Merge master into staging-next

2025-04-17 20:09:26 +00:00 · 2024-02-05 18:01:13 +00:00 · 2024-02-05 18:01:13 +00:00 · 2579984b85
commit 2579984b85
parent 5f4d3d57a7 7072592b62
127 changed files with 11974 additions and 1344 deletions
--- a/lib/tests/packages-from-directory/c/not-a-namespace/not-a-package.nix
+++ b/lib/tests/packages-from-directory/c/not-a-namespace/not-a-package.nix
@ -0,0 +1 @@
+{ }
--- a/lib/tests/packages-from-directory/c/support-definitions.nix
+++ b/lib/tests/packages-from-directory/c/support-definitions.nix
@ -0,0 +1 @@
+{ }
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -9667,6 +9667,11 @@
    matrix = "@katexochen:matrix.org";
    name = "Paul Meyer";
  };
+  katrinafyi = {
+    name = "katrinafyi";
+    github = "katrinafyi";
+    githubId = 39479354;
+  };
  kayhide = {
    email = "kayhide@gmail.com";
    github = "kayhide";
@ -18118,6 +18123,12 @@
    githubId = 38893265;
    name = "StrikerLulu";
  };
+  struan = {
+    email = "contact@struanrobertson.co.uk";
+    github = "struan-robertson";
+    githubId = 7543617;
+    name = "Struan Robertson";
+  };
  stteague = {
    email = "stteague505@yahoo.com";
    github = "stteague";
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -285,6 +285,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 - New options were added to the dnsdist module to enable and configure a DNSCrypt endpoint (see `services.dnsdist.dnscrypt.enable`, etc.).
  The module can generate the DNSCrypt provider key pair, certificates and also performs their rotation automatically with no downtime.

+- With a bump to `sonarr` v4, existing config database files will be upgraded automatically, but note that some old apparently-working configs [might actually be corrupt and fail to upgrade cleanly](https://forums.sonarr.tv/t/sonarr-v4-released/33089).
+
 - The Yama LSM is now enabled by default in the kernel, which prevents ptracing
  non-child processes. This means you will not be able to attach gdb to an
  existing process, but will need to start that process from gdb (so it is a
--- a/nixos/modules/config/no-x-libs.nix
+++ b/nixos/modules/config/no-x-libs.nix
@ -30,6 +30,7 @@ with lib;
      beam = super.beam_nox;
      cairo = super.cairo.override { x11Support = false; };
      dbus = super.dbus.override { x11Support = false; };
+      fastfetch = super.fastfetch.override { vulkanSupport = false; waylandSupport = false; x11Support = false; };
      ffmpeg_4 = super.ffmpeg_4.override { ffmpegVariant = "headless"; };
      ffmpeg_5 = super.ffmpeg_5.override { ffmpegVariant = "headless"; };
      # dep of graphviz, libXpm is optional for Xpm support
--- a/nixos/modules/services/web-apps/youtrack.nix
+++ b/nixos/modules/services/web-apps/youtrack.nix
@ -137,7 +137,7 @@ in
  config = lib.mkIf cfg.enable {
    warnings = lib.optional (lib.versions.major cfg.package.version <= "2022")
      "YouTrack 2022.x is deprecated. See https://nixos.org/manual/nixos/unstable/index.html#module-services-youtrack for details on how to upgrade."
-    ++ lib.optional (cfg.extraParams != "" && (lib.versions.major cfg.package.version >= "2023"))
+    ++ lib.optional (cfg.extraParams != {} && (lib.versions.major cfg.package.version >= "2023"))
      "'services.youtrack.extraParams' is deprecated and has no effect on YouTrack 2023.x and newer. Please migrate to 'services.youtrack.generalParameters'"
    ++ lib.optional (cfg.jvmOpts != "" && (lib.versions.major cfg.package.version >= "2023"))
      "'services.youtrack.jvmOpts' is deprecated and has no effect on YouTrack 2023.x and newer. Please migrate to 'services.youtrack.generalParameters'";
@ -231,7 +231,7 @@ in
    users.groups.youtrack = {};

    services.nginx = lib.mkIf (cfg.virtualHost != null) {
-      upstreams.youtrack.servers."${cfg.address}:${toString cfg.port}" = {};
+      upstreams.youtrack.servers."${cfg.address}:${toString cfg.environmentalParameters.listen-port}" = {};
      virtualHosts.${cfg.virtualHost}.locations = {
        "/" = {
          proxyPass = "http://youtrack";
--- a/nixos/modules/virtualisation/libvirtd.nix
+++ b/nixos/modules/virtualisation/libvirtd.nix
@ -466,6 +466,7 @@ in
        Type = "notify";
        KillMode = "process"; # when stopping, leave the VMs alone
        Restart = "no";
+        OOMScoreAdjust = "-999";
      };
      restartIfChanged = false;
    };
--- a/nixos/tests/incus/lxd-to-incus.nix
+++ b/nixos/tests/incus/lxd-to-incus.nix
@ -18,8 +18,6 @@ import ../make-test-python.nix (
    nodes.machine =
      { lib, ... }:
      {
-        environment.systemPackages = [ pkgs.lxd-to-incus ];
-
        virtualisation = {
          diskSize = 6144;
          cores = 2;
--- a/nixos/tests/kernel-generic.nix
+++ b/nixos/tests/kernel-generic.nix
@ -23,7 +23,7 @@ let
        assert "${linuxPackages.kernel.modDirVersion}" in machine.succeed("uname -a")
      '';
  }) args);
-  kernels = pkgs.linuxKernel.vanillaPackages // {
+  kernels = (removeAttrs pkgs.linuxKernel.vanillaPackages ["__attrsFailEvaluation"]) // {
    inherit (pkgs.linuxKernel.packages)
      linux_4_19_hardened
      linux_5_4_hardened
--- a/pkgs/applications/audio/furnace/default.nix
+++ b/pkgs/applications/audio/furnace/default.nix
@ -27,14 +27,14 @@

 stdenv.mkDerivation rec {
  pname = "furnace";
-  version = "0.6";
+  version = "0.6.1";

  src = fetchFromGitHub {
    owner = "tildearrow";
    repo = "furnace";
    rev = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-8we7vKyGWjM9Rx0MJjSKLJcKBHiHt5vjuy17HHx/pP8=";
+    hash = "sha256-QUOZGUyZp20ls7rtDK+cmg3Smbd+hl1m9aMhHQmMMbY=";
  };

  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
--- a/pkgs/applications/audio/mopidy/ytmusic.nix
+++ b/pkgs/applications/audio/mopidy/ytmusic.nix
@ -1,32 +1,32 @@
 { lib
 , python3
-, fetchPypi
+, fetchFromGitHub
 , mopidy
 }:

 let
-  python = python3.override {
-    packageOverrides = self: super: {
-      ytmusicapi = super.ytmusicapi.overridePythonAttrs (old: rec {
-        version = "0.25.1";
-        src = fetchPypi {
-          inherit (old) pname;
-          inherit version;
-          hash = "sha256-uc/fgDetSYaCRzff0SzfbRhs3TaKrfE2h6roWkkj8yQ=";
-        };
-      });
-    };
-  };
+  python = python3;
 in python.pkgs.buildPythonApplication rec {
  pname = "mopidy-ytmusic";
-  version = "0.3.8";
+  version = "0.3.9";
+  pyproject = true;

-  src = fetchPypi {
-    inherit version;
-    pname = "mopidy_ytmusic";
-    sha256 = "6b4d8ff9c477dbdd30d0259a009494ebe104cad3f8b37241ae503e5bce4ec2e8";
+  src = fetchFromGitHub {
+    owner = "jmcdo29";
+    repo = "mopidy-ytmusic";
+    rev = "v${version}";
+    hash = "sha256-2o4fDtaIxRDvIiAGV/9qK/00BmYXasBUwW03fxFcDAU=";
  };

+  postPatch = ''
+    # only setup.py has up to date dependencies
+    rm pyproject.toml
+  '';
+
+  nativeBuildInputs = with python.pkgs; [
+    setuptools
+  ];
+
  propagatedBuildInputs = [
    (mopidy.override { pythonPackages = python.pkgs; })
    python.pkgs.ytmusicapi
@ -39,9 +39,9 @@ in python.pkgs.buildPythonApplication rec {
  doCheck = false;

  meta = with lib; {
-    changelog = "https://github.com/OzymandiasTheGreat/mopidy-ytmusic/blob/v${version}/CHANGELOG.rst";
+    changelog = "https://github.com/jmcdo29/mopidy-ytmusic/releases/tag/${src.rev}";
    description = "Mopidy extension for playing music from YouTube Music";
-    homepage = "https://github.com/OzymandiasTheGreat/mopidy-ytmusic";
+    homepage = "https://github.com/jmcdo29/mopidy-ytmusic";
    license = licenses.asl20;
    maintainers = [ maintainers.nickhu ];
  };
--- a/pkgs/applications/audio/openutau/default.nix
+++ b/pkgs/applications/audio/openutau/default.nix
@ -2,7 +2,6 @@
 , stdenv
 , buildDotnetModule
 , fetchFromGitHub
-, fetchpatch
 , dotnetCorePackages
 , dbus
 , fontconfig
@ -14,28 +13,15 @@

 buildDotnetModule rec {
  pname = "OpenUtau";
-  version = "0.1.158";
+  version = "0.1.327";

  src = fetchFromGitHub {
    owner = "stakira";
    repo = "OpenUtau";
    rev = "build/${version}";
-    hash = "sha256-/+hlL2sj/juzWrDcb5dELp8Zdg688XK8OnjKz20rx/M=";
+    hash = "sha256-Bss32Fk4yBEFqaIxT2dfdvWXz09sO6akiitDQBXoSvY=";
  };

-  patches = [
-    # Needed until stakira/OpenUtau#836 is merged and released to fix crashing issues. See stakira/OpenUtau#822
-    (fetchpatch {
-      name = "openutau-update-avalonia-to-11.0.4.patch";
-      url = "https://github.com/stakira/OpenUtau/commit/0130d7387fb626a72850305dc61d7c175caccc0f.diff";
-      hash = "sha256-w9PLnfiUtiKY/8+y4qqINeEul4kP72nKEVc5c8p2g7c=";
-      # It looks like fetched files use CRLF but patch comes back with LF
-      decode = "sed -e 's/$/\\r/'";
-    })
-  ];
-  # Needs binary for above patch due to CRLF shenanigans otherwise being ignored
-  patchFlags = [ "-p1" "--binary" ];
-
  dotnet-sdk = dotnetCorePackages.sdk_7_0;
  dotnet-runtime = dotnetCorePackages.runtime_7_0;

@ -58,11 +44,15 @@ buildDotnetModule rec {
  # socket cannot bind to localhost on darwin for tests
  doCheck = !stdenv.isDarwin;

-  # needed until upstream bumps to dotnet 7
+  # net7.0 replacement needed until upstream bumps to dotnet 7
  postPatch = ''
    substituteInPlace OpenUtau/OpenUtau.csproj OpenUtau.Test/OpenUtau.Test.csproj --replace \
      '<TargetFramework>net6.0</TargetFramework>' \
      '<TargetFramework>net7.0</TargetFramework>'
+
+    substituteInPlace OpenUtau/Program.cs --replace \
+      '/usr/bin/fc-match' \
+      '${lib.getExe' fontconfig "fc-match"}'
  '';

  # need to make sure proprietary worldline resampler is copied
--- a/pkgs/applications/audio/openutau/deps.nix
+++ b/pkgs/applications/audio/openutau/deps.nix
@ -41,18 +41,18 @@
  (fetchNuGet { pname = "Microsoft.CodeAnalysis.CSharp"; version = "3.8.0"; sha256 = "1kmry65csvfn72zzc16vj1nfbfwam28wcmlrk3m5rzb8ydbzgylb"; })
  (fetchNuGet { pname = "Microsoft.CodeAnalysis.CSharp.Scripting"; version = "3.8.0"; sha256 = "0w0yx0lpg54iw5jazqk46h48gx43ij32gwac8iywdj6kxfxm03vw"; })
  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Scripting.Common"; version = "3.8.0"; sha256 = "0hjgxcsj5zy27lqk0986m59n5dbplx2vjjla2lsvg4bwg8qa7bpk"; })
-  (fetchNuGet { pname = "Microsoft.CodeCoverage"; version = "17.6.2"; sha256 = "1wwmg6hn4dp2mvwn2bm81wccdw149lq17xdnpz17mvg4zcwmax7g"; })
+  (fetchNuGet { pname = "Microsoft.CodeCoverage"; version = "17.8.0"; sha256 = "173wjadp3gan4x2jfjchngnc4ca4mb95h1sbb28jydfkfw0z1zvj"; })
  (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.3.0"; sha256 = "0gw297dgkh0al1zxvgvncqs0j15lsna9l1wpqas4rflmys440xvb"; })
  (fetchNuGet { pname = "Microsoft.Extensions.ObjectPool"; version = "5.0.10"; sha256 = "07fk669pjydkcg6bxxv7aj548fzab4yb7ba8370d719lgi9y425l"; })
  (fetchNuGet { pname = "Microsoft.ML.OnnxRuntime"; version = "1.15.0"; sha256 = "1wjafpn0fgxxyl5kw427ypc8c2gwha286sf96mv3fivdk3qyysxw"; })
  (fetchNuGet { pname = "Microsoft.ML.OnnxRuntime.Managed"; version = "1.15.0"; sha256 = "06hnsx0a81gbz5zr4qqij2c518wqdn3hg784zvkj0jlkwi5z2hr8"; })
-  (fetchNuGet { pname = "Microsoft.NET.Test.Sdk"; version = "17.6.2"; sha256 = "1a658bnh5q3lfkrr81h3lyx1mc3hggnjr1bpmim71rr2s42ad70v"; })
+  (fetchNuGet { pname = "Microsoft.NET.Test.Sdk"; version = "17.8.0"; sha256 = "1syvl3g0hbrcgfi9rq6pld8s8hqqww4dflf1lxn59ccddyyx0gmv"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; sha256 = "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "2.1.2"; sha256 = "1507hnpr9my3z4w1r6xk5n0s1j3y6a2c2cnynj76za7cphxi1141"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "5.0.0"; sha256 = "0mwpwdflidzgzfx2dlpkvvnkgkr2ayaf0s80737h4wa35gaj11rc"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.1.0"; sha256 = "193xwf33fbm0ni3idxzbr5fdq3i2dlfgihsac9jj7whj0gd902nh"; })
-  (fetchNuGet { pname = "Microsoft.TestPlatform.ObjectModel"; version = "17.6.2"; sha256 = "0asbrbdyyig1p034smf79lszzbfv1cn6q181i7d4p2vsiqpjp9sj"; })
-  (fetchNuGet { pname = "Microsoft.TestPlatform.TestHost"; version = "17.6.2"; sha256 = "0lcj8kkcnxbwiaw6j0xf4fxqpa6z0s41nq52spvckfg4367lg4fg"; })
+  (fetchNuGet { pname = "Microsoft.TestPlatform.ObjectModel"; version = "17.8.0"; sha256 = "0b0i7lmkrcfvim8i3l93gwqvkhhhfzd53fqfnygdqvkg6np0cg7m"; })
+  (fetchNuGet { pname = "Microsoft.TestPlatform.TestHost"; version = "17.8.0"; sha256 = "0f5jah93kjkvxwmhwb78lw11m9pkkq9fvf135hpymmmpxqbdh97q"; })
  (fetchNuGet { pname = "Microsoft.Win32.Primitives"; version = "4.3.0"; sha256 = "0j0c1wj4ndj21zsgivsc24whiya605603kxrbiw6wkfdync464wq"; })
  (fetchNuGet { pname = "Microsoft.Win32.SystemEvents"; version = "5.0.0"; sha256 = "0sja4ba0mrvdamn0r9mhq38b9dxi08yb3c1hzh29n1z6ws1hlrcq"; })
  (fetchNuGet { pname = "Microsoft.Win32.SystemEvents"; version = "6.0.0"; sha256 = "0c6pcj088g1yd1vs529q3ybgsd2vjlk5y1ic6dkmbhvrp5jibl9p"; })
@ -227,21 +227,19 @@
  (fetchNuGet { pname = "System.Windows.Extensions"; version = "5.0.0"; sha256 = "0q776jpacfjmps4sc6gjvqj89w1ynj41hb0lvqmfl3j221lsfdbz"; })
  (fetchNuGet { pname = "System.Xml.ReaderWriter"; version = "4.3.0"; sha256 = "0c47yllxifzmh8gq6rq6l36zzvw4kjvlszkqa9wq3fr59n0hl3s1"; })
  (fetchNuGet { pname = "System.Xml.XDocument"; version = "4.3.0"; sha256 = "08h8fm4l77n0nd4i4fk2386y809bfbwqb7ih9d7564ifcxr5ssxd"; })
-  (fetchNuGet { pname = "TinyPinyin.Net"; version = "1.0.2"; sha256 = "1f71xv8891gq5fsw89zq0n85hhxpc5pkh5ykwvigqpwb1s4zpx3w"; })
  (fetchNuGet { pname = "Tmds.DBus.Protocol"; version = "0.15.0"; sha256 = "0d99kcs7r9cp6gpyc7z230czkkyx4164x86dhy0mca73f2ykc2g2"; })
-  (fetchNuGet { pname = "ToolGood.Words.Pinyin"; version = "3.1.0"; sha256 = "19jpdbwclknc7wxpdrazq4pjgspzkzkzj0s9hxqksajx6pzgawhx"; })
  (fetchNuGet { pname = "UTF.Unknown"; version = "2.5.1"; sha256 = "0giks1ww539m4r5kzdyzkq0cvfi5k50va9idjz93rclgljl96gpl"; })
  (fetchNuGet { pname = "Vortice.DirectX"; version = "2.4.2"; sha256 = "11yjyvyz922z1ygl8gxmdym3918df12nl7xxry4pdjpl8is33qic"; })
  (fetchNuGet { pname = "Vortice.DXGI"; version = "2.4.2"; sha256 = "17vsnm9ca6nqk3f1dfpfvd6i6fp8x8v41bn65rchrzwcv1zzi6pz"; })
  (fetchNuGet { pname = "Vortice.Mathematics"; version = "1.4.25"; sha256 = "0vl6g087disxyzskvkbnwym74s47lkza0ly3nk4y0y88zibcggrj"; })
  (fetchNuGet { pname = "WanaKana-net"; version = "1.0.0"; sha256 = "197qklph8hzrihalpi0kx4n9sf94xnhywzscisnlsxybxxdjz79z"; })
-  (fetchNuGet { pname = "xunit"; version = "2.4.2"; sha256 = "0barl6x1qwx9srjxnanw9z0jik7lv1fp6cvmgqhk10aiv57dgqxm"; })
+  (fetchNuGet { pname = "xunit"; version = "2.6.2"; sha256 = "0g5j0xwrv9cwrx91cjb9gas3wnkcwwk8krhdzsv50vlyp71pqqgz"; })
  (fetchNuGet { pname = "xunit.abstractions"; version = "2.0.3"; sha256 = "00wl8qksgkxld76fgir3ycc5rjqv1sqds6x8yx40927q5py74gfh"; })
-  (fetchNuGet { pname = "xunit.analyzers"; version = "1.0.0"; sha256 = "0p4f24c462z49gvbh3k4z5ksa8ffa6p8abdgysqbbladl96im4c5"; })
-  (fetchNuGet { pname = "xunit.assert"; version = "2.4.2"; sha256 = "0ifdry9qq3yaw2lfxdll30ljx1jkyhwwy3ydw6gd97y3kifr3k60"; })
-  (fetchNuGet { pname = "xunit.core"; version = "2.4.2"; sha256 = "1ir029igwm6b571lcm6585v5yxagy66rwrg26v4a1fnjq9dnh4cd"; })
-  (fetchNuGet { pname = "xunit.extensibility.core"; version = "2.4.2"; sha256 = "1h0a62xddsd82lljfjldn1nqy17imga905jb7j0ddr10wi8cqm62"; })
-  (fetchNuGet { pname = "xunit.extensibility.execution"; version = "2.4.2"; sha256 = "0r9gczqz4bc59cwl6d6wali6pvlw210i97chc1nlwn2qh383m54p"; })
-  (fetchNuGet { pname = "xunit.runner.visualstudio"; version = "2.4.5"; sha256 = "0y8w33ci80z8k580pp24mfnaw1r8ji0w3az543xxcz6aagax9zhs"; })
+  (fetchNuGet { pname = "xunit.analyzers"; version = "1.6.0"; sha256 = "1nwrz0mxk2hk2rwwabgr0a4wa3j22qwm94xvrzci39l58hmzxpbi"; })
+  (fetchNuGet { pname = "xunit.assert"; version = "2.6.2"; sha256 = "1nxg9m8qhh05i9linap7a8bdhxnr7x2pg7piw8hh76cshx0402ql"; })
+  (fetchNuGet { pname = "xunit.core"; version = "2.6.2"; sha256 = "0q0kzjdb0hxq4bajl11pvnwl1dp47b2adqx47j30bi2llj21ihj6"; })
+  (fetchNuGet { pname = "xunit.extensibility.core"; version = "2.6.2"; sha256 = "1a27ng02piwjr3ggff4mg0r92b6rabd1339clnxzqxwcyf620q2c"; })
+  (fetchNuGet { pname = "xunit.extensibility.execution"; version = "2.6.2"; sha256 = "1lhhlrq6lzd4w61x78dhxjz1453lnipjgph8sc52izgwq9d5xp1n"; })
+  (fetchNuGet { pname = "xunit.runner.visualstudio"; version = "2.5.4"; sha256 = "0mp3z8m5l4q09lr17142hff6p05zl189cwz3iavfqk8dpspyjgvd"; })
  (fetchNuGet { pname = "YamlDotNet"; version = "13.1.0"; sha256 = "1mqgg0m1mr8vmcz24miagmf1s2b4mmm5mbsf1p0d7cippficiiaz"; })
 ]
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -3279,6 +3279,19 @@ let
        };
      };

+      shopify.ruby-lsp = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          publisher = "shopify";
+          name = "ruby-lsp";
+          version = "0.5.8";
+          sha256 = "sha256-1FfBnw98SagHf1P7udWzMU6BS5dBihpeRj4qv9S4ZHw=";
+        };
+        meta = {
+          description = "VS Code plugin for connecting with the Ruby LSP";
+          license = lib.licenses.mit;
+        };
+      };
+
      shyykoserhiy.vscode-spotify = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "vscode-spotify";
--- a/pkgs/applications/emulators/atari800/default.nix
+++ b/pkgs/applications/emulators/atari800/default.nix
@ -1,43 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook
-, zlib, SDL, readline, libGLU, libGL, libX11 }:
-
-with lib;
-stdenv.mkDerivation rec {
-  pname = "atari800";
-  version = "5.0.0";
-
-  src = fetchFromGitHub {
-    owner = "atari800";
-    repo = "atari800";
-    rev = "ATARI800_${replaceStrings ["."] ["_"] version}";
-    sha256 = "sha256-+eJXhqPyU0GhmzF7DbteTXzEnn5klCor9Io/UgXQfQg=";
-  };
-
-  nativeBuildInputs = [ autoreconfHook ];
-
-  buildInputs = [ zlib SDL readline libGLU libGL libX11 ];
-
-  configureFlags = [
-    "--target=default"
-    "--with-video=sdl"
-    "--with-sound=sdl"
-    "--with-readline"
-    "--with-opengl"
-    "--with-x"
-    "--enable-riodevice"
-  ];
-
-  meta = {
-    homepage = "https://atari800.github.io/";
-    description = "An Atari 8-bit emulator";
-    longDescription = ''
-      Atari800 is the emulator of Atari 8-bit computer systems and
-      5200 game console for Unix, Linux, Amiga, MS-DOS, Atari
-      TT/Falcon, MS-Windows, MS WinCE, Sega Dreamcast, Android and
-      other systems supported by the SDL library.
-    '';
-    maintainers = [ maintainers.AndersonTorres ];
-    license = licenses.gpl2Plus;
-    platforms = lib.platforms.linux;
-  };
-}
--- a/pkgs/applications/emulators/blink/default.nix
+++ b/pkgs/applications/emulators/blink/default.nix
@ -1,24 +1,16 @@
-{ stdenv, fetchFromGitHub, fetchpatch, lib }:
+{ stdenv, fetchFromGitHub, lib }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "blink";
-  version = "1.0.0";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "jart";
    repo = "blink";
    rev = finalAttrs.version;
-    hash = "sha256-W7yL7Ut3MRygJhFGr+GIj/CK57MkuDTcenft8IvH7jU=";
+    hash = "sha256-4wgDftXOYm2fMP+/aTRljDi38EzbbwAJlQkuxjAMl3I=";
  };

-  # Drop after next release
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/jart/blink/commit/b31fed832b10d32eadaec885fb20dacbb0eb6986.patch";
-      hash = "sha256-DfZxW/H58qXAjkQz31YS4SPMz7152ZzNHK7wHopgnQA=";
-    })
-  ];
-
  # Do not include --enable-static and --disable-shared flags during static compilation
  dontAddStaticConfigureFlags = true;

--- a/pkgs/applications/emulators/yuzu/compat-list.nix
+++ b/pkgs/applications/emulators/yuzu/compat-list.nix
@ -1,13 +1,13 @@
 { stdenv, fetchFromGitHub, unstableGitUpdater }:
 stdenv.mkDerivation {
  pname = "yuzu-compatibility-list";
-  version = "unstable-2024-01-30";
+  version = "unstable-2024-02-04";

  src = fetchFromGitHub {
    owner = "flathub";
    repo = "org.yuzu_emu.yuzu";
-    rev = "82194fa23ec35545ade47cc3dc2035b2b07badcb";
-    hash = "sha256-LsQZml8I43fZDFACtVZpc76/62Pv11Z6bm8w/9hTHdI=";
+    rev = "963c657c2f852d96b5f203fbb6fafe6c56197ac9";
+    hash = "sha256-TNvAonMoGpJXjrkBFrBlYoTlwdPEMwiF/YhsOTYEB4k=";
  };

  buildCommand = ''
--- a/pkgs/applications/emulators/yuzu/early-access/sources.nix
+++ b/pkgs/applications/emulators/yuzu/early-access/sources.nix
@ -1,7 +1,7 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2024-01-28
+# Last updated: 2024-02-05
 {
-  version = "4093";
-  distHash = "sha256:0f6ffs0qvq516vcc6w132p9lg888cy6id9cgkdmzc6039aymdgki";
-  fullHash = "sha256:1scn06anfjvy4ysxmv8qq7p5dzkfqyxbm6h6lpywy3nkpyx1cz15";
+  version = "4115";
+  distHash = "sha256:16dfqlgz7lw909jqa505d69kx9jm0l3hxrfikkqpnvfr2fywkfng";
+  fullHash = "sha256:1506435pbpb1m8i6qz717wxbinxqbs6c8pq6ymw5zs9dnfh765ms";
 }
--- a/pkgs/applications/emulators/yuzu/mainline.nix
+++ b/pkgs/applications/emulators/yuzu/mainline.nix
@ -1,10 +1,9 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , nix-update-script
 , wrapQtAppsHook
-, alsa-lib
+, autoconf
 , boost
 , catch2_3
 , cmake
@ -12,58 +11,46 @@
 , cpp-jwt
 , cubeb
 , discord-rpc
-, doxygen
 , enet
-, ffmpeg
 , fmt
 , glslang
-, httplib
-, inih
-, libjack2
 , libopus
-, libpulseaudio
 , libusb1
 , libva
-, libzip
 , lz4
 , nlohmann_json
+, nv-codec-headers-12
 , nx_tzdb
-, perl
 , pkg-config
-, python3
 , qtbase
 , qtmultimedia
 , qttools
 , qtwayland
 , qtwebengine
-, rapidjson
 , SDL2
-, sndio
-, speexdsp
-, udev
 , vulkan-headers
 , vulkan-loader
+, yasm
 , zlib
 , zstd
 }:
 stdenv.mkDerivation(finalAttrs: {
  pname = "yuzu";
-  version = "1696";
+  version = "1704";

  src = fetchFromGitHub {
    owner = "yuzu-emu";
    repo = "yuzu-mainline";
    rev = "mainline-0-${finalAttrs.version}";
-    hash = "sha256-9xIhOA8hA7rsjtO0sgg1ucqghSzaOtkuTAHyQvmT+y4=";
+    hash = "sha256-8vIwWahl5JmFlOfMRuec1LiYz4F6mPEH4+p2e1IRBdU=";
    fetchSubmodules = true;
  };

  nativeBuildInputs = [
    cmake
-    doxygen
-    perl
+    glslang
    pkg-config
-    python3
+    qttools
    wrapQtAppsHook
  ];

@ -72,7 +59,6 @@ stdenv.mkDerivation(finalAttrs: {
    # don't get picked up by accident
    vulkan-headers

-    alsa-lib
    boost
    catch2_3
    cpp-jwt
@ -80,30 +66,31 @@ stdenv.mkDerivation(finalAttrs: {
    discord-rpc
    # intentionally omitted: dynarmic - prefer vendored version for compatibility
    enet
-    ffmpeg
+
+    # vendored ffmpeg deps
+    autoconf
+    yasm
+    libva  # for accelerated video decode on non-nvidia
+    nv-codec-headers-12  # for accelerated video decode on nvidia
+    # end vendored ffmpeg deps
+
    fmt
-    glslang
-    httplib
-    inih
-    libjack2
+    # intentionally omitted: gamemode - loaded dynamically at runtime
+    # intentionally omitted: httplib - upstream requires an older version than what we have
    libopus
-    libpulseaudio
    libusb1
-    libva
-    libzip
    # intentionally omitted: LLVM - heavy, only used for stack traces in the debugger
    lz4
    nlohmann_json
    qtbase
    qtmultimedia
-    qttools
    qtwayland
    qtwebengine
-    rapidjson
+    # intentionally omitted: renderdoc - heavy, developer only
    SDL2
-    sndio
-    speexdsp
-    udev
+    # not packaged in nixpkgs: simpleini
+    # intentionally omitted: stb - header only libraries, vendor uses git snapshot
+    # not packaged in nixpkgs: vulkan-memory-allocator
    # intentionally omitted: xbyak - prefer vendored version for compatibility
    zlib
    zstd
@ -127,6 +114,9 @@ stdenv.mkDerivation(finalAttrs: {
    "-DYUZU_USE_EXTERNAL_SDL2=OFF"
    "-DYUZU_USE_EXTERNAL_VULKAN_HEADERS=OFF"

+    # don't use system ffmpeg, yuzu uses internal APIs
+    "-DYUZU_USE_BUNDLED_FFMPEG=ON"
+
    # don't check for missing submodules
    "-DYUZU_CHECK_SUBMODULES=OFF"

@ -140,6 +130,9 @@ stdenv.mkDerivation(finalAttrs: {
    "-DENABLE_COMPATIBILITY_LIST_DOWNLOAD=OFF" # We provide this deterministically
  ];

+  # Does some handrolled SIMD
+  env.NIX_CFLAGS_COMPILE = "-msse4.1";
+
  # Fixes vulkan detection.
  # FIXME: patchelf --add-rpath corrupts the binary for some reason, investigate
  qtWrapperArgs = [
--- a/pkgs/applications/kde/audiotube.nix
+++ b/pkgs/applications/kde/audiotube.nix
@ -11,6 +11,7 @@
 , ki18n
 , kirigami2
 , kirigami-addons
+, kpurpose
 , qcoro
 , qtimageformats
 , qtmultimedia
@ -35,6 +36,7 @@ mkDerivation rec {
    ki18n
    kirigami2
    kirigami-addons
+    kpurpose
    qcoro
    qtimageformats
    qtmultimedia
--- a/pkgs/applications/misc/confy/default.nix
+++ b/pkgs/applications/misc/confy/default.nix
@ -1,9 +1,9 @@
-{ blueprint-compiler
+{ lib
+, blueprint-compiler
 , desktop-file-utils
 , fetchFromSourcehut
 , gobject-introspection
 , gtk4
-, lib
 , libadwaita
 , libnotify
 , meson
@ -14,25 +14,25 @@
 , wrapGAppsHook
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "confy";
-  version = "0.7.0";
+  version = "0.7.1";

  src = fetchFromSourcehut {
    owner = "~fabrixxm";
    repo = "confy";
-    rev = version;
-    hash = "sha256-q8WASTNbiBuKb2tPQBmUL9ji60PRAPnYOTYxnUn0MAw=";
+    rev = finalAttrs.version;
+    hash = "sha256-BXQDnRRt2Kuqc1Gwx6Ba6BoEWhICTCsWWkGlBsStyT8=";
  };

  nativeBuildInputs = [
    blueprint-compiler
    desktop-file-utils
+    gobject-introspection
    meson
    ninja
    pkg-config
    wrapGAppsHook
-    gobject-introspection
  ];

  buildInputs = [
@ -50,10 +50,11 @@ stdenv.mkDerivation rec {
  '';

  meta = with lib; {
+    changelog = "https://git.sr.ht/~fabrixxm/confy/refs/${finalAttrs.version}";
    description = "Conferences schedule viewer";
    homepage = "https://confy.kirgroup.net/";
-    changelog = "https://git.sr.ht/~fabrixxm/confy/refs/${version}";
-    license = licenses.gpl3;
+    license = licenses.gpl3Plus;
+    mainProgram = "confy";
    maintainers = with maintainers; [ michaelgrahamevans ];
  };
-}
+})
--- a/pkgs/applications/misc/ff2mpv/default.nix
+++ b/pkgs/applications/misc/ff2mpv/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "ff2mpv";
-  version = "5.0.1";
+  version = "5.1.0";

  src = fetchFromGitHub {
    owner = "woodruffw";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-unSnySEhaaLIW/6R+vmNONb5xMSgQLtSsOLGcfuW0RY=";
+    hash = "sha256-Xx18EX/MxLrnwZGwMFZJxJURUpjU2P01CQue5XbZ3fw=";
  };

  buildInputs = [ python3 mpv ];
--- a/pkgs/applications/misc/octoprint/plugins.nix
+++ b/pkgs/applications/misc/octoprint/plugins.nix
@ -233,13 +233,13 @@ in

  printtimegenius = buildPlugin rec {
    pname = "printtimegenius";
-    version = "2.2.8";
+    version = "2.3.1";

    src = fetchFromGitHub {
      owner = "eyal0";
      repo = "OctoPrint-PrintTimeGenius";
      rev = version;
-      sha256 = "sha256-Bbpm7y4flzEbUb6Sgkp6hIIHs455A0IsbmzvZwlkbh0=";
+      sha256 = "sha256-2lxaTcmPBSdfMmViIfLEbeYWfXZpNVAO4i5Z678gWy0=";
    };

    propagatedBuildInputs = with super; [
--- a/pkgs/applications/misc/qcad/default.nix
+++ b/pkgs/applications/misc/qcad/default.nix
@ -18,14 +18,14 @@

 mkDerivation rec {
  pname = "qcad";
-  version = "3.29.2.0";
+  version = "3.29.3.1";

  src = fetchFromGitHub {
    name = "qcad-${version}-src";
    owner = "qcad";
    repo = "qcad";
    rev = "v${version}";
-    sha256 = "sha256-7SX0hBSySY8AgmIwVjuszrfdfVKZ8axQzkpON9mjHgg=";
+    sha256 = "sha256-QPBiEoOseNUzAWQHPEBq6O0jg8ed5dH+8xlyRCct0g4=";
  };

  patches = [
--- a/pkgs/applications/networking/browsers/microsoft-edge/default.nix
+++ b/pkgs/applications/networking/browsers/microsoft-edge/default.nix
@ -1,20 +1,20 @@
 {
  stable = import ./browser.nix {
    channel = "stable";
-    version = "121.0.2277.83";
+    version = "121.0.2277.98";
    revision = "1";
-    hash = "sha256-WuDu44elNlkYZEtol+TZNpcRAkAq8HHATYCc9Or/bvU=";
+    hash = "sha256-vm0aBWiGtjdSu55nCNuhbqn4XVI6l/BxwmpTlTHWt/M=";
  };
  beta = import ./browser.nix {
    channel = "beta";
-    version = "121.0.2277.83";
+    version = "122.0.2365.8";
    revision = "1";
-    hash = "sha256-eW8Bpcjw1aY5lMqsGCJ3hORVLhzW8Fmaio+kpSOzPeU=";
+    hash = "sha256-1qM61lO7LyX7CuLrKsEuciud7BuDxRKNyQahdFJhq+g=";
  };
  dev = import ./browser.nix {
    channel = "dev";
-    version = "122.0.2353.0";
+    version = "122.0.2365.3";
    revision = "1";
-    hash = "sha256-llLaq13SU4ZpqhOYK0hy6ZD6amAqijStk8TIHX3gydQ=";
+    hash = "sha256-O2SxGzcvNloxLbexDjA0C28w7EJi1Fl9IUnI1zc1S6Y=";
  };
 }
--- a/pkgs/applications/networking/cluster/atmos/default.nix
+++ b/pkgs/applications/networking/cluster/atmos/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "atmos";
-  version = "1.55.0";
+  version = "1.57.0";

  src = fetchFromGitHub {
    owner = "cloudposse";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-JRvPRlq4H9PcELozlvIE065LSNIxrh/Ej+2GXO8s2x4=";
+    sha256 = "sha256-saOEMGZKtlMDZjkzac3j5hu5j0rKCNnDKV3aRnP5TWc=";
  };

-  vendorHash = "sha256-YBcVsuBL5n5ycaY1a0uxlDKX7YyrtF16gi17wCK1Jio=";
+  vendorHash = "sha256-Gjff8341MrUal3fVTDXE6nP9RwxaHYTjhPImaEv/9RU=";

  ldflags = [ "-s" "-w" "-X github.com/cloudposse/atmos/cmd.Version=v${version}" ];

--- a/pkgs/applications/networking/cluster/linkerd/edge.nix
+++ b/pkgs/applications/networking/cluster/linkerd/edge.nix
@ -2,7 +2,7 @@

 (callPackage ./generic.nix { }) {
  channel = "edge";
-  version = "24.1.2";
-  sha256 = "1rwdjlf20k84g94ca724wcpykpd9z0q8ymi0mdyz86kfry6hr5sz";
-  vendorHash = "sha256-8fNse2ZuyWqZsHSUh+buEIYPf8JsEL+0Z8tkbxfiCwA=";
+  version = "24.2.1";
+  sha256 = "1flbjsa2wj35zgiq4vgb2bqvjvxmpla6fnrlkwnh2l10w4i2n5sl";
+  vendorHash = "sha256-1DyqtUSMzVahy8yzX8HAnCe3UI5Z1Pht5XQaMS2i9mw=";
 }
--- a/pkgs/applications/networking/cluster/starboard/default.nix
+++ b/pkgs/applications/networking/cluster/starboard/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "starboard";
-  version = "0.15.19";
+  version = "0.15.20";

  src = fetchFromGitHub {
    owner = "aquasecurity";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-99YxScZNSNBiqFb7vsus7yJ99oGf+e2AjWn8aqnuQso=";
+    sha256 = "sha256-oOz7Dt+j2EmBL/aJUjqRST90wYpXkyREnKCcmNBQX18=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
--- a/pkgs/applications/networking/cluster/velero/default.nix
+++ b/pkgs/applications/networking/cluster/velero/default.nix
@ -2,14 +2,14 @@

 buildGoModule rec {
  pname = "velero";
-  version = "1.12.3";
+  version = "1.13.0";


  src = fetchFromGitHub {
    owner = "vmware-tanzu";
    repo = "velero";
    rev = "v${version}";
-    sha256 = "sha256-bMl6OYsKG7RR2a0N4RK+3ySSPk1RNbQ4WSQVz3lS9TU=";
+    sha256 = "sha256-R9iZpib8hoU9EC6B6Kaj2dWDOkb5qFw1UzsxMBClCso=";
  };

  ldflags = [
@ -20,7 +20,7 @@ buildGoModule rec {
    "-X github.com/vmware-tanzu/velero/pkg/buildinfo.GitSHA=none"
  ];

-  vendorHash = "sha256-kPs7N3N7E1IiBqBIYFwXlNIrGtFnaRJiTFR4eCOc1mo=";
+  vendorHash = "sha256-Fu4T2VEW5s/KCdgJLk3bf0wIUhKULK6QuNEmL99MUCI=";

  excludedPackages = [ "issue-template-gen" "release-tools" "v1" "velero-restic-restore-helper" ];

--- a/pkgs/applications/networking/cluster/werf/default.nix
+++ b/pkgs/applications/networking/cluster/werf/default.nix
@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "werf";
-  version = "1.2.284";
+  version = "1.2.287";

  src = fetchFromGitHub {
    owner = "werf";
    repo = "werf";
    rev = "v${version}";
-    hash = "sha256-02dvkz8lgvbiTZ194pv5UruKgB5+BtDbogAkEOfzpaA=";
+    hash = "sha256-+xilQ9By8cbH/CDCxAocm2OlVnvh7efqcB/3cMZhc1w=";
  };

-  vendorHash = "sha256-u7E+4VK3D36ipAqQVPeIyAhv/1JvgMHEuUUiQH/43ME=";
+  vendorHash = "sha256-uzIUjG3Hv7wdsbX75wHZ8Z8fy/EPgRKH74VXUhThycE=";

  proxyVendor = true;

--- a/pkgs/applications/networking/gnome-network-displays/default.nix
+++ b/pkgs/applications/networking/gnome-network-displays/default.nix
@ -13,20 +13,26 @@
 # Not native
 , gst_all_1
 , gsettings-desktop-schemas
-, gtk3
+, gtk4
+, avahi
 , glib
 , networkmanager
+, json-glib
+, libadwaita
+, libportal-gtk4
 , libpulseaudio
+, libsoup_3
 , pipewire
+, protobufc
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "gnome-network-displays";
-  version = "0.90.5";
+  version = "0.92.1";

  src = fetchurl {
    url = "mirror://gnome/sources/${finalAttrs.pname}/${lib.versions.majorMinor finalAttrs.version}/${finalAttrs.pname}-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-2SBVQK4fJeK8Y2UrrL0g5vQIerDdGE1nhFc6ke4oIpI=";
+    sha256 = "sha256-aoH9SpD7AfM6c6moMCCuQ1igkcrKgqAf1iLlpuXtaic=";
  };

  nativeBuildInputs = [
@ -41,7 +47,8 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  buildInputs = [
-    gtk3
+    avahi
+    gtk4
    glib
    gsettings-desktop-schemas
    gst_all_1.gstreamer
@ -53,9 +60,24 @@ stdenv.mkDerivation (finalAttrs: {
    gst_all_1.gst-vaapi
    pipewire
    networkmanager
+    json-glib
+    libadwaita
+    libportal-gtk4
    libpulseaudio
+    libsoup_3
+    protobufc
  ];

+  /* Without this flag, we get this include error:
+
+  /nix/store/...-gst-rtsp-server-1.22.8-dev/include/gstreamer-1.0/gst/rtsp-server/rtsp-media-factory.h:21:10: fatal error: gst/rtsp/gstrtspurl.h: No such file or directory
+  21 | #include <gst/rtsp/gstrtspurl.h>
+
+  Hence, this is not necessarily an upstream issue, but could be something
+  wrong with how our gst_all_1 depend on each other.
+  */
+  CFLAGS = "-I${gst_all_1.gst-plugins-base.dev}/include/gstreamer-1.0";
+
  preConfigure = ''
    patchShebangs ./build-aux/meson/postinstall.py
  '';
--- a/pkgs/applications/networking/instant-messengers/beeper/default.nix
+++ b/pkgs/applications/networking/instant-messengers/beeper/default.nix
@ -11,11 +11,11 @@
 }:
 let
  pname = "beeper";
-  version = "3.93.36";
+  version = "3.94.20";
  name = "${pname}-${version}";
  src = fetchurl {
-    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.93.36-build-2401269p8vcb695-x86_64.AppImage";
-    hash = "sha256-3pOOAI4/BWdbWfPweRx5I2KRi9VOgJ5vcQ89FTJhPak=";
+    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.94.20-build-240202yjfv5ggow-x86_64.AppImage";
+    hash = "sha256-bpGZk0fkul5hPBO3Wmvwzjxw6j2KK90Xbk7HeeggZBs=";
  };
  appimage = appimageTools.wrapType2 {
    inherit version pname src;
--- a/pkgs/applications/networking/shellhub-agent/default.nix
+++ b/pkgs/applications/networking/shellhub-agent/default.nix
@ -11,18 +11,18 @@

 buildGoModule rec {
  pname = "shellhub-agent";
-  version = "0.14.2";
+  version = "0.14.3";

  src = fetchFromGitHub {
    owner = "shellhub-io";
    repo = "shellhub";
    rev = "v${version}";
-    hash = "sha256-VP1U5JSVsAcGeV/xUrToJfrdw0TWbHhmi2Y/tM5bHpQ=";
+    hash = "sha256-XnkU/I41x6JqrH5D6JGw1fgdiNfiMOBy9DUUXzKwkGg=";
  };

  modRoot = "./agent";

-  vendorHash = "sha256-ISFnljpdOcvhNTM4jMGmi2xArjWSmjJj7dCnlcSfkVI=";
+  vendorHash = "sha256-nuFgJc1xQU4X86ojdFzs+9Gp3HDLsw3tkMcprlXCrko=";

  ldflags = [ "-s" "-w" "-X main.AgentVersion=v${version}" ];

--- a/pkgs/applications/office/fava/default.nix
+++ b/pkgs/applications/office/fava/default.nix
@ -2,12 +2,12 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "fava";
-  version = "1.27.1";
+  version = "1.27.2";
  format = "pyproject";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-W/uxzk+/4tDVOL+nVUJfyBAE5sI9/pYq1zu42GCGjSk=";
+    hash = "sha256-kLQAWFHDmzsBjVMm/ZUn+TFkM52W0h0jg0wSp1tmPZQ=";
  };

  nativeBuildInputs = with python3.pkgs; [ setuptools-scm ];
--- a/pkgs/applications/office/jabref/default.nix
+++ b/pkgs/applications/office/jabref/default.nix
@ -2,7 +2,6 @@
 , stdenv
 , fetchurl
 , fetchFromGitHub
-, fetchpatch
 , wrapGAppsHook
 , makeDesktopItem
 , copyDesktopItems
@ -22,16 +21,20 @@ let
      pin = "2.2.1-20230117.075740-16";
    };
  };
+  jackson-datatype-jsr310 = fetchurl {
+    url = "https://repo1.maven.org/maven2/com/fasterxml/jackson/datatype/jackson-datatype-jsr310/2.15.3/jackson-datatype-jsr310-2.15.3.jar";
+    hash = "sha256-vqHXgAnrxOXVSRij967F2p+9CfZiwZGiF//PN+hSfF4=";
+  };
 in
 stdenv.mkDerivation rec {
-  version = "5.11";
+  version = "5.12";
  pname = "jabref";

  src = fetchFromGitHub {
    owner = "JabRef";
    repo = "jabref";
    rev = "v${version}";
-    hash = "sha256-MTnM4QHTFXJt/T8SOWwHlZ1CuegSGjpT3qDaMRi5n18=";
+    hash = "sha256-+ltd9hItmMkEpKzX6TFfFy5fiOkLBK/tQNsh8OVDeoc=";
    fetchSubmodules = true;
  };

@ -51,7 +54,7 @@ stdenv.mkDerivation rec {

  deps = stdenv.mkDerivation {
    pname = "${pname}-deps";
-    inherit src version patches postPatch;
+    inherit src version postPatch;

    nativeBuildInputs = [ gradle perl ];
    buildPhase = ''
@ -61,26 +64,20 @@ stdenv.mkDerivation rec {
    '';
    # perl code mavenizes pathes (com.squareup.okio/okio/1.13.0/a9283170b7305c8d92d25aff02a6ab7e45d06cbe/okio-1.13.0.jar -> com/squareup/okio/okio/1.13.0/okio-1.13.0.jar)
    installPhase = ''
-      find $GRADLE_USER_HOME/caches/modules-2 -type f -regex '.*\.\(jar\|pom\)' \
+      find $GRADLE_USER_HOME/caches/modules-2/ -type f -regex '.*\.\(jar\|pom\)' \
        | perl -pe 's#(.*/([^/]+)/([^/]+)/([^/]+)/[0-9a-f]{30,40}/([^/\s]+))$# ($x = $2) =~ tr|\.|/|; "install -Dm444 $1 \$out/$x/$3/$4/''${\($5 =~ s/-jvm//r)}" #e' \
        | sh
      mv $out/com/tobiasdiez/easybind/${versionReplace.easybind.pin} \
        $out/com/tobiasdiez/easybind/${versionReplace.easybind.snapshot}
+      # This is used but not cached by Gradle.
+      cp ${jackson-datatype-jsr310} $out/com/fasterxml/jackson/datatype/jackson-datatype-jsr310/2.15.3/jackson-datatype-jsr310-2.15.3.jar
    '';
    # Don't move info to share/
    forceShare = [ "dummy" ];
    outputHashMode = "recursive";
-    outputHash = "sha256-sMbAv122EcLPOqbEVKowfxp9B71iJaccLRlKS75b3Xc=";
+    outputHash = "sha256-baP/zNgcc6oYwwbWvT7ontULcKKCw0rTQRkdZMgcWfY=";
  };

-  patches = [
-    # Use JavaFX 21
-    (fetchpatch {
-      url = "https://github.com/JabRef/jabref/commit/2afd1f622a3ab85fc2cf5fa879c5a4d41c245eca.patch";
-      hash = "sha256-cs7TSSnEY4Yf5xrqMOpfIA4jVdzM3OQQV/anQxJyy64=";
-    })
-  ];
-
  postPatch = ''
    # Pin the version
    substituteInPlace build.gradle \
@ -92,6 +89,13 @@ stdenv.mkDerivation rec {
      --replace 'VERSION_CHECK_ENABLED, Boolean.TRUE' \
        'VERSION_CHECK_ENABLED, Boolean.FALSE'

+    # Find OpenOffice/LibreOffice binary
+    substituteInPlace src/main/java/org/jabref/logic/openoffice/OpenOfficePreferences.java \
+      --replace '/usr' '/run/current-system/sw'
+
+    # Don't fetch predatory sources. These source are fetched from online webpages.
+    sed -i -e '/new PJSource/,/);/c);' src/main/java/org/jabref/logic/journals/predatory/PredatoryJournalListCrawler.java
+
    # Add back downloadDependencies task for deps download which is removed upstream in https://github.com/JabRef/jabref/pull/10326
    cat <<EOF >> build.gradle
    task downloadDependencies {
@ -152,7 +156,7 @@ stdenv.mkDerivation rec {
    runHook preInstall

    install -dm755 $out/share/java/jabref
-    install -Dm644 LICENSE.md $out/share/licenses/jabref/LICENSE.md
+    install -Dm644 LICENSE $out/share/licenses/jabref/LICENSE
    install -Dm644 src/main/resources/icons/jabref.svg $out/share/pixmaps/jabref.svg

    # script to support browser extensions
--- a/pkgs/applications/science/astronomy/gnuastro/default.nix
+++ b/pkgs/applications/science/astronomy/gnuastro/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  pname = "gnuastro";
-  version = "0.21";
+  version = "0.22";

  src = fetchurl {
    url = "mirror://gnu/gnuastro/gnuastro-${version}.tar.gz";
-    sha256 = "sha256-L7qZPYQiORUXtV9+tRF4iUbXqIaqFYSYT9Rni90nU38=";
+    sha256 = "sha256-f9fxaga95VrtliggkM2SITW+6pAjaeWvgUOJ6rnMcwg=";
  };

  nativeBuildInputs = [ libtool ];
@ -29,6 +29,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "GNU astronomy utilities and library";
    homepage = "https://www.gnu.org/software/gnuastro/";
+    changelog = "https://git.savannah.gnu.org/cgit/gnuastro.git/plain/NEWS?id=gnuastro_v${version}";
    license = licenses.gpl3Plus;
    platforms = platforms.unix;
    maintainers = with maintainers; [ sikmir ];
--- a/pkgs/applications/science/math/wxmaxima/default.nix
+++ b/pkgs/applications/science/math/wxmaxima/default.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation (finalAttrs:{
  pname = "wxmaxima";
-  version = "23.12.0";
+  version = "24.02.0";

  src = fetchFromGitHub {
    owner = "wxMaxima-developers";
    repo = "wxmaxima";
    rev = "Version-${finalAttrs.version}";
-    sha256 = "sha256-5MOj4loZsD1Fhy+D7V6ZL4QFyVkWyIaxTcHe7R2xypo=";
+    hash = "sha256-X4nx8zARToogQS4bfkv3CbsS2qU2uL9BBYw0Lw7QC18=";
  };

  buildInputs = [
--- a/pkgs/applications/version-management/git-codereview/default.nix
+++ b/pkgs/applications/version-management/git-codereview/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "git-codereview";
-  version = "1.8.0";
+  version = "1.9.0";

  src = fetchFromGitHub {
    owner = "golang";
    repo = "review";
    rev = "v${version}";
-    hash = "sha256-E6KgFSlWa/MKG6R2P+K4T+P/JOqaIfxdWpsSFGHbihg=";
+    hash = "sha256-Nnjo4MwkpFp1OTJZ+eeiJKboBGiRW520iWcJbu8cBnE=";
  };

  vendorHash = null;
--- a/pkgs/applications/version-management/stgit/default.nix
+++ b/pkgs/applications/version-management/stgit/default.nix
@ -18,15 +18,15 @@

 rustPlatform.buildRustPackage rec {
  pname = "stgit";
-  version = "2.4.2";
+  version = "2.4.3";

  src = fetchFromGitHub {
    owner = "stacked-git";
    repo = "stgit";
    rev = "v${version}";
-    hash = "sha256-Rdpi20FRtSYQtYfBvLr+2hghpHKSSDoUZBQqm2nxZxk=";
+    hash = "sha256-4DYuNWQ/C6/HuApmD36myUb92CkBp/3lrjYpDc9s450=";
  };
-  cargoHash = "sha256-vd2y6XYBlFU9gxd8hNj0srWqEuJAuXTOzt9GPD9q0yc=";
+  cargoHash = "sha256-B/aeSPYyoAmXgqZu+Onjh32sXKdkmDs2UdyoNRsFPcg=";

  nativeBuildInputs = [
    pkg-config installShellFiles makeWrapper asciidoc xmlto docbook_xsl
--- a/pkgs/applications/video/shotcut/default.nix
+++ b/pkgs/applications/video/shotcut/default.nix
@ -20,13 +20,13 @@
 }:
 stdenv.mkDerivation rec {
  pname = "shotcut";
-  version = "24.01.13";
+  version = "24.01.31";

  src = fetchFromGitHub {
    owner = "mltframework";
    repo = "shotcut";
    rev = "v${version}";
-    hash = "sha256-a/PgwxD8MXItkxT4LTdEJrrExD3r9CUkxr/uhgJicD8=";
+    hash = "sha256-3Itlv9Jc4xl9pB4WDUwc3f7iP7NHyZ6yr5NZuH8M2Jo=";
  };

  nativeBuildInputs = [ pkg-config cmake wrapQtAppsHook ];
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@ -62,13 +62,13 @@ let
 in
 buildGoModule rec {
  pname = "podman";
-  version = "4.9.1";
+  version = "4.9.2";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "podman";
    rev = "v${version}";
-    hash = "sha256-G5LTxBzBn+JFQzhzpsphqTcqq5bi+WjmjsOtJvSxO3k=";
+    hash = "sha256-6E6Qobkvv6y+Jx+X6Z9wJsGIuP7MXoc+cXRiajj0ojw=";
  };

  patches = [
--- a/pkgs/by-name/at/atari800/package.nix
+++ b/pkgs/by-name/at/atari800/package.nix
@ -0,0 +1,60 @@
+{ lib
+, stdenv
+, SDL
+, autoreconfHook
+, fetchFromGitHub
+, libGL
+, libGLU
+, libX11
+, readline
+, zlib
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "atari800";
+  version = "5.1.0";
+
+  src = fetchFromGitHub {
+    owner = "atari800";
+    repo = "atari800";
+    rev = "ATARI800_${lib.replaceStrings ["."] ["_"] finalAttrs.version}";
+    hash = "sha256-OZj0x9+M3jkiXUWgB93JTQzi4OUSBCZ3KtniwcZeVB0=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+  ];
+
+  buildInputs = [
+    SDL
+    libGL
+    libGLU
+    libX11
+    readline
+    zlib
+  ];
+
+  configureFlags = [
+    "--target=default"
+    (lib.enableFeature true "riodevice")
+    (lib.withFeature true "opengl")
+    (lib.withFeature true "readline")
+    (lib.withFeature true "x")
+    (lib.withFeatureAs true "sound" "sdl")
+    (lib.withFeatureAs true "video" "sdl")
+  ];
+
+  meta = {
+    homepage = "https://atari800.github.io/";
+    description = "An Atari 8-bit emulator";
+    longDescription = ''
+      Atari800 is the emulator of Atari 8-bit computer systems and 5200 game
+      console for Unix, Linux, Amiga, MS-DOS, Atari TT/Falcon, MS-Windows, MS
+      WinCE, Sega Dreamcast, Android and other systems supported by the SDL
+      library.
+    '';
+    license = with lib.licenses; [ gpl2Plus ];
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/applications/emulators/atari++/default.nix
+++ b/pkgs/applications/emulators/atari++/default.nix
@ -1,8 +1,8 @@
 { lib
 , stdenv
-, fetchurl
 , SDL
 , alsa-lib
+, fetchurl
 , gcc-unwrapped
 , libICE
 , libSM
@ -30,10 +30,12 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  postFixup = ''
-    patchelf --set-rpath ${lib.makeLibraryPath finalAttrs.buildInputs} "$out/bin/atari++"
+    patchelf \
+      --set-rpath ${lib.makeLibraryPath finalAttrs.buildInputs} \
+      "$out/bin/atari++"
  '';

-  meta = with lib; {
+  meta = {
    homepage = "http://www.xl-project.com/";
    description = "An enhanced, cycle-accurated Atari emulator";
    longDescription = ''
@ -42,8 +44,8 @@ stdenv.mkDerivation (finalAttrs: {
      and the Atari 5200 game console. The emulator is auto-configurable and
      will compile on a variety of systems (Linux, Solaris, Irix).
    '';
-    maintainers = [ maintainers.AndersonTorres ];
-    license = licenses.gpl2Plus;
-    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    license = with lib.licenses; [ gpl2Plus ];
+    platforms = lib.platforms.unix;
  };
 })
--- a/pkgs/by-name/de/delfin/package.nix
+++ b/pkgs/by-name/de/delfin/package.nix
@ -0,0 +1,84 @@
+{ lib
+, stdenv
+, appstream
+, cargo
+, desktop-file-utils
+, fetchFromGitea
+, gitUpdater
+, gtk4
+, libadwaita
+, libepoxy
+, libglvnd
+, meson
+, mpv
+, ninja
+, openssl
+, pkg-config
+, rustPlatform
+, rustc
+, wrapGAppsHook4
+}:
+
+stdenv.mkDerivation rec {
+  pname = "delfin";
+  version = "0.3.0";
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "avery42";
+    repo = "delfin";
+    rev = "v${version}";
+    hash = "sha256-1Q3Aywf80CCXxorWSymwxJwMU1I4k7juDoWG5J18AXY=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-/RZD4b7hrbC1Z5MtHDdib5TFEmxAh9odjNPo4m+FqK4=";
+  };
+
+  # upstream pinned the linker to clang/mold through 0.3.0, unnecessarily.
+  # remove this patch for version > 0.3.0.
+  # see: <https://codeberg.org/avery42/delfin/commit/e6deee77e9a6a6ba2425d1cc88dcbdeb471d1fdc>
+  postPatch = ''
+    rm .cargo/config.toml
+  '';
+
+  nativeBuildInputs = [
+    appstream
+    desktop-file-utils
+    meson
+    ninja
+    pkg-config
+    rustPlatform.cargoSetupHook
+    cargo
+    rustc
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    gtk4
+    libadwaita
+    libglvnd
+    libepoxy
+    mpv
+    openssl
+  ];
+
+  mesonFlags = [
+    (lib.mesonOption "profile" "release")
+  ];
+
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "v";
+  };
+
+  meta = with lib; {
+    description = "Stream movies and TV shows from Jellyfin";
+    homepage = "https://www.delfin.avery.cafe/";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ colinsane ];
+    mainProgram = "delfin";
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/by-name/do/dopewars/0001-remove_setuid.patch
+++ b/pkgs/by-name/do/dopewars/0001-remove_setuid.patch
@ -0,0 +1,13 @@
+diff --git a/src/Makefile.am b/src/Makefile.am
+index 4b0c466..ce008fa 100644
+--- a/src/Makefile.am
+++ b/src/Makefile.am
+@@ -54,7 +54,7 @@
+ 	@chgrp games ${DOPEBIN} || chgrp wheel ${DOPEBIN} || \
+ 	  ( echo "WARNING: Cannot change group of dopewars binary - the high"; \
+ 	    echo "score file may be unreadable or unwriteable by some users" )
+-	chmod 2755 ${DOPEBIN}
+	chmod 755 ${DOPEBIN}
+ 
+ install-data-local:
+ 	${mkinstalldirs} ${PIXDIR}
--- a/pkgs/by-name/do/dopewars/package.nix
+++ b/pkgs/by-name/do/dopewars/package.nix
@ -0,0 +1,54 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, makeWrapper
+, curl
+, ncurses
+, gtk3
+, pkg-config
+, scoreDirectory ? "$HOME/.local/share"
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "dopewars";
+  version = "1.6.2";
+
+  src = fetchFromGitHub {
+    owner = "benmwebb";
+    repo = "dopewars";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-CpgqRYmrfOFxhC7yAS2OqRBi4r3Vesq3+7a0q5rc3vM=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    makeWrapper
+    pkg-config
+  ];
+
+  buildInputs = [
+    curl
+    gtk3
+    ncurses
+  ];
+
+  # remove the denied setting of setuid bit permission
+  patches = [ ./0001-remove_setuid.patch ];
+
+  # run dopewars with -f so that it finds its scoreboard file in ~/.local/share
+  postInstall = ''
+    wrapProgram $out/bin/dopewars \
+      --run 'mkdir -p ${scoreDirectory}' \
+      --add-flags '-f ${scoreDirectory}/dopewars.sco'
+  '';
+
+  meta = with lib; {
+    description = "Game simulating the life of a drug dealer in New York";
+    homepage = "https://dopewars.sourceforge.io";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ geri1701 ];
+    mainProgram = "dopewars";
+    platforms = platforms.unix;
+  };
+})
--- a/pkgs/by-name/el/elektroid/package.nix
+++ b/pkgs/by-name/el/elektroid/package.nix
@ -14,7 +14,7 @@
 }:

 let
-  version = "3.0";
+  version = "3.0.1";
 in
 stdenv.mkDerivation {
  inherit version;
@ -25,7 +25,7 @@ stdenv.mkDerivation {
    owner = "dagargo";
    repo = "elektroid";
    rev = version;
-    sha256 = "sha256-77bsFB6hOxiW5f9bZ7IQIiwWd3MgtJUD37E6IXBfv/E=";
+    sha256 = "sha256-Qv4jvk6N0IMgYGCPWNYGDZJKGA+UPzhHeYfSrkq5hy4=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/fi/files-cli/package.nix
+++ b/pkgs/by-name/fi/files-cli/package.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "files-cli";
-  version = "2.12.27";
+  version = "2.12.28";

  src = fetchFromGitHub {
    repo = "files-cli";
    owner = "files-com";
    rev = "v${version}";
-    hash = "sha256-MKW5jvdSd41nuz9oTP6sMzBo+TnNxE/+86KoPHRogBM=";
+    hash = "sha256-4YW261qQtbfbX08zuGzr3qH470DaWUDIVaex7qYe2tI=";
  };

-  vendorHash = "sha256-rJtcocjH6GFmiDs7IizCMt/51RbHmvXdIIlWRETg6tg=";
+  vendorHash = "sha256-w5R7eVrnpcKu0/V2gAeZ7RL6VyA57INcOU31Jhwf1so=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/fi/fitsverify/package.nix
+++ b/pkgs/by-name/fi/fitsverify/package.nix
@ -0,0 +1,44 @@
+{ lib
+, stdenv
+, fetchurl
+, cfitsio
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "fitsverify";
+  version = "4.22";
+
+  src = fetchurl {
+    url = "https://heasarc.gsfc.nasa.gov/docs/software/ftools/fitsverify/fitsverify-${finalAttrs.version}.tar.gz";
+    hash = "sha256-bEXoA6fg7by30TkYYVuuY2HSszPCkrhJxQnsm+vbGLQ=";
+  };
+
+  buildInputs = [
+    cfitsio
+  ];
+
+  # See build instructions in the README file in src.
+  buildPhase = ''
+    $CC -o fitsverify ftverify.c fvrf_data.c fvrf_file.c fvrf_head.c \
+       fvrf_key.c fvrf_misc.c -DSTANDALONE \
+       $NIX_CFLAGS_COMPILE \
+       -lcfitsio
+  '';
+
+  installPhase = ''
+    install -D fitsverify $out/bin/fitsverify
+  '';
+
+  meta = with lib; {
+    description = "FITS File Format-Verification Tool";
+    longDescription = ''
+      Fitsverify is a computer program that rigorously checks whether a FITS
+      (Flexible Image Transport System) data file conforms to all the
+      requirements defined in Version 3.0 of the FITS Standard document.
+    '';
+    homepage = "https://heasarc.gsfc.nasa.gov/docs/software/ftools/fitsverify/";
+    license = licenses.mit;
+    platforms = with platforms; linux;
+    maintainers = with maintainers; [ panicgh ];
+  };
+})
--- a/pkgs/by-name/fr/freefilesync/package.nix
+++ b/pkgs/by-name/fr/freefilesync/package.nix
@ -64,6 +64,14 @@ stdenv.mkDerivation (finalAttrs: {
      patch = "revert_buggy_gtk3_change_in_12.1.patch";
      hash = "sha256-eqush3zXxypQUxtO5110GoOJ30F5LZcF8XIC/Y8/fgM=";
    })
+    # Disable update patch
+    (fetchDebianPatch {
+      pname = "freefilesync";
+      version = "13.3";
+      debianRevision = "1";
+      patch = "ffs_no_check_updates.patch";
+      hash = "sha256-lPyHpxhZz8BSnDI8QfAzKpKwVkp2jiF49RWjKNuZGII=";
+    })
  ];

  nativeBuildInputs = [
--- a/pkgs/by-name/ha/hare/package.nix
+++ b/pkgs/by-name/ha/hare/package.nix
@ -8,6 +8,7 @@
 , scdoc
 , tzdata
 , substituteAll
+, unstableGitUpdater
 , callPackage
 , enableCrossCompilation ? (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.is64bit)
 , pkgsCross
@ -16,7 +17,7 @@
 , riscv64PkgsCrossToolchain ? pkgsCross.riscv64
 }:

-# There's no support for `aarch64-freebsd` or `riscv64-freebsd` on nix.
+# There's no support for `aarch64` or `riscv64` for freebsd nor for openbsd on nix.
 # See `lib.systems.doubles.aarch64` and `lib.systems.doubles.riscv64`.
 assert let
  inherit (stdenv.hostPlatform) isLinux is64bit;
@ -33,7 +34,6 @@ let
  # We use harec's override of qbe until 1.2 is released, but the `qbe` argument
  # is kept to avoid breakage.
  qbe = harec.qbeUnstable;
-  # https://harelang.org/platforms/
  arch = stdenv.hostPlatform.uname.processor;
  platform = lib.toLower stdenv.hostPlatform.uname.system;
  embeddedOnBinaryTools =
@ -60,15 +60,15 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "hare";
-  version = "unstable-2023-11-27";
+  version = "0-unstable-2024-02-01";

  outputs = [ "out" "man" ];

  src = fetchFromSourcehut {
    owner = "~sircmpwn";
    repo = "hare";
-    rev = "d94f355481a320fb2aec13ef62cb3bfe2416f5e4";
-    hash = "sha256-Mpl3VO4xvLCKHeYr/FPuS6jl8CkyeqDz18mQ6Zv05oc=";
+    rev = "4d387ed61968f468e43571d15485b498e28acaec";
+    hash = "sha256-vVL8e+P/lnp0/jO+lQ/q0CehwxAvXh+FPOMJ8r+2Ftk=";
  };

  patches = [
@ -96,7 +96,6 @@ stdenv.mkDerivation (finalAttrs: {
  makeFlags = [
    "HARECACHE=.harecache"
    "PREFIX=${builtins.placeholder "out"}"
-    "PLATFORM=${platform}"
    "ARCH=${arch}"
    # Strip the variable of an empty $(SRCDIR)/hare/third-party, since nix does
    # not follow the FHS.
@ -122,8 +121,8 @@ stdenv.mkDerivation (finalAttrs: {

  doCheck = true;

-  preConfigure = ''
-    ln -s config.example.mk config.mk
+  postConfigure = ''
+    ln -s configs/${platform}.mk config.mk
  '';

  postFixup = ''
@ -134,6 +133,7 @@ stdenv.mkDerivation (finalAttrs: {
  setupHook = ./setup-hook.sh;

  passthru = {
+    updateScript = unstableGitUpdater { };
    tests = lib.optionalAttrs enableCrossCompilation {
      crossCompilation = callPackage ./cross-compilation-tests.nix {
        hare = finalAttrs.finalPackage;
--- a/pkgs/by-name/ha/harec/package.nix
+++ b/pkgs/by-name/ha/harec/package.nix
@ -3,29 +3,33 @@
 , fetchFromSourcehut
 , qbe
 , fetchgit
+, unstableGitUpdater
 }:
 let
  # harec needs the dbgfile and dbgloc features implemented up to this commit.
-  # This can be dropped once 1.2 is released, for a possible release date see:
+  # This can be dropped once 1.2 is released. For a possible release date, see:
  # https://lists.sr.ht/~mpu/qbe/%3CZPkmHE9KLohoEohE%40cloudsdale.the-delta.net.eu.org%3E
  qbe' = qbe.overrideAttrs (_old: {
-    version = "1.1-unstable-2023-08-18";
+    version = "1.1-unstable-2024-01-12";
    src = fetchgit {
      url = "git://c9x.me/qbe.git";
-      rev = "36946a5142c40b733d25ea5ca469f7949ee03439";
-      hash = "sha256-bqxWFP3/aw7kRoD6ictbFcjzijktHvh4AgWAXBIODW8=";
+      rev = "85287081c4a25785dec1ec48c488a5879b3c37ac";
+      hash = "sha256-7bVbxUU/HXJXLtAxhoK0URmPtjGwMSZrPkx8WKl52Mg=";
    };
  });
+
+  platform = lib.toLower stdenv.hostPlatform.uname.system;
+  arch = stdenv.hostPlatform.uname.processor;
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "harec";
-  version = "unstable-2023-11-29";
+  version = "0-unstable-2024-01-29";

  src = fetchFromSourcehut {
    owner = "~sircmpwn";
    repo = "harec";
-    rev = "ec3193e3870436180b0f3df82b769adc57a1c099";
-    hash = "sha256-HXQIgFC4YVDJjo5xbyg1ea3jWYKLEwKkD1KFzWFz9UI= ";
+    rev = "f9e17e633845d8d38566b4ea32db0a29ac85d96e";
+    hash = "sha256-Xy9VOcDtbJUz3z6Vk8bqH41VbAFKtJ9fzPGEwVz8KQM=";
  };

  nativeBuildInputs = [
@ -36,15 +40,26 @@ stdenv.mkDerivation (finalAttrs: {
    qbe'
  ];

+  makeFlags = [
+    "PREFIX=${builtins.placeholder "out"}"
+    "ARCH=${arch}"
+  ];
+
  strictDeps = true;
+
  enableParallelBuilding = true;

  doCheck = true;

+  postConfigure = ''
+    ln -s configs/${platform}.mk config.mk
+  '';
+
  passthru = {
    # We create this attribute so that the `hare` package can access the
    # overwritten `qbe`.
    qbeUnstable = qbe';
+    updateScript = unstableGitUpdater { };
  };

  meta = {
@ -57,7 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
    # https://harelang.org/platforms/
    # UPDATE: https://github.com/hshq/harelang provides a MacOS port
    platforms = with lib.platforms;
-      lib.intersectLists (freebsd ++ linux) (aarch64 ++ x86_64 ++ riscv64);
+      lib.intersectLists (freebsd ++ openbsd ++ linux) (aarch64 ++ x86_64 ++ riscv64);
    badPlatforms = lib.platforms.darwin;
  };
 })
--- a/pkgs/by-name/in/incus/client.nix
+++ b/pkgs/by-name/in/incus/client.nix
@ -0,0 +1,53 @@
+{
+  lts ? false,
+
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+}:
+let
+  releaseFile = if lts then ./lts.nix else ./latest.nix;
+  inherit (import releaseFile) version hash vendorHash;
+in
+
+buildGoModule rec {
+  pname = "incus-client";
+
+  inherit vendorHash version;
+
+  src = fetchFromGitHub {
+    owner = "lxc";
+    repo = "incus";
+    rev = "refs/tags/v${version}";
+    inherit hash;
+  };
+
+  CGO_ENABLED = 0;
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  subPackages = [ "cmd/incus" ];
+
+  postInstall = ''
+    # use custom bash completion as it has extra logic for e.g. instance names
+    installShellCompletion --bash --name incus ./scripts/bash/incus
+
+    installShellCompletion --cmd incus \
+      --fish <($out/bin/incus completion fish) \
+      --zsh <($out/bin/incus completion zsh)
+  '';
+
+  # don't run the full incus test suite
+  doCheck = false;
+
+  meta = {
+    description = "Powerful system container and virtual machine manager";
+    homepage = "https://linuxcontainers.org/incus";
+    changelog = "https://github.com/lxc/incus/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = lib.teams.lxc.members;
+    platforms = lib.platforms.unix;
+    mainProgram = "incus";
+  };
+}
--- a/pkgs/by-name/in/incus/latest.nix
+++ b/pkgs/by-name/in/incus/latest.nix
@ -0,0 +1,5 @@
+{
+  hash = "sha256-3eWkQT2P69ZfN62H9B4WLnmlUOGkpzRR0rctgchP+6A=";
+  version = "0.5.1";
+  vendorHash = "sha256-2ZJU7WshN4UIbJv55bFeo9qiAQ/wxu182mnz7pE60xA=";
+}
--- a/pkgs/by-name/in/incus/lts.nix
+++ b/pkgs/by-name/in/incus/lts.nix
@ -0,0 +1,3 @@
+# this release doesn't exist yet, but satisfay the by-name checks
+# will be added as incus-lts in all-packages.nix once ready
+{ }
--- a/pkgs/by-name/in/incus/package.nix
+++ b/pkgs/by-name/in/incus/package.nix
@ -1,42 +1,49 @@
-{ lib
-, incus-unwrapped
-, linkFarm
-, makeWrapper
-, stdenv
-, symlinkJoin
-, writeShellScriptBin
-, acl
-, apparmor-parser
-, apparmor-profiles
-, attr
-, bash
-, btrfs-progs
-, cdrkit
-, criu
-, dnsmasq
-, e2fsprogs
-, getent
-, gnutar
-, gptfdisk
-, gzip
-, iproute2
-, iptables
-, kmod
-, lvm2
-, minio
-, nftables
-, OVMF
-, qemu_kvm
-, qemu-utils
-, rsync
-, spice-gtk
-, squashfsTools
-, thin-provisioning-tools
-, util-linux
-, virtiofsd
-, xz
+{
+  lts ? false,
+
+  lib,
+  callPackage,
+  linkFarm,
+  makeWrapper,
+  stdenv,
+  symlinkJoin,
+  writeShellScriptBin,
+  acl,
+  apparmor-parser,
+  apparmor-profiles,
+  attr,
+  bash,
+  btrfs-progs,
+  cdrkit,
+  criu,
+  dnsmasq,
+  e2fsprogs,
+  getent,
+  gnutar,
+  gptfdisk,
+  gzip,
+  iproute2,
+  iptables,
+  kmod,
+  lvm2,
+  minio,
+  nftables,
+  OVMF,
+  qemu_kvm,
+  qemu-utils,
+  rsync,
+  spice-gtk,
+  squashfsTools,
+  thin-provisioning-tools,
+  util-linux,
+  virtiofsd,
+  xz,
 }:
 let
+  unwrapped = callPackage ./unwrapped.nix { inherit lts; };
+  client = callPackage ./client.nix { inherit lts; };
+  name = "incus${lib.optionalString lts "-lts"}";
+
  binPath = lib.makeBinPath [
    acl
    attr
@ -70,9 +77,7 @@ let
    '')
  ];

-  clientBinPath = [
-    spice-gtk
-  ];
+  clientBinPath = [ spice-gtk ];

  ovmf-2mb = OVMF.override {
    secureBoot = true;
@ -98,24 +103,57 @@ let
  # mimic ovmf from https://github.com/canonical/incus-pkg-snap/blob/3abebe1dfeb20f9b7729556960c7e9fe6ad5e17c/snapcraft.yaml#L378
  # also found in /snap/incus/current/share/qemu/ on a snap install
  ovmf = linkFarm "incus-ovmf" [
-    { name = "OVMF_CODE.2MB.fd"; path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_CODE.fd"; }
-    { name = "OVMF_CODE.4MB.CSM.fd"; path = "${ovmf-4mb-csm.fd}/FV/${ovmf-prefix}_CODE.fd"; }
-    { name = "OVMF_CODE.4MB.fd"; path = "${ovmf-4mb.fd}/FV/${ovmf-prefix}_CODE.fd"; }
-    { name = "OVMF_CODE.fd"; path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_CODE.fd"; }
+    {
+      name = "OVMF_CODE.2MB.fd";
+      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_CODE.fd";
+    }
+    {
+      name = "OVMF_CODE.4MB.CSM.fd";
+      path = "${ovmf-4mb-csm.fd}/FV/${ovmf-prefix}_CODE.fd";
+    }
+    {
+      name = "OVMF_CODE.4MB.fd";
+      path = "${ovmf-4mb.fd}/FV/${ovmf-prefix}_CODE.fd";
+    }
+    {
+      name = "OVMF_CODE.fd";
+      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_CODE.fd";
+    }

-    { name = "OVMF_VARS.2MB.fd"; path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd"; }
-    { name = "OVMF_VARS.2MB.ms.fd"; path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd"; }
-    { name = "OVMF_VARS.4MB.CSM.fd"; path = "${ovmf-4mb-csm.fd}/FV/${ovmf-prefix}_VARS.fd"; }
-    { name = "OVMF_VARS.4MB.fd"; path = "${ovmf-4mb.fd}/FV/${ovmf-prefix}_VARS.fd"; }
-    { name = "OVMF_VARS.4MB.ms.fd"; path = "${ovmf-4mb.fd}/FV/${ovmf-prefix}_VARS.fd"; }
-    { name = "OVMF_VARS.fd"; path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd"; }
-    { name = "OVMF_VARS.ms.fd"; path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd"; }
+    {
+      name = "OVMF_VARS.2MB.fd";
+      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd";
+    }
+    {
+      name = "OVMF_VARS.2MB.ms.fd";
+      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd";
+    }
+    {
+      name = "OVMF_VARS.4MB.CSM.fd";
+      path = "${ovmf-4mb-csm.fd}/FV/${ovmf-prefix}_VARS.fd";
+    }
+    {
+      name = "OVMF_VARS.4MB.fd";
+      path = "${ovmf-4mb.fd}/FV/${ovmf-prefix}_VARS.fd";
+    }
+    {
+      name = "OVMF_VARS.4MB.ms.fd";
+      path = "${ovmf-4mb.fd}/FV/${ovmf-prefix}_VARS.fd";
+    }
+    {
+      name = "OVMF_VARS.fd";
+      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd";
+    }
+    {
+      name = "OVMF_VARS.ms.fd";
+      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd";
+    }
  ];
 in
 symlinkJoin {
-  name = "incus-${incus-unwrapped.version}";
+  name = "${name}-${unwrapped.version}";

-  paths = [ incus-unwrapped ];
+  paths = [ unwrapped ];

  nativeBuildInputs = [ makeWrapper ];

@ -126,8 +164,10 @@ symlinkJoin {
  '';

  passthru = {
-    inherit (incus-unwrapped) tests;
+    inherit client unwrapped;
+
+    inherit (unwrapped) tests;
  };

-  inherit (incus-unwrapped) meta pname version;
+  inherit (unwrapped) meta pname version;
 }
--- a/pkgs/by-name/in/incus-unwrapped/package.nix
+++ b/pkgs/by-name/in/incus-unwrapped/package.nix
@ -1,41 +1,51 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
-, acl
-, cowsql
-, hwdata
-, libcap
-, lxc
-, pkg-config
-, sqlite
-, udev
-, installShellFiles
-, nix-update-script
-, nixosTests
+{
+  lts ? false,
+
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  writeShellScript,
+  acl,
+  cowsql,
+  hwdata,
+  libcap,
+  lxc,
+  pkg-config,
+  sqlite,
+  udev,
+  installShellFiles,
+  nixosTests,
 }:

+let
+  releaseFile = if lts then ./lts.nix else ./latest.nix;
+  inherit (import releaseFile) version hash vendorHash;
+  name = "incus${lib.optionalString lts "-lts"}";
+in
+
 buildGoModule rec {
-  pname = "incus-unwrapped";
-  version = "0.5.1";
+  pname = "${name}-unwrapped";
+
+  inherit vendorHash version;

  src = fetchFromGitHub {
    owner = "lxc";
    repo = "incus";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-3eWkQT2P69ZfN62H9B4WLnmlUOGkpzRR0rctgchP+6A=";
+    rev = "v${version}";
+    inherit hash;
  };

-  vendorHash = "sha256-2ZJU7WshN4UIbJv55bFeo9qiAQ/wxu182mnz7pE60xA=";
-
  postPatch = ''
    substituteInPlace internal/usbid/load.go \
      --replace "/usr/share/misc/usb.ids" "${hwdata}/share/hwdata/usb.ids"
  '';

  excludedPackages = [
+    # statically compile these
    "cmd/incus-agent"
    "cmd/incus-migrate"
-    "cmd/lxd-to-incus"
+
+    # oidc test requires network
    "test/mini-oidc"
  ];

@ -53,7 +63,10 @@ buildGoModule rec {
    udev.dev
  ];

-  ldflags = [ "-s" "-w" ];
+  ldflags = [
+    "-s"
+    "-w"
+  ];
  tags = [ "libsqlite3" ];

  # required for go-cowsql.
@ -64,13 +77,15 @@ buildGoModule rec {
  '';

  preCheck =
-    let skippedTests = [
-      "TestValidateConfig"
-      "TestConvertNetworkConfig"
-      "TestConvertStorageConfig"
-      "TestSnapshotCommon"
-      "TestContainerTestSuite"
-    ]; in
+    let
+      skippedTests = [
+        "TestValidateConfig"
+        "TestConvertNetworkConfig"
+        "TestConvertStorageConfig"
+        "TestSnapshotCommon"
+        "TestContainerTestSuite"
+      ];
+    in
    ''
      # Disable tests requiring local operations
      buildFlagsArray+=("-run" "[^(${builtins.concatStringsSep "|" skippedTests})]")
@ -85,15 +100,14 @@ buildGoModule rec {
      --zsh <($out/bin/incus completion zsh)
  '';

-
  passthru = {
    tests.incus = nixosTests.incus;

-    updateScript = nix-update-script {
-       extraArgs = [
-        "-vr" "v\(.*\)"
-       ];
-     };
+    updateScript = writeShellScript "update-incus" ''
+      nix-update ${name}.unwrapped -vr 'v(.*)' --override-filename pkgs/by-name/in/incus/${
+        if lts then "lts" else "latest"
+      }.nix
+    '';
  };

  meta = {
--- a/pkgs/by-name/li/libopenraw/package.nix
+++ b/pkgs/by-name/li/libopenraw/package.nix
@ -0,0 +1,29 @@
+{ stdenv, fetchurl, boost, gdk-pixbuf, glib, libjpeg, libxml2, lib, pkg-config
+, cargo, rustc }:
+
+stdenv.mkDerivation rec {
+  pname = "libopenraw";
+  version = "0.3.7";
+
+  src = fetchurl {
+    url = "https://libopenraw.freedesktop.org/download/libopenraw-${version}.tar.bz2";
+    hash = "sha256-VRWyYQNh7zRYC2uXZjURn23ttPCnnVRmL6X+YYakXtU=";
+  };
+
+  nativeBuildInputs = [ pkg-config cargo rustc ];
+
+  buildInputs = [ boost gdk-pixbuf glib libjpeg libxml2 ];
+
+  postPatch = ''
+    sed -i configure{,.ac} \
+      -e "s,GDK_PIXBUF_DIR=.*,GDK_PIXBUF_DIR=$out/lib/gdk-pixbuf-2.0/2.10.0/loaders,"
+  '';
+
+  meta = with lib; {
+    description = "RAW camerafile decoding library";
+    homepage = "https://libopenraw.freedesktop.org";
+    license = licenses.lgpl3Plus;
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
+    maintainers = [ maintainers.struan ];
+  };
+}
--- a/pkgs/by-name/lx/lxd-to-incus/package.nix
+++ b/pkgs/by-name/lx/lxd-to-incus/package.nix
@ -1,48 +0,0 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
-, fetchpatch
-, nix-update-script
-}:
-
-buildGoModule rec {
-  pname = "lxd-to-incus";
-  version = "0.4.0";
-
-  src = fetchFromGitHub {
-    owner = "lxc";
-    repo = "incus";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-crWepf5j3Gd1lhya2DGIh/to7l+AnjKJPR+qUd9WOzw=";
-  };
-
-  patches = [
-    # create migration touch file, remove > 0.4.0
-    (fetchpatch {
-      url = "https://github.com/lxc/incus/commit/edc5fd2a9baccfb7b6814a440e2947cbb580afcf.diff";
-      hash = "sha256-ffQfMFrKDPuLU4jVbG/VGHSO3DmeHw30ATJ8yxJAoHQ=";
-    })
-  ];
-
-  modRoot = "cmd/lxd-to-incus";
-
-  vendorHash = "sha256-cBAqJz3Y4CqyxTt7u/4mXoQPKmKgQ3gYJV1NiC/H+TA=";
-
-  CGO_ENABLED = 0;
-
-  passthru = {
-    updateScript = nix-update-script {
-       extraArgs = [
-        "-vr" "v\(.*\)"
-       ];
-     };
-  };
-
-  meta = {
-    description = "LXD to Incus migration tool";
-    homepage = "https://linuxcontainers.org/incus";
-    license = lib.licenses.asl20;
-    maintainers = lib.teams.lxc.members;
-    platforms = lib.platforms.linux;
-  };
-}
--- a/pkgs/by-name/mc/mcomix/package.nix
+++ b/pkgs/by-name/mc/mcomix/package.nix
@ -18,12 +18,12 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "mcomix";
-  version = "3.0.0";
+  version = "3.1.0";
  pyproject = true;

  src = fetchurl {
    url = "mirror://sourceforge/mcomix/mcomix-${version}.tar.gz";
-    hash = "sha256-InDEPXXih49k5MiG1bATElxCiUs2RZTV7JeRVMTeoAQ=";
+    hash = "sha256-+Shuun/7w86VKBNamTmCPEJfO76fdKY5+HBvzCi0xCc=";
  };

  buildInputs = [
@ -58,6 +58,10 @@ python3.pkgs.buildPythonApplication rec {
    )
  '';

+  postInstall = ''
+    cp -a share $out/
+  '';
+
  passthru.tests.version = testers.testVersion {
    package = mcomix;
  };
--- a/pkgs/by-name/ru/rustdesk-flutter/Cargo.lock
+++ b/pkgs/by-name/ru/rustdesk-flutter/Cargo.lock
--- a/pkgs/by-name/ru/rustdesk-flutter/package.nix
+++ b/pkgs/by-name/ru/rustdesk-flutter/package.nix
@ -0,0 +1,214 @@
+{ lib
+, cargo
+, copyDesktopItems
+, fetchFromGitHub
+, flutter313
+, gst_all_1
+, libXtst
+, libaom
+, libopus
+, libpulseaudio
+, libva
+, libvdpau
+, libvpx
+, libxkbcommon
+, libyuv
+, makeDesktopItem
+, rustPlatform
+, rustc
+, rustfmt
+, xdotool
+}: let
+
+  flutterRustBridge = rustPlatform.buildRustPackage rec {
+    pname = "flutter_rust_bridge_codegen";
+    version = "1.80.1"; # https://github.com/rustdesk/rustdesk/blob/0cf4711515077e400827c3ec92c8102f11b4a69c/.github/workflows/bridge.yml#L10
+
+    src = fetchFromGitHub {
+      owner = "fzyzcjy";
+      repo = "flutter_rust_bridge";
+      rev = "v${version}";
+      hash = "sha256-SbwqWapJbt6+RoqRKi+wkSH1D+Wz7JmnVbfcfKkjt8Q=";
+    };
+
+    cargoHash = "sha256-dDyiptG9TKes+fXx2atwx697SWH7Rltx6xVubtTn7FM=";
+    cargoBuildFlags = [ "--package" "flutter_rust_bridge_codegen" ];
+    doCheck = false;
+  };
+
+in flutter313.buildFlutterApplication rec {
+  pname = "rustdesk";
+  version = "unstable-2024-02-03";
+  src = fetchFromGitHub {
+    owner = "rustdesk";
+    repo = "rustdesk";
+    rev = "0cf4711515077e400827c3ec92c8102f11b4a69c";
+    hash = "sha256-jqtOCrmFNpFEGAZU8LBH3ge5S++nK/dVpaszMbwdIOw=";
+  };
+
+  strictDeps = true;
+  strucutedAttrs = true;
+
+  # Configure the Flutter/Dart build
+  sourceRoot = "source/flutter";
+  pubspecLock = lib.importJSON ./pubspec.lock.json;
+  gitHashes = {
+    dash_chat_2 = "sha256-J5Bc6CeCoRGN870aNEVJ2dkQNb+LOIZetfG2Dsfz5Ow=";
+    desktop_drop = "sha256-rt9N6TNAq7YRPzHSDVukGCXMvIIIj48HZaEJikbh6Pk=";
+    desktop_multi_window = "sha256-jhhqV4srWd3oJwlKMHPpGvvdzyoH/kJtTg6AB4e9Udk=";
+    dynamic_layouts = "sha256-eFp1YVI6vI2HRgtE5nTqGZIylB226H0O8kuxy9ypuf8=";
+    flutter_improved_scrolling = "sha256-fKs1+JmhDVVfjyhr6Fl17pc6n++mCTjBo1PT3l/DUnc=";
+    uni_links_desktop = "sha256-h3wlo31XnHELCCPlk7OSLglm9Xn/969yTllp5UkGY98=";
+    window_manager = "sha256-CUTcSl+W7Wz/Og5k9ujOdAlhKWv/gIYe58wurf9CJH4=";
+    window_size = "sha256-+lqY46ZURT0qcqPvHFXUnd83Uvfq79Xr+rw1AHqrpak=";
+    flutter_gpu_texture_renderer = "sha256-w1iMp4wUDkG1UZCHFjUUL11GIHyUDUxM+ZM8l423MLk=";
+  };
+
+  # Configure the Rust build
+  cargoRoot = "..";
+  cargoDeps = rustPlatform.importCargoLock {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "amf-0.1.0" = "sha256-4xZIp0Zs1VJQixChxC4b6ac108DGqgzZ/O/+94d2jKI=";
+      "android-wakelock-0.1.0" = "sha256-09EH/U1BBs3l4galQOrTKmPUYBgryUjfc/rqPZhdYc4=";
+      "cacao-0.4.0-beta2" = "sha256-U5tCLeVxjmZCm7ti1u71+i116xmozPaR69pCsA4pxrM=";
+      "confy-0.4.0-2" = "sha256-r5VeggXrIq5Cwxc2WSrxQDI5Gvbw979qIUQfMKHgBUI=";
+      "core-foundation-0.9.3" = "sha256-iB4OVmWZhuWbs9RFWvNc+RNut6rip2/50o5ZM6c0c3g=";
+      "evdev-0.11.5" = "sha256-aoPmjGi/PftnH6ClEWXHvIj0X3oh15ZC1q7wPC1XPr0=";
+      "hwcodec-0.2.0" = "sha256-PMDynyMAf4E314HEZ7loqANucshXc+R6sCH8dwUY+oU=";
+      "impersonate_system-0.1.0" = "sha256-pIV7s2qGoCIUrhaRovBDCJaGQ/pMdJacDXJmeBpkcyI=";
+      "keepawake-0.4.3" = "sha256-wDLjjhKWbCeaWbA896a5E5UMB0B/xI/84QRCUYNKX7I=";
+      "machine-uid-0.3.0" = "sha256-rEOyNThg6p5oqE9URnxSkPtzyW8D4zKzLi9pAnzTElE=";
+      "magnum-opus-0.4.0" = "sha256-T4qaYOl8lCK1h9jWa9KqGvnVfDViT9Ob5R+YgnSw2tg=";
+      "mouce-0.2.1" = "sha256-3PtNEmVMXgqKV4r3KiKTkk4oyCt4BKynniJREE+RyFk=";
+      "pam-0.7.0" = "sha256-qe2GH6sfGEUnqLiQucYLB5rD/GyAaVtm9pAxWRb1H3Q=";
+      "parity-tokio-ipc-0.7.3-2" = "sha256-WXDKcDBaJuq4K9gjzOKMozePOFiVX0EqYAFamAz/Yvw=";
+      "rdev-0.5.0-2" = "sha256-KrzNa4sKyuVw3EV/Ec9VBNRyJy7QFR2Gu4c2WkltwUw=";
+      "reqwest-0.11.23" = "sha256-kEUT+gs4ziknDiGdPMLnj5pmxC5SBpLopZ8jZ34GDWc=";
+      "rust-pulsectl-0.2.12" = "sha256-8jXTspWvjONFcvw9/Z8C43g4BuGZ3rsG32tvLMQbtbM=";
+      "sciter-rs-0.5.57" = "sha256-NQPDlMQ0sGY8c9lBMlplT82sNjbgJy2m/+REnF3fz8M=";
+      "sysinfo-0.29.10" = "sha256-O2zJGQdtXNiIwatmyIB6bu5eVyv1JS/IHkv//BDCpcY=";
+      "tao-0.22.2" = "sha256-vZx7WM6vK9UarbFQ/FMnTNEEDS+tglhWcPXt/h7YMFA=";
+      "tfc-0.6.1" = "sha256-ukxJl7Z+pUXCjvTsG5Q0RiXocPERWGsnAyh3SIWm0HU=";
+      "tokio-socks-0.5.1-2" = "sha256-x3aFJKo0XLaCGkZLtG9GYA+A/cGGedVZ8gOztWiYVUY=";
+      "tray-icon-0.5.1" = "sha256-1VyUg8V4omgdRIYyXhfn8kUvhV5ef6D2cr2Djz2uQyc=";
+      "wallpaper-3.2.0" = "sha256-p9NRmusdA0wvF6onp1UTL0/4t7XnEAc19sqyGDnfg/Q=";
+      "webm-1.1.0" = "sha256-p4BMej7yvb8c/dJynRWZmwo2hxAAY96Qx6Qx2DbT8hE=";
+      "x11-2.19.0" = "sha256-GDCeKzUtvaLeBDmPQdyr499EjEfT6y4diBMzZVEptzc=";
+      "x11-clipboard-0.8.1" = "sha256-PtqmSD2MwkbLVWbfTSXZW3WEvEnUlo04qieUTjN2whE=";
+    };
+  };
+  dontCargoBuild = true;
+  cargoBuildFlags = "--lib";
+  cargoBuildType = "release";
+  cargoBuildFeatures = [
+    "linux-pkg-config"
+    "hwcodec"
+    "flutter"
+    "flutter_texture_render"
+  ];
+
+  nativeBuildInputs = [
+    # flutter_rust_bridge_codegen
+    cargo
+    copyDesktopItems
+    rustfmt
+    # Rust
+    rustPlatform.cargoSetupHook
+    rustPlatform.cargoBuildHook
+    rustPlatform.bindgenHook
+  ];
+
+  buildInputs = [
+    gst_all_1.gst-plugins-base
+    gst_all_1.gstreamer
+    libXtst
+    libaom
+    libopus
+    libpulseaudio
+    libva
+    libvdpau
+    libvpx
+    libxkbcommon
+    libyuv
+    xdotool
+  ];
+
+  postPatch = ''
+    chmod -R +w ..
+    substituteInPlace ../Cargo.toml --replace ", \"staticlib\", \"rlib\"" ""
+    # The supplied Cargo.lock doesn't work with our fetcher so copy over the fixed version
+    cp ${./Cargo.lock} ../Cargo.lock
+    chmod +w ../Cargo.lock
+  '';
+
+  preBuild = ''
+    # Build the Flutter/Rust bridge bindings
+    cat <<EOF > bridge.yml
+    rust_input:
+      - "../src/flutter_ffi.rs"
+    dart_output:
+      - "./lib/generated_bridge.dart"
+    llvm_path:
+      - "${rustc.llvmPackages.libclang.lib}"
+    dart_format_line_length: 80
+    llvm_compiler_opts: "-I ${rustc.llvmPackages.clang-unwrapped.lib}/lib/clang/${lib.versions.major rustc.llvmPackages.clang-unwrapped.version}/include -I ${rustc.unwrapped.stdenv.cc.libc_dev}/include"
+    EOF
+    RUST_LOG=info ${flutterRustBridge}/bin/flutter_rust_bridge_codegen bridge.yml
+
+    # Build the Rust shared library
+    cd ..
+    preBuild=() # prevent loops
+    runHook cargoBuildHook
+    mv ./target/*/release/liblibrustdesk.so ./target/release/liblibrustdesk.so
+    cd flutter
+  '';
+
+  postInstall = ''
+    mkdir -p $out/share/polkit-1/actions $out/share/icons/hicolor/{256x256,scalable}/apps
+    cp ../res/128x128@2x.png $out/share/icons/hicolor/256x256/apps/rustdesk.png
+    cp ../res/scalable.svg $out/share/icons/hicolor/scalable/apps/rustdesk.svg
+    cp ../res/com.rustdesk.RustDesk.policy $out/share/polkit-1/actions/
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "rustdesk";
+      desktopName = "RustDesk";
+      genericName = "Remote Desktop";
+      comment = meta.description;
+      exec = "${meta.mainProgram} %u";
+      icon = "rustdesk";
+      terminal = false;
+      type = "Application";
+      startupNotify = true;
+      categories = [ "Network" "RemoteAccess" "GTK" ];
+      keywords = [ "internet" ];
+      actions.new-window = {
+        name = "Open a New Window";
+        exec = "${meta.mainProgram} %u";
+      };
+    })
+    (makeDesktopItem {
+      name = "rustdesk-link";
+      desktopName = "RustDeskURL Scheme Handler";
+      noDisplay = true;
+      mimeTypes = [ "x-scheme-handler/rustdesk" ];
+      tryExec = "rustdesk";
+      exec = "${meta.mainProgram} %u";
+      icon = "rustdesk";
+      terminal = false;
+      type = "Application";
+      startupNotify = false;
+    })
+  ];
+
+  meta = with lib; {
+    description = "Virtual / remote desktop infrastructure for everyone! Open source TeamViewer / Citrix alternative";
+    homepage = "https://rustdesk.com";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ das_j ];
+    mainProgram = "rustdesk";
+    platforms = platforms.linux; # should work on darwin as well but I have no machine to test with
+  };
+}
--- a/pkgs/by-name/ru/rustdesk-flutter/pubspec.lock.json
+++ b/pkgs/by-name/ru/rustdesk-flutter/pubspec.lock.json
--- a/pkgs/by-name/tl/tlmi-auth/package.nix
+++ b/pkgs/by-name/tl/tlmi-auth/package.nix
@ -6,18 +6,15 @@
 , ninja
 , openssl
 }:
-let
-  name = "tlmi-auth";
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "tlmi-auth";
  version = "1.0.1";
-in
-stdenv.mkDerivation {
-  pname = name;
-  version = version;

  src = fetchFromGitHub {
    owner = "lenovo";
-    repo = name;
-    rev = "v${version}";
+    repo = "tlmi-auth";
+    rev = "v${finalAttrs.version}";
    hash = "sha256-/juXQrb3MsQ6FxmrAa7E1f0vIMu1397tZ1pzLfr56M4=";
  };

@ -25,6 +22,9 @@ stdenv.mkDerivation {
    meson
    ninja
    pkg-config
+  ];
+
+  buildInputs = [
    openssl
  ];

@ -32,8 +32,8 @@ stdenv.mkDerivation {
    homepage = "https://github.com/lenovo/tlmi-auth";
    maintainers = with maintainers; [ snpschaaf ];
    description = "Utility for creating signature strings needed for thinklmi certificate based authentication";
-    mainProgram = name;
+    mainProgram = "tlmi-auth";
    license = licenses.gpl2;
    platforms = platforms.linux;
  };
-}
+})
--- a/pkgs/data/fonts/sketchybar-app-font/default.nix
+++ b/pkgs/data/fonts/sketchybar-app-font/default.nix
@ -5,11 +5,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "sketchybar-app-font";
-  version = "2.0.3";
+  version = "2.0.4";

  src = fetchurl {
    url = "https://github.com/kvndrsslr/sketchybar-app-font/releases/download/v${finalAttrs.version}/sketchybar-app-font.ttf";
-    hash = "sha256-KeyUx/u0YARmNdVC9RQtAL3QFOgV59uyg53y0Lknvyw=";
+    hash = "sha256-G3ceScZQT1rrjw+V9ALRo78lSVYsLymQLFfzSo/gA8U=";
  };

  dontUnpack = true;
--- a/pkgs/development/compilers/flutter/artifacts/prepare-artifacts.nix
+++ b/pkgs/development/compilers/flutter/artifacts/prepare-artifacts.nix
@ -20,7 +20,7 @@
    runHook postInstall
  '';
 }).overrideAttrs (
-  if builtins.pathExists ./overrides/${src.flutterPlatform}.nix
-  then callPackage ./overrides/${src.flutterPlatform}.nix { }
+  if builtins.pathExists (./overrides + "/${src.flutterPlatform}.nix")
+  then callPackage (./overrides + "/${src.flutterPlatform}.nix") { }
  else ({ ... }: { })
 )
--- a/pkgs/development/compilers/flutter/update/get-artifact-hashes.nix.in
+++ b/pkgs/development/compilers/flutter/update/get-artifact-hashes.nix.in
@ -35,7 +35,7 @@ let
                flutter = flutterPackages."v${flutterCompactVersion}";
                inherit flutterPlatform;
                inherit systemPlatform;
-                hash = "";
+                hash = lib.fakeSha256;
              })
            systemPlatforms)
      ) [ ]
--- a/pkgs/development/compilers/flutter/update/get-dart-hashes.nix.in
+++ b/pkgs/development/compilers/flutter/update/get-dart-hashes.nix.in
@ -6,21 +6,21 @@ in
  x86_64-linux = { fetchzip }:
    fetchzip {
      url = "https://storage.googleapis.com/dart-archive/channels/stable/release/${dartVersion}/sdk/dartsdk-linux-x64-release.zip";
-      sha256 = "";
+      sha256 = "0000000000000000000000000000000000000000000000000000";
    };
  aarch64-linux = { fetchzip }:
    fetchzip {
      url = "https://storage.googleapis.com/dart-archive/channels/stable/release/${dartVersion}/sdk/dartsdk-linux-arm64-release.zip";
-      sha256 = "";
+      sha256 = "0000000000000000000000000000000000000000000000000000";
    };
  x86_64-darwin = { fetchzip }:
    fetchzip {
      url = "https://storage.googleapis.com/dart-archive/channels/stable/release/${dartVersion}/sdk/dartsdk-macos-x64-release.zip";
-      sha256 = "";
+      sha256 = "0000000000000000000000000000000000000000000000000000";
    };
  aarch64-darwin = { fetchzip }:
    fetchzip {
      url = "https://storage.googleapis.com/dart-archive/channels/stable/release/${dartVersion}/sdk/dartsdk-macos-arm64-release.zip";
-      sha256 = "";
+      sha256 = "0000000000000000000000000000000000000000000000000000";
    };
 }.${platform}
--- a/pkgs/development/compilers/flutter/update/get-flutter.nix.in
+++ b/pkgs/development/compilers/flutter/update/get-flutter.nix.in
--- a/pkgs/development/compilers/flutter/update/get-pubspec-lock.nix.in
+++ b/pkgs/development/compilers/flutter/update/get-pubspec-lock.nix.in
--- a/pkgs/development/compilers/flutter/update/update.py
+++ b/pkgs/development/compilers/flutter/update/update.py
@ -23,7 +23,7 @@ NIXPKGS_ROOT = subprocess.Popen(['git',


 def load_code(name, **kwargs):
-    with open(f"{NIXPKGS_ROOT}/pkgs/development/compilers/flutter/update/{name}", 'r') as f:
+    with open(f"{NIXPKGS_ROOT}/pkgs/development/compilers/flutter/update/{name}.in", 'r') as f:
        code = f.read()

    for (key, value) in kwargs.items():
--- a/pkgs/development/compilers/go/1.19.nix
+++ b/pkgs/development/compilers/go/1.19.nix
@ -1,197 +0,0 @@
-{ lib
-, stdenv
-, fetchpatch
-, fetchurl
-, tzdata
-, substituteAll
-, iana-etc
-, Security
-, Foundation
-, xcbuild
-, mailcap
-, buildPackages
-, pkgsBuildTarget
-, threadsCross
-, testers
-, skopeo
-, buildGo119Module
-}:
-
-let
-  useGccGoBootstrap = stdenv.buildPlatform.isMusl || stdenv.buildPlatform.isRiscV;
-  goBootstrap = if useGccGoBootstrap then buildPackages.gccgo12 else buildPackages.callPackage ./bootstrap116.nix { };
-
-  skopeoTest = skopeo.override { buildGoModule = buildGo119Module; };
-
-  goarch = platform: {
-    "aarch64" = "arm64";
-    "arm" = "arm";
-    "armv5tel" = "arm";
-    "armv6l" = "arm";
-    "armv7l" = "arm";
-    "i686" = "386";
-    "mips" = "mips";
-    "mips64el" = "mips64le";
-    "mipsel" = "mipsle";
-    "powerpc64le" = "ppc64le";
-    "riscv64" = "riscv64";
-    "s390x" = "s390x";
-    "x86_64" = "amd64";
-  }.${platform.parsed.cpu.name} or (throw "Unsupported system: ${platform.parsed.cpu.name}");
-
-  # We need a target compiler which is still runnable at build time,
-  # to handle the cross-building case where build != host == target
-  targetCC = pkgsBuildTarget.targetPackages.stdenv.cc;
-
-  isCross = stdenv.buildPlatform != stdenv.targetPlatform;
-in
-stdenv.mkDerivation (finalAttrs: {
-  pname = "go";
-  version = "1.19.13";
-
-  src = fetchurl {
-    url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-zPNrU/sAJKAXNTw92yLB8AvHqAc8aqx5BC2iTuNENNM=";
-  };
-
-  strictDeps = true;
-  buildInputs = [ ]
-    ++ lib.optionals stdenv.isLinux [ stdenv.cc.libc.out ]
-    ++ lib.optionals (stdenv.hostPlatform.libc == "glibc") [ stdenv.cc.libc.static ];
-
-  depsTargetTargetPropagated = lib.optionals stdenv.targetPlatform.isDarwin [ Foundation Security xcbuild ];
-
-  depsBuildTarget = lib.optional isCross targetCC;
-
-  depsTargetTarget = lib.optional stdenv.targetPlatform.isWindows threadsCross.package;
-
-  postPatch = ''
-    patchShebangs .
-  '';
-
-  patches = [
-    (substituteAll {
-      src = ./iana-etc-1.17.patch;
-      iana = iana-etc;
-    })
-    # Patch the mimetype database location which is missing on NixOS.
-    # but also allow static binaries built with NixOS to run outside nix
-    (substituteAll {
-      src = ./mailcap-1.17.patch;
-      inherit mailcap;
-    })
-    # prepend the nix path to the zoneinfo files but also leave the original value for static binaries
-    # that run outside a nix server
-    (substituteAll {
-      src = ./tzdata-1.19.patch;
-      inherit tzdata;
-    })
-    ./remove-tools-1.11.patch
-    ./go_no_vendor_checks-1.16.patch
-
-    # runtime: support riscv64 SV57 mode
-    (fetchpatch {
-      url = "https://github.com/golang/go/commit/1e3c19f3fee12e5e2b7802a54908a4d4d03960da.patch";
-      sha256 = "sha256-mk/9gXwQEcAkiRemF6GiNU0c0fhDR29/YcKgQR7ONTA=";
-    })
-  ];
-
-  GOOS = stdenv.targetPlatform.parsed.kernel.name;
-  GOARCH = goarch stdenv.targetPlatform;
-  # GOHOSTOS/GOHOSTARCH must match the building system, not the host system.
-  # Go will nevertheless build a for host system that we will copy over in
-  # the install phase.
-  GOHOSTOS = stdenv.buildPlatform.parsed.kernel.name;
-  GOHOSTARCH = goarch stdenv.buildPlatform;
-
-  # {CC,CXX}_FOR_TARGET must be only set for cross compilation case as go expect those
-  # to be different from CC/CXX
-  CC_FOR_TARGET =
-    if isCross then
-      "${targetCC}/bin/${targetCC.targetPrefix}cc"
-    else
-      null;
-  CXX_FOR_TARGET =
-    if isCross then
-      "${targetCC}/bin/${targetCC.targetPrefix}c++"
-    else
-      null;
-
-  GOARM = toString (lib.intersectLists [ (stdenv.hostPlatform.parsed.cpu.version or "") ] [ "5" "6" "7" ]);
-  GO386 = "softfloat"; # from Arch: don't assume sse2 on i686
-  CGO_ENABLED = 1;
-
-  GOROOT_BOOTSTRAP = if useGccGoBootstrap then goBootstrap else "${goBootstrap}/share/go";
-
-  buildPhase = ''
-    runHook preBuild
-    export GOCACHE=$TMPDIR/go-cache
-    # this is compiled into the binary
-    export GOROOT_FINAL=$out/share/go
-
-    export PATH=$(pwd)/bin:$PATH
-
-    ${lib.optionalString isCross ''
-    # Independent from host/target, CC should produce code for the building system.
-    # We only set it when cross-compiling.
-    export CC=${buildPackages.stdenv.cc}/bin/cc
-    ''}
-    ulimit -a
-
-    pushd src
-    ./make.bash
-    popd
-    runHook postBuild
-  '';
-
-  preInstall = ''
-    rm -r pkg/obj
-    # Contains the wrong perl shebang when cross compiling,
-    # since it is not used for anything we can deleted as well.
-    rm src/regexp/syntax/make_perl_groups.pl
-  '' + (if (stdenv.buildPlatform.system != stdenv.hostPlatform.system) then ''
-    mv bin/*_*/* bin
-    rmdir bin/*_*
-    ${lib.optionalString (!(finalAttrs.GOHOSTARCH == finalAttrs.GOARCH && finalAttrs.GOOS == finalAttrs.GOHOSTOS)) ''
-      rm -rf pkg/${finalAttrs.GOHOSTOS}_${finalAttrs.GOHOSTARCH} pkg/tool/${finalAttrs.GOHOSTOS}_${finalAttrs.GOHOSTARCH}
-    ''}
-  '' else lib.optionalString (stdenv.hostPlatform.system != stdenv.targetPlatform.system) ''
-    rm -rf bin/*_*
-    ${lib.optionalString (!(finalAttrs.GOHOSTARCH == finalAttrs.GOARCH && finalAttrs.GOOS == finalAttrs.GOHOSTOS)) ''
-      rm -rf pkg/${finalAttrs.GOOS}_${finalAttrs.GOARCH} pkg/tool/${finalAttrs.GOOS}_${finalAttrs.GOARCH}
-    ''}
-  '');
-
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $GOROOT_FINAL
-    cp -a bin pkg src lib misc api doc $GOROOT_FINAL
-    mkdir -p $out/bin
-    ln -s $GOROOT_FINAL/bin/* $out/bin
-    runHook postInstall
-  '';
-
-  disallowedReferences = [ goBootstrap ];
-
-  passthru = {
-    inherit goBootstrap skopeoTest;
-    tests = {
-      skopeo = testers.testVersion { package = skopeoTest; };
-      version = testers.testVersion {
-        package = finalAttrs.finalPackage;
-        command = "go version";
-        version = "go${finalAttrs.version}";
-      };
-    };
-  };
-
-  meta = with lib; {
-    changelog = "https://go.dev/doc/devel/release#go${lib.versions.majorMinor finalAttrs.version}";
-    description = "The Go Programming language";
-    homepage = "https://go.dev/";
-    license = licenses.bsd3;
-    maintainers = teams.golang.members;
-    platforms = platforms.darwin ++ platforms.linux;
-    mainProgram = "go";
-  };
-})
--- a/pkgs/development/hare-third-party/hare-ev/default.nix
+++ b/pkgs/development/hare-third-party/hare-ev/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation {
  pname = "hare-ev";
-  version = "unstable-2023-12-04";
+  version = "0-unstable-2024-01-04";

  src = fetchFromSourcehut {
    owner = "~sircmpwn";
    repo = "hare-ev";
-    rev = "e3c3f7613c602672ac41a3e47c106a5bd27a2378";
-    hash = "sha256-TQsR2lXJfkPu53WpJy/K+Jruyfw8mCkEIE9DbFQoS+s=";
+    rev = "736ab9bb17257ee5eba3bc96f6650fc4a14608ea";
+    hash = "sha256-SXExwDZKlW/2XYzmJUhkLWj6NF/znrv3vY9V0mD5iFQ=";
  };

  nativeCheckInputs = [
--- a/pkgs/development/hare-third-party/hare-toml/default.nix
+++ b/pkgs/development/hare-third-party/hare-toml/default.nix
@ -3,36 +3,20 @@
 , scdoc
 , lib
 , fetchFromGitea
-, fetchpatch
 , nix-update-script
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "hare-toml";
-  version = "0.1.0";
+  version = "0.1.0-unstable-2023-12-27";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "lunacb";
    repo = "hare-toml";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-JKK5CcDmAW7FH7AzFwgsr9i13eRSXDUokWfZix7f4yY=";
+    rev = "022d0a8d59e5518029f72724a46e6133b934774c";
+    hash = "sha256-DsVcbh1zn8GNKzzb+1o6bfgiVigrxHw/5Xm3uuUhRy0=";
  };

-  patches = [
-    # Remove `abort()` calls from never returning expressions.
-    (fetchpatch {
-      name = "remove-abort-from-never-returning-expressions.patch";
-      url = "https://codeberg.org/lunacb/hare-toml/commit/f26e7cdfdccd2e82c9fce7e9fca8644b825b40f1.patch";
-      hash = "sha256-DFbrxiaV4lQlFmMzo5GbMubIQ4hU3lXgsJqoyeFWf2g=";
-    })
-    # Fix make's install target to install the correct files
-    (fetchpatch {
-      name = "install-correct-files-with-install-target.patch";
-      url = "https://codeberg.org/lunacb/hare-toml/commit/b79021911fe7025a8f5ddd97deb2c4d18c67b25e.patch";
-      hash = "sha256-IL+faumX6BmdyePXTzsSGgUlgDBqOXXzShupVAa7jlQ=";
-    })
-  ];
-
  nativeBuildInputs = [
    scdoc
    hare
--- a/pkgs/development/libraries/jellyfin-ffmpeg/default.nix
+++ b/pkgs/development/libraries/jellyfin-ffmpeg/default.nix
@ -5,13 +5,13 @@

 ffmpeg_6-full.overrideAttrs (old: rec {
  pname = "jellyfin-ffmpeg";
-  version = "6.0.1-1";
+  version = "6.0.1-2";

  src = fetchFromGitHub {
    owner = "jellyfin";
    repo = "jellyfin-ffmpeg";
    rev = "v${version}";
-    hash = "sha256-LMwGxx++z6TpZLnpeRGraid4653Mp8T4pY5EP4Z7GXY=";
+    hash = "sha256-wc9OGwjcRDTDxlHYVTlbLe1B/F11z0Xcz6WRrO42zn4=";
  };

  # Clobber upstream patches as they don't apply to the Jellyfin fork
--- a/pkgs/development/libraries/libglibutil/default.nix
+++ b/pkgs/development/libraries/libglibutil/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "libglibutil";
-  version = "1.0.75";
+  version = "1.0.76";

  src = fetchFromGitHub {
    owner = "sailfishos";
    repo = pname;
    rev = version;
-    sha256 = "sha256-YHK5gRXBIhZJTY7F8b7QIUnftCIgOHwXVM3D35M3DC4=";
+    sha256 = "sha256-qp3zcaoLM6G3DZgb2Jic1OhHetraEmYRiGkbQlSBnjs=";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/xdg-desktop-portal-wlr/default.nix
+++ b/pkgs/development/libraries/xdg-desktop-portal-wlr/default.nix
@ -21,13 +21,13 @@

 stdenv.mkDerivation rec {
  pname = "xdg-desktop-portal-wlr";
-  version = "0.7.0";
+  version = "0.7.1";

  src = fetchFromGitHub {
    owner = "emersion";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-EwBHkXFEPAEgVUGC/0e2Bae/rV5lec1ttfbJ5ce9cKw=";
+    sha256 = "sha256-GIIDeZMIGUiZV0IUhcclRVThE5LKaqVc5VwnNT8beNU=";
  };

  strictDeps = true;
--- a/pkgs/development/ocaml-modules/domain-local-await/default.nix
+++ b/pkgs/development/ocaml-modules/domain-local-await/default.nix
@ -2,20 +2,20 @@
 , buildDunePackage
 , fetchurl
 , alcotest
+, domain_shims
 , mdx
 , thread-table
 }:

 buildDunePackage rec {
  pname = "domain-local-await";
-  version = "1.0.0";
+  version = "1.0.1";

  minimalOCamlVersion = "5.0";
-  duneVersion = "3";

  src = fetchurl {
    url = "https://github.com/ocaml-multicore/${pname}/releases/download/${version}/${pname}-${version}.tbz";
-    sha256 = "KijWg0iTSdqbwkXd5Kr3/94urDm8QFSY2lMmGjUuxGo=";
+    hash = "sha256-KVIRPFPLB+KwVLLchs5yk5Ex2rggfI8xOa2yPmTN+m8=";
  };

  propagatedBuildInputs = [
@ -26,6 +26,7 @@ buildDunePackage rec {

  checkInputs = [
    alcotest
+    domain_shims
    mdx
  ];

--- a/pkgs/development/php-packages/opentelemetry/default.nix
+++ b/pkgs/development/php-packages/opentelemetry/default.nix
@ -1,7 +1,7 @@
 { lib, buildPecl, fetchFromGitHub }:

 let
-  version = "1.0.0";
+  version = "1.0.1";
 in buildPecl {
  inherit version;
  pname = "opentelemetry";
@ -10,7 +10,7 @@ in buildPecl {
    owner = "open-telemetry";
    repo = "opentelemetry-php-instrumentation";
    rev = version;
-    hash = "sha256-uCsm2vsxXfbEH9spCgWHhmqzyRH9k8kqIAIdQk5CNYg=";
+    hash = "sha256-VHUzRhTtHygHoW+poItaphV+mxe4rmmSfGgesUgPz8Q=";
  };

  sourceRoot = "source/ext";
--- a/pkgs/development/python-modules/azure-mgmt-datafactory/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-datafactory/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "azure-mgmt-datafactory";
-  version = "4.0.0";
+  version = "5.0.0";
  format = "setuptools";

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-XfTLbVdoPVLKgVlBDr59N0EKe+G9fAS+SjI9cWhhs4g=";
+    hash = "sha256-WX/lFsU8qGg3Mg5bk+U0SBdR6cQpjtfmbX02Hr8uz7o=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/django-import-export/default.nix
+++ b/pkgs/development/python-modules/django-import-export/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "django-import-export";
-  version = "3.3.6";
+  version = "3.3.7";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "django-import-export";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-1c+ZGCVrHqqT9aUua+7fI8fYZYBq4I/qq1yIjdVLJPY=";
+    hash = "sha256-xcvBavXrA1XhBKYBkbaOuzG6yYkSnX2USvjg5djoXQ8=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/django-ipware/default.nix
+++ b/pkgs/development/python-modules/django-ipware/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "django-ipware";
-  version = "6.0.3";
+  version = "6.0.4";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-D2gt1POv73kJuz3TlpScNVmCU5vUOS1OnfCwsxYESE0=";
+    hash = "sha256-YU0PCpEfinZeVbbTWLFxW7he62PR67d0R9CdZF8TQ+g=";
  };

  propagatedBuildInputs = [ django ];
--- a/pkgs/development/python-modules/geopandas/default.nix
+++ b/pkgs/development/python-modules/geopandas/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "geopandas";
-  version = "0.14.2";
+  version = "0.14.3";
  format = "setuptools";

  disabled = pythonOlder "3.9";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "geopandas";
    repo = "geopandas";
    rev = "refs/tags/v${version}";
-    hash = "sha256-E4J6VBKPwyQ4IVVClLzNoI//oxlymY+KE6ALaENWwOg=";
+    hash = "sha256-qAINoqnCVfpg2mQhnu0qT/5EjUB+9a3//H8vJJnyj6A=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/gtts/default.nix
+++ b/pkgs/development/python-modules/gtts/default.nix
@ -15,14 +15,14 @@

 buildPythonPackage rec {
  pname = "gtts";
-  version = "2.5.0";
+  version = "2.5.1";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "pndurette";
    repo = "gTTS";
    rev = "refs/tags/v${version}";
-    hash = "sha256-eNBgUP1lXZCr4dx3wNfWS6nFf93C1oZXpkPDtKDCr9Y=";
+    hash = "sha256-CCxD73fpHGsO4zSifWLQtgDkbPvPEnA2357umhOCNoI=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/hstspreload/default.nix
+++ b/pkgs/development/python-modules/hstspreload/default.nix
@ -7,7 +7,7 @@

 buildPythonPackage rec {
  pname = "hstspreload";
-  version = "2024.1.5";
+  version = "2024.2.1";
  pyproject = true;

  disabled = pythonOlder "3.6";
@ -16,7 +16,7 @@ buildPythonPackage rec {
    owner = "sethmlarson";
    repo = "hstspreload";
    rev = "refs/tags/${version}";
-    hash = "sha256-sf0Dsl6zH64O3Y8jns10jAE5faaJSRAu4M5JQ4JBKh0=";
+    hash = "sha256-e0PQpnzYWl8IMtLFdnYPMCBioriumc3vc1ExRjCYoc8=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/hvplot/default.nix
+++ b/pkgs/development/python-modules/hvplot/default.nix
@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "hvplot";
-  version = "0.9.1";
+  version = "0.9.2";
  format = "setuptools";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-KB0YmiEtJkGT9446k079oWqTwBZMSFTakzW0LuBlazo=";
+    hash = "sha256-moyekkkTmqo97l8c6g+TzzY3TReemGcF/N3CuSxHB5M=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/mashumaro/default.nix
+++ b/pkgs/development/python-modules/mashumaro/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "mashumaro";
-  version = "3.11";
+  version = "3.12";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "Fatal1ty";
    repo = "mashumaro";
    rev = "refs/tags/v${version}";
-    hash = "sha256-7gRbTNNK8elWsL0ub7c/EeswIk4xxJOxKVk8HmvWMZA=";
+    hash = "sha256-sSwj/8j+vPX7M8l2h4bPs8WnjzIN2WIpyd7/NcGaExg=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pox/default.nix
+++ b/pkgs/development/python-modules/pox/default.nix
@ -6,14 +6,14 @@

 buildPythonPackage rec {
  pname = "pox";
-  version = "0.3.3";
+  version = "0.3.4";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-4c7WbyoMkqWM82Rrx8y4tHc9QIhLdvhe7aBnBHSHFmc=";
+    hash = "sha256-FubsqE8b7DgoIQsGsFKt8EzyqyDCL9b77194Mgyab+0=";
  };

  # Test sare failing the sandbox
--- a/pkgs/development/python-modules/pymc/default.nix
+++ b/pkgs/development/python-modules/pymc/default.nix
@ -52,7 +52,7 @@ buildPythonPackage rec {

  meta = with lib; {
    description = "Bayesian estimation, particularly using Markov chain Monte Carlo (MCMC)";
-    homepage = "https://github.com/pymc-devs/pymc3";
+    homepage = "https://github.com/pymc-devs/pymc";
    changelog = "https://github.com/pymc-devs/pymc/releases/tag/v${version}";
    license = licenses.asl20;
    maintainers = with maintainers; [ nidabdella ];
--- a/pkgs/development/python-modules/pytest-playwright/default.nix
+++ b/pkgs/development/python-modules/pytest-playwright/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "pytest-playwright";
-  version = "0.4.3";
+  version = "0.4.4";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "microsoft";
    repo = "playwright-pytest";
    rev = "refs/tags/v${version}";
-    hash = "sha256-5qjfZGDM1OqXXNyj81O49ClKKGiAPdgyZZu6TgpskGs=";
+    hash = "sha256-jCK2i27wRGsv65zfzW+Ef72HNQd4Qu/Mw3HX66ZMQ9Y=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/rtfunicode/default.nix
+++ b/pkgs/development/python-modules/rtfunicode/default.nix
@ -0,0 +1,29 @@
+{ buildPythonPackage
+, lib
+, fetchFromGitHub
+, unittestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "rtfunicode";
+  version = "1.4";
+
+  src = fetchFromGitHub {
+    owner = "mjpieters";
+    repo = "rtfunicode";
+    rev = "refs/tags/${version}";
+    hash = "sha256-5lmiazxiEENpdqzVgoKQoG2OW/w5nGmC8odulo2XaLo=";
+  };
+
+  nativeBuildInputs = [ unittestCheckHook ];
+
+  pythonImportsCheck = [ "rtfunicode" ];
+
+  meta = with lib; {
+    description = "Encoder for unicode to RTF 1.5 command sequences";
+    maintainers = [ maintainers.lucasew ];
+    license = licenses.bsd2;
+    homepage = "https://github.com/mjpieters/rtfunicode";
+    changelog = "https://github.com/mjpieters/rtfunicode/releases/tag/${version}";
+  };
+}
--- a/pkgs/development/python-modules/yalexs-ble/default.nix
+++ b/pkgs/development/python-modules/yalexs-ble/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "yalexs-ble";
-  version = "2.4.0";
+  version = "2.4.1";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "bdraco";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-kdEeLd+83Pdno1ZzirZUrRk/7q0WFc/XfqvuKvVQ8/s=";
+    hash = "sha256-u6Mhqt6DcPiini8EvtqKoVAYUwb31hvWfCNb/sbqvWQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/tools/altair-graphql-client/default.nix
+++ b/pkgs/development/tools/altair-graphql-client/default.nix
@ -2,11 +2,11 @@

 let
  pname = "altair";
-  version = "6.1.0";
+  version = "6.2.0";

  src = fetchurl {
    url = "https://github.com/imolorhe/altair/releases/download/v${version}/altair_${version}_x86_64_linux.AppImage";
-    sha256 = "sha256-Au4jsjHhsosawqQCqE0oK4SSIVXuh6P/5m1xCjXSVkw=";
+    sha256 = "sha256-tDku9PNPCJ3ft7eFq34l90jGOXjHMk8JZcfO8SWJras=";
  };

  appimageContents = appimageTools.extract { inherit pname version src; };
--- a/pkgs/development/tools/analysis/retdec/default.nix
+++ b/pkgs/development/tools/analysis/retdec/default.nix
@ -2,8 +2,8 @@
 , fetchFromGitHub
 , fetchpatch
 , fetchzip
+, writeText
 , lib
-, callPackage
 , openssl
 , cmake
 , autoconf
@ -15,131 +15,132 @@
 , groff
 , perl
 , python3
+, ncurses
 , time
 , upx
-, ncurses
+, gtest
 , libffi
 , libxml2
 , zlib
-, withPEPatterns ? false
+, enableTests ? true
+, buildDevTools ? true
+, compileYaraPatterns ? true
 }:

 let
+  # all dependencies that are normally fetched during build time (the subdirectories of `deps`)
+  # all of these need to be fetched through nix and applied via their <NAME>_URL cmake variable
  capstone = fetchFromGitHub {
-    owner = "avast-tl";
+    owner = "capstone-engine";
    repo = "capstone";
-    rev = "27c713fe4f6eaf9721785932d850b6291a6073fe";
-    sha256 = "105z1g9q7s6n15qpln9vzhlij7vj6cyc5dqdr05n7wzjvlagwgxc";
+    rev = "5.0-rc2";
+    sha256 = "sha256-nB7FcgisBa8rRDS3k31BbkYB+tdqA6Qyj9hqCnFW+ME=";
  };
-  elfio = fetchFromGitHub {
+  llvm = fetchFromGitHub {
    owner = "avast-tl";
-    repo = "elfio";
-    rev = "998374baace397ea98f3b1d768e81c978b4fba41";
-    sha256 = "09n34rdp0wpm8zy30zx40wkkc4gbv2k3cv181y6c1260rllwk5d1";
+    repo = "llvm";
+    rev = "2a1f3d8a97241c6e91710be8f84cf3cf80c03390";
+    sha256 = "sha256-+v1T0VI9R92ed9ViqsfYZMJtPCjPHCr4FenoYdLuFOU=";
  };
-  keystone = fetchFromGitHub { # only for tests
+  yaracpp = fetchFromGitHub {
+    owner = "VirusTotal";
+    repo = "yara";
+    rev = "v4.2.0-rc1";
+    sha256 = "sha256-WcN6ClYO2d+/MdG06RHx3kN0o0WVAY876dJiG7CwJ8w=";
+  };
+  yaramod = fetchFromGitHub {
+    owner = "avast";
+    repo = "yaramod";
+    rev = "aa06dd408c492a8f4488774caf2ee105ccc23ab5";
+    sha256 = "sha256-NVDRf2U5H92EN/Ks//uxNEaeKU+sT4VL4QyyYMO+zKk=";
+  };
+  keystone = fetchFromGitHub {
+    # only for tests
    owner = "keystone-engine";
    repo = "keystone";
    rev = "d7ba8e378e5284e6384fc9ecd660ed5f6532e922";
    sha256 = "1yzw3v8xvxh1rysh97y0i8y9svzbglx2zbsqjhrfx18vngh0x58f";
  };
-  libdwarf = fetchFromGitHub {
-    owner = "avast-tl";
-    repo = "libdwarf";
-    rev = "85465d5e235cc2d2f90d04016d6aca1a452d0e73";
-    sha256 = "11y62r65py8yp57i57a4cymxispimn62by9z4j2g19hngrpsgbki";
-  };
-  llvm = fetchFromGitHub {
-    owner = "avast-tl";
-    repo = "llvm";
-    rev = "725d0cee133c6ab9b95c493f05de3b08016f5c3c";
-    sha256 = "0dzvafmn4qs62w1y9vh0a11clpj6q3hb41aym4izpcyybjndf9bq";
-  };
-  pelib = fetchFromGitHub {
-    owner = "avast-tl";
-    repo = "pelib";
-    rev = "a7004b2e80e4f6dc984f78b821e7b585a586050d";
-    sha256 = "0nyrb3g749lxgcymz1j584xbb1x6rvy1mc700lyn0brznvqsm81n";
-  };
-  rapidjson = fetchFromGitHub {
-    owner = "Tencent";
-    repo = "rapidjson";
-    rev = "v1.1.0";
-    sha256 = "1jixgb8w97l9gdh3inihz7avz7i770gy2j2irvvlyrq3wi41f5ab";
-  };
-  yaracpp = callPackage ./yaracpp.nix {}; # is its own package because it needs a patch
-  yaramod = fetchFromGitHub {
-    owner = "avast-tl";
-    repo = "yaramod";
-    rev = "v2.2.2";
-    sha256 = "0cq9h4h686q9ybamisbl797g6xjy211s3cq83nixkwkigmz48ccp";
-  };
-  jsoncpp = fetchFromGitHub {
-    owner = "open-source-parsers";
-    repo = "jsoncpp";
-    rev = "1.8.4";
-    sha256 = "1z0gj7a6jypkijmpknis04qybs1hkd04d1arr3gy89lnxmp6qzlm";
-  };
-  googletest = fetchFromGitHub { # only for tests
-    owner = "google";
-    repo = "googletest";
-    rev = "83fa0cb17dad47a1d905526dcdddb5b96ed189d2";
-    sha256 = "1c2r0p9v7vz2vasy8bknfb448l6wsvzw35s8hmc5z013z5502mpk";
-  };
-  tinyxml2 = fetchFromGitHub {
-    owner = "leethomason";
-    repo = "tinyxml2";
-    rev = "cc1745b552dd12bb1297a99f82044f83b06729e0";
-    sha256 = "015g8520a0c55gwmv7pfdsgfz2rpdmh3d1nq5n9bd65n35492s3q";
-  };

-  retdec-support = let
-    version = "2018-02-08"; # make sure to adjust both hashes (once with withPEPatterns=true and once withPEPatterns=false)
-  in fetchzip {
-    url = "https://github.com/avast-tl/retdec-support/releases/download/${version}/retdec-support_${version}.tar.xz";
-    sha256 = if withPEPatterns then "148i8flbyj1y4kfdyzsz7jsj38k4h97npjxj18h6v4wksd4m4jm7"
-                               else "0ixv9qyqq40pzyqy6v9jf5rxrvivjb0z0zn260nbmb9gk765bacy";
-    stripRoot = false;
-    # Removing PE signatures reduces this from 3.8GB -> 642MB (uncompressed)
-    postFetch = lib.optionalString (!withPEPatterns) ''
-      rm -r "$out/generic/yara_patterns/static-code/pe"
+  retdec-support-version = "2019-03-08";
+  retdec-support =
+    { rev = retdec-support-version; } // # for checking the version against the expected version
+    fetchzip {
+      url = "https://github.com/avast-tl/retdec-support/releases/download/${retdec-support-version}/retdec-support_${retdec-support-version}.tar.xz";
+      hash = "sha256-t1tx4MfLW/lwtbO5JQ1nrFBIOeMclq+0dENuXW+ahIM=";
+      stripRoot = false;
+    };
+
+  check-dep = name: dep:
+    ''
+      context="$(grep ${name}_URL --after-context 1 cmake/deps.cmake)"
+      expected="$(echo "$context" | grep --only-matching '".*"')"
+      have="${dep.rev}"
+
+      echo "checking ${name} dependency matches deps.cmake...";
+      if ! echo "$expected" | grep -q "$have"; then
+        printf '%s\n' "${name} version does not match!"  "  nix: $have, expected: $expected"
+        false
+      fi
    '';
-  } // {
-    inherit version; # necessary to check the version against the expected version
+
+  deps = {
+    CAPSTONE = capstone;
+    LLVM = llvm;
+    YARA = yaracpp;
+    YARAMOD = yaramod;
+    SUPPORT_PKG = retdec-support;
+  } // lib.optionalAttrs enableTests {
+    KEYSTONE = keystone;
+    # nixpkgs googletest is used
+    # GOOGLETEST = googletest;
  };

-  # patch CMakeLists.txt for a dependency and compare the versions to the ones expected by upstream
-  # this has to be applied for every dependency (which it is in postPatch)
-  patchDep = dep: ''
-    # check if our version of dep is the same version that upstream expects
-    echo "Checking version of ${dep.dep_name}"
-    expected_rev="$( sed -n -e 's|.*URL https://github.com/.*/archive/\(.*\)\.zip.*|\1|p' "deps/${dep.dep_name}/CMakeLists.txt" )"
-    if [ "$expected_rev" != '${dep.rev}' ]; then
-      echo "The ${dep.dep_name} dependency has the wrong version: ${dep.rev} while $expected_rev is expected."
-      exit 1
-    fi
+  # overwrite install-share.py to copy instead of download.
+  # we use this so the copy happens at the right time in the build,
+  # otherwise, the build process cleans the directory.
+  install-share =
+    writeText
+      "install-share.py"
+      ''
+        import os, sys, shutil, subprocess

-    # patch the CMakeLists.txt file to use our local copy of the dependency instead of fetching it at build time
-    sed -i -e 's|URL .*|URL ${dep}|' "deps/${dep.dep_name}/CMakeLists.txt"
-  '';
+        install_path, arch_url, sha256hash_ref, version = sys.argv[1:]
+        support_dir = os.path.join(install_path, 'share', 'retdec', 'support')

-in stdenv.mkDerivation rec {
+        assert os.path.isdir(arch_url), "nix install-share.py expects a path for support url"
+
+        os.makedirs(support_dir, exist_ok=True)
+        shutil.copytree(arch_url, support_dir, dirs_exist_ok=True)
+        subprocess.check_call(['chmod', '-R', 'u+w', support_dir])
+      '';
+in
+stdenv.mkDerivation (self: {
  pname = "retdec";

-  # If you update this you will also need to adjust the versions of the updated dependencies. You can do this by first just updating retdec
-  # itself and trying to build it. The build should fail and tell you which dependencies you have to upgrade to which versions.
+  # If you update this you will also need to adjust the versions of the updated dependencies.
  # I've notified upstream about this problem here:
  # https://github.com/avast-tl/retdec/issues/412
-  # gcc is pinned to gcc8 in all-packages.nix. That should probably be re-evaluated on update.
-  version = "3.2";
+  #
+  # The dependencies and their sources are listed in this file:
+  # https://github.com/avast/retdec/blob/master/cmake/deps.cmake
+  version = "5.0";

  src = fetchFromGitHub {
-    owner = "avast-tl";
-    repo = pname;
-    rev = "refs/tags/v${version}";
-    sha256 = "0chky656lsddn20bnm3pmz6ix20y4a0y8swwr42hrhi01vkhmzrp";
+    owner = "avast";
+    repo = "retdec";
+    rev = "refs/tags/v${self.version}";
+    sha256 = "sha256-H4e+aSgdBBbG6X6DzHGiDEIASPwBVNVsfHyeBTQLAKI=";
  };

+  patches = [
+    # gcc 13 compatibility: https://github.com/avast/retdec/pull/1153
+    (fetchpatch {
+      url = "https://github.com/avast/retdec/commit/dbaab2c3d17b1eae22c581e8ab6bfefadf4ef6ae.patch";
+      hash = "sha256-YqHYPGAGWT4x6C+CpsOSsOIZ+NPM2FBQtGQFs74OUIQ=";
+    })
+  ];
+
  nativeBuildInputs = [
    cmake
    autoconf
@ -159,64 +160,66 @@ in stdenv.mkDerivation rec {
    libffi
    libxml2
    zlib
-  ];
+  ] ++ lib.optional self.doInstallCheck gtest;

  cmakeFlags = [
-    "-DRETDEC_TESTS=ON" # build tests
-  ];
+    (lib.cmakeBool "RETDEC_TESTS" self.doInstallCheck) # build tests
+    (lib.cmakeBool "RETDEC_DEV_TOOLS" buildDevTools) # build tools e.g. capstone2llvmir, retdectool
+    (lib.cmakeBool "RETDEC_COMPILE_YARA" compileYaraPatterns) # build and install compiled patterns
+  ] ++ lib.mapAttrsToList (k: v: lib.cmakeFeature "${k}_URL" "${v}") deps;

-  # all dependencies that are normally fetched during build time (the subdirectories of `deps`)
-  # all of these need to be fetched through nix and the CMakeLists files need to be patched not to fetch them themselves
-  external_deps = [
-    (capstone // { dep_name = "capstone"; })
-    (elfio // { dep_name = "elfio"; })
-    (googletest // { dep_name = "googletest"; })
-    (jsoncpp // { dep_name = "jsoncpp"; })
-    (keystone // { dep_name = "keystone"; })
-    (libdwarf // { dep_name = "libdwarf"; })
-    (llvm // { dep_name = "llvm"; })
-    (pelib // { dep_name = "pelib"; })
-    (rapidjson // { dep_name = "rapidjson"; })
-    (tinyxml2 // { dep_name = "tinyxml2"; })
-    (yaracpp // { dep_name = "yaracpp"; })
-    (yaramod // { dep_name = "yaramod"; })
-  ];
+  preConfigure =
+    lib.concatStringsSep "\n" (lib.mapAttrsToList check-dep deps)
+    +
+    ''
+      cp -v ${install-share} ./support/install-share.py

-  # Use newer yaramod to fix w/bison 3.2+
-  patches = [
-    # 2.1.2 -> 2.2.1
-    (fetchpatch {
-      url = "https://github.com/avast-tl/retdec/commit/c9d23da1c6e23c149ed684c6becd3f3828fb4a55.patch";
-      sha256 = "0hdq634f72fihdy10nx2ajbps561w03dfdsy5r35afv9fapla6mv";
-    })
-    # 2.2.1 -> 2.2.2
-    (fetchpatch {
-      url = "https://github.com/avast-tl/retdec/commit/fb85f00754b5d13b781385651db557741679721e.patch";
-      sha256 = "0a8mwmwb39pr5ag3q11nv81ncdk51shndqrkm92shqrmdq14va52";
-    })
-  ];
+      # the CMakeLists assume CMAKE_INSTALL_BINDIR, etc are path components but in Nix, they are absolute.
+      # therefore, we need to remove the unnecessary CMAKE_INSTALL_PREFIX prepend.
+      substituteInPlace ./CMakeLists.txt \
+        --replace-warn "''$"{CMAKE_INSTALL_PREFIX}/"''$"{RETDEC_INSTALL_BIN_DIR} "''$"{CMAKE_INSTALL_FULL_BINDIR} \
+        --replace-warn "''$"{CMAKE_INSTALL_PREFIX}/"''$"{RETDEC_INSTALL_LIB_DIR} "''$"{CMAKE_INSTALL_FULL_LIBDIR} \

-  postPatch = (lib.concatMapStrings patchDep external_deps) + ''
-    # install retdec-support
-    echo "Checking version of retdec-support"
-    expected_version="$( sed -n -e "s|^version = '\(.*\)'$|\1|p" 'cmake/install-share.py' )"
-    if [ "$expected_version" != '${retdec-support.version}' ]; then
-      echo "The retdec-support dependency has the wrong version: ${retdec-support.version} while $expected_version is expected."
-      exit 1
-    fi
-    mkdir -p "$out/share/retdec"
-    cp -r ${retdec-support} "$out/share/retdec/support" # write permission needed during install
-    chmod -R u+w "$out/share/retdec/support"
-    # python file originally responsible for fetching the retdec-support archive to $out/share/retdec
-    # that is not necessary anymore, so empty the file
-    echo > cmake/install-share.py
+      # --replace "''$"{CMAKE_INSTALL_PREFIX}/"''$"{RETDEC_INSTALL_SUPPORT_DIR} "''$"{RETDEC_INSTALL_SUPPORT_DIR}
+      # note! Nix does not set CMAKE_INSTALL_DATADIR to an absolute path, so this replacement would be incorrect

-    # call correct `time` and `upx` programs
-    substituteInPlace scripts/retdec-config.py --replace /usr/bin/time ${time}/bin/time
-    substituteInPlace scripts/retdec-unpacker.py --replace "'upx'" "'${upx}/bin/upx'"
-  '';
+      # similarly for yaramod. here, we fix the LIBDIR to lib64. for whatever reason, only "lib64" works.
+      substituteInPlace deps/yaramod/CMakeLists.txt \
+        --replace-fail "''$"{YARAMOD_INSTALL_DIR}/"''$"{CMAKE_INSTALL_LIBDIR} "''$"{YARAMOD_INSTALL_DIR}/lib64 \
+        --replace-fail CMAKE_ARGS 'CMAKE_ARGS -DCMAKE_INSTALL_LIBDIR=lib64'

-  doInstallCheck = true;
+      # yara needs write permissions in the generated source directory.
+      echo ${lib.escapeShellArg ''
+        ExternalProject_Add_Step(
+          yara chmod WORKING_DIRECTORY ''${YARA_DIR}
+          DEPENDEES download COMMAND chmod -R u+w .
+        )
+      ''} >> deps/yara/CMakeLists.txt
+
+      # patch gtest to use the system package
+      gtest=deps/googletest/CMakeLists.txt
+      old="$(cat $gtest)"
+      (echo 'find_package(GTest REQUIRED)'; echo "$old") > $gtest
+      sed -i 's/ExternalProject_[^(]\+[(]/ set(IGNORED /g' $gtest
+
+      substituteInPlace $gtest \
+        --replace-fail '$'{GTEST_LIB} "GTest::gtest"\
+        --replace-fail '$'{GMOCK_LIB} "GTest::gmock"\
+        --replace-fail '$'{GTEST_MAIN_LIB} "GTest::gtest_main"\
+        --replace-fail '$'{GMOCK_MAIN_LIB} "GTest::gmock_main"
+
+      # without git history, there is no chance these tests will pass.
+      substituteInPlace tests/utils/version_tests.cpp \
+        --replace-quiet VersionTests DISABLED_VersionTests
+
+      substituteInPlace scripts/retdec-utils.py \
+        --replace-warn /usr/bin/time ${time} \
+        --replace-warn /usr/local/bin/gtime ${time}
+      substituteInPlace scripts/retdec-unpacker.py \
+        --replace-warn "'upx'" "'${upx}'"
+    '';
+
+  doInstallCheck = enableTests;
  installCheckPhase = ''
    ${python3.interpreter} "$out/bin/retdec-tests-runner.py"

@ -227,7 +230,7 @@ in stdenv.mkDerivation rec {
    description = "A retargetable machine-code decompiler based on LLVM";
    homepage = "https://retdec.com";
    license = licenses.mit;
-    maintainers = with maintainers; [ dtzWill timokau ];
-    platforms = ["x86_64-linux" "i686-linux"];
+    maintainers = with maintainers; [ dtzWill katrinafyi ];
+    platforms = [ "x86_64-linux" ];
  };
-}
+})
--- a/pkgs/development/tools/analysis/retdec/yaracpp.nix
+++ b/pkgs/development/tools/analysis/retdec/yaracpp.nix
@ -1,49 +0,0 @@
-{ stdenv
-, fetchFromGitHub
-, coreutils
-}:
-
-let
-  yara = fetchFromGitHub {
-    owner = "avast-tl";
-    repo = "yara";
-    rev = "ea101c5856941f39cad2db3012f2660d1d5c8b65";
-    sha256 = "033ssx2hql5k4pv9si043s3mjq2b748ymjzif8pg6rdwh260faky";
-  };
-in stdenv.mkDerivation rec {
-  # only fetches the yaracpp source patched to work with a local yara clone,
-  # does not build anything
-  pname = "yaracpp-src";
-  version = "2018-10-09";
-  rev = "b92bde0e59e3b75bc445227e04b71105771dee8b"; # as specified in retdec/deps/yaracpp/CMakeLists.txt
-
-  src = fetchFromGitHub {
-    inherit rev;
-    owner = "avast-tl";
-    repo = "yaracpp";
-    sha256 = "0fan7q79j7s3bjmhsd2nw6sqyi14xgikn7mr2p4nj87lick5l4a2";
-  };
-
-  postPatch = ''
-      # check if our version of yara is the same version that upstream expects
-      echo "Checking version of yara"
-      expected_rev="$( sed -n -e 's|.*URL https://github.com/.*/archive/\(.*\)\.zip.*|\1|p' "deps/CMakeLists.txt" )"
-      if [ "$expected_rev" != '${yara.rev}' ]; then
-        echo "The yara dependency has the wrong version: ${yara.rev} while $expected_rev is expected."
-        exit 1
-      fi
-
-      # patch the CMakeLists.txt file to use our local copy of the dependency instead of fetching it at build time
-      sed -i -e "s|URL .*|URL ${yara}|" "deps/CMakeLists.txt"
-
-      # abuse the CONFIGURE_COMMAND to make the source writeable after copying it to the build locatoin (necessary for the build)
-      sed -i -e 's|CONFIGURE_COMMAND ""|CONFIGURE_COMMAND COMMAND ${coreutils}/bin/chmod -R u+w .|' "deps/CMakeLists.txt"
-    '';
-
-  buildPhase = "# do nothing";
-  configurePhase = "# do nothing";
-  installPhase = ''
-    mkdir -p "$out"
-    cp -r * "$out"
-  '';
-}
--- a/pkgs/development/tools/gauge/default.nix
+++ b/pkgs/development/tools/gauge/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "gauge";
-  version = "1.5.7";
+  version = "1.6.1";

  src = fetchFromGitHub {
    owner = "getgauge";
    repo = "gauge";
    rev = "v${version}";
-    hash = "sha256-9zoZKd/mubm64Pb95iUFZK622hTqm3A+U0OOX3uDtd8=";
+    hash = "sha256-dgSrjSAO0MwVML07gIqI9hIgRu+Pgv2jZOItSFd0DVU=";
  };

-  vendorHash = "sha256-BQkQ6huTm3hI1MQvq2VffCrxCQyDJb/S7yxvPpfQaGI=";
+  vendorHash = "sha256-IGxETjZ2RCvhcA7XUQYbr2jf+9P/WReuAOLIpE3kyes=";

  excludedPackages = [ "build" "man" ];

--- a/pkgs/development/tools/rust/cargo-deb/default.nix
+++ b/pkgs/development/tools/rust/cargo-deb/default.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-deb";
-  version = "2.0.4";
+  version = "2.0.5";

  src = fetchFromGitHub {
    owner = "kornelski";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-vIWgkaAprbsdfPUZvyfxJm7wZxExKcV9jkz/A/G6tAo=";
+    hash = "sha256-s/VM3MF3X+2x/0CktzbOPdo8zQMUS5z92hRGfn5P6/w=";
  };

-  cargoHash = "sha256-EMbqIpFWbUvZaszsYSJaOEl+vm3mrmub7mdfeJPEX7Y=";
+  cargoHash = "sha256-4FGnX+Uj3SYs0OBJZQrNF4fvKm8XIMdiSBOPYxF45yU=";

  nativeBuildInputs = [
    makeWrapper
--- a/pkgs/development/tools/rust/cargo-mutants/default.nix
+++ b/pkgs/development/tools/rust/cargo-mutants/default.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-mutants";
-  version = "24.1.2";
+  version = "24.2.0";

  src = fetchFromGitHub {
    owner = "sourcefrog";
    repo = "cargo-mutants";
    rev = "v${version}";
-    hash = "sha256-V1BQJmwLhsh36Gyg1Zrxw5MCUQcyIKlnEsYmchu8K5A=";
+    hash = "sha256-cjU/RvfRgeFYwATEVQLmqxxy5qnQtY4R5Hd7jG772Ik=";
  };

-  cargoHash = "sha256-f2iJnBklzSgHqez6KSk1+ZqiY/t9iCdtsQze9PhG164=";
+  cargoHash = "sha256-0DFMiR4QelTfbTLxU7ceuUgYowO8eRhPemndEWq5xQQ=";

  buildInputs = lib.optionals stdenv.isDarwin [
    darwin.apple_sdk.frameworks.SystemConfiguration
--- a/pkgs/games/openttd/jgrpp.nix
+++ b/pkgs/games/openttd/jgrpp.nix
@ -2,13 +2,13 @@

 openttd.overrideAttrs (oldAttrs: rec {
  pname = "openttd-jgrpp";
-  version = "0.56.2";
+  version = "0.57.0";

  src = fetchFromGitHub rec {
    owner = "JGRennison";
    repo = "OpenTTD-patches";
    rev = "jgrpp-${version}";
-    hash = "sha256-87MquPFoFz6LFlwBTDrFNO11UYCtZUzdZYR1YttkDF8=";
+    hash = "sha256-gXn5O+WSYCK34FKMBOyuTg3cq4Yg59CuLxxzwLbsFBA=";
  };

  buildInputs = oldAttrs.buildInputs ++ [ zstd ];
--- a/pkgs/misc/frescobaldi/default.nix
+++ b/pkgs/misc/frescobaldi/default.nix
@ -2,13 +2,13 @@

 buildPythonApplication rec {
  pname = "frescobaldi";
-  version = "3.2";
+  version = "3.3.0";

  src = fetchFromGitHub {
    owner = "wbsoft";
    repo = "frescobaldi";
-    rev = "v${version}";
-    sha256 = "sha256-q340ChF7VZcbLMW/nd1so7WScsPfbdeJUjTzsY5dkec=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-Q6ruthNcpjLlYydUetkuTECiCIzu055bw40O8BPGq/A=";
  };

  propagatedBuildInputs = with python3Packages; [
--- a/Show More
+++ b/Show More