bump deps, nix flake lockfile, cleanup some things, bump rust, provide macOS binaries, fix more build issues and macOS building

Signed-off-by: strawberry <strawberry@puppygock.gay>
2024-12-04 11:04:27 +00:00 · 2024-10-20 00:59:39 -04:00 · 2024-10-20 00:59:39 -04:00 · 3cb5850d1e
parent 8f4f95e2b4
commit 3cb5850d1e
28 changed files with 744 additions and 406 deletions
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@ -69,7 +69,9 @@ jobs:
              with:
                diagnostic-endpoint: ""
                extra-conf: |
                  show-trace = true
                  experimental-features = nix-command flakes
                  extra-experimental-features = nix-command flakes
                  accept-flake-config = true
            - name: Enable Cachix binary cache
@ -172,8 +174,8 @@ jobs:
        strategy:
            matrix:
                include:
-                    - target: aarch64-unknown-linux-musl
+                    - target: aarch64-linux-musl
-                    - target: x86_64-unknown-linux-musl
+                    - target: x86_64-linux-musl
        steps:
            - name: Sync repository
              uses: https://github.com/actions/checkout@v4
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@ -16,7 +16,6 @@ on:
          - 'docker/**'
        branches:
            - main
            - change-ci-cache
        tags:
          - '*'
    # Allows you to run this workflow manually from the Actions tab
@ -24,7 +23,7 @@ on:
 concurrency:
    group: ${{ github.head_ref || github.ref_name }}
-    cancel-in-progress: true
+    cancel-in-progress: false
 env:
    # sccache only on main repo
@ -51,25 +50,41 @@ env:
    # Get error output from nix that we can actually use, and use our binary caches for the earlier CI steps
    NIX_CONFIG: |
      show-trace = true
-      extra-substituters = https://attic.kennel.juneis.dog/conduit https://attic.kennel.juneis.dog/conduwuit https://cache.lix.systems https://conduwuit.cachix.org
+      extra-substituters = https://attic.kennel.juneis.dog/conduwuit https://attic.kennel.juneis.dog/conduit https://cache.lix.systems https://conduwuit.cachix.org https://aseipp-nix-cache.freetls.fastly.net
      extra-trusted-public-keys = conduit:eEKoUwlQGDdYmAI/Q/0slVlegqh/QmAvQd7HBSm21Wk= conduwuit:BbycGUgTISsltcmH0qNjFR9dbrQNYgdIAcmViSGoVTE= cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o= conduwuit.cachix.org-1:MFRm6jcnfTf0jSAbmvLfhO3KBMt4px+1xaereWXp8Xg=
-    # complement uses libolm
+      experimental-features = nix-command flakes
-    NIXPKGS_ALLOW_INSECURE: 1
+      extra-experimental-features = nix-command flakes
      accept-flake-config = true
      download-buffer-size = 134217728
 permissions:
    packages: write
    contents: read
 jobs:
-    tests:
+    test_and_build:
-        name: Test
+        name: Test and Build Artifacts
        strategy:
          matrix:
            target: ["aarch64-linux-musl", "x86_64-linux-musl"]
        runs-on: ubuntu-latest
        env:
          CARGO_PROFILE: "test"
        steps:
            - name: Free Disk Space (Ubuntu)
              uses: jlumbroso/free-disk-space@main
            - name: Free up more runner space
              run: |
                set +o pipefail
                # large docker images
                sudo docker image prune --all --force || true
                # large packages
                sudo apt-get purge -y '^llvm-.*' 'php.*' '^mongodb-.*' '^mysql-.*' azure-cli google-cloud-cli google-chrome-stable firefox powershell microsoft-edge-stable || true
                sudo apt-get autoremove -y
                sudo apt-get clean
                # large folders
                sudo rm -rf /var/lib/apt/lists/* /usr/local/games /usr/local/sqlpackage /usr/local/.ghcup /usr/local/share/powershell /usr/local/share/edge_driver /usr/local/share/gecko_driver /usr/local/share/chromium /usr/local/share/chromedriver-linux64 /usr/local/share/vcpkg /usr/local/lib/python* /usr/local/lib/node_modules /usr/local/julia* /opt/mssql-tools /etc/skel /usr/share/vim /usr/share/postgresql /usr/share/man /usr/share/apache-maven-* /usr/share/R /usr/share/alsa /usr/share/miniconda /usr/share/grub /usr/share/gradle-* /usr/share/locale /usr/share/texinfo /usr/share/kotlinc /usr/share/swift /usr/share/doc /usr/share/az_9.3.0 /usr/share/sbt /usr/share/ri /usr/share/icons /usr/share/java /usr/share/fonts /usr/lib/google-cloud-sdk /usr/lib/jvm /usr/lib/mono /usr/lib/R /usr/lib/postgresql /usr/lib/heroku /usr/lib/gcc
                set -o pipefail
            - name: Sync repository
              uses: actions/checkout@v4
@ -85,7 +100,7 @@ jobs:
                    exit 1
                  fi
-            - uses: nixbuild/nix-quick-install-action@v28
+            - uses: nixbuild/nix-quick-install-action@master
            - name: Restore and cache Nix store
              uses: nix-community/cache-nix-action@v5.1.0
@ -117,8 +132,10 @@ jobs:
            - name: Apply Nix binary cache configuration
              run: |
                  sudo tee -a "${XDG_CONFIG_HOME:-$HOME/.config}/nix/nix.conf" > /dev/null <<EOF
-                  extra-substituters = https://attic.kennel.juneis.dog/conduit https://attic.kennel.juneis.dog/conduwuit https://cache.lix.systems https://conduwuit.cachix.org
+                  extra-substituters = https://attic.kennel.juneis.dog/conduwuit https://attic.kennel.juneis.dog/conduit https://cache.lix.systems https://conduwuit.cachix.org https://aseipp-nix-cache.freetls.fastly.net
                  extra-trusted-public-keys = conduit:eEKoUwlQGDdYmAI/Q/0slVlegqh/QmAvQd7HBSm21Wk= conduwuit:BbycGUgTISsltcmH0qNjFR9dbrQNYgdIAcmViSGoVTE= cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o= conduwuit.cachix.org-1:MFRm6jcnfTf0jSAbmvLfhO3KBMt4px+1xaereWXp8Xg=
                  accept-flake-config = true
                  download-buffer-size = 134217728
                  EOF
            - name: Use alternative Nix binary caches if specified
@ -129,16 +146,19 @@ jobs:
                  extra-trusted-public-keys = ${{ env.ATTIC_PUBLIC_KEY }}
                  EOF
-            - name: Prepare build environment
+            - name: Prepare build environment (Linux)
              run: |
                  echo 'source $HOME/.nix-profile/share/nix-direnv/direnvrc' > "$HOME/.direnvrc"
-                  nix profile install --impure --inputs-from . nixpkgs#direnv nixpkgs#nix-direnv
+                  nix profile install --inputs-from . nixpkgs#direnv nixpkgs#nix-direnv
                  direnv allow
-                  nix develop .#all-features --command true --impure
+                  nix develop .#all-features --command true
-            - name: Cache CI dependencies
+            - name: Cache CI dependencies (Linux)
              run: |
                  bin/nix-build-and-cache ci
                  bin/nix-build-and-cache just '.#devShells.x86_64-linux.default'
                  bin/nix-build-and-cache just '.#devShells.x86_64-linux.all-features'
                  bin/nix-build-and-cache just '.#devShells.x86_64-linux.dynamic'
            # use sccache for Rust
            - name: Run sccache-cache
@ -151,10 +171,14 @@ jobs:
                cache-all-crates: "true"
            - name: Run CI tests
              env:
                CARGO_PROFILE: "test"
              run: |
                  direnv exec . engage > >(tee -a test_output.log)
            - name: Run Complement tests
              env:
                CARGO_PROFILE: "test"
              run: |
                  # the nix devshell sets $COMPLEMENT_SRC, so "/dev/null" is no-op
                  direnv exec . bin/complement "/dev/null" complement_test_logs.jsonl complement_test_results.jsonl > >(tee -a test_output.log)
@ -198,94 +222,24 @@ jobs:
                      echo '# Complement diff results' >> $GITHUB_STEP_SUMMARY
                      echo '```diff' >> $GITHUB_STEP_SUMMARY
-                      tail -n 100 complement_diff_output.log | sed 's/\x1b\[[0-9;]*m//g' >>     $GITHUB_STEP_SUMMARY
+                      tail -n 100 complement_diff_output.log | sed 's/\x1b\[[0-9;]*m//g' >> $GITHUB_STEP_SUMMARY
                      echo '```' >> $GITHUB_STEP_SUMMARY
                  fi
-            - name: Run cargo clean test artifacts
+            - name: Run cargo clean test artifacts to free up space
              run: |
                  cargo clean --profile test
    build:
        name: Build
        runs-on: ubuntu-latest
        needs: tests
        strategy:
            matrix:
                include:
                    - target: aarch64-unknown-linux-musl
                    - target: x86_64-unknown-linux-musl
        steps:
            - name: Free Disk Space (Ubuntu)
              uses: jlumbroso/free-disk-space@main
            - name: Sync repository
              uses: actions/checkout@v4
            - uses: nixbuild/nix-quick-install-action@v28
            - name: Restore and cache Nix store
              uses: nix-community/cache-nix-action@v5.1.0
              with:
                # restore and save a cache using this key
                primary-key: nix-${{ runner.os }}-${{ matrix.target }}-${{ hashFiles('**/*.nix', '**/.lock') }}
                # if there's no cache hit, restore a cache by this prefix
                restore-prefixes-first-match: nix-${{ runner.os }}-
                # collect garbage until Nix store size (in bytes) is at most this number
                # before trying to save a new cache
                gc-max-store-size-linux: 2073741824
                # do purge caches
                purge: true
                # purge all versions of the cache
                purge-prefixes: nix-${{ runner.os }}-
                # created more than this number of seconds ago relative to the start of the `Post Restore` phase
                purge-last-accessed: 86400
                # except the version with the `primary-key`, if it exists
                purge-primary-key: never
                # always save the cache
                save-always: true
            - name: Enable Cachix binary cache
              run: |
                  nix profile install nixpkgs#cachix
                  cachix use crane
                  cachix use nix-community
            - name: Apply Nix binary cache configuration
              run: |
                  sudo tee -a "${XDG_CONFIG_HOME:-$HOME/.config}/nix/nix.conf" > /dev/null <<EOF
                  extra-substituters = https://attic.kennel.juneis.dog/conduit https://attic.kennel.juneis.dog/conduwuit https://cache.lix.systems https://conduwuit.cachix.org
                  extra-trusted-public-keys = conduit:eEKoUwlQGDdYmAI/Q/0slVlegqh/QmAvQd7HBSm21Wk= conduwuit:BbycGUgTISsltcmH0qNjFR9dbrQNYgdIAcmViSGoVTE= cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o= conduwuit.cachix.org-1:MFRm6jcnfTf0jSAbmvLfhO3KBMt4px+1xaereWXp8Xg=
                  EOF
            - name: Use alternative Nix binary caches if specified
              if: ${{ (env.ATTIC_ENDPOINT != '') && (env.ATTIC_PUBLIC_KEY != '') }}
              run: |
                  sudo tee -a "${XDG_CONFIG_HOME:-$HOME/.config}/nix/nix.conf" > /dev/null <<EOF
                  extra-substituters = ${{ env.ATTIC_ENDPOINT }}
                  extra-trusted-public-keys = ${{ env.ATTIC_PUBLIC_KEY }}
                  EOF
            - name: Prepare build environment
              run: |
                  echo 'source $HOME/.nix-profile/share/nix-direnv/direnvrc' > "$HOME/.direnvrc"
                  nix profile install --impure --inputs-from . nixpkgs#direnv nixpkgs#nix-direnv
                  direnv allow
                  nix develop .#all-features --command true --impure
            # use sccache for Rust
            - name: Run sccache-cache
              if: (github.event.pull_request.draft != true) && (vars.DOCKER_USERNAME != '') && (vars.GITLAB_USERNAME != '') && (vars.SCCACHE_ENDPOINT != '') && (github.event.pull_request.user.login != 'renovate[bot]')
              uses: mozilla-actions/sccache-action@main
            # use rust-cache
            - uses: Swatinem/rust-cache@v2
              with:
                cache-all-crates: "true"
            - name: Build static ${{ matrix.target }}
              run: |
-                  CARGO_DEB_TARGET_TUPLE=$(echo ${{ matrix.target }} | grep -o -E '^([^-]*-){3}[^-]*')
+                  if [[ ${{ matrix.target }} == "x86_64-linux-musl" ]]
                  then
                    CARGO_DEB_TARGET_TUPLE="x86_64-unknown-linux-musl"
                  elif [[ ${{ matrix.target }} == "aarch64-linux-musl" ]]
                  then
                    CARGO_DEB_TARGET_TUPLE="aarch64-unknown-linux-musl"
                  fi
                  SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)
                  bin/nix-build-and-cache just .#static-${{ matrix.target }}-all-features
@ -302,7 +256,7 @@ jobs:
            # quick smoke test of the x86_64 static release binary
            - name: Run x86_64 static release binary
              run: |
-                  # GH actions default runners are x86_64 only
+                  # GH actions default ubuntu runners are x86_64 only
                  if file result/bin/conduit | grep x86-64; then
                    result/bin/conduit --version
                  fi
@ -401,10 +355,86 @@ jobs:
                  if-no-files-found: error
                  compression-level: 0
    build_mac_binaries:
        name: Build MacOS Binaries
        strategy:
          matrix:
            os: [macos-latest, macos-13]
        runs-on: ${{ matrix.os }}
        steps:
            - name: Sync repository
              uses: actions/checkout@v4
            - name: Tag comparison check
              if: ${{ startsWith(github.ref, 'refs/tags/v') && !endsWith(github.ref, '-rc') }}
              run: |
                  # Tag mismatch with latest repo tag check to prevent potential downgrades
                  LATEST_TAG=$(git describe --tags `git rev-list --tags --max-count=1`)
                  if [ $LATEST_TAG != ${{ github.ref_name }} ]; then
                    echo '# WARNING: Attempting to run this workflow for a tag that is not the latest repo tag. Aborting.'
                    echo '# WARNING: Attempting to run this workflow for a tag that is not the latest repo tag. Aborting.' >> $GITHUB_STEP_SUMMARY
                    exit 1
                  fi
            # use sccache for Rust
            - name: Run sccache-cache
              if: (github.event.pull_request.draft != true) && (vars.DOCKER_USERNAME != '') && (vars.GITLAB_USERNAME != '') && (vars.SCCACHE_ENDPOINT != '') && (github.event.pull_request.user.login != 'renovate[bot]')
              uses: mozilla-actions/sccache-action@main
            # use rust-cache
            - uses: Swatinem/rust-cache@v2
              with:
                cache-all-crates: "true"
            # Nix can't do portable macOS builds yet
            - name: Build macOS x86_64 binary
              if: ${{ matrix.os == 'macos-13' }}
              run: |
                  CONDUWUIT_VERSION_EXTRA="$(git rev-parse --short HEAD)" cargo build --release
                  cp -v -f target/release/conduit conduwuit-macos-x86_64
                  otool -L conduwuit-macos-x86_64
            # quick smoke test of the x86_64 macOS binary
            - name: Run x86_64 macOS release binary
              if: ${{ matrix.os == 'macos-13' }}
              run: |
                  ./conduwuit-macos-x86_64 --version
            - name: Build macOS arm64 binary
              if: ${{ matrix.os == 'macos-latest' }}
              run: |
                  CONDUWUIT_VERSION_EXTRA="$(git rev-parse --short HEAD)" cargo build --release
                  cp -v -f target/release/conduit conduwuit-macos-arm64
                  otool -L conduwuit-macos-arm64
            # quick smoke test of the arm64 macOS binary
            - name: Run arm64 macOS release binary
              if: ${{ matrix.os == 'macos-latest' }}
              run: |
                  ./conduwuit-macos-arm64 --version
            - name: Upload macOS x86_64 binary
              if: ${{ matrix.os == 'macos-13' }}
              uses: actions/upload-artifact@v4
              with:
                  name: conduwuit-macos-x86_64
                  path: conduwuit-macos-x86_64
                  if-no-files-found: error
            - name: Upload macOS arm64 binary
              if: ${{ matrix.os == 'macos-latest' }}
              uses: actions/upload-artifact@v4
              with:
                  name: conduwuit-macos-arm64
                  path: conduwuit-macos-arm64
                  if-no-files-found: error
    docker:
        name: Docker publish
        runs-on: ubuntu-latest
-        needs: build
+        needs: test_and_build
        if: (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main' || (github.event.pull_request.draft != true)) && (vars.DOCKER_USERNAME != '') && (vars.GITLAB_USERNAME != '') && github.event.pull_request.user.login != 'renovate[bot]'
        env:
            DOCKER_ARM64: docker.io/${{ github.repository }}:${{ (github.head_ref != '' && format('merge-{0}-{1}', github.event.number, github.event.pull_request.user.login)) || github.ref_name }}-${{ github.sha }}-arm64v8
@ -451,10 +481,10 @@ jobs:
            - name: Move OCI images into position
              run: |
-                  mv -v oci-image-x86_64-unknown-linux-musl/*.tar.gz oci-image-amd64.tar.gz
+                  mv -v oci-image-x86_64-linux-musl/*.tar.gz oci-image-amd64.tar.gz
-                  mv -v oci-image-aarch64-unknown-linux-musl/*.tar.gz oci-image-arm64v8.tar.gz
+                  mv -v oci-image-aarch64-linux-musl/*.tar.gz oci-image-arm64v8.tar.gz
-                  mv -v oci-image-x86_64-unknown-linux-musl-debug/*.tar.gz oci-image-amd64-debug.tar.gz
+                  mv -v oci-image-x86_64-linux-musl-debug/*.tar.gz oci-image-amd64-debug.tar.gz
-                  mv -v oci-image-aarch64-unknown-linux-musl-debug/*.tar.gz oci-image-arm64v8-debug.tar.gz
+                  mv -v oci-image-aarch64-linux-musl-debug/*.tar.gz oci-image-arm64v8-debug.tar.gz
            - name: Load and push amd64 image
              if: ${{ (vars.DOCKER_USERNAME != '') && (env.DOCKERHUB_TOKEN != '') }}
--- a/.github/workflows/documentation.yml
+++ b/.github/workflows/documentation.yml
@ -24,8 +24,12 @@ env:
  # Get error output from nix that we can actually use, and use our binary caches for the earlier CI steps
  NIX_CONFIG: |
    show-trace = true
-    extra-substituters = https://attic.kennel.juneis.dog/conduit https://attic.kennel.juneis.dog/conduwuit https://cache.lix.systems https://conduwuit.cachix.org
+    extra-substituters = https://attic.kennel.juneis.dog/conduwuit https://attic.kennel.juneis.dog/conduit https://cache.lix.systems https://conduwuit.cachix.org https://aseipp-nix-cache.freetls.fastly.net
    extra-trusted-public-keys = conduit:eEKoUwlQGDdYmAI/Q/0slVlegqh/QmAvQd7HBSm21Wk= conduwuit:BbycGUgTISsltcmH0qNjFR9dbrQNYgdIAcmViSGoVTE= cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o= conduwuit.cachix.org-1:MFRm6jcnfTf0jSAbmvLfhO3KBMt4px+1xaereWXp8Xg=
    experimental-features = nix-command flakes
    extra-experimental-features = nix-command flakes
    accept-flake-config = true
    download-buffer-size = 134217728
 # Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
 # However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
@ -89,8 +93,10 @@ jobs:
      - name: Apply Nix binary cache configuration
        run: |
            sudo tee -a "${XDG_CONFIG_HOME:-$HOME/.config}/nix/nix.conf" > /dev/null <<EOF
-            extra-substituters = https://attic.kennel.juneis.dog/conduit https://attic.kennel.juneis.dog/conduwuit https://cache.lix.systems https://conduwuit.cachix.org
+            extra-substituters = https://attic.kennel.juneis.dog/conduwuit https://attic.kennel.juneis.dog/conduit https://cache.lix.systems https://conduwuit.cachix.org https://aseipp-nix-cache.freetls.fastly.net
            extra-trusted-public-keys = conduit:eEKoUwlQGDdYmAI/Q/0slVlegqh/QmAvQd7HBSm21Wk= conduwuit:BbycGUgTISsltcmH0qNjFR9dbrQNYgdIAcmViSGoVTE= cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o= conduwuit.cachix.org-1:MFRm6jcnfTf0jSAbmvLfhO3KBMt4px+1xaereWXp8Xg=
            accept-flake-config = true
            download-buffer-size = 134217728
            EOF
      - name: Use alternative Nix binary caches if specified
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@ -26,7 +26,7 @@ jobs:
        uses: actions/checkout@v4
      - name: Run Trivy code and vulnerability scanner on repo
-        uses: aquasecurity/trivy-action@0.24.0
+        uses: aquasecurity/trivy-action@0.28.0
        with:
          scan-type: repo
          format: sarif
@ -34,7 +34,7 @@ jobs:
          severity: CRITICAL,HIGH,MEDIUM,LOW
      - name: Run Trivy code and vulnerability scanner on filesystem
-        uses: aquasecurity/trivy-action@0.24.0
+        uses: aquasecurity/trivy-action@0.28.0
        with:
          scan-type: fs
          format: sarif
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@ -10,6 +10,13 @@ variables:
  FF_USE_FASTZIP: true
  # Print progress reports for cache and artifact transfers
  TRANSFER_METER_FREQUENCY: 5s
  NIX_CONFIG: |
    show-trace = true
    extra-substituters = https://attic.kennel.juneis.dog/conduit https://attic.kennel.juneis.dog/conduwuit https://cache.lix.systems https://conduwuit.cachix.org
    extra-trusted-public-keys = conduit:eEKoUwlQGDdYmAI/Q/0slVlegqh/QmAvQd7HBSm21Wk= conduwuit:BbycGUgTISsltcmH0qNjFR9dbrQNYgdIAcmViSGoVTE= cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o= conduwuit.cachix.org-1:MFRm6jcnfTf0jSAbmvLfhO3KBMt4px+1xaereWXp8Xg=
    experimental-features = nix-command flakes
    extra-experimental-features = nix-command flakes
    accept-flake-config = true
 # Avoid duplicate pipelines
 # See: https://docs.gitlab.com/ee/ci/yaml/workflow.html#switch-between-branch-pipelines-and-merge-request-pipelines
@ -23,6 +30,13 @@ workflow:
 before_script:
  # Enable nix-command and flakes
  - if command -v nix > /dev/null; then echo "experimental-features = nix-command flakes" >> /etc/nix/nix.conf; fi
  - if command -v nix > /dev/null; then echo "extra-experimental-features = nix-command flakes" >> /etc/nix/nix.conf; fi
  # Accept flake config from "untrusted" users
  - if command -v nix > /dev/null; then echo "accept-flake-config = true" >> /etc/nix/nix.conf; fi
  # Increase download buffer size to 128MB
  - if command -v nix > /dev/null; then echo "download-buffer-size = 134217728" >> /etc/nix/nix.conf; fi
  # Add conduwuit binary cache
  - if command -v nix > /dev/null; then echo "extra-substituters = https://attic.kennel.juneis.dog/conduwuit" >> /etc/nix/nix.conf; fi
@ -47,6 +61,8 @@ before_script:
  - if command -v nix > /dev/null; then echo "extra-substituters = https://nix-community.cachix.org" >> /etc/nix/nix.conf; fi
  - if command -v nix > /dev/null; then echo "extra-trusted-public-keys = nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" >> /etc/nix/nix.conf; fi
  - if command -v nix > /dev/null; then echo "extra-substituters = https://aseipp-nix-cache.freetls.fastly.net" >> /etc/nix/nix.conf; fi
  # Install direnv and nix-direnv
  - if command -v nix > /dev/null; then nix-env -iA nixpkgs.direnv nixpkgs.nix-direnv; fi
@ -56,6 +72,10 @@ before_script:
  # Set CARGO_HOME to a cacheable path
  - export CARGO_HOME="$(git rev-parse --show-toplevel)/.gitlab-ci.d/cargo"
  # /tmp on gitlab is weird and causes https://github.com/NixOS/nix/issues/11470
  - export TEMP="$PWD"
  - export TMPDIR="$PWD"
 ci:
  stage: ci
  image: nixos/nix:2.24.9
@ -85,29 +105,29 @@ artifacts:
  stage: artifacts
  image: nixos/nix:2.24.9
  script:
-    - ./bin/nix-build-and-cache just .#static-x86_64-unknown-linux-musl
+    - ./bin/nix-build-and-cache just .#static-x86_64-linux-musl
-    - cp result/bin/conduit x86_64-unknown-linux-musl
+    - cp result/bin/conduit x86_64-linux-musl
    - mkdir -p target/release
    - cp result/bin/conduit target/release
    - direnv exec . cargo deb --no-build --no-strip
-    - mv target/debian/*.deb x86_64-unknown-linux-musl.deb
+    - mv target/debian/*.deb x86_64-linux-musl.deb
    # Since the OCI image package is based on the binary package, this has the
    # fun side effect of uploading the normal binary too. Conduit users who are
    # deploying with Nix can leverage this fact by adding our binary cache to
    # their systems.
    #
-    # Note that although we have an `oci-image-x86_64-unknown-linux-musl`
+    # Note that although we have an `oci-image-x86_64-linux-musl`
    # output, we don't build it because it would be largely redundant to this
    # one since it's all containerized anyway.
    - ./bin/nix-build-and-cache just .#oci-image
    - cp result oci-image-amd64.tar.gz
-    - ./bin/nix-build-and-cache just .#static-aarch64-unknown-linux-musl
+    - ./bin/nix-build-and-cache just .#static-aarch64-linux-musl
-    - cp result/bin/conduit aarch64-unknown-linux-musl
+    - cp result/bin/conduit aarch64-linux-musl
-    - ./bin/nix-build-and-cache just .#oci-image-aarch64-unknown-linux-musl
+    - ./bin/nix-build-and-cache just .#oci-image-aarch64-linux-musl
    - cp result oci-image-arm64v8.tar.gz
    - ./bin/nix-build-and-cache just .#book
@ -115,9 +135,9 @@ artifacts:
    - cp -r --dereference result public
  artifacts:
    paths:
-      - x86_64-unknown-linux-musl
+      - x86_64-linux-musl
-      - aarch64-unknown-linux-musl
+      - aarch64-linux-musl
-      - x86_64-unknown-linux-musl.deb
+      - x86_64-linux-musl.deb
      - oci-image-amd64.tar.gz
      - oci-image-arm64v8.tar.gz
      - public
--- a/Cargo.lock
+++ b/Cargo.lock
@ -91,9 +91,9 @@ checksum = "5f093eed78becd229346bf859eec0aa4dd7ddde0757287b2b4107a1f09c80002"
 [[package]]
 name = "async-compression"
-version = "0.4.13"
+version = "0.4.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e614738943d3f68c628ae3dbce7c3daffb196665f82f8c8ea6b65de73c79429"
+checksum = "103db485efc3e41214fe4fda9f3dbeae2eb9082f48fd236e6095627a9422066e"
 dependencies = [
 "brotli",
 "flate2",
@ -290,7 +290,7 @@ dependencies = [
 "hyper",
 "hyper-util",
 "pin-project-lite",
- "rustls 0.23.14",
+ "rustls 0.23.15",
 "rustls-pemfile",
 "rustls-pki-types",
 "tokio",
@ -310,7 +310,7 @@ dependencies = [
 "http",
 "http-body-util",
 "pin-project",
- "rustls 0.23.14",
+ "rustls 0.23.15",
 "tokio",
 "tokio-rustls",
 "tokio-util",
@ -353,9 +353,9 @@ checksum = "8c3c1a368f70d6cf7302d78f8f7093da241fb8e8807c05cc9e51a125895a6d5b"
 [[package]]
 name = "bindgen"
-version = "0.69.4"
+version = "0.69.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a00dc851838a2120612785d195287475a3ac45514741da670b735818822129a0"
+checksum = "271383c67ccabffb7381723dea0672a673f292304fcb45c01cc648c7a8d58088"
 dependencies = [
 "bitflags 2.6.0",
 "cexpr",
@ -433,9 +433,9 @@ checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
 [[package]]
 name = "bytemuck"
-version = "1.18.0"
+version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94bbb0ad554ad961ddc5da507a12a29b14e4ae5bda06b19f575a3e6079d2e2ae"
+checksum = "8334215b81e418a0a7bdb8ef0849474f40bb10c8b71f1c4ed315cff49f32494d"
 [[package]]
 name = "byteorder"
@ -478,9 +478,9 @@ dependencies = [
 [[package]]
 name = "cc"
-version = "1.1.27"
+version = "1.1.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "677207f6eaec43fcfd092a718c847fc38aa261d0e19b8ef6797e0ccbe789e738"
+checksum = "b16803a61b81d9eabb7eae2588776c4c1e584b738ede45fdbb4c972cec1e9945"
 dependencies = [
 "jobserver",
 "libc",
@ -539,9 +539,9 @@ dependencies = [
 [[package]]
 name = "clap"
-version = "4.5.19"
+version = "4.5.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7be5744db7978a28d9df86a214130d106a89ce49644cbc4e3f0c22c3fba30615"
+checksum = "b97f376d85a664d5837dbae44bf546e6477a679ff6610010f17276f686d867e8"
 dependencies = [
 "clap_builder",
 "clap_derive",
@ -549,9 +549,9 @@ dependencies = [
 [[package]]
 name = "clap_builder"
-version = "4.5.19"
+version = "4.5.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a5fbc17d3ef8278f55b282b2a2e75ae6f6c7d4bb70ed3d0382375104bfafdb4b"
+checksum = "19bc80abd44e4bed93ca373a0704ccbd1b710dc5749406201bb018272808dc54"
 dependencies = [
 "anstyle",
 "clap_lex",
@ -770,7 +770,7 @@ dependencies = [
 "hyper-util",
 "log",
 "ruma",
- "rustls 0.23.14",
+ "rustls 0.23.15",
 "sd-notify",
 "sentry",
 "sentry-tower",
@ -1678,9 +1678,9 @@ checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
 [[package]]
 name = "hyper"
-version = "1.4.1"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50dfd22e0e76d0f662d429a5f80fcaf3855009297eab6a0a9f8543834744ba05"
+checksum = "bbbff0a806a4728c99295b254c8838933b5b082d75e3cb70c8dab21fdfbcfa9a"
 dependencies = [
 "bytes",
 "futures-channel",
@ -1707,7 +1707,7 @@ dependencies = [
 "http",
 "hyper",
 "hyper-util",
- "rustls 0.23.14",
+ "rustls 0.23.15",
 "rustls-native-certs",
 "rustls-pki-types",
 "tokio",
@ -1771,9 +1771,9 @@ dependencies = [
 [[package]]
 name = "image"
-version = "0.25.2"
+version = "0.25.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99314c8a2152b8ddb211f924cdae532d8c5e4c8bb54728e12fff1b0cd5963a10"
+checksum = "bc144d44a31d753b02ce64093d532f55ff8dc4ebf2ffb8a63c0dda691385acae"
 dependencies = [
 "bytemuck",
 "byteorder-lite",
@ -1788,9 +1788,9 @@ dependencies = [
 [[package]]
 name = "image-webp"
-version = "0.1.3"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f79afb8cbee2ef20f59ccd477a218c12a93943d075b492015ecb1bb81f8ee904"
+checksum = "e031e8e3d94711a9ccb5d6ea357439ef3dcbed361798bd4071dc4d9793fbe22f"
 dependencies = [
 "byteorder-lite",
 "quick-error 2.0.1",
@ -1896,9 +1896,9 @@ dependencies = [
 [[package]]
 name = "js-sys"
-version = "0.3.70"
+version = "0.3.72"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1868808506b929d7b0cfa8f75951347aa71bb21144b7791bae35d9bccfcfe37a"
+checksum = "6a88f1bda2bd75b0452a14784937d796722fdebfe50df998aeb3f0b7603019a9"
 dependencies = [
 "wasm-bindgen",
 ]
@ -1993,9 +1993,9 @@ checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
 [[package]]
 name = "libc"
-version = "0.2.159"
+version = "0.2.160"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "561d97a539a36e26a9a5fad1ea11a3039a67714694aaa379433e580854bc3dc5"
+checksum = "f0b21006cd1874ae9e650973c565615676dc4a274c965bb0a73796dac838ce4f"
 [[package]]
 name = "libloading"
@ -2395,7 +2395,7 @@ dependencies = [
 "glob",
 "once_cell",
 "opentelemetry",
- "ordered-float 4.3.0",
+ "ordered-float 4.4.0",
 "percent-encoding",
 "rand",
 "thiserror",
@ -2414,9 +2414,9 @@ dependencies = [
 [[package]]
 name = "ordered-float"
-version = "4.3.0"
+version = "4.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44d501f1a72f71d3c063a6bbc8f7271fa73aa09fe5d6283b6571e2ed176a2537"
+checksum = "83e7ccb95e240b7c9506a3d544f10d935e142cc90b0a1d56954fb44d89ad6b97"
 dependencies = [
 "num-traits",
 ]
@ -2677,9 +2677,9 @@ dependencies = [
 [[package]]
 name = "proc-macro2"
-version = "1.0.86"
+version = "1.0.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e719e8df665df0d1c8fbfd238015744736151d4445ec0836b8e628aae103b77"
+checksum = "f139b0662de085916d1fb67d2b4169d1addddda1919e696f3252b740b629986e"
 dependencies = [
 "unicode-ident",
 ]
@ -2731,9 +2731,9 @@ dependencies = [
 [[package]]
 name = "pulldown-cmark"
-version = "0.12.1"
+version = "0.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "666f0f59e259aea2d72e6012290c09877a780935cc3c18b1ceded41f3890d59c"
+checksum = "f86ba2052aebccc42cbbb3ed234b8b13ce76f75c3551a303cb2bcffcff12bb14"
 dependencies = [
 "bitflags 2.6.0",
 "memchr",
@ -2770,7 +2770,7 @@ dependencies = [
 "quinn-proto",
 "quinn-udp",
 "rustc-hash 2.0.0",
- "rustls 0.23.14",
+ "rustls 0.23.15",
 "socket2",
 "thiserror",
 "tokio",
@ -2787,7 +2787,7 @@ dependencies = [
 "rand",
 "ring",
 "rustc-hash 2.0.0",
- "rustls 0.23.14",
+ "rustls 0.23.15",
 "slab",
 "thiserror",
 "tinyvec",
@ -2927,7 +2927,7 @@ dependencies = [
 "percent-encoding",
 "pin-project-lite",
 "quinn",
- "rustls 0.23.14",
+ "rustls 0.23.15",
 "rustls-native-certs",
 "rustls-pemfile",
 "rustls-pki-types",
@ -2976,7 +2976,7 @@ dependencies = [
 [[package]]
 name = "ruma"
 version = "0.10.1"
-source = "git+https://github.com/girlbossceo/ruwuma?rev=d7baeb7e5c3ae28e79ad3fe81c5e8b207a26cc73#d7baeb7e5c3ae28e79ad3fe81c5e8b207a26cc73"
+source = "git+https://github.com/girlbossceo/ruwuma?rev=9f6c48eea2239e4c065dde38534407ea2596ab99#9f6c48eea2239e4c065dde38534407ea2596ab99"
 dependencies = [
 "assign",
 "js_int",
@ -2998,7 +2998,7 @@ dependencies = [
 [[package]]
 name = "ruma-appservice-api"
 version = "0.10.0"
-source = "git+https://github.com/girlbossceo/ruwuma?rev=d7baeb7e5c3ae28e79ad3fe81c5e8b207a26cc73#d7baeb7e5c3ae28e79ad3fe81c5e8b207a26cc73"
+source = "git+https://github.com/girlbossceo/ruwuma?rev=9f6c48eea2239e4c065dde38534407ea2596ab99#9f6c48eea2239e4c065dde38534407ea2596ab99"
 dependencies = [
 "js_int",
 "ruma-common",
@ -3010,7 +3010,7 @@ dependencies = [
 [[package]]
 name = "ruma-client-api"
 version = "0.18.0"
-source = "git+https://github.com/girlbossceo/ruwuma?rev=d7baeb7e5c3ae28e79ad3fe81c5e8b207a26cc73#d7baeb7e5c3ae28e79ad3fe81c5e8b207a26cc73"
+source = "git+https://github.com/girlbossceo/ruwuma?rev=9f6c48eea2239e4c065dde38534407ea2596ab99#9f6c48eea2239e4c065dde38534407ea2596ab99"
 dependencies = [
 "as_variant",
 "assign",
@ -3033,7 +3033,7 @@ dependencies = [
 [[package]]
 name = "ruma-common"
 version = "0.13.0"
-source = "git+https://github.com/girlbossceo/ruwuma?rev=d7baeb7e5c3ae28e79ad3fe81c5e8b207a26cc73#d7baeb7e5c3ae28e79ad3fe81c5e8b207a26cc73"
+source = "git+https://github.com/girlbossceo/ruwuma?rev=9f6c48eea2239e4c065dde38534407ea2596ab99#9f6c48eea2239e4c065dde38534407ea2596ab99"
 dependencies = [
 "as_variant",
 "base64 0.22.1",
@ -3063,7 +3063,7 @@ dependencies = [
 [[package]]
 name = "ruma-events"
 version = "0.28.1"
-source = "git+https://github.com/girlbossceo/ruwuma?rev=d7baeb7e5c3ae28e79ad3fe81c5e8b207a26cc73#d7baeb7e5c3ae28e79ad3fe81c5e8b207a26cc73"
+source = "git+https://github.com/girlbossceo/ruwuma?rev=9f6c48eea2239e4c065dde38534407ea2596ab99#9f6c48eea2239e4c065dde38534407ea2596ab99"
 dependencies = [
 "as_variant",
 "indexmap 2.6.0",
@ -3087,7 +3087,7 @@ dependencies = [
 [[package]]
 name = "ruma-federation-api"
 version = "0.9.0"
-source = "git+https://github.com/girlbossceo/ruwuma?rev=d7baeb7e5c3ae28e79ad3fe81c5e8b207a26cc73#d7baeb7e5c3ae28e79ad3fe81c5e8b207a26cc73"
+source = "git+https://github.com/girlbossceo/ruwuma?rev=9f6c48eea2239e4c065dde38534407ea2596ab99#9f6c48eea2239e4c065dde38534407ea2596ab99"
 dependencies = [
 "bytes",
 "http",
@ -3105,7 +3105,7 @@ dependencies = [
 [[package]]
 name = "ruma-identifiers-validation"
 version = "0.9.5"
-source = "git+https://github.com/girlbossceo/ruwuma?rev=d7baeb7e5c3ae28e79ad3fe81c5e8b207a26cc73#d7baeb7e5c3ae28e79ad3fe81c5e8b207a26cc73"
+source = "git+https://github.com/girlbossceo/ruwuma?rev=9f6c48eea2239e4c065dde38534407ea2596ab99#9f6c48eea2239e4c065dde38534407ea2596ab99"
 dependencies = [
 "js_int",
 "thiserror",
@ -3114,7 +3114,7 @@ dependencies = [
 [[package]]
 name = "ruma-identity-service-api"
 version = "0.9.0"
-source = "git+https://github.com/girlbossceo/ruwuma?rev=d7baeb7e5c3ae28e79ad3fe81c5e8b207a26cc73#d7baeb7e5c3ae28e79ad3fe81c5e8b207a26cc73"
+source = "git+https://github.com/girlbossceo/ruwuma?rev=9f6c48eea2239e4c065dde38534407ea2596ab99#9f6c48eea2239e4c065dde38534407ea2596ab99"
 dependencies = [
 "js_int",
 "ruma-common",
@ -3124,7 +3124,7 @@ dependencies = [
 [[package]]
 name = "ruma-macros"
 version = "0.13.0"
-source = "git+https://github.com/girlbossceo/ruwuma?rev=d7baeb7e5c3ae28e79ad3fe81c5e8b207a26cc73#d7baeb7e5c3ae28e79ad3fe81c5e8b207a26cc73"
+source = "git+https://github.com/girlbossceo/ruwuma?rev=9f6c48eea2239e4c065dde38534407ea2596ab99#9f6c48eea2239e4c065dde38534407ea2596ab99"
 dependencies = [
 "cfg-if",
 "once_cell",
@ -3140,7 +3140,7 @@ dependencies = [
 [[package]]
 name = "ruma-push-gateway-api"
 version = "0.9.0"
-source = "git+https://github.com/girlbossceo/ruwuma?rev=d7baeb7e5c3ae28e79ad3fe81c5e8b207a26cc73#d7baeb7e5c3ae28e79ad3fe81c5e8b207a26cc73"
+source = "git+https://github.com/girlbossceo/ruwuma?rev=9f6c48eea2239e4c065dde38534407ea2596ab99#9f6c48eea2239e4c065dde38534407ea2596ab99"
 dependencies = [
 "js_int",
 "ruma-common",
@ -3152,7 +3152,7 @@ dependencies = [
 [[package]]
 name = "ruma-server-util"
 version = "0.3.0"
-source = "git+https://github.com/girlbossceo/ruwuma?rev=d7baeb7e5c3ae28e79ad3fe81c5e8b207a26cc73#d7baeb7e5c3ae28e79ad3fe81c5e8b207a26cc73"
+source = "git+https://github.com/girlbossceo/ruwuma?rev=9f6c48eea2239e4c065dde38534407ea2596ab99#9f6c48eea2239e4c065dde38534407ea2596ab99"
 dependencies = [
 "headers",
 "http",
@ -3165,7 +3165,7 @@ dependencies = [
 [[package]]
 name = "ruma-signatures"
 version = "0.15.0"
-source = "git+https://github.com/girlbossceo/ruwuma?rev=d7baeb7e5c3ae28e79ad3fe81c5e8b207a26cc73#d7baeb7e5c3ae28e79ad3fe81c5e8b207a26cc73"
+source = "git+https://github.com/girlbossceo/ruwuma?rev=9f6c48eea2239e4c065dde38534407ea2596ab99#9f6c48eea2239e4c065dde38534407ea2596ab99"
 dependencies = [
 "base64 0.22.1",
 "ed25519-dalek",
@ -3181,7 +3181,7 @@ dependencies = [
 [[package]]
 name = "ruma-state-res"
 version = "0.11.0"
-source = "git+https://github.com/girlbossceo/ruwuma?rev=d7baeb7e5c3ae28e79ad3fe81c5e8b207a26cc73#d7baeb7e5c3ae28e79ad3fe81c5e8b207a26cc73"
+source = "git+https://github.com/girlbossceo/ruwuma?rev=9f6c48eea2239e4c065dde38534407ea2596ab99#9f6c48eea2239e4c065dde38534407ea2596ab99"
 dependencies = [
 "futures-util",
 "itertools 0.13.0",
@ -3196,8 +3196,8 @@ dependencies = [
 [[package]]
 name = "rust-librocksdb-sys"
-version = "0.26.0+9.6.1"
+version = "0.28.0+9.7.3"
-source = "git+https://github.com/girlbossceo/rust-rocksdb-zaidoon1?rev=22f942609921ecf837399e1c2fe6fcb8dbb1095e#22f942609921ecf837399e1c2fe6fcb8dbb1095e"
+source = "git+https://github.com/girlbossceo/rust-rocksdb-zaidoon1?rev=c1e5523eae095a893deaf9056128c7dbc2d5fd73#c1e5523eae095a893deaf9056128c7dbc2d5fd73"
 dependencies = [
 "bindgen",
 "bzip2-sys",
@ -3213,8 +3213,8 @@ dependencies = [
 [[package]]
 name = "rust-rocksdb"
-version = "0.30.0"
+version = "0.31.0"
-source = "git+https://github.com/girlbossceo/rust-rocksdb-zaidoon1?rev=22f942609921ecf837399e1c2fe6fcb8dbb1095e#22f942609921ecf837399e1c2fe6fcb8dbb1095e"
+source = "git+https://github.com/girlbossceo/rust-rocksdb-zaidoon1?rev=c1e5523eae095a893deaf9056128c7dbc2d5fd73#c1e5523eae095a893deaf9056128c7dbc2d5fd73"
 dependencies = [
 "libc",
 "rust-librocksdb-sys",
@ -3284,9 +3284,9 @@ dependencies = [
 [[package]]
 name = "rustls"
-version = "0.23.14"
+version = "0.23.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "415d9944693cb90382053259f89fbb077ea730ad7273047ec63b19bc9b160ba8"
+checksum = "5fbb44d7acc4e873d613422379f69f237a1b141928c02f6bc6ccfddddc2d7993"
 dependencies = [
 "aws-lc-rs",
 "log",
@ -3322,9 +3322,9 @@ dependencies = [
 [[package]]
 name = "rustls-pki-types"
-version = "1.9.0"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e696e35370c65c9c541198af4543ccd580cf17fc25d8e05c5a242b202488c55"
+checksum = "16f1201b3c9a7ee8039bcadc17b7e605e2945b27eee7631788c1bd2b0643674b"
 [[package]]
 name = "rustls-webpki"
@ -3340,9 +3340,9 @@ dependencies = [
 [[package]]
 name = "rustversion"
-version = "1.0.17"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "955d28af4278de8121b7ebeb796b6a45735dc01436d898801014aced2773a3d6"
+checksum = "0e819f2bc632f285be6d7cd36e25940d45b2391dd6d9b939e79de557f7014248"
 [[package]]
 name = "rustyline-async"
@ -3377,9 +3377,9 @@ dependencies = [
 [[package]]
 name = "schannel"
-version = "0.1.24"
+version = "0.1.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9aaafd5a2b6e3d657ff009d82fbd630b6bd54dd4eb06f21693925cdf80f9b8b"
+checksum = "01227be5826fa0690321a2ba6c5cd57a19cf3f6a09e76973b58e61de6ab9d1c1"
 dependencies = [
 "windows-sys 0.59.0",
 ]
@ -3595,9 +3595,9 @@ dependencies = [
 [[package]]
 name = "serde_json"
-version = "1.0.128"
+version = "1.0.129"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ff5456707a1de34e7e37f2a6fd3d3f808c318259cbd01ab6377795054b483d8"
+checksum = "6dbcf9b78a125ee667ae19388837dd12294b858d101fdd393cb9d5501ef09eb2"
 dependencies = [
 "itoa",
 "memchr",
@ -3908,9 +3908,9 @@ dependencies = [
 [[package]]
 name = "termimad"
-version = "0.30.0"
+version = "0.30.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "920e7c4671e79f3d9df269da9c8edf0dbc580044fd727d3594f7bfba5eb6107a"
+checksum = "22117210909e9dfff30a558f554c7fb3edb198ef614e7691386785fb7679677c"
 dependencies = [
 "coolor",
 "crokey",
@ -3987,7 +3987,7 @@ dependencies = [
 [[package]]
 name = "tikv-jemalloc-ctl"
 version = "0.6.0"
-source = "git+https://github.com/girlbossceo/jemallocator?rev=c32af15f3b440ae5e46c3404f78b19093bbd5294#c32af15f3b440ae5e46c3404f78b19093bbd5294"
+source = "git+https://github.com/girlbossceo/jemallocator?rev=d87938bfddc26377dd7fdf14bbcd345f3ab19442#d87938bfddc26377dd7fdf14bbcd345f3ab19442"
 dependencies = [
 "libc",
 "paste",
@ -3997,7 +3997,7 @@ dependencies = [
 [[package]]
 name = "tikv-jemalloc-sys"
 version = "0.6.0+5.3.0-1-ge13ca993e8ccb9ba9847cc330696e02839f328f7"
-source = "git+https://github.com/girlbossceo/jemallocator?rev=c32af15f3b440ae5e46c3404f78b19093bbd5294#c32af15f3b440ae5e46c3404f78b19093bbd5294"
+source = "git+https://github.com/girlbossceo/jemallocator?rev=d87938bfddc26377dd7fdf14bbcd345f3ab19442#d87938bfddc26377dd7fdf14bbcd345f3ab19442"
 dependencies = [
 "cc",
 "libc",
@ -4006,7 +4006,7 @@ dependencies = [
 [[package]]
 name = "tikv-jemallocator"
 version = "0.6.0"
-source = "git+https://github.com/girlbossceo/jemallocator?rev=c32af15f3b440ae5e46c3404f78b19093bbd5294#c32af15f3b440ae5e46c3404f78b19093bbd5294"
+source = "git+https://github.com/girlbossceo/jemallocator?rev=d87938bfddc26377dd7fdf14bbcd345f3ab19442#d87938bfddc26377dd7fdf14bbcd345f3ab19442"
 dependencies = [
 "libc",
 "tikv-jemalloc-sys",
@ -4105,7 +4105,7 @@ version = "0.26.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c7bc40d0e5a97695bb96e27995cd3a08538541b0a846f65bba7a359f36700d4"
 dependencies = [
- "rustls 0.23.14",
+ "rustls 0.23.15",
 "rustls-pki-types",
 "tokio",
 ]
@ -4474,7 +4474,7 @@ dependencies = [
 "base64 0.22.1",
 "log",
 "once_cell",
- "rustls 0.23.14",
+ "rustls 0.23.15",
 "rustls-pki-types",
 "url",
 "webpki-roots",
@ -4506,9 +4506,9 @@ checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
 [[package]]
 name = "uuid"
-version = "1.10.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81dfa00651efa65069b0b6b651f4aaa31ba9e3c3ce0137aaad053604ee7e0314"
+checksum = "f8c5f0a0af699448548ad1a2fbf920fb4bee257eae39953ba95cb84891a0446a"
 dependencies = [
 "getrandom",
 "serde",
@ -4549,9 +4549,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.93"
+version = "0.2.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a82edfc16a6c469f5f44dc7b571814045d60404b55a0ee849f9bcfa2e63dd9b5"
+checksum = "128d1e363af62632b8eb57219c8fd7877144af57558fb2ef0368d0087bddeb2e"
 dependencies = [
 "cfg-if",
 "once_cell",
@ -4560,9 +4560,9 @@ dependencies = [
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.93"
+version = "0.2.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9de396da306523044d3302746f1208fa71d7532227f15e347e2d93e4145dd77b"
+checksum = "cb6dd4d3ca0ddffd1dd1c9c04f94b868c37ff5fac97c30b97cff2d74fce3a358"
 dependencies = [
 "bumpalo",
 "log",
@ -4575,9 +4575,9 @@ dependencies = [
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.43"
+version = "0.4.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61e9300f63a621e96ed275155c108eb6f843b6a26d053f122ab69724559dc8ed"
+checksum = "cc7ec4f8827a71586374db3e87abdb5a2bb3a15afed140221307c3ec06b1f63b"
 dependencies = [
 "cfg-if",
 "js-sys",
@ -4587,9 +4587,9 @@ dependencies = [
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.93"
+version = "0.2.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "585c4c91a46b072c92e908d99cb1dcdf95c5218eeb6f3bf1efa991ee7a68cccf"
+checksum = "e79384be7f8f5a9dd5d7167216f022090cf1f9ec128e6e6a482a2cb5c5422c56"
 dependencies = [
 "quote",
 "wasm-bindgen-macro-support",
@ -4597,9 +4597,9 @@ dependencies = [
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.93"
+version = "0.2.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "afc340c74d9005395cf9dd098506f7f44e38f2b4a21c6aaacf9a105ea5e1e836"
+checksum = "26c6ab57572f7a24a4985830b120de1594465e5d500f24afe89e16b4e833ef68"
 dependencies = [
 "proc-macro2",
 "quote",
@ -4610,15 +4610,15 @@ dependencies = [
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.93"
+version = "0.2.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c62a0a307cb4a311d3a07867860911ca130c3494e8c2719593806c08bc5d0484"
+checksum = "65fc09f10666a9f147042251e0dda9c18f166ff7de300607007e96bdebc1068d"
 [[package]]
 name = "web-sys"
-version = "0.3.70"
+version = "0.3.72"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26fdeaafd9bd129f65e7c031593c24d62186301e0c72c8978fa1678be7d532c0"
+checksum = "f6488b90108c040df0fe62fa815cbdee25124641df01814dd7282749234c6112"
 dependencies = [
 "js-sys",
 "wasm-bindgen",
--- a/Cargo.toml
+++ b/Cargo.toml
@ -19,7 +19,7 @@ license = "Apache-2.0"
 # See also `rust-toolchain.toml`
 readme = "README.md"
 repository = "https://github.com/girlbossceo/conduwuit"
-rust-version = "1.81.0"
+rust-version = "1.82.0"
 version = "0.4.7"
 [workspace.metadata.crane]
@ -107,7 +107,7 @@ default-features = false
 version = "0.7"
 [workspace.dependencies.axum-client-ip]
-version = "0.6.0"
+version = "0.6.1"
 [workspace.dependencies.tower]
 version = "0.5.1"
@ -199,7 +199,7 @@ default-features = false
 # used for conduit's CLI and admin room command parsing
 [workspace.dependencies.clap]
-version = "4.5.15"
+version = "4.5.20"
 default-features = false
 features = [
 	"std",
@ -248,7 +248,7 @@ features = ["alloc", "std"]
 default-features = false
 [workspace.dependencies.hyper]
-version = "1.4.1"
+version = "1.5.0"
 default-features = false
 features = [
 	"server",
@ -315,7 +315,7 @@ version = "0.1.2"
 [workspace.dependencies.ruma]
 git = "https://github.com/girlbossceo/ruwuma"
 #branch = "conduwuit-changes"
-rev = "d7baeb7e5c3ae28e79ad3fe81c5e8b207a26cc73"
+rev = "9f6c48eea2239e4c065dde38534407ea2596ab99"
 features = [
    "compat",
    "rand",
@ -408,17 +408,17 @@ version = "0.34.0"
 # jemalloc usage
 [workspace.dependencies.tikv-jemalloc-sys]
 git = "https://github.com/girlbossceo/jemallocator"
-rev = "c32af15f3b440ae5e46c3404f78b19093bbd5294"
+rev = "d87938bfddc26377dd7fdf14bbcd345f3ab19442"
 default-features = false
 features = ["unprefixed_malloc_on_supported_platforms"]
 [workspace.dependencies.tikv-jemallocator]
 git = "https://github.com/girlbossceo/jemallocator"
-rev = "c32af15f3b440ae5e46c3404f78b19093bbd5294"
+rev = "d87938bfddc26377dd7fdf14bbcd345f3ab19442"
 default-features = false
 features = ["unprefixed_malloc_on_supported_platforms"]
 [workspace.dependencies.tikv-jemalloc-ctl]
 git = "https://github.com/girlbossceo/jemallocator"
-rev = "c32af15f3b440ae5e46c3404f78b19093bbd5294"
+rev = "d87938bfddc26377dd7fdf14bbcd345f3ab19442"
 default-features = false
 features = ["use_std"]
@ -447,7 +447,7 @@ version = "0.4.3"
 default-features = false
 [workspace.dependencies.termimad]
-version = "0.30.0"
+version = "0.30.1"
 default-features = false
 [workspace.dependencies.checked_ops]
@ -462,7 +462,7 @@ features = ["full", "extra-traits"]
 version = "1.0.36"
 [workspace.dependencies.proc-macro2]
-version = "1.0.86"
+version = "1.0.89"
 #
 # Patches
@ -719,12 +719,16 @@ opt-level = 'z'
 # primarily used for CI
 [profile.test]
 inherits = "dev"
 strip = false
 opt-level = 0
 codegen-units = 16
 incremental = false
 [profile.test.package.'*']
 inherits = "dev"
 debug = 0
 strip = false
 opt-level = 0
 codegen-units = 16
 incremental = false
@ -812,6 +816,7 @@ significant_drop_tightening = { level = "allow", priority = 1 }      # TODO
 pedantic = { level = "warn", priority = -1 }
 ## some sadness
 too_long_first_doc_paragraph = { level = "allow", priority = 1 }
 doc_markdown = { level = "allow", priority = 1 }
 enum_glob_use = { level = "allow", priority = 1 }
 if_not_else = { level = "allow", priority = 1 }
--- a/bin/complement
+++ b/bin/complement
@ -15,7 +15,7 @@ LOG_FILE="$2"
 # A `.jsonl` file to write test results to
 RESULTS_FILE="$3"
-OCI_IMAGE="complement-conduit:main"
+OCI_IMAGE="complement-conduwuit:main"
 # Complement tests that are skipped due to flakiness/reliability issues
 SKIPPED_COMPLEMENT_TESTS='-skip=TestClientSpacesSummary.*|TestJoinFederatedRoomFromApplicationServiceBridgeUser.*|TestJumpToDateEndpoint.*'
@ -34,7 +34,7 @@ toplevel="$(git rev-parse --show-toplevel)"
 pushd "$toplevel" > /dev/null
-bin/nix-build-and-cache just .#static-complement
+bin/nix-build-and-cache just .#linux-complement
 docker load < result
 popd > /dev/null
--- a/bin/nix-build-and-cache
+++ b/bin/nix-build-and-cache
@ -26,7 +26,13 @@ just() {
        "$ATTIC_TOKEN"
    # Find all output paths of the installables and their build dependencies
-    readarray -t derivations < <(nix path-info --derivation "$@")
+    #readarray -t derivations < <(nix path-info --derivation "$@")
    derivations=()
    while IFS=$'\n' read derivation; do
        derivations+=("$derivation")
    done < <(nix path-info --derivation "$@")
    cache=()
    for derivation in "${derivations[@]}"; do
        cache+=(
@ -77,8 +83,8 @@ ci() {
        --inputs-from "$toplevel"
        # Keep sorted
-        "$toplevel#devShells.x86_64-linux.default"
+        #"$toplevel#devShells.x86_64-linux.default"
-        "$toplevel#devShells.x86_64-linux.all-features"
+        #"$toplevel#devShells.x86_64-linux.all-features"
        attic#default
        cachix#default
        nixpkgs#direnv
--- a/deps/rust-rocksdb/Cargo.toml
+++ b/deps/rust-rocksdb/Cargo.toml
@ -27,7 +27,7 @@ malloc-usable-size = ["rust-rocksdb/malloc-usable-size"]
 [dependencies.rust-rocksdb]
 git = "https://github.com/girlbossceo/rust-rocksdb-zaidoon1"
-rev = "22f942609921ecf837399e1c2fe6fcb8dbb1095e"
+rev = "c1e5523eae095a893deaf9056128c7dbc2d5fd73"
 #branch = "master"
 default-features = false
--- a/docs/deploying/generic.md
+++ b/docs/deploying/generic.md
@ -23,8 +23,8 @@ Nix (or [Lix](https://lix.systems)) to build conduwuit as this has the most guar
 reproducibiltiy and easiest to get a build environment and output going. This also
 allows easy cross-compilation.
-You can run the `nix build -L .#static-x86_64-unknown-linux-musl-all-features` or
+You can run the `nix build -L .#static-x86_64-linux-musl-all-features` or
-`nix build -L .#static-aarch64-unknown-linux-musl-all-features` commands based
+`nix build -L .#static-aarch64-linux-musl-all-features` commands based
 on architecture to cross-compile the necessary static binary located at
 `result/bin/conduit`. This is reproducible with the static binaries produced in our CI.
--- a/flake.lock
+++ b/flake.lock
@ -5,16 +5,15 @@
        "crane": "crane",
        "flake-compat": "flake-compat",
        "flake-parts": "flake-parts",
        "flake-utils": "flake-utils",
        "nixpkgs": "nixpkgs",
        "nixpkgs-stable": "nixpkgs-stable"
      },
      "locked": {
-        "lastModified": 1725300620,
+        "lastModified": 1729116596,
-        "narHash": "sha256-IdM+pZ6BnmD3o1fTJZ2BD43k7dwi1BbVfLDLpM1nE5s=",
+        "narHash": "sha256-NnLMLIXGZtAscUF4dCShksuQ1nOGF6Y2dEeyj0rBbUg=",
        "owner": "zhaofengli",
        "repo": "attic",
-        "rev": "bea72d75b6165dfb529ba0c39cc6c7e9c7f0d234",
+        "rev": "2b05b7d986cf6009b1c1ef7daa4961cd1a658782",
        "type": "github"
      },
      "original": {
@ -29,14 +28,14 @@
        "devenv": "devenv",
        "flake-compat": "flake-compat_3",
        "git-hooks": "git-hooks",
-        "nixpkgs": "nixpkgs_3"
+        "nixpkgs": "nixpkgs_4"
      },
      "locked": {
-        "lastModified": 1724232775,
+        "lastModified": 1728672398,
-        "narHash": "sha256-6u2DycIEgrgNYlLxyGqdFVmBNiKIitnQKJ1pbRP5oko=",
+        "narHash": "sha256-KxuGSoVUFnQLB2ZcYODW7AVPAh9JqRlD5BrfsC/Q4qs=",
        "owner": "cachix",
        "repo": "cachix",
-        "rev": "03b6cb3f953097bff378fb8b9ea094bd091a4ec7",
+        "rev": "aac51f698309fd0f381149214b7eee213c66ef0a",
        "type": "github"
      },
      "original": {
@ -54,12 +53,51 @@
          "devenv",
          "flake-compat"
        ],
        "git-hooks": [
          "cachix",
          "devenv",
          "pre-commit-hooks"
        ],
        "nixpkgs": [
          "cachix",
          "devenv",
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1726520618,
        "narHash": "sha256-jOsaBmJ/EtX5t/vbylCdS7pWYcKGmWOKg4QKUzKr6dA=",
        "owner": "cachix",
        "repo": "cachix",
        "rev": "695525f9086542dfb09fde0871dbf4174abbf634",
        "type": "github"
      },
      "original": {
        "owner": "cachix",
        "repo": "cachix",
        "type": "github"
      }
    },
    "cachix_3": {
      "inputs": {
        "devenv": "devenv_3",
        "flake-compat": [
          "cachix",
          "devenv",
          "cachix",
          "devenv",
          "flake-compat"
        ],
        "nixpkgs": [
          "cachix",
          "devenv",
          "cachix",
          "devenv",
          "nixpkgs"
        ],
        "pre-commit-hooks": [
          "cachix",
          "devenv",
          "cachix",
          "devenv",
          "pre-commit-hooks"
@ -82,11 +120,11 @@
    "complement": {
      "flake": false,
      "locked": {
-        "lastModified": 1724347376,
+        "lastModified": 1727346895,
-        "narHash": "sha256-y0e/ULDJ92IhNQZsS/06g0s+AYZ82aJfrIO9qEse94c=",
+        "narHash": "sha256-S7EuoeTuvMvk1yo7WiVa9GKiNlnP8kWKsmHYJ4qk2Cc=",
        "owner": "matrix-org",
        "repo": "complement",
-        "rev": "39733c1b2f8314800776748cc7164f9a34650686",
+        "rev": "c246a092fda4178b0c97d1ab02f64f8b55ca139a",
        "type": "github"
      },
      "original": {
@ -119,11 +157,11 @@
    },
    "crane_2": {
      "locked": {
-        "lastModified": 1725409566,
+        "lastModified": 1729273024,
-        "narHash": "sha256-PrtLmqhM6UtJP7v7IGyzjBFhbG4eOAHT6LPYOFmYfbk=",
+        "narHash": "sha256-Mb5SemVsootkn4Q2IiY0rr9vrXdCCpQ9HnZeD/J3uXs=",
        "owner": "ipetkov",
        "repo": "crane",
-        "rev": "7e4586bad4e3f8f97a9271def747cf58c4b68f3c",
+        "rev": "fa8b7445ddadc37850ed222718ca86622be01967",
        "type": "github"
      },
      "original": {
@ -140,7 +178,7 @@
          "cachix",
          "flake-compat"
        ],
-        "nix": "nix_2",
+        "nix": "nix_3",
        "nixpkgs": [
          "cachix",
          "nixpkgs"
@ -150,6 +188,43 @@
          "git-hooks"
        ]
      },
      "locked": {
        "lastModified": 1727963652,
        "narHash": "sha256-os0EDjn7QVXL6RtHNb9TrZLXVm2Tc5/nZKk3KpbTzd8=",
        "owner": "cachix",
        "repo": "devenv",
        "rev": "cb0052e25dbcc8267b3026160dc73cddaac7d5fd",
        "type": "github"
      },
      "original": {
        "owner": "cachix",
        "repo": "devenv",
        "type": "github"
      }
    },
    "devenv_2": {
      "inputs": {
        "cachix": "cachix_3",
        "flake-compat": [
          "cachix",
          "devenv",
          "cachix",
          "flake-compat"
        ],
        "nix": "nix_2",
        "nixpkgs": [
          "cachix",
          "devenv",
          "cachix",
          "nixpkgs"
        ],
        "pre-commit-hooks": [
          "cachix",
          "devenv",
          "cachix",
          "git-hooks"
        ]
      },
      "locked": {
        "lastModified": 1723156315,
        "narHash": "sha256-0JrfahRMJ37Rf1i0iOOn+8Z4CLvbcGNwa2ChOAVrp/8=",
@ -164,9 +239,11 @@
        "type": "github"
      }
    },
-    "devenv_2": {
+    "devenv_3": {
      "inputs": {
        "flake-compat": [
          "cachix",
          "devenv",
          "cachix",
          "devenv",
          "cachix",
@ -176,6 +253,8 @@
        "nixpkgs": "nixpkgs_2",
        "poetry2nix": "poetry2nix",
        "pre-commit-hooks": [
          "cachix",
          "devenv",
          "cachix",
          "devenv",
          "cachix",
@ -205,11 +284,11 @@
        "rust-analyzer-src": "rust-analyzer-src"
      },
      "locked": {
-        "lastModified": 1725690497,
+        "lastModified": 1729578683,
-        "narHash": "sha256-5fT+96rV7Hx29HG+4/oBbr3V+yExKuLN2vcBcPbVBlU=",
+        "narHash": "sha256-h0Wmvrkadbyi3IJXFLPi+QyYjCAKDr2xQ6dLxlQ8cXY=",
        "owner": "nix-community",
        "repo": "fenix",
-        "rev": "4b8d964df93d1f918ee6c4f003b3548c432cc866",
+        "rev": "d66cda53e8193a878742dcadb5bb75f4df7c3c0a",
        "type": "github"
      },
      "original": {
@ -305,27 +384,32 @@
        "type": "github"
      }
    },
-    "flake-utils": {
+    "flake-parts_2": {
      "inputs": {
-        "systems": "systems"
+        "nixpkgs-lib": [
          "cachix",
          "devenv",
          "nix",
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1710146030,
+        "lastModified": 1712014858,
-        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "narHash": "sha256-sB4SWl2lX95bExY2gMFG5HIzvva5AVMJd4Igm+GpZNw=",
-        "owner": "numtide",
+        "owner": "hercules-ci",
-        "repo": "flake-utils",
+        "repo": "flake-parts",
-        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "rev": "9126214d0a59633752a136528f5f3b9aa8565b7d",
        "type": "github"
      },
      "original": {
-        "owner": "numtide",
+        "owner": "hercules-ci",
-        "repo": "flake-utils",
+        "repo": "flake-parts",
        "type": "github"
      }
    },
-    "flake-utils_2": {
+    "flake-utils": {
      "inputs": {
-        "systems": "systems_2"
+        "systems": "systems"
      },
      "locked": {
        "lastModified": 1689068808,
@ -341,16 +425,31 @@
        "type": "github"
      }
    },
-    "flake-utils_3": {
+    "flake-utils_2": {
      "inputs": {
        "systems": "systems_3"
      },
      "locked": {
-        "lastModified": 1710146030,
+        "lastModified": 1667395993,
-        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
        "type": "github"
      },
      "original": {
        "owner": "numtide",
        "repo": "flake-utils",
        "type": "github"
      }
    },
    "flake-utils_3": {
      "inputs": {
        "systems": "systems_2"
      },
      "locked": {
        "lastModified": 1726560853,
        "narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
        "owner": "numtide",
        "repo": "flake-utils",
        "rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
        "type": "github"
      },
      "original": {
@ -374,11 +473,11 @@
        "nixpkgs-stable": "nixpkgs-stable_2"
      },
      "locked": {
-        "lastModified": 1723202784,
+        "lastModified": 1727854478,
-        "narHash": "sha256-qbhjc/NEGaDbyy0ucycubq4N3//gDFFH3DOmp1D3u1Q=",
+        "narHash": "sha256-/odH2nUMAwkMgOS2nG2z0exLQNJS4S2LfMW0teqU7co=",
        "owner": "cachix",
        "repo": "git-hooks.nix",
-        "rev": "c7012d0c18567c889b948781bc74a501e92275d1",
+        "rev": "5f58871c9657b5fc0a7f65670fe2ba99c26c1d79",
        "type": "github"
      },
      "original": {
@ -409,14 +508,30 @@
        "type": "github"
      }
    },
    "libgit2": {
      "flake": false,
      "locked": {
        "lastModified": 1697646580,
        "narHash": "sha256-oX4Z3S9WtJlwvj0uH9HlYcWv+x1hqp8mhXl7HsLu2f0=",
        "owner": "libgit2",
        "repo": "libgit2",
        "rev": "45fd9ed7ae1a9b74b957ef4f337bc3c8b3df01b5",
        "type": "github"
      },
      "original": {
        "owner": "libgit2",
        "repo": "libgit2",
        "type": "github"
      }
    },
    "liburing": {
      "flake": false,
      "locked": {
-        "lastModified": 1725659644,
+        "lastModified": 1729703603,
-        "narHash": "sha256-WjnpmopfvFoUbubIu9bki+Y6P4YXDfvnW4+72hniq3g=",
+        "narHash": "sha256-10zmoMDzO41oNRVXE/6FzDGPVRVJTJTARVUmc1b7f+o=",
        "owner": "axboe",
        "repo": "liburing",
-        "rev": "0fe5c09195c0918f89582dd6ff098a58a0bdf62a",
+        "rev": "80272cbeb42bcd0b39a75685a50b0009b77cd380",
        "type": "github"
      },
      "original": {
@ -434,6 +549,8 @@
          "devenv",
          "cachix",
          "devenv",
          "cachix",
          "devenv",
          "nixpkgs"
        ],
        "nixpkgs-regression": "nixpkgs-regression"
@ -476,6 +593,8 @@
          "devenv",
          "cachix",
          "devenv",
          "cachix",
          "devenv",
          "poetry2nix",
          "nixpkgs"
        ]
@ -497,11 +616,15 @@
    "nix_2": {
      "inputs": {
        "flake-compat": [
          "cachix",
          "devenv",
          "cachix",
          "devenv",
          "flake-compat"
        ],
        "nixpkgs": [
          "cachix",
          "devenv",
          "cachix",
          "devenv",
          "nixpkgs"
@ -523,13 +646,42 @@
        "type": "github"
      }
    },
    "nix_3": {
      "inputs": {
        "flake-compat": [
          "cachix",
          "devenv",
          "flake-compat"
        ],
        "flake-parts": "flake-parts_2",
        "libgit2": "libgit2",
        "nixpkgs": "nixpkgs_3",
        "nixpkgs-23-11": "nixpkgs-23-11",
        "nixpkgs-regression": "nixpkgs-regression_3",
        "pre-commit-hooks": "pre-commit-hooks"
      },
      "locked": {
        "lastModified": 1727438425,
        "narHash": "sha256-X8ES7I1cfNhR9oKp06F6ir4Np70WGZU5sfCOuNBEwMg=",
        "owner": "domenkozar",
        "repo": "nix",
        "rev": "f6c5ae4c1b2e411e6b1e6a8181cc84363d6a7546",
        "type": "github"
      },
      "original": {
        "owner": "domenkozar",
        "ref": "devenv-2.24",
        "repo": "nix",
        "type": "github"
      }
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1724999960,
+        "lastModified": 1726042813,
-        "narHash": "sha256-LB3jqSGW5u1ZcUcX6vO/qBOq5oXHlmOCxsTXGMEitp4=",
+        "narHash": "sha256-LnNKCCxnwgF+575y0pxUdlGZBO/ru1CtGHIqQVfvjlA=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "b96f849e725333eb2b1c7f1cb84ff102062468ba",
+        "rev": "159be5db480d1df880a0135ca0bfed84c2f88353",
        "type": "github"
      },
      "original": {
@ -539,6 +691,22 @@
        "type": "github"
      }
    },
    "nixpkgs-23-11": {
      "locked": {
        "lastModified": 1717159533,
        "narHash": "sha256-oamiKNfr2MS6yH64rUn99mIZjc45nGJlj9eGth/3Xuw=",
        "owner": "NixOS",
        "repo": "nixpkgs",
        "rev": "a62e6edd6d5e1fa0329b8653c801147986f8d446",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
        "repo": "nixpkgs",
        "rev": "a62e6edd6d5e1fa0329b8653c801147986f8d446",
        "type": "github"
      }
    },
    "nixpkgs-regression": {
      "locked": {
        "lastModified": 1643052045,
@ -571,6 +739,22 @@
        "type": "github"
      }
    },
    "nixpkgs-regression_3": {
      "locked": {
        "lastModified": 1643052045,
        "narHash": "sha256-uGJ0VXIhWKGXxkeNnq4TvV3CIOkUJ3PAoLZ3HMzNVMw=",
        "owner": "NixOS",
        "repo": "nixpkgs",
        "rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
        "repo": "nixpkgs",
        "rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2",
        "type": "github"
      }
    },
    "nixpkgs-stable": {
      "locked": {
        "lastModified": 1724316499,
@ -621,11 +805,27 @@
    },
    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1722813957,
+        "lastModified": 1717432640,
-        "narHash": "sha256-IAoYyYnED7P8zrBFMnmp7ydaJfwTnwcnqxUElC1I26Y=",
+        "narHash": "sha256-+f9c4/ZX5MWDOuB1rKoWj+lBNm0z0rs4CK47HBLxy1o=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "cb9a96f23c491c081b38eab96d22fa958043c9fa",
+        "rev": "88269ab3044128b7c2f4c7d68448b2fb50456870",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
        "ref": "release-24.05",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "nixpkgs_4": {
      "locked": {
        "lastModified": 1727802920,
        "narHash": "sha256-HP89HZOT0ReIbI7IJZJQoJgxvB2Tn28V6XS3MNKnfLs=",
        "owner": "NixOS",
        "repo": "nixpkgs",
        "rev": "27e30d177e57d912d614c88c622dcfdb2e6e6515",
        "type": "github"
      },
      "original": {
@ -635,13 +835,13 @@
        "type": "github"
      }
    },
-    "nixpkgs_4": {
+    "nixpkgs_5": {
      "locked": {
-        "lastModified": 1725534445,
+        "lastModified": 1729428082,
-        "narHash": "sha256-Yd0FK9SkWy+ZPuNqUgmVPXokxDgMJoGuNpMEtkfcf84=",
+        "narHash": "sha256-xb4/Y+Y7ZlkQaA5rXnrXplDzdt2Jfgdmar3+qkb56UA=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "9bb1e7571aadf31ddb4af77fc64b2d59580f9a39",
+        "rev": "ca30f584e18024baf39c395001262ed936f27ebd",
        "type": "github"
      },
      "original": {
@ -653,13 +853,15 @@
    },
    "poetry2nix": {
      "inputs": {
-        "flake-utils": "flake-utils_2",
+        "flake-utils": "flake-utils",
        "nix-github-actions": "nix-github-actions",
        "nixpkgs": [
          "cachix",
          "devenv",
          "cachix",
          "devenv",
          "cachix",
          "devenv",
          "nixpkgs"
        ]
      },
@ -677,19 +879,59 @@
        "type": "github"
      }
    },
    "pre-commit-hooks": {
      "inputs": {
        "flake-compat": [
          "cachix",
          "devenv",
          "nix"
        ],
        "flake-utils": "flake-utils_2",
        "gitignore": [
          "cachix",
          "devenv",
          "nix"
        ],
        "nixpkgs": [
          "cachix",
          "devenv",
          "nix",
          "nixpkgs"
        ],
        "nixpkgs-stable": [
          "cachix",
          "devenv",
          "nix",
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1712897695,
        "narHash": "sha256-nMirxrGteNAl9sWiOhoN5tIHyjBbVi5e2tgZUgZlK3Y=",
        "owner": "cachix",
        "repo": "pre-commit-hooks.nix",
        "rev": "40e6053ecb65fcbf12863338a6dcefb3f55f1bf8",
        "type": "github"
      },
      "original": {
        "owner": "cachix",
        "repo": "pre-commit-hooks.nix",
        "type": "github"
      }
    },
    "rocksdb": {
      "flake": false,
      "locked": {
-        "lastModified": 1725811807,
+        "lastModified": 1729712930,
-        "narHash": "sha256-k6aubvLSJwW7CtIxBRSlM6Z8UiJDCdFUgDWPYLV47Qk=",
+        "narHash": "sha256-jlp4kPkRTpoJaUdobEoHd8rCGAQNBy4ZHZ6y5zL/ibw=",
        "owner": "girlbossceo",
        "repo": "rocksdb",
-        "rev": "347d50e212b24d98b5ad9841404ff80c1bb873f0",
+        "rev": "871eda6953c3f399aae39808dcfccdd014885beb",
        "type": "github"
      },
      "original": {
        "owner": "girlbossceo",
-        "ref": "v9.6.1",
+        "ref": "v9.7.3",
        "repo": "rocksdb",
        "type": "github"
      }
@ -705,18 +947,18 @@
        "flake-utils": "flake-utils_3",
        "liburing": "liburing",
        "nix-filter": "nix-filter",
-        "nixpkgs": "nixpkgs_4",
+        "nixpkgs": "nixpkgs_5",
        "rocksdb": "rocksdb"
      }
    },
    "rust-analyzer-src": {
      "flake": false,
      "locked": {
-        "lastModified": 1725630423,
+        "lastModified": 1729533545,
-        "narHash": "sha256-gNCLk3Zg7JlAwmWbVHTH6f3+iqdeQ4fheOotCZy8x5M=",
+        "narHash": "sha256-A/AuEWcGwwjpfBCZqWDNNg5GwYrJduzLvlMe+A7xG5U=",
        "owner": "rust-lang",
        "repo": "rust-analyzer",
-        "rev": "08c7bbc2dbe4dcc8968484f1a0e1e6fe7a1d4f6d",
+        "rev": "de2ff17bc513807412d7bbaba1d995a774938583",
        "type": "github"
      },
      "original": {
@ -755,21 +997,6 @@
        "repo": "default",
        "type": "github"
      }
    },
    "systems_3": {
      "locked": {
        "lastModified": 1681028828,
        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
        "owner": "nix-systems",
        "repo": "default",
        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
        "type": "github"
      },
      "original": {
        "owner": "nix-systems",
        "repo": "default",
        "type": "github"
      }
    }
  },
  "root": "root",
--- a/flake.nix
+++ b/flake.nix
@ -9,7 +9,7 @@
    flake-utils.url = "github:numtide/flake-utils?ref=main";
    nix-filter.url = "github:numtide/nix-filter?ref=main";
    nixpkgs.url = "github:NixOS/nixpkgs?ref=nixpkgs-unstable";
-    rocksdb = { url = "github:girlbossceo/rocksdb?ref=v9.6.1"; flake = false; };
+    rocksdb = { url = "github:girlbossceo/rocksdb?ref=v9.7.3"; flake = false; };
    liburing = { url = "github:axboe/liburing?ref=master"; flake = false; };
  };
@ -18,7 +18,6 @@
    let
      pkgsHost = import inputs.nixpkgs{
        inherit system;
        config.permittedInsecurePackages = [ "olm-3.2.16" ];
      };
      pkgsHostStatic = pkgsHost.pkgsStatic;
@ -27,7 +26,7 @@
        file = ./rust-toolchain.toml;
        # See also `rust-toolchain.toml`
-        sha256 = "sha256-VZZnlyP69+Y3crrLHQyJirqlHrTtGTsyiSnZB8jEvVo=";
+        sha256 = "sha256-yMuSb5eQPO/bHv+Bcf/US8LVMbf/G/0MSfiPwBhiPpk=";
      };
      mkScope = pkgs: pkgs.lib.makeScope pkgs.newScope (self: {
@ -38,10 +37,19 @@
        inherit inputs;
        main = self.callPackage ./nix/pkgs/main {};
        oci-image = self.callPackage ./nix/pkgs/oci-image {};
        tini = pkgs.tini.overrideAttrs {
            # newer clang/gcc is unhappy with tini-static: <https://3.dog/~strawberry/pb/c8y4>
            patches = [ (pkgs.fetchpatch {
                url = "https://patch-diff.githubusercontent.com/raw/krallin/tini/pull/224.patch";
                hash = "sha256-4bTfAhRyIT71VALhHY13hUgbjLEUyvgkIJMt3w9ag3k=";
              })
            ];
        };
        liburing = pkgs.liburing.overrideAttrs {
          # Tests weren't building
          outputs = [ "out" "dev" "man" ];
-          buildFlags = [ "library"];
+          buildFlags = [ "library" ];
          src = inputs.liburing;
        };
        rocksdb = (pkgs.rocksdb.override {
@ -88,6 +96,17 @@
      scopeHost = mkScope pkgsHost;
      scopeHostStatic = mkScope pkgsHostStatic;
      scopeCrossLinux = mkScope pkgsHost.pkgsLinux.pkgsStatic;
      mkCrossScope = crossSystem:
        let pkgsCrossStatic = (import inputs.nixpkgs {
          inherit system;
          crossSystem = {
           config = crossSystem;
          };
        }).pkgsStatic;
         in
        mkScope pkgsCrossStatic;
      mkDevShell = scope: scope.pkgs.mkShell {
        env = scope.main.env // {
@ -100,9 +119,9 @@
          # code.
          COMPLEMENT_SRC = inputs.complement.outPath;
-          # Needed for Complement
+          # Needed for Complement: <https://github.com/golang/go/issues/52690>
-          CGO_CFLAGS = "-I${scope.pkgs.olm}/include";
+          CGO_CFLAGS = "-Wl,--no-gc-sections";
-          CGO_LDFLAGS = "-L${scope.pkgs.olm}/lib";
+          CGO_LDFLAGS = "-Wl,--no-gc-sections";
        };
        # Development tools
@ -116,9 +135,6 @@
          toolchain
        ]
        ++ (with pkgsHost.pkgs; [
          engage
          cargo-audit
          liburing
          # Required by hardened-malloc.rs dep
          binutils
@ -126,9 +142,15 @@
          # Needed for producing Debian packages
          cargo-deb
          # Needed for CI
          cargo-audit
          # Needed for CI to check validity of produced Debian packages (dpkg-deb)
          dpkg
          # Needed for CI
          engage
          # Needed for Complement
          go
@ -149,12 +171,22 @@
          # needed so we can get rid of gcc and other unused deps that bloat OCI images
          removeReferencesTo
-        ])
+        ]
        # liburing is Linux-exclusive
        ++ lib.optional stdenv.hostPlatform.isLinux liburing
        # needed to build Rust applications on macOS
        ++ lib.optionals stdenv.hostPlatform.isDarwin [
            # https://github.com/NixOS/nixpkgs/issues/206242
            # ld: library not found for -liconv
            libiconv
            # https://stackoverflow.com/questions/69869574/properly-adding-darwin-apple-sdk-to-a-nix-shell
            # https://discourse.nixos.org/t/compile-a-rust-binary-on-macos-dbcrossbar/8612
            pkgsBuildHost.darwin.apple_sdk.frameworks.Security
            ])
        ++ scope.main.buildInputs
        ++ scope.main.propagatedBuildInputs
        ++ scope.main.nativeBuildInputs;
        meta.broken = scope.main.meta.broken;
      };
    in
    {
@ -228,6 +260,8 @@
        complement = scopeHost.complement;
        static-complement = scopeHostStatic.complement;
        # macOS containers don't exist, so the complement images must be forced to linux
        linux-complement = (mkCrossScope "${pkgsHost.hostPlatform.qemuArch}-linux-musl").complement;
      }
      //
      builtins.listToAttrs
@ -236,14 +270,7 @@
            (crossSystem:
              let
                binaryName = "static-${crossSystem}";
-                pkgsCrossStatic =
+                scopeCrossStatic = mkCrossScope crossSystem;
                  (import inputs.nixpkgs {
                    inherit system;
                    crossSystem = {
                      config = crossSystem;
                    };
                  }).pkgsStatic;
                scopeCrossStatic = mkScope pkgsCrossStatic;
              in
              [
                # An output for a statically-linked binary
@ -373,11 +400,20 @@
                    };
                  };
                }
                # An output for a complement OCI image for the specified platform
                {
                  name = "complement-${crossSystem}";
                  value = scopeCrossStatic.complement;
                }
              ]
            )
            [
-              "x86_64-unknown-linux-musl"
+              #"x86_64-apple-darwin"
-              "aarch64-unknown-linux-musl"
+              #"aarch64-apple-darwin"
              "x86_64-linux-gnu"
              "x86_64-linux-musl"
              "aarch64-linux-musl"
            ]
          )
        );
--- a/nix/pkgs/complement/default.nix
+++ b/nix/pkgs/complement/default.nix
@ -18,6 +18,15 @@ let
    all_features = true;
    disable_release_max_log_level = true;
    disable_features = [
        # no reason to use jemalloc for complement, just has compatibility/build issues
        "jemalloc"
        # console/CLI stuff isn't used or relevant for complement
        "console"
        "tokio_console"
        # sentry telemetry isn't useful for complement, disabled by default anyways
        "sentry_telemetry"
        # the containers don't use or need systemd signal support
        "systemd"
        # this is non-functional on nix for some reason
        "hardened_malloc"
        # dont include experimental features
@ -57,7 +66,7 @@ let
 in
 dockerTools.buildImage {
-  name = "complement-${main.pname}";
+  name = "complement-conduwuit";
  tag = "main";
  copyToRoot = buildEnv {
@ -78,7 +87,7 @@ dockerTools.buildImage {
      "${lib.getExe start}"
    ];
-    Entrypoint = if !stdenv.isDarwin
+    Entrypoint = if !stdenv.hostPlatform.isDarwin
      # Use the `tini` init system so that signals (e.g. ctrl+c/SIGINT)
      # are handled as expected
      then [ "${lib.getExe' tini "tini"}" "--" ]
--- a/nix/pkgs/main/cross-compilation-env.nix
+++ b/nix/pkgs/main/cross-compilation-env.nix
@ -1,5 +1,6 @@
 { lib
 , pkgsBuildHost
 , pkgsBuildTarget
 , rust
 , stdenv
 }:
@ -35,7 +36,7 @@ lib.optionalAttrs stdenv.hostPlatform.isStatic {
            # including it here. Linkers are weird.
            (stdenv.hostPlatform.isAarch64 || stdenv.hostPlatform.isx86_64)
              && stdenv.hostPlatform.isStatic
-              && !stdenv.isDarwin
+              && !stdenv.hostPlatform.isDarwin
              && !stdenv.cc.bintools.isLLVM
          )
          [
@ -52,11 +53,12 @@ lib.optionalAttrs stdenv.hostPlatform.isStatic {
 # even covers the case of build scripts that need native code compiled and
 # run on the build platform (I think).
 #
-# [0]: https://github.com/NixOS/nixpkgs/blob/5cdb38bb16c6d0a38779db14fcc766bc1b2394d6/pkgs/build-support/rust/lib/default.nix#L57-L80
+# [0]: https://github.com/NixOS/nixpkgs/blob/nixpkgs-unstable/pkgs/build-support/rust/lib/default.nix#L48-L68
 //
 (
  let
    inherit (rust.lib) envVars;
    shouldUseLLD = platform: platform.isAarch64 && platform.isStatic && !stdenv.hostPlatform.isDarwin;
  in
  lib.optionalAttrs
    (stdenv.targetPlatform.rust.rustcTarget
@ -64,23 +66,30 @@ lib.optionalAttrs stdenv.hostPlatform.isStatic {
    (
      let
        inherit (stdenv.targetPlatform.rust) cargoEnvVarTarget;
        linkerForTarget = if shouldUseLLD stdenv.targetPlatform
          && !stdenv.cc.bintools.isLLVM # whether stdenv's linker is lld already
          then "${pkgsBuildTarget.llvmPackages.bintools}/bin/${stdenv.cc.targetPrefix}ld.lld"
          else envVars.ccForTarget;
      in
      {
        "CC_${cargoEnvVarTarget}" = envVars.ccForTarget;
        "CXX_${cargoEnvVarTarget}" = envVars.cxxForTarget;
-        "CARGO_TARGET_${cargoEnvVarTarget}_LINKER" =
+        "CARGO_TARGET_${cargoEnvVarTarget}_LINKER" = linkerForTarget;
          envVars.linkerForTarget;
      }
    )
  //
  (
    let
      inherit (stdenv.hostPlatform.rust) cargoEnvVarTarget rustcTarget;
      linkerForHost = if shouldUseLLD stdenv.targetPlatform
        && !stdenv.cc.bintools.isLLVM
        then "${pkgsBuildHost.llvmPackages.bintools}/bin/${stdenv.cc.targetPrefix}ld.lld"
        else envVars.ccForHost;
    in
    {
      "CC_${cargoEnvVarTarget}" = envVars.ccForHost;
      "CXX_${cargoEnvVarTarget}" = envVars.cxxForHost;
-      "CARGO_TARGET_${cargoEnvVarTarget}_LINKER" = envVars.linkerForHost;
+      "CARGO_TARGET_${cargoEnvVarTarget}_LINKER" = linkerForHost;
      CARGO_BUILD_TARGET = rustcTarget;
    }
  )
@ -92,7 +101,7 @@ lib.optionalAttrs stdenv.hostPlatform.isStatic {
    {
      "CC_${cargoEnvVarTarget}" = envVars.ccForBuild;
      "CXX_${cargoEnvVarTarget}" = envVars.cxxForBuild;
-      "CARGO_TARGET_${cargoEnvVarTarget}_LINKER" = envVars.linkerForBuild;
+      "CARGO_TARGET_${cargoEnvVarTarget}_LINKER" = envVars.ccForBuild;
      HOST_CC = "${pkgsBuildHost.stdenv.cc}/bin/cc";
      HOST_CXX = "${pkgsBuildHost.stdenv.cc}/bin/c++";
    }
--- a/nix/pkgs/main/default.nix
+++ b/nix/pkgs/main/default.nix
@ -6,6 +6,7 @@
 , libiconv
 , liburing
 , pkgsBuildHost
 , pkgsBuildTarget
 , rocksdb
 , removeReferencesTo
 , rust
@ -40,7 +41,7 @@ features'' = lib.subtractLists disable_features' features';
 featureEnabled = feature : builtins.elem feature features'';
-enableLiburing = featureEnabled "io_uring" && !stdenv.isDarwin;
+enableLiburing = featureEnabled "io_uring" && !stdenv.hostPlatform.isDarwin;
 # This derivation will set the JEMALLOC_OVERRIDE variable, causing the
 # tikv-jemalloc-sys crate to use the nixpkgs jemalloc instead of building it's
@ -72,16 +73,12 @@ buildDepsOnlyEnv =
      # jemalloc symbols are prefixed.
      #
      # [1]: https://github.com/tikv/jemallocator/blob/ab0676d77e81268cd09b059260c75b38dbef2d51/jemalloc-sys/src/env.rs#L17
-      enableJemalloc = featureEnabled "jemalloc" && !stdenv.isDarwin;
+      enableJemalloc = featureEnabled "jemalloc" && !stdenv.hostPlatform.isDarwin;
      # for some reason enableLiburing in nixpkgs rocksdb is default true
      # which breaks Darwin entirely
      enableLiburing = enableLiburing;
    }).overrideAttrs (old: {
      # TODO: static rocksdb fails to build on darwin, also see <https://github.com/NixOS/nixpkgs/issues/320448>
      # build log at <https://girlboss.ceo/~strawberry/pb/JjGH>
      meta.broken = stdenv.hostPlatform.isStatic && stdenv.isDarwin;
      enableLiburing = enableLiburing;
    });
  in
@ -99,6 +96,7 @@ buildDepsOnlyEnv =
    inherit
      lib
      pkgsBuildHost
      pkgsBuildTarget
      rust
      stdenv;
  });
@ -137,7 +135,17 @@ commonAttrs = {
    dontStrip = profile == "dev" || profile == "test";
    dontPatchELF = profile == "dev" || profile == "test";
-    buildInputs = lib.optional (featureEnabled "jemalloc") rust-jemalloc-sys';
+    buildInputs = lib.optional (featureEnabled "jemalloc") rust-jemalloc-sys'
    # needed to build Rust applications on macOS
    ++ lib.optionals stdenv.hostPlatform.isDarwin [
        # https://github.com/NixOS/nixpkgs/issues/206242
        # ld: library not found for -liconv
        libiconv
        # https://stackoverflow.com/questions/69869574/properly-adding-darwin-apple-sdk-to-a-nix-shell
        # https://discourse.nixos.org/t/compile-a-rust-binary-on-macos-dbcrossbar/8612
        pkgsBuildHost.darwin.apple_sdk.frameworks.Security
      ];
    nativeBuildInputs = [
      # bindgen needs the build platform's libclang. Apparently due to "splicing
@ -154,8 +162,10 @@ commonAttrs = {
      # needed so we can get rid of gcc and other unused deps that bloat OCI images
      removeReferencesTo
  ]
-  ++ lib.optionals stdenv.isDarwin [
+  # needed to build Rust applications on macOS
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
      # https://github.com/NixOS/nixpkgs/issues/206242
      # ld: library not found for -liconv
      libiconv
      # https://stackoverflow.com/questions/69869574/properly-adding-darwin-apple-sdk-to-a-nix-shell
@ -167,7 +177,7 @@ commonAttrs = {
    #
    # <https://github.com/input-output-hk/haskell.nix/issues/829>
    postInstall = with pkgsBuildHost; ''
-        find "$out" -type f -exec remove-references-to -t ${stdenv.cc} -t ${gcc} -t ${libgcc} -t ${linuxHeaders} -t ${libidn2} -t ${libunistring} '{}' +
+        find "$out" -type f -exec remove-references-to -t ${stdenv.cc} -t ${rustc.unwrapped} -t ${rustc} '{}' +
    '';
 };
 in
--- a/nix/pkgs/oci-image/default.nix
+++ b/nix/pkgs/oci-image/default.nix
@ -16,7 +16,7 @@ dockerTools.buildLayeredImage {
    dockerTools.caCertificates
  ];
  config = {
-    Entrypoint = if !stdenv.isDarwin
+    Entrypoint = if !stdenv.hostPlatform.isDarwin
      # Use the `tini` init system so that signals (e.g. ctrl+c/SIGINT)
      # are handled as expected
      then [ "${lib.getExe' tini "tini"}" "--" ]
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@ -2,8 +2,6 @@
 #
 # Other files that need upkeep when this changes:
 #
 # * `.gitlab-ci.yml`
 # * `.github/workflows/ci.yml`
 # * `Cargo.toml`
 # * `flake.nix`
 #
@ -11,13 +9,20 @@
 # If you're having trouble making the relevant changes, bug a maintainer.
 [toolchain]
-channel = "1.81.0"
+channel = "1.82.0"
 profile = "minimal"
 components = [
    # For rust-analyzer
    "rust-src",
    "rust-analyzer",
    # For CI and editors
    "rustfmt",
    "clippy",
 ]
 targets = [
    #"x86_64-apple-darwin",
    "x86_64-unknown-linux-gnu",
    "x86_64-unknown-linux-musl",
    "aarch64-unknown-linux-musl",
    #"aarch64-apple-darwin",
 ]
--- a/src/admin/debug/commands.rs
+++ b/src/admin/debug/commands.rs
@ -203,6 +203,7 @@ pub(super) async fn get_remote_pdu(
 			&server,
 			ruma::api::federation::event::get_event::v1::Request {
 				event_id: event_id.clone().into(),
 				include_unredacted_content: None,
 			},
 		)
 		.await
--- a/src/api/client/push.rs
+++ b/src/api/client/push.rs
@ -5,7 +5,7 @@ use ruma::{
 		error::ErrorKind,
 		push::{
 			delete_pushrule, get_pushers, get_pushrule, get_pushrule_actions, get_pushrule_enabled, get_pushrules_all,
-			set_pusher, set_pushrule, set_pushrule_actions, set_pushrule_enabled, RuleScope,
+			set_pusher, set_pushrule, set_pushrule_actions, set_pushrule_enabled,
 		},
 	},
 	events::{
@ -50,7 +50,7 @@ pub(crate) async fn get_pushrules_all_route(
 	})
 }
-/// # `GET /_matrix/client/r0/pushrules/{scope}/{kind}/{ruleId}`
+/// # `GET /_matrix/client/r0/pushrules/global/{kind}/{ruleId}`
 ///
 /// Retrieves a single specified push rule for this user.
 pub(crate) async fn get_pushrule_route(
@ -79,7 +79,7 @@ pub(crate) async fn get_pushrule_route(
 	}
 }
-/// # `PUT /_matrix/client/r0/pushrules/{scope}/{kind}/{ruleId}`
+/// # `PUT /_matrix/client/r0/pushrules/global/{kind}/{ruleId}`
 ///
 /// Creates a single specified push rule for this user.
 pub(crate) async fn set_pushrule_route(
@ -88,13 +88,6 @@ pub(crate) async fn set_pushrule_route(
 	let sender_user = body.sender_user.as_ref().expect("user is authenticated");
 	let body = body.body;
 	if body.scope != RuleScope::Global {
 		return Err(Error::BadRequest(
 			ErrorKind::InvalidParam,
 			"Scopes other than 'global' are not supported.",
 		));
 	}
 	let mut account_data: PushRulesEvent = services
 		.account_data
 		.get_global(sender_user, GlobalAccountDataEventType::PushRules)
@ -145,7 +138,7 @@ pub(crate) async fn set_pushrule_route(
 	Ok(set_pushrule::v3::Response {})
 }
-/// # `GET /_matrix/client/r0/pushrules/{scope}/{kind}/{ruleId}/actions`
+/// # `GET /_matrix/client/r0/pushrules/global/{kind}/{ruleId}/actions`
 ///
 /// Gets the actions of a single specified push rule for this user.
 pub(crate) async fn get_pushrule_actions_route(
@ -153,13 +146,6 @@ pub(crate) async fn get_pushrule_actions_route(
 ) -> Result<get_pushrule_actions::v3::Response> {
 	let sender_user = body.sender_user.as_ref().expect("user is authenticated");
 	if body.scope != RuleScope::Global {
 		return Err(Error::BadRequest(
 			ErrorKind::InvalidParam,
 			"Scopes other than 'global' are not supported.",
 		));
 	}
 	let event: PushRulesEvent = services
 		.account_data
 		.get_global(sender_user, GlobalAccountDataEventType::PushRules)
@ -178,7 +164,7 @@ pub(crate) async fn get_pushrule_actions_route(
 	})
 }
-/// # `PUT /_matrix/client/r0/pushrules/{scope}/{kind}/{ruleId}/actions`
+/// # `PUT /_matrix/client/r0/pushrules/global/{kind}/{ruleId}/actions`
 ///
 /// Sets the actions of a single specified push rule for this user.
 pub(crate) async fn set_pushrule_actions_route(
@ -186,13 +172,6 @@ pub(crate) async fn set_pushrule_actions_route(
 ) -> Result<set_pushrule_actions::v3::Response> {
 	let sender_user = body.sender_user.as_ref().expect("user is authenticated");
 	if body.scope != RuleScope::Global {
 		return Err(Error::BadRequest(
 			ErrorKind::InvalidParam,
 			"Scopes other than 'global' are not supported.",
 		));
 	}
 	let mut account_data: PushRulesEvent = services
 		.account_data
 		.get_global(sender_user, GlobalAccountDataEventType::PushRules)
@ -221,7 +200,7 @@ pub(crate) async fn set_pushrule_actions_route(
 	Ok(set_pushrule_actions::v3::Response {})
 }
-/// # `GET /_matrix/client/r0/pushrules/{scope}/{kind}/{ruleId}/enabled`
+/// # `GET /_matrix/client/r0/pushrules/global/{kind}/{ruleId}/enabled`
 ///
 /// Gets the enabled status of a single specified push rule for this user.
 pub(crate) async fn get_pushrule_enabled_route(
@ -229,13 +208,6 @@ pub(crate) async fn get_pushrule_enabled_route(
 ) -> Result<get_pushrule_enabled::v3::Response> {
 	let sender_user = body.sender_user.as_ref().expect("user is authenticated");
 	if body.scope != RuleScope::Global {
 		return Err(Error::BadRequest(
 			ErrorKind::InvalidParam,
 			"Scopes other than 'global' are not supported.",
 		));
 	}
 	let event: PushRulesEvent = services
 		.account_data
 		.get_global(sender_user, GlobalAccountDataEventType::PushRules)
@ -254,7 +226,7 @@ pub(crate) async fn get_pushrule_enabled_route(
 	})
 }
-/// # `PUT /_matrix/client/r0/pushrules/{scope}/{kind}/{ruleId}/enabled`
+/// # `PUT /_matrix/client/r0/pushrules/global/{kind}/{ruleId}/enabled`
 ///
 /// Sets the enabled status of a single specified push rule for this user.
 pub(crate) async fn set_pushrule_enabled_route(
@ -262,13 +234,6 @@ pub(crate) async fn set_pushrule_enabled_route(
 ) -> Result<set_pushrule_enabled::v3::Response> {
 	let sender_user = body.sender_user.as_ref().expect("user is authenticated");
 	if body.scope != RuleScope::Global {
 		return Err(Error::BadRequest(
 			ErrorKind::InvalidParam,
 			"Scopes other than 'global' are not supported.",
 		));
 	}
 	let mut account_data: PushRulesEvent = services
 		.account_data
 		.get_global(sender_user, GlobalAccountDataEventType::PushRules)
@ -297,7 +262,7 @@ pub(crate) async fn set_pushrule_enabled_route(
 	Ok(set_pushrule_enabled::v3::Response {})
 }
-/// # `DELETE /_matrix/client/r0/pushrules/{scope}/{kind}/{ruleId}`
+/// # `DELETE /_matrix/client/r0/pushrules/global/{kind}/{ruleId}`
 ///
 /// Deletes a single specified push rule for this user.
 pub(crate) async fn delete_pushrule_route(
@ -305,13 +270,6 @@ pub(crate) async fn delete_pushrule_route(
 ) -> Result<delete_pushrule::v3::Response> {
 	let sender_user = body.sender_user.as_ref().expect("user is authenticated");
 	if body.scope != RuleScope::Global {
 		return Err(Error::BadRequest(
 			ErrorKind::InvalidParam,
 			"Scopes other than 'global' are not supported.",
 		));
 	}
 	let mut account_data: PushRulesEvent = services
 		.account_data
 		.get_global(sender_user, GlobalAccountDataEventType::PushRules)
--- a/src/api/router/auth.rs
+++ b/src/api/router/auth.rs
@ -190,6 +190,7 @@ async fn auth_server(services: &Services, request: &mut Request, body: Option<&C
 	let destination = services.globals.server_name();
 	let origin = &x_matrix.origin;
 	#[allow(clippy::or_fun_call)]
 	let signature_uri = request
 		.parts
 		.uri
--- a/src/core/debug.rs
+++ b/src/core/debug.rs
@ -60,8 +60,7 @@ pub fn set_panic_trap() {
 }
 #[inline(always)]
-#[allow(deprecated_in_future)]
+fn panic_handler(info: &panic::PanicHookInfo<'_>, next: &dyn Fn(&panic::PanicHookInfo<'_>)) {
 fn panic_handler(info: &panic::PanicInfo<'_>, next: &dyn Fn(&panic::PanicInfo<'_>)) {
 	trap();
 	next(info);
 }
--- a/src/core/mods/macros.rs
+++ b/src/core/mods/macros.rs
@ -23,10 +23,10 @@ macro_rules! mod_dtor {
 macro_rules! mod_init {
 	($body:block) => {
 		#[used]
-		#[cfg_attr(target_family = "unix", link_section = ".init_array")]
+		#[cfg_attr(target_family = "unix", unsafe(link_section = ".init_array"))]
 		static MOD_INIT: extern "C" fn() = { _mod_init };
-		#[cfg_attr(target_family = "unix", link_section = ".text.startup")]
+		#[cfg_attr(target_family = "unix", unsafe(link_section = ".text.startup"))]
 		extern "C" fn _mod_init() -> () $body
 	};
 }
@ -35,10 +35,10 @@ macro_rules! mod_init {
 macro_rules! mod_fini {
 	($body:block) => {
 		#[used]
-		#[cfg_attr(target_family = "unix", link_section = ".fini_array")]
+		#[cfg_attr(target_family = "unix", unsafe(link_section = ".fini_array"))]
 		static MOD_FINI: extern "C" fn() = { _mod_fini };
-		#[cfg_attr(target_family = "unix", link_section = ".text.startup")]
+		#[cfg_attr(target_family = "unix", unsafe(link_section = ".text.startup"))]
 		extern "C" fn _mod_fini() -> () $body
 	};
 }
--- a/src/core/utils/content_disposition.rs
+++ b/src/core/utils/content_disposition.rs
@ -45,9 +45,10 @@ pub fn content_disposition_type(content_type: Option<&str>) -> ContentDispositio
 		return ContentDispositionType::Attachment;
 	};
-	// is_sorted is unstable
+	assert!(
-	/* debug_assert!(ALLOWED_INLINE_CONTENT_TYPES.is_sorted(),
+		ALLOWED_INLINE_CONTENT_TYPES.is_sorted(),
-	 * "ALLOWED_INLINE_CONTENT_TYPES is not sorted"); */
+		"ALLOWED_INLINE_CONTENT_TYPES is not sorted!"
 	);
 	let content_type: Cow<'_, str> = content_type
 		.split(';')
--- a/src/router/mod.rs
+++ b/src/router/mod.rs
@ -16,7 +16,7 @@ conduit::mod_ctor! {}
 conduit::mod_dtor! {}
 conduit::rustc_flags_capture! {}
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "Rust" fn start(server: &Arc<Server>) -> Pin<Box<dyn Future<Output = Result<Arc<Services>>> + Send>> {
 	AssertUnwindSafe(run::start(server.clone()))
 		.catch_unwind()
@ -25,7 +25,7 @@ pub extern "Rust" fn start(server: &Arc<Server>) -> Pin<Box<dyn Future<Output =
 		.boxed()
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "Rust" fn stop(services: Arc<Services>) -> Pin<Box<dyn Future<Output = Result<()>> + Send>> {
 	AssertUnwindSafe(run::stop(services))
 		.catch_unwind()
@ -34,7 +34,7 @@ pub extern "Rust" fn stop(services: Arc<Services>) -> Pin<Box<dyn Future<Output
 		.boxed()
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "Rust" fn run(services: &Arc<Services>) -> Pin<Box<dyn Future<Output = Result<()>> + Send>> {
 	AssertUnwindSafe(run::run(services.clone()))
 		.catch_unwind()
--- a/src/service/pusher/mod.rs
+++ b/src/service/pusher/mod.rs
@ -332,6 +332,13 @@ impl Service {
 						.await
 						.ok();
 					notifi.room_alias = self
 						.services
 						.state_accessor
 						.get_canonical_alias(&event.room_id)
 						.await
 						.ok();
 					self.send_request(&http.url, send_event_notification::v1::Request::new(notifi))
 						.await?;
 				}
--- a/src/service/rooms/event_handler/mod.rs
+++ b/src/service/rooms/event_handler/mod.rs
@ -1159,6 +1159,7 @@ impl Service {
 						origin,
 						get_event::v1::Request {
 							event_id: (*next_id).to_owned(),
 							include_unredacted_content: None,
 						},
 					)
 					.await
--- a/src/service/sending/sender.rs
+++ b/src/service/sending/sender.rs
@ -524,8 +524,13 @@ impl Service {
 					}
 				},
 				SendingEvent::Edu(edu) => {
-					if let Ok(edu) = serde_json::from_slice(edu) {
+					if appservice
-						edu_jsons.push(edu);
+						.receive_ephemeral
 						.is_some_and(|receive_ephemeral| receive_ephemeral)
 					{
 						if let Ok(edu) = serde_json::from_slice(edu) {
 							edu_jsons.push(edu);
 						}
 					}
 				},
 				SendingEvent::Flush => {}, // flush only; no new content