Merge staging-next into staging

2026-09-30 03:39:59 +00:00 · 2025-07-18 00:18:34 +00:00
parent 16a224b355 7f9c6b1472
commit abbe5cd65f
108 changed files with 10350 additions and 1155 deletions
--- a/nixos/modules/services/networking/searx.nix
+++ b/nixos/modules/services/networking/searx.nix
@@ -15,8 +15,8 @@ let

  settingsFile = pkgs.writeText "settings.yml" (builtins.toJSON cfg.settings);

-  limiterSettingsFile = (pkgs.formats.toml { }).generate "limiter.toml" cfg.limiterSettings;
  faviconsSettingsFile = (pkgs.formats.toml { }).generate "favicons.toml" cfg.faviconsSettings;
+  limiterSettingsFile = (pkgs.formats.toml { }).generate "limiter.toml" cfg.limiterSettings;

  generateConfig = ''
    cd ${runDir}
@@ -46,15 +46,8 @@ let
    // {
      description = "JSON value";
    };
-
 in
-
 {
-
-  imports = [
-    (mkRenamedOptionModule [ "services" "searx" "configFile" ] [ "services" "searx" "settingsFile" ])
-  ];
-
  options = {
    services.searx = {
      enable = mkOption {
@@ -64,14 +57,20 @@ in
        description = "Whether to enable Searx, the meta search engine.";
      };

+      domain = mkOption {
+        type = types.str;
+        description = ''
+          The domain under which searxng will be served.
+          Right now this is only used with the configureNginx option.
+        '';
+      };
+
      environmentFile = mkOption {
        type = types.nullOr types.path;
        default = null;
        description = ''
-          Environment file (see {manpage}`systemd.exec(5)`
-          "EnvironmentFile=" section for the syntax) to define variables for
-          Searx. This option can be used to safely include secret keys into the
-          Searx configuration.
+          Environment file (see {manpage}`systemd.exec(5)` "EnvironmentFile=" section for the syntax) to define variables for Searx.
+          This option can be used to safely include secret keys into the Searx configuration.
        '';
      };

@@ -79,37 +78,40 @@ in
        type = types.bool;
        default = false;
        description = ''
-          Configure a local Redis server for SearXNG. This is required if you
-          want to enable the rate limiter and bot protection of SearXNG.
+          Configure a local Redis server for SearXNG.
+          This is required if you want to enable the rate limiter and bot protection of SearXNG.
        '';
      };

      settings = mkOption {
-        type = types.attrsOf settingType;
+        type = types.submodule {
+          freeformType = settingType;
+          imports = [
+            (mkRenamedOptionModule [ "redis" ] [ "valkey" ])
+          ];
+        };
        default = { };
        example = literalExpression ''
-          { server.port = 8080;
+          {
+            server.port = 8080;
            server.bind_address = "0.0.0.0";
            server.secret_key = "@SEARX_SECRET_KEY@";

-            engines = lib.singleton
-              { name = "wolframalpha";
-                shortcut = "wa";
-                api_key = "@WOLFRAM_API_KEY@";
-                engine = "wolframalpha_api";
-              };
+            engines = lib.singleton {
+              name = "wolframalpha";
+              shortcut = "wa";
+              api_key = "@WOLFRAM_API_KEY@";
+              engine = "wolframalpha_api";
+            };
          }
        '';
        description = ''
-          Searx settings. These will be merged with (taking precedence over)
-          the default configuration. It's also possible to refer to
-          environment variables
-          (defined in [](#opt-services.searx.environmentFile))
-          using the syntax `@VARIABLE_NAME@`.
+          Searx settings.
+          These will be merged with (taking precedence over) the default configuration.
+          It's also possible to refer to environment variables (defined in [](#opt-services.searx.environmentFile)) using the syntax `@VARIABLE_NAME@`.

          ::: {.note}
-          For available settings, see the Searx
-          [docs](https://searx.github.io/searx/admin/settings.html).
+          For available settings, see the Searx [docs](https://docs.searxng.org/admin/settings/index.html).
          :::
        '';
      };
@@ -118,14 +120,43 @@ in
        type = types.path;
        default = "${runDir}/settings.yml";
        description = ''
-          The path of the Searx server settings.yml file. If no file is
-          specified, a default file is used (default config file has debug mode
-          enabled). Note: setting this options overrides
-          [](#opt-services.searx.settings).
+          The path of the Searx server settings.yml file.
+          If no file is specified, a default file is used (default config file has debug mode enabled).
+
+          ::: {.note}
+          Setting this options overrides [](#opt-services.searx.settings).
+          :::

          ::: {.warning}
-          This file, along with any secret key it contains, will be copied
-          into the world-readable Nix store.
+          This file, along with any secret key it contains, will be copied into the world-readable Nix store.
+          :::
+        '';
+      };
+
+      faviconsSettings = mkOption {
+        type = types.attrsOf settingType;
+        default = { };
+        example = literalExpression ''
+          {
+            favicons = {
+              cfg_schema = 1;
+              cache = {
+                db_url = "/var/cache/searx/faviconcache.db";
+                HOLD_TIME = 5184000;
+                LIMIT_TOTAL_BYTES = 2147483648;
+                BLOB_MAX_BYTES = 40960;
+                MAINTENANCE_MODE = "auto";
+                MAINTENANCE_PERIOD = 600;
+              };
+            };
+          }
+        '';
+        description = ''
+          Favicons settings for SearXNG.
+
+          ::: {.note}
+          For available settings, see the SearXNG
+          [schema file](https://github.com/searxng/searxng/blob/master/searx/favicons/favicons.toml).
          :::
        '';
      };
@@ -149,43 +180,14 @@ in
          Limiter settings for SearXNG.

          ::: {.note}
-          For available settings, see the SearXNG
-          [schema file](https://github.com/searxng/searxng/blob/master/searx/limiter.toml).
-          :::
-        '';
-      };
-
-      faviconsSettings = mkOption {
-        type = types.attrsOf settingType;
-        default = { };
-        example = literalExpression ''
-          {
-            favicons = {
-              cfg_schema = 1;
-              cache = {
-                db_url = "/run/searx/faviconcache.db";
-                HOLD_TIME = 5184000;
-                LIMIT_TOTAL_BYTES = 2147483648;
-                BLOB_MAX_BYTES = 40960;
-                MAINTENANCE_MODE = "auto";
-                MAINTENANCE_PERIOD = 600;
-              };
-            };
-          }
-        '';
-        description = ''
-          Favicons settings for SearXNG.
-
-          ::: {.note}
-          For available settings, see the SearXNG
-          [schema file](https://github.com/searxng/searxng/blob/master/searx/favicons/favicons.toml).
+          For available settings, see the SearXNG [schema file](https://github.com/searxng/searxng/blob/master/searx/limiter.toml).
          :::
        '';
      };

      package = mkPackageOption pkgs "searxng" { };

-      runInUwsgi = mkOption {
+      configureUwsgi = mkOption {
        type = types.bool;
        default = false;
        description = ''
@@ -199,8 +201,16 @@ in
        '';
      };

+      configureNginx = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to configure nginx as an frontend to uwsgi.
+        '';
+      };
+
      uwsgiConfig = mkOption {
-        type = options.services.uwsgi.instance.type;
+        inherit (options.services.uwsgi.instance) type;
        default = {
          http = ":8080";
        };
@@ -218,114 +228,168 @@ in
          should listen.
        '';
      };
-
    };
-
  };

+  imports = [
+    (mkRenamedOptionModule [ "services" "searx" "configFile" ] [ "services" "searx" "settingsFile" ])
+    (mkRenamedOptionModule [ "services" "searx" "runInUwsgi" ] [ "services" "searx" "configureUwsgi" ])
+  ];
+
  config = mkIf cfg.enable {
-    environment.systemPackages = [ cfg.package ];
-
-    users.users.searx = {
-      description = "Searx daemon user";
-      group = "searx";
-      isSystemUser = true;
+    environment = {
+      etc = {
+        "searxng/favicons.toml" = lib.mkIf (cfg.faviconsSettings != { }) {
+          source = faviconsSettingsFile;
+        };
+        "searxng/limiter.toml" = lib.mkIf (cfg.limiterSettings != { }) {
+          source = limiterSettingsFile;
+        };
+      };
+      systemPackages = [ cfg.package ];
    };

-    users.groups.searx = { };
-
-    systemd.services.searx-init = {
-      description = "Initialise Searx settings";
-      serviceConfig =
-        {
-          Type = "oneshot";
-          RemainAfterExit = true;
-          User = "searx";
-          RuntimeDirectory = "searx";
-          RuntimeDirectoryMode = "750";
-        }
-        // optionalAttrs (cfg.environmentFile != null) {
-          EnvironmentFile = builtins.toPath cfg.environmentFile;
+    services = {
+      nginx = lib.mkIf cfg.configureNginx {
+        enable = true;
+        virtualHosts."${cfg.domain}".locations = {
+          "/" = {
+            recommendedProxySettings = true;
+            recommendedUwsgiSettings = true;
+            uwsgiPass = "unix:${config.services.uwsgi.instance.vassals.searx.socket}";
+            extraConfig = # nginx
+              ''
+                uwsgi_param  HTTP_HOST             $host;
+                uwsgi_param  HTTP_CONNECTION       $http_connection;
+                uwsgi_param  HTTP_X_SCHEME         $scheme;
+                uwsgi_param  HTTP_X_SCRIPT_NAME    ""; # NOTE: When we ever make the path configurable, this must be set to anything not "/"!
+                uwsgi_param  HTTP_X_REAL_IP        $remote_addr;
+                uwsgi_param  HTTP_X_FORWARDED_FOR  $proxy_add_x_forwarded_for;
+              '';
+          };
+          "/static/".alias = lib.mkDefault "${cfg.package}/share/static/";
        };
-      script = generateConfig;
-    };
+      };

-    systemd.services.searx = mkIf (!cfg.runInUwsgi) {
-      description = "Searx server, the meta search engine.";
-      wantedBy = [ "multi-user.target" ];
-      requires = [ "searx-init.service" ];
-      after = [
-        "searx-init.service"
-        "network.target"
-      ];
-      serviceConfig =
-        {
-          User = "searx";
-          Group = "searx";
-          ExecStart = lib.getExe cfg.package;
-        }
-        // optionalAttrs (cfg.environmentFile != null) {
-          EnvironmentFile = builtins.toPath cfg.environmentFile;
+      redis.servers.searx = lib.mkIf cfg.redisCreateLocally {
+        enable = true;
+        user = "searx";
+        port = 0;
+      };
+
+      searx = {
+        configureUwsgi = lib.mkIf cfg.configureNginx true;
+        settings = {
+          # merge NixOS settings with defaults settings.yml
+          use_default_settings = mkDefault true;
+          server.base_url = lib.mkIf cfg.configureNginx "http${
+            lib.optionalString (lib.any lib.id (
+              with config.services.nginx.virtualHosts."${cfg.domain}";
+              [
+                onlySSL
+                addSSL
+                forceSSL
+              ]
+            )) "s"
+          }://${cfg.domain}/";
+          ui.static_use_hash = true;
+          valkey.url = lib.mkIf cfg.redisCreateLocally "unix://${config.services.redis.servers.searx.unixSocket}";
        };
-      environment = {
-        SEARX_SETTINGS_PATH = cfg.settingsFile;
-        SEARXNG_SETTINGS_PATH = cfg.settingsFile;
+      };
+
+      uwsgi = mkIf cfg.configureUwsgi {
+        enable = true;
+        plugins = [ "python3" ];
+        instance.type = "emperor";
+        instance.vassals.searx =
+          {
+            type = "normal";
+            strict = true;
+            immediate-uid = "searx";
+            immediate-gid = "searx";
+            lazy-apps = true;
+            enable-threads = true;
+            module = "searx.webapp";
+            env = [
+              "SEARXNG_SETTINGS_PATH=${cfg.settingsFile}"
+            ];
+            buffer-size = 32768;
+            pythonPackages = _: [ cfg.package ];
+          }
+          // lib.optionalAttrs cfg.configureNginx {
+            socket = "/run/searx/uwsgi.sock";
+            chmod-socket = "660";
+          }
+          // cfg.uwsgiConfig;
      };
    };

-    systemd.services.uwsgi = mkIf cfg.runInUwsgi {
-      requires = [ "searx-init.service" ];
-      after = [ "searx-init.service" ];
-    };
+    systemd.services = {
+      nginx = lib.mkIf cfg.configureNginx {
+        serviceConfig.SupplementaryGroups = [ "searx" ];
+      };

-    services.searx.settings = {
-      # merge NixOS settings with defaults settings.yml
-      use_default_settings = mkDefault true;
-      redis.url = lib.mkIf cfg.redisCreateLocally "unix://${config.services.redis.servers.searx.unixSocket}";
-    };
+      searx-init = {
+        description = "Initialise Searx settings";
+        serviceConfig =
+          {
+            Type = "oneshot";
+            RemainAfterExit = true;
+            User = "searx";
+            RuntimeDirectory = "searx";
+            RuntimeDirectoryMode = "750";
+            RuntimeDirectoryPreserve = "yes";
+          }
+          // optionalAttrs (cfg.environmentFile != null) {
+            EnvironmentFile = cfg.environmentFile;
+          };
+        script = generateConfig;
+      };

-    services.uwsgi = mkIf cfg.runInUwsgi {
-      enable = true;
-      plugins = [ "python3" ];
-
-      instance.type = "emperor";
-      instance.vassals.searx = {
-        type = "normal";
-        strict = true;
-        immediate-uid = "searx";
-        immediate-gid = "searx";
-        lazy-apps = true;
-        enable-threads = true;
-        module = "searx.webapp";
-        env = [
-          # TODO: drop this as it is only required for searx
-          "SEARX_SETTINGS_PATH=${cfg.settingsFile}"
-          # searxng compatibility https://github.com/searxng/searxng/issues/1519
-          "SEARXNG_SETTINGS_PATH=${cfg.settingsFile}"
+      searx = mkIf (!cfg.configureUwsgi) {
+        description = "Searx server, the meta search engine.";
+        wantedBy = [ "multi-user.target" ];
+        requires = [ "searx-init.service" ];
+        after = [
+          "searx-init.service"
+          "network.target"
        ];
-        buffer-size = 32768;
-        pythonPackages = self: [ cfg.package ];
-      } // cfg.uwsgiConfig;
-    };
-
-    services.redis.servers.searx = lib.mkIf cfg.redisCreateLocally {
-      enable = true;
-      user = "searx";
-      port = 0;
-    };
-
-    environment.etc = {
-      "searxng/limiter.toml" = lib.mkIf (cfg.limiterSettings != { }) {
-        source = limiterSettingsFile;
+        serviceConfig =
+          {
+            User = "searx";
+            Group = "searx";
+            ExecStart = lib.getExe cfg.package;
+          }
+          // optionalAttrs (cfg.environmentFile != null) {
+            EnvironmentFile = cfg.environmentFile;
+          };
+        environment = {
+          SEARXNG_SETTINGS_PATH = cfg.settingsFile;
+        };
      };
-      "searxng/favicons.toml" = lib.mkIf (cfg.faviconsSettings != { }) {
-        source = faviconsSettingsFile;
+
+      uwsgi = mkIf cfg.configureUwsgi {
+        requires = [ "searx-init.service" ];
+        after = [ "searx-init.service" ];
+        restartTriggers = [
+          cfg.package
+          cfg.settingsFile
+        ] ++ lib.optional (cfg.environmentFile != null) cfg.environmentFile;
+      };
+    };
+
+    users = {
+      groups.searx = { };
+      users.searx = {
+        description = "Searx daemon user";
+        group = "searx";
+        isSystemUser = true;
      };
    };
  };

  meta.maintainers = with maintainers; [
-    rnhmjoj
+    SuperSandro2000
    _999eagle
  ];
 }
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -832,6 +832,15 @@ in
        minsize = "1M";
      };
    };
+
+    # run0 is supposed to authenticate the user via polkit and then run a command. Without this next
+    # part, run0 would fail to run the command even if authentication is successful and the user has
+    # permission to run the command. This next part is only enabled if polkit is enabled because the
+    # error that we’re trying to avoid can’t possibly happen if polkit isn’t enabled. When polkit isn’t
+    # enabled, run0 will fail before it even tries to run the command.
+    security.pam.services = mkIf config.security.polkit.enable {
+      systemd-run0 = { };
+    };
  };

  # FIXME: Remove these eventually.
--- a/nixos/tests/searx.nix
+++ b/nixos/tests/searx.nix
@@ -1,57 +1,54 @@
-{ pkgs, ... }:
+{ lib, pkgs, ... }:

 {
  name = "searx";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ rnhmjoj ];
+  meta = with lib.maintainers; {
+    maintainers = [
+      SuperSandro2000
+      _999eagle
+    ];
  };

  # basic setup: searx running the built-in webserver
-  nodes.base =
-    { ... }:
-    {
-      services.searx = {
-        enable = true;
-        environmentFile = pkgs.writeText "secrets" ''
-          WOLFRAM_API_KEY  = sometoken
-          SEARX_SECRET_KEY = somesecret
-        '';
+  nodes.base = {
+    services.searx = {
+      enable = true;
+      environmentFile = pkgs.writeText "secrets" ''
+        SEARX_SECRET_KEY = somesecret
+      '';

-        settings.server = {
-          port = "8080";
-          bind_address = "0.0.0.0";
-          secret_key = "@SEARX_SECRET_KEY@";
-        };
-        settings.engines = [
-          {
-            name = "wolframalpha";
-            api_key = "@WOLFRAM_API_KEY@";
-            engine = "wolframalpha_api";
-          }
+      settings = {
+        engines = [
          {
            name = "startpage";
            shortcut = "start";
          }
        ];
+        plugins = { };
+        server = {
+          port = "8080";
+          bind_address = "0.0.0.0";
+          secret_key = "@SEARX_SECRET_KEY@";
+        };
      };
-
    };

+  };
+
  # fancy setup: run in uWSGI and use nginx as proxy
  nodes.fancy =
-    { config, ... }:
+    { config, lib, ... }:
    {
      services.searx = {
        enable = true;
-        # searx refuses to run if unchanged
-        settings.server.secret_key = "somesecret";
+        settings = {
+          plugins = { };
+          server.secret_key = "somesecret";
+        };

-        runInUwsgi = true;
+        configureNginx = true;
+        domain = "localhost";
        uwsgiConfig = {
-          # serve using the uwsgi protocol
-          socket = "/run/searx/uwsgi.sock";
-          chmod-socket = "660";
-
          # use /searx as url "mountpoint"
          mount = "/searx=searx.webapp:application";
          module = "";
@@ -59,19 +56,12 @@
        };
      };

-      # use nginx as reverse proxy
-      services.nginx.enable = true;
-      services.nginx.virtualHosts.localhost = {
-        locations."/searx".extraConfig = ''
-          include ${pkgs.nginx}/conf/uwsgi_params;
-          uwsgi_pass unix:/run/searx/uwsgi.sock;
-        '';
-        locations."/searx/static/".alias = "${config.services.searx.package}/share/static/";
+      services.nginx.virtualHosts.${config.services.searx.domain} = {
+        locations = {
+          "/static/" = lib.mkForce { };
+          "/searx/static/".alias = "${config.services.searx.package}/share/static/";
+        };
      };
-
-      # allow nginx access to the searx socket
-      users.users.nginx.extraGroups = [ "searx" ];
-
    };

  testScript = ''
@@ -89,7 +79,6 @@

    with subtest("Environment variables have been substituted"):
        base.succeed("grep -q somesecret /run/searx/settings.yml")
-        base.succeed("grep -q sometoken /run/searx/settings.yml")
        base.copy_from_vm("/run/searx/settings.yml")

    with subtest("Basic setup is working"):
--- a/pkgs/applications/emulators/libretro/cores/vice.nix
+++ b/pkgs/applications/emulators/libretro/cores/vice.nix
@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
  core = "vice-${type}";
-  version = "0-unstable-2025-07-05";
+  version = "0-unstable-2025-07-14";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "vice-libretro";
-    rev = "94cd4c7d010957109527403fff4b753f918efd3d";
-    hash = "sha256-MjdaBluBmdf22F9yG8xZtCTAqhM4P5bvIcFm0Cga9FM=";
+    rev = "f98f16ca1950b930d233cb0de24e181f0b7b5e14";
+    hash = "sha256-X58uKqtlm8dW1aexBuBF8PLVAcaGyhZjeLH3+dkeDns=";
  };

  makefile = "Makefile";
--- a/pkgs/applications/networking/cluster/k3s/1_31/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_31/images-versions.json
@@ -1,18 +1,18 @@
 {
  "airgap-images-amd64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.9%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "939480f43b0214bfcc9fbd33cc73c810c1fded4e7ad16b204ac050277574ed9c"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.10%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "86fd5e5cceee3ab6743b1257ed39e62ef73b20475c12495888589e68199210a3"
  },
  "airgap-images-arm": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.9%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "b9e90a490568705fac716b330316f1cea190a3bce6220487f539d6eddbc3dfaa"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.10%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "0bb5712817ea3c98c69b51eb5925e37ad47a5b2851a0fd72868502a70ef5c3e6"
  },
  "airgap-images-arm64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.9%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "9a31f65d02f9be290288351c01ae57cc16550ae16cbf8c95296ec15da2676dce"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.10%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "4e34adcadba448524851d8b1ea98bc918105eb7b1717c7d8cb8866749373b060"
  },
  "images-list": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.9%2Bk3s1/k3s-images.txt",
-    "sha256": "7a53b3def0199b17de6ec690d13ae2001fb83809258d28d985eafa69869c3aa9"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.10%2Bk3s1/k3s-images.txt",
+    "sha256": "ebe55bbef8ec772071bf736c9671e444aa31ac259e86bfb65180d2405b314c5e"
  }
 }
--- a/pkgs/applications/networking/cluster/k3s/1_31/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_31/versions.nix
@@ -1,14 +1,14 @@
 {
-  k3sVersion = "1.31.9+k3s1";
-  k3sCommit = "812206503b2874c703dcc93c5d6baa5ffc745930";
-  k3sRepoSha256 = "0cknigj3cx5ndh5n15nymzmr8xgsr7is5hbi923n6h2q5bjm12q4";
-  k3sVendorHash = "sha256-ojzoxqtVYSmw5gZk+0W4V5ImRcXX451QauIFNR9j9eY=";
+  k3sVersion = "1.31.10+k3s1";
+  k3sCommit = "c02ce139f6409f455775004d235d98fc9bee849b";
+  k3sRepoSha256 = "1ap91j0vwgayis1g7j8rh4dxq4g5fn1kkf1dfa2wg0kxfkcldp0x";
+  k3sVendorHash = "sha256-URczHgCfkg2XoX9XNxW7GxPQcfMraLkFCTEbGafyTEI=";
  chartVersions = import ./chart-versions.nix;
  imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
  k3sRootVersion = "0.14.1";
  k3sRootSha256 = "0svbi42agqxqh5q2ri7xmaw2a2c70s7q5y587ls0qkflw5vx4sl7";
-  k3sCNIVersion = "1.6.0-k3s1";
-  k3sCNISha256 = "0g7zczvwba5xqawk37b0v96xysdwanyf1grxn3l3lhxsgjjsmkd7";
+  k3sCNIVersion = "1.7.1-k3s1";
+  k3sCNISha256 = "0k1qfmsi5bqgwd5ap8ndimw09hsxn0cqf4m5ad5a4mgl6akw6dqz";
  containerdVersion = "2.0.5-k3s1.32";
  containerdSha256 = "1la7ygx5caqfqk025wyrxmhjb0xbpkzwnxv52338p33g68sb3yb0";
  criCtlVersion = "1.31.0-k3s2";
--- a/pkgs/applications/networking/cluster/k3s/1_33/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_33/images-versions.json
@@ -1,18 +1,18 @@
 {
  "airgap-images-amd64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.1%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "5fd0e18b7cd7457773d30e86270a4e1caed66d2e5c1380e65b3d0375227d241c"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.2%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "aa52e035f7e2fff17f4cb59cdaa60d117770bfa7b5c67be655c1d1fa4f261137"
  },
  "airgap-images-arm": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.1%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "518343da6213e7edba9da2f58fcf30c268600fc8003f92f245d9818ead2db03e"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.2%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "670743ad088ada4a72966e30cbf10c7c3b0cc1fe7775f709647820c32b8d3b05"
  },
  "airgap-images-arm64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.1%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "2ac40b650104a1dc21b4b77fccf943efca8893de0432e6cdf1e7e1534eb6f4aa"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.2%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "3f2b8c54702018362c24266daaa39b582742c8612cf16ac53c04fb778193884b"
  },
  "images-list": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.1%2Bk3s1/k3s-images.txt",
-    "sha256": "aa8e10337aef453cb17e6408dbaec9eb2da409ca6ba1f8bc7332fcef97fdaf3a"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.2%2Bk3s1/k3s-images.txt",
+    "sha256": "637ccb5f5a8f4a7d13991cb3060f05b8c7c46e7351e0edae351f9ad23bb51631"
  }
 }
--- a/pkgs/applications/networking/cluster/k3s/1_33/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_33/versions.nix
@@ -1,14 +1,14 @@
 {
-  k3sVersion = "1.33.1+k3s1";
-  k3sCommit = "99d91538b1327da933356c318dc8040335fbb66c";
-  k3sRepoSha256 = "1ncj30nid3x96irw2raxf1naa2jap1d0s1ygxsvfckblbb6rjnmx";
-  k3sVendorHash = "sha256-jrPVY+FVZV9wlbik/I35W8ChcLrHlYbLAwUYU16mJLM=";
+  k3sVersion = "1.33.2+k3s1";
+  k3sCommit = "6e38c8b55284c0d68f64a9e603fb645a32ecd232";
+  k3sRepoSha256 = "1s2ibbq2ivy1w3dkqlwnipg6cphiji0ax96fagfxgzwyjhxkyvxh";
+  k3sVendorHash = "sha256-MLntaqh1uwJ4cfvHW4lJxUzxtlq87DWCfhU4X6aRbxI=";
  chartVersions = import ./chart-versions.nix;
  imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
  k3sRootVersion = "0.14.1";
  k3sRootSha256 = "0svbi42agqxqh5q2ri7xmaw2a2c70s7q5y587ls0qkflw5vx4sl7";
-  k3sCNIVersion = "1.6.0-k3s1";
-  k3sCNISha256 = "0g7zczvwba5xqawk37b0v96xysdwanyf1grxn3l3lhxsgjjsmkd7";
+  k3sCNIVersion = "1.7.1-k3s1";
+  k3sCNISha256 = "0k1qfmsi5bqgwd5ap8ndimw09hsxn0cqf4m5ad5a4mgl6akw6dqz";
  containerdVersion = "2.0.5-k3s1";
  containerdSha256 = "1c3hv22zx8y94zwmv5r59bnwgqyhxd10zkinm0jrcvny32ijqdfj";
  criCtlVersion = "1.31.0-k3s2";
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -99,13 +99,13 @@
    "vendorHash": "sha256-YIn8akPW+DCVF0eYZxsmJxmrJuYhK4QLG/uhmmrXd4c="
  },
  "auth0": {
-    "hash": "sha256-UmX2FMr1BarFbh86yase8FMp9myr2yqnBkvl86XvCCk=",
+    "hash": "sha256-Pr8cqPtmINxM5zYy8qrGlGoW/q2ha7sLwSy3oCPm/h8=",
    "homepage": "https://registry.terraform.io/providers/auth0/auth0",
    "owner": "auth0",
    "repo": "terraform-provider-auth0",
-    "rev": "v1.23.1",
+    "rev": "v1.24.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-RKhoWNu5IO3hedg3Zfq3I+lHvBaaETiWBo3Grs1ENVA="
+    "vendorHash": "sha256-uKzgEBNrLqcOkrrxKO9c5wKRwUjQInzeseN/euEI2G8="
  },
  "avi": {
    "hash": "sha256-e8yzc3nRP0ktcuuKyBXydS9NhoceYZKzJcqCWOfaPL0=",
@@ -967,13 +967,13 @@
    "vendorHash": "sha256-ofzbDmivXgH1i1Gjhpyp0bk3FDs5SnxwoRuNAWyMqyI="
  },
  "openstack": {
-    "hash": "sha256-pGNHWhg/1LM1IJYEVLppCJWVzow+j3WPW+H8yWQXMyM=",
+    "hash": "sha256-N5PhTfFNA6jU12uDxSQpOriDOK6okOTh1aFZo3isA7E=",
    "homepage": "https://registry.terraform.io/providers/terraform-provider-openstack/openstack",
    "owner": "terraform-provider-openstack",
    "repo": "terraform-provider-openstack",
-    "rev": "v3.2.0",
+    "rev": "v3.3.1",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-mTWLix4A0GRe7ayHTwU3Jt+DfDKMIKJlt1I6JuL3wXU="
+    "vendorHash": "sha256-ke7Dd3I/6Mja8SzrDy/f4GGgcB3C9xpCT4KiCr0PNZw="
  },
  "opentelekomcloud": {
    "hash": "sha256-u2bKqEPsytjYU5NeY7NZmDemHA4hgqSn8fKiJxwCNKI=",
@@ -1174,13 +1174,13 @@
    "vendorHash": null
  },
  "selectel": {
-    "hash": "sha256-n9/lmrfjILQpqPan379cwrUc7zjbiGhxz1JuL8jSCcY=",
+    "hash": "sha256-4tU/S+YSOkQJSh1p/Fjx00i7RJYFv3OuicDvjTOGGPk=",
    "homepage": "https://registry.terraform.io/providers/selectel/selectel",
    "owner": "selectel",
    "repo": "terraform-provider-selectel",
-    "rev": "v6.5.0",
+    "rev": "v6.6.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-tOQkoTt8NTPyyONWY3JKtHdnfgGKqImH4jp588hrMiE="
+    "vendorHash": "sha256-uMZIze8sng80sCb6f9CsWHVMmUGMaaOD4Ezx9B2fAJ4="
  },
  "sentry": {
    "hash": "sha256-/rulw49DcAi5tk4j6XpvlG0X6HJgcMI+zotKsFU2MmI=",
@@ -1418,13 +1418,13 @@
    "vendorHash": "sha256-giqZi1CmuyANNwzW+y9BUUUEfBhFZKkVGAvIPVvZnzE="
  },
  "vault": {
-    "hash": "sha256-Vqnmw69fktBQhSkj/W0legJ4sHOQP9Moqqi6Z5qYFy4=",
+    "hash": "sha256-tRKMu9mFyZkVjTMeXccUviWHiW9hPLj5heErRDK9eBw=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/vault",
    "owner": "hashicorp",
    "repo": "terraform-provider-vault",
-    "rev": "v5.0.0",
+    "rev": "v5.1.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-6gWw4ypQZWPX7VC9cZxHiU/KhTYEdMTZ276B9neGAiI="
+    "vendorHash": "sha256-GRrU/ARa88EX9kp6UBBhkYrTeX3i94eEQalz5QBHwGc="
  },
  "vcd": {
    "hash": "sha256-W+ffIT70IaePg3xfOaQgCjPTWTN3iSAYwkf+s+zkB84=",
--- a/pkgs/applications/video/obs-studio/plugins/obs-freeze-filter.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-freeze-filter.nix
@@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "obs-freeze-filter";
-  version = "0.3.4";
+  version = "0.3.5";

  src = fetchFromGitHub {
    owner = "exeldro";
    repo = "obs-freeze-filter";
    rev = finalAttrs.version;
-    hash = "sha256-fVrfGqwce4oFYdWGElXMsXHO1AzQ/mhfBmZL1mPdT3I=";
+    hash = "sha256-1x2r3Hdvx3y8reTWNUOgMqnOPaaUB75ibL6RuwEubQQ=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/video/obs-studio/plugins/obs-move-transition.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-move-transition.nix
@@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "obs-move-transition";
-  version = "3.1.4";
+  version = "3.1.5";

  src = fetchFromGitHub {
    owner = "exeldro";
    repo = "obs-move-transition";
    rev = version;
-    sha256 = "sha256-dOPt0++vBV95GycItuzaCHUQ8DHVEj6Q6EhNhhss4mA=";
+    sha256 = "sha256-MelIMAy+9LiSlYwDdS8mbgttyZ6rvGFS5TKMas8LzCM=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/build-support/fetchgit/nix-prefetch-git
+++ b/pkgs/build-support/fetchgit/nix-prefetch-git
@@ -214,8 +214,8 @@ checkout_ref(){
 init_submodules(){
    # shallow with leaveDotGit will change hashes
    [[ -z "$deepClone" ]] && [[ -z "$leaveDotGit" ]] && \
-    clean_git submodule update --init --recursive -j ${NIX_BUILD_CORES:-1} --progress --depth 1 || \
-    clean_git submodule update --init --recursive -j ${NIX_BUILD_CORES:-1} --progress
+    clean_git submodule update --init --recursive --checkout -j ${NIX_BUILD_CORES:-1} --progress --depth 1 || \
+    clean_git submodule update --init --recursive --checkout -j ${NIX_BUILD_CORES:-1} --progress
 }

 clone(){
--- a/pkgs/by-name/ap/apfelgrid/package.nix
+++ b/pkgs/by-name/ap/apfelgrid/package.nix
@@ -6,7 +6,8 @@
  apfel,
  applgrid,
  lhapdf,
-  root5,
+  root,
+  zlib,
 }:

 stdenv.mkDerivation rec {
@@ -25,7 +26,8 @@ stdenv.mkDerivation rec {
    apfel
    applgrid
    lhapdf
-    root5
+    root
+    zlib
  ];

  enableParallelBuilding = true;
--- a/pkgs/by-name/ap/applgrid/bad_code.patch
+++ b/pkgs/by-name/ap/applgrid/bad_code.patch
@@ -1,50 +0,0 @@
-diff --git a/appl_grid/appl_grid.h b/appl_grid/appl_grid.h
-index 5059622..a0651c9 100644
--- a/appl_grid/appl_grid.h
-+++ b/appl_grid/appl_grid.h
-@@ -56,7 +56,7 @@ public:
-   class exception : public std::exception { 
-   public:
-     exception(const std::string& s) { std::cerr << what() << " " << s << std::endl; }; 
-    exception(std::ostream& s)      { std::cerr << what() << " " << s << std::endl; }; 
-+    exception(std::ostream& s)      { s << what() << " " << std::endl; }; 
-     virtual const char* what() const throw() { return "appl::grid::exception"; }
-   };
- 
-diff --git a/appl_grid/appl_pdf.h b/appl_grid/appl_pdf.h
-index c71fd84..2525527 100644
--- a/appl_grid/appl_pdf.h
-+++ b/appl_grid/appl_pdf.h
-@@ -51,7 +51,7 @@ public:
-   class exception : public std::exception { 
-   public: 
-     exception(const std::string& s="") { std::cerr << what() << " " << s << std::endl; }; 
-    exception(std::ostream& s)         { std::cerr << what() << " " << s << std::endl; }; 
-+    exception(std::ostream& s)         { s << " " << std::endl; }; 
-     const char* what() const throw() { return "appl::appl_pdf::exception "; }
-   };
-   
-diff --git a/src/appl_igrid.h b/src/appl_igrid.h
-index d25288e..be354df 100644
--- a/src/appl_igrid.h
-+++ b/src/appl_igrid.h
-@@ -52,7 +52,7 @@ private:
-   class exception { 
-   public:
-     exception(const std::string& s) { std::cerr << s << std::endl; }; 
-    exception(std::ostream& s)      { std::cerr << s << std::endl; }; 
-+    exception(std::ostream& s)      { s << std::endl; }; 
-   };
- 
-   typedef double (igrid::*transform_t)(double) const;
-diff --git a/src/lumi_pdf.cxx b/src/lumi_pdf.cxx
--- a/src/lumi_pdf.cxx
-+++ b/src/lumi_pdf.cxx
-@@ -235,6 +235,6 @@ void lumi_pdf::write(const std::string& filename) const {
- // std::string lumi_pdf::summary(std::ostream& s=std::cout) const { 
- std::string lumi_pdf::summary() const { 
-   std::stringstream s;
-  s << "lumi_pdf::lumi_pdf() " << s << "\tsize " << m_combinations.size() << " lookup size " << m_lookup.size() << " " << this; 
-+  s << "lumi_pdf::lumi_pdf() " << "\tsize " << m_combinations.size() << " lookup size " << m_lookup.size() << " " << this; 
-   return s.str();
- }
--- a/pkgs/by-name/ap/applgrid/package.nix
+++ b/pkgs/by-name/ap/applgrid/package.nix
@@ -5,41 +5,41 @@
  gfortran,
  hoppet,
  lhapdf,
-  root5,
+  root,
  zlib,
 }:

 stdenv.mkDerivation rec {
  pname = "applgrid";
-  version = "1.4.70";
+  version = "1.6.27";

  src = fetchurl {
    url = "https://www.hepforge.org/archive/applgrid/${pname}-${version}.tgz";
-    sha256 = "1yw9wrk3vjv84kd3j4s1scfhinirknwk6xq0hvj7x2srx3h93q9p";
+    hash = "sha256-h+ZNGj33FIwg4fOCyfGJrUKM2vDDQl76JcLhtboAOtc=";
  };

+  postPatch = ''
+    sed -i appl_grid/serialise_base.h -e '1i#include <cstdint>'
+  '';
+
  nativeBuildInputs = [ gfortran ];

  # For some reason zlib was only needed after bump to gfortran8
  buildInputs = [
    hoppet
    lhapdf
-    root5
+    root
    zlib
  ];

-  patches = [
-    ./bad_code.patch
-  ];
-
  preConfigure =
    ''
      substituteInPlace src/Makefile.in \
-        --replace "-L\$(subst /libgfortran.a, ,\$(FRTLIB) )" "-L${gfortran.cc.lib}/lib"
+        --replace-fail "-L\$(subst /libgfortran.a, ,\$(FRTLIB) )" "-L${gfortran.cc.lib}/lib"
    ''
    + (lib.optionalString stdenv.hostPlatform.isDarwin ''
      substituteInPlace src/Makefile.in \
-        --replace "gfortran -print-file-name=libgfortran.a" "gfortran -print-file-name=libgfortran.dylib"
+        --replace-fail "gfortran -print-file-name=libgfortran.a" "gfortran -print-file-name=libgfortran.dylib"
    '');

  enableParallelBuilding = false; # broken
--- a/pkgs/by-name/as/ast-grep/package.nix
+++ b/pkgs/by-name/as/ast-grep/package.nix
@@ -11,13 +11,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ast-grep";
-  version = "0.38.6";
+  version = "0.38.7";

  src = fetchFromGitHub {
    owner = "ast-grep";
    repo = "ast-grep";
    tag = finalAttrs.version;
-    hash = "sha256-bgJzu7n/Qy0JAJ19VRXCvMtZBM/wZkQKT9AAXvIg5Ms=";
+    hash = "sha256-3ZjXHmPBI40rXrEUerlvmozBYEu8NDvy0Fj3wopA7D8=";
  };

  # error: linker `aarch64-linux-gnu-gcc` not found
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  '';

  useFetchCargoVendor = true;
-  cargoHash = "sha256-TVPI3394elxDzn/8S4hDkVounWI6bo6vpZeYJJzDOr4=";
+  cargoHash = "sha256-VoVSI6pg+V4lz/K5ASM8bwMo3G3+ZzK8/Yko33zsCNk=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/au/audiobookshelf/source.json
+++ b/pkgs/by-name/au/audiobookshelf/source.json
@@ -1,9 +1,9 @@
 {
  "owner": "advplyr",
  "repo": "audiobookshelf",
-  "rev": "264ae928a9c1af620487488110eec816b14e23ec",
-  "hash": "sha256-QNzQY5+tHzMopvJJw3ihb+x203wNnvIRbyyFNESN0Bk=",
-  "version": "2.26.0",
-  "depsHash": "sha256-rbe0EAGK2t3KkTaNie9psiFcA4EVooPDQzQclgW9R6k=",
-  "clientDepsHash": "sha256-yrTkVDFsf8o3QVtRAiy6rS3UZO2vxvBIoh2RsAmVp18="
+  "rev": "b911a25c573c537551bae234743eaab449c836b1",
+  "hash": "sha256-SZDESaog136kUCGHlxR8EI1JU0lCDIFQ2qyEO5mXx8Q=",
+  "version": "2.26.1",
+  "depsHash": "sha256-1NomDTDACypnLkwzhNkK2k8oDKRO7xJmqp8IIIcFG0M=",
+  "clientDepsHash": "sha256-BB7fbN1SlqsfJDCBFpOgmqzMXh2w6WRoamEzm8Y6iVU="
 }
--- a/pkgs/by-name/aw/aws-iam-authenticator/package.nix
+++ b/pkgs/by-name/aw/aws-iam-authenticator/package.nix
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "aws-iam-authenticator";
-  version = "0.7.3";
+  version = "0.7.4";

  src = fetchFromGitHub {
    owner = "kubernetes-sigs";
    repo = "aws-iam-authenticator";
    tag = "v${version}";
-    hash = "sha256-mr13gHMq7ZtoxToQu0WokTec0JC2e8msYUIB05U4zfw=";
+    hash = "sha256-TC8FntHiOrYdaVajvkzOK5P13LyOrmaZNsBhqD7bDpw=";
  };

-  vendorHash = "sha256-mne3oVfcsfZ5ECYiJujhJU6dxSax972TG5nM2oMGuCE=";
+  vendorHash = "sha256-XmFskQF8YFL3Ol0mF2wBb0v+2+VrtwBKmfOH8j3IWOs=";

  ldflags =
    let
--- a/pkgs/by-name/ba/badger/package.nix
+++ b/pkgs/by-name/ba/badger/package.nix
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "badger";
-  version = "4.7.0";
+  version = "4.8.0";

  src = fetchFromGitHub {
    owner = "dgraph-io";
    repo = "badger";
    rev = "v${version}";
-    hash = "sha256-R4nahpUuCjPas1NBnWmQ/KBTY+/yPSyo8AmTvgwhYVI=";
+    hash = "sha256-LkJp0ixEJcD0mGeafjFoxjekeyep2nbZPXgVcMEofAU=";
  };

-  vendorHash = "sha256-x4+CHLmQhu7Y6n1qx2CBY6KzRIRLD7Gn+pzXQy3/5rA=";
+  vendorHash = "sha256-I7N85gdf4Bm/0zTcdFfbpah9veSpOzZcTvd7Ku5Xqpg=";

  subPackages = [ "badger" ];

--- a/pkgs/by-name/bi/biliup-rs/package.nix
+++ b/pkgs/by-name/bi/biliup-rs/package.nix
@@ -10,13 +10,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "biliup-rs";
-  version = "0.2.3";
+  version = "0.2.4";

  src = fetchFromGitHub {
    owner = "biliup";
    repo = "biliup-rs";
    tag = "v${version}";
-    hash = "sha256-Gr2veeFDNHisqin4MQl/RcZN51BUHwTn7zUplP+VODo=";
+    hash = "sha256-Zbl/d0LXwxHWyzfcLg+AMJrLXlXOf+aIzdNYHEvAd90=";
  };

  nativeBuildInputs = [
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage rec {
  ];

  useFetchCargoVendor = true;
-  cargoHash = "sha256-7LiwKBsDAIc3zZvKFzgnIjup8lA70g7r7TtBCJ5VgL8=";
+  cargoHash = "sha256-bSnc8xFFcWONFX35G3S75ppqA2WF/M0EB/68BR1AgWM=";

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/bo/bottles-unwrapped/package.nix
+++ b/pkgs/by-name/bo/bottles-unwrapped/package.nix
@@ -32,13 +32,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "bottles-unwrapped";
-  version = "51.21";
+  version = "51.24";

  src = fetchFromGitHub {
    owner = "bottlesdevs";
    repo = "bottles";
    tag = version;
-    hash = "sha256-rUS2LRr7NqTvNd706AC/U/QUDcF8tzwkHDuS3R0O1KY=";
+    hash = "sha256-cKW2b8MVpVksDnthn9kPBtUoCiiCMTQ993KTJSJuZDE=";
  };

  patches =
--- a/pkgs/by-name/br/brave/package.nix
+++ b/pkgs/by-name/br/brave/package.nix
@@ -3,24 +3,24 @@

 let
  pname = "brave";
-  version = "1.80.120";
+  version = "1.80.122";

  allArchives = {
    aarch64-linux = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-BicdZFFU8MmBpkl6F0tf0aR0t4dfEI8QQS/gCBlye8w=";
+      hash = "sha256-UQmSZ3Xi96Q6/8Y09L5VaPVJHv7gUXcOyv5Ba35Z80s=";
    };
    x86_64-linux = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-RgJK9Q60hTBcxaA2B0UuwJrDtw1zqXnm/IZKiu1XcZg=";
+      hash = "sha256-Q/m81hCZF8om3Tlxlj77GPiBElJVibJFA/ts7mtN6n8=";
    };
    aarch64-darwin = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-gUuLnZU6JlvH7IQMhwSc947ybXls6GoCvVXo630qaxY=";
+      hash = "sha256-BezJ5ZXUBC2itSNUivnqygY8VzzIXM6wb3QSC+LE1uM=";
    };
    x86_64-darwin = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-x64.zip";
-      hash = "sha256-1mQow2Bqit6uINEc2SysiXJfx9lNYyT2evb7aZB6Un4=";
+      hash = "sha256-NN7Anrjym50DRo0qI5bF/XzhssgPuKOhk1CJgMoOq70=";
    };
  };

--- a/pkgs/by-name/ch/checkov/package.nix
+++ b/pkgs/by-name/ch/checkov/package.nix
@@ -25,14 +25,14 @@ with py.pkgs;

 python3.pkgs.buildPythonApplication rec {
  pname = "checkov";
-  version = "3.2.450";
+  version = "3.2.451";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "bridgecrewio";
    repo = "checkov";
    tag = version;
-    hash = "sha256-jU3qb+ds5A4a/FXw0+G8BU7iPVpunEJuTA0GyQYjqTc=";
+    hash = "sha256-omTsb7H6EGzFDZmYX0ZEHW/kDivzE64jVZbxWRSY5Nk=";
  };

  pythonRelaxDeps = [
--- a/pkgs/by-name/cl/claude-code/package-lock.json
+++ b/pkgs/by-name/cl/claude-code/package-lock.json
@@ -6,13 +6,13 @@
  "packages": {
    "": {
      "dependencies": {
-        "@anthropic-ai/claude-code": "^1.0.53"
+        "@anthropic-ai/claude-code": "^1.0.54"
      }
    },
    "node_modules/@anthropic-ai/claude-code": {
-      "version": "1.0.53",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.53.tgz",
-      "integrity": "sha512-YE7PKtU1VPLtI3kCI4lvQyR+GE6v18ZvigO2mZqUUCqw537jeRMpAtVCtrp/onAuWUdHBYm7GhV0yDtsVc5Vug==",
+      "version": "1.0.54",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.54.tgz",
+      "integrity": "sha512-83K9hwLE68G+WusGctrQBBQ6WGbbj2vy0cNZtv34LRj46u54+ujkZZRVbVR6Z0HkeLftXGSEVQsy0UuRZ1y7ZQ==",
      "license": "SEE LICENSE IN README.md",
      "bin": {
        "claude": "cli.js"
--- a/pkgs/by-name/cl/claude-code/package.nix
+++ b/pkgs/by-name/cl/claude-code/package.nix
@@ -7,16 +7,16 @@

 buildNpmPackage rec {
  pname = "claude-code";
-  version = "1.0.53";
+  version = "1.0.54";

  nodejs = nodejs_20; # required for sandboxed Nix builds on Darwin

  src = fetchzip {
    url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";
-    hash = "sha256-opFOUa/YtJDwhkD5dN+PL74z5NqkrRCVrU2RQu6xmEc=";
+    hash = "sha256-eLYGalDQX6hde6ooB886oM8gRTVKKdLAtLTH8Z4b7FY=";
  };

-  npmDepsHash = "sha256-e+WTydp3WIl6hZwbmv5SKM9XhcMJpYO5mTInT41/p2c=";
+  npmDepsHash = "sha256-KxyE52kNgm7O7faz9HYdSJTzZK7qXUEGp/8y5dZjhto=";

  postPatch = ''
    cp ${./package-lock.json} package-lock.json
--- a/pkgs/by-name/cl/clusterctl/package.nix
+++ b/pkgs/by-name/cl/clusterctl/package.nix
@@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "clusterctl";
-  version = "1.10.3";
+  version = "1.10.4";

  src = fetchFromGitHub {
    owner = "kubernetes-sigs";
    repo = "cluster-api";
    rev = "v${version}";
-    hash = "sha256-xbmhvGCSrGDX/sgq4T7tcWwY8gckXnTk79ukjYjdDig=";
+    hash = "sha256-MMwM1hWZd1DdiymRAJrcFD4YoLqP0wrgDV5oIv7Lkxo=";
  };

-  vendorHash = "sha256-zNYChnY5U31pWCdtjv6HIivmkJoxWbqpmWqmUlb2gw8=";
+  vendorHash = "sha256-YFtlu9ml7ZHG+m8se4K229+kzbiBZ4+dcJhFFIH7XgA=";

  subPackages = [ "cmd/clusterctl" ];

--- a/pkgs/by-name/co/coder/package.nix
+++ b/pkgs/by-name/co/coder/package.nix
@@ -15,21 +15,21 @@ let

  channels = {
    stable = {
-      version = "2.23.2";
+      version = "2.23.4";
      hash = {
-        x86_64-linux = "sha256-nFb4G4PQdrxwXHpialI0g3CszOdNt8xnSEZCAsFADAo=";
-        x86_64-darwin = "sha256-XHivHFYxTmjR+vkkR4632ZjKqKVVb6MwSSPy0rzuLLo=";
-        aarch64-linux = "sha256-DNuEeiTkGlDyOrFMuApSASs51bRYleoPQN9eMyY7c78=";
-        aarch64-darwin = "sha256-A1sF3RFAQrkPU8GMOXmpzzY3CXjKwOeA6f/dZtuetZc=";
+        x86_64-linux = "sha256-tpU26+3NrfOUWgd4Wav1fhTMtErh2CXt3Nr8BTIUdbc=";
+        x86_64-darwin = "sha256-07pSXm++a9VWcnc4AgrR7OaaDw2ki2XMtr8PZkWW2Vw=";
+        aarch64-linux = "sha256-Rm1CIVK7qPLizK+0H3Eb2qwPEj1TjHtIqdBr+Z+21eA=";
+        aarch64-darwin = "sha256-H5MLnRokC5Wb3FrotprunG+kx0qwT8/Ou6ScO7N2h+E=";
      };
    };
    mainline = {
-      version = "2.24.1";
+      version = "2.24.2";
      hash = {
-        x86_64-linux = "sha256-gqQlyA1LtWYpeBHupbFTFLD0KmF1P61JgrokCtqTDiI=";
-        x86_64-darwin = "sha256-iiCMCs7Det/ebTRo69FDqUW76cHnzgtl0gxRfAYMnho=";
-        aarch64-linux = "sha256-Qxc+GQ2xmKkgJkoMi4gtauTen1wvU5UD/faY13xnuHI=";
-        aarch64-darwin = "sha256-0wRRpLhqosd4n0JhFe4/4/odUTMGwf74bYFBJ6rlTw4=";
+        x86_64-linux = "sha256-Al3bvIsSnU0vdNAkZknpP/rxJIP6UGUIeIZ6kw84SuM=";
+        x86_64-darwin = "sha256-0+n69BWKIgKFUCQzW4AMRW4QdRQcZkK5Ioiu4d4RvnE=";
+        aarch64-linux = "sha256-2JkEO7hhLY9e22OTYLhzv+Zb0aP6PRVG8ZX5r686o0Q=";
+        aarch64-darwin = "sha256-7CJQEj7VA3SwaZeimng6BPDtw14LXt7+1E7HxVs8kYM=";
      };
    };
  };
--- a/pkgs/by-name/co/coroot-node-agent/package.nix
+++ b/pkgs/by-name/co/coroot-node-agent/package.nix
@@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "coroot-node-agent";
-  version = "1.25.4";
+  version = "1.25.5";

  src = fetchFromGitHub {
    owner = "coroot";
    repo = "coroot-node-agent";
    rev = "v${version}";
-    hash = "sha256-mzgeV3spny6swOj6nU7uhHgPF0SIuuKXbRCquMH0ZwY=";
+    hash = "sha256-TIUl3DGidIgPFPh9dBkLRRIHK7gMtoXGJDehKltQ0CE=";
  };

  vendorHash = "sha256-QvdFW/o481F85WuXNdz99Q9MBiGRjVSWvPRytq67vYU=";
--- a/pkgs/by-name/cp/cpptrace/package.nix
+++ b/pkgs/by-name/cp/cpptrace/package.nix
@@ -14,13 +14,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cpptrace";
-  version = "1.0.2";
+  version = "1.0.3";

  src = fetchFromGitHub {
    owner = "jeremy-rifkin";
    repo = "cpptrace";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Rqj0yFOOOZyK4BJWVFGyYznMSSwNgb+o1HTykyyOWcA=";
+    hash = "sha256-8H1eJQYQn1DsVsJ0OpJAOJSWD/0iSn1SQLzg1elyEmM=";
  };

  patches = [
--- a/pkgs/by-name/ex/exploitdb/package.nix
+++ b/pkgs/by-name/ex/exploitdb/package.nix
@@ -7,13 +7,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "exploitdb";
-  version = "2025-07-09";
+  version = "2025-07-17";

  src = fetchFromGitLab {
    owner = "exploit-database";
    repo = "exploitdb";
    tag = finalAttrs.version;
-    hash = "sha256-AOasRKblz35p1UdMZFNxVoaTcvL39ssLCW3rVBqZEx8=";
+    hash = "sha256-RxK983lsfEHKCG9lG7EBVgpS3XJ3NC0LjsgDF8dVcn8=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/fn/fn-cli/package.nix
+++ b/pkgs/by-name/fn/fn-cli/package.nix
@@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "fn";
-  version = "0.6.42";
+  version = "0.6.43";

  src = fetchFromGitHub {
    owner = "fnproject";
    repo = "cli";
    rev = version;
-    hash = "sha256-cVxanejijbHx455P5Elc4uiqHmG1+MtRoXiHr52YyAw=";
+    hash = "sha256-8JvrCY56i6Nksg+LgfIIpUZozUF0IBfdG8rKMuYUrzI=";
  };

  vendorHash = null;
--- a/pkgs/by-name/fu/functiontrace-server/package.nix
+++ b/pkgs/by-name/fu/functiontrace-server/package.nix
@@ -7,15 +7,15 @@

 rustPlatform.buildRustPackage rec {
  pname = "functiontrace-server";
-  version = "0.8.4";
+  version = "0.8.6";

  src = fetchCrate {
    inherit pname version;
-    hash = "sha256-i+lXjFXCPT6Skr+r/RKYQm+iJ+WETJ/tAQg5U6qFFi8=";
+    hash = "sha256-f/DpT5IYhUA/+w+QK3Itk4bBaYRFhGOWQbN51YYrmxA=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-61+hEq0cdJZ+DTgN/ZtK6IKuwLCq3oxk0SrzqWewQXs=";
+  cargoHash = "sha256-rDCIzJUFA+2iEpITg3MuKFfgiyQ6GtMvIigiHkX70M8=";

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/fx/fx/package.nix
+++ b/pkgs/by-name/fx/fx/package.nix
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "fx";
-  version = "37.0.0";
+  version = "37.0.1";

  src = fetchFromGitHub {
    owner = "antonmedv";
    repo = "fx";
    tag = finalAttrs.version;
-    hash = "sha256-rGwOYPH72Qy8aGQ8vf+vu584zKoB5nQXEtOI+JIiv4U=";
+    hash = "sha256-n2Jaw8ffRnMQ89OsV5HhRGkjD3n8p49N2jYyx3SUrjU=";
  };

-  vendorHash = "sha256-cskcP87rTwY68x3M3xzH5d5X2aDqQtSkX8aXvgMl2Vk=";
+  vendorHash = "sha256-yVAoswClpf5+1nwLyrLKLYFt9Noh2HRemif1e1nWm7M=";

  ldflags = [ "-s" ];

--- a/pkgs/by-name/gi/gitlab-ci-ls/package.nix
+++ b/pkgs/by-name/gi/gitlab-ci-ls/package.nix
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "gitlab-ci-ls";
-  version = "1.1.1";
+  version = "1.1.2";
  src = fetchFromGitHub {
    owner = "alesbrelih";
    repo = "gitlab-ci-ls";
    rev = "${version}";
-    hash = "sha256-3DR1MV9YSugWFodLh4wBa6oT8yGEkir0rVm0mcHXpxU=";
+    hash = "sha256-yJA6xdeLJVPbHI2VdRAmsYvuULCJk40ntIJ0JIWsZds=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-V2ZQLHLIaYJpNeQIZyRq2G5u6/cTJvMXV2301VG21xQ=";
+  cargoHash = "sha256-3Ko+vf24dEfu+g4yGA5xY0R0TA9fSWuG398DxhHIVFU=";

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ openssl ];
--- a/pkgs/by-name/gl/glitchtip/frontend.nix
+++ b/pkgs/by-name/gl/glitchtip/frontend.nix
@@ -9,20 +9,22 @@

 buildNpmPackage (finalAttrs: {
  pname = "glitchtip-frontend";
-  version = "5.0.5";
+  version = "5.0.9";

  src = fetchFromGitLab {
    owner = "glitchtip";
    repo = "glitchtip-frontend";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-PL0/1u+gJk/obRnSeMRx6BeSOxzXeFXZ1WlKnebyCqI=";
+    hash = "sha256-iNTGs+rq2TVDIBcLV4wMmWxwBvwWqKXytowLD7SRFEw=";
  };

  npmDeps = fetchNpmDeps {
-    inherit (finalAttrs) src;
-    hash = "sha256-kiL4UtY6qOVS1X6UeZFM53+oPyM1E5NCBstZQwBgZDI=";
+    inherit (finalAttrs) src patches;
+    hash = "sha256-81Z1NijHuvG9I4pdsUQ1cS3OdfAtHoiSdmrpu1KUpWE=";
  };

+  patches = [ ./update_esbuild.patch ];
+
  postPatch = ''
    jq '.devDependencies |= del(.cypress, ."cypress-localstorage-commands")' package.json | sponge package.json
  '';
--- a/pkgs/by-name/gl/glitchtip/package.nix
+++ b/pkgs/by-name/gl/glitchtip/package.nix
@@ -2,7 +2,6 @@
  lib,
  python313,
  fetchFromGitLab,
-  fetchpatch,
  fetchPypi,
  callPackage,
  stdenv,
@@ -61,6 +60,9 @@ let
      orjson
      psycopg
      pydantic
+      # undocumented on django-allauth side
+      # https://codeberg.org/allauth/django-allauth/issues/4493
+      pyyaml
      sentry-sdk
      symbolic
      user-agents
@@ -84,25 +86,16 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "glitchtip";
-  version = "5.0.5";
+  version = "5.0.9";
  pyproject = true;

  src = fetchFromGitLab {
    owner = "glitchtip";
    repo = "glitchtip-backend";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-7ulmrFOy14/Y/8LmKrmBzqrMPuwfdWOGMuhhhYI7+f4=";
+    hash = "sha256-yRXrcwE5DDJpDiX4XB18ezrLn62AV4w/ASvrOoKD6p4=";
  };

-  patches = [
-    # update symbolic
-    (fetchpatch {
-      url = "https://gitlab.com/glitchtip/glitchtip-backend/-/merge_requests/1642.patch";
-      excludes = [ "uv.lock" ];
-      hash = "sha256-6x1W/79DBPVQdAFWAozK2TXUoj/oArEuNMrARIeWtIY=";
-    })
-  ];
-
  propagatedBuildInputs = pythonPackages;

  nativeBuildInputs = [
--- a/pkgs/by-name/gl/glitchtip/update_esbuild.patch
+++ b/pkgs/by-name/gl/glitchtip/update_esbuild.patch
--- a/pkgs/by-name/go/go-mockery/package.nix
+++ b/pkgs/by-name/go/go-mockery/package.nix
@@ -10,17 +10,17 @@

 buildGoModule (finalAttrs: {
  pname = "go-mockery";
-  version = "3.4.0";
+  version = "3.5.1";

  src = fetchFromGitHub {
    owner = "vektra";
    repo = "mockery";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-qcK0FXtAL7kJ+dotthmnMcGa9wu97UsDKBoKy5lD2W4=";
+    hash = "sha256-x7WniZ4wpnuzUHM2ZC2P7Ns67bIp4V4F9f4xQEJONEk=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-Xy2w61ATNDOZKtdekeA9NSdyJq2/eiEZ9iJ3PDSUm9Q=";
+  vendorHash = "sha256-cNMknwlU7ENwN67CtyU1YgYIXCJbh4b7Z3oUK7kkEkk=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/go/gobuster/package.nix
+++ b/pkgs/by-name/go/gobuster/package.nix
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "gobuster";
-  version = "3.7.0";
+  version = "3.8.0";

  src = fetchFromGitHub {
    owner = "OJ";
    repo = "gobuster";
    tag = "v${version}";
-    hash = "sha256-RiT9WUvMCv64Q1kl3WoZ6hu8whpAuG2SN6S0897SE2k=";
+    hash = "sha256-EUfpCuEbWe0+98b63ITrAeB6GGfu1b9vbP6/5gg/7Nw=";
  };

-  vendorHash = "sha256-3okd9ixxfFJTVYMj3qLnezfeR6esfagEfUNfWl6Oo60=";
+  vendorHash = "sha256-k3NDFBDMiysrnjiEODrrxLdpePLCzUYD41mZbiYuqAE=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/hy/hyprland-per-window-layout/package.nix
+++ b/pkgs/by-name/hy/hyprland-per-window-layout/package.nix
@@ -6,17 +6,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "hyprland-per-window-layout";
-  version = "2.13";
+  version = "2.14";

  src = fetchFromGitHub {
    owner = "coffebar";
    repo = "hyprland-per-window-layout";
    rev = version;
-    hash = "sha256-Bwdh+Cy5LTRSBDfk4r28FmPRUEHYI++nKRhS9eSSbyg=";
+    hash = "sha256-dYoHa4b7BZc/LGVLsNs/LTj4sSMaFel+QE0TUv5kGAk=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-QXT7utSEF5S5MWAng4fKMoloUJovxLT8oLUK9dJEb/0=";
+  cargoHash = "sha256-wXPc3jAY8E0k8cn4Z2OIhCyrfszzlzFmhQZIZay16Ec=";

  meta = with lib; {
    description = "Per window keyboard layout (language) for Hyprland wayland compositor";
--- a/pkgs/by-name/ka/kakasi/gettext-0.25.patch
+++ b/pkgs/by-name/ka/kakasi/gettext-0.25.patch
@@ -0,0 +1,16 @@
+diff --git a/configure.in b/configure.in
+index e865b04..478b689 100644
+--- a/configure.in
+++ b/configure.in
+@@ -3,8 +3,11 @@ dnl $Id: configure.in,v 1.23 2014-03-18 06:33:20 knok Exp $
+ 
+ AC_INIT
+ AC_CONFIG_SRCDIR([src/kakasi.c])
+AC_CONFIG_MACRO_DIRS([m4])
+ AC_PREREQ([2.50])
+ AM_INIT_AUTOMAKE(kakasi, 2.3.6)
+AM_GNU_GETTEXT_VERSION([0.21])
+AM_GNU_GETTEXT([external])
+ 
+ AM_MAINTAINER_MODE
+ 
--- a/pkgs/by-name/ka/kakasi/package.nix
+++ b/pkgs/by-name/ka/kakasi/package.nix
@@ -36,6 +36,7 @@ stdenv.mkDerivation rec {
      url = "https://src.fedoraproject.org/rpms/kakasi/raw/4756771/f/kakasi-configure-c99.patch";
      hash = "sha256-XPIp/+AR6K84lv606aRHPQwia/1K3rt/7KSo0V0ZQ5o=";
    })
+    ./gettext-0.25.patch
  ];

  postPatch = ''
--- a/pkgs/by-name/kt/ktls-utils/package.nix
+++ b/pkgs/by-name/kt/ktls-utils/package.nix
@@ -15,13 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "ktls-utils";
-  version = "1.1.0";
+  version = "1.2.0";

  src = fetchFromGitHub {
    owner = "oracle";
    repo = "ktls-utils";
    rev = "ktls-utils-${version}";
-    hash = "sha256-UQMM4P2YZbdB8H+kTLPBKLces0HJHAO3f21VvI1yNmk=";
+    hash = "sha256-cGvTuesaAMWVeJFQKdGKLGJJ4OMudOjqxCneViGl4IQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ku/kubelogin/package.nix
+++ b/pkgs/by-name/ku/kubelogin/package.nix
@@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "kubelogin";
-  version = "0.2.9";
+  version = "0.2.10";

  src = fetchFromGitHub {
    owner = "Azure";
    repo = "kubelogin";
    rev = "v${version}";
-    sha256 = "sha256-5qIGUI7hw4Yvpb0Pub3P2lYMnTuMfu7I2x8Xq0Gsuag=";
+    sha256 = "sha256-pi2dzIf48mqD3S7QqaZZ5sgcgPRtQZ10KpfojLVYCZA=";
  };

-  vendorHash = "sha256-fILOPZnSsEX9f1nWxC1jTN2wNGmlz15fFmeVvXMA25w=";
+  vendorHash = "sha256-tuqWg7z9YJygEW3XwBXDwXHUNwaJeTAxRS1xv6bQpj4=";

  ldflags = [
    "-X main.gitTag=v${version}"
--- a/pkgs/by-name/kw/kwok/package.nix
+++ b/pkgs/by-name/kw/kwok/package.nix
@@ -23,7 +23,7 @@ buildGoModule rec {
    description = "Simulate massive Kubernetes clusters with low resource usage locally without kubelet";
    homepage = "https://kwok.sigs.k8s.io";
    changelog = "https://github.com/kubernetes-sigs/kwok/releases/tag/v${version}";
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
    maintainers = with lib.maintainers; [ bot-wxt1221 ];
  };
 }
--- a/pkgs/by-name/ly/lychee/package.nix
+++ b/pkgs/by-name/ly/lychee/package.nix
@@ -36,8 +36,7 @@ rustPlatform.buildRustPackage rec {
  checkFlags = [
    #  Network errors for all of these tests
    # "error reading DNS system conf: No such file or directory (os error 2)" } }
-    "--skip=archive::wayback::tests::wayback_suggestion"
-    "--skip=archive::wayback::tests::wayback_suggestion_unknown_url"
+    "--skip=archive::wayback::tests::wayback_suggestion_real_unknown"
    "--skip=archive::wayback::tests::wayback_api_no_breaking_changes"
    "--skip=cli::test_dont_dump_data_uris_by_default"
    "--skip=cli::test_dump_data_uris_in_verbose_mode"
--- a/pkgs/by-name/ma/matrix-authentication-service/package.nix
+++ b/pkgs/by-name/ma/matrix-authentication-service/package.nix
@@ -12,26 +12,28 @@
  stdenv,
  open-policy-agent,
  cctools,
+  nix-update-script,
+  versionCheckHook,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "matrix-authentication-service";
-  version = "0.17.1";
+  version = "0.19.0";

  src = fetchFromGitHub {
    owner = "element-hq";
    repo = "matrix-authentication-service";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-iBDvvKy5alaieIm+Jv9WnqHVGjItDSvJAk+ClTRj3v0=";
+    hash = "sha256-JimVGDHL4pwN0ALdZVJjkzgdOMTlXo4okiH8b7aALJg=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-rHlzLawpCD9onhca9NzgUXmA2vDmW48cQrV05qs+tn8=";
+  cargoHash = "sha256-5Db3veAs2Zk1EzCp0M8krkUEtfiuJwbAUpUODquYXlA=";

  npmDeps = fetchNpmDeps {
    name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
    src = "${finalAttrs.src}/${finalAttrs.npmRoot}";
-    hash = "sha256-0rJAU4PZAshTu6KD4EzIltUT8PO4dnWCY5oM3kyxBBk=";
+    hash = "sha256-m0W9S/NcbwVMsqSBh5GIHawQR1kRsEEQCnHGbSGNq74=";
  };

  npmRoot = "frontend";
@@ -83,6 +85,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
    cp -r translations   "$out/share/$pname/translations"
  '';

+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+  passthru.updateScript = nix-update-script { };
+
  meta = {
    description = "OAuth2.0 + OpenID Provider for Matrix Homeservers";
    homepage = "https://github.com/element-hq/matrix-authentication-service";
--- a/pkgs/by-name/ma/mautrix-meta/package.nix
+++ b/pkgs/by-name/ma/mautrix-meta/package.nix
@@ -15,7 +15,7 @@

 buildGoModule rec {
  pname = "mautrix-meta";
-  version = "0.5.0";
+  version = "0.5.2";

  subPackages = [ "cmd/mautrix-meta" ];

@@ -23,13 +23,13 @@ buildGoModule rec {
    owner = "mautrix";
    repo = "meta";
    rev = "v${version}";
-    hash = "sha256-SM57PLfRVEKspqnAZz1XES6ba9Puuzvx8XZwAWKVRmw=";
+    hash = "sha256-S/HWCN9d3Nhbl73RoFD684OG3CbdNWXU8QReJoSYJK0=";
  };

  buildInputs = lib.optional (!withGoolm) olm;
  tags = lib.optional withGoolm "goolm";

-  vendorHash = "sha256-+gQPlI9DHuY01JlUnEaYctOs+2XFAkw+X9SkvH0xlbc=";
+  vendorHash = "sha256-m0s99gl49NzGEpuDPB5tL92krt2Zho36NsIEXJk+nCw=";

  passthru = {
    tests = {
--- a/pkgs/by-name/ma/mautrix-slack/package.nix
+++ b/pkgs/by-name/ma/mautrix-slack/package.nix
@@ -13,7 +13,7 @@
  withGoolm ? false,
 }:
 let
-  version = "0.2.1";
+  version = "0.2.2";
 in
 buildGoModule {
  pname = "mautrix-slack";
@@ -23,10 +23,10 @@ buildGoModule {
    owner = "mautrix";
    repo = "slack";
    tag = "v${version}";
-    hash = "sha256-1/OuwyQU68tsg9WOl0Eg4ZM28sD6JDMQN9i1LZLYOuE=";
+    hash = "sha256-Ha3Rwd9+2RFxOF+H5jG6wRlgqLfUbCcoZcaXehyr1m0=";
  };

-  vendorHash = "sha256-YjM2ZpXm3DGNRtCGvj7+0+bXAnb7HXYzQvxCSL4+hHo=";
+  vendorHash = "sha256-BjKEf4cG9kPcwuUefosBFzyCUpYhK7fm+w/GtG+oicg=";

  buildInputs = lib.optional (!withGoolm) olm;
  tags = lib.optional withGoolm "goolm";
--- a/pkgs/by-name/ma/mautrix-whatsapp/package.nix
+++ b/pkgs/by-name/ma/mautrix-whatsapp/package.nix
@@ -14,19 +14,19 @@

 buildGoModule rec {
  pname = "mautrix-whatsapp";
-  version = "0.12.2";
+  version = "0.12.3";

  src = fetchFromGitHub {
    owner = "mautrix";
    repo = "whatsapp";
    rev = "v${version}";
-    hash = "sha256-Es6RWUo/e25wYGIz6feVNXIQbMCDPl1iZoKT3x8vHtA=";
+    hash = "sha256-gbKphWFBT5+7kIptIS/GquFBPVaZzJolbEkZ6bj3Fiw=";
  };

  buildInputs = lib.optional (!withGoolm) olm;
  tags = lib.optional withGoolm "goolm";

-  vendorHash = "sha256-/R6MI6egGV1E1YzKcxBSOb2z97kA1HCK5GdMgfR1vSM=";
+  vendorHash = "sha256-LGHW1n36fdDtIPNENA2qqLcho+7FVna/zUPEYcxd9LQ=";

  doCheck = false;

--- a/pkgs/by-name/me/melonDS/package.nix
+++ b/pkgs/by-name/me/melonDS/package.nix
@@ -28,13 +28,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "melonDS";
-  version = "1.0rc-unstable-2025-07-07";
+  version = "1.0-unstable-2025-07-13";

  src = fetchFromGitHub {
    owner = "melonDS-emu";
    repo = "melonDS";
-    rev = "85dcf65231224f34e25b5007b644d8987e33838c";
-    hash = "sha256-ZKPsE3+kkv2xlIHB+TBKp2J5GnKU7BA1+O4Y1Rq4low=";
+    rev = "13a9825c9a84fdbf42d0d4b922f9c2e0920ed19e";
+    hash = "sha256-16QcMsYARA5tXeEtCyV2jsWSRwrcBJBYSxG5YtYMPa4=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ni/nix-du/package.nix
+++ b/pkgs/by-name/ni/nix-du/package.nix
@@ -25,13 +25,13 @@ rustPlatform.buildRustPackage rec {

  doCheck = true;
  nativeCheckInputs = [
-    nixVersions.nix_2_24
+    nixVersions.nix_2_28
    graphviz
  ];

  buildInputs = [
    boost
-    nixVersions.nix_2_24
+    nixVersions.nix_2_28
    nlohmann_json
  ];

--- a/pkgs/by-name/nu/nu_scripts/package.nix
+++ b/pkgs/by-name/nu/nu_scripts/package.nix
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation {
  pname = "nu_scripts";
-  version = "0-unstable-2025-07-03";
+  version = "0-unstable-2025-07-08";

  src = fetchFromGitHub {
    owner = "nushell";
    repo = "nu_scripts";
-    rev = "f0cd46cafc9d0d73efde0f2a0b6f455dd2dfbfe3";
-    hash = "sha256-JEytcntdN+krsjzJdwa+pbF76Z2XhStdKS9/GZ9JjtE=";
+    rev = "b09b60cc434bb9be05ce2bbb6dc299760d13b18b";
+    hash = "sha256-Vh2yuIMvYiYdCYWqFRx7G24hWrQ5iJr1byOV/pIkFyI=";
  };

  installPhase = ''
--- a/pkgs/by-name/pr/protoc-gen-dart/package.nix
+++ b/pkgs/by-name/pr/protoc-gen-dart/package.nix
@@ -6,13 +6,13 @@

 buildDartApplication rec {
  pname = "protoc-gen-dart";
-  version = "22.4.0";
+  version = "22.5.0";

  src = fetchFromGitHub {
    owner = "google";
    repo = "protobuf.dart";
    tag = "protoc_plugin-v${version}";
-    hash = "sha256-X5WBju6DHsimhvOIVhX+zJCm5BTlEky/7iR2CS5Ybm4=";
+    hash = "sha256-8pSCYlbZLqHnpetM4luyfGo1qnWgKx93JPjRVWCOX0w=";
  };

  sourceRoot = "${src.name}/protoc_plugin";
--- a/pkgs/by-name/pr/protoc-gen-dart/pubspec.lock.json
+++ b/pkgs/by-name/pr/protoc-gen-dart/pubspec.lock.json
@@ -14,11 +14,11 @@
      "dependency": "transitive",
      "description": {
        "name": "analyzer",
-        "sha256": "f6154230675c44a191f2e20d16eeceb4aa18b30ca732db4efaf94c6a7d43cfa6",
+        "sha256": "b1ade5707ab7a90dfd519eaac78a7184341d19adb6096c68d499b59c7c6cf880",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "7.5.2"
+      "version": "7.7.0"
    },
    "args": {
      "dependency": "transitive",
@@ -84,11 +84,11 @@
      "dependency": "transitive",
      "description": {
        "name": "coverage",
-        "sha256": "aa07dbe5f2294c827b7edb9a87bba44a9c15a3cc81bc8da2ca19b37322d30080",
+        "sha256": "5da775aa218eaf2151c721b16c01c7676fbfdd99cebba2bf64e8b807a28ff94d",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.14.1"
+      "version": "1.15.0"
    },
    "crypto": {
      "dependency": "transitive",
@@ -101,7 +101,7 @@
      "version": "3.0.6"
    },
    "dart_style": {
-      "dependency": "direct dev",
+      "dependency": "direct main",
      "description": {
        "name": "dart_style",
        "sha256": "5b236382b47ee411741447c1f1e111459c941ea1b3f2b540dde54c210a3662af",
@@ -284,14 +284,14 @@
      "dependency": "direct main",
      "description": {
        "name": "protobuf",
-        "sha256": "579fe5557eae58e3adca2e999e38f02441d8aa908703854a9e0a0f47fa857731",
+        "sha256": "6153efcc92a06910918f3db8231fd2cf828ac81e50ebd87adc8f8a8cb3caff0e",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "4.1.0"
+      "version": "4.1.1"
    },
    "pub_semver": {
-      "dependency": "direct dev",
+      "dependency": "direct main",
      "description": {
        "name": "pub_semver",
        "sha256": "5bfcf68ca79ef689f8990d1160781b4bad40a3bd5e5218ad4076ddb7f4081585",
--- a/pkgs/by-name/pr/protonup-rs/package.nix
+++ b/pkgs/by-name/pr/protonup-rs/package.nix
@@ -6,15 +6,15 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "protonup-rs";
-  version = "0.9.0";
+  version = "0.9.1";

  src = fetchCrate {
    inherit (finalAttrs) pname version;
-    hash = "sha256-OVdoXe83lH6wjYb36tT4P3sG1w6NdWhRYC0L3v8USs4=";
+    hash = "sha256-zUsb+ZJmKUizBVwE4Uf/YnIukRn0AEQa7UeXdIIWYt8=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-qESp4z3HRe414Ro04NuiVNy0j/zJUmII4Gbacs3Bc48=";
+  cargoHash = "sha256-baa3VtGUnVFMwlPdKSa4jXecSlKogRHjKMfcGbqUFM0=";

  checkFlags = [
    # Requires internet access
--- a/pkgs/by-name/ro/root5/disable_libc_dicts_root5.patch
+++ b/pkgs/by-name/ro/root5/disable_libc_dicts_root5.patch
@@ -1,27 +0,0 @@
-diff --git a/cint/ROOT/CMakeLists.txt b/cint/ROOT/CMakeLists.txt
--- a/cint/ROOT/CMakeLists.txt
-+++ b/cint/ROOT/CMakeLists.txt
-@@ -47,21 +47,13 @@ set(CINTSTLDLLHEADERS
-     ${CMAKE_SOURCE_DIR}/cint/cint/lib/stdstrct/stdcxxfunc.h
-   )
- set(CINTINCDLLNAMES 
-    stdfunc 
-+#    stdfunc 
- #    stdcxxfunc
-    )
- set(CINTINCDLLHEADERS
-    ${CMAKE_SOURCE_DIR}/cint/cint/lib/stdstrct/stdfunc.h 
-+#    ${CMAKE_SOURCE_DIR}/cint/cint/lib/stdstrct/stdfunc.h 
- #    ${CMAKE_SOURCE_DIR}/cint/cint/lib/stdstrct/stdcxxfunc.h
-    )
-if(NOT WIN32)
-  set(CINTSTLDLLNAMES ${CINTSTLDLLNAMES}  valarray)
-  set(CINTSTLDLLHEADERS ${CINTSTLDLLHEADERS} ${CINTDLLDIR}/vary.h)
-  set(CINTINCDLLNAMES ${CINTINCDLLNAMES} posix ipc)
-  set(CINTINCDLLHEADERS ${CINTINCDLLHEADERS} 
-    ${CMAKE_SOURCE_DIR}/cint/cint/lib/posix/exten.h 
-    ${CMAKE_SOURCE_DIR}/cint/cint/lib/ipc/ipcif.h)
-endif()
- 
- set(CINTBUILDLOADER
-     vector 
--- a/pkgs/by-name/ro/root5/package.nix
+++ b/pkgs/by-name/ro/root5/package.nix
@@ -1,195 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  fetchpatch,
-  cmake,
-  pcre,
-  pkg-config,
-  python3,
-  libX11,
-  libXpm,
-  libXft,
-  libXext,
-  libGLU,
-  libGL,
-  zlib,
-  libxml2,
-  libxcrypt,
-  lz4,
-  xz,
-  gsl,
-  xxHash,
-  noSplash ? false,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "root";
-  version = "5.34.38";
-
-  src = fetchurl {
-    url = "https://root.cern.ch/download/root_v${version}.source.tar.gz";
-    sha256 = "1ln448lszw4d6jmbdphkr2plwxxlhmjkla48vmmq750xc1lxlfrc";
-  };
-
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-  ];
-  buildInputs =
-    [
-      pcre
-      python3
-      zlib
-      libxml2
-      lz4
-      xz
-      gsl
-      xxHash
-      libxcrypt
-    ]
-    ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
-      libX11
-      libXpm
-      libXft
-      libXext
-      libGLU
-      libGL
-    ];
-
-  patches = [
-    ./sw_vers_root5.patch
-
-    # prevents rootcint from looking in /usr/includes and such
-    ./purify_include_paths_root5.patch
-
-    # disable dictionary generation for stuff that includes libc headers
-    # our glibc requires a modern compiler
-    ./disable_libc_dicts_root5.patch
-
-    (fetchpatch {
-      name = "root5-gcc9-fix.patch";
-      url = "https://github.com/root-project/root/commit/348f30a6a3b5905ef734a7bd318bc0ee8bca6dc9.diff";
-      sha256 = "0dvrsrkpacyn5z87374swpy7aciv9a8s6m61b4iqd7a956r67rn3";
-    })
-    (fetchpatch {
-      name = "root5-gcc10-fix.patch";
-      url = "https://github.com/root-project/root/commit/3c243b18768d3c3501faf3ca4e4acfc071021350.diff";
-      sha256 = "1hjmgnp4zx6im8ps78673x0rrhmfyy1nffhgxjlfl1r2z8cq210z";
-    })
-    (fetchpatch {
-      name = "root5-python37-fix.patch";
-      url = "https://github.com/root-project/root/commit/c75458024082de0cc35b45505c652b8460a9e71b.patch";
-      sha256 = "sha256-A5zEjQE9OGPFp/L1HUs4NIdxQMRiwbwCRNWOLN2ENrM=";
-    })
-    # Backport Python 3.11 fix to v5 from v6.26
-    # https://github.com/root-project/root/commit/484deb056dacf768aba4954073b41105c431bffc
-    ./root5-python311-fix.patch
-
-    # Backport Python 3.13 fix to v5 from v6.25
-    # https://github.com/root-project/root/commit/9aa67a863482eef8cf50850b9ac3724e35f58781
-    ./python313-PyCFunction_Call.patch
-  ];
-
-  # https://github.com/root-project/root/issues/13216
-  hardeningDisable = [ "fortify3" ];
-
-  preConfigure =
-    ''
-      # binutils 2.37 fixes
-      fixupList=(
-        cint/demo/gl/make0
-        cint/demo/exception/Makefile
-        cint/demo/makecint/KRcc/Makefile
-        cint/demo/makecint/Stub2/Make2
-        cint/demo/makecint/Array/Makefile
-        cint/demo/makecint/DArray/Makefile
-        cint/demo/makecint/ReadFile/Makefile
-        cint/demo/makecint/stl/Makefile
-        cint/demo/makecint/Stub2/Make1
-        cint/cint/include/makemat
-        cint/cint/lib/WildCard/Makefile
-        cint/cint/include/make.arc
-        cint/cint/lib/qt/Makefile
-        cint/cint/lib/pthread/Makefile
-        graf2d/asimage/src/libAfterImage/Makefile.in
-      )
-      for toFix in "''${fixupList[@]}"; do
-        substituteInPlace "$toFix" --replace "clq" "cq"
-      done
-
-      patchShebangs build/unix/
-
-      # __malloc_hook is deprecated
-      substituteInPlace misc/memstat/src/TMemStatHook.cxx \
-        --replace "defined(R__GNU) && (defined(R__LINUX) || defined(__APPLE__))" \
-                  "defined(R__GNU) && (defined(__APPLE__))"
-
-      # python 3.12
-      substituteInPlace bindings/pyroot/src/PyROOT.h \
-        --replace " PyUnicode_GET_SIZE" " PyUnicode_GetLength" \
-        --replace " PyUnicode_GetSize" " PyUnicode_GetLength"
-    ''
-    # Fix CINTSYSDIR for "build" version of rootcint
-    # This is probably a bug that breaks out-of-source builds
-    + ''
-      substituteInPlace cint/cint/src/loadfile.cxx\
-        --replace 'env = "cint";' 'env = "'`pwd`'/cint";'
-    ''
-    + lib.optionalString noSplash ''
-      substituteInPlace rootx/src/rootx.cxx --replace "gNoLogo = false" "gNoLogo = true"
-    '';
-
-  cmakeFlags =
-    [
-      "-Drpath=ON"
-      "-DCMAKE_INSTALL_LIBDIR=lib"
-      "-DCMAKE_INSTALL_INCLUDEDIR=include"
-      "-DCMAKE_CXX_FLAGS=-std=c++11"
-      "-Dalien=OFF"
-      "-Dbonjour=OFF"
-      "-Dcastor=OFF"
-      "-Dchirp=OFF"
-      "-Ddavix=OFF"
-      "-Ddcache=OFF"
-      "-Dfftw3=OFF"
-      "-Dfitsio=OFF"
-      "-Dfortran=OFF"
-      "-Dgfal=OFF"
-      "-Dgsl_shared=ON"
-      "-Dgviz=OFF"
-      "-Dhdfs=OFF"
-      "-Dkrb5=OFF"
-      "-Dldap=OFF"
-      "-Dmathmore=ON"
-      "-Dmonalisa=OFF"
-      "-Dmysql=OFF"
-      "-Dodbc=OFF"
-      "-Dopengl=ON"
-      "-Doracle=OFF"
-      "-Dpgsql=OFF"
-      "-Dpythia6=OFF"
-      "-Dpythia8=OFF"
-      "-Drfio=OFF"
-      "-Dsqlite=OFF"
-      "-Dssl=OFF"
-      "-Dxml=ON"
-      "-Dxrootd=OFF"
-    ]
-    ++ lib.optional (
-      (!stdenv.hostPlatform.isDarwin) && (stdenv.cc.libc != null)
-    ) "-DC_INCLUDE_DIRS=${lib.getDev stdenv.cc.libc}/include";
-
-  env.NIX_CFLAGS_COMPILE = "-fpermissive";
-
-  setupHook = ./setup-hook.sh;
-
-  meta = with lib; {
-    homepage = "https://root.cern.ch/";
-    description = "Data analysis framework";
-    platforms = platforms.unix;
-    broken = !stdenv.hostPlatform.isx86_64 || stdenv.cc.isClang or false;
-    maintainers = with maintainers; [ veprbl ];
-    license = licenses.lgpl21;
-  };
-}
--- a/pkgs/by-name/ro/root5/purify_include_paths_root5.patch
+++ b/pkgs/by-name/ro/root5/purify_include_paths_root5.patch
@@ -1,204 +0,0 @@
-diff --git a/cint/cint/src/loadfile.cxx b/cint/cint/src/loadfile.cxx
--- a/cint/cint/src/loadfile.cxx
-+++ b/cint/cint/src/loadfile.cxx
-@@ -1365,92 +1365,6 @@ int G__statfilename(const char *filenamein, struct stat *statBuf,
-          }
-       }         
- #endif /* G__EDU_VERSION */
-      
-#ifdef G__VISUAL
-      /**********************************************
-       * try /msdev/include
-       **********************************************/
-      if('\0'!=G__cintsysdir[0]) {
-         workname.Format("/msdev/include/%s%s",filename(),addpost[i2]);
-         res = stat( workname, statBuf );         
-         if (res==0) {
-            if (fullPath) fullPath->Swap(workname);
-            return res;
-         }
-      }
-#endif /* G__VISUAL */
-         
-#ifdef G__SYMANTEC
-      /**********************************************
-       * try /sc/include
-       **********************************************/
-      if('\0'!=G__cintsysdir[0]) {
-         workname.Format("/sc/include/%s%s",filename(),addpost[i2]);
-         res = stat( workname, statBuf );         
-         if (res==0) {
-            if (fullPath) fullPath->Swap(workname);
-            return res;
-         }
-      }
-#endif // G__SYMANTEC
-         
-#ifndef G__WIN32
-      /**********************************************
-       * try /usr/include/filename
-       **********************************************/
-      if('\0'!=G__cintsysdir[0]) {
-         workname.Format("/usr/include/%s%s",filename(),addpost[i2]);
-         res = stat( workname, statBuf );         
-         if (res==0) {
-            if (fullPath) fullPath->Swap(workname);
-            return res;
-         }
-      }
-#endif
-      
-#ifdef __GNUC__
-      /**********************************************
-       * try /usr/include/g++/filename
-       **********************************************/
-      if('\0'!=G__cintsysdir[0]) {
-         workname.Format("/usr/include/g++/%s%s",filename(),addpost[i2]);
-         res = stat( workname, statBuf );         
-         if (res==0) {
-            if (fullPath) fullPath->Swap(workname);
-            return res;
-         }
-      }
-#endif /* __GNUC__ */
-      
-#ifndef G__WIN32
-      /* #ifdef __hpux */
-      /**********************************************
-       * try /usr/include/CC/filename
-       **********************************************/
-      if('\0'!=G__cintsysdir[0]) {
-         workname.Format("/usr/include/CC/%s%s",filename(),addpost[i2]);
-         res = stat( workname, statBuf );         
-         if (res==0) {
-            if (fullPath) fullPath->Swap(workname);
-            return res;
-         }
-      }         
-#endif
-         
-#ifndef G__WIN32
-      /**********************************************
-       * try /usr/include/codelibs/filename
-       **********************************************/
-      if('\0'!=G__cintsysdir[0]) {
-         workname.Format("/usr/include/codelibs/%s%s"
-                         ,filename(),addpost[i2]);
-         res = stat( workname, statBuf );         
-         if (res==0) {
-            if (fullPath) fullPath->Swap(workname);
-            return res;
-         }
-      }
-#endif
-    }
-    return -1;
- }
-@@ -1960,107 +1874,6 @@ int G__loadfile(const char *filenamein)
-       }
-       if(G__ifile.fp) break;
- #endif /* G__EDU_VERSION */
-
-#ifdef G__VISUAL
-      /**********************************************
-       * try /msdev/include
-       **********************************************/
-      if('\0'!=G__cintsysdir[0]) {
-         G__snprintf(G__ifile.name,G__MAXFILENAME,"/msdev/include/%s%s",filename(),addpost[i2]);
-#ifndef G__WIN32
-        G__ifile.fp = fopen(G__ifile.name,"r");
-#else
-        G__ifile.fp = fopen(G__ifile.name,"rb");
-#endif
-        G__globalcomp=G__store_globalcomp;
-      }
-      if(G__ifile.fp) break;
-#endif /* G__VISUAL */
-
-#ifdef G__SYMANTEC
-      /**********************************************
-       * try /sc/include
-       **********************************************/
-      if('\0'!=G__cintsysdir[0]) {
-         G__snprintf(G__ifile.name,G__MAXFILENAME,"/sc/include/%s%s",filename(),addpost[i2]);
-#ifndef G__WIN32
-        G__ifile.fp = fopen(G__ifile.name,"r");
-#else
-        G__ifile.fp = fopen(G__ifile.name,"rb");
-#endif
-        G__globalcomp=G__store_globalcomp;
-      }
-      if(G__ifile.fp) break;
-#endif /* G__SYMANTEC */
-
-#ifndef G__WIN32
-      /**********************************************
-       * try /usr/include/filename
-       **********************************************/
-      if('\0'!=G__cintsysdir[0]) {
-         G__snprintf(G__ifile.name,G__MAXFILENAME,"/usr/include/%s%s",filename(),addpost[i2]);
-#ifndef G__WIN32
-        G__ifile.fp = fopen(G__ifile.name,"r");
-#else
-        G__ifile.fp = fopen(G__ifile.name,"rb");
-#endif
-        G__globalcomp=G__store_globalcomp;
-      }
-      if(G__ifile.fp) break;
-#endif
-
-#ifdef __GNUC__
-      /**********************************************
-       * try /usr/include/g++/filename
-       **********************************************/
-      if('\0'!=G__cintsysdir[0]) {
-         G__snprintf(G__ifile.name,G__MAXFILENAME,"/usr/include/g++/%s%s",filename(),addpost[i2]);
-#ifndef G__WIN32
-        G__ifile.fp = fopen(G__ifile.name,"r");
-#else
-        G__ifile.fp = fopen(G__ifile.name,"rb");
-#endif
-        G__globalcomp=G__store_globalcomp;
-      }
-      if(G__ifile.fp) break;
-#endif /* __GNUC__ */
-
-#ifndef G__WIN32
-/* #ifdef __hpux */
-      /**********************************************
-       * try /usr/include/CC/filename
-       **********************************************/
-      if('\0'!=G__cintsysdir[0]) {
-         G__snprintf(G__ifile.name,G__MAXFILENAME,"/usr/include/CC/%s%s",filename(),addpost[i2]);
-#ifndef G__WIN32
-        G__ifile.fp = fopen(G__ifile.name,"r");
-#else
-        G__ifile.fp = fopen(G__ifile.name,"rb");
-#endif
-        G__globalcomp=G__store_globalcomp;
-      }
-      if(G__ifile.fp) break;
-/* #endif __hpux */
-#endif
-
-#ifndef G__WIN32
-/* #ifdef __hpux */
-      /**********************************************
-       * try /usr/include/codelibs/filename
-       **********************************************/
-      if('\0'!=G__cintsysdir[0]) {
-        G__snprintf(G__ifile.name,G__MAXFILENAME,"/usr/include/codelibs/%s%s"
-                    ,filename(),addpost[i2]);
-#ifndef G__WIN32
-        G__ifile.fp = fopen(G__ifile.name,"r");
-#else
-        G__ifile.fp = fopen(G__ifile.name,"rb");
-#endif
-        G__globalcomp=G__store_globalcomp;
-      }
-      if(G__ifile.fp) break;
-/* #endif __hpux */
-#endif
-     }
-   }
- 
--- a/pkgs/by-name/ro/root5/python313-PyCFunction_Call.patch
+++ b/pkgs/by-name/ro/root5/python313-PyCFunction_Call.patch
@@ -1,14 +0,0 @@
--- a/bindings/pyroot/src/TCustomPyTypes.cxx
-+++ b/bindings/pyroot/src/TCustomPyTypes.cxx
-@@ -240,7 +240,11 @@
- // the function is globally shared, so set and reset its "self" (ok, b/c of GIL)
-    Py_INCREF( self );
-    func->m_self = self;
-+#if PY_VERSION_HEX >= 0x03090000
-+   PyObject* result = PyObject_Call( (PyObject*)func, args, kw );
-+#else
-    PyObject* result = PyCFunction_Call( (PyObject*)func, args, kw );
-+#endif
-    func->m_self = 0;
-    Py_DECREF( self );
-    Py_DECREF( args );
--- a/pkgs/by-name/ro/root5/root5-python311-fix.patch
+++ b/pkgs/by-name/ro/root5/root5-python311-fix.patch
@@ -1,17 +0,0 @@
-diff --git a/bindings/pyroot/src/MethodProxy.cxx b/bindings/pyroot/src/MethodProxy.cxx
--- a/bindings/pyroot/src/MethodProxy.cxx
-+++ b/bindings/pyroot/src/MethodProxy.cxx
-@@ -4,10 +4,10 @@
- // Bindings
- #include "PyROOT.h"
- #include "structmember.h"    // from Python
-#if PY_VERSION_HEX >= 0x02050000
-#include "code.h"            // from Python
-#else
-+#if PY_VERSION_HEX < 0x02050000
- #include "compile.h"         // from Python
-+#elif PY_VERSION_HEX < 0x030b0000
-+#include "code.h"            // from Python
- #endif
- #ifndef CO_NOFREE
- // python2.2 does not have CO_NOFREE defined
--- a/pkgs/by-name/ro/root5/setup-hook.sh
+++ b/pkgs/by-name/ro/root5/setup-hook.sh
@@ -1,19 +0,0 @@
-thisroot () {
-    # Workaround thisroot.sh dependency on man
-    if [ -z "${MANPATH-}" ]; then
-        MANPATH=:
-    fi
-    local oldOpts="-u"
-    shopt -qo nounset || oldOpts="+u"
-    set +u
-    source @out@/bin/thisroot.sh
-    set "$oldOpts"
-}
-
-postHooks+=(thisroot)
-
-addRootIncludePath() {
-    addToSearchPath ROOT_INCLUDE_PATH $1/include
-}
-
-addEnvHooks "$targetOffset" addRootIncludePath
--- a/pkgs/by-name/ro/root5/sw_vers_root5.patch
+++ b/pkgs/by-name/ro/root5/sw_vers_root5.patch
@@ -1,104 +0,0 @@
-diff --git a/build/unix/compiledata.sh b/build/unix/compiledata.sh
--- a/build/unix/compiledata.sh
-+++ b/build/unix/compiledata.sh
-@@ -49,7 +49,7 @@ fi
- 
- if [ "$ARCH" = "macosx" ] || [ "$ARCH" = "macosx64" ] || \
-    [ "$ARCH" = "macosxicc" ]; then
-   macosx_minor=`sw_vers | sed -n 's/ProductVersion://p' | cut -d . -f 2`
-+   macosx_minor=7
-    SOEXT="so"
-    if [ $macosx_minor -ge 5 ]; then
-       if [ "x`echo $SOFLAGS | grep -- '-install_name'`" != "x" ]; then
-diff --git a/cmake/modules/SetUpMacOS.cmake b/cmake/modules/SetUpMacOS.cmake
--- a/cmake/modules/SetUpMacOS.cmake
-+++ b/cmake/modules/SetUpMacOS.cmake
-@@ -12,25 +12,11 @@ set(CMAKE_PREFIX_PATH ${CMAKE_PREFIX_PATH} /usr/X11R6)
- #---------------------------------------------------------------------------------------------------------
- 
- if (CMAKE_SYSTEM_NAME MATCHES Darwin)
-  EXECUTE_PROCESS(COMMAND sw_vers "-productVersion"
-                  COMMAND cut -d . -f 1-2
-                  OUTPUT_VARIABLE MACOSX_VERSION OUTPUT_STRIP_TRAILING_WHITESPACE)
-  MESSAGE(STATUS "Found a Mac OS X System ${MACOSX_VERSION}")
-  EXECUTE_PROCESS(COMMAND sw_vers "-productVersion"
-                  COMMAND cut -d . -f 2
-                  OUTPUT_VARIABLE MACOSX_MINOR OUTPUT_STRIP_TRAILING_WHITESPACE)
-
-  if(MACOSX_VERSION VERSION_GREATER 10.7 AND ${CMAKE_CXX_COMPILER_ID} STREQUAL Clang)
-     set(libcxx ON CACHE BOOL "Build using libc++" FORCE)
-  endif()
- 
-  if(${MACOSX_MINOR} GREATER 4)
-     #TODO: check haveconfig and rpath -> set rpath true
-     #TODO: check Thread, define link command
-     #TODO: more stuff check configure script
-    execute_process(COMMAND /usr/sbin/sysctl machdep.cpu.extfeatures OUTPUT_VARIABLE SYSCTL_OUTPUT)
-    if(${SYSCTL_OUTPUT} MATCHES 64)
-       MESSAGE(STATUS "Found a 64bit system")
-        set(ROOT_ARCHITECTURE macosx64)
-        SET(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS}")
-        SET(CMAKE_SHARED_LIBRARY_CREATE_C_FLAGS "${CMAKE_SHARED_LIBRARY_CREATE_C_FLAGS} -m64")
-@@ -38,28 +24,6 @@ if (CMAKE_SYSTEM_NAME MATCHES Darwin)
-        SET(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -m64")
-        SET(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -m64")
-        SET(CMAKE_FORTRAN_FLAGS "${CMAKE_FORTRAN_FLAGS} -m64")
-    else(${SYSCTL_OUTPUT} MATCHES 64)
-       MESSAGE(STATUS "Found a 32bit system")
-       SET(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -m32")
-       SET(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -m32")
-       SET(CMAKE_FORTRAN_FLAGS "${CMAKE_FORTRAN_FLAGS} -m32")
-    endif(${SYSCTL_OUTPUT} MATCHES 64)
-  endif()
-
-  if(MACOSX_VERSION VERSION_GREATER 10.6)
-    set(MACOSX_SSL_DEPRECATED ON)
-  endif()
-  if(MACOSX_VERSION VERSION_GREATER 10.7)
-    set(MACOSX_ODBC_DEPRECATED ON)
-  endif()
-  if(MACOSX_VERSION VERSION_GREATER 10.8)
-    set(MACOSX_GLU_DEPRECATED ON)
-    set(MACOSX_KRB5_DEPRECATED ON)
-    set(MACOSX_TMPNAM_DEPRECATED ON)
-  endif()
-  if(MACOSX_VERSION VERSION_GREATER 10.9)
-    set(MACOSX_LDAP_DEPRECATED ON)
-  endif()
- 
-   if (CMAKE_COMPILER_IS_GNUCXX)
-      message(STATUS "Found GNU compiler collection")
-@@ -132,7 +96,7 @@ if (CMAKE_SYSTEM_NAME MATCHES Darwin)
-   endif()
- 
-   #---Set Linker flags----------------------------------------------------------------------
-  set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS}  -mmacosx-version-min=${MACOSX_VERSION} -Wl,-rpath,@loader_path/../lib")
-+  set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -Wl,-rpath,@loader_path/../lib")
- 
- 
- else (CMAKE_SYSTEM_NAME MATCHES Darwin)
-diff --git a/config/root-config.in b/config/root-config.in
--- a/config/root-config.in
-+++ b/config/root-config.in
-@@ -391,7 +391,7 @@ macosxicc)
-    ;;
- macosx64)
-    # MacOS X with gcc (GNU cc v4.x) in 64 bit mode
-   macosx_minor=`sw_vers | sed -n 's/ProductVersion://p' | cut -d . -f 2`
-+   macosx_minor=7
-    # cannot find the one linked to libGraf if relocated after built
-    if [ $macosx_minor -le 4 ]; then
-       rootlibs="$rootlibs -lfreetype"
-diff --git a/cint/ROOT/CMakeLists.txt b/cint/ROOT/CMakeLists.txt
--- a/cint/ROOT/CMakeLists.txt
-+++ b/cint/ROOT/CMakeLists.txt
-@@ -232,9 +232,7 @@ foreach(_name ${CINTINCDLLNAMES})
-                        DEPENDS ${HEADER_OUTPUT_PATH}/systypes.h
-                       )
-
-    if(MACOSX_MINOR GREATER 4)
-       set(_ExtraFlag "-D__DARWIN_UNIX03")
-    endif()
-
-     add_custom_command(OUTPUT ${OutFileName}
-                        COMMAND cint_tmp -K -w1 -z${_name} -n${OutFileName} -D__MAKECINT__ -DG__MAKECINT ${_ExtraFlag} -c-2 -Z0 ${InFileName} ${AdditionalHeaderFiles} ${CMAKE_BINARY_DIR}/cint/cint/include/sys/types.h ${CMAKE_SOURCE_DIR}/cint/cint/lib/posix/posix.h
--- a/pkgs/by-name/rs/rsop/package.nix
+++ b/pkgs/by-name/rs/rsop/package.nix
@@ -11,18 +11,18 @@

 rustPlatform.buildRustPackage rec {
  pname = "rsop";
-  version = "0.7.1";
+  version = "0.7.2";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "heiko";
    repo = "rsop";
    rev = "rsop/v${version}";
-    hash = "sha256-8Zp+sdEV+HJfreBuIaB952Go0LBxMzYFl557TWSxxMk=";
+    hash = "sha256-6vP+epxsDid3M7cpfpOY29VWeIbuCB30qtmotPhzShc=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-3/pdOkgd4X9HpJN3LHMCmWchb/qwaNM7pE/dKHxSi5U=";
+  cargoHash = "sha256-BSsqI3zo7eC4zGIsU1xScnjWNwt4iTqs4SWzbOUt7Iw=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/by-name/se/searxng/package.nix
+++ b/pkgs/by-name/se/searxng/package.nix
@@ -7,45 +7,20 @@
 }:
 let
  python = python3.override {
-    packageOverrides = final: prev: {
-      httpx = prev.httpx.overridePythonAttrs (old: rec {
-        version = "0.27.2";
-        src = old.src.override {
-          tag = version;
-          hash = "sha256-N0ztVA/KMui9kKIovmOfNTwwrdvSimmNkSvvC+3gpck=";
-        };
-      });
-
-      httpx-socks = prev.httpx-socks.overridePythonAttrs (old: rec {
-        version = "0.9.2";
-        src = old.src.override {
-          tag = "v${version}";
-          hash = "sha256-PUiciSuDCO4r49st6ye5xPLCyvYMKfZY+yHAkp5j3ZI=";
-        };
-      });
-
-      starlette = prev.starlette.overridePythonAttrs (old: {
-        disabledTests = old.disabledTests or [ ] ++ [
-          # fails in assertion with spacing issue
-          "test_request_body"
-          "test_request_stream"
-          "test_wsgi_post"
-        ];
-      });
-    };
+    packageOverrides = final: prev: { };
  };
 in
 python.pkgs.toPythonModule (
  python.pkgs.buildPythonApplication rec {
    pname = "searxng";
-    version = "0-unstable-2025-07-08";
+    version = "0-unstable-2025-07-16";
    format = "setuptools";

    src = fetchFromGitHub {
      owner = "searxng";
      repo = "searxng";
-      rev = "bd593d0bad2189f57657bbcfa2c5e86f795c680e";
-      hash = "sha256-vNI66OKA8LPXqc2mt8lm4iKS6njRLQhjzcykCQyPJsk=";
+      rev = "62fac1c6a9db94682f8ef686f0424a482663b288";
+      hash = "sha256-3Ma16EdQdqnXyz+ipH5qq9TF0+DwpNU2kq2RTgK5b/A=";
    };

    postPatch = ''
@@ -77,23 +52,24 @@ python.pkgs.toPythonModule (
        babel
        brotli
        certifi
+        cryptography
        fasttext-predict
        flask
        flask-babel
+        httpx
+        httpx-socks
        isodate
        jinja2
        lxml
+        markdown-it-py
        msgspec
        pygments
        python-dateutil
        pyyaml
-        redis
+        setproctitle
        typer
        uvloop
-        setproctitle
-        httpx
-        httpx-socks
-        markdown-it-py
+        valkey
      ]
      ++ httpx.optional-dependencies.http2
      ++ httpx-socks.optional-dependencies.asyncio;
--- a/pkgs/by-name/sh/shanggu-fonts/package.nix
+++ b/pkgs/by-name/sh/shanggu-fonts/package.nix
@@ -5,7 +5,7 @@
  p7zip,
 }:
 let
-  version = "1.021";
+  version = "1.022";

  source =
    with lib.attrsets;
@@ -18,10 +18,10 @@ let
        })
      )
      {
-        Mono = "sha256-3WwknXSMH12Lu/HA/f647AyhDg2O9Eg5ZGDBrFp4SbE=";
-        Round = "sha256-vRL2YQkcp5vDSbLaMDEYd7HJVohZFYKlBfxAdY2l3mA=";
-        Sans = "sha256-x5z6GYsfQ+8a8W0djJTY8iutuLNYvaemIpdYh94krk0=";
-        Serif = "sha256-3WK7vty3zZFNKkwViEsozU3qa+5hymYwXk6ta9AxmNM=";
+        Mono = "sha256-kRUnhNXTcU6DCgM0yDVZTzr+2SooANoSkj5bJ1zK+YI=";
+        Round = "sha256-5VJsgTSOGNW87ybKtu55rn+1wp7aUBBC3IPwZopcb9o=";
+        Sans = "sha256-Bss244+gG00tnWUt6hri3BO11tBMWB3+VUEuWqHqr6Y=";
+        Serif = "sha256-PYuqBGxU/T6dlVpa5gqaxe5BShiaIlVisRGtPamlykE=";
      };

  extraOutputs = builtins.attrNames source;
--- a/pkgs/by-name/sp/spicy-parser-generator/package.nix
+++ b/pkgs/by-name/sp/spicy-parser-generator/package.nix
@@ -12,7 +12,7 @@

 stdenv.mkDerivation rec {
  pname = "spicy";
-  version = "1.13.1";
+  version = "1.13.2";

  strictDeps = true;

@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
    owner = "zeek";
    repo = "spicy";
    rev = "v${version}";
-    hash = "sha256-AbUVt3agmvtapmw6nYPUEhSRzqoaV/DIF6hZjTbz7KQ=";
+    hash = "sha256-+F7P8D70vN85pYyTOSMXgf1yWgPJHPpvP38rOyKTJ/A=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/sq/sqldef/package.nix
+++ b/pkgs/by-name/sq/sqldef/package.nix
@@ -6,18 +6,18 @@

 buildGoModule rec {
  pname = "sqldef";
-  version = "2.0.4";
+  version = "2.0.5";

  src = fetchFromGitHub {
    owner = "sqldef";
    repo = "sqldef";
    rev = "v${version}";
-    hash = "sha256-UTGLq+IbY/H9KdchVQ4cV7JWL9PDnBZJZGsH4syjIyo=";
+    hash = "sha256-+5Ri5MbQJEF3Z3mocO/ugXwZ9ye2IY2YXkdAMLkPupg=";
  };

  proxyVendor = true;

-  vendorHash = "sha256-SkYRt/w8/YC6LGoADVRdyYdQw/Lves1rd4tl8lYNSSs=";
+  vendorHash = "sha256-G6krEo6zutcjVhKF7ZYNulUG/lppSfDF2VMUv3g4JMk=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/st/stunner/package.nix
+++ b/pkgs/by-name/st/stunner/package.nix
@@ -5,7 +5,7 @@
 }:

 let
-  version = "0.0.8";
+  version = "0.0.10";
 in
 buildGoModule {
  pname = "stunner";
@@ -15,10 +15,10 @@ buildGoModule {
    owner = "jaxxstorm";
    repo = "stunner";
    tag = "v${version}";
-    hash = "sha256-jZNM58aP2hBfuAIFjSCwdBkCbDA5KDTlZV8AkoWnhD4=";
+    hash = "sha256-rwoid49YkrXU59XiC6zY6562MShomozQNV0KFPv7oMM=";
  };

-  vendorHash = "sha256-arWRaTqaN6Ji6MjTZdp8J7bs6NjbdY7YkueKMBdAAts=";
+  vendorHash = "sha256-tO61UBZxPBg6oFKOuMjPSb4EHZ9wPAyBsdQZb7DLdw0=";

  ldflags = [
    "-X=main.Version=${version}"
--- a/pkgs/by-name/sw/swiftformat/package.nix
+++ b/pkgs/by-name/sw/swiftformat/package.nix
@@ -12,13 +12,13 @@

 swift.stdenv.mkDerivation rec {
  pname = "swiftformat";
-  version = "0.56.4";
+  version = "0.57.2";

  src = fetchFromGitHub {
    owner = "nicklockwood";
    repo = "SwiftFormat";
    rev = version;
-    sha256 = "sha256-WnBQTpbz9tcnbvmtWpZ9esirWdQKJOpVmH8zk97OuFE=";
+    sha256 = "sha256-KMSRryaSoAX4zi+AhIEHFMX0UVN8ena27SoJF8gAbzY=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/sy/symbolicator/package.nix
+++ b/pkgs/by-name/sy/symbolicator/package.nix
@@ -10,18 +10,18 @@

 rustPlatform.buildRustPackage rec {
  pname = "symbolicator";
-  version = "25.6.2";
+  version = "25.7.0";

  src = fetchFromGitHub {
    owner = "getsentry";
    repo = "symbolicator";
    rev = version;
-    hash = "sha256-So6WApFwgTlhwcQlxBUVlL/JPW1X+ZkJhFxb+0ZMI3o=";
+    hash = "sha256-pLo28qtNDQig85GQh6Swo3XUqsSM5XNBbZM5lj2mAbQ=";
    fetchSubmodules = true;
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-eQJ/V+4uvcg8v+b8DVJHGNbOq9OTCs/E6wU0WBuxsEA=";
+  cargoHash = "sha256-9oRPs3r63JMV0zugdoZLpfe2uToBVIPVMZ78I1+v60o=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/sy/syrics/package.nix
+++ b/pkgs/by-name/sy/syrics/package.nix
@@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "syrics";
-  version = "0.1.2.1";
+  version = "0.1.2.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "akashrchandran";
    repo = "syrics";
    tag = "v${version}";
-    hash = "sha256-qRC376RcheiiRAmxwszXbz5CFkpsN6uREiCwc0/NUQg=";
+    hash = "sha256-Ck7pTUgOdib0WqPnvTU6NHKWhMYsIZBY0rzUtFi0q/A=";
  };

  build-system = [
--- a/pkgs/by-name/ta/taproot-assets/package.nix
+++ b/pkgs/by-name/ta/taproot-assets/package.nix
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "taproot-assets";
-  version = "0.6.0";
+  version = "0.6.1";

  src = fetchFromGitHub {
    owner = "lightninglabs";
    repo = "taproot-assets";
    rev = "v${version}";
-    hash = "sha256-ZLuV52W5WTNp45tnF1mmf+Snjd14604cKpnOjhabuoc=";
+    hash = "sha256-g9YG/qeXM7hmpgvhyTPTOWy37rGG/Tbc5YiuaQFIbJA=";
  };

-  vendorHash = "sha256-9Du4WHLltGqmJXDOs2t5dwK5dbFGxWn0EiEE47czW2M=";
+  vendorHash = "sha256-9d7+y3f+IGDn5wbe9PY58en3cCkWMxCqBBBrRCDDg2U=";

  subPackages = [
    "cmd/tapcli"
--- a/pkgs/by-name/vi/viskores/package.nix
+++ b/pkgs/by-name/vi/viskores/package.nix
@@ -0,0 +1,68 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch2,
+  cmake,
+  ninja,
+  llvmPackages,
+  tbb,
+  mpi,
+  mpiSupport ? true,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "viskores";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "viskores";
+    repo = "viskores";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-jKuDM/NPfbMIfNpDNsDpmXdKuVobsr3s9+iht1zBLvI=";
+  };
+
+  patches = [
+    # https://github.com/Viskores/viskores/pull/137
+    (fetchpatch2 {
+      url = "https://github.com/Viskores/viskores/commit/36bf609511adb5530e6952bc14daefeafdf4ab11.patch?full_index=1";
+      hash = "sha256-SKmgVZhkCk1/X17dLXZ8ceF9Pq1Kkc2sXuFdrvotsdo=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+  ];
+
+  propagatedBuildInputs =
+    [
+      tbb
+    ]
+    ++ lib.optional mpiSupport mpi
+    ++ lib.optional stdenv.cc.isClang llvmPackages.openmp;
+
+  cmakeFlags = [
+    (lib.cmakeBool "Viskores_ENABLE_OPENMP" true)
+    (lib.cmakeBool "Viskores_ENABLE_TBB" true)
+    (lib.cmakeBool "Viskores_ENABLE_MPI" mpiSupport)
+    (lib.cmakeBool "Viskores_USE_DEFAULT_TYPES_FOR_VTK" true)
+    (lib.cmakeFeature "Viskores_INSTALL_INCLUDE_DIR" "include")
+    (lib.cmakeFeature "Viskores_INSTALL_CONFIG_DIR" "lib/cmake/viskores")
+    (lib.cmakeFeature "Viskores_INSTALL_SHARE_DIR" "share/viskores")
+  ];
+
+  passthru.tests.cmake-config = testers.hasCmakeConfigModules {
+    moduleNames = [ "Viskores" ];
+    package = finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Visualization library for many-threaded devices";
+    homepage = "https://github.com/Viskores/viskores";
+    changelog = "https://github.com/Viskores/viskores/releases/tag/${finalAttrs.src.tag}";
+    license = with lib.licenses; [ bsd3 ];
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ qbisi ];
+  };
+})
--- a/pkgs/by-name/vi/vivaldi/package.nix
+++ b/pkgs/by-name/vi/vivaldi/package.nix
@@ -66,7 +66,7 @@

 stdenv.mkDerivation rec {
  pname = "vivaldi";
-  version = "7.5.3735.47";
+  version = "7.5.3735.54";

  suffix =
    {
@@ -79,8 +79,8 @@ stdenv.mkDerivation rec {
    url = "https://downloads.vivaldi.com/stable/vivaldi-stable_${version}-1_${suffix}.deb";
    hash =
      {
-        aarch64-linux = "sha256-zkVGgQNZSu3Th8Se9uvj8OERwDxWG3m6+zz9Hv4TGIc=";
-        x86_64-linux = "sha256-uKHv4OEDZkbiGwEyYBl0/4ni2WmBz9NC/oKmYyiJgJ0=";
+        aarch64-linux = "sha256-wgvqNeRrwPHmv4DNlo69mCJ+/cNOv2ZwvEnijTZke+s=";
+        x86_64-linux = "sha256-Wey4X3GUN1HnJsrEo0E/Zr7ozZiw8DyVYh2jQ67wFM0=";
      }
      .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  };
--- a/pkgs/by-name/xf/xfitter/package.nix
+++ b/pkgs/by-name/xf/xfitter/package.nix
@@ -43,25 +43,21 @@ stdenv.mkDerivation {
    gfortran
    pkg-config
  ];
-  buildInputs =
-    [
-      apfel
-      blas
-      ceres-solver
-      lhapdf
-      lapack
-      libyaml
-      root
-      qcdnum
-      gsl
-      yaml-cpp
-      zlib
-    ]
-    ++ lib.optionals ("5" == lib.versions.major root.version) [
-      apfelgrid
-      applgrid
-    ]
-    ++ lib.optional (stdenv.hostPlatform.libc == "glibc") libtirpc;
+  buildInputs = [
+    apfel
+    apfelgrid
+    applgrid
+    blas
+    ceres-solver
+    lhapdf
+    lapack
+    libyaml
+    root
+    qcdnum
+    gsl
+    yaml-cpp
+    zlib
+  ] ++ lib.optional (stdenv.hostPlatform.libc == "glibc") libtirpc;

  env.NIX_CFLAGS_COMPILE = lib.optionalString (
    stdenv.hostPlatform.libc == "glibc"
--- a/pkgs/development/cuda-modules/cuda/extension.nix
+++ b/pkgs/development/cuda-modules/cuda/extension.nix
@@ -20,6 +20,7 @@ let
    "12.5" = "12.5.1";
    "12.6" = "12.6.3";
    "12.8" = "12.8.1";
+    "12.9" = "12.9.1";
  };

  # Check if the current CUDA version is supported.
--- a/pkgs/development/cuda-modules/cuda/manifests/feature_12.9.1.json
+++ b/pkgs/development/cuda-modules/cuda/manifests/feature_12.9.1.json
--- a/pkgs/development/cuda-modules/cuda/manifests/redistrib_12.9.1.json
+++ b/pkgs/development/cuda-modules/cuda/manifests/redistrib_12.9.1.json
--- a/pkgs/development/cuda-modules/cudatoolkit/default.nix
+++ b/pkgs/development/cuda-modules/cudatoolkit/default.nix
@@ -19,6 +19,7 @@
  libxcrypt-legacy,
  libxkbcommon,
  libkrb5,
+  libxml2,
  krb5,
  makeWrapper,
  markForCudatoolkitRootHook,
@@ -31,6 +32,7 @@
  python3, # FIXME: CUDAToolkit 10 may still need python27
  python310,
  python311,
+  python312,
  pulseaudio,
  setupCudaHook,
  stdenv,
@@ -156,6 +158,17 @@ backendStdenv.mkDerivation rec {
      ncurses6
      python310
      python311
+    ]
+    ++ lib.optionals (lib.versionAtLeast version "12.9") [
+      # Replace once https://github.com/NixOS/nixpkgs/pull/421740 is merged.
+      (libxml2.overrideAttrs rec {
+        version = "2.13.8";
+        src = fetchurl {
+          url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
+          hash = "sha256-J3KUyzMRmrcbK8gfL0Rem8lDW4k60VuyzSsOhZoO6Eo=";
+        };
+      })
+      python312
    ];

  # Prepended to runpaths by autoPatchelf.
@@ -178,6 +191,9 @@ backendStdenv.mkDerivation rec {
    # than pinned in runpath
    "libcuda.so.1"

+    # Similar to libcuda.so.1, this is part of the driver package.
+    "libnvidia-ml.so.1"
+
    # The krb5 expression ships libcom_err.so.3 but cudatoolkit asks for the
    # older
    # This dependency is asked for by target-linux-x64/CollectX/RedHat/x86_64/libssl.so.10
@@ -292,14 +308,22 @@ backendStdenv.mkDerivation rec {
        wrapProgram $out/bin/nvprof \
          --prefix LD_LIBRARY_PATH : $out/lib
      ''
-    # 11.8 includes a broken symlink, include/include, pointing to targets/x86_64-linux/include
-    + lib.optionalString (lib.versions.majorMinor version == "11.8") ''
-      rm $out/include/include
+    # 11.8 and 12.9 include a broken symlink, include/include, pointing to targets/x86_64-linux/include
+    +
+      lib.optionalString
+        (lib.versions.majorMinor version == "11.8" || lib.versions.majorMinor version == "12.9")
+        ''
+          rm $out/include/include
+        ''
+    # 12.9 has another broken symlink, lib64/lib64, pointing to lib/targets/x86_64-linux/lib
+    + lib.optionalString (lib.versions.majorMinor version == "12.9") ''
+      rm $out/lib64/lib64
    ''
-    # Python 3.8 is not in nixpkgs anymore, delete Python 3.8 cuda-gdb support
-    # to avoid autopatchelf failing to find libpython3.8.so.
+    # Python 3.8 and 3.9 are not in nixpkgs anymore, delete Python 3.{8,9} cuda-gdb support
+    # to avoid autopatchelf failing to find libpython3.{8,9}.so.
    + lib.optionalString (lib.versionAtLeast version "12.6") ''
      find $out -name '*python3.8*' -delete
+      find $out -name '*python3.9*' -delete
    ''
    + ''
      runHook postInstall
--- a/pkgs/development/cuda-modules/cudatoolkit/releases.nix
+++ b/pkgs/development/cuda-modules/cudatoolkit/releases.nix
@@ -111,4 +111,10 @@
    url = "https://developer.download.nvidia.com/compute/cuda/12.8.1/local_installers/cuda_12.8.1_570.124.06_linux.run";
    sha256 = "sha256-Io9ryvW3YY0DKTn0MZFPyS0OXtOevjcJiiRQLyahl5c=";
  };
+
+  "12.9" = {
+    version = "12.9.1";
+    url = "https://developer.download.nvidia.com/compute/cuda/12.9.1/local_installers/cuda_12.9.1_575.57.08_linux.run";
+    sha256 = "sha256-D22Abd2HIw0q2+imAGqdIBRP29qd4tasxnfapdA2QXo=";
+  };
 }
--- a/pkgs/development/cuda-modules/cudnn/releases.nix
+++ b/pkgs/development/cuda-modules/cudnn/releases.nix
@@ -138,6 +138,14 @@
        url = "https://developer.download.nvidia.com/compute/cudnn/redist/cudnn/linux-sbsa/cudnn-linux-sbsa-9.8.0.87_cuda11-archive.tar.xz";
        hash = "sha256-j/EXcV+zMjAy0bSJiAEXVWrYteV6kGAUPwy3I4TbdxA=";
      }
+      {
+        version = "9.11.0.98";
+        minCudaVersion = "12.0";
+        maxCudaVersion = "12.9";
+        url = "https://developer.download.nvidia.com/compute/cudnn/redist/cudnn/linux-sbsa/cudnn-linux-sbsa-9.11.0.98_cuda12-archive.tar.xz";
+        hash = "sha256-X81kUdiKnTt/rLwASB+l4rsV8sptxvhuCysgG8QuzVY=";
+      }
+
    ];
    # x86_64
    linux-x86_64 = [
@@ -274,6 +282,13 @@
        url = "https://developer.download.nvidia.com/compute/cudnn/redist/cudnn/linux-x86_64/cudnn-linux-x86_64-9.8.0.87_cuda11-archive.tar.xz";
        hash = "sha256-z03674MR2YfWQKMi9mjNUkCsPlMCq+lhfdmRtbJTJ1g=";
      }
+      {
+        version = "9.11.0.98";
+        minCudaVersion = "12.0";
+        maxCudaVersion = "12.9";
+        url = "https://developer.download.nvidia.com/compute/cudnn/redist/cudnn/linux-x86_64/cudnn-linux-x86_64-9.11.0.98_cuda12-archive.tar.xz";
+        hash = "sha256-tgyPrQH6FSHS5x7TiIe5BHjX8Hs9pJ/WirEYqf7k2kg=";
+      }
    ];
  };
 }
--- a/pkgs/development/libraries/c-blosc/2.nix
+++ b/pkgs/development/libraries/c-blosc/2.nix
@@ -14,13 +14,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "c-blosc2";
-  version = "2.19.0";
+  version = "2.19.1";

  src = fetchFromGitHub {
    owner = "Blosc";
    repo = "c-blosc2";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-KfuZKeWri1REV8gxtyoM/ksUcfrDnz/UrIbm2gb7EcE=";
+    sha256 = "sha256-t+zh89VFVnqYzxqZh13hS6iieSqbG+DTPzI4aXwY8os=";
  };

  # https://github.com/NixOS/nixpkgs/issues/144170
--- a/pkgs/development/libraries/gdcm/default.nix
+++ b/pkgs/development/libraries/gdcm/default.nix
@@ -32,6 +32,9 @@ stdenv.mkDerivation rec {
  patches =
    [
      ./add-missing-losslylosslessarray-in-TestTransferSyntax.patch
+      # Fix vtk deprecated api, See https://docs.vtk.org/en/latest/release_details/9.3.html#id13.
+      # Upstream mailing list: https://sourceforge.net/p/gdcm/mailman/message/59197515.
+      ./fix-vtk-deprecated-api.patch
    ]
    ++ lib.optionals (lib.versionOlder vtk.version "9.3") [
      (fetchpatch2 {
--- a/pkgs/development/libraries/gdcm/fix-vtk-deprecated-api.patch
+++ b/pkgs/development/libraries/gdcm/fix-vtk-deprecated-api.patch
@@ -0,0 +1,184 @@
+diff --git a/Utilities/VTK/Applications/gdcm2vtk.cxx b/Utilities/VTK/Applications/gdcm2vtk.cxx
+index 344aec0df..c1cd4b43d 100644
+--- a/Utilities/VTK/Applications/gdcm2vtk.cxx
+++ b/Utilities/VTK/Applications/gdcm2vtk.cxx
+@@ -498,7 +498,7 @@ int main(int argc, char *argv[])
+     {
+     imgreader->SetFileLowerLeft( lowerleft );
+     if( names->GetNumberOfValues() == 1 )
+-      imgreader->SetFileName( names->GetValue(0) );
+      imgreader->SetFileName( names->GetValue(0).c_str() );
+     else
+       imgreader->SetFileNames(names);
+     imgreader->Update();
+diff --git a/Utilities/VTK/Applications/gdcmviewer.cxx b/Utilities/VTK/Applications/gdcmviewer.cxx
+index 3ed4778f8..58236a6a5 100644
+--- a/Utilities/VTK/Applications/gdcmviewer.cxx
+++ b/Utilities/VTK/Applications/gdcmviewer.cxx
+@@ -321,7 +321,7 @@ void ExecuteViewer(TViewer *viewer, vtkStringArray *filenames)
+   vtkGDCMImageReader *reader = vtkGDCMImageReader::New();
+   if( filenames->GetSize() == 1 ) // Backward compatible...
+     {
+-    reader->SetFileName( filenames->GetValue(0) );
+    reader->SetFileName( filenames->GetValue(0).c_str() );
+     }
+   else
+     {
+diff --git a/Utilities/VTK/Testing/Cxx/TestvtkGDCMImageWriter2.cxx b/Utilities/VTK/Testing/Cxx/TestvtkGDCMImageWriter2.cxx
+index fa1d7d895..00d9f3845 100644
+--- a/Utilities/VTK/Testing/Cxx/TestvtkGDCMImageWriter2.cxx
+++ b/Utilities/VTK/Testing/Cxx/TestvtkGDCMImageWriter2.cxx
+@@ -113,7 +113,7 @@ int TestvtkGDCMImageWrite2(const char *filename, bool verbose = false)
+     // Need to check we can still read those files back:
+     for(int file=0; file<filenames->GetNumberOfValues(); ++file)
+       {
+-      const char *fname = filenames->GetValue(file);
+      const char *fname = filenames->GetValue(file).c_str();
+       gdcm::ImageReader r;
+       //r.SetFileName( gdcmfile.c_str() );
+       r.SetFileName( fname );
+diff --git a/Utilities/VTK/Testing/Cxx/TestvtkGDCMThreadedImageReader.cxx b/Utilities/VTK/Testing/Cxx/TestvtkGDCMThreadedImageReader.cxx
+index 8b253ec83..1c83ed417 100644
+--- a/Utilities/VTK/Testing/Cxx/TestvtkGDCMThreadedImageReader.cxx
+++ b/Utilities/VTK/Testing/Cxx/TestvtkGDCMThreadedImageReader.cxx
+@@ -170,7 +170,7 @@ int TestvtkGDCMThreadedImageRead(const char *filename, bool verbose = false)
+     assert( sarray->GetNumberOfValues() == (int)nfiles );
+     reader->SetFileNames( sarray );
+     sarray->Delete();
+-    refimage = sarray->GetValue( 0 ); // Ok since sarray is ref count
+    refimage = sarray->GetValue( 0 ).c_str(); // Ok since sarray is ref count
+     }
+   else
+     {
+diff --git a/Utilities/VTK/Testing/Cxx/TestvtkGDCMThreadedImageReader2.cxx b/Utilities/VTK/Testing/Cxx/TestvtkGDCMThreadedImageReader2.cxx
+index 5151893e8..22dd4fd57 100644
+--- a/Utilities/VTK/Testing/Cxx/TestvtkGDCMThreadedImageReader2.cxx
+++ b/Utilities/VTK/Testing/Cxx/TestvtkGDCMThreadedImageReader2.cxx
+@@ -160,7 +160,7 @@ int TestvtkGDCMThreadedImageRead2(const char *filename, bool verbose = false)
+     assert( sarray->GetNumberOfValues() == (int)nfiles );
+     reader->SetFileNames( sarray );
+     sarray->Delete();
+-    refimage = sarray->GetValue( 0 ); // Ok since sarray is ref count
+    refimage = sarray->GetValue( 0 ).c_str(); // Ok since sarray is ref count
+     }
+   else
+     {
+diff --git a/Utilities/VTK/vtkGDCMImageReader.cxx b/Utilities/VTK/vtkGDCMImageReader.cxx
+index c62034300..463c3879b 100644
+--- a/Utilities/VTK/vtkGDCMImageReader.cxx
+++ b/Utilities/VTK/vtkGDCMImageReader.cxx
+@@ -608,7 +608,7 @@ ComputePixelTypeFromFiles(const char *inputfilename, vtkStringArray *filenames,
+     // FIXME a gdcm::Scanner would be much faster here:
+     for(int i = 0; i < filenames->GetNumberOfValues(); ++i )
+       {
+-      const char *filename = filenames->GetValue( i );
+      const char *filename = filenames->GetValue( i ).c_str();
+       gdcm::ImageReader reader;
+       reader.SetFileName( filename );
+       if( !reader.Read() )
+@@ -703,7 +703,7 @@ int vtkGDCMImageReader::RequestInformationCompat()
+     }
+   else if ( this->FileNames && this->FileNames->GetNumberOfValues() > 0 )
+     {
+-    filename = this->FileNames->GetValue( 0 );
+    filename = this->FileNames->GetValue( 0 ).c_str();
+     }
+   else
+     {
+@@ -1459,7 +1459,7 @@ int vtkGDCMImageReader::RequestDataCompat()
+     for(int j = dext[4]; !this->AbortExecute && j <= dext[5]; ++j)
+       {
+       assert( j >= 0 && j <= this->FileNames->GetNumberOfValues() );
+-      const char *filename = this->FileNames->GetValue( j );
+      const char *filename = this->FileNames->GetValue( j ).c_str();
+       int load = this->LoadSingleFile( filename, pointer, len );
+       if( !load )
+         {
+diff --git a/Utilities/VTK/vtkGDCMImageReader2.cxx b/Utilities/VTK/vtkGDCMImageReader2.cxx
+index 266c1270a..4976f0190 100644
+--- a/Utilities/VTK/vtkGDCMImageReader2.cxx
+++ b/Utilities/VTK/vtkGDCMImageReader2.cxx
+@@ -388,7 +388,7 @@ ComputePixelTypeFromFiles(const char *inputfilename, vtkStringArray *filenames,
+     // FIXME a gdcm::Scanner would be much faster here:
+     for(int i = 0; i < filenames->GetNumberOfValues(); ++i )
+       {
+-      const char *filename = filenames->GetValue( i );
+      const char *filename = filenames->GetValue( i ).c_str();
+       gdcm::ImageReader reader;
+       reader.SetFileName( filename );
+       if( !reader.Read() )
+@@ -480,7 +480,7 @@ int vtkGDCMImageReader2::RequestInformationCompat()
+     }
+   else if ( this->FileNames && this->FileNames->GetNumberOfValues() > 0 )
+     {
+-    filename = this->FileNames->GetValue( 0 );
+    filename = this->FileNames->GetValue( 0 ).c_str();
+     }
+   else
+     {
+@@ -1177,7 +1177,7 @@ int vtkGDCMImageReader2::RequestDataCompat()
+     for(int j = outExt[4]; !this->AbortExecute && j <= outExt[5]; ++j)
+       {
+       assert( j >= 0 && j <= this->FileNames->GetNumberOfValues() );
+-      const char *filename = this->FileNames->GetValue( j );
+      const char *filename = this->FileNames->GetValue( j ).c_str();
+       int load = this->LoadSingleFile( filename, pointer, len );
+       vtkDebugMacro( "LoadSingleFile: " << filename );
+       if( !load )
+diff --git a/Utilities/VTK/vtkGDCMImageWriter.cxx b/Utilities/VTK/vtkGDCMImageWriter.cxx
+index 37e1245a5..e723d15b7 100644
+--- a/Utilities/VTK/vtkGDCMImageWriter.cxx
+++ b/Utilities/VTK/vtkGDCMImageWriter.cxx
+@@ -255,7 +255,7 @@ int vtkGDCMImageWriter::RequestData(
+ {
+   if( this->FileNames->GetNumberOfValues() )
+     {
+-    const char *filename = this->FileNames->GetValue(0);
+    const char *filename = this->FileNames->GetValue(0).c_str();
+     return const_cast<char*>(filename);
+     }
+   return this->Superclass::GetFileName();
+@@ -1148,7 +1148,7 @@ int vtkGDCMImageWriter::WriteGDCMData(vtkImageData *data, int timeStep)
+   if( this->FileNames->GetNumberOfValues() )
+     {
+     //int n = this->FileNames->GetNumberOfValues();
+-    filename = this->FileNames->GetValue(k);
+    filename = this->FileNames->GetValue(k).c_str();
+     }
+   else
+     {
+diff --git a/Utilities/VTK/vtkGDCMThreadedImageReader.cxx b/Utilities/VTK/vtkGDCMThreadedImageReader.cxx
+index d50a3fee2..c531b8854 100644
+--- a/Utilities/VTK/vtkGDCMThreadedImageReader.cxx
+++ b/Utilities/VTK/vtkGDCMThreadedImageReader.cxx
+@@ -592,7 +592,7 @@ void vtkGDCMThreadedImageReader::RequestDataCompat()
+     const char **filenames = new const char* [ nfiles ];
+     for(unsigned int i = 0; i < nfiles; ++i)
+       {
+-      filenames[i] = this->FileNames->GetValue( i );
+      filenames[i] = this->FileNames->GetValue( i ).c_str();
+       //std::cerr << filenames[i] << std::endl;
+       }
+     ReadFiles((unsigned int)nfiles, filenames);
+diff --git a/Utilities/VTK/vtkGDCMThreadedImageReader2.cxx b/Utilities/VTK/vtkGDCMThreadedImageReader2.cxx
+index 2e6a2e932..72ce6453c 100644
+--- a/Utilities/VTK/vtkGDCMThreadedImageReader2.cxx
+++ b/Utilities/VTK/vtkGDCMThreadedImageReader2.cxx
+@@ -71,7 +71,7 @@ vtkGDCMThreadedImageReader2::~vtkGDCMThreadedImageReader2()
+ //----------------------------------------------------------------------------
+ const char *vtkGDCMThreadedImageReader2::GetFileName(int i)
+ {
+-  return this->FileNames->GetValue( i );
+  return this->FileNames->GetValue( i ).c_str();
+ }
+ 
+ //----------------------------------------------------------------------------
+@@ -106,7 +106,7 @@ void vtkGDCMThreadedImageReader2Execute(vtkGDCMThreadedImageReader2 *self,
+   for( int i = outExt[4]; i <= outExt[5] && i < maxfiles; ++i )
+     {
+     assert( i < maxfiles );
+-    const char *filename = self->GetFileNames()->GetValue( i );
+    const char *filename = self->GetFileNames()->GetValue( i ).c_str();
+     //ReadOneFile( filename );
+     //outData->GetPointData()->GetScalars()->SetName("GDCMImage");
+ 
--- a/pkgs/development/python-modules/coqpit/default.nix
+++ b/pkgs/development/python-modules/coqpit/default.nix
@@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "coqpit-config";
-  version = "0.2.0";
+  version = "0.2.1";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "idiap";
    repo = "coqui-ai-coqpit";
    tag = "v${version}";
-    hash = "sha256-iitAq+sOPFQqKiwwnPnWheZ+0+OLznu3G9Ncf18s4VQ=";
+    hash = "sha256-puTqaYK1j1SGqGQQsrEH9lbpcF0FzcQ8v2siUQVyHsE=";
  };

  nativeCheckInputs = [ pytestCheckHook ];
--- a/pkgs/development/python-modules/django-allauth/default.nix
+++ b/pkgs/development/python-modules/django-allauth/default.nix
@@ -17,6 +17,7 @@

  # optional-dependencies
  fido2,
+  oauthlib,
  python3-openid,
  python3-saml,
  requests,
@@ -67,6 +68,10 @@ buildPythonPackage rec {
  '';

  optional-dependencies = {
+    idp-oidc = [
+      oauthlib
+      pyjwt
+    ] ++ pyjwt.optional-dependencies.crypto;
    mfa = [
      fido2
      qrcode
--- a/pkgs/development/python-modules/generic/default.nix
+++ b/pkgs/development/python-modules/generic/default.nix
@@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "generic";
-  version = "1.1.4";
+  version = "1.1.5";
  pyproject = true;

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-3QcFbbWgCJcL37MwiK1Sv7LG6N60zsw93CupD4Xzp/w=";
+    hash = "sha256-Dvpiw6DRQczT5Tcj81II1cdZAIPbcWTIENLP/QQprpI=";
  };

  build-system = [ poetry-core ];
--- a/pkgs/development/python-modules/gvm-tools/default.nix
+++ b/pkgs/development/python-modules/gvm-tools/default.nix
@@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "gvm-tools";
-  version = "25.3.0";
+  version = "25.3.1";
  pyproject = true;

  disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "greenbone";
    repo = "gvm-tools";
    tag = "v${version}";
-    hash = "sha256-DDs08VnyUB32n3JuVNmt9uMTssmbHOb351pla4zdE54=";
+    hash = "sha256-luvxcsTxhOEi0Tz5Hc2QZgFjBa7j1PUG+cw8kuDch7Y=";
  };

  __darwinAllowLocalNetworking = true;
--- a/pkgs/development/python-modules/hcloud/default.nix
+++ b/pkgs/development/python-modules/hcloud/default.nix
@@ -10,12 +10,12 @@

 buildPythonPackage rec {
  pname = "hcloud";
-  version = "2.5.3";
+  version = "2.5.4";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-+9unvxFjf/ryqN6g4IKWX1viwgSfkgrX1prjXvBnbWs=";
+    hash = "sha256-JTLg2LbiD7WpCvX4026wA5oZfCCU0dVvx/zniaMAAl4=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/jianpu-ly/default.nix
+++ b/pkgs/development/python-modules/jianpu-ly/default.nix
@@ -8,13 +8,13 @@

 buildPythonPackage rec {
  pname = "jianpu-ly";
-  version = "1.858";
+  version = "1.859";
  pyproject = true;

  src = fetchPypi {
    inherit version;
    pname = "jianpu_ly";
-    hash = "sha256-IzFNCBJBDMJrqDxrH8OtHQCbh0O3z9P7OYHSpF39Xao=";
+    hash = "sha256-+DMaFEf8LfXMujmq1eKQO2/8L1lqQ2Idc5UuN7saIP4=";
  };

  dependencies = [ lilypond ];
--- a/pkgs/development/python-modules/json-logging/default.nix
+++ b/pkgs/development/python-modules/json-logging/default.nix
@@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "json-logging";
-  version = "1.5.0-rc0";
+  version = "1.5.1";
  pyproject = true;

  disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "bobbui";
    repo = "json-logging-python";
    tag = version;
-    hash = "sha256-WOAEY1pONH+Gx1b8zHZDMNgJJSn7jvMO60LYTA8z/dE=";
+    hash = "sha256-r2ttPFvlN+hqMxBLPkr5hOz0UKNX4NRoXmLMXhTZ/VY=";
  };

  # The logging module introduced the `taskName` field in Python 3.12, which the tests don't expect
@@ -67,7 +67,7 @@ buildPythonPackage rec {
      infrastructure such as ELK, EFK, AWS Cloudwatch, GCP Stackdriver.
    '';
    homepage = "https://github.com/bobbui/json-logging-python";
-    changelog = "https://github.com/bobbui/json-logging-python/releases/tag/${version}";
+    changelog = "https://github.com/bobbui/json-logging-python/releases/tag/${src.tag}";
    license = licenses.asl20;
    maintainers = [ ];
  };
--- a/pkgs/development/python-modules/nibabel/default.nix
+++ b/pkgs/development/python-modules/nibabel/default.nix
@@ -2,6 +2,7 @@
  lib,
  buildPythonPackage,
  fetchPypi,
+  fetchpatch2,
  pythonOlder,
  hatchling,
  hatch-vcs,
@@ -32,6 +33,13 @@ buildPythonPackage rec {
    hash = "sha256-C9ymUDsceEtEbHRaRUI2fed1bPug1yFDuR+f+3i+Vps=";
  };

+  patches = [
+    (fetchpatch2 {
+      url = "https://github.com/nipy/nibabel/commit/3f40a3bc0c4bd996734576a15785ad0f769a963a.patch?full_index=1";
+      hash = "sha256-URsxgP6Sd5IIOX20GtAYtWBWOhw+Hiuhgu1oa8o8NXk=";
+    })
+  ];
+
  build-system = [
    hatchling
    hatch-vcs
--- a/pkgs/development/python-modules/nipy/default.nix
+++ b/pkgs/development/python-modules/nipy/default.nix
@@ -2,6 +2,7 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+  fetchpatch2,

  # build-system
  cython,
@@ -35,6 +36,14 @@ buildPythonPackage rec {
    hash = "sha256-KGMGu0/0n1CzN++ri3Ig1AJjeZfkl4KzNgm6jdwXB7o=";
  };

+  patches = [
+    # https://github.com/nipy/nipy/pull/589
+    (fetchpatch2 {
+      url = "https://github.com/nipy/nipy/pull/589/commits/76f2aae95dede9b8ac025dc32ce94791904f25e4.patch?full_index=1";
+      hash = "sha256-Rnwfx6JKl+nE9wvBGKXFtizjuB4Bl1QDF88CvSZU/RQ=";
+    })
+  ];
+
  postPatch = ''
    patchShebangs nipy/_build_utils/cythoner.py
  '';
--- a/pkgs/development/python-modules/python-gvm/default.nix
+++ b/pkgs/development/python-modules/python-gvm/default.nix
@@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "python-gvm";
-  version = "26.2.1";
+  version = "26.4.0";
  pyproject = true;

  disabled = pythonOlder "3.9";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "greenbone";
    repo = "python-gvm";
    tag = "v${version}";
-    hash = "sha256-rYUqWuAnbT5XAvUJx0D7y9I0w8z8/jhvwAFtxCL/iGw=";
+    hash = "sha256-AIF5oq1eNkasgXV2v+9ofqjGwiivQv+rO12LuzN7PN8=";
  };

  build-system = [ poetry-core ];
--- a/pkgs/development/python-modules/pytransportnswv2/default.nix
+++ b/pkgs/development/python-modules/pytransportnswv2/default.nix
@@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "pytransportnswv2";
-  version = "0.8.3";
+  version = "0.8.7";
  pyproject = true;

  disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "PyTransportNSWv2";
    inherit version;
-    hash = "sha256-IjEc+fIlov0eOFhgq+k64aINqVVHq63pHEZrxAMUH+Q=";
+    hash = "sha256-Jg/oEgbxn0eGf9Bn9wte6Wqc1TYVb8GjzU1mLWk1qtE=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/quaternion/default.nix
+++ b/pkgs/development/python-modules/quaternion/default.nix
@@ -18,14 +18,14 @@

 buildPythonPackage rec {
  pname = "quaternion";
-  version = "2024.0.9";
+  version = "2024.0.10";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "moble";
    repo = "quaternion";
    tag = "v${version}";
-    hash = "sha256-i2GgcHbSN/JnJti8Nz8nFTKgbpntsxiG2KOPzJwNQa8=";
+    hash = "sha256-jkaSxnq1i5DZP7unbKktJWFmsDNc1ZGOKMcN9SiObMg=";
  };

  build-system = [
--- a/pkgs/development/python-modules/screenlogicpy/default.nix
+++ b/pkgs/development/python-modules/screenlogicpy/default.nix
@@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "screenlogicpy";
-  version = "0.10.1";
+  version = "0.10.2";
  pyproject = true;

  disabled = pythonOlder "3.10";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "dieselrabbit";
    repo = "screenlogicpy";
    tag = "v${version}";
-    hash = "sha256-z6cM0sihZvOHCA3v1DYQEev0axf4AcqEW13WA1EMhQM=";
+    hash = "sha256-o/NcLassEaucnWqu5fnYA19wFwCPCT9nYKBeHzFZTKo=";
  };

  nativeBuildInputs = [ setuptools ];
@@ -57,7 +57,7 @@ buildPythonPackage rec {
    description = "Python interface for Pentair Screenlogic devices";
    mainProgram = "screenlogicpy";
    homepage = "https://github.com/dieselrabbit/screenlogicpy";
-    changelog = "https://github.com/dieselrabbit/screenlogicpy/releases/tag/v${version}";
+    changelog = "https://github.com/dieselrabbit/screenlogicpy/releases/tag/${src.tag}";
    license = with licenses; [ gpl3Only ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/tools/misc/automake/automake-1.18.x.nix
+++ b/pkgs/development/tools/misc/automake/automake-1.18.x.nix
@@ -9,11 +9,11 @@

 stdenv.mkDerivation rec {
  pname = "automake";
-  version = "1.17";
+  version = "1.18.1";

  src = fetchurl {
    url = "mirror://gnu/automake/automake-${version}.tar.xz";
-    hash = "sha256-iSDB/EEeE7kL9wTvnbbynVQOdtIyyzssn03EzFmb2ZA=";
+    hash = "sha256-FoqjYyeDUbia9WaERI9SWlvOUHnQtoQr2RD90/FkaIc=";
  };

  strictDeps = true;
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
  dontPatchShebangs = true;

  meta = with lib; {
-    branch = "1.17";
+    branch = "1.18";
    homepage = "https://www.gnu.org/software/automake/";
    description = "GNU standard-compliant makefile generator";
    license = licenses.gpl2Plus;
--- a/pkgs/misc/tmux-plugins/tmux-fingers/default.nix
+++ b/pkgs/misc/tmux-plugins/tmux-fingers/default.nix
@@ -7,13 +7,13 @@
 let
  fingers = crystal.buildCrystalPackage rec {
    format = "shards";
-    version = "2.4.1";
+    version = "2.5.0";
    pname = "fingers";
    src = fetchFromGitHub {
      owner = "Morantron";
      repo = "tmux-fingers";
      rev = "${version}";
-      sha256 = "sha256-djSf5zsxrUbkVhWzz6t8Usvk2HtBbQNCMeMc+5V3x/M=";
+      sha256 = "sha256-PESjKpVKRyuhkyiSzq2ZAD8CzFyqD3O7LcQxEbKfc9A=";
    };

    shardsFile = ./shards.nix;
--- a/Show More
+++ b/Show More