Merge staging-next into staging

2024-11-29 02:13:23 +00:00 · 2024-07-26 06:01:50 +00:00 · 2024-07-26 06:01:50 +00:00 · 09de87d288
commit 09de87d288
parent 9f80e31c4a 7d5eca7a3f
195 changed files with 3539 additions and 7709 deletions
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@ -557,138 +557,11 @@ Names of files and directories should be in lowercase, with dashes between words

 ### Syntax

- Use 2 spaces of indentation per indentation level in Nix expressions, 4 spaces in shell scripts.
-
- Do not use tab characters, i.e. configure your editor to use soft tabs. For instance, use `(setq-default indent-tabs-mode nil)` in Emacs. Everybody has different tab settings so it’s asking for trouble.
+- Set up [editorconfig](https://editorconfig.org/) for your editor, such that [the settings](./.editorconfig) are automatically applied.

 - Use `lowerCamelCase` for variable names, not `UpperCamelCase`. Note, this rule does not apply to package attribute names, which instead follow the rules in [package naming](./pkgs/README.md#package-naming).

- Function calls with attribute set arguments are written as
-
-  ```nix
-  foo {
-    arg = <...>;
-  }
-  ```
-
-  not
-
-  ```nix
-  foo
-  {
-    arg = <...>;
-  }
-  ```
-
-  Also fine is
-
-  ```nix
-  foo { arg = <...>; }
-  ```
-
-  if it's a short call.
-
- In attribute sets or lists that span multiple lines, the attribute names or list elements should be aligned:
-
-  ```nix
-  {
-    # A long list.
-    list = [
-      elem1
-      elem2
-      elem3
-    ];
-
-    # A long attribute set.
-    attrs = {
-      attr1 = short_expr;
-      attr2 =
-        if true then big_expr else big_expr;
-    };
-
-    # Combined
-    listOfAttrs = [
-      {
-        attr1 = 3;
-        attr2 = "fff";
-      }
-      {
-        attr1 = 5;
-        attr2 = "ggg";
-      }
-    ];
-  }
-  ```
-
- Short lists or attribute sets can be written on one line:
-
-  ```nix
-  {
-    # A short list.
-    list = [ elem1 elem2 elem3 ];
-
-    # A short set.
-    attrs = { x = 1280; y = 1024; };
-  }
-  ```
-
- Breaking in the middle of a function argument can give hard-to-read code, like
-
-  ```nix
-  someFunction { x = 1280;
-    y = 1024; } otherArg
-    yetAnotherArg
-  ```
-
-  (especially if the argument is very large, spanning multiple lines).
-
-  Better:
-
-  ```nix
-  someFunction
-    { x = 1280; y = 1024; }
-    otherArg
-    yetAnotherArg
-  ```
-
-  or
-
-  ```nix
-  let res = { x = 1280; y = 1024; };
-  in someFunction res otherArg yetAnotherArg
-  ```
-
- The bodies of functions, asserts, and withs are not indented to prevent a lot of superfluous indentation levels, i.e.
-
-  ```nix
-  { arg1, arg2 }:
-  assert system == "i686-linux";
-  stdenv.mkDerivation { /* ... */ }
-  ```
-
-  not
-
-  ```nix
-  { arg1, arg2 }:
-    assert system == "i686-linux";
-      stdenv.mkDerivation { /* ... */ }
-  ```
-
- Function formal arguments are written as:
-
-  ```nix
-  { arg1, arg2, arg3 }: { /* ... */ }
-  ```
-
-  but if they don't fit on one line they're written as:
-
-  ```nix
-  { arg1, arg2, arg3
-  , arg4
-  # Some comment...
-  ,  argN
-  }: { }
-  ```
+- New files must be formatted by entering the `nix-shell` from the repository root and running `nixfmt`.

 - Functions should list their expected arguments as precisely as possible. That is, write

--- a/doc/README.md
+++ b/doc/README.md
@ -293,7 +293,7 @@ Though this is not shown in the rendered documentation on nixos.org.

 #### Figures

-To define a referencable figure use the following fencing:
+To define a referenceable figure use the following fencing:

 ```markdown
 ::: {.figure #nixos-logo}
--- a/doc/build-helpers/trivial-build-helpers.chapter.md
+++ b/doc/build-helpers/trivial-build-helpers.chapter.md
@ -241,7 +241,7 @@ Write a text file to the Nix store.
 `allowSubstitutes` (Bool, _optional_)

 : Whether to allow substituting from a binary cache.
-  Passed through to [`allowSubsitutes`](https://nixos.org/manual/nix/stable/language/advanced-attributes#adv-attr-allowSubstitutes) of the underlying call to `builtins.derivation`.
+  Passed through to [`allowSubstitutes`](https://nixos.org/manual/nix/stable/language/advanced-attributes#adv-attr-allowSubstitutes) of the underlying call to `builtins.derivation`.

  It defaults to `false`, as running the derivation's simple `builder` executable locally is assumed to be faster than network operations.
  Set it to true if the `checkPhase` step is expensive.
@ -453,7 +453,7 @@ writeTextFile {

 ### `writeScriptBin` {#trivial-builder-writeScriptBin}

-Write a script within a `bin` subirectory of a directory in the Nix store.
+Write a script within a `bin` subdirectory of a directory in the Nix store.
 This is for consistency with the convention of software packages placing executables under `bin`.

 `writeScriptBin` takes the following arguments:
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@ -233,7 +233,7 @@ If these are not defined, `npm pack` may miss some files, and no binaries will b
 * `npmPruneFlags`: Flags to pass to `npm prune`. Defaults to the value of `npmInstallFlags`.
 * `makeWrapperArgs`: Flags to pass to `makeWrapper`, added to executable calling the generated `.js` with `node` as an interpreter. These scripts are defined in `package.json`.
 * `nodejs`: The `nodejs` package to build against, using the corresponding `npm` shipped with that version of `node`. Defaults to `pkgs.nodejs`.
-* `npmDeps`: The dependencies used to build the npm package. Especially useful to not have to recompute workspace depedencies.
+* `npmDeps`: The dependencies used to build the npm package. Especially useful to not have to recompute workspace dependencies.

 #### prefetch-npm-deps {#javascript-buildNpmPackage-prefetch-npm-deps}

--- a/doc/languages-frameworks/nim.section.md
+++ b/doc/languages-frameworks/nim.section.md
@ -88,7 +88,7 @@ For example, to propagate a dependency on SDL2 for lockfiles that select the Nim
 }
 ```

-The annotations in the `nim-overrides.nix` set are functions that take two arguments and return a new attrset to be overlayed on the package being built.
+The annotations in the `nim-overrides.nix` set are functions that take two arguments and return a new attrset to be overlaid on the package being built.
 - lockAttrs: the attrset for this library from within a lockfile. This can be used to implement library version constraints, such as marking libraries as broken or insecure.
 - prevAttrs: the attrset produced by initial arguments to `buildNimPackage` and any preceding lockfile overlays.

--- a/doc/stdenv/meta.chapter.md
+++ b/doc/stdenv/meta.chapter.md
@ -81,6 +81,12 @@ The license, or licenses, for the package. One from the attribute set defined in

 For details, see [Licenses](#sec-meta-license).

+### `sourceProvenance` {#var-meta-sourceProvenance}
+
+A list containing the type or types of source inputs from which the package is built, e.g. original source code, pre-built binaries, etc.
+
+For details, see [Source provenance](#sec-meta-sourceProvenance).
+
 ### `maintainers` {#var-meta-maintainers}

 A list of the maintainers of this Nix expression. Maintainers are defined in [`nixpkgs/maintainers/maintainer-list.nix`](https://github.com/NixOS/nixpkgs/blob/master/maintainers/maintainer-list.nix). There is no restriction to becoming a maintainer, just add yourself to that list in a separate commit titled “maintainers: add alice” in the same pull request, and reference maintainers with `maintainers = with lib.maintainers; [ alice bob ]`.
--- a/lib/default.nix
+++ b/lib/default.nix
@ -105,7 +105,7 @@ let
      hasInfix hasPrefix hasSuffix stringToCharacters stringAsChars escape
      escapeShellArg escapeShellArgs
      isStorePath isStringLike
-      isValidPosixName toShellVar toShellVars
+      isValidPosixName toShellVar toShellVars trim trimWith
      escapeRegex escapeURL escapeXML replaceChars lowerChars
      upperChars toLower toUpper addContextFrom splitString
      removePrefix removeSuffix versionOlder versionAtLeast
@ -123,7 +123,7 @@ let
    inherit (self.derivations) lazyDerivation optionalDrvAttr;
    inherit (self.meta) addMetaAttrs dontDistribute setName updateName
      appendToName mapDerivationAttrset setPrio lowPrio lowPrioSet hiPrio
-      hiPrioSet getLicenseFromSpdxId getExe getExe';
+      hiPrioSet getLicenseFromSpdxId getLicenseFromSpdxIdOr getExe getExe';
    inherit (self.filesystem) pathType pathIsDirectory pathIsRegularFile
      packagesFromDirectoryRecursive;
    inherit (self.sources) cleanSourceFilter
--- a/lib/fileset/README.md
+++ b/lib/fileset/README.md
@ -236,7 +236,7 @@ File sets cannot add single files to the store, they can only import files under
 Arguments:
 - (+) There's no point in using this library for a single file, since you can't do anything other than add it to the store or not.
  And it would be unclear how the library should behave if the one file wouldn't be added to the store:
-  `toSource { root = ./file.nix; fileset = <empty>; }` has no reasonable result because returing an empty store path wouldn't match the file type, and there's no way to have an empty file store path, whatever that would mean.
+  `toSource { root = ./file.nix; fileset = <empty>; }` has no reasonable result because returning an empty store path wouldn't match the file type, and there's no way to have an empty file store path, whatever that would mean.

 ### `fileFilter` takes a path

--- a/lib/meta.nix
+++ b/lib/meta.nix
@ -287,10 +287,10 @@ rec {
    all (elem: !platformMatch platform elem) (pkg.meta.badPlatforms or []);

  /**
-    Get the corresponding attribute in lib.licenses
-    from the SPDX ID.
-    For SPDX IDs, see
-    https://spdx.org/licenses
+    Get the corresponding attribute in lib.licenses from the SPDX ID
+    or warn and fallback to `{ shortName = <license string>; }`.
+
+    For SPDX IDs, see https://spdx.org/licenses

    # Type

@ -315,15 +315,57 @@ rec {
    :::
  */
  getLicenseFromSpdxId =
-    let
-      spdxLicenses = lib.mapAttrs (id: ls: assert lib.length ls == 1; builtins.head ls)
-        (lib.groupBy (l: lib.toLower l.spdxId) (lib.filter (l: l ? spdxId) (lib.attrValues lib.licenses)));
-    in licstr:
-      spdxLicenses.${ lib.toLower licstr } or (
+    licstr:
+      getLicenseFromSpdxIdOr licstr (
        lib.warn "getLicenseFromSpdxId: No license matches the given SPDX ID: ${licstr}"
        { shortName = licstr; }
      );

+  /**
+    Get the corresponding attribute in lib.licenses from the SPDX ID
+    or fallback to the given default value.
+
+    For SPDX IDs, see https://spdx.org/licenses
+
+    # Inputs
+
+    `licstr`
+    : 1\. SPDX ID string to find a matching license
+
+    `default`
+    : 2\. Fallback value when a match is not found
+
+    # Type
+
+    ```
+    getLicenseFromSpdxIdOr :: str -> Any -> Any
+    ```
+
+    # Examples
+    :::{.example}
+    ## `lib.meta.getLicenseFromSpdxIdOr` usage example
+
+    ```nix
+    lib.getLicenseFromSpdxIdOr "MIT" null == lib.licenses.mit
+    => true
+    lib.getLicenseFromSpdxId "mIt" null == lib.licenses.mit
+    => true
+    lib.getLicenseFromSpdxIdOr "MY LICENSE" lib.licenses.free == lib.licenses.free
+    => true
+    lib.getLicenseFromSpdxIdOr "MY LICENSE" null
+    => null
+    lib.getLicenseFromSpdxIdOr "MY LICENSE" (builtins.throw "No SPDX ID matches MY LICENSE")
+    => error: No SPDX ID matches MY LICENSE
+    ```
+    :::
+  */
+  getLicenseFromSpdxIdOr =
+    let
+      spdxLicenses = lib.mapAttrs (id: ls: assert lib.length ls == 1; builtins.head ls)
+        (lib.groupBy (l: lib.toLower l.spdxId) (lib.filter (l: l ? spdxId) (lib.attrValues lib.licenses)));
+    in licstr: default:
+      spdxLicenses.${ lib.toLower licstr } or default;
+
  /**
    Get the path to the main program of a package based on meta.mainProgram

--- a/lib/strings.nix
+++ b/lib/strings.nix
@ -157,6 +157,69 @@ rec {
  */
  replicate = n: s: concatStrings (lib.lists.replicate n s);

+  /*
+    Remove leading and trailing whitespace from a string.
+
+    Whitespace is defined as any of the following characters:
+      " ", "\t" "\r" "\n"
+
+    Type: trim :: string -> string
+
+    Example:
+      trim "   hello, world!   "
+      => "hello, world!"
+  */
+  trim = trimWith {
+    start = true;
+    end = true;
+  };
+
+  /*
+    Remove leading and/or trailing whitespace from a string.
+    To remove both leading and trailing whitespace, you can also use [`trim`](#function-library-lib.strings.trim)
+
+    Whitespace is defined as any of the following characters:
+      " ", "\t" "\r" "\n"
+
+    Type: trimWith :: { start ? false, end ? false } -> string -> string
+
+    Example:
+      trimWith { start = true; } "   hello, world!   "}
+      => "hello, world!   "
+      trimWith { end = true; } "   hello, world!   "}
+      => "   hello, world!"
+  */
+  trimWith =
+    {
+      # Trim leading whitespace (`false` by default)
+      start ? false,
+      # Trim trailing whitespace (`false` by default)
+      end ? false,
+    }:
+    s:
+    let
+      # Define our own whitespace character class instead of using
+      # `[:space:]`, which is not well-defined.
+      chars = " \t\r\n";
+
+      # To match up until trailing whitespace, we need to capture a
+      # group that ends with a non-whitespace character.
+      regex =
+        if start && end then
+          "[${chars}]*(.*[^${chars}])[${chars}]*"
+        else if start then
+          "[${chars}]*(.*)"
+        else if end then
+          "(.*[^${chars}])[${chars}]*"
+        else
+          "(.*)";
+
+      # If the string was empty or entirely whitespace,
+      # then the regex may not match and `res` will be `null`.
+      res = match regex s;
+    in
+      optionalString (res != null) (head res);
+
  /* Construct a Unix-style, colon-separated search path consisting of
     the given `subDir` appended to each of the given paths.

--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@ -58,6 +58,7 @@ let
    genList
    getExe
    getExe'
+    getLicenseFromSpdxIdOr
    groupBy
    groupBy'
    hasAttrByPath
@ -368,6 +369,72 @@ runTests {
    expected = "hellohellohellohellohello";
  };

+  # Test various strings are trimmed correctly
+  testTrimString = {
+    expr =
+    let
+      testValues = f: mapAttrs (_: f) {
+        empty = "";
+        cr = "\r";
+        lf = "\n";
+        tab = "\t";
+        spaces = "   ";
+        leading = "  Hello, world";
+        trailing = "Hello, world   ";
+        mixed = " Hello, world ";
+        mixed-tabs = " \t\tHello, world \t \t ";
+        multiline = "  Hello,\n  world!  ";
+        multiline-crlf = "  Hello,\r\n  world!  ";
+      };
+    in
+      {
+        leading = testValues (strings.trimWith { start = true; });
+        trailing = testValues (strings.trimWith { end = true; });
+        both = testValues strings.trim;
+      };
+    expected = {
+      leading = {
+        empty = "";
+        cr = "";
+        lf = "";
+        tab = "";
+        spaces = "";
+        leading = "Hello, world";
+        trailing = "Hello, world   ";
+        mixed = "Hello, world ";
+        mixed-tabs = "Hello, world \t \t ";
+        multiline = "Hello,\n  world!  ";
+        multiline-crlf = "Hello,\r\n  world!  ";
+      };
+      trailing = {
+        empty = "";
+        cr = "";
+        lf = "";
+        tab = "";
+        spaces = "";
+        leading = "  Hello, world";
+        trailing = "Hello, world";
+        mixed = " Hello, world";
+        mixed-tabs = " \t\tHello, world";
+        multiline = "  Hello,\n  world!";
+        multiline-crlf = "  Hello,\r\n  world!";
+      };
+      both = {
+        empty = "";
+        cr = "";
+        lf = "";
+        tab = "";
+        spaces = "";
+        leading = "Hello, world";
+        trailing = "Hello, world";
+        mixed = "Hello, world";
+        mixed-tabs = "Hello, world";
+        multiline = "Hello,\n  world!";
+        multiline-crlf = "Hello,\r\n  world!";
+      };
+    };
+  };
+
  testSplitStringsSimple = {
    expr = strings.splitString "." "a.b.c.d";
    expected = [ "a" "b" "c" "d" ];
@ -2323,6 +2390,25 @@ runTests {
    getExe' { type = "derivation"; } "dir/executable"
  );

+  testGetLicenseFromSpdxIdOrExamples = {
+    expr = [
+      (getLicenseFromSpdxIdOr "MIT" null)
+      (getLicenseFromSpdxIdOr "mIt" null)
+      (getLicenseFromSpdxIdOr "MY LICENSE" lib.licenses.free)
+      (getLicenseFromSpdxIdOr "MY LICENSE" null)
+    ];
+    expected = [
+      lib.licenses.mit
+      lib.licenses.mit
+      lib.licenses.free
+      null
+    ];
+  };
+
+  testGetLicenseFromSpdxIdOrThrow = testingThrow (
+    getLicenseFromSpdxIdOr "MY LICENSE" (throw "No SPDX ID matches MY LICENSE")
+  );
+
  testPlatformMatch = {
    expr = meta.platformMatch { system = "x86_64-linux"; } "x86_64-linux";
    expected = true;
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -17414,6 +17414,12 @@
    githubId = 1080963;
    name = "Roberto";
  };
+  robertrichter = {
+    email = "robert.richter@rrcomtech.com";
+    github = "rrcomtech";
+    githubId = 50635122;
+    name = "Robert Richter";
+  };
  robgssp = {
    email = "robgssp@gmail.com";
    github = "robgssp";
@ -18222,6 +18228,12 @@
    githubId = 11587657;
    keys = [ { fingerprint = "E173 237A C782 296D 98F5  ADAC E13D FD4B 4712 7951"; } ];
  };
+  scvalex = {
+    name = "Alexandru Scvorțov";
+    email = "github@abstractbinary.org";
+    github = "scvalex";
+    githubId = 2588;
+  };
  sdaqo = {
    name = "sdaqo";
    email = "sdaqo.dev@protonmail.com";
--- a/nixos/doc/manual/configuration/luks-file-systems.section.md
+++ b/nixos/doc/manual/configuration/luks-file-systems.section.md
@ -90,7 +90,7 @@ as [Trezor](https://trezor.io/).

 ### systemd Stage 1 {#sec-luks-file-systems-fido2-systemd}

-If systemd stage 1 is enabled, it handles unlocking of LUKS-enrypted volumes
+If systemd stage 1 is enabled, it handles unlocking of LUKS-encrypted volumes
 during boot. The following example enables systemd stage1 and adds support for
 unlocking the existing LUKS2 volume `root` using any enrolled FIDO2 compatible
 tokens.
--- a/nixos/doc/manual/development/unit-handling.section.md
+++ b/nixos/doc/manual/development/unit-handling.section.md
@ -75,7 +75,7 @@ units".

 "Normal" systemd units, by default, are ordered AFTER `sysinit.target`. In
 other words, these "normal" units expect all services ordered before
-`sysinit.target` to have finished without explicity declaring this dependency
+`sysinit.target` to have finished without explicitly declaring this dependency
 relationship for each dependency. See the [systemd
 bootup](https://www.freedesktop.org/software/systemd/man/latest/bootup.html)
 for more details on the bootup process.
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -824,7 +824,7 @@ In addition to numerous new and upgraded packages, this release has the followin
  Configurations using this default will print a warning when rebuilt.

 - `security.acme` certificates will now correctly check for CA
-  revokation before reaching their minimum age.
+  revocation before reaching their minimum age.

 - Removing domains from `security.acme.certs._name_.extraDomainNames`
  will now correctly remove those domains during rebuild/renew.
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -365,7 +365,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
  This means that configuration now has to be done using [environment variables](https://hexdocs.pm/livebook/readme.html#environment-variables) instead of command line arguments.
  This has the further consequence that the `livebook` service configuration has changed.

- `lua` interpreters default LUA_PATH and LUA_CPATH are not overriden by nixpkgs
+- `lua` interpreters default LUA_PATH and LUA_CPATH are not overridden by nixpkgs
  anymore, we patch LUA_ROOT instead which is more respectful to upstream.

 - `luarocks-packages-updater`'s .csv format, used to define lua packages to be updated, has changed: `src` (URL of a git repository) has now become `rockspec` (URL of a rockspec) to remove ambiguity regarding which rockspec to use and simplify implementation.
@ -730,7 +730,7 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
 - `services.postgresql.extraPlugins`' type has expanded. Previously it was a list of packages, now it can also be a function that returns such a list.
  For example a config line like ``services.postgresql.extraPlugins = with pkgs.postgresql_11.pkgs; [ postgis ];`` is recommended to be changed to ``services.postgresql.extraPlugins = ps: with ps; [ postgis ];``;

- `services.slskd` has been refactored to include more configuation options in
+- `services.slskd` has been refactored to include more configuration options in
  the free-form `services.slskd.settings` option, and some defaults (including listen ports)
  have been changed to match the upstream defaults. Additionally, disk logging is now
  disabled by default, and the log rotation timer has been removed.
@ -758,7 +758,7 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi

 - `systemd` units can now specify the `Upholds=` and `UpheldBy=` unit dependencies via the aptly
  named `upholds` and `upheldBy` options. These options get systemd to enforce that the
-  dependencies remain continuosly running for as long as the dependent unit is in a running state.
+  dependencies remain continuously running for as long as the dependent unit is in a running state.

 - A stdenv's default set of hardening flags can now be set via its `bintools-wrapper`'s `defaultHardeningFlags` argument. A convenient stdenv adapter, `withDefaultHardeningFlags`, can be used to override an existing stdenv's `defaultHardeningFlags`.

--- a/nixos/modules/services/development/livebook.nix
+++ b/nixos/modules/services/development/livebook.nix
@ -89,6 +89,13 @@ in
        EnvironmentFile = cfg.environmentFile;
        ExecStart = "${cfg.package}/bin/livebook start";
        KillMode = "mixed";
+
+        # Fix for the issue described here:
+        # https://github.com/livebook-dev/livebook/issues/2691
+        #
+        # Without this, the livebook service fails to start and gets
+        # stuck running a `cat /dev/urandom | tr | fold` pipeline.
+        IgnoreSIGPIPE = false;
      };
      environment = mapAttrs (name: value:
        if isBool value then boolToString value else toString value)
@ -98,5 +105,8 @@ in
    };
  };

-  meta.doc = ./livebook.md;
+  meta = {
+    doc = ./livebook.md;
+    maintainers = with lib.maintainers; [ munksgaard scvalex ];
+  };
 }
--- a/nixos/modules/services/misc/jackett.nix
+++ b/nixos/modules/services/misc/jackett.nix
@ -11,6 +11,14 @@ in
    services.jackett = {
      enable = mkEnableOption "Jackett, API support for your favorite torrent trackers";

+      port = mkOption {
+        default = 9117;
+        type = types.port;
+        description = ''
+          Port serving the web interface
+        '';
+      };
+
      dataDir = mkOption {
        type = types.str;
        default = "/var/lib/jackett/.config/Jackett";
@ -53,13 +61,13 @@ in
        Type = "simple";
        User = cfg.user;
        Group = cfg.group;
-        ExecStart = "${cfg.package}/bin/Jackett --NoUpdates --DataFolder '${cfg.dataDir}'";
+        ExecStart = "${cfg.package}/bin/Jackett --NoUpdates --Port ${toString cfg.port} --DataFolder '${cfg.dataDir}'";
        Restart = "on-failure";
      };
    };

    networking.firewall = mkIf cfg.openFirewall {
-      allowedTCPPorts = [ 9117 ];
+      allowedTCPPorts = [ cfg.port ];
    };

    users.users = mkIf (cfg.user == "jackett") {
--- a/nixos/modules/services/misc/radicle.nix
+++ b/nixos/modules/services/misc/radicle.nix
@ -137,7 +137,7 @@ in
      node = {
        listenAddress = mkOption {
          type = types.str;
-          default = "0.0.0.0";
+          default = "[::]";
          example = "127.0.0.1";
          description = "The IP address on which `radicle-node` listens.";
        };
@ -180,6 +180,14 @@ in
          See https://app.radicle.xyz/nodes/seed.radicle.garden/rad:z3gqcJUoA1n9HaHKufZs5FCSGazv5/tree/radicle/src/node/config.rs#L275
        '';
        default = { };
+        example = literalExpression ''
+          {
+            web.pinned.repositories = [
+              "rad:z3gqcJUoA1n9HaHKufZs5FCSGazv5" # heartwood
+              "rad:z3trNYnLWS11cJWC6BbxDs5niGo82" # rips
+            ];
+          }
+        '';
        type = types.submodule {
          freeformType = json.type;
        };
--- a/nixos/modules/services/web-apps/freshrss.nix
+++ b/nixos/modules/services/web-apps/freshrss.nix
@ -281,7 +281,10 @@ in
              ${if cfg.database.passFile != null then "--db-password" else null} = ''"$(cat ${cfg.database.passFile})"'';
              ${if cfg.database.user != null then "--db-user" else null} = ''"${cfg.database.user}"'';
              ${if cfg.database.tableprefix != null then "--db-prefix" else null} = ''"${cfg.database.tableprefix}"'';
+              # hostname:port e.g. "localhost:5432"
              ${if cfg.database.host != null && cfg.database.port != null then "--db-host" else null} = ''"${cfg.database.host}:${toString cfg.database.port}"'';
+              # socket path e.g. "/run/postgresql"
+              ${if cfg.database.host != null && cfg.database.port == null then "--db-host" else null} = ''"${cfg.database.host}"'';
            });
        in
        {
--- a/nixos/tests/jackett.nix
+++ b/nixos/tests/jackett.nix
@ -1,17 +1,21 @@
 import ./make-test-python.nix ({ lib, ... }:

-{
+let
+  jackettPort = 9117;
+in {
  name = "jackett";
  meta.maintainers = with lib.maintainers; [ etu ];

  nodes.machine =
-    { pkgs, ... }:
-    { services.jackett.enable = true; };
+    { pkgs, ... }: {
+      services.jackett.enable = true;
+      services.jackett.port = jackettPort;
+    };

  testScript = ''
    machine.start()
    machine.wait_for_unit("jackett.service")
-    machine.wait_for_open_port(9117)
-    machine.succeed("curl --fail http://localhost:9117/")
+    machine.wait_for_open_port(${toString jackettPort})
+    machine.succeed("curl --fail http://localhost:${toString jackettPort}/")
  '';
 })
--- a/nixos/tests/livebook-service.nix
+++ b/nixos/tests/livebook-service.nix
@ -11,9 +11,6 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
        enableUserService = true;
        environment = {
          LIVEBOOK_PORT = 20123;
-          LIVEBOOK_COOKIE = "chocolate chip";
-          LIVEBOOK_TOKEN_ENABLED = true;
-
        };
        environmentFile = pkgs.writeText "livebook.env" ''
          LIVEBOOK_PASSWORD = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
@ -38,7 +35,7 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {

      machine.succeed("loginctl enable-linger alice")
      machine.wait_until_succeeds("${sudo} systemctl --user is-active livebook.service")
-      machine.wait_for_open_port(20123)
+      machine.wait_for_open_port(20123, timeout=10)

      machine.succeed("curl -L localhost:20123 | grep 'Type password'")
    '';
--- a/pkgs/applications/blockchains/alfis/Cargo.lock
+++ b/pkgs/applications/blockchains/alfis/Cargo.lock
--- a/pkgs/applications/blockchains/alfis/default.nix
+++ b/pkgs/applications/blockchains/alfis/default.nix
@ -15,20 +15,20 @@

 rustPlatform.buildRustPackage rec {
  pname = "alfis";
-  version = "0.8.4-unstable-2024-03-08";
+  version = "0.8.5";

  src = fetchFromGitHub {
    owner = "Revertron";
    repo = "Alfis";
-    rev = "28431ec0530405782038e7c02c2dedc3086bd7c9";
-    hash = "sha256-HL4RRGXE8PIcD+zTF1xZSyOpKMhKF75Mxm6KLGsR4Hc=";
+    rev = "v${version}";
+    hash = "sha256-ettStNktSDZnYNN/IWqTB1Ou1g1QEGFabS4EatnDLaE=";
  };

  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "ecies-ed25519-ng-0.5.2" = "sha256-E+jVbgKKK1DnJWAJN+xGZPCV2n7Gxp2t7XXkDNDnPN4=";
-      "ureq-2.9.1" = "sha256-ATT2wJ9kmY/Jjw6FEbxqM9pDytKFLmu/ZqH/pJpZTu8=";
+      "ecies-ed25519-ng-0.5.3" = "sha256-sJZ5JCaGNa3DdAaHw7/2qeLYv+HDKEMcY4uHbzfzQBM=";
+      "ureq-2.10.0" = "sha256-XNjY8qTgt2OzlfKu7ECIfgRLkSlprvjpgITsNVMi1uc=";
      "web-view-0.7.3" = "sha256-eVMcpMRZHwOdWhfV6Z1uGUNOmhB41YZPaiz1tRQvhrI=";
    };
  };
--- a/pkgs/applications/blockchains/optimism/default.nix
+++ b/pkgs/applications/blockchains/optimism/default.nix
@ -6,19 +6,19 @@

 buildGoModule rec {
  pname = "optimism";
-  version = "1.7.7";
+  version = "1.8.0";

  src = fetchFromGitHub {
    owner = "ethereum-optimism";
    repo = "optimism";
    rev = "op-node/v${version}";
-    hash = "sha256-KN6Y8YhYGNGg/t4t599RAo6mF7Wn7GaSnrLEk3WLekc=";
+    hash = "sha256-sryXVqbAvmHIOg8osBecmU6/TIZjJvcFipimWMcHqME=";
    fetchSubmodules = true;
  };

  subPackages = [ "op-node/cmd" "op-proposer/cmd" "op-batcher/cmd" ];

-  vendorHash = "sha256-MWGjRj5SMFi3O86l3Gc/oavzWd1TtoKr53eEXbCOamQ=";
+  vendorHash = "sha256-UQ/appKaBvHkya9RNIYvSd4E+22DDFjJgJ3g82IShNY=";

  buildInputs = [
    libpcap
--- a/pkgs/applications/editors/eclipse/default.nix
+++ b/pkgs/applications/editors/eclipse/default.nix
@ -241,6 +241,6 @@ in rec {

  ### Plugins

-  plugins = callPackage ./plugins.nix { } // { __attrsFailEvaluation = true; };
+  plugins = callPackage ./plugins.nix { };

 }
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/el-easydraw/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/el-easydraw/default.nix
@ -8,13 +8,13 @@

 melpaBuild {
  pname = "edraw";
-  version = "1.2.0-unstable-2024-07-01";
+  version = "1.2.0-unstable-2024-07-24";

  src = fetchFromGitHub {
    owner = "misohena";
    repo = "el-easydraw";
-    rev = "a6c849619abcdd80dc82ec5417195414ad438fa3";
-    hash = "sha256-CbcI1mmghc3HObg80bjScVDcJ1DHx9aX1WP2HlhAshs=";
+    rev = "6f93e744d5f62de2176d3d0f0aa1f9e8d84ccefd";
+    hash = "sha256-dXu4hDC4qE7W+KkWb9HIqYwesOKisMiZSTAulDpjyfA=";
  };

  propagatedUserEnvPkgs = [ gzip ];
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/git-undo/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/git-undo/default.nix
@ -7,13 +7,13 @@

 melpaBuild {
  pname = "git-undo";
-  version = "0-unstable-2019-12-21";
+  version = "0-unstable-2022-08-07";

  src = fetchFromGitHub {
    owner = "jwiegley";
    repo = "git-undo-el";
-    rev = "cf31e38e7889e6ade7d2d2b9f8719fd44f52feb5";
-    hash = "sha256-cVkK9EF6qQyVV3uVqnBEjF8e9nEx/8ixnM8PvxqCyYE=";
+    rev = "3d9c95fc40a362eae4b88e20ee21212d234a9ee6";
+    hash = "sha256-xwVCAdxnIRHrFNWvtlM3u6CShsUiGgl1CiBTsp2x7IM=";
  };

  passthru.updateScript = unstableGitUpdater { hardcodeZeroVersion = true; };
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/isearch-plus/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/isearch-plus/default.nix
@ -8,13 +8,13 @@
 melpaBuild {
  pname = "isearch-plus";
  ename = "isearch+";
-  version = "3434-unstable-2021-08-23";
+  version = "3434-unstable-2023-09-27";

  src = fetchFromGitHub {
    owner = "emacsmirror";
    repo = "isearch-plus";
-    rev = "93088ea0ac4d51bdb76c4c32ea53172f6c435852";
-    hash = "sha256-kD+Fyps3fc5YK6ATU1nrkKHazGMYJnU2gRcpQZf6A1E=";
+    rev = "b10a36fb6bb8b45ff9d924107384e3bf0cee201d";
+    hash = "sha256-h/jkIWjkLFbtBp9F+lhA3CulYy2XaeloLmexR0CDm3E=";
  };

  passthru.updateScript = unstableGitUpdater { };
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -6168,6 +6168,18 @@ final: prev:
    meta.homepage = "https://github.com/savq/melange-nvim/";
  };

+  messenger-nvim = buildVimPlugin {
+    pname = "messenger.nvim";
+    version = "2024-07-18";
+    src = fetchFromGitHub {
+      owner = "lsig";
+      repo = "messenger.nvim";
+      rev = "309fec2ddd3de55eba2781b676931b37ce8190af";
+      sha256 = "1ycvxxcp04hh134nazdrzd9g98mkdipc2p0amvcphpqr9p9s3pcm";
+    };
+    meta.homepage = "https://github.com/lsig/messenger.nvim/";
+  };
+
  miasma-nvim = buildVimPlugin {
    pname = "miasma.nvim";
    version = "2023-10-24";
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -517,6 +517,7 @@ https://github.com/kaicataldo/material.vim/,HEAD,
 https://github.com/vim-scripts/mayansmoke/,,
 https://github.com/chikamichi/mediawiki.vim/,HEAD,
 https://github.com/savq/melange-nvim/,,
+https://github.com/lsig/messenger.nvim/,HEAD,
 https://github.com/xero/miasma.nvim/,,
 https://github.com/dasupradyumna/midnight.nvim/,,
 https://github.com/phaazon/mind.nvim/,HEAD,
--- a/pkgs/applications/misc/cotp/default.nix
+++ b/pkgs/applications/misc/cotp/default.nix
@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cotp";
-  version = "1.7.2";
+  version = "1.7.3";

  src = fetchFromGitHub {
    owner = "replydev";
    repo = "cotp";
    rev = "v${version}";
-    hash = "sha256-U+rOwBxT3on1hUlkb93sgdYIpPTOHb42x1cibueGDn0=";
+    hash = "sha256-CBe/K06z4oqpiwHKwAkWdp+zwAV6Qzne6T/xSSIRz7Y=";
  };

-  cargoHash = "sha256-mdcQSmTLU2bj+wEyzgqFJpjBEesD7zPDVHziNkTIR+s=";
+  cargoHash = "sha256-OMQnmZacHNTGAyBoTLulvwXb6DELFag70m5C75FQ648=";

  buildInputs = lib.optionals stdenv.isLinux [ libxcb ]
    ++ lib.optionals stdenv.isDarwin [ AppKit ];
--- a/pkgs/applications/misc/diebahn/default.nix
+++ b/pkgs/applications/misc/diebahn/default.nix
@ -21,19 +21,19 @@

 stdenv.mkDerivation rec {
  pname = "diebahn";
-  version = "2.6.0";
+  version = "2.7.0";

  src = fetchFromGitLab {
    owner = "schmiddi-on-mobile";
    repo = "railway";
    rev = version;
-    hash = "sha256-cVCq7iVurX5SlCs7A5FSds6KaxMW3Qv/JIhhO69FTrk=";
+    hash = "sha256-ps55DiAsetmdcItZKcfyYDD0q0w1Tkf/U48UR/zQx1g=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    name = "${pname}-${src}";
    inherit src;
-    hash = "sha256-J8KOmvSiUNBpt4qSFnNEwSKFJMSaTFd14G2INDYwPUE=";
+    hash = "sha256-StJxWasUMj9kh9rLs4LFI3XaZ1Z5pvFBjEjtp79WZjg=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/gum/default.nix
+++ b/pkgs/applications/misc/gum/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "gum";
-  version = "0.14.1";
+  version = "0.14.3";

  src = fetchFromGitHub {
    owner = "charmbracelet";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-rQSSbDHMSWJDSxn/SNNMaOrdZJUhQPnZutmpY9828t0=";
+    hash = "sha256-cSPzbPGUwgvaFJ4qp9Dmm+hwORI5ndFqXjuAjjPwFeQ=";
  };

-  vendorHash = "sha256-pkQ8UvWLIWH8gXux/dd0HLdiz7RDrmFJ8SX63Q+nNyw=";
+  vendorHash = "sha256-1M+qg20OMeOzxwTkYVROYAhK6lHhXoZ5bAnU2PNaYPQ=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/applications/misc/raider/default.nix
+++ b/pkgs/applications/misc/raider/default.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "raider";
-  version = "3.0.0";
+  version = "3.0.1";

  src = fetchFromGitHub {
    owner = "ADBeveridge";
    repo = "raider";
    rev = "v${version}";
-    hash = "sha256-zqM2B1M7E4CRupd09rvFYG7H7wBd2hTWnjN3xadS36w=";
+    hash = "sha256-LkGSEUoruWfEq/ttM3LkA/UjHc3ZrlvGF44HsJLntAo=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/tipp10/default.nix
+++ b/pkgs/applications/misc/tipp10/default.nix
@ -15,12 +15,12 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ cmake qttools wrapQtAppsHook ];
  buildInputs = [ qtmultimedia ];

-  meta = with lib; {
+  meta = {
    description = "Learn and train typing with the ten-finger system";
    mainProgram = "tipp10";
    homepage = "https://gitlab.com/tipp10/tipp10";
-    license = licenses.gpl2Only;
-    maintainers = with maintainers; [ sigmanificient ];
-    platforms = platforms.all;
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ sigmanificient ];
+    platforms = lib.platforms.all;
  };
 }
--- a/pkgs/applications/networking/cluster/civo/default.nix
+++ b/pkgs/applications/networking/cluster/civo/default.nix
@ -42,6 +42,6 @@ buildGoModule rec {
    mainProgram = "civo";
    homepage = "https://github.com/civo/cli";
    license = licenses.asl20;
-    maintainers = with maintainers; [ berryp ];
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/applications/networking/cluster/k3s/docs/ONBOARDING_MAINTAINER.md
+++ b/pkgs/applications/networking/cluster/k3s/docs/ONBOARDING_MAINTAINER.md
@ -24,13 +24,13 @@ Only consensus is required to move forward any proposal. Consensus meaning the a

 If you cause a regression (we've all been there), you are responsible for fixing it, but in case you can't fix it (it happens), feel free to ask for help. That's fine, just let us know.

-To merge code, you need to be a commiter, or use the merge-bot, but currently the merge-bot only works for packages located at `pkgs/by-name/`, which means, K3s still need to be migrated there before you can use merge-bot for merging. As a non-commiter, once you have approved a PR you need to forward the request to a commiter. For deciding which commiter, give preference initially to K3s commiters, but any commiter can commit. A commiter usually has a green approval in PRs.
+To merge code, you need to be a committer, or use the merge-bot, but currently the merge-bot only works for packages located at `pkgs/by-name/`, which means, K3s still need to be migrated there before you can use merge-bot for merging. As a non-committer, once you have approved a PR you need to forward the request to a committer. For deciding which committer, give preference initially to K3s committers, but any committer can commit. A committer usually has a green approval in PRs.

-K3s's commiters currently are: superherointj, marcusramberg, Mic92.
+K3s's committers currently are: superherointj, marcusramberg, Mic92.

@euank is often silent but still active and has always handled anything dreadful, internal parts of K3s/Kubernetes or architecture things, he initially packaged K3s for nixpkgs, think of him as a last resort, when we fail to accomplish a fix, he comes to rescue us from ourselves.

-@mic92 stepped up when @superherointj stepped down a time ago, as Mic92 has a broad responsibility in nixpkgs (he is responsible for far too many things already, nixpkgs-reviews, sops-nix, release manager, bot-whatever), we avoid giving him chore work for `nixos-unstable`, only pick him as commiter last. As Mic92 runs K3s in a `nixos-stable` setting, he might help in testing stable backports.
+@mic92 stepped up when @superherointj stepped down a time ago, as Mic92 has a broad responsibility in nixpkgs (he is responsible for far too many things already, nixpkgs-reviews, sops-nix, release manager, bot-whatever), we avoid giving him chore work for `nixos-unstable`, only pick him as committer last. As Mic92 runs K3s in a `nixos-stable` setting, he might help in testing stable backports.

 On how to handle requests, it's the usual basics, such as, when reviewing PRs, issues, be welcoming, helpful, provide hints whenever possible, try to move things forward, assume good will, ignore [as don't react to] any negativity [since it spirals badly], delay and sort any (severe) disagreement in private. Even on disagrements, be thankful to people for their dedicated time, no matter what happens. In essence, on any unfortunate event, **always put people over code**.

--- a/pkgs/applications/networking/cluster/k3s/docs/VERSIONING.md
+++ b/pkgs/applications/networking/cluster/k3s/docs/VERSIONING.md
@ -11,7 +11,7 @@ afoul of the upstream version skew policy.

 ## Patch Release Support Lifecycle

-K3s is built on top of K8s and typically provides a similar release cadence and support window (simply by cherry-picking over k8s patches). As such, we assume k3s's support lifecycle is identical to upstream K8s. The upstream K8s release and support lifecycle, including maintenance and end-of-life dates for current releases, is documented [on their suppport site](https://kubernetes.io/releases/patch-releases/#support-period). A more tabular view of the current support timeline can also be found on [endoflife.date](https://endoflife.date/kubernetes).
+K3s is built on top of K8s and typically provides a similar release cadence and support window (simply by cherry-picking over k8s patches). As such, we assume k3s's support lifecycle is identical to upstream K8s. The upstream K8s release and support lifecycle, including maintenance and end-of-life dates for current releases, is documented [on their support site](https://kubernetes.io/releases/patch-releases/#support-period). A more tabular view of the current support timeline can also be found on [endoflife.date](https://endoflife.date/kubernetes).

 In short, a new Kubernetes version is released roughly every 4 months and each release is supported for a little over 1 year.

--- a/pkgs/applications/networking/cluster/pluto/default.nix
+++ b/pkgs/applications/networking/cluster/pluto/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "pluto";
-  version = "5.19.4";
+  version = "5.20";

  src = fetchFromGitHub {
    owner = "FairwindsOps";
    repo = "pluto";
    rev = "v${version}";
-    hash = "sha256-PhP3ILOYv+7gmxOJLCgIYp+1FIJirZo7TZJoZv8A1WM=";
+    hash = "sha256-OoWeyt1lZ3ivo1uSOTwzGJranf6fGYJGjHXIDItg6yc=";
  };

-  vendorHash = "sha256-EVlYhlEXwgUfRaxAJ3dBTz6MJ2QITZtnHVcQQN1cHbk=";
+  vendorHash = "sha256-AVFMUO/5OUqO4zPH53FHWldfRrmHK3Oj+De78m+yhpE=";

  ldflags = [
    "-w" "-s"
--- a/pkgs/applications/networking/cluster/yor/default.nix
+++ b/pkgs/applications/networking/cluster/yor/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "yor";
-  version = "0.1.196";
+  version = "0.1.198";

  src = fetchFromGitHub {
    owner = "bridgecrewio";
    repo = pname;
    rev = version;
-    hash = "sha256-3jM5UaI8kmcW4z9YU7GJKHCNoX10BpO10C47/b/1I74=";
+    hash = "sha256-Af/k9O+wIEgBfpa3VffZx4mbjQGypfb5z0GWbhTOLxY=";
  };

  vendorHash = "sha256-uT/jGD4hDVes4h+mlSIT2p+C9TjxnUWsmKv9haPjjLc=";
--- a/pkgs/applications/networking/instant-messengers/cinny-desktop/Cargo.lock
+++ b/pkgs/applications/networking/instant-messengers/cinny-desktop/Cargo.lock
--- a/pkgs/applications/networking/instant-messengers/cinny-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/cinny-desktop/default.nix
@ -21,19 +21,18 @@
 rustPlatform.buildRustPackage rec {
  pname = "cinny-desktop";
  # We have to be using the same version as cinny-web or this isn't going to work.
-  version = "3.2.0";
+  version = "4.0.3";

  src = fetchFromGitHub {
    owner = "cinnyapp";
    repo = "cinny-desktop";
    rev = "v${version}";
-    hash = "sha256-uHGqvulH7/9JpUjkpcbCh1pPvX4/ndVIKcBXzWmDo+s=";
+    hash = "sha256-05T/2e5+st+vGQuO8lRw6KWz3+Qiqd14dCPvayyz5mo=";
  };

  sourceRoot = "${src.name}/src-tauri";

-  # modififying $cargoDepsCopy requires the lock to be vendored
-  cargoLock.lockFile = ./Cargo.lock;
+  cargoHash = "sha256-bM+V37PJAob/DA2jy2g69zUY99ZyZBzgO6djadbdiJw=";

  postPatch = let
    cinny' =
@ -94,12 +93,12 @@ rustPlatform.buildRustPackage rec {
    })
  ];

-  meta = with lib; {
+  meta = {
    description = "Yet another matrix client for desktop";
    homepage = "https://github.com/cinnyapp/cinny-desktop";
-    maintainers = with maintainers; [ qyriad ];
-    license = licenses.agpl3Only;
-    platforms = platforms.linux ++ platforms.darwin;
+    maintainers = with lib.maintainers; [ qyriad ];
+    license = lib.licenses.agpl3Only;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
    mainProgram = "cinny";
  };
 }
--- a/pkgs/applications/networking/instant-messengers/cinny/default.nix
+++ b/pkgs/applications/networking/instant-messengers/cinny/default.nix
@ -18,16 +18,16 @@ let
 in
 buildNpmPackage rec {
  pname = "cinny";
-  version = "3.2.0";
+  version = "4.0.3";

  src = fetchFromGitHub {
    owner = "cinnyapp";
    repo = "cinny";
    rev = "v${version}";
-    hash = "sha256-wAa7y2mXPkXAfirRSFqwZYIJK0CKDzZG8ULzXzr4zZ4=";
+    hash = "sha256-5Tf1CgB/YAyGVpopHERQ8xNGwklB+f2l+yfgCKsR3I8=";
  };

-  npmDepsHash = "sha256-dVdylvclUIHvF5syVumdxkXR4bG1FA4LOYg3GmnNzXE=";
+  npmDepsHash = "sha256-wtHFqnz5BtMUikdFZyTiLrw+e69WErowYBhu8cnEjkI=";

  # Fix error: no member named 'aligned_alloc' in the global namespace
  env.NIX_CFLAGS_COMPILE = lib.optionalString (
@ -57,11 +57,11 @@ buildNpmPackage rec {
    runHook postInstall
  '';

-  meta = with lib; {
+  meta = {
    description = "Yet another Matrix client for the web";
    homepage = "https://cinny.in/";
-    maintainers = with maintainers; [ abbe ];
-    license = licenses.agpl3Only;
-    platforms = platforms.all;
+    maintainers = with lib.maintainers; [ abbe ];
+    license = lib.licenses.agpl3Only;
+    platforms = lib.platforms.all;
  };
 }
--- a/pkgs/applications/networking/instant-messengers/pidgin/pidgin-plugins/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin/pidgin-plugins/default.nix
@ -14,7 +14,8 @@ lib.makeScope newScope (self:
      plugins = [];
    };

-    pidginPackages = self;
+    # Prevent `pkgs/top-level/release-attrpaths-superset.nix` from recursing here.
+    pidginPackages = self // { pidginPackages = self.pidginPackages // { __attrsFailEvaluation = true; }; };

    pidgin-indicator = callPackage ./pidgin-indicator { };

--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "signalbackup-tools";
-  version = "20240718-1";
+  version = "20240724";

  src = fetchFromGitHub {
    owner = "bepaald";
    repo = pname;
    rev = version;
-    hash = "sha256-FqBKyIRxeRVGxKtBfBO0XX57VzW0XuSKZSLurHh3JNM=";
+    hash = "sha256-fWvmQb8qxuwwShSCQrQnBQuDM2/3lvzsWxXmLq0vXdY=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@ -60,8 +60,8 @@ in rec {
  };

  thunderbird-128 = common {
-    version = "128.0esr";
-    sha512 = "8524fbdcc51eddf83fec439273319315c44e6d3be9e4dcf51e453ced7fd1676abdca44442dcb302c637a98b7873828168f2d2d2b635551e406645a134d09aee0";
+    version = "128.0.1esr";
+    sha512 = "db7507fcfd5bc2dd4ad52eaeb87c575d87cb438765861c468ab17678ca6ab32b28b60d0431ec7f558ea0db90fa59e35a8a4aeba046ebd0b00cfb6d9e8019318e";

    updateScript = callPackage ./update.nix {
      attrPath = "thunderbirdPackages.thunderbird-128";
--- a/pkgs/applications/networking/onionshare/default.nix
+++ b/pkgs/applications/networking/onionshare/default.nix
@ -2,6 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , fetchpatch
+, meek
 , obfs4
 , python3
 , qt5
@ -44,9 +45,6 @@ let
    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ bbjubjub ];
  };
-
-  # TODO: package meek https://support.torproject.org/glossary/meek/
-  meek = "/meek-not-available";
 in
 rec {
  onionshare = python3.pkgs.buildPythonApplication {
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@ -152,7 +152,7 @@ let
    flatten flip
    concatMapStrings concatStringsSep
    getDev getLib
-    optionals optionalString;
+    optionals optionalAttrs optionalString;

  fontsConf = makeFontsConf {
    fontDirectories = [
@ -200,6 +200,7 @@ let
      }) // {
        inherit (x) md5name md5;
      }) srcsAttributes.deps;
+  } // optionalAttrs (variant != "collabora") {
    translations = fetchurl srcsAttributes.translations;
    help = fetchurl srcsAttributes.help;
  };
--- a/pkgs/applications/science/biology/ants/default.nix
+++ b/pkgs/applications/science/biology/ants/default.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ANTs";
-  version = "2.5.2";
+  version = "2.5.3";

  src = fetchFromGitHub {
    owner = "ANTsX";
    repo = "ANTs";
    rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-crvLxUP/uM0u1oakxcpsiULAKUo+86hGATs/kHNseaw=";
+    hash = "sha256-DZzuHMC0XymFCnDn+H1pRFx9jUt+s03PaN88R4ZBRwY=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/math/gurobi/default.nix
+++ b/pkgs/applications/science/math/gurobi/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "gurobi";
-  version = "11.0.2";
+  version = "11.0.3";

  src = fetchurl {
    url = "https://packages.gurobi.com/${lib.versions.majorMinor version}/gurobi${version}_linux64.tar.gz";
-    hash = "sha256-9DrIo+25h7mgphRSrNnY2+nrNzaMbafONuUkfLKho2g=";
+    hash = "sha256-gqLIZxwjS7qp3GTaIrGVGr9BxiBH/fdwBOZfJKkd/RM=";
  };

  sourceRoot = "gurobi${builtins.replaceStrings ["."] [""] version}/linux64";
--- a/pkgs/applications/science/misc/rink/default.nix
+++ b/pkgs/applications/science/misc/rink/default.nix
@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, rustPlatform, openssl, pkg-config, ncurses
-, curl, libiconv, Security }:
+, curl, installShellFiles, asciidoctor, libiconv, Security }:

 rustPlatform.buildRustPackage rec {
  version = "0.8.0";
@ -14,13 +14,21 @@ rustPlatform.buildRustPackage rec {

  cargoHash = "sha256-j1pQfMjDNu57otOBTVBQEZIx80p4/beEUQdUkAJhvso=";

-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config installShellFiles asciidoctor ];
  buildInputs = [ ncurses ]
    ++ (if stdenv.isDarwin then [ curl libiconv Security ] else [ openssl ]);

  # Some tests fail and/or attempt to use internet servers.
  doCheck = false;

+  postBuild = ''
+    make man
+  '';
+
+  postInstall = ''
+    installManPage build/*
+  '';
+
  meta = with lib; {
    description = "Unit-aware calculator";
    mainProgram = "rink";
--- a/pkgs/applications/version-management/commitizen/default.nix
+++ b/pkgs/applications/version-management/commitizen/default.nix
@ -11,7 +11,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "commitizen";
-  version = "3.27.0";
+  version = "3.28.0";
  format = "pyproject";

  disabled = python3.pythonOlder "3.8";
@ -20,7 +20,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "commitizen-tools";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-Bfz9MBpFsbAcsyQ7CYyObE14q7UE9ZyeY1GVFb9maKk=";
+    hash = "sha256-Z/L8TvMoee3qB+P6HUJEQxqw3nDEbBQabQOUyx0iugw=";
  };

  pythonRelaxDeps = [
--- a/pkgs/applications/version-management/git-branchless/default.nix
+++ b/pkgs/applications/version-management/git-branchless/default.nix
@ -1,6 +1,5 @@
 { lib
 , fetchFromGitHub
-, fetchpatch
 , git
 , libiconv
 , ncurses
@ -15,31 +14,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "git-branchless";
-  version = "0.8.0";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "arxanas";
    repo = "git-branchless";
    rev = "v${version}";
-    hash = "sha256-ev56NzrEF7xm3WmR2a0pHPs69Lvmb4He7+kIBYiJjKY=";
+    hash = "sha256-4RRSffkAe0/8k4SNnlB1iiaW4gWFTuYXplVBj2aRIdU=";
  };

-  patches = [
-    # Fix tests with Git 2.44.0+
-    (fetchpatch {
-      name = "1245.patch"; # https://github.com/arxanas/git-branchless/pull/1245
-      url = "https://github.com/arxanas/git-branchless/commit/c8436aed3d616409b4d6fb1eedb383077f435497.patch";
-      hash = "sha256-gBm0A478Uhg9IQVLQppvIeTa8s1yHUMddxiUbpHUvGw=";
-    })
-    # Fix tests with Git 2.44.0+
-    (fetchpatch {
-      name = "1161.patch"; # https://github.com/arxanas/git-branchless/pull/1161
-      url = "https://github.com/arxanas/git-branchless/commit/6e1f26900a0dd60d10d9aa3552cab9181fa7be03.patch";
-      hash = "sha256-KHobEIXhlDar8CvIVUi4I695jcJZXgGRhU86b99x86Y=";
-    })
-  ];
-
-  cargoHash = "sha256-Ppw5TN/6zMNxFAx90Q9hQ7RdGxV+TT8UlOm68ldK8oc=";
+  cargoHash = "sha256-Jg4d7tJXr2O1sEDdB/zk+7TPBZvgHlmW8mNiXozLKV8=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/applications/version-management/git-series/Cargo.lock
+++ b/pkgs/applications/version-management/git-series/Cargo.lock
@ -1,517 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 3
-
-[[package]]
-name = "ansi_term"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23ac7c30002a5accbf7e8987d0632fa6de155b7c3d39d0067317a391e00a2ef6"
-
-[[package]]
-name = "ansi_term"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d52a9bb7ec0cf484c551830a7ce27bd20d67eac647e1befb56b0be4ee39a55d2"
-dependencies = [
- "winapi",
-]
-
-[[package]]
-name = "atty"
-version = "0.2.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
-dependencies = [
- "hermit-abi",
- "libc",
- "winapi",
-]
-
-[[package]]
-name = "autocfg"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
-
-[[package]]
-name = "bitflags"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
-
-[[package]]
-name = "cc"
-version = "1.0.79"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50d30906286121d95be3d479533b458f87493b30a4b5f79a607db8f5d11aa91f"
-dependencies = [
- "jobserver",
-]
-
-[[package]]
-name = "cfg-if"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
-
-[[package]]
-name = "chrono"
-version = "0.2.25"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9213f7cd7c27e95c2b57c49f0e69b1ea65b27138da84a170133fd21b07659c00"
-dependencies = [
- "num",
- "time",
-]
-
-[[package]]
-name = "clap"
-version = "2.34.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0610544180c38b88101fecf2dd634b174a62eef6946f84dfc6a7127512b381c"
-dependencies = [
- "ansi_term 0.12.1",
- "atty",
- "bitflags",
- "strsim",
- "textwrap",
- "unicode-width",
- "vec_map",
-]
-
-[[package]]
-name = "colorparse"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "179f9a3462d05f4c15041d8ba8bd59534731fe6ddd89a65ca61ec67655f37379"
-dependencies = [
- "ansi_term 0.9.0",
-]
-
-[[package]]
-name = "fixedbitset"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "45e780567ed7abc415d12fd464571d265eb4a5710ddc97cdb1a31a4c35bb479d"
-
-[[package]]
-name = "form_urlencoded"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9c384f161156f5260c24a097c56119f9be8c798586aecc13afbcbe7b7e26bf8"
-dependencies = [
- "percent-encoding",
-]
-
-[[package]]
-name = "fuchsia-cprng"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a06f77d526c1a601b7c4cdd98f54b5eaabffc14d5f2f0296febdc7f357c6d3ba"
-
-[[package]]
-name = "git-series"
-version = "0.9.1"
-dependencies = [
- "ansi_term 0.9.0",
- "atty",
- "chrono",
- "clap",
- "colorparse",
- "git2",
- "munkres",
- "quick-error",
- "tempdir",
-]
-
-[[package]]
-name = "git2"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c1af51ea8a906616af45a4ce78eacf25860f7a13ae7bf8a814693f0f4037a26"
-dependencies = [
- "bitflags",
- "libc",
- "libgit2-sys",
- "log",
- "openssl-probe",
- "openssl-sys",
- "url",
-]
-
-[[package]]
-name = "hermit-abi"
-version = "0.1.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "idna"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e14ddfc70884202db2244c223200c204c2bda1bc6e0998d11b5e024d657209e6"
-dependencies = [
- "unicode-bidi",
- "unicode-normalization",
-]
-
-[[package]]
-name = "jobserver"
-version = "0.1.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "936cfd212a0155903bcbc060e316fb6cc7cbf2e1907329391ebadc1fe0ce77c2"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "libc"
-version = "0.2.144"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b00cc1c228a6782d0f076e7b232802e0c5689d41bb5df366f2a6b6621cfdfe1"
-
-[[package]]
-name = "libgit2-sys"
-version = "0.9.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4870c781f6063efb83150cd22c1ddf6ecf58531419e7570cdcced46970f64a16"
-dependencies = [
- "cc",
- "libc",
- "libssh2-sys",
- "libz-sys",
- "openssl-sys",
- "pkg-config",
-]
-
-[[package]]
-name = "libssh2-sys"
-version = "0.2.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b094a36eb4b8b8c8a7b4b8ae43b2944502be3e59cd87687595cf6b0a71b3f4ca"
-dependencies = [
- "cc",
- "libc",
- "libz-sys",
- "openssl-sys",
- "pkg-config",
- "vcpkg",
-]
-
-[[package]]
-name = "libz-sys"
-version = "1.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56ee889ecc9568871456d42f603d6a0ce59ff328d291063a45cbdf0036baf6db"
-dependencies = [
- "cc",
- "libc",
- "pkg-config",
- "vcpkg",
-]
-
-[[package]]
-name = "log"
-version = "0.4.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "abb12e687cfb44aa40f41fc3978ef76448f9b6038cad6aef4259d3c095a2382e"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "matrixmultiply"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "916806ba0031cd542105d916a97c8572e1fa6dd79c9c51e7eb43a09ec2dd84c1"
-dependencies = [
- "rawpointer",
-]
-
-[[package]]
-name = "munkres"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74ce2515494bc1593d54364884e807c4a97c8c3210ddcc51c541a7ab391339ce"
-dependencies = [
- "fixedbitset",
- "ndarray",
-]
-
-[[package]]
-name = "ndarray"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c0d5c9540a691d153064dc47a4db2504587a75eae07bf1d73f7a596ebc73c04"
-dependencies = [
- "matrixmultiply",
- "num-complex",
- "num-integer",
- "num-traits",
- "rawpointer",
-]
-
-[[package]]
-name = "num"
-version = "0.1.42"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4703ad64153382334aa8db57c637364c322d3372e097840c72000dabdcf6156e"
-dependencies = [
- "num-integer",
- "num-iter",
- "num-traits",
-]
-
-[[package]]
-name = "num-complex"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "747d632c0c558b87dbabbe6a82f3b4ae03720d0646ac5b7b4dae89394be5f2c5"
-dependencies = [
- "num-traits",
-]
-
-[[package]]
-name = "num-integer"
-version = "0.1.45"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "225d3389fb3509a24c93f5c29eb6bde2586b98d9f016636dff58d7c6f7569cd9"
-dependencies = [
- "autocfg",
- "num-traits",
-]
-
-[[package]]
-name = "num-iter"
-version = "0.1.43"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d03e6c028c5dc5cac6e2dec0efda81fc887605bb3d884578bb6d6bf7514e252"
-dependencies = [
- "autocfg",
- "num-integer",
- "num-traits",
-]
-
-[[package]]
-name = "num-traits"
-version = "0.2.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "578ede34cf02f8924ab9447f50c28075b4d3e5b269972345e7e0372b38c6cdcd"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "openssl-probe"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
-
-[[package]]
-name = "openssl-sys"
-version = "0.9.87"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e17f59264b2809d77ae94f0e1ebabc434773f370d6ca667bd223ea10e06cc7e"
-dependencies = [
- "cc",
- "libc",
- "pkg-config",
- "vcpkg",
-]
-
-[[package]]
-name = "percent-encoding"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "478c572c3d73181ff3c2539045f6eb99e5491218eae919370993b890cdbdd98e"
-
-[[package]]
-name = "pkg-config"
-version = "0.3.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26072860ba924cbfa98ea39c8c19b4dd6a4a25423dbdf219c1eca91aa0cf6964"
-
-[[package]]
-name = "quick-error"
-version = "1.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
-
-[[package]]
-name = "rand"
-version = "0.4.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "552840b97013b1a26992c11eac34bdd778e464601a4c2054b5f0bff7c6761293"
-dependencies = [
- "fuchsia-cprng",
- "libc",
- "rand_core 0.3.1",
- "rdrand",
- "winapi",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a6fdeb83b075e8266dcc8762c22776f6877a63111121f5f8c7411e5be7eed4b"
-dependencies = [
- "rand_core 0.4.2",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c33a3c44ca05fa6f1807d8e6743f3824e8509beca625669633be0acbdf509dc"
-
-[[package]]
-name = "rawpointer"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60a357793950651c4ed0f3f52338f53b2f809f32d83a07f72909fa13e4c6c1e3"
-
-[[package]]
-name = "rdrand"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "678054eb77286b51581ba43620cc911abf02758c91f93f479767aed0f90458b2"
-dependencies = [
- "rand_core 0.3.1",
-]
-
-[[package]]
-name = "remove_dir_all"
-version = "0.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3acd125665422973a33ac9d3dd2df85edad0f4ae9b00dafb1a05e43a9f5ef8e7"
-dependencies = [
- "winapi",
-]
-
-[[package]]
-name = "strsim"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"
-
-[[package]]
-name = "tempdir"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15f2b5fb00ccdf689e0149d1b1b3c03fead81c2b37735d812fa8bddbbf41b6d8"
-dependencies = [
- "rand",
- "remove_dir_all",
-]
-
-[[package]]
-name = "textwrap"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060"
-dependencies = [
- "unicode-width",
-]
-
-[[package]]
-name = "time"
-version = "0.1.45"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b797afad3f312d1c66a56d11d0316f916356d11bd158fbc6ca6389ff6bf805a"
-dependencies = [
- "libc",
- "wasi",
- "winapi",
-]
-
-[[package]]
-name = "tinyvec"
-version = "1.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87cc5ceb3875bb20c2890005a4e226a4651264a5c75edb2421b52861a0a0cb50"
-dependencies = [
- "tinyvec_macros",
-]
-
-[[package]]
-name = "tinyvec_macros"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
-
-[[package]]
-name = "unicode-bidi"
-version = "0.3.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92888ba5573ff080736b3648696b70cafad7d250551175acbaa4e0385b3e1460"
-
-[[package]]
-name = "unicode-normalization"
-version = "0.1.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c5713f0fc4b5db668a2ac63cdb7bb4469d8c9fed047b1d0292cc7b0ce2ba921"
-dependencies = [
- "tinyvec",
-]
-
-[[package]]
-name = "unicode-width"
-version = "0.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0edd1e5b14653f783770bce4a4dabb4a5108a5370a5f5d8cfe8710c361f6c8b"
-
-[[package]]
-name = "url"
-version = "2.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d68c799ae75762b8c3fe375feb6600ef5602c883c5d21eb51c09f22b83c4643"
-dependencies = [
- "form_urlencoded",
- "idna",
- "percent-encoding",
-]
-
-[[package]]
-name = "vcpkg"
-version = "0.2.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
-
-[[package]]
-name = "vec_map"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
-
-[[package]]
-name = "wasi"
-version = "0.10.0+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a143597ca7c7793eff794def352d41792a93c481eb1042423ff7ff72ba2c31f"
-
-[[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
--- a/pkgs/applications/version-management/git-series/default.nix
+++ b/pkgs/applications/version-management/git-series/default.nix
@ -1,55 +1,49 @@
-{ lib
-, rustPlatform
-, fetchFromGitHub
-, pkg-config
-, stdenv
-, curl
-, libgit2
-, libssh2
-, openssl
-, zlib
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  stdenv,
+  curl,
+  installShellFiles,
+  libgit2,
+  libssh2,
+  openssl,
+  zlib,
 }:

 rustPlatform.buildRustPackage {
  pname = "git-series";
-  version = "unstable-2019-10-15";
+  version = "0.9.1-unstable-2024-02-02";

  src = fetchFromGitHub {
    owner = "git-series";
    repo = "git-series";
-    rev = "c570a015e15214be46a7fd06ba08526622738e20";
-    sha256 = "1i0m2b7ma6xvkg95k57gaj1wpc1rfvka6h8jr5hglxmqqbz6cb6w";
+    rev = "9c5d40edec87b79db0c5bac1458aa0e2c8fdeb8e";
+    hash = "sha256-DtOR7+vX7efNzYMRJwJTj5cXlFHQwzcS0Gp2feVdea4=";
  };

-  cargoLock = {
-    lockFile = ./Cargo.lock;
-  };
+  cargoHash = "sha256-D83mfaH4iKagGjdX+YhCzva99+dCneHeWPNnkzZB/k0=";

  nativeBuildInputs = [
    pkg-config
-  ] ++ lib.optionals stdenv.isDarwin [
-    curl
-  ];
+    installShellFiles
+  ] ++ lib.optionals stdenv.isDarwin [ curl ];

  buildInputs = [
    libgit2
    libssh2
    openssl
    zlib
-  ] ++ lib.optionals stdenv.isDarwin [
-    curl
-  ];
+  ] ++ lib.optionals stdenv.isDarwin [ curl ];

-  LIBGIT2_SYS_USE_PKG_CONFIG = true;
-  LIBSSH2_SYS_USE_PKG_CONFIG = true;
-
-  # update Cargo.lock to work with openssl 3
-  postPatch = ''
-    ln -sf ${./Cargo.lock} Cargo.lock
-  '';
+  env = {
+    LIBGIT2_SYS_USE_PKG_CONFIG = true;
+    LIBSSH2_SYS_USE_PKG_CONFIG = true;
+  };

  postInstall = ''
-    install -D "$src/git-series.1" "$out/man/man1/git-series.1"
+    installManPage ./git-series.1
  '';

  meta = with lib; {
@ -60,9 +54,12 @@ rustPlatform.buildRustPackage {
      formats the series for email, and prepares pull requests.
    '';
    homepage = "https://github.com/git-series/git-series";
-
    license = licenses.mit;
-    maintainers = with maintainers; [ edef vmandela ];
+    maintainers = with maintainers; [
+      edef
+      vmandela
+      aleksana
+    ];
    mainProgram = "git-series";
  };
 }
--- a/pkgs/applications/video/vdr/softhddevice/default.nix
+++ b/pkgs/applications/video/vdr/softhddevice/default.nix
@ -14,12 +14,12 @@
 }:
 stdenv.mkDerivation rec {
  pname = "vdr-softhddevice";
-  version = "2.3.5";
+  version = "2.3.6";

  src = fetchFromGitHub {
    owner = "ua0lnj";
    repo = "vdr-plugin-softhddevice";
-    sha256 = "sha256-i/lxR/iSarmhJvqjcu8+HscTYoVExwCcweSNo206BYU=";
+    sha256 = "sha256-T3OG93Bx1RVyXeqkNJvhOSGojZHIWT3DHHEIzUoykds=";
    rev = "v${version}";
  };

--- a/pkgs/applications/window-managers/ragnarwm/default.nix
+++ b/pkgs/applications/window-managers/ragnarwm/default.nix
@ -61,13 +61,13 @@ stdenv.mkDerivation (finalAttrs: {
    providedSessions = [ "ragnar" ];
  };

-  meta = with lib; {
+  meta = {
    description = "Minimal, flexible & user-friendly X tiling window manager";
    homepage = "https://ragnar-website.vercel.app";
    changelog = "https://github.com/cococry/Ragnar/releases/tag/${finalAttrs.version}";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ sigmanificient ];
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ sigmanificient ];
    mainProgram = "ragnar";
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
+++ b/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation {
  pname = "ananicy-rules-cachyos";
-  version = "0-unstable-2024-07-11";
+  version = "0-unstable-2024-07-23";

  src = fetchFromGitHub {
    owner = "CachyOS";
    repo = "ananicy-rules";
-    rev = "d0cfc437783a2ca2bb0f071419df753a98981614";
-    hash = "sha256-FMZok6rW3UbkotPPG1xmdlMPfHB2JBqJZ1oTg8eUux8=";
+    rev = "2453e457d44422164c616b548114ffc5c13bc11b";
+    hash = "sha256-aILzlb/sZy3UuYlnaqYEj93hzuzCx1ZwDjU5iC5Mjpc=";
  };

  dontConfigure = true;
--- a/pkgs/by-name/bi/bitmagnet/package.nix
+++ b/pkgs/by-name/bi/bitmagnet/package.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "bitmagnet";
-  version = "0.9.4";
+  version = "0.9.5";

  src = fetchFromGitHub {
    owner = "bitmagnet-io";
    repo = "bitmagnet";
    rev = "v${version}";
-    hash = "sha256-IUWt6CBW2SXE6lc52ArKrmW+7uR1vczfbx4SOeE30IA=";
+    hash = "sha256-so9GD9hyGfuqqYq61OD1WJXba22cR4msOPp1wLI5vAU=";
  };

  vendorHash = "sha256-aauXgHPZbSiTW9utuHXzJr7GsWs/2aFiGuukA/B9BRc=";
--- a/pkgs/by-name/cl/clang-tidy-sarif/package.nix
+++ b/pkgs/by-name/cl/clang-tidy-sarif/package.nix
@ -1,37 +1,33 @@
 {
  lib,
-  fetchFromGitHub,
+  fetchCrate,
  rustPlatform,
-  clang-tidy-sarif,
-  testers,
+  nix-update-script,
+  versionCheckHook,
 }:
 rustPlatform.buildRustPackage rec {
  pname = "clang-tidy-sarif";
-  version = "0.4.2";
+  version = "0.5.0";

-  src = fetchFromGitHub {
-    owner = "psastras";
-    repo = "sarif-rs";
-    rev = "clang-tidy-sarif-v${version}";
-    hash = "sha256-EzWzDeIeSJ11CVcVyAhMjYQJcKHnieRrFkULc5eXAno=";
+  src = fetchCrate {
+    inherit pname version;
+    hash = "sha256-lxZtuE6hvmeX2CCO8UeGDORnCV5N7ZNiVZR+9LOCrdk=";
  };

-  cargoHash = "sha256-NzdgfHRDgLB6sMhBflk9rACEocLP23KlZL22iAfBfh8=";
-  cargoBuildFlags = [
-    "--package"
-    "clang-tidy-sarif"
-  ];
-  cargoTestFlags = cargoBuildFlags;
+  cargoHash = "sha256-R0IyXinUhIVqGal2Vt0EdU0EFyzs3KIbp/UIseWlj1Y=";
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;

  passthru = {
-    tests.version = testers.testVersion { package = clang-tidy-sarif; };
+    updateScript = nix-update-script { };
  };

  meta = {
    description = "A CLI tool to convert clang-tidy diagnostics into SARIF";
-    mainProgram = "clang-tidy-sarif";
    homepage = "https://psastras.github.io/sarif-rs";
    maintainers = with lib.maintainers; [ getchoo ];
+    mainProgram = "clang-tidy-sarif";
    license = lib.licenses.mit;
  };
 }
--- a/pkgs/by-name/di/dita-ot/package.nix
+++ b/pkgs/by-name/di/dita-ot/package.nix
@ -0,0 +1,48 @@
+{
+  stdenv,
+  fetchzip,
+  openjdk17,
+  lib,
+  makeWrapper,
+  testers,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "dita-ot";
+  version = "4.2.3";
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ openjdk17 ];
+
+  src = fetchzip {
+    url = "https://github.com/dita-ot/dita-ot/releases/download/${finalAttrs.version}/dita-ot-${finalAttrs.version}.zip";
+    hash = "sha256-siHz81OuKVF77NsDpldAhq7YxzBFvo9RwGPe/mqkquQ=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin $out/share/dita-ot/
+    cp -r $src/* $out/share/dita-ot/
+
+    makeWrapper "$out/share/dita-ot/bin/dita" "$out/bin/dita" \
+      --prefix PATH : "${lib.makeBinPath [ openjdk17 ]}" \
+      --set-default JDK_HOME "${openjdk17.home}" \
+      --set-default JAVA_HOME "${openjdk17.home}"
+
+    runHook postInstall
+  '';
+
+  passthru.tests.version = testers.testVersion { package = finalAttrs.finalPackage; };
+
+  meta = {
+    homepage = "https://dita-ot.org";
+    changelog = "https://www.dita-ot.org/dev/release-notes/#v${finalAttrs.version}";
+    description = "The open-source publishing engine for content authored in the Darwin Information Typing Architecture";
+    license = lib.licenses.asl20;
+    mainProgram = "dita";
+    platforms = openjdk17.meta.platforms;
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+    maintainers = with lib.maintainers; [ robertrichter ];
+  };
+})
--- a/pkgs/by-name/fz/fzf-make/package.nix
+++ b/pkgs/by-name/fz/fzf-make/package.nix
@ -29,12 +29,12 @@ rustPlatform.buildRustPackage rec {
      --suffix PATH : ${lib.makeBinPath [ bat gnugrep gnumake ]}
  '';

-  meta = with lib; {
+  meta = {
    description = "Fuzzy finder for Makefile";
    homepage = "https://github.com/kyu08/fzf-make";
    changelog = "https://github.com/kyu08/fzf-make/releases/tag/${src.rev}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ figsoda sigmanificient ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ figsoda sigmanificient ];
    mainProgram = "fzf-make";
  };
 }
--- a/pkgs/by-name/go/goss/package.nix
+++ b/pkgs/by-name/go/goss/package.nix
@ -14,16 +14,16 @@

 buildGoModule rec {
  pname = "goss";
-  version = "0.4.7";
+  version = "0.4.8";

  src = fetchFromGitHub {
    owner = "goss-org";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-KP0i+ePmkx43MdokVQO3CvTsdIFO7rCWLd8vJVC9Qf0=";
+    hash = "sha256-xabGzCTzWwT8568xg6sdlE32OYPXlG9Fei0DoyAoXgo=";
  };

-  vendorHash = "sha256-VLIDAlLO6COGDKDN12bYIBluFVgqPEmm8QRfSNPfLJY=";
+  vendorHash = "sha256-BPW4nC9gxDbyhA5UOfFAtOIusNvwJ7pQiprZsqTiak0=";

  CGO_ENABLED = 0;

--- a/pkgs/by-name/go/gotree/package.nix
+++ b/pkgs/by-name/go/gotree/package.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "gotree";
-  version = "0.2.0";
+  version = "0.3.1";

  src = fetchFromGitHub {
    owner = "elbachir-one";
    repo = "gt";
    rev = "v${version}";
-    hash = "sha256-baK2pA+jVTeMy06jrn2VrQZUsMCf7wpX7gX8mnnDh3A=";
+    hash = "sha256-0CI9dQXMlED3VoZwB+QI8kUVrUIx9vGIgNZ7mNsZGgs=";
  };

  vendorHash = null;
--- a/pkgs/by-name/gr/grafterm/package.nix
+++ b/pkgs/by-name/gr/grafterm/package.nix
--- a/pkgs/by-name/kc/kcl/package.nix
+++ b/pkgs/by-name/kc/kcl/package.nix
@ -1,44 +1,59 @@
 { lib
+, stdenv
 , buildGoModule
 , fetchFromGitHub
 , kclvm_cli
 , kclvm
 , makeWrapper
 , installShellFiles
+, darwin
 ,
 }:
 buildGoModule rec {
  pname = "kcl";
-  version = "0.8.9";
+  version = "0.9.3";

  src = fetchFromGitHub {
    owner = "kcl-lang";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-slU3n7YCV5VfvXArzlcITb9epdu/gyXlAWq9KLjGdJA=";
+    hash = "sha256-QUVTRlzG8hT+iQx5dSycbRDAyeknjwGOWynCRw3oxlo=";
  };

-  vendorHash = "sha256-Xv8Tfq9Kb1xGFCWZQwBFDX9xZW9j99td/DUb7jBtkpE=";
+  vendorHash = "sha256-AP1MOlnoTnD7luNR+1QtAdMiJL8tEEwJocT+9wBRgAo=";
+
+  # By default, libs and bins are stripped. KCL will crash on darwin if they are.
+  dontStrip = stdenv.isDarwin;

  ldflags = [
    "-w -s"
    "-X=kcl-lang.io/cli/pkg/version.version=v${version}"
  ];

-  nativeBuildInputs = [ makeWrapper installShellFiles ];
-  buildInputs = [ kclvm kclvm_cli ];
+  nativeBuildInputs = [ makeWrapper installShellFiles ] ++ (
+    lib.optionals stdenv.isDarwin [ darwin.cctools ]
+  );
+
+  buildInputs = [ kclvm kclvm_cli ] ++ (
+    lib.optional stdenv.isDarwin [
+      darwin.apple_sdk.frameworks.Security
+      darwin.apple_sdk.frameworks.CoreServices
+      darwin.apple_sdk.frameworks.SystemConfiguration
+    ]
+  );

  subPackages = [ "cmd/kcl" ];

  # env vars https://github.com/kcl-lang/kcl-go/blob/main/pkg/env/env.go#L29
  postFixup = ''
     wrapProgram $out/bin/kcl \
-    --set PATH ${lib.makeBinPath [kclvm_cli]} \
-    --set KCL_LIB_HOME ${lib.makeLibraryPath [kclvm]} \
-    --set KCL_GO_DISABLE_INSTALL_ARTIFACT false \
+    --prefix PATH : "${lib.makeBinPath [kclvm kclvm_cli]}" \
+    --prefix KCL_LIB_HOME : "${lib.makeLibraryPath [kclvm]}" \
+    --prefix KCL_GO_DISABLE_INSTALL_ARTIFACT : false
  '';

  postInstall = ''
+    export HOME=$(mktemp -d)
    installShellCompletion --cmd kcl \
      --bash <($out/bin/kcl completion bash) \
      --fish <($out/bin/kcl completion fish) \
@ -49,7 +64,7 @@ buildGoModule rec {
    description = "A command line interface for KCL programming language";
    homepage = "https://github.com/kcl-lang/cli";
    license = licenses.asl20;
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
    maintainers = with maintainers; [ selfuryon peefy ];
    mainProgram = "kcl";
  };
--- a/pkgs/by-name/kc/kclvm/Cargo.lock
+++ b/pkgs/by-name/kc/kclvm/Cargo.lock
--- a/pkgs/by-name/kc/kclvm/enable_protoc_env.patch
+++ b/pkgs/by-name/kc/kclvm/enable_protoc_env.patch
@ -1,37 +1,46 @@
-diff --git a/api/build.rs b/api/build.rs
-index 617c1b9a..20d728e3 100644
+diff --git a/kclvm/api/build.rs b/kclvm/api/build.rs
+index 7d1c39b7..0104bb6f 100644
 --- a/api/build.rs
 +++ b/api/build.rs
-@@ -5,10 +5,10 @@ use prost_wkt_build::{FileDescriptorSet, Message};
+@@ -5,12 +5,12 @@ use prost_wkt_build::{FileDescriptorSet, Message};
 /// According to the file kclvm/spec/gpyrpc/gpyrpc.proto, automatically generate
 /// the corresponding rust source file to the directory src/model
 fn main() {
-    std::env::set_var(
-        "PROTOC",
-        protoc_bin_vendored::protoc_bin_path().unwrap().as_os_str(),
-    );
-+    // std::env::set_var(
-+    //     "PROTOC",
-+    //     protoc_bin_vendored::protoc_bin_path().unwrap().as_os_str(),
-+    // );
-
+-    if env::var("PROTOC").is_err() {
+-        env::set_var(
+-            "PROTOC",
+-            protoc_bin_vendored::protoc_bin_path().unwrap().as_os_str(),
+-        );
+-    }
+    //if env::var("PROTOC").is_err() {
+    //    env::set_var(
+    //        "PROTOC",
+    //        protoc_bin_vendored::protoc_bin_path().unwrap().as_os_str(),
+    //    );
+    //}
+ 
     let out = PathBuf::from(env::var("OUT_DIR").unwrap());
     let descriptor_file = out.join("kclvm_service_descriptor.bin");
-diff --git b/third-party/prost-wkt/wkt-types/build.rs a/third-party/prost-wkt/wkt-types/build.rs
-index e49222d5..a933ddf4 100644
+diff --git a/kclvm/third-party/prost-wkt/wkt-types/build.rs b/kclvm/third-party/prost-wkt/wkt-types/build.rs
+index 620c759a..7f77e1b1 100644
 --- a/third-party/prost-wkt/wkt-types/build.rs
 +++ b/third-party/prost-wkt/wkt-types/build.rs
-@@ -13,10 +13,10 @@ use regex::Regex;
-
+@@ -13,12 +13,12 @@ use regex::Regex;
+ 
 fn main() {
     //hack: set protoc_bin_vendored::protoc_bin_path() to PROTOC
-    std::env::set_var(
-        "PROTOC",
-        protoc_bin_vendored::protoc_bin_path().unwrap().as_os_str(),
-    );
-+    // std::env::set_var(
-+    //     "PROTOC",
-+    //     protoc_bin_vendored::protoc_bin_path().unwrap().as_os_str(),
-+    // );
+-    if env::var("PROTOC").is_err() {
+-        env::set_var(
+-            "PROTOC",
+-            protoc_bin_vendored::protoc_bin_path().unwrap().as_os_str(),
+-        );
+-    }
+    //if env::var("PROTOC").is_err() {
+    //    env::set_var(
+    //         "PROTOC",
+    //        protoc_bin_vendored::protoc_bin_path().unwrap().as_os_str(),
+    //    );
+    //}
     let dir = PathBuf::from(env::var("OUT_DIR").unwrap());
     process_prost_pbtime(&dir);
+ 
--- a/pkgs/by-name/kc/kclvm/package.nix
+++ b/pkgs/by-name/kc/kclvm/package.nix
@ -1,19 +1,22 @@
 { lib
+, stdenv
 , rustPlatform
 , fetchFromGitHub
 , protobuf
 , pkg-config
+, darwin
+, rustc
 ,
 }:
 rustPlatform.buildRustPackage rec {
  pname = "kclvm";
-  version = "0.8.7";
+  version = "0.9.3";

  src = fetchFromGitHub {
    owner = "kcl-lang";
    repo = "kcl";
    rev = "v${version}";
-    hash = "sha256-ieGpuNkzT6AODZYUcEanb7Jpb+PXclnQ9KkdmlehK0o=";
+    hash = "sha256-nk5oJRTBRj0LE2URJqno8AoZ+/342C2tEt8d6k2MAc8=";
  };

  sourceRoot = "source/kclvm";
@ -21,9 +24,22 @@ rustPlatform.buildRustPackage rec {
    lockFile = ./Cargo.lock;
    outputHashes = {
      "inkwell-0.2.0" = "sha256-JxSlhShb3JPhsXK8nGFi2uGPp8XqZUSiqniLBrhr+sM=";
+      "protoc-bin-vendored-3.1.0" = "sha256-RRqpPMJygpKGG5NYzD93iy4htpVqFhYMmfPgbRtpUqg=";
    };
  };

+  buildInputs = [ rustc ] ++ lib.optionals stdenv.isDarwin [
+    darwin.cctools
+    darwin.apple_sdk.frameworks.Security
+    darwin.apple_sdk.frameworks.CoreServices
+    darwin.apple_sdk.frameworks.SystemConfiguration
+  ];
+
+
+  postInstall = lib.optionalString stdenv.isDarwin ''
+    install_name_tool -id $out/lib/libkclvm_cli_cdylib.dylib $out/lib/libkclvm_cli_cdylib.dylib
+  '';
+
  nativeBuildInputs = [ pkg-config protobuf ];

  patches = [ ./enable_protoc_env.patch ];
@ -35,7 +51,7 @@ rustPlatform.buildRustPackage rec {
    description = "A high-performance implementation of KCL written in Rust that uses LLVM as the compiler backend";
    homepage = "https://github.com/kcl-lang/kcl";
    license = licenses.asl20;
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
    maintainers = with maintainers; [ selfuryon peefy ];
  };
 }
--- a/pkgs/by-name/kc/kclvm_cli/Cargo.lock
+++ b/pkgs/by-name/kc/kclvm_cli/Cargo.lock
@ -1,7 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 3
-
-[[package]]
-name = "kclvm_cli"
-version = "0.8.7"
--- a/pkgs/by-name/kc/kclvm_cli/cargo_lock.patch
+++ b/pkgs/by-name/kc/kclvm_cli/cargo_lock.patch
@ -7,4 +7,4 @@
 +
 +[[package]]
 +name = "kclvm_cli"
-+version = "0.8.7"
+version = "0.9.3"
--- a/pkgs/by-name/kc/kclvm_cli/package.nix
+++ b/pkgs/by-name/kc/kclvm_cli/package.nix
@ -1,30 +1,41 @@
 { lib
+, stdenv
 , rustPlatform
 , fetchFromGitHub
 , kclvm
+, darwin
+, rustc
+,
 }:
 rustPlatform.buildRustPackage rec {
  pname = "kclvm_cli";
-  version = "0.8.7";
+  version = "0.9.3";

  src = fetchFromGitHub {
    owner = "kcl-lang";
    repo = "kcl";
    rev = "v${version}";
-    hash = "sha256-ieGpuNkzT6AODZYUcEanb7Jpb+PXclnQ9KkdmlehK0o=";
+    hash = "sha256-nk5oJRTBRj0LE2URJqno8AoZ+/342C2tEt8d6k2MAc8=";
  };

  sourceRoot = "source/cli";
-  cargoLock.lockFile = ./Cargo.lock;
+  cargoHash = "sha256-LZUE2J/UYepl5BGf4T4eWKIZfN3mVJtMDLtm0uUmvI8=";
  cargoPatches = [ ./cargo_lock.patch ];

-  buildInputs = [ kclvm ];
+  buildInputs = [ kclvm rustc ] ++ (
+    lib.optionals stdenv.isDarwin [
+      darwin.cctools
+      darwin.apple_sdk.frameworks.Security
+      darwin.apple_sdk.frameworks.CoreServices
+      darwin.apple_sdk.frameworks.SystemConfiguration
+    ]
+  );

  meta = with lib; {
    description = "A high-performance implementation of KCL written in Rust that uses LLVM as the compiler backend";
    homepage = "https://github.com/kcl-lang/kcl";
    license = licenses.asl20;
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
    maintainers = with maintainers; [ selfuryon peefy ];
    mainProgram = "kclvm_cli";
  };
--- a/pkgs/development/tools/konf/default.nix
+++ b/pkgs/development/tools/konf/default.nix
--- a/pkgs/applications/audio/lollypop/default.nix
+++ b/pkgs/applications/audio/lollypop/default.nix
@ -1,32 +1,34 @@
-{ lib
-, fetchFromGitLab
-, nix-update-script
-, meson
-, ninja
-, pkg-config
-, python3
-, gtk3
-, gst_all_1
-, libhandy
-, libsecret
-, libsoup_3
-, appstream-glib
-, desktop-file-utils
-, totem-pl-parser
-, gobject-introspection
-, glib-networking
-, gdk-pixbuf
-, glib
-, pango
-, wrapGAppsHook3
-, lastFMSupport ? true
-, youtubeSupport ? true
-, kid3Support ? true
+{
+  lib,
+  fetchFromGitLab,
+  nix-update-script,
+  meson,
+  ninja,
+  pkg-config,
+  python3,
+  gtk3,
+  gst_all_1,
+  libhandy,
+  libsecret,
+  libsoup_3,
+  appstream-glib,
+  desktop-file-utils,
+  totem-pl-parser,
+  gobject-introspection,
+  glib-networking,
+  gdk-pixbuf,
+  glib,
+  pango,
+  kid3,
+  wrapGAppsHook3,
+  lastFMSupport ? true,
+  youtubeSupport ? true,
+  kid3Support ? true,
 }:

 python3.pkgs.buildPythonApplication rec {
  pname = "lollypop";
-  version = "1.4.39";
+  version = "1.4.40";

  format = "other";

@ -36,7 +38,7 @@ python3.pkgs.buildPythonApplication rec {
    repo = pname;
    rev = version;
    fetchSubmodules = true;
-    hash = "sha256-VPHQwy2+XR9R7toIN5sNFB91ddROlL7Scr8AKLgUzuo=";
+    hash = "sha256-hdReviNgcigXuNqJns6aPW+kixlpmRXtqrLlm/LGHBo=";
  };

  nativeBuildInputs = [
@ -49,29 +51,38 @@ python3.pkgs.buildPythonApplication rec {
    wrapGAppsHook3
  ];

-  buildInputs = with gst_all_1;
-    [
-      gdk-pixbuf
-      glib
-      glib-networking
+  buildInputs =
+    (with gst_all_1; [
      gst-libav
      gst-plugins-bad
      gst-plugins-base
      gst-plugins-good
      gst-plugins-ugly
      gstreamer
+
+    ])
+    ++ [
+      gdk-pixbuf
+      glib
+      glib-networking
      gtk3
      libhandy
      libsoup_3
      pango
      totem-pl-parser
-    ] ++ lib.optional lastFMSupport libsecret;
+    ]
+    ++ lib.optional lastFMSupport libsecret;

-  propagatedBuildInputs = with python3.pkgs;
-    [ beautifulsoup4 pillow pycairo pygobject3 ]
-    ++ lib.optional lastFMSupport pylast
-    ++ lib.optional youtubeSupport yt-dlp
-    ++ lib.optional kid3Support pkgs.kid3;
+  propagatedBuildInputs =
+    (with python3.pkgs; [
+      beautifulsoup4
+      pillow
+      pycairo
+      pygobject3
+    ])
+    ++ lib.optional lastFMSupport python3.pkgs.pylast
+    ++ lib.optional youtubeSupport python3.pkgs.yt-dlp
+    ++ lib.optional kid3Support kid3;

  postPatch = ''
    chmod +x meson_post_install.py
@ -93,15 +104,17 @@ python3.pkgs.buildPythonApplication rec {
    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
  '';

-  passthru = { updateScript = nix-update-script { }; };
+  passthru = {
+    updateScript = nix-update-script { };
+  };

-  meta = with lib; {
+  meta = {
    changelog = "https://gitlab.gnome.org/World/lollypop/tags/${version}";
    description = "Modern music player for GNOME";
    homepage = "https://gitlab.gnome.org/World/lollypop";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ lovesegfault ];
-    platforms = platforms.linux;
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ lovesegfault ];
+    platforms = lib.platforms.linux;
    mainProgram = "lollypop";
  };
 }
--- a/pkgs/by-name/ma/mariadb-connector-java/package.nix
+++ b/pkgs/by-name/ma/mariadb-connector-java/package.nix
@ -6,16 +6,16 @@

 maven.buildMavenPackage rec {
  pname = "mariadb-connector-java";
-  version = "3.4.0";
+  version = "3.4.1";

  src = fetchFromGitHub {
    owner = "mariadb-corporation";
    repo = "mariadb-connector-j";
    rev = "refs/tags/${version}";
-    hash = "sha256-4DsRTXjSKgC/mz3divnqdioFQnqgQXwRKNv4xxvH0H8=";
+    hash = "sha256-MDC0flAD56cXLiLNytbjp0au1NACugFNEpHxbucZO4U=";
  };

-  mvnHash = "sha256-7O+G5HT6mtp12zWL3Gn12KPVUwp3GMaWGvXX6Sg1+6k=";
+  mvnHash = "sha256-kwKL37LCv4rQYc4bYdyP1tOaovJ8pSp7p52nuk10z/U=";

  doCheck = false; # Requires networking

--- a/pkgs/by-name/ma/markuplinkchecker/package.nix
+++ b/pkgs/by-name/ma/markuplinkchecker/package.nix
@ -0,0 +1,55 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  openssl,
+  stdenv,
+  darwin,
+}:
+let
+  version = "0.18.0";
+in
+rustPlatform.buildRustPackage {
+  pname = "markuplinkchecker";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "becheran";
+    repo = "mlc";
+    rev = "v${version}";
+    hash = "sha256-hMS0ZX4Ta1xq5e8R7mvmOQCEW3UCk1nd2TGzWOyOGY8=";
+  };
+
+  cargoHash = "sha256-adJZcuUynxYpj2h6YKozb6W/2WjNsWq9IwxJaIVl0YI=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs =
+    [ openssl ]
+    ++ lib.optionals stdenv.isDarwin (
+      with darwin.apple_sdk.frameworks;
+      [
+        Security
+        SystemConfiguration
+      ]
+    );
+
+  env = {
+    OPENSSL_NO_VENDOR = true;
+  };
+
+  doCheck = false; # tests require an internet connection
+
+  meta = {
+    description = "Check for broken links in markup files";
+    homepage = "https://github.com/becheran/mlc";
+    changelog = "https://github.com/becheran/mlc/blob/v${version}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      uncenter
+      anas
+    ];
+    mainProgram = "mlc";
+  };
+}
--- a/pkgs/by-name/na/namespace-cli/package.nix
+++ b/pkgs/by-name/na/namespace-cli/package.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "namespace-cli";
-  version = "0.0.386";
+  version = "0.0.388";

  src = fetchFromGitHub {
    owner = "namespacelabs";
    repo = "foundation";
    rev = "v${version}";
-    hash = "sha256-UT5gCwMxnd/saK3n3jLJeF/ri9pq1KBP++T3lvAM7ng=";
+    hash = "sha256-57T1pD5Whx3OcqUoAu27y/bsNIvfDkmiCsYxQoLD5lc=";
  };

-  vendorHash = "sha256-VG21dKoMsZefSXUP/itFbt0RGWjlVDwJbeJDmhJ47PA=";
+  vendorHash = "sha256-WUtN7yDXrMngn+LAa2FfF62kDlOSJiuNhDSiatlTu2s=";

  subPackages = ["cmd/nsc" "cmd/ns" "cmd/docker-credential-nsc"];

--- a/pkgs/by-name/na/narsil/package.nix
+++ b/pkgs/by-name/na/narsil/package.nix
@ -14,13 +14,13 @@
 }:
 stdenv.mkDerivation rec {
  pname = "narsil";
-  version = "1.3.0-84-g042c39e9c";
+  version = "1.3.0-85-g68f1491ca";

  src = fetchFromGitHub {
    owner = "NickMcConnell";
    repo = "NarSil";
    rev = version;
-    hash = "sha256-P+J+1KR5ZIUSXq8FXHGcIllGH3iEFlNniHWzlT4WZUM=";
+    hash = "sha256-uiueTkfucYcK6BQ0WpXp8Sye7E0D1uxd/InowWznBjY=";
  };

  passthru.updateScript = nix-update-script { };
--- a/pkgs/by-name/oc/octosql/package.nix
+++ b/pkgs/by-name/oc/octosql/package.nix
--- a/pkgs/by-name/op/opshin/package.nix
+++ b/pkgs/by-name/op/opshin/package.nix
@ -1,11 +1,12 @@
-{ lib
-, fetchFromGitHub
-, python3
+{
+  lib,
+  fetchFromGitHub,
+  python3,
 }:

 python3.pkgs.buildPythonApplication rec {
  pname = "opshin";
-  version = "0.20.0";
+  version = "0.21.2";

  format = "pyproject";

@ -13,7 +14,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "OpShin";
    repo = "opshin";
    rev = version;
-    hash = "sha256-fJlPeVAuEf80FVxdXnaKASLmjMEgz6ysXenUY72+sos=";
+    hash = "sha256-YBdYF04iKUwIZncqyEDalU+YN6/qwlx/vQDzZ19GaPU=";
  };

  propagatedBuildInputs = with python3.pkgs; [
@ -27,6 +28,11 @@ python3.pkgs.buildPythonApplication rec {
    ordered-set
  ];

+  pythonRelaxDeps = [
+    "pluthon"
+    "uplc"
+  ];
+
  meta = with lib; {
    description = "Simple pythonic programming language for Smart Contracts on Cardano";
    homepage = "https://opshin.dev";
--- a/pkgs/by-name/ph/physac/package.nix
+++ b/pkgs/by-name/ph/physac/package.nix
@ -6,7 +6,7 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "physac";
-  version = "2.5-unstable-2023-12-11";
+  version = "1.1-unstable-2023-12-11";

  src = fetchFromGitHub {
    owner = "victorfisac";
--- a/pkgs/by-name/pr/promql-cli/package.nix
+++ b/pkgs/by-name/pr/promql-cli/package.nix
--- a/pkgs/by-name/pr/prowler/package.nix
+++ b/pkgs/by-name/pr/prowler/package.nix
@ -6,21 +6,19 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "prowler";
-  version = "3.15.0";
+  version = "3.16.11";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "prowler-cloud";
    repo = "prowler";
    rev = "refs/tags/${version}";
-    hash = "sha256-7aWWaGdHTveFwXsFNj4+tjX5g83/nD77jLAOrDOw8JE=";
+    hash = "sha256-cBqPD5lOhaMXh4OKo7+mERU3YjRU1NiRzSbnKFR6+1I=";
  };

  pythonRelaxDeps = true;

-  build-system = with python3.pkgs; [
-    poetry-core
-  ];
+  build-system = with python3.pkgs; [ poetry-core ];

  dependencies = with python3.pkgs; [
    alive-progress
@ -53,10 +51,12 @@ python3.pkgs.buildPythonApplication rec {
    msgraph-sdk
    msrestazure
    pydantic_1
+    pytz
    schema
    shodan
    slack-sdk
    tabulate
+    tzlocal
  ];

  pythonImportsCheck = [ "prowler" ];
--- a/pkgs/by-name/ra/rasm/package.nix
+++ b/pkgs/by-name/ra/rasm/package.nix
@ -18,13 +18,13 @@ stdenv.mkDerivation rec {
    install -Dt $out/bin rasm
  '';

-  meta = with lib; {
+  meta = {
    homepage = "http://rasm.wikidot.com/english-index:home";
    description = "Z80 assembler";
    mainProgram = "rasm";
    # use -n option to display all licenses
-    license = licenses.mit; # expat version
+    license = lib.licenses.mit; # expat version
    maintainers = with lib.maintainers; [ sigmanificient ];
-    platforms = platforms.all;
+    platforms = lib.platforms.all;
  };
 }
--- a/pkgs/by-name/rs/rs-tftpd/package.nix
+++ b/pkgs/by-name/rs/rs-tftpd/package.nix
@ -6,16 +6,18 @@

 rustPlatform.buildRustPackage rec {
  pname = "rs-tftpd";
-  version = "0.3.0";
+  version = "0.3.1";

  src = fetchFromGitHub {
    owner = "altugbakan";
    repo = "rs-tftpd";
    rev = version;
-    hash = "sha256-J7Cy8ymqZH1dCQ4/NWi+ukOsD/0KAfqgYBnCgfRt/KU=";
+    hash = "sha256-ZWafSqHEBgS7LR9hTfatatvAFZnCP8L5rHLerdjyrUc=";
  };

-  cargoHash = "sha256-gVNwMgv3acJaoQFJi5G/zo2ECzxYvcgaHlpwuCF2HVE=";
+  cargoHash = "sha256-uBVDH7YYSuFv0r5T2+EAoL02ta+1hjaza/Ilu+a+k0k=";
+
+  buildFeatures = [ "client" ];

  passthru.updateScript = nix-update-script {};

--- a/pkgs/by-name/ss/sshesame/package.nix
+++ b/pkgs/by-name/ss/sshesame/package.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "sshesame";
-  version = "0.0.35";
+  version = "0.0.38";

  src = fetchFromGitHub {
    owner = "jaksi";
    repo = "sshesame";
    rev = "v${version}";
-    hash = "sha256-D+vygu+Zx/p/UmqOXqx/4zGv6mtCUKTeU5HdBhxdbN4=";
+    hash = "sha256-CSoDUfbYSf+V7jHVqXGhLc6Mrluy+XbZKCs6IA8reIw=";
  };

-  vendorHash = "sha256-WX3rgv9xz3lisYSjf7xvx4oukDSuxE1yqLl6Sz/iDYc=";
+  vendorHash = "sha256-tfxqr1yDXE+ACCfAtZ0xePpB/xktfwJe/xPU8qAVz54=";

  ldflags = [ "-s" "-w" ];

--- a/pkgs/by-name/ti/tio/package.nix
+++ b/pkgs/by-name/ti/tio/package.nix
@ -14,13 +14,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "tio";
-  version = "3.5";
+  version = "3.6";

  src = fetchFromGitHub {
    owner = "tio";
    repo = "tio";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-3d3TYHSERIQdw+Iw6qCydGpWRpWrhZwb4SnwV1nVtIk=";
+    hash = "sha256-1NXp94AQOgMNKf+P2eJ6ifUhWSqIYllVeCraBO2pHxQ=";
  };

  strictDeps = true;
--- a/pkgs/os-specific/linux/tomb/default.nix
+++ b/pkgs/os-specific/linux/tomb/default.nix
@ -1,40 +1,43 @@
-{ stdenvNoCC
-, lib
-, fetchFromGitHub
-, substituteAll
-, makeWrapper
-, zsh
-, coreutils
-, cryptsetup
-, e2fsprogs
-, file
-, gawk
-, getent
-, gettext
-, gnugrep
-, gnupg
-, libargon2
-, lsof
-, pinentry
-, util-linux
-, nix-update-script
+{
+  coreutils,
+  cryptsetup,
+  e2fsprogs,
+  fetchFromGitHub,
+  file,
+  gawk,
+  getent,
+  gettext,
+  gnugrep,
+  gnupg,
+  lib,
+  libargon2,
+  lsof,
+  makeWrapper,
+  nix-update-script,
+  pinentry,
+  stdenvNoCC,
+  util-linux,
+  zsh,
 }:

 stdenvNoCC.mkDerivation rec {
  pname = "tomb";
-  version = "2.10";
+  version = "2.11";

  src = fetchFromGitHub {
    owner = "dyne";
    repo = "Tomb";
    rev = "refs/tags/v${version}";
-    hash = "sha256-lLxQJX0P6b6lbXEcrq45EsX9iKiayZ9XkhqgMfpN3/w=";
+    hash = "sha256-H9etbodTKxROJAITbViQQ6tkEr9rKNITTHfsGGQbyR0=";
  };

-  buildInputs = [ zsh pinentry ];
-
  nativeBuildInputs = [ makeWrapper ];

+  buildInputs = [
+    pinentry
+    zsh
+  ];
+
  postPatch = ''
    # if not, it shows .tomb-wrapped when running
    substituteInPlace tomb \
@ -46,7 +49,8 @@ stdenvNoCC.mkDerivation rec {
    install -Dm644 doc/tomb.1 $out/share/man/man1/tomb.1

    wrapProgram $out/bin/tomb \
-      --prefix PATH : $out/bin:${lib.makeBinPath [
+      --prefix PATH : $out/bin:${
+        lib.makeBinPath [
          coreutils
          cryptsetup
          e2fsprogs
@ -60,20 +64,24 @@ stdenvNoCC.mkDerivation rec {
          lsof
          pinentry
          util-linux
-        ]}
+        ]
+      }
  '';

  passthru = {
    updateScript = nix-update-script { };
  };

-  meta = with lib; {
+  meta = {
    description = "File encryption on GNU/Linux";
    homepage = "https://www.dyne.org/software/tomb/";
    changelog = "https://github.com/dyne/Tomb/blob/v${version}/ChangeLog.md";
-    license = licenses.gpl3Only;
+    license = lib.licenses.gpl3Only;
    mainProgram = "tomb";
-    maintainers = with maintainers; [ peterhoeg anthonyroussel ];
-    platforms = platforms.linux;
+    maintainers = with lib.maintainers; [
+      peterhoeg
+      anthonyroussel
+    ];
+    platforms = lib.platforms.linux;
  };
 }
--- a/pkgs/by-name/tr/trickest-cli/package.nix
+++ b/pkgs/by-name/tr/trickest-cli/package.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "trickest-cli";
-  version = "1.8.0";
+  version = "1.8.1";

  src = fetchFromGitHub {
    owner = "trickest";
    repo = "trickest-cli";
    rev = "refs/tags/v${version}";
-    hash = "sha256-wzBUPotuv1natDB896Uu+O9Nj4ycT8jkcvIumjMdbqs=";
+    hash = "sha256-6fshMuwGv4tkaqySHVsCwX+kBpUt+u/x9qnJNZ3c0HA=";
  };

  vendorHash = "sha256-gk8YMMvTHBL7yoXU9n0jhtUS472fqLW5m+mSl4Lio6c=";
--- a/pkgs/by-name/tu/tuifimanager/package.nix
+++ b/pkgs/by-name/tu/tuifimanager/package.nix
@ -62,7 +62,7 @@ python3.pkgs.buildPythonApplication rec {

  pythonImportsCheck = [ "TUIFIManager" ];

-  meta = with lib; {
+  meta = {
    description = "Cross-platform terminal-based termux-oriented file manager";
    longDescription = ''
      A cross-platform terminal-based termux-oriented file manager (and component),
@ -70,8 +70,8 @@ python3.pkgs.buildPythonApplication rec {
      attempt to get more attention to the Uni-Curses project.
    '';
    homepage = "https://github.com/GiorgosXou/TUIFIManager";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ michaelBelsanti sigmanificient ];
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ michaelBelsanti sigmanificient ];
    mainProgram = "tuifi";
  };
 }
--- a/pkgs/by-name/us/ustr/package.nix
+++ b/pkgs/by-name/us/ustr/package.nix
@ -41,12 +41,12 @@ stdenv.mkDerivation (finalAttrs: {
    find $out/lib -name \*debug\* -delete
  '';

-  meta = with lib; {
+  meta = {
    homepage = "http://www.and.org/ustr/";
    description = "Micro String API for C language";
    mainProgram = "ustr-import";
-    license = licenses.bsd2;
+    license = lib.licenses.bsd2;
    maintainers = with lib.maintainers; [ sigmanificient ];
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/by-name/uw/uwsm/package.nix
+++ b/pkgs/by-name/uw/uwsm/package.nix
@ -0,0 +1,71 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  meson,
+  ninja,
+  scdoc,
+  pkg-config,
+  nix-update-script,
+  dmenu,
+  libnotify,
+  python3Packages,
+  util-linux,
+  fumonSupport ? true,
+  uuctlSupport ? true,
+  uwsmAppSupport ? true,
+}:
+let
+  python = python3Packages.python.withPackages (ps: [
+    ps.pydbus
+    ps.dbus-python
+    ps.pyxdg
+  ]);
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "uwsm";
+  version = "0.17.0";
+
+  src = fetchFromGitHub {
+    owner = "Vladimir-csp";
+    repo = "uwsm";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-M2j7l5XTSS2IzaJofAHct1tuAO2A9Ps9mCgAWKEvzoE=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    scdoc
+  ];
+
+  buildInputs = [
+    libnotify
+    util-linux
+  ] ++ (lib.optionals uuctlSupport [ dmenu ]);
+
+  propagatedBuildInputs = [ python ];
+
+  mesonFlags = [
+    "--prefix=${placeholder "out"}"
+    (lib.mapAttrsToList lib.mesonEnable {
+      "uwsm-app" = uwsmAppSupport;
+      "fumon" = fumonSupport;
+      "uuctl" = uuctlSupport;
+      "man-pages" = true;
+    })
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Universal wayland session manager";
+    homepage = "https://github.com/Vladimir-csp/uwsm";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ johnrtitor ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/vl/vlc-bin/package.nix
+++ b/pkgs/by-name/vl/vlc-bin/package.nix
@ -14,14 +14,14 @@
 assert builtins.elem variant [ "arm64" "intel64" "universal" ];
 stdenv.mkDerivation (finalAttrs: {
  pname = "vlc-bin-${variant}";
-  version = "3.0.20";
+  version = "3.0.21";

  src = fetchurl {
    url = "http://get.videolan.org/vlc/${finalAttrs.version}/macosx/vlc-${finalAttrs.version}-${variant}.dmg";
    hash = {
-      "arm64" = "sha256-XV8O5S2BmCpiL0AhkopktHBalVRJniDDPQusIlkLEY4=";
-      "intel64" = "sha256-pNwUQfyrjiuQxil0zlOZu4isv2xw1U8hxhWNn7H7onk=";
-      "universal" = "sha256-IqGPOWzMmHbGDV+0QxFslv19BC2J1Z5Qzcuja/Od1Us=";
+      "arm64" = "sha256-Fd1lv2SJ2p7Gpn9VhcdMQKWJk6z/QagpWKkW3XQXgEQ=";
+      "intel64" = "sha256-1DH9BRw9x68CvTE8bQXZDPYEtw7T7Fu6b9TEnvPmONk=";
+      "universal" = "sha256-UDgOVvgdYw41MUJqJlq/iz3ubAgiu3yeMLUyx9aaZcA=";
    }.${variant};
  };

--- a/pkgs/by-name/wa/wakatime-cli/package.nix
+++ b/pkgs/by-name/wa/wakatime-cli/package.nix
@ -47,11 +47,11 @@ buildGoModule rec {
    command = "HOME=$(mktemp -d) wakatime-cli --version";
  };

-  meta = with lib; {
+  meta = {
    homepage = "https://wakatime.com/";
    description = "WakaTime command line interface";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ sigmanificient ];
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ sigmanificient ];
    mainProgram = "wakatime-cli";
  };
 }
--- a/pkgs/desktops/deepin/library/qt6platform-plugins/default.nix
+++ b/pkgs/desktops/deepin/library/qt6platform-plugins/default.nix
@ -12,22 +12,19 @@

 stdenv.mkDerivation rec {
  pname = "qt6platform-plugins";
-  version = "6.0.16";
+  version = "6.0.18";

  src = fetchFromGitHub {
    owner = "linuxdeepin";
    repo = pname;
    rev = version;
-    hash = "sha256-0/hwsdB0UNzlekxfdKeItW2lXTMTzEtBR2hS153woLo=";
+    hash = "sha256-O2wylkNKqN0JxKffwFNSfv7S1hPIFrVKwSsppSGTp6I=";
  };

-  patches = [
-    (fetchpatch {
-      name = "support-to-qt_6_7_1.patch";
-      url = "https://github.com/linuxdeepin/qt6platform-plugins/commit/88ba963d11355391d62501cd5a6da9e3d5e9ddce.patch";
-      hash = "sha256-9NiKIdY9PXBYgKQGRf5pFV+tNrHe7BjbVrnwII9lLFI=";
-    })
-  ];
+  postUnpack = ''
+    tar -xf ${qt6Packages.qtbase.src}
+    mv qtbase-everywhere-src-${qt6Packages.qtbase.version}/src/plugins/platforms/xcb ${src.name}/xcb/libqt6xcbqpa-dev/${qt6Packages.qtbase.version}
+  '';

  nativeBuildInputs = [
    cmake
--- a/pkgs/development/beam-modules/mix-release.nix
+++ b/pkgs/development/beam-modules/mix-release.nix
@ -1,56 +1,61 @@
-{ stdenv
-, lib
-, elixir
-, erlang
-, hex
-, git
-, rebar
-, rebar3
-, fetchMixDeps
-, findutils
-, ripgrep
-, bbe
-, makeWrapper
-, coreutils
-, gnused
-, gnugrep
-, gawk
+{
+  stdenv,
+  lib,
+  elixir,
+  erlang,
+  hex,
+  git,
+  rebar,
+  rebar3,
+  fetchMixDeps,
+  findutils,
+  ripgrep,
+  bbe,
+  makeWrapper,
+  coreutils,
+  gnused,
+  gnugrep,
+  gawk,
 }@inputs:

-{ pname
-, version
-, src
-, nativeBuildInputs ? [ ]
-, buildInputs ? [ ]
-, meta ? { }
-, enableDebugInfo ? false
-, mixEnv ? "prod"
-, compileFlags ? [ ]
+{
+  pname,
+  version,
+  src,
+  nativeBuildInputs ? [ ],
+  buildInputs ? [ ],
+  meta ? { },
+  enableDebugInfo ? false,
+  mixEnv ? "prod",
+  compileFlags ? [ ],
+  # Build a particular named release.
+  # see https://hexdocs.pm/mix/1.12/Mix.Tasks.Release.html#content
+  mixReleaseName ? "",

  # Options to be passed to the Erlang compiler. As documented in the reference
  # manual, these must be valid Erlang terms. They will be turned into an
  # erlang list and set as the ERL_COMPILER_OPTIONS environment variable.
  # See https://www.erlang.org/doc/man/compile
-, erlangCompilerOptions ? [ ]
+  erlangCompilerOptions ? [ ],

  # Deterministic Erlang builds remove full system paths from debug information
  # among other things to keep builds more reproducible. See their docs for more:
  # https://www.erlang.org/doc/man/compile
-, erlangDeterministicBuilds ? true
+  erlangDeterministicBuilds ? true,

  # Mix dependencies provided as a fixed output derivation
-, mixFodDeps ? null
+  mixFodDeps ? null,

  # Mix dependencies generated by mix2nix
  #
  # This assumes each dependency is built by buildMix or buildRebar3. Each
  # dependency needs to have a setup hook to add the lib path to $ERL_LIBS.
  # This is how Mix finds dependencies.
-, mixNixDeps ? { }
+  mixNixDeps ? { },

-, elixir ? inputs.elixir
-, erlang ? inputs.erlang
-, hex ? inputs.hex.override { inherit elixir; }
+  elixir ? inputs.elixir,
+  erlang ? inputs.erlang,
+  hex ? inputs.hex.override { inherit elixir; },

  # Remove releases/COOKIE
  #
@ -65,172 +70,204 @@
  #
  # You can always specify a custom cookie by using RELEASE_COOKIE environment
  # variable, regardless of the value of this attr.
-, removeCookie ? true
+  removeCookie ? true,

  # This reduces closure size, but can lead to some hard to understand runtime
  # errors, so use with caution. See e.g.
  # https://github.com/whitfin/cachex/issues/205
  # https://framagit.org/framasoft/mobilizon/-/issues/1169
-, stripDebug ? false
+  stripDebug ? false,

-, ...
+  ...
 }@attrs:
 let
  # Remove non standard attributes that cannot be coerced to strings
-  overridable = builtins.removeAttrs attrs [ "compileFlags" "erlangCompilerOptions" "mixNixDeps" ];
+  overridable = builtins.removeAttrs attrs [
+    "compileFlags"
+    "erlangCompilerOptions"
+    "mixNixDeps"
+  ];
 in
 assert mixNixDeps != { } -> mixFodDeps == null;
 assert stripDebug -> !enableDebugInfo;

-stdenv.mkDerivation (overridable // {
-  nativeBuildInputs = nativeBuildInputs ++
-    # Erlang/Elixir deps
-    [ erlang elixir hex git ] ++
-    # Mix deps
-    (builtins.attrValues mixNixDeps) ++
-    # other compile-time deps
-    [ findutils ripgrep bbe makeWrapper ];
+stdenv.mkDerivation (
+  overridable
+  // {
+    nativeBuildInputs =
+      nativeBuildInputs
+      ++
+        # Erlang/Elixir deps
+        [
+          erlang
+          elixir
+          hex
+          git
+        ]
+      ++
+        # Mix deps
+        (builtins.attrValues mixNixDeps)
+      ++
+        # other compile-time deps
+        [
+          findutils
+          ripgrep
+          bbe
+          makeWrapper
+        ];

-  buildInputs = buildInputs;
+    buildInputs = buildInputs;

-  MIX_ENV = mixEnv;
-  MIX_DEBUG = if enableDebugInfo then 1 else 0;
-  HEX_OFFLINE = 1;
+    MIX_ENV = mixEnv;
+    MIX_DEBUG = if enableDebugInfo then 1 else 0;
+    HEX_OFFLINE = 1;

-  DEBUG = if enableDebugInfo then 1 else 0; # for Rebar3 compilation
-  # The API with `mix local.rebar rebar path` makes a copy of the binary
-  # some older dependencies still use rebar.
-  MIX_REBAR = "${rebar}/bin/rebar";
-  MIX_REBAR3 = "${rebar3}/bin/rebar3";
+    DEBUG = if enableDebugInfo then 1 else 0; # for Rebar3 compilation
+    # The API with `mix local.rebar rebar path` makes a copy of the binary
+    # some older dependencies still use rebar.
+    MIX_REBAR = "${rebar}/bin/rebar";
+    MIX_REBAR3 = "${rebar3}/bin/rebar3";

-  ERL_COMPILER_OPTIONS =
-    let
-      options = erlangCompilerOptions ++ lib.optionals erlangDeterministicBuilds [ "deterministic" ];
-    in
-    "[${lib.concatStringsSep "," options}]";
+    ERL_COMPILER_OPTIONS =
+      let
+        options = erlangCompilerOptions ++ lib.optionals erlangDeterministicBuilds [ "deterministic" ];
+      in
+      "[${lib.concatStringsSep "," options}]";

-  LC_ALL = "C.UTF-8";
+    LC_ALL = "C.UTF-8";

-  postUnpack = ''
-    # Mix and Hex
-    export MIX_HOME="$TEMPDIR/mix"
-    export HEX_HOME="$TEMPDIR/hex"
+    postUnpack =
+      ''
+        # Mix and Hex
+        export MIX_HOME="$TEMPDIR/mix"
+        export HEX_HOME="$TEMPDIR/hex"

-    # Rebar
-    export REBAR_GLOBAL_CONFIG_DIR="$TEMPDIR/rebar3"
-    export REBAR_CACHE_DIR="$TEMPDIR/rebar3.cache"
+        # Rebar
+        export REBAR_GLOBAL_CONFIG_DIR="$TEMPDIR/rebar3"
+        export REBAR_CACHE_DIR="$TEMPDIR/rebar3.cache"

-    ${lib.optionalString (mixFodDeps != null) ''
-      # Compilation of the dependencies will require that the dependency path is
-      # writable, thus a copy to the $TEMPDIR is inevitable here.
-      export MIX_DEPS_PATH="$TEMPDIR/deps"
-      cp --no-preserve=mode -R "${mixFodDeps}" "$MIX_DEPS_PATH"
-    ''}
-  '' + (attrs.postUnpack or "");
+        ${lib.optionalString (mixFodDeps != null) ''
+          # Compilation of the dependencies will require that the dependency path is
+          # writable, thus a copy to the $TEMPDIR is inevitable here.
+          export MIX_DEPS_PATH="$TEMPDIR/deps"
+          cp --no-preserve=mode -R "${mixFodDeps}" "$MIX_DEPS_PATH"
+        ''}
+      ''
+      + (attrs.postUnpack or "");

-  configurePhase = attrs.configurePhase or ''
-    runHook preConfigure
+    configurePhase =
+      attrs.configurePhase or ''
+        runHook preConfigure

-    ${./mix-configure-hook.sh}
+        ${./mix-configure-hook.sh}

-    # This is needed for projects that have a specific compile step
-    # the dependency needs to be compiled in order for the task
-    # to be available.
-    #
-    # Phoenix projects for example will need compile.phoenix.
-    mix deps.compile --no-deps-check --skip-umbrella-children
+        # This is needed for projects that have a specific compile step
+        # the dependency needs to be compiled in order for the task
+        # to be available.
+        #
+        # Phoenix projects for example will need compile.phoenix.
+        mix deps.compile --no-deps-check --skip-umbrella-children

-    # Symlink dependency sources. This is needed for projects that require
-    # access to the source of their dependencies. For example, Phoenix
-    # projects need javascript assets to build asset bundles.
-    ${lib.optionalString (mixNixDeps != { }) ''
-      mkdir -p deps
+        # Symlink dependency sources. This is needed for projects that require
+        # access to the source of their dependencies. For example, Phoenix
+        # projects need javascript assets to build asset bundles.
+        ${lib.optionalString (mixNixDeps != { }) ''
+          mkdir -p deps

-      ${lib.concatMapStringsSep "\n" (dep: ''
-        dep_name=$(basename ${dep} | cut -d '-' -f2)
-        dep_path="deps/$dep_name"
-        if [ -d "${dep}/src" ]; then
-          ln -s ${dep}/src $dep_path
+          ${lib.concatMapStringsSep "\n" (dep: ''
+            dep_name=$(basename ${dep} | cut -d '-' -f2)
+            dep_path="deps/$dep_name"
+            if [ -d "${dep}/src" ]; then
+              ln -s ${dep}/src $dep_path
+            fi
+          '') (builtins.attrValues mixNixDeps)}
+        ''}
+
+        # Symlink deps to build root. Similar to above, but allows for mixFodDeps
+        # Phoenix projects to find javascript assets.
+        ${lib.optionalString (mixFodDeps != null) ''
+          ln -s ../deps ./
+        ''}
+
+        runHook postConfigure
+      '';
+
+    buildPhase =
+      attrs.buildPhase or ''
+        runHook preBuild
+
+        mix compile --no-deps-check ${lib.concatStringsSep " " compileFlags}
+
+        runHook postBuild
+      '';
+
+    installPhase =
+      attrs.installPhase or ''
+        runHook preInstall
+
+        mix release ${mixReleaseName} --no-deps-check --path "$out"
+
+        runHook postInstall
+      '';
+
+    postFixup =
+      ''
+        echo "removing files for Microsoft Windows"
+        rm -f "$out"/bin/*.bat
+
+        echo "wrapping programs in $out/bin with their runtime deps"
+        for f in $(find $out/bin/ -type f -executable); do
+          wrapProgram "$f" \
+            --prefix PATH : ${
+              lib.makeBinPath [
+                coreutils
+                gnused
+                gnugrep
+                gawk
+              ]
+            }
+        done
+      ''
+      + lib.optionalString removeCookie ''
+        if [ -e $out/releases/COOKIE ]; then
+          echo "removing $out/releases/COOKIE"
+          rm $out/releases/COOKIE
        fi
-      '') (builtins.attrValues mixNixDeps)}
-    ''}
+      ''
+      + ''
+        if [ -e $out/erts-* ]; then
+          # ERTS is included in the release, then erlang is not required as a runtime dependency.
+          # But, erlang is still referenced in some places. To removed references to erlang,
+          # following steps are required.

-    # Symlink deps to build root. Similar to above, but allows for mixFodDeps
-    # Phoenix projects to find javascript assets.
-    ${lib.optionalString (mixFodDeps != null) ''
-      ln -s ../deps ./
-    ''}
+          # 1. remove references to erlang from plain text files
+          for file in $(rg "${erlang}/lib/erlang" "$out" --files-with-matches); do
+            echo "removing references to erlang in $file"
+            substituteInPlace "$file" --replace "${erlang}/lib/erlang" "$out"
+          done

-    runHook postConfigure
-  '';
+          # 2. remove references to erlang from .beam files
+          #
+          # No need to do anything, because it has been handled by "deterministic" option specified
+          # by ERL_COMPILER_OPTIONS.

-  buildPhase = attrs.buildPhase or ''
-    runHook preBuild
+          # 3. remove references to erlang from normal binary files
+          for file in $(rg "${erlang}/lib/erlang" "$out" --files-with-matches --binary --iglob '!*.beam'); do
+            echo "removing references to erlang in $file"
+            # use bbe to substitute strings in binary files, because using substituteInPlace
+            # on binaries will raise errors
+            bbe -e "s|${erlang}/lib/erlang|$out|" -o "$file".tmp "$file"
+            rm -f "$file"
+            mv "$file".tmp "$file"
+          done

-    mix compile --no-deps-check ${lib.concatStringsSep " " compileFlags}
-
-    runHook postBuild
-  '';
-
-  installPhase = attrs.installPhase or ''
-    runHook preInstall
-
-    mix release --no-deps-check --path "$out"
-
-    runHook postInstall
-  '';
-
-  postFixup = ''
-    echo "removing files for Microsoft Windows"
-    rm -f "$out"/bin/*.bat
-
-    echo "wrapping programs in $out/bin with their runtime deps"
-    for f in $(find $out/bin/ -type f -executable); do
-      wrapProgram "$f" \
-        --prefix PATH : ${lib.makeBinPath [
-          coreutils
-          gnused
-          gnugrep
-          gawk
-        ]}
-    done
-  '' + lib.optionalString removeCookie ''
-    if [ -e $out/releases/COOKIE ]; then
-      echo "removing $out/releases/COOKIE"
-      rm $out/releases/COOKIE
-    fi
-  '' + ''
-    if [ -e $out/erts-* ]; then
-      # ERTS is included in the release, then erlang is not required as a runtime dependency.
-      # But, erlang is still referenced in some places. To removed references to erlang,
-      # following steps are required.
-
-      # 1. remove references to erlang from plain text files
-      for file in $(rg "${erlang}/lib/erlang" "$out" --files-with-matches); do
-        echo "removing references to erlang in $file"
-        substituteInPlace "$file" --replace "${erlang}/lib/erlang" "$out"
-      done
-
-      # 2. remove references to erlang from .beam files
-      #
-      # No need to do anything, because it has been handled by "deterministic" option specified
-      # by ERL_COMPILER_OPTIONS.
-
-      # 3. remove references to erlang from normal binary files
-      for file in $(rg "${erlang}/lib/erlang" "$out" --files-with-matches --binary --iglob '!*.beam'); do
-        echo "removing references to erlang in $file"
-        # use bbe to substitute strings in binary files, because using substituteInPlace
-        # on binaries will raise errors
-        bbe -e "s|${erlang}/lib/erlang|$out|" -o "$file".tmp "$file"
-        rm -f "$file"
-        mv "$file".tmp "$file"
-      done
-
-      # References to erlang should be removed from output after above processing.
-    fi
-  '' + lib.optionalString stripDebug ''
-    # Strip debug symbols to avoid hardreferences to "foreign" closures actually
-    # not needed at runtime, while at the same time reduce size of BEAM files.
-    erl -noinput -eval 'lists:foreach(fun(F) -> io:format("Stripping ~p.~n", [F]), beam_lib:strip(F) end, filelib:wildcard("'"$out"'/**/*.beam"))' -s init stop
-  '';
-})
+          # References to erlang should be removed from output after above processing.
+        fi
+      ''
+      + lib.optionalString stripDebug ''
+        # Strip debug symbols to avoid hardreferences to "foreign" closures actually
+        # not needed at runtime, while at the same time reduce size of BEAM files.
+        erl -noinput -eval 'lists:foreach(fun(F) -> io:format("Stripping ~p.~n", [F]), beam_lib:strip(F) end, filelib:wildcard("'"$out"'/**/*.beam"))' -s init stop
+      '';
+  }
+)
--- a/pkgs/development/compilers/erg/default.nix
+++ b/pkgs/development/compilers/erg/default.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "erg";
-  version = "0.6.39";
+  version = "0.6.40";

  src = fetchFromGitHub {
    owner = "erg-lang";
    repo = "erg";
    rev = "v${version}";
-    hash = "sha256-eVf1pQJ0mIZURRDK2k6boZUs+m6hu6lbWqKYWSNC5ng=";
+    hash = "sha256-j2H8haSyoIqhvoAWDqKdgX+CL2BseT0PyPi3tamvaeM=";
  };

-  cargoHash = "sha256-H7JorE6Psg/rndYpNMiyxOfsifBEi4l4bk4CvhDRFjE=";
+  cargoHash = "sha256-G2aM5joIumnOcTJhx9rpaYJfCOBPnNaoZ8VJZaoZ1bc=";

  nativeBuildInputs = [
    makeWrapper
--- a/pkgs/development/compilers/rust/default.nix
+++ b/pkgs/development/compilers/rust/default.nix
@ -65,7 +65,10 @@ in
      bootRustPlatform = makeRustPlatform bootstrapRustPackages;
    in {
      # Packages suitable for build-time, e.g. `build.rs`-type stuff.
-      buildRustPackages = (selectRustPackage pkgsBuildHost).packages.stable // { __attrsFailEvaluation = true; };
+      buildRustPackages = (selectRustPackage pkgsBuildHost).packages.stable // {
+        # Prevent `pkgs/top-level/release-attrpaths-superset.nix` from recursing more than one level here.
+        buildRustPackages = self.buildRustPackages // { __attrsFailEvaluation = true; };
+      };
      # Analogous to stdenv
      rustPlatform = makeRustPlatform self.buildRustPackages;
      rustc-unwrapped = self.callPackage ./rustc.nix ({
--- a/pkgs/development/cuda-modules/README.md
+++ b/pkgs/development/cuda-modules/README.md
@ -23,7 +23,7 @@ scope. These are typically required for the creation of the finalized
 ## Top-level directories

 - `cuda`: CUDA redistributables! Provides extension to `cudaPackages` scope.
- `cudatoolkit`: monolothic CUDA Toolkit run-file installer. Provides extension
+- `cudatoolkit`: monolithic CUDA Toolkit run-file installer. Provides extension
    to `cudaPackages` scope.
 - `cudnn`: NVIDIA cuDNN library.
 - `cutensor`: NVIDIA cuTENSOR library.
--- a/Show More
+++ b/Show More