Merge staging-next into staging

2026-09-30 11:50:06 +00:00 · 2025-07-15 00:19:20 +00:00
parent f70b43a891 6941cd1f02
commit b467d22efb
62 changed files with 683 additions and 232 deletions
--- a/nixos/tests/sing-box.nix
+++ b/nixos/tests/sing-box.nix
@@ -57,8 +57,6 @@ let
      "${hosts."${server_host}"}/32"
    ];
    strict_route = false;
-    sniff = true;
-    sniff_override_destination = false;
  };

  tproxyPort = 1081;
@@ -219,6 +217,9 @@ in
                tag = "outbound:direct";
              }
            ];
+            route = {
+              default_interface = "eth1";
+            };
          };
        };
      };
@@ -267,6 +268,7 @@ in
              vmessOutbound
            ];
            route = {
+              default_interface = "eth1";
              final = "outbound:block";
              rules = [
                {
@@ -315,25 +317,28 @@ in
                type = "block";
                tag = "outbound:block";
              }
+            ];
+            endpoints = [
              {
-                type = "direct";
-                tag = "outbound:direct";
-              }
-              {
-                detour = "outbound:direct";
                type = "wireguard";
                tag = "outbound:wireguard";
-                interface_name = "wg0";
-                local_address = [ "10.23.42.2/32" ];
+                name = "wg0";
+                address = [ "10.23.42.2/32" ];
                mtu = 1280;
                private_key = wg-keys.peer1.privateKey;
-                peer_public_key = wg-keys.peer0.publicKey;
-                server = server_host;
-                server_port = 2408;
-                system_interface = true;
+                peers = [
+                  {
+                    address = server_host;
+                    port = 2408;
+                    public_key = wg-keys.peer0.publicKey;
+                    allowed_ips = [ "0.0.0.0/0" ];
+                  }
+                ];
+                system = true;
              }
            ];
            route = {
+              default_interface = "eth1";
              final = "outbound:block";
            };
          };
@@ -377,8 +382,6 @@ in
                listen = "0.0.0.0";
                listen_port = tproxyPort;
                udp_fragment = true;
-                sniff = true;
-                sniff_override_destination = false;
              }
            ];
            outbounds = [
@@ -393,6 +396,7 @@ in
              vmessOutbound
            ];
            route = {
+              default_interface = "eth1";
              final = "outbound:block";
              rules = [
                {
@@ -434,7 +438,7 @@ in
              independent_cache = true;
              fakeip = {
                enabled = true;
-                "inet4_range" = "198.18.0.0/16";
+                inet4_range = "198.18.0.0/16";
              };
              servers = [
                {
@@ -458,7 +462,6 @@ in
                    "AAAA"
                  ];
                  server = "dns:fakeip";
-
                }
              ];
            };
@@ -474,17 +477,17 @@ in
                type = "direct";
                tag = "outbound:direct";
              }
-              {
-                type = "dns";
-                tag = "outbound:dns";
-              }
            ];
            route = {
+              default_interface = "eth1";
              final = "outbound:direct";
              rules = [
+                {
+                  action = "sniff";
+                }
                {
                  protocol = "dns";
-                  outbound = "outbound:dns";
+                  action = "hijack-dns";
                }
              ];
            };
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -171,11 +171,11 @@
    "vendorHash": null
  },
  "bigip": {
-    "hash": "sha256-JGsleJiOo2wnIObvbQpvpmfc/CUaznVDIiNFX+eetW8=",
+    "hash": "sha256-lhN9YPufx6JITEhwLfqUMudXKTJqFdRCPkS+lTZpmH8=",
    "homepage": "https://registry.terraform.io/providers/F5Networks/bigip",
    "owner": "F5Networks",
    "repo": "terraform-provider-bigip",
-    "rev": "v1.23.0",
+    "rev": "v1.23.1",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -1147,13 +1147,13 @@
    "vendorHash": null
  },
  "sakuracloud": {
-    "hash": "sha256-vIP7hlPvx7o8/uXpg6TOEeoDL9FGaTBdXzziOyLrdGY=",
+    "hash": "sha256-IbR3m0s5LCC9tIOC67yn2yI6lssnIlc/pB6XIf0UOuk=",
    "homepage": "https://registry.terraform.io/providers/sacloud/sakuracloud",
    "owner": "sacloud",
    "repo": "terraform-provider-sakuracloud",
-    "rev": "v2.28.0",
+    "rev": "v2.28.1",
    "spdx": "Apache-2.0",
-    "vendorHash": "sha256-hJmMNxlhyzcnguLFJih/K1CSZHIOspTgCJ8nyVjT7mg="
+    "vendorHash": "sha256-HKmIl/GjGJZmhWLrK3lMjYo1F5nmo+U9ZpvBo5hDH/0="
  },
  "scaleway": {
    "hash": "sha256-3MLtSOcMCIl3pFJH/xKK/fPQcRrW2Nx4b2jCZiUE2aw=",
--- a/pkgs/applications/office/scribus/default.nix
+++ b/pkgs/applications/office/scribus/default.nix
@@ -4,14 +4,27 @@
  cmake,
  cups,
  fetchurl,
+  fetchpatch,
  fontconfig,
  freetype,
+  graphicsmagick,
  harfbuzzFull,
  hunspell,
  lcms2,
+  libcdr,
+  libfreehand,
  libjpeg,
+  libjxl,
+  libmspub,
+  libpagemaker,
+  libqxp,
+  librevenge,
+  libsysprof-capture,
  libtiff,
+  libvisio,
+  libwpg,
  libxml2,
+  libzmf,
  pixman,
  pkg-config,
  podofo_0_10,
@@ -20,7 +33,7 @@
  python3,
  lib,
  stdenv,
-  qt5,
+  qt6,
 }:

 let
@@ -32,17 +45,17 @@ in
 stdenv.mkDerivation (finalAttrs: {
  pname = "scribus";

-  version = "1.6.4";
+  version = "1.7.0";

  src = fetchurl {
    url = "mirror://sourceforge/scribus/scribus-devel/scribus-${finalAttrs.version}.tar.xz";
-    hash = "sha256-UzvnrwOs+qc27F96P8JWKr0gD+9coqfN7gK19E1hgp4=";
+    hash = "sha256-+lnWIh/3z/qTcjV5l+hlcBYuHhiRNza3F2/RD0jCQ/Y=";
  };

  nativeBuildInputs = [
    cmake
    pkg-config
-    qt5.wrapQtAppsHook
+    qt6.wrapQtAppsHook
  ];

  buildInputs = [
@@ -51,37 +64,63 @@ stdenv.mkDerivation (finalAttrs: {
    cups
    fontconfig
    freetype
+    graphicsmagick
    harfbuzzFull
    hunspell
    lcms2
+    libcdr
+    libfreehand
    libjpeg
+    libjxl
+    libpagemaker
+    libqxp
+    librevenge
+    libsysprof-capture
    libtiff
+    libvisio
+    libwpg
    libxml2
+    libzmf
    pixman
    podofo_0_10
    poppler
    poppler_data
    pythonEnv
-    qt5.qtbase
-    qt5.qtimageformats
-    qt5.qttools
+    qt6.qt5compat
+    qt6.qtbase
+    qt6.qtdeclarative
+    qt6.qtimageformats
+    qt6.qtsvg
+    qt6.qttools
+  ] ++ lib.optionals libmspub.meta.available [ libmspub ];
+
+  cmakeFlags = [ (lib.cmakeBool "WANT_GRAPHICSMAGICK" true) ];
+
+  patches = [
+    (fetchpatch {
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/fix_build_with_qt_6.9.0.patch?h=scribus-unstable";
+      hash = "sha256-hzd9XpoVVqbwvZ40QPGBqqWkIFXug/tSojf/Ikc4nn4=";
+    })
+    (fetchpatch {
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/fix_build_with_poppler_25.02.0.patch?h=scribus-unstable";
+      hash = "sha256-t9xJA6KGMGAdUFyjI8OlTNilewyMr1FFM7vjHOM15Xg=";
+    })
  ];

-  meta = with lib; {
-    maintainers = with maintainers; [
-      arthsmn
-    ];
+  meta = {
+    maintainers = with lib.maintainers; [ arthsmn ];
    description = "Desktop Publishing (DTP) and Layout program";
    mainProgram = "scribus";
    homepage = "https://www.scribus.net";
    # There are a lot of licenses...
    # https://github.com/scribusproject/scribus/blob/20508d69ca4fc7030477db8dee79fd1e012b52d2/COPYING#L15-L19
-    license = with licenses; [
+    license = with lib.licenses; [
      bsd3
      gpl2Plus
      mit
      publicDomain
    ];
+    platforms = lib.platforms.all;
    broken = stdenv.hostPlatform.isDarwin;
  };
 })
--- a/pkgs/by-name/ad/ada/package.nix
+++ b/pkgs/by-name/ad/ada/package.nix
@@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "ada";
-  version = "3.2.4";
+  version = "3.2.5";

  src = fetchFromGitHub {
    owner = "ada-url";
    repo = "ada";
    tag = "v${version}";
-    hash = "sha256-tC7Hpf9xCysraTtVC+mYE/DVNrG02lwLAlDiTeaWpY4=";
+    hash = "sha256-gXeQYNuhrlCEvvDQtQ07+nE/9gGzzEYPnEKMxWryLRI=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/au/autotiling-rs/package.nix
+++ b/pkgs/by-name/au/autotiling-rs/package.nix
@@ -6,17 +6,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "autotiling-rs";
-  version = "0.1.4";
+  version = "0.1.5";

  src = fetchFromGitHub {
    owner = "ammgws";
    repo = "autotiling-rs";
    rev = "v${version}";
-    sha256 = "sha256-rihNlKaESxIEQ61FP6PzIg82yuwQ/R4GX5BA0Ss+I5w=";
+    sha256 = "sha256-S/6LRQTHdPGZkmbTAb0ufNoXE1nD+rIQ2ASJ8jjFS3E=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-mXuI+kA8J2Bhli6HiX9h72i61cRbByKJQtUHHjCUza8=";
+  cargoHash = "sha256-riQ1nOs4fBj9y/jK0nS7Y85vMejLrKrEJzNnsQKkoeg=";

  meta = with lib; {
    description = "Autotiling for sway (and possibly i3)";
--- a/pkgs/by-name/ba/basedpyright/package.nix
+++ b/pkgs/by-name/ba/basedpyright/package.nix
@@ -16,13 +16,13 @@

 buildNpmPackage rec {
  pname = "basedpyright";
-  version = "1.29.5";
+  version = "1.30.1";

  src = fetchFromGitHub {
    owner = "detachhead";
    repo = "basedpyright";
    tag = "v${version}";
-    hash = "sha256-fD7A37G1kr7sWfwI8GXOm1cOlpnTSE9tN/WzotM8BeQ=";
+    hash = "sha256-YPjeiRg7vIpb9k32og6byWMk+EfhDS9MwfJveAndbQQ=";
  };

  npmDepsHash = "sha256-aJte4ApeXJQ9EYn87Uo+Xx7s+wi80I1JsZHeqklHGs4=";
--- a/pkgs/by-name/di/diffoscope/package.nix
+++ b/pkgs/by-name/di/diffoscope/package.nix
@@ -106,12 +106,12 @@ in
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
 python.pkgs.buildPythonApplication rec {
  pname = "diffoscope";
-  version = "300";
+  version = "301";
  format = "setuptools";

  src = fetchurl {
    url = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    hash = "sha256-ByfAS1ygWex8FLGeaV1HouSb6ElDZjAhXV5xjpsltFE=";
+    hash = "sha256-piTdP812LgcxvvgvUOKUrkxVXCbclyQW8dp84beT7H4=";
  };

  outputs = [
--- a/pkgs/development/tools/djhtml/default.nix
+++ b/pkgs/development/tools/djhtml/default.nix
@@ -1,10 +1,9 @@
 {
  lib,
-  buildPythonApplication,
+  python3Packages,
  fetchFromGitHub,
-  setuptools,
 }:
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  pname = "djhtml";
  version = "3.0.8";
  pyproject = true;
@@ -16,16 +15,16 @@ buildPythonApplication rec {
    hash = "sha256-1bopV6mjwjXdoIN9i3An4NvSpeGcVlQ24nLLjP/UfQU=";
  };

-  build-system = [ setuptools ];
+  build-system = [ python3Packages.setuptools ];

  pythonImportsCheck = [ "djhtml" ];

-  meta = with lib; {
+  meta = {
    homepage = "https://github.com/rtts/djhtml";
    description = "Django/Jinja template indenter";
    changelog = "https://github.com/rtts/djhtml/releases/tag/${src.tag}";
-    license = licenses.gpl3Plus;
-    maintainers = [ ];
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ ];
    mainProgram = "djhtml";
  };
 }
--- a/pkgs/by-name/do/doctl/package.nix
+++ b/pkgs/by-name/do/doctl/package.nix
@@ -9,7 +9,7 @@

 buildGoModule rec {
  pname = "doctl";
-  version = "1.132.0";
+  version = "1.133.0";

  vendorHash = null;

@@ -42,7 +42,7 @@ buildGoModule rec {
    owner = "digitalocean";
    repo = "doctl";
    tag = "v${version}";
-    hash = "sha256-A4CtJpqHkC88kH6CsEt2Pc+SgHeznjnzRYwclvm7De0=";
+    hash = "sha256-U3n407HnivvogybgTuB/Rb932bt0WTbk6M1Wf7jRoTo=";
  };

  meta = {
--- a/pkgs/by-name/dr/drawterm/package.nix
+++ b/pkgs/by-name/dr/drawterm/package.nix
@@ -23,13 +23,13 @@ let
 in
 stdenv.mkDerivation {
  pname = "drawterm";
-  version = "0-unstable-2025-06-13";
+  version = "0-unstable-2025-06-29";

  src = fetchFrom9Front {
    owner = "plan9front";
    repo = "drawterm";
-    rev = "4e32a9fa6e58c1474f747a99083303c4a2f14ea7";
-    hash = "sha256-j0s6xB8c8vQoOzL34Gu84elec0ig4z75NzlUx6PsW4E=";
+    rev = "903bcd8dba9cb9dfc70707a28089c469e5302539";
+    hash = "sha256-gZAPNRzAuvpIAV7ArPGsqVv6SYBJkqA+Okf6FmStvsU=";
  };

  enableParallelBuilding = true;
--- a/pkgs/by-name/ev/evcc/package.nix
+++ b/pkgs/by-name/ev/evcc/package.nix
@@ -17,16 +17,16 @@
 }:

 let
-  version = "0.204.5";
+  version = "0.205.0";

  src = fetchFromGitHub {
    owner = "evcc-io";
    repo = "evcc";
    tag = version;
-    hash = "sha256-kGn7O2OCvStez2eaT+h7EDBi96Q7dshK8X7DUD2SBOo=";
+    hash = "sha256-T97f5K4TDaAdqm2zU8+cEyq1YIzwy35tX8mb3pPkhIo=";
  };

-  vendorHash = "sha256-n67OSKpMhvgqftoVAqtABfcNgdRSbWjmJv7HSmv3Ev8=";
+  vendorHash = "sha256-gbTh9/Ny4JVCbpzz+opN92m6LQhPEBj/XuLLZ4M6tIc=";

  commonMeta = with lib; {
    license = licenses.mit;
@@ -52,7 +52,7 @@ buildGo124Module rec {

  npmDeps = fetchNpmDeps {
    inherit src;
-    hash = "sha256-HDokBgvRxmKkuQyGIqkX0Hy4Up+K25yYSRYAstE8mBY=";
+    hash = "sha256-OmiINzMCXbvceCDZ9zYTQKfWQ3iUgovMznmVoQkQ5DE=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/fr/freedv/no-framework.patch
+++ b/pkgs/by-name/fr/freedv/no-framework.patch
@@ -0,0 +1,28 @@
+diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
+index 38b3b262..3be9bfee 100644
+--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
+@@ -146,21 +146,16 @@ if(APPLE)
+         TARGET FreeDV
+         POST_BUILD
+         COMMAND rm -rf dist_tmp FreeDV.dmg || true
+-        COMMAND DYLD_LIBRARY_PATH=${CODEC2_BUILD_DIR}/src:${portaudio_BINARY_DIR}:${samplerate_BINARY_DIR}/src:${Python3_ROOT_DIR}:${DYLD_LIBRARY_PATH} ${CMAKE_SOURCE_DIR}/macdylibbundler/dylibbundler ARGS -od -b -x FreeDV.app/Contents/MacOS/FreeDV -d FreeDV.app/Contents/libs -p @loader_path/../libs/ -i /usr/lib -s ${CODEC2_BUILD_DIR}/src -s ${CMAKE_BINARY_DIR}/codec2_build/src ${PORTAUDIO_BUNDLE_ARG} -s ${samplerate_BINARY_DIR}/src -s ${rade_BINARY_DIR}/src -s ${Python3_ROOT_DIR}
+        COMMAND DYLD_LIBRARY_PATH=${CODEC2_BUILD_DIR}/src:${portaudio_BINARY_DIR}:${samplerate_BINARY_DIR}/src:${DYLD_LIBRARY_PATH} ${CMAKE_SOURCE_DIR}/macdylibbundler/dylibbundler ARGS -od -b -x FreeDV.app/Contents/MacOS/FreeDV -d FreeDV.app/Contents/libs -p @loader_path/../libs/ -i /usr/lib -s ${CODEC2_BUILD_DIR}/src -s ${CMAKE_BINARY_DIR}/codec2_build/src ${PORTAUDIO_BUNDLE_ARG} -s ${samplerate_BINARY_DIR}/src -s ${rade_BINARY_DIR}/src
+         COMMAND cp ARGS ${CMAKE_CURRENT_SOURCE_DIR}/freedv.icns FreeDV.app/Contents/Resources
+         COMMAND rm ARGS -rf FreeDV.app/Contents/Frameworks
+         COMMAND mkdir ARGS FreeDV.app/Contents/Frameworks
+-        COMMAND cp ARGS -a ${Python3_ROOT_DIR}/../../../Python.framework FreeDV.app/Contents/Frameworks
+-        COMMAND install_name_tool ARGS -add_rpath @loader_path/../Frameworks/Python.framework FreeDV.app/Contents/libs/librade*.dylib
+         COMMAND cp ARGS ../rade_src/radae_*e.py FreeDV.app/Contents/Resources
+         COMMAND cp ARGS -a ../rade_src/radae FreeDV.app/Contents/Resources
+         COMMAND cp ARGS -a ../rade_src/model19_check3 FreeDV.app/Contents/Resources
+         
+-        # Precompile Python code to improve startup time
+-        COMMAND cd FreeDV.app/Contents/Resources && ../Frameworks/Python.framework/Versions/Current/bin/python3 -c "import radae_txe\; import radae_rxe\;" && cd ../../..
+-        
+         # Codesign binary so that it can execute
+-        COMMAND codesign --force --options runtime --timestamp --entitlements ${CMAKE_CURRENT_SOURCE_DIR}/entitlements.plist --sign ${MACOS_CODESIGN_IDENTITY} ${CMAKE_CURRENT_BINARY_DIR}/FreeDV.app `find ${CMAKE_CURRENT_BINARY_DIR}/FreeDV.app -name '*.so' -o -name '*.dylib'` `find ${CMAKE_CURRENT_BINARY_DIR}/FreeDV.app/Contents/Frameworks/Python.framework/Versions/3.12/bin -name 'Python' -o -name 'python3.12*'` `find ${CMAKE_CURRENT_BINARY_DIR}/FreeDV.app/Contents/Frameworks/Python.framework/ -name 'Python'` ${CMAKE_CURRENT_BINARY_DIR}/FreeDV.app/Contents/MacOS/FreeDV ${CMAKE_CURRENT_BINARY_DIR}/FreeDV.app/Contents/Frameworks/Python.framework/Versions/3.12/lib/python3.12/site-packages/torch/bin/* ${CMAKE_CURRENT_BINARY_DIR}/FreeDV.app/Contents/Frameworks/Python.framework/Versions/3.12/Python
+        COMMAND codesign --force --options runtime --timestamp --entitlements ${CMAKE_CURRENT_SOURCE_DIR}/entitlements.plist --sign ${MACOS_CODESIGN_IDENTITY} ${CMAKE_CURRENT_BINARY_DIR}/FreeDV.app `find ${CMAKE_CURRENT_BINARY_DIR}/FreeDV.app -name '*.so' -o -name '*.dylib'`
+     )
+ 
+     if (MACOS_CODESIGN_KEYCHAIN_PROFILE)
--- a/pkgs/by-name/fr/freedv/package.nix
+++ b/pkgs/by-name/fr/freedv/package.nix
@@ -1,9 +1,11 @@
 {
-  config,
  lib,
  stdenv,
  fetchFromGitHub,
  cmake,
+  pkg-config,
+  python3,
+  libopus,
  macdylibbundler,
  makeWrapper,
  darwin,
@@ -17,64 +19,115 @@
  hamlib_4,
  wxGTK32,
  sioclient,
-  pulseSupport ? config.pulseaudio or stdenv.hostPlatform.isLinux,
+  dbus,
+  apple-sdk_15,
  nix-update-script,
 }:

+let
+  radaeSrc = fetchFromGitHub {
+    owner = "drowe67";
+    repo = "radae";
+    rev = "2354cd2a4b3af60c7feb1c0d6b3d6dd7417c2ac9";
+    hash = "sha256-yEr/OCXV83qXi89QHXMrUtQ2UwNOsijQMN35Or2JP+Y=";
+  };
+in
 stdenv.mkDerivation (finalAttrs: {
  pname = "freedv";
-  version = "1.9.9.2";
+  version = "2.0.0";

  src = fetchFromGitHub {
    owner = "drowe67";
    repo = "freedv-gui";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-oFuAH81mduiSQGIDgDDy1IPskqqCBmfWbpqQstUIw9g=";
+    hash = "sha256-3vwFB+3LloumEAGlSJZc2+/I8uI6KLP/KuDGeDOj87k=";
  };

-  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    substituteInPlace CMakeLists.txt \
-      --replace-fail "-Wl,-ld_classic" ""
-    substituteInPlace src/CMakeLists.txt \
-      --replace-fail "\''${CMAKE_SOURCE_DIR}/macdylibbundler/dylibbundler" "dylibbundler"
-    sed -i "/codesign/d;/hdiutil/d" src/CMakeLists.txt
-  '';
+  patches = [
+    ./no-framework.patch
+  ];
+
+  postPatch =
+    ''
+      cp -R ${radaeSrc} radae
+      chmod -R u+w radae
+      substituteInPlace radae/cmake/BuildOpus.cmake \
+        --replace-fail "https://gitlab.xiph.org/xiph/opus/-/archive/main/opus-main.tar.gz" "${libopus.src}" \
+        --replace-fail "./autogen.sh && " ""
+      substituteInPlace cmake/BuildRADE.cmake \
+        --replace-fail "GIT_REPOSITORY https://github.com/drowe67/radae.git" "URL $(realpath radae)" \
+        --replace-fail "GIT_TAG main" ""
+      patchShebangs test/test_*.sh
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      substituteInPlace CMakeLists.txt \
+        --replace-fail "-Wl,-ld_classic" ""
+      substituteInPlace src/CMakeLists.txt \
+        --replace-fail "\''${CMAKE_SOURCE_DIR}/macdylibbundler/dylibbundler" "dylibbundler"
+      sed -i "/codesign/d;/hdiutil/d" src/CMakeLists.txt
+    '';

  nativeBuildInputs =
    [
      cmake
+      pkg-config
+      python3
    ]
    ++ lib.optionals stdenv.hostPlatform.isDarwin [
      macdylibbundler
      makeWrapper
      darwin.autoSignDarwinBinariesHook
+      darwin.sigtool
    ];

-  buildInputs = [
-    codec2
-    libsamplerate
-    libsndfile
-    lpcnet
-    speexdsp
-    hamlib_4
-    wxGTK32
-    sioclient
-  ] ++ (if pulseSupport then [ libpulseaudio ] else [ portaudio ]);
+  buildInputs =
+    [
+      codec2
+      libsamplerate
+      libsndfile
+      lpcnet
+      speexdsp
+      hamlib_4
+      wxGTK32
+      sioclient
+      python3.pkgs.numpy
+    ]
+    ++ (
+      if stdenv.hostPlatform.isLinux then
+        [
+          libpulseaudio
+          dbus
+        ]
+      else if stdenv.hostPlatform.isDarwin then
+        [
+          apple-sdk_15
+        ]
+      else
+        [
+          portaudio
+        ]
+    );

  cmakeFlags = [
    (lib.cmakeBool "USE_INTERNAL_CODEC2" false)
    (lib.cmakeBool "USE_STATIC_DEPS" false)
    (lib.cmakeBool "UNITTEST" true)
-    (lib.cmakeBool "USE_PULSEAUDIO" pulseSupport)
+    (lib.cmakeBool "USE_NATIVE_AUDIO" (with stdenv.hostPlatform; isLinux || isDarwin))
  ];

-  doCheck = true;
+  env.NIX_CFLAGS_COMPILE = "-I${codec2.src}/src";

-  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    mkdir -p $out/Applications
-    mv $out/bin/FreeDV.app $out/Applications
-    makeWrapper $out/Applications/FreeDV.app/Contents/MacOS/FreeDV $out/bin/freedv
-  '';
+  doCheck = false;
+
+  postInstall =
+    ''
+      install -Dm755 rade_build/src/librade.* -t $out/lib
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      mkdir -p $out/Applications
+      mv $out/bin/FreeDV.app $out/Applications
+      makeWrapper $out/Applications/FreeDV.app/Contents/MacOS/FreeDV $out/bin/freedv
+    '';

  passthru.updateScript = nix-update-script {
    extraArgs = [
--- a/pkgs/by-name/gi/gifski/package.nix
+++ b/pkgs/by-name/gi/gifski/package.nix
@@ -8,17 +8,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "gifski";
-  version = "1.33.0";
+  version = "1.34.0";

  src = fetchFromGitHub {
    owner = "ImageOptim";
    repo = "gifski";
    rev = version;
-    hash = "sha256-IjQ2PqjXhNvXknVxfphSSwQEWBuTkSxMFrbwd2trlVI=";
+    hash = "sha256-8EAC8YH3AIbvYdTL7HtqTL7WqztzCwvDwIVkhiqvtrQ=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-2A7SDu9f7Tf74SAD72gCQ00Ccp3r2MaPo0qjVe3nR5s=";
+  cargoHash = "sha256-ZppSO3TyZBbNhG+YW71+C9kMu7ok2+kbnnCRbAKsbfs=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/gi/gitkraken/package.nix
+++ b/pkgs/by-name/gi/gitkraken/package.nix
@@ -56,24 +56,24 @@

 let
  pname = "gitkraken";
-  version = "11.2.0";
+  version = "11.2.1";

  throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";

  srcs = {
    x86_64-linux = fetchzip {
      url = "https://api.gitkraken.dev/releases/production/linux/x64/${version}/gitkraken-amd64.tar.gz";
-      hash = "sha256-yCAxNYwjnmK0lSkH9x8Q4KoQgAWwWmCS8O81tcsqWhs=";
+      hash = "sha256-nxYWcw8A/lIVyjiUJOmcjmTblbxiLSxMUjo7KnlAMzs=";
    };

    x86_64-darwin = fetchzip {
      url = "https://api.gitkraken.dev/releases/production/darwin/x64/${version}/GitKraken-v${version}.zip";
-      hash = "sha256-q3sy2VxgccA/9UaX08NcNusibXYNPFzZcaNlVi2eN9E=";
+      hash = "sha256-7I3yAEarGGhFs/PvcqvoDx8MbJ/zEuNN/s0o357M1vc=";
    };

    aarch64-darwin = fetchzip {
      url = "https://api.gitkraken.dev/releases/production/darwin/arm64/${version}/GitKraken-v${version}.zip";
-      hash = "sha256-6SxuOgfWMpaYYES+9QBwYJ4t+Go43Af0cwzs/tPVOts=";
+      hash = "sha256-pDPdi+cRMqhxu/84u6ojxteIi1VHfN3qy/NTruHVt8U=";
    };
  };

--- a/pkgs/by-name/ha/halo/package.nix
+++ b/pkgs/by-name/ha/halo/package.nix
@@ -8,10 +8,10 @@
 }:
 stdenv.mkDerivation rec {
  pname = "halo";
-  version = "2.21.2";
+  version = "2.21.3";
  src = fetchurl {
    url = "https://github.com/halo-dev/halo/releases/download/v${version}/halo-${version}.jar";
-    hash = "sha256-XYzk989eaOXU81EWUbwhLl6Fy30dbLhn4/x2wJ4I4ac=";
+    hash = "sha256-l5tD9QIQfuRXG6hxP2ensb3SeX/A7F/xx694rQKUUrI=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ho/home-manager/package.nix
+++ b/pkgs/by-name/ho/home-manager/package.nix
@@ -19,14 +19,14 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "home-manager";
-  version = "0-unstable-2025-07-02";
+  version = "0-unstable-2025-07-11";

  src = fetchFromGitHub {
    name = "home-manager-source";
    owner = "nix-community";
    repo = "home-manager";
-    rev = "89af52d9a893af013f5f4c1d2d56912106827153";
-    hash = "sha256-ENTd/sd4Vz/VJYn14SVqW1OH2m7WIAvsm9A9SrmDZRY=";
+    rev = "392ddb642abec771d63688c49fa7bcbb9d2a5717";
+    hash = "sha256-A4nftqiNz2bNihz0bKY94Hq/6ydR6UQOcGioeL7iymY=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ku/kubo/package.nix
+++ b/pkgs/by-name/ku/kubo/package.nix
@@ -8,7 +8,7 @@

 buildGoModule rec {
  pname = "kubo";
-  version = "0.35.0"; # When updating, also check if the repo version changed and adjust repoVersion below
+  version = "0.36.0"; # When updating, also check if the repo version changed and adjust repoVersion below
  rev = "v${version}";

  passthru.repoVersion = "16"; # Also update kubo-migrator when changing the repo version
@@ -16,7 +16,7 @@ buildGoModule rec {
  # Kubo makes changes to its source tarball that don't match the git source.
  src = fetchurl {
    url = "https://github.com/ipfs/kubo/releases/download/${rev}/kubo-source.tar.gz";
-    hash = "sha256-OubXaa2JWbEaakDV6pExm5PkiZ5XPd9uG+S4KwWb0xQ=";
+    hash = "sha256-KrNP3JMkyTo6hghLLGWerH1Oz3HsnTI5jCfqRbp6AR8=";
  };

  # tarball contains multiple files/directories
--- a/pkgs/by-name/li/libfreehand/package.nix
+++ b/pkgs/by-name/li/libfreehand/package.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  stdenv,
+  fetchzip,
+  fetchpatch,
+  perl,
+  pkg-config,
+  boost,
+  cppunit,
+  doxygen,
+  gperf,
+  icu,
+  lcms2,
+  librevenge,
+  zlib,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libfreehand";
+  version = "0.1.2";
+
+  src = fetchzip {
+    url = "https://dev-www.libreoffice.org/src/libfreehand/libfreehand-${finalAttrs.version}.tar.xz";
+    hash = "sha256-0icEGnTtYveP24FbYjRB7tFW/TquSOszbqZspHAhQ7I=";
+  };
+
+  nativeBuildInputs = [
+    perl
+    pkg-config
+  ];
+
+  buildInputs = [
+    boost
+    cppunit
+    doxygen
+    gperf
+    icu
+    lcms2
+    librevenge
+    zlib
+  ];
+
+  configureFlags = [ "--disable-werror" ];
+
+  patches = [
+    (fetchpatch {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libfreehand/-/raw/main/libfreehand-0.1.2-icu-fix.patch?ref_type=heads";
+      hash = "sha256-SRkcF+FRkFdueLSTOMYWo6+CCl05f0OBP6G5VrXRyCw=";
+    })
+  ];
+
+  meta = {
+    description = "Adobe Freehand import library";
+    homepage = "https://wiki.documentfoundation.org/DLP/Libraries/libfreehand";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [ arthsmn ];
+    platforms = lib.platforms.all;
+  };
+})
--- a/pkgs/by-name/li/libmspub/package.nix
+++ b/pkgs/by-name/li/libmspub/package.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  stdenv,
+  fetchzip,
+  fetchpatch,
+  pkg-config,
+  boost,
+  doxygen,
+  icu,
+  librevenge,
+  zlib,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libmspub";
+  version = "0.1.4";
+
+  src = fetchzip {
+    url = "https://dev-www.libreoffice.org/src/libmspub/libmspub-${finalAttrs.version}.tar.xz";
+    hash = "sha256-/6e9IGcTIZTlnsakOaSjTn3DsO9ZNQigdCCbMbrBTQE=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    boost
+    doxygen
+    icu
+    librevenge
+    zlib
+  ];
+
+  configureFlags = [ "--with-docs" ];
+
+  patches = [
+    (fetchpatch {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libmspub/-/raw/main/buildfix.diff?ref_type=heads";
+      hash = "sha256-evxEoQ0a6YHoymR+SEJwqfr7rkWp3JnsWOD1tfYfZOw=";
+    })
+  ];
+
+  meta = {
+    description = "Microsoft Publisher import library";
+    homepage = "https://wiki.documentfoundation.org/DLP/Libraries/libmspub";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [ arthsmn ];
+    platforms = lib.platforms.all;
+    broken = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64;
+  };
+})
--- a/pkgs/by-name/li/libpagemaker/package.nix
+++ b/pkgs/by-name/li/libpagemaker/package.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  stdenv,
+  fetchzip,
+  fetchpatch,
+  pkg-config,
+  boost,
+  doxygen,
+  librevenge,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libpagemaker";
+  version = "0.0.4";
+
+  src = fetchzip {
+    url = "https://dev-www.libreoffice.org/src/libpagemaker/libpagemaker-${finalAttrs.version}.tar.xz";
+    hash = "sha256-fAtCNbP0fI2LxTOPPh5zbdF50wWhsrfSoNFPVU9tBas=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    boost
+    doxygen
+    librevenge
+  ];
+
+  patches = [
+    (fetchpatch {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libpagemaker/-/raw/main/libpagemaker-0.0.4-const-ref-exception.patch?ref_type=heads";
+      hash = "sha256-yZbiLAZHgzygGetiuoKiQS010pRfZTi2CbAAxQdCZbs=";
+    })
+  ];
+
+  meta = {
+    description = "Adobe PageMaker import library";
+    homepage = "https://wiki.documentfoundation.org/DLP/Libraries/libpagemaker";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [ arthsmn ];
+    platforms = lib.platforms.all;
+  };
+})
--- a/pkgs/by-name/li/libqxp/package.nix
+++ b/pkgs/by-name/li/libqxp/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  stdenv,
+  fetchzip,
+  pkg-config,
+  boost,
+  cppunit,
+  doxygen,
+  icu,
+  librevenge,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libqxp";
+  version = "0.0.2";
+
+  src = fetchzip {
+    url = "https://dev-www.libreoffice.org/src/libqxp/libqxp-${finalAttrs.version}.tar.xz";
+    hash = "sha256-5AcZDdmowFbsl9xJ/CPXAUL5zSNu90HgX3V0V8Pt/Rw=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    boost
+    cppunit
+    doxygen
+    icu
+    librevenge
+  ];
+
+  meta = {
+    description = "QuarkXPress import library";
+    homepage = "https://wiki.documentfoundation.org/DLP/Libraries/libqxp";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [ arthsmn ];
+    platforms = lib.platforms.all;
+  };
+})
--- a/pkgs/by-name/lx/lxgw-neoxihei/package.nix
+++ b/pkgs/by-name/lx/lxgw-neoxihei/package.nix
@@ -6,11 +6,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "lxgw-neoxihei";
-  version = "1.218";
+  version = "1.218.1";

  src = fetchurl {
    url = "https://github.com/lxgw/LxgwNeoXiHei/releases/download/v${version}/LXGWNeoXiHei.ttf";
-    hash = "sha256-TGl4J4r7ueAahrTgsJH0DlucuT2OrW3NzR1jQGwQA7E=";
+    hash = "sha256-ZWotvGj2LpQbi3t6mVBL8kE19JC4X6VqkIXSQSuyjR0=";
  };

  dontUnpack = true;
--- a/pkgs/by-name/me/melange/package.nix
+++ b/pkgs/by-name/me/melange/package.nix
@@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "melange";
-  version = "0.29.0";
+  version = "0.29.1";

  src = fetchFromGitHub {
    owner = "chainguard-dev";
    repo = "melange";
    rev = "v${version}";
-    hash = "sha256-nyrR9RxoZzQQ4OqV4FtW9534PQAyGnBCEqCJReMkCIQ=";
+    hash = "sha256-GQvsq9PJA4dbi69ZAMcyPwbsSSbsNm4ZyBj+W6c0VV4=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
--- a/pkgs/by-name/mi/misconfig-mapper/package.nix
+++ b/pkgs/by-name/mi/misconfig-mapper/package.nix
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "misconfig-mapper";
-  version = "1.14.4";
+  version = "1.14.5";

  src = fetchFromGitHub {
    owner = "intigriti";
    repo = "misconfig-mapper";
    tag = "v${version}";
-    hash = "sha256-HLGBQugGg66wH3NFPDvFRRGdDscd+Vz6LHG8CYHqgYw=";
+    hash = "sha256-faIjS3B019eYefOIklJMuUVcCzkM3bHu/HJ1kaERtUA=";
  };

-  vendorHash = "sha256-GY3eRMj7YtuP/Bibf2e4fAOwGNe9TTadmOBpOxK4S6c=";
+  vendorHash = "sha256-mh66gH4ln/D2OWaD+VISTysszjpPGg2dHF29BD1i6z8=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/nc/ncspot/package.nix
+++ b/pkgs/by-name/nc/ncspot/package.nix
@@ -33,16 +33,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ncspot";
-  version = "1.2.2";
+  version = "1.3.0";

  src = fetchFromGitHub {
    owner = "hrkfdn";
    repo = "ncspot";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-4zeBTi1WBy9tXowsehUo4qou6bhznWPeCXFg+R3akho=";
+    hash = "sha256-FSMQv2443oPQjMSv68ppfI2ZTUG79b+GcXmHNAmjPZk=";
  };

-  cargoHash = "sha256-c16qw2khbMXTA8IbYQnMKqivO63DwyAWKfV2P1aD7dU=";
+  cargoHash = "sha256-Qjsn3U9KZr5qZliJ/vbudfkH1uOng1N5c8dAyH+Y5vQ=";

  nativeBuildInputs = [ pkg-config ] ++ lib.optional withClipboard python3;

--- a/pkgs/by-name/ni/nix-fast-build/package.nix
+++ b/pkgs/by-name/ni/nix-fast-build/package.nix
@@ -6,6 +6,7 @@
  nix-eval-jobs,
  nix-output-monitor,
  nix-update-script,
+  bashInteractive,
 }:

 python3Packages.buildPythonApplication rec {
@@ -28,6 +29,7 @@ python3Packages.buildPythonApplication rec {
        [
          nix-eval-jobs
          nix-eval-jobs.nix
+          bashInteractive
        ]
        ++ lib.optional (lib.meta.availableOn stdenv.buildPlatform nix-output-monitor.compiler) nix-output-monitor
      )
--- a/pkgs/by-name/ol/olivetin/package.nix
+++ b/pkgs/by-name/ol/olivetin/package.nix
@@ -81,18 +81,18 @@ buildGoModule (

  {
    pname = "olivetin";
-    version = "2025.6.22";
+    version = "2025.7.13";

    src = fetchFromGitHub {
      owner = "OliveTin";
      repo = "OliveTin";
      tag = finalAttrs.version;
-      hash = "sha256-fNE8x0d0lnKVxy4fk3h5QrcWnMKBcxhrxpDbZYTXimc=";
+      hash = "sha256-/KylnGxamyhrvLNHAIcBUcDWU+Agizg7tlMOv6qnpCI=";
    };

    modRoot = "service";

-    vendorHash = "sha256-8rPJoB75de2Y56iyIwdI9HPk7OlCgfMPy28TW1i7+sU=";
+    vendorHash = "sha256-mI17WV+U4wbcZhSymX4NnxwvHqQNehubrvH9CxXe4/o=";

    ldflags = [
      "-s"
--- a/pkgs/by-name/op/openobserve/build.rs.patch
+++ b/pkgs/by-name/op/openobserve/build.rs.patch
@@ -1,11 +1,11 @@
 diff --git a/build.rs b/build.rs
 index 0f66ace..be74fad 100644
--- a/build.rs
-+++ b/build.rs
-@@ -99,24 +99,5 @@ fn main() -> Result<()> {
-         &["proto"],
-     )?;
- 
+--- a/src/config/build.rs
+++ b/src/config/build.rs
+@@ -20,24 +20,5 @@ use chrono::{DateTime, SecondsFormat, Utc};
+ fn main() -> Result<()> {
+     println!("cargo:rerun-if-changed=build.rs");
+
 -    // build information
 -    let output = Command::new("git")
 -        .args(["describe", "--tags", "--abbrev=0"])
--- a/pkgs/by-name/op/openobserve/package.nix
+++ b/pkgs/by-name/op/openobserve/package.nix
@@ -15,12 +15,12 @@
 }:

 let
-  version = "0.14.0";
+  version = "0.14.7";
  src = fetchFromGitHub {
    owner = "openobserve";
    repo = "openobserve";
    tag = "v${version}";
-    hash = "sha256-rTp+DkADqYkJg1zJog1yURE082V5kCqgid/oUd81SN8=";
+    hash = "sha256-+YcVTn/jcEbaqTycMCYn6B0z2HsvgrCY1gHnkRajwSs=";
  };
  web = buildNpmPackage {
    inherit src version;
@@ -28,7 +28,7 @@ let

    sourceRoot = "${src.name}/web";

-    npmDepsHash = "sha256-awfQR1wZBX3ggmD0uJE9Fur4voPydeygrviRijKnBTE=";
+    npmDepsHash = "sha256-1MUmAWkeYUEL6WZGq1Jg5W2uKa2xj0oZbGlIbvZWT1E=";

    preBuild = ''
      # Patch vite config to not open the browser to visualize plugin composition
@@ -64,7 +64,7 @@ rustPlatform.buildRustPackage {
  '';

  useFetchCargoVendor = true;
-  cargoHash = "sha256-FWMUPghx9CxuzP7jFZYSIwZsylApWzQsfx8DuwS4GTo=";
+  cargoHash = "sha256-vfc6B+Uc8RXQD8vGC1yV9w5YAefkYJMpCH2frqjrSWk=";

  nativeBuildInputs = [
    pkg-config
@@ -96,6 +96,7 @@ rustPlatform.buildRustPackage {
  checkFlags = [
    "--skip=handler::http::router::tests::test_get_proxy_routes"
    "--skip=tests::e2e_test"
+    "--skip=service::organization::tests::test_organization"
  ];

  passthru.updateScript = gitUpdater {
--- a/pkgs/by-name/op/openpgp-card-tools/package.nix
+++ b/pkgs/by-name/op/openpgp-card-tools/package.nix
@@ -13,18 +13,18 @@

 rustPlatform.buildRustPackage rec {
  pname = "openpgp-card-tools";
-  version = "0.11.9";
+  version = "0.11.10";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "openpgp-card";
    repo = "openpgp-card-tools";
    rev = "v${version}";
-    hash = "sha256-kT/egkOBOomUX+fwT3OeRSZOnGeuFRLKKAXtW8nN4rw=";
+    hash = "sha256-1sm/zaKhUPMGdYg8sX/IXAI4vIRRZezSD89rljG4S/Y=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-mZZ8veY3iqsgScfFAGYo496qxTew24R5NxYf3WjnHco=";
+  cargoHash = "sha256-S+TOSUh/sr647aUBjo+aaZgVrrOubwa+XVFcwNBOxmI=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/by-name/pr/protonplus/package.nix
+++ b/pkgs/by-name/pr/protonplus/package.nix
@@ -20,13 +20,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "protonplus";
-  version = "0.5.8";
+  version = "0.5.9";

  src = fetchFromGitHub {
    owner = "Vysp3r";
    repo = "protonplus";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-99RD1M6i/titM0dzyNPZGdWyNAUo7ZBj2QEw/qDl5nM=";
+    hash = "sha256-Ss+9p6mQQNYcY+5gAD1CtM+TpNRC/kVqV8fmfowydBk=";
  };

  nativeBuildInputs = [
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  meta = {
-    mainProgram = "com.vysp3r.ProtonPlus";
+    mainProgram = "protonplus";
    description = "Simple Wine and Proton-based compatibility tools manager";
    homepage = "https://github.com/Vysp3r/ProtonPlus";
    changelog = "https://github.com/Vysp3r/ProtonPlus/releases/tag/v${finalAttrs.version}";
--- a/pkgs/by-name/sq/sqlfluff/package.nix
+++ b/pkgs/by-name/sq/sqlfluff/package.nix
@@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "sqlfluff";
-  version = "3.4.1";
+  version = "3.4.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "sqlfluff";
    repo = "sqlfluff";
    tag = version;
-    hash = "sha256-gtpYQvhDOxNO97YXaSHqSgUklmPJIe2ynjexTZPBUmA=";
+    hash = "sha256-Cf4nrINpe5Kr2JYwcTYx1oO+E6ydlBs0W7F4Mh7ITAs=";
  };

  build-system = with python3.pkgs; [ setuptools ];
@@ -71,7 +71,7 @@ python3.pkgs.buildPythonApplication rec {
  meta = {
    description = "SQL linter and auto-formatter";
    homepage = "https://www.sqlfluff.com/";
-    changelog = "https://github.com/sqlfluff/sqlfluff/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/sqlfluff/sqlfluff/blob/${src.tag}/CHANGELOG.md";
    license = with lib.licenses; [ mit ];
    maintainers = with lib.maintainers; [ fab ];
    mainProgram = "sqlfluff";
--- a/pkgs/by-name/su/surrealdb/package.nix
+++ b/pkgs/by-name/su/surrealdb/package.nix
@@ -6,22 +6,21 @@
  openssl,
  rocksdb,
  testers,
-  surrealdb,
  protobuf,
 }:
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
  pname = "surrealdb";
-  version = "2.3.5";
+  version = "2.3.7";

  src = fetchFromGitHub {
    owner = "surrealdb";
    repo = "surrealdb";
-    tag = "v${version}";
-    hash = "sha256-7Rv57D966TQFHbZKmtnt1XWuNOwD+r175iUVJiVho/0=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-gZICuvgMOdwa39i+5ETUDuFfBtSiZuuFOYW5pHPkoms=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-JENp5g1as1RS9fdV5qepEAhE9/SJ8lbMiwyk3YDeu5k=";
+  cargoHash = "sha256-KndVaz7o0kMtMvQf4NK0pNMaC518keWddmGkYtemeWg=";

  # error: linker `aarch64-linux-gnu-gcc` not found
  postPatch = ''
@@ -55,19 +54,19 @@ rustPlatform.buildRustPackage rec {
  __darwinAllowLocalNetworking = true;

  passthru.tests.version = testers.testVersion {
-    package = surrealdb;
+    package = finalAttrs.finalPackage;
    command = "surreal version";
  };

-  meta = with lib; {
+  meta = {
    description = "Scalable, distributed, collaborative, document-graph database, for the realtime web";
    homepage = "https://surrealdb.com/";
    mainProgram = "surreal";
-    license = licenses.bsl11;
-    maintainers = with maintainers; [
+    license = lib.licenses.bsl11;
+    maintainers = with lib.maintainers; [
      sikmir
      happysalada
      siriobalmelli
    ];
  };
-}
+})
--- a/pkgs/by-name/sy/synapse-admin-etkecc/package.nix
+++ b/pkgs/by-name/sy/synapse-admin-etkecc/package.nix
@@ -17,18 +17,18 @@ assert lib.asserts.assertMsg (

 stdenv.mkDerivation (finalAttrs: {
  pname = "synapse-admin-etkecc";
-  version = "0.11.1-etke44";
+  version = "0.11.1-etke45";

  src = fetchFromGitHub {
    owner = "etkecc";
    repo = "synapse-admin";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-8IL81rMohPNss0ZTKgyxvx4FNcgFtDoJGZ6uyM/nJgg=";
+    hash = "sha256-LlwNVlgZl5O9paEGem68FbzAPOfXlLTxZ865vR7qPR8=";
  };

  yarnOfflineCache = fetchYarnDeps {
    yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-6TVVYitLtpNjyMOUXaMYlhOskSZCb/eWW91S69RTeFo=";
+    hash = "sha256-7eSQQdcJkBIbG/0cj0uh02Day+4ph6LMQGIaMPqjpdk=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/tr/trickest-cli/package.nix
+++ b/pkgs/by-name/tr/trickest-cli/package.nix
@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "trickest-cli";
-  version = "2.1.2";
+  version = "2.1.3";

  src = fetchFromGitHub {
    owner = "trickest";
    repo = "trickest-cli";
    tag = "v${version}";
-    hash = "sha256-OuCiW/5g4swtSpqM2rhLyB1syiRkyTbJsghEvyosz/A=";
+    hash = "sha256-rYdv0OkABV2ih5u28AoxAg3qabbl2VQnuQ01PCXPY6M=";
  };

  vendorHash = "sha256-Ae0fNzYOAeCMrNFVhw4VvG/BkOMcguIMiBvLGt7wxEo=";
--- a/pkgs/by-name/uh/uhk-agent/package.nix
+++ b/pkgs/by-name/uh/uhk-agent/package.nix
@@ -13,12 +13,12 @@

 let
  pname = "uhk-agent";
-  version = "7.0.1";
+  version = "8.0.0";

  src = fetchurl {
    url = "https://github.com/UltimateHackingKeyboard/agent/releases/download/v${version}/UHK.Agent-${version}-linux-x86_64.AppImage";
    name = "${pname}-${version}.AppImage";
-    sha256 = "sha256-8zf6vhgZj8cY9XoI/6FZH1/xh7/I3vboVumLsTq3q8Q=";
+    sha256 = "sha256-1XgmGAjLoxJ9ZyeaDSk8UC9fVVwkY83i+DRBRIQz7/M=";
  };

  appimageContents = appimageTools.extract {
--- a/pkgs/by-name/wd/wdt/package.nix
+++ b/pkgs/by-name/wd/wdt/package.nix
@@ -13,13 +13,13 @@

 stdenv.mkDerivation {
  pname = "wdt";
-  version = "1.27.1612021-unstable-2025-06-12";
+  version = "1.27.1612021-unstable-2025-07-09";

  src = fetchFromGitHub {
    owner = "facebook";
    repo = "wdt";
-    rev = "5fdb967ef2618e483341bc5021c6fa5f5506a549";
-    sha256 = "sha256-3RT7sM8KosrW0r/yrxa8fKz2dSjjf2684VL3ULqfkC4=";
+    rev = "e4d03e392e90b8ff4d2a67da31d65405afd32db5";
+    sha256 = "sha256-epjZFTczJLmI5MgKLMVXhEhv9MYJCYWYOAkZcvqeBs0=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/wp/wpprobe/package.nix
+++ b/pkgs/by-name/wp/wpprobe/package.nix
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "wpprobe";
-  version = "0.7.2";
+  version = "0.7.3";

  src = fetchFromGitHub {
    owner = "Chocapikk";
    repo = "wpprobe";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-6aL1hK9oZYcBVQbfualIOsYrbMWTA1uV+fEKbOFaSHU=";
+    hash = "sha256-duTd+4nY8G8+RPlNBrcEZ4hBd4lf/gEyykIdbWcWPbs=";
  };

  vendorHash = "sha256-KV6Ss0fN3xwm5Id7MAHMUjq9TsQbaInLjd5xcLKGX6U=";
--- a/pkgs/by-name/xs/xscreensaver/package.nix
+++ b/pkgs/by-name/xs/xscreensaver/package.nix
@@ -35,11 +35,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "xscreensaver";
-  version = "6.11";
+  version = "6.12";

  src = fetchurl {
    url = "https://www.jwz.org/xscreensaver/xscreensaver-${finalAttrs.version}.tar.gz";
-    hash = "sha256-lIi3ouZVkSh7lEMB8x+WjXcX/5vGswmJ46vtZiyH4eg=";
+    hash = "sha256-T/Z5ghfju7w8cza+7afoPq+/AzAawpsiNtpmoPExdkM=";
  };

  outputs = [
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -3214,6 +3214,18 @@ with haskellLib;
  brillo-juicy = warnAfterVersion "0.2.4" (doJailbreak super.brillo-juicy);
  brillo = warnAfterVersion "1.13.3" (doJailbreak super.brillo);

+  # Floating point precision issues. Test suite is only checked on x86_64.
+  # https://github.com/tweag/monad-bayes/issues/368
+  monad-bayes = dontCheckIf (
+    let
+      inherit (pkgs.stdenv) hostPlatform;
+    in
+    !hostPlatform.isx86_64
+    # Presumably because we emulate x86_64-darwin via Rosetta, x86_64-darwin
+    # also fails on Hydra
+    || hostPlatform.isDarwin
+  ) super.monad-bayes;
+
  # 2025-04-13: jailbreak to allow th-abstraction >= 0.7
  crucible = warnAfterVersion "0.7.2" (
    doJailbreak (
--- a/pkgs/development/python-modules/edk2-pytool-library/default.nix
+++ b/pkgs/development/python-modules/edk2-pytool-library/default.nix
@@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "edk2-pytool-library";
-  version = "0.23.3";
+  version = "0.23.4";
  pyproject = true;

  disabled = pythonOlder "3.10";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "tianocore";
    repo = "edk2-pytool-library";
    tag = "v${version}";
-    hash = "sha256-fWt9epsc77YCQiB5BeuCHUZ2Or8ddgMDSZPHC4f3yZ8=";
+    hash = "sha256-7wjNOwrTXhieUI7Etn6AdiNedoPKSIADtC7dc4Bdlxc=";
  };

  build-system = [
--- a/pkgs/development/python-modules/llm-grok/default.nix
+++ b/pkgs/development/python-modules/llm-grok/default.nix
@@ -15,14 +15,14 @@

 buildPythonPackage rec {
  pname = "llm-grok";
-  version = "1.0.1";
+  version = "1.1.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Hiepler";
    repo = "llm-grok";
    tag = "v${version}";
-    hash = "sha256-OeeU/53XKucLCtGvnl5RWc/QqF0TprB/SO8pnnK5fdw=";
+    hash = "sha256-Zwvf33XSoULJxJMBHftysY3RzGEQ+L46UJ0V8b/+UXQ=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/openfga-sdk/default.nix
+++ b/pkgs/development/python-modules/openfga-sdk/default.nix
@@ -17,14 +17,14 @@

 buildPythonPackage rec {
  pname = "openfga-sdk";
-  version = "0.9.4";
+  version = "0.9.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "openfga";
    repo = "python-sdk";
    tag = "v${version}";
-    hash = "sha256-ukx3XzNl2vIhPtHPJ46mUYbuxXkMKmlUNXV/3UF4DKo=";
+    hash = "sha256-e/Pgyj7A1HtcDPeRy0QK+Nok2ruWBiU9A1Yh7RZvtVI=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/py-ocsf-models/default.nix
+++ b/pkgs/development/python-modules/py-ocsf-models/default.nix
@@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "py-ocsf-models";
-  version = "0.6.0";
+  version = "0.7.0";
  pyproject = true;

  disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "prowler-cloud";
    repo = "py-ocsf-models";
    tag = version;
-    hash = "sha256-aHde/dYgY4x5b/iwIddqvfQ3/pRhEp0zDsrK3+jMV44=";
+    hash = "sha256-9aKZtSolUARl70QdavQ6mkW7jk3OlOAIoy/8I6o1+0M=";
  };

  pythonRelaxDeps = true;
--- a/pkgs/development/python-modules/pyais/default.nix
+++ b/pkgs/development/python-modules/pyais/default.nix
@@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "pyais";
-  version = "2.11.1";
+  version = "2.12.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "M0r13n";
    repo = "pyais";
    tag = "v${version}";
-    hash = "sha256-/etiTXKNcf5sMHxdl2dq1gH3OwKTwrz7zyH3CXmx/vQ=";
+    hash = "sha256-83JZ8OWbk6vwcbB6JFwHNNuvbq1n/4YHi1FhG+FIts8=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/pyatv/default.nix
+++ b/pkgs/development/python-modules/pyatv/default.nix
@@ -29,14 +29,14 @@

 buildPythonPackage rec {
  pname = "pyatv";
-  version = "0.16.0";
+  version = "0.16.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "postlund";
    repo = "pyatv";
    tag = "v${version}";
-    hash = "sha256-yjPbSTmHoKnVwNArZw5mGf3Eh4Ei1+DkY9y2XRRy4YA=";
+    hash = "sha256-b5u9u5CD/1W422rCxHvoyBqT5CuBAh68/EUBzNDcXoE=";
  };

  postPatch = ''
@@ -109,7 +109,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Python client library for the Apple TV";
    homepage = "https://github.com/postlund/pyatv";
-    changelog = "https://github.com/postlund/pyatv/blob/v${version}/CHANGES.md";
+    changelog = "https://github.com/postlund/pyatv/blob/${src.tag}/CHANGES.md";
    license = licenses.mit;
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/pyexploitdb/default.nix
+++ b/pkgs/development/python-modules/pyexploitdb/default.nix
@@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "pyexploitdb";
-  version = "0.2.88";
+  version = "0.2.89";
  pyproject = true;

  disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "pyExploitDb";
    inherit version;
-    hash = "sha256-KHFzK9MIT3tHwFmdGx/i9OSzQTKIhGXgWEI+qtH1Dkk=";
+    hash = "sha256-DCQmJ4YNQKMIK0IJwAYwIYp+ulGcRdjwDIsNI6W6RsU=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/pylamarzocco/default.nix
+++ b/pkgs/development/python-modules/pylamarzocco/default.nix
@@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "pylamarzocco";
-  version = "2.0.10";
+  version = "2.0.11";
  pyproject = true;

  disabled = pythonOlder "3.12";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "zweckj";
    repo = "pylamarzocco";
    tag = "v${version}";
-    hash = "sha256-8nmbnucTJa1RAmsOsqQLusjTnnrDZtHaADycnn3NyUU=";
+    hash = "sha256-g0qhNBhcU7Dogcw9WiEk+APk2McU7woXBqgeUS9D8iQ=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/pylitterbot/default.nix
+++ b/pkgs/development/python-modules/pylitterbot/default.nix
@@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "pylitterbot";
-  version = "2024.2.1";
+  version = "2024.2.2";
  pyproject = true;

  disabled = pythonOlder "3.10";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "natekspencer";
    repo = "pylitterbot";
    tag = "v${version}";
-    hash = "sha256-33LiWgI9E7/I6fyrdv+YXcw+gxUOsPZ0mYvEIF8/fOI=";
+    hash = "sha256-FKBgvP3qXT3nKHn5R9pp4nYNX+mO4vfDi5fzQ5+y1Nc=";
  };

  pythonRelaxDeps = [ "deepdiff" ];
--- a/pkgs/development/python-modules/python-arango/default.nix
+++ b/pkgs/development/python-modules/python-arango/default.nix
@@ -33,7 +33,7 @@ in

 buildPythonPackage rec {
  pname = "python-arango";
-  version = "8.2.0";
+  version = "8.2.1";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@@ -42,7 +42,7 @@ buildPythonPackage rec {
    owner = "arangodb";
    repo = "python-arango";
    tag = version;
-    hash = "sha256-DPyCHa9tAnxKYeieiHe10UV7EPnF7octbDm23dSlIb0=";
+    hash = "sha256-ZLjCcH6cSG+LcoeSifBm6HGjnRFJwYNTXbcw9b/BeQY=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pyvers/default.nix
+++ b/pkgs/development/python-modules/pyvers/default.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  poetry-core,
+
+  # dependencies
+  packaging,
+
+  # tests
+  jax,
+  numpy,
+  pytest-cov-stub,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "pyvers";
+  version = "0.1.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "vmoens";
+    repo = "pyvers";
+    tag = "v${version}";
+    hash = "sha256-BUUfb0vI1r/VV5aF9gmqnXGOIWQfBJ98MrcF/IH5CEs=";
+  };
+
+  build-system = [
+    poetry-core
+  ];
+
+  dependencies = [
+    packaging
+  ];
+
+  pythonImportsCheck = [ "pyvers" ];
+
+  nativeCheckInputs = [
+    jax
+    numpy
+    pytest-cov-stub
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "Python library for dynamic dispatch based on module versions and backends";
+    homepage = "https://github.com/vmoens/pyvers";
+    changelog = "https://github.com/vmoens/pyvers/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+}
--- a/pkgs/development/python-modules/qpageview/default.nix
+++ b/pkgs/development/python-modules/qpageview/default.nix
@@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "qpageview";
-  version = "1.0.0";
+  version = "1.0.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "frescobaldi";
    repo = "qpageview";
    tag = "v${version}";
-    hash = "sha256-UADC+DH3eG1pqlC9BRsqGQQjJcpfwWWVq4O7aFGLxLA=";
+    hash = "sha256-5D+fumQVCfl9ZEHIQmbdXkAuAkiKy6P5+StMWSE+a0A=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/rclone-python/default.nix
+++ b/pkgs/development/python-modules/rclone-python/default.nix
@@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "rclone-python";
-  version = "0.1.21";
+  version = "0.1.23";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Johannes11833";
    repo = "rclone_python";
    tag = "v${version}";
-    hash = "sha256-lYrPSDBWGVQmT2/MgzbtZ6hHNZXINCmmFP+ZHFZQDw8=";
+    hash = "sha256-vvsiXS3uI0TcL+X8+75BQmycrF+EGIgQE1dmGef35rI=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/robotframework-databaselibrary/default.nix
+++ b/pkgs/development/python-modules/robotframework-databaselibrary/default.nix
@@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "robotframework-databaselibrary";
-  version = "2.1.3";
+  version = "2.1.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "MarketSquare";
    repo = "Robotframework-Database-Library";
    tag = "v.${version}";
-    hash = "sha256-XsRXQU31Q2iGUMJgDvIIcSsT8guALZO5tnIjwGLR8+Q=";
+    hash = "sha256-ZZOhGZTJGWYCHyvJXDYGn9BMuPioCVIu0KONGkXsRmk=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/tensordict/default.nix
+++ b/pkgs/development/python-modules/tensordict/default.nix
@@ -19,6 +19,7 @@
  numpy,
  orjson,
  packaging,
+  pyvers,
  torch,

  # tests
@@ -28,14 +29,14 @@

 buildPythonPackage rec {
  pname = "tensordict";
-  version = "0.9.0";
+  version = "0.9.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pytorch";
    repo = "tensordict";
    tag = "v${version}";
-    hash = "sha256-actBFzWb2JBPsLhRZiD6zRpk7eyX2OHUPMU9JpJ90Wc=";
+    hash = "sha256-OdS9dw/BtSLZuY857O2njlFOMQj5IJ6v9c2aRP+H1Hc=";
  };

  build-system = [
@@ -56,6 +57,7 @@ buildPythonPackage rec {
    numpy
    orjson
    packaging
+    pyvers
    torch
  ];

--- a/pkgs/development/python-modules/urwid-satext/default.nix
+++ b/pkgs/development/python-modules/urwid-satext/default.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchhg,
+  setuptools,
+  urwid,
+}:
+
+buildPythonPackage rec {
+  pname = "urwid-satext";
+  version = "0.8.0-unstable-2023-04-08";
+  pyproject = true;
+
+  src = fetchhg {
+    url = "https://repos.goffi.org/urwid-satext";
+    rev = "6689aa54b20cb38731c68d4d39d86d01d25c21fa";
+    hash = "sha256-llCONyYV2kVVmT4EsugnW9j5X5PIeYEnnk4i5rQnE0w=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    urwid
+  ];
+
+  pythonImportsCheck = [
+    "urwid_satext"
+  ];
+
+  # no pytest tests exist
+  doCheck = false;
+
+  meta = {
+    description = "SàT extension widgets for Urwid";
+    homepage = "https://libervia.org";
+    changelog = "https://repos.goffi.org/urwid-satext/file/${src.rev}/CHANGELOG";
+    license = lib.licenses.lgpl3Plus;
+    teams = with lib.teams; [ ngi ];
+    maintainers = [ lib.maintainers.oluchitheanalyst ];
+  };
+}
--- a/pkgs/development/python-modules/xformers/default.nix
+++ b/pkgs/development/python-modules/xformers/default.nix
@@ -26,7 +26,8 @@
  einops,
  transformers,
  timm,
-#, flash-attn
+  #, flash-attn
+  openmp,
 }:
 let
  inherit (torch) cudaCapabilities cudaPackages cudaSupport;
@@ -66,23 +67,28 @@ buildPythonPackage {

  stdenv = if cudaSupport then cudaPackages.backendStdenv else stdenv;

-  buildInputs = lib.optionals cudaSupport (
-    with cudaPackages;
-    [
-      # flash-attn build
-      cuda_cudart # cuda_runtime_api.h
-      libcusparse # cusparse.h
-      cuda_cccl # nv/target
-      libcublas # cublas_v2.h
-      libcusolver # cusolverDn.h
-      libcurand # curand_kernel.h
-    ]
-  );
+  buildInputs =
+    lib.optional stdenv.hostPlatform.isDarwin openmp
+    ++ lib.optionals cudaSupport (
+      with cudaPackages;
+      [
+        # flash-attn build
+        cuda_cudart # cuda_runtime_api.h
+        libcusparse # cusparse.h
+        cuda_cccl # nv/target
+        libcublas # cublas_v2.h
+        libcusolver # cusolverDn.h
+        libcurand # curand_kernel.h
+      ]
+    );

-  nativeBuildInputs = [
-    ninja
-    which
-  ] ++ lib.optionals cudaSupport (with cudaPackages; [ cuda_nvcc ]);
+  nativeBuildInputs =
+    [
+      ninja
+      which
+    ]
+    ++ lib.optionals cudaSupport (with cudaPackages; [ cuda_nvcc ])
+    ++ lib.optional stdenv.hostPlatform.isDarwin openmp.dev;

  dependencies = [
    numpy
@@ -123,9 +129,5 @@ buildPythonPackage {
    changelog = "https://github.com/facebookresearch/xformers/blob/${version}/CHANGELOG.md";
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [ happysalada ];
-    badPlatforms = [
-      # fatal error: 'omp.h' file not found
-      lib.systems.inspect.patterns.isDarwin
-    ];
  };
 }
--- a/pkgs/os-specific/linux/broadcom-sta/default.nix
+++ b/pkgs/os-specific/linux/broadcom-sta/default.nix
@@ -3,12 +3,15 @@
  stdenv,
  fetchurl,
  fetchFromGitHub,
-  fetchpatch2,
  kernel,
 }:

 let
  version = "6.30.223.271";
+  # Patchset release number from rpmfusion, to more easily differentiate
+  # versions and updates. See `wl-kmod.spec` file:
+  # https://github.com/rpmfusion/wl-kmod/blob/master/wl-kmod.spec#L19
+  release = "57";
  hashes = {
    i686-linux = "sha256-T4twspOsjMXHDlca1dGHjQ8p0TOkb+eGmGjZwZtQWM0=";
    x86_64-linux = "sha256-X3l3TVvuyPdja1nA+wegMQju8eP9MkVjiyCFjHFBRL4=";
@@ -21,8 +24,8 @@ let
  rpmFusionPatches = fetchFromGitHub {
    owner = "rpmfusion";
    repo = "wl-kmod";
-    rev = "9a5a0d7195e0f6b05ff97e948b97fb0b7427cbf2";
-    hash = "sha256-pOOkkOjc77KGqc9fWuRyRsymd90OpLEnbOvxBbeIdKQ=";
+    rev = "b0d19578ebd0daae9c5b7f9e9511a6d73ac4d957";
+    hash = "sha256-v7mZ2S/eVfGTEXrxpdiemHhrC+P3/sPOZqTBhRtins4=";
  };
  patchset = [
    "wl-kmod-001_wext_workaround.patch"
@@ -55,10 +58,14 @@ let
    "wl-kmod-028_kernel_6.12_adaptation.patch"
    "wl-kmod-029_kernel_6.13_adaptation.patch"
    "wl-kmod-030_kernel_6.14_adaptation.patch"
+    "wl-kmod-031_replace_EXTRA_CFLAGS_EXTRA_LDFLAGS_with_ccflags-y_ldflags-y.patch"
+    "wl-kmod-032_add_MODULE_DESCRIPTION_macro.patch"
+    "wl-kmod-033_disable_objtool_add_warning_unmaintained.patch"
+    "wl-kmod-034_kernel_6.15_adaptation_replace_del_timer_with_timer_delete.patch"
  ];
 in
 stdenv.mkDerivation {
-  name = "broadcom-sta-${version}-${kernel.version}";
+  name = "broadcom-sta-${version}-${release}-${kernel.version}";

  src = fetchurl {
    url = "https://docs.broadcom.com/docs-and-downloads/docs/linux_sta/${tarball}";
@@ -94,9 +101,25 @@ stdenv.mkDerivation {

  meta = {
    description = "Kernel module driver for some Broadcom's wireless cards";
-    homepage = "http://www.broadcom.com/support/802.11/linux_sta.php";
+    homepage = "https://www.broadcom.com/support/download-search?pg=Legacy%20Products&pf=Legacy%20Wireless&pn&pa&po&dk&pl";
    license = lib.licenses.unfreeRedistributable;
-    maintainers = [ lib.maintainers.j0hax ];
-    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      j0hax
+      nullcube
+    ];
+    platforms = [
+      "i686-linux"
+      "x86_64-linux"
+    ];
+    knownVulnerabilities = [
+      "CVE-2019-9501: heap buffer overflow, potentially allowing remote code execution by sending specially-crafted WiFi packets"
+      "CVE-2019-9502: heap buffer overflow, potentially allowing remote code execution by sending specially-crafted WiFi packets"
+      (
+        "The Broadcom STA wireless driver is not maintained "
+        + "and is incompatible with Linux kernel security mitigations. "
+        + "It is heavily recommended to replace the hardware and remove the driver. "
+        + "Proceed at your own risk!"
+      )
+    ];
  };
 }
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -101,13 +101,13 @@ rec {
  # Vulkan developer beta driver
  # See here for more information: https://developer.nvidia.com/vulkan-driver
  vulkan_beta = generic rec {
-    version = "570.123.18";
-    persistencedVersion = "550.142";
-    settingsVersion = "550.142";
-    sha256_64bit = "sha256-GoBNatVpits13a3xsJSUr9BFG+5xrUDROfHmvss2cSY=";
-    openSha256 = "sha256-AYl8En0ZAZXWlJ8J8LKbPvAEKX+y65L1aq4Hm+dJScs=";
-    settingsSha256 = "sha256-Wk6IlVvs23cB4s0aMeZzSvbOQqB1RnxGMv3HkKBoIgY=";
-    persistencedSha256 = "sha256-yQFrVk4i2dwReN0XoplkJ++iA1WFhnIkP7ns4ORmkFA=";
+    version = "570.123.19";
+    persistencedVersion = "570.169";
+    settingsVersion = "570.169";
+    sha256_64bit = "sha256-K1ElpoTBjlLUG7slBrAhKqnEjUFwupiF7TS/8ogCf7c=";
+    openSha256 = "sha256-uGH2lnnADf5AGl5ShcbCOULsCIWtJlbxgHiz7I2efVE=";
+    settingsSha256 = "sha256-0E3UnpMukGMWcX8td6dqmpakaVbj4OhhKXgmqz77XZc=";
+    persistencedSha256 = "sha256-dttFu+TmbFI+mt1MbbmJcUnc1KIJ20eHZDR7YzfWmgE=";
    url = "https://developer.nvidia.com/downloads/vulkan-beta-${lib.concatStrings (lib.splitVersion version)}-linux";

    broken = kernel.kernelAtLeast "6.15";
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -395,8 +395,6 @@ with pkgs;
    }
  );

-  djhtml = python3Packages.callPackage ../development/tools/djhtml { };
-
  dnf-plugins-core = with python3Packages; toPythonApplication dnf-plugins-core;

  dnf4 = python3Packages.callPackage ../development/python-modules/dnf4/wrapper.nix { };
@@ -13716,8 +13714,7 @@ with pkgs;

  scantailor-universal = callPackage ../applications/graphics/scantailor/universal.nix { };

-  scribus_1_5 = libsForQt5.callPackage ../applications/office/scribus/default.nix { };
-  scribus = scribus_1_5;
+  scribus = callPackage ../applications/office/scribus/default.nix { };

  seafile-client = libsForQt5.callPackage ../applications/networking/seafile-client { };

--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -14945,6 +14945,8 @@ self: super: with self; {

  pyverilog = callPackage ../development/python-modules/pyverilog { };

+  pyvers = callPackage ../development/python-modules/pyvers { };
+
  pyversasense = callPackage ../development/python-modules/pyversasense { };

  pyvesync = callPackage ../development/python-modules/pyvesync { };
@@ -19063,6 +19065,8 @@ self: super: with self; {

  urwid-readline = callPackage ../development/python-modules/urwid-readline { };

+  urwid-satext = callPackage ../development/python-modules/urwid-satext { };
+
  urwidgets = callPackage ../development/python-modules/urwidgets { };

  urwidtrees = callPackage ../development/python-modules/urwidtrees { };
@@ -19684,7 +19688,9 @@ self: super: with self; {

  xen = toPythonModule (pkgs.xen.override { python3Packages = self; });

-  xformers = callPackage ../development/python-modules/xformers { };
+  xformers = callPackage ../development/python-modules/xformers {
+    inherit (pkgs.llvmPackages) openmp;
+  };

  xgboost = callPackage ../development/python-modules/xgboost { inherit (pkgs) xgboost; };