Merge staging-next into staging

2026-01-11 18:32:23 +08:00 · 2024-11-23 00:15:02 +00:00
parent 77aaee1a06 ae6f2c4417
commit 5d73f1b15f
40 changed files with 669 additions and 254 deletions
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -14,7 +14,7 @@
 # Processing of this file is implemented in workflows/codeowners-v2.yml

 # CI
-/.github/workflows @NixOS/Security @Mic92 @zowoq @infinisil
+/.github/workflows @NixOS/Security @Mic92 @zowoq @infinisil @azuwis
 /.github/workflows/check-nix-format.yml @infinisil
 /.github/workflows/nixpkgs-vet.yml @infinisil @philiptaron
 /.github/workflows/codeowners-v2.yml @infinisil
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@@ -329,6 +329,7 @@ rec {
  ucrtAarch64 = {
    config = "aarch64-w64-mingw32";
    libc = "ucrt";
+    rust.rustcTarget = "aarch64-pc-windows-gnullvm";
    useLLVM = true;
  };

--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -44,6 +44,8 @@
 - `authelia` has been upgraded to version 4.38. This version brings several features and improvements which are detailed in the [release blog post](https://www.authelia.com/blog/4.38-release-notes/).
  This release also deprecates some configuration keys which are likely to be removed in version 5.0.0.

+- `netbird` has been updated to 0.31.1. This adds a built-in relay server which is not yet supported by the NixOS module, as well as a metrics endpoint for both the management and signal services. The default metrics port for the `signal` service has been changed from `9090` to `9091` to prevent a port conflict with the management server. This can be changed with their respective `metricsPort` as needed. Refer to the [release notes](https://github.com/netbirdio/netbird/releases/tag/v0.31.1) and [this pull request](https://github.com/NixOS/nixpkgs/pull/354032#issuecomment-2480925927) for more information.
+
 - `compressDrv` can compress selected files in a derivation. `compressDrvWeb` compresses files for common web server usage (`.gz` with `zopfli`, `.br` with `brotli`).

 - [`hardware.display`](#opt-hardware.display.edid.enable) is a new module implementing workarounds for misbehaving monitors
@@ -85,6 +87,8 @@

 ## New Modules {#sec-release-24.11-new-modules}

+- [Coral](https://coral.ai/), hardware support for Coral.ai Edge TPU devices. Available as [hardware.coral.usb.enable](#opt-hardware.coral.usb.enable) and [hardware.coral.pcie.enable](#opt-hardware.coral.pcie.enable).
+
 - [Cyrus IMAP](https://github.com/cyrusimap/cyrus-imapd), an email, contacts and calendar server. Available as [services.cyrus-imap](#opt-services.cyrus-imap.enable) service.

 - [TaskChampion Sync-Server](https://github.com/GothenburgBitFactory/taskchampion-sync-server), a [Taskwarrior 3](https://taskwarrior.org/docs/upgrade-3/) sync server. Available as [services.taskchampion-sync-server](#opt-services.taskchampion-sync-server.enable).
--- a/nixos/modules/hardware/coral.nix
+++ b/nixos/modules/hardware/coral.nix
@@ -0,0 +1,38 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    mkEnableOption
+    mkIf
+    mkMerge
+    ;
+
+  cfg = config.hardware.coral;
+in
+
+{
+  options.hardware.coral = {
+    usb.enable = mkEnableOption "Coral USB support";
+    pcie.enable = mkEnableOption "Coral PCIe support";
+  };
+
+  config = mkMerge [
+    (mkIf (cfg.usb.enable || cfg.pcie.enable) {
+      users.groups.coral = { };
+    })
+    (mkIf cfg.usb.enable {
+      services.udev.packages = with pkgs; [ libedgetpu ];
+    })
+    (mkIf cfg.pcie.enable {
+      boot.extraModulePackages = with config.boot.kernelPackages; [ gasket ];
+      services.udev.extraRules = ''
+        SUBSYSTEM=="apex",MODE="0660",GROUP="coral"
+      '';
+    })
+  ];
+}
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -52,6 +52,7 @@
  ./hardware/bladeRF.nix
  ./hardware/brillo.nix
  ./hardware/ckb-next.nix
+  ./hardware/coral.nix
  ./hardware/corectrl.nix
  ./hardware/cpu/amd-microcode.nix
  ./hardware/cpu/amd-sev.nix
--- a/nixos/modules/services/networking/netbird/management.nix
+++ b/nixos/modules/services/networking/netbird/management.nix
@@ -196,6 +196,12 @@ in
      description = "Internal port of the management server.";
    };

+    metricsPort = mkOption {
+      type = port;
+      default = 9090;
+      description = "Internal port of the metrics server.";
+    };
+
    extraOptions = mkOption {
      type = listOf str;
      default = [ ];
@@ -360,6 +366,13 @@ in
          }
        ];

+    assertions = [
+      {
+        assertion = cfg.port != cfg.metricsPort;
+        message = "The primary listen port cannot be the same as the listen port for the metrics endpoint";
+      }
+    ];
+
    systemd.services.netbird-management = {
      description = "The management server for Netbird, a wireguard VPN";
      documentation = [ "https://netbird.io/docs/" ];
@@ -387,6 +400,9 @@ in
            # Port to listen on
            "--port"
            cfg.port
+            # Port the internal prometheus server listens on
+            "--metrics-port"
+            cfg.metricsPort
            # Log to stdout
            "--log-file"
            "console"
--- a/nixos/modules/services/networking/netbird/signal.nix
+++ b/nixos/modules/services/networking/netbird/signal.nix
@@ -15,7 +15,12 @@ let
    mkOption
    ;

-  inherit (lib.types) enum port str;
+  inherit (lib.types)
+    listOf
+    enum
+    port
+    str
+    ;

  inherit (utils) escapeSystemdExecArgs;

@@ -41,6 +46,20 @@ in
      description = "Internal port of the signal server.";
    };

+    metricsPort = mkOption {
+      type = port;
+      default = 9091;
+      description = "Internal port of the metrics server.";
+    };
+
+    extraOptions = mkOption {
+      type = listOf str;
+      default = [ ];
+      description = ''
+        Additional options given to netbird-signal as commandline arguments.
+      '';
+    };
+
    logLevel = mkOption {
      type = enum [
        "ERROR"
@@ -54,24 +73,38 @@ in
  };

  config = mkIf cfg.enable {
+
+    assertions = [
+      {
+        assertion = cfg.port != cfg.metricsPort;
+        message = "The primary listen port cannot be the same as the listen port for the metrics endpoint";
+      }
+    ];
+
    systemd.services.netbird-signal = {
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];

      serviceConfig = {
-        ExecStart = escapeSystemdExecArgs [
-          (getExe' cfg.package "netbird-signal")
-          "run"
-          # Port to listen on
-          "--port"
-          cfg.port
-          # Log to stdout
-          "--log-file"
-          "console"
-          # Log level
-          "--log-level"
-          cfg.logLevel
-        ];
+        ExecStart = escapeSystemdExecArgs (
+          [
+            (getExe' cfg.package "netbird-signal")
+            "run"
+            # Port to listen on
+            "--port"
+            cfg.port
+            # Port the internal prometheus server listens on
+            "--metrics-port"
+            cfg.metricsPort
+            # Log to stdout
+            "--log-file"
+            "console"
+            # Log level
+            "--log-level"
+            cfg.logLevel
+          ]
+          ++ cfg.extraOptions
+        );

        Restart = "always";
        RuntimeDirectory = "netbird-mgmt";
--- a/nixos/modules/services/video/frigate.nix
+++ b/nixos/modules/services/video/frigate.nix
@@ -6,19 +6,28 @@

 let
  inherit (lib)
-    literalExpression
+    any
+    attrValues
+    converge
+    elem
+    filterAttrsRecursive
+    hasPrefix
+    makeLibraryPath
+    match
    mkDefault
    mkEnableOption
    mkPackageOption
    mkIf
    mkOption
+    optionalAttrs
+    optionals
    types;

  cfg = config.services.frigate;

  format = pkgs.formats.yaml { };

-  filteredConfig = lib.converge (lib.filterAttrsRecursive (_: v: ! lib.elem v [ null ])) cfg.settings;
+  filteredConfig = converge (filterAttrsRecursive (_: v: ! elem v [ null ])) cfg.settings;

  cameraFormat = with types; submodule {
    freeformType = format.type;
@@ -94,6 +103,15 @@ let
    proxy_connect_timeout 360;
  '';

+  # Discover configured detectors for acceleration support
+  detectors = attrValues cfg.settings.detectors or {};
+  withCoralUSB = any (d: d.type == "edgetpu" && hasPrefix "usb" d.device or "") detectors;
+  withCoralPCI =  any (d: d.type == "edgetpu" && hasPrefix "pci" d.device or "") detectors;
+  withCoral = withCoralPCI || withCoralUSB;
+
+  # Provide ffmpeg-full for NVIDIA hardware acceleration
+  ffmpegArgs = cfg.settings.ffmpeg.hwaccel_args or "";
+  ffmpeg' = if match "/nvidia/" ffmpegArgs != null then pkgs.ffmpeg-full else pkgs.ffmpeg-headless;
 in

 {
@@ -114,6 +132,27 @@ in
      '';
    };

+    vaapiDriver = mkOption {
+      type = nullOr (enum [ "i965" "iHD" "nouveau" "vdpau" "nvidia" "radeonsi" ]);
+      default = null;
+      example = "radeonsi";
+      description = ''
+        Force usage of a particular VA-API driver for video acceleration. Use together with `settings.ffmpeg.hwaccel_args`.
+
+        Setting this *is not required* for VA-API to work, but it can help steer VA-API towards the correct card if you have multiple.
+
+        :::{.note}
+        For VA-API to work you must enable {option}`hardware.graphics.enable` (sufficient for AMDGPU) and pass for example
+        `pkgs.intel-media-driver` (required for Intel 5th Gen. and newer) into {option}`hardware.graphics.extraPackages`.
+        :::
+
+        See also:
+
+        - https://docs.frigate.video/configuration/hardware_acceleration
+        - https://docs.frigate.video/configuration/ffmpeg_presets#hwaccel-presets
+      '';
+    };
+
    settings = mkOption {
      type = submodule {
        freeformType = format.type;
@@ -171,7 +210,6 @@ in
        set-misc
        vod
      ];
-      recommendedProxySettings = mkDefault true;
      recommendedGzipSettings = mkDefault true;
      mapHashBucketSize = mkDefault 128;
      upstreams = {
@@ -202,6 +240,7 @@ in
          # auth_location.conf
          "/auth" = {
            proxyPass = "http://frigate-api/auth";
+            recommendedProxySettings = true;
            extraConfig = ''
              internal;

@@ -306,11 +345,13 @@ in
          };
          "/ws" = {
            proxyPass = "http://frigate-mqtt-ws/";
+            recommendedProxySettings = true;
            proxyWebsockets = true;
            extraConfig = nginxAuthRequest + nginxProxySettings;
          };
          "/live/jsmpeg" = {
            proxyPass = "http://frigate-jsmpeg/";
+            recommendedProxySettings = true;
            proxyWebsockets = true;
            extraConfig = nginxAuthRequest + nginxProxySettings;
          };
@@ -318,6 +359,7 @@ in
          "/live/mse/api/ws" = {
            proxyPass = "http://frigate-go2rtc/api/ws";
            proxyWebsockets = true;
+            recommendedProxySettings = true;
            extraConfig = nginxAuthRequest + nginxProxySettings + ''
              limit_except GET {
                  deny  all;
@@ -327,6 +369,7 @@ in
          "/live/webrtc/api/ws" = {
            proxyPass = "http://frigate-go2rtc/api/ws";
            proxyWebsockets = true;
+            recommendedProxySettings = true;
            extraConfig = nginxAuthRequest + nginxProxySettings + ''
              limit_except GET {
                  deny  all;
@@ -336,6 +379,7 @@ in
          # pass through go2rtc player
          "/live/webrtc/webrtc.html" = {
            proxyPass = "http://frigate-go2rtc/webrtc.html";
+            recommendedProxySettings = true;
            extraConfig = nginxAuthRequest + nginxProxySettings + ''
              limit_except GET {
                  deny  all;
@@ -345,6 +389,7 @@ in
          # frontend uses this to fetch the version
          "/api/go2rtc/api" = {
            proxyPass = "http://frigate-go2rtc/api";
+            recommendedProxySettings = true;
            extraConfig = nginxAuthRequest + nginxProxySettings + ''
              limit_except GET {
                  deny  all;
@@ -355,6 +400,7 @@ in
          "/api/go2rtc/webrtc" = {
            proxyPass = "http://frigate-go2rtc/api/webrtc";
            proxyWebsockets = true;
+            recommendedProxySettings = true;
            extraConfig = nginxAuthRequest + nginxProxySettings + ''
              limit_except GET {
                  deny  all;
@@ -363,12 +409,14 @@ in
          };
          "~* /api/.*\.(jpg|jpeg|png|webp|gif)$" = {
            proxyPass = "http://frigate-api";
+            recommendedProxySettings = true;
            extraConfig = nginxAuthRequest + nginxProxySettings + ''
              rewrite ^/api/(.*)$ $1 break;
            '';
          };
          "/api/" = {
            proxyPass = "http://frigate-api/";
+            recommendedProxySettings = true;
            extraConfig = nginxAuthRequest + nginxProxySettings + ''
              add_header Cache-Control "no-store";
              expires off;
@@ -492,6 +540,11 @@ in
      "frigate"
    ];

+    hardware.coral = {
+      usb.enable = mkDefault withCoralUSB;
+      pcie.enable = mkDefault withCoralPCI;
+    };
+
    users.users.frigate = {
      isSystemUser = true;
      group = "frigate";
@@ -510,26 +563,35 @@ in
        CONFIG_FILE = format.generate "frigate.yml" filteredConfig;
        HOME = "/var/lib/frigate";
        PYTHONPATH = cfg.package.pythonPath;
+      } // optionalAttrs (cfg.vaapiDriver != null) {
+        LIBVA_DRIVER_NAME = cfg.vaapiDriver;
+      } // optionalAttrs withCoral {
+        LD_LIBRARY_PATH = makeLibraryPath (with pkgs; [ libedgetpu ]);
      };
      path = with pkgs; [
        # unfree:
        # config.boot.kernelPackages.nvidiaPackages.latest.bin
-        ffmpeg-headless
+        ffmpeg'
        libva-utils
        procps
        radeontop
-      ] ++ lib.optionals (!stdenv.hostPlatform.isAarch64) [
+      ] ++ optionals (!stdenv.hostPlatform.isAarch64) [
        # not available on aarch64-linux
        intel-gpu-tools
      ];
      serviceConfig = {
-        ExecStartPre = "-rm /var/cache/frigate/*.mp4";
+        ExecStartPre = pkgs.writeShellScript "frigate-clear-cache" ''
+          rm --recursive --force /var/cache/frigate/*
+        '';
        ExecStart = "${cfg.package.python.interpreter} -m frigate";
        Restart = "on-failure";
        SyslogIdentifier = "frigate";

        User = "frigate";
        Group = "frigate";
+        SupplementaryGroups = [ "render" ] ++ optionals withCoral [ "coral" ];
+
+        AmbientCapabilities = optionals (elem cfg.vaapiDriver [ "i965" "iHD" ]) [ "CAP_PERFMON" ]; # for intel_gpu_top

        UMask = "0027";

--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2656,6 +2656,23 @@ let
        };
      };

+      jetmartin.bats = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "bats";
+          publisher = "jetmartin";
+          version = "0.1.10";
+          hash = "sha256-WD1YTRgzSVElixnNGtg6mMlcLCIaI6IBb+uh4cfzuBs=";
+        };
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/jetmartin.bats/changelog";
+          description = "VSCode extension for full language support for the Bats (Bash Automated Testing System) testing framework";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=jetmartin.bats";
+          homepage = "https://github.com/bats-core/bats-vscode";
+          license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.dotmobo ];
+        };
+      };
+
      jkillian.custom-local-formatters = buildVscodeMarketplaceExtension {
        mktplcRef = {
          publisher = "jkillian";
--- a/pkgs/by-name/ch/chez/package.nix
+++ b/pkgs/by-name/ch/chez/package.nix
@@ -6,11 +6,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "chez-scheme";
-  version = "10.0.0";
+  version = "10.1.0";

  src = fetchurl {
    url = "https://github.com/cisco/ChezScheme/releases/download/v${finalAttrs.version}/csv${finalAttrs.version}.tar.gz";
-    hash = "sha256-03GZASte0ZhcQGnWqH/xjl4fWi3yfkApkfr0XcTyIyw=";
+    hash = "sha256-kYGmyMSrXl0y2Hn/FZ0zWlDU+LOIYRriKiY+kyw1OYs=";
  };

  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
--- a/pkgs/by-name/fr/frigate/package.nix
+++ b/pkgs/by-name/fr/frigate/package.nix
@@ -29,6 +29,12 @@ let
    };
  };

+  # Tensorflow audio model
+  tflite_audio_model = fetchurl {
+    url = "https://www.kaggle.com/api/v1/models/google/yamnet/tfLite/classification-tflite/1/download";
+    hash = "sha256-G5cbITJ2AnOl+49dxQToZ4OyeFO7MTXVVa4G8eHjZfM=";
+  };
+
  # Tensorflow Lite models
  # https://github.com/blakeblackshear/frigate/blob/v0.13.0/docker/main/Dockerfile#L96-L97
  tflite_cpu_model = fetchurl {
@@ -72,14 +78,22 @@ python.pkgs.buildPythonApplication rec {
    substituteInPlace frigate/detectors/detector_config.py \
      --replace-fail "/labelmap.txt" "${placeholder "out"}/share/frigate/labelmap.txt"

+    substituteInPlace frigate/output/birdseye.py \
+      --replace-fail "/opt/frigate/" "${placeholder "out"}/${python.sitePackages}/"
+
    # work around onvif-zeep idiosyncrasy
    substituteInPlace frigate/ptz/onvif.py \
      --replace-fail dist-packages site-packages

+    # provide default paths for models and maps that are shipped with frigate
    substituteInPlace frigate/config.py \
      --replace-fail "/cpu_model.tflite" "${tflite_cpu_model}" \
      --replace-fail "/edgetpu_model.tflite" "${tflite_edgetpu_model}"

+    substituteInPlace frigate/events/audio.py \
+      --replace-fail "/cpu_audio_model.tflite" "${placeholder "out"}/share/frigate/cpu_audio_model.tflite" \
+      --replace-fail "/audio-labelmap.txt" "${placeholder "out"}/share/frigate/audio-labelmap.txt"
+
    substituteInPlace frigate/test/test_config.py \
      --replace-fail "(MODEL_CACHE_DIR" "('/build/model_cache'" \
      --replace-fail "/config/model_cache" "/build/model_cache"
@@ -131,7 +145,10 @@ python.pkgs.buildPythonApplication rec {
    cp -R frigate/* $out/${python.sitePackages}/frigate/

    mkdir -p $out/share/frigate
-    cp -R {migrations,labelmap.txt} $out/share/frigate/
+    cp -R {migrations,labelmap.txt,audio-labelmap.txt} $out/share/frigate/
+
+    tar --extract --gzip --file ${tflite_audio_model}
+    cp --no-preserve=mode ./1.tflite $out/share/frigate/cpu_audio_model.tflite

    cp --no-preserve=mode ${openvino_model} $out/share/frigate/coco_91cl_bkgr.txt
    sed -i 's/truck/car/g' $out/share/frigate/coco_91cl_bkgr.txt
--- a/pkgs/by-name/gi/giada/package.nix
+++ b/pkgs/by-name/gi/giada/package.nix
@@ -1,24 +1,26 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, cmake
-, pkg-config
-, fltk
-, fmt
-, rtmidi
-, libsamplerate
-, libmpg123
-, libsndfile
-, jack2
-, alsa-lib
-, libpulseaudio
-, libXpm
-, libXrandr
-, flac
-, libogg
-, libvorbis
-, libopus
-, nlohmann_json
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  fltk,
+  fontconfig,
+  fmt,
+  rtmidi,
+  libsamplerate,
+  libmpg123,
+  libsndfile,
+  jack2,
+  alsa-lib,
+  libpulseaudio,
+  libXpm,
+  libXrandr,
+  flac,
+  libogg,
+  libvorbis,
+  libopus,
+  nlohmann_json,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -47,24 +49,28 @@ stdenv.mkDerivation (finalAttrs: {
    pkg-config
  ];

-  buildInputs = [
-    rtmidi
-    fltk
-    fmt
-    libmpg123
-    libsndfile
-    libsamplerate
-    nlohmann_json
-    alsa-lib
-    libXpm
-    libpulseaudio
-    jack2
-    flac
-    libogg
-    libvorbis
-    libopus
-    libXrandr
-  ];
+  buildInputs =
+    [
+      rtmidi
+      fltk
+      fmt
+      libmpg123
+      libsndfile
+      libsamplerate
+      nlohmann_json
+      alsa-lib
+      libXpm
+      libpulseaudio
+      jack2
+      flac
+      libogg
+      libvorbis
+      libopus
+      libXrandr
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isLinux || stdenv.hostPlatform.isFreeBSD) [
+      fontconfig
+    ];

  meta = {
    description = "Free, minimal, hardcore audio tool for DJs, live performers and electronic musicians";
--- a/pkgs/by-name/ho/homer/package.nix
+++ b/pkgs/by-name/ho/homer/package.nix
@@ -0,0 +1,64 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  pnpm,
+  nodejs,
+  dart-sass,
+}:
+stdenvNoCC.mkDerivation rec {
+  pname = "homer";
+  version = "24.11.4";
+  src = fetchFromGitHub {
+    owner = "bastienwirtz";
+    repo = "homer";
+    rev = "v${version}";
+    hash = "sha256-UaoBdYzTEYB1pkiTYrt4T7GjwMJWXPuW5VSl4MU8DCI=";
+  };
+
+  pnpmDeps = pnpm.fetchDeps {
+    inherit
+      pname
+      version
+      src
+      patches
+      ;
+    hash = "sha256-5unoY8lPaX9sZAJEBICpxSddwLV8liK1tbamB2ulvew=";
+  };
+
+  # Enables specifying a custom Sass compiler binary path via `SASS_EMBEDDED_BIN_PATH` environment variable.
+  patches = [ ./sass-embedded.patch ];
+
+  nativeBuildInputs = [
+    nodejs
+    dart-sass
+    pnpm.configHook
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    export SASS_EMBEDDED_BIN_PATH="${dart-sass}/bin/sass"
+    pnpm build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    cp -R dist/* $out/
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A very simple static homepage for your server.";
+    homepage = "https://homer-demo.netlify.app/";
+    changelog = "https://github.com/bastienwirtz/homer/releases";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ stunkymonkey ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/by-name/ho/homer/sass-embedded.patch
+++ b/pkgs/by-name/ho/homer/sass-embedded.patch
@@ -0,0 +1,133 @@
+diff --git a/package.json b/package.json
+index f121431..97f1b11 100644
+--- a/package.json
+++ b/package.json
+@@ -28,5 +28,10 @@
+     "vite-plugin-pwa": "^0.20.5"
+   },
+   "license": "Apache-2.0",
+-  "packageManager": "pnpm@9.12.1+sha512.e5a7e52a4183a02d5931057f7a0dbff9d5e9ce3161e33fa68ae392125b79282a8a8a470a51dfc8a0ed86221442eb2fb57019b0990ed24fab519bf0e1bc5ccfc4"
+  "packageManager": "pnpm@9.12.1+sha512.e5a7e52a4183a02d5931057f7a0dbff9d5e9ce3161e33fa68ae392125b79282a8a8a470a51dfc8a0ed86221442eb2fb57019b0990ed24fab519bf0e1bc5ccfc4",
+  "pnpm": {
+    "patchedDependencies": {
+      "sass-embedded": "patches/sass-embedded.patch"
+    }
+  }
+ }
+diff --git a/patches/sass-embedded.patch b/patches/sass-embedded.patch
+new file mode 100644
+index 0000000..f941a8e
+--- /dev/null
+++ b/patches/sass-embedded.patch
+@@ -0,0 +1,15 @@
+diff --git a/dist/lib/src/compiler-path.js b/dist/lib/src/compiler-path.js
+index ae33aa3028e1a120d9e84b043bb19a71f1083b96..7a49d16a54982312ad638632d6750d7bec670f02 100644
+--- a/dist/lib/src/compiler-path.js
++++ b/dist/lib/src/compiler-path.js
+@@ -24,6 +24,10 @@ function isLinuxMusl(path) {
+ }
+ /** The full command for the embedded compiler executable. */
+ exports.compilerCommand = (() => {
++    const binPath = process.env.SASS_EMBEDDED_BIN_PATH;
++    if (binPath) {
++        return [binPath];
++    }
+     const platform = process.platform === 'linux' && isLinuxMusl(process.execPath)
+         ? 'linux-musl'
+         : process.platform;
+diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
+index 4c4267a..fd278e1 100644
+--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
+@@ -4,6 +4,11 @@ settings:
+   autoInstallPeers: true
+   excludeLinksFromLockfile: false
+ 
+patchedDependencies:
+  sass-embedded:
+    hash: 6wjvcsryx2tfkpottp4wf5nbzi
+    path: patches/sass-embedded.patch
+
+ importers:
+ 
+   .:
+@@ -26,7 +31,7 @@ importers:
+     devDependencies:
+       '@vitejs/plugin-vue':
+         specifier: ^5.1.4
+-        version: 5.1.4(vite@5.4.9(sass-embedded@1.79.5)(sass@1.79.5)(terser@5.35.0))(vue@3.5.12)
+        version: 5.1.4(vite@5.4.9(sass-embedded@1.79.5(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.35.0))(vue@3.5.12)
+       '@vue/eslint-config-prettier':
+         specifier: ^10.0.0
+         version: 10.0.0(eslint@9.12.0)(prettier@3.3.3)
+@@ -44,13 +49,13 @@ importers:
+         version: 3.3.3
+       sass-embedded:
+         specifier: ^1.79.5
+-        version: 1.79.5
+        version: 1.79.5(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi)
+       vite:
+         specifier: ^5.4.9
+-        version: 5.4.9(sass-embedded@1.79.5)(sass@1.79.5)(terser@5.35.0)
+        version: 5.4.9(sass-embedded@1.79.5(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.35.0)
+       vite-plugin-pwa:
+         specifier: ^0.20.5
+-        version: 0.20.5(vite@5.4.9(sass-embedded@1.79.5)(sass@1.79.5)(terser@5.35.0))(workbox-build@7.1.0)(workbox-window@7.1.0)
+        version: 0.20.5(vite@5.4.9(sass-embedded@1.79.5(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.35.0))(workbox-build@7.1.0)(workbox-window@7.1.0)
+ 
+ packages:
+ 
+@@ -3516,9 +3521,9 @@ snapshots:
+ 
+   '@types/trusted-types@2.0.7': {}
+ 
+-  '@vitejs/plugin-vue@5.1.4(vite@5.4.9(sass-embedded@1.79.5)(sass@1.79.5)(terser@5.35.0))(vue@3.5.12)':
+  '@vitejs/plugin-vue@5.1.4(vite@5.4.9(sass-embedded@1.79.5(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.35.0))(vue@3.5.12)':
+     dependencies:
+-      vite: 5.4.9(sass-embedded@1.79.5)(sass@1.79.5)(terser@5.35.0)
+      vite: 5.4.9(sass-embedded@1.79.5(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.35.0)
+       vue: 3.5.12
+ 
+   '@vue/compiler-core@3.5.12':
+@@ -4693,7 +4698,7 @@ snapshots:
+   sass-embedded-win32-x64@1.79.5:
+     optional: true
+ 
+-  sass-embedded@1.79.5:
+  sass-embedded@1.79.5(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi):
+     dependencies:
+       '@bufbuild/protobuf': 2.2.0
+       buffer-builder: 0.2.0
+@@ -4975,18 +4980,18 @@ snapshots:
+ 
+   varint@6.0.0: {}
+ 
+-  vite-plugin-pwa@0.20.5(vite@5.4.9(sass-embedded@1.79.5)(sass@1.79.5)(terser@5.35.0))(workbox-build@7.1.0)(workbox-window@7.1.0):
+  vite-plugin-pwa@0.20.5(vite@5.4.9(sass-embedded@1.79.5(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.35.0))(workbox-build@7.1.0)(workbox-window@7.1.0):
+     dependencies:
+       debug: 4.3.7
+       pretty-bytes: 6.1.1
+       tinyglobby: 0.2.9
+-      vite: 5.4.9(sass-embedded@1.79.5)(sass@1.79.5)(terser@5.35.0)
+      vite: 5.4.9(sass-embedded@1.79.5(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.35.0)
+       workbox-build: 7.1.0
+       workbox-window: 7.1.0
+     transitivePeerDependencies:
+       - supports-color
+ 
+-  vite@5.4.9(sass-embedded@1.79.5)(sass@1.79.5)(terser@5.35.0):
+  vite@5.4.9(sass-embedded@1.79.5(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi))(sass@1.79.5)(terser@5.35.0):
+     dependencies:
+       esbuild: 0.21.5
+       postcss: 8.4.47
+@@ -4994,7 +4999,7 @@ snapshots:
+     optionalDependencies:
+       fsevents: 2.3.3
+       sass: 1.79.5
+-      sass-embedded: 1.79.5
+      sass-embedded: 1.79.5(patch_hash=6wjvcsryx2tfkpottp4wf5nbzi)
+       terser: 5.35.0
+ 
+   vue-eslint-parser@9.4.3(eslint@9.12.0):
+-- 
+2.47.0
--- a/pkgs/by-name/ju/just/package.nix
+++ b/pkgs/by-name/ju/just/package.nix
@@ -12,17 +12,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "just";
-  version = "1.36.0";
+  version = "1.37.0";
  outputs = [ "out" "man" "doc" ];

  src = fetchFromGitHub {
    owner = "casey";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-4p4otR0W/v0DoWwwcNq/UEDa1V8vlZMpdk33B/9A4Bo=";
+    hash = "sha256-WF1kyIZyqnIYfFL/HZWBER97aXH3FSCbTRonOKSwgNg=";
  };

-  cargoHash = "sha256-y6wBFjBOeymbXUIeflQ35FxQRMPlDvB0Zeo2bQeZjJ0=";
+  cargoHash = "sha256-/uWxYxczTOlUs2wOCCn5wwbGETHwIqdDI2mb/h4xVxQ=";

  nativeBuildInputs = [ installShellFiles mdbook ];
  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ libiconv ];
--- a/pkgs/by-name/ki/kid3/package.nix
+++ b/pkgs/by-name/ki/kid3/package.nix
@@ -42,11 +42,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "kid3";
-  version = "3.9.5";
+  version = "3.9.6";

  src = fetchurl {
    url = "mirror://kde/stable/kid3/${finalAttrs.version}/kid3-${finalAttrs.version}.tar.xz";
-    hash = "sha256-pCT+3eNcF247RDNEIqrUOEhBh3LaAgdR0A0IdOXOgUU=";
+    hash = "sha256-zyf/zENpyZQNp7/BL9EN+9pSa4GH5bYmYqvoBp/CbCc=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/lc/lcov/package.nix
+++ b/pkgs/by-name/lc/lcov/package.nix
@@ -21,13 +21,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "lcov";
-  version = "2.1";
+  version = "2.2";

  src = fetchFromGitHub {
    owner = "linux-test-project";
    repo = "lcov";
    rev = "v${version}";
-    hash = "sha256-QfA+mzLfpi2fuhcPvCKO7YnPef1GMhCbgBWdXFTXPzE=";
+    hash = "sha256-cZdDlOf3IgPQrUNl+wu6Gwecaj+r2xu0eqmlz67TeAI=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/li/libedgetpu/package.nix
+++ b/pkgs/by-name/li/libedgetpu/package.nix
@@ -43,6 +43,12 @@ stdenv.mkDerivation {
    })
  ];

+  postPatch = ''
+    # Use dedicated group for coral devices
+    substituteInPlace debian/edgetpu-accelerator.rules \
+      --replace-fail "plugdev" "coral"
+  '';
+
  makeFlags = [
    "-f"
    "makefile_build/Makefile"
--- a/pkgs/by-name/me/meshoptimizer/package.nix
+++ b/pkgs/by-name/me/meshoptimizer/package.nix
@@ -9,12 +9,12 @@ let
  };
 in stdenv.mkDerivation rec {
  pname = "meshoptimizer";
-  version = "0.21";
+  version = "0.22";
  src = fetchFromGitHub {
    owner = "zeux";
    repo = "meshoptimizer";
    rev = "v${version}";
-    hash = "sha256-G8rR4Ff3mVxTPD1etI82fYwFawsjrLvwWuEuib+dUBU=";
+    hash = "sha256-/47CfgPtj+e4iz01+rwahP+jCXPXXZhTeLLiLktrJ6g=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/op/open-webui/package.nix
+++ b/pkgs/by-name/op/open-webui/package.nix
@@ -2,24 +2,24 @@
  lib,
  buildNpmPackage,
  fetchFromGitHub,
-  python311,
+  python312,
  nixosTests,
 }:
 let
  pname = "open-webui";
-  version = "0.3.35";
+  version = "0.4.3";

  src = fetchFromGitHub {
    owner = "open-webui";
    repo = "open-webui";
    rev = "refs/tags/v${version}";
-    hash = "sha256-H46qoOEajPKRU/Lbd6r7r0vRjWSd7uGoA0deaDv6HSw=";
+    hash = "sha256-OVj7yAHN3XMeqTa1oZIxEz9cwt4kW1ng+bwD44y/qQA=";
  };

  frontend = buildNpmPackage {
    inherit pname version src;

-    npmDepsHash = "sha256-ohWSfwZfC/jfOpnNSqsvMyYnukk3Xa3Tq32PAl8Ds60=";
+    npmDepsHash = "sha256-qT7oqOZSZjicsFnd7nsnGvW5ifAV16Ah/fPSaKlf7fw=";

    # Disabling `pyodide:fetch` as it downloads packages during `buildPhase`
    # Until this is solved, running python packages from the browser will not work.
@@ -41,7 +41,7 @@ let
    '';
  };
 in
-python311.pkgs.buildPythonApplication rec {
+python312.pkgs.buildPythonApplication rec {
  inherit pname version src;
  pyproject = true;

@@ -61,7 +61,8 @@ python311.pkgs.buildPythonApplication rec {
    "pytest-docker"
  ];

-  dependencies = with python311.pkgs; [
+  dependencies = with python312.pkgs; [
+    aiocache
    aiohttp
    alembic
    anthropic
@@ -86,22 +87,24 @@ python311.pkgs.buildPythonApplication rec {
    flask-cors
    fpdf2
    ftfy
-    qdrant-client
    google-generativeai
    googleapis-common-protos
    langchain
    langchain-chroma
    langchain-community
    langfuse
+    ldap3
    markdown
    nltk
    openai
    opencv-python-headless
    openpyxl
+    opensearch-py
    pandas
    passlib
    peewee
    peewee-migrate
+    pgvector
    psutil
    psycopg2-binary
    pydub
@@ -119,21 +122,22 @@ python311.pkgs.buildPythonApplication rec {
    python-socketio
    pytube
    pyxlsb
+    qdrant-client
    rank-bm25
    rapidocr-onnxruntime
    redis
    requests
    sentence-transformers
+    soundfile
    tiktoken
    unstructured
    uvicorn
    validators
-    xhtml2pdf
    xlrd
    youtube-transcript-api
  ];

-  build-system = with python311.pkgs; [ hatchling ];
+  build-system = with python312.pkgs; [ hatchling ];

  pythonImportsCheck = [ "open_webui" ];

@@ -144,11 +148,11 @@ python311.pkgs.buildPythonApplication rec {
  };

  meta = {
+    changelog = "https://github.com/open-webui/open-webui/blob/${src.rev}/CHANGELOG.md";
    description = "Comprehensive suite for LLMs with a user-friendly WebUI";
    homepage = "https://github.com/open-webui/open-webui";
-    changelog = "https://github.com/open-webui/open-webui/blob/${src.rev}/CHANGELOG.md";
    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ shivaraj-bh ];
    mainProgram = "open-webui";
+    maintainers = with lib.maintainers; [ shivaraj-bh ];
  };
 }
--- a/pkgs/by-name/pl/plfit/package.nix
+++ b/pkgs/by-name/pl/plfit/package.nix
@@ -1,21 +1,22 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, cmake
-, python ? null
-, swig
-, llvmPackages
+{
+  cmake,
+  fetchFromGitHub,
+  lib,
+  llvmPackages,
+  python ? null,
+  stdenv,
+  swig,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "plfit";
-  version = "0.9.6";
+  version = "1.0.0";

  src = fetchFromGitHub {
    owner = "ntamas";
    repo = "plfit";
    rev = finalAttrs.version;
-    hash = "sha256-XRl6poEdgPNorFideQmEJHCU+phs4rIhMYa8iAOtL1A=";
+    hash = "sha256-ur+ai0in7PaoDZcPzuUzQTrZ3nB0H5FDSfPBpl1e9ug=";
  };

  postPatch = lib.optionalString (python != null) ''
@@ -24,18 +25,22 @@ stdenv.mkDerivation (finalAttrs: {
      --replace-fail ' ''${Python3_SITELIB}' ' ${placeholder "out"}/${python.sitePackages}'
  '';

-  nativeBuildInputs = [
-    cmake
-  ] ++ lib.optionals (python != null) [
-    python
-    swig
-  ];
+  nativeBuildInputs =
+    [
+      cmake
+    ]
+    ++ lib.optionals (python != null) [
+      python
+      swig
+    ];

-  cmakeFlags = [
-    "-DPLFIT_USE_OPENMP=ON"
-  ] ++ lib.optionals (python != null) [
-    "-DPLFIT_COMPILE_PYTHON_MODULE=ON"
-  ];
+  cmakeFlags =
+    [
+      "-DPLFIT_USE_OPENMP=ON"
+    ]
+    ++ lib.optionals (python != null) [
+      "-DPLFIT_COMPILE_PYTHON_MODULE=ON"
+    ];

  buildInputs = lib.optionals stdenv.cc.isClang [
    llvmPackages.openmp
@@ -43,11 +48,11 @@ stdenv.mkDerivation (finalAttrs: {

  doCheck = true;

-  meta = with lib; {
+  meta = {
    description = "Fitting power-law distributions to empirical data";
    homepage = "https://github.com/ntamas/plfit";
    changelog = "https://github.com/ntamas/plfit/blob/${finalAttrs.src.rev}/CHANGELOG.md";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ dotlambda ];
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ dotlambda ];
  };
 })
--- a/pkgs/by-name/ra/rabbit/package.nix
+++ b/pkgs/by-name/ra/rabbit/package.nix
@@ -5,28 +5,22 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "rabbit";
-  version = "2.2.0";
+  version = "2.3.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "natarajan-chidambaram";
    repo = "RABBIT";
    rev = "refs/tags/${version}";
-    hash = "sha256-diy94QhgLHLvkb1kKhGDxiHAyQ43BNJUXjHFYahEDpw=";
+    hash = "sha256-QmP6yfVnlYoNVa4EUtKR9xbCnQW2V6deV0+hN9IGtic=";
  };

  pythonRelaxDeps = [
    "numpy"
-    "scikit-learn"
-    "scipy"
-    "tqdm"
-    "pandas"
-    "urllib3"
  ];

-  build-system = [
-    python3.pkgs.setuptools
-    python3.pkgs.wheel
+  build-system = with python3.pkgs; [
+    setuptools
  ];

  dependencies = with python3.pkgs; [
--- a/pkgs/by-name/te/television/package.nix
+++ b/pkgs/by-name/te/television/package.nix
@@ -8,16 +8,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "television";
-  version = "0.5.0";
+  version = "0.5.1";

  src = fetchFromGitHub {
    owner = "alexpasmantier";
    repo = "television";
    rev = "refs/tags/" + version;
-    hash = "sha256-yi8lPm3zkmamN6gPlGfojNlIXM1cgSr1zL2zMNni5f0=";
+    hash = "sha256-mbf39AcW7MYu0A6D7poX6TChJccqweBvUbzJ1Ib+ABI=";
  };

-  cargoHash = "sha256-1SdyVtMjkfXH9iGew9i8xpx8WlUly4vIcKY3weeW3LQ=";
+  cargoHash = "sha256-aWEqPIAcq5ZWCf0ZOYnswmj2dR0+41D1HMna0TAhxcE=";

  passthru = {
    tests.version = testers.testVersion {
--- a/pkgs/by-name/ve/velero/package.nix
+++ b/pkgs/by-name/ve/velero/package.nix
@@ -2,14 +2,14 @@

 buildGoModule rec {
  pname = "velero";
-  version = "1.14.1";
+  version = "1.15.0";


  src = fetchFromGitHub {
    owner = "vmware-tanzu";
    repo = "velero";
    rev = "v${version}";
-    hash = "sha256-rXWBTPM3dCGON1DvpCOsA4C4mAuVDqV9YbrvP5yDCa0=";
+    hash = "sha256-Ba5Bjock3NmNI6XdnX7UOW35ytgnHzYAjX9Cu6iGILo=";
  };

  ldflags = [
@@ -20,7 +20,7 @@ buildGoModule rec {
    "-X github.com/vmware-tanzu/velero/pkg/buildinfo.GitSHA=none"
  ];

-  vendorHash = "sha256-HpPJXYBrk5qfV01VOqXGpn4waEONJa61mqLbEsuwrEs=";
+  vendorHash = "sha256-FcyqCnOZSdoyOjBIrEC1AKM5KqWSkNxbgvXeG3Y0CO4=";

  excludedPackages = [ "issue-template-gen" "release-tools" "v1" "velero-restic-restore-helper" ];

--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -90,13 +90,13 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "zed-editor";
-  version = "0.162.3";
+  version = "0.162.5";

  src = fetchFromGitHub {
    owner = "zed-industries";
    repo = "zed";
    rev = "refs/tags/v${version}";
-    hash = "sha256-B0iTJMVUpsSVZ0l2bdPnWc7YaZErKnxqiuhgYopmJ/4=";
+    hash = "sha256-ZrjrJbRvyw5insK+v5fxKj8ouylIPxapDVFgLb3M3uE=";
  };

  patches =
@@ -118,7 +118,7 @@ rustPlatform.buildRustPackage rec {
    ];

  useFetchCargoVendor = true;
-  cargoHash = "sha256-88x9x+EoH1Vi34CdFdYRD8EQzGHU+8DTHd0tT+tyW8k=";
+  cargoHash = "sha256-/KjZTtkSI7njErwgwJY5OEM172TreBfq80w8bA3xg2k=";

  nativeBuildInputs =
    [
--- a/pkgs/data/fonts/font-awesome/default.nix
+++ b/pkgs/data/fonts/font-awesome/default.nix
@@ -61,7 +61,7 @@ in
    hash = "sha256-gd23ZplNY56sm1lfkU3kPXUOmNmY5SRnT0qlQZRNuBo=";
  };
  v6 = font-awesome {
-    version = "6.6.0";
-    hash = "sha256-tQ9Hxph5YiPZMiO9gs2HCkRJ8cdECa2swgS++cytEnM=";
+    version = "6.7.1";
+    hash = "sha256-Lzy12F0qEGzvdyN9SC3nyh2eTc80HM4qR5U6h0G15bo=";
  };
 }
--- a/pkgs/development/compilers/gleam/default.nix
+++ b/pkgs/development/compilers/gleam/default.nix
@@ -13,13 +13,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "gleam";
-  version = "1.5.1";
+  version = "1.6.1";

  src = fetchFromGitHub {
    owner = "gleam-lang";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-4/NDZGq62M0tdWerIkmoYS0WHC06AV8c9vlo/6FhsAo=";
+    hash = "sha256-SiP9h0m2Y+eRicRWTmwjqXpmgizoUadofgSMmRYEFg0=";
  };

  nativeBuildInputs = [ git pkg-config ];
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage rec {
  buildInputs = [ openssl erlang ] ++
    lib.optionals stdenv.hostPlatform.isDarwin [ Security SystemConfiguration ];

-  cargoHash = "sha256-B8tCVkubP04gAHKQC0idR5AjpVHG/kCXvPCfwKCuaSo=";
+  cargoHash = "sha256-MQX0hQlucaOgX42XHw55QCsIADAib7cKs4PeMc7Za4s=";

  passthru.updateScript = nix-update-script { };

--- a/pkgs/development/libraries/fltk/common.nix
+++ b/pkgs/development/libraries/fltk/common.nix
@@ -85,6 +85,8 @@ stdenv.mkDerivation rec {
    libGLU
  ] ++ lib.optionals (withExamples && withGL) [
    glew
+  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
+    fontconfig
  ];

  propagatedBuildInputs = [
@@ -93,7 +95,6 @@ stdenv.mkDerivation rec {
    libpng
  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
    freetype
-    fontconfig
    libX11
    libXext
    libXinerama
--- a/pkgs/development/ocaml-modules/merlin-extend/default.nix
+++ b/pkgs/development/ocaml-modules/merlin-extend/default.nix
@@ -2,13 +2,11 @@

 buildDunePackage rec {
  pname = "merlin-extend";
-  version = "0.6";
-
-  useDune2 = true;
+  version = "0.6.2";

  src = fetchurl {
-    url = "https://github.com/let-def/merlin-extend/releases/download/v${version}/merlin-extend-v${version}.tbz";
-    sha256 = "0hvc4mz92x3rl2dxwrhvhzwl4gilnyvvwcqgr45vmdpyjyp3dwn2";
+    url = "https://github.com/let-def/merlin-extend/releases/download/v${version}/merlin-extend-${version}.tbz";
+    hash = "sha256-R1WOfzC2RGLyucgvt/eHEzrPoNUTJFK2rXhI4LD013k=";
  };

  nativeBuildInputs = [ cppo ];
--- a/pkgs/development/python-modules/certomancer/default.nix
+++ b/pkgs/development/python-modules/certomancer/default.nix
@@ -2,7 +2,6 @@
  lib,
  buildPythonPackage,
  pythonOlder,
-  pythonAtLeast,
  fetchFromGitHub,
  # build-system
  setuptools,
@@ -30,17 +29,16 @@

 buildPythonPackage rec {
  pname = "certomancer";
-  version = "0.12.0";
+  version = "0.12.3";
  pyproject = true;

-  # https://github.com/MatthiasValvekens/certomancer/issues/12
-  disabled = pythonOlder "3.7" || pythonAtLeast "3.12";
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "MatthiasValvekens";
    repo = "certomancer";
    rev = "refs/tags/v${version}";
-    hash = "sha256-c2Fq4YTHQvhxuZrpKQYZvqHIMfubbkeKV4rctELLeJU=";
+    hash = "sha256-2BjLoGUWU0RaWVI9JA3s/Hf5aVtmv8hn+fB2jkWdQNY=";
  };

  build-system = [
@@ -75,11 +73,6 @@ buildPythonPackage rec {
    requests
  ] ++ lib.flatten (builtins.attrValues optional-dependencies);

-  disabledTests = [
-    # pyhanko_certvalidator.errors.DisallowedAlgorithmError
-    "test_validate"
-  ];
-
  pythonImportsCheck = [ "certomancer" ];

  meta = {
--- a/pkgs/development/python-modules/pyhanko-certvalidator/default.nix
+++ b/pkgs/development/python-modules/pyhanko-certvalidator/default.nix
@@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "pyhanko-certvalidator";
-  version = "0.26.3";
+  version = "0.26.5";
  pyproject = true;

  disabled = pythonOlder "3.7";
@@ -26,17 +26,12 @@ buildPythonPackage rec {
    owner = "MatthiasValvekens";
    repo = "certvalidator";
    rev = "refs/tags/v${version}";
-    hash = "sha256-uUmsWiN182g+kxrCny7UNLDHdAdqKk64w6vnjmGBNjM=";
+    hash = "sha256-+/3n+v/8Tpqt7UoOrBi4S84N6Jioay7e2j+SvKJeoLA=";
  };

-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace ', "pytest-runner",' ""
-  '';
+  build-system = [ setuptools ];

-  nativeBuildInputs = [ setuptools ];
-
-  propagatedBuildInputs = [
+  dependencies = [
    asn1crypto
    cryptography
    oscrypto
@@ -51,26 +46,6 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

-  disabledTestPaths = [
-    # Requests
-    "tests/test_crl_client.py"
-  ];
-
-  disabledTests = [
-    # Look for nonexisting certificates
-    "test_basic_certificate_validator_tls"
-    # Failed to fetch OCSP response from http://ocsp.digicert.com
-    "test_fetch_ocsp_aiohttp"
-    "test_fetch_ocsp_requests"
-    "test_fetch_ocsp_err_requests"
-    # Unable to build a validation path for the certificate "%s" - no issuer matching "%s" was found
-    "test_revocation_mode_hard_aiohttp_autofetch"
-    # The path could not be validated because no revocation information could be found for intermediate certificate 1
-    "test_revocation_mode_hard"
-    # ValueError: Hash algorithm not known for ed448
-    "test_ed"
-  ];
-
  pythonImportsCheck = [ "pyhanko_certvalidator" ];

  meta = with lib; {
--- a/pkgs/development/python-modules/pyhanko/default.nix
+++ b/pkgs/development/python-modules/pyhanko/default.nix
@@ -39,18 +39,22 @@

 buildPythonPackage rec {
  pname = "pyhanko";
-  version = "0.25.1";
+  version = "0.25.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "MatthiasValvekens";
    repo = "pyHanko";
    rev = "refs/tags/v${version}";
-    hash = "sha256-keWAiqwaMZYh92B0mlR4+jjxBKLOAJ9Kgc0l0GiIQbc=";
+    hash = "sha256-HJkCQ5YDVr17gtY4PW89ep7GwFdP21/ruBEKm7j3+Qo=";
  };

  build-system = [ setuptools ];

+  pythonRelaxDeps = [
+    "cryptography"
+  ];
+
  dependencies = [
    asn1crypto
    click
--- a/pkgs/development/python-modules/ray/binary-hashes.nix
+++ b/pkgs/development/python-modules/ray/binary-hashes.nix
@@ -1,11 +1,11 @@
 {
  cp310 = {
-    hash = "sha256-On1vcVm85BF7/o+cPQtl/yclf+LdjXN9rQ84aWZkQNo=";
+    hash = "sha256-Ypj7mBzQ+oYH8ZF96yeSWrit1IxgulvQ9s9A1MxdrOQ=";
  };
  cp311 = {
-    hash = "sha256-7OgCzzocECtT9juLyQ2UeXHEs4feryM8Ik7Y7zSh88s=";
+    hash = "sha256-Ia7hJ64anPYZMAGrQdJVG8yBMxujtxltAA8W0Q8VxwU=";
  };
  cp312 = {
-    hash = "sha256-B1B9L5lh6NU5DA62Bt8kkhbvWvsf+BhVgfPpIEHWYpM=";
+    hash = "sha256-AWkw5rp0uRtAEXpksk97//SKangPI9KwZKej9DvE4aI=";
  };
 }
--- a/pkgs/development/python-modules/ray/default.nix
+++ b/pkgs/development/python-modules/ray/default.nix
@@ -8,55 +8,63 @@
  autoPatchelfHook,

  # dependencies
-  aiohttp,
-  aiohttp-cors,
  aiosignal,
-  attrs,
  click,
-  cloudpickle,
-  colorama,
-  colorful,
-  cython,
  filelock,
  frozenlist,
-  gpustat,
-  grpcio,
  jsonschema,
  msgpack,
-  numpy,
-  opencensus,
  packaging,
-  prometheus-client,
-  psutil,
-  pydantic,
-  py-spy,
+  protobuf,
  pyyaml,
  requests,
-  setproctitle,
-  smart-open,
-  virtualenv,
+  watchfiles,

  # optional-dependencies
+  # adag
+  cupy,
+  # client
+  grpcio,
+  # data
  fsspec,
+  numpy,
  pandas,
  pyarrow,
+  # default
+  aiohttp,
+  aiohttp-cors,
+  colorful,
+  opencensus,
+  prometheus-client,
+  pydantic,
+  py-spy,
+  smart-open,
+  virtualenv,
+  # observability
+  opentelemetry-api,
+  opentelemetry-sdk,
+  opentelemetry-exporter-otlp,
+  # rllib
  dm-tree,
-  gym,
+  gymnasium,
  lz4,
-  matplotlib,
  scikit-image,
  scipy,
-  aiorwlock,
+  typer,
+  rich,
+  # serve
  fastapi,
  starlette,
  uvicorn,
-  tabulate,
+  # serve-grpc
+  pyopenssl,
+  # tune
  tensorboardx,
 }:

 let
  pname = "ray";
-  version = "2.38.0";
+  version = "2.39.0";
 in
 buildPythonPackage rec {
  inherit pname version;
@@ -84,68 +92,84 @@ buildPythonPackage rec {
    autoPatchelfHook
  ];

-  pythonRelaxDeps = [
-    "click"
-    "grpcio"
-    "protobuf"
-    "virtualenv"
-  ];
-
  dependencies = [
-    aiohttp
-    aiohttp-cors
-    aiosignal
-    attrs
    click
-    cloudpickle
-    colorama
-    colorful
-    cython
+    aiosignal
    filelock
    frozenlist
-    gpustat
-    grpcio
    jsonschema
    msgpack
-    numpy
-    opencensus
    packaging
-    prometheus-client
-    psutil
-    pydantic
-    py-spy
+    protobuf
    pyyaml
    requests
-    setproctitle
-    smart-open
-    virtualenv
+    watchfiles
  ];

  optional-dependencies = rec {
-    air-deps = data-deps ++ serve-deps ++ tune-deps ++ rllib-deps;
-    data-deps = [
+    adag = [
+      cupy
+    ];
+    air = lib.unique (data ++ serve ++ tune ++ train);
+    all = lib.flatten (builtins.attrValues optional-dependencies);
+    client = [ grpcio ];
+    data = [
      fsspec
+      numpy
      pandas
      pyarrow
    ];
-    rllib-deps = tune-deps ++ [
+    default = [
+      aiohttp
+      aiohttp-cors
+      colorful
+      grpcio
+      opencensus
+      prometheus-client
+      pydantic
+      py-spy
+      requests
+      smart-open
+      virtualenv
+    ];
+    observability = [
+      opentelemetry-api
+      opentelemetry-sdk
+      opentelemetry-exporter-otlp
+    ];
+    rllib = [
      dm-tree
-      gym
+      gymnasium
      lz4
-      matplotlib
      pyyaml
      scikit-image
      scipy
+      typer
+      rich
    ];
-    serve-deps = [
-      aiorwlock
-      fastapi
+    serve = lib.unique (
+      [
+        fastapi
+        requests
+        starlette
+        uvicorn
+        watchfiles
+      ]
+      ++ default
+    );
+    serve-grpc = lib.unique (
+      [
+        grpcio
+        pyopenssl
+      ]
+      ++ serve
+    );
+    train = tune;
+    tune = [
+      fsspec
      pandas
-      starlette
-      uvicorn
-    ];
-    tune-deps = [
-      tabulate
+      pyarrow
+      requests
      tensorboardx
    ];
  };
--- a/pkgs/os-specific/linux/gasket/default.nix
+++ b/pkgs/os-specific/linux/gasket/default.nix
@@ -1,4 +1,10 @@
-{ stdenv, lib, fetchFromGitHub, kernel }:
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  fetchpatch2,
+  kernel
+}:

 stdenv.mkDerivation rec {
  pname = "gasket";
@@ -11,6 +17,20 @@ stdenv.mkDerivation rec {
    sha256 = "O17+msok1fY5tdX1DvqYVw6plkUDF25i8sqwd6mxYf8=";
  };

+  patches = [
+    (fetchpatch2 {
+      # https://github.com/google/gasket-driver/issues/36
+      # https://github.com/google/gasket-driver/pull/35
+      name = "linux-6.12-compat.patch";
+      url = "https://github.com/google/gasket-driver/commit/4b2a1464f3b619daaf0f6c664c954a42c4b7ce00.patch";
+      hash = "sha256-UOoOSEnpUMa4QXWVFpGFxBoF5szXaLEfcWtfKatO5XY=";
+    })
+  ];
+
+  postPatch = ''
+    cd src
+  '';
+
  makeFlags = kernel.makeFlags ++ [
    "-C"
    "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
@@ -21,7 +41,6 @@ stdenv.mkDerivation rec {
  installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
  installTargets = [ "modules_install" ];

-  sourceRoot = "${src.name}/src";
  hardeningDisable = [ "pic" "format" ];
  nativeBuildInputs = kernel.moduleBuildDependencies;

--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!

 {
-  version = "2024.11.2";
+  version = "2024.11.3";
  components = {
    "3_day_blinds" = ps: with ps; [
    ];
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/mushroom/default.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/mushroom/default.nix
@@ -5,16 +5,16 @@

 buildNpmPackage rec {
  pname = "mushroom";
-  version = "4.1.1";
+  version = "4.2.0";

  src = fetchFromGitHub {
    owner = "piitaya";
    repo = "lovelace-mushroom";
    rev = "v${version}";
-    hash = "sha256-d38FyJ3pQ6L0AY2j6aTB8CRxJt8LDgT1A9ZpMoQgbXo=";
+    hash = "sha256-nUGRn5fRP47F3+/wpU9j2HfAliz94O8GkS7jB+07bKE=";
  };

-  npmDepsHash = "sha256-9i7pJh1dmhKobGFcLvZlc0JfaygwVuBvm6ttphl7SWg=";
+  npmDepsHash = "sha256-62wYR7Qkmcb4f2dWe6M3HMvrX9GyinNdTz0JeuismiA=";

  installPhase = ''
    runHook preInstall
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -439,7 +439,7 @@ let
  extraBuildInputs = extraPackages python.pkgs;

  # Don't forget to run update-component-packages.py after updating
-  hassVersion = "2024.11.2";
+  hassVersion = "2024.11.3";

 in python.pkgs.buildPythonApplication rec {
  pname = "homeassistant";
@@ -457,13 +457,13 @@ in python.pkgs.buildPythonApplication rec {
    owner = "home-assistant";
    repo = "core";
    rev = "refs/tags/${version}";
-    hash = "sha256-cP9Q700JLnThAPDfeJ8mx+PSI6I62hjA49TpAMHN2Wk=";
+    hash = "sha256-9b4HPSCPYUUwKxn0JBw5uN6nI97jvgqBHFRUNhDue/k=";
  };

  # Secondary source is pypi sdist for translations
  sdist = fetchPypi {
    inherit pname version;
-    hash = "sha256-qBKcY8PybEJeExTjxs9bgiM6YWjyoSLE1dzgrD1Hdtc=";
+    hash = "sha256-W7Z6C3kMyEIkY/3zQHm1OMMN7Tuj3ThsubLo6KjVotw=";
  };

  build-system = with python.pkgs; [
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "homeassistant-stubs";
-  version = "2024.11.2";
+  version = "2024.11.3";
  pyproject = true;

  disabled = python.version != home-assistant.python.version;
@@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "KapJI";
    repo = "homeassistant-stubs";
    rev = "refs/tags/${version}";
-    hash = "sha256-P9fhFl91IJyRCacJ5lDJu036hgzcNMCF7LO4Brv4P6c=";
+    hash = "sha256-wctoMEduYZxGiSNgZWq4OPgBaiykwTY7FP8PhRsMh0I=";
  };

  build-system = [
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4957,7 +4957,7 @@ with pkgs;
    beamPackages = beamPackages.extend (self: super: { elixir = elixir_1_17; });
  };

-  plfit = callPackage ../tools/misc/plfit {
+  plfit = callPackage ../by-name/pl/plfit/package.nix {
    python = null;
  };