Project import generated by Copybara.

GitOrigin-RevId: 2768c7d042a37de65bb1b5b3268fc987e534c49d
2024-10-23 09:41:50 +03:00 · 2024-10-23 09:41:50 +03:00 · 24fdeddc0a
commit 24fdeddc0a
parent 0c4a432cf2
1132 changed files with 65389 additions and 42064 deletions
--- a/third_party/nixpkgs/.github/workflows/basic-eval.yml
+++ b/third_party/nixpkgs/.github/workflows/basic-eval.yml
@ -26,5 +26,6 @@ jobs:
        # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
        name: nixpkgs-ci
        signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
+    - run: nix --experimental-features 'nix-command flakes' flake check --all-systems --no-build
    # explicit list of supportedSystems is needed until aarch64-darwin becomes part of the trunk jobset
    - run: nix-build pkgs/top-level/release.nix -A release-checks --arg supportedSystems '[ "aarch64-darwin" "aarch64-linux" "x86_64-linux" "x86_64-darwin"  ]'
--- a/third_party/nixpkgs/CONTRIBUTING.md
+++ b/third_party/nixpkgs/CONTRIBUTING.md
@ -615,6 +615,11 @@ Names of files and directories should be in lowercase, with dashes between words
  As an exception, an explicit conditional expression with null can be used when fixing a important bug without triggering a mass rebuild.
  If this is done a follow up pull request _should_ be created to change the code to `lib.optional(s)`.

+# Practical contributing advice
+
+To contribute effectively and efficiently, you need to be aware of how the contributing process generally works.
+This section aims to document the process as we live it in Nixpkgs to set expectations right and give practical tips on how to work with it.
+
 ## I opened a PR, how do I get it merged?
 [i-opened-a-pr-how-do-i-get-it-merged]:#i-opened-a-pr-how-do-i-get-it-merged

--- a/third_party/nixpkgs/ci/OWNERS
+++ b/third_party/nixpkgs/ci/OWNERS
@ -27,7 +27,7 @@

 # Libraries
 /lib                        @infinisil
-/lib/systems                @alyssais @ericson2314
+/lib/systems                @alyssais @ericson2314 @NixOS/stdenv
 /lib/generators.nix         @infinisil @Profpatsch
 /lib/cli.nix                @infinisil @Profpatsch
 /lib/debug.nix              @infinisil @Profpatsch
@ -49,10 +49,10 @@
 /pkgs/top-level/splice.nix                       @Ericson2314
 /pkgs/top-level/release-cross.nix                @Ericson2314
 /pkgs/top-level/by-name-overlay.nix              @infinisil @philiptaron
-/pkgs/stdenv                                     @philiptaron
-/pkgs/stdenv/generic                             @Ericson2314
-/pkgs/stdenv/generic/check-meta.nix              @Ericson2314
-/pkgs/stdenv/cross                               @Ericson2314
+/pkgs/stdenv                                     @philiptaron @NixOS/stdenv
+/pkgs/stdenv/generic                             @Ericson2314 @NixOS/stdenv
+/pkgs/stdenv/generic/check-meta.nix              @Ericson2314 @NixOS/stdenv
+/pkgs/stdenv/cross                               @Ericson2314 @NixOS/stdenv
 /pkgs/build-support                              @philiptaron
 /pkgs/build-support/cc-wrapper                   @Ericson2314
 /pkgs/build-support/bintools-wrapper             @Ericson2314
@ -179,7 +179,7 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @NixOS/nix-team @raitobeza

 # C compilers
 /pkgs/development/compilers/gcc
-/pkgs/development/compilers/llvm @alyssais @RossComputerGuy
+/pkgs/development/compilers/llvm @alyssais @RossComputerGuy @NixOS/llvm
 /pkgs/development/compilers/emscripten @raitobezarius
 /doc/languages-frameworks/emscripten.section.md @raitobezarius

@ -351,6 +351,7 @@ pkgs/by-name/fo/forgejo/                @adamcstephens @bendlas @emilylange
 /pkgs/build-support/node/build-npm-package      @winterqt
 /pkgs/build-support/node/fetch-npm-deps         @winterqt
 /doc/languages-frameworks/javascript.section.md @winterqt
+/pkgs/development/tools/pnpm                    @Scrumplex @gepbird

 # OCaml
 /pkgs/build-support/ocaml           @ulrikstrid
--- a/third_party/nixpkgs/doc/hooks/cmake.section.md
+++ b/third_party/nixpkgs/doc/hooks/cmake.section.md
@ -1,3 +1,35 @@
 # cmake {#cmake}

-Overrides the default configure phase to run the CMake command. By default, we use the Make generator of CMake. In addition, dependencies are added automatically to `CMAKE_PREFIX_PATH` so that packages are correctly detected by CMake. Some additional flags are passed in to give similar behavior to configure-based packages. You can disable this hook’s behavior by setting `configurePhase` to a custom value, or by setting `dontUseCmakeConfigure`. `cmakeFlags` controls flags passed only to CMake. By default, parallel building is enabled as CMake supports parallel building almost everywhere. When Ninja is also in use, CMake will detect that and use the ninja generator.
+Overrides the default configure phase to run the CMake command.
+
+By default, we use the Make generator of CMake.
+But when Ninja is also available as a `nativeBuildInput`, this setup hook will detect that and use the ninja generator.
+
+Dependencies are added automatically to `CMAKE_PREFIX_PATH` so that packages are correctly detected by CMake.
+Some additional flags are passed in to give similar behavior to configure-based packages.
+
+By default, parallel building is enabled as CMake supports parallel building almost everywhere.
+
+You can disable this hook’s behavior by setting `configurePhase` to a custom value, or by setting `dontUseCmakeConfigure`.
+
+## Variables controlling CMake {#cmake-variables-controlling}
+
+### CMake Exclusive Variables {#cmake-exclusive-variables}
+
+#### `cmakeFlags` {#cmake-flags}
+
+Controls the flags passed to `cmake setup` during configure phase.
+
+#### `cmakeBuildDir` {#cmake-build-dir}
+
+Directory where CMake will put intermediate files.
+
+Setting this can be useful for debugging multiple CMake builds while in the same source directory, for example, when building for different platforms.
+Different values for each build will prevent build artefacts from interefering with each other.
+This setting has no tangible effect when running the build in a sandboxed derivation.
+
+The default value is `build`.
+
+#### `dontUseCmakeConfigure` {#dont-use-cmake-configure}
+
+When set to true, don't use the predefined `cmakeConfigurePhase`.
--- a/third_party/nixpkgs/doc/languages-frameworks/gnome.section.md
+++ b/third_party/nixpkgs/doc/languages-frameworks/gnome.section.md
@ -155,9 +155,11 @@ There are no schemas available in `XDG_DATA_DIRS`. Temporarily add a random pack

 Package is missing some GSettings schemas. You can find out the package containing the schema with `nix-locate org.gnome.foo.gschema.xml` and let the hooks handle the wrapping as [above](#ssec-gnome-common-issues-no-schemas).

-### When using `wrapGApps*` hook with special derivers you can end up with double wrapped binaries. {#ssec-gnome-common-issues-double-wrapped}
+### When using `wrapGApps*` hook with special derivers or hooks you can end up with double wrapped binaries. {#ssec-gnome-common-issues-double-wrapped}

-This is because derivers like `python.pkgs.buildPythonApplication` or `qt5.mkDerivation` have setup-hooks automatically added that produce wrappers with makeWrapper. The simplest way to workaround that is to disable the `wrapGApps*` hook automatic wrapping with `dontWrapGApps = true;` and pass the arguments it intended to pass to makeWrapper to another.
+This is because some setup hooks like `qt6.wrapQtAppsHook` also wrap programs using `makeWrapper`.  Likewise, some derivers (e.g. `python.pkgs.buildPythonApplication`) automatically pull in their own setup hooks that produce wrappers.
+
+The simplest workaround is to disable the `wrapGApps*` hook's automatic wrapping using `dontWrapGApps = true;` while passing its `makeWrapper` arguments to another wrapper.

 In the case of a Python application it could look like:

@ -184,19 +186,19 @@ python3.pkgs.buildPythonApplication {
 And for a QT app like:

 ```nix
-mkDerivation {
+stdenv.mkDerivation {
  pname = "calibre";
  version = "3.47.0";

  nativeBuildInputs = [
    wrapGAppsHook3
+    qt6.wrapQtAppsHook
    qmake
    # ...
  ];

  dontWrapGApps = true;

-  # Arguments to be passed to `makeWrapper`, only used by qt5’s mkDerivation
  preFixup = ''
    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
  '';
--- a/third_party/nixpkgs/doc/languages-frameworks/vim.section.md
+++ b/third_party/nixpkgs/doc/languages-frameworks/vim.section.md
@ -232,6 +232,19 @@ To add a new plugin, run `nix-shell -p vimPluginsUpdater --run 'vim-plugins-upda

 Finally, there are some plugins that are also packaged in nodePackages because they have Javascript-related build steps, such as running webpack. Those plugins are not listed in `vim-plugin-names` or managed by `vimPluginsUpdater` at all, and are included separately in `overrides.nix`. Currently, all these plugins are related to the `coc.nvim` ecosystem of the Language Server Protocol integration with Vim/Neovim.

+### Testing Neovim plugins {#testing-neovim-plugins}
+
+`nvimRequireCheck=MODULE` is a simple test which checks if Neovim can requires the lua module `MODULE` without errors. This is often enough to catch missing dependencies.
+
+This can be manually added through plugin definition overrides in the [overrides.nix](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/overrides.nix).
+
+```nix
+  gitsigns-nvim = super.gitsigns-nvim.overrideAttrs {
+    dependencies = [ self.plenary-nvim ];
+    nvimRequireCheck = "gitsigns";
+  };
+```
+
 ### Plugin optional configuration {#vim-plugin-required-snippet}

 Some plugins require specific configuration to work. We choose not to
--- a/third_party/nixpkgs/doc/stdenv/cross-compilation.chapter.md
+++ b/third_party/nixpkgs/doc/stdenv/cross-compilation.chapter.md
@ -181,6 +181,31 @@ Example of an error which this fixes.

 `[Errno 8] Exec format error: './gdk3-scan'`

+#### Using `-static` outside a `isStatic` platform. {#cross-static-on-non-static-platform}
+
+Add `stdenv.cc.libc.static` (static output of glibc) to `buildInputs` conditionally on if `hostPlatform` uses `glibc`.
+
+
+e.g.
+
+```nix
+{
+  buildInputs = lib.optionals (stdenv.hostPlatform.libc == "glibc") [ stdenv.cc.libc.static ];
+}
+```
+
+Examples of errors which this fixes.
+
+`cannot find -lm: No such file or directory`
+
+`cannot find -lc: No such file or directory`
+
+::: {.note}
+At the time of writing it is assumed the issue only happens on `glibc` because it splits the static libraries in to a different output.
+
+::: {.note}
+You may want to look in to using `stdenvAdapters.makeStatic` or `pkgsStatic` or a `isStatic = true` platform.
+
 ## Cross-building packages {#sec-cross-usage}

 Nixpkgs can be instantiated with `localSystem` alone, in which case there is no cross-compiling and everything is built by and for that system, or also with `crossSystem`, in which case packages run on the latter, but all building happens on the former. Both parameters take the same schema as the 3 (build, host, and target) platforms defined in the previous section. As mentioned above, `lib.systems.examples` has some platforms which are used as arguments for these parameters in practice. You can use them programmatically, or on the command line:
--- a/third_party/nixpkgs/doc/stdenv/multiple-output.chapter.md
+++ b/third_party/nixpkgs/doc/stdenv/multiple-output.chapter.md
@ -21,7 +21,7 @@ In the Nix language the individual outputs can be reached explicitly as attribut

 When a multiple-output derivation gets into a build input of another derivation, the `dev` output is added if it exists, otherwise the first output is added. In addition to that, `propagatedBuildOutputs` of that package which by default contain `$outputBin` and `$outputLib` are also added. (See [](#multiple-output-file-type-groups).)

-In some cases it may be desirable to combine different outputs under a single store path. A function `symlinkJoin` can be used to do this. (Note that it may negate some closure size benefits of using a multiple-output package.)
+In some cases it may be desirable to combine different outputs under a single store path. The `symlinkJoin` builder can be used to do this. (See [](#trivial-builder-symlinkJoin)). Note that this may negate some closure size benefits of using a multiple-output package.

 ## Writing a split derivation {#sec-multiple-outputs-}

--- a/third_party/nixpkgs/flake.nix
+++ b/third_party/nixpkgs/flake.nix
@ -80,8 +80,17 @@

      checks = forAllSystems (system: {
        tarball = jobs.${system}.tarball;
+      } // lib.optionalAttrs
+        (
+          self.legacyPackages.${system}.stdenv.hostPlatform.isLinux
          # Exclude power64 due to "libressl is not available on the requested hostPlatform" with hostPlatform being power64
-      } // lib.optionalAttrs (self.legacyPackages.${system}.stdenv.hostPlatform.isLinux && !self.legacyPackages.${system}.targetPlatform.isPower64) {
+          && !self.legacyPackages.${system}.targetPlatform.isPower64
+          # Exclude armv6l-linux due to "cannot bootstrap GHC on this platform ('armv6l-linux' with libc 'defaultLibc')"
+          && system != "armv6l-linux"
+          # Exclude riscv64-linux due to "cannot bootstrap GHC on this platform ('riscv64-linux' with libc 'defaultLibc')"
+          && system != "riscv64-linux"
+        )
+      {
        # Test that ensures that the nixosSystem function can accept a lib argument
        # Note: prefer not to extend or modify `lib`, especially if you want to share reusable modules
        #       alternatives include: `import` a file, or put a custom library in an option or in `_module.args.<libname>`
@ -111,7 +120,17 @@
        }).nixos.manual;
      };

-      devShells = forAllSystems (system: {
+      devShells = forAllSystems (system:
+        { } // lib.optionalAttrs
+          (
+            # Exclude armv6l-linux because "Package ‘ghc-9.6.6’ in .../pkgs/development/compilers/ghc/common-hadrian.nix:579 is not available on the requested hostPlatform"
+            system != "armv6l-linux"
+            # Exclude riscv64-linux because "Package ‘ghc-9.6.6’ in .../pkgs/development/compilers/ghc/common-hadrian.nix:579 is not available on the requested hostPlatform"
+            && system != "riscv64-linux"
+            # Exclude FreeBSD because "Package ‘ghc-9.6.6’ in .../pkgs/development/compilers/ghc/common-hadrian.nix:579 is not available on the requested hostPlatform"
+            && !self.legacyPackages.${system}.stdenv.hostPlatform.isFreeBSD
+          )
+        {
          /** A shell to get tooling for Nixpkgs development. See nixpkgs/shell.nix. */
          default = import ./shell.nix { inherit system; };
        });
--- a/third_party/nixpkgs/maintainers/maintainer-list.nix
+++ b/third_party/nixpkgs/maintainers/maintainer-list.nix
@ -662,6 +662,13 @@
    githubId = 4296804;
    name = "Alex Franchuk";
  };
+  aftix = {
+    name = "Wyatt Campbell";
+    email = "aftix@aftix.xyz";
+    matrix = "@aftix:matrix.org";
+    github = "aftix";
+    githubId = 4008299;
+  };
  agbrooks = {
    email = "andrewgrantbrooks@gmail.com";
    github = "agbrooks";
@ -1708,6 +1715,12 @@
    githubId = 718812;
    name = "Antoine R. Dumont";
  };
+  areif-dev = {
+    email = "aj@ajreifsnyder.com";
+    github = "areif-dev";
+    githubId = 53097078;
+    name = "AJ Reifsnyder";
+  };
  arezvov = {
    email = "alex@rezvov.ru";
    github = "arezvov";
@ -1804,6 +1817,13 @@
    githubId = 338268;
    name = "Alexei Robyn";
  };
+  artem = {
+    email = "a@pelenitsyn.top";
+    github = "ulysses4ever";
+    githubId = 6832600;
+    name = "Artem Pelenitsyn";
+    matrix = "@artem.types:matrix.org";
+  };
  artemist = {
    email = "me@artem.ist";
    github = "artemist";
@ -2328,6 +2348,12 @@
    githubId = 18467667;
    name = "Alexander Bantyev";
  };
+  balssh = {
+    email = "george.bals25@gmail.com";
+    github = "balssh";
+    githubId = 82440615;
+    name = "George Bals";
+  };
  bananad3v = {
    email = "banana@banana.is-cool.dev";
    github = "BANanaD3V";
@ -2996,6 +3022,12 @@
    githubId = 68566724;
    name = "bootstrap-prime";
  };
+  booxter = {
+    email = "ihar.hrachyshka@gmail.com";
+    github = "booxter";
+    githubId = 90200;
+    name = "Ihar Hrachyshka";
+  };
  boozedog = {
    email = "code@booze.dog";
    github = "boozedog";
@ -3823,6 +3855,12 @@
    github = "CHN-beta";
    githubId = 35858462;
  };
+  cholli = {
+    email = "christoph.hollizeck@hey.com";
+    github = "Daholli";
+    githubId = 25060097;
+    name = "Christoph Hollizeck";
+  };
  choochootrain = {
    email = "hurshal@imap.cc";
    github = "choochootrain";
@ -6511,6 +6549,13 @@
    githubId = 46724898;
    name = "Erik Backman";
  };
+  erikeah = {
+    email = "erikeah@protonmail.com";
+    github = "erikeah";
+    githubId = 11900869;
+    keys = [ { fingerprint = "4142 0380 C7F8 BCDA CC9E  7ABA 0FF3 076B 71F2 5DEF"; } ];
+    name = "Erik Alonso";
+  };
  erikryb = {
    email = "erik.rybakken@math.ntnu.no";
    github = "erikryb";
@ -7608,6 +7653,12 @@
    githubId = 91987;
    name = "Jim Garrison";
  };
+  garyguo = {
+    email = "gary@garyguo.net";
+    github = "nbdd0121";
+    githubId = 4065244;
+    name = "Gary Guo";
+  };
  gavin = {
    email = "gavin.rogers@holo.host";
    github = "gavinrogers";
@ -7853,6 +7904,17 @@
    githubId = 15957973;
    name = "Jeffry Molanus";
  };
+  gileri = {
+    email = "s@linuxw.info";
+    github = "gileri";
+    githubId = 493438;
+    name = "Éric Gillet";
+    keys = [
+      {
+        fingerprint = "E478 85DC 8F33 FA86 D3FC  183D 80A8 14DB 8ED5 70BC";
+      }
+    ];
+  };
  gilice = {
    email = "gilice@proton.me";
    github = "gilice";
@ -8182,7 +8244,8 @@
    email = "guanran928@outlook.com";
    github = "Guanran928";
    githubId = 68757440;
-    name = "Guanran928";
+    name = "Guanran Wang";
+    keys = [ { fingerprint = "7835 BC13 4560 0660 0448  5A2C 91F9 7D9E D126 39CF"; } ];
  };
  guekka = {
    github = "Guekka";
@ -8882,6 +8945,12 @@
    githubId = 6109326;
    name = "David Hummel";
  };
+  husjon = {
+    name = "Jon Erling Hustadnes";
+    email = "jonerling.hustadnes+nixpkgs@gmail.com";
+    github = "husjon";
+    githubId = 554229;
+  };
  husky = {
    email = "husky@husky.sh";
    github = "huskyistaken";
@ -9424,6 +9493,12 @@
    githubId = 1318743;
    name = "Ivar";
  };
+  ivyfanchiang = {
+    email = "dev@ivyfanchiang.ca";
+    github = "hexadecimalDinosaur";
+    githubId = 36890802;
+    name = "Ivy Fan-Chiang";
+  };
  iwanb = {
    email = "tracnar@gmail.com";
    github = "iwanb";
@ -10746,6 +10821,12 @@
    githubId = 79042825;
    name = "Jan Kremer";
  };
+  JulianFP = {
+    name = "Julian Partanen";
+    github = "JulianFP";
+    githubId = 70963316;
+    keys = [ { fingerprint = "C61D 7747 43DE EF05 4E4A  3AC1 6FE2 79EB 5C9F 3466"; } ];
+  };
  juliendehos = {
    email = "dehos@lisic.univ-littoral.fr";
    github = "juliendehos";
@ -11489,6 +11570,12 @@
    githubId = 17219127;
    name = "kotatsuyaki";
  };
+  kototama = {
+    email = "kototama@posteo.net";
+    github = "kototama";
+    githubId = 128620;
+    name = "Kototama";
+  };
  kouyk = {
    email = "skykinetic@stevenkou.xyz";
    github = "kouyk";
@ -12668,6 +12755,12 @@
    githubId = 26020062;
    name = "lumi";
  };
+  luna_1024 = {
+    email = "contact@luna.computer";
+    github = "luna-1024";
+    githubId = 7243615;
+    name = "Luna";
+  };
  lunarequest = {
    email = "nullarequest@vivlaid.net";
    github = "Lunarequest";
@ -13667,6 +13760,12 @@
    githubId = 1215331;
    name = "Matt Melling";
  };
+  melon = {
+    email = "melontime05@gmail.com";
+    github = "BlaiZephyr";
+    githubId = 101197249;
+    name = "Tim";
+  };
  melsigl = {
    email = "melanie.bianca.sigl@gmail.com";
    github = "melsigl";
@ -14489,6 +14588,12 @@
    name = "Arthur Outhenin-Chalandre";
    githubId = 3845213;
  };
+  mrgiles = {
+    email = "marcelogiles@gmail.com";
+    github = "mrgiles";
+    githubId = 4009450;
+    name = "Marcelo Giles";
+  };
  mrityunjaygr8 = {
    email = "mrityunjaysaxena1996@gmail.com";
    github = "mrityunjaygr8";
@ -15270,12 +15375,6 @@
    github = "niklaskorz";
    githubId = 590517;
  };
-  NikolaMandic = {
-    email = "nikola@mandic.email";
-    github = "NikolaMandic";
-    githubId = 4368690;
-    name = "Ratko Mladic";
-  };
  nikstur = {
    email = "nikstur@outlook.com";
    name = "nikstur";
@ -15850,6 +15949,12 @@
    githubId = 72201;
    name = "Ole Jørgen Brønner";
  };
+  olifloof = {
+    email = "benmoreosm@gmail.com";
+    github = "olifloof";
+    githubId = 35699052;
+    name = "oli";
+  };
  oliver-koss = {
    email = "oliver.koss06@gmail.com";
    github = "oliver-koss";
@ -16163,6 +16268,12 @@
    githubId = 10776658;
    name = "Patrick Gordon";
  };
+  paepcke = {
+    email = "git@paepcke.de";
+    github = "paepckehh";
+    githubId = 120342602;
+    name = "Michael Paepcke";
+  };
  paholg = {
    email = "paho@paholg.com";
    github = "paholg";
@ -16546,6 +16657,13 @@
    githubId = 28323;
    name = "Peter Simons";
  };
+  petrkozorezov = {
+    email = "petr.kozorezov@gmail.com";
+    github = "petrkozorezov";
+    githubId = 645017;
+    name = "Petr Kozorezov";
+    keys = [ { fingerprint = "7F1A 353D 3D6D 9CEF 63A9  B5C6 699F 32D5 9999 7C90"; } ];
+  };
  petrosagg = {
    email = "petrosagg@gmail.com";
    github = "petrosagg";
@ -16774,12 +16892,6 @@
    name = "Jelle Besseling";
    keys = [ { fingerprint = "A3A3 65AE 16ED A7A0 C29C  88F1 9712 452E 8BE3 372E"; } ];
  };
-  pinkcreeper100 = {
-    email = "benmoreosm@gmail.com";
-    github = "pinkcreeper100";
-    githubId = 35699052;
-    name = "Oliver Samuel Morris";
-  };
  pinpox = {
    email = "mail@pablo.tools";
    github = "pinpox";
@ -18291,7 +18403,7 @@
  };
  rnhmjoj = {
    email = "rnhmjoj@inventati.org";
-    matrix = "@rnhmjoj:maxwell.ydns.eu";
+    matrix = "@rnhmjoj:eurofusion.eu";
    github = "rnhmjoj";
    githubId = 2817565;
    name = "Michele Guerini Rocco";
@ -18709,6 +18821,12 @@
    githubId = 141248;
    name = "Ramses";
  };
+  rvfg = {
+    email = "i@rvf6.com";
+    github = "duament";
+    githubId = 30264485;
+    name = "Rvfg";
+  };
  rvl = {
    email = "dev+nix@rodney.id.au";
    github = "rvl";
@ -20004,6 +20122,12 @@
    githubId = 7091399;
    keys = [ { fingerprint = "897E 6BE3 0345 B43D CADD  05B7 290F CF08 1AED B3EC"; } ];
  };
+  smonson = {
+    name = "Samuel Monson";
+    email = "smonson@irbash.net";
+    github = "sjmonson";
+    githubId = 17662218;
+  };
  smrehman = {
    name = "Syed Moiz Ur Rehman";
    email = "smrehman@proton.me";
--- a/third_party/nixpkgs/maintainers/team-list.nix
+++ b/third_party/nixpkgs/maintainers/team-list.nix
@ -963,6 +963,21 @@ with lib.maintainers;
    shortName = "Serokell employees";
  };

+  stdenv = {
+    members = [
+      artturin
+      emily
+      ericson2314
+      philiptaron
+      reckenrode
+      RossComputerGuy
+    ];
+    scope = "Maintain the standard environment and its surrounding logic.";
+    shortName = "stdenv";
+    enableFeatureFreezePing = true;
+    githubTeams = [ "stdenv" ];
+  };
+
  steam = {
    members = [
      atemu
--- a/third_party/nixpkgs/nixos/doc/manual/configuration/wayland.chapter.md
+++ b/third_party/nixpkgs/nixos/doc/manual/configuration/wayland.chapter.md
@ -18,14 +18,9 @@ This installs the sway compositor along with some essential utilities.
 Now you can start sway from the TTY console.

 If you are using a wlroots-based compositor, like sway, and want to be
-able to share your screen, you might want to activate this option:
-
-```nix
-{
-  xdg.portal.wlr.enable = true;
-}
-```
-
-and configure Pipewire using
+able to share your screen, make sure to configure Pipewire using
 [](#opt-services.pipewire.enable)
 and related options.
+
+For more helpful tips and tricks, see the
+[wiki page about Sway](https://wiki.nixos.org/wiki/Sway).
--- a/third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2405.section.md
@ -201,6 +201,8 @@ The pre-existing `services.ankisyncd` has been marked deprecated and will be dro

 - [watchdogd](https://troglobit.com/projects/watchdogd/), a system and process supervisor using watchdog timers. Available as [services.watchdogd](#opt-services.watchdogd.enable).

+- [WiVRn](https://github.com/Meumeu/WiVRn), an OpenXR streaming application. Available as [services.wivrn](#opt-services.wivrn.enable).
+
 - [Workout-tracker](https://github.com/jovandeginste/workout-tracker), a workout tracking web application for personal use.

 - [wyoming-satellite](https://github.com/rhasspy/wyoming-satellite), a voice assistant satellite for Home Assistant using the Wyoming protocol. Available as [services.wyoming.satellite](#opt-services.wyoming.satellite.enable).
--- a/third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2411.section.md
@ -73,6 +73,8 @@

 ## New Modules {#sec-release-24.11-new-modules}

+- [Cyrus IMAP](https://github.com/cyrusimap/cyrus-imapd), an email, contacts and calendar server. Available as [services.cyrus-imap](#opt-services.cyrus-imap.enable) service.
+
 - [TaskChampion Sync-Server](https://github.com/GothenburgBitFactory/taskchampion-sync-server), a [Taskwarrior 3](https://taskwarrior.org/docs/upgrade-3/) sync server, replacing Taskwarrior 2's sync server named [`taskserver`](https://github.com/GothenburgBitFactory/taskserver).

 - [FlareSolverr](https://github.com/FlareSolverr/FlareSolverr), proxy server to bypass Cloudflare protection. Available as [services.flaresolverr](#opt-services.flaresolverr.enable) service.
@ -165,6 +167,9 @@
 - [chromadb](https://www.trychroma.com/), an open-source AI application
  database. Batteries included. Available as [services.chromadb](options.html#opt-services.chromadb.enable).

+- [bitmagnet](https://bitmagnet.io/), A self-hosted BitTorrent indexer, DHT crawler, content classifier and torrent search engine with web UI, GraphQL API and Servarr stack integration.
+  Available as [services.bitmagnet](options.html#opt-services.bitmagnet.enable).
+
 - [Wakapi](https://wakapi.dev/), a time tracking software for programmers. Available as [services.wakapi](#opt-services.wakapi.enable).

 - [foot](https://codeberg.org/dnkl/foot), a fast, lightweight and minimalistic Wayland terminal emulator. Available as [programs.foot](#opt-programs.foot.enable).
@ -267,6 +272,8 @@

 - The logrotate service has received hardening and now requires enabling `allowNetworking`, if logrotate needs to access the network.

+- `mautrix-whatsapp` has been updated to version 0.11.0, which is a major rewrite of the bridge. Config file changes are required.
+
 - qBittorrent has been updated to major version 5, which drops support for Qt 5.
  The `qbittorrent-qt5` package has been removed.

@ -355,6 +362,16 @@

 - `services.pgbouncer` systemd service is configured with `Type=notify-reload` and allows reloading configuration without process restart. PgBouncer configuration options were moved to the free-form type option named [`services.pgbouncer.settings`](#opt-services.pgbouncer.settings) according to the NixOS RFC 0042.

+- `nodePackages.coc-metals` was removed due to being deprecated upstream.
+  `vimPlugins.nvim-metals` is its official replacement.
+
+- `matrix-sliding-sync` was removed because it has been replaced by the simplified sliding sync functionality introduced in matrix-synapse 114.0.
+
+- `nodePackages.coc-tslint`, `vimPlugins.coc-tslint`, `nodePackages.coc-tslint-plugin`,
+  and `vimPlugins.coc-tslint-plugin` were removed due to being deprecated upstream. The
+  `nodePackages.coc-eslint` and `vimPlugins.coc-eslint` packages offer comparable
+  features for `eslint`, which replaced `tslint`.
+
 - `teleport` has been upgraded from major version 15 to major version 16.
  Refer to upstream [upgrade instructions](https://goteleport.com/docs/management/operations/upgrading/)
  and [release notes for v16](https://goteleport.com/docs/changelog/#1600-061324).
@ -506,6 +523,10 @@

 - `services.mautrix-meta` was updated to [0.4](https://github.com/mautrix/meta/releases/tag/v0.4.0). This release makes significant changes to the settings format. If you have custom settings you should migrate them to the new format. Unfortunately upstream provides little guidance for how to do this, but [the auto-migration code](https://github.com/mautrix/meta/blob/f5440b05aac125b4c95b1af85635a717cbc6dd0e/cmd/mautrix-meta/legacymigrate.go#L23) may serve as a useful reference. The NixOS module should warn you if you still have any old settings configured.

+- The `nodePackages.shout` package has been removed because it was deprecated upstream in favor of `thelounge`.
+  The `shout` top-level attribute was an alias to this package.
+  The associated `services.shout` module has also been removed.
+
 - The `indi-full` package no longer contains non-free drivers.
  To get the old collection of drivers use `indi-full-nonfree` or create your own collection of drivers by overriding indi-with-drivers.
  E.g.: `pkgs.indi-with-drivers.override {extraDrivers = with pkgs.indi-3rdparty; [indi-gphoto];}`
@ -717,6 +738,8 @@
  This saves UPS battery and ensures that host(s) get back up again when power comes back, even in the scenario when the UPS would have had enough capacity to keep power on during the whole power outage.
  If you like the old behaviour of keeping the UPSs on (and emptying the battery) after the host(s) have shut down, and risk not getting a power cycle event to get the host(s) back up, set `power.ups.upsmon.settings.POWERDOWNFLAG = null;`.

+- `nixos-firewall-tool` now supports nftables in addition to iptables and is installed by default when NixOS firewall is enabled.
+
 - Support for *runner registration tokens* has been [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/380872)
  in `gitlab-runner` 15.6 and is expected to be removed in `gitlab-runner` 18.0. Configuration of existing runners
  should be changed to using *runner authentication tokens* by configuring
--- a/third_party/nixpkgs/nixos/modules/misc/ids.nix
+++ b/third_party/nixpkgs/nixos/modules/misc/ids.nix
@ -236,7 +236,7 @@ in
      riemanntools = 203;
      subsonic = 204;
      # riak = 205; # unused, remove 2022-07-22
-      #shout = 206; # dynamically allocated as of 2021-09-18
+      #shout = 206; # dynamically allocated as of 2021-09-18, module removed 2024-10-19
      gateone = 207;
      namecoin = 208;
      #lxd = 210; # unused
--- a/third_party/nixpkgs/nixos/modules/module-list.nix
+++ b/third_party/nixpkgs/nixos/modules/module-list.nix
@ -593,6 +593,7 @@
  ./services/hardware/irqbalance.nix
  ./services/hardware/joycond.nix
  ./services/hardware/kanata.nix
+  ./services/hardware/kmonad.nix
  ./services/hardware/lcd.nix
  ./services/hardware/libinput.nix
  ./services/hardware/lirc.nix
@ -660,6 +661,7 @@
  ./services/logging/ulogd.nix
  ./services/mail/automx2.nix
  ./services/mail/clamsmtp.nix
+  ./services/mail/cyrus-imap.nix
  ./services/mail/davmail.nix
  ./services/mail/dkimproxy-out.nix
  ./services/mail/dovecot.nix
@ -709,7 +711,6 @@
  ./services/matrix/mjolnir.nix
  ./services/matrix/mx-puppet-discord.nix
  ./services/matrix/pantalaimon.nix
-  ./services/matrix/matrix-sliding-sync.nix
  ./services/matrix/synapse.nix
  ./services/misc/airsonic.nix
  ./services/misc/amazon-ssm-agent.nix
@ -1204,7 +1205,6 @@
  ./services/networking/shellhub-agent.nix
  ./services/networking/shorewall.nix
  ./services/networking/shorewall6.nix
-  ./services/networking/shout.nix
  ./services/networking/sing-box.nix
  ./services/networking/sitespeed-io.nix
  ./services/networking/skydns.nix
@ -1359,6 +1359,7 @@
  ./services/system/uptimed.nix
  ./services/system/userborn.nix
  ./services/system/zram-generator.nix
+  ./services/torrent/bitmagnet.nix
  ./services/torrent/deluge.nix
  ./services/torrent/flexget.nix
  ./services/torrent/flood.nix
@ -1379,6 +1380,7 @@
  ./services/video/photonvision.nix
  ./services/video/mediamtx.nix
  ./services/video/v4l2-relayd.nix
+  ./services/video/wivrn.nix
  ./services/wayland/cage.nix
  ./services/wayland/hypridle.nix
  ./services/web-apps/akkoma.nix
@ -1469,6 +1471,7 @@
  ./services/web-apps/netbox.nix
  ./services/web-apps/nextcloud.nix
  ./services/web-apps/nextcloud-notify_push.nix
+  ./services/web-apps/nextcloud-whiteboard-server.nix
  ./services/web-apps/nextjs-ollama-llm-ui.nix
  ./services/web-apps/nexus.nix
  ./services/web-apps/nifi.nix
--- a/third_party/nixpkgs/nixos/modules/rename.nix
+++ b/third_party/nixpkgs/nixos/modules/rename.nix
@ -87,6 +87,7 @@ in
    (mkRemovedOptionModule [ "services" "mailpile" ] "The corresponding package was removed from nixpkgs.")
    (mkRemovedOptionModule [ "services" "marathon" ] "The corresponding package was removed from nixpkgs.")
    (mkRemovedOptionModule [ "services" "mathics" ] "The Mathics module has been removed")
+    (mkRemovedOptionModule [ "services" "matrix-sliding-sync" ] "The matrix-sliding-sync package has been removed, since matrix-synapse incorporated its functionality")
    (mkRemovedOptionModule [ "services" "meguca" ] "Use meguca has been removed from nixpkgs")
    (mkRemovedOptionModule [ "services" "mesos" ] "The corresponding package was removed from nixpkgs.")
    (mkRemovedOptionModule [ "services" "mxisd" ] "The mxisd module has been removed as both mxisd and ma1sd got removed.")
@ -102,6 +103,7 @@ in
    (mkRemovedOptionModule [ "services" "railcar" ] "the corresponding package has been removed from nixpkgs")
    (mkRemovedOptionModule [ "services" "replay-sorcery" ] "the corresponding package has been removed from nixpkgs as it is unmaintained upstream. Consider using `gpu-screen-recorder` or `obs-studio` instead.")
    (mkRemovedOptionModule [ "services" "seeks" ] "")
+    (mkRemovedOptionModule [ "services" "shout" ] "shout was removed because it was deprecated upstream in favor of thelounge.")
    (mkRemovedOptionModule [ "services" "ssmtp" ] ''
      The ssmtp package and the corresponding module have been removed due to
      the program being unmaintained. The options `programs.msmtp.*` can be
--- a/third_party/nixpkgs/nixos/modules/security/pam.nix
+++ b/third_party/nixpkgs/nixos/modules/security/pam.nix
@ -1168,8 +1168,7 @@ in

          If set, users can authenticate with their Kerberos password.
          This requires a valid Kerberos configuration
-          (`config.security.krb5.enable` should be set to
-          `true`).
+          (`security.krb5.enable` should be set to `true`).

          Note that the Kerberos PAM modules are not necessary when using SSS
          to handle Kerberos authentication.
@ -1587,8 +1586,8 @@ in

    warnings = lib.optional
      (with config.security.pam.sshAgentAuth;
-        enable && lib.any (s: lib.hasPrefix "%h" s || lib.hasPrefix "~" s) authorizedKeysFiles)
-      ''config.security.pam.sshAgentAuth.authorizedKeysFiles contains files in the user's home directory.
+        enable && lib.any (s: lib.hasPrefix "%h" s || lib.hasPrefix "~" s) authorizedKeysFiles) ''
+        security.pam.sshAgentAuth.authorizedKeysFiles contains files in the user's home directory.

        Specifying user-writeable files there result in an insecure configuration:
        a malicious process can then edit such an authorized_keys file and bypass the ssh-agent-based authentication.
--- a/third_party/nixpkgs/nixos/modules/services/desktop-managers/plasma6.nix
+++ b/third_party/nixpkgs/nixos/modules/services/desktop-managers/plasma6.nix
@ -12,7 +12,7 @@

  activationScript = ''
    # will be rebuilt automatically
-    rm -fv $HOME/.cache/ksycoca*
+    rm -fv "$HOME/.cache/ksycoca"*
  '';
 in {
  options = {
@ -79,6 +79,7 @@ in {
        kio-fuse # fuse interface for KIO
        kpackage # provides kpackagetool tool
        kservice # provides kbuildsycoca6 tool
+        kunifiedpush # provides a background service and a KCM
        kwallet # provides helper service
        kwallet-pam # provides helper service
        kwalletmanager # provides KCMs and stuff
--- a/third_party/nixpkgs/nixos/modules/services/hardware/kmonad.nix
+++ b/third_party/nixpkgs/nixos/modules/services/hardware/kmonad.nix
@ -0,0 +1,190 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.kmonad;
+
+  # Per-keyboard options:
+  keyboard =
+    { name, ... }:
+    {
+      options = {
+        name = lib.mkOption {
+          type = lib.types.str;
+          example = "laptop-internal";
+          description = "Keyboard name.";
+        };
+
+        device = lib.mkOption {
+          type = lib.types.path;
+          example = "/dev/input/by-id/some-dev";
+          description = "Path to the keyboard's device file.";
+        };
+
+        extraGroups = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
+          description = ''
+            Extra permission groups to attach to the KMonad instance for
+            this keyboard.
+
+            Since KMonad runs as an unprivileged user, it may sometimes
+            need extra permissions in order to read the keyboard device
+            file.  If your keyboard's device file isn't in the input
+            group you'll need to list its group in this option.
+          '';
+        };
+
+        defcfg = {
+          enable = lib.mkEnableOption ''
+            Automatically generate the defcfg block.
+
+            When this is option is set to true the config option for
+            this keyboard should not include a defcfg block.
+          '';
+
+          compose = {
+            key = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              default = "ralt";
+              description = "The (optional) compose key to use.";
+            };
+
+            delay = lib.mkOption {
+              type = lib.types.int;
+              default = 5;
+              description = "The delay (in milliseconds) between compose key sequences.";
+            };
+          };
+
+          fallthrough = lib.mkEnableOption "Re-emit unhandled key events.";
+
+          allowCommands = lib.mkEnableOption "Allow keys to run shell commands.";
+        };
+
+        config = lib.mkOption {
+          type = lib.types.lines;
+          description = "Keyboard configuration.";
+        };
+      };
+
+      config = {
+        name = lib.mkDefault name;
+      };
+    };
+
+  # Create a complete KMonad configuration file:
+  mkCfg =
+    keyboard:
+    let
+      defcfg = ''
+        (defcfg
+          input  (device-file "${keyboard.device}")
+          output (uinput-sink "kmonad-${keyboard.name}")
+          ${
+            lib.optionalString (keyboard.defcfg.compose.key != null) ''
+              cmp-seq ${keyboard.defcfg.compose.key}
+              cmp-seq-delay ${toString keyboard.defcfg.compose.delay}
+            ''
+          }
+          fallthrough ${lib.boolToString keyboard.defcfg.fallthrough}
+          allow-cmd ${lib.boolToString keyboard.defcfg.allowCommands}
+        )
+      '';
+    in
+    pkgs.writeTextFile {
+      name = "kmonad-${keyboard.name}.cfg";
+      text = lib.optionalString keyboard.defcfg.enable (defcfg + "\n") + keyboard.config;
+      checkPhase = "${cfg.package}/bin/kmonad -d $out";
+    };
+
+  # Build a systemd path config that starts the service below when a
+  # keyboard device appears:
+  mkPath =
+    keyboard:
+    let
+      name = "kmonad-${keyboard.name}";
+    in
+    lib.nameValuePair name {
+      description = "KMonad trigger for ${keyboard.device}";
+      wantedBy = [ "paths.target" ];
+      pathConfig = {
+        Unit = "${name}.service";
+        PathExists = keyboard.device;
+      };
+    };
+
+  # Build a systemd service that starts KMonad:
+  mkService =
+    keyboard:
+    let
+      cmd = [
+        (lib.getExe cfg.package)
+        "--input"
+        ''device-file "${keyboard.device}"''
+      ] ++ cfg.extraArgs ++ [ "${mkCfg keyboard}" ];
+    in
+    lib.nameValuePair "kmonad-${keyboard.name}" {
+      description = "KMonad for ${keyboard.device}";
+      script = lib.escapeShellArgs cmd;
+      unitConfig = {
+        # Control rate limiting.
+        # Stop the restart logic if we restart more than
+        # StartLimitBurst times in a period of StartLimitIntervalSec.
+        StartLimitIntervalSec = 2;
+        StartLimitBurst = 5;
+      };
+      serviceConfig = {
+        Restart = "always";
+        # Restart at increasing intervals from 2s to 1m
+        RestartSec = 2;
+        RestartSteps = 30;
+        RestartMaxDelaySec = "1min";
+        Nice = -20;
+        DynamicUser = true;
+        User = "kmonad";
+        Group = "kmonad";
+        SupplementaryGroups = [
+          # These ensure that our dynamic user has access to the device node
+          config.users.groups.input.name
+          config.users.groups.uinput.name
+        ] ++ keyboard.extraGroups;
+      };
+    };
+in
+{
+  options.services.kmonad = {
+    enable = lib.mkEnableOption "KMonad: An advanced keyboard manager.";
+
+    package = lib.mkPackageOption pkgs "kmonad" { };
+
+    keyboards = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.submodule keyboard);
+      default = { };
+      description = "Keyboard configuration.";
+    };
+
+    extraArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      example = [
+        "--log-level"
+        "debug"
+      ];
+      description = "Extra arguments to pass to KMonad.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    hardware.uinput.enable = true;
+
+    systemd = {
+      paths = lib.mapAttrs' (_: mkPath) cfg.keyboards;
+      services = lib.mapAttrs' (_: mkService) cfg.keyboards;
+    };
+  };
+}
--- a/third_party/nixpkgs/nixos/modules/services/hardware/nvidia-container-toolkit/default.nix
+++ b/third_party/nixpkgs/nixos/modules/services/hardware/nvidia-container-toolkit/default.nix
@ -78,6 +78,11 @@
  };

  config = lib.mkIf config.hardware.nvidia-container-toolkit.enable {
+    assertions = [
+      { assertion = config.hardware.nvidia.datacenter.enable || lib.elem "nvidia" config.services.xserver.videoDrivers;
+        message = ''`nvidia-container-toolkit` requires nvidia datacenter or desktop drivers: set `hardware.nvidia.datacenter.enable` or add "nvidia" to `services.xserver.videoDrivers`'';
+      }];
+
    virtualisation.docker = {
      daemon.settings = lib.mkIf
        (lib.versionAtLeast config.virtualisation.docker.package.version "25") {
@ -130,9 +135,6 @@
      ]);
    };

-    services.xserver.videoDrivers = lib.mkIf
-      (!config.hardware.nvidia.datacenter.enable) [ "nvidia" ];
-
    systemd.services.nvidia-container-toolkit-cdi-generator = {
      description = "Container Device Interface (CDI) for Nvidia generator";
      wantedBy = [ "multi-user.target" ];
--- a/third_party/nixpkgs/nixos/modules/services/mail/cyrus-imap.nix
+++ b/third_party/nixpkgs/nixos/modules/services/mail/cyrus-imap.nix
@ -0,0 +1,379 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.services.cyrus-imap;
+  cyrus-imapdPkg = pkgs.cyrus-imapd;
+  inherit (lib)
+    mkEnableOption
+    mkIf
+    mkOption
+    optionalAttrs
+    optionalString
+    generators
+    mapAttrsToList
+    ;
+  inherit (lib.strings) concatStringsSep;
+  inherit (lib.types)
+    attrsOf
+    submodule
+    listOf
+    oneOf
+    str
+    int
+    bool
+    nullOr
+    path
+    ;
+
+  mkCyrusConfig =
+    settings:
+    let
+      mkCyrusOptionsList =
+        v:
+        mapAttrsToList (
+          p: q:
+          if (q != null) then
+            if builtins.isInt q then
+              "${p}=${builtins.toString q}"
+            else
+              "${p}=\"${if builtins.isList q then (concatStringsSep " " q) else q}\""
+          else
+            ""
+        ) v;
+      mkCyrusOptionsString = v: concatStringsSep " " (mkCyrusOptionsList v);
+    in
+    concatStringsSep "\n  " (mapAttrsToList (n: v: n + " " + (mkCyrusOptionsString v)) settings);
+
+  cyrusConfig = lib.concatStringsSep "\n" (
+    lib.mapAttrsToList (n: v: ''
+      ${n} {
+        ${mkCyrusConfig v}
+      }
+    '') cfg.cyrusSettings
+  );
+
+  imapdConfig =
+    with generators;
+    toKeyValue {
+      mkKeyValue = mkKeyValueDefault {
+        mkValueString =
+          v:
+          if builtins.isBool v then
+            if v then "yes" else "no"
+          else if builtins.isList v then
+            concatStringsSep " " v
+          else
+            mkValueStringDefault { } v;
+      } ": ";
+    } cfg.imapdSettings;
+in
+{
+  options.services.cyrus-imap = {
+    enable = mkEnableOption "Cyrus IMAP, an email, contacts and calendar server";
+    debug = mkEnableOption "debugging messages for the Cyrus master process";
+
+    listenQueue = mkOption {
+      type = int;
+      default = 32;
+      description = ''
+        Socket listen queue backlog size. See listen(2) for more information about a backlog.
+        Default is 32, which may be increased if you have a very high connection rate.
+      '';
+    };
+    tmpDBDir = mkOption {
+      type = path;
+      default = "/run/cyrus/db";
+      description = ''
+        Location where DB files are stored.
+        Databases in this directory are recreated upon startup, so ideally they should live in ephemeral storage for best performance.
+      '';
+    };
+    cyrusSettings = mkOption {
+      type = submodule {
+        freeformType = attrsOf (
+          attrsOf (oneOf [
+            bool
+            int
+            (listOf str)
+          ])
+        );
+        options = {
+          START = mkOption {
+            default = {
+              recover = {
+                cmd = [
+                  "ctl_cyrusdb"
+                  "-r"
+                ];
+              };
+            };
+            description = ''
+              This section lists the processes to run before any SERVICES are spawned.
+              This section is typically used to initialize databases.
+              Master itself will not startup until all tasks in START have completed, so put no blocking commands here.
+            '';
+          };
+          SERVICES = mkOption {
+            default = {
+              imap = {
+                cmd = [ "imapd" ];
+                listen = "imap";
+                prefork = 0;
+              };
+              pop3 = {
+                cmd = [ "pop3d" ];
+                listen = "pop3";
+                prefork = 0;
+              };
+              lmtpunix = {
+                cmd = [ "lmtpd" ];
+                listen = "/run/cyrus/lmtp";
+                prefork = 0;
+              };
+              notify = {
+                cmd = [ "notifyd" ];
+                listen = "/run/cyrus/notify";
+                proto = "udp";
+                prefork = 0;
+              };
+            };
+            description = ''
+              This section is the heart of the cyrus.conf file. It lists the processes that should be spawned to handle client connections made on certain Internet/UNIX sockets.
+            '';
+          };
+          EVENTS = mkOption {
+            default = {
+              tlsprune = {
+                cmd = [ "tls_prune" ];
+                at = 400;
+              };
+              delprune = {
+                cmd = [
+                  "cyr_expire"
+                  "-E"
+                  "3"
+                ];
+                at = 400;
+              };
+              deleteprune = {
+                cmd = [
+                  "cyr_expire"
+                  "-E"
+                  "4"
+                  "-D"
+                  "28"
+                ];
+                at = 430;
+              };
+              expungeprune = {
+                cmd = [
+                  "cyr_expire"
+                  "-E"
+                  "4"
+                  "-X"
+                  "28"
+                ];
+                at = 445;
+              };
+              checkpoint = {
+                cmd = [
+                  "ctl_cyrusdb"
+                  "-c"
+                ];
+                period = 30;
+              };
+            };
+            description = ''
+              This section lists processes that should be run at specific intervals, similar to cron jobs. This section is typically used to perform scheduled cleanup/maintenance.
+            '';
+          };
+          DAEMON = mkOption {
+            default = { };
+            description = ''
+              This section lists long running daemons to start before any SERVICES are spawned. master(8) will ensure that these processes are running, restarting any process which dies or forks. All listed processes will be shutdown when master(8) is exiting.
+            '';
+          };
+        };
+      };
+      description = "Cyrus configuration settings. See [cyrus.conf(5)](https://www.cyrusimap.org/imap/reference/manpages/configs/cyrus.conf.html)";
+    };
+    imapdSettings = mkOption {
+      type = submodule {
+        freeformType = attrsOf (oneOf [
+          str
+          int
+          bool
+          (listOf str)
+        ]);
+        options = {
+          configdirectory = mkOption {
+            type = path;
+            default = "/var/lib/cyrus";
+            description = ''
+              The pathname of the IMAP configuration directory.
+            '';
+          };
+          lmtpsocket = mkOption {
+            type = path;
+            default = "/run/cyrus/lmtp";
+            description = ''
+              Unix socket that lmtpd listens on, used by deliver(8). This should match the path specified in cyrus.conf(5).
+            '';
+          };
+          idlesocket = mkOption {
+            type = path;
+            default = "/run/cyrus/idle";
+            description = ''
+              Unix socket that idled listens on.
+            '';
+          };
+          notifysocket = mkOption {
+            type = path;
+            default = "/run/cyrus/notify";
+            description = ''
+              Unix domain socket that the mail notification daemon listens on.
+            '';
+          };
+        };
+      };
+      default = {
+        admins = [ "cyrus" ];
+        allowplaintext = true;
+        defaultdomain = "localhost";
+        defaultpartition = "default";
+        duplicate_db_path = "/run/cyrus/db/deliver.db";
+        hashimapspool = true;
+        httpmodules = [
+          "carddav"
+          "caldav"
+        ];
+        mboxname_lockpath = "/run/cyrus/lock";
+        partition-default = "/var/lib/cyrus/storage";
+        popminpoll = 1;
+        proc_path = "/run/cyrus/proc";
+        ptscache_db_path = "/run/cyrus/db/ptscache.db";
+        sasl_auto_transition = true;
+        sasl_pwcheck_method = [ "saslauthd" ];
+        sievedir = "/var/lib/cyrus/sieve";
+        statuscache_db_path = "/run/cyrus/db/statuscache.db";
+        syslog_prefix = "cyrus";
+        tls_client_ca_dir = "/etc/ssl/certs";
+        tls_session_timeout = 1440;
+        tls_sessions_db_path = "/run/cyrus/db/tls_sessions.db";
+        virtdomains = "on";
+      };
+      description = "IMAP configuration settings. See [imapd.conf(5)](https://www.cyrusimap.org/imap/reference/manpages/configs/imapd.conf.html)";
+    };
+
+    user = mkOption {
+      type = nullOr str;
+      default = null;
+      description = "Cyrus IMAP user name. If this is not set, a user named `cyrus` will be created.";
+    };
+
+    group = mkOption {
+      type = nullOr str;
+      default = null;
+      description = "Cyrus IMAP group name. If this is not set, a group named `cyrus` will be created.";
+    };
+
+    imapdConfigFile = mkOption {
+      type = nullOr path;
+      default = null;
+      description = "Path to the configuration file used for cyrus-imap.";
+      apply = v: if v != null then v else pkgs.writeText "imapd.conf" imapdConfig;
+    };
+
+    cyrusConfigFile = mkOption {
+      type = nullOr path;
+      default = null;
+      description = "Path to the configuration file used for Cyrus.";
+      apply = v: if v != null then v else pkgs.writeText "cyrus.conf" cyrusConfig;
+    };
+
+    sslCACert = mkOption {
+      type = nullOr str;
+      default = null;
+      description = "File path which containing one or more CA certificates to use.";
+    };
+
+    sslServerCert = mkOption {
+      type = nullOr str;
+      default = null;
+      description = "File containing the global certificate used for all services (IMAP, POP3, LMTP, Sieve)";
+    };
+
+    sslServerKey = mkOption {
+      type = nullOr str;
+      default = null;
+      description = "File containing the private key belonging to the global server certificate.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    users.users.cyrus = optionalAttrs (cfg.user == null) {
+      description = "Cyrus IMAP user";
+      isSystemUser = true;
+      group = optionalString (cfg.group == null) "cyrus";
+    };
+
+    users.groups.cyrus = optionalAttrs (cfg.group == null) { };
+
+    environment.etc."imapd.conf".source = cfg.imapdConfigFile;
+    environment.etc."cyrus.conf".source = cfg.cyrusConfigFile;
+
+    systemd.services.cyrus-imap = {
+      description = "Cyrus IMAP server";
+
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      restartTriggers = [
+        "/etc/imapd.conf"
+        "/etc/cyrus.conf"
+      ];
+
+      startLimitIntervalSec = 60;
+      environment = {
+        CYRUS_VERBOSE = mkIf cfg.debug "1";
+        LISTENQUEUE = builtins.toString cfg.listenQueue;
+      };
+      serviceConfig = {
+        User = if (cfg.user == null) then "cyrus" else cfg.user;
+        Group = if (cfg.group == null) then "cyrus" else cfg.group;
+        Type = "simple";
+        ExecStart = "${cyrus-imapdPkg}/libexec/master -l $LISTENQUEUE -C /etc/imapd.conf -M /etc/cyrus.conf -p /run/cyrus/master.pid -D";
+        Restart = "on-failure";
+        RestartSec = "1s";
+        RuntimeDirectory = "cyrus";
+        StateDirectory = "cyrus";
+
+        # Hardening
+        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectSystem = "full";
+        CapabilityBoundingSet = [ "~CAP_NET_ADMIN CAP_SYS_ADMIN CAP_SYS_BOOT CAP_SYS_MODULE" ];
+        MemoryDenyWriteExecute = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectControlGroups = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_NETLINK"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+      };
+      preStart = ''
+        mkdir -p '${cfg.imapdSettings.configdirectory}/socket' '${cfg.tmpDBDir}' /run/cyrus/proc /run/cyrus/lock
+      '';
+    };
+    environment.systemPackages = [ cyrus-imapdPkg ];
+  };
+}
--- a/third_party/nixpkgs/nixos/modules/services/matrix/matrix-sliding-sync.nix
+++ b/third_party/nixpkgs/nixos/modules/services/matrix/matrix-sliding-sync.nix
@ -1,107 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  cfg = config.services.matrix-sliding-sync;
-in
-{
-  imports = [
-    (lib.mkRenamedOptionModule [ "services" "matrix-synapse" "sliding-sync" ] [ "services" "matrix-sliding-sync" ])
-  ];
-
-  options.services.matrix-sliding-sync = {
-    enable = lib.mkEnableOption "sliding sync";
-
-    package = lib.mkPackageOption pkgs "matrix-sliding-sync" { };
-
-    settings = lib.mkOption {
-      type = lib.types.submodule {
-        freeformType = with lib.types; attrsOf str;
-        options = {
-          SYNCV3_SERVER = lib.mkOption {
-            type = lib.types.str;
-            description = ''
-              The destination homeserver to talk to not including `/_matrix/` e.g `https://matrix.example.org`.
-            '';
-          };
-
-          SYNCV3_DB = lib.mkOption {
-            type = lib.types.str;
-            default = "postgresql:///matrix-sliding-sync?host=/run/postgresql";
-            description = ''
-              The postgres connection string.
-              Refer to <https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING>.
-            '';
-          };
-
-          SYNCV3_BINDADDR = lib.mkOption {
-            type = lib.types.str;
-            default = "127.0.0.1:8009";
-            example = "[::]:8008";
-            description = "The interface and port or path (for unix socket) to listen on.";
-          };
-
-          SYNCV3_LOG_LEVEL = lib.mkOption {
-            type = lib.types.enum [ "trace" "debug" "info" "warn" "error" "fatal" ];
-            default = "info";
-            description = "The level of verbosity for messages logged.";
-          };
-        };
-      };
-      default = { };
-      description = ''
-        Freeform environment variables passed to the sliding sync proxy.
-        Refer to <https://github.com/matrix-org/sliding-sync#setup> for all supported values.
-      '';
-    };
-
-    createDatabase = lib.mkOption {
-      type = lib.types.bool;
-      default = true;
-      description = ''
-        Whether to enable and configure `services.postgres` to ensure that the database user `matrix-sliding-sync`
-        and the database `matrix-sliding-sync` exist.
-      '';
-    };
-
-    environmentFile = lib.mkOption {
-      type = lib.types.str;
-      description = ''
-        Environment file as defined in {manpage}`systemd.exec(5)`.
-
-        This must contain the {env}`SYNCV3_SECRET` variable which should
-        be generated with {command}`openssl rand -hex 32`.
-      '';
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.postgresql = lib.optionalAttrs cfg.createDatabase {
-      enable = true;
-      ensureDatabases = [ "matrix-sliding-sync" ];
-      ensureUsers = [ {
-        name = "matrix-sliding-sync";
-        ensureDBOwnership = true;
-      } ];
-    };
-
-    systemd.services.matrix-sliding-sync = rec {
-      after =
-        lib.optional cfg.createDatabase "postgresql.service"
-        ++ lib.optional config.services.dendrite.enable "dendrite.service"
-        ++ lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit;
-      wants = after;
-      wantedBy = [ "multi-user.target" ];
-      environment = cfg.settings;
-      serviceConfig = {
-        DynamicUser = true;
-        EnvironmentFile = cfg.environmentFile;
-        ExecStart = lib.getExe cfg.package;
-        StateDirectory = "matrix-sliding-sync";
-        WorkingDirectory = "%S/matrix-sliding-sync";
-        RuntimeDirectory = "matrix-sliding-sync";
-        Restart = "on-failure";
-        RestartSec = "1s";
-      };
-    };
-  };
-}
--- a/third_party/nixpkgs/nixos/modules/services/misc/bazarr.nix
+++ b/third_party/nixpkgs/nixos/modules/services/misc/bazarr.nix
@ -7,6 +7,8 @@ in
    services.bazarr = {
      enable = lib.mkEnableOption "bazarr, a subtitle manager for Sonarr and Radarr";

+      package = lib.mkPackageOption pkgs "bazarr" { };
+
      openFirewall = lib.mkOption {
        type = lib.types.bool;
        default = false;
@ -46,7 +48,7 @@ in
        StateDirectory = "bazarr";
        SyslogIdentifier = "bazarr";
        ExecStart = pkgs.writeShellScript "start-bazarr" ''
-          ${pkgs.bazarr}/bin/bazarr \
+          ${cfg.package}/bin/bazarr \
            --config '/var/lib/${StateDirectory}' \
            --port ${toString cfg.listenPort} \
            --no-update True
--- a/third_party/nixpkgs/nixos/modules/services/misc/docker-registry.nix
+++ b/third_party/nixpkgs/nixos/modules/services/misc/docker-registry.nix
@ -96,7 +96,12 @@ in {

    extraConfig = lib.mkOption {
      description = ''
-        Docker extra registry configuration via environment variables.
+        Docker extra registry configuration.
+      '';
+      example = lib.literalExpression ''
+        {
+          log.level = "debug";
+        }
      '';
      default = {};
      type = lib.types.attrs;
--- a/third_party/nixpkgs/nixos/modules/services/monitoring/netdata.nix
+++ b/third_party/nixpkgs/nixos/modules/services/monitoring/netdata.nix
@ -218,7 +218,6 @@ in {
      ps.psycopg2
      ps.python-ldap
      ps.netdata-pandas
-      ps.changefinder
    ]);

    services.netdata.configDir.".opt-out-from-anonymous-statistics" = mkIf (!cfg.enableAnalyticsReporting) (pkgs.writeText ".opt-out-from-anonymous-statistics" "");
--- a/third_party/nixpkgs/nixos/modules/services/networking/ddclient.nix
+++ b/third_party/nixpkgs/nixos/modules/services/networking/ddclient.nix
@ -222,7 +222,7 @@ in
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
      restartTriggers = lib.optional (cfg.configFile != null) cfg.configFile;
-      path = lib.optional (lib.hasPrefix "if," cfg.use) pkgs.iproute2;
+      path = lib.optional (lib.hasPrefix "if," cfg.use || lib.hasPrefix "if," cfg.usev4 || lib.hasPrefix "if," cfg.usev6) pkgs.iproute2;

      serviceConfig = {
        DynamicUser = true;
--- a/third_party/nixpkgs/nixos/modules/services/networking/firewall-iptables.nix
+++ b/third_party/nixpkgs/nixos/modules/services/networking/firewall-iptables.nix
@ -297,7 +297,6 @@ in
      }
    ];

-    environment.systemPackages = [ pkgs.nixos-firewall-tool ];
    networking.firewall.checkReversePath = lib.mkIf (!kernelHasRPFilter) (lib.mkDefault false);

    systemd.services.firewall = {
--- a/third_party/nixpkgs/nixos/modules/services/networking/firewall-nftables.nix
+++ b/third_party/nixpkgs/nixos/modules/services/networking/firewall-nftables.nix
@ -81,6 +81,13 @@ in

    networking.nftables.tables."nixos-fw".family = "inet";
    networking.nftables.tables."nixos-fw".content = ''
+        set temp-ports {
+          comment "Temporarily opened ports"
+          type inet_proto . inet_service
+          flags interval
+          auto-merge
+        }
+
        ${lib.optionalString (cfg.checkReversePath != false) ''
          chain rpfilter {
            type filter hook prerouting priority mangle + 10; policy drop;
@ -147,6 +154,8 @@ in
            ''
          ) cfg.allInterfaces)}

+          meta l4proto . th dport @temp-ports accept
+
          ${lib.optionalString cfg.allowPing ''
            icmp type echo-request ${lib.optionalString (cfg.pingLimit != null) "limit rate ${cfg.pingLimit}"} accept comment "allow ping"
          ''}
--- a/third_party/nixpkgs/nixos/modules/services/networking/firewall.nix
+++ b/third_party/nixpkgs/nixos/modules/services/networking/firewall.nix
@ -274,7 +274,10 @@ in

    networking.firewall.trustedInterfaces = [ "lo" ];

-    environment.systemPackages = [ cfg.package ] ++ cfg.extraPackages;
+    environment.systemPackages = [
+      cfg.package
+      pkgs.nixos-firewall-tool
+    ] ++ cfg.extraPackages;

    boot.kernelModules = (lib.optional cfg.autoLoadConntrackHelpers "nf_conntrack")
      ++ map (x: "nf_conntrack_${x}") cfg.connectionTrackingModules;
--- a/third_party/nixpkgs/nixos/modules/services/networking/go-camo.nix
+++ b/third_party/nixpkgs/nixos/modules/services/networking/go-camo.nix
@ -55,7 +55,8 @@ in
        GOCAMO_HMAC_FILE = "%d/hmac";
      };
      script = ''
-        export GOCAMO_HMAC=$(cat "$GOCAMO_HMAC_FILE")
+        GOCAMO_HMAC="$(cat "$GOCAMO_HMAC_FILE")"
+        export GOCAMO_HMAC
        exec ${lib.escapeShellArgs(lib.lists.remove "" ([ "${pkgs.go-camo}/bin/go-camo" cfg.listen cfg.sslListen cfg.sslKey cfg.sslCert ] ++ cfg.extraOptions))}
      '';
      serviceConfig = {
--- a/third_party/nixpkgs/nixos/modules/services/networking/mihomo.nix
+++ b/third_party/nixpkgs/nixos/modules/services/networking/mihomo.nix
@ -18,7 +18,7 @@ in
    package = lib.mkPackageOption pkgs "mihomo" { };

    configFile = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
+      type = lib.types.path;
      description = "Configuration file to use.";
    };

--- a/third_party/nixpkgs/nixos/modules/services/networking/shout.nix
+++ b/third_party/nixpkgs/nixos/modules/services/networking/shout.nix
@ -1,115 +0,0 @@
-{ pkgs, lib, config, ... }:
-
-with lib;
-
-let
-  cfg = config.services.shout;
-  shoutHome = "/var/lib/shout";
-
-  defaultConfig = pkgs.runCommand "config.js" { preferLocalBuild = true; } ''
-    EDITOR=true ${pkgs.shout}/bin/shout config --home $PWD
-    mv config.js $out
-  '';
-
-  finalConfigFile = if (cfg.configFile != null) then cfg.configFile else ''
-    var _ = require('${pkgs.shout}/lib/node_modules/shout/node_modules/lodash')
-
-    module.exports = _.merge(
-      {},
-      require('${defaultConfig}'),
-      ${builtins.toJSON cfg.config}
-    )
-  '';
-
-in {
-  options.services.shout = {
-    enable = mkEnableOption "Shout web IRC client";
-
-    private = mkOption {
-      type = types.bool;
-      default = false;
-      description = ''
-        Make your shout instance private. You will need to configure user
-        accounts by adding entries in {file}`${shoutHome}/users`.
-      '';
-    };
-
-    listenAddress = mkOption {
-      type = types.str;
-      default = "0.0.0.0";
-      description = "IP interface to listen on for http connections.";
-    };
-
-    port = mkOption {
-      type = types.port;
-      default = 9000;
-      description = "TCP port to listen on for http connections.";
-    };
-
-    configFile = mkOption {
-      type = types.nullOr types.lines;
-      default = null;
-      description = ''
-        Contents of Shout's {file}`config.js` file.
-
-        Used for backward compatibility, recommended way is now to use
-        the `config` option.
-
-        Documentation: http://shout-irc.com/docs/server/configuration.html
-      '';
-    };
-
-    config = mkOption {
-      default = {};
-      type = types.attrs;
-      example = {
-        displayNetwork = false;
-        defaults = {
-          name = "Your Network";
-          host = "localhost";
-          port = 6697;
-        };
-      };
-      description = ''
-        Shout {file}`config.js` contents as attribute set (will be
-        converted to JSON to generate the configuration file).
-
-        The options defined here will be merged to the default configuration file.
-
-        Documentation: http://shout-irc.com/docs/server/configuration.html
-      '';
-    };
-  };
-
-  config = mkIf cfg.enable {
-    users.users.shout = {
-      isSystemUser = true;
-      group = "shout";
-      description = "Shout daemon user";
-      home = shoutHome;
-      createHome = true;
-    };
-    users.groups.shout = {};
-
-    systemd.services.shout = {
-      description = "Shout web IRC client";
-      wantedBy = [ "multi-user.target" ];
-      wants = [ "network-online.target" ];
-      after = [ "network-online.target" ];
-      preStart = "ln -sf ${pkgs.writeText "config.js" finalConfigFile} ${shoutHome}/config.js";
-      script = concatStringsSep " " [
-        "${pkgs.shout}/bin/shout"
-        (if cfg.private then "--private" else "--public")
-        "--port" (toString cfg.port)
-        "--host" (toString cfg.listenAddress)
-        "--home" shoutHome
-      ];
-      serviceConfig = {
-        User = "shout";
-        ProtectHome = "true";
-        ProtectSystem = "full";
-        PrivateTmp = "true";
-      };
-    };
-  };
-}
--- a/third_party/nixpkgs/nixos/modules/services/networking/sing-box.nix
+++ b/third_party/nixpkgs/nixos/modules/services/networking/sing-box.nix
@ -55,11 +55,17 @@ in
    systemd.packages = [ cfg.package ];

    systemd.services.sing-box = {
-      preStart = ''
-        umask 0077
-        mkdir -p /etc/sing-box
-        ${utils.genJqSecretsReplacementSnippet cfg.settings "/etc/sing-box/config.json"}
-      '';
+      preStart = utils.genJqSecretsReplacementSnippet cfg.settings "/run/sing-box/config.json";
+      serviceConfig = {
+        StateDirectory = "sing-box";
+        StateDirectoryMode = "0700";
+        RuntimeDirectory = "sing-box";
+        RuntimeDirectoryMode = "0700";
+        ExecStart = [
+          ""
+          "${lib.getExe cfg.package} -D \${STATE_DIRECTORY} -C \${RUNTIME_DIRECTORY} run"
+        ];
+      };
      wantedBy = [ "multi-user.target" ];
    };
  };
--- a/third_party/nixpkgs/nixos/modules/services/networking/smokeping.nix
+++ b/third_party/nixpkgs/nixos/modules/services/networking/smokeping.nix
@ -375,8 +375,5 @@ in
    };
  };

-  meta.maintainers = with lib.maintainers; [
-    erictapen
-    nh2
-  ];
+  meta.maintainers = with lib.maintainers; [ nh2 ];
 }
--- a/third_party/nixpkgs/nixos/modules/services/networking/tailscale.nix
+++ b/third_party/nixpkgs/nixos/modules/services/networking/tailscale.nix
@ -57,6 +57,7 @@ in {
      example = "/run/secrets/tailscale_key";
      description = ''
        A file containing the auth key.
+        Tailscale will be automatically started if provided.
      '';
    };

--- a/third_party/nixpkgs/nixos/modules/services/security/kanidm.nix
+++ b/third_party/nixpkgs/nixos/modules/services/security/kanidm.nix
@ -979,7 +979,6 @@ in
  };

  meta.maintainers = with lib.maintainers; [
-    erictapen
    Flakebi
    oddlama
  ];
--- a/third_party/nixpkgs/nixos/modules/services/torrent/bitmagnet.nix
+++ b/third_party/nixpkgs/nixos/modules/services/torrent/bitmagnet.nix
@ -0,0 +1,194 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.bitmagnet;
+  inherit (lib)
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    optional
+    ;
+  inherit (lib.types)
+    bool
+    int
+    port
+    str
+    submodule
+    ;
+  inherit (lib.generators) toYAML;
+
+  freeformType = (pkgs.formats.yaml { }).type;
+in
+{
+  options.services.bitmagnet = {
+    enable = mkEnableOption "Bitmagnet service";
+    useLocalPostgresDB = mkOption {
+      description = "Use a local postgresql database, create user and database";
+      type = bool;
+      default = true;
+    };
+    settings = mkOption {
+      description = "Bitmagnet configuration (https://bitmagnet.io/setup/configuration.html).";
+      default = { };
+      type = submodule {
+        inherit freeformType;
+        options = {
+          http_server = mkOption {
+            default = { };
+            description = "HTTP server settings";
+            type = submodule {
+              inherit freeformType;
+              options = {
+                port = mkOption {
+                  type = str;
+                  default = ":3333";
+                  description = "HTTP server listen port";
+                };
+              };
+            };
+          };
+          dht_server = mkOption {
+            default = { };
+            description = "DHT server settings";
+            type = submodule {
+              inherit freeformType;
+              options = {
+                port = mkOption {
+                  type = port;
+                  default = 3334;
+                  description = "DHT listen port";
+                };
+              };
+            };
+          };
+          postgres = mkOption {
+            default = { };
+            description = "PostgreSQL database configuration";
+            type = submodule {
+              inherit freeformType;
+              options = {
+                host = mkOption {
+                  type = str;
+                  default = "";
+                  description = "Address, hostname or Unix socket path of the database server";
+                };
+                name = mkOption {
+                  type = str;
+                  default = "bitmagnet";
+                  description = "Database name to connect to";
+                };
+                user = mkOption {
+                  type = str;
+                  default = "";
+                  description = "User to connect as";
+                };
+                password = mkOption {
+                  type = str;
+                  default = "";
+                  description = "Password for database user";
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+    package = mkPackageOption pkgs "bitmagnet" { };
+    user = mkOption {
+      description = "User running bitmagnet";
+      type = str;
+      default = "bitmagnet";
+    };
+    group = mkOption {
+      description = "Group of user running bitmagnet";
+      type = str;
+      default = "bitmagnet";
+    };
+    openFirewall = mkOption {
+      description = "Open DHT ports in firewall";
+      type = bool;
+      default = false;
+    };
+  };
+  config = mkIf cfg.enable {
+    environment.etc."xdg/bitmagnet/config.yml" = {
+      text = toYAML { } cfg.settings;
+      mode = "0440";
+      user = cfg.user;
+      group = cfg.group;
+    };
+    systemd.services.bitmagnet = {
+      enable = true;
+      wantedBy = [ "multi-user.target" ];
+      after = [
+        "network.target"
+      ] ++ optional cfg.useLocalPostgresDB "postgresql.service";
+      requires = optional cfg.useLocalPostgresDB "postgresql.service";
+      serviceConfig = {
+        Type = "simple";
+        DynamicUser = true;
+        User = cfg.user;
+        Group = cfg.group;
+        ExecStart = "${cfg.package}/bin/bitmagnet worker run --all";
+        Restart = "on-failure";
+        WorkingDirectory = "/var/lib/bitmagnet";
+        StateDirectory = "bitmagnet";
+
+        # Sandboxing (sorted by occurrence in https://www.freedesktop.org/software/systemd/man/systemd.exec.html)
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectHostname = true;
+        ProtectClock = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+        ];
+        RestrictNamespaces = true;
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        RemoveIPC = true;
+        PrivateMounts = true;
+      };
+    };
+    users.users = mkIf (cfg.user == "bitmagnet") {
+      bitmagnet = {
+        group = cfg.group;
+        isSystemUser = true;
+      };
+    };
+    users.groups = mkIf (cfg.group == "bitmagnet") { bitmagnet = { }; };
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.settings.dht_server.port ];
+      allowedUDPPorts = [ cfg.settings.dht_server.port ];
+    };
+    services.postgresql = mkIf cfg.useLocalPostgresDB {
+      enable = true;
+      ensureDatabases = [
+        cfg.settings.postgres.name
+        (if (cfg.settings.postgres.user == "") then cfg.user else cfg.settings.postgres.user)
+      ];
+      ensureUsers = [
+        {
+          name = if (cfg.settings.postgres.user == "") then cfg.user else cfg.settings.postgres.user;
+          ensureDBOwnership = true;
+        }
+      ];
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ gileri ];
+}
--- a/third_party/nixpkgs/nixos/modules/services/video/wivrn.nix
+++ b/third_party/nixpkgs/nixos/modules/services/video/wivrn.nix
@ -0,0 +1,226 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  inherit (lib)
+    mkIf
+    mkEnableOption
+    mkPackageOption
+    mkOption
+    optionalString
+    optionalAttrs
+    isDerivation
+    recursiveUpdate
+    getExe
+    literalExpression
+    types
+    maintainers
+    ;
+  cfg = config.services.wivrn;
+  configFormat = pkgs.formats.json { };
+
+  # For the application option to work with systemd PATH, we find the store binary path of
+  # the package, concat all of the following strings, and then update the application attribute.
+  # Application can either be a package or a list that has a package as the first element.
+  applicationExists = builtins.hasAttr "application" cfg.config.json;
+  applicationListNotEmpty = (
+    if builtins.isList cfg.config.json.application then
+      (builtins.length cfg.config.json.application) != 0
+    else
+      true
+  );
+  applicationCheck = applicationExists && applicationListNotEmpty;
+
+  applicationBinary = (
+    if builtins.isList cfg.config.json.application then
+      builtins.head cfg.config.json.application
+    else
+      cfg.config.json.application
+  );
+  applicationStrings = builtins.tail cfg.config.json.application;
+
+  applicationPath = mkIf applicationCheck applicationBinary;
+
+  applicationConcat = (
+    if builtins.isList cfg.config.json.application then
+      builtins.concatStringsSep " " ([ (getExe applicationBinary) ] ++ applicationStrings)
+    else
+      (getExe applicationBinary)
+  );
+  applicationUpdate = recursiveUpdate cfg.config.json (
+    optionalAttrs applicationCheck { application = applicationConcat; }
+  );
+  configFile = configFormat.generate "config.json" applicationUpdate;
+in
+{
+  options = {
+    services.wivrn = {
+      enable = mkEnableOption "WiVRn, an OpenXR streaming application";
+
+      package = mkPackageOption pkgs "wivrn" { };
+
+      openFirewall = mkEnableOption "the default ports in the firewall for the WiVRn server";
+
+      defaultRuntime = mkEnableOption ''
+        WiVRn Monado as the default OpenXR runtime on the system.
+        The config can be found at `/etc/xdg/openxr/1/active_runtime.json`.
+
+        Note that applications can bypass this option by setting an active
+        runtime in a writable XDG_CONFIG_DIRS location like `~/.config`
+      '';
+
+      autoStart = mkEnableOption "starting the service by default";
+
+      monadoEnvironment = mkOption {
+        type = types.attrs;
+        description = "Environment variables to be passed to the Monado environment.";
+        default = {
+          XRT_COMPOSITOR_LOG = "debug";
+          XRT_PRINT_OPTIONS = "on";
+          IPC_EXIT_ON_DISCONNECT = "off";
+        };
+      };
+
+      extraPackages = mkOption {
+        type = types.listOf types.package;
+        description = "Packages to add to the wivrn-application service $PATH.";
+        default = [ ];
+        example = literalExpression "[ pkgs.bash pkgs.procps ]";
+      };
+
+      config = {
+        enable = mkEnableOption "configuration for WiVRn";
+        json = mkOption {
+          type = configFormat.type;
+          description = ''
+            Configuration for WiVRn. The attributes are serialized to JSON in config.json.
+
+            Note that the application option must be either a package or a
+            list with package as the first element.
+
+            See https://github.com/Meumeu/WiVRn/blob/master/docs/configuration.md
+          '';
+          default = { };
+          example = literalExpression ''
+            {
+              scale = 0.8;
+              bitrate = 100000000;
+              encoders = [
+                {
+                  encoder = "nvenc";
+                  codec = "h264";
+                  width = 1.0;
+                  height = 1.0;
+                  offset_x = 0.0;
+                  offset_y = 0.0;
+                }
+              ];
+              application = [ pkgs.wlx-overlay-s ];
+              tcp_only = true;
+            }
+          '';
+        };
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !applicationCheck || isDerivation applicationBinary;
+        message = "The application in WiVRn configuration is not a package. Please ensure that the application is a package or that a package is the first element in the list.";
+      }
+    ];
+
+    systemd.user = {
+      services = {
+        # The WiVRn server runs in a hardened service and starts the applications in a different service
+        wivrn = {
+          description = "WiVRn XR runtime service";
+          environment = {
+            # Default options
+            # https://gitlab.freedesktop.org/monado/monado/-/blob/598080453545c6bf313829e5780ffb7dde9b79dc/src/xrt/targets/service/monado.in.service#L12
+            XRT_COMPOSITOR_LOG = "debug";
+            XRT_PRINT_OPTIONS = "on";
+            IPC_EXIT_ON_DISCONNECT = "off";
+          } // cfg.monadoEnvironment;
+          serviceConfig = {
+            ExecStart = (
+              (getExe cfg.package) + " --systemd" + optionalString cfg.config.enable " -f ${configFile}"
+            );
+            # Hardening options
+            CapabilityBoundingSet = [ "CAP_SYS_NICE" ];
+            AmbientCapabilities = [ "CAP_SYS_NICE" ];
+            LockPersonality = true;
+            NoNewPrivileges = true;
+            PrivateTmp = true;
+            ProtectClock = true;
+            ProtectControlGroups = true;
+            ProtectKernelLogs = true;
+            ProtectKernelModules = true;
+            ProtectKernelTunables = true;
+            ProtectProc = "invisible";
+            ProtectSystem = "strict";
+            RemoveIPC = true;
+            RestrictNamespaces = true;
+            RestrictSUIDSGID = true;
+          };
+          wantedBy = mkIf cfg.autoStart [ "default.target" ];
+          restartTriggers = [
+            cfg.package
+            configFile
+          ];
+        };
+        wivrn-application = mkIf applicationCheck {
+          description = "WiVRn application service";
+          requires = [ "wivrn.service" ];
+          serviceConfig = {
+            ExecStart = (
+              (getExe cfg.package) + " --application" + optionalString cfg.config.enable " -f ${configFile}"
+            );
+            Restart = "on-failure";
+            RestartSec = 0;
+            PrivateTmp = true;
+          };
+          # We need to add the application to PATH so WiVRn can find it
+          path = [ applicationPath ] ++ cfg.extraPackages;
+        };
+      };
+    };
+
+    services = {
+      # WiVRn can be used with some wired headsets so we include xr-hardware
+      udev.packages = with pkgs; [
+        android-udev-rules
+        xr-hardware
+      ];
+      avahi = {
+        enable = true;
+        publish = {
+          enable = true;
+          userServices = true;
+        };
+      };
+    };
+
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ 9757 ];
+      allowedUDPPorts = [ 9757 ];
+    };
+
+    environment = {
+      systemPackages = [
+        cfg.package
+        applicationPath
+      ];
+      pathsToLink = [ "/share/openxr" ];
+      etc."xdg/openxr/1/active_runtime.json" = mkIf cfg.defaultRuntime {
+        source = "${cfg.package}/share/openxr/1/openxr_wivrn.json";
+      };
+    };
+  };
+  meta.maintainers = with maintainers; [ passivelemon ];
+}
--- a/third_party/nixpkgs/nixos/modules/services/web-apps/nextcloud-notify_push.nix
+++ b/third_party/nixpkgs/nixos/modules/services/web-apps/nextcloud-notify_push.nix
@ -77,15 +77,21 @@ in
        dbType = if cfg.dbtype == "pgsql" then "postgresql" else cfg.dbtype;
        dbUser = lib.optionalString (cfg.dbuser != null) cfg.dbuser;
        dbPass = lib.optionalString (cfg.dbpassFile != null) ":$DATABASE_PASSWORD";
-        isSocket = lib.hasPrefix "/" (toString cfg.dbhost);
+        dbHostHasPrefix = prefix: lib.hasPrefix prefix (toString cfg.dbhost);
+        isPostgresql = dbType == "postgresql";
+        isMysql = dbType == "mysql";
+        isSocket = (isPostgresql && dbHostHasPrefix "/") || (isMysql && dbHostHasPrefix "localhost:/");
        dbHost = lib.optionalString (cfg.dbhost != null) (if
          isSocket then
-            if dbType == "postgresql" then "?host=${cfg.dbhost}" else
-            if dbType == "mysql" then "?socket=${cfg.dbhost}" else throw "unsupported dbtype"
+            lib.optionalString isMysql "@localhost"
          else
            "@${cfg.dbhost}");
+        dbOpts = lib.optionalString (cfg.dbhost != null && isSocket) (
+          if isPostgresql then "?host=${cfg.dbhost}" else
+          if isMysql then "?socket=${lib.removePrefix "localhost:" cfg.dbhost}" else throw "unsupported dbtype"
+        );
        dbName = lib.optionalString (cfg.dbname != null) "/${cfg.dbname}";
-        dbUrl = "${dbType}://${dbUser}${dbPass}${lib.optionalString (!isSocket) dbHost}${dbName}${lib.optionalString isSocket dbHost}";
+        dbUrl = "${dbType}://${dbUser}${dbPass}${dbHost}${dbName}${dbOpts}";
      in lib.optionalString (dbPass != "") ''
        export DATABASE_PASSWORD="$(<"${cfg.dbpassFile}")"
      '' + ''
--- a/third_party/nixpkgs/nixos/modules/services/web-apps/nextcloud-whiteboard-server.nix
+++ b/third_party/nixpkgs/nixos/modules/services/web-apps/nextcloud-whiteboard-server.nix
@ -0,0 +1,72 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+
+  inherit (lib)
+    mkIf
+    mkEnableOption
+    mkOption
+    types
+    literalExpression
+    ;
+  cfg = config.services.nextcloud-whiteboard-server;
+
+in
+{
+  options.services.nextcloud-whiteboard-server = {
+
+    enable = mkEnableOption "Nextcloud backend server for the Whiteboard app";
+
+    settings = mkOption {
+      type = types.attrsOf types.str;
+      default = { };
+      description = ''
+        Settings to configure backend server. Especially the Nextcloud host
+        url has to be set. The required environment variable `JWT_SECRET_KEY`
+        should be set via the secrets option.
+      '';
+      example = literalExpression ''
+        {
+          NEXTCLOUD_URL = "https://nextcloud.example.org";
+        }
+      '';
+    };
+
+    secrets = lib.mkOption {
+      type = with types; listOf str;
+      description = ''
+        A list of files containing the various secrets. Should be in the
+        format expected by systemd's `EnvironmentFile` directory.
+      '';
+      default = [ ];
+    };
+
+  };
+
+  config = mkIf cfg.enable {
+
+    systemd.services.nextcloud-whiteboard-server = {
+      description = "Nextcloud backend server for the Whiteboard app";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      environment = cfg.settings;
+      serviceConfig = {
+        ExecStart = "${lib.getExe pkgs.nextcloud-whiteboard-server}";
+        WorkingDirectory = "%S/whiteboard";
+        StateDirectory = "whiteboard";
+        EnvironmentFile = [ cfg.secrets ];
+        DynamicUser = true;
+      };
+    };
+
+  };
+
+  meta.maintainers = with lib.maintainers; [ onny ];
+
+}
--- a/third_party/nixpkgs/nixos/modules/services/web-apps/nextcloud.nix
+++ b/third_party/nixpkgs/nixos/modules/services/web-apps/nextcloud.nix
@ -930,7 +930,10 @@ in {
        nextcloud-setup = let
          c = cfg.config;
          occInstallCmd = let
-            mkExport = { arg, value }: "export ${arg}=${value}";
+            mkExport = { arg, value }: ''
+              ${arg}=${value};
+              export ${arg};
+            '';
            dbpass = {
              arg = "DBPASS";
              value = if c.dbpassFile != null
--- a/third_party/nixpkgs/nixos/modules/services/web-apps/pretalx.nix
+++ b/third_party/nixpkgs/nixos/modules/services/web-apps/pretalx.nix
@ -22,7 +22,6 @@ let
    ]
    ++ finalPackage.optional-dependencies.redis
    ++ lib.optionals cfg.celery.enable [ celery ]
-    ++ lib.optionals (cfg.settings.database.backend == "mysql") finalPackage.optional-dependencies.mysql
    ++ lib.optionals (cfg.settings.database.backend == "postgresql") finalPackage.optional-dependencies.postgres;
  };
 in
@ -184,6 +183,17 @@ in
            };
          };

+          files = {
+            upload_limit = lib.mkOption {
+              type = lib.types.ints.positive;
+              default = 10;
+              example = 50;
+              description = ''
+                Maximum file upload size in MiB.
+              '';
+            };
+          };
+
          filesystem = {
            data = lib.mkOption {
              type = lib.types.path;
--- a/third_party/nixpkgs/nixos/modules/services/web-apps/wakapi.nix
+++ b/third_party/nixpkgs/nixos/modules/services/web-apps/wakapi.nix
@ -66,6 +66,60 @@ in
        The path to a file containing the password for the smtp mailer used by Wakapi.
      '';
    };
+
+    database = {
+      createLocally = mkEnableOption ''
+        automatic database configuration.
+
+        ::: {.note}
+        Only PostgreSQL is supported for the time being.
+        :::
+      '';
+
+      dialect = mkOption {
+        type = types.nullOr (
+          types.enum [
+            "postgres"
+            "sqlite3"
+            "mysql"
+            "cockroach"
+            "mssql"
+          ]
+        );
+        default = cfg.settings.db.dialect or null; # handle case where dialect is not set
+        defaultText = ''
+          Database dialect from settings if {option}`services.wakatime.settings.db.dialect`
+          is set, or `null` otherwise.
+        '';
+        description = ''
+          The database type to use for Wakapi.
+        '';
+      };
+
+      name = mkOption {
+        type = types.str;
+        default = cfg.settings.db.name or "wakapi";
+        defaultText = ''
+          Database name from settings if {option}`services.wakatime.settings.db.name`
+          is set, or "wakapi" otherwise.
+        '';
+        description = ''
+          The name of the database to use for Wakapi.
+        '';
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = cfg.settings.db.user or "wakapi";
+        defaultText = ''
+          User from settings if {option}`services.wakatime.settings.db.user`
+          is set, or "wakapi" otherwise.
+        '';
+        description = ''
+          The name of the user to use for Wakapi.
+        '';
+      };
+    };
  };

  config = mkIf cfg.enable {
@ -73,10 +127,10 @@ in
      description = "Wakapi (self-hosted WakaTime-compatible backend)";
      wants = [
        "network-online.target"
-      ] ++ optional (cfg.settings.db.dialect == "postgres") "postgresql.service";
+      ] ++ optional (cfg.database.dialect == "postgres") "postgresql.service";
      after = [
        "network-online.target"
-      ] ++ optional (cfg.settings.db.dialect == "postgres") "postgresql.service";
+      ] ++ optional (cfg.database.dialect == "postgres") "postgresql.service";
      wantedBy = [ "multi-user.target" ];

      script = ''
@ -128,13 +182,26 @@ in
        message = "Either `services.wakapi.passwordSalt` or `services.wakapi.passwordSaltFile` must be set.";
      }
      {
-        assertion = cfg.passwordSalt != null -> cfg.passwordSaltFile != null;
+        assertion = !(cfg.passwordSalt != null && cfg.passwordSaltFile != null);
        message = "Both `services.wakapi.passwordSalt` `services.wakapi.passwordSaltFile` should not be set at the same time.";
      }
      {
-        assertion = cfg.smtpPassword != null -> cfg.smtpPasswordFile != null;
+        assertion = !(cfg.smtpPassword != null && cfg.smtpPasswordFile != null);
        message = "Both `services.wakapi.smtpPassword` `services.wakapi.smtpPasswordFile` should not be set at the same time.";
      }
+      {
+        assertion = cfg.database.createLocally -> cfg.settings.db.dialect != null;
+        message = "`services.wakapi.database.createLocally` is true, but a database dialect is not set!";
+      }
+    ];
+
+    warnings = [
+      (lib.optionalString (cfg.database.createLocally -> cfg.settings.db.dialect != "postgres") ''
+        You have enabled automatic database configuration, but the database dialect is not set to "posgres".
+
+        The Wakapi module only supports for PostgreSQL. Please set `services.wakapi.database.createLocally`
+        to `false`, or switch to "postgres" as your database dialect.
+      '')
    ];

    users = {
@ -146,10 +213,10 @@ in
      groups.wakapi = { };
    };

-    services.postgresql = mkIf (cfg.settings.db.dialect == "postgres") {
+    services.postgresql = mkIf (cfg.database.createLocally && cfg.database.dialect == "postgres") {
      enable = true;

-      ensureDatabases = singleton cfg.settings.db.name;
+      ensureDatabases = singleton cfg.database.name;
      ensureUsers = singleton {
        name = cfg.settings.db.user;
        ensureDBOwnership = true;
@ -161,5 +228,8 @@ in
    };
  };

-  meta.maintainers = with lib.maintainers; [ isabelroses ];
+  meta.maintainers = with lib.maintainers; [
+    isabelroses
+    NotAShelf
+  ];
 }
--- a/third_party/nixpkgs/nixos/modules/services/web-servers/nginx/default.nix
+++ b/third_party/nixpkgs/nixos/modules/services/web-servers/nginx/default.nix
@ -1150,14 +1150,6 @@ in
        '';
      }

-      {
-        assertion = any (host: host.rejectSSL) (attrValues virtualHosts) -> versionAtLeast cfg.package.version "1.19.4";
-        message = ''
-          services.nginx.virtualHosts.<name>.rejectSSL requires nginx version
-          1.19.4 or above; see the documentation for services.nginx.package.
-        '';
-      }
-
      {
        assertion = all (host: !(host.enableACME && host.useACMEHost != null)) (attrValues virtualHosts);
        message = ''
--- a/third_party/nixpkgs/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
+++ b/third_party/nixpkgs/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
@ -74,8 +74,6 @@ let

    netbootxyz = optionalString cfg.netbootxyz.enable pkgs.netbootxyz-efi;

-    edk2-uefi-shell = optionalString cfg.edk2-uefi-shell.enable pkgs.edk2-uefi-shell;
-
    checkMountpoints = pkgs.writeShellScript "check-mountpoints" ''
      fail() {
        echo "$1 = '$2' is not a mounted partition. Is the path configured correctly?" >&2
--- a/third_party/nixpkgs/nixos/modules/virtualisation/virtualbox-guest.nix
+++ b/third_party/nixpkgs/nixos/modules/virtualisation/virtualbox-guest.nix
@ -1,5 +1,10 @@
 # Module for VirtualBox guests.
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
  cfg = config.virtualisation.virtualbox.guest;
  kernel = config.boot.kernelPackages;
@ -28,7 +33,20 @@ let
 in
 {
  imports = [
-    (lib.mkRenamedOptionModule [ "virtualisation" "virtualbox" "guest" "draganddrop" ] [ "virtualisation" "virtualbox" "guest" "dragAndDrop" ])
+    (lib.mkRenamedOptionModule
+      [
+        "virtualisation"
+        "virtualbox"
+        "guest"
+        "draganddrop"
+      ]
+      [
+        "virtualisation"
+        "virtualbox"
+        "guest"
+        "dragAndDrop"
+      ]
+    )
  ];

  options.virtualisation.virtualbox.guest = {
@ -59,12 +77,15 @@ in

  ###### implementation

-  config = lib.mkIf cfg.enable (lib.mkMerge [
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        assertions = [
          {
-      assertions = [{
            assertion = pkgs.stdenv.hostPlatform.isx86;
            message = "Virtualbox not currently supported on ${pkgs.stdenv.hostPlatform.system}";
-      }];
+          }
+        ];

        environment.systemPackages = [ kernel.virtualboxGuestAdditions ];

@ -87,8 +108,7 @@ in
          serviceConfig.ExecStart = "@${kernel.virtualboxGuestAdditions}/bin/VBoxService VBoxService --foreground";
        };

-      services.udev.extraRules =
-        ''
+        services.udev.extraRules = ''
          # /dev/vboxuser is necessary for VBoxClient to work.  Maybe we
          # should restrict this to logged-in users.
          KERNEL=="vboxuser",  OWNER="root", GROUP="root", MODE="0666"
@ -99,20 +119,15 @@ in

        systemd.user.services.virtualboxClientVmsvga = mkVirtualBoxUserService "--vmsvga-session";
      }
-    (
-      lib.mkIf cfg.clipboard {
+      (lib.mkIf cfg.clipboard {
        systemd.user.services.virtualboxClientClipboard = mkVirtualBoxUserService "--clipboard";
-      }
-    )
-    (
-      lib.mkIf cfg.seamless {
+      })
+      (lib.mkIf cfg.seamless {
        systemd.user.services.virtualboxClientSeamless = mkVirtualBoxUserService "--seamless";
-      }
-    )
-    (
-      lib.mkIf cfg.dragAndDrop {
+      })
+      (lib.mkIf cfg.dragAndDrop {
        systemd.user.services.virtualboxClientDragAndDrop = mkVirtualBoxUserService "--draganddrop";
-      }
-    )
-  ]);
+      })
+    ]
+  );
 }
--- a/third_party/nixpkgs/nixos/modules/virtualisation/virtualbox-host.nix
+++ b/third_party/nixpkgs/nixos/modules/virtualisation/virtualbox-host.nix
@ -1,9 +1,19 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
  cfg = config.virtualisation.virtualbox.host;

  virtualbox = cfg.package.override {
-    inherit (cfg) enableHardening headless enableWebService enableKvm;
+    inherit (cfg)
+      enableHardening
+      headless
+      enableWebService
+      enableKvm
+      ;
    extensionPack = if cfg.enableExtensionPack then pkgs.virtualboxExtpack else null;
  };

@ -93,93 +103,119 @@ in
    };
  };

-  config = lib.mkIf cfg.enable (lib.mkMerge [{
-    warnings = lib.mkIf (pkgs.config.virtualbox.enableExtensionPack or false)
-      ["'nixpkgs.virtualbox.enableExtensionPack' has no effect, please use 'virtualisation.virtualbox.host.enableExtensionPack'"];
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        warnings = lib.mkIf (pkgs.config.virtualbox.enableExtensionPack or false) [
+          "'nixpkgs.virtualbox.enableExtensionPack' has no effect, please use 'virtualisation.virtualbox.host.enableExtensionPack'"
+        ];
        environment.systemPackages = [ virtualbox ];

-    security.wrappers = let
+        security.wrappers =
+          let
            mkSuid = program: {
              source = "${virtualbox}/libexec/virtualbox/${program}";
              owner = "root";
              group = "vboxusers";
              setuid = true;
            };
-      executables = [
+            executables =
+              [
                "VBoxHeadless"
                "VBoxNetAdpCtl"
                "VBoxNetDHCP"
                "VBoxNetNAT"
                "VBoxVolInfo"
-      ] ++ (lib.optionals (!cfg.headless) [
+              ]
+              ++ (lib.optionals (!cfg.headless) [
                "VBoxSDL"
                "VirtualBoxVM"
              ]);
-    in lib.mkIf cfg.enableHardening
-      (builtins.listToAttrs (map (x: { name = x; value = mkSuid x; }) executables));
+          in
+          lib.mkIf cfg.enableHardening (
+            builtins.listToAttrs (
+              map (x: {
+                name = x;
+                value = mkSuid x;
+              }) executables
+            )
+          );

        users.groups.vboxusers.gid = config.ids.gids.vboxusers;

-    services.udev.extraRules =
-      ''
+        services.udev.extraRules = ''
          SUBSYSTEM=="usb_device", ACTION=="add", RUN+="${virtualbox}/libexec/virtualbox/VBoxCreateUSBNode.sh $major $minor $attr{bDeviceClass}"
          SUBSYSTEM=="usb", ACTION=="add", ENV{DEVTYPE}=="usb_device", RUN+="${virtualbox}/libexec/virtualbox/VBoxCreateUSBNode.sh $major $minor $attr{bDeviceClass}"
          SUBSYSTEM=="usb_device", ACTION=="remove", RUN+="${virtualbox}/libexec/virtualbox/VBoxCreateUSBNode.sh --remove $major $minor"
          SUBSYSTEM=="usb", ACTION=="remove", ENV{DEVTYPE}=="usb_device", RUN+="${virtualbox}/libexec/virtualbox/VBoxCreateUSBNode.sh --remove $major $minor"
        '';
-  } (lib.mkIf cfg.enableKvm {
+      }
+      (lib.mkIf cfg.enableKvm {
        assertions = [
          {
            assertion = !cfg.addNetworkInterface;
            message = "VirtualBox KVM only supports standard NAT networking for VMs. Please turn off virtualisation.virtualbox.host.addNetworkInterface.";
          }
        ];
-  }) (lib.mkIf (!cfg.enableKvm) {
-    boot.kernelModules = [ "vboxdrv" "vboxnetadp" "vboxnetflt" ];
+      })
+      (lib.mkIf (!cfg.enableKvm) {
+        boot.kernelModules = [
+          "vboxdrv"
+          "vboxnetadp"
+          "vboxnetflt"
+        ];
        boot.extraModulePackages = [ kernelModules ];

-    services.udev.extraRules =
-      ''
+        services.udev.extraRules = ''
          KERNEL=="vboxdrv",    OWNER="root", GROUP="vboxusers", MODE="0660", TAG+="systemd"
          KERNEL=="vboxdrvu",   OWNER="root", GROUP="root",      MODE="0666", TAG+="systemd"
          KERNEL=="vboxnetctl", OWNER="root", GROUP="vboxusers", MODE="0660", TAG+="systemd"
        '';

        # Since we lack the right setuid/setcap binaries, set up a host-only network by default.
-  }) (lib.mkIf cfg.addNetworkInterface {
-    systemd.services.vboxnet0 =
-      { description = "VirtualBox vboxnet0 Interface";
+      })
+      (lib.mkIf cfg.addNetworkInterface {
+        systemd.services.vboxnet0 = {
+          description = "VirtualBox vboxnet0 Interface";
          requires = [ "dev-vboxnetctl.device" ];
          after = [ "dev-vboxnetctl.device" ];
-        wantedBy = [ "network.target" "sys-subsystem-net-devices-vboxnet0.device" ];
+          wantedBy = [
+            "network.target"
+            "sys-subsystem-net-devices-vboxnet0.device"
+          ];
          path = [ virtualbox ];
          serviceConfig.RemainAfterExit = true;
          serviceConfig.Type = "oneshot";
          serviceConfig.PrivateTmp = true;
          environment.VBOX_USER_HOME = "/tmp";
-        script =
-          ''
+          script = ''
            if ! [ -e /sys/class/net/vboxnet0 ]; then
              VBoxManage hostonlyif create
              cat /tmp/VBoxSVC.log >&2
            fi
          '';
-        postStop =
-          ''
+          postStop = ''
            VBoxManage hostonlyif remove vboxnet0
          '';
        };

-    networking.interfaces.vboxnet0.ipv4.addresses = [{ address = "192.168.56.1"; prefixLength = 24; }];
+        networking.interfaces.vboxnet0.ipv4.addresses = [
+          {
+            address = "192.168.56.1";
+            prefixLength = 24;
+          }
+        ];
        # Make sure NetworkManager won't assume this interface being up
        # means we have internet access.
-    networking.networkmanager.unmanaged = ["vboxnet0"];
-  }) (lib.mkIf config.networking.useNetworkd {
+        networking.networkmanager.unmanaged = [ "vboxnet0" ];
+      })
+      (lib.mkIf config.networking.useNetworkd {
        systemd.network.networks."40-vboxnet0".extraConfig = ''
          [Link]
          RequiredForOnline=no
        '';
      })

-]);
+    ]
+  );
 }
--- a/third_party/nixpkgs/nixos/tests/all-tests.nix
+++ b/third_party/nixpkgs/nixos/tests/all-tests.nix
@ -245,6 +245,7 @@ in {
  curl-impersonate = handleTest ./curl-impersonate.nix {};
  custom-ca = handleTest ./custom-ca.nix {};
  croc = handleTest ./croc.nix {};
+  cyrus-imap = runTest ./cyrus-imap.nix;
  darling = handleTest ./darling.nix {};
  darling-dmg = runTest ./darling-dmg.nix;
  dae = handleTest ./dae.nix {};
@ -928,6 +929,7 @@ in {
  sourcehut = handleTest ./sourcehut {};
  spacecookie = handleTest ./spacecookie.nix {};
  spark = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./spark {};
+  spiped = runTest ./spiped.nix;
  sqlite3-to-mysql = handleTest ./sqlite3-to-mysql.nix {};
  sslh = handleTest ./sslh.nix {};
  ssh-agent-auth = handleTest ./ssh-agent-auth.nix {};
@ -1106,6 +1108,7 @@ in {
  vscode-remote-ssh = handleTestOn ["x86_64-linux"] ./vscode-remote-ssh.nix {};
  vscodium = discoverTests (import ./vscodium.nix);
  vsftpd = handleTest ./vsftpd.nix {};
+  wakapi = handleTest ./wakapi.nix {};
  warzone2100 = handleTest ./warzone2100.nix {};
  wasabibackend = handleTest ./wasabibackend.nix {};
  wastebin = handleTest ./wastebin.nix {};
--- a/third_party/nixpkgs/nixos/tests/cyrus-imap.nix
+++ b/third_party/nixpkgs/nixos/tests/cyrus-imap.nix
@ -0,0 +1,120 @@
+{ lib, pkgs, ... }:
+{
+  name = "cyrus-imap";
+
+  meta = {
+    maintainers = with lib.maintainers; [ moraxyc ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = with pkgs; [
+        curl
+        sudo
+      ];
+      services.saslauthd = {
+        enable = true;
+        config = ''
+          DESC="SASL Authentication Daemon"
+          NAME="saslauthd"
+          MECH_OPTIONS=""
+          THREADS=5
+          START=yes
+          OPTIONS="-c -m /run/saslauthd"
+        '';
+      };
+      services.cyrus-imap = {
+        enable = true;
+        cyrusSettings = {
+          START = {
+            recover = {
+              cmd = [
+                "ctl_cyrusdb"
+                "-r"
+              ];
+            };
+          };
+          EVENTS = {
+            tlsprune = {
+              cmd = [ "tls_prune" ];
+              at = 400;
+            };
+            delprune = {
+              cmd = [
+                "cyr_expire"
+                "-E"
+                "3"
+              ];
+              at = 400;
+            };
+            deleteprune = {
+              cmd = [
+                "cyr_expire"
+                "-E"
+                "4"
+                "-D"
+                "28"
+              ];
+              at = 430;
+            };
+            expungeprune = {
+              cmd = [
+                "cyr_expire"
+                "-E"
+                "4"
+                "-X"
+                "28"
+              ];
+              at = 445;
+            };
+            checkpoint = {
+              cmd = [
+                "ctl_cyrusdb"
+                "-c"
+              ];
+              period = 30;
+            };
+          };
+          SERVICES = {
+            http = {
+              cmd = [ "httpd" ];
+              listen = "80";
+              prefork = 0;
+            };
+            imap = {
+              cmd = [ "imapd" ];
+              listen = "143";
+              prefork = 0;
+            };
+            lmtpunix = {
+              cmd = [ "lmtpd" ];
+              listen = "/run/cyrus/lmtp";
+              prefork = 0;
+            };
+            notify = {
+              cmd = [ "notifyd" ];
+              listen = "/run/cyrus/notify";
+              proto = "udp";
+              prefork = 0;
+            };
+          };
+        };
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("saslauthd.service")
+    machine.wait_for_unit("cyrus-imap.service")
+
+    machine.wait_for_open_port(80)
+    machine.wait_for_open_port(143)
+
+    machine.succeed("echo 'secret' | ${lib.getExe' pkgs.cyrus_sasl.bin "saslpasswd2"} -p -c cyrus")
+    machine.succeed("chown cyrus /etc/sasldb2")
+
+    machine.succeed("sudo -ucyrus curl --fail --max-time 10 imap://cyrus:secret@localhost:143")
+    machine.fail("curl --fail --max-time 10 imap://cyrus:wrongsecret@localhost:143")
+    machine.fail("curl --fail --max-time 10 -X PROPFIND -H 'Depth: 1' 'http://localhost/dav/addressbooks/user/cyrus@localhost/Default'")
+  '';
+}
--- a/third_party/nixpkgs/nixos/tests/firewall.nix
+++ b/third_party/nixpkgs/nixos/tests/firewall.nix
@ -3,14 +3,31 @@
 import ./make-test-python.nix ( { pkgs, nftables, ... } : {
  name = "firewall" + pkgs.lib.optionalString nftables "-nftables";
  meta = with pkgs.lib.maintainers; {
-    maintainers = [ ];
+    maintainers = [ rvfg garyguo ];
  };

  nodes =
    { walled =
        { ... }:
-        { networking.firewall.enable = true;
-          networking.firewall.logRefusedPackets = true;
+        { networking.firewall = {
+            enable = true;
+            logRefusedPackets = true;
+            # Syntax smoke test, not actually verified otherwise
+            allowedTCPPorts = [ 25 993 8005 ];
+            allowedTCPPortRanges = [
+              { from = 980; to = 1000; }
+              { from = 990; to = 1010; }
+              { from = 8000; to = 8010; }
+            ];
+            interfaces.eth0 = {
+              allowedTCPPorts = [ 10003 ];
+              allowedTCPPortRanges = [ { from = 10000; to = 10005; } ];
+            };
+            interfaces.eth3 = {
+              allowedUDPPorts = [ 10003 ];
+              allowedUDPPortRanges = [ { from = 10000; to = 10005; } ];
+            };
+          };
          networking.nftables.enable = nftables;
          services.httpd.enable = true;
          services.httpd.adminAddr = "foo@example.org";
@ -48,6 +65,14 @@ import ./make-test-python.nix ( { pkgs, nftables, ... } : {
    walled.succeed("curl -v http://attacker/ >&2")
    walled.succeed("ping -c 1 attacker >&2")

+    # Open tcp port 80 at runtime
+    walled.succeed("nixos-firewall-tool open tcp 80")
+    attacker.succeed("curl -v http://walled/ >&2")
+
+    # Reset the firewall
+    walled.succeed("nixos-firewall-tool reset")
+    attacker.fail("curl --fail --connect-timeout 2 http://walled/ >&2")
+
    # If we stop the firewall, then connections should succeed.
    walled.stop_job("${unit}")
    attacker.succeed("curl -v http://walled/ >&2")
--- a/third_party/nixpkgs/nixos/tests/kanidm.nix
+++ b/third_party/nixpkgs/nixos/tests/kanidm.nix
@ -16,7 +16,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
  in
  {
    name = "kanidm";
-    meta.maintainers = with pkgs.lib.maintainers; [ erictapen Flakebi oddlama ];
+    meta.maintainers = with pkgs.lib.maintainers; [ Flakebi oddlama ];

    nodes.server = { pkgs, ... }: {
      services.kanidm = {
--- a/third_party/nixpkgs/nixos/tests/keymap.nix
+++ b/third_party/nixpkgs/nixos/tests/keymap.nix
@ -11,15 +11,15 @@ let

  testReader = pkgs.writeScript "test-input-reader" ''
    rm -f ${resultFile} ${resultFile}.tmp
-    logger "testReader: START: Waiting for $1 characters, expecting '$2'."
+    logger "testReader: START: expecting '$1'."
    touch ${readyFile}
-    read -r -N $1 chars
+    read -r -N ''${#1} -t 60 chars
    rm -f ${readyFile}

-    if [ "$chars" == "$2" ]; then
-      logger -s "testReader: PASS: Got '$2' as expected." 2>${resultFile}.tmp
+    if [ "$chars" == "$1" ]; then
+      logger -s "testReader: PASS: Got '$1' as expected." 2>${resultFile}.tmp
    else
-      logger -s "testReader: FAIL: Expected '$2' but got '$chars'." 2>${resultFile}.tmp
+      logger -s "testReader: FAIL: Expected '$1' but got '$chars'." 2>${resultFile}.tmp
    fi
    # rename after the file is written to prevent a race condition
    mv  ${resultFile}.tmp ${resultFile}
@ -39,29 +39,19 @@ let
      import shlex


-      def run_test_case(cmd, xorg_keymap, test_case_name, inputs, expected):
-          with subtest(test_case_name):
+      def run_test_case(cmd, inputs, expected):
          assert len(inputs) == len(expected)
          machine.execute("rm -f ${readyFile} ${resultFile}")

          # set up process that expects all the keys to be entered
          machine.succeed(
-                  "{} {} {} {} >&2 &".format(
+              "${pkgs.systemd}/bin/systemd-cat -t input-test-reader -- {} {} {} &".format(
                  cmd,
                  "${testReader}",
-                      len(inputs),
                  shlex.quote("".join(expected)),
              )
          )

-              if xorg_keymap:
-                  # make sure the xterm window is open and has focus
-                  machine.wait_for_window("testterm")
-                  machine.wait_until_succeeds(
-                      "${pkgs.xdotool}/bin/xdotool search --sync --onlyvisible "
-                      "--class testterm windowfocus --sync"
-                  )
-
          # wait for reader to be ready
          machine.wait_for_file("${readyFile}")

@ -87,19 +77,17 @@ let
      # fighting over the virtual terminal. This does not appear to be a problem
      # when the X test runs first.
      keymap_environments = {
-          "Xorg Keymap": "DISPLAY=:0 xterm -title testterm -class testterm -fullscreen -e",
-          "VT Keymap": "openvt -sw --",
+          "Xorg Keymap": "env DISPLAY=:0 xterm -title testterm -class testterm -fullscreen -e",
+          "VT Keymap": "openvt -c 2 -sw --",
      }

      machine.wait_for_x()

-      for keymap_env_name, command in keymap_environments.items():
-          with subtest(keymap_env_name):
      for test_case_name, test_data in tests.items():
+          for keymap_env_name, command in keymap_environments.items():
+              with subtest(f"{test_case_name} - {keymap_env_name}"):
                  run_test_case(
                      command,
-                      False,
-                      test_case_name,
                      test_data["qwerty"],
                      test_data["expect"],
                  )
--- a/third_party/nixpkgs/nixos/tests/mihomo.nix
+++ b/third_party/nixpkgs/nixos/tests/mihomo.nix
@ -39,6 +39,8 @@ import ./make-test-python.nix ({ pkgs, ... }: {
    machine.fail("curl --fail --max-time 10 --proxy socks5://user:supervillain@localhost:7890 http://localhost")

    # Web UI
-    machine.succeed("curl --fail http://localhost:9090") == '{"hello":"clash"}'
+    result = machine.succeed("curl --fail http://localhost:9090")
+    target = '{"hello":"mihomo"}\n'
+    assert result == target, f"{result!r} != {target!r}"
  '';
 })
--- a/third_party/nixpkgs/nixos/tests/spiped.nix
+++ b/third_party/nixpkgs/nixos/tests/spiped.nix
@ -0,0 +1,73 @@
+{ pkgs, ... }:
+let
+  key = pkgs.runCommand "key" { } "${pkgs.openssl}/bin/openssl rand 32 > $out";
+in
+{
+  name = "spiped";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ tomfitzhenry ];
+  };
+
+  nodes = {
+    server =
+      { pkgs, lib, ... }:
+      {
+        services.caddy = {
+          enable = true;
+          settings = {
+            apps.http.servers.default = {
+              listen = [ ":80" ];
+              routes = [
+                {
+                  handle = [
+                    {
+                      body = "hello world";
+                      handler = "static_response";
+                      status_code = 200;
+                    }
+                  ];
+                }
+              ];
+            };
+          };
+        };
+
+        systemd.services."spiped@server" = {
+          wantedBy = [ "multi-user.target" ];
+          overrideStrategy = "asDropin";
+        };
+        systemd.services."spiped@client" = {
+          wantedBy = [ "multi-user.target" ];
+          overrideStrategy = "asDropin";
+        };
+        services.spiped = {
+          enable = true;
+          config = {
+            server = {
+              source = "localhost:8080";
+              target = "localhost:80";
+              keyfile = key;
+              decrypt = true;
+            };
+            client = {
+              source = "localhost:8081";
+              target = "localhost:8080";
+              keyfile = key;
+              encrypt = true;
+            };
+          };
+        };
+      };
+  };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      server.wait_for_unit("caddy")
+      server.wait_for_open_port(80)
+      server.wait_for_open_port(8080)
+      server.wait_for_open_port(8081)
+
+      server.succeed("curl http://localhost:8081 | grep hello")
+    '';
+}
--- a/third_party/nixpkgs/nixos/tests/teleport.nix
+++ b/third_party/nixpkgs/nixos/tests/teleport.nix
@ -9,7 +9,6 @@ with import ../lib/testing-python.nix { inherit system pkgs; };
 let
  packages = with pkgs; {
    "default" = teleport;
-    "14" = teleport_14;
    "15" = teleport_15;
  };

--- a/third_party/nixpkgs/nixos/tests/wakapi.nix
+++ b/third_party/nixpkgs/nixos/tests/wakapi.nix
@ -0,0 +1,40 @@
+import ./make-test-python.nix (
+  { lib, ... }:
+  {
+    name = "Wakapi";
+
+    nodes.machine = {
+      services.wakapi = {
+        enable = true;
+        settings = {
+          server.port = 3000; # upstream default, set explicitly in case upstream changes it
+
+          db = {
+            dialect = "postgres"; # `createLocally` only supports postgres
+            host = "/run/postgresql";
+            port = 5432; # service will fail if port is not set
+            name = "wakapi";
+            user = "wakapi";
+          };
+        };
+
+        database.createLocally = true;
+
+        # Created with `cat /dev/urandom | LC_ALL=C tr -dc 'a-zA-Z0-9' | fold -w ${1:-32} | head -n 1`
+        # Prefer passwordSaltFile in production.
+        passwordSalt = "NpqCY7eY7fMoIWYmPx5mAgr6YoSlXSuI";
+      };
+    };
+
+    # Test that the service is running and that it is reachable.
+    # This is not very comprehensive for a test, but it should
+    # catch very basic mistakes in the module.
+    testScript = ''
+      machine.wait_for_unit("wakapi.service")
+      machine.wait_for_open_port(3000)
+      machine.succeed("curl --fail http://localhost:3000")
+    '';
+
+    meta.maintainers = [ lib.maintainers.NotAShelf ];
+  }
+)
--- a/third_party/nixpkgs/nixos/tests/xmpp/ejabberd.nix
+++ b/third_party/nixpkgs/nixos/tests/xmpp/ejabberd.nix
@ -1,3 +1,10 @@
+let
+  cert = pkgs: pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
+    openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -subj '/CN=example.com/CN=muc.example.com' -days 36500
+    mkdir -p $out
+    cp key.pem cert.pem $out
+  '';
+in
 import ../make-test-python.nix ({ pkgs, ... }: {
  name = "ejabberd";
  meta = with pkgs.lib.maintainers; {
@ -5,6 +12,7 @@ import ../make-test-python.nix ({ pkgs, ... }: {
  };
  nodes = {
    client = { nodes, pkgs, ... }: {
+      security.pki.certificateFiles = [ "${cert pkgs}/cert.pem" ];
      networking.extraHosts = ''
        ${nodes.server.config.networking.primaryIPAddress} example.com
      '';
@ -14,6 +22,7 @@ import ../make-test-python.nix ({ pkgs, ... }: {
      ];
    };
    server = { config, pkgs, ... }: {
+      security.pki.certificateFiles = [ "${cert pkgs}/cert.pem" ];
      networking.extraHosts = ''
        ${config.networking.primaryIPAddress} example.com
      '';
@ -23,6 +32,7 @@ import ../make-test-python.nix ({ pkgs, ... }: {
        configFile = "/etc/ejabberd.yml";
      };

+      systemd.services.ejabberd.serviceConfig.TimeoutStartSec = "15min";
      environment.etc."ejabberd.yml" = {
        user = "ejabberd";
        mode = "0600";
@ -40,6 +50,7 @@ import ../make-test-python.nix ({ pkgs, ... }: {
              max_stanza_size: 65536
              shaper: c2s_shaper
              access: c2s
+              starttls: true
            -
              port: 5269
              ip: "::"
@ -56,6 +67,10 @@ import ../make-test-python.nix ({ pkgs, ... }: {
              request_handlers:
                "/upload": mod_http_upload

+          certfiles:
+            - ${cert pkgs}/key.pem
+            - ${cert pkgs}/cert.pem
+
          ## Disabling digest-md5 SASL authentication. digest-md5 requires plain-text
          ## password storage (see auth_password_format option).
          disable_sasl_mechanisms: "digest-md5"
--- a/third_party/nixpkgs/pkgs/README.md
+++ b/third_party/nixpkgs/pkgs/README.md
@ -132,6 +132,8 @@ Now that this is out of the way. To add a package to Nixpkgs:

    https://www.mozilla.org/en-US/firefox/55.0/releasenotes/

+(using "→" instead of "->" is also accepted)
+
 ## Category Hierarchy
 [categories]: #category-hierarchy

--- a/third_party/nixpkgs/pkgs/applications/audio/flac/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/flac/default.nix
@ -44,6 +44,7 @@ stdenv.mkDerivation rec {
    homepage = "https://xiph.org/flac/";
    description = "Library and tools for encoding and decoding the FLAC lossless audio file format";
    changelog = "https://xiph.org/flac/changelog.html";
+    mainProgram = "flac";
    platforms = platforms.all;
    license = licenses.bsd3;
    maintainers = with maintainers; [ ruuda ];
--- a/third_party/nixpkgs/pkgs/applications/audio/pocket-casts/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/pocket-casts/default.nix
@ -9,16 +9,16 @@

 buildNpmPackage rec {
  pname = "pocket-casts";
-  version = "0.7.0";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "felicianotech";
    repo = "pocket-casts-desktop-app";
    rev = "v${version}";
-    hash = "sha256-d4uVeHy4/91Ki6Wk6GlOt2lcK6U+M7fOryiOYA7q/x4=";
+    hash = "sha256-PwM9B2Qx4TxlcahQM/KEBTzWKc4cNrleDEYKg0m8bVE=";
  };

-  npmDepsHash = "sha256-rMLUQGcbBJBbxXP67lXp0ww8U2HYM/m1CP2dOw1cCHc=";
+  npmDepsHash = "sha256-WPuXTcHCKrwepITGtZFCIwylVAdYlI3cNsuhqx1AEYI=";

  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";

@ -52,7 +52,7 @@ buildNpmPackage rec {
    description = "Pocket Casts webapp, packaged for the Linux Desktop";
    homepage = "https://github.com/felicianotech/pocket-casts-desktop-app";
    license = licenses.mit;
-    maintainers = [ ];
+    maintainers = with maintainers; [ yayayayaka ];
    mainProgram = "pocket-casts";
    platforms = platforms.linux;
  };
--- a/third_party/nixpkgs/pkgs/applications/audio/polyphone/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/polyphone/default.nix
@ -17,14 +17,14 @@
 }:

 stdenv.mkDerivation rec {
-  version = "2.4.0";
+  version = "2.4.1";
  pname = "polyphone";

  src = fetchFromGitHub {
    owner = "davy7125";
    repo = "polyphone";
    rev = version;
-    hash = "sha256-cPHLmqsS4ReqOCcsgOf77V/ShIkk7chGoJ6bU4W5ejs=";
+    hash = "sha256-43EswCgNJv11Ov+4vmj2vS/yJ2atyzkRmk/SoCKYD/0=";
  };

  nativeBuildInputs = [
--- a/third_party/nixpkgs/pkgs/applications/audio/tonelib-gfx/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/tonelib-gfx/default.nix
@ -1,29 +1,33 @@
-{ lib
-, stdenv
-, fetchurl
-, autoPatchelfHook
-, dpkg
-, alsa-lib
-, freetype
-, libglvnd
-, curl
-, libXcursor
-, libXinerama
-, libXrandr
-, libXrender
-, libjack2
+{
+  lib,
+  stdenv,
+  fetchurl,
+  autoPatchelfHook,
+  dpkg,
+  alsa-lib,
+  freetype,
+  libglvnd,
+  curl,
+  libXcursor,
+  libXinerama,
+  libXrandr,
+  libXrender,
+  libjack2,
 }:

 stdenv.mkDerivation rec {
  pname = "tonelib-gfx";
-  version = "4.7.8";
+  version = "4.8.5";

  src = fetchurl {
-    url = "https://tonelib.net/download/221222/ToneLib-GFX-amd64.deb";
-    hash = "sha256-1sTwHqQYqNloZ3XSwhryqlW7b1FHh4ymtj3rKUcVZIo=";
+    url = "https://tonelib.vip/download/24-10-03/ToneLib-GFX-amd64.deb";
+    hash = "sha256-RG5rliF4/9LDd07i5dSFQzTGPqyF6UmTfatKb59LZA4=";
  };

-  nativeBuildInputs = [ autoPatchelfHook dpkg ];
+  nativeBuildInputs = [
+    autoPatchelfHook
+    dpkg
+  ];

  buildInputs = [
    stdenv.cc.cc.lib
@ -53,7 +57,11 @@ stdenv.mkDerivation rec {
    homepage = "https://tonelib.net/";
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
    license = licenses.unfree;
-    maintainers = with maintainers; [ dan4ik605743 orivej ];
+    maintainers = with maintainers; [
+      dan4ik605743
+      husjon
+      orivej
+    ];
    platforms = [ "x86_64-linux" ];
    mainProgram = "ToneLib-GFX";
  };
--- a/third_party/nixpkgs/pkgs/applications/audio/youtube-music/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/audio/youtube-music/default.nix
@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {

  pnpmDeps = pnpm.fetchDeps {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-lxqBmtHkyk4mnM/AJQmpyCmvhW2e96vZBkgtoREjEXY=";
+    hash = "sha256-6Fh1fbl7Y33EyWbWUhe70CGzhc4y+I59vPbzZydoJ18=";
  };

  nativeBuildInputs = [ makeWrapper python3 nodejs pnpm.configHook ]
--- a/third_party/nixpkgs/pkgs/applications/blockchains/groestlcoin/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/blockchains/groestlcoin/default.nix
@ -2,7 +2,6 @@
 , stdenv
 , fetchurl
 , fetchFromGitHub
-, fetchpatch2
 , autoreconfHook
 , pkg-config
 , installShellFiles
@ -15,6 +14,7 @@
 , miniupnpc
 , zeromq
 , zlib
+, db53
 , sqlite
 , qrencode
 , qtbase ? null
@ -33,23 +33,15 @@ let
 in
 stdenv.mkDerivation rec {
  pname = if withGui then "groestlcoin" else "groestlcoind";
-  version = "27.0";
+  version = "28.0";

  src = fetchFromGitHub {
    owner = "Groestlcoin";
    repo = "groestlcoin";
    rev = "v${version}";
-    sha256 = "0f6vi2k5xvjrhiazfjcd4aj246dfcg51xsnqb9wdjl41cg0ckwmf";
+    sha256 = "0kl7nq62362clgzxwwd5c256xnaar4ilxcvbralazxg47zv95r11";
  };

-  patches = [
-    # upnp: add compatibility for miniupnpc 2.2.8
-    (fetchpatch2 {
-      url = "https://github.com/Groestlcoin/groestlcoin/commit/8acdf66540834b9f9cf28f16d389e8b6a48516d5.patch?full_index=1";
-      hash = "sha256-oDvHUvwAEp0LJCf6QBESn38Bu359TcPpLhvuLX3sm6M=";
-    })
-  ];
-
  nativeBuildInputs = [ autoreconfHook pkg-config installShellFiles ]
    ++ lib.optionals stdenv.hostPlatform.isLinux [ util-linux ]
    ++ lib.optionals stdenv.hostPlatform.isDarwin [ hexdump ]
@ -57,7 +49,7 @@ stdenv.mkDerivation rec {
    ++ lib.optionals withGui [ wrapQtAppsHook ];

  buildInputs = [ boost libevent miniupnpc zeromq zlib ]
-    ++ lib.optionals withWallet [ sqlite ]
+    ++ lib.optionals withWallet [ db53 sqlite ]
    ++ lib.optionals withGui [ qrencode qtbase qttools ];

  postInstall = ''
--- a/third_party/nixpkgs/pkgs/applications/blockchains/ledger-live-desktop/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/blockchains/ledger-live-desktop/default.nix
@ -2,11 +2,11 @@

 let
  pname = "ledger-live-desktop";
-  version = "2.84.1";
+  version = "2.89.1";

  src = fetchurl {
    url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-V/bOCddc7UhmN8zlHmKj+H4v+ZZ/qn8jRj0jH4EtwMI=";
+    hash = "sha256-PPoQnXDVf6Q6QPVE41guJL1vu7rW7mZdpRZjRME3Ue8=";
  };

  appimageContents = appimageTools.extractType2 {
--- a/third_party/nixpkgs/pkgs/applications/editors/cudatext/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/editors/cudatext/default.nix
@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, coreutils
 , lazarus
 , fpc
 , libX11
@ -53,6 +54,8 @@ stdenv.mkDerivation rec {
    substituteInPlace app/proc_globdata.pas \
      --subst-var out \
      --subst-var-by python3 ${python3}
+    substituteInPlace app/proc_editor_saving.pas \
+      --replace-fail '/bin/cp' "${coreutils}/bin/cp"
  '';

  nativeBuildInputs = [ lazarus fpc ]
--- a/third_party/nixpkgs/pkgs/applications/editors/music/tuxguitar/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/editors/music/tuxguitar/default.nix
@ -1,48 +0,0 @@
-{ lib, stdenv, fetchurl, swt, jre, makeWrapper, alsa-lib, jack2, fluidsynth, libpulseaudio, nixosTests }:
-
-let metadata = assert stdenv.hostPlatform.system == "i686-linux" || stdenv.hostPlatform.system == "x86_64-linux";
-  if stdenv.hostPlatform.system == "i686-linux" then
-    { arch = "x86"; sha256 = "sha256-k4FQrt72VNb5FdYMzxskcVhKlvx8MZelUlLCItxDB7c="; }
-  else
-    { arch = "x86_64"; sha256 = "sha256-mj5wVQlY2xFzdulvMdb5Qb5HGwr7RElzIkpOLjaAfGA="; };
-in stdenv.mkDerivation rec {
-  version = "1.5.5";
-  pname = "tuxguitar";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/${pname}/${pname}-${version}-linux-${metadata.arch}.tar.gz";
-    sha256 = metadata.sha256;
-  };
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp -r dist lib share $out/
-    cp tuxguitar.sh $out/bin/tuxguitar
-
-    ln -s $out/dist $out/bin/dist
-    ln -s $out/lib $out/bin/lib
-    ln -s $out/share $out/bin/share
-
-    wrapProgram $out/bin/tuxguitar \
-      --set JAVA "${jre}/bin/java" \
-      --prefix LD_LIBRARY_PATH : "$out/lib/:${lib.makeLibraryPath [ swt alsa-lib jack2 fluidsynth libpulseaudio ]}" \
-      --prefix CLASSPATH : "${swt}/jars/swt.jar:$out/lib/tuxguitar.jar:$out/lib/itext.jar"
-  '';
-
-  passthru.tests = { inherit (nixosTests) tuxguitar; };
-
-  meta = with lib; {
-    description = "Multitrack guitar tablature editor";
-    longDescription = ''
-      TuxGuitar is a multitrack guitar tablature editor and player written
-      in Java-SWT. It can open GuitarPro, PowerTab and TablEdit files.
-    '';
-    homepage = "http://www.tuxguitar.com.ar/";
-    sourceProvenance = with sourceTypes; [ binaryBytecode ];
-    license = licenses.lgpl2;
-    maintainers = [ maintainers.ardumont ];
-    platforms = platforms.linux;
-  };
-}
--- a/third_party/nixpkgs/pkgs/applications/editors/neovim/ruby_provider/Gemfile.lock
+++ b/third_party/nixpkgs/pkgs/applications/editors/neovim/ruby_provider/Gemfile.lock
@ -1,9 +1,9 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    msgpack (1.5.1)
+    msgpack (1.7.2)
    multi_json (1.15.0)
-    neovim (0.9.0)
+    neovim (0.10.0)
      msgpack (~> 1.1)
      multi_json (~> 1.0)

@ -14,4 +14,4 @@ DEPENDENCIES
  neovim

 BUNDLED WITH
-   2.1.4
+   2.3.27
--- a/third_party/nixpkgs/pkgs/applications/editors/neovim/ruby_provider/gemset.nix
+++ b/third_party/nixpkgs/pkgs/applications/editors/neovim/ruby_provider/gemset.nix
@ -4,10 +4,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "sha256-fPWiGi0w4OFlMZOIf3gd21jyeYhg5t/VdLz7kK9fD8Q=";
+      sha256 = "1a5adcb7bwan09mqhj3wi9ib52hmdzmqg7q08pggn3adibyn5asr";
      type = "gem";
    };
-    version = "1.5.1";
+    version = "1.7.2";
  };
  multi_json = {
    groups = ["default"];
@ -25,9 +25,9 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "sha256-hRI43XGHGeqxMvpFjp0o79GGReiLXTkhwh5LYq6AQL4=";
+      sha256 = "0gl34rriwwmj6p1s6ms0b311wmqaqiyc510svq31283jk0kp0qcd";
      type = "gem";
    };
-    version = "0.9.0";
+    version = "0.10.0";
  };
 }
--- a/third_party/nixpkgs/pkgs/applications/editors/neovim/wrapper.nix
+++ b/third_party/nixpkgs/pkgs/applications/editors/neovim/wrapper.nix
@ -107,7 +107,10 @@ let

    wrapperArgsStr = if lib.isString wrapperArgs then wrapperArgs else lib.escapeShellArgs wrapperArgs;

-    generatedWrapperArgs =
+    generatedWrapperArgs = let
+      binPath = lib.makeBinPath (lib.optional finalAttrs.withRuby rubyEnv ++ lib.optional finalAttrs.withNodeJs nodejs);
+    in
+
      # vim accepts a limited number of commands so we join them all
          [
            "--add-flags" ''--cmd "lua ${providerLuaRc}"''
@ -116,10 +119,15 @@ let
            "--add-flags" ''--cmd "set packpath^=${finalPackdir}"''
            "--add-flags" ''--cmd "set rtp^=${finalPackdir}"''
          ]
+          ++ lib.optionals finalAttrs.withRuby [
+            "--set" "GEM_HOME" "${rubyEnv}/${rubyEnv.ruby.gemPath}"
+          ] ++ lib.optionals (binPath != "") [
+            "--suffix" "PATH" ":" binPath
+          ]
          ;

    providerLuaRc = neovimUtils.generateProviderRc {
-      inherit withPython3 withNodeJs withPerl;
+      inherit (finalAttrs) withPython3 withNodeJs withPerl;
      withRuby = rubyEnv != null;
    };

--- a/third_party/nixpkgs/pkgs/applications/editors/vim/plugins/avante-nvim/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/editors/vim/plugins/avante-nvim/default.nix
@ -10,13 +10,13 @@
 }:

 let
-  version = "2024-09-30";
+  version = "2024-10-18";

  src = fetchFromGitHub {
    owner = "yetone";
    repo = "avante.nvim";
-    rev = "0705234991d03170a72582085dc508600a03a779";
-    hash = "sha256-tAigYqS3ZAtZJp7RaarbXrDxrjiYu2wjNHq6GP/BMfk=";
+    rev = "36b23cef16c2c624c34bea213f01c06782d2ca40";
+    hash = "sha256-QUFcJMbfr5BAS04ig1IHLCMLACeQhFVH9ZCH/VD8i8Y=";
  };

  meta = with lib; {
@ -71,6 +71,5 @@ vimUtils.buildVimPlugin {
    '';

  doInstallCheck = true;
-  # TODO: enable after https://github.com/NixOS/nixpkgs/pull/342240 merged
-  # nvimRequireCheck = "avante";
+  nvimRequireCheck = "avante";
 }
--- a/third_party/nixpkgs/pkgs/applications/editors/vim/plugins/blink-cmp/Cargo.lock
+++ b/third_party/nixpkgs/pkgs/applications/editors/vim/plugins/blink-cmp/Cargo.lock
@ -0,0 +1,572 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "bincode"
+version = "1.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "bitflags"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b048fb63fd8b5923fc5aa7b340d8e156aec7ec02f0c78fa8a6ddc2613f6f71de"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "blink-cmp-fuzzy"
+version = "0.1.0"
+dependencies = [
+ "c-marshalling",
+ "frizbee",
+ "generator",
+ "heed",
+ "lazy_static",
+ "libc",
+ "lua-marshalling",
+ "regex",
+ "serde",
+]
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "c-marshalling"
+version = "0.2.0"
+source = "git+https://github.com/distil/rust_lua_ffi#30820cdc9282c938dbf8e7bb0a1ea31cf56b25a6"
+dependencies = [
+ "libc",
+ "quick-error",
+]
+
+[[package]]
+name = "cc"
+version = "1.1.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58e804ac3194a48bb129643eb1d62fcc20d18c6b8c181704489353d13120bcd1"
+dependencies = [
+ "shlex",
+]
+
+[[package]]
+name = "crossbeam-queue"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df0346b5d5e76ac2fe4e327c5fd1118d6be7c51dfb18f9b7922923f287471e35"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22ec99545bb0ed0ea7bb9b8e1e9122ea386ff8a48c0922e43f36d45ab09e0e80"
+
+[[package]]
+name = "derive-c-marshalling-library"
+version = "0.1.0"
+source = "git+https://github.com/distil/rust_lua_ffi#30820cdc9282c938dbf8e7bb0a1ea31cf56b25a6"
+dependencies = [
+ "libc",
+ "quote 0.4.2",
+ "syn 0.12.15",
+]
+
+[[package]]
+name = "derive-lua-marshalling"
+version = "0.2.0"
+source = "git+https://github.com/distil/rust_lua_ffi#30820cdc9282c938dbf8e7bb0a1ea31cf56b25a6"
+dependencies = [
+ "derive-c-marshalling-library",
+ "libc",
+ "quote 0.4.2",
+ "syn 0.12.15",
+]
+
+[[package]]
+name = "doxygen-rs"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "415b6ec780d34dcf624666747194393603d0373b7141eef01d12ee58881507d9"
+dependencies = [
+ "phf",
+]
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13624c2627564efccf4934284bdd98cbaa14e79b0b5a141218e507b3a823456"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "frizbee"
+version = "0.1.0"
+source = "git+https://github.com/saghen/frizbee#d910bec53b867ce06702520c7e05f9862bf78dd9"
+dependencies = [
+ "memchr",
+ "smith_waterman_macro",
+]
+
+[[package]]
+name = "generator"
+version = "2.0.0"
+source = "git+https://github.com/distil/rust_lua_ffi#30820cdc9282c938dbf8e7bb0a1ea31cf56b25a6"
+dependencies = [
+ "parser",
+ "quote 0.4.2",
+ "syn 0.12.15",
+]
+
+[[package]]
+name = "heed"
+version = "0.20.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d4f449bab7320c56003d37732a917e18798e2f1709d80263face2b4f9436ddb"
+dependencies = [
+ "bitflags",
+ "byteorder",
+ "heed-traits",
+ "heed-types",
+ "libc",
+ "lmdb-master-sys",
+ "once_cell",
+ "page_size",
+ "serde",
+ "synchronoise",
+ "url",
+]
+
+[[package]]
+name = "heed-traits"
+version = "0.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb3130048d404c57ce5a1ac61a903696e8fcde7e8c2991e9fcfc1f27c3ef74ff"
+
+[[package]]
+name = "heed-types"
+version = "0.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d3f528b053a6d700b2734eabcd0fd49cb8230647aa72958467527b0b7917114"
+dependencies = [
+ "bincode",
+ "byteorder",
+ "heed-traits",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "idna"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "634d9b1461af396cad843f47fdba5597a4f9e6ddd4bfb6ff5d85028c25cb12f6"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+
+[[package]]
+name = "libc"
+version = "0.2.159"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "561d97a539a36e26a9a5fad1ea11a3039a67714694aaa379433e580854bc3dc5"
+
+[[package]]
+name = "lmdb-master-sys"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "472c3760e2a8d0f61f322fb36788021bb36d573c502b50fa3e2bcaac3ec326c9"
+dependencies = [
+ "cc",
+ "doxygen-rs",
+ "libc",
+]
+
+[[package]]
+name = "lua-marshalling"
+version = "0.3.0"
+source = "git+https://github.com/distil/rust_lua_ffi#30820cdc9282c938dbf8e7bb0a1ea31cf56b25a6"
+dependencies = [
+ "c-marshalling",
+ "derive-lua-marshalling",
+ "lazy_static",
+ "libc",
+]
+
+[[package]]
+name = "memchr"
+version = "2.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
+
+[[package]]
+name = "once_cell"
+version = "1.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1261fe7e33c73b354eab43b1273a57c8f967d0391e80353e51f764ac02cf6775"
+
+[[package]]
+name = "page_size"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30d5b2194ed13191c1999ae0704b7839fb18384fa22e49b57eeaa97d79ce40da"
+dependencies = [
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "parser"
+version = "0.2.0"
+source = "git+https://github.com/distil/rust_lua_ffi#30820cdc9282c938dbf8e7bb0a1ea31cf56b25a6"
+dependencies = [
+ "quote 0.4.2",
+ "syn 0.12.15",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
+
+[[package]]
+name = "phf"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ade2d8b8f33c7333b51bcf0428d37e217e9f32192ae4772156f65063b8ce03dc"
+dependencies = [
+ "phf_macros",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48e4cc64c2ad9ebe670cb8fd69dd50ae301650392e81c05f9bfcb2d5bdbc24b0"
+dependencies = [
+ "phf_shared",
+ "rand",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3444646e286606587e49f3bcf1679b8cef1dc2c5ecc29ddacaffc305180d464b"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2 1.0.87",
+ "quote 1.0.37",
+ "syn 2.0.79",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90fcb95eef784c2ac79119d1dd819e162b5da872ce6f3c3abe1e8ca1c082f72b"
+dependencies = [
+ "siphasher",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd07deb3c6d1d9ff827999c7f9b04cdfd66b1b17ae508e14fe47b620f2282ae0"
+dependencies = [
+ "unicode-xid",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.87"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b3e4daa0dcf6feba26f985457cdf104d4b4256fc5a09547140f3631bb076b19a"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quick-error"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
+
+[[package]]
+name = "quote"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1eca14c727ad12702eb4b6bfb5a232287dcf8385cb8ca83a3eeaf6519c44c408"
+dependencies = [
+ "proc-macro2 0.2.3",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5b9d34b8991d19d98081b46eacdd8eb58c6f2b201139f7c5f643cc155a633af"
+dependencies = [
+ "proc-macro2 1.0.87",
+]
+
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "rand_core",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+
+[[package]]
+name = "regex"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38200e5ee88914975b69f657f0801b6f6dccafd44fd9326302a4aaeecfacb1d8"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "368758f23274712b504848e9d5a6f010445cc8b87a7cdb4d7cbee666c1288da3"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
+
+[[package]]
+name = "ryu"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
+
+[[package]]
+name = "serde"
+version = "1.0.210"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8e3592472072e6e22e0a54d5904d9febf8508f65fb8552499a1abc7d1078c3a"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.210"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "243902eda00fad750862fc144cea25caca5e20d615af0a81bee94ca738f1df1f"
+dependencies = [
+ "proc-macro2 1.0.87",
+ "quote 1.0.37",
+ "syn 2.0.79",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.128"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ff5456707a1de34e7e37f2a6fd3d3f808c318259cbd01ab6377795054b483d8"
+dependencies = [
+ "itoa",
+ "memchr",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "siphasher"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38b58827f4464d87d377d175e90bf58eb00fd8716ff0a62f80356b5e61555d0d"
+
+[[package]]
+name = "smith_waterman_macro"
+version = "0.1.0"
+source = "git+https://github.com/saghen/frizbee#d910bec53b867ce06702520c7e05f9862bf78dd9"
+dependencies = [
+ "proc-macro2 1.0.87",
+ "quote 1.0.37",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "syn"
+version = "0.12.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c97c05b8ebc34ddd6b967994d5c6e9852fa92f8b82b3858c39451f97346dcce5"
+dependencies = [
+ "proc-macro2 0.2.3",
+ "quote 0.4.2",
+ "unicode-xid",
+]
+
+[[package]]
+name = "syn"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2 1.0.87",
+ "quote 1.0.37",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.79"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89132cd0bf050864e1d38dc3bbc07a0eb8e7530af26344d3d2bbbef83499f590"
+dependencies = [
+ "proc-macro2 1.0.87",
+ "quote 1.0.37",
+ "unicode-ident",
+]
+
+[[package]]
+name = "synchronoise"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3dbc01390fc626ce8d1cffe3376ded2b72a11bb70e1c75f404a210e4daa4def2"
+dependencies = [
+ "crossbeam-queue",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "445e881f4f6d382d5f27c034e25eb92edd7c784ceab92a0937db7f2e9471b938"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "unicode-bidi"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ab17db44d7388991a428b2ee655ce0c212e862eff1768a455c58f9aad6e7893"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e91b56cd4cadaeb79bbf1a5645f6b4f8dc5bde8834ad5894a8db35fda9efa1fe"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5033c97c4262335cded6d6fc3e5c18ab755e1a3dc96376350f3d8e9f009ad956"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-xid"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc72304796d0818e357ead4e000d19c9c174ab23dc11093ac919054d20a6a7fc"
+
+[[package]]
+name = "url"
+version = "2.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22784dbdf76fdde8af1aeda5622b546b422b6fc585325248a2bf9f5e41e94d6c"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
--- a/third_party/nixpkgs/pkgs/applications/editors/vim/plugins/blink-cmp/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/editors/vim/plugins/blink-cmp/default.nix
@ -0,0 +1,50 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  stdenv,
+  vimUtils,
+}:
+let
+  version = "0.3.1";
+  src = fetchFromGitHub {
+    owner = "Saghen";
+    repo = "blink.cmp";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-bvhLOM0NMx5S069uX2OecEpzYaR3hV4r8nCIPD0f0XQ=";
+  };
+  libExt = if stdenv.hostPlatform.isDarwin then "dylib" else "so";
+  blink-fuzzy-lib = rustPlatform.buildRustPackage {
+    inherit version src;
+    pname = "blink-fuzzy-lib";
+    env = {
+      # TODO: remove this if plugin stops using nightly rust
+      RUSTC_BOOTSTRAP = true;
+    };
+    cargoLock = {
+      lockFile = ./Cargo.lock;
+      outputHashes = {
+        "c-marshalling-0.2.0" = "sha256-eL6nkZOtuLLQ0r31X7uroUUDYZsWOJ9KNXl4NCVNRuw=";
+        "frizbee-0.1.0" = "sha256-zO2S282DVCjnALMXu3GxmAfjCXsPNUZ7+xgiqITfGmU=";
+      };
+    };
+  };
+in
+vimUtils.buildVimPlugin {
+  pname = "blink-cmp";
+  inherit version src;
+  preInstall = ''
+    mkdir -p target/release
+    ln -s ${blink-fuzzy-lib}/lib/libblink_cmp_fuzzy.${libExt} target/release/libblink_cmp_fuzzy.${libExt}
+  '';
+  meta = {
+    description = "Performant, batteries-included completion plugin for Neovim";
+    homepage = "https://github.com/saghen/blink.cmp";
+    maintainers = with lib.maintainers; [
+      balssh
+      redxtech
+    ];
+  };
+  doInstallCheck = true;
+  nvimRequireCheck = "blink-cmp";
+}
--- a/third_party/nixpkgs/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/third_party/nixpkgs/pkgs/applications/editors/vim/plugins/generated.nix
--- a/third_party/nixpkgs/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/third_party/nixpkgs/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@ -403,12 +403,12 @@
  };
  devicetree = buildGrammar {
    language = "devicetree";
-    version = "0.0.0+rev=07a647c";
+    version = "0.0.0+rev=16c9cb9";
    src = fetchFromGitHub {
      owner = "joelspadin";
      repo = "tree-sitter-devicetree";
-      rev = "07a647c8fb70e6b06379a60526721e3141aa2fd2";
-      hash = "sha256-2uJEItLwoBoiB49r2XuO216Dhu9AnAa0p7Plmm4JNY8=";
+      rev = "16c9cb959675bc9bc4f4e5bebe473d511a12a06d";
+      hash = "sha256-UVxLF4IKRXexz+PbSlypS/1QsWXkS/iYVbgmFCgjvZM=";
    };
    meta.homepage = "https://github.com/joelspadin/tree-sitter-devicetree";
  };
@ -526,12 +526,12 @@
  };
  editorconfig = buildGrammar {
    language = "editorconfig";
-    version = "0.0.0+rev=79bb1dc";
+    version = "0.0.0+rev=f5b5ac3";
    src = fetchFromGitHub {
      owner = "ValdezFOmar";
      repo = "tree-sitter-editorconfig";
-      rev = "79bb1dc197d0eb7499843b19d3dd0f9a2ee34d3c";
-      hash = "sha256-A58dlaDQBmufKT/yG+At0NN0Op6gbEU47DvHjpzklwg=";
+      rev = "f5b5ac3f718523fe9d5ee926f64eb177306afdb6";
+      hash = "sha256-l5ryC0wINO/oN8FNrngR7QnDAhiX65y0Hw5AExvAfBo=";
    };
    meta.homepage = "https://github.com/ValdezFOmar/tree-sitter-editorconfig";
  };
@ -559,12 +559,12 @@
  };
  elixir = buildGrammar {
    language = "elixir";
-    version = "0.0.0+rev=827d15d";
+    version = "0.0.0+rev=2ac7a0f";
    src = fetchFromGitHub {
      owner = "elixir-lang";
      repo = "tree-sitter-elixir";
-      rev = "827d15deada6ca2f40eece82d1bbe65df07af954";
-      hash = "sha256-yKeSOH1/6R1km3vzIZurVwVE1hxVoGMBCFGHkHFkt20=";
+      rev = "2ac7a0f81f0731d83068b2872c4a8fee39263a85";
+      hash = "sha256-u0gwq4eIoFNcTeoJpY2lRE97M7JSHZ5X2zSKrNlTycM=";
    };
    meta.homepage = "https://github.com/elixir-lang/tree-sitter-elixir";
  };
@ -735,12 +735,12 @@
  };
  fsharp = buildGrammar {
    language = "fsharp";
-    version = "0.0.0+rev=5202637";
+    version = "0.0.0+rev=971da5f";
    src = fetchFromGitHub {
      owner = "ionide";
      repo = "tree-sitter-fsharp";
-      rev = "5202637c203fcf8876affbd18b04ff43256d4c4a";
-      hash = "sha256-OjCwEhTACaVcnR/NyfUGZN/juLUHgqY6h+3DSrqUuiQ=";
+      rev = "971da5ff0266bfe4a6ecfb94616548032d6d1ba0";
+      hash = "sha256-0jrbznAXcjXrbJ5jnxWMzPKxRopxKCtoQXGl80R1M0M=";
    };
    location = "fsharp";
    meta.homepage = "https://github.com/ionide/tree-sitter-fsharp";
@ -846,12 +846,12 @@
  };
  gitcommit = buildGrammar {
    language = "gitcommit";
-    version = "0.0.0+rev=79fdc5d";
+    version = "0.0.0+rev=67ab180";
    src = fetchFromGitHub {
      owner = "gbprod";
      repo = "tree-sitter-gitcommit";
-      rev = "79fdc5de52d0e2c6854db924525196af22100dad";
-      hash = "sha256-SvYMfldARrwhte6lJrCwpVaBjCerCsYwL4Z+qjdhHKs=";
+      rev = "67ab180883ba5ce3f5b0a5f4288cc6d9f9d83a5d";
+      hash = "sha256-5ieeIuUcaky3gWcrCrPXEGzfqom3Kv6rR8CEaWk797k=";
    };
    meta.homepage = "https://github.com/gbprod/tree-sitter-gitcommit";
  };
@ -890,23 +890,23 @@
  };
  glimmer_javascript = buildGrammar {
    language = "glimmer_javascript";
-    version = "0.0.0+rev=a260911";
+    version = "0.0.0+rev=7e8ea8c";
    src = fetchFromGitHub {
      owner = "NullVoxPopuli";
      repo = "tree-sitter-glimmer-javascript";
-      rev = "a260911201684f80cf815418b3771e6c39309f81";
-      hash = "sha256-fpVlfYjVI1ricwNfuzI5AV3RV4ijFTYOf/2NhCirCvU=";
+      rev = "7e8ea8cf39fc360cb97bd253442cd48e4f7a9ce3";
+      hash = "sha256-gqadIB5tB7aIOl3g6pxDeOsuENAwzb5RLVFn4d0G9MY=";
    };
    meta.homepage = "https://github.com/NullVoxPopuli/tree-sitter-glimmer-javascript";
  };
  glimmer_typescript = buildGrammar {
    language = "glimmer_typescript";
-    version = "0.0.0+rev=9d018a0";
+    version = "0.0.0+rev=4006128";
    src = fetchFromGitHub {
      owner = "NullVoxPopuli";
      repo = "tree-sitter-glimmer-typescript";
-      rev = "9d018a0f93417e6951264a26093b89ee63df7315";
-      hash = "sha256-ZV6q4OEwj0ulGh5PO5XEMvT4WJQHkMmMXFJs8mcJqXk=";
+      rev = "4006128790efb58ca82a4492d8ef0983b260fc6a";
+      hash = "sha256-oOF36q09hcOCdFWrFQlhDX79tS9xBNVgcp1vmxjRdGM=";
    };
    meta.homepage = "https://github.com/NullVoxPopuli/tree-sitter-glimmer-typescript";
  };
@ -1042,6 +1042,17 @@
    };
    meta.homepage = "https://github.com/bkegley/tree-sitter-graphql";
  };
+  gren = buildGrammar {
+    language = "gren";
+    version = "0.0.0+rev=c06e272";
+    src = fetchFromGitHub {
+      owner = "MaeBrooks";
+      repo = "tree-sitter-gren";
+      rev = "c06e272341363c5d8e19ac34bc7c56258a37e71b";
+      hash = "sha256-Zxa/5hTFrkVRzswKion1tzrwp//ASuZKQjw7g/znBsI=";
+    };
+    meta.homepage = "https://github.com/MaeBrooks/tree-sitter-gren";
+  };
  groovy = buildGrammar {
    language = "groovy";
    version = "0.0.0+rev=0d88845";
@ -1309,12 +1320,12 @@
  };
  java = buildGrammar {
    language = "java";
-    version = "0.0.0+rev=3f86793";
+    version = "0.0.0+rev=b864ed9";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-java";
-      rev = "3f8679368cf00ed10ec086975fa87f697b91b7bc";
-      hash = "sha256-Mkh3zwZmErBEwzQ1yLTo9kyEhSZm6WigXtWKZpPYyXY=";
+      rev = "b864ed97b9675e86de7c15a70c12e4c1ca85fbf9";
+      hash = "sha256-CiWIh8IFmK1xW7DfERWqsnFjtveAevANlzJbPOwA7Z0=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-java";
  };
@ -1353,12 +1364,12 @@
  };
  json = buildGrammar {
    language = "json";
-    version = "0.0.0+rev=8bfdb43";
+    version = "0.0.0+rev=f2503f1";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-json";
-      rev = "8bfdb43f47ad805bb1ce093203cfcbaa8ed2c571";
-      hash = "sha256-zEuPynGi11vr7UvxC+mgZ+zOJBEVDjxvMwx0dozANn0=";
+      rev = "f2503f1c437fe24560876557868ac94c9cfd3216";
+      hash = "sha256-9tkKDvVB5YHqtIiBqrCRGp4H9MwapC1mHrm86iytiz4=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-json";
  };
@ -1629,24 +1640,24 @@
  };
  markdown = buildGrammar {
    language = "markdown";
-    version = "0.0.0+rev=b7eba93";
+    version = "0.0.0+rev=be81c59";
    src = fetchFromGitHub {
      owner = "MDeiml";
      repo = "tree-sitter-markdown";
-      rev = "b7eba93e6a3e588e259e831416ac11abdaa8616a";
-      hash = "sha256-lOLLHHMmNAtK+RLOSIt0GpeNRiMj3eu9jhSKS0HT370=";
+      rev = "be81c59efc552bd875650fe078bf6b78d57330ca";
+      hash = "sha256-gqZYUJWijD0UQAQeElx/VxAILI2WZtvC/+Eno3AiCTU=";
    };
    location = "tree-sitter-markdown";
    meta.homepage = "https://github.com/MDeiml/tree-sitter-markdown";
  };
  markdown_inline = buildGrammar {
    language = "markdown_inline";
-    version = "0.0.0+rev=b7eba93";
+    version = "0.0.0+rev=be81c59";
    src = fetchFromGitHub {
      owner = "MDeiml";
      repo = "tree-sitter-markdown";
-      rev = "b7eba93e6a3e588e259e831416ac11abdaa8616a";
-      hash = "sha256-lOLLHHMmNAtK+RLOSIt0GpeNRiMj3eu9jhSKS0HT370=";
+      rev = "be81c59efc552bd875650fe078bf6b78d57330ca";
+      hash = "sha256-gqZYUJWijD0UQAQeElx/VxAILI2WZtvC/+Eno3AiCTU=";
    };
    location = "tree-sitter-markdown-inline";
    meta.homepage = "https://github.com/MDeiml/tree-sitter-markdown";
@ -1943,24 +1954,24 @@
  };
  php = buildGrammar {
    language = "php";
-    version = "0.0.0+rev=69af07e";
+    version = "0.0.0+rev=2bce5a6";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-php";
-      rev = "69af07eedf60bc1992c59a8fd6b5e41f25442715";
-      hash = "sha256-uS5MTotJypsawMR1z/KmZCNxfTuFIyimqbms5IEJ0cE=";
+      rev = "2bce5a6588ad6d53ffe5effaf9708682f0fbfc9b";
+      hash = "sha256-0yWXwRc0cMMLL8P99eW3BwYIrm6FDG7eBNfjmIDzZIU=";
    };
    location = "php";
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-php";
  };
  php_only = buildGrammar {
    language = "php_only";
-    version = "0.0.0+rev=69af07e";
+    version = "0.0.0+rev=2bce5a6";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-php";
-      rev = "69af07eedf60bc1992c59a8fd6b5e41f25442715";
-      hash = "sha256-uS5MTotJypsawMR1z/KmZCNxfTuFIyimqbms5IEJ0cE=";
+      rev = "2bce5a6588ad6d53ffe5effaf9708682f0fbfc9b";
+      hash = "sha256-0yWXwRc0cMMLL8P99eW3BwYIrm6FDG7eBNfjmIDzZIU=";
    };
    location = "php_only";
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-php";
@ -2322,12 +2333,12 @@
  };
  regex = buildGrammar {
    language = "regex";
-    version = "0.0.0+rev=123552e";
+    version = "0.0.0+rev=58f4caf";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-regex";
-      rev = "123552e5849fae9a7c536eac84d471579c7f3328";
-      hash = "sha256-qcVZHrhlx66usrG5aapYdyv8Tx2wK4ZivjzsDNLpmsY=";
+      rev = "58f4caf9db12db3b38b81c77d274aa73c9e85aca";
+      hash = "sha256-IeAp2fEdxVf8r/f8B85ex5Y5DL8Z1ZOqovjVyMBIOKM=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-regex";
  };
@ -2454,12 +2465,12 @@
  };
  scala = buildGrammar {
    language = "scala";
-    version = "0.0.0+rev=2cfbb6e";
+    version = "0.0.0+rev=a9af635";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-scala";
-      rev = "2cfbb6e3fcdfd51e0d477a43cc37ae8c6f87dc2e";
-      hash = "sha256-8s5Li+fuHyr19KYaC/UzXc7ASLimwAu1VS+8lc5rNLA=";
+      rev = "a9af6356f8e31f04e870587bca79bc2b15808ff5";
+      hash = "sha256-nZUQh42OsPnQffixOklbAmAIGtct/AaKOn4fE6ndTfQ=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-scala";
  };
@ -2700,12 +2711,12 @@
  };
  superhtml = buildGrammar {
    language = "superhtml";
-    version = "0.0.0+rev=36f37aa";
+    version = "0.0.0+rev=3325bbb";
    src = fetchFromGitHub {
      owner = "kristoff-it";
      repo = "superhtml";
-      rev = "36f37aa5aa440805f27d4a9f5203e616a303c6a1";
-      hash = "sha256-oegEpBCk7Fhx4SbXebBq33b7Ef9XshYfx2SciaKwINY=";
+      rev = "3325bbb2dda260131a8db0cae1f1f557d17ebced";
+      hash = "sha256-3NAS3eqayFYRziryNgOWfY+3d1HcVe+jPcKkkL9jbWY=";
    };
    location = "tree-sitter-superhtml";
    meta.homepage = "https://github.com/kristoff-it/superhtml";
@ -2723,12 +2734,12 @@
  };
  svelte = buildGrammar {
    language = "svelte";
-    version = "0.0.0+rev=774a65a";
+    version = "0.0.0+rev=ae5199d";
    src = fetchFromGitHub {
      owner = "tree-sitter-grammars";
      repo = "tree-sitter-svelte";
-      rev = "774a65aea563accc35f5d45fafa4d96ec5761f57";
-      hash = "sha256-mkw3s0pZQ6ry+fiTk2fJeKVA7Nqyv2Z2R1AFZknzpFM=";
+      rev = "ae5199db47757f785e43a14b332118a5474de1a2";
+      hash = "sha256-cH9h7i6MImw7KlcuVQ6XVKNjd9dFjo93J1JdTWmEpV4=";
    };
    meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-svelte";
  };
@ -2766,25 +2777,14 @@
    };
    meta.homepage = "https://github.com/ok-ryoko/tree-sitter-systemtap";
  };
-  systemverilog = buildGrammar {
-    language = "systemverilog";
-    version = "0.0.0+rev=4f897d5";
-    src = fetchFromGitHub {
-      owner = "zhangwwpeng";
-      repo = "tree-sitter-systemverilog";
-      rev = "4f897d5e3f0e38bf8fbb55e8f39dc97d2bc2229e";
-      hash = "sha256-guNdS07QqbqegFICNHP1ECX9bc+ZCW9li3ILIZVHRwM=";
-    };
-    meta.homepage = "https://github.com/zhangwwpeng/tree-sitter-systemverilog";
-  };
  t32 = buildGrammar {
    language = "t32";
-    version = "0.0.0+rev=6182836";
+    version = "0.0.0+rev=0f6a5b1";
    src = fetchFromGitLab {
      owner = "xasc";
      repo = "tree-sitter-t32";
-      rev = "6182836f4128725f1e74ce986840d7317021a015";
-      hash = "sha256-w9X/CL5X6Lwr4/GGVQcMZ1O2HfJmdNiVjRQKGZHrRqg=";
+      rev = "0f6a5b1e031c97ebf58d3c76eadb2c6bf1e4f780";
+      hash = "sha256-Pd6rudBmDVvBwlVSLtBmSsoOBU9aG0iSyEPbTaYX6JE=";
    };
    meta.homepage = "https://gitlab.com/xasc/tree-sitter-t32.git";
  };
@ -2858,12 +2858,12 @@
  };
  textproto = buildGrammar {
    language = "textproto";
-    version = "0.0.0+rev=d900077";
+    version = "0.0.0+rev=568471b";
    src = fetchFromGitHub {
      owner = "PorterAtGoogle";
      repo = "tree-sitter-textproto";
-      rev = "d900077aef9f5dcb0d47c86be33585013ed5db9a";
-      hash = "sha256-PZMhYhIpGa7Y50jxvXZ0Z5l9e26P5q55sC18ptDi/uU=";
+      rev = "568471b80fd8793d37ed01865d8c2208a9fefd1b";
+      hash = "sha256-VAj8qSxbkFqNp0X8BOZNvGTggSXZvzDjODedY11J0BQ=";
    };
    meta.homepage = "https://github.com/PorterAtGoogle/tree-sitter-textproto";
  };
@ -3116,14 +3116,14 @@
  };
  verilog = buildGrammar {
    language = "verilog";
-    version = "0.0.0+rev=5a01c57";
+    version = "0.0.0+rev=0dacb91";
    src = fetchFromGitHub {
-      owner = "tree-sitter";
-      repo = "tree-sitter-verilog";
-      rev = "5a01c57fa8e3d8801953a67ae7c6b240e2284ee8";
-      hash = "sha256-Q8RaoL/1vNd553VFOI8crRffV8iVmAnMVCC+O2zjEZU=";
+      owner = "gmlarumbe";
+      repo = "tree-sitter-systemverilog";
+      rev = "0dacb911daa9614a7c7e79a594d4cb9f478e6554";
+      hash = "sha256-WATrVeP3c//tWLG8VibXZrYrChBs7d4V6LCcEGcofdg=";
    };
-    meta.homepage = "https://github.com/tree-sitter/tree-sitter-verilog";
+    meta.homepage = "https://github.com/gmlarumbe/tree-sitter-systemverilog";
  };
  vhdl = buildGrammar {
    language = "vhdl";
@ -3204,12 +3204,12 @@
  };
  wgsl_bevy = buildGrammar {
    language = "wgsl_bevy";
-    version = "0.0.0+rev=0f06f24";
+    version = "0.0.0+rev=47c1818";
    src = fetchFromGitHub {
      owner = "theHamsta";
      repo = "tree-sitter-wgsl-bevy";
-      rev = "0f06f24e259ac725045956436b9025dab008ff9f";
-      hash = "sha256-/HNDdI2Tg6YG/lAvubZtN2g6pUCk0Kl4kRTRsABIm0Y=";
+      rev = "47c1818d245a6156a488c4c4d06e9336714bae9b";
+      hash = "sha256-oL9HDMDl6MgDLZw4NWtdX7W775JZKwD2BweAO+9iI/k=";
    };
    meta.homepage = "https://github.com/theHamsta/tree-sitter-wgsl-bevy";
  };
--- a/third_party/nixpkgs/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/third_party/nixpkgs/pkgs/applications/editors/vim/plugins/overrides.nix
@ -199,6 +199,8 @@ in
    meta.homepage = "https://github.com/sblumentritt/bitbake.vim/";
  };

+  blink-cmp = callPackage ./blink-cmp { };
+
  # The GitHub repository returns 404, which breaks the update script
  vim-pony = buildVimPlugin {
    pname = "vim-pony";
@ -1112,6 +1114,11 @@ in
    };
  };

+  hunk-nvim = super.hunk-nvim.overrideAttrs {
+    dependencies = with self; [ nui-nvim ];
+    nvimRequireCheck = "hunk";
+  };
+
  # https://hurl.dev/
  hurl = buildVimPlugin {
    pname = "hurl";
@ -1669,6 +1676,10 @@ in

  nvim-treesitter-parsers = lib.recurseIntoAttrs self.nvim-treesitter.grammarPlugins;

+  nvim-treesitter-sexp = super.nvim-treesitter-sexp.overrideAttrs {
+    nvimRequireCheck = "treesitter-sexp";
+  };
+
  nvim-ufo = super.nvim-ufo.overrideAttrs {
    dependencies = with self; [ promise-async ];
    nvimRequireCheck = "ufo";
@ -1854,6 +1865,10 @@ in
    nvimRequireCheck = "rustaceanvim";
  };

+  scretch-nvim = super.scretch-nvim.overrideAttrs {
+    nvimRequireCheck = "scretch";
+  };
+
  sg-nvim = super.sg-nvim.overrideAttrs (
    old:
    let
@ -2734,7 +2749,6 @@ in
      "coc-lists"
      "coc-ltex"
      "coc-markdownlint"
-      "coc-metals"
      "coc-pairs"
      "coc-prettier"
      "coc-r-lsp"
@ -2751,8 +2765,6 @@ in
      "coc-tabnine"
      "coc-texlab"
      "coc-toml"
-      "coc-tslint"
-      "coc-tslint-plugin"
      "coc-tsserver"
      "coc-ultisnips"
      "coc-vetur"
--- a/third_party/nixpkgs/pkgs/applications/editors/vim/plugins/patches/ranger.nvim/fix-paths.patch
+++ b/third_party/nixpkgs/pkgs/applications/editors/vim/plugins/patches/ranger.nvim/fix-paths.patch
@ -1,17 +1,26 @@
 diff --git a/lua/ranger-nvim.lua b/lua/ranger-nvim.lua
-index 3b18880..78eb9db 100644
+index be95e36..3bd1587 100644
 --- a/lua/ranger-nvim.lua
 +++ b/lua/ranger-nvim.lua
-@@ -109,7 +109,7 @@ local function build_ranger_cmd(select_current_file)
- 	end
+@@ -127,7 +127,7 @@ local function build_ranger_cmd(select_current_file)
 	local selectfile_flag = select_current_file and " --selectfile=" .. selected_file or ""
+ 	if select_current_file then
 		return string.format(
 -			"ranger --choosefiles=%s %s %s",
 +			"@ranger@ --choosefiles=%s %s %s",
 			SELECTED_FILEPATH,
 			selectfile_flag,
 			create_ranger_cmd_flags(create_cmd_values(opts.keybinds))
-@@ -182,7 +182,7 @@ end
+@@ -135,7 +135,7 @@ local function build_ranger_cmd(select_current_file)
+ 	else
+ 		vim.api.nvim_buf_delete(1, { force = true })
+ 		return string.format(
+-			"ranger  --choosefiles=%s %s %s",
+			"@ranger@  --choosefiles=%s %s %s",
+ 			SELECTED_FILEPATH,
+ 			create_ranger_cmd_flags(create_cmd_values(opts.keybinds)),
+ 			get_absolute_argument()
+@@ -209,7 +209,7 @@ end
 ---Opens ranger and open selected files on exit.
 ---@param select_current_file boolean|nil open ranger and select the current file. Defaults to true.
 function M.open(select_current_file)
--- a/third_party/nixpkgs/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/third_party/nixpkgs/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -53,6 +53,7 @@ https://github.com/joshuavial/aider.nvim/,HEAD,
 https://github.com/slashmili/alchemist.vim/,,
 https://github.com/dense-analysis/ale/,,
 https://github.com/vim-scripts/align/,,
+https://github.com/Vonr/align.nvim/,HEAD,
 https://github.com/goolord/alpha-nvim/,HEAD,
 https://github.com/anuvyklack/animation.nvim/,HEAD,
 https://github.com/Olical/aniseed/,,
@ -338,6 +339,7 @@ https://github.com/liangxianzhe/floating-input.nvim/,HEAD,
 https://github.com/fhill2/floating.nvim/,,
 https://github.com/floobits/floobits-neovim/,,
 https://github.com/akinsho/flutter-tools.nvim/,HEAD,
+https://github.com/nvim-focus/focus.nvim/,HEAD,
 https://github.com/anuvyklack/fold-preview.nvim/,HEAD,
 https://github.com/mhartington/formatter.nvim/,,
 https://github.com/megaannum/forms/,,
@ -419,6 +421,7 @@ https://github.com/smoka7/hop.nvim/,,
 https://github.com/rktjmp/hotpot.nvim/,,
 https://github.com/lewis6991/hover.nvim/,HEAD,
 https://github.com/othree/html5.vim/,HEAD,
+https://github.com/julienvincent/hunk.nvim/,HEAD,
 https://github.com/nvimtools/hydra.nvim/,HEAD,
 https://github.com/mboughaba/i3config.vim/,,
 https://github.com/cocopon/iceberg.vim/,,
@ -457,6 +460,7 @@ https://github.com/Myzel394/jsonfly.nvim/,HEAD,
 https://github.com/JuliaEditorSupport/julia-vim/,,
 https://github.com/GCBallesteros/jupytext.nvim/,HEAD,
 https://github.com/rebelot/kanagawa.nvim/,,
+https://github.com/imsnif/kdl.vim/,HEAD,
 https://github.com/anuvyklack/keymap-layer.nvim/,HEAD,
 https://github.com/kmonad/kmonad-vim/,,
 https://github.com/frabjous/knap/,HEAD,
@ -730,6 +734,7 @@ https://github.com/vijaymarupudi/nvim-fzf/,,
 https://github.com/vijaymarupudi/nvim-fzf-commands/,,
 https://github.com/sakhnik/nvim-gdb/,,
 https://github.com/chrisgrieser/nvim-genghis/,HEAD,
+https://github.com/booperlv/nvim-gomove/,HEAD,
 https://github.com/smiteshp/nvim-gps/,,
 https://github.com/brenoprata10/nvim-highlight-colors/,HEAD,
 https://github.com/Iron-E/nvim-highlite/,,
@ -784,8 +789,10 @@ https://github.com/nvim-tree/nvim-tree.lua/,,
 https://github.com/nvim-treesitter/nvim-treesitter/,,
 https://github.com/nvim-treesitter/nvim-treesitter-context/,,
 https://github.com/RRethy/nvim-treesitter-endwise/,HEAD,
+https://github.com/theHamsta/nvim-treesitter-pairs/,HEAD,
 https://github.com/eddiebergman/nvim-treesitter-pyfold/,,
 https://github.com/nvim-treesitter/nvim-treesitter-refactor/,,
+https://github.com/PaterJason/nvim-treesitter-sexp/,HEAD,
 https://github.com/nvim-treesitter/nvim-treesitter-textobjects/,,
 https://github.com/RRethy/nvim-treesitter-textsubjects/,HEAD,
 https://github.com/windwp/nvim-ts-autotag/,,
@ -899,6 +906,7 @@ https://github.com/vmware-archive/salt-vim/,,
 https://github.com/lewis6991/satellite.nvim/,HEAD,
 https://github.com/davidgranstrom/scnvim/,HEAD,
 https://github.com/tiagovla/scope.nvim/,HEAD,
+https://github.com/0xJohnnyboy/scretch.nvim/,HEAD,
 https://github.com/Xuyuanp/scrollbar.nvim/,,
 https://github.com/cakebaker/scss-syntax.vim/,,
 https://github.com/VonHeikemen/searchbox.nvim/,,
@ -1053,6 +1061,7 @@ https://github.com/altermo/ultimate-autopair.nvim/,HEAD,
 https://github.com/SirVer/ultisnips/,,
 https://github.com/mbbill/undotree/,,
 https://github.com/chrisbra/unicode.vim/,,
+https://github.com/tummetott/unimpaired.nvim/,HEAD,
 https://github.com/unisonweb/unison/,,
 https://github.com/Shougo/unite.vim/,,
 https://github.com/sontungexpt/url-open/,HEAD,
--- a/third_party/nixpkgs/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/editors/vscode/extensions/default.nix
@ -656,7 +656,7 @@ let
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=bierner.markdown-footnotes";
          homepage = "https://github.com/mjbvz/vscode-markdown-footnotes";
          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.uncenter ];
+          maintainers = [ ];
        };
      };

@ -689,7 +689,7 @@ let
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=bierner.markdown-preview-github-styles";
          homepage = "https://github.com/mjbvz/vscode-github-markdown-preview-style";
          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.uncenter ];
+          maintainers = [ ];
        };
      };

@ -710,7 +710,7 @@ let
            # or
            asl20
          ];
-          maintainers = [ lib.maintainers.uncenter ];
+          maintainers = [ ];
        };
      };

@ -727,7 +727,7 @@ let
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=bmalehorn.vscode-fish";
          homepage = "https://github.com/bmalehorn/vscode-fish";
          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.uncenter ];
+          maintainers = [ ];
        };
      };

@ -1793,7 +1793,7 @@ let
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=fabiospampinato.vscode-open-in-github";
          homepage = "https://github.com/fabiospampinato/vscode-open-in-github";
          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.uncenter ];
+          maintainers = [ ];
        };
      };

@ -1930,7 +1930,7 @@ let
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=fortran-lang.linter-gfortran";
          homepage = "https://github.com/fortran-lang/vscode-fortran-support";
          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.uncenter ];
+          maintainers = [ ];
        };
      };

@ -2844,7 +2844,7 @@ let
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=Kravets.vscode-publint";
          homepage = "https://github.com/kravetsone/vscode-publint";
          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.uncenter ];
+          maintainers = [ ];
        };
      };

@ -3069,7 +3069,7 @@ let
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=meganrogge.template-string-converter";
          homepage = "https://github.com/meganrogge/template-string-converter";
          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.uncenter ];
+          maintainers = [ ];
        };
      };

@ -3605,7 +3605,7 @@ let
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-wsl";
          homepage = "https://code.visualstudio.com/docs/remote/wsl";
          license = lib.licenses.unfree;
-          maintainers = [ lib.maintainers.uncenter ];
+          maintainers = [ ];
        };
      };

@ -3716,7 +3716,7 @@ let
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=nefrob.vscode-just-syntax";
          homepage = "https://github.com/nefrob/vscode-just";
          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.uncenter ];
+          maintainers = [ ];
        };
      };

@ -4455,7 +4455,7 @@ let
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=sswg.swift-lang";
          homepage = "https://github.com/swiftlang/vscode-swift";
          license = lib.licenses.asl20;
-          maintainers = [ lib.maintainers.uncenter ];
+          maintainers = [ ];
        };
      };

@ -5076,7 +5076,7 @@ let
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=vitaliymaz.vscode-svg-previewer";
          homepage = "https://github.com/vitaliymaz/vscode-svg-previewer";
          license = lib.licenses.unfree;
-          maintainers = [ lib.maintainers.uncenter ];
+          maintainers = [ ];
        };
      };

@ -5408,7 +5408,7 @@ let
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=yoavbls.pretty-ts-errors";
          homepage = "https://github.com/yoavbls/pretty-ts-errors";
          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.uncenter ];
+          maintainers = [ ];
        };
      };

@ -5495,7 +5495,7 @@ let
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=zguolee.tabler-icons";
          homepage = "https://github.com/zguolee/vscode-tabler-icons";
          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.uncenter ];
+          maintainers = [ ];
        };
      };

--- a/third_party/nixpkgs/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
@ -11,7 +11,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
    name = "tinymist";
    publisher = "myriad-dreamin";
    inherit (tinymist) version;
-    hash = "sha256-CQVujtl1SFcUmEG7O1cvN2gr6v3kcWMMZz+oYEkclKI=";
+    hash = "sha256-NQ7LsX8/1h7sSI5mPdDgu4MVc29iNJ1vl0K7fMCBmlc=";
  };

  nativeBuildInputs = [
--- a/third_party/nixpkgs/pkgs/applications/emulators/fceux/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/emulators/fceux/default.nix
@ -1,46 +0,0 @@
-{ lib
-, SDL2
-, cmake
-, fetchFromGitHub
-, lua
-, minizip
-, pkg-config
-, stdenv
-, wrapQtAppsHook
-, x264
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "fceux";
-  version = "2.6.6-unstable-2024-01-19";
-
-  src = fetchFromGitHub {
-    owner = "TASEmulators";
-    repo = "fceux";
-    rev = "2fce5ffe745bb89be471e450d9cd6284cd5614d9";
-    hash = "sha256-5uUTw7ZkmBrGuntSQFNAp1Xz69ANmmIxNGd0/enPoW8=";
-  };
-
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-    wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    SDL2
-    lua
-    minizip
-    x264
-  ];
-
-  meta = {
-    homepage = "http://www.fceux.com/";
-    description = "Nintendo Entertainment System (NES) Emulator";
-    mainProgram = "fceux";
-    changelog = "https://github.com/TASEmulators/blob/fceux/${finalAttrs.src.rev}/changelog.txt";
-    license = with lib.licenses; [ gpl2Plus ];
-    maintainers = with lib.maintainers; [ AndersonTorres sbruder ];
-    platforms = lib.platforms.linux;
-  };
-})
--- a/third_party/nixpkgs/pkgs/applications/file-managers/nnn/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/file-managers/nnn/default.nix
@ -10,6 +10,7 @@
 , which
 , musl-fts
 , pcre
+, gnused
  # options
 , conf ? null
 , withIcons ? false
@ -60,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
    ++ lib.optionals withPcre [ "O_PCRE=1" ]
    ++ extraMakeFlags;

-  binPath = lib.makeBinPath [ file which ];
+  binPath = lib.makeBinPath [ file which gnused ];

  installTargets = [ "install" "install-desktop" ];

--- a/third_party/nixpkgs/pkgs/applications/gis/gmt/dcw.nix
+++ b/third_party/nixpkgs/pkgs/applications/gis/gmt/dcw.nix
@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
      for use by GMT, the Generic Mapping Tools.
    '';
    license = licenses.lgpl3Plus;
-    maintainers = with maintainers; [ tviti ];
+    maintainers = lib.teams.geospatial.members ++ (with lib.maintainers; [ tviti ]);
  };

 }
--- a/third_party/nixpkgs/pkgs/applications/gis/gmt/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/gis/gmt/default.nix
@ -106,7 +106,7 @@ in stdenv.mkDerivation (finalAttrs: {
    '';
    platforms = lib.platforms.unix;
    license = lib.licenses.lgpl3Plus;
-    maintainers = with lib.maintainers; [ tviti ];
+    maintainers = lib.teams.geospatial.members ++ (with lib.maintainers; [ tviti ]);
  };

 })
--- a/third_party/nixpkgs/pkgs/applications/gis/gmt/gshhg.nix
+++ b/third_party/nixpkgs/pkgs/applications/gis/gmt/gshhg.nix
@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
      Mapping Tools.
    '';
    license = licenses.lgpl3Plus;
-    maintainers = with maintainers; [ tviti ];
+    maintainers = lib.teams.geospatial.members ++ (with lib.maintainers; [ tviti ]);
  };

 }
--- a/third_party/nixpkgs/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/graphics/ImageMagick/default.nix
@ -146,7 +146,7 @@ stdenv.mkDerivation (finalAttrs: {
    description = "Software suite to create, edit, compose, or convert bitmap images";
    pkgConfigModules = [ "ImageMagick" "MagickWand" ];
    platforms = platforms.linux ++ platforms.darwin;
-    maintainers = with maintainers; [ erictapen dotlambda rhendric ];
+    maintainers = with maintainers; [ dotlambda rhendric ];
    license = licenses.asl20;
    mainProgram = "magick";
  };
--- a/third_party/nixpkgs/pkgs/applications/graphics/drawio/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/graphics/drawio/default.nix
@ -116,9 +116,9 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "Desktop application for creating diagrams";
    homepage = "https://about.draw.io/";
-    license = licenses.asl20;
+    license = licenses.unfree;
    changelog = "https://github.com/jgraph/drawio-desktop/releases/tag/v${version}";
-    maintainers = with maintainers; [ qyliss darkonion0 ];
+    maintainers = with maintainers; [ darkonion0 ];
    platforms = platforms.darwin ++ platforms.linux;
    mainProgram = "drawio";
  };
--- a/third_party/nixpkgs/pkgs/applications/graphics/foxotron/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/graphics/foxotron/default.nix
@ -26,14 +26,14 @@

 stdenv.mkDerivation rec {
  pname = "foxotron";
-  version = "2023-07-16";
+  version = "2024-09-23";

  src = fetchFromGitHub {
    owner = "Gargaj";
    repo = "Foxotron";
    rev = version;
    fetchSubmodules = true;
-    hash = "sha256-s1eWZMVitVSP7nJJ5wXvnV8uI6yto7LmvlvocOwVAxw=";
+    hash = "sha256-OnZWoiQ5ASKQV73/W6nl17B2ANwqCy/PlybHbNwrOyQ=";
  };

  patches = [
--- a/third_party/nixpkgs/pkgs/applications/graphics/ovito/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/graphics/ovito/default.nix
@ -1,7 +1,8 @@
-{ mkDerivation
-, lib
+{ lib
 , stdenv
 , fetchFromGitLab
+, fetchurl
+, makeDesktopItem
 , cmake
 , boost
 , bzip2
@ -17,21 +18,27 @@
 , qtsvg
 , qttools
 , VideoDecodeAcceleration
+, wrapQtAppsHook
+, copyDesktopItems
+# needed to run natively on wayland
+, qtwayland
 }:

-mkDerivation rec {
+stdenv.mkDerivation rec {
  pname = "ovito";
-  version = "3.7.11";
+  version = "3.11.0";

  src = fetchFromGitLab {
    owner = "stuko";
    repo = "ovito";
    rev = "v${version}";
-    hash = "sha256-Z3uwjOYJ7di/LLllbzdKjzUE7m119i03bA8dJPqhxWA=";
+    hash = "sha256-egiA6z1e8ZS7i4CIVjsCKJP1wQSRpmSKitoVTszu0Mc=";
  };

  nativeBuildInputs = [
    cmake
+    wrapQtAppsHook
+    copyDesktopItems
  ];

  buildInputs = [
@ -48,16 +55,42 @@ mkDerivation rec {
    qtbase
    qtsvg
    qttools
+    qtwayland
  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
    VideoDecodeAcceleration
  ];

+  # manually create a desktop file
+  desktopItems = [ (makeDesktopItem {
+    name = "ovito";
+    comment= "Open Visualization Tool";
+    exec = "ovito";
+    icon = "ovito";
+    terminal = false;
+    startupNotify = false;
+    desktopName = "ovito";
+    startupWMClass = "Ovito";
+    categories = [ "Science" ];
+  })];
+
+  postInstall = let
+    icon = fetchurl {
+      url = "https://www.ovito.org/wp-content/uploads/logo_rgb-768x737.png";
+      hash = "sha256-FOmIUeXem+4MjavQNag0UIlcR2wa2emJjivwxoJh6fI=";
+    };
+  in ''
+    install -Dm644 ${icon} $out/share/pixmaps/ovito.png
+  '';
+
  meta = with lib; {
    description = "Scientific visualization and analysis software for atomistic and particle simulation data";
    mainProgram = "ovito";
    homepage = "https://ovito.org";
    license = with licenses;  [ gpl3Only mit ];
-    maintainers = with maintainers; [ twhitehead ];
+    maintainers = with maintainers; [
+      twhitehead
+      chn
+    ];
    broken = stdenv.hostPlatform.isDarwin; # clang-11: error: no such file or directory: '$-DOVITO_COPYRIGHT_NOTICE=...
  };
 }
--- a/third_party/nixpkgs/pkgs/applications/graphics/viewnior/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/graphics/viewnior/default.nix
@ -1,30 +1,20 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, meson, ninja, pkg-config, desktop-file-utils, gtk2, libpng, exiv2, lcms
-, intltool, gettext, shared-mime-info, glib, gdk-pixbuf, perl}:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, meson, ninja, pkg-config, desktop-file-utils, gtk3, libpng, exiv2, lcms
+, intltool, gettext, shared-mime-info, glib, gdk-pixbuf, perl, wrapGAppsHook3, webp-pixbuf-loader, gnome, librsvg}:

 stdenv.mkDerivation rec {
-  pname = "viewnior";
-  version = "1.8";
+  pname = "viewnior-gtk3";
+  version = "1.8-unstable-2023-11-23";

  src = fetchFromGitHub {
-    owner = "hellosiyan";
+    #owner = "hellosiyan";
+    #repo = "Viewnior";
+    owner = "Artturin";
    repo = "Viewnior";
-    rev = "${pname}-${version}";
-    hash = "sha256-LTahMmcAqgqviUxR624kTozJGTniAAGWKo1ZqXjoG5M=";
+    # https://github.com/hellosiyan/Viewnior/pull/142
+    rev = "23ce6e5630b24509d8009f17a833ad9e59b85fab";
+    hash = "sha256-+/f0+og1Dd7eJK7P83+q4lf4SjzW2g6qNk8ZTxNAuDA=";
  };

-  patches = [
-    (fetchpatch {
-      name = "viewnior-1.8-change-exiv2-AutoPtr-to-unique_ptr.patch";
-      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-gfx/viewnior/files/viewnior-1.8-change-exiv2-AutoPtr-to-unique_ptr.patch?id=002882203ad6a2b08ce035a18b95844a9f4b85d0";
-      hash = "sha256-O3/d7qMiOsYJmz7ekoLM6oaHcuYjEbAfPFuDUWSybfE=";
-    })
-    (fetchpatch {
-      name = "viewnior-1.8-add-support-for-exiv-0.28.0-errors.patch";
-      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-gfx/viewnior/files/viewnior-1.8-add-support-for-exiv-0.28.0-errors.patch?id=002882203ad6a2b08ce035a18b95844a9f4b85d0";
-      hash = "sha256-Zjc4CIlelAkbyvX2F1yo/qJjUajtAgF4+FoHWFEIPWY=";
-    })
-  ];
-
  nativeBuildInputs = [
    meson
    ninja
@ -32,10 +22,11 @@ stdenv.mkDerivation rec {
    desktop-file-utils
    intltool
    gettext
+    wrapGAppsHook3
  ];

  buildInputs = [
-    gtk2
+    gtk3
    libpng
    exiv2
    lcms
@ -45,6 +36,23 @@ stdenv.mkDerivation rec {
    perl
  ];

+  postInstall = ''
+    export GDK_PIXBUF_MODULE_FILE="${
+      gnome._gdkPixbufCacheBuilder_DO_NOT_USE {
+        extraLoaders = [
+          webp-pixbuf-loader
+          librsvg
+        ];
+      }
+    }"
+
+    # gtk3 viewnior can be launched in wayland mode and does so by default
+    # but moving around in a zoomed in image doesn't work
+    gappsWrapperArgs+=(
+      --set-default GDK_BACKEND x11
+    )
+  '';
+
  meta = with lib; {
    description = "Fast and simple image viewer";
    longDescription =
--- a/third_party/nixpkgs/pkgs/applications/graphics/xournalpp/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/graphics/xournalpp/default.nix
@ -1,39 +1,42 @@
-{ lib, stdenv
-, fetchFromGitHub
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,

-, cmake
-, gettext
-, wrapGAppsHook3
-, pkg-config
+  cmake,
+  gettext,
+  wrapGAppsHook3,
+  pkg-config,

-, adwaita-icon-theme
-, alsa-lib
-, binutils
-, glib
-, gsettings-desktop-schemas
-, gtk3
-, gtksourceview4
-, librsvg
-, libsndfile
-, libxml2
-, libzip
-, pcre
-, poppler
-, portaudio
-, zlib
-# plugins
-, withLua ? true, lua
+  adwaita-icon-theme,
+  alsa-lib,
+  binutils,
+  glib,
+  gsettings-desktop-schemas,
+  gtk3,
+  gtksourceview4,
+  librsvg,
+  libsndfile,
+  libxml2,
+  libzip,
+  pcre,
+  poppler,
+  portaudio,
+  zlib,
+  # plugins
+  withLua ? true,
+  lua,
 }:

 stdenv.mkDerivation rec {
  pname = "xournalpp";
-  version = "1.2.3";
+  version = "1.2.4";

  src = fetchFromGitHub {
    owner = "xournalpp";
    repo = "xournalpp";
    rev = "v${version}";
-    sha256 = "sha256-8UAAX/kixqiY9zEYs5eva0G2K2vlfnYd1yyVHMSfSeY=";
+    hash = "sha256-72e47fVP0c8KioRHUqyEQIUgrLm+xMPE2Mm6+2v7pZk=";
  };

  postPatch = ''
@ -41,12 +44,18 @@ stdenv.mkDerivation rec {
      --replace-fail "addr2line" "${binutils}/bin/addr2line"
  '';

-  nativeBuildInputs = [ cmake gettext pkg-config wrapGAppsHook3 ];
+  nativeBuildInputs = [
+    cmake
+    gettext
+    pkg-config
+    wrapGAppsHook3
+  ];

  buildInputs =
    lib.optionals stdenv.hostPlatform.isLinux [
      alsa-lib
-    ] ++ [
+    ]
+    ++ [
      glib
      gsettings-desktop-schemas
      gtk3
--- a/third_party/nixpkgs/pkgs/applications/kde/cantor.nix
+++ b/third_party/nixpkgs/pkgs/applications/kde/cantor.nix
@ -1,46 +1,56 @@
-{ lib
-, mkDerivation
+{
+  lib,
+  mkDerivation,

-, cmake
-, extra-cmake-modules
-, makeWrapper
-, shared-mime-info
+  cmake,
+  extra-cmake-modules,
+  makeWrapper,
+  shared-mime-info,

-, qtbase
-, qtsvg
-, qttools
-, qtwebengine
-, qtxmlpatterns
+  fetchpatch,
+  qtbase,
+  qtsvg,
+  qttools,
+  qtwebengine,
+  qtxmlpatterns,

-, poppler
+  poppler,

-, karchive
-, kcompletion
-, kconfig
-, kcoreaddons
-, kcrash
-, kdoctools
-, ki18n
-, kiconthemes
-, kio
-, knewstuff
-, kparts
-, kpty
-, ktexteditor
-, ktextwidgets
-, kxmlgui
-, syntax-highlighting
+  karchive,
+  kcompletion,
+  kconfig,
+  kcoreaddons,
+  kcrash,
+  kdoctools,
+  ki18n,
+  kiconthemes,
+  kio,
+  knewstuff,
+  kparts,
+  kpty,
+  ktexteditor,
+  ktextwidgets,
+  kxmlgui,
+  syntax-highlighting,

-, libspectre
+  libspectre,

-# Backends. Set to null if you want to omit from the build
-, withAnalitza ? true, analitza
-, wtihJulia ? true, julia
-, withQalculate ? true, libqalculate
-, withLua ? true, luajit
-, withPython ? true, python3
-, withR ? true, R
-, withSage ? true, sage, sage-with-env ? sage.with-env
+  # Backends. Set to null if you want to omit from the build
+  withAnalitza ? true,
+  analitza,
+  wtihJulia ? true,
+  julia,
+  withQalculate ? true,
+  libqalculate,
+  withLua ? true,
+  luajit,
+  withPython ? true,
+  python3,
+  withR ? true,
+  R,
+  withSage ? true,
+  sage,
+  sage-with-env ? sage.with-env,
 }:

 mkDerivation {
@ -54,7 +64,8 @@ mkDerivation {
    qttools
  ];

-  buildInputs = [
+  buildInputs =
+    [
      qtbase
      qtsvg
      qtwebengine
@ -88,8 +99,7 @@ mkDerivation {
    ++ lib.optional withLua luajit
    ++ lib.optional withPython python3
    ++ lib.optional withR R
-  ++ lib.optional withSage sage-with-env
-  ;
+    ++ lib.optional withSage sage-with-env;

  qtWrapperArgs = [
    "--prefix PATH : ${placeholder "out"}/bin"
@ -98,10 +108,24 @@ mkDerivation {
  # Causes failures on Hydra and ofborg from some reason
  enableParallelBuilding = false;

-  meta = with lib; {
+  patches = [
+    # fix build for julia 1.1 from upstream
+    (fetchpatch {
+      url = "https://github.com/KDE/cantor/commit/ed9525ec7895c2251668d11218f16f186db48a59.patch?full_index=1";
+      hash = "sha256-paq0e7Tl2aiUjBf1bDHLLUpShwdCQLICNTPNsXSoe5M=";
+    })
+  ];
+
+  meta = {
    description = "Front end to powerful mathematics and statistics packages";
    homepage = "https://cantor.kde.org/";
-    license = with licenses; [ bsd3 cc0 gpl2Only gpl2Plus gpl3Only ];
-    maintainers = with maintainers; [ hqurve ];
+    license = with lib.licenses; [
+      bsd3
+      cc0
+      gpl2Only
+      gpl2Plus
+      gpl3Only
+    ];
+    maintainers = with lib.maintainers; [ hqurve ];
  };
 }
--- a/third_party/nixpkgs/pkgs/applications/misc/1password-gui/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/1password-gui/default.nix
@ -10,43 +10,43 @@

 let
  pname = "1password";
-  version = if channel == "stable" then "8.10.40" else "8.10.44-21.BETA";
+  version = if channel == "stable" then "8.10.46" else "8.10.48-17.BETA";

  sources = {
    stable = {
      x86_64-linux = {
        url = "https://downloads.1password.com/linux/tar/stable/x86_64/1password-${version}.x64.tar.gz";
-        hash = "sha256-viY0SOUhrOvmue6Nolau356rIqwDo2nLzMilFFmNb9g=";
+        hash = "sha256-oewS90rSBqxA0V+ttcmUXznUZ3+mb5FKtmYD4kUDmTk=";
      };
      aarch64-linux = {
        url = "https://downloads.1password.com/linux/tar/stable/aarch64/1password-${version}.arm64.tar.gz";
-        hash = "sha256-7lUZiS3TSsIVqPoN5A6YqyVaaaRI9BliT51FHkwOPyw=";
+        hash = "sha256-tHQIhLPTD2dFRK542kFnpExg36paaNuzyOED8ZKyIYk=";
      };
      x86_64-darwin = {
        url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        hash = "sha256-xK/B8J3VP8y1xw3KorzZzPf/LjYmYdOIjDECMJnVv6I=";
+        hash = "sha256-pnAE1UTMXX89wshEI/wzhySb1NZY5ke5bSYmUjvU/pc=";
      };
      aarch64-darwin = {
        url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        hash = "sha256-iqdK6K7dcypZFGseYal2KjOaqJtUjXeCzbDdx7pDv8A=";
+        hash = "sha256-MmHUa96keBV9+E2GQdgz/aCTXeFkVNqHV0eH8/WhvhY=";
      };
    };
    beta = {
      x86_64-linux = {
        url = "https://downloads.1password.com/linux/tar/beta/x86_64/1password-${version}.x64.tar.gz";
-        hash = "sha256-enorJfbn+xJVy1fG3wjhO3LkSsMncHA9/yA13kG+h4Y=";
+        hash = "sha256-4SPZJP/ebnyAMEWrIGonb+5nYXuM8KCPK9modC/Cr/Y=";
      };
      aarch64-linux = {
        url = "https://downloads.1password.com/linux/tar/beta/aarch64/1password-${version}.arm64.tar.gz";
-        hash = "sha256-EUnIIi6DB5kBVid9ExBpNApKItHnRKQziBy/GFt0xag=";
+        hash = "sha256-V5Nt81Trw6l7DAUtCX2Yv/fL2wBJpJER0iaOBmMfQ5o=";
      };
      x86_64-darwin = {
        url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        hash = "sha256-U14CjoUJUpd4wWidZz6xGErhHI/VPChqG8cwBTBYoYc=";
+        hash = "sha256-UfSUPqZgbYdWyrfw41SdnnI1IeA+dYsfBAu/UQl0vVI=";
      };
      aarch64-darwin = {
        url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        hash = "sha256-DD1M2EFSHqG9OHX5Q/CmZLZIKYrBMS4cnX/6tLVi7H0=";
+        hash = "sha256-ynkDnJtoKMAtegeilB0XIH+YrSS9EKYV1ceN0Ecls+A=";
      };
    };
  };
--- a/third_party/nixpkgs/pkgs/applications/misc/copyq/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/copyq/default.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "CopyQ";
-  version = "9.0.0";
+  version = "9.1.0";

  src = fetchFromGitHub {
    owner = "hluk";
    repo = "CopyQ";
    rev = "v${version}";
-    hash = "sha256-Dxiytspqs4+bcnUM+B3lO8iQp9rrCvMfI+WMFMCtM7g=";
+    hash = "sha256-WBJyLfiPPEQ/Cj5uuwy9KhVc1kw4Hv5TeEuRFDydlGk=";
  };

  nativeBuildInputs = [
--- a/third_party/nixpkgs/pkgs/applications/misc/electrum/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/electrum/default.nix
@ -1,7 +1,7 @@
 { lib
 , stdenv
 , fetchurl
-, fetchFromGitHub
+, protobuf
 , wrapQtAppsHook
 , python3
 , zbar
@ -9,28 +9,9 @@
 , enableQt ? true
 , callPackage
 , qtwayland
-, fetchPypi
 }:

 let
-  version = "4.5.5";
-
-  python = python3.override {
-    self = python;
-    packageOverrides = self: super: {
-      # Pin ledger-bitcoin to 0.2.1
-      ledger-bitcoin = super.ledger-bitcoin.overridePythonAttrs (oldAttrs: rec {
-        version = "0.2.1";
-        format = "pyproject";
-        src = fetchPypi {
-          pname = "ledger_bitcoin";
-          inherit version;
-          hash = "sha256-AWl/q2MzzspNIo6yf30S92PgM/Ygsb+1lJsg7Asztso=";
-        };
-      });
-    };
-  };
-
  libsecp256k1_name =
    if stdenv.hostPlatform.isLinux then "libsecp256k1.so.{v}"
    else if stdenv.hostPlatform.isDarwin then "libsecp256k1.{v}.dylib"
@ -41,39 +22,21 @@ let
    else if stdenv.hostPlatform.isDarwin then "libzbar.0.dylib"
    else "libzbar${stdenv.hostPlatform.extensions.sharedLibrary}";

-  # Not provided in official source releases, which are what upstream signs.
-  tests = fetchFromGitHub {
-    owner = "spesmilo";
-    repo = "electrum";
-    rev = version;
-    sha256 = "sha256-CbhI/q+zjk9odxuvdzpogi046FqkedJooiQwS+WAkJ8=";
-
-    postFetch = ''
-      mv $out ./all
-      mv ./all/tests $out
-    '';
-  };
-
 in

-python.pkgs.buildPythonApplication {
+python3.pkgs.buildPythonApplication rec {
  pname = "electrum";
-  inherit version;
+  version = "4.5.6";

  src = fetchurl {
    url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz";
-    sha256 = "1jiagz9avkbd158pcip7p4wz0pdsxi94ndvg5p8afvshb32aqwav";
+    hash = "sha256-LO2ZUvbDJaIxrdgA+cM3sGgqJ+N+UlA9ObNINQcrorA=";
  };

-  postUnpack = ''
-    # can't symlink, tests get confused
-    cp -ar ${tests} $sourceRoot/tests
-  '';
-
-  nativeBuildInputs = lib.optionals enableQt [ wrapQtAppsHook ];
+  build-system = [ protobuf ] ++ lib.optionals enableQt [ wrapQtAppsHook ];
  buildInputs = lib.optional (stdenv.hostPlatform.isLinux && enableQt) qtwayland;

-  propagatedBuildInputs = with python.pkgs; [
+  dependencies = with python3.pkgs; [
    aiohttp
    aiohttp-socks
    aiorpcx
@ -104,7 +67,7 @@ python.pkgs.buildPythonApplication {
    qdarkstyle
  ];

-  checkInputs = with python.pkgs; lib.optionals enableQt [
+  checkInputs = with python3.pkgs; lib.optionals enableQt [
    pyqt6
  ];

@ -136,7 +99,7 @@ python.pkgs.buildPythonApplication {
    wrapQtApp $out/bin/electrum
  '';

-  nativeCheckInputs = with python.pkgs; [ pytestCheckHook pyaes pycryptodomex ];
+  nativeCheckInputs = with python3.pkgs; [ pytestCheckHook pyaes pycryptodomex ];

  pytestFlagsArray = [ "tests" ];

--- a/third_party/nixpkgs/pkgs/applications/misc/fluidd/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/fluidd/default.nix
@ -2,12 +2,12 @@

 stdenvNoCC.mkDerivation rec {
  pname = "fluidd";
-  version = "1.30.4";
+  version = "1.30.5";

  src = fetchurl {
    name = "fluidd-v${version}.zip";
-    url = "https://github.com/cadriel/fluidd/releases/download/v${version}/fluidd.zip";
-    sha256 = "sha256-r9RYNfbMa0axxS5kVBsFmvnuznsZz4s0ZfsIJVczHlI=";
+    url = "https://github.com/fluidd-core/fluidd/releases/download/v${version}/fluidd.zip";
+    sha256 = "sha256-Ry9aD8pSFw076yIywik0ov+ZPNRsI9srM4YJBW/1bY8=";
  };

  nativeBuildInputs = [ unzip ];
--- a/third_party/nixpkgs/pkgs/applications/misc/gmrun/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/misc/gmrun/default.nix
@ -1,43 +0,0 @@
-{ lib, stdenv, fetchurl, glib, gtk2, pkg-config, popt }:
-
-let
-  version = "0.9.2";
-in
-
-stdenv.mkDerivation rec {
-  pname = "gmrun";
-  inherit version;
-
-  src = fetchurl {
-    url = "mirror://sourceforge/gmrun/${pname}-${version}.tar.gz";
-    sha256 = "180z6hbax1qypy5cyy2z6nn7fzxla4ib47ck8mqwr714ag77na8p";
-  };
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ glib gtk2 popt ];
-
-  doCheck = true;
-
-  enableParallelBuilding = true;
-
-  patches = [
-      ./gcc43.patch
-      ./find-config-file-in-system-etc-dir.patch
-      ./gmrun-0.9.2-xdg.patch
-    ];
-
-  meta = with lib; {
-    description = "Gnome Completion-Run Utility";
-    longDescription = ''
-      A simple program which provides a "run program" window, featuring a bash-like TAB completion.
-      It uses GTK interface.
-      Also, supports CTRL-R / CTRL-S / "!" for searching through history.
-      Running commands in a terminal with CTRL-Enter. URL handlers.
-    '';
-    homepage = "https://sourceforge.net/projects/gmrun/";
-    license = licenses.gpl2;
-    maintainers = [ ];
-    platforms = platforms.all;
-    mainProgram = "gmrun";
-  };
-}
--- a/third_party/nixpkgs/pkgs/applications/misc/gmrun/find-config-file-in-system-etc-dir.patch
+++ b/third_party/nixpkgs/pkgs/applications/misc/gmrun/find-config-file-in-system-etc-dir.patch
@ -1,18 +0,0 @@
-diff -ur gmrun-0.9.2-orig/src/prefs.cc gmrun-0.9.2/src/prefs.cc
--- gmrun-0.9.2-orig/src/prefs.cc	2019-05-02 12:56:39.025088361 +0200
-+++ gmrun-0.9.2/src/prefs.cc	2019-05-02 13:21:51.179778620 +0200
-@@ -31,9 +31,11 @@
- 
- Prefs::Prefs()
- {
-  string file_name = PACKAGE_DATA_DIR"/";
-  file_name += GMRUNRC;
-  init(file_name);
-+  string file_name = "/etc/" GMRUNRC;
-+  if (!init(file_name)) {
-+    file_name = PACKAGE_DATA_DIR "/" GMRUNRC;;
-+    init(file_name);
-+  }
- 
-   file_name = getenv("HOME");
-   if (!file_name.empty()) {
--- a/third_party/nixpkgs/pkgs/applications/misc/gmrun/gcc43.patch
+++ b/third_party/nixpkgs/pkgs/applications/misc/gmrun/gcc43.patch
@ -1,51 +0,0 @@
--- a/src/gtkcompletionline.cc.orig	2003-11-16 11:55:07.000000000 +0100
-+++ a/src/gtkcompletionline.cc	2008-05-08 08:51:22.000000000 +0200
-@@ -29,6 +29,7 @@
- #include <set>
- #include <sstream>
- #include <string>
-+#include <cstring>
- #include <vector>
- using namespace std;
- 
--- a/src/ci_string.h.orig	2001-05-16 16:39:31.000000000 +0200
-+++ a/src/ci_string.h	2008-05-08 08:51:33.000000000 +0200
-@@ -7,6 +7,7 @@
- #define __CI_STRING_H__
- 
- #include <string>
-+#include <cstring>
- #include <ctype.h>
- 
- struct ci_char_traits : public std::char_traits<char>
--- a/src/prefs.cc.orig	2002-08-16 12:48:22.000000000 +0200
-+++ a/src/prefs.cc	2008-05-08 08:51:54.000000000 +0200
-@@ -13,6 +13,7 @@
- #include <fstream>
- #include <iostream>
- #include <stdio.h>
-+#include <stdlib.h>
- 
- #include <list>
- 
--- a/src/main.cc.orig	2003-11-16 11:55:07.000000000 +0100
-+++ a/src/main.cc	2008-05-08 09:03:11.000000000 +0200
-@@ -14,6 +14,7 @@
- #include <gdk/gdkkeysyms.h>
- 
- #include <string>
-+#include <cstring>
- #include <iostream>
- #include <sstream>
- #include <vector>
-
--- a/src/gtkcompletionline.cc.orig	2009-06-19 22:38:14.000000000 +0400
-+++ a/src/gtkcompletionline.cc	2009-06-19 22:37:14.000000000 +0400
-@@ -376,7 +377,7 @@
-   return 0;
- }
- 
-int my_alphasort(const void* va, const void* vb) {
-+int my_alphasort(const dirent** va, const dirent** vb) {
-   const struct dirent** a = (const struct dirent**)va;
-   const struct dirent** b = (const struct dirent**)vb;
--- a/Show more
+++ b/Show more