Merge remote-tracking branch 'origin/master' into staging-next

2024-11-25 00:12:56 +00:00 · 2024-11-08 18:40:48 +01:00 · 2024-11-08 18:40:48 +01:00 · 2900723943
commit 2900723943
parent 4dab54a2c8 7701a9e6c6
91 changed files with 4912 additions and 4775 deletions
--- a/doc/languages-frameworks/haskell.section.md
+++ b/doc/languages-frameworks/haskell.section.md
@ -57,8 +57,8 @@ Available compilers are collected under `haskell.compiler`.
 Each of those compiler versions has a corresponding attribute set `packages` built with
 it. However, the non-standard package sets are not tested regularly and, as a
 result, contain fewer working packages. The corresponding package set for GHC
-9.4.5 is `haskell.packages.ghc945`. In fact `haskellPackages` (at the time of writing) is just an alias
-for `haskell.packages.ghc966`:
+9.4.5 is `haskell.packages.ghc945`. In fact `haskellPackages` is just an alias
+for `haskell.packages.ghc964`:

 Every package set also re-exposes the GHC used to build its packages as `haskell.packages.*.ghc`.

--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1044,6 +1044,12 @@
    github = "Alexnortung";
    githubId = 1552267;
  };
+  alex-nt = {
+    email = "nix@azuremyst.org";
+    github = "alex-nt";
+    githubId = 12470950;
+    name = "AN";
+  };
  alexoundos = {
    email = "alexoundos@gmail.com";
    github = "AleXoundOS";
@ -2134,7 +2140,6 @@
  };
  aucub = {
    name = "aucub";
-    email = "dr56ekgbb@mozmail.com";
    github = "aucub";
    githubId = 78630225;
  };
@ -11244,6 +11249,7 @@
    name = "katanallama";
  };
  katexochen = {
+    email = "katexochen0@gmail.com";
    github = "katexochen";
    githubId = 49727155;
    matrix = "@katexochen:matrix.org";
@ -23408,7 +23414,6 @@
    github = "willbush";
    githubId = 2023546;
    name = "Will Bush";
-    keys = [ { fingerprint = "4441 422E 61E4 C8F3 EBFE  5E33 3823 864B 54B1 3BDA"; } ];
  };
  willcohen = {
    github = "willcohen";
@ -24071,6 +24076,13 @@
    github = "youhaveme9";
    githubId = 58213083;
  };
+  youwen5 = {
+    name = "Youwen Wu";
+    email = "youwenw@gmail.com";
+    github = "youwen5";
+    githubId = 38934577;
+    keys = [ { fingerprint = "8F5E 6C1A F909 76CA 7102 917A 8656 58ED 1FE6 1EC3"; } ];
+  };
  yrashk = {
    email = "yrashk@gmail.com";
    github = "yrashk";
--- a/nixos/modules/security/acme/default.nix
+++ b/nixos/modules/security/acme/default.nix
@ -217,7 +217,7 @@ let

    protocolOpts = if useDns then (
      [ "--dns" data.dnsProvider ]
-      ++ lib.optionals (!data.dnsPropagationCheck) [ "--dns.disable-cp" ]
+      ++ lib.optionals (!data.dnsPropagationCheck) [ "--dns.propagation-disable-ans" ]
      ++ lib.optionals (data.dnsResolver != null) [ "--dns.resolvers" data.dnsResolver ]
    ) else if data.s3Bucket != null then [ "--http" "--http.s3-bucket" data.s3Bucket ]
    else if data.listenHTTP != null then [ "--http" "--http.port" data.listenHTTP ]
--- a/nixos/modules/security/acme/mk-cert-ownership-assertion.nix
+++ b/nixos/modules/security/acme/mk-cert-ownership-assertion.nix
@ -1,4 +1,21 @@
-{ cert, group, groups, user }: {
-  assertion = cert.group == group || builtins.any (u: u == user) groups.${cert.group}.members;
-  message = "Group for certificate ${cert.domain} must be ${group}, or user ${user} must be a member of group ${cert.group}";
+lib:
+
+{ cert, groups, services }:
+let
+  catSep = builtins.concatStringsSep;
+
+  svcGroups = svc:
+    (lib.optional (svc.serviceConfig ? Group) svc.serviceConfig.Group)
+    ++ (svc.serviceConfig.SupplementaryGroups or [ ]);
+in
+{
+  assertion = builtins.all (svc:
+    svc.serviceConfig.User or "root" == "root"
+    || builtins.elem svc.serviceConfig.User groups.${cert.group}.members
+    || builtins.elem cert.group (svcGroups svc)
+  ) services;
+
+  message = "Certificate ${cert.domain} (group=${cert.group}) must be readable by service(s) ${
+    catSep ", " (map (svc: "${svc.name} (user=${svc.serviceConfig.User} groups=${catSep " " (svcGroups svc)})") services)
+  }";
 }
--- a/nixos/modules/services/web-servers/apache-httpd/default.nix
+++ b/nixos/modules/services/web-servers/apache-httpd/default.nix
@ -33,7 +33,9 @@ let
    certName = if hostOpts.useACMEHost != null then hostOpts.useACMEHost else hostOpts.hostName;
  }) (filter (hostOpts: hostOpts.enableACME || hostOpts.useACMEHost != null) vhosts);

-  dependentCertNames = unique (map (hostOpts: hostOpts.certName) acmeEnabledVhosts);
+  vhostCertNames = unique (map (hostOpts: hostOpts.certName) acmeEnabledVhosts);
+  dependentCertNames = filter (cert: certs.${cert}.dnsProvider == null) vhostCertNames; # those that might depend on the HTTP server
+  independentCertNames = filter (cert: certs.${cert}.dnsProvider != null) vhostCertNames; # those that don't depend on the HTTP server

  mkListenInfo = hostOpts:
    if hostOpts.listen != [] then
@ -371,7 +373,7 @@ let
      echo "$options" >> $out
    '';

-  mkCertOwnershipAssertion = import ../../../security/acme/mk-cert-ownership-assertion.nix;
+  mkCertOwnershipAssertion = import ../../../security/acme/mk-cert-ownership-assertion.nix lib;
 in


@ -641,10 +643,10 @@ in
        '';
      }
    ] ++ map (name: mkCertOwnershipAssertion {
-      inherit (cfg) group user;
      cert = config.security.acme.certs.${name};
      groups = config.users.groups;
-    }) dependentCertNames;
+      services = [ config.systemd.services.httpd ] ++ lib.optional (vhostCertNames != []) config.systemd.services.httpd-config-reload;
+    }) vhostCertNames;

    warnings =
      mapAttrsToList (name: hostOpts: ''
@ -747,8 +749,10 @@ in
    systemd.services.httpd = {
        description = "Apache HTTPD";
        wantedBy = [ "multi-user.target" ];
-        wants = concatLists (map (certName: [ "acme-finished-${certName}.target" ]) dependentCertNames);
-        after = [ "network.target" ] ++ map (certName: "acme-selfsigned-${certName}.service") dependentCertNames;
+        wants = concatLists (map (certName: [ "acme-finished-${certName}.target" ]) vhostCertNames);
+        after = [ "network.target" ]
+          ++ map (certName: "acme-selfsigned-${certName}.service") vhostCertNames
+          ++ map (certName: "acme-${certName}.service") independentCertNames; # avoid loading self-signed key w/ real cert, or vice-versa
        before = map (certName: "acme-${certName}.service") dependentCertNames;
        restartTriggers = [ cfg.configFile ];

@ -789,9 +793,9 @@ in
    # which allows the acme-finished-$cert.target to signify the successful updating
    # of certs end-to-end.
    systemd.services.httpd-config-reload = let
-      sslServices = map (certName: "acme-${certName}.service") dependentCertNames;
-      sslTargets = map (certName: "acme-finished-${certName}.target") dependentCertNames;
-    in mkIf (sslServices != []) {
+      sslServices = map (certName: "acme-${certName}.service") vhostCertNames;
+      sslTargets = map (certName: "acme-finished-${certName}.target") vhostCertNames;
+    in mkIf (vhostCertNames != []) {
      wantedBy = sslServices ++ [ "multi-user.target" ];
      # Before the finished targets, after the renew services.
      # This service might be needed for HTTP-01 challenges, but we only want to confirm
@ -801,7 +805,7 @@ in
      restartTriggers = [ cfg.configFile ];
      # Block reloading if not all certs exist yet.
      # Happens when config changes add new vhosts/certs.
-      unitConfig.ConditionPathExists = map (certName: certs.${certName}.directory + "/fullchain.pem") dependentCertNames;
+      unitConfig.ConditionPathExists = map (certName: certs.${certName}.directory + "/fullchain.pem") vhostCertNames;
      serviceConfig = {
        Type = "oneshot";
        TimeoutSec = 60;
--- a/nixos/modules/services/web-servers/caddy/default.nix
+++ b/nixos/modules/services/web-servers/caddy/default.nix
@ -5,8 +5,12 @@ with lib;
 let
  cfg = config.services.caddy;

+  certs = config.security.acme.certs;
  virtualHosts = attrValues cfg.virtualHosts;
-  acmeVHosts = filter (hostOpts: hostOpts.useACMEHost != null) virtualHosts;
+  acmeEnabledVhosts = filter (hostOpts: hostOpts.useACMEHost != null) virtualHosts;
+  vhostCertNames = unique (map (hostOpts: hostOpts.useACMEHost) acmeEnabledVhosts);
+  dependentCertNames = filter (cert: certs.${cert}.dnsProvider == null) vhostCertNames; # those that might depend on the HTTP server
+  independentCertNames = filter (cert: certs.${cert}.dnsProvider != null) vhostCertNames; # those that don't depend on the HTTP server

  mkVHostConf = hostOpts:
    let
@ -51,9 +55,7 @@ let

  configPath = "/etc/${etcConfigFile}";

-  acmeHosts = unique (catAttrs "useACMEHost" acmeVHosts);
-
-  mkCertOwnershipAssertion = import ../../../security/acme/mk-cert-ownership-assertion.nix;
+  mkCertOwnershipAssertion = import ../../../security/acme/mk-cert-ownership-assertion.nix lib;
 in
 {
  imports = [
@ -329,10 +331,10 @@ in
        message = "To specify an adapter other than 'caddyfile' please provide your own configuration via `services.caddy.configFile`";
      }
    ] ++ map (name: mkCertOwnershipAssertion {
-      inherit (cfg) group user;
      cert = config.security.acme.certs.${name};
      groups = config.users.groups;
-    }) acmeHosts;
+      services = [ config.systemd.services.caddy ];
+    }) vhostCertNames;

    services.caddy.globalConfig = ''
      ${optionalString (cfg.email != null) "email ${cfg.email}"}
@ -348,9 +350,10 @@ in

    systemd.packages = [ cfg.package ];
    systemd.services.caddy = {
-      wants = map (hostOpts: "acme-finished-${hostOpts.useACMEHost}.target") acmeVHosts;
-      after = map (hostOpts: "acme-selfsigned-${hostOpts.useACMEHost}.service") acmeVHosts;
-      before = map (hostOpts: "acme-${hostOpts.useACMEHost}.service") acmeVHosts;
+      wants = map (certName: "acme-finished-${certName}.target") vhostCertNames;
+      after = map (certName: "acme-selfsigned-${certName}.service") vhostCertNames
+        ++ map (certName: "acme-${certName}.service") independentCertNames; # avoid loading self-signed key w/ real cert, or vice-versa
+      before = map (certName: "acme-${certName}.service") dependentCertNames;

      wantedBy = [ "multi-user.target" ];
      startLimitIntervalSec = 14400;
@ -397,10 +400,10 @@ in

    security.acme.certs =
      let
-        certCfg = map (useACMEHost: nameValuePair useACMEHost {
+        certCfg = map (certName: nameValuePair certName {
          group = mkDefault cfg.group;
          reloadServices = [ "caddy.service" ];
-        }) acmeHosts;
+        }) vhostCertNames;
      in
        listToAttrs certCfg;

--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@ -7,7 +7,9 @@ let
  inherit (config.security.acme) certs;
  vhostsConfigs = mapAttrsToList (vhostName: vhostConfig: vhostConfig) virtualHosts;
  acmeEnabledVhosts = filter (vhostConfig: vhostConfig.enableACME || vhostConfig.useACMEHost != null) vhostsConfigs;
-  dependentCertNames = unique (map (hostOpts: hostOpts.certName) acmeEnabledVhosts);
+  vhostCertNames = unique (map (hostOpts: hostOpts.certName) acmeEnabledVhosts);
+  dependentCertNames = filter (cert: certs.${cert}.dnsProvider == null) vhostCertNames; # those that might depend on the HTTP server
+  independentCertNames = filter (cert: certs.${cert}.dnsProvider != null) vhostCertNames; # those that don't depend on the HTTP server
  virtualHosts = mapAttrs (vhostName: vhostConfig:
    let
      serverName = if vhostConfig.serverName != null
@ -471,7 +473,7 @@ let
    '') authDef)
  );

-  mkCertOwnershipAssertion = import ../../../security/acme/mk-cert-ownership-assertion.nix;
+  mkCertOwnershipAssertion = import ../../../security/acme/mk-cert-ownership-assertion.nix lib;

  oldHTTP2 = (versionOlder cfg.package.version "1.25.1" && !(cfg.package.pname == "angie" || cfg.package.pname == "angieQuic"));
 in
@ -1209,10 +1211,10 @@ in
        '';
      }
    ] ++ map (name: mkCertOwnershipAssertion {
-      inherit (cfg) group user;
      cert = config.security.acme.certs.${name};
      groups = config.users.groups;
-    }) dependentCertNames;
+      services = [ config.systemd.services.nginx ] ++ lib.optional (cfg.enableReload || vhostCertNames != []) config.systemd.services.nginx-config-reload;
+    }) vhostCertNames;

    services.nginx.additionalModules = optional cfg.recommendedBrotliSettings pkgs.nginxModules.brotli
      ++ lib.optional cfg.recommendedZstdSettings pkgs.nginxModules.zstd;
@ -1236,8 +1238,10 @@ in
    systemd.services.nginx = {
      description = "Nginx Web Server";
      wantedBy = [ "multi-user.target" ];
-      wants = concatLists (map (certName: [ "acme-finished-${certName}.target" ]) dependentCertNames);
-      after = [ "network.target" ] ++ map (certName: "acme-selfsigned-${certName}.service") dependentCertNames;
+      wants = concatLists (map (certName: [ "acme-finished-${certName}.target" ]) vhostCertNames);
+      after = [ "network.target" ]
+        ++ map (certName: "acme-selfsigned-${certName}.service") vhostCertNames
+        ++ map (certName: "acme-${certName}.service") independentCertNames; # avoid loading self-signed key w/ real cert, or vice-versa
      # Nginx needs to be started in order to be able to request certificates
      # (it's hosting the acme challenge after all)
      # This fixes https://github.com/NixOS/nixpkgs/issues/81842
@ -1316,9 +1320,9 @@ in
    # which allows the acme-finished-$cert.target to signify the successful updating
    # of certs end-to-end.
    systemd.services.nginx-config-reload = let
-      sslServices = map (certName: "acme-${certName}.service") dependentCertNames;
-      sslTargets = map (certName: "acme-finished-${certName}.target") dependentCertNames;
-    in mkIf (cfg.enableReload || sslServices != []) {
+      sslServices = map (certName: "acme-${certName}.service") vhostCertNames;
+      sslTargets = map (certName: "acme-finished-${certName}.target") vhostCertNames;
+    in mkIf (cfg.enableReload || vhostCertNames != []) {
      wants = optionals cfg.enableReload [ "nginx.service" ];
      wantedBy = sslServices ++ [ "multi-user.target" ];
      # Before the finished targets, after the renew services.
@ -1329,7 +1333,7 @@ in
      restartTriggers = optionals cfg.enableReload [ configFile ];
      # Block reloading if not all certs exist yet.
      # Happens when config changes add new vhosts/certs.
-      unitConfig.ConditionPathExists = optionals (sslServices != []) (map (certName: certs.${certName}.directory + "/fullchain.pem") dependentCertNames);
+      unitConfig.ConditionPathExists = optionals (sslServices != []) (map (certName: certs.${certName}.directory + "/fullchain.pem") vhostCertNames);
      serviceConfig = {
        Type = "oneshot";
        TimeoutSec = 60;
--- a/nixos/tests/common/acme/server/default.nix
+++ b/nixos/tests/common/acme/server/default.nix
@ -54,11 +54,6 @@ let
  testCerts = import ./snakeoil-certs.nix;
  domain = testCerts.domain;

-  resolver = let
-    message = "You need to define a resolver for the acme test module.";
-    firstNS = lib.head config.networking.nameservers;
-  in if config.networking.nameservers == [] then throw message else firstNS;
-
  pebbleConf.pebble = {
    listenAddress = "0.0.0.0:443";
    managementListenAddress = "0.0.0.0:15000";
--- a/pkgs/applications/audio/pwvucontrol/Cargo.lock
+++ b/pkgs/applications/audio/pwvucontrol/Cargo.lock
@ -880,7 +880,7 @@ dependencies = [

 [[package]]
 name = "pwvucontrol"
-version = "0.4.5"
+version = "0.4.7"
 dependencies = [
 "anyhow",
 "futures",
--- a/pkgs/applications/audio/pwvucontrol/default.nix
+++ b/pkgs/applications/audio/pwvucontrol/default.nix
@ -34,13 +34,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "pwvucontrol";
-  version = "0.4.5";
+  version = "0.4.7";

  src = fetchFromGitHub {
    owner = "saivert";
    repo = "pwvucontrol";
    rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-s4sop1qmqPVOGX7erRfClUUcixNhi+wUY5MXSmv+zVk=";
+    hash = "sha256-v8xANTbaIPIAPoukP8rcVzM6NHNpS2Ej/nfdmg3Vgvg=";
  };

  cargoDeps = rustPlatform.importCargoLock {
--- a/pkgs/applications/audio/spotify/linux.nix
+++ b/pkgs/applications/audio/spotify/linux.nix
@ -14,14 +14,14 @@ let
  # If an update breaks things, one of those might have valuable info:
  # https://aur.archlinux.org/packages/spotify/
  # https://community.spotify.com/t5/Desktop-Linux
-  version = "1.2.45.454.gc16ec9f6";
+  version = "1.2.48.405.gf2c48e6f";
  # To get the latest stable revision:
  # curl -H 'X-Ubuntu-Series: 16' 'https://api.snapcraft.io/api/v1/snaps/details/spotify?channel=stable' | jq '.download_url,.version,.last_updated'
  # To get general information:
  # curl -H 'Snap-Device-Series: 16' 'https://api.snapcraft.io/v2/snaps/info/spotify' | jq '.'
  # More examples of api usage:
  # https://github.com/canonical-websites/snapcraft.io/blob/master/webapp/publisher/snaps/views.py
-  rev = "79";
+  rev = "80";

  deps = [
    alsa-lib
@ -88,7 +88,7 @@ stdenv.mkDerivation {
  src = fetchurl {
    name = "spotify-${version}-${rev}.snap";
    url = "https://api.snapcraft.io/api/v1/snaps/download/pOBIoZ2LrCB3rDohMxoYGnbN14EHOgD7_${rev}.snap";
-    hash = "sha512-F1Npz/oKCsMKaQx2M5dm1dhWhaSlt8422tpRWnwuk2yjwLWrOYDY2uKYph8YFXfOdS3mV6u5yVlzgFdDqAFmCQ==";
+    hash = "sha512-Ej9SEhZhssQiH1srcgUW5lQuUNg+htudV7mcnK6o0pW5PiBYZ6qOPEIZ/1tZzD9xkUJ8hCq08fJMB8NQ12KXMg==";
  };

  nativeBuildInputs = [ wrapGAppsHook3 makeShellWrapper squashfsTools ];
@ -146,6 +146,7 @@ stdenv.mkDerivation {

      rpath="$out/share/spotify:$libdir"

+      chmod +w "$out/share/spotify/spotify"
      patchelf \
        --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
        --set-rpath $rpath $out/share/spotify/spotify
--- a/pkgs/applications/editors/yi/wrapper.nix
+++ b/pkgs/applications/editors/yi/wrapper.nix
@ -1,28 +0,0 @@
-# To use this for hacking of your Yi config file, drop into a shell
-# with env attribute.
-{
-  lib,
-  stdenv,
-  makeWrapper,
-  haskellPackages,
-  extraPackages ? (s: [ ]),
-}:
-let
-  yiEnv = haskellPackages.ghcWithPackages (self: [ self.yi ] ++ extraPackages self);
-in
-stdenv.mkDerivation {
-  pname = "yi-custom";
-  dontUnpack = true;
-  nativeBuildInputs = [ makeWrapper ];
-
-  buildCommand = ''
-    mkdir -p $out/bin
-    makeWrapper ${haskellPackages.yi}/bin/yi $out/bin/yi \
-      --set NIX_GHC ${yiEnv}/bin/ghc
-  '';
-
-  # For hacking purposes
-  passthru.env = yiEnv;
-
-  inherit (haskellPackages.yi) meta version;
-}
--- a/pkgs/applications/misc/diebahn/default.nix
+++ b/pkgs/applications/misc/diebahn/default.nix
@ -17,23 +17,24 @@
 , pango
 , gettext
 , darwin
+, blueprint-compiler
 }:

 stdenv.mkDerivation rec {
  pname = "diebahn";
-  version = "2.7.0";
+  version = "2.7.1";

  src = fetchFromGitLab {
    owner = "schmiddi-on-mobile";
    repo = "railway";
    rev = version;
-    hash = "sha256-ps55DiAsetmdcItZKcfyYDD0q0w1Tkf/U48UR/zQx1g=";
+    hash = "sha256-SLZJiCkHUS2p7cNk3i3yO2c3tWR4T4ch+zJ1iYEkS6E=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    name = "${pname}-${src}";
    inherit src;
-    hash = "sha256-StJxWasUMj9kh9rLs4LFI3XaZ1Z5pvFBjEjtp79WZjg=";
+    hash = "sha256-XYlRm8yqQr9ZNV7jQeuR8kvqFNudUjJlzE6h9X0zq0Y=";
  };

  nativeBuildInputs = [
@ -45,6 +46,7 @@ stdenv.mkDerivation rec {
    rustPlatform.cargoSetupHook
    rustc
    wrapGAppsHook4
+    blueprint-compiler
  ];

  buildInputs = [
--- a/pkgs/by-name/al/alt-tab-macos/package.nix
+++ b/pkgs/by-name/al/alt-tab-macos/package.nix
@ -8,11 +8,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "alt-tab-macos";
-  version = "6.73.0";
+  version = "7.2.0";

  src = fetchurl {
    url = "https://github.com/lwouis/alt-tab-macos/releases/download/v${finalAttrs.version}/AltTab-${finalAttrs.version}.zip";
-    hash = "sha256-l/Nuyr5jYBR6LtScgM2LP0mq1NEMkRNVGWZDhiZkAa8=";
+    hash = "sha256-70ODYDPcE5UT6bVY3H2J7RvqB3sDpPoeOpkqhwVkxJ0=";
  };

  sourceRoot = ".";
--- a/pkgs/by-name/au/authentik/package.nix
+++ b/pkgs/by-name/au/authentik/package.nix
@ -110,75 +110,15 @@ let
  python = python312.override {
    self = python;
    packageOverrides = final: prev: {
-      django-tenants = prev.buildPythonPackage rec {
-        pname = "django-tenants";
-        version = "unstable-2024-01-11";
+      django-tenants = prev.django-tenants.overrideAttrs {
+        version = "3.6.1-unstable-2024-01-11";
        src = fetchFromGitHub {
          owner = "rissson";
-          repo = pname;
+          repo = "django-tenants";
          rev = "a7f37c53f62f355a00142473ff1e3451bb794eca";
          hash = "sha256-YBT0kcCfETXZe0j7/f1YipNIuRrcppRVh1ecFS3cvNo=";
        };
-        format = "setuptools";
-        doCheck = false; # Tests require postgres
-
-        propagatedBuildInputs = with final; [
-          django
-          psycopg
-          gunicorn
-        ];
      };
-
-      django-cte = prev.buildPythonPackage rec {
-        pname = "django-cte";
-        version = "1.3.3";
-        src = fetchFromGitHub {
-          owner = "dimagi";
-          repo = pname;
-          rev = "v${version}";
-          hash = "sha256-OCENg94xHBeeE4A2838Cu3q2am2im2X4SkFSjc6DuhE=";
-        };
-        doCheck = false; # Tests require postgres
-        format = "setuptools";
-      };
-
-      django-pgactivity = prev.buildPythonPackage rec {
-        pname = "django-pgactivity";
-        version = "1.4.1";
-        src = fetchFromGitHub {
-          owner = "Opus10";
-          repo = pname;
-          rev = version;
-          hash = "sha256-VwH7fwLcoH2Z9D/OY9iieM0cRhyDKOpAzqQ+4YVE3vU=";
-        };
-        nativeBuildInputs = with prev; [
-          poetry-core
-        ];
-        propagatedBuildInputs = with final; [
-          django
-        ];
-        pyproject = true;
-      };
-
-      django-pglock = prev.buildPythonPackage rec {
-        pname = "django-pglock";
-        version = "1.5.1";
-        src = fetchFromGitHub {
-          owner = "Opus10";
-          repo = pname;
-          rev = version;
-          hash = "sha256-ZoEHDkGmrcNiMe/rbwXsEPZo3LD93cZp6zjftMKjLeg=";
-        };
-        nativeBuildInputs = with prev; [
-          poetry-core
-        ];
-        propagatedBuildInputs = with final; [
-          django
-          django-pgactivity
-        ];
-        pyproject = true;
-      };
-
      # Use 3.14.0 until https://github.com/encode/django-rest-framework/issues/9358 is fixed.
      # Otherwise applying blueprints/default/default-brand.yaml fails with:
      #   authentik.flows.models.RelatedObjectDoesNotExist: FlowStageBinding has no target.
@ -213,48 +153,6 @@ let
        pythonImportsCheck = [ "rest_framework" ];
      };

-      tenant-schemas-celery = prev.buildPythonPackage rec {
-        pname = "tenant-schemas-celery";
-        version = "3.0.0";
-        src = fetchFromGitHub {
-          owner = "maciej-gol";
-          repo = pname;
-          rev = version;
-          hash = "sha256-3ZUXSAOBMtj72sk/VwPV24ysQK+E4l1HdwKa78xrDtg=";
-        };
-        format = "setuptools";
-        doCheck = false;
-
-        propagatedBuildInputs = with final; [
-          freezegun
-          more-itertools
-          psycopg2
-        ];
-      };
-
-      scim2-filter-parser = prev.buildPythonPackage rec {
-        pname = "scim2-filter-parser";
-        version = "0.5.1";
-        # For some reason the normal fetchPypi does not work
-        src = fetchzip {
-          url = "https://files.pythonhosted.org/packages/54/df/ad9718acce76e81a93c57327356eecd23701625f240fbe03d305250399e6/scim2_filter_parser-0.5.1.tar.gz";
-          hash = "sha256-DZAdRj6qyySggsvJZC47vdvXbHrB1ra3qiYBEUiceJ4=";
-        };
-
-        postPatch = ''
-          substituteInPlace pyproject.toml \
-            --replace-fail 'poetry>=0.12' 'poetry-core>=1.0.0' \
-            --replace-fail 'poetry.masonry.api' 'poetry.core.masonry.api'
-        '';
-
-        nativeBuildInputs = [ prev.poetry-core ];
-        pyproject = true;
-
-        propagatedBuildInputs = with final; [
-          sly
-        ];
-      };
-
      authentik-django = prev.buildPythonPackage {
        pname = "authentik-django";
        inherit version src meta;
--- a/pkgs/by-name/ba/bazecor/package.nix
+++ b/pkgs/by-name/ba/bazecor/package.nix
@ -6,12 +6,12 @@
 }:
 let
  pname = "bazecor";
-  version = "1.5.2";
+  version = "1.5.3";
  src = appimageTools.extract {
    inherit pname version;
    src = fetchurl {
      url = "https://github.com/Dygmalab/Bazecor/releases/download/v${version}/Bazecor-${version}-x64.AppImage";
-      hash = "sha256-Eq66tuRP/+TPLNDQRox8/dMT/7fGGrxmUUML8wJ3v+M=";
+      hash = "sha256-96BHIOt9vA9sLpR8+XRKi8+h953VWMyAeE04A+4GR2Q=";
    };

    # Workaround for https://github.com/Dygmalab/Bazecor/issues/370
--- a/pkgs/by-name/cl/cloneit/package.nix
+++ b/pkgs/by-name/cl/cloneit/package.nix
@ -0,0 +1,35 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  openssl,
+  unstableGitUpdater,
+}:
+rustPlatform.buildRustPackage {
+  pname = "cloneit";
+  version = "0-unstable-2024-06-28";
+
+  src = fetchFromGitHub {
+    owner = "alok8bb";
+    repo = "cloneit";
+    rev = "6198556e810d964cc5938c446ef42fc21b55fe0b";
+    sha256 = "sha256-RP0/kquAlSwRMeB6cjvS5JB9qfdkT8IKLVxaxrmzJ+0=";
+  };
+
+  cargoHash = "sha256-XXcqmDPEQUm4YBqY5+06X55ym3o3RqE7fNSiR4n+iyc=";
+
+  strictDeps = true;
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ openssl ];
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = {
+    description = "CLI tool to download specific GitHub directories or files";
+    homepage = "https://github.com/alok8bb/cloneit";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ NotAShelf ];
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/by-name/co/cosmic-edit/Cargo.lock
+++ b/pkgs/by-name/co/cosmic-edit/Cargo.lock
--- a/pkgs/by-name/co/cosmic-edit/package.nix
+++ b/pkgs/by-name/co/cosmic-edit/package.nix
@ -20,40 +20,38 @@

 rustPlatform.buildRustPackage rec {
  pname = "cosmic-edit";
-  version = "1.0.0-alpha.2";
+  version = "1.0.0-alpha.3";

  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-edit";
    rev = "epoch-${version}";
-    hash = "sha256-3goolnDRGQkQ3zN08WKzN6Dxt+Sh1lR+tFxeWjO3VKY=";
+    hash = "sha256-GCy/JyicPeCA7y9bfbVlyYiofRp0c82INPZi0zbnnxE=";
  };

  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "accesskit-0.12.2" = "sha256-1UwgRyUe0PQrZrpS7574oNLi13fg5HpgILtZGW6JNtQ=";
+      "accesskit-0.16.0" = "sha256-yeBzocXxuvHmuPGMRebbsYSKSvN+8sUsmaSKlQDpW4w=";
      "atomicwrites-0.4.2" = "sha256-QZSuGPrJXh+svMeFWqAXoqZQxLq/WfIiamqvjJNVhxA=";
-      "clipboard_macos-0.1.0" = "sha256-cG5vnkiyDlQnbEfV2sPbmBYKv1hd3pjJrymfZb8ziKk=";
-      "cosmic-config-0.1.0" = "sha256-gXrMEoAN+7nYAEcs4w6wROhQTjMCxkGn+muJutktLyk=";
-      "cosmic-files-0.1.0" = "sha256-rBR6IPpMgOltyaRPPZ5V8tYH/xtQphgrPWci/kvlgEg=";
+      "clipboard_macos-0.1.0" = "sha256-tovB4fjPVVRY8LKn5albMzskFQ+1W5ul4jT5RXx9gKE=";
+      "cosmic-config-0.1.0" = "sha256-u/qzhRvP+HsfCfxl3aM/L4ZwmZ/Zorrlq5l9UemfoRg=";
+      "cosmic-files-0.1.0" = "sha256-XNUeDj5Dl8jXJRERP2F4Yx2BPV2b4bwzMNCbIH3FJdA=";
      "cosmic-syntax-theme-0.1.0" = "sha256-BNb9wrryD5FJImboD3TTdPRIfiBqPpItqwGdT1ZiNng=";
      "cosmic-text-0.12.1" = "sha256-u2Tw+XhpIKeFg8Wgru/sjGw6GUZ2m50ZDmRBJ1IM66w=";
-      "d3d12-0.19.0" = "sha256-usrxQXWLGJDjmIdw1LBXtBvX+CchZDvE8fHC0LjvhD4=";
-      "filetime-0.2.24" = "sha256-lU7dPotdnmyleS2B75SmDab7qJfEzmJnHPF18CN/Y98=";
+      "dpi-0.1.1" = "sha256-whi05/2vc3s5eAJTZ9TzVfGQ/EnfPr0S4PZZmbiYio0=";
      "fs_extra-1.3.0" = "sha256-ftg5oanoqhipPnbUsqnA4aZcyHqn9XsINJdrStIPLoE=";
-      "glyphon-0.5.0" = "sha256-j1HrbEpUBqazWqNfJhpyjWuxYAxkvbXzRKeSouUoPWg=";
+      "iced_glyphon-0.6.0" = "sha256-u1vnsOjP8npQ57NNSikotuHxpi4Mp/rV9038vAgCsfQ=";
      "smithay-clipboard-0.8.0" = "sha256-4InFXm0ahrqFrtNLeqIuE3yeOpxKZJZx+Bc0yQDtv34=";
      "softbuffer-0.4.1" = "sha256-a0bUFz6O8CWRweNt/OxTvflnPYwO5nm6vsyc/WcXyNg=";
      "taffy-0.3.11" = "sha256-SCx9GEIJjWdoNVyq+RZAGn0N71qraKZxf9ZWhvyzLaI=";
      "trash-5.1.1" = "sha256-So8rQ8gLF5o79Az396/CQY/veNo4ticxYpYZPfMJyjQ=";
-      "winit-0.29.10" = "sha256-ScTII2AzK3SC8MVeASZ9jhVWsEaGrSQ2BnApTxgfxK4=";
    };
  };

  # COSMIC applications now uses vergen for the About page
  # Update the COMMIT_DATE to match when the commit was made
-  env.VERGEN_GIT_COMMIT_DATE = "2024-09-24";
+  env.VERGEN_GIT_COMMIT_DATE = "2024-10-31";
  env.VERGEN_GIT_SHA = src.rev;

  postPatch = ''
--- a/pkgs/by-name/co/cosmic-term/Cargo.lock
+++ b/pkgs/by-name/co/cosmic-term/Cargo.lock
--- a/pkgs/by-name/co/cosmic-term/package.nix
+++ b/pkgs/by-name/co/cosmic-term/package.nix
@ -18,34 +18,32 @@

 rustPlatform.buildRustPackage rec {
  pname = "cosmic-term";
-  version = "1.0.0-alpha.2";
+  version = "1.0.0-alpha.3";

  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-term";
    rev = "epoch-${version}";
-    hash = "sha256-rMaHWtT5bhjdji3dAnfyCm7lMXDWjIBVh4ZUwApZphU=";
+    hash = "sha256-4++wCyRVIodWdlrvK2vMcHGoY4BctnrkopWC6dZvhMk=";
  };

  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "accesskit-0.12.2" = "sha256-1UwgRyUe0PQrZrpS7574oNLi13fg5HpgILtZGW6JNtQ=";
+      "accesskit-0.16.0" = "sha256-yeBzocXxuvHmuPGMRebbsYSKSvN+8sUsmaSKlQDpW4w=";
      "alacritty_terminal-0.24.1-dev" = "sha256-aVB1CNOLjNh6AtvdbomODNrk00Md8yz8QzldzvDo1LI=";
      "atomicwrites-0.4.2" = "sha256-QZSuGPrJXh+svMeFWqAXoqZQxLq/WfIiamqvjJNVhxA=";
-      "clipboard_macos-0.1.0" = "sha256-cG5vnkiyDlQnbEfV2sPbmBYKv1hd3pjJrymfZb8ziKk=";
-      "cosmic-config-0.1.0" = "sha256-gXrMEoAN+7nYAEcs4w6wROhQTjMCxkGn+muJutktLyk=";
-      "cosmic-files-0.1.0" = "sha256-rBR6IPpMgOltyaRPPZ5V8tYH/xtQphgrPWci/kvlgEg=";
+      "clipboard_macos-0.1.0" = "sha256-tovB4fjPVVRY8LKn5albMzskFQ+1W5ul4jT5RXx9gKE=";
+      "cosmic-config-0.1.0" = "sha256-u/qzhRvP+HsfCfxl3aM/L4ZwmZ/Zorrlq5l9UemfoRg=";
+      "cosmic-files-0.1.0" = "sha256-XNUeDj5Dl8jXJRERP2F4Yx2BPV2b4bwzMNCbIH3FJdA=";
      "cosmic-text-0.12.1" = "sha256-u2Tw+XhpIKeFg8Wgru/sjGw6GUZ2m50ZDmRBJ1IM66w=";
-      "d3d12-0.19.0" = "sha256-usrxQXWLGJDjmIdw1LBXtBvX+CchZDvE8fHC0LjvhD4=";
-      "filetime-0.2.24" = "sha256-lU7dPotdnmyleS2B75SmDab7qJfEzmJnHPF18CN/Y98=";
+      "dpi-0.1.1" = "sha256-whi05/2vc3s5eAJTZ9TzVfGQ/EnfPr0S4PZZmbiYio0=";
      "fs_extra-1.3.0" = "sha256-ftg5oanoqhipPnbUsqnA4aZcyHqn9XsINJdrStIPLoE=";
-      "glyphon-0.5.0" = "sha256-j1HrbEpUBqazWqNfJhpyjWuxYAxkvbXzRKeSouUoPWg=";
+      "iced_glyphon-0.6.0" = "sha256-u1vnsOjP8npQ57NNSikotuHxpi4Mp/rV9038vAgCsfQ=";
      "smithay-clipboard-0.8.0" = "sha256-4InFXm0ahrqFrtNLeqIuE3yeOpxKZJZx+Bc0yQDtv34=";
      "softbuffer-0.4.1" = "sha256-a0bUFz6O8CWRweNt/OxTvflnPYwO5nm6vsyc/WcXyNg=";
      "taffy-0.3.11" = "sha256-SCx9GEIJjWdoNVyq+RZAGn0N71qraKZxf9ZWhvyzLaI=";
      "trash-5.1.1" = "sha256-So8rQ8gLF5o79Az396/CQY/veNo4ticxYpYZPfMJyjQ=";
-      "winit-0.29.10" = "sha256-ScTII2AzK3SC8MVeASZ9jhVWsEaGrSQ2BnApTxgfxK4=";
    };
  };

--- a/pkgs/by-name/db/dbeaver-bin/package.nix
+++ b/pkgs/by-name/db/dbeaver-bin/package.nix
@ -41,7 +41,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
      inherit hash;
    };

-  sourceRoot = lib.optional stdenvNoCC.hostPlatform.isDarwin "dbeaver.app";
+  sourceRoot = lib.optional stdenvNoCC.hostPlatform.isDarwin "DBeaver.app";

  nativeBuildInputs =
    [ makeWrapper ]
@ -56,7 +56,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  dontBuild = true;

  prePatch = ''
-    substituteInPlace dbeaver.ini \
+    substituteInPlace ${lib.optionalString stdenvNoCC.hostPlatform.isDarwin "Contents/Eclipse/"}dbeaver.ini \
      --replace-fail '-Xmx1024m' '-Xmx${override_xmx}'
  '';

--- a/pkgs/applications/video/dmlive/default.nix
+++ b/pkgs/applications/video/dmlive/default.nix
@ -1,15 +1,13 @@
-{ lib
-, stdenv
-, rustPlatform
-, fetchFromGitHub
-, pkg-config
-, makeWrapper
-, openssl
-, configd
-, Security
-, mpv
-, ffmpeg
-, nodejs
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  makeWrapper,
+  openssl,
+  mpv,
+  ffmpeg,
+  nodejs,
 }:

 rustPlatform.buildRustPackage rec {
@ -27,19 +25,30 @@ rustPlatform.buildRustPackage rec {

  OPENSSL_NO_VENDOR = true;

-  nativeBuildInputs = [ pkg-config makeWrapper ];
-  buildInputs = [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ configd Security ];
+  nativeBuildInputs = [
+    pkg-config
+    makeWrapper
+  ];
+
+  buildInputs = [
+    openssl
+  ];

  postInstall = ''
-    wrapProgram "$out/bin/dmlive" --prefix PATH : "${lib.makeBinPath [ mpv ffmpeg nodejs ]}"
+    wrapProgram "$out/bin/dmlive" --prefix PATH : "${
+      lib.makeBinPath [
+        mpv
+        ffmpeg
+        nodejs
+      ]
+    }"
  '';

-  meta = with lib; {
+  meta = {
    description = "Tool to play and record videos or live streams with danmaku";
    homepage = "https://github.com/THMonster/dmlive";
-    license = licenses.mit;
+    license = lib.licenses.mit;
    mainProgram = "dmlive";
-    maintainers = with maintainers; [ nickcao ];
+    maintainers = with lib.maintainers; [ nickcao ];
  };
 }
--- a/pkgs/development/libraries/libchewing/default.nix
+++ b/pkgs/development/libraries/libchewing/default.nix
@ -1,14 +1,20 @@
-{ lib, stdenv, fetchFromGitHub, sqlite, cmake }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  sqlite,
+}:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "libchewing";
-  version = "unstable-2020-06-27";
+  version = "0.6.0";

  src = fetchFromGitHub {
    owner = "chewing";
    repo = "libchewing";
-    rev = "452f6221fbad90c0706a3963b17e226216e40dd7";
-    sha256 = "sha256-w3/K2O/CU+XVzqzVCYJyq1vLgToN6iIUhJ9J7ia4p9E=";
+    rev = "v${finalAttrs.version}";
+    sha256 = "sha256-X+4Rr5Mfc4qeJxmHczu4MKgHBvQN1rhqUrJSx8SFnDk=";
  };

  buildInputs = [ sqlite ];
@ -19,7 +25,10 @@ stdenv.mkDerivation rec {
    description = "Intelligent Chinese phonetic input method";
    homepage = "https://chewing.im/";
    license = licenses.lgpl21Only;
-    maintainers = [ maintainers.ericsagnes ];
-    platforms = platforms.linux;
+    maintainers = with maintainers; [
+      ericsagnes
+      ShamrockLee
+    ];
+    platforms = platforms.all;
  };
-}
+})
--- a/pkgs/by-name/ma/manga-tui/0001-fix-remove-flaky-test.patch
+++ b/pkgs/by-name/ma/manga-tui/0001-fix-remove-flaky-test.patch
@ -0,0 +1,42 @@
+From e84ddb20ca6b99ec2bf84bb3c3cfc3cdbbfd5ff2 Mon Sep 17 00:00:00 2001
+From: Youwen Wu <youwenw@gmail.com>
+Date: Wed, 6 Nov 2024 02:11:30 -0800
+Subject: [PATCH] fix: remove flaky test
+
+---
+ src/view/pages/manga.rs | 21 ---------------------
+ 1 file changed, 21 deletions(-)
+
+diff --git a/src/view/pages/manga.rs b/src/view/pages/manga.rs
+index 119d9ea..7179a22 100644
+--- a/src/view/pages/manga.rs
+++ b/src/view/pages/manga.rs
+@@ -1853,25 +1853,4 @@ mod test {
+         assert_eq!(manga_page.bookmark_state.phase, BookmarkPhase::SearchingFromApi);
+         assert_eq!(expected, result)
+     }
+-
+-    #[tokio::test]
+-    async fn it_sends_event_chapter_bookmarked_failed_to_fetch() {
+-        let (tx, _) = unbounded_channel();
+-        let mut manga_page = MangaPage::new(Manga::default(), None).with_global_sender(tx);
+-
+-        flush_events(&mut manga_page);
+-
+-        let api_client = TestApiClient::with_failing_response();
+-
+-        manga_page.fetch_chapter_bookmarked(ChapterBookmarked::default(), api_client);
+-
+-        let expected = MangaPageEvents::FetchBookmarkFailed;
+-
+-        let result = timeout(Duration::from_millis(250), manga_page.local_event_rx.recv())
+-            .await
+-            .unwrap()
+-            .unwrap();
+-
+-        assert_eq!(expected, result);
+-    }
+ }
+-- 
+2.46.1
+
--- a/pkgs/by-name/ma/manga-tui/package.nix
+++ b/pkgs/by-name/ma/manga-tui/package.nix
@ -3,13 +3,15 @@
  rustPlatform,
  fetchFromGitHub,
  pkg-config,
+  fetchpatch,
  openssl,
  sqlite,
  stdenv,
  darwin,
+  nix-update-script,
 }:
 let
-  version = "0.3.1";
+  version = "0.4.0";
 in
 rustPlatform.buildRustPackage {
  pname = "manga-tui";
@ -19,10 +21,19 @@ rustPlatform.buildRustPackage {
    owner = "josueBarretogit";
    repo = "manga-tui";
    rev = "v${version}";
-    hash = "sha256-672AuQWviwihnUS3G0xSn4IAMHy0fPE1VLDfu8wrPGg=";
+    hash = "sha256-Se0f5jfYBmvemrYRKduDr1yT3fB2wfQP1fDpa/qrYlI=";
  };

-  cargoHash = "sha256-yf0hISz/jHtrO1clTSIKfxFiwI+W0Mu3mY+XW6+ynJU=";
+  patches = [
+    # apply patches to fix failing tests <https://github.com/josueBarretogit/manga-tui/pull/56>
+    (fetchpatch {
+      url = "https://github.com/josueBarretogit/manga-tui/commit/131a5208e6a3d74a9ad852baab75334e4a1ebf34.patch";
+      hash = "sha256-RIliZcaRVUOb33Cl+uBkMH4b34S1JpvnPGv+QCFQZ58=";
+    })
+    ./0001-fix-remove-flaky-test.patch
+  ];
+
+  cargoHash = "sha256-IufJPCvUEWR5p4PrFlaiQPW9wyIFj/Pd/JHki69L6Es=";

  nativeBuildInputs = [ pkg-config ];

@ -44,7 +55,12 @@ rustPlatform.buildRustPackage {
    homepage = "https://github.com/josueBarretogit/manga-tui";
    changelog = "https://github.com/josueBarretogit/manga-tui/releases/tag/v${version}";
    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ isabelroses ];
+    maintainers = with lib.maintainers; [
+      isabelroses
+      youwen5
+    ];
    mainProgram = "manga-tui";
  };
+
+  passthru.updateScript = nix-update-script { };
 }
--- a/pkgs/by-name/ne/nemo-emblems/package.nix
+++ b/pkgs/by-name/ne/nemo-emblems/package.nix
@ -8,6 +8,7 @@ python3.pkgs.buildPythonApplication rec {
  pname = "nemo-emblems";
  version = "6.2.1";

+  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = "nemo-extensions";
--- a/pkgs/by-name/ni/nixos-anywhere/package.nix
+++ b/pkgs/by-name/ni/nixos-anywhere/package.nix
@ -30,12 +30,12 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "nixos-anywhere";
-  version = "1.4.0";
+  version = "1.5.0";
  src = fetchFromGitHub {
    owner = "nix-community";
    repo = "nixos-anywhere";
    rev = finalAttrs.version;
-    hash = "sha256-ssx6Y665uoOO3PX6Mp9NAF8sqoGb7Ezfw+bTY69aGlE=";
+    hash = "sha256-LrCxIU6laEf4JD1QtOBNr+PASY6CbNPpUrjLIUizt+Y=";
  };
  nativeBuildInputs = [ makeWrapper ];
  installPhase = ''
--- a/pkgs/by-name/ni/nixos-facter/package.nix
+++ b/pkgs/by-name/ni/nixos-facter/package.nix
@ -9,6 +9,7 @@
  util-linux,
  pciutils,
  stdenv,
+  systemdMinimal,
 }:
 let
  # We are waiting on some changes to be merged upstream: https://github.com/openSUSE/hwinfo/pulls
@ -16,23 +17,23 @@ let
    src = fetchFromGitHub {
      owner = "numtide";
      repo = "hwinfo";
-      rev = "a559f34934098d54096ed2078e750a8245ae4044";
-      hash = "sha256-3abkWPr98qXXQ17r1Z43gh2M5hl/DHjW2hfeWl+GSAs=";
+      rev = "c2259845d10694c099fb306a8cfc5a403e71c708";
+      hash = "sha256-RGIoJkYiNMRHwUclzdRMELxCgBU9Pfvaghvt3op0zM0=";
    };
  };
 in
 buildGoModule rec {
  pname = "nixos-facter";
-  version = "0.1.1";
+  version = "0.2.0";

  src = fetchFromGitHub {
    owner = "numtide";
    repo = "nixos-facter";
    rev = "v${version}";
-    hash = "sha256-vlPmvCrgX64dcf//BPtQszBt7dkq35JpgQg+/LW0AqM=";
+    hash = "sha256-Rird32KB+V1xGBZvrEaPDPOhl5YMClIljOLcFO/0vOU=";
  };

-  vendorHash = "sha256-5leiTNp3FJmgFd0SKhu18hxYZ2G9SuQPhZJjki2SDVs=";
+  vendorHash = "sha256-qDzd+aq08PN9kl1YkvNLGvWaFVh7xFXJhGdx/ELwYGY=";

  CGO_ENABLED = 1;

@ -50,6 +51,7 @@ buildGoModule rec {
    libusb1
    util-linux
    pciutils
+    systemdMinimal
  ];

  ldflags = [
--- a/pkgs/by-name/np/npm-lockfile-fix/package.nix
+++ b/pkgs/by-name/np/npm-lockfile-fix/package.nix
@ -7,13 +7,13 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "npm-lockfile-fix";
-  version = "0.1.0";
+  version = "0.1.1";

  src = fetchFromGitHub {
    owner = "jeslie0";
    repo = "npm-lockfile-fix";
    rev = "v${version}";
-    hash = "sha256-0EGPCPmCf6bxbso3aHCeJ1XBOpYp3jtMXv8LGdwrsbs=";
+    hash = "sha256-P93OowrVkkOfX5XKsRsg0c4dZLVn2ZOonJazPmHdD7g=";
  };

  propagatedBuildInputs = [
--- a/pkgs/by-name/oa/oama/package.nix
+++ b/pkgs/by-name/oa/oama/package.nix
@ -15,7 +15,14 @@ let
    passthru.updateScript = ./update.sh;
  };

-  raw-pkg = haskellPackages.callPackage ./generated-package.nix { };
+  raw-pkg = (haskellPackages.callPackage ./generated-package.nix { }).overrideScope (
+    final: prev: {
+      # Dependency twain requires an older version of http2, and we cannot mix
+      # versions of transitive dependencies.
+      http2 = final.http2_3_0_3;
+      warp = final.warp_3_3_30;
+    }
+  );
 in
 lib.pipe raw-pkg [
  (overrideCabal overrides)
--- a/pkgs/by-name/ob/obsidian/package.nix
+++ b/pkgs/by-name/ob/obsidian/package.nix
@ -12,7 +12,7 @@
 }:
 let
  pname = "obsidian";
-  version = "1.7.4";
+  version = "1.7.5";
  appname = "Obsidian";
  meta = with lib; {
    description = "Powerful knowledge base that works on top of a local folder of plain text Markdown files";
@ -26,7 +26,7 @@ let
  filename = if stdenv.hostPlatform.isDarwin then "Obsidian-${version}.dmg" else "obsidian-${version}.tar.gz";
  src = fetchurl {
    url = "https://github.com/obsidianmd/obsidian-releases/releases/download/v${version}/${filename}";
-    hash = if stdenv.hostPlatform.isDarwin then "sha256-r3dSHx3y7BzjbWYJwXwyWCeTRya2jLMVhzV7NWpRDb4=" else "sha256-NRL8WHi+4ne48z7b9G6trJZiTt/lhwcF2CZjgyYmOug=";
+    hash = if stdenv.hostPlatform.isDarwin then "sha256-2gUXA0a7gcVFtTl5qiJFTAu6A9W79DiP0hd8j1Mwv3I=" else "sha256-T177UqPnPLM/2dGUdwhK21AByYrJu9wgEKOWrrGBQkA=";
  };

  icon = fetchurl {
@ -61,7 +61,7 @@ let
        -t $out/share/applications/
      for size in 16 24 32 48 64 128 256 512; do
        mkdir -p $out/share/icons/hicolor/"$size"x"$size"/apps
-        convert -background none -resize "$size"x"$size" ${icon} $out/share/icons/hicolor/"$size"x"$size"/apps/obsidian.png
+        magick ${icon} -background none -resize "$size"x"$size" $out/share/icons/hicolor/"$size"x"$size"/apps/obsidian.png
      done
      runHook postInstall
    '';
--- a/pkgs/by-name/pr/proton-pass/package.nix
+++ b/pkgs/by-name/pr/proton-pass/package.nix
@ -5,6 +5,7 @@
  dpkg,
  makeWrapper,
  electron,
+  asar,
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "proton-pass";
@ -21,21 +22,30 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  nativeBuildInputs = [
    dpkg
    makeWrapper
+    asar
  ];

+  # Rebuild the ASAR archive with the assets embedded
+  preInstall = ''
+    asar extract usr/lib/proton-pass/resources/app.asar tmp
+    cp -r usr/lib/proton-pass/resources/assets/ tmp/
+    rm usr/lib/proton-pass/resources/app.asar
+    asar pack tmp/ usr/lib/proton-pass/resources/app.asar
+    rm -fr tmp
+  '';
+
  installPhase = ''
    runHook preInstall
-    mkdir -p $out
+    mkdir -p $out/share/proton-pass
    cp -r usr/share/ $out/
-    cp -r usr/lib/proton-pass/resources/app.asar $out/share/
+    cp -r usr/lib/proton-pass/resources/app.asar $out/share/proton-pass/
    runHook postInstall
  '';

  preFixup = ''
    makeWrapper ${lib.getExe electron} $out/bin/proton-pass \
-      --add-flags $out/share/app.asar \
+      --add-flags $out/share/proton-pass/app.asar \
      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
-      --set-default ELECTRON_FORCE_IS_PACKAGED 1 \
      --set-default ELECTRON_IS_DEV 0 \
      --inherit-argv0
  '';
--- a/pkgs/by-name/ra/raycast/package.nix
+++ b/pkgs/by-name/ra/raycast/package.nix
@ -11,12 +11,12 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "raycast";
-  version = "1.84.12";
+  version = "1.85.0";

  src = fetchurl {
    name = "Raycast.dmg";
    url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=universal";
-    hash = "sha256-32RLnGtSVDik86dfXr8wtVMhWvnGs0Bh1CiK/ZDeWxU=";
+    hash = "sha256-wx9Ps/7O4y21D7lK3UlL23Cbvl8lRDZ375lOHq67w0I=";
  };

  dontPatch = true;
--- a/pkgs/by-name/we/wechat-uos/libuosdevicea.c
+++ b/pkgs/by-name/we/wechat-uos/libuosdevicea.c
@ -1,44 +0,0 @@
-// taken from https://aur.archlinux.org/cgit/aur.git/tree/libuosdevicea.c?h=wechat-universal
-
-/*
- * licensestub - compat layer for libuosdevicea
- * Copyright (C) 2024 Zephyr Lykos <self@mochaa.ws>
- * Copyright (C) 2024 Guoxin "7Ji" Pu <pugokushin@gmail.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
- *
- */
-#define _GNU_SOURCE
-
-#include <string.h>
-
-#define declare_string_getter(suffix, constant) void uos_get_##suffix(char *const restrict out) { if (out) strcpy(out, constant); }
-
-declare_string_getter(mac,      // MAC address with colon stripped
-    "000000000000")
-declare_string_getter(hddsninfo,
-    "SN")
-declare_string_getter(hwserial, // MD5 of hddsninfo
-    "92666505ce75444ee14be2ebc2f10a60")
-declare_string_getter(mb_sn,    // hardcoded
-    "E50022008800015957007202c59a1a8-3981-2020-0810-204909000000")
-declare_string_getter(osver, 
-    "UnionTech OS Desktop")
-declare_string_getter(licensetoken, 
-    "djEsdjEsMSwyLDk5QUFFN0FBQVdRQjk5OFhKS0FIU1QyOTQsMTAsOTI2NjY1MDVjZTc1NDQ0ZWUxNGJlMmViYzJmMTBhNjAsQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUE6ZjA3NjAwYzZkNmMyMDkyMDBkMzE5YzU2OThmNTc3MGRlYWY1NjAyZTY5MzUxZTczNjI2NjlhNzIyZTBkNTJiOTNhYzk0MmM3YTNkZTgxNjIxMmUwMDA1NTUwODg4N2NlMDQ4ODMyNTExY2JhNGFiMjdmYzlmZjMyYzFiNTYwNjMwZDI3ZDI2NmE5ZGIxZDQ0N2QxYjNlNTNlNTVlOTY1MmU5YTU4OGY0NWYzMTMwZDE0NDc4MTRhM2FmZjRlZGNmYmNkZjhjMmFiMDc5OWYwNGVmYmQ2NjdiNGYwYzEwNDhkYzExNjYwZWU1NTdlNTdmNzBlNjA1N2I0NThkMDgyOA==")
-
-int uos_is_active() {
-    return 0;
-}
--- a/pkgs/by-name/we/wechat-uos/package.nix
+++ b/pkgs/by-name/we/wechat-uos/package.nix
@ -2,7 +2,6 @@
 , stdenv
 , lib
 , fetchurl
-, requireFile
 , dpkg
 , nss
 , nspr
@ -45,21 +44,6 @@
 , libnotify
 , buildFHSEnv
 , writeShellScript
-, /**
-  License for wechat-uos, packed in a gz archive named "license.tar.gz".
-  It should have the following files:
-  license.tar.gz
-  ├── etc
-  │   ├── lsb-release
-  │   └── os-release
-  └── var
-      ├── lib
-      │   └── uos-license
-      │       └── .license.json
-      └── uos
-          └── .license.key
-  */
-  uosLicense ? null
 }:
 let
  # zerocallusedregs hardening breaks WeChat
@ -72,79 +56,16 @@ let
    name = "wechat-uos-env";
    buildCommand = ''
      mkdir -p $out/etc
-      mkdir -p $out/lib/license
      mkdir -p $out/usr/bin
      mkdir -p $out/usr/share
      mkdir -p $out/opt
      mkdir -p $out/var

      ln -s ${wechat}/opt/* $out/opt/
-      ln -s ${wechat}/usr/lib/wechat-uos/license/etc/os-release  $out/etc/os-release
-      ln -s ${wechat}/usr/lib/wechat-uos/license/etc/lsb-release  $out/etc/lsb-release
-      ln -s ${wechat}/usr/lib/wechat-uos/license/var/*  $out/var/
-      ln -s ${wechat}/usr/lib/wechat-uos/license/libuosdevicea.so $out/lib/license/
    '';
    preferLocalBuild = true;
  };

-  uosLicenseUnzipped = stdenvNoCC.mkDerivation {
-    name = "uos-license-unzipped";
-    src =
-      if uosLicense == null then
-        requireFile
-          {
-            name = "license.tar.gz";
-            url = "https://www.uniontech.com";
-            hash = "sha256-U3YAecGltY8vo9Xv/h7TUjlZCyiIQdgSIp705VstvWk=";
-          } else uosLicense;
-
-    installPhase = ''
-      runHook preInstall
-
-      mkdir -p $out
-      cp -r * $out/
-
-      runHook postInstall
-    '';
-    outputHashAlgo = "sha256";
-    outputHashMode = "recursive";
-    outputHash = "sha256-pNftwtUZqBsKBSPQsEWlYLlb6h2Xd9j56ZRMi8I82ME=";
-  };
-
-  libuosdevicea = stdenv.mkDerivation rec {
-    name = "libuosdevicea";
-    src = ./libuosdevicea.c;
-
-    unpackPhase = ''
-      runHook preUnpack
-
-      cp ${src} libuosdevicea.c
-
-      runHook postUnpack
-    '';
-
-    buildPhase = ''
-      runHook preBuild
-
-      $CC -shared -fPIC -o libuosdevicea.so libuosdevicea.c
-
-      runHook postBuild
-    '';
-
-    installPhase = ''
-      runHook preInstall
-
-      mkdir -p $out/lib
-      cp libuosdevicea.so $out/lib/
-
-      runHook postInstall
-    '';
-
-    meta = with lib; {
-      license = licenses.gpl2Plus;
-    };
-  };
-
  wechat-uos-runtime = with xorg; [
    # Make sure our glibc without hardening gets picked up first
    (lib.hiPrio glibcWithoutHardening)
@ -231,8 +152,6 @@ let
        };
      }.${stdenv.system} or (throw "${pname}-${version}: ${stdenv.system} is unsupported.");

-      inherit uosLicense;
-
      nativeBuildInputs = [ dpkg ];

      unpackPhase = ''
@ -250,10 +169,6 @@ let

        cp -r wechat-uos/* $out

-        mkdir -pv $out/usr/lib/wechat-uos/license
-        ln -s ${uosLicenseUnzipped}/* $out/usr/lib/wechat-uos/license/
-        ln -s ${libuosdevicea}/lib/libuosdevicea.so $out/usr/lib/wechat-uos/license/
-
        runHook postInstall
      '';

--- a/pkgs/by-name/we/wechat-uos/sources.nix
+++ b/pkgs/by-name/we/wechat-uos/sources.nix
@ -1,11 +1,11 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2024-11-04
+# Last updated: 2024-11-08
 {
-  version = "4.0.0.21";
-  amd64_url = "https://pro-store-packages.uniontech.com/appstore/pool/appstore/c/com.tencent.wechat/com.tencent.wechat_4.0.0.21_amd64.deb";
-  arm64_url = "https://pro-store-packages.uniontech.com/appstore/pool/appstore/c/com.tencent.wechat/com.tencent.wechat_4.0.0.21_arm64.deb";
-  loongarch64_url = "https://pro-store-packages.uniontech.com/appstore/pool/appstore/c/com.tencent.wechat/com.tencent.wechat_4.0.0.21_loongarch64.deb";
-  amd64_hash = "sha256-1tO8ARt2LuCwPz7rO25/9dTOIf9Rwqc9TdqiZTTojRk=";
-  arm64_hash = "sha256-Xl+bT/WXZ58rchvUBAMfcdqMxOIRxp5qyMRE/FvEC9I=";
-  loongarch64_hash = "sha256-b6j3y10HOdRvKoTTY9j2jGoM/W9XAjdIrQNZA9ddmUw=";
+  version = "4.0.0.23";
+  amd64_url = "https://pro-store-packages.uniontech.com/appstore/pool/appstore/c/com.tencent.wechat/com.tencent.wechat_4.0.0.23_amd64.deb";
+  arm64_url = "https://pro-store-packages.uniontech.com/appstore/pool/appstore/c/com.tencent.wechat/com.tencent.wechat_4.0.0.23_arm64.deb";
+  loongarch64_url = "https://pro-store-packages.uniontech.com/appstore/pool/appstore/c/com.tencent.wechat/com.tencent.wechat_4.0.0.23_loongarch64.deb";
+  amd64_hash = "sha256-Q3gmo83vJddj9p4prhBHm16LK6CAtW3ltd5j4FqPcgM=";
+  arm64_hash = "sha256-oIsPbEkw1+zXpzvXAVEdmykXjb5zulHATwnrnhsxkPc=";
+  loongarch64_hash = "sha256-grj9yGHZZag20l5s8IgcknvUvz0fBHkakgKsOe+rhmI=";
 }
--- a/pkgs/by-name/zf/zfind/package.nix
+++ b/pkgs/by-name/zf/zfind/package.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "zfind";
-  version = "0.4.5";
+  version = "0.4.6";

  src = fetchFromGitHub {
    owner = "laktak";
    repo = "zfind";
    rev = "v${version}";
-    hash = "sha256-sRZAsmh193K5HX7oC1UdCQccNpSc5QHtec+UpvpntKU=";
+    hash = "sha256-bbeS2x9HzrsOE5h1y07LoEBm9dinMCHX9GJftj5Md9s=";
  };

  vendorHash = "sha256-blq0/pRppdf2jcuhIqYeNhcazFNZOGeEjPTSLgHqhrU=";
--- a/pkgs/data/misc/hackage/pin.json
+++ b/pkgs/data/misc/hackage/pin.json
@ -1,6 +1,6 @@
 {
-  "commit": "0b0765b206e909965c9a65d28e87ebc9aae4d8af",
-  "url": "https://github.com/commercialhaskell/all-cabal-hashes/archive/0b0765b206e909965c9a65d28e87ebc9aae4d8af.tar.gz",
-  "sha256": "1rh4jmbj2v4n1lf8cv8qkj5rx10gjib2cmfsdxaf2d3n0c4cr4bn",
-  "msg": "Update from Hackage at 2024-10-25T11:10:52Z"
+  "commit": "750067bc36e810a96c066c8800438e0ce9ced327",
+  "url": "https://github.com/commercialhaskell/all-cabal-hashes/archive/750067bc36e810a96c066c8800438e0ce9ced327.tar.gz",
+  "sha256": "1bfr8r14rkisjp1f3iln12h4f5n66k8wkk09jvk7adal4grlpjny",
+  "msg": "Update from Hackage at 2024-10-05T14:46:54Z"
 }
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-weather-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-weather-plugin/default.nix
@ -23,11 +23,11 @@ in

 stdenv.mkDerivation rec {
  pname = "xfce4-weather-plugin";
-  version = "0.11.2";
+  version = "0.11.3";

  src = fetchurl {
    url = "mirror://xfce/src/${category}/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-ZdQK/3hjVQhYqfnStgVPJ8aaPn5xKZF4WYf5pzu6h2s=";
+    sha256 = "sha256-AC0f5jkG0vOgEvPLWMzv8d+8xGZ1njbHbTsD3QHA3Fc=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/compilers/ghc/head.nix
+++ b/pkgs/development/compilers/ghc/head.nix
@ -1,5 +1,5 @@
 import ./common-hadrian.nix {
-  version = "9.13.20241031";
-  rev = "0b11cdc022ce33d089db95b2b2e7c1f4bb326d37";
-  sha256 = "0kqnpcgv49ricbr950lffs8gx7jrcg6anzc0qvwy5pb518w0d37i";
+  version = "9.11.20240423";
+  rev = "dddc9dff0547733a10e7f505612ab9df3a7c21b6";
+  sha256 = "0993sdmzzyymllck8mcpa1zgrjqjfxcvk1ykvfc18bvbs4145cm9";
 }
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@ -22,16 +22,20 @@ self: super: {
  # enable list-transformer, jailbreaking is necessary until next release >0.13.0: https://github.com/ivanperez-keera/dunai/issues/427
  dunai = doJailbreak (addBuildDepend self.list-transformer (enableCabalFlag "list-transformer" super.dunai));

-  # Make sure that Cabal_* can be built as-is
-  Cabal_3_10_3_0 = doDistribute (super.Cabal_3_10_3_0.override {
+  # Make sure that Cabal 3.10.* can be built as-is
+  Cabal_3_10_3_0 = doDistribute (super.Cabal_3_10_3_0.override ({
    Cabal-syntax = self.Cabal-syntax_3_10_3_0;
-  });
-  Cabal_3_12_1_0 = doDistribute (super.Cabal_3_12_1_0.override {
+  } // lib.optionalAttrs (lib.versionOlder self.ghc.version "9.2.5") {
+    # Use process core package when possible
+    process = self.process_1_6_24_0;
+  }));
+
+  Cabal_3_12_1_0 = doDistribute (super.Cabal_3_12_1_0.override ({
    Cabal-syntax = self.Cabal-syntax_3_12_1_0;
-  });
-  Cabal_3_14_0_0 = doDistribute (super.Cabal_3_14_0_0.override {
-    Cabal-syntax = self.Cabal-syntax_3_14_0_0;
-  });
+  } // lib.optionalAttrs (lib.versionOlder self.ghc.version "9.2.5") {
+    # Use process core package when possible
+    process = self.process_1_6_24_0;
+  }));

  # hackage-security == 0.6.2.6 has a wider support range in theory, but it only
  # makes sense to use the non Stackage version if we want to use Cabal* >= 3.12
@ -362,6 +366,15 @@ self: super: {
  ]
    super.threadscope);

+  # http2 also overridden in all-packages.nix for mailctl.
+  # twain is currently only used by mailctl, so the .overrideScope shouldn't
+  # negatively affect any other packages, at least currently...
+  # https://github.com/alexmingoia/twain/issues/5
+  twain = super.twain.overrideScope (self: _: {
+    http2 = self.http2_3_0_3;
+    warp = self.warp_3_3_30;
+  });
+
  # The latest release on hackage has an upper bound on containers which
  # breaks the build, though it works with the version of containers present
  # and the upper bound doesn't exist in code anymore:
@ -1257,7 +1270,6 @@ self: super: {
  stack = super.stack.overrideScope (lself: lsuper: {
    # stack-3.1.1 requires the latest versions of these libraries
    pantry = lself.pantry_0_10_0;
-    static-bytes = lself.static-bytes_0_1_1; # for pantry_0_10_0
    tar = lself.tar_0_6_3_0;

    # Upstream stack-3.1.1 is compiled with hpack-0.37.0, and we make sure to
@ -1990,6 +2002,14 @@ self: super: {
  # Test suite fails, upstream not reachable for simple fix (not responsive on github)
  vivid-osc = dontCheck super.vivid-osc;
  vivid-supercollider = dontCheck super.vivid-supercollider;
+  vivid = overrideCabal (drv: assert drv.version == "0.5.2.0"; {
+    # 2024-10-18: Some library dependency must have stopped
+    # re-exporting 'void', so now it needs an extra import line.
+    # Fixed in 0.5.2.1.
+    postPatch = ''
+      sed -i '/) where/a import Control.Monad (void)' Vivid/GlobalState.hs
+    '';
+  }) super.vivid;

  # Test suite does not compile.
  feed = dontCheck super.feed;
@ -2256,6 +2276,44 @@ self: super: {
  # Too strict bound on hspec (<2.11)
  utf8-light = doJailbreak super.utf8-light;

+  large-hashable = lib.pipe (super.large-hashable.override {
+    # https://github.com/factisresearch/large-hashable/commit/5ec9d2c7233fc4445303564047c992b693e1155c
+    utf8-light = null;
+  }) [
+    # 2022-03-21: use version from git which supports GHC 9.{0,2} and aeson 2.0
+    (assert super.large-hashable.version == "0.1.0.4"; overrideSrc {
+      version = "unstable-2022-06-10";
+      src = pkgs.fetchFromGitHub {
+        owner = "factisresearch";
+        repo = "large-hashable";
+        rev = "4d149c828c185bcf05556d1660f79ff1aec7eaa1";
+        sha256 = "141349qcw3m93jw95jcha9rsg2y8sn5ca5j59cv8xmci38k2nam0";
+      };
+    })
+    # Provide newly added dependencies
+    (overrideCabal (drv: {
+      libraryHaskellDepends = drv.libraryHaskellDepends or [] ++ [
+        self.cryptonite
+        self.memory
+      ];
+      testHaskellDepends = drv.testHaskellDepends or [] ++ [
+        self.inspection-testing
+      ];
+    }))
+    # https://github.com/factisresearch/large-hashable/issues/24
+    (overrideCabal (drv: {
+      testFlags = drv.testFlags or [] ++ [
+        "-n" "^Data.LargeHashable.Tests.Inspection:genericSumGetsOptimized$"
+      ];
+    }))
+    # https://github.com/factisresearch/large-hashable/issues/25
+    # Currently broken with text >= 2.0
+    (overrideCabal (lib.optionalAttrs (lib.versionAtLeast self.ghc.version "9.4") {
+      broken = true;
+      hydraPlatforms = [];
+    }))
+  ];
+
  # BSON defaults to requiring network instead of network-bsd which is
  # required nowadays: https://github.com/mongodb-haskell/bson/issues/26
  bson = appendConfigureFlag "-f-_old_network" (super.bson.override {
--- a/pkgs/development/haskell-modules/configuration-darwin.nix
+++ b/pkgs/development/haskell-modules/configuration-darwin.nix
@ -331,10 +331,6 @@ self: super: ({
  # Tests fail on macOS https://github.com/mrkkrp/zip/issues/112
  zip = dontCheck super.zip;

-  snap = super.snap.overrideAttrs (drv: {
-    __darwinAllowLocalNetworking = true;
-  });
-
  warp = super.warp.overrideAttrs (drv: {
    __darwinAllowLocalNetworking = true;
  });
--- a/pkgs/development/haskell-modules/configuration-ghc-9.10.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-9.10.x.nix
@ -69,7 +69,7 @@ self: super: {
  integer-conversion = doDistribute self.integer-conversion_0_1_1;
  ghc-lib-parser = doDistribute self.ghc-lib-parser_9_10_1_20240511;
  ghc-lib-parser-ex = doDistribute self.ghc-lib-parser-ex_9_10_0_0;
-  http2 = self.http2_5_3_4;
+  http2 = super.http2_5_3_4;
  lens = doDistribute self.lens_5_3_2;
  lukko = doDistribute self.lukko_0_1_2;
  network-control = super.network-control_0_1_3;
@ -84,7 +84,6 @@ self: super: {
  time-manager = super.time-manager_0_1_0;
  th-abstraction = doDistribute self.th-abstraction_0_7_0_0;
  uuid-types = doDistribute self.uuid-types_1_0_6;
-  warp = pkgs.haskell.lib.dontCheck super.warp_3_4_3; # test suite assumes it can freely call curl

  # A given major version of ghc-exactprint only supports one version of GHC.
  ghc-exactprint = doDistribute self.ghc-exactprint_1_9_0_0;
@ -127,6 +126,7 @@ self: super: {
  primitive-unlifted = dontCheck super.primitive-unlifted; # doesn't compile with primitive ==0.9.*
  bsb-http-chunked = pkgs.haskell.lib.dontCheck super.bsb-http-chunked; # https://github.com/sjakobi/bsb-http-chunked/issues/45
  hinotify = pkgs.haskell.lib.dontCheck super.hinotify; # https://github.com/kolmodin/hinotify/issues/38
+  warp = pkgs.haskell.lib.dontCheck super.warp_3_4_2; # test suite assumes it can freely call curl

  haskell-language-server = disableCabalFlag "retrie" (disableCabalFlag "hlint" (disableCabalFlag "stylishhaskel" (super.haskell-language-server.override {stylish-haskell = null;retrie = null;apply-refact=null;hlint = null;})));

--- a/pkgs/development/haskell-modules/configuration-ghc-9.8.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-9.8.x.nix
@ -4,7 +4,7 @@ with haskellLib;

 let
  inherit (pkgs.stdenv.hostPlatform) isDarwin;
-  inherit (pkgs) lib;
+
 in

 self: super: {
@ -54,9 +54,9 @@ self: super: {
  # Version upgrades
  #
  th-abstraction = doDistribute self.th-abstraction_0_7_0_0;
-  ghc-lib-parser = doDistribute self.ghc-lib-parser_9_8_3_20241022;
+  ghc-lib-parser = doDistribute self.ghc-lib-parser_9_8_2_20240223;
  ghc-lib-parser-ex = doDistribute self.ghc-lib-parser-ex_9_8_0_2;
-  ghc-lib = doDistribute self.ghc-lib_9_8_3_20241022;
+  ghc-lib = doDistribute self.ghc-lib_9_8_2_20240223;
  megaparsec = doDistribute self.megaparsec_9_6_1;
  # aeson 2.2.3.0 seemingly unnecessesarily bumped the lower bound on hashable
  # https://github.com/haskell/aeson/commit/1a666febd0775d8e88d315ece1b97cd20602fb5f
@ -147,8 +147,3 @@ self: super: {
  }) super.reflex;

 }
-// lib.optionalAttrs (lib.versionAtLeast super.ghc.version "9.8.3") {
-  # Breakage related to GHC 9.8.3 / deepseq 1.5.1.0
-  # https://github.com/typeable/generic-arbitrary/issues/18
-  generic-arbitrary = dontCheck super.generic-arbitrary;
-}
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml
@ -84,7 +84,6 @@ broken-packages:
  - aeson-flat # failure in job https://hydra.nixos.org/build/233220787 at 2023-09-02
  - aeson-flatten # failure in job https://hydra.nixos.org/build/233242954 at 2023-09-02
  - aeson-flowtyped # failure in job https://hydra.nixos.org/build/233245878 at 2023-09-02
-  - aeson-generic-default # failure in job https://hydra.nixos.org/build/276370826 at 2024-11-06
  - aeson-generics-typescript # failure in job https://hydra.nixos.org/build/245703304 at 2024-01-07
  - aeson-injector # failure in job https://hydra.nixos.org/build/233200351 at 2023-09-02
  - aeson-json-ast # failure in job https://hydra.nixos.org/build/233249406 at 2023-09-02
@ -2160,7 +2159,6 @@ broken-packages:
  - graph-matchings # failure in job https://hydra.nixos.org/build/233245821 at 2023-09-02
  - graphmod-plugin # failure in job https://hydra.nixos.org/build/233192543 at 2023-09-02
  - graphql-api # failure in job https://hydra.nixos.org/build/233254333 at 2023-09-02
-  - graphql-spice # failure in job https://hydra.nixos.org/build/276376899 at 2024-11-06
  - graphql-utils # failure in job https://hydra.nixos.org/build/233221340 at 2023-09-02
  - graphql-w-persistent # failure in job https://hydra.nixos.org/build/233228956 at 2023-09-02
  - graph-rewriting # failure in job https://hydra.nixos.org/build/233191278 at 2023-09-02
@ -2911,7 +2909,6 @@ broken-packages:
  - hssqlppp # failure in job https://hydra.nixos.org/build/233216888 at 2023-09-02
  - HsSVN # failure in job https://hydra.nixos.org/build/233213151 at 2023-09-02
  - hs-tags # failure in job https://hydra.nixos.org/build/233258358 at 2023-09-02
-  - hs-tango # failure in job https://hydra.nixos.org/build/276377558 at 2024-11-06
  - hstatsd # failure in job https://hydra.nixos.org/build/233232363 at 2023-09-02
  - hstats # failure in job https://hydra.nixos.org/build/233239963 at 2023-09-02
  - hs-term-emulator # failure in job https://hydra.nixos.org/build/233252262 at 2023-09-02
@ -3071,7 +3068,6 @@ broken-packages:
  - ieee-utils # failure in job https://hydra.nixos.org/build/233224430 at 2023-09-02
  - iexcloud # failure in job https://hydra.nixos.org/build/233224874 at 2023-09-02
  - ifcxt # failure in job https://hydra.nixos.org/build/233196911 at 2023-09-02
-  - if-instance # failure in job https://hydra.nixos.org/build/276378643 at 2024-11-06
  - IFS # failure in job https://hydra.nixos.org/build/233246865 at 2023-09-02
  - ige # failure in job https://hydra.nixos.org/build/233224389 at 2023-09-02
  - ig # failure in job https://hydra.nixos.org/build/233203872 at 2023-09-02
@ -3811,7 +3807,6 @@ broken-packages:
  - microbase # failure in job https://hydra.nixos.org/build/233204368 at 2023-09-02
  - microformats2-parser # failure in job https://hydra.nixos.org/build/233238485 at 2023-09-02
  - microgroove # failure in job https://hydra.nixos.org/build/233196933 at 2023-09-02
-  - MicroHs # failure in job https://hydra.nixos.org/build/276379260 at 2024-11-06
  - microlens-each # failure in job https://hydra.nixos.org/build/233253621 at 2023-09-02
  - microlens-process # failure in job https://hydra.nixos.org/build/233190805 at 2023-09-02
  - microlens-pro # failure in job https://hydra.nixos.org/build/252733422 at 2024-03-16
@ -4232,7 +4227,6 @@ broken-packages:
  - oi # failure in job https://hydra.nixos.org/build/233190838 at 2023-09-02
  - okapi # failure in job https://hydra.nixos.org/build/233193822 at 2023-09-02
  - old-version # failure in job https://hydra.nixos.org/build/233198538 at 2023-09-02
-  - ollama-haskell # failure in job https://hydra.nixos.org/build/276371507 at 2024-11-06
  - om-actor # failure in job https://hydra.nixos.org/build/233231027 at 2023-09-02
  - omaketex # failure in job https://hydra.nixos.org/build/233202599 at 2023-09-02
  - ombra # failure in job https://hydra.nixos.org/build/233192387 at 2023-09-02
@ -4737,8 +4731,6 @@ broken-packages:
  - powermate # failure in job https://hydra.nixos.org/build/233224977 at 2023-09-02
  - powerpc # failure in job https://hydra.nixos.org/build/233217983 at 2023-09-02
  - powerqueue-levelmem # failure in job https://hydra.nixos.org/build/233232882 at 2023-09-02
-  - ppad-sha256 # failure in job https://hydra.nixos.org/build/276377736 at 2024-11-06
-  - ppad-sha512 # failure in job https://hydra.nixos.org/build/276375868 at 2024-11-06
  - pprecord # failure in job https://hydra.nixos.org/build/233198838 at 2023-09-02
  - PPrinter # failure in job https://hydra.nixos.org/build/233253160 at 2023-09-02
  - pqc # failure in job https://hydra.nixos.org/build/233217425 at 2023-09-02
@ -6295,7 +6287,6 @@ broken-packages:
  - type-indexed-queues # failure in job https://hydra.nixos.org/build/233197833 at 2023-09-02
  - type-interpreter # failure in job https://hydra.nixos.org/build/233192182 at 2023-09-02
  - type-int # failure in job https://hydra.nixos.org/build/233245978 at 2023-09-02
-  - typelet # failure in job https://hydra.nixos.org/build/276367145 at 2024-11-06
  - type-level-bst # failure in job https://hydra.nixos.org/build/233202030 at 2023-09-02
  - type-level-natural-number-induction # failure in job https://hydra.nixos.org/build/233259499 at 2023-09-02
  - type-level-natural-number-operations # failure in job https://hydra.nixos.org/build/233198314 at 2023-09-02
@ -6848,10 +6839,7 @@ broken-packages:
  - yhccore # failure in job https://hydra.nixos.org/build/233199669 at 2023-09-02
  - yhseq # failure in job https://hydra.nixos.org/build/233191724 at 2023-09-02
  - yices # failure in job https://hydra.nixos.org/build/233242137 at 2023-09-02
-  - yi-contrib # failure in job https://hydra.nixos.org/build/276370855 at 2024-11-06
-  - yi-monokai # failure in job https://hydra.nixos.org/build/276375617 at 2024-11-06
-  - yi-solarized # failure in job https://hydra.nixos.org/build/276380211 at 2024-11-06
-  - yi-spolsky # failure in job https://hydra.nixos.org/build/276371008 at 2024-11-06
+  - yi-language # failure in job https://hydra.nixos.org/build/233217570 at 2023-09-02
  - yoctoparsec # failure in job https://hydra.nixos.org/build/233192019 at 2023-09-02
  - yoda # failure in job https://hydra.nixos.org/build/233200530 at 2023-09-02
  - Yogurt # failure in job https://hydra.nixos.org/build/233212103 at 2023-09-02
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
@ -36,8 +36,7 @@ default-package-overrides:
  - hnix-store-remote < 0.7
  # 2024-09-12: match xmonad 0.17.* from Stackage LTS
  - xmonad-contrib < 0.18.1
-  # 2024-11-01: no release version of http2/3 supports http-semantics >= 0.3.0 at the moment
-  - http-semantics < 0.3.0
+

 extra-packages:
  - Cabal == 3.2.*                      # Used for packages needing newer Cabal on ghc 8.6 and 8.8
@ -73,6 +72,7 @@ extra-packages:
  - hspec-discover < 2.8                # 2022-04-07: Needed for tasty-hspec 1.1.6
  - hspec-megaparsec == 2.2.0           # 2023-11-18: Latest version compatible with ghc 9.0, needed for HLS
  - hspec-meta < 2.8                    # 2022-12-07: Needed for elmPackages.elm / hspec-discover
+  - http2 < 3.3                         # 2023-08-24: Needed for twain <https://github.com/alexmingoia/twain/issues/5>
  - immortal == 0.2.2.1                 # required by Hasura 1.3.1, 2020-08-20
  - language-docker == 11.0.0           # required by hadolint 2.12.0, 2022-11-16
  - language-javascript == 0.7.0.0      # required by purescript
@ -89,6 +89,7 @@ extra-packages:
  - primitive-unlifted == 0.1.3.1       # 2024-03-16: Needed for hls on ghc 9.2
  - stylish-haskell == 0.14.4.0         # 2022-09-19: needed for hls on ghc 9.2
  - text == 2.0.2                       # 2023-09-14: Needed for elm (which is currently on ghc-8.10)
+  - warp < 3.3.31                       # 2024-03-20: for twain, which requires http2 3.0.3
  - weeder == 2.2.*                     # 2022-02-21: preserve for GHC 8.10.7
  - weeder == 2.3.*                     # 2022-05-31: preserve for GHC 9.0.2
  - weeder == 2.4.*                     # 2023-02-02: preserve for GHC 9.2.*
@ -820,6 +821,8 @@ supported-platforms:
  midi-alsa:                                    [ platforms.linux ] # alsa-core only supported on linux
  midisurface:                                  [ platforms.linux ] # alsa-core only supported on linux
  OrderedBits:                                  [ platforms.x86 ] # lacks implementations for non-x86: https://github.com/choener/OrderedBits/blob/401cbbe933b1635aa33e8e9b29a4a570b0a8f044/lib/Data/Bits/Ordered.hs#L316
+  password:                                     [ platforms.x86 ] # uses scrypt, which requries x86
+  password-instances:                           [ platforms.x86 ] # uses scrypt, which requries x86
  reactivity:                                   [ platforms.windows ]
  reflex-libtelnet:                             [ platforms.linux ] # pkgs.libtelnet only supports linux
  scat:                                         [ platforms.x86 ] # uses scrypt, which requries x86
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/stackage.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/stackage.yaml
@ -1,4 +1,4 @@
-# Stackage LTS 22.39
+# Stackage LTS 22.36
 # This file is auto-generated by
 # maintainers/scripts/haskell/update-stackage.sh
 default-package-overrides:
@ -397,7 +397,7 @@ default-package-overrides:
  - atom-conduit ==0.9.0.1
  - atomic-counter ==0.1.2.1
  - atomic-primops ==0.8.8
-  - atomic-write ==0.2.1.0
+  - atomic-write ==0.2.0.7
  - attoparsec ==0.14.4
  - attoparsec-aeson ==2.1.0.0
  - attoparsec-base64 ==0.0.0
@ -454,7 +454,7 @@ default-package-overrides:
  - bcp47 ==0.2.0.6
  - bcp47-orphans ==0.1.0.6
  - bcrypt ==0.0.11
-  - beam-core ==0.10.3.0
+  - beam-core ==0.10.1.0
  - bech32 ==1.1.7
  - bech32-th ==1.1.7
  - benchpress ==0.2.2.23
@ -508,8 +508,6 @@ default-package-overrides:
  - blaze-textual ==0.2.3.1
  - bloodhound ==0.21.0.0
  - bloomfilter ==2.0.1.2
-  - bluefin ==0.0.9.0
-  - bluefin-internal ==0.0.9.0
  - bm ==0.2.0.0
  - bmp ==1.2.6.4
  - bnb-staking-csvs ==0.2.2.0
@ -529,7 +527,7 @@ default-package-overrides:
  - bounded-qsem ==0.1.0.2
  - bounded-queue ==1.0.0
  - boundingboxes ==0.2.3
-  - box ==0.9.3.2
+  - box ==0.9.3.1
  - boxes ==0.1.5
  - breakpoint ==0.1.4.0
  - brick ==2.1.1
@ -554,7 +552,7 @@ default-package-overrides:
  - bv-sized ==1.0.5
  - byteable ==0.1.1
  - bytebuild ==0.3.16.2
-  - byte-count-reader ==0.10.1.12
+  - byte-count-reader ==0.10.1.11
  - bytedump ==1.0
  - bytehash ==0.1.1.0
  - byte-order ==0.1.3.1
@ -579,7 +577,7 @@ default-package-overrides:
  - cabal2spec ==2.7.1
  - cabal-appimage ==0.4.0.5
  - cabal-clean ==0.2.20230609
-  - cabal-debian ==5.2.4
+  - cabal-debian ==5.2.3
  - cabal-doctest ==1.0.10
  - cabal-file ==0.1.1
  - cabal-plan ==0.7.3.0
@ -685,9 +683,9 @@ default-package-overrides:
  - comfort-fftw ==0.0.0.1
  - comfort-glpk ==0.1
  - comfort-graph ==0.0.4
-  - commonmark ==0.2.6.1
+  - commonmark ==0.2.6
  - commonmark-extensions ==0.2.5.5
-  - commonmark-pandoc ==0.2.2.2
+  - commonmark-pandoc ==0.2.2.1
  - commutative ==0.0.2
  - commutative-semigroups ==0.1.1.0
  - comonad ==5.0.8
@ -826,14 +824,14 @@ default-package-overrides:
  - data-bword ==0.1.0.2
  - data-checked ==0.3
  - data-clist ==0.2
-  - data-default ==0.7.1.2
-  - data-default-class ==0.1.2.2
-  - data-default-instances-base ==0.1.0.3
+  - data-default ==0.7.1.1
+  - data-default-class ==0.1.2.0
+  - data-default-instances-base ==0.1.0.1
  - data-default-instances-bytestring ==0.0.1
  - data-default-instances-case-insensitive ==0.0.1
  - data-default-instances-containers ==0.0.1
-  - data-default-instances-dlist ==0.0.1.2
-  - data-default-instances-old-locale ==0.0.1.2
+  - data-default-instances-dlist ==0.0.1
+  - data-default-instances-old-locale ==0.0.1
  - data-default-instances-unordered-containers ==0.0.1
  - data-default-instances-vector ==0.0.1
  - data-diverse ==4.7.1.0
@ -1059,7 +1057,7 @@ default-package-overrides:
  - extrapolate ==0.4.6
  - fail ==4.9.0.0
  - FailT ==0.1.2.0
-  - fakedata ==1.0.5
+  - fakedata ==1.0.3
  - fakedata-parser ==0.1.0.0
  - fakedata-quickcheck ==0.2.0
  - fakefs ==0.3.0.2
@ -1068,7 +1066,7 @@ default-package-overrides:
  - falsify ==0.2.0
  - fasta ==0.10.4.2
  - fast-digits ==0.3.2.0
-  - fast-logger ==3.2.4
+  - fast-logger ==3.2.3
  - fast-math ==1.0.2
  - fast-myers-diff ==0.0.1
  - fb ==2.1.1.1
@ -1076,11 +1074,12 @@ default-package-overrides:
  - fclabels ==2.0.5.1
  - fdo-notify ==0.3.1
  - feature-flags ==0.1.0.1
-  - fedora-releases ==0.1.0
+  - fedora-dists ==2.1.1
+  - fedora-haskell-tools ==1.1
  - FenwickTree ==0.1.2.1
  - fft ==0.1.8.7
  - fftw-ffi ==0.1
-  - fgl ==5.8.3.0
+  - fgl ==5.8.2.0
  - fgl-arbitrary ==0.2.0.6
  - fields-json ==0.4.0.0
  - file-embed ==0.0.16.0
@ -1133,7 +1132,7 @@ default-package-overrides:
  - ForestStructures ==0.0.1.1
  - forkable-monad ==0.2.0.3
  - forma ==1.2.0
-  - formatn ==0.3.1.0
+  - formatn ==0.3.0.1
  - format-numbers ==0.1.0.1
  - formatting ==7.2.0
  - foundation ==0.0.30
@ -1171,7 +1170,7 @@ default-package-overrides:
  - generically ==0.1.1
  - generic-arbitrary ==1.0.1
  - generic-constraints ==1.1.1.1
-  - generic-data ==1.1.0.1
+  - generic-data ==1.1.0.0
  - generic-data-surgery ==0.3.0.0
  - generic-deriving ==1.14.5
  - generic-functor ==1.1.0.0
@ -1297,7 +1296,7 @@ default-package-overrides:
  - GLUT ==2.7.0.16
  - gmail-simple ==0.1.0.6
  - gnuplot ==0.5.7
-  - goldplate ==0.2.2.1
+  - goldplate ==0.2.1.1
  - google-isbn ==1.0.3
  - gopher-proxy ==0.1.1.3
  - gpolyline ==0.1.0.1
@ -1344,7 +1343,7 @@ default-package-overrides:
  - hashing ==0.1.1.0
  - hashmap ==1.3.3
  - hashtables ==1.3.1
-  - haskell-gi ==0.26.12
+  - haskell-gi ==0.26.11
  - haskell-gi-base ==0.26.8
  - haskell-gi-overloading ==1.0
  - haskell-lexer ==1.1.1
@ -1477,7 +1476,7 @@ default-package-overrides:
  - hslua-classes ==2.3.1
  - hslua-cli ==1.4.3
  - hslua-core ==2.3.2
-  - hslua-list ==1.1.4
+  - hslua-list ==1.1.3
  - hslua-marshalling ==2.3.1
  - hslua-module-doclayout ==1.1.1.2
  - hslua-module-path ==1.1.1
@ -1732,7 +1731,7 @@ default-package-overrides:
  - LambdaHack ==0.11.0.1
  - lame ==0.2.2
  - language-avro ==0.1.4.0
-  - language-c ==0.9.4
+  - language-c ==0.9.3
  - language-c99 ==0.2.0
  - language-c99-simple ==0.3.0
  - language-c99-util ==0.2.0
@ -1782,7 +1781,7 @@ default-package-overrides:
  - liboath-hs ==0.0.1.2
  - libyaml ==0.1.4
  - libyaml-clib ==0.2.5
-  - lifted-async ==0.10.2.6
+  - lifted-async ==0.10.2.5
  - lifted-base ==0.2.3.12
  - lift-generics ==0.2.1
  - lift-type ==0.1.2.0
@ -1854,7 +1853,7 @@ default-package-overrides:
  - markdown-unlit ==0.6.0
  - markov-chain ==0.0.3.4
  - markov-chain-usage-model ==0.0.0
-  - markup-parse ==0.1.1.1
+  - markup-parse ==0.1.1
  - mason ==0.2.6
  - massiv ==1.0.4.0
  - massiv-io ==1.0.0.1
@ -1873,7 +1872,7 @@ default-package-overrides:
  - matrix-static ==0.3
  - maximal-cliques ==0.1.1
  - mbox-utility ==0.0.3.1
-  - mcmc ==0.8.3.1
+  - mcmc ==0.8.2.0
  - mcmc-types ==1.0.3
  - median-stream ==0.7.0.0
  - med-module ==0.1.3
@ -2154,7 +2153,7 @@ default-package-overrides:
  - pandoc-cli ==3.1.11.1
  - pandoc-dhall-decoder ==0.1.0.1
  - pandoc-lua-engine ==0.2.1.2
-  - pandoc-lua-marshal ==0.2.9
+  - pandoc-lua-marshal ==0.2.8
  - pandoc-plot ==1.8.0
  - pandoc-server ==0.1.0.5
  - pandoc-throw ==0.1.0.0
@ -2318,7 +2317,7 @@ default-package-overrides:
  - primes ==0.2.1.0
  - primitive ==0.8.0.0
  - primitive-addr ==0.1.0.3
-  - primitive-extras ==0.10.2.1
+  - primitive-extras ==0.10.2
  - primitive-offset ==0.2.0.1
  - primitive-serial ==0.1
  - primitive-unaligned ==0.1.1.2
@ -2363,8 +2362,8 @@ default-package-overrides:
  - PyF ==0.11.3.0
  - qchas ==1.1.0.1
  - qm-interpolated-string ==0.3.1.0
-  - qrcode-core ==0.9.10
-  - qrcode-juicypixels ==0.8.6
+  - qrcode-core ==0.9.9
+  - qrcode-juicypixels ==0.8.5
  - quaalude ==0.0.0.1
  - quadratic-irrational ==0.1.1
  - QuasiText ==0.1.2.6
@ -2465,7 +2464,7 @@ default-package-overrides:
  - relational-record ==0.2.2.0
  - relational-schemas ==0.1.8.1
  - reliable-io ==0.0.2
-  - relude ==1.2.2.0
+  - relude ==1.2.1.0
  - renderable ==0.2.0.1
  - replace-attoparsec ==1.5.0.0
  - replace-megaparsec ==1.5.0.1
@ -2607,7 +2606,7 @@ default-package-overrides:
  - servant-rate-limit ==0.2.0.0
  - servant-rawm ==1.0.0.0
  - servant-server ==0.20.2
-  - servant-static-th ==1.0.0.1
+  - servant-static-th ==1.0.0.0
  - servant-subscriber ==0.7.0.0
  - servant-swagger ==1.2.1
  - servant-swagger-ui ==0.3.5.5.0.0
@ -2636,8 +2635,8 @@ default-package-overrides:
  - shared-memory ==0.2.0.1
  - shell-conduit ==5.0.0
  - shell-escape ==0.2.0
-  - shellify ==0.11.0.3
-  - shellmet ==0.0.5.0
+  - shellify ==0.11.0.1
+  - shellmet ==0.0.4.1
  - shelltestrunner ==1.10
  - shell-utility ==0.1
  - shellwords ==0.1.3.1
@ -2763,7 +2762,7 @@ default-package-overrides:
  - Stream ==0.4.7.2
  - streaming ==0.2.4.0
  - streaming-attoparsec ==1.0.0.1
-  - streaming-bytestring ==0.3.3
+  - streaming-bytestring ==0.3.2
  - streaming-commons ==0.2.2.6
  - streaming-wai ==0.1.1
  - streamly ==0.10.1
@ -3095,9 +3094,9 @@ default-package-overrides:
  - universe-instances-extended ==1.1.3
  - universe-reverse-instances ==1.1.1
  - universe-some ==1.2.1
-  - universum ==1.8.2.2
+  - universum ==1.8.2.1
  - unix-bytestring ==0.4.0.2
-  - unix-compat ==0.7.3
+  - unix-compat ==0.7.2
  - unix-time ==0.4.15
  - unjson ==0.15.4
  - unliftio ==0.2.25.0
@ -3283,7 +3282,7 @@ default-package-overrides:
  - xxhash-ffi ==0.2.0.0
  - yaml ==0.11.11.2
  - yaml-unscrambler ==0.1.0.19
-  - Yampa ==0.14.11
+  - Yampa ==0.14.10
  - yarn-lock ==0.6.5
  - yeshql-core ==4.2.0.0
  - yesod ==1.6.2.1
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml
@ -802,7 +802,7 @@ dont-distribute-packages:
 - chart-cli
 - chart-svg
 - chart-svg-various
- - chart-svg_0_7_0_0
+ - chart-svg_0_6_1_0
 - chart-unit
 - chassis
 - chatty
@ -1866,7 +1866,6 @@ dont-distribute-packages:
 - hark
 - harmony
 - haroonga-httpd
- - harpie-numhask
 - has-th
 - hasbolt
 - hascat
@ -2014,6 +2013,7 @@ dont-distribute-packages:
 - hedgehog-gen-json
 - hedis-pile
 - heftia
+ - heftia-effects
 - heist-aeson
 - helic
 - helics
@ -2498,7 +2498,6 @@ dont-distribute-packages:
 - language-python-colour
 - language-qux
 - language-spelling
- - large-anon
 - lat
 - latex-formulae-hakyll
 - latex-formulae-pandoc
@ -3029,7 +3028,6 @@ dont-distribute-packages:
 - perdure
 - perf
 - perf-analysis
- - perf_0_13_0_0
 - perfecthash
 - periodic-client
 - periodic-client-exe
@ -3164,8 +3162,6 @@ dont-distribute-packages:
 - potoki-hasql
 - potoki-zlib
 - powerqueue-sqs
- - ppad-hmac-drbg
- - ppad-secp256k1
 - pqueue-mtl
 - practice-room
 - pred-set
@ -3294,7 +3290,6 @@ dont-distribute-packages:
 - rasa-ext-vim
 - rascal
 - raw-feldspar
- - rawlock
 - rawr
 - razom-text-util
 - rbr
@ -3384,7 +3379,6 @@ dont-distribute-packages:
 - reserve
 - resin
 - resource-pool-catchio
- - resource-registry
 - resource-simple
 - respond
 - rest-client
@ -4295,6 +4289,25 @@ dont-distribute-packages:
 - yesod-routes-typescript
 - yesod-session-redis
 - yesod-worker
+ - yi
+ - yi-contrib
+ - yi-core
+ - yi-dynamic-configuration
+ - yi-emacs-colours
+ - yi-frontend-pango
+ - yi-frontend-vty
+ - yi-fuzzy-open
+ - yi-ireader
+ - yi-keymap-cua
+ - yi-keymap-emacs
+ - yi-keymap-vim
+ - yi-misc-modes
+ - yi-mode-haskell
+ - yi-mode-javascript
+ - yi-monokai
+ - yi-snippet
+ - yi-solarized
+ - yi-spolsky
 - yjftp
 - yjftp-libs
 - yoko
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@ -113,35 +113,6 @@ self: super: builtins.intersectAttrs super {
    '' + drv.preCheck or "";
  }) super.agda2lagda;

-  # - Disable scrypt support since the library used only works on x86 due to SSE2:
-  #   https://github.com/informatikr/scrypt/issues/8
-  # - Use crypton as the encryption backend. That override becomes obsolete with
-  #   3.1.* since cabal2nix picks crypton by default then.
-  password =
-    let
-      scryptSupported = pkgs.stdenv.hostPlatform.isx86;
-    in
-
-      lib.pipe
-        (super.password.override ({
-          cryptonite = self.crypton;
-        } // lib.optionalAttrs (!scryptSupported) {
-          scrypt = null;
-        }))
-        ([
-          (enableCabalFlag "crypton")
-          (disableCabalFlag "cryptonite")
-          # https://github.com/cdepillabout/password/pull/84
-          (appendPatch ./patches/password-3.0.4.0-scrypt-conditional.patch)
-          (overrideCabal (drv: {
-            # patch doesn't apply otherwise because of revisions
-            prePatch = drv.prePatch or "" + ''
-              ${pkgs.buildPackages.dos2unix}/bin/dos2unix *.cabal
-            '';
-          }))
-        ] ++ lib.optionals (!scryptSupported) [
-          (disableCabalFlag "scrypt")
-        ]);

  audacity = enableCabalFlag "buildExamples" (overrideCabal (drv: {
      executableHaskellDepends = [self.optparse-applicative self.soxlib];
@ -185,11 +156,6 @@ self: super: builtins.intersectAttrs super {
    '';
  }) super.nvvm;

-  # Doesn't declare LLVM dependency, needs llvm-config
-  llvm-codegen = addBuildTools [
-    pkgs.llvmPackages_17.llvm.dev # for native llvm-config
-  ] super.llvm-codegen;
-
  # hledger* overrides
  inherit (
    let
@ -415,6 +381,7 @@ self: super: builtins.intersectAttrs super {

  # The curl executable is required for withApplication tests.
  warp = addTestToolDepend pkgs.curl super.warp;
+  warp_3_3_30 = addTestToolDepend pkgs.curl super.warp_3_3_30;

  safe-exceptions = overrideCabal (drv: {
    # Fix strictDeps build error "could not execute: hspec-discover"
@ -1447,7 +1414,7 @@ self: super: builtins.intersectAttrs super {
        mpiImpl = pkgs.mpi.pname;
        disableUnused = with builtins; map disableCabalFlag (filter (n: n != mpiImpl) validMpi);
     in lib.pipe
-          (super.mpi-hs_0_7_3_1.override { ompi = pkgs.mpi; })
+          (super.mpi-hs_0_7_3_0.override { ompi = pkgs.mpi; })
          ( [ (addTestToolDepends [ pkgs.openssh pkgs.mpiCheckPhaseHook ]) ]
            ++ disableUnused
            ++ lib.optional (builtins.elem mpiImpl validMpi) (enableCabalFlag mpiImpl)
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
--- a/pkgs/development/haskell-modules/patches/password-3.0.4.0-scrypt-conditional.patch
+++ b/pkgs/development/haskell-modules/patches/password-3.0.4.0-scrypt-conditional.patch
@ -1,21 +0,0 @@
-diff --git a/password/password.cabal b/password/password.cabal
-index 506457e..8fa978b 100644
--- a/password.cabal
-+++ b/password.cabal
-@@ -186,6 +186,8 @@ test-suite password-tasty
-     other-modules:
-       Scrypt
-       Data.Password.Scrypt
-+    build-depends:
-+      scrypt
-   ghc-options:
-       -threaded -O2 -rtsopts -with-rtsopts=-N
-   build-depends:
-@@ -195,7 +197,6 @@ test-suite password-tasty
-     , bytestring
-     , memory
-     , quickcheck-instances
-    , scrypt
-     , tasty
-     , tasty-hunit
-     , tasty-quickcheck
--- a/pkgs/development/libraries/gdcm/default.nix
+++ b/pkgs/development/libraries/gdcm/default.nix
@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
    "-DGDCM_USE_VTK=ON"
  ] ++ lib.optionals enablePython [
    "-DGDCM_WRAP_PYTHON:BOOL=ON"
-    "-DGDCM_INSTALL_PYTHONMODULE_DIR=${placeholder "out"}/${python.sitePackages}"
+    "-DGDCM_INSTALL_PYTHONMODULE_DIR=${placeholder "out"}/${python.sitePackages}/python_gdcm"
  ];

  nativeBuildInputs = [
@ -66,6 +66,13 @@ stdenv.mkDerivation rec {
    libiconv
  ] ++ lib.optionals enablePython [ swig python ];

+  postInstall = lib.optionalString enablePython ''
+    substitute \
+      ${./python_gdcm.egg-info} \
+      $out/${python.sitePackages}/python_gdcm-${version}.egg-info \
+      --subst-var-by GDCM_VER "${version}"
+  '';
+
  disabledTests = [
    # require networking:
    "TestEcho"
@ -77,6 +84,8 @@ stdenv.mkDerivation rec {
    "TestSCUValidation"
    # errors because 3 classes not wrapped:
    "TestWrapPython"
+    # AttributeError: module 'gdcm' has no attribute 'UIDGenerator_SetRoot'; maybe a wrapping regression:
+    "TestUIDGeneratorPython"
  ] ++ lib.optionals (stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isLinux) [
    "TestRescaler2"
  ];
--- a/pkgs/development/libraries/gdcm/python_gdcm.egg-info
+++ b/pkgs/development/libraries/gdcm/python_gdcm.egg-info
@ -0,0 +1,5 @@
+Metadata-Version: 2.1
+Name: python-gdcm
+Version: @GDCM_VER@
+Summary: C++ library for DICOM medical files wrapped for Python using SWIG
+Platform: UNKNOWN
--- a/pkgs/development/libraries/jitterentropy/default.nix
+++ b/pkgs/development/libraries/jitterentropy/default.nix
@ -1,4 +1,9 @@
-{ lib, stdenv, fetchFromGitHub }:
+{
+  lib,
+  stdenv,
+  cmake,
+  fetchFromGitHub,
+}:

 stdenv.mkDerivation rec {
  pname = "jitterentropy";
@ -11,24 +16,27 @@ stdenv.mkDerivation rec {
    hash = "sha256-CPvgc/W5Z2OfbP9Lp2tQevUQZr+xlh6q5r5Fp2WUHhg=";
  };

-  outputs = [ "out" "dev" ];
+  nativeBuildInputs = [ cmake ];

-  enableParallelBuilding = true;
-  hardeningDisable = [ "fortify" ]; # avoid warnings
-
-  # prevent jitterentropy from builtin strip to allow controlling this from the derivation's
-  # settings. Also fixes a strange issue, where this strip may fail when cross-compiling.
-  installFlags = [
-    "INSTALL_STRIP=install"
-    "PREFIX=${placeholder "out"}"
+  outputs = [
+    "out"
+    "dev"
  ];

-  meta = with lib; {
+  hardeningDisable = [ "fortify" ]; # avoid warnings
+
+  meta = {
    description = "Provides a noise source using the CPU execution timing jitter";
    homepage = "https://github.com/smuellerDD/jitterentropy-library";
    changelog = "https://github.com/smuellerDD/jitterentropy-library/raw/v${version}/CHANGES.md";
-    license = with licenses; [ bsd3 /* OR */ gpl2Only ];
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ johnazoidberg c0bw3b ];
+    license = with lib.licenses; [
+      bsd3 # OR
+      gpl2Only
+    ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    maintainers = with lib.maintainers; [
+      johnazoidberg
+      c0bw3b
+    ];
  };
 }
--- a/pkgs/development/python-modules/better-exceptions/default.nix
+++ b/pkgs/development/python-modules/better-exceptions/default.nix
@ -0,0 +1,33 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "better-exceptions";
+  version = "0.3.3";
+  pyproject = true;
+
+  src = fetchPypi {
+    pname = "better_exceptions";
+    inherit version;
+    hash = "sha256-5Oa8GERNXwTm6JSxA4Hl6SHT1UQkBBgWLH21fp6zRTs=";
+  };
+
+  build-system = [ setuptools ];
+
+  pythonImportsCheck = [ "better_exceptions" ];
+
+  # As noted by @WolfangAukang, some check files need to be disabled because of various errors, same with some tests.
+  # After disabling and running the build, no tests are collected.
+  doCheck = false;
+
+  meta = {
+    description = "Pretty and more helpful exceptions in Python, automatically";
+    homepage = "https://github.com/qix-/better-exceptions";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.alex-nt ];
+  };
+}
--- a/pkgs/development/python-modules/biopython/close_parser_on_time.patch
+++ b/pkgs/development/python-modules/biopython/close_parser_on_time.patch
@ -0,0 +1,18 @@
+diff --git a/Bio/SeqIO/SeqXmlIO.py b/Bio/SeqIO/SeqXmlIO.py
+index 8fe75ebb728..6758317d05f 100644
+--- a/Bio/SeqIO/SeqXmlIO.py
+++ b/Bio/SeqIO/SeqXmlIO.py
+@@ -498,11 +498,12 @@ def iterate(self, handle):
+             if not text:
+                 break
+             parser.feed(text)
+        # Closing the parser ensures that all XML data fed into it are processed
+        parser.close()
+         # We have reached the end of the XML file;
+         # send out the remaining records
+         yield from records
+         records.clear()
+-        parser.close()
+ 
+ 
+ class SeqXmlWriter(SequenceWriter):
--- a/pkgs/development/python-modules/biopython/default.nix
+++ b/pkgs/development/python-modules/biopython/default.nix
@ -1,7 +1,7 @@
 {
  lib,
  buildPythonPackage,
-  fetchFromGitHub,
+  fetchPypi,
  pythonOlder,
  setuptools,
  numpy,
@ -9,18 +9,22 @@

 buildPythonPackage rec {
  pname = "biopython";
-  version = "1.84";
+  version = "1.83";
  pyproject = true;

  disabled = pythonOlder "3.9";

-  src = fetchFromGitHub {
-    owner = "biopython";
-    repo = "biopython";
-    rev = "refs/tags/biopython-${lib.replaceStrings [ "." ] [ "" ] version}";
-    hash = "sha256-zXUB/AkWc/cY9M02WheSvXjT/nwM+lGXfXgCcWfu0G4=";
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-eOa/t43mMDQDev01/nfLbgqeW2Jwa+z3in2SKxbtg/c=";
  };

+  patches = [
+    # cherry-picked from https://github.com/biopython/biopython/commit/3f9bda7ef44f533dadbaa0de29ac21929bc0b2f1
+    # fixes SeqXMLIO parser to process all data. remove on next update
+    ./close_parser_on_time.patch
+  ];
+
  build-system = [ setuptools ];

  dependencies = [ numpy ];
--- a/pkgs/development/python-modules/clickclick/default.nix
+++ b/pkgs/development/python-modules/clickclick/default.nix
@ -1,7 +1,7 @@
 {
  lib,
  buildPythonPackage,
-  fetchFromGitHub,
+  fetchFromGitea,
  flake8,
  click,
  pyyaml,
@ -12,14 +12,15 @@

 buildPythonPackage rec {
  pname = "clickclick";
-  version = "1.2.2";
+  version = "20.10.2";
  format = "setuptools";

-  src = fetchFromGitHub {
+  src = fetchFromGitea {
+    domain = "codeberg.org";
    owner = "hjacobs";
    repo = "python-clickclick";
    rev = version;
-    sha256 = "1rij9ws9nhsmagiy1vclzliiqfkxi006rf65qvrw1k3sm2s8p5g0";
+    hash = "sha256-gefU6CI4ibtvonsaKZmuffuUNUioBn5ODs72BI5zXOw=";
  };

  nativeCheckInputs = [
@ -38,7 +39,7 @@ buildPythonPackage rec {

  meta = with lib; {
    description = "Click command line utilities";
-    homepage = "https://github.com/hjacobs/python-clickclick/";
+    homepage = "https://codeberg.org/hjacobs/python-clickclick/";
    license = licenses.asl20;
  };
 }
--- a/pkgs/development/python-modules/dicom2nifti/default.nix
+++ b/pkgs/development/python-modules/dicom2nifti/default.nix
@ -8,6 +8,8 @@
  nibabel,
  numpy,
  pydicom,
+  pylibjpeg,
+  pylibjpeg-libjpeg,
  scipy,
  setuptools,
 }:
@ -37,16 +39,16 @@ buildPythonPackage rec {
    scipy
  ];

-  # python-gdcm just builds the python interface provided by the "gdcm" package, so
-  # we should be able to replace "python-gdcm" with "gdcm" but this doesn't work
-  # (similar to https://github.com/NixOS/nixpkgs/issues/84774)
  postPatch = ''
-    substituteInPlace setup.py --replace-fail "python-gdcm" ""
    substituteInPlace tests/test_generic.py --replace-fail "from common" "from dicom2nifti.common"
    substituteInPlace tests/test_ge.py --replace-fail "import convert_generic" "import dicom2nifti.convert_generic as convert_generic"
  '';

-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+    pylibjpeg
+    pylibjpeg-libjpeg
+  ];

  pythonImportsCheck = [ "dicom2nifti" ];

--- a/pkgs/development/python-modules/django-cte/default.nix
+++ b/pkgs/development/python-modules/django-cte/default.nix
@ -0,0 +1,64 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  unittestCheckHook,
+  setuptools,
+  django,
+}:
+
+buildPythonPackage rec {
+  pname = "django-cte";
+  version = "1.3.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "dimagi";
+    repo = "django-cte";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-OCENg94xHBeeE4A2838Cu3q2am2im2X4SkFSjc6DuhE=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ django ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  disabledTests = [
+    # Require Database connection
+    "test_cte_queryset"
+    "test_experimental_left_outer_join"
+    "test_explain"
+    "test_left_outer_join_on_empty_result_set_cte"
+    "test_named_ctes"
+    "test_named_simple_ctes"
+    "test_non_cte_subquery"
+    "test_outerref_in_cte_query"
+    "test_simple_cte_query"
+    "test_update_cte_query"
+    "test_update_with_subquery"
+    "test_heterogeneous_filter_in_cte"
+    "test_raw_cte_sql"
+    "test_alias_as_subquery"
+    "test_alias_change_in_annotation"
+    "test_attname_should_not_mask_col_name"
+    "test_pickle_recursive_cte_queryset"
+    "test_recursive_cte_query"
+    "test_recursive_cte_reference_in_condition"
+    "test_union_with_first"
+    "test_union_with_select_related_and_first"
+    "test_union_with_select_related_and_order"
+  ];
+
+  pythonImportsCheck = [ "django_cte" ];
+
+  meta = {
+    description = "Common Table Expressions (CTE) for Django";
+    homepage = "https://github.com/dimagi/django-cte";
+    changelog = "https://github.com/dimagi/django-cte/blob/v${version}/CHANGELOG.md";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ jopejoe1 ];
+  };
+}
--- a/pkgs/development/python-modules/django-pgactivity/default.nix
+++ b/pkgs/development/python-modules/django-pgactivity/default.nix
@ -0,0 +1,38 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  django,
+  psycopg,
+}:
+
+buildPythonPackage rec {
+  pname = "django-pgactivity";
+  version = "1.5.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "Opus10";
+    repo = "django-pgactivity";
+    rev = "refs/tags/${version}";
+    hash = "sha256-jOpm/vYy3Ubi+NfvARH19ozZMUgyGD/ZztqxKNvAoLQ=";
+  };
+
+  build-system = [ poetry-core ];
+
+  dependencies = [
+    django
+    psycopg
+  ];
+
+  pythonImportsCheck = [ "pgactivity" ];
+
+  meta = {
+    description = "View, filter, and kill Postgres queries";
+    homepage = "https://github.com/Opus10/django-pgactivity";
+    changelog = "https://github.com/Opus10/django-pgactivity/blob/${version}/CHANGELOG.md";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ jopejoe1 ];
+  };
+}
--- a/pkgs/development/python-modules/django-pglock/default.nix
+++ b/pkgs/development/python-modules/django-pglock/default.nix
@ -0,0 +1,38 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  django,
+  django-pgactivity,
+}:
+
+buildPythonPackage rec {
+  pname = "django-pglock";
+  version = "1.6.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "Opus10";
+    repo = "django-pglock";
+    rev = "refs/tags/${version}";
+    hash = "sha256-KCB00W3sUyEERgK/DfDPl051uFkc0IRdbOJusUVs5SA=";
+  };
+
+  build-system = [ poetry-core ];
+
+  dependencies = [
+    django
+    django-pgactivity
+  ];
+
+  pythonImportsCheck = [ "pglock" ];
+
+  meta = {
+    description = "Postgres advisory locks, table locks, and blocking lock management";
+    homepage = "https://github.com/Opus10/django-pglock";
+    changelog = "https://github.com/Opus10/django-pglock/blob/${version}/CHANGELOG.md";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ jopejoe1 ];
+  };
+}
--- a/pkgs/development/python-modules/django-tenants/default.nix
+++ b/pkgs/development/python-modules/django-tenants/default.nix
@ -0,0 +1,38 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  django,
+  psycopg,
+}:
+
+buildPythonPackage rec {
+  pname = "django-tenants";
+  version = "3.7.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "django-tenants";
+    repo = "django-tenants";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-QdEONKVFW/DWBjXWRTG+ahvirw9BP8M6PztUMZGZ33Q=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    django
+    psycopg
+  ];
+
+  pythonImportsCheck = [ "django_tenants" ];
+
+  meta = {
+    description = "Django tenants using PostgreSQL Schemas";
+    homepage = "https://github.com/django-tenants/django-tenants";
+    changelog = "https://github.com/django-tenants/django-tenants/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jopejoe1 ];
+  };
+}
--- a/pkgs/development/python-modules/home-assistant-chip-core/default.nix
+++ b/pkgs/development/python-modules/home-assistant-chip-core/default.nix
@ -44,7 +44,7 @@ buildPythonPackage rec {
    deprecation
    mobly
    pygobject3
-  ];
+  ] ++ home-assistant-chip-wheels.propagatedBuildInputs;

  pythonNamespaces = [
    "chip"
--- a/pkgs/development/python-modules/home-assistant-chip-wheels/default.nix
+++ b/pkgs/development/python-modules/home-assistant-chip-wheels/default.nix
@ -118,7 +118,7 @@ stdenv.mkDerivation rec {
    yapf
  ];

-  buildInputs = [
+  propagatedBuildInputs = [
    openssl
    glib
    libnl
--- a/pkgs/development/python-modules/pyside6/default.nix
+++ b/pkgs/development/python-modules/pyside6/default.nix
@ -1,6 +1,7 @@
 {
  lib,
  stdenv,
+  fetchpatch,
  cmake,
  cups,
  ninja,
@ -57,7 +58,14 @@ stdenv.mkDerivation (finalAttrs: {

  inherit (shiboken6) version src;

-  sourceRoot = "pyside-setup-everywhere-src-${finalAttrs.version}/sources/pyside6";
+  sourceRoot = "pyside-setup-everywhere-src-6.8.0/sources/pyside6";
+
+  patches = [
+    # Manual backport of https://code.qt.io/cgit/pyside/pyside-setup.git/patch/?id=cacc9c5803a6dec820dd46211a836453183c8dab
+    # to fit our structure.
+    # FIXME: remove for 6.8.1
+    ./fix-installing-docs.patch
+  ];

  # cmake/Macros/PySideModules.cmake supposes that all Qt frameworks on macOS
  # reside in the same directory as QtCore.framework, which is not true for Nix.
--- a/pkgs/development/python-modules/pyside6/fix-installing-docs.patch
+++ b/pkgs/development/python-modules/pyside6/fix-installing-docs.patch
@ -0,0 +1,25 @@
+--- a/cmake/Macros/PySideModules.cmake
+++ b/cmake/Macros/PySideModules.cmake
+@@ -176,6 +176,14 @@ macro(create_pyside_module)
+         set(${module_NAME}_glue_dependency ${${module_NAME}_glue})
+     endif()
+ 
+    # Install module doc files.
+    set(${module_NAME}_doc "${CMAKE_CURRENT_SOURCE_DIR}/../doc/${lower_module_name}.rst")
+    set(${module_name}_doc_dependency "")
+    if(EXISTS ${${module_NAME}_doc})
+        install(FILES ${${module_NAME}_doc} DESTINATION share/PySide6${pyside6_SUFFIX}/doc)
+        set(${module_NAME}_doc_dependency ${${module_NAME}_doc})
+    endif()
+
+     # Install standalone glue files into typesystems subfolder, so that the resolved relative
+     # paths remain correct.
+     if (module_GLUE_SOURCES)
+@@ -245,6 +253,7 @@ macro(create_pyside_module)
+                         DEPENDS ${total_type_system_files}
+                                 ${module_GLUE_SOURCES}
+                                 ${${module_NAME}_glue_dependency}
+                                ${${module_NAME}_doc_dependency}
+                         WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+                         COMMENT "Running generator for ${module_NAME}...")
+ 
--- a/pkgs/development/python-modules/shiboken6/default.nix
+++ b/pkgs/development/python-modules/shiboken6/default.nix
@ -13,16 +13,16 @@ let
 in
 stdenv'.mkDerivation (finalAttrs: {
  pname = "shiboken6";
-  version = "6.8";
+  version = "6.8.0.2";

  src = fetchurl {
    # https://download.qt.io/official_releases/QtForPython/shiboken6/
    # FIXME: inconsistent version numbers in directory name and tarball?
-    url = "mirror://qt/official_releases/QtForPython/shiboken6/PySide6-${finalAttrs.version}.0-src/pyside-setup-everywhere-src-${finalAttrs.version}.tar.xz";
-    hash = "sha256-XAWtOufnJ51tudyUpG6woF/Qk1NzCfdDnDhnG9clUZA=";
+    url = "mirror://qt/official_releases/QtForPython/shiboken6/PySide6-6.8.0.2-src/pyside-setup-everywhere-src-6.8.0.tar.xz";
+    hash = "sha256-Ghohmo8yfjQNJYJ1+tOp8mG48EvFcEF0fnPdatJStOE=";
  };

-  sourceRoot = "pyside-setup-everywhere-src-${finalAttrs.version}/sources/shiboken6";
+  sourceRoot = "pyside-setup-everywhere-src-6.8.0/sources/shiboken6";

  patches = [ ./fix-include-qt-headers.patch ];

--- a/pkgs/development/python-modules/sphinx-sitemap/default.nix
+++ b/pkgs/development/python-modules/sphinx-sitemap/default.nix
@ -5,6 +5,7 @@
  setuptools,
  sphinx,
  sphinx-pytest,
+  defusedxml,
  pytestCheckHook,
 }:
 let
@ -29,6 +30,7 @@ buildPythonPackage {
  nativeCheckInputs = [
    pytestCheckHook
    sphinx-pytest
+    defusedxml
  ];

  meta = with lib; {
--- a/pkgs/development/python-modules/tenant-schemas-celery/default.nix
+++ b/pkgs/development/python-modules/tenant-schemas-celery/default.nix
@ -0,0 +1,34 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  celery,
+}:
+
+buildPythonPackage rec {
+  pname = "tenant-schemas-celery";
+  version = "3.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "maciej-gol";
+    repo = "tenant-schemas-celery";
+    rev = "refs/tags/${version}";
+    hash = "sha256-3ZUXSAOBMtj72sk/VwPV24ysQK+E4l1HdwKa78xrDtg=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ celery ];
+
+  pythonImportsCheck = [ "tenant_schemas_celery" ];
+
+  meta = {
+    description = "Celery application implementation that allows celery tasks to cooperate with multi-tenancy provided by django-tenant-schemas and django-tenants packages";
+    homepage = "https://github.com/maciej-gol/tenant-schemas-celery";
+    changelog = "https://github.com/maciej-gol/tenant-schemas-celery/releases/tag/${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jopejoe1 ];
+  };
+}
--- a/pkgs/development/tools/build-managers/xmake/default.nix
+++ b/pkgs/development/tools/build-managers/xmake/default.nix
@ -4,25 +4,22 @@
  fetchurl,
  fetchpatch,
  CoreServices,
+  nix-update-script,
 }:
 stdenv.mkDerivation rec {
  pname = "xmake";
-  version = "2.9.5";
+  version = "2.9.6";
  src = fetchurl {
    url = "https://github.com/xmake-io/xmake/releases/download/v${version}/xmake-v${version}.tar.gz";
-    hash = "sha256-A/61eH4i+rjdQEGew9hKvTWrzZ+KGyTEiMfrVx1nJMg=";
+    hash = "sha256-R/bvywD5DJigLDlflztNVb3TqP5FJnbc5XtVwFV1loY=";
  };

-  patches = [
-    (fetchpatch {
-      name = "xmake-fix-configure-compatibility.patch";
-      url = "https://github.com/xmake-io/xmake/commit/2a1220727a367e753b92131577ab0c2fd974bff8.patch";
-      hash = "sha256-xknlyydHvdwqTl975VQogKozT8nAp5+gPZQuRl1yXKE=";
-    })
-  ];
-
  buildInputs = lib.optional stdenv.hostPlatform.isDarwin CoreServices;

+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
  meta = with lib; {
    description = "Cross-platform build utility based on Lua";
    homepage = "https://xmake.io";
--- a/pkgs/development/tools/haskell/hadrian/make-hadrian.nix
+++ b/pkgs/development/tools/haskell/hadrian/make-hadrian.nix
@ -52,7 +52,4 @@ callPackage' ./hadrian.nix ({
  # to build hadrian. (Hackage-released conditional dependencies are handled
  # in ./hadrian.nix without requiring intervention here.)
  inherit ghc-platform ghc-toolchain;
-} // lib.optionalAttrs (lib.versionAtLeast ghcVersion "9.11") {
-  # See https://gitlab.haskell.org/ghc/ghc/-/commit/145a6477854d4003a07573d5e7ffa0c9a64ae29c
-  Cabal = bootPkgs.Cabal_3_14_0_0;
 })
--- a/pkgs/games/ecwolf/default.nix
+++ b/pkgs/games/ecwolf/default.nix
@ -11,6 +11,9 @@
 , SDL2_net
 , SDL2_mixer
 , gtk3
+, writers
+, python3Packages
+, nix-update
 }:

 stdenv.mkDerivation rec {
@ -40,6 +43,33 @@ stdenv.mkDerivation rec {
    makeWrapper $out/{Applications/ecwolf.app/Contents/MacOS,bin}/ecwolf
  '';

+  passthru.updateScript = let
+    updateScriptPkg = writers.writePython3 "ecwolf_update_script" {
+      libraries = with python3Packages; [ debian-inspector requests ];
+    } ''
+      from os import execl
+      from sys import argv
+
+      from debian_inspector.debcon import get_paragraphs_data
+      from requests import get
+
+      # The debian.drdteam.org repo is a primary source of information. It’s
+      # run by Blzut3, the creator and primary developer of ECWolf. It’s also
+      # listed on ECWolf’s download page:
+      # <https://maniacsvault.net/ecwolf/download.php>.
+      url = 'https://debian.drdteam.org/dists/stable/multiverse/binary-amd64/Packages'  # noqa: E501
+      response = get(url)
+      packages = get_paragraphs_data(response.text)
+      for package in packages:
+          if package['package'] == 'ecwolf':
+              latest_version = package['version']
+              break
+      nix_update_path = argv[1]
+
+      execl(nix_update_path, nix_update_path, '--version', latest_version)
+    '';
+  in [ updateScriptPkg (lib.getExe nix-update) ];
+
  meta = with lib; {
    description = "Enhanched SDL-based port of Wolfenstein 3D for various platforms";
    mainProgram = "ecwolf";
--- a/pkgs/kde/gear/akonadi-search/default.nix
+++ b/pkgs/kde/gear/akonadi-search/default.nix
@ -7,7 +7,7 @@
  cargo,
  rustc,
  # provided as callPackage input to enable easier overrides through overlays
-  cargoHash ? "sha256-E+QaicYnFF79FDIhhvuEPQLikiLk5oKIjvLA132RUZo=",
+  cargoHash ? "sha256-9cwNQSw0ueWyyL/qgWXXqIRsi4Lk/DX48CIbvQFNgP8=",
 }:
 mkKdeDerivation rec {
  pname = "akonadi-search";
--- a/pkgs/kde/gear/angelfish/default.nix
+++ b/pkgs/kde/gear/angelfish/default.nix
@ -8,7 +8,7 @@
  cargo,
  rustc,
  # provided as callPackage input to enable easier overrides through overlays
-  cargoHash ? "sha256-B3M5tkmftR4nFbPAQqJDvvPidVGxq/8zH0KRgpBR92w=",
+  cargoHash ? "sha256-gE3wrRI8TaiA6LNqyrpEuw8ALnprGjzWQduCckG1Eo0=",
  qcoro,
 }:
 mkKdeDerivation rec {
--- a/pkgs/kde/gear/kalzium/default.nix
+++ b/pkgs/kde/gear/kalzium/default.nix
@ -1,6 +1,5 @@
 {
  mkKdeDerivation,
-  fetchpatch,
  pkg-config,
  ocaml,
  eigen,
@ -11,15 +10,6 @@
 mkKdeDerivation {
  pname = "kalzium";

-  patches = [
-    # Fix build with Qt 6.8
-    # FIXME: remove in next major update
-    (fetchpatch {
-      url = "https://invent.kde.org/education/kalzium/-/commit/557d9bc96636f413430d0789cbf775915fc0dc45.patch";
-      hash = "sha256-KDCT/COqk7OTuF8pN7qrRrIPRU4PSGm+efpCDGbtZwA=";
-    })
-  ];
-
  # FIXME: look into how to make it find libfacile
  extraNativeBuildInputs = [
    pkg-config
--- a/pkgs/kde/gear/kdepim-addons/default.nix
+++ b/pkgs/kde/gear/kdepim-addons/default.nix
@ -8,7 +8,7 @@
  corrosion,
  alpaka,
  # provided as callPackage input to enable easier overrides through overlays
-  cargoHash ? "sha256-t7izRAYjuCYA0YMZaCnvwbVo2UvfTTvdlYUd69T6w/Q=",
+  cargoHash ? "sha256-2t4i7lTJxVNjsU5eO6svadZBIerSyXt6BMScpEl119s=",
 }:
 mkKdeDerivation rec {
  pname = "kdepim-addons";
--- a/pkgs/kde/generated/sources/gear.json
+++ b/pkgs/kde/generated/sources/gear.json
--- a/pkgs/os-specific/bsd/freebsd/patches/14.1/mkimg-openbsd.patch
+++ b/pkgs/os-specific/bsd/freebsd/patches/14.1/mkimg-openbsd.patch
@ -0,0 +1,44 @@
+diff --git a/usr.bin/mkimg/gpt.c b/usr.bin/mkimg/gpt.c
+index ed3f008c394f..b4fb98682a4c 100644
+--- a/usr.bin/mkimg/gpt.c
+++ b/usr.bin/mkimg/gpt.c
+@@ -50,6 +50,7 @@ static mkimg_uuid_t gpt_uuid_freebsd_zfs = GPT_ENT_TYPE_FREEBSD_ZFS;
+ static mkimg_uuid_t gpt_uuid_mbr = GPT_ENT_TYPE_MBR;
+ static mkimg_uuid_t gpt_uuid_ms_basic_data = GPT_ENT_TYPE_MS_BASIC_DATA;
+ static mkimg_uuid_t gpt_uuid_prep_boot = GPT_ENT_TYPE_PREP_BOOT;
+static mkimg_uuid_t gpt_uuid_openbsd_ufs = GPT_ENT_TYPE_OPENBSD_DATA;
+ 
+ static struct mkimg_alias gpt_aliases[] = {
+     {	ALIAS_EFI, ALIAS_PTR2TYPE(&gpt_uuid_efi) },
+@@ -63,6 +64,7 @@ static struct mkimg_alias gpt_aliases[] = {
+     {	ALIAS_MBR, ALIAS_PTR2TYPE(&gpt_uuid_mbr) },
+     {	ALIAS_NTFS, ALIAS_PTR2TYPE(&gpt_uuid_ms_basic_data) },
+     {	ALIAS_PPCBOOT, ALIAS_PTR2TYPE(&gpt_uuid_prep_boot) },
+    {	ALIAS_OPENBSD_UFS, ALIAS_PTR2TYPE(&gpt_uuid_openbsd_ufs) },
+     {	ALIAS_NONE, 0 }		/* Keep last! */
+ };
+ 
+diff --git a/usr.bin/mkimg/scheme.c b/usr.bin/mkimg/scheme.c
+index 85ed94013e8d..00a3432c5328 100644
+--- a/usr.bin/mkimg/scheme.c
+++ b/usr.bin/mkimg/scheme.c
+@@ -56,6 +56,7 @@ static struct {
+ 	{ "mbr", ALIAS_MBR },
+ 	{ "ntfs", ALIAS_NTFS },
+ 	{ "prepboot", ALIAS_PPCBOOT },
+	{ "openbsd-ufs", ALIAS_OPENBSD_UFS },
+ 	{ NULL, ALIAS_NONE }		/* Keep last! */
+ };
+ 
+diff --git a/usr.bin/mkimg/scheme.h b/usr.bin/mkimg/scheme.h
+index 52614255595f..0c44f8653af2 100644
+--- a/usr.bin/mkimg/scheme.h
+++ b/usr.bin/mkimg/scheme.h
+@@ -45,6 +45,7 @@ enum alias {
+ 	ALIAS_MBR,
+ 	ALIAS_NTFS,
+ 	ALIAS_PPCBOOT,
+	ALIAS_OPENBSD_UFS,
+ 	/* end */
+ 	ALIAS_COUNT		/* Keep last! */
+ };
--- a/pkgs/os-specific/bsd/openbsd/pkgs/makefs/compat.patch
+++ b/pkgs/os-specific/bsd/openbsd/pkgs/makefs/compat.patch
@ -0,0 +1,343 @@
+diff --git a/usr.sbin/makefs/cd9660.c b/usr.sbin/makefs/cd9660.c
+index 9fbcc5d0dbc..6b68508585a 100644
+--- a/usr.sbin/makefs/cd9660.c
+++ b/usr.sbin/makefs/cd9660.c
+@@ -97,6 +97,7 @@
+   */
+ 
+ #include <sys/queue.h>
+#include <sys/param.h>
+ 
+ #include <string.h>
+ #include <ctype.h>
+diff --git a/usr.sbin/makefs/cd9660.h b/usr.sbin/makefs/cd9660.h
+index f3b8d2238be..178ab84bf04 100644
+--- a/usr.sbin/makefs/cd9660.h
+++ b/usr.sbin/makefs/cd9660.h
+@@ -37,7 +37,7 @@
+ #define _MAKEFS_CD9660_H
+ 
+ #include <sys/queue.h>
+-#include <sys/endian.h>
+#include <sys/param.h>
+ 
+ #include <assert.h>
+ #include <errno.h>
+diff --git a/usr.sbin/makefs/cd9660/cd9660_conversion.c b/usr.sbin/makefs/cd9660/cd9660_conversion.c
+index d010c4002cf..6722891d77d 100644
+--- a/usr.sbin/makefs/cd9660/cd9660_conversion.c
+++ b/usr.sbin/makefs/cd9660/cd9660_conversion.c
+@@ -34,9 +34,9 @@
+  */
+ #include "cd9660.h"
+ 
+-#define bswap16 swap16
+-#define bswap32 swap32
+-
+#include <arpa/inet.h>
+#define bswap16 htons
+#define bswap32 htonl
+ 
+ static char cd9660_compute_gm_offset(time_t);
+ 
+diff --git a/usr.sbin/makefs/cd9660/cd9660_strings.c b/usr.sbin/makefs/cd9660/cd9660_strings.c
+index dd0622e0f10..acc9006848b 100644
+--- a/usr.sbin/makefs/cd9660/cd9660_strings.c
+++ b/usr.sbin/makefs/cd9660/cd9660_strings.c
+@@ -34,6 +34,7 @@
+  */
+ 
+ #include <ctype.h>
+#include <stdint.h>
+ 
+ #include "makefs.h"
+ 
+diff --git a/usr.sbin/makefs/cd9660/iso.h b/usr.sbin/makefs/cd9660/iso.h
+index 3ed58d1dedc..96e7b96b35a 100644
+--- a/usr.sbin/makefs/cd9660/iso.h
+++ b/usr.sbin/makefs/cd9660/iso.h
+@@ -46,6 +46,8 @@
+ #ifndef _ISOFS_CD9660_ISO_H_
+ #define _ISOFS_CD9660_ISO_H_
+ 
+#include "compat.h"
+
+ #define ISODCL(from, to) (to - from + 1)
+ 
+ struct iso_volume_descriptor {
+diff --git a/usr.sbin/makefs/compat.h b/usr.sbin/makefs/compat.h
+new file mode 100644
+index 00000000000..8cc830662bd
+--- /dev/null
+++ b/usr.sbin/makefs/compat.h
+@@ -0,0 +1,71 @@
+#pragma once
+#include <stdint.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+
+#define u_int8_t uint8_t
+#define u_int16_t uint16_t
+#define u_int32_t uint32_t
+#define u_int64_t uint64_t
+typedef unsigned char u_char;
+typedef unsigned short u_short;
+typedef unsigned int u_int;
+typedef unsigned long u_long;
+typedef uint64_t dev_t;
+typedef int64_t off_t;
+#define __unused
+#define __dead
+#define pledge(x, y) 0
+#define unveil(x, y) 0
+#define srandom_deterministic srandom
+#define     MAXBSIZE        (64 * 1024)
+
+static inline void errc(int status, int code, const char *fmt, ...) {
+	// TODO
+	printf("You're outta here!\n");
+	exit(status);
+}
+
+static inline void warnc(int code, const char *fmt, ...) {
+	// TODO
+	printf("You're outta here!\n");
+}
+
+static inline int scan_scaled(char* number_w_scale, long long *result) {
+	int number, fraction = 0;
+	char scale[3];
+	long long tresult;
+	if (sscanf(number_w_scale, "%d.%1d%2s", &number, &fraction, &scale[0]) == 3 ||
+	    sscanf(number_w_scale, "%d%2s", &number, &scale[0]) == 2) {
+		tresult = number * 10 + fraction;
+		switch (scale[0]) {
+			case 'E':
+				tresult *= 1024;
+			case 'P':
+				tresult *= 1024;
+			case 'T':
+				tresult *= 1024;
+			case 'G':
+				tresult *= 1024;
+			case 'M':
+				tresult *= 1024;
+			case 'K':
+				tresult *= 1024;
+			case 'B':
+			case ' ':
+			case '\0':
+				break;
+			default:
+				errno = EINVAL;
+				return -1;
+		}
+		tresult /= 10;
+		*result = tresult;
+		return 0;
+	} else {
+		errno = EINVAL;
+		return -1;
+	}
+}
+diff --git a/usr.sbin/makefs/ffs.c b/usr.sbin/makefs/ffs.c
+index b055c62a598..c99cbfef5a7 100644
+--- a/usr.sbin/makefs/ffs.c
+++ b/usr.sbin/makefs/ffs.c
+@@ -198,7 +198,7 @@ ffs_parse_opts(const char *option, fsinfo_t *fsopts)
+ 	if (strcmp(ffs_options[rv].name, "disklabel") == 0) {
+ 		struct disklabel *dp;
+ 
+-		dp = getdiskbyname(buf);
+		dp = NULL;
+ 		if (dp == NULL)
+ 			errx(1, "unknown disk type: %s", buf);
+ 
+@@ -603,8 +603,8 @@ ffs_build_dinode1(struct ufs1_dinode *dinp, dirbuf_t *dbufp, fsnode *cur,
+ 	dinp->di_mode = cur->inode->st.st_mode;
+ 	dinp->di_nlink = cur->inode->nlink;
+ 	dinp->di_size = cur->inode->st.st_size;
+-	dinp->di_flags = cur->inode->st.st_flags;
+-	dinp->di_gen = cur->inode->st.st_gen;
+	dinp->di_flags = 0;
+	dinp->di_gen = 0;
+ 	dinp->di_uid = cur->inode->st.st_uid;
+ 	dinp->di_gid = cur->inode->st.st_gid;
+ 
+@@ -645,8 +645,8 @@ ffs_build_dinode2(struct ufs2_dinode *dinp, dirbuf_t *dbufp, fsnode *cur,
+ 	dinp->di_mode = cur->inode->st.st_mode;
+ 	dinp->di_nlink = cur->inode->nlink;
+ 	dinp->di_size = cur->inode->st.st_size;
+-	dinp->di_flags = cur->inode->st.st_flags;
+-	dinp->di_gen = cur->inode->st.st_gen;
+	dinp->di_flags = 0;
+	dinp->di_gen = 0;
+ 	dinp->di_uid = cur->inode->st.st_uid;
+ 	dinp->di_gid = cur->inode->st.st_gid;
+ 
+diff --git a/usr.sbin/makefs/ffs/buf.c b/usr.sbin/makefs/ffs/buf.c
+index ce512c7d389..8130f7e9cbc 100644
+--- a/usr.sbin/makefs/ffs/buf.c
+++ b/usr.sbin/makefs/ffs/buf.c
+@@ -47,6 +47,7 @@
+ 
+ #include "makefs.h"
+ #include "buf.h"
+#include "compat.h"
+ 
+ TAILQ_HEAD(buftailhead,mkfsbuf) buftail;
+ 
+diff --git a/usr.sbin/makefs/include/machine/disklabel.h b/usr.sbin/makefs/include/machine/disklabel.h
+new file mode 100644
+index 00000000000..7c5aa45c998
+--- /dev/null
+++ b/usr.sbin/makefs/include/machine/disklabel.h
+@@ -0,0 +1,7 @@
+#define LABELSECTOR 1
+#define LABELOFFSET 0
+#define MAXPARTITIONS 16
+
+static inline struct disklabel *getdiskbyname(const char *name) {
+	return (void*)0;
+}
+diff --git a/usr.sbin/makefs/include/msdosfs/bootsect.h b/usr.sbin/makefs/include/msdosfs/bootsect.h
+new file mode 100644
+index 00000000000..02e88ac2b9c
+--- /dev/null
+++ b/usr.sbin/makefs/include/msdosfs/bootsect.h
+@@ -0,0 +1 @@
+#include <bsdroot/sys/msdosfs/bootsect.h>
+diff --git a/usr.sbin/makefs/include/msdosfs/bpb.h b/usr.sbin/makefs/include/msdosfs/bpb.h
+new file mode 100644
+index 00000000000..08598cc217b
+--- /dev/null
+++ b/usr.sbin/makefs/include/msdosfs/bpb.h
+@@ -0,0 +1 @@
+#include <bsdroot/sys/msdosfs/bpb.h>
+diff --git a/usr.sbin/makefs/include/sys/disklabel.h b/usr.sbin/makefs/include/sys/disklabel.h
+new file mode 100644
+index 00000000000..f382f87226c
+--- /dev/null
+++ b/usr.sbin/makefs/include/sys/disklabel.h
+@@ -0,0 +1 @@
+#include <bsdroot/sys/sys/disklabel.h>
+diff --git a/usr.sbin/makefs/include/sys/endian.h b/usr.sbin/makefs/include/sys/endian.h
+new file mode 100644
+index 00000000000..e69de29bb2d
+diff --git a/usr.sbin/makefs/include/sys/uuid.h b/usr.sbin/makefs/include/sys/uuid.h
+new file mode 100644
+index 00000000000..7c2abace377
+--- /dev/null
+++ b/usr.sbin/makefs/include/sys/uuid.h
+@@ -0,0 +1,2 @@
+#include "compat.h"
+#include <bsdroot/sys/sys/uuid.h>
+diff --git a/usr.sbin/makefs/include/ufs/ffs/fs.h b/usr.sbin/makefs/include/ufs/ffs/fs.h
+new file mode 100644
+index 00000000000..d7905d33c2a
+--- /dev/null
+++ b/usr.sbin/makefs/include/ufs/ffs/fs.h
+@@ -0,0 +1,2 @@
+#include "compat.h"
+#include <bsdroot/sys/ufs/ffs/fs.h>
+diff --git a/usr.sbin/makefs/include/ufs/ufs/dinode.h b/usr.sbin/makefs/include/ufs/ufs/dinode.h
+new file mode 100644
+index 00000000000..0d29007bdd1
+--- /dev/null
+++ b/usr.sbin/makefs/include/ufs/ufs/dinode.h
+@@ -0,0 +1,2 @@
+#include "compat.h"
+#include <bsdroot/sys/ufs/ufs/dinode.h>
+diff --git a/usr.sbin/makefs/include/ufs/ufs/dir.h b/usr.sbin/makefs/include/ufs/ufs/dir.h
+new file mode 100644
+index 00000000000..9ec3e81be3d
+--- /dev/null
+++ b/usr.sbin/makefs/include/ufs/ufs/dir.h
+@@ -0,0 +1 @@
+#include <bsdroot/sys/ufs/ufs/dir.h>
+diff --git a/usr.sbin/makefs/include/util.h b/usr.sbin/makefs/include/util.h
+new file mode 100644
+index 00000000000..e69de29bb2d
+diff --git a/usr.sbin/makefs/makefs.c b/usr.sbin/makefs/makefs.c
+index af39605d996..10d86fa10e2 100644
+--- a/usr.sbin/makefs/makefs.c
+++ b/usr.sbin/makefs/makefs.c
+@@ -44,8 +44,10 @@
+ #include <string.h>
+ #include <unistd.h>
+ #include <util.h>
+#include <time.h>
+ 
+ #include "makefs.h"
+#include "compat.h"
+ 
+ /*
+  * list of supported file systems and dispatch functions
+diff --git a/usr.sbin/makefs/makefs.h b/usr.sbin/makefs/makefs.h
+index 303ec7a2c46..6d72859532e 100644
+--- a/usr.sbin/makefs/makefs.h
+++ b/usr.sbin/makefs/makefs.h
+@@ -41,6 +41,8 @@
+ 
+ #include <sys/stat.h>
+ #include <err.h>
+#include <stdint.h>
+#include <stddef.h>
+ 
+ /*
+  * fsnode -
+diff --git a/usr.sbin/makefs/msdos/denode.h b/usr.sbin/makefs/msdos/denode.h
+index 48cdf968945..baf3dc3d807 100644
+--- a/usr.sbin/makefs/msdos/denode.h
+++ b/usr.sbin/makefs/msdos/denode.h
+@@ -50,6 +50,8 @@
+ #ifndef _MSDOSFS_DENODE_H_
+ #define _MSDOSFS_DENODE_H_
+ 
+#include "compat.h"
+
+ struct genfs_node {
+ };
+ struct mkfsvnode;
+diff --git a/usr.sbin/makefs/msdos/direntry.h b/usr.sbin/makefs/msdos/direntry.h
+index 77f8d7dd657..9c3a19bae8c 100644
+--- a/usr.sbin/makefs/msdos/direntry.h
+++ b/usr.sbin/makefs/msdos/direntry.h
+@@ -48,6 +48,8 @@
+  * October 1992
+  */
+ 
+#include "compat.h"
+
+ /*
+  * Structure of a dos directory entry.
+  */
+diff --git a/usr.sbin/makefs/msdos/mkfs_msdos.c b/usr.sbin/makefs/msdos/mkfs_msdos.c
+index c9aa0877b7a..e72f1680585 100644
+--- a/usr.sbin/makefs/msdos/mkfs_msdos.c
+++ b/usr.sbin/makefs/msdos/mkfs_msdos.c
+@@ -596,7 +596,6 @@ mkfs_msdos(const char *fname, const char *dtype, const struct msdos_options *op)
+     tm = localtime(&now);
+     img = emalloc(bpb.bps);
+     dir = bpb.res + (bpb.spf ? bpb.spf : bpb.bspf) * bpb.nft;
+-    signal(SIGINFO, infohandler);
+     for (lsn = 0; lsn < dir + (o.fat_type == 32 ? bpb.spc : rds); lsn++) {
+         if (got_siginfo) {
+             fprintf(stderr,"%s: writing sector %u of %u (%u%%)\n",
+diff --git a/usr.sbin/makefs/msdos/msdosfs_conv.c b/usr.sbin/makefs/msdos/msdosfs_conv.c
+index 7b73c19bd6e..d38f035a87c 100644
+--- a/usr.sbin/makefs/msdos/msdosfs_conv.c
+++ b/usr.sbin/makefs/msdos/msdosfs_conv.c
+@@ -52,8 +52,8 @@
+  * System include files.
+  */
+ #include <sys/time.h>
+-#include <sys/dirent.h>
+-#include <sys/lock.h>
+#include <sys/param.h>  // howmany
+#include "compat.h"
+ 
+ /*
+  * MSDOSFS include files.
--- a/pkgs/os-specific/bsd/openbsd/pkgs/makefs/package.nix
+++ b/pkgs/os-specific/bsd/openbsd/pkgs/makefs/package.nix
@ -0,0 +1,17 @@
+{ mkDerivation, lib }:
+mkDerivation {
+  path = "usr.sbin/makefs";
+  extraPaths = [
+    "sys/sys"
+    "sys/ufs"
+    "sys/msdosfs"
+    "sys/dev"
+  ];
+  patches = [ ./compat.patch ];
+  preBuild = ''
+    mkdir -p $BSDSRCDIR/usr.sbin/makefs/include
+    ln -s $BSDSRCDIR $BSDSRCDIR/usr.sbin/makefs/include/bsdroot
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -I$BSDSRCDIR/usr.sbin/makefs/include"
+  '';
+  meta.platforms = lib.platforms.all;
+}
--- a/pkgs/os-specific/bsd/openbsd/pkgs/stand.nix
+++ b/pkgs/os-specific/bsd/openbsd/pkgs/stand.nix
@ -0,0 +1,32 @@
+{
+  mkDerivation,
+  stdenv,
+  pkgsBuildTarget,
+}:
+
+mkDerivation {
+  path = "sys/arch/amd64/stand";
+  extraPaths = [ "sys" ];
+
+  # gcc compat
+  postPatch = ''
+    find $BSDSRCDIR -name Makefile -print0 | xargs -0 sed -E -i -e 's/-nopie/-no-pie/g'
+    substituteInPlace $BSDSRCDIR/sys/arch/*/stand/boot/check-boot.pl --replace-fail /usr/bin/objdump objdump
+    substituteInPlace $BSDSRCDIR/sys/arch/*/stand/Makefile --replace-quiet " boot " " " --replace-quiet " fdboot " " "
+  '';
+
+  # expects to be able to use unprefixed programs
+  # needs gnu assembler + objdump + objcopy
+  # this is really not designed for cross...
+  preBuild = ''
+    mkdir $TMP/bin
+    export PATH=$TMP/bin:$PATH
+    ln -s ${stdenv.cc}/bin/${stdenv.cc.targetPrefix}size $TMP/bin/size
+    ln -s ${pkgsBuildTarget.binutils}/bin/${pkgsBuildTarget.binutils.targetPrefix}as $TMP/bin/as
+    ln -s ${pkgsBuildTarget.binutils}/bin/${pkgsBuildTarget.binutils.targetPrefix}objdump $TMP/bin/objdump
+    ln -s ${pkgsBuildTarget.binutils}/bin/${pkgsBuildTarget.binutils.targetPrefix}objcopy $TMP/bin/objcopy
+    ln -s ${pkgsBuildTarget.binutils}/bin/${pkgsBuildTarget.binutils.targetPrefix}objcopy $TMP/bin/
+
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -Wno-pointer-sign"
+  '';
+}
--- a/pkgs/os-specific/linux/kernel/perf/default.nix
+++ b/pkgs/os-specific/linux/kernel/perf/default.nix
@ -59,7 +59,7 @@ stdenv.mkDerivation {
  pname = "perf-linux";
  inherit (kernel) version src;

-  patches = [
+  patches = lib.optionals (lib.versionAtLeast kernel.version "5.10") [
    # fix wrong path to dmesg
    ./fix-dmesg-path.diff
  ] ++ lib.optionals (lib.versions.majorMinor kernel.version == "6.10") [
@ -143,7 +143,12 @@ stdenv.mkDerivation {
  ++ lib.optional withZstd zstd
  ++ lib.optional withLibcap libcap
  ++ lib.optional (lib.versionAtLeast kernel.version "5.8") libpfm
-  ++ lib.optional (lib.versionAtLeast kernel.version "6.0") python3.pkgs.setuptools;
+  ++ lib.optional (lib.versionAtLeast kernel.version "6.0") python3.pkgs.setuptools
+  # Python 3.12 no longer includes distutils, not needed for 6.0 and newer.
+  ++ lib.optional (!(lib.versionAtLeast kernel.version "6.0") && lib.versionAtLeast python3.version "3.12") [
+    python3.pkgs.distutils
+    python3.pkgs.packaging
+  ];

  env.NIX_CFLAGS_COMPILE = toString [
    "-Wno-error=cpp"
--- a/pkgs/servers/mautrix-signal/default.nix
+++ b/pkgs/servers/mautrix-signal/default.nix
@ -1,10 +1,12 @@
 {
  lib,
+  stdenv,
  buildGoModule,
  fetchFromGitHub,
  fetchpatch,
  olm,
  libsignal-ffi,
+  versionCheckHook,
  # This option enables the use of an experimental pure-Go implementation of
  # the Olm protocol instead of libolm for end-to-end encryption. Using goolm
  # is not recommended by the mautrix developers, but they are interested in
@ -32,16 +34,39 @@ buildGoModule rec {
    })
  ];

-  buildInputs = (lib.optional (!withGoolm) olm) ++ [
-    # must match the version used in https://github.com/mautrix/signal/tree/main/pkg/libsignalgo
-    # see https://github.com/mautrix/signal/issues/401
-    libsignal-ffi
-  ];
+  buildInputs =
+    (lib.optional (!withGoolm) olm)
+    ++ (lib.optional withGoolm stdenv.cc.cc.lib)
+    ++ [
+      # must match the version used in https://github.com/mautrix/signal/tree/main/pkg/libsignalgo
+      # see https://github.com/mautrix/signal/issues/401
+      libsignal-ffi
+    ];
+
  tags = lib.optional withGoolm "goolm";

+  CGO_LDFLAGS = lib.optional withGoolm [ "-lstdc++" ];
+
  vendorHash = "sha256-bKQKO5RqgMrWq7NyNF1rj2CLp5SeBP80HWxF8MWnZ1U=";

-  doCheck = false;
+  doCheck = true;
+  preCheck =
+    ''
+      # Needed by the tests to be able to find libstdc++
+      export LD_LIBRARY_PATH="${stdenv.cc.cc.lib}/lib:$LD_LIBRARY_PATH"
+    ''
+    + (lib.optionalString (!withGoolm) ''
+      # When using libolm, the tests need explicit linking to libstdc++
+      export CGO_LDFLAGS="-lstdc++"
+    '');
+
+  postCheck = ''
+    unset LD_LIBRARY_PATH
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = [ "--version" ];

  meta = with lib; {
    homepage = "https://github.com/mautrix/signal";
--- a/pkgs/tools/misc/gaphor/default.nix
+++ b/pkgs/tools/misc/gaphor/default.nix
@ -4,16 +4,23 @@
 , copyDesktopItems
 , gobject-introspection
 , poetry-core
-, wrapGAppsHook3
-, gtksourceview4
+, wrapGAppsHook4
+, gtksourceview5
+, libadwaita
 , pango
 , gaphas
 , generic
 , jedi
 , pycairo
+, pillow
+, dulwich
+, pydot
+, defusedxml
+, better-exceptions
+, babel
 , pygobject3
 , tinycss2
-, gtk3
+, gtk4
 , librsvg
 , makeDesktopItem
 , python
@ -21,34 +28,43 @@

 buildPythonApplication rec {
  pname = "gaphor";
-  version = "2.8.2";
-
-  format = "pyproject";
+  version = "2.26.0";
+  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-+qqsSLjdY2I19fxdfkOEQ9DhTTHccUDll4O5yqtLiz0=";
+    hash = "sha256-e0K5bfgPqlJh8qrAz40c/w3ANzkfa/6txuqzQDJYXfE=";
  };

+  pythonRelaxDeps = [ "defusedxml" ];
+
  nativeBuildInputs = [
    copyDesktopItems
    gobject-introspection
-    poetry-core
-    wrapGAppsHook3
+    wrapGAppsHook4
  ];

  buildInputs = [
-    gtksourceview4
+    gtksourceview5
    pango
+    libadwaita
  ];

-  propagatedBuildInputs = [
-    gaphas
-    generic
-    jedi
+  build-system = [ poetry-core ];
+
+  dependencies = [
    pycairo
    pygobject3
+    gaphas
+    generic
    tinycss2
+    babel
+    jedi
+    better-exceptions
+    pydot
+    pillow
+    defusedxml
+    dulwich
  ];

  desktopItems = [
@ -61,7 +77,7 @@ buildPythonApplication rec {
    })
  ];

-  # Disable automatic wrapGAppsHook3 to prevent double wrapping
+  # Disable automatic wrapGAppsHook4 to prevent double wrapping
  dontWrapGApps = true;

  postInstall = ''
@ -71,7 +87,7 @@ buildPythonApplication rec {
  preFixup = ''
    makeWrapperArgs+=(
      "''${gappsWrapperArgs[@]}" \
-      --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}/" \
+      --prefix XDG_DATA_DIRS : "${gtk4}/share/gsettings-schemas/${gtk4.name}/" \
      --set GDK_PIXBUF_MODULE_FILE "${librsvg.out}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache"
    )
  '';
@ -81,6 +97,6 @@ buildPythonApplication rec {
    maintainers = [ ];
    homepage = "https://github.com/gaphor/gaphor";
    license = licenses.asl20;
-    platforms = [ "x86_64-linux" ];
+    platforms = lib.platforms.linux;
  };
 }
--- a/pkgs/tools/networking/mailctl/default.nix
+++ b/pkgs/tools/networking/mailctl/default.nix
@ -0,0 +1,97 @@
+{ mkDerivation
+, fetchFromGitHub
+, aeson
+, base
+, base64
+, bytestring
+, containers
+, directory
+, hsyslog
+, http-conduit
+, lib
+, network-uri
+, optparse-applicative
+, pretty-simple
+, process
+, random
+, strings
+, template-haskell
+, text
+, time
+, twain
+, unix
+, utf8-string
+, warp
+, yaml
+}:
+mkDerivation rec {
+  pname = "mailctl";
+  version = "0.9.2";
+
+  src = fetchFromGitHub {
+    owner = "pdobsan";
+    repo = "mailctl";
+    rev = version;
+    hash = "sha256-frT+fRJpixSvpb2+C34Z47zbMqvmDHdESItXb9YVbfU=";
+  };
+
+  isLibrary = true;
+  isExecutable = true;
+
+  libraryHaskellDepends = [
+    aeson
+    base
+    base64
+    bytestring
+    containers
+    directory
+    hsyslog
+    http-conduit
+    network-uri
+    optparse-applicative
+    pretty-simple
+    process
+    random
+    strings
+    template-haskell
+    text
+    time
+    twain
+    unix
+    utf8-string
+    warp
+    yaml
+  ];
+
+  executableHaskellDepends = [
+    aeson
+    base
+    base64
+    bytestring
+    containers
+    directory
+    hsyslog
+    http-conduit
+    network-uri
+    optparse-applicative
+    pretty-simple
+    process
+    random
+    strings
+    template-haskell
+    text
+    time
+    twain
+    unix
+    utf8-string
+    warp
+    yaml
+  ];
+
+  description = "OAuth2 tool for mail clients";
+  homepage = "https://github.com/pdobsan/mailctl";
+  changelog = "https://github.com/pdobsan/mailctl/releases/tag/${version}";
+  license = lib.licenses.bsd3;
+  maintainers = with lib.maintainers; [ aidalgol ];
+  mainProgram = "mailctl";
+}
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -1339,6 +1339,7 @@ mapAliases {

  yacc = throw "'yacc' has been renamed to/replaced by 'bison'"; # Converted to throw 2024-10-17
  yafaray-core = libyafaray; # Added 2022-09-23
+  yi = throw "'yi' has been removed, as it was broken and unmaintained"; # added 2024-05-09
  youtrack_2022_3 = throw "'youtrack_2022_3' has been removed as it was deprecated. Please update to the 'youtrack' package."; # Added 2024-10-17
  yrd = throw "'yrd' has been removed, as it was broken and unmaintained"; # added 2024-05-27

--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -13819,9 +13819,6 @@ with pkgs;

  ytfzf = callPackage ../tools/misc/ytfzf { };

-  # To expose more packages for Yi, override the extraPackages arg.
-  yi = callPackage ../applications/editors/yi/wrapper.nix { };
-
  yaydl = callPackage ../tools/video/yaydl {
    inherit (darwin.apple_sdk.frameworks) Security;
  };
@ -20433,8 +20430,6 @@ with pkgs;

  libchardet = callPackage ../development/libraries/libchardet { };

-  libchewing = callPackage ../development/libraries/libchewing { };
-
  libchipcard = callPackage ../development/libraries/aqbanking/libchipcard.nix { };

  libcrafter = callPackage ../development/libraries/libcrafter { };
@ -23974,11 +23969,6 @@ with pkgs;

  dmarc-metrics-exporter = callPackage ../servers/monitoring/prometheus/dmarc-metrics-exporter { };

-  dmlive = callPackage ../applications/video/dmlive {
-    inherit (darwin) configd;
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
-
  do-agent = callPackage ../servers/monitoring/do-agent { };

  dodgy = with python3Packages; toPythonApplication dodgy;
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -1591,6 +1591,8 @@ self: super: with self; {

  betamax-serializers = callPackage ../development/python-modules/betamax-serializers { };

+  better-exceptions = callPackage ../development/python-modules/better-exceptions { };
+
  betterproto = callPackage ../development/python-modules/betterproto { };

  beziers = callPackage ../development/python-modules/beziers { };
@ -3393,6 +3395,8 @@ self: super: with self; {

  django-csp = callPackage ../development/python-modules/django-csp { };

+  django-cte = callPackage ../development/python-modules/django-cte { };
+
  django-currentuser = callPackage ../development/python-modules/django-currentuser { };

  django-debug-toolbar = callPackage ../development/python-modules/django-debug-toolbar { };
@ -3497,6 +3501,10 @@ self: super: with self; {

  django-payments = callPackage ../development/python-modules/django-payments { };

+  django-pgactivity = callPackage ../development/python-modules/django-pgactivity { };
+
+  django-pglock = callPackage ../development/python-modules/django-pglock { };
+
  django-pglocks = callPackage ../development/python-modules/django-pglocks { };

  django-phonenumber-field = callPackage ../development/python-modules/django-phonenumber-field { };
@ -3597,6 +3605,8 @@ self: super: with self; {

  django-tastypie = callPackage ../development/python-modules/django-tastypie { };

+  django-tenants = callPackage ../development/python-modules/django-tenants { };
+
  django-timezone-field = callPackage ../development/python-modules/django-timezone-field { };

  django-tinymce = callPackage ../development/python-modules/django-tinymce { };
@ -15512,6 +15522,8 @@ self: super: with self; {

  tenacity = callPackage ../development/python-modules/tenacity { };

+  tenant-schemas-celery = callPackage ../development/python-modules/tenant-schemas-celery { };
+
  tencentcloud-sdk-python = callPackage ../development/python-modules/tencentcloud-sdk-python { };

  tendo = callPackage ../development/python-modules/tendo { };
--- a/pkgs/top-level/release-haskell.nix
+++ b/pkgs/top-level/release-haskell.nix
@ -379,7 +379,6 @@ let
        xmobar
        xmonadctl
        xmonad-with-packages
-        yi
        zsh-git-prompt
        ;

@ -561,8 +560,9 @@ let
        compilerNames.ghc9101
      ] released;
      Cabal_3_10_3_0 = released;
+      Cabal-syntax_3_10_3_0 = released;
      Cabal_3_12_1_0 = released;
-      Cabal_3_14_0_0 = released;
+      Cabal-syntax_3_12_1_0 = released;
      cabal2nix = lib.subtractLists [
        compilerNames.ghc9101
      ] released;
@ -590,6 +590,9 @@ let
      language-nix = lib.subtractLists [
        compilerNames.ghc9101
      ] released;
+      large-hashable = [
+        compilerNames.ghc928
+      ];
      nix-paths = released;
      titlecase = lib.subtractLists [
        compilerNames.ghc9101