/keith/rspec.vim/,,
 https://github.com/ccarpita/rtorrent-syntax-file/,,
+https://codeberg.org/ssnoer/run.nvim,,
 https://github.com/TheLazyCat00/runner-nvim/,,
 https://github.com/simrat39/rust-tools.nvim/,,
 https://github.com/rust-lang/rust.vim/,,
--- a/pkgs/by-name/ab/abcmidi/package.nix
+++ b/pkgs/by-name/ab/abcmidi/package.nix
@@ -6,13 +6,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "abcmidi";
-  version = "2026.02.24";
+  version = "2026.04.26";

  src = fetchFromGitHub {
    owner = "sshlien";
    repo = "abcmidi";
    tag = finalAttrs.version;
-    hash = "sha256-Hy0ICuMK4pCaJn/36QwkCfEI5kgmkWyr9V4RhMpGQes=";
+    hash = "sha256-d3mzAMFohBppduP25FUWmmQFFCo5lnP5LFLcoVFwjn0=";
  };

  # TODO: remove once https://github.com/sshlien/abcmidi/pull/15 merged
--- a/pkgs/by-name/az/azure-cli/extensions-manual.nix
+++ b/pkgs/by-name/az/azure-cli/extensions-manual.nix
@@ -192,7 +192,7 @@
      chmod +x $out/${python3.sitePackages}/azext_confcom/bin/genpolicy-linux
    '';
    meta = {
-      maintainers = with lib.maintainers; [ miampf ];
+      maintainers = [ ];
      platforms = lib.platforms.linux; # confcom is linux only
    };
  };
--- a/pkgs/by-name/bi/bitwarden-desktop/package.nix
+++ b/pkgs/by-name/bi/bitwarden-desktop/package.nix
@@ -134,7 +134,7 @@ buildNpmPackage' rec {
    patchShebangs apps/desktop/node_modules

    pushd apps/desktop/desktop_native/napi
-    npm run build
+    npm run build -- --release
    popd

    pushd apps/desktop/desktop_native/proxy
--- a/pkgs/by-name/bu/bun/package.nix
+++ b/pkgs/by-name/bu/bun/package.nix
@@ -17,7 +17,7 @@
 }:

 stdenvNoCC.mkDerivation (finalAttrs: {
-  version = "1.3.11";
+  version = "1.3.13";
  pname = "bun";

  src =
@@ -81,19 +81,19 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    sources = {
      "aarch64-darwin" = fetchurl {
        url = "https://github.com/oven-sh/bun/releases/download/bun-v${finalAttrs.version}/bun-darwin-aarch64.zip";
-        hash = "sha256-b1o0Z+2crsR5W/eM1HZQfZ+HDH1XuGyUX8szgSZ3L/w=";
+        hash = "sha256-VGfj9l26Umuf6pjwzOBO+vwMY+Fpcz7Ce4dqOtMtoZA=";
      };
      "aarch64-linux" = fetchurl {
        url = "https://github.com/oven-sh/bun/releases/download/bun-v${finalAttrs.version}/bun-linux-aarch64.zip";
-        hash = "sha256-0TlE2hKlPsx0v2pyC9HQTEVVwDjf5CI2U1anvkdpH98=";
+        hash = "sha256-cLrkGzkIsKEg4eWMXIrzDnSvrjuNEbDT/djnh937SyI=";
      };
      "x86_64-darwin" = fetchurl {
        url = "https://github.com/oven-sh/bun/releases/download/bun-v${finalAttrs.version}/bun-darwin-x64-baseline.zip";
-        hash = "sha256-+2c5sIv1RVDtqnyCTNWy3KRbagav70CEQwh6YxBfb40=";
+        hash = "sha256-qYumpIDyL9qbNDYmuQak4mqlNhi/hdK8WSjs8rpF8O0=";
      };
      "x86_64-linux" = fetchurl {
        url = "https://github.com/oven-sh/bun/releases/download/bun-v${finalAttrs.version}/bun-linux-x64.zip";
-        hash = "sha256-hhG6k1r4hvBabzh0ChUWAybBXl1dB63vlmEwtEk2B+0=";
+        hash = "sha256-ecB3H6i5LDOq5B4VoODTB+qZ0OLwAxfHHGxTI3p44lo=";
      };
    };
    updateScript = writeShellScript "update-bun" ''
--- a/pkgs/by-name/c2/c2patool/package.nix
+++ b/pkgs/by-name/c2/c2patool/package.nix
@@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "c2patool";
-  version = "0.26.50";
+  version = "0.26.55";

  src = fetchFromGitHub {
    owner = "contentauth";
    repo = "c2pa-rs";
    tag = "c2patool-v${finalAttrs.version}";
-    hash = "sha256-4I+q+6gz+xNz+lhxyC14hZ8yyYG4qzT8TtkLxl8Y71g=";
+    hash = "sha256-QsBS5J35R4/e6JzuurPo0WzHfDunu7mkdrBFLlY165g=";
  };

-  cargoHash = "sha256-Fp+EuxrPx817wjzzq8+f6vBzBe5vyhkXGRsaEqTa/Jo=";
+  cargoHash = "sha256-3rRSFHtQVzXeK+k+A5XW+cMvrxamkxDy57PO6SG6E8E=";

  # use the non-vendored openssl
  env.OPENSSL_NO_VENDOR = 1;
--- a/pkgs/by-name/co/codex-acp/hashes.json
+++ b/pkgs/by-name/co/codex-acp/hashes.json
@@ -1,8 +0,0 @@
-{
-  "version": "0.9.4",
-  "hash": "sha256-sVmy7t1+z88WmYuupVmUA3GYA2kkv3nY7Z3Ic99f5UY=",
-  "cargoHash": "sha256-Ik6pewc6f+cmVKiqVj1g0h7cIxLhE6xOd9p/ySo/EPg=",
-  "codexRev": "c34b30a3c128bb75fcec27ef838c93c99b92fc61",
-  "codexSrcHash": "sha256-SnJHiecKNCHhkiMpbsEwpUarpKLpxn1JOHLHy2vgRog=",
-  "nodeVersionHash": "sha256-q/bOpgF6/0K3MDKXAC+bi1Rb/vCHNhKZpNDbhyYH+oc="
-}
--- a/pkgs/by-name/co/codex-acp/librusty_v8.nix
+++ b/pkgs/by-name/co/codex-acp/librusty_v8.nix
@@ -0,0 +1,24 @@
+# auto-generated file -- DO NOT EDIT!
+{
+  lib,
+  stdenv,
+  fetchurl,
+}:
+
+fetchurl {
+  name = "librusty_v8-146.4.0";
+  url = "https://github.com/denoland/rusty_v8/releases/download/v146.4.0/librusty_v8_release_${stdenv.hostPlatform.rust.rustcTarget}.a.gz";
+  hash =
+    {
+      x86_64-linux = "sha256-5ktNmeSuKTouhGJEqJuAF4uhA4LBP7WRwfppaPUpEVM=";
+      aarch64-linux = "sha256-2/FlsHyBvbBUvARrQ9I+afz3vMGkwbW0d2mDpxBi7Ng=";
+      x86_64-darwin = "sha256-YwzSQPG77NsHFBfcGDh6uBz2fFScHFFaC0/Pnrpke7c=";
+      aarch64-darwin = "sha256-v+LJvjKlbChUbw+WWCXuaPv2BkBfMQzE4XtEilaM+Yo=";
+    }
+    .${stdenv.hostPlatform.system}
+      or (throw "librusty_v8 146.4.0 is not available for ${stdenv.hostPlatform.system}");
+  meta = {
+    version = "146.4.0";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+}
--- a/pkgs/by-name/co/codex-acp/package.nix
+++ b/pkgs/by-name/co/codex-acp/package.nix
@@ -1,60 +1,50 @@
 {
  lib,
  stdenv,
+  callPackage,
  fetchFromGitHub,
-  fetchurl,
  rustPlatform,
  pkg-config,
  openssl,
  libcap,
+  bubblewrap,
+  librusty_v8 ? callPackage ./librusty_v8.nix { },
 }:
 let
-  versionData = builtins.fromJSON (builtins.readFile ./hashes.json);
-  inherit (versionData)
-    version
-    hash
-    cargoHash
-    codexRev
-    codexSrcHash
-    nodeVersionHash
-    ;
-
-  # codex-core uses include_str!("../../../../node-version.txt"), so we need
-  # to place node-version.txt at the vendored workspace root.
-  nodeVersionFile = fetchurl {
-    url = "https://raw.githubusercontent.com/zed-industries/codex/${codexRev}/codex-rs/node-version.txt";
-    hash = nodeVersionHash;
-  };
-
-  # codex-linux-sandbox compiles a patched bubblewrap source tree from
-  # codex-rs/vendor/bubblewrap. Cargo vendoring flattens workspace layout,
-  # so this directory must be provided explicitly.
+  # codex-acp 0.12.0 pins openai/codex rust-v0.124.0 in Cargo.lock.
+  codexRev = "e9fb49366c93a1478ec71cc41ecee415a197d036";
+  codexHash = "sha256-YFnzzwCm9/b30qLDMbkf/rEizuTjeqdCgoBZeS0wNBo=";
  codexSrc = fetchFromGitHub {
-    owner = "zed-industries";
+    owner = "openai";
    repo = "codex";
    rev = codexRev;
-    hash = codexSrcHash;
+    hash = codexHash;
  };
 in
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage (finalAttrs: {
  pname = "codex-acp";
-  inherit version;
+  version = "0.12.0";

  src = fetchFromGitHub {
    owner = "zed-industries";
    repo = "codex-acp";
-    rev = "v${version}";
-    inherit hash;
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-qPqg95FpXHBtyHBJtrfJUwu9GokfmOJgKgqLKQ48u+8=";
  };

-  inherit cargoHash;
+  cargoHash = "sha256-/BZ82qiTy/mPwhf5v5CFrNSB6AxCRFdmHB72L0+KjJw=";

-  preBuild = ''
-    cp ${nodeVersionFile} "$NIX_BUILD_TOP/codex-acp-${version}-vendor/node-version.txt"
+  # fetchCargoVendor only keeps the individual git crate subtrees, so restore
+  # the workspace-root file that codex-core includes via ../../../../node-version.txt.
+  postPatch = ''
+    cp ${codexSrc}/codex-rs/node-version.txt "$cargoDepsCopy/source-git-0/node-version.txt"
  '';

-  env = lib.optionalAttrs stdenv.hostPlatform.isLinux {
-    CODEX_BWRAP_SOURCE_DIR = "${codexSrc}/codex-rs/vendor/bubblewrap";
+  env = {
+    RUSTY_V8_ARCHIVE = librusty_v8;
+  }
+  // lib.optionalAttrs stdenv.hostPlatform.isLinux {
+    CODEX_BWRAP_SOURCE_DIR = "${bubblewrap.src}";
  };

  nativeBuildInputs = [
@@ -70,16 +60,16 @@ rustPlatform.buildRustPackage {

  doCheck = false;

-  passthru.updateScript = ./update.py;
+  passthru.updateScript = ./update.sh;

  meta = {
    description = "An ACP-compatible coding agent powered by Codex";
    homepage = "https://github.com/zed-industries/codex-acp";
-    changelog = "https://github.com/zed-industries/codex-acp/releases/tag/v${version}";
+    changelog = "https://github.com/zed-industries/codex-acp/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ tlvince ];
    platforms = lib.platforms.unix;
    sourceProvenance = with lib.sourceTypes; [ fromSource ];
    mainProgram = "codex-acp";
  };
-}
+})
--- a/pkgs/by-name/co/codex-acp/update.py
+++ b/pkgs/by-name/co/codex-acp/update.py
@@ -1,216 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -I nixpkgs=./. -i python3 -p python3 nix cacert
-
-"""Update script for codex-acp package.
-
-codex-acp depends on crates from zed-industries/codex via a git dependency.
-To keep the Nix expression up to date, we need to:
- update codex-acp source hash,
- extract the pinned codex git revision from Cargo.lock,
- refresh node-version.txt hash for that codex revision,
- refresh codex source hash for vendored bubblewrap on Linux,
- recompute cargoHash.
-"""
-
-from __future__ import annotations
-
-import json
-import os
-import re
-import subprocess
-import tarfile
-import tempfile
-import urllib.request
-from pathlib import Path
-
-SCRIPT_DIR = Path(__file__).resolve().parent
-NIXPKGS_ROOT = SCRIPT_DIR.parents[4]
-HASHES_FILE = SCRIPT_DIR / "hashes.json"
-
-OWNER = "zed-industries"
-REPO = "codex-acp"
-DUMMY_CARGO_HASH = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
-ANSI_ESCAPE_RE = re.compile(r"\x1b\[[0-9;]*m")
-
-
-def run(cmd: list[str], cwd: Path | None = None) -> str:
-    result = subprocess.run(
-        cmd,
-        cwd=str(cwd) if cwd else None,
-        check=False,
-        capture_output=True,
-        text=True,
-    )
-    if result.returncode != 0:
-        output = result.stderr.strip() or result.stdout.strip()
-        msg = f"Command failed ({result.returncode}): {' '.join(cmd)}"
-        if output:
-            msg = f"{msg}\n{output}"
-        raise RuntimeError(msg)
-    return result.stdout.strip()
-
-
-def github_request(url: str) -> dict:
-    headers = {
-        "Accept": "application/vnd.github+json",
-    }
-    token = os.environ.get("GITHUB_TOKEN")
-    if token:
-        headers["Authorization"] = f"Bearer {token}"
-
-    req = urllib.request.Request(url, headers=headers)
-    with urllib.request.urlopen(req) as response:
-        return json.loads(response.read().decode("utf-8"))
-
-
-def fetch_latest_release(owner: str, repo: str) -> str:
-    data = github_request(f"https://api.github.com/repos/{owner}/{repo}/releases/latest")
-    tag_name = data["tag_name"]
-    return tag_name[1:] if tag_name.startswith("v") else tag_name
-
-
-def version_key(version: str) -> tuple[int, ...]:
-    parts = re.findall(r"\d+", version)
-    return tuple(int(part) for part in parts)
-
-
-def should_update(current: str, latest: str) -> bool:
-    return version_key(latest) > version_key(current)
-
-
-def load_hashes(path: Path) -> dict[str, str]:
-    with path.open() as f:
-        return json.load(f)
-
-
-def save_hashes(path: Path, data: dict[str, str]) -> None:
-    with path.open("w") as f:
-        json.dump(data, f, indent=2)
-        f.write("\n")
-
-
-def prefetch_sri(url: str, *, unpack: bool = False) -> str:
-    cmd = ["nix-prefetch-url", "--type", "sha256"]
-    if unpack:
-        cmd.append("--unpack")
-    cmd.append(url)
-
-    raw_hash = run(cmd, cwd=NIXPKGS_ROOT)
-    return run(
-        [
-            "nix",
-            "--extra-experimental-features",
-            "nix-command",
-            "hash",
-            "to-sri",
-            "--type",
-            "sha256",
-            raw_hash,
-        ],
-        cwd=NIXPKGS_ROOT,
-    )
-
-
-def extract_codex_rev_from_tarball(tag: str) -> str:
-    """Extract zed-industries/codex git revision from codex-acp Cargo.lock."""
-    url = f"https://github.com/{OWNER}/{REPO}/archive/refs/tags/{tag}.tar.gz"
-
-    with tempfile.TemporaryDirectory() as tmpdir:
-        tarball_path = Path(tmpdir) / "source.tar.gz"
-        urllib.request.urlretrieve(url, tarball_path)
-
-        with tarfile.open(tarball_path, "r:gz") as tar:
-            for member in tar.getmembers():
-                if not member.name.endswith("Cargo.lock"):
-                    continue
-                cargo_lock = tar.extractfile(member)
-                if cargo_lock is None:
-                    continue
-
-                content = cargo_lock.read().decode("utf-8")
-                match = re.search(r"zed-industries/codex\?branch=acp#([a-f0-9]+)", content)
-                if match:
-                    return match.group(1)
-
-    raise RuntimeError("Could not extract codex git revision from Cargo.lock")
-
-
-def calculate_dependency_hash(attr_path: str) -> str:
-    result = subprocess.run(
-        ["nix-build", "--no-out-link", "-A", attr_path],
-        cwd=str(NIXPKGS_ROOT),
-        check=False,
-        capture_output=True,
-        text=True,
-    )
-    output = ANSI_ESCAPE_RE.sub("", f"{result.stdout}\n{result.stderr}")
-
-    match = re.search(r"got:\s*(sha256-[A-Za-z0-9+/=]+)", output)
-    if match:
-        return match.group(1)
-
-    if result.returncode == 0:
-        raise RuntimeError("nix-build unexpectedly succeeded with placeholder cargoHash")
-
-    raise RuntimeError("Failed to parse cargoHash from nix-build output")
-
-
-def main() -> None:
-    data = load_hashes(HASHES_FILE)
-    current = data["version"]
-    latest = fetch_latest_release(OWNER, REPO)
-
-    print(f"Current: {current}, Latest: {latest}")
-
-    if not should_update(current, latest):
-        print("Already up to date")
-        return
-
-    tag = f"v{latest}"
-    print(f"Updating codex-acp to {latest}...")
-
-    source_url = f"https://github.com/{OWNER}/{REPO}/archive/refs/tags/{tag}.tar.gz"
-    print("Calculating source hash...")
-    source_hash = prefetch_sri(source_url, unpack=True)
-    print(f"  hash: {source_hash}")
-
-    print("Extracting codex git revision from Cargo.lock...")
-    codex_rev = extract_codex_rev_from_tarball(tag)
-    print(f"  codexRev: {codex_rev}")
-
-    codex_src_url = f"https://github.com/zed-industries/codex/archive/{codex_rev}.tar.gz"
-    print("Calculating codex source hash...")
-    codex_src_hash = prefetch_sri(codex_src_url, unpack=True)
-    print(f"  codexSrcHash: {codex_src_hash}")
-
-    node_version_url = (
-        f"https://raw.githubusercontent.com/zed-industries/codex/{codex_rev}/"
-        "codex-rs/node-version.txt"
-    )
-    print("Calculating node-version.txt hash...")
-    node_version_hash = prefetch_sri(node_version_url, unpack=False)
-    print(f"  nodeVersionHash: {node_version_hash}")
-
-    data = {
-        "version": latest,
-        "hash": source_hash,
-        "cargoHash": DUMMY_CARGO_HASH,
-        "codexRev": codex_rev,
-        "codexSrcHash": codex_src_hash,
-        "nodeVersionHash": node_version_hash,
-    }
-    save_hashes(HASHES_FILE, data)
-
-    print("Calculating cargoHash...")
-    attr_path = os.environ.get("UPDATE_NIX_ATTR_PATH", "codex-acp")
-    cargo_hash = calculate_dependency_hash(attr_path)
-    print(f"  cargoHash: {cargo_hash}")
-
-    data["cargoHash"] = cargo_hash
-    save_hashes(HASHES_FILE, data)
-
-    print(f"Updated to {latest}")
-
-
-if __name__ == "__main__":
-    main()
--- a/pkgs/by-name/co/codex-acp/update.sh
+++ b/pkgs/by-name/co/codex-acp/update.sh
@@ -0,0 +1,198 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bash cacert common-updater-scripts coreutils curl gnutar jq nix-update
+
+set -euo pipefail
+
+PACKAGE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+NIXPKGS_ROOT="$(realpath "$PACKAGE_DIR/../../../..")"
+PACKAGE_NIX="$PACKAGE_DIR/package.nix"
+LIBRUSTY_V8_NIX="$PACKAGE_DIR/librusty_v8.nix"
+ATTR_PATH=codex-acp
+OWNER="zed-industries"
+REPO="codex-acp"
+
+github_api_get() {
+  local url="$1"
+  local curl_args=(
+    --fail
+    --silent
+    --show-error
+    -H "Accept: application/vnd.github+json"
+  )
+
+  if [[ -n "${GITHUB_TOKEN:-}" ]]; then
+    curl_args+=(-H "Authorization: Bearer ${GITHUB_TOKEN}")
+  fi
+
+  curl "${curl_args[@]}" "$url"
+}
+
+normalize_version() {
+  local version="$1"
+  echo "${version#v}"
+}
+
+prefetch_sri() {
+  local url="$1"
+  local unpack="${2:-false}"
+  local raw_hash
+  local args=(--type sha256)
+
+  if [[ "$unpack" == "true" ]]; then
+    args+=(--unpack)
+  fi
+
+  raw_hash="$(nix-prefetch-url "${args[@]}" "$url")"
+  nix hash convert --to sri --hash-algo sha256 "$raw_hash"
+}
+
+parse_release_metadata() {
+  local cargo_lock="$1"
+  local codex_metadata codex_tag codex_rev v8_version
+
+  codex_metadata="$(
+    sed -nE 's|.*git\+https://github\.com/openai/codex\?tag=([^#"]+)#([0-9a-f]+).*|\1 \2|p' "$cargo_lock" \
+      | head -n1
+  )"
+  if [[ -z "$codex_metadata" ]]; then
+    echo "Could not find pinned openai/codex dependency in Cargo.lock" >&2
+    return 1
+  fi
+  read -r codex_tag codex_rev <<<"$codex_metadata"
+  if [[ -z "$codex_tag" || -z "$codex_rev" ]]; then
+    echo "Could not parse pinned openai/codex dependency in Cargo.lock" >&2
+    return 1
+  fi
+
+  v8_version="$(
+    awk '
+      /^\[\[package\]\]$/ { in_pkg = 1; is_v8 = 0; next }
+      in_pkg && /^name = "v8"$/ { is_v8 = 1; next }
+      in_pkg && is_v8 && /^version = "/ {
+        gsub(/^version = "/, "")
+        gsub(/"$/, "")
+        print
+        exit
+      }
+    ' "$cargo_lock"
+  )"
+  if [[ -z "$v8_version" ]]; then
+    echo "Could not find v8 package version in Cargo.lock" >&2
+    return 1
+  fi
+
+  printf '%s\n%s\n%s\n' "$codex_tag" "$codex_rev" "$v8_version"
+}
+
+update_codex_pins() {
+  local tmp
+  tmp="$(mktemp)"
+
+  awk -v codex_rev="$CODEX_REV" -v codex_hash="$CODEX_HASH" '
+    /codexRev = "[0-9a-f]+";/ {
+      rev_count++
+      sub(/codexRev = "[0-9a-f]+";/, "codexRev = \"" codex_rev "\";")
+    }
+    /codexHash = "sha256-[^"]+";/ {
+      hash_count++
+      sub(/codexHash = "sha256-[^"]+";/, "codexHash = \"" codex_hash "\";")
+    }
+    { print }
+    END {
+      if (rev_count != 1) {
+        print "Failed to update codexRev in package.nix" > "/dev/stderr"
+        exit 1
+      }
+      if (hash_count != 1) {
+        print "Failed to update codexHash in package.nix" > "/dev/stderr"
+        exit 1
+      }
+    }
+  ' "$PACKAGE_NIX" >"$tmp"
+
+  mv "$tmp" "$PACKAGE_NIX"
+}
+
+write_librusty_v8_nix() {
+  cat >"$LIBRUSTY_V8_NIX" <<EOF
+# auto-generated file -- DO NOT EDIT!
+{
+  lib,
+  stdenv,
+  fetchurl,
+}:
+
+fetchurl {
+  name = "librusty_v8-${V8_VERSION}";
+  url = "https://github.com/denoland/rusty_v8/releases/download/v${V8_VERSION}/librusty_v8_release_\${stdenv.hostPlatform.rust.rustcTarget}.a.gz";
+  hash =
+    {
+      x86_64-linux = "${V8_HASH_X86_64_LINUX}";
+      aarch64-linux = "${V8_HASH_AARCH64_LINUX}";
+      x86_64-darwin = "${V8_HASH_X86_64_DARWIN}";
+      aarch64-darwin = "${V8_HASH_AARCH64_DARWIN}";
+    }
+    .\${stdenv.hostPlatform.system}
+    or (throw "librusty_v8 ${V8_VERSION} is not available for \${stdenv.hostPlatform.system}");
+  meta = {
+    version = "${V8_VERSION}";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+}
+EOF
+}
+
+cd "$NIXPKGS_ROOT"
+
+current_version="$(nix eval --raw -f . "${ATTR_PATH}.version")"
+latest_version="${CODEX_ACP_LATEST_VERSION_OVERRIDE:-}"
+if [[ -z "$latest_version" ]]; then
+  latest_version="$(github_api_get "https://api.github.com/repos/${OWNER}/${REPO}/releases/latest" | jq --raw-output '.tag_name')"
+fi
+latest_version="$(normalize_version "$latest_version")"
+
+echo "latest  version: $latest_version"
+echo "current version: $current_version"
+
+if [[ "$latest_version" == "$current_version" ]]; then
+  echo "codex-acp is already up to date"
+  exit 0
+fi
+
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "$tmpdir"' EXIT
+
+source_tarball="$tmpdir/codex-acp-${latest_version}.tar.gz"
+source_root="$tmpdir/codex-acp-${latest_version}"
+
+curl --fail --silent --show-error --location \
+  "https://github.com/${OWNER}/${REPO}/archive/refs/tags/v${latest_version}.tar.gz" \
+  --output "$source_tarball"
+tar -xzf "$source_tarball" -C "$tmpdir"
+
+mapfile -t release_metadata < <(parse_release_metadata "$source_root/Cargo.lock")
+CODEX_TAG="${release_metadata[0]}"
+CODEX_REV="${release_metadata[1]}"
+V8_VERSION="${release_metadata[2]}"
+export CODEX_REV
+
+echo "pinned codex tag: $CODEX_TAG"
+echo "pinned codex rev: $CODEX_REV"
+echo "pinned v8 version: $V8_VERSION"
+
+src_hash="$(prefetch_sri "https://github.com/${OWNER}/${REPO}/archive/refs/tags/v${latest_version}.tar.gz" true)"
+CODEX_HASH="$(prefetch_sri "https://github.com/openai/codex/archive/${CODEX_REV}.tar.gz" true)"
+export CODEX_HASH
+
+V8_HASH_X86_64_LINUX="$(prefetch_sri "https://github.com/denoland/rusty_v8/releases/download/v${V8_VERSION}/librusty_v8_release_x86_64-unknown-linux-gnu.a.gz")"
+V8_HASH_AARCH64_LINUX="$(prefetch_sri "https://github.com/denoland/rusty_v8/releases/download/v${V8_VERSION}/librusty_v8_release_aarch64-unknown-linux-gnu.a.gz")"
+V8_HASH_X86_64_DARWIN="$(prefetch_sri "https://github.com/denoland/rusty_v8/releases/download/v${V8_VERSION}/librusty_v8_release_x86_64-apple-darwin.a.gz")"
+V8_HASH_AARCH64_DARWIN="$(prefetch_sri "https://github.com/denoland/rusty_v8/releases/download/v${V8_VERSION}/librusty_v8_release_aarch64-apple-darwin.a.gz")"
+export V8_VERSION V8_HASH_X86_64_LINUX V8_HASH_AARCH64_LINUX V8_HASH_X86_64_DARWIN V8_HASH_AARCH64_DARWIN
+
+update-source-version "$ATTR_PATH" "$latest_version" "$src_hash" --ignore-same-version
+update_codex_pins
+write_librusty_v8_nix
+nix-update "$ATTR_PATH" --version skip
+
+echo "updated codex-acp to $latest_version"
--- a/pkgs/by-name/en/ente-web/package.nix
+++ b/pkgs/by-name/en/ente-web/package.nix
@@ -27,7 +27,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ente-web-${enteApp}";
-  version = "1.3.32";
+  version = "1.3.36";

  src = fetchFromGitHub {
    owner = "ente-io";
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
    ];
    tag = "photos-v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-Lwa45QqqyvFgHJ4IiJm2tJy5CdPI5XO3wCzXTeNCTq4=";
+    hash = "sha256-o75r8LFgG3BT3IIPiD9x6gY3fRDoxJ3ZTBPAYr3hLWI=";
  };
  sourceRoot = "${finalAttrs.src.name}/web";

@@ -50,13 +50,13 @@ stdenv.mkDerivation (finalAttrs: {
      sourceRoot
      cargoRoot
      ;
-    hash = "sha256-/FkAxi9KpW/Z6sdo7gfxvCmaAe0JzjubScrcGjbLD88=";
+    hash = "sha256-NYPxaVYEaJVcsRX6wLVJd+/UUJrNel0zTPYGdEv8a+U=";
  };
  cargoRoot = "packages/wasm";

  offlineCache = fetchYarnDeps {
    yarnLock = "${finalAttrs.src}/web/yarn.lock";
-    hash = "sha256-bWOwIa7SD0z2StoUg9HlQGTBq2xXltLgQ2ft8umjg/Y=";
+    hash = "sha256-eGu+s8g0nGijYfjo8RkT5/iBfbwk5cBMacbe/gO03NI=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/gn/gnunet-gtk/package.nix
+++ b/pkgs/by-name/gn/gnunet-gtk/package.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = gnunet.meta // {
    description = "GNUnet GTK User Interface";
-    homepage = "https://git.gnunet.org/gnunet-gtk.git";
+    homepage = "https://git-www.taler.net/gnunet-gtk.git";
    # https://www.gnunet.org/en/news/2025-09-0.25.0.html
    broken = true;
  };
--- a/pkgs/by-name/gn/gnunet-messenger-cli/package.nix
+++ b/pkgs/by-name/gn/gnunet-messenger-cli/package.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation (finalAttrs: {
  version = "0.3.1";

  src = fetchgit {
-    url = "https://git.gnunet.org/messenger-cli.git";
+    url = "https://git-www.taler.net/messenger-cli.git";
    tag = "v${finalAttrs.version}";
    hash = "sha256-8Iby3IZXEZJ1dqVV62xDzXx/qq7JKhVtn6ZLb697ZSw=";
  };
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Decentralized, privacy-preserving networking framework for secure peer-to-peer communication";
-    homepage = "https://git.gnunet.org/messenger-cli.git";
+    homepage = "https://git-www.taler.net/messenger-cli.git";
    license = lib.licenses.gpl3Plus;
    platforms = lib.platforms.all;
    teams = with lib.teams; [ ngi ];
--- a/pkgs/by-name/gn/gnunet/package.nix
+++ b/pkgs/by-name/gn/gnunet/package.nix
@@ -127,7 +127,7 @@ stdenv.mkDerivation (finalAttrs: {
    maintainers = with lib.maintainers; [ pstn ];
    teams = with lib.teams; [ ngi ];
    platforms = lib.platforms.unix;
-    changelog = "https://git.gnunet.org/gnunet.git/tree/ChangeLog?h=v${finalAttrs.version}";
+    changelog = "https://git-www.taler.net/gnunet.git/tree/NEWS/?h=v${finalAttrs.version}";
    # meson: "Can not run test applications in this cross environment." (for dane_verify_crt_raw)
    broken = !stdenv.buildPlatform.canExecute stdenv.hostPlatform;
  };
--- a/pkgs/by-name/go/golangci-lint/package.nix
+++ b/pkgs/by-name/go/golangci-lint/package.nix
@@ -14,16 +14,16 @@

 buildGo126Module (finalAttrs: {
  pname = "golangci-lint";
-  version = "2.11.4";
+  version = "2.12.1";

  src = fetchFromGitHub {
    owner = "golangci";
    repo = "golangci-lint";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-B19aLvfNRY9TOYw/71f2vpNUuSIz8OI4dL0ijGezsas=";
+    hash = "sha256-dMXjfMPdqOPJDC7t6+X4GgfmSf/9ThOuUdp4JgVSmmI=";
  };

-  vendorHash = "sha256-xuoj4+U4tB5gpABKq4Dbp2cxnljxdYoBbO8A7DqPM5E=";
+  vendorHash = "sha256-qTvBE+c1frDZj3NOy0VKYVbsdxEunun67QrKTye5Rx8=";

  subPackages = [ "cmd/golangci-lint" ];

--- a/pkgs/by-name/ha/havn/package.nix
+++ b/pkgs/by-name/ha/havn/package.nix
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "havn";
-  version = "0.3.6";
+  version = "0.3.7";

  src = fetchFromGitHub {
    owner = "mrjackwills";
    repo = "havn";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-eQyWaAPDnfAXvqOVNI9luZIdLMSj1P779yiWOhZ5dsg=";
+    hash = "sha256-9xMrzRfnUA8GG+u255oBhdUWL7NACVtj50QwZuMM4yg=";
  };

-  cargoHash = "sha256-pnXPIEVzAn6ovNo7+3BNzFptleOPFDklSU/e44roahs=";
+  cargoHash = "sha256-Fu+AU46AY/96uwKqDQcQ9inp2VZAZnq0YxR8N6wcQ2M=";

  checkFlags = [
    # Skip tests that require network access
--- a/pkgs/by-name/li/libeufin/package.nix
+++ b/pkgs/by-name/li/libeufin/package.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
  version = "1.3.0";

  src = fetchgit {
-    url = "https://git.taler.net/libeufin.git/";
+    url = "https://git-www.taler.net/libeufin.git/";
    tag = "v${finalAttrs.version}";
    hash = "sha256-bt1NBoiN52CX2Itg8lQ/b0V/MZulBTaD8luNlH4Mwss=";
    fetchSubmodules = true;
@@ -116,7 +116,7 @@ stdenv.mkDerivation (finalAttrs: {
  doCheck = false;

  meta = {
-    homepage = "https://git.taler.net/libeufin.git/";
+    homepage = "https://git-www.taler.net/libeufin.git";
    description = "Integration and sandbox testing for FinTech APIs and data formats";
    license = lib.licenses.agpl3Plus;
    maintainers = with lib.maintainers; [ atemu ];
--- a/pkgs/by-name/li/libgnunetchat/package.nix
+++ b/pkgs/by-name/li/libgnunetchat/package.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
  version = "0.6.1";

  src = fetchgit {
-    url = "https://git.gnunet.org/libgnunetchat.git";
+    url = "https://git-www.taler.net/libgnunetchat.git";
    tag = "v${finalAttrs.version}";
    hash = "sha256-FKFoIuGGPcYVRBrsqn1rnodRVCLAjLKlgZOs9v4H+8w=";
  };
@@ -58,8 +58,8 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    pkgConfigModules = [ "gnunetchat" ];
    description = "Library for secure, decentralized chat using GNUnet network services";
-    homepage = "https://git.gnunet.org/libgnunetchat.git";
-    changelog = "https://git.gnunet.org/libgnunetchat.git/plain/ChangeLog?h=v${finalAttrs.version}";
+    homepage = "https://git-www.taler.net/libgnunetchat.git";
+    changelog = "https://git-www.taler.net/libgnunetchat.git/plain/ChangeLog?h=v${finalAttrs.version}";
    license = lib.licenses.gpl3Plus;
    platforms = lib.platforms.all;
    teams = with lib.teams; [ ngi ];
--- a/pkgs/by-name/mc/mcp-gateway/package.nix
+++ b/pkgs/by-name/mc/mcp-gateway/package.nix
@@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "mcp-gateway";
-  version = "2.9.1";
+  version = "2.11.0";

  src = fetchFromGitHub {
    owner = "MikkoParkkola";
    repo = "mcp-gateway";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-jPggWHX/Qz3sMh3P791D9WRMsppy3xRfUXd3jAcef5M=";
+    hash = "sha256-7IALz7hOnCeKtiEm8b3M7v5oy4hw173viyhNeqQIhTI=";
  };

-  cargoHash = "sha256-TLjiI6mgWRkxZEifbyLzZpHj+486RYoGY2GOXsh/1Bs=";
+  cargoHash = "sha256-B5HRETFryzLqQhdIqRFj0apZS0wMggW2MHE2VsbB22Y=";

  nativeInstallCheckInputs = [
    versionCheckHook
--- a/pkgs/by-name/my/mympd/package.nix
+++ b/pkgs/by-name/my/mympd/package.nix
@@ -18,13 +18,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "mympd";
-  version = "25.0.1";
+  version = "25.0.2";

  src = fetchFromGitHub {
    owner = "jcorporation";
    repo = "myMPD";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-qi+VzDe91yEQzNEcUSuhcuxF76FmBsVkmb5LCB+yjP0=";
+    sha256 = "sha256-DF2+n6yiMOhHIS271YKzsEX0EZ7UXAtojVv48m7GSmQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/my/mystmd/package.nix
+++ b/pkgs/by-name/my/mystmd/package.nix
@@ -1,30 +1,96 @@
 {
+  bun,
  lib,
-  buildNpmPackage,
  fetchFromGitHub,
  mystmd,
+  nodejs,
+  stdenv,
  testers,
  nix-update-script,
+  writableTmpDirAsHomeHook,
 }:
-
-buildNpmPackage rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "mystmd";
-  version = "1.3.18";
+  version = "1.8.3";
+
+  strictDeps = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "jupyter-book";
    repo = "mystmd";
-    rev = "mystmd@${version}";
-    hash = "sha256-20Cxs4ib7xRn4UC9ShiQ+KnyrTCmW/vII7QN9BObY78=";
+    tag = "mystmd@${finalAttrs.version}";
+    hash = "sha256-OmREjNDgmq5+nidBZh4DUy9bMtDeHMrGWZEqKo5TUrQ=";
  };

-  npmDepsHash = "sha256-dcjOxEYTG/EnBRu+RE7cpSEvNmG32QsDDYzItaNTpa0=";
+  node_modules = stdenv.mkDerivation {
+    inherit (finalAttrs) src version;
+    pname = "${finalAttrs.pname}-node_modules";

-  dontNpmInstall = true;
+    nativeBuildInputs = [
+      bun
+      nodejs
+      writableTmpDirAsHomeHook
+    ];
+
+    dontConfigure = true;
+    dontFixup = true;
+
+    buildPhase = ''
+      runHook preBuild
+      export BUN_INSTALL_CACHE_DIR=$(mktemp -d)
+      bun install --no-progress --frozen-lockfile --no-cache
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/node_modules
+      cp -R ./node_modules $out
+
+      runHook postInstall
+    '';
+
+    outputHash =
+      {
+        x86_64-linux = "sha256-4EQkvsoji9M4VCrdwyHm+ncd4XFjgAf34Kt+YeM3qjs=";
+        aarch64-linux = "sha256-xm4T1BL3AyRsYOERz4LhG4ZJQkSMzspoA+l60OND3E0=";
+        x86_64-darwin = "sha256-L+zY9O5ridMvZEhGH0R56P3XiDlYF3UrFZwmOYlqxYY=";
+        aarch64-darwin = "sha256-ZUx+jF7IcEbUCnUUeW0uOFgEpO9UIJpP3/VpUJ5ulAM=";
+      }
+      .${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
+
+    outputHashAlgo = "sha256";
+    outputHashMode = "recursive";
+  };
+
+  nativeBuildInputs = [
+    bun
+    nodejs
+  ];
+
+  buildInputs = [
+    nodejs
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    cp -R ${finalAttrs.node_modules}/node_modules .
+    patchShebangs node_modules
+    bun run build
+
+    runHook postBuild
+  '';

  installPhase = ''
    runHook preInstall

+    mkdir -p $out/lib
+    cp -r node_modules $out/lib/
+    cp -r packages $out/lib/
    install -D packages/mystmd/dist/myst.cjs $out/bin/myst

    runHook postInstall
@@ -32,8 +98,8 @@ buildNpmPackage rec {

  passthru = {
    tests.version = testers.testVersion {
-      package = mystmd;
-      version = "v${version}";
+      package = finalAttrs.finalPackage;
+      version = "v${finalAttrs.version}";
    };
    updateScript = nix-update-script { };
  };
@@ -41,9 +107,9 @@ buildNpmPackage rec {
  meta = {
    description = "Command line tools for working with MyST Markdown";
    homepage = "https://github.com/jupyter-book/mystmd";
-    changelog = "https://github.com/jupyter-book/mystmd/blob/${src.rev}/packages/myst-cli/CHANGELOG.md";
+    changelog = "https://github.com/jupyter-book/mystmd/blob/${finalAttrs.src.rev}/packages/myst-cli/CHANGELOG.md";
    license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ tbutter ];
    mainProgram = "myst";
  };
-}
+})
--- a/pkgs/by-name/ni/nixfmt-rs/package.nix
+++ b/pkgs/by-name/ni/nixfmt-rs/package.nix
@@ -12,7 +12,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "nixfmt-rs";
-  version = "0.2.0";
+  version = "0.3.0";

  __structuredAttrs = true;
  strictDeps = true;
@@ -21,10 +21,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "Mic92";
    repo = "nixfmt-rs";
    tag = finalAttrs.version;
-    hash = "sha256-eBVi22+EGMYWv2t/seoPqou8PuABxVcsWTFcrNYP6So=";
+    hash = "sha256-H4APJn0NGaD2LrkjcJ7io+fu3aKoO0Cn2BJk731YlqQ=";
  };

-  cargoHash = "sha256-fadjOtfB8bFuhTN9mAmi2A526boW7Aje39IBjdxszok=";
+  cargoHash = "sha256-gJq6PxA6WaWObHnIL7jsKQBOSHQj31kzlrM95OY27ro=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/by-name/pa/pantheon-tweaks/package.nix
+++ b/pkgs/by-name/pa/pantheon-tweaks/package.nix
@@ -17,13 +17,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "pantheon-tweaks";
-  version = "2.5.1";
+  version = "2.5.2";

  src = fetchFromGitHub {
    owner = "pantheon-tweaks";
    repo = "pantheon-tweaks";
    rev = finalAttrs.version;
-    hash = "sha256-haiKElDv6lvZeROpiCc2n3I0Ho/l6HjUhu/yBISsT2E=";
+    hash = "sha256-C6QgGjNjkgJ1qCNNe5gkwjzMfBosxjDIdVyIokCRkbE=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/py/pytr/package.nix
+++ b/pkgs/by-name/py/pytr/package.nix
@@ -9,14 +9,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "pytr";
-  version = "0.4.7";
+  version = "0.4.9";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pytr-org";
    repo = "pytr";
    tag = "v${version}";
-    hash = "sha256-+GIjNtlg9q125jf8p5AyE1F+lT0mfqQaSJbusp0kRmo=";
+    hash = "sha256-W6OtXK9c8NV8wIhvaym2tAg6UNJtCEPk1mt5VB0+Rkg=";
  };

  build-system = with python3Packages; [
@@ -30,9 +30,9 @@ python3Packages.buildPythonApplication rec {
    coloredlogs
    cryptography
    curl-cffi
-    ecdsa
    packaging
    pathvalidate
+    playwright
    pygments
    requests-futures
    shtab
--- a/pkgs/by-name/rc/rclone/package.nix
+++ b/pkgs/by-name/rc/rclone/package.nix
@@ -17,7 +17,7 @@

 buildGoModule (finalAttrs: {
  pname = "rclone";
-  version = "1.73.5";
+  version = "1.74.0";

  outputs = [
    "out"
@@ -28,10 +28,10 @@ buildGoModule (finalAttrs: {
    owner = "rclone";
    repo = "rclone";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-9oWxL6VHPOl0IJgc7uBWfDkJlUBMvqsEQR8kVH37DZo=";
+    hash = "sha256-nYtUPC7qaX0mvg4AtCIkDT6v7y0zZPn02XnR7lNhtio=";
  };

-  vendorHash = "sha256-ZEkZbP2r9PFAURkJNR1829VgaL1GXq72mt5Hnz5++kY=";
+  vendorHash = "sha256-fRUHQ0cTggHn6rJY4QiFgFBdQYAQ/cD0feUTstp2jMg=";

  subPackages = [ "." ];

--- a/pkgs/by-name/rn/rnote/package.nix
+++ b/pkgs/by-name/rn/rnote/package.nix
@@ -26,18 +26,18 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "rnote";
-  version = "0.14.1";
+  version = "0.14.2";

  src = fetchFromGitHub {
    owner = "flxzt";
    repo = "rnote";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-uOfFZuxxU8StirS5E/Tm8Lg58u8s4USgA9BeEUKw3xE=";
+    hash = "sha256-uuLoc1nWlb3Xm/WSrvjCit1G8kUZA3+HIW8akFXPGi4=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-N3mh/hGQ/Pu01uGL5e8BZvrrEm3u7cnJHSqt5FHynKQ=";
+    hash = "sha256-eDKyA8LaH+nvDcCG74ucWYSJc8qLmps1xz3WPHoOJ0w=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/sp/spotdl/package.nix
+++ b/pkgs/by-name/sp/spotdl/package.nix
@@ -8,14 +8,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "spotdl";
-  version = "4.4.3";
+  version = "4.4.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "spotDL";
    repo = "spotify-downloader";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-opbbcYjsR+xuo2uQ7Ic/2+BfkiwdEe1xD/whRonDBWo=";
+    hash = "sha256-GKkkYA1Z6YsthIKE8Hf/vKRHU7kPCKabOh28i/JSSOc=";
  };

  build-system = with python3Packages; [ hatchling ];
@@ -26,11 +26,14 @@ python3Packages.buildPythonApplication (finalAttrs: {
    with python3Packages;
    [
      beautifulsoup4
+      datastar-py
      fastapi
+      jinja2
      mutagen
      platformdirs
      pydantic
      pykakasi
+      python-multipart
      python-slugify
      pytube
      rapidfuzz
--- a/pkgs/by-name/ta/taldir/package.nix
+++ b/pkgs/by-name/ta/taldir/package.nix
@@ -9,7 +9,7 @@ buildGoModule (finalAttrs: {
  version = "1.0.5";

  src = fetchgit {
-    url = "https://git.taler.net/taldir.git";
+    url = "https://git-www.taler.net/taldir.git";
    tag = "v${finalAttrs.version}";
    hash = "sha256-ZKNkMV0IV6E+yCQeabGXpIQclx1S4YEgFn4whGXTaks=";
  };
@@ -40,7 +40,7 @@ buildGoModule (finalAttrs: {
  doCheck = false;

  meta = {
-    homepage = "https://git.taler.net/taldir.git";
+    homepage = "https://git-www.taler.net/taldir.git";
    description = "Directory service to resolve wallet mailboxes by messenger addresses";
    teams = with lib.teams; [ ngi ];
    # themadbit will maintain after being added to maintainers
--- a/pkgs/by-name/ta/taler-challenger/package.nix
+++ b/pkgs/by-name/ta/taler-challenger/package.nix
@@ -24,12 +24,12 @@ stdenv.mkDerivation (finalAttrs: {
  version = "1.3.0";

  src = fetchgit {
-    url = "https://git.taler.net/challenger.git";
+    url = "https://git-www.taler.net/challenger.git";
    tag = "v${finalAttrs.version}";
    hash = "sha256-oomrqpA/V2sNTRzFbHS7rnZdTIs8w+SRYsa9AYDFn5o=";
  };

-  # https://git.taler.net/challenger.git/tree/bootstrap
+  # https://git-www.taler.net/challenger.git/tree/bootstrap
  preAutoreconf = ''
    # Generate Makefile.am in contrib/
    pushd contrib
@@ -73,7 +73,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "OAuth 2.0-based authentication service that validates user can receive messages at a certain address";
-    homepage = "https://git.taler.net/challenger.git";
+    homepage = "https://git-www.taler.net/challenger.git";
    license = lib.licenses.agpl3Plus;
    maintainers = with lib.maintainers; [ wegank ];
    teams = with lib.teams; [ ngi ];
--- a/pkgs/by-name/ta/taler-depolymerization/package.nix
+++ b/pkgs/by-name/ta/taler-depolymerization/package.nix
@@ -8,7 +8,7 @@ rustPlatform.buildRustPackage {
  version = "0-unstable-2024-06-17";

  src = fetchgit {
-    url = "https://git.taler.net/depolymerization.git/";
+    url = "https://git-www.taler.net/depolymerization.git";
    rev = "a0d27ac3bba22d4934ca9f7b244b0d9e45bb484f";
    hash = "sha256-HmQ/DPq/O6aODWms/bSsCVgBF7z246xxfYxiHrAkgYw=";
  };
@@ -35,7 +35,7 @@ rustPlatform.buildRustPackage {

  meta = {
    description = "Wire gateway for Bitcoin/Ethereum";
-    homepage = "https://git.taler.net/depolymerization.git/";
+    homepage = "https://git-www.taler.net/depolymerization.git/";
    license = lib.licenses.agpl3Only;
    teams = [ lib.teams.ngi ];
  };
--- a/pkgs/by-name/ta/taler-exchange/package.nix
+++ b/pkgs/by-name/ta/taler-exchange/package.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
  version = "1.3.0";

  src = fetchgit {
-    url = "https://git.taler.net/exchange.git";
+    url = "https://git-www.taler.net/exchange.git";
    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
    hash = "sha256-FePuJUEa01E2jlAOdHryzkFwXqNcU+AkMKs1pamNJn8=";
@@ -133,7 +133,7 @@ stdenv.mkDerivation (finalAttrs: {
      payment system.
    '';
    homepage = "https://taler.net/";
-    changelog = "https://git.taler.net/exchange.git/tree/ChangeLog";
+    changelog = "https://git-www.taler.net/exchange.git/tree/ChangeLog?h=v${finalAttrs.version}";
    license = lib.licenses.agpl3Plus;
    maintainers = with lib.maintainers; [ astro ];
    teams = with lib.teams; [ ngi ];
--- a/pkgs/by-name/ta/taler-mdb/package.nix
+++ b/pkgs/by-name/ta/taler-mdb/package.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
  version = "1.3.0";

  src = fetchgit {
-    url = "https://git.taler.net/taler-mdb.git";
+    url = "https://git-www.taler.net/taler-mdb.git";
    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
    hash = "sha256-bslsC/m75kt8JoIQPp53u64SxghwZloOHehctphpNwI=";
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
  doCheck = true;

  meta = {
-    homepage = "https://git.taler.net/taler-mdb.git";
+    homepage = "https://git-www.taler.net/taler-mdb.git";
    description = "Sales integration with the Multi-Drop-Bus of Snack machines, NFC readers and QR code display";
    license = lib.licenses.agpl3Plus;
    teams = with lib.teams; [ ngi ];
--- a/pkgs/by-name/ta/taler-merchant/package.nix
+++ b/pkgs/by-name/ta/taler-merchant/package.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
  version = "1.3.0";

  src = fetchgit {
-    url = "https://git.taler.net/merchant.git";
+    url = "https://git-www.taler.net/merchant.git";
    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
    hash = "sha256-nrXokwZ0IFXAH3B12/FDAhhyE6JAiiJ59cuWLwLM684=";
@@ -113,7 +113,7 @@ stdenv.mkDerivation (finalAttrs: {
      to know the customer's physical address.
    '';
    homepage = "https://taler.net/";
-    changelog = "https://git.taler.net/merchant.git/tree/ChangeLog";
+    changelog = "https://git-www.taler.net/merchant.git/tree/ChangeLog?h=v${finalAttrs.version}";
    license = lib.licenses.agpl3Plus;
    maintainers = with lib.maintainers; [ astro ];
    teams = with lib.teams; [ ngi ];
--- a/pkgs/by-name/ta/taler-sync/package.nix
+++ b/pkgs/by-name/ta/taler-sync/package.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
  version = "1.3.0";

  src = fetchgit {
-    url = "https://git.taler.net/sync.git";
+    url = "https://git-www.taler.net/sync.git";
    tag = "v${finalAttrs.version}";
    hash = "sha256-1m26ORKsN0GHJWQ/5gtMO3x1ng+GsZK9Y80413vF5pI=";
  };
@@ -55,7 +55,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Backup and synchronization service";
-    homepage = "https://git.taler.net/sync.git";
+    homepage = "https://git-www.taler.net/sync.git";
    license = lib.licenses.agpl3Plus;
    maintainers = with lib.maintainers; [ wegank ];
    teams = with lib.teams; [ ngi ];
--- a/pkgs/by-name/ta/taler-twister/package.nix
+++ b/pkgs/by-name/ta/taler-twister/package.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation (finalAttrs: {
  version = "1.0.0";

  src = fetchgit {
-    url = "https://git.taler.net/twister.git";
+    url = "https://git-www.taler.net/twister.git";
    tag = "v${finalAttrs.version}";
    hash = "sha256-ir+kU9bCWwhqR88hmNHB5cm1DXOQowI5y6GdhWpX/L0=";
  };
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
  doInstallCheck = true;

  meta = {
-    homepage = "https://git.taler.net/twister.git";
+    homepage = "https://git-www.taler.net/twister.git";
    description = "Fault injector for HTTP traffic";
    teams = with lib.teams; [ ngi ];
    maintainers = [ ];
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -2000,6 +2000,19 @@
    };
  };

+  plank = {
+    version = "0.1.0";
+    url = "github:plankevm/plank-monorepo";
+    hash = "sha256-B2UmV5i2ELlmzyrR8iFIOQcSpHeRQl4I6lxakMskolg=";
+    location = "plank-tree-sitter";
+    meta = {
+      license = lib.licenses.mit;
+      maintainers = with lib.maintainers; [
+        _0xferrous
+      ];
+    };
+  };
+
  po = {
    version = "0-unstable-2024-04-20";
    url = "github:erasin/tree-sitter-po";
--- a/pkgs/by-name/va/vaultwarden/package.nix
+++ b/pkgs/by-name/va/vaultwarden/package.nix
@@ -8,9 +8,10 @@
  pkg-config,
  openssl,
  libiconv,
-  dbBackend ? "sqlite",
+  dbBackend ? "sqlite_system",
  libmysqlclient,
  libpq,
+  sqlite,
 }:

 let
@@ -19,16 +20,16 @@ in

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "vaultwarden";
-  version = "1.35.8";
+  version = "1.36.0";

  src = fetchFromGitHub {
    owner = "dani-garcia";
    repo = "vaultwarden";
    tag = finalAttrs.version;
-    hash = "sha256-bEPwH0+b4cQTh1hNiiX2qvTNeRxxShm2JXNKNfn4xm8=";
+    hash = "sha256-jc2f7Ia2c+U1cQBXmyzfQAgFMFoAPexLejs6/FKaN9I=";
  };

-  cargoHash = "sha256-gcE3qfSVCk08haADyqOff4R0ekd9Q6RB59LUtow9Yi4=";
+  cargoHash = "sha256-sjWBM9SsI/7AQ8SuFiTR19l8kqp3rhy64Uh/1TatH6A=";

  # used for "Server Installed" version in admin panel
  env.VW_VERSION = finalAttrs.version;
@@ -41,7 +42,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
    libiconv
  ]
  ++ lib.optional (dbBackend == "mysql") libmysqlclient
-  ++ lib.optional (dbBackend == "postgresql") libpq;
+  ++ lib.optional (dbBackend == "postgresql") libpq
+  ++ lib.optional (dbBackend == "sqlite_system") sqlite;

  buildFeatures = dbBackend;

--- a/pkgs/by-name/va/vaultwarden/webvault.nix
+++ b/pkgs/by-name/va/vaultwarden/webvault.nix
@@ -10,16 +10,25 @@

 buildNpmPackage rec {
  pname = "vaultwarden-webvault";
-  version = "2026.3.1+0";
+  version = "2026.4.1+0";

  src = fetchFromGitHub {
    owner = "vaultwarden";
    repo = "vw_web_builds";
    tag = "v${version}";
-    hash = "sha256-nUhSoqf655eOs+rKqAZB0XzPD6ePL6CIxVAnB5dmJAs=";
+    hash = "sha256-CIKhdCQwx1zS8rkOtZoG9WDxtweSmrCNL6HfZXi+mM8=";
  };

-  npmDepsHash = "sha256-dlYN2aiv6XbDXQVstfI6XIe+X5Q1lqs62eNalGTGx7k=";
+  # Upstream lockfile is out of sync for @napi-rs/cli (spec 3.5.1, resolved
+  # 3.2.0), which makes offline `npm ci` hit the registry. The desktop
+  # workspace is unused here. https://github.com/bitwarden/clients/pull/20480
+  postPatch = ''
+    substituteInPlace package-lock.json \
+      --replace-fail '"@napi-rs/cli": "3.5.1"' '"@napi-rs/cli": "3.2.0"'
+  '';
+
+  npmDepsFetcherVersion = 2;
+  npmDepsHash = "sha256-NBhII5HySIkv0bCeWjH6MknX5NMp11Gwno7RnfCKgjc=";

  nativeBuildInputs = [
    python3
--- a/pkgs/by-name/wx/wxmaxima/package.nix
+++ b/pkgs/by-name/wx/wxmaxima/package.nix
@@ -13,13 +13,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "wxmaxima";
-  version = "26.01.0";
+  version = "26.05.0";

  src = fetchFromGitHub {
    owner = "wxMaxima-developers";
    repo = "wxmaxima";
    rev = "Version-${finalAttrs.version}";
-    hash = "sha256-RoFOmBro8Oo6P3gglaz8ofkrhwxnwy6Rf0po3jOY5D4=";
+    hash = "sha256-/O57UjejHb9lDYiLs9jdtmt/S7CTHY0tlq07fAxh5TM=";
  };

  buildInputs = [
--- a/pkgs/by-name/xf/xfce4-session/package.nix
+++ b/pkgs/by-name/xf/xfce4-session/package.nix
@@ -7,6 +7,7 @@
  xfce4-dev-tools,
  wrapGAppsHook3,
  polkit,
+  bashNonInteractive,
  xfce4-exo,
  libxfce4util,
  libxfce4ui,
@@ -37,9 +38,11 @@ stdenv.mkDerivation (finalAttrs: {
    pkg-config
    xfce4-dev-tools
    wrapGAppsHook3
+    iceauth
  ];

  buildInputs = [
+    bashNonInteractive
    xfce4-exo
    gtk3
    gtk-layer-shell
@@ -50,9 +53,10 @@ stdenv.mkDerivation (finalAttrs: {
    libwnck
    xfconf
    polkit
-    iceauth
  ];

+  strictDeps = true;
+
  configureFlags = [
    "--enable-maintainer-mode"
    "--with-xsession-prefix=${placeholder "out"}"
--- a/pkgs/by-name/ze/zensical/package.nix
+++ b/pkgs/by-name/ze/zensical/package.nix
@@ -8,7 +8,7 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "zensical";
-  version = "0.0.31";
+  version = "0.0.39";
  pyproject = true;

  # We fetch from PyPi, because GitHub repo does not contain all sources.
@@ -16,12 +16,12 @@ python3Packages.buildPythonApplication (finalAttrs: {
  # We could combine sources, but then nix-update won't work.
  src = fetchPypi {
    inherit (finalAttrs) pname version;
-    hash = "sha256-nBLwe95wxL/bE9bK4b7fjRgGTSV6boESihUlArKKj8M=";
+    hash = "sha256-KocTxUNirbCIHpsFFLWtmmljJHVmmd7bVfocvzzMDto=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-5lsL42TYg7AsnCxzLcg/KEewcTKLBKvRMJtu+fBkgeY=";
+    hash = "sha256-dsmb65a/dDQJXxPqM2re1w9NkomuL4JtJm0c09rN4BI=";
  };

  nativeBuildInputs = with rustPlatform; [
@@ -36,6 +36,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
    pygments
    pymdown-extensions
    pyyaml
+    tomli
  ];

  nativeCheckInputs = [ versionCheckHook ];
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/about/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/about/default.nix
@@ -28,13 +28,13 @@

 stdenv.mkDerivation rec {
  pname = "switchboard-plug-about";
-  version = "8.2.2";
+  version = "8.2.3";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = "settings-system";
    tag = version;
-    hash = "sha256-SPFCBsk4tVR+5Q6uuDG/fTIn+4TXdeAobfQxkmxMiW0=";
+    hash = "sha256-skuMgLZTkJEWrmDGwSuCivsJrvKIUYT2YISYj7/BVe4=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/claude-agent-sdk/default.nix
+++ b/pkgs/development/python-modules/claude-agent-sdk/default.nix
@@ -13,14 +13,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "claude-agent-sdk";
-  version = "0.1.68";
+  version = "0.1.72";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "anthropics";
    repo = "claude-agent-sdk-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-m42AYi9OkII9NOSNV9D9M7GMamh2Qncpz21s7BS1E70=";
+    hash = "sha256-F8V1BUC0jeGWWFBS1GE931bycm0xJlAmoH1kPpxkk9o=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/datastar-py/default.nix
+++ b/pkgs/development/python-modules/datastar-py/default.nix
@@ -0,0 +1,40 @@
+{
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatchling,
+  lib,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "datastar-py";
+  version = "1.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "starfederation";
+    repo = "datastar-python";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-79pdSzHwkF8JX3rF5PIEvx//rKRvX3H1B2382Wfbm9U=";
+  };
+
+  build-system = [ hatchling ];
+
+  pythonImportsCheck = [ "datastar_py" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  # tests were only added after 1.0.0
+  # TODO enable after update
+  doCheck = false;
+
+  meta = {
+    changelog = "https://github.com/starfederation/datastar-python/releases/tag/${finalAttrs.src.tag}";
+    description = "Helper functions and classes for the Datastar library";
+    homepage = "https://github.com/starfederation/datastar-python";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.dotlambda ];
+  };
+})
--- a/pkgs/development/python-modules/django-hijack/default.nix
+++ b/pkgs/development/python-modules/django-hijack/default.nix
@@ -19,14 +19,14 @@

 buildPythonPackage rec {
  pname = "django-hijack";
-  version = "3.7.7";
+  version = "3.7.8";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "django-hijack";
    repo = "django-hijack";
    tag = version;
-    hash = "sha256-qPghlZpzhFZZhmJUJSXjDvE9zB3QFVk1BTu9z0KEa/g=";
+    hash = "sha256-91ziHv39GmXrbswqOyVHmSv11LqKNT318/8mx5iIdHg=";
  };

  build-system = [
--- a/pkgs/development/python-modules/insteon-frontend-home-assistant/default.nix
+++ b/pkgs/development/python-modules/insteon-frontend-home-assistant/default.nix
@@ -7,13 +7,13 @@

 buildPythonPackage rec {
  pname = "insteon-frontend-home-assistant";
-  version = "0.6.1";
+  version = "0.6.2";
  pyproject = true;

  src = fetchPypi {
    pname = "insteon_frontend_home_assistant";
    inherit version;
-    hash = "sha256-r6xXEZFAGgXByl+urpXfzhuCedBPjqkwT8Q0sEHQA2w=";
+    hash = "sha256-p5hL8LE8h/4ytHft/v23uzv7YwR9UBDVru8n7WeY99Q=";
  };

  nativeBuildInputs = [ setuptools ];
--- a/pkgs/development/python-modules/knx-frontend/default.nix
+++ b/pkgs/development/python-modules/knx-frontend/default.nix
@@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "knx-frontend";
-  version = "2026.4.22.141111";
+  version = "2026.4.30.60856";
  pyproject = true;

  # TODO: source build, uses yarn.lock
  src = fetchPypi {
    pname = "knx_frontend";
    inherit version;
-    hash = "sha256-2gzQETX2YayiahCGw9sSS6mCo5DmApBZB54ISQBm43M=";
+    hash = "sha256-ZviZoQY0ZlIgiiEKwsOpTRVoi8F1JPE1RqD8Nzozpr4=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/miniaudio/default.nix
+++ b/pkgs/development/python-modules/miniaudio/default.nix
@@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "miniaudio";
-  version = "1.70";
+  version = "1.71";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "irmen";
    repo = "pyminiaudio";
    tag = "v${version}";
-    hash = "sha256-7i1ORJJwdd/an5IsW/xO1puI/LJJ5WDEdaE8DU4/laQ=";
+    hash = "sha256-fBdRricV0eqQknOQInB3cj8reZGKS9hrJTMF1ILASpY=";
  };

  # TODO: Properly unvendor miniaudio c library
--- a/pkgs/development/python-modules/pyintesishome/default.nix
+++ b/pkgs/development/python-modules/pyintesishome/default.nix
@@ -3,21 +3,24 @@
  aiohttp,
  buildPythonPackage,
  fetchFromGitHub,
+  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "pyintesishome";
-  version = "1.8.5";
-  format = "setuptools";
+  version = "1.8.7";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "jnimmo";
    repo = "pyIntesisHome";
-    tag = version;
-    hash = "sha256-QgIvIn8I5EtJSNj1FdOI+DPgG7/y2ToQ62dhk7flieo=";
+    tag = finalAttrs.version;
+    hash = "sha256-TwZAuu/mnChZwhZ5uGPiQ23curCiqTKWNgDrvwpgojc=";
  };

-  propagatedBuildInputs = [ aiohttp ];
+  build-system = [ setuptools ];
+
+  dependencies = [ aiohttp ];

  # Project has no tests
  doCheck = false;
@@ -27,8 +30,8 @@ buildPythonPackage rec {
  meta = {
    description = "Python interface for IntesisHome devices";
    homepage = "https://github.com/jnimmo/pyIntesisHome";
-    changelog = "https://github.com/jnimmo/pyIntesisHome/releases/tag/${version}";
-    license = with lib.licenses; [ mit ];
+    changelog = "https://github.com/jnimmo/pyIntesisHome/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
--- a/pkgs/development/python-modules/requests-cache/default.nix
+++ b/pkgs/development/python-modules/requests-cache/default.nix
@@ -64,7 +64,7 @@ buildPythonPackage (finalAttrs: {
      orjson
      ujson
    ]
-    ++ lib.concatAttrValues (lib.removeAttrs finalAttrs.optional-dependencies [ "all" ]);
+    ++ lib.concatAttrValues (lib.removeAttrs finalAttrs.passthru.optional-dependencies [ "all" ]);
  };

  nativeCheckInputs = [
--- a/pkgs/development/python-modules/rocketchat-api/default.nix
+++ b/pkgs/development/python-modules/rocketchat-api/default.nix
@@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "rocketchat-api";
-  version = "3.6.0";
+  version = "3.6.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "jadolg";
    repo = "rocketchat_API";
    tag = version;
-    hash = "sha256-GYk3ZMAothllMxFhSFc2p4nX0wQOaWtltcrXpwK6lzE=";
+    hash = "sha256-KatsV5MbZ7akD/nsNLEIwPecsaa9W8PplGCppe5rcZI=";
  };

  build-system = [
--- a/pkgs/development/python-modules/soxr/default.nix
+++ b/pkgs/development/python-modules/soxr/default.nix
@@ -23,14 +23,14 @@

 buildPythonPackage rec {
  pname = "soxr";
-  version = "1.0.0";
+  version = "1.1.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "dofuuz";
    repo = "python-soxr";
    tag = "v${version}";
-    hash = "sha256-8NVQD1LamIRe77bKEs8YqHXeXifdMJpQUedmeiBRHSI=";
+    hash = "sha256-XdSInR0ogbcku6yvMkGEEIxu2nlqa0mffBtd+ifvzoU=";
  };

  patches = [ ./cmake-nanobind.patch ];
--- a/pkgs/development/python-modules/sqlmap/default.nix
+++ b/pkgs/development/python-modules/sqlmap/default.nix
@@ -9,12 +9,12 @@

 buildPythonPackage (finalAttrs: {
  pname = "sqlmap";
-  version = "1.10.3";
+  version = "1.10.5";
  pyproject = true;

  src = fetchPypi {
    inherit (finalAttrs) pname version;
-    hash = "sha256-PRZvDidyvwjJ7oXU9Mu6eObHm08wWCjjHx6BPjP/Dlg=";
+    hash = "sha256-LS4K7+3KyxjVoFKeNteRypSa7Yr6RAHiL/eviY8YajE=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/tesla-fleet-api/default.nix
+++ b/pkgs/development/python-modules/tesla-fleet-api/default.nix
@@ -15,14 +15,14 @@

 buildPythonPackage rec {
  pname = "tesla-fleet-api";
-  version = "1.4.6";
+  version = "1.4.7";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Teslemetry";
    repo = "python-tesla-fleet-api";
    tag = "v${version}";
-    hash = "sha256-2LCpwVf10dsgZlouvu3Spr0geK8uDpEXKOI1l6sZqmM=";
+    hash = "sha256-704vqQwT50j/F1Mk8VMJ9VSOUfu+pHmxYQySs4UlFls=";
  };

  build-system = [ setuptools ];
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -37,7 +37,7 @@ let
    ;

  inherit (lib.meta)
-    availableOn
+    platformMatch
    cpeFullVersionWithVendor
    ;

@@ -82,19 +82,19 @@ let
  hasListedLicense =
    assert areLicenseListsValid;
    list:
-    if list == [ ] then
-      attrs: false
-    else
-      attrs:
-      attrs ? meta.license
-      && (
-        if isList attrs.meta.license then
-          any (l: elem l list) attrs.meta.license
-        else if attrs.meta.license ? "licenseType" then
-          lib.licenses.containsLicenses list attrs.meta.license
-        else
-          elem attrs.meta.license list
-      );
+    let
+      containsListLicenses = lib.licenses.containsLicenses list;
+    in
+    attrs:
+    attrs ? meta.license
+    && (
+      if isList attrs.meta.license then
+        any (l: elem l list) attrs.meta.license
+      else if attrs.meta.license ? "licenseType" then
+        containsListLicenses attrs.meta.license
+      else
+        elem attrs.meta.license list
+    );

  hasAllowlistedLicense = hasListedLicense allowlist;

@@ -122,7 +122,14 @@ let

  isMarkedBroken = attrs: attrs.meta.broken or false;

-  hasUnsupportedPlatform = pkg: !(availableOn hostPlatform pkg);
+  # Logical inversion of meta.availableOn for hostPlatform
+  hasUnsupportedPlatform =
+    let
+      anyHostPlatform = any (platformMatch hostPlatform);
+    in
+    pkg:
+    pkg ? meta.platforms && !(anyHostPlatform pkg.meta.platforms)
+    || pkg ? meta.badPlatforms && anyHostPlatform pkg.meta.badPlatforms;

  isMarkedInsecure = attrs: (attrs.meta.knownVulnerabilities or [ ]) != [ ];

@@ -178,7 +185,6 @@ let
    attrs:
    attrs ? meta.sourceProvenance
    && any (t: !t.isSource) attrs.meta.sourceProvenance
-    && !allowNonSource
    && !allowNonSourcePredicate attrs;

  showLicenseOrSourceType =
@@ -381,17 +387,17 @@ let
      identifiers = attrs;
    };

-  metaInvalid = if config.checkMeta then meta: !metaType.verify meta else meta: false;
+  checkMeta = config.checkMeta;

  checkOutputsToInstall =
-    if config.checkMeta then
-      attrs:
+    attrs:
+    attrs.meta ? outputsToInstall
+    && (
      let
        actualOutputs = attrs.outputs or [ "out" ];
      in
-      any (output: !elem output actualOutputs) (attrs.meta.outputsToInstall or [ ])
-    else
-      attrs: false;
+      !all (output: elem output actualOutputs) attrs.meta.outputsToInstall
+    );

  # Check if a derivation is valid, that is whether it passes checks for
  # e.g brokenness or license.
@@ -403,9 +409,12 @@ let
  # Along with a boolean flag for each reason
  checkValidity =
    attrs:
+    if !attrs ? meta then
+      null
+    else
    # Check meta attribute types first, to make sure it is always called even when there are other issues
    # Note that this is not a full type check and functions below still need to by careful about their inputs!
-    if metaInvalid (attrs.meta or { }) then
+    if checkMeta && !metaType.verify attrs.meta then
      {
        reason = "unknown-meta";
        msg = "has an invalid meta attrset:${
@@ -415,7 +424,7 @@ let
      }

    # --- Put checks that cannot be ignored here ---
-    else if checkOutputsToInstall attrs then
+    else if checkMeta && checkOutputsToInstall attrs then
      {
        reason = "broken-outputs";
        msg = "has invalid meta.outputsToInstall";
@@ -423,19 +432,19 @@ let
      }

    # --- Put checks that can be ignored here ---
-    else if hasDeniedUnfreeLicense attrs && !(hasAllowlistedLicense attrs) then
+    else if hasDeniedUnfreeLicense attrs && !(allowlist != [ ] && hasAllowlistedLicense attrs) then
      {
        reason = "unfree";
        msg = "has an unfree license (‘${showLicense attrs.meta.license}’)";
        remediation = remediate_allowlist "Unfree" (remediate_predicate "allowUnfreePredicate" attrs);
      }
-    else if hasBlocklistedLicense attrs then
+    else if blocklist != [ ] && hasBlocklistedLicense attrs then
      {
        reason = "blocklisted";
        msg = "has a blocklisted license (‘${showLicense attrs.meta.license}’)";
        remediation = "";
      }
-    else if hasDeniedNonSourceProvenance attrs then
+    else if !allowNonSource && hasDeniedNonSourceProvenance attrs then
      {
        reason = "non-source";
        msg = "contains elements not built from source (‘${showSourceType attrs.meta.sourceProvenance}’)";
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3650,6 +3650,8 @@ self: super: with self; {

  datasketch = callPackage ../development/python-modules/datasketch { };

+  datastar-py = callPackage ../development/python-modules/datastar-py { };
+
  datauri = callPackage ../development/python-modules/datauri { };

  datefinder = callPackage ../development/python-modules/datefinder { };