Merge staging-next into staging

2024-11-21 22:43:01 +00:00 · 2024-10-28 18:05:09 +00:00 · 2024-10-28 18:05:09 +00:00 · 549b778c4e
commit 549b778c4e
parent 593d771826 a54a74f958
96 changed files with 1491 additions and 2711 deletions
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@ -217,9 +217,9 @@
    - changed-files:
      - any-glob-to-any-file:
        - doc/languages-frameworks/nim.section.md
-        - pkgs/development/compilers/nim/*
-        - pkgs/development/nim-packages/**/*
-        - pkgs/top-level/nim-packages.nix
+        - pkgs/build-support/build-nim-package.nix
+        - pkgs/by-name/ni/nim*
+        - pkgs/top-level/nim-overrides.nix

 "6.topic: nodejs":
  - any:
--- a/ci/OWNERS
+++ b/ci/OWNERS
@ -339,7 +339,9 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/by-name/ne/nemo-*        @mkg20001

 # nim
-/pkgs/development/compilers/nim   @ehmry
+/doc/languages-frameworks/nim.section.md  @ehmry
+/pkgs/build-support/build-nim-package.nix @ehmry
+/pkgs/top-level/nim-overrides.nix         @ehmry

 # terraform providers
 /pkgs/applications/networking/cluster/terraform-providers @zowoq
--- a/nixos/doc/manual/development/writing-nixos-tests.section.md
+++ b/nixos/doc/manual/development/writing-nixos-tests.section.md
@ -71,20 +71,20 @@ nix-build -A nixosTests.hostname

 ### Testing outside the NixOS project {#sec-call-nixos-test-outside-nixos}

-Outside the `nixpkgs` repository, you can instantiate the test by first importing the NixOS library,
+Outside the `nixpkgs` repository, you can use the `runNixOSTest` function from
+`pkgs.testers`:

 ```nix
-let nixos-lib = import (nixpkgs + "/nixos/lib") { };
+let pkgs = import <nixpkgs> {};
 in

-nixos-lib.runTest {
+pkgs.testers.runNixOSTest {
  imports = [ ./test.nix ];
-  hostPkgs = pkgs;  # the Nixpkgs package set used outside the VMs
  defaults.services.foo.package = mypkg;
 }
 ```

-`runTest` returns a derivation that runs the test.
+`runNixOSTest` returns a derivation that runs the test.

 ## Configuring the nodes {#sec-nixos-test-nodes}

--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@ -757,6 +757,8 @@

 - The arguments from [](#opt-services.postgresql.initdbArgs) now get shell-escaped.

+- Mattermost has been updated from 9.5 to 9.11 ESR. See the [changelog](https://docs.mattermost.com/about/mattermost-v9-changelog.html#release-v9-11-extended-support-release) for more details.
+
 - `cargo-tauri.hook` was introduced to help users build [Tauri](https://tauri.app/) projects. It is meant to be used alongside
  `rustPlatform.buildRustPackage` and Node hooks such as `npmConfigHook`, `pnpm.configHook`, and the new `yarnConfig`

--- a/nixos/modules/programs/_1password.nix
+++ b/nixos/modules/programs/_1password.nix
@ -17,7 +17,7 @@ in
      enable = lib.mkEnableOption "the 1Password CLI tool";

      package = lib.mkPackageOption pkgs "1Password CLI" {
-        default = [ "_1password" ];
+        default = [ "_1password-cli" ];
      };
    };
  };
--- a/nixos/modules/programs/wayland/uwsm.nix
+++ b/nixos/modules/programs/wayland/uwsm.nix
@ -108,18 +108,19 @@ in
    systemd.packages = [ cfg.package ];
    environment.pathsToLink = [ "/share/uwsm" ];

-    services.graphical-desktop.enable = true;
-
    # UWSM recommends dbus broker for better compatibility
    services.dbus.implementation = "broker";

-    services.displayManager.sessionPackages = lib.mapAttrsToList (
-      name: value:
-      mk_uwsm_desktop_entry {
-        inherit name;
-        inherit (value) prettyName comment binPath;
-      }
-    ) cfg.waylandCompositors;
+    services.displayManager = {
+      enable = true;
+      sessionPackages = lib.mapAttrsToList (
+        name: value:
+        mk_uwsm_desktop_entry {
+          inherit name;
+          inherit (value) prettyName comment binPath;
+        }
+      ) cfg.waylandCompositors;
+    };
  };

  meta.maintainers = with lib.maintainers; [
--- a/nixos/modules/services/misc/calibre-server.nix
+++ b/nixos/modules/services/misc/calibre-server.nix
@ -12,7 +12,7 @@ let
      "--port" = cfg.port;
      "--auth-mode" = cfg.auth.mode;
      "--userdb" = cfg.auth.userDb;
-    }) ++ [(lib.optionalString (cfg.auth.enable == true) "--enable-auth")])
+    }) ++ [ (lib.optionalString (cfg.auth.enable == true) "--enable-auth") ] ++ cfg.extraFlags)
  );
 in

@ -42,6 +42,15 @@ in
        '';
      };

+      extraFlags = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = ''
+          Extra flags to pass to the calibre-server command.
+          See the [calibre-server documentation](${generatedDocumentationLink}) for details.
+        '';
+      };
+
      user = lib.mkOption {
        type = lib.types.str;
        default = "calibre-server";
@ -73,6 +82,13 @@ in
        '';
      };

+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description =
+          "Open ports in the firewall for the Calibre Server web interface.";
+      };
+
      auth = {
        enable = lib.mkOption {
          type = lib.types.bool;
@ -137,6 +153,9 @@ in
      };
    };

+    networking.firewall =
+      lib.mkIf cfg.openFirewall { allowedTCPPorts = [ cfg.port ]; };
+
  };

  meta.maintainers = with lib.maintainers; [ gaelreyrol ];
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -849,8 +849,8 @@ in {
  qemu-vm-volatile-root = runTest ./qemu-vm-volatile-root.nix;
  qemu-vm-external-disk-image = runTest ./qemu-vm-external-disk-image.nix;
  qemu-vm-store = runTest ./qemu-vm-store.nix;
-  qgis = handleTest ./qgis.nix { qgisPackage = pkgs.qgis; };
-  qgis-ltr = handleTest ./qgis.nix { qgisPackage = pkgs.qgis-ltr; };
+  qgis = handleTest ./qgis.nix { package = pkgs.qgis; };
+  qgis-ltr = handleTest ./qgis.nix { package = pkgs.qgis-ltr; };
  qownnotes = handleTest ./qownnotes.nix {};
  qtile = handleTestOn ["x86_64-linux" "aarch64-linux"] ./qtile/default.nix {};
  quake3 = handleTest ./quake3.nix {};
--- a/nixos/tests/qgis.nix
+++ b/nixos/tests/qgis.nix
@ -1,5 +1,6 @@
-import ./make-test-python.nix ({ pkgs, lib, qgisPackage, ... }:
+import ./make-test-python.nix ({ pkgs, lib, package, ... }:
  let
+    qgisPackage = package.override { withServer = true; };
    testScript = pkgs.writeTextFile {
      name = "qgis-test.py";
      text = (builtins.readFile ../../pkgs/applications/gis/qgis/test.py);
@ -12,19 +13,74 @@ import ./make-test-python.nix ({ pkgs, lib, qgisPackage, ... }:
    };

    nodes = {
-      machine = { pkgs, ... }: {
+      machine = { config, pkgs, ... }:
+
+      let
+        qgisServerUser = config.services.nginx.user;
+        qgisServerSocket = "/run/qgis_mapserv.socket";
+      in
+      {
        virtualisation.diskSize = 2 * 1024;

        imports = [ ./common/x11.nix ];
-        environment.systemPackages = [ qgisPackage ];
+        environment.systemPackages = [
+          qgisPackage
+        ];

+        systemd.sockets.qgis-server = {
+          listenStreams = [ qgisServerSocket ];
+          socketConfig = {
+            Accept = false;
+            SocketUser = qgisServerUser;
+            SocketMode = 0600;
+          };
+          wantedBy = ["sockets.target" "qgis-server.service"];
+          before = [ "qgis-server.service" ];
+        };
+
+        systemd.services.qgis-server = {
+          description = "QGIS server";
+          serviceConfig = {
+            User = qgisServerUser;
+            StandardOutput = "null";
+            StandardError = "journal";
+            StandardInput = "socket";
+            Environment = [
+              "QT_QPA_PLATFORM_PLUGIN_PATH=${pkgs.libsForQt5.qt5.qtbase}/${pkgs.libsForQt5.qt5.qtbase.qtPluginPrefix}/platforms"
+              "QGIS_SERVER_LOG_LEVEL=0"
+              "QGIS_SERVER_LOG_STDERR=1"
+            ];
+            ExecStart = "${qgisPackage}/lib/cgi-bin/qgis_mapserv.fcgi";
+          };
+          after = [ "network.target" ];
+          wantedBy = [ "multi-user.target" ];
+        };
+
+        services.nginx = {
+          enable = true;
+          virtualHosts."qgis" = {
+            locations."~".extraConfig = ''
+              gzip off;
+              include ${pkgs.nginx}/conf/fastcgi_params;
+              include ${pkgs.nginx}/conf/fastcgi.conf;
+              fastcgi_pass unix:${qgisServerSocket};
+            '';
+          };
+        };
      };
    };

    testScript = ''
      start_all()

+      # test desktop
      machine.succeed("${qgisPackage}/bin/qgis --version | grep 'QGIS ${qgisPackage.version}'")
      machine.succeed("${qgisPackage}/bin/qgis --code ${testScript}")
+
+      # test server
+      machine.succeed("${qgisPackage}/bin/qgis_mapserver --version | grep 'QGIS ${qgisPackage.version}'")
+
+      machine.succeed("curl --head http://localhost | grep 'Server:.*${qgisPackage.version}'")
+      machine.succeed("curl http://localhost/index.json | grep 'Landing page as JSON'")
    '';
  })
--- a/pkgs/applications/audio/ashuffle/default.nix
+++ b/pkgs/applications/audio/ashuffle/default.nix
@ -7,7 +7,6 @@
 , ninja
 , libmpdclient
 , yaml-cpp
-, darwin
 }:

 stdenv.mkDerivation rec {
@ -24,11 +23,14 @@ stdenv.mkDerivation rec {

  dontUseCmakeConfigure = true;
  nativeBuildInputs = [ cmake pkg-config meson ninja ];
-  buildInputs = [ libmpdclient yaml-cpp ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.CoreFoundation ];
+  buildInputs = [ libmpdclient yaml-cpp ];

  mesonFlags = [ "-Dunsupported_use_system_yamlcpp=true" ];

+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    NIX_LDFLAGS = "-framework CoreFoundation";
+  };
+
  meta = with lib; {
    homepage = "https://github.com/joshkunz/ashuffle";
    description = "Automatic library-wide shuffle for mpd";
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -2008,20 +2008,23 @@ in
    meta.homepage = "https://github.com/ackyshake/Spacegray.vim/";
  };

-  sqlite-lua = super.sqlite-lua.overrideAttrs (oa: {
-    postPatch =
-      let
-        libsqlite = "${sqlite.out}/lib/libsqlite3${stdenv.hostPlatform.extensions.sharedLibrary}";
-      in
-      ''
+  sqlite-lua = super.sqlite-lua.overrideAttrs (
+    oa:
+    let
+      libsqlite = "${sqlite.out}/lib/libsqlite3${stdenv.hostPlatform.extensions.sharedLibrary}";
+    in
+    {
+      postPatch = ''
        substituteInPlace lua/sqlite/defs.lua \
-          --replace "path = vim.g.sqlite_clib_path" "path = vim.g.sqlite_clib_path or ${lib.escapeShellArg libsqlite}"
+          --replace-fail "path = vim.g.sqlite_clib_path" "path = vim.g.sqlite_clib_path or '${lib.escapeShellArg libsqlite}'"
      '';

-    passthru = oa.passthru // {
-      initLua = ''vim.g.sqlite_clib_path = "${sqlite.out}/lib/libsqlite3${stdenv.hostPlatform.extensions.sharedLibrary}"'';
-    };
-  });
+      passthru = oa.passthru // {
+        initLua = ''vim.g.sqlite_clib_path = "${libsqlite}"'';
+      };
+      nvimRequireCheck = "sqlite";
+    }
+  );

  ssr = super.ssr-nvim.overrideAttrs {
    dependencies = with self; [ nvim-treesitter ];
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -4585,8 +4585,8 @@ let
        mktplcRef = {
          name = "svelte-vscode";
          publisher = "svelte";
-          version = "108.3.3";
-          hash = "sha256-q7w8DPzBLpD+13v7RnyDdC3ocDKAihHBVt3pnwSTwio=";
+          version = "109.1.0";
+          hash = "sha256-ozD9k/zfklwBJtc1WdC52hgJckxBgVRmcZOwSYboACM=";
        };
        meta = {
          changelog = "https://github.com/sveltejs/language-tools/releases";
--- a/pkgs/applications/gis/qgis/default.nix
+++ b/pkgs/applications/gis/qgis/default.nix
@ -8,11 +8,13 @@

 # unwrapped package parameters
 , withGrass ? false
+, withServer ? false
 , withWebKit ? false
 }:
 let
  qgis-unwrapped = libsForQt5.callPackage ./unwrapped.nix {
    withGrass = withGrass;
+    withServer = withServer;
    withWebKit = withWebKit;
  };
 in symlinkJoin rec {
--- a/pkgs/applications/gis/qgis/ltr.nix
+++ b/pkgs/applications/gis/qgis/ltr.nix
@ -8,11 +8,13 @@

 # unwrapped package parameters
 , withGrass ? false
+, withServer ? false
 , withWebKit ? false
 }:
 let
  qgis-ltr-unwrapped = libsForQt5.callPackage ./unwrapped-ltr.nix {
    withGrass = withGrass;
+    withServer = withServer;
    withWebKit = withWebKit;
  };
 in symlinkJoin rec {
--- a/pkgs/applications/gis/qgis/unwrapped-ltr.nix
+++ b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
@ -7,6 +7,7 @@
 , wrapQtAppsHook

 , withGrass
+, withServer
 , withWebKit

 , bison
@ -155,7 +156,10 @@ in mkDerivation rec {
    "-DWITH_PDAL=True"
    "-DENABLE_TESTS=False"
  ] ++ lib.optional (!withWebKit) "-DWITH_QTWEBKIT=OFF"
-    ++ lib.optional withGrass (let
+    ++ lib.optional withServer [
+    "-DWITH_SERVER=True"
+    "-DQGIS_CGIBIN_SUBDIR=${placeholder "out"}/lib/cgi-bin"
+  ] ++ lib.optional withGrass (let
        gmajor = lib.versions.major grass.version;
        gminor = lib.versions.minor grass.version;
      in "-DGRASS_PREFIX${gmajor}=${grass}/grass${gmajor}${gminor}"
--- a/pkgs/applications/gis/qgis/unwrapped.nix
+++ b/pkgs/applications/gis/qgis/unwrapped.nix
@ -7,6 +7,7 @@
 , wrapQtAppsHook

 , withGrass
+, withServer
 , withWebKit

 , bison
@ -157,7 +158,10 @@ in mkDerivation rec {
    "-DENABLE_TESTS=False"
    "-DQT_PLUGINS_DIR=${qtbase}/${qtbase.qtPluginPrefix}"
  ] ++ lib.optional (!withWebKit) "-DWITH_QTWEBKIT=OFF"
-    ++ lib.optional withGrass (let
+    ++ lib.optional withServer [
+    "-DWITH_SERVER=True"
+    "-DQGIS_CGIBIN_SUBDIR=${placeholder "out"}/lib/cgi-bin"
+  ] ++ lib.optional withGrass (let
        gmajor = lib.versions.major grass.version;
        gminor = lib.versions.minor grass.version;
      in "-DGRASS_PREFIX${gmajor}=${grass}/grass${gmajor}${gminor}"
--- a/pkgs/applications/misc/gollum/Gemfile.lock
+++ b/pkgs/applications/misc/gollum/Gemfile.lock
@ -5,7 +5,7 @@ GEM
    asciidoctor (2.0.23)
    base64 (0.2.0)
    builder (3.3.0)
-    concurrent-ruby (1.3.3)
+    concurrent-ruby (1.3.4)
    crass (1.0.6)
    creole (0.5.0)
    expression_parser (0.9.0)
@ -43,36 +43,38 @@ GEM
      mime-types (~> 3.4)
      rugged (~> 1.5)
    htmlentities (4.3.4)
-    i18n (1.14.5)
+    i18n (1.14.6)
      concurrent-ruby (~> 1.0)
-    json (2.7.2)
+    json (2.7.4)
    kramdown (2.4.0)
      rexml
    kramdown-parser-gfm (1.1.0)
      kramdown (~> 2.0)
-    loofah (2.22.0)
+    logger (1.6.1)
+    loofah (2.23.1)
      crass (~> 1.0.2)
      nokogiri (>= 1.12.0)
-    mime-types (3.5.2)
+    mime-types (3.6.0)
+      logger
      mime-types-data (~> 3.2015)
-    mime-types-data (3.2024.0702)
+    mime-types-data (3.2024.1001)
    mini_portile2 (2.8.7)
    multi_json (1.15.0)
    mustache (1.1.1)
    mustache-sinatra (2.0.0)
      mustache (~> 1.0)
-    mustermann (3.0.0)
+    mustermann (3.0.3)
      ruby2_keywords (~> 0.0.1)
    nokogiri (1.16.7)
      mini_portile2 (~> 2.8.2)
      racc (~> 1.4)
-    octicons (19.11.0)
+    octicons (19.12.0)
    org-ruby (0.9.12)
      rubypants (~> 0.2)
    psych (5.1.2)
      stringio
-    racc (1.8.0)
-    rack (3.1.7)
+    racc (1.8.1)
+    rack (3.1.8)
    rack-protection (4.0.0)
      base64 (>= 0.1.0)
      rack (>= 3.0.0, < 4)
@ -83,10 +85,9 @@ GEM
      webrick (~> 1.8)
    rdoc (6.7.0)
      psych (>= 4.0.0)
-    rexml (3.3.2)
-      strscan
+    rexml (3.3.9)
    rouge (3.30.0)
-    rss (0.3.0)
+    rss (0.3.1)
      rexml
    ruby2_keywords (0.0.5)
    rubypants (0.7.1)
@ -109,7 +110,6 @@ GEM
    sprockets-helpers (1.4.0)
      sprockets (>= 2.2)
    stringio (3.1.1)
-    strscan (3.1.0)
    therubyrhino (2.1.2)
      therubyrhino_jar (>= 1.7.4, < 1.7.9)
    therubyrhino_jar (1.7.8)
@ -120,7 +120,7 @@ GEM
      unf_ext
    unf_ext (0.0.9.1)
    useragent (0.16.10)
-    webrick (1.8.1)
+    webrick (1.8.2)
    wikicloth (0.8.3)
      builder
      expression_parser
--- a/pkgs/applications/misc/gollum/gemset.nix
+++ b/pkgs/applications/misc/gollum/gemset.nix
@ -34,10 +34,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0skwdasxq7mnlcccn6aqabl7n9r3jd7k19ryzlzzip64cn4x572g";
+      sha256 = "0chwfdq2a6kbj6xz9l6zrdfnyghnh32si82la1dnpa5h75ir5anl";
      type = "gem";
    };
-    version = "1.3.3";
+    version = "1.3.4";
  };
  crass = {
    groups = ["default"];
@ -139,20 +139,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1ffix518y7976qih9k1lgnc17i3v6yrlh0a3mckpxdb4wc2vrp16";
+      sha256 = "0k31wcgnvcvd14snz0pfqj976zv6drfsnq6x8acz10fiyms9l8nw";
      type = "gem";
    };
-    version = "1.14.5";
+    version = "1.14.6";
  };
  json = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0b4qsi8gay7ncmigr0pnbxyb17y3h8kavdyhsh7nrlqwr35vb60q";
+      sha256 = "1klf2mnfilzjqwcjdi5qb1zl3ghrifz1amcnvwjvsfnx9a5jb9ly";
      type = "gem";
    };
-    version = "2.7.2";
+    version = "2.7.4";
  };
  kramdown = {
    dependencies = ["rexml"];
@ -176,37 +176,47 @@
    };
    version = "1.1.0";
  };
+  logger = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0lwncq2rf8gm79g2rcnnyzs26ma1f4wnfjm6gs4zf2wlsdz5in9s";
+      type = "gem";
+    };
+    version = "1.6.1";
+  };
  loofah = {
    dependencies = ["crass" "nokogiri"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1zkjqf37v2d7s11176cb35cl83wls5gm3adnfkn2zcc61h3nxmqh";
+      sha256 = "0ppp2cgli5avzk0z3dwnah6y65ymyr793yja28p2fs9vrci7986h";
      type = "gem";
    };
-    version = "2.22.0";
+    version = "2.23.1";
  };
  mime-types = {
-    dependencies = ["mime-types-data"];
+    dependencies = ["logger" "mime-types-data"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1r64z0m5zrn4k37wabfnv43wa6yivgdfk6cf2rpmmirlz889yaf1";
+      sha256 = "0r34mc3n7sxsbm9mzyzy8m3dvq7pwbryyc8m452axkj0g2axnwbg";
      type = "gem";
    };
-    version = "3.5.2";
+    version = "3.6.0";
  };
  mime-types-data = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "104r7glqjal9fgvnv49wjzp4ssai9hmyn3npkari51s2ska3jnr0";
+      sha256 = "06dbn0j13jwdrmlvrjd50mxqrjlkh3lvxp0afh4glyzbliqvqpsd";
      type = "gem";
    };
-    version = "3.2024.0702";
+    version = "3.2024.1001";
  };
  mini_portile2 = {
    groups = ["default"];
@ -255,10 +265,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0rwbq20s2gdh8dljjsgj5s6wqqfmnbclhvv2c2608brv7jm6jdbd";
+      sha256 = "123ycmq6pkivv29bqbv79jv2cs04xakzd0fz1lalgvfs5nxfky6i";
      type = "gem";
    };
-    version = "3.0.0";
+    version = "3.0.3";
  };
  nokogiri = {
    dependencies = ["mini_portile2" "racc"];
@ -276,10 +286,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "07nb9i9yl3xk6dr7aacxx3dfrrslrw9cn9a55gn9rrhgckb3pymy";
+      sha256 = "00ld13van1xiayr24gwpbxfb63zbw44fx25xs9cp29g6cdzi5hrp";
      type = "gem";
    };
-    version = "19.11.0";
+    version = "19.12.0";
  };
  org-ruby = {
    dependencies = ["rubypants"];
@ -308,20 +318,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "021s7maw0c4d9a6s07vbmllrzqsj2sgmrwimlh8ffkvwqdjrld09";
+      sha256 = "0byn0c9nkahsl93y9ln5bysq4j31q8xkf2ws42swighxd4lnjzsa";
      type = "gem";
    };
-    version = "1.8.0";
+    version = "1.8.1";
  };
  rack = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "12z55b90vvr4sh93az2yfr3fg91jivsag8lcg0k360d99vdq568f";
+      sha256 = "1cd13019gnnh2c0a3kj27ij5ibk72v0bmpypqv4l6ayw8g5cpyyk";
      type = "gem";
    };
-    version = "3.1.7";
+    version = "3.1.8";
  };
  rack-protection = {
    dependencies = ["base64" "rack"];
@ -378,15 +388,14 @@
    version = "4.3.4";
  };
  rexml = {
-    dependencies = ["strscan"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0zr5qpa8lampaqzhdcjcvyqnrqcjl7439mqjlkjz43wdhmpnh4s5";
+      sha256 = "1j9p66pmfgxnzp76ksssyfyqqrg7281dyi3xyknl3wwraaw7a66p";
      type = "gem";
    };
-    version = "3.3.2";
+    version = "3.3.9";
  };
  rouge = {
    groups = ["default"];
@ -404,10 +413,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1wv27axi39hhr0nmaffdl5bdjqiafcvp9xhfgnsgfczsblja50sn";
+      sha256 = "0dv74a07j3ih5ykyszs1k2cjvgs5c1pzrvcb1wc2bfai8p038qml";
      type = "gem";
    };
-    version = "0.3.0";
+    version = "0.3.1";
  };
  ruby2_keywords = {
    groups = ["default"];
@ -493,16 +502,6 @@
    };
    version = "3.1.1";
  };
-  strscan = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0mamrl7pxacbc79ny5hzmakc9grbjysm3yy6119ppgsg44fsif01";
-      type = "gem";
-    };
-    version = "3.1.0";
-  };
  therubyrhino = {
    dependencies = ["therubyrhino_jar"];
    groups = ["default"];
@ -581,10 +580,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "13qm7s0gr2pmfcl7dxrmq38asaza4w0i2n9my4yzs499j731wh8r";
+      sha256 = "089gy5494j560b242vi173wnbj2913hwlwnjkpzld58r96ilc5s3";
      type = "gem";
    };
-    version = "1.8.1";
+    version = "1.8.2";
  };
  wikicloth = {
    dependencies = ["builder" "expression_parser" "htmlentities" "nokogiri" "twitter-text"];
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -81,13 +81,13 @@
    "vendorHash": "sha256-0UM4I/oxIsWIP1G93KJsJxYofXrO4Yy86PEk0FnB1DE="
  },
  "artifactory": {
-    "hash": "sha256-6VwEQ6fGZ1V5AkI5FvQwuFipjREduVkZePGwQqpyxig=",
+    "hash": "sha256-ehwskBqWAlbv+3ULOic8792kWulKuJ8v9/UmPngooRY=",
    "homepage": "https://registry.terraform.io/providers/jfrog/artifactory",
    "owner": "jfrog",
    "repo": "terraform-provider-artifactory",
-    "rev": "v12.2.0",
+    "rev": "v12.3.1",
    "spdx": "Apache-2.0",
-    "vendorHash": "sha256-HAZZ/P7zDbHs/xkIY69QbbcxwgPHEZOqeKCX8jIZTQE="
+    "vendorHash": "sha256-detefSJ3hVIk2xXsAB16XiQkaOAiBkGTnaIku7veFQU="
  },
  "auth0": {
    "hash": "sha256-5drMyf+jymrKb6cxB2eCnvVE9hPo9aDGaloZVlOeRlI=",
--- a/pkgs/applications/networking/instant-messengers/jackline/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jackline/default.nix
@ -4,15 +4,15 @@ with ocamlPackages;

 buildDunePackage rec {
  pname = "jackline";
-  version = "unstable-2024-02-28";
+  version = "unstable-2024-10-21";

-  minimalOCamlVersion = "4.08";
+  minimalOCamlVersion = "4.13";

  src = fetchFromGitHub {
    owner  = "hannesm";
    repo   = "jackline";
-    rev  = "31b90275a5f848cfc8c4f5b75e7d1933bec37852";
-    hash = "sha256-G2jjsc/i9Qgo0TP+ZE4gB/1cjuZ9l8R7e59K2DGD5GY=";
+    rev  = "cf6b26e37e37b0b48be9fd2e74fc563375f757f0";
+    hash = "sha256-6QZZ77C1G3x/GOJsUEQMrCatVsyyxNjq36ez/TgeHSY=";
  };

  nativeBuildInputs = [
@ -39,7 +39,6 @@ buildDunePackage rec {
    uuseg
    uutf
    dns-client
-    cstruct
    base64
    happy-eyeballs-lwt
    ppx_sexp_conv
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@ -1,15 +1,15 @@
 {
-  "version": "17.2.9",
-  "repo_hash": "060d5rzbcnhr1fsvbaiirgjm5rjr5c5r6yi601lxvksffyn5hmxw",
-  "yarn_hash": "10y540bxwaz355p9r4q34199aibadrd5p4d9ck2y3n6735k0hm74",
+  "version": "17.3.6",
+  "repo_hash": "1dysv5xblm33z4vlnkz2s43w6cqrhmzq1729sab3x0zznyaa5vks",
+  "yarn_hash": "1g5xqggdbrxz6ablav119jw8a2v8qdd2cwlbvpygablbcxqak41l",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v17.2.9-ee",
+  "rev": "v17.3.6-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "17.2.9",
-    "GITLAB_PAGES_VERSION": "17.2.9",
-    "GITLAB_SHELL_VERSION": "14.37.0",
+    "GITALY_SERVER_VERSION": "17.3.6",
+    "GITLAB_PAGES_VERSION": "17.3.6",
+    "GITLAB_SHELL_VERSION": "14.38.0",
    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.2.0",
-    "GITLAB_WORKHORSE_VERSION": "17.2.9"
+    "GITLAB_WORKHORSE_VERSION": "17.3.6"
  }
 }
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@ -6,7 +6,7 @@
 }:

 let
-  version = "17.2.9";
+  version = "17.3.6";
  package_version = "v${lib.versions.major version}";
  gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";

@ -20,10 +20,10 @@ let
      owner = "gitlab-org";
      repo = "gitaly";
      rev = "v${version}";
-      hash = "sha256-UgNQtM3NdAUJVP+vvTHtZWSjCmVzsHlEtXQroxKorIY=";
+      hash = "sha256-nXblQfr9ml6F5nNz64haN7ub+cuN3eao14N0Y2d3n0Y=";
    };

-    vendorHash = "sha256-FqnGVRldhevJgBBvJcvGXzRaYWqSHzZiXIQmCNzJv+4=";
+    vendorHash = "sha256-spfSOOe+9NGu+2ZbEGb93X3HnANEXYbvP73DD6neIXQ=";

    ldflags = [ "-X ${gitaly_package}/internal/version.version=${version}" "-X ${gitaly_package}/internal/version.moduleVersion=${version}" ];

@ -46,6 +46,9 @@ buildGoModule ({
  preConfigure = ''
    mkdir -p _build/bin
    cp -r ${auxBins}/bin/* _build/bin
+    for f in ${git}/bin/git-*; do
+      cp "$f" "_build/bin/gitaly-$(basename $f)";
+    done
  '';

  outputs = [ "out" ];
--- a/pkgs/applications/version-management/gitlab/gitaly/git.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/git.nix
@ -9,14 +9,14 @@

 stdenv.mkDerivation rec {
  pname = "gitaly-git";
-  version = "2.44.2.gl1";
+  version = "2.45.2";

  # `src` attribute for nix-update
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "git";
    rev = "v${version}";
-    hash = "sha256-VIffbZZEbGjVW1No8zojSQlX/ciJ2DJnaogNlQtc77o=";
+    hash = "sha256-R4K5b4d1DQw+pwoOCAK4EJtVPXQDPossTUmVv0LJtUs=";
  };

  # we actually use the gitaly build system
--- a/pkgs/applications/version-management/gitlab/gitlab-container-registry/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-container-registry/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "gitlab-container-registry";
-  version = "4.10.0";
+  version = "4.11.0";
  rev = "v${version}-gitlab";

  # nixpkgs-update: no auto update
@ -10,10 +10,10 @@ buildGoModule rec {
    owner = "gitlab-org";
    repo = "container-registry";
    inherit rev;
-    hash = "sha256-9OiuA0TqRfnZKfAeLbIcPUw5qH6twWKqt0IP8roaWNg=";
+    hash = "sha256-wUypldxi3O5sm4i9v2HiZjqUy/JwtcRPvCCmINCk4YU=";
  };

-  vendorHash = "sha256-Bzhg5coOrs3JO6Qslr9csUIrnCMJiG89Fio8ziJjH9k=";
+  vendorHash = "sha256-Ed+WvdWpEU5c9v14eM1PdCcT3qRnaRF/XeUKedPmaSU=";

  postPatch = ''
    # Disable flaky inmemory storage driver test
--- a/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
@ -2,17 +2,17 @@

 buildGoModule rec {
  pname = "gitlab-pages";
-  version = "17.2.9";
+  version = "17.3.6";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-pages";
    rev = "v${version}";
-    hash = "sha256-ggfPZ/PMjgfRzzPZdVCVydd/4mdCfh2xh7QWGjp5U/0=";
+    hash = "sha256-yieOM9QQuQQ4RkfjASpcEvIKwbYMT9LkkJPHAYhY7uY=";
  };

-  vendorHash = "sha256-yNHeM8MExcLwv2Ga4vtBmPFBt/Rj7Gd4QQYDlnAIo+c=";
+  vendorHash = "sha256-O8kWiOpgVCUD6DdM95F1b+j4Gv9LTLRdBjByqXWV7Pk=";
  subPackages = [ "." ];

  meta = with lib; {
--- a/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
@ -2,14 +2,14 @@

 buildGoModule rec {
  pname = "gitlab-shell";
-  version = "14.37.0";
+  version = "14.38.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-shell";
    rev = "v${version}";
-    hash = "sha256-to4ZIFKEiM4FCznoLrvHua9/hIqiHcviALzfay+1rb8=";
+    hash = "sha256-oYvsSjdzfJn4ujy1qbMmqZyEQFbYTSke8t3KBqjr/Vc=";
  };

  buildInputs = [ ruby libkrb5 ];
@ -18,7 +18,7 @@ buildGoModule rec {
    ./remove-hardcoded-locations.patch
  ];

-  vendorHash = "sha256-TbjpCCo/ZdFP+yE2h8B8kwS08iUilXNgBT2F5Si7/dc=";
+  vendorHash = "sha256-YOShgZv0zdfXgKi//IENt6wE2m0S1Kqa+2ndvCwKDLQ=";

  postInstall = ''
    cp -r "$NIX_BUILD_TOP/source"/bin/* $out/bin
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@ -5,7 +5,7 @@ in
 buildGoModule rec {
  pname = "gitlab-workhorse";

-  version = "17.2.9";
+  version = "17.3.6";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
@ -17,7 +17,7 @@ buildGoModule rec {

  sourceRoot = "${src.name}/workhorse";

-  vendorHash = "sha256-ZWpuJTlGCsjjURa8iYTaGMKulx99uyYJ+dr2cL9hiwo=";
+  vendorHash = "sha256-sLr9kFKRNYOlCj9bmP+J7/Iu/OfFTEjAm64BUni+eiY=";
  buildInputs = [ git ];
  ldflags = [ "-X main.Version=${version}" ];
  doCheck = false;
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@ -1,5 +1,9 @@
 # frozen_string_literal: true

+def next?
+  File.basename(__FILE__) == "Gemfile.next"
+end
+
 source 'https://rubygems.org'

 if ENV.fetch('BUNDLER_CHECKSUM_VERIFICATION_OPT_IN', 'false') != 'false' # this verification is still experimental
@ -24,7 +28,12 @@ gem 'bundler-checksum', '~> 0.1.0', path: 'vendor/gems/bundler-checksum', requir
 # https://gitlab.com/gitlab-org/gitlab/-/issues/375713
 #
 # See https://docs.gitlab.com/ee/development/gemfile.html#upgrade-rails for guidelines when upgrading Rails
-gem 'rails', '~> 7.0.8.4' # rubocop:todo Gemfile/MissingFeatureCategory
+
+if next?
+  gem 'rails', '~> 7.1.3.4', feature_category: :shared
+else
+  gem 'rails', '~> 7.0.8.4', feature_category: :shared
+end

 gem 'activerecord-gitlab', path: 'gems/activerecord-gitlab' # rubocop:todo Gemfile/MissingFeatureCategory

@ -50,7 +59,7 @@ gem 'responders', '~> 3.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'sprockets', '~> 3.7.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'sprockets-rails', '~>  3.5.1' # rubocop:todo Gemfile/MissingFeatureCategory

-gem 'view_component', '~> 3.12.1' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'view_component', '~> 3.13.0' # rubocop:todo Gemfile/MissingFeatureCategory

 # Supported DBs
 gem 'pg', '~> 1.5.6', feature_category: :database
@ -59,7 +68,11 @@ gem 'neighbor', '~> 0.3.2', feature_category: :duo_chat

 gem 'rugged', '~> 1.6' # rubocop:todo Gemfile/MissingFeatureCategory

-gem 'faraday', '~> 1.10.3' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'faraday', '~> 2', feature_category: :shared
+gem 'faraday-retry', '~> 2', feature_category: :shared
+# Logger is a dependency of Faraday, but Logger 1.6.0 does not work with Chef.
+gem 'logger', '~> 1.5.3' # rubocop:todo Gemfile/MissingFeatureCategory
+
 gem 'marginalia', '~> 1.11.1' # rubocop:todo Gemfile/MissingFeatureCategory

 # Authorization
@ -75,8 +88,8 @@ gem 'bcrypt', '~> 3.1', '>= 3.1.14' # rubocop:todo Gemfile/MissingFeatureCategor
 gem 'doorkeeper', '~> 5.6', '>= 5.6.6' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'doorkeeper-openid_connect', '~> 1.8', '>= 1.8.7' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'doorkeeper-device_authorization_grant', '~> 1.0.0', feature_category: :system_access
-gem 'rexml', '~> 3.2.6' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'ruby-saml', '~> 1.17.0', feature_category: :system_access
+gem 'rexml', '~> 3.3.2' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'ruby-saml', '~> 1.17.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth', '~> 2.1.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth-auth0', '~> 3.1' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth-azure-activedirectory-v2', '~> 2.0' # rubocop:todo Gemfile/MissingFeatureCategory
@ -85,16 +98,16 @@ gem 'omniauth-github', '2.0.1' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth-gitlab', '~> 4.0.0', path: 'vendor/gems/omniauth-gitlab' # See vendor/gems/omniauth-gitlab/README.md # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth-google-oauth2', '~> 1.1' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth-oauth2-generic', '~> 0.2.2' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'omniauth-saml', '~> 2.2.1', feature_category: :system_access
+gem 'omniauth-saml', '~> 2.2.1' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth-shibboleth-redux', '~> 2.0', require: 'omniauth-shibboleth' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth_crowd', '~> 2.4.0', path: 'vendor/gems/omniauth_crowd' # See vendor/gems/omniauth_crowd/README.md # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'omniauth_openid_connect', '~> 0.6.1' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'omniauth_openid_connect', '~> 0.8.0' # rubocop:todo Gemfile/MissingFeatureCategory
 # Locked until Ruby 3.0 upgrade since upgrading will pull in an updated net-smtp gem.
 # See https://docs.gitlab.com/ee/development/emails.html#rationale.
-gem 'openid_connect', '= 1.3.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'openid_connect', '~> 2.3.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth-salesforce', '~> 1.0.5', path: 'vendor/gems/omniauth-salesforce' # See gem README.md # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth-atlassian-oauth2', '~> 0.2.0' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'rack-oauth2', '~> 1.21.3' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'rack-oauth2', '~> 2.2.1' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'jwt', '~> 2.5' # rubocop:todo Gemfile/MissingFeatureCategory

 # Kerberos authentication. EE-only
@ -116,7 +129,7 @@ gem 'attr_encrypted', '~> 3.2.4', path: 'vendor/gems/attr_encrypted' # rubocop:t
 gem 'validates_hostname', '~> 1.0.13' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'rubyzip', '~> 2.3.2', require: 'zip' # rubocop:todo Gemfile/MissingFeatureCategory
 # GitLab Pages letsencrypt support
-gem 'acme-client', '~> 2.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'acme-client', '~> 2.0.18' # rubocop:todo Gemfile/MissingFeatureCategory

 # Browser detection
 gem 'browser', '~> 5.3.1' # rubocop:todo Gemfile/MissingFeatureCategory
@ -146,7 +159,17 @@ gem 'graphql', '~> 2.3.5', feature_category: :api
 gem 'graphql-docs', '~> 5.0.0', group: [:development, :test], feature_category: :api
 gem 'graphiql-rails', '~> 1.10', feature_category: :api
 gem 'apollo_upload_server', '~> 2.1.6', feature_category: :api
-gem 'graphlient', '~> 0.6.0', feature_category: :importers # Used by BulkImport feature (group::import)
+gem 'graphlient', '~> 0.8.0', feature_category: :importers # Used by BulkImport feature (group::import)
+
+# Cells
+gem 'gitlab-topology-service-client', '~> 0.1',
+  path: 'vendor/gems/gitlab-topology-service-client',
+  feature_category: :cell
+
+# Duo Workflow
+gem 'gitlab-duo-workflow-service-client', '~> 0.1',
+  path: 'vendor/gems/gitlab-duo-workflow-service-client',
+  feature_category: :duo_workflow

 # Generate Fake data
 gem 'ffaker', '~> 2.23' # rubocop:todo Gemfile/MissingFeatureCategory
@ -177,7 +200,7 @@ gem 'fog-local', '~> 0.8' # rubocop:todo Gemfile/MissingFeatureCategory
 # We may want to update this dependency if this is ever addressed upstream, e.g. via
 # https://github.com/aliyun/aliyun-oss-ruby-sdk/pull/93
 gem 'fog-aliyun', '~> 0.4' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'gitlab-fog-azure-rm', '~> 1.9.1', require: 'fog/azurerm' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'gitlab-fog-azure-rm', '~> 2.0.1', require: 'fog/azurerm', feature_category: :shared

 # for Google storage

@ -205,14 +228,16 @@ gem 'google-cloud-compute-v1', '~> 2.6.0', feature_category: :shared
 gem 'seed-fu', '~> 2.3.7' # rubocop:todo Gemfile/MissingFeatureCategory

 # Search
-gem 'elasticsearch-model', '~> 7.2' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'elasticsearch-rails', '~> 7.2', require: 'elasticsearch/rails/instrumentation' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'elasticsearch-api',   '7.13.3' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'aws-sdk-core', '~> 3.199.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'elasticsearch-model', '~> 7.2', feature_category: :global_search
+gem 'elasticsearch-rails', '~> 7.2', require: 'elasticsearch/rails/instrumentation', feature_category: :global_search
+gem 'elasticsearch-api', '7.17.11', feature_category: :global_search
+gem 'aws-sdk-core', '~> 3.201.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'aws-sdk-cloudformation', '~> 1' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'aws-sdk-s3', '~> 1.154.0' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'faraday_middleware-aws-sigv4', '~>0.3.0' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'typhoeus', '~> 1.4.0' # Used with Elasticsearch to support http keep-alive connections # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'aws-sdk-s3', '~> 1.157.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'faraday-typhoeus', '~> 1.1', feature_category: :global_search
+gem 'faraday_middleware-aws-sigv4', '~> 1.0.1', feature_category: :global_search
+# Used with Elasticsearch to support http keep-alive connections
+gem 'typhoeus', '~> 1.4.0', feature_category: :global_search

 # Markdown and HTML processing
 gem 'html-pipeline', '~> 2.14.3', feature_category: :team_planning
@ -253,9 +278,6 @@ end
 # State machine
 gem 'state_machines-activerecord', '~> 0.8.0' # rubocop:todo Gemfile/MissingFeatureCategory

-# CI domain tags
-gem 'acts-as-taggable-on', '~> 10.0' # rubocop:todo Gemfile/MissingFeatureCategory
-
 # Background jobs
 gem 'sidekiq', '~> 7.1.6', feature_category: :scalability
 gem 'sidekiq-cron', '~> 1.12.0', feature_category: :scalability
@ -331,9 +353,7 @@ gem 'loofah', '~> 2.22.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'licensee', '~> 9.16' # rubocop:todo Gemfile/MissingFeatureCategory

 # Detect and convert string character encoding
-# We forked charlock_holmes at https://gitlab.com/gitlab-org/ruby/gems/charlock_holmes
-# but changed it's name to 'static_holmes' in the gemspec file.
-gem 'static_holmes', '~> 0.7.11', require: 'charlock_holmes', feature_category: :shared
+gem 'charlock_holmes', '~> 0.7.9', feature_category: :shared

 # Detect mime content type from content
 gem 'ruby-magic', '~> 0.6' # rubocop:todo Gemfile/MissingFeatureCategory
@ -347,7 +367,7 @@ gem 'gitlab_chronic_duration', '~> 0.12' # rubocop:todo Gemfile/MissingFeatureCa

 gem 'rack-proxy', '~> 0.7.7' # rubocop:todo Gemfile/MissingFeatureCategory

-gem 'cssbundling-rails', '1.4.0', feature_category: :shared
+gem 'cssbundling-rails', '1.4.1', feature_category: :shared
 gem 'terser', '1.0.2' # rubocop:todo Gemfile/MissingFeatureCategory

 gem 'click_house-client', path: 'gems/click_house-client', require: 'click_house/client' # rubocop:todo Gemfile/MissingFeatureCategory
@ -363,9 +383,9 @@ gem 'gitlab-license', '~> 2.5', feature_category: :shared
 gem 'rack-attack', '~> 6.7.0' # rubocop:todo Gemfile/MissingFeatureCategory

 # Sentry integration
-gem 'sentry-ruby', '~> 5.17.3', feature_category: :error_tracking
-gem 'sentry-rails', '~> 5.17.3', feature_category: :error_tracking
-gem 'sentry-sidekiq', '~> 5.17.3', feature_category: :error_tracking
+gem 'sentry-ruby', '~> 5.18.0', feature_category: :error_tracking
+gem 'sentry-rails', '~> 5.18.0', feature_category: :error_tracking
+gem 'sentry-sidekiq', '~> 5.18.0', feature_category: :error_tracking

 # PostgreSQL query parsing
 #
@ -404,7 +424,8 @@ gem 'webrick', '~> 1.8.1', require: false # rubocop:todo Gemfile/MissingFeatureC
 gem 'prometheus-client-mmap', '~> 1.1', '>= 1.1.1', require: 'prometheus/client' # rubocop:todo Gemfile/MissingFeatureCategory

 # Event-driven reactor for Ruby
-gem 'async', '~> 2.12.1' # rubocop:disable Gemfile/MissingFeatureCategory -- This is general utility gem
+# Required manually in config/initializers/require_async_gem
+gem 'async', '~> 2.12.1', require: false # rubocop:disable Gemfile/MissingFeatureCategory -- This is general utility gem

 # OpenTelemetry
 group :opentelemetry do
@ -472,7 +493,7 @@ group :development, :test do

  gem 'awesome_print', require: false # rubocop:todo Gemfile/MissingFeatureCategory

-  gem 'database_cleaner-active_record', '~> 2.1.0', feature_category: :database
+  gem 'database_cleaner-active_record', '~> 2.2.0', feature_category: :database
  gem 'rspec-rails', '~> 6.1.1', feature_category: :shared
  gem 'factory_bot_rails', '~> 6.4.3', feature_category: :tooling

@ -494,7 +515,7 @@ group :development, :test do
  # Profiling data from CI/CD pipelines
  gem 'influxdb-client', '~> 3.1', require: false, feature_category: :tooling

-  gem 'knapsack', '~> 1.22.0', feature_category: :tooling
+  gem 'knapsack', '~> 4.0.0', feature_category: :tooling
  gem 'crystalball', '~> 0.7.0', require: false, feature_category: :tooling
  gem 'test_file_finder', '~> 0.3.1', feature_category: :tooling

@ -511,7 +532,7 @@ group :development, :test do
  # For now we only use vite in development / test, and not for production builds
  # See: https://gitlab.com/gitlab-org/frontend/rfcs/-/issues/106
  gem 'vite_rails', '~> 3.0.17', feature_category: :shared
-  gem 'vite_ruby', '~> 3.5.0', feature_category: :shared
+  gem 'vite_ruby', '~> 3.7.0', feature_category: :shared

  gem 'gitlab-housekeeper', path: 'gems/gitlab-housekeeper', feature_category: :tooling
 end
@ -524,7 +545,7 @@ group :development, :test, :coverage do
  gem 'simplecov', '~> 0.22', require: false, feature_category: :tooling
  gem 'simplecov-lcov', '~> 0.8.0', require: false, feature_category: :tooling
  gem 'simplecov-cobertura', '~> 2.1.0', require: false, feature_category: :tooling
-  gem 'undercover', '~> 0.4.4', require: false, feature_category: :tooling
+  gem 'undercover', '~> 0.5.0', require: false, feature_category: :tooling
 end

 # Gems required in omnibus-gitlab pipeline
@ -565,17 +586,19 @@ group :test do
  # Moved in `test` because https://gitlab.com/gitlab-org/gitlab/-/issues/217527
  gem 'derailed_benchmarks', require: false # rubocop:todo Gemfile/MissingFeatureCategory

-  gem 'gitlab_quality-test_tooling', '~> 1.31.0', require: false, feature_category: :tooling
+  gem 'gitlab_quality-test_tooling', '~> 1.33.0', require: false, feature_category: :tooling
 end

 gem 'octokit', '~> 9.0', feature_category: :importers
+# Needed by octokit: https://github.com/octokit/octokit.rb/pull/1688
+gem 'faraday-multipart', '~> 1.0', feature_category: :importers

 gem 'gitlab-mail_room', '~> 0.0.24', require: 'mail_room', feature_category: :shared

 gem 'email_reply_trimmer', '~> 0.1' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'html2text' # rubocop:todo Gemfile/MissingFeatureCategory

-gem 'stackprof', '~> 0.2.25', require: false # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'stackprof', '~> 0.2.26', require: false, feature_category: :shared
 gem 'rbtrace', '~> 0.4', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'memory_profiler', '~> 1.0', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'activerecord-explain-analyze', '~> 0.1', require: false # rubocop:todo Gemfile/MissingFeatureCategory
@ -600,12 +623,16 @@ gem 'ssh_data', '~> 1.3' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'spamcheck', '~> 1.3.0' # rubocop:todo Gemfile/MissingFeatureCategory

 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 17.1.0', feature_category: :gitaly
+gem 'gitaly', '~> 17.2.0', feature_category: :gitaly

 # KAS GRPC protocol definitions
-gem 'kas-grpc', '~> 0.5.0', feature_category: :deployment_management
+gem 'kas-grpc', '~> 0.6.0', feature_category: :deployment_management

-gem 'grpc', '~> 1.63', feature_category: :shared
+# Lock the version before issues below are resolved:
+# https://gitlab.com/gitlab-org/gitlab/-/issues/473169#note_2028352939
+# Or we can upgrade to a more recent version as long as we can confirm
+# that it doesn't have the same issues.
+gem 'grpc', '= 1.63.0', feature_category: :shared

 gem 'google-protobuf', '~> 3.25', '>= 3.25.3' # rubocop:todo Gemfile/MissingFeatureCategory

@ -654,7 +681,7 @@ gem 'valid_email', '~> 0.1' # rubocop:todo Gemfile/MissingFeatureCategory
 # JSON
 gem 'jsonb_accessor', '~> 1.3.10' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'json', '~> 2.7.2', feature_category: :shared
-gem 'json_schemer', '~> 0.2.18' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'json_schemer', '~> 2.3.0', feature_category: :shared
 gem 'oj', '~> 3.13.21' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'oj-introspect', '~> 0.7' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'multi_json', '~> 1.14.1' # rubocop:todo Gemfile/MissingFeatureCategory
@ -702,3 +729,5 @@ gem 'net-http', '= 0.4.1', feature_category: :shared
 gem 'duo_api', '~> 1.3' # rubocop:todo Gemfile/MissingFeatureCategory

 gem 'gitlab-sdk', '~> 0.3.0', feature_category: :application_instrumentation
+
+gem 'openbao_client', path: 'gems/openbao_client' # rubocop:todo Gemfile/MissingFeatureCategory
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@ -27,7 +27,9 @@ PATH
  remote: gems/gitlab-backup-cli
  specs:
    gitlab-backup-cli (0.0.1)
-      activesupport (~> 7.0.8)
+      activesupport (< 7.2)
+      google-cloud-storage_transfer (~> 1.2.0)
+      googleauth (~> 1.8.1)
      rainbow (~> 3.0)
      thor (~> 1.3)

@ -104,6 +106,12 @@ PATH
      diffy (~> 3.4)
      oj (~> 3.13.16)

+PATH
+  remote: gems/openbao_client
+  specs:
+    openbao_client (1.0.0)
+      typhoeus (~> 1.0, >= 1.0.1)
+
 PATH
  remote: vendor/gems/attr_encrypted
  specs:
@ -137,6 +145,18 @@ PATH
  specs:
    diff_match_patch (0.1.0)

+PATH
+  remote: vendor/gems/gitlab-duo-workflow-service-client
+  specs:
+    gitlab-duo-workflow-service-client (0.1)
+      grpc
+
+PATH
+  remote: vendor/gems/gitlab-topology-service-client
+  specs:
+    gitlab-topology-service-client (0.1)
+      grpc
+
 PATH
  remote: vendor/gems/mail-smtp_pool
  specs:
@ -186,9 +206,9 @@ GEM
    CFPropertyList (3.0.5)
      rexml
    RedCloth (4.3.3)
-    acme-client (2.0.11)
+    acme-client (2.0.18)
      faraday (>= 1.0, < 3.0.0)
-      faraday-retry (~> 1.0)
+      faraday-retry (>= 1.0, < 3.0.0)
    actioncable (7.0.8.4)
      actionpack (= 7.0.8.4)
      activesupport (= 7.0.8.4)
@ -257,8 +277,6 @@ GEM
      i18n (>= 1.6, < 2)
      minitest (>= 5.1)
      tzinfo (~> 2.0)
-    acts-as-taggable-on (10.0.0)
-      activerecord (>= 6.1, < 7.2)
    addressable (2.8.1)
      public_suffix (>= 2.0.2, < 6.0)
    aes_key_wrap (1.1.0)
@ -291,7 +309,7 @@ GEM
      io-event (~> 1.6, >= 1.6.5)
    atlassian-jwt (0.2.1)
      jwt (~> 2.1)
-    attr_required (1.0.1)
+    attr_required (1.0.2)
    awesome_print (1.9.2)
    awrence (1.2.1)
    aws-eventstream (1.3.0)
@ -299,7 +317,7 @@ GEM
    aws-sdk-cloudformation (1.41.0)
      aws-sdk-core (~> 3, >= 3.99.0)
      aws-sigv4 (~> 1.1)
-    aws-sdk-core (3.199.0)
+    aws-sdk-core (3.201.4)
      aws-eventstream (~> 1, >= 1.3.0)
      aws-partitions (~> 1, >= 1.651.0)
      aws-sigv4 (~> 1.8)
@ -307,10 +325,10 @@ GEM
    aws-sdk-kms (1.76.0)
      aws-sdk-core (~> 3, >= 3.188.0)
      aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.154.0)
-      aws-sdk-core (~> 3, >= 3.199.0)
+    aws-sdk-s3 (1.157.0)
+      aws-sdk-core (~> 3, >= 3.201.0)
      aws-sdk-kms (~> 1)
-      aws-sigv4 (~> 1.8)
+      aws-sigv4 (~> 1.5)
    aws-sigv4 (1.8.0)
      aws-eventstream (~> 1, >= 1.0.2)
    axe-core-api (4.9.1)
@ -324,14 +342,6 @@ GEM
      descendants_tracker (~> 0.0.4)
      ice_nine (~> 0.11.0)
      thread_safe (~> 0.3, >= 0.3.1)
-    azure-storage-blob (2.0.3)
-      azure-storage-common (~> 2.0)
-      nokogiri (~> 1, >= 1.10.8)
-    azure-storage-common (2.0.4)
-      faraday (~> 1.0)
-      faraday_middleware (~> 1.0, >= 1.0.0.rc1)
-      net-http-persistent (~> 4.0)
-      nokogiri (~> 1, >= 1.10.8)
    babosa (2.0.0)
    backport (1.2.0)
    base32 (0.3.2)
@ -353,7 +363,7 @@ GEM
    bindata (2.4.11)
    binding_of_caller (1.0.0)
      debug_inspector (>= 0.0.1)
-    bootsnap (1.18.3)
+    bootsnap (1.18.4)
      msgpack (~> 1.2)
    browser (5.3.1)
    builder (3.2.4)
@ -383,6 +393,7 @@ GEM
      ssrf_filter (~> 1.0, < 1.1.0)
    cbor (0.5.9.8)
    character_set (1.8.0)
+    charlock_holmes (0.7.9)
    chef-config (18.3.0)
      addressable
      chef-utils (= 18.3.0)
@ -429,7 +440,7 @@ GEM
      git
    css_parser (1.14.0)
      addressable
-    cssbundling-rails (1.4.0)
+    cssbundling-rails (1.4.1)
      railties (>= 6.0.0)
    cvss-suite (3.0.1)
    danger (9.4.2)
@ -448,7 +459,7 @@ GEM
    danger-gitlab (8.0.0)
      danger
      gitlab (~> 4.2, >= 4.2.0)
-    database_cleaner-active_record (2.1.0)
+    database_cleaner-active_record (2.2.0)
      activerecord (>= 5.a)
      database_cleaner-core (~> 2.0.0)
    database_cleaner-core (2.0.1)
@ -525,27 +536,28 @@ GEM
    dumb_delegator (1.0.0)
    duo_api (1.3.0)
    e2mmap (0.1.0)
-    ecma-re-validator (0.3.0)
-      regexp_parser (~> 2.0)
    ed25519 (1.3.0)
-    elasticsearch (7.13.3)
-      elasticsearch-api (= 7.13.3)
-      elasticsearch-transport (= 7.13.3)
-    elasticsearch-api (7.13.3)
+    elasticsearch (7.17.11)
+      elasticsearch-api (= 7.17.11)
+      elasticsearch-transport (= 7.17.11)
+    elasticsearch-api (7.17.11)
      multi_json
-    elasticsearch-model (7.2.0)
+    elasticsearch-model (7.2.1)
      activesupport (> 3)
      elasticsearch (~> 7)
      hashie
    elasticsearch-rails (7.2.1)
-    elasticsearch-transport (7.13.3)
-      faraday (~> 1)
+    elasticsearch-transport (7.17.11)
+      base64
+      faraday (>= 1, < 3)
      multi_json
    email_reply_trimmer (0.1.6)
    email_spec (2.2.0)
      htmlentities (~> 4.3.3)
      launchy (~> 2.1)
      mail (~> 2.7)
+    email_validator (2.2.4)
+      activemodel
    encryptor (3.0.0)
    erubi (1.12.0)
    escape_utils (1.3.0)
@ -565,36 +577,28 @@ GEM
    factory_bot_rails (6.4.3)
      factory_bot (~> 6.4)
      railties (>= 5.0.0)
-    faraday (1.10.3)
-      faraday-em_http (~> 1.0)
-      faraday-em_synchrony (~> 1.0)
-      faraday-excon (~> 1.1)
-      faraday-httpclient (~> 1.0)
-      faraday-multipart (~> 1.0)
-      faraday-net_http (~> 1.0)
-      faraday-net_http_persistent (~> 1.0)
-      faraday-patron (~> 1.0)
-      faraday-rack (~> 1.0)
-      faraday-retry (~> 1.0)
-      ruby2_keywords (>= 0.0.4)
-    faraday-em_http (1.0.0)
-    faraday-em_synchrony (1.0.0)
-    faraday-excon (1.1.0)
+    faraday (2.10.1)
+      faraday-net_http (>= 2.0, < 3.2)
+      logger
+    faraday-follow_redirects (0.3.0)
+      faraday (>= 1, < 3)
    faraday-http-cache (2.5.0)
      faraday (>= 0.8)
-    faraday-httpclient (1.0.1)
    faraday-multipart (1.0.4)
      multipart-post (~> 2)
-    faraday-net_http (1.0.1)
-    faraday-net_http_persistent (1.2.0)
-    faraday-patron (1.0.0)
-    faraday-rack (1.0.0)
-    faraday-retry (1.0.3)
-    faraday_middleware (1.2.0)
-      faraday (~> 1.0)
-    faraday_middleware-aws-sigv4 (0.3.0)
+    faraday-net_http (3.1.0)
+      net-http
+    faraday-net_http_persistent (2.1.0)
+      faraday (~> 2.5)
+      net-http-persistent (~> 4.0)
+    faraday-retry (2.2.1)
+      faraday (~> 2.0)
+    faraday-typhoeus (1.1.0)
+      faraday (~> 2.0)
+      typhoeus (~> 1.4)
+    faraday_middleware-aws-sigv4 (1.0.1)
      aws-sigv4 (~> 1.0)
-      faraday (>= 0.15)
+      faraday (>= 2.0, < 3)
    fast_blank (1.0.1)
    fast_gettext (2.3.0)
    ffaker (2.23.0)
@ -688,7 +692,7 @@ GEM
    git (1.18.0)
      addressable (~> 2.8)
      rchardet (~> 1.8)
-    gitaly (17.1.2)
+    gitaly (17.2.0)
      grpc (~> 1.0)
    gitlab (4.19.0)
      httparty (~> 0.20)
@ -702,12 +706,15 @@ GEM
    gitlab-experiment (0.9.1)
      activesupport (>= 3.0)
      request_store (>= 1.0)
-    gitlab-fog-azure-rm (1.9.1)
-      azure-storage-blob (~> 2.0)
-      azure-storage-common (~> 2.0)
+    gitlab-fog-azure-rm (2.0.1)
+      faraday (~> 2.0)
+      faraday-follow_redirects (~> 0.3.0)
+      faraday-net_http_persistent (~> 2.0)
      fog-core (~> 2.1)
      fog-json (~> 1.2)
      mime-types
+      net-http-persistent (~> 4.0)
+      nokogiri (~> 1, >= 1.10.8)
    gitlab-glfm-markdown (0.0.17)
      rb_sys (= 0.9.94)
    gitlab-labkit (0.36.1)
@ -745,7 +752,7 @@ GEM
      omniauth (>= 1.3, < 3)
      pyu-ruby-sasl (>= 0.0.3.3, < 0.1)
      rubyntlm (~> 0.5)
-    gitlab_quality-test_tooling (1.31.0)
+    gitlab_quality-test_tooling (1.33.0)
      activesupport (>= 7.0, < 7.2)
      amatch (~> 0.4.1)
      gitlab (~> 4.19)
@ -833,7 +840,13 @@ GEM
      google-cloud-core (~> 1.6)
      googleauth (>= 0.16.2, < 2.a)
      mini_mime (~> 1.0)
-    google-protobuf (3.25.3)
+    google-cloud-storage_transfer (1.2.0)
+      google-cloud-core (~> 1.6)
+      google-cloud-storage_transfer-v1 (>= 0.5, < 2.a)
+    google-cloud-storage_transfer-v1 (0.8.0)
+      gapic-common (>= 0.20.0, < 2.a)
+      google-cloud-errors (~> 1.0)
+    google-protobuf (3.25.4)
    googleapis-common-protos (1.4.0)
      google-protobuf (~> 3.14)
      googleapis-common-protos-types (~> 1.2)
@ -874,9 +887,8 @@ GEM
      rack
    graphiql-rails (1.10.0)
      railties
-    graphlient (0.6.0)
-      faraday (>= 1.0)
-      faraday_middleware
+    graphlient (0.8.0)
+      faraday (~> 2.0)
      graphql-client
    graphlyte (1.0.0)
    graphql (2.3.5)
@ -985,16 +997,18 @@ GEM
      regexp_parser (~> 2.5)
      regexp_property_values (~> 1.0)
    json (2.7.2)
-    json-jwt (1.15.3)
+    json-jwt (1.16.6)
      activesupport (>= 4.2)
      aes_key_wrap
+      base64
      bindata
-      httpclient
-    json_schemer (0.2.18)
-      ecma-re-validator (~> 0.3)
+      faraday (~> 2.0)
+      faraday-follow_redirects
+    json_schemer (2.3.0)
+      bigdecimal
      hana (~> 1.3)
      regexp_parser (~> 2.0)
-      uri_template (~> 0.7)
+      simpleidn (~> 0.2)
    jsonb_accessor (1.3.10)
      activerecord (>= 5.0)
      activesupport (>= 5.0)
@ -1014,9 +1028,9 @@ GEM
      activerecord
      kaminari-core (= 1.2.2)
    kaminari-core (1.2.2)
-    kas-grpc (0.5.0)
+    kas-grpc (0.6.0)
      grpc (~> 1.0)
-    knapsack (1.22.0)
+    knapsack (4.0.0)
      rake
    kramdown (2.3.2)
      rexml
@ -1060,7 +1074,7 @@ GEM
      rake (~> 13.0)
    locale (2.1.3)
    lockbox (1.3.0)
-    logger (1.6.0)
+    logger (1.5.3)
    lograge (0.11.2)
      actionpack (>= 4)
      activesupport (>= 4)
@ -1212,21 +1226,24 @@ GEM
      ruby-saml (~> 1.17)
    omniauth-shibboleth-redux (2.0.0)
      omniauth (>= 2.0.0)
-    omniauth_openid_connect (0.6.1)
+    omniauth_openid_connect (0.8.0)
      omniauth (>= 1.9, < 3)
-      openid_connect (~> 1.1)
+      openid_connect (~> 2.2)
    open4 (1.3.4)
-    openid_connect (1.3.0)
+    openid_connect (2.3.0)
      activemodel
      attr_required (>= 1.0.0)
-      json-jwt (>= 1.5.0)
-      rack-oauth2 (>= 1.6.1)
-      swd (>= 1.0.0)
+      email_validator
+      faraday (~> 2.0)
+      faraday-follow_redirects
+      json-jwt (>= 1.16)
+      mail
+      rack-oauth2 (~> 2.2)
+      swd (~> 2.0)
      tzinfo
-      validate_email
      validate_url
-      webfinger (>= 1.0.1)
-    openssl (3.1.0)
+      webfinger (~> 2.0)
+    openssl (3.2.0)
    openssl-signature_algorithm (1.3.0)
      openssl (> 2.0)
    opentelemetry-api (1.2.5)
@ -1241,6 +1258,10 @@ GEM
      opentelemetry-semantic_conventions
    opentelemetry-helpers-sql-obfuscation (0.1.0)
      opentelemetry-common (~> 0.20)
+    opentelemetry-instrumentation-action_mailer (0.1.0)
+      opentelemetry-api (~> 1.0)
+      opentelemetry-instrumentation-active_support (~> 0.1)
+      opentelemetry-instrumentation-base (~> 0.22.1)
    opentelemetry-instrumentation-action_pack (0.9.0)
      opentelemetry-api (~> 1.0)
      opentelemetry-instrumentation-base (~> 0.22.1)
@ -1305,8 +1326,9 @@ GEM
      opentelemetry-api (~> 1.0)
      opentelemetry-common (~> 0.21.0)
      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-rails (0.30.1)
+    opentelemetry-instrumentation-rails (0.30.2)
      opentelemetry-api (~> 1.0)
+      opentelemetry-instrumentation-action_mailer (~> 0.1.0)
      opentelemetry-instrumentation-action_pack (~> 0.9.0)
      opentelemetry-instrumentation-action_view (~> 0.7.0)
      opentelemetry-instrumentation-active_job (~> 0.7.0)
@ -1419,10 +1441,11 @@ GEM
      rack (>= 1.0, < 4)
    rack-cors (2.0.2)
      rack (>= 2.0.0)
-    rack-oauth2 (1.21.3)
+    rack-oauth2 (2.2.1)
      activesupport
      attr_required
-      httpclient
+      faraday (~> 2.0)
+      faraday-follow_redirects
      json-jwt (>= 1.11.0)
      rack (>= 2.1.0)
    rack-protection (2.2.2)
@ -1505,7 +1528,7 @@ GEM
    redis-rack (3.0.0)
      rack-session (>= 0.2.0)
      redis-store (>= 1.2, < 2)
-    redis-store (1.10.0)
+    redis-store (1.11.0)
      redis (>= 4, < 6)
    regexp_parser (2.6.0)
    regexp_property_values (1.0.0)
@ -1526,7 +1549,8 @@ GEM
    retriable (3.1.2)
    reverse_markdown (1.4.0)
      nokogiri
-    rexml (3.2.6)
+    rexml (3.3.2)
+      strscan
    rinku (2.0.0)
    rotp (6.3.0)
    rouge (4.3.0)
@ -1618,8 +1642,8 @@ GEM
      prism (>= 0.29.0, < 0.31)
      rbs (>= 3, < 4)
      sorbet-runtime (>= 0.5.10782)
-    ruby-lsp-rails (0.3.7)
-      ruby-lsp (>= 0.17.0, < 0.18.0)
+    ruby-lsp-rails (0.3.8)
+      ruby-lsp (>= 0.17.2, < 0.18.0)
    ruby-lsp-rspec (0.1.12)
      ruby-lsp (~> 0.17.0)
    ruby-magic (0.6.0)
@ -1655,24 +1679,25 @@ GEM
    seed-fu (2.3.7)
      activerecord (>= 3.1)
      activesupport (>= 3.1)
-    selenium-webdriver (4.21.1)
+    selenium-webdriver (4.23.0)
      base64 (~> 0.2)
+      logger (~> 1.4)
      rexml (~> 3.2, >= 3.2.5)
      rubyzip (>= 1.2.2, < 3.0)
      websocket (~> 1.0)
-    semver_dialects (3.4.0)
+    semver_dialects (3.4.3)
      deb_version (~> 1.0.1)
      pastel (~> 0.8.0)
      thor (~> 1.3)
      tty-command (~> 0.10.1)
-    sentry-rails (5.17.3)
+    sentry-rails (5.18.2)
      railties (>= 5.0)
-      sentry-ruby (~> 5.17.3)
-    sentry-ruby (5.17.3)
+      sentry-ruby (~> 5.18.2)
+    sentry-ruby (5.18.2)
      bigdecimal
      concurrent-ruby (~> 1.0, >= 1.0.2)
-    sentry-sidekiq (5.17.3)
-      sentry-ruby (~> 5.17.3)
+    sentry-sidekiq (5.18.2)
+      sentry-ruby (~> 5.18.2)
      sidekiq (>= 3.0)
    sexp_processor (4.17.1)
    shellany (0.0.1)
@ -1704,6 +1729,7 @@ GEM
    simplecov-html (0.12.3)
    simplecov-lcov (0.8.0)
    simplecov_json_formatter (0.1.4)
+    simpleidn (0.2.3)
    singleton (0.1.1)
    sixarm_ruby_unaccent (1.2.0)
    slack-messenger (2.3.6)
@ -1743,7 +1769,7 @@ GEM
      sprockets (>= 3.0.0)
    ssh_data (1.3.0)
    ssrf_filter (1.0.8)
-    stackprof (0.2.25)
+    stackprof (0.2.26)
    state_machines (0.5.0)
    state_machines-activemodel (0.8.0)
      activemodel (>= 5.1)
@ -1751,16 +1777,17 @@ GEM
    state_machines-activerecord (0.8.0)
      activerecord (>= 5.1)
      state_machines-activemodel (>= 0.8.0)
-    static_holmes (0.7.11)
    strings (0.2.1)
      strings-ansi (~> 0.2)
      unicode-display_width (>= 1.5, < 3.0)
      unicode_utils (~> 1.4)
    strings-ansi (0.2.0)
-    swd (1.3.0)
+    strscan (3.1.0)
+    swd (2.0.3)
      activesupport (>= 3)
      attr_required (>= 0.0.5)
-      httpclient (>= 2.4)
+      faraday (~> 2.0)
+      faraday-follow_redirects
    sync (0.5.0)
    sys-filesystem (1.4.3)
      ffi (~> 1.1)
@ -1778,7 +1805,7 @@ GEM
      unicode-display_width (>= 1.1.1, < 3)
    terser (1.0.2)
      execjs (>= 0.3.0, < 3)
-    test-prof (1.3.3)
+    test-prof (1.3.3.1)
    test_file_finder (0.3.1)
      faraday (>= 1.0, < 3.0, != 2.0.0)
    text (1.3.1)
@ -1827,15 +1854,16 @@ GEM
      tty-screen (~> 0.8)
      wisper (~> 2.0)
    tty-screen (0.8.1)
-    typhoeus (1.4.0)
+    typhoeus (1.4.1)
      ethon (>= 0.9.0)
    tzinfo (2.0.6)
      concurrent-ruby (~> 1.0)
    uber (0.1.0)
-    undercover (0.4.6)
+    undercover (0.5.0)
+      bigdecimal
      imagen (>= 0.1.8)
      rainbow (>= 2.1, < 4.0)
-      rugged (>= 0.27, < 1.7)
+      rugged (>= 0.27, < 1.8)
    unf (0.1.4)
      unf_ext
    unf_ext (0.0.8.2)
@ -1848,13 +1876,9 @@ GEM
      diff-lcs (~> 1.3)
      parser (>= 3.2.0)
    uri (0.13.0)
-    uri_template (0.7.0)
    valid_email (0.1.3)
      activemodel
      mail (>= 2.6.1)
-    validate_email (0.1.6)
-      activemodel (>= 3.0)
-      mail (>= 2.2.5)
    validate_url (1.0.15)
      activemodel (>= 3.0.0)
      public_suffix
@ -1863,7 +1887,7 @@ GEM
      activesupport (>= 3.0)
    version_gem (1.1.0)
    version_sorter (2.3.0)
-    view_component (3.12.1)
+    view_component (3.13.0)
      activesupport (>= 5.2.0, < 8.0)
      concurrent-ruby (~> 1.0)
      method_source (~> 1.0)
@ -1874,7 +1898,7 @@ GEM
    vite_rails (3.0.17)
      railties (>= 5.1, < 8)
      vite_ruby (~> 3.0, >= 3.2.2)
-    vite_ruby (3.5.0)
+    vite_ruby (3.7.0)
      dry-cli (>= 0.7, < 2)
      rack-proxy (~> 0.6, >= 0.6.1)
      zeitwerk (~> 2.2)
@ -1891,9 +1915,10 @@ GEM
      openssl (>= 2.2)
      safety_net_attestation (~> 0.4.0)
      tpm-key_attestation (~> 0.12.0)
-    webfinger (1.2.0)
+    webfinger (2.1.3)
      activesupport
-      httpclient (>= 2.4)
+      faraday (~> 2.0)
+      faraday-follow_redirects
    webmock (3.23.1)
      addressable (>= 2.8.0)
      crack (>= 0.3.2)
@ -1924,10 +1949,9 @@ PLATFORMS
 DEPENDENCIES
  CFPropertyList (~> 3.0.0)
  RedCloth (~> 4.3.3)
-  acme-client (~> 2.0)
+  acme-client (~> 2.0.18)
  activerecord-explain-analyze (~> 0.1)
  activerecord-gitlab!
-  acts-as-taggable-on (~> 10.0)
  addressable (~> 2.8)
  akismet (~> 3.0)
  apollo_upload_server (~> 2.1.6)
@ -1942,8 +1966,8 @@ DEPENDENCIES
  attr_encrypted (~> 3.2.4)!
  awesome_print
  aws-sdk-cloudformation (~> 1)
-  aws-sdk-core (~> 3.199.0)
-  aws-sdk-s3 (~> 1.154.0)
+  aws-sdk-core (~> 3.201.0)
+  aws-sdk-s3 (~> 1.157.0)
  axe-core-rspec (~> 4.9.0)
  babosa (~> 2.0)
  base32 (~> 0.3.0)
@ -1960,6 +1984,7 @@ DEPENDENCIES
  capybara (~> 3.40)
  capybara-screenshot (~> 1.0.26)
  carrierwave (~> 1.3)
+  charlock_holmes (~> 0.7.9)
  circuitbox (= 2.0.0)
  click_house-client!
  cloud_profiler_agent (~> 0.0.0)!
@ -1970,10 +1995,10 @@ DEPENDENCIES
  coverband (= 6.1.2)
  creole (~> 0.5.0)
  crystalball (~> 0.7.0)
-  cssbundling-rails (= 1.4.0)
+  cssbundling-rails (= 1.4.1)
  csv_builder!
  cvss-suite (~> 3.0.1)
-  database_cleaner-active_record (~> 2.1.0)
+  database_cleaner-active_record (~> 2.2.0)
  deckar01-task_list (= 2.3.4)
  declarative_policy (~> 1.1.0)
  deprecation_toolkit (~> 1.5.1)
@ -1991,15 +2016,18 @@ DEPENDENCIES
  doorkeeper-openid_connect (~> 1.8, >= 1.8.7)
  duo_api (~> 1.3)
  ed25519 (~> 1.3.0)
-  elasticsearch-api (= 7.13.3)
+  elasticsearch-api (= 7.17.11)
  elasticsearch-model (~> 7.2)
  elasticsearch-rails (~> 7.2)
  email_reply_trimmer (~> 0.1)
  email_spec (~> 2.2.0)
  error_tracking_open_api!
  factory_bot_rails (~> 6.4.3)
-  faraday (~> 1.10.3)
-  faraday_middleware-aws-sigv4 (~> 0.3.0)
+  faraday (~> 2)
+  faraday-multipart (~> 1.0)
+  faraday-retry (~> 2)
+  faraday-typhoeus (~> 1.1)
+  faraday_middleware-aws-sigv4 (~> 1.0.1)
  fast_blank (~> 1.0.1)
  ffaker (~> 2.23)
  flipper (~> 0.26.2)
@ -2015,12 +2043,13 @@ DEPENDENCIES
  gdk-toogle (~> 0.9, >= 0.9.5)
  gettext (~> 3.4, >= 3.4.9)
  gettext_i18n_rails (~> 1.12.0)
-  gitaly (~> 17.1.0)
+  gitaly (~> 17.2.0)
  gitlab-backup-cli!
  gitlab-chronic (~> 0.10.5)
  gitlab-dangerfiles (~> 4.8.0)
+  gitlab-duo-workflow-service-client (~> 0.1)!
  gitlab-experiment (~> 0.9.1)
-  gitlab-fog-azure-rm (~> 1.9.1)
+  gitlab-fog-azure-rm (~> 2.0.1)
  gitlab-glfm-markdown (~> 0.0.17)
  gitlab-housekeeper!
  gitlab-http!
@ -2037,10 +2066,11 @@ DEPENDENCIES
  gitlab-secret_detection!
  gitlab-sidekiq-fetcher!
  gitlab-styles (~> 12.0.1)
+  gitlab-topology-service-client (~> 0.1)!
  gitlab-utils!
  gitlab_chronic_duration (~> 0.12)
  gitlab_omniauth-ldap (~> 2.2.0)
-  gitlab_quality-test_tooling (~> 1.31.0)
+  gitlab_quality-test_tooling (~> 1.33.0)
  gon (~> 6.4.0)
  google-apis-androidpublisher_v3 (~> 0.34.0)
  google-apis-cloudbilling_v1 (~> 0.21.0)
@ -2066,11 +2096,11 @@ DEPENDENCIES
  grape-swagger-entity (~> 0.5.1)
  grape_logging (~> 1.8, >= 1.8.4)
  graphiql-rails (~> 1.10)
-  graphlient (~> 0.6.0)
+  graphlient (~> 0.8.0)
  graphlyte (~> 1.0.0)
  graphql (~> 2.3.5)
  graphql-docs (~> 5.0.0)
-  grpc (~> 1.63)
+  grpc (= 1.63.0)
  gssapi (~> 1.3.1)
  guard-rspec
  haml_lint (~> 0.58)
@ -2089,12 +2119,12 @@ DEPENDENCIES
  jira-ruby (~> 2.3.0)
  js_regex (~> 3.8)
  json (~> 2.7.2)
-  json_schemer (~> 0.2.18)
+  json_schemer (~> 2.3.0)
  jsonb_accessor (~> 1.3.10)
  jwt (~> 2.5)
  kaminari (~> 1.2.2)
-  kas-grpc (~> 0.5.0)
-  knapsack (~> 1.22.0)
+  kas-grpc (~> 0.6.0)
+  knapsack (~> 4.0.0)
  kramdown (~> 2.3.1)
  kubeclient (~> 4.11.0)
  lefthook (~> 1.6.8)
@ -2103,6 +2133,7 @@ DEPENDENCIES
  licensee (~> 9.16)
  listen (~> 3.7)
  lockbox (~> 1.3.0)
+  logger (~> 1.5.3)
  lograge (~> 0.5)
  loofah (~> 2.22.0)
  lookbook (~> 2.3)
@ -2139,8 +2170,9 @@ DEPENDENCIES
  omniauth-saml (~> 2.2.1)
  omniauth-shibboleth-redux (~> 2.0)
  omniauth_crowd (~> 2.4.0)!
-  omniauth_openid_connect (~> 0.6.1)
-  openid_connect (= 1.3.0)
+  omniauth_openid_connect (~> 0.8.0)
+  openbao_client!
+  openid_connect (~> 2.3.0)
  openssl (~> 3.0)
  opentelemetry-exporter-otlp
  opentelemetry-instrumentation-action_pack
@ -2184,7 +2216,7 @@ DEPENDENCIES
  rack (~> 2.2.9)
  rack-attack (~> 6.7.0)
  rack-cors (~> 2.0.1)
-  rack-oauth2 (~> 1.21.3)
+  rack-oauth2 (~> 2.2.1)
  rack-proxy (~> 0.7.7)
  rack-timeout (~> 0.7.0)
  rails (~> 7.0.8.4)
@ -2201,7 +2233,7 @@ DEPENDENCIES
  request_store (~> 1.5.1)
  responders (~> 3.0)
  retriable (~> 3.1.2)
-  rexml (~> 3.2.6)
+  rexml (~> 3.3.2)
  rouge (~> 4.3.0)
  rqrcode (~> 2.2)
  rspec-benchmark (~> 0.6.0)
@ -2226,9 +2258,9 @@ DEPENDENCIES
  seed-fu (~> 2.3.7)
  selenium-webdriver (~> 4.21, >= 4.21.1)
  semver_dialects (~> 3.0)
-  sentry-rails (~> 5.17.3)
-  sentry-ruby (~> 5.17.3)
-  sentry-sidekiq (~> 5.17.3)
+  sentry-rails (~> 5.18.0)
+  sentry-ruby (~> 5.18.0)
+  sentry-sidekiq (~> 5.18.0)
  shoulda-matchers (~> 5.1.0)
  sidekiq (~> 7.1.6)
  sidekiq-cron (~> 1.12.0)
@ -2247,9 +2279,8 @@ DEPENDENCIES
  sprockets (~> 3.7.0)
  sprockets-rails (~> 3.5.1)
  ssh_data (~> 1.3)
-  stackprof (~> 0.2.25)
+  stackprof (~> 0.2.26)
  state_machines-activerecord (~> 0.8.0)
-  static_holmes (~> 0.7.11)
  sys-filesystem (~> 1.4.3)
  tanuki_emoji (~> 0.9)
  telesignenterprise (~> 2.2)
@ -2262,14 +2293,14 @@ DEPENDENCIES
  truncato (~> 0.7.12)
  tty-prompt (~> 0.23)
  typhoeus (~> 1.4.0)
-  undercover (~> 0.4.4)
+  undercover (~> 0.5.0)
  unleash (~> 3.2.2)
  valid_email (~> 0.1)
  validates_hostname (~> 1.0.13)
  version_sorter (~> 2.3)
-  view_component (~> 3.12.1)
+  view_component (~> 3.13.0)
  vite_rails (~> 3.0.17)
-  vite_ruby (~> 3.5.0)
+  vite_ruby (~> 3.7.0)
  vmstat (~> 2.3.0)
  warning (~> 1.3.0)
  webauthn (~> 3.0)
--- a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
--- a/pkgs/development/compilers/nim/build-nim-package.nix
+++ b/pkgs/development/compilers/nim/build-nim-package.nix
--- a/pkgs/by-name/_1/_1password-cli/package.nix
+++ b/pkgs/by-name/_1/_1password-cli/package.nix
--- a/pkgs/by-name/_1/_1password-cli/update.sh
+++ b/pkgs/by-name/_1/_1password-cli/update.sh
--- a/pkgs/by-name/ca/cargo-pio/package.nix
+++ b/pkgs/by-name/ca/cargo-pio/package.nix
@ -0,0 +1,27 @@
+{ lib
+, fetchFromGitHub
+, rustPlatform
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "cargo-pio";
+  version = "0.25.6";
+
+  src = fetchFromGitHub {
+    owner = "esp-rs";
+    repo = "embuild";
+    rev = "cargo-pio-v${version}";
+    hash = "sha256-YH2CPb3uBlPncd+KkP25xhCVvDB7HDxJuSqWOJ1LT3k=";
+  };
+
+  cargoHash = "sha256-41ZDe7yP4C9JcX5trcDxcqdgZ+SnhDIIq51hM0Viv9w=";
+
+  buildAndTestSubdir = "cargo-pio";
+
+  meta = with lib; {
+    description = "Build Rust embedded projects with PlatformIO";
+    homepage = "https://github.com/esp-rs/embuild/tree/master/cargo-pio";
+    license = with lib.licenses; [ asl20 mit ];
+    maintainers = with maintainers; [ dannixon ];
+    mainProgram = "cargo-pio";
+  };
+}
--- a/pkgs/by-name/fl/flatpak/package.nix
+++ b/pkgs/by-name/fl/flatpak/package.nix
@ -74,6 +74,8 @@ stdenv.mkDerivation (finalAttrs: {
    "installedTests"
  ];

+  separateDebugInfo = true;
+
  src = fetchurl {
    url = "https://github.com/flatpak/flatpak/releases/download/${finalAttrs.version}/flatpak-${finalAttrs.version}.tar.xz";
    hash = "sha256-a73HkIEnNQrYWkpH1wKSyi9MRul3sysf0jHCpxnYIc0=";
--- a/pkgs/by-name/fy/fyne/package.nix
+++ b/pkgs/by-name/fy/fyne/package.nix
@ -17,16 +17,16 @@

 buildGoModule rec {
  pname = "fyne";
-  version = "2.5.1";
+  version = "2.5.2";

  src = fetchFromGitHub {
    owner = "fyne-io";
    repo = "fyne";
    rev = "refs/tags/v${version}";
-    hash = "sha256-21/52Uub5+l0TcuWZ9QSyckgR1kKNfDvro1CF5QuZWA=";
+    hash = "sha256-XaD7t1hSv5plDa6QHDTyoWgzvSFMRezvHl47YphXoig=";
  };

-  vendorHash = "sha256-+g11BRf9xRXjtF8InzdTHGOGOf8lJgLKEdBR5DcpEmo=";
+  vendorHash = "sha256-uV+pbGxAV/uuHV0xl2vPZpgGYRj9/E0rhFtLfCV5rnE=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/by-name/gi/github-markdown-toc-go/package.nix
+++ b/pkgs/by-name/gi/github-markdown-toc-go/package.nix
@ -0,0 +1,25 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+buildGoModule rec {
+  pname = "github-markdown-toc-go";
+  version = "1.4.0";
+
+  src = fetchFromGitHub {
+    owner = "ekalinin";
+    repo = "github-markdown-toc.go";
+    rev = "v${version}";
+    hash = "sha256-tZGAvbC9lrNhtRubCJUkQShRsfCsaAeI6XHhSp4FkS0=";
+  };
+
+  vendorHash = "sha256-K5yb7bnW6eS5UESK9wgNEUwGjB63eJk6+B0jFFiFero=";
+
+  meta = {
+    homepage = "https://github.com/ekalinin/github-markdown-toc.go";
+    description = "Easy TOC creation for GitHub README.md (in go)";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dannixon ];
+    mainProgram = "gh-md-toc";
+  };
+}
--- a/pkgs/by-name/gr/granian/Cargo.lock
+++ b/pkgs/by-name/gr/granian/Cargo.lock
--- a/pkgs/by-name/gr/granian/package.nix
+++ b/pkgs/by-name/gr/granian/package.nix
@ -8,21 +8,20 @@

 python3Packages.buildPythonApplication rec {
  pname = "granian";
-  version = "1.6.0";
+  version = "1.6.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "emmett-framework";
    repo = "granian";
    rev = "v${version}";
-    hash = "sha256-ZIwZrLl7goweYUj3t5e0yaOqeppFHXvK9PL3chNZZRw=";
+    hash = "sha256-Cuojg2Ko+KH/279z7HGYEthrMAqLgmnoHGjZ8HL7unw=";
  };

-  cargoDeps = rustPlatform.importCargoLock {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "pyo3-log-0.11.0" = "sha256-UU8064vM7cf20lwfifyPC205CY4tIgif0slDz/Pjf9Q=";
-    };
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-dRBjN0/EmQlGtQ1iGvSPE30KOHVlkWpjpMU2lpIGUdA=";
  };

  nativeBuildInputs = with rustPlatform; [
--- a/pkgs/by-name/ma/mattermost/package.nix
+++ b/pkgs/by-name/ma/mattermost/package.nix
@ -12,13 +12,13 @@ buildGoModule rec {
  # See https://docs.mattermost.com/upgrade/extended-support-release.html
  # When a new ESR version is available (e.g. 8.1.x -> 9.5.x), update
  # the version regex in passthru.updateScript as well.
-  version = "9.5.11";
+  version = "9.11.3";

  src = fetchFromGitHub {
    owner = "mattermost";
    repo = "mattermost";
    rev = "v${version}";
-    hash = "sha256-kPsBQjBMHxh5EGTFPNceE51nSEKSu6ieifIAV8PjpAc=";
+    hash = "sha256-CuFkydl1ZZUAWmrDIV1Jp9S6jIKYmglAe5XW2lTRgtQ=";
  };

  # Needed because buildGoModule does not support go workspaces yet.
@ -34,14 +34,14 @@ buildGoModule rec {

  webapp = fetchurl {
    url = "https://releases.mattermost.com/${version}/mattermost-${version}-linux-amd64.tar.gz";
-    hash = "sha256-dRB0CqUoEIkCDlH/vcn/S1TLlhz9iWp61WM2kk+ToZk=";
+    hash = "sha256-4JzhL2+G3T98pNFgKugs/eoSrbm7QSk5grVlprrIKEI=";
  };

  # Makes nix-update-script pick up the fetchurl for the webapp.
  # https://github.com/Mic92/nix-update/blob/1.3.1/nix_update/eval.py#L179
  offlineCache = webapp;

-  vendorHash = "sha256-3IiW5ZAMX0bbN65iFgD2CH3BmXd1Uv2HgcCqY8VQgrA=";
+  vendorHash = "sha256-Gwv6clnq7ihoFC8ox8iEM5xp/us9jWUrcmqA9/XbxBE=";

  modRoot = "./server";
  preBuild = ''
@ -73,7 +73,7 @@ buildGoModule rec {

  passthru = {
    updateScript = nix-update-script {
-      extraArgs = [ "--version-regex" "^v(9\.5\.[0-9]+)$" ];
+      extraArgs = [ "--version-regex" "^v(9\.11\.[0-9]+)$" ];
    };
    tests.mattermost = nixosTests.mattermost;
  };
--- a/pkgs/by-name/nf/nf-test/package.nix
+++ b/pkgs/by-name/nf/nf-test/package.nix
@ -10,11 +10,11 @@
 stdenv.mkDerivation rec {

  pname = "nf-test";
-  version = "0.9.0";
+  version = "0.9.1";

  src = fetchurl {
    url = "https://github.com/askimed/nf-test/releases/download/v${version}/nf-test-${version}.tar.gz";
-    hash = "sha256-PhI866NrbokMsSrU6YeSv03S1+VcNqVJsocI3xPfDcc=";
+    hash = "sha256-NjmB6bL9j6p4CWeVWU9q+aAe+dgH6lwUNZYARm41p8M=";
  };
  sourceRoot = ".";

--- a/pkgs/development/compilers/nim/nim.cfg.patch
+++ b/pkgs/development/compilers/nim/nim.cfg.patch
--- a/pkgs/by-name/ni/nim-1_0/package.nix
+++ b/pkgs/by-name/ni/nim-1_0/package.nix
@ -0,0 +1,12 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  nim-unwrapped-1,
+  nim,
+}:
+
+nim.passthru.wrapNim {
+  nimUnwrapped = nim-unwrapped-1;
+  patches = [ ./nim.cfg.patch ];
+}
--- a/pkgs/by-name/ni/nim-2_0/package.nix
+++ b/pkgs/by-name/ni/nim-2_0/package.nix
@ -0,0 +1,12 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  nim-unwrapped-2_0,
+  nim-2_2,
+}:
+
+nim-2_2.passthru.wrapNim {
+  nimUnwrapped = nim-unwrapped-2_0;
+  inherit (nim-2_2) patches;
+}
--- a/pkgs/development/compilers/nim/nim2.cfg.patch
+++ b/pkgs/development/compilers/nim/nim2.cfg.patch
--- a/pkgs/by-name/ni/nim-2_2/package.nix
+++ b/pkgs/by-name/ni/nim-2_2/package.nix
@ -0,0 +1,156 @@
+# When updating this package please check that all other versions of Nim
+# evaluate because they reuse definitions from the latest compiler.
+{
+  lib,
+  stdenv,
+  buildPackages,
+  darwin,
+  makeWrapper,
+  openssl,
+  pcre,
+  nim-unwrapped-2_2 ? buildPackages.nim-unwrapped-2_2,
+  Security ? darwin.Security,
+}:
+
+let
+  wrapNim =
+    { nimUnwrapped, patches }:
+    let
+      targetPlatformConfig = stdenv.targetPlatform.config;
+    in
+    stdenv.mkDerivation (finalAttrs: {
+      name = "${targetPlatformConfig}-nim-wrapper-${nimUnwrapped.version}";
+      inherit (nimUnwrapped) version;
+      preferLocalBuild = true;
+      strictDeps = true;
+
+      nativeBuildInputs = [ makeWrapper ];
+
+      # Needed for any nim package that uses the standard library's
+      # 'std/sysrand' module.
+      depsTargetTargetPropagated = lib.optional stdenv.hostPlatform.isDarwin Security;
+
+      inherit patches;
+
+      unpackPhase = ''
+        runHook preUnpack
+        tar xf ${nimUnwrapped.src} nim-$version/config
+        cd nim-$version
+        runHook postUnpack
+      '';
+
+      dontConfigure = true;
+
+      buildPhase =
+        # Configure the Nim compiler to use $CC and $CXX as backends
+        # The compiler is configured by two configuration files, each with
+        # a different DSL. The order of evaluation matters and that order
+        # is not documented, so duplicate the configuration across both files.
+        ''
+          runHook preBuild
+          cat >> config/config.nims << WTF
+
+          switch("os", "${nimUnwrapped.passthru.nimTarget.os}")
+          switch("cpu", "${nimUnwrapped.passthru.nimTarget.cpu}")
+          switch("define", "nixbuild")
+
+          # Configure the compiler using the $CC set by Nix at build time
+          import strutils
+          let cc = getEnv"CC"
+          if cc.contains("gcc"):
+            switch("cc", "gcc")
+          elif cc.contains("clang"):
+            switch("cc", "clang")
+          WTF
+
+          mv config/nim.cfg config/nim.cfg.old
+          cat > config/nim.cfg << WTF
+          os = "${nimUnwrapped.passthru.nimTarget.os}"
+          cpu =  "${nimUnwrapped.passthru.nimTarget.cpu}"
+          define:"nixbuild"
+          WTF
+
+          cat >> config/nim.cfg < config/nim.cfg.old
+          rm config/nim.cfg.old
+
+          cat >> config/nim.cfg << WTF
+
+          clang.cpp.exe %= "\$CXX"
+          clang.cpp.linkerexe %= "\$CXX"
+          clang.exe %= "\$CC"
+          clang.linkerexe %= "\$CC"
+          gcc.cpp.exe %= "\$CXX"
+          gcc.cpp.linkerexe %= "\$CXX"
+          gcc.exe %= "\$CC"
+          gcc.linkerexe %= "\$CC"
+          WTF
+
+          runHook postBuild
+        '';
+
+      wrapperArgs = lib.optionals (!(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64)) [
+        "--prefix PATH : ${lib.makeBinPath [ buildPackages.gdb ]}:${placeholder "out"}/bin"
+        # Used by nim-gdb
+
+        "--prefix LD_LIBRARY_PATH : ${
+          lib.makeLibraryPath [
+            openssl
+            pcre
+          ]
+        }"
+        # These libraries may be referred to by the standard library.
+        # This is broken for cross-compilation because the package
+        # set will be shifted back by nativeBuildInputs.
+
+        "--set NIM_CONFIG_PATH ${placeholder "out"}/etc/nim"
+        # Use the custom configuration
+      ];
+
+      installPhase =
+        ''
+          runHook preInstall
+
+          mkdir -p $out/bin $out/etc
+
+          cp -r config $out/etc/nim
+
+          for binpath in ${nimUnwrapped}/bin/nim?*; do
+            local binname=`basename $binpath`
+            makeWrapper \
+              $binpath $out/bin/${targetPlatformConfig}-$binname \
+              $wrapperArgs
+            ln -s $out/bin/${targetPlatformConfig}-$binname $out/bin/$binname
+          done
+
+          makeWrapper \
+            ${nimUnwrapped}/nim/bin/nim $out/bin/${targetPlatformConfig}-nim \
+            --set-default CC $(command -v $CC) \
+            --set-default CXX $(command -v $CXX) \
+            $wrapperArgs
+          ln -s $out/bin/${targetPlatformConfig}-nim $out/bin/nim
+
+          makeWrapper \
+            ${nimUnwrapped}/bin/testament $out/bin/${targetPlatformConfig}-testament \
+            $wrapperArgs
+          ln -s $out/bin/${targetPlatformConfig}-testament $out/bin/testament
+
+        ''
+        + ''
+          runHook postInstall
+        '';
+
+      passthru = nimUnwrapped.passthru // {
+        inherit wrapNim;
+        nim = nimUnwrapped;
+      };
+
+      meta = nimUnwrapped.meta // {
+        description = nimUnwrapped.meta.description + " (${targetPlatformConfig} wrapper)";
+        platforms = with lib.platforms; unix ++ genode ++ windows;
+      };
+    });
+in
+wrapNim {
+  nimUnwrapped = nim-unwrapped-2_2;
+  patches = [ ./nim2.cfg.patch ];
+}
--- a/pkgs/by-name/ni/nim-unwrapped-1_0/extra-mangling.patch
+++ b/pkgs/by-name/ni/nim-unwrapped-1_0/extra-mangling.patch
--- a/pkgs/by-name/ni/nim-unwrapped-1_0/package.nix
+++ b/pkgs/by-name/ni/nim-unwrapped-1_0/package.nix
@ -0,0 +1,30 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  nim-unwrapped-2,
+}:
+
+nim-unwrapped-2.overrideAttrs (
+  finalAttrs: prevAttrs: {
+    version = "1.6.20";
+    src = fetchurl {
+      url = "https://nim-lang.org/download/nim-${finalAttrs.version}.tar.xz";
+      hash = "sha256-/+0EdQTR/K9hDw3Xzz4Ce+kaKSsMnFEWFQTC87mE/7k=";
+    };
+
+    patches =
+      builtins.filter (
+        p:
+        builtins.elem (builtins.baseNameOf p) [
+          "NIM_CONFIG_DIR.patch"
+          "nixbuild.patch"
+        ]
+      ) nim-unwrapped-2.patches
+      ++ [
+        ./extra-mangling.patch
+        # Mangle store paths of modules to prevent runtime dependence.
+      ]
+      ++ lib.optional (!stdenv.hostPlatform.isWindows) ./toLocation.patch;
+  }
+)
--- a/pkgs/by-name/ni/nim-unwrapped-1_0/toLocation.patch
+++ b/pkgs/by-name/ni/nim-unwrapped-1_0/toLocation.patch
--- a/pkgs/by-name/ni/nim-unwrapped-2_0/package.nix
+++ b/pkgs/by-name/ni/nim-unwrapped-2_0/package.nix
@ -0,0 +1,27 @@
+{
+  lib,
+  fetchurl,
+  nim-unwrapped-1,
+  nim-unwrapped-2_2,
+}:
+
+nim-unwrapped-2_2.overrideAttrs (
+  finalAttrs: previousAttrs: {
+    version = "2.0.10";
+    src = fetchurl {
+      url = "https://nim-lang.org/download/nim-${finalAttrs.version}.tar.xz";
+      hash = "sha256-8UVDwjOpLHub0np9mEx4yfnBvXMyAwrBa+fFQMdbDqA=";
+    };
+    patches = lib.lists.unique (
+      builtins.filter (
+        p:
+        builtins.elem (builtins.baseNameOf p) [
+          "NIM_CONFIG_DIR.patch"
+          "nixbuild.patch"
+          "extra-mangling.patch"
+          "openssl.patch"
+        ]
+      ) (nim-unwrapped-1.patches ++ nim-unwrapped-2_2.patches)
+    );
+  }
+)
--- a/pkgs/by-name/ni/nim-unwrapped-2_2/NIM_CONFIG_DIR.patch
+++ b/pkgs/by-name/ni/nim-unwrapped-2_2/NIM_CONFIG_DIR.patch
--- a/pkgs/by-name/ni/nim-unwrapped-2_2/extra-mangling-2.patch
+++ b/pkgs/by-name/ni/nim-unwrapped-2_2/extra-mangling-2.patch
--- a/pkgs/by-name/ni/nim-unwrapped-2_2/nixbuild.patch
+++ b/pkgs/by-name/ni/nim-unwrapped-2_2/nixbuild.patch
--- a/pkgs/by-name/ni/nim-unwrapped-2_2/openssl.patch
+++ b/pkgs/by-name/ni/nim-unwrapped-2_2/openssl.patch
--- a/pkgs/by-name/ni/nim-unwrapped-2_2/package.nix
+++ b/pkgs/by-name/ni/nim-unwrapped-2_2/package.nix
@ -0,0 +1,187 @@
+# When updating this package please check that all other versions of Nim
+# evaluate because they reuse definitions from the latest compiler.
+{
+  lib,
+  stdenv,
+  fetchurl,
+  boehmgc,
+  openssl,
+  pcre,
+  readline,
+  sqlite,
+  darwin,
+  Security ? darwin.Security,
+}:
+
+let
+  parseCpu =
+    platform:
+    with platform;
+    # Derive a Nim CPU identifier
+    if isAarch32 then
+      "arm"
+    else if isAarch64 then
+      "arm64"
+    else if isAlpha then
+      "alpha"
+    else if isAvr then
+      "avr"
+    else if isMips && is32bit then
+      "mips"
+    else if isMips && is64bit then
+      "mips64"
+    else if isMsp430 then
+      "msp430"
+    else if isPower && is32bit then
+      "powerpc"
+    else if isPower && is64bit then
+      "powerpc64"
+    else if isRiscV && is64bit then
+      "riscv64"
+    else if isSparc then
+      "sparc"
+    else if isx86_32 then
+      "i386"
+    else if isx86_64 then
+      "amd64"
+    else
+      abort "no Nim CPU support known for ${config}";
+
+  parseOs =
+    platform:
+    with platform;
+    # Derive a Nim OS identifier
+    if isAndroid then
+      "Android"
+    else if isDarwin then
+      "MacOSX"
+    else if isFreeBSD then
+      "FreeBSD"
+    else if isGenode then
+      "Genode"
+    else if isLinux then
+      "Linux"
+    else if isNetBSD then
+      "NetBSD"
+    else if isNone then
+      "Standalone"
+    else if isOpenBSD then
+      "OpenBSD"
+    else if isWindows then
+      "Windows"
+    else if isiOS then
+      "iOS"
+    else
+      abort "no Nim OS support known for ${config}";
+
+  parsePlatform = p: {
+    cpu = parseCpu p;
+    os = parseOs p;
+  };
+
+  nimHost = parsePlatform stdenv.hostPlatform;
+  nimTarget = parsePlatform stdenv.targetPlatform;
+in
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "nim-unwrapped";
+  version = "2.2.0";
+  strictDeps = true;
+
+  src = fetchurl {
+    url = "https://nim-lang.org/download/nim-${finalAttrs.version}.tar.xz";
+    hash = "sha256-zphChJyXYOSH7N0c2t98DyhEyvrmBUAcfHKuJXZEiTw=";
+  };
+
+  buildInputs = [
+    boehmgc
+    openssl
+    pcre
+    readline
+    sqlite
+  ] ++ lib.optional stdenv.hostPlatform.isDarwin Security;
+
+  patches = [
+    ./NIM_CONFIG_DIR.patch
+    # Override compiler configuration via an environmental variable
+
+    ./nixbuild.patch
+    # Load libraries at runtime by absolute path
+
+    ./extra-mangling-2.patch
+    # Mangle store paths of modules to prevent runtime dependence.
+
+    ./openssl.patch
+    # dlopen is widely used by Python, Ruby, Perl, ... what you're really telling me here is that your OS is fundamentally broken. That might be news for you, but it isn't for me.
+  ];
+
+  configurePhase =
+    let
+      bootstrapCompiler = stdenv.mkDerivation {
+        pname = "nim-bootstrap";
+        inherit (finalAttrs) version src preBuild;
+        enableParallelBuilding = true;
+        installPhase = ''
+          runHook preInstall
+          install -Dt $out/bin bin/nim
+          runHook postInstall
+        '';
+      };
+    in
+    ''
+      runHook preConfigure
+      cp ${bootstrapCompiler}/bin/nim bin/
+      echo 'define:nixbuild' >> config/nim.cfg
+      runHook postConfigure
+    '';
+
+  kochArgs =
+    [
+      "--cpu:${nimHost.cpu}"
+      "--os:${nimHost.os}"
+      "-d:release"
+      "-d:useGnuReadline"
+    ]
+    ++ lib.optional (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isLinux) "-d:nativeStacktrace";
+
+  preBuild = lib.optionalString (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) ''
+    substituteInPlace makefile \
+      --replace "aarch64" "arm64"
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+    local HOME=$TMPDIR
+    ./bin/nim c --parallelBuild:$NIX_BUILD_CORES koch
+    ./koch boot $kochArgs --parallelBuild:$NIX_BUILD_CORES
+    ./koch toolsNoExternal $kochArgs --parallelBuild:$NIX_BUILD_CORES
+    ./bin/nim js -d:release tools/dochack/dochack.nim
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -Dt $out/bin bin/*
+    ln -sf $out/nim/bin/nim $out/bin/nim
+    ln -sf $out/nim/lib $out/lib
+    ./install.sh $out
+    cp -a tools dist $out/nim/
+    runHook postInstall
+  '';
+
+  passthru = {
+    inherit nimHost nimTarget;
+  };
+
+  meta = with lib; {
+    description = "Statically typed, imperative programming language";
+    homepage = "https://nim-lang.org/";
+    license = licenses.mit;
+    mainProgram = "nim";
+    maintainers = with maintainers; [
+      ehmry
+      eveeifyeve
+    ];
+  };
+
+})
--- a/pkgs/by-name/ni/nimlsp/package.nix
+++ b/pkgs/by-name/ni/nimlsp/package.nix
@ -1,6 +1,12 @@
-{ lib, buildNimPackage, fetchFromGitHub, srcOnly, nim-unwrapped-2 }:
+{ lib, buildNimPackage, fetchFromGitHub, srcOnly, nim-2_0, nim-unwrapped-2_0 }:

-buildNimPackage (finalAttrs: {
+let
+  buildNimPackage' = buildNimPackage.override {
+    # Do not build with Nim-2.2.x.
+    nim2 = nim-2_0;
+  };
+in
+buildNimPackage' (finalAttrs: {
  pname = "nimlsp";
  version = "0.4.6";

@ -27,7 +33,7 @@ buildNimPackage (finalAttrs: {

  nimFlags = [
    "--threads:on"
-    "-d:explicitSourcePath=${srcOnly nim-unwrapped-2}"
+    "-d:explicitSourcePath=${srcOnly nim-unwrapped-2_0}"
    "-d:tempDir=/tmp"
  ];

--- a/pkgs/by-name/py/pytr/package.nix
+++ b/pkgs/by-name/py/pytr/package.nix
@ -8,14 +8,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "pytr";
-  version = "0.2.5";
+  version = "0.3.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pytr-org";
    repo = "pytr";
    rev = "refs/tags/v${version}";
-    hash = "sha256-9FKG4QgRBU+DaaYJIDMDqqxFMCAguv5iRUUrQr6RMz8=";
+    hash = "sha256-sMDWL0lA5iJ2v2dhUIhMgSZ1vk7LjkNMYZGiJRpd3XY=";
  };

  build-system = with python3Packages; [
@ -49,7 +49,7 @@ python3Packages.buildPythonApplication rec {
  pythonImportsCheck = [ "pytr" ];

  meta = {
-    changelog = "https://github.com/pytr-org/pytr/releases/tag/${version}";
+    changelog = "https://github.com/pytr-org/pytr/releases/tag/${lib.removePrefix "refs/tags/" src.rev}";
    description = "Use TradeRepublic in terminal and mass download all documents";
    homepage = "https://github.com/pytr-org/pytr";
    license = lib.licenses.mit;
--- a/pkgs/by-name/tu/tun2proxy/package.nix
+++ b/pkgs/by-name/tu/tun2proxy/package.nix
@ -3,18 +3,19 @@
  rustPlatform,
  fetchFromGitHub,
 }:
+
 rustPlatform.buildRustPackage rec {
  pname = "tun2proxy";
-  version = "0.5.4";
+  version = "0.6.0";

  src = fetchFromGitHub {
    owner = "tun2proxy";
    repo = "tun2proxy";
-    rev = "v${version}";
-    hash = "sha256-EeSXEPg4TxbjQXoM2jx8T9+VOT7VndBnxhy7pwwQ8Kk=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-LY7vVD85GVFqARYOBDeb4fS6rL2PwPXYXIAJtwm2goo=";
  };

-  cargoHash = "sha256-WwCUSnXSlSrO+YfqpZlC9WWsX/pM6ixYlqU1pZY4e5o=";
+  cargoHash = "sha256-o/zQjWR9qNs0XVL/dcRiMHgj+8Xvl6vVl/Yw5iLhroI=";

  cargoPatches = [
    ./Cargo.lock.patch
@ -23,6 +24,7 @@ rustPlatform.buildRustPackage rec {
  meta = {
    homepage = "https://github.com/tun2proxy/tun2proxy";
    description = "Tunnel (TUN) interface for SOCKS and HTTP proxies";
+    changelog = "https://github.com/tun2proxy/tun2proxy/releases/tag/v${version}";
    license = lib.licenses.mit;
    platforms = lib.platforms.linux;
    mainProgram = "tun2proxy-bin";
--- a/pkgs/by-name/wi/wiremock/package.nix
+++ b/pkgs/by-name/wi/wiremock/package.nix
@ -10,11 +10,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "wiremock";
-  version = "3.9.1";
+  version = "3.9.2";

  src = fetchurl {
    url = "mirror://maven/org/wiremock/wiremock-standalone/${finalAttrs.version}/wiremock-standalone-${finalAttrs.version}.jar";
-    hash = "sha256-cjqIDVDTsKFFrw3wfleMLLhed/6yIx5pkcmhNmkmkSw=";
+    hash = "sha256-d7iNxBwyaOPOOR8/7yIrDNBpbyhtP8NahLoi/8uHcBI=";
  };

  dontUnpack = true;
--- a/pkgs/development/compilers/elm/packages/lamdera/default.nix
+++ b/pkgs/development/compilers/elm/packages/lamdera/default.nix
@ -8,16 +8,16 @@ let
  arch = if stdenv.hostPlatform.isAarch64 then "arm64" else "x86_64";
  hashes =
    {
-      "x86_64-linux" = "1v596zi4zmx88r4axrp7pmci3w9c6f1kz4izrbj65c7ch6wwa7f2";
-      "aarch64-linux" = "0xf6lqm9xgph8q95h6smq6dzn5549nfsnayny5nyvm56nbmv5iw9";
-      "x86_64-darwin" = "0kijrjfbr7hn469x67yya6ndfwj901m54gd96sq3yiay0jvmapga";
-      "aarch64-darwin" = "1iigsd4ac0cbb1q2g02zxjxpcma6yyd7ms72ri8g2vq8i90zys9n";
+      "x86_64-linux" = "8534ff055073490719ed05be847bebef46250ebb7af1d72bdaa4fc115c6dcea3";
+      "aarch64-linux" = "01397ce50cb0ad1dac18e4e0f7ab490bbf41a1c23d06a1946eec689e7811085b";
+      "x86_64-darwin" = "46305fb0de9fd7685fdf7cf175ad965d5320f76d4b5f2de2f9dc8403c8127d52";
+      "aarch64-darwin" = "b1e3d7bd624cdff0522bd71dc5825fa98b4eed1eae064df55a86a40b554ce0d1";
    };
 in

 stdenv.mkDerivation rec {
  pname = "lamdera";
-  version = "1.3.0";
+  version = "1.3.1";

  src = fetchurl {
    url = "https://static.lamdera.com/bin/lamdera-${version}-${os}-${arch}";
--- a/pkgs/development/compilers/nim/default.nix
+++ b/pkgs/development/compilers/nim/default.nix
@ -1,325 +0,0 @@
-# https://nim-lang.github.io/Nim/packaging.html
-# https://nim-lang.org/docs/nimc.html
-
-{ lib, callPackage, buildPackages, stdenv, fetchurl, fetchgit
-, makeWrapper, openssl, pcre, readline, boehmgc, sqlite, Security
-, nim-unwrapped-2, nim-unwrapped-1, nim }:
-
-let
-  parseCpu = platform:
-    with platform;
-    # Derive a Nim CPU identifier
-    if isAarch32 then
-      "arm"
-    else if isAarch64 then
-      "arm64"
-    else if isAlpha then
-      "alpha"
-    else if isAvr then
-      "avr"
-    else if isMips && is32bit then
-      "mips"
-    else if isMips && is64bit then
-      "mips64"
-    else if isMsp430 then
-      "msp430"
-    else if isPower && is32bit then
-      "powerpc"
-    else if isPower && is64bit then
-      "powerpc64"
-    else if isRiscV && is64bit then
-      "riscv64"
-    else if isSparc then
-      "sparc"
-    else if isx86_32 then
-      "i386"
-    else if isx86_64 then
-      "amd64"
-    else
-      abort "no Nim CPU support known for ${config}";
-
-  parseOs = platform:
-    with platform;
-    # Derive a Nim OS identifier
-    if isAndroid then
-      "Android"
-    else if isDarwin then
-      "MacOSX"
-    else if isFreeBSD then
-      "FreeBSD"
-    else if isGenode then
-      "Genode"
-    else if isLinux then
-      "Linux"
-    else if isNetBSD then
-      "NetBSD"
-    else if isNone then
-      "Standalone"
-    else if isOpenBSD then
-      "OpenBSD"
-    else if isWindows then
-      "Windows"
-    else if isiOS then
-      "iOS"
-    else
-      abort "no Nim OS support known for ${config}";
-
-  parsePlatform = p: {
-    cpu = parseCpu p;
-    os = parseOs p;
-  };
-
-  nimHost = parsePlatform stdenv.hostPlatform;
-  nimTarget = parsePlatform stdenv.targetPlatform;
-
-in {
-
-  nim-unwrapped-2 = stdenv.mkDerivation (finalAttrs: {
-    pname = "nim-unwrapped";
-    version = "2.2.0";
-    strictDeps = true;
-
-    src = fetchurl {
-      url = "https://nim-lang.org/download/nim-${finalAttrs.version}.tar.xz";
-      hash = "sha256-zphChJyXYOSH7N0c2t98DyhEyvrmBUAcfHKuJXZEiTw=";
-    };
-
-    buildInputs = [ boehmgc openssl pcre readline sqlite ]
-      ++ lib.optional stdenv.hostPlatform.isDarwin Security;
-
-    patches = [
-      ./NIM_CONFIG_DIR.patch
-      # Override compiler configuration via an environmental variable
-
-      ./nixbuild.patch
-      # Load libraries at runtime by absolute path
-
-      ./extra-mangling-2.patch
-      # Mangle store paths of modules to prevent runtime dependence.
-
-      ./openssl.patch
-      # dlopen is widely used by Python, Ruby, Perl, ... what you're really telling me here is that your OS is fundamentally broken. That might be news for you, but it isn't for me.
-    ];
-
-    configurePhase = let
-      bootstrapCompiler = stdenv.mkDerivation {
-        pname = "nim-bootstrap";
-        inherit (finalAttrs) version src preBuild;
-        enableParallelBuilding = true;
-        installPhase = ''
-          runHook preInstall
-          install -Dt $out/bin bin/nim
-          runHook postInstall
-        '';
-      };
-    in ''
-      runHook preConfigure
-      cp ${bootstrapCompiler}/bin/nim bin/
-      echo 'define:nixbuild' >> config/nim.cfg
-      runHook postConfigure
-    '';
-
-    kochArgs = [
-      "--cpu:${nimHost.cpu}"
-      "--os:${nimHost.os}"
-      "-d:release"
-      "-d:useGnuReadline"
-    ] ++ lib.optional (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isLinux) "-d:nativeStacktrace";
-
-    preBuild = lib.optionalString (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) ''
-      substituteInPlace makefile \
-        --replace "aarch64" "arm64"
-    '';
-
-    buildPhase = ''
-      runHook preBuild
-      local HOME=$TMPDIR
-      ./bin/nim c --parallelBuild:$NIX_BUILD_CORES koch
-      ./koch boot $kochArgs --parallelBuild:$NIX_BUILD_CORES
-      ./koch toolsNoExternal $kochArgs --parallelBuild:$NIX_BUILD_CORES
-      ./bin/nim js -d:release tools/dochack/dochack.nim
-      runHook postBuild
-    '';
-
-    installPhase = ''
-      runHook preInstall
-      install -Dt $out/bin bin/*
-      ln -sf $out/nim/bin/nim $out/bin/nim
-      ln -sf $out/nim/lib $out/lib
-      ./install.sh $out
-      cp -a tools dist $out/nim/
-      runHook postInstall
-    '';
-
-    passthru = {
-      updateScript.command = [ ./update.sh ];
-    };
-
-    meta = with lib; {
-      description = "Statically typed, imperative programming language";
-      homepage = "https://nim-lang.org/";
-      license = licenses.mit;
-      mainProgram = "nim";
-      maintainers = with maintainers; [ ehmry eveeifyeve ];
-    };
-  });
-
-  nim-unwrapped-1 = nim-unwrapped-2.overrideAttrs (finalAttrs: prevAttrs: {
-    version = "1.6.20";
-    src = fetchurl {
-      url = "https://nim-lang.org/download/nim-${finalAttrs.version}.tar.xz";
-      hash = "sha256-/+0EdQTR/K9hDw3Xzz4Ce+kaKSsMnFEWFQTC87mE/7k=";
-    };
-
-    patches = [
-      ./NIM_CONFIG_DIR.patch
-      # Override compiler configuration via an environmental variable
-
-      ./nixbuild.patch
-      # Load libraries at runtime by absolute path
-
-      ./extra-mangling.patch
-      # Mangle store paths of modules to prevent runtime dependence.
-    ] ++ lib.optional (!stdenv.hostPlatform.isWindows) ./toLocation.patch;
-  });
-
-} // (let
-  wrapNim = { nim', patches }:
-    let targetPlatformConfig = stdenv.targetPlatform.config;
-    in stdenv.mkDerivation (finalAttrs: {
-        name = "${targetPlatformConfig}-nim-wrapper-${nim'.version}";
-        inherit (nim') version;
-        preferLocalBuild = true;
-        strictDeps = true;
-
-        nativeBuildInputs = [ makeWrapper ];
-
-        # Needed for any nim package that uses the standard library's
-        # 'std/sysrand' module.
-        depsTargetTargetPropagated = lib.optional stdenv.hostPlatform.isDarwin Security;
-
-        inherit patches;
-
-        unpackPhase = ''
-          runHook preUnpack
-          tar xf ${nim'.src} nim-$version/config
-          cd nim-$version
-          runHook postUnpack
-        '';
-
-        dontConfigure = true;
-
-        buildPhase =
-          # Configure the Nim compiler to use $CC and $CXX as backends
-          # The compiler is configured by two configuration files, each with
-          # a different DSL. The order of evaluation matters and that order
-          # is not documented, so duplicate the configuration across both files.
-          ''
-            runHook preBuild
-            cat >> config/config.nims << WTF
-
-            switch("os", "${nimTarget.os}")
-            switch("cpu", "${nimTarget.cpu}")
-            switch("define", "nixbuild")
-
-            # Configure the compiler using the $CC set by Nix at build time
-            import strutils
-            let cc = getEnv"CC"
-            if cc.contains("gcc"):
-              switch("cc", "gcc")
-            elif cc.contains("clang"):
-              switch("cc", "clang")
-            WTF
-
-            mv config/nim.cfg config/nim.cfg.old
-            cat > config/nim.cfg << WTF
-            os = "${nimTarget.os}"
-            cpu =  "${nimTarget.cpu}"
-            define:"nixbuild"
-            WTF
-
-            cat >> config/nim.cfg < config/nim.cfg.old
-            rm config/nim.cfg.old
-
-            cat >> config/nim.cfg << WTF
-
-            clang.cpp.exe %= "\$CXX"
-            clang.cpp.linkerexe %= "\$CXX"
-            clang.exe %= "\$CC"
-            clang.linkerexe %= "\$CC"
-            gcc.cpp.exe %= "\$CXX"
-            gcc.cpp.linkerexe %= "\$CXX"
-            gcc.exe %= "\$CC"
-            gcc.linkerexe %= "\$CC"
-            WTF
-
-            runHook postBuild
-          '';
-
-        wrapperArgs = lib.optionals (!(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64)) [
-          "--prefix PATH : ${lib.makeBinPath [ buildPackages.gdb ]}:${
-            placeholder "out"
-          }/bin"
-          # Used by nim-gdb
-
-          "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ openssl pcre ]}"
-          # These libraries may be referred to by the standard library.
-          # This is broken for cross-compilation because the package
-          # set will be shifted back by nativeBuildInputs.
-
-          "--set NIM_CONFIG_PATH ${placeholder "out"}/etc/nim"
-          # Use the custom configuration
-        ];
-
-        installPhase = ''
-          runHook preInstall
-
-          mkdir -p $out/bin $out/etc
-
-          cp -r config $out/etc/nim
-
-          for binpath in ${nim'}/bin/nim?*; do
-            local binname=`basename $binpath`
-            makeWrapper \
-              $binpath $out/bin/${targetPlatformConfig}-$binname \
-              $wrapperArgs
-            ln -s $out/bin/${targetPlatformConfig}-$binname $out/bin/$binname
-          done
-
-          makeWrapper \
-            ${nim'}/nim/bin/nim $out/bin/${targetPlatformConfig}-nim \
-            --set-default CC $(command -v $CC) \
-            --set-default CXX $(command -v $CXX) \
-            $wrapperArgs
-          ln -s $out/bin/${targetPlatformConfig}-nim $out/bin/nim
-
-          makeWrapper \
-            ${nim'}/bin/testament $out/bin/${targetPlatformConfig}-testament \
-            $wrapperArgs
-          ln -s $out/bin/${targetPlatformConfig}-testament $out/bin/testament
-
-        '' + ''
-          runHook postInstall
-        '';
-
-        passthru = { nim = nim'; };
-
-        meta = nim'.meta // {
-          description = nim'.meta.description
-            + " (${targetPlatformConfig} wrapper)";
-          platforms = with lib.platforms; unix ++ genode ++ windows;
-        };
-      });
-in {
-
-  nim2 = wrapNim {
-    nim' = buildPackages.nim-unwrapped-2;
-    patches = [ ./nim2.cfg.patch ];
-  };
-
-  nim1 = wrapNim {
-    nim' = buildPackages.nim-unwrapped-1;
-    patches = [ ./nim.cfg.patch ];
-  };
-
-})
--- a/pkgs/development/compilers/nim/update.sh
+++ b/pkgs/development/compilers/nim/update.sh
@ -1,25 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p bash nix-update curl coreutils jq
-
-set -ex
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
-
-curl_github() {
-  curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} "$@"
-}
-
-
-case "$UPDATE_NIX_ATTR_PATH" in
-nim)
-  latestTag=$(curl_github https://api.github.com/repos/nim-lang/Nim/releases/latest | jq -r ".tag_name")
-  latestVersion="$(expr "$latestTag" : 'v\(.*\)')"
-
-  echo "Updating Nim"
-  nix-update --version "$latestVersion" \
-    --override-filename "$SCRIPT_DIR/default.nix" \
-  nim
-*)
-  echo "Unknown attr path $UPDATE_NIX_ATTR_PATH"
-  ;;
-esac
--- a/pkgs/development/coq-modules/mathcomp-analysis/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-analysis/default.nix
@ -9,6 +9,7 @@ let
  repo  = "analysis";
  owner = "math-comp";

+  release."1.5.0".sha256 = "sha256-EWogrkr5TC5F9HjQJwO3bl4P8mij8U7thUGJNNI+k88=";
  release."1.4.0".sha256 = "sha256-eDggeuEU0fMK7D5FbxvLkbAgpLw5lwL/Rl0eLXAnJeg=";
  release."1.2.0".sha256 = "sha256-w6BivDM4dF4Iv4rUTy++2feweNtMAJxgGExPfYGhXxo=";
  release."1.1.0".sha256 = "sha256-wl4kZf4mh9zbFfGcqaFEgWRyp0Bj511F505mYodpS6o=";
@ -33,7 +34,7 @@ let

  defaultVersion = let inherit (lib.versions) range; in
    lib.switch [ coq.version mathcomp.version ] [
-      { cases = [ (range "8.19" "8.20") (range "2.1.0" "2.2.0") ];   out = "1.4.0"; }
+      { cases = [ (range "8.19" "8.20") (range "2.1.0" "2.2.0") ];   out = "1.5.0"; }
      { cases = [ (range "8.17" "8.20") (range "2.0.0" "2.2.0") ];   out = "1.1.0"; }
      { cases = [ (range "8.17" "8.19") (range "1.17.0" "1.19.0") ]; out = "0.7.0"; }
      { cases = [ (range "8.17" "8.18") (range "1.15.0" "1.18.0") ]; out = "0.6.7"; }
--- a/pkgs/development/coq-modules/mathcomp-infotheo/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-infotheo/default.nix
@ -7,12 +7,14 @@
  inherit version;

  defaultVersion = with lib.versions; lib.switch [ coq.version mathcomp-analysis.version] [
+    { cases = [ (range "8.18" "8.20") (isGe "1.5") ];            out = "0.7.3"; }
    { cases = [ (range "8.18" "8.19") (isGe "1.2") ];            out = "0.7.2"; }
    { cases = [ (range "8.17" "8.19") (isGe "1.0") ];                    out = "0.7.1"; }
    { cases = [ (isGe "8.17") (range "0.6.6" "0.7.0") ];         out = "0.6.1"; }
    { cases = [ (range "8.17" "8.18") (range "0.6.0" "0.6.7") ]; out = "0.5.2"; }
    { cases = [ (range "8.15" "8.16") (range "0.5.4" "0.6.5") ]; out = "0.5.1"; }
  ] null;
+  release."0.7.3".sha256 = "sha256-7+qPtE1KfDmo9ZsQtWMzoR2MYnFpTjFHK/yZYVm+GxA=";
  release."0.7.2".sha256 = "sha256-dekrdVmuTcqXXmKhIb831EKtMhbPrXHJZhzmGb9rdRo=";
  release."0.7.1".sha256 = "sha256-/4Elb35SmscG6EjEcHYDo+AmWrpBUlygZL0WhaD+fcY=";
  release."0.6.1".sha256 = "sha256-tFB5lrwRPIlHkP+ebgcJwu03Cc9yVaOINOAo8Bf2LT4=";
--- a/pkgs/development/interpreters/bqn/cbqn/sources.nix
+++ b/pkgs/development/interpreters/bqn/cbqn/sources.nix
@ -10,13 +10,13 @@
  cbqn = let
    self = {
      pname = "cbqn";
-      version = "0.7.0";
+      version = "0.8.0";

      src = fetchFromGitHub {
        owner = "dzaima";
        repo = "CBQN";
        rev = "v${self.version}";
-        hash = "sha256-TUK0HrJ1IyiVi9Y3S1IrK/d4/EZxdRdWyxsAwj79KEc=";
+        hash = "sha256-vmd7CX0jgozysmjKK0p5GM4Qd3vY71q1kcKwfr+6fkw=";
      };
    };
  in
@ -24,13 +24,13 @@

  cbqn-bytecode = {
    pname = "cbqn-bytecode";
-    version = "0-unstable-2024-05-22";
+    version = "0-unstable-2024-09-15";

    src = fetchFromGitHub {
      owner = "dzaima";
      repo = "cbqnBytecode";
-      rev = "c5674783c11d7569e5a4d166600ffcde2409331d";
-      hash = "sha256-y7gqHzUxVUUVryutlq3Upuso8r3ZRSyF7ydMg1OVlwA=";
+      rev = "c7d83937710889591bad3525077afc30a21e5148";
+      hash = "sha256-bEHyiJusddBuTk7MZX1NGvkj66WeOJv5qxBQV6Uhs1E=";
    };
  };

@ -48,13 +48,13 @@

  singeli = {
    pname = "singeli";
-    version = "0-unstable-2024-02-26";
+    version = "0-unstable-2024-09-29";

    src = fetchFromGitHub {
      owner = "mlochbaum";
      repo = "Singeli";
-      rev = "ce6ef5d06d35777f0016bbfe0c6c1cf6a9c1b48e";
-      hash = "sha256-dDoWoq4LYMD2CKyPxXDAwoeH2E+f0FDyvngtWPEr67w=";
+      rev = "b43f3999b0c5a40b43ceee258fbe6bb8245d06af";
+      hash = "sha256-tf5mYIV368Y2cgYJ0U4OZQxuN6kldHUKi9oSjAHbA4Y=";
    };
  };
 }
--- a/pkgs/development/interpreters/php/8.2.nix
+++ b/pkgs/development/interpreters/php/8.2.nix
@ -2,8 +2,8 @@

 let
  base = callPackage ./generic.nix (_args // {
-    version = "8.2.24";
-    hash = "sha256-TMduxkTu6X0XySv+jQ6EcU/t8pmlOLffrcBjndDcQy8=";
+    version = "8.2.25";
+    hash = "sha256-B7QcXpbGDAllEORfAvgYQU0RvdDV2htoQN26K6colAE=";
  });
 in
 base.withExtensions ({ all, ... }: with all; ([
--- a/pkgs/development/ocaml-modules/kdf/default.nix
+++ b/pkgs/development/ocaml-modules/kdf/default.nix
@ -0,0 +1,30 @@
+{ lib
+, buildDunePackage
+, fetchurl
+, digestif
+, mirage-crypto
+, alcotest
+, ohex
+}:
+
+buildDunePackage rec {
+  pname = "kdf";
+  version = "1.0.0";
+
+  src = fetchurl {
+    url = "https://github.com/robur-coop/kdf/releases/download/v${version}/kdf-${version}.tbz";
+    hash = "sha256-0WFYKw7+ZtlY3WuMnCEGjp9kVM4hg3fWz4eCPexi4M4=";
+  };
+
+  propagatedBuildInputs = [ digestif mirage-crypto ];
+
+  checkInputs = [ alcotest ohex ];
+  doCheck = true;
+
+  meta = {
+    description = "Key Derivation Functions: HKDF RFC 5869, PBKDF RFC 2898, SCRYPT RFC 7914";
+    homepage = "https://github.com/robur-coop/kdf";
+    license = lib.licenses.bsd2;
+    maintainers = [ lib.maintainers.vbgl ];
+  };
+}
--- a/pkgs/development/ocaml-modules/otr/default.nix
+++ b/pkgs/development/ocaml-modules/otr/default.nix
@ -1,19 +1,19 @@
 { lib, fetchurl, buildDunePackage
-, cstruct, sexplib0, mirage-crypto, mirage-crypto-pk, astring, base64
+, digestif, sexplib0, mirage-crypto, mirage-crypto-pk, astring, base64
 }:

 buildDunePackage rec {
  pname = "otr";
-  version = "0.3.10";
+  version = "1.0.0";

-  minimalOCamlVersion = "4.08";
+  minimalOCamlVersion = "4.13";

  src = fetchurl {
-    url = "https://github.com/hannesm/ocaml-otr/releases/download/v${version}/otr-v${version}.tbz";
-    hash = "sha256:0dssc7p6s7z53n0mddyipjghzr8ld8bb7alaxqrx9gdpspwab1gq";
+    url = "https://github.com/hannesm/ocaml-otr/releases/download/v${version}/otr-${version}.tbz";
+    hash = "sha256-/CcVqLbdylB+LqpKNETkpvQ8SEAIcEFCO1MZqvdmJWU=";
  };

-  propagatedBuildInputs = [ cstruct sexplib0 mirage-crypto mirage-crypto-pk
+  propagatedBuildInputs = [ digestif sexplib0 mirage-crypto mirage-crypto-pk
                            astring base64 ];

  doCheck = true;
@ -23,6 +23,5 @@ buildDunePackage rec {
    description = "Off-the-record messaging protocol, purely in OCaml";
    license = licenses.bsd2;
    maintainers = with maintainers; [ sternenseemann ];
-    broken = true; # Not compatible with mirage-crypto ≥ 1.0
  };
 }
--- a/pkgs/development/ocaml-modules/tls/default.nix
+++ b/pkgs/development/ocaml-modules/tls/default.nix
@ -1,16 +1,16 @@
 { lib, fetchurl, buildDunePackage
-, domain-name, fmt, logs, hkdf, mirage-crypto, mirage-crypto-ec, mirage-crypto-pk, mirage-crypto-rng, ptime, x509
+, domain-name, fmt, logs, kdf, mirage-crypto, mirage-crypto-ec, mirage-crypto-pk, mirage-crypto-rng, x509
 , ipaddr
 , alcotest, ounit2
 }:

 buildDunePackage rec {
  pname = "tls";
-  version = "1.0.1";
+  version = "1.0.2";

  src = fetchurl {
    url = "https://github.com/mirleft/ocaml-tls/releases/download/v${version}/tls-${version}.tbz";
-    hash = "sha256-2uS1/8gD6ILphIBCWP+KrKe4N9hVbeaEABldpccKjYM=";
+    hash = "sha256-ohdRIAyzFG/+FUf11t4Ye1FH6O5r7RKwnVLAAtQrP+s=";
  };

  minimalOCamlVersion = "4.08";
@ -19,12 +19,11 @@ buildDunePackage rec {
    domain-name
    fmt
    logs
-    hkdf
+    kdf
    mirage-crypto
    mirage-crypto-ec
    mirage-crypto-pk
    mirage-crypto-rng
-    ptime
    x509
    ipaddr
  ];
--- a/pkgs/development/python-modules/aiocoap/default.nix
+++ b/pkgs/development/python-modules/aiocoap/default.nix
@ -19,7 +19,7 @@

 buildPythonPackage rec {
  pname = "aiocoap";
-  version = "0.4.10";
+  version = "0.4.11";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -28,7 +28,7 @@ buildPythonPackage rec {
    owner = "chrysn";
    repo = "aiocoap";
    rev = "refs/tags/${version}";
-    hash = "sha256-sKDkbv8OyPewfQpunFxezP0wjy3EAQxsQ0UfUm0REPM=";
+    hash = "sha256-a2qhMDFkRbMK4+xvPc140i0lPaWbTWeFlpvdLaNtOxA=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/distrax/default.nix
+++ b/pkgs/development/python-modules/distrax/default.nix
@ -74,6 +74,20 @@ buildPythonPackage rec {
    "distrax/_src/distributions/transformed_test.py"
    "distrax/_src/distributions/uniform_test.py"
    "distrax/_src/utils/transformations_test.py"
+    # https://github.com/google-deepmind/distrax/pull/270
+    "distrax/_src/distributions/deterministic_test.py"
+    "distrax/_src/distributions/epsilon_greedy_test.py"
+    "distrax/_src/distributions/gamma_test.py"
+    "distrax/_src/distributions/greedy_test.py"
+    "distrax/_src/distributions/gumbel_test.py"
+    "distrax/_src/distributions/logistic_test.py"
+    "distrax/_src/distributions/log_stddev_normal_test.py"
+    "distrax/_src/distributions/mvn_diag_test.py"
+    "distrax/_src/distributions/mvn_full_covariance_test.py"
+    "distrax/_src/distributions/mvn_tri_test.py"
+    "distrax/_src/distributions/one_hot_categorical_test.py"
+    "distrax/_src/distributions/softmax_test.py"
+    "distrax/_src/utils/hmm_test.py"
  ];

  meta = with lib; {
@ -81,8 +95,5 @@ buildPythonPackage rec {
    homepage = "https://github.com/deepmind/distrax";
    license = licenses.asl20;
    maintainers = with maintainers; [ onny ];
-    # Several tests fail with:
-    # AssertionError: [Chex] Assertion assert_type failed: Error in type compatibility check
-    broken = true;
  };
 }
--- a/pkgs/development/python-modules/django-modelcluster/default.nix
+++ b/pkgs/development/python-modules/django-modelcluster/default.nix
@ -1,27 +1,22 @@
 {
  lib,
  buildPythonPackage,
-  fetchFromGitHub,
-  pythonOlder,
-
-  # dependencies
-  django,
-  pytz,
-
-  # optionals
  django-taggit,
-
-  # tests
+  django,
+  fetchFromGitHub,
  pytest-django,
  pytestCheckHook,
+  pythonOlder,
+  pytz,
+  setuptools,
 }:

 buildPythonPackage rec {
  pname = "django-modelcluster";
  version = "6.3";
-  format = "setuptools";
+  pyproject = true;

-  disabled = pythonOlder "3.5";
+  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "wagtail";
@ -30,7 +25,9 @@ buildPythonPackage rec {
    hash = "sha256-AUVl2aidjW7Uu//3HlAod7pxzj6Gs1Xd0uTt3NrrqAU=";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    django
    pytz
  ];
@ -44,14 +41,12 @@ buildPythonPackage rec {
    pytestCheckHook
  ] ++ optional-dependencies.taggit;

-  # https://github.com/wagtail/django-modelcluster/issues/173
-  disabledTests = lib.optionals (lib.versionAtLeast django.version "4.2") [
-    "test_formfield_callback"
-  ];
+  pythonImportsCheck = [ "modelcluster" ];

  meta = with lib; {
    description = "Django extension to allow working with 'clusters' of models as a single unit, independently of the database";
    homepage = "https://github.com/torchbox/django-modelcluster/";
+    changelog = "https://github.com/wagtail/django-modelcluster/blob/v${version}/CHANGELOG.txt";
    license = licenses.bsd2;
    maintainers = with maintainers; [ desiderius ];
  };
--- a/pkgs/development/python-modules/django-otp-webauthn/default.nix
+++ b/pkgs/development/python-modules/django-otp-webauthn/default.nix
@ -11,13 +11,13 @@

 buildPythonPackage rec {
  pname = "django-otp-webauthn";
-  version = "0.3.0";
+  version = "0.4.0";
  pyproject = true;

  src = fetchPypi {
    inherit version;
    pname = "django_otp_webauthn";
-    hash = "sha256-+Y46/PDeXL9zayoZykaU63faQmnLHzYPmqJJeRBx+hs=";
+    hash = "sha256-BXwIjQjynTjFK+bNML5i35qxQ7TJeb4Xc+duS6Y+5Fk=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/fyta-cli/default.nix
+++ b/pkgs/development/python-modules/fyta-cli/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "fyta-cli";
-  version = "0.6.7";
+  version = "0.6.10";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "dontinelli";
    repo = "fyta_cli";
    rev = "refs/tags/v${version}";
-    hash = "sha256-KdrDRiPpkG8SDPWtGKU7A14WtQuuA4823t47uWHdGko=";
+    hash = "sha256-sPbN6gMPtNzYTYQ5F8w59m5DKobx/TV6v5v8Q9u1rXQ=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/git-filter-repo/default.nix
+++ b/pkgs/development/python-modules/git-filter-repo/default.nix
@ -15,7 +15,7 @@ buildPythonPackage rec {
  docs_version = "71d71d4be238628bf9cb9b27be79b8bb824ed1a9";
  pyproject = true;

-  disabled = pythonOlder "3.5";
+  disabled = pythonOlder "3.9";

  src = fetchPypi {
    pname = "git_filter_repo";
@ -34,10 +34,9 @@ buildPythonPackage rec {
    installManPage ${docs}/man1/git-filter-repo.1
  '';

-  nativeBuildInputs = [
-    setuptools-scm
-    installShellFiles
-  ];
+  build-system = [ setuptools-scm ];
+
+  nativeBuildInputs = [ installShellFiles ];

  # Project has no tests
  doCheck = false;
--- a/pkgs/development/python-modules/knocki/default.nix
+++ b/pkgs/development/python-modules/knocki/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "knocki";
-  version = "0.3.5";
+  version = "0.4.1";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "swan-solutions";
    repo = "knocki-homeassistant";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Fb3skFttY5gtm80k1LCUQ4Z7/TQGClCNcWt1k6bLQoI=";
+    hash = "sha256-Eh/ykTbR2NMZ9Mjgcc53OU3+2EsX6FWV93DmwCDvsRg=";
  };

  postPatch = ''
@ -54,6 +54,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Asynchronous Python client for Knocki vibration / door sensors";
    homepage = "https://github.com/swan-solutions/knocki-homeassistant";
+    changelog = "https://github.com/swan-solutions/knocki-homeassistant/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ mindstorms6 ];
  };
--- a/pkgs/development/python-modules/okonomiyaki/default.nix
+++ b/pkgs/development/python-modules/okonomiyaki/default.nix
@ -1,64 +1,86 @@
 {
-  buildPythonPackage,
-  stdenv,
-  fetchFromGitHub,
  lib,
+  stdenv,
  attrs,
+  buildPythonPackage,
  distro,
+  fetchFromGitHub,
+  parameterized,
  jsonschema,
-  six,
-  zipfile2,
-  hypothesis,
  mock,
  packaging,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
  testfixtures,
-  pythonAtLeast,
+  zipfile2,
 }:

 buildPythonPackage rec {
  pname = "okonomiyaki";
-  version = "1.4.0";
-  format = "setuptools";
+  version = "2.0.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.9";

  src = fetchFromGitHub {
    owner = "enthought";
-    repo = pname;
+    repo = "okonomiyaki";
    rev = "refs/tags/${version}";
-    hash = "sha256-MEll1H7l41m8uz2/WK/Ilm7Dubg0uqYwe+ZgakO1aXQ=";
+    hash = "sha256-JQZhw0H4iSdxoyS6ODICJz1vAZsOISQitX7wTgSS1xc=";
  };

-  propagatedBuildInputs = [
-    distro
-    attrs
-    jsonschema
-    six
-    zipfile2
-  ];
+  postPatch = ''
+    # Fixed for >= 2.0.0
+    substituteInPlace setup.cfg \
+      --replace-fail "long_description_content_type = rst" "long_description_content_type = text/x-rst"
+  '';
+
+  build-system = [ setuptools ];
+
+  optional-dependencies = {
+    all = [
+      attrs
+      distro
+      jsonschema
+      zipfile2
+    ];
+    platforms = [
+      attrs
+      distro
+    ];
+    formats = [
+      attrs
+      distro
+      jsonschema
+      zipfile2
+    ];
+  };
+
+  nativeCheckInputs = [
+    packaging
+    parameterized
+    pytestCheckHook
+    testfixtures
+  ] ++ lib.flatten (builtins.attrValues optional-dependencies);

  preCheck =
    ''
      substituteInPlace okonomiyaki/runtimes/tests/test_runtime.py \
-        --replace 'runtime_info = PythonRuntime.from_running_python()' 'raise unittest.SkipTest() #'
+        --replace-fail 'runtime_info = PythonRuntime.from_running_python()' 'raise unittest.SkipTest() #'
    ''
    + lib.optionalString stdenv.hostPlatform.isDarwin ''
      substituteInPlace okonomiyaki/platforms/tests/test_pep425.py \
-        --replace 'self.assertEqual(platform_tag, self.tag.platform)' 'raise unittest.SkipTest()'
+        --replace-fail 'self.assertEqual(platform_tag, self.tag.platform)' 'raise unittest.SkipTest()'
    '';

-  checkInputs = [
-    hypothesis
-    mock
-    packaging
-    testfixtures
-  ];
-
  pythonImportsCheck = [ "okonomiyaki" ];

  meta = with lib; {
-    homepage = "https://github.com/enthought/okonomiyaki";
    description = "Experimental library aimed at consolidating a lot of low-level code used for Enthought's eggs";
+    homepage = "https://github.com/enthought/okonomiyaki";
+    changelog = "https://github.com/enthought/okonomiyaki/releases/tag/${version}";
    maintainers = with maintainers; [ genericnerdyusername ];
    license = licenses.bsd3;
-    broken = pythonAtLeast "3.12"; # multiple tests are failing
  };
 }
--- a/pkgs/development/python-modules/okta/default.nix
+++ b/pkgs/development/python-modules/okta/default.nix
@ -18,6 +18,7 @@
  python-jose,
  pythonOlder,
  pyyaml,
+  setuptools,
  xmltodict,
  yarl,
 }:
@ -25,7 +26,7 @@
 buildPythonPackage rec {
  pname = "okta";
  version = "2.9.8";
-  format = "setuptools";
+  pyproject = true;

  disabled = pythonOlder "3.7";

@ -34,7 +35,11 @@ buildPythonPackage rec {
    hash = "sha256-RDnRiPsc4p5yI9jFzOtRI+r00tvska8x4uCSjl+cWvo=";
  };

-  propagatedBuildInputs = [
+  pythonRelaxDeps = [ "aenum" ];
+
+  build-system = [ setuptools ];
+
+  dependencies = [
    aenum
    aiohttp
    flatdict
@ -66,6 +71,7 @@ buildPythonPackage rec {
    "test_update_org_contact_user"
    "test_get_role_subscription"
    "test_subscribe_unsubscribe"
+    "test_client_invalid_url"
  ];

  pythonImportsCheck = [
--- a/pkgs/development/python-modules/pylint-venv/default.nix
+++ b/pkgs/development/python-modules/pylint-venv/default.nix
@ -8,19 +8,19 @@

 buildPythonPackage rec {
  pname = "pylint-venv";
-  version = "3.0.3";
-  format = "pyproject";
+  version = "3.0.4";
+  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "jgosmann";
-    repo = pname;
+    repo = "pylint-venv";
    rev = "refs/tags/v${version}";
-    hash = "sha256-dsVEHJawsTNKVCVmeOa61wOU5GPeyzAU/eUDFrK9PPg=";
+    hash = "sha256-dJWVfltze4zT0CowBZSn3alqR2Y8obKUCmO8Nfw+ahs=";
  };

-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];

  # Module has no tests
  doCheck = false;
@ -31,7 +31,7 @@ buildPythonPackage rec {
    description = "Module to make pylint respect virtual environments";
    homepage = "https://github.com/jgosmann/pylint-venv/";
    changelog = "https://github.com/jgosmann/pylint-venv/blob/v${version}/CHANGES.md";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
    maintainers = with maintainers; [ fab ];
  };
 }
--- a/pkgs/development/python-modules/simplesat/default.nix
+++ b/pkgs/development/python-modules/simplesat/default.nix
@ -1,33 +1,24 @@
 {
-  buildPythonPackage,
-  fetchFromGitHub,
-  writeText,
  lib,
  attrs,
+  buildPythonPackage,
+  fetchFromGitHub,
  mock,
  okonomiyaki,
  pytestCheckHook,
+  pythonOlder,
  pyyaml,
  setuptools,
  six,
 }:

-let
-  version = "0.9.1";
-  versionFile = writeText "simplesat_ver" ''
-    version = '${version}'
-    full_version = '${version}'
-    git_revision = '0000000000000000000000000000000000000000'
-    is_released = True
-    msi_version = '${version}.000'
-    version_info = (${lib.versions.major version}, ${lib.versions.minor version}, ${lib.versions.patch version}, 'final', 0)
-  '';
-in
 buildPythonPackage rec {
  pname = "simplesat";
-  inherit version;
+  version = "0.9.1";
  pyproject = true;

+  disabled = pythonOlder "3.9";
+
  src = fetchFromGitHub {
    owner = "enthought";
    repo = "sat-solver";
@ -35,8 +26,9 @@ buildPythonPackage rec {
    hash = "sha256-/fBnpf1DtaF+wQYZztcB8Y20/ZMYxrF3fH5qRsMucL0=";
  };

-  preConfigure = ''
-    cp ${versionFile} simplesat/_version.py
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace-fail "version = file: VERSION" "version = ${version}"
  '';

  build-system = [ setuptools ];
@ -47,20 +39,26 @@ buildPythonPackage rec {
    six
  ];

-  pythonImportsCheck = [ "simplesat" ];
-
  nativeCheckInputs = [
    mock
    pytestCheckHook
    pyyaml
  ];

+  pythonImportsCheck = [ "simplesat" ];
+
+  preCheck = ''
+    substituteInPlace simplesat/tests/test_pool.py \
+      --replace-fail "assertRaisesRegexp" "assertRaisesRegex"
+  '';
+
  pytestFlagsArray = [ "simplesat/tests" ];

  meta = with lib; {
-    homepage = "https://github.com/enthought/sat-solver";
    description = "Prototype for SAT-based dependency handling";
-    maintainers = with maintainers; [ genericnerdyusername ];
+    homepage = "https://github.com/enthought/sat-solver";
+    changelog = "https://github.com/enthought/sat-solver/blob/v${version}/CHANGES.rst";
    license = licenses.bsd3;
+    maintainers = with maintainers; [ genericnerdyusername ];
  };
 }
--- a/pkgs/development/python-modules/tpm2-pytss/default.nix
+++ b/pkgs/development/python-modules/tpm2-pytss/default.nix
@ -37,9 +37,6 @@ buildPythonPackage rec {
    [
      # Fix hardcoded `fapi-config.json` configuration path
      ./fapi-config.patch
-      # Backport for https://github.com/tpm2-software/tpm2-pytss/pull/576
-      # This is likely to be dropped with the next major release (>= 2.3)
-      ./pr576-backport.patch
    ]
    ++ lib.optionals isCross [
      # pytss will regenerate files from headers of tpm2-tss.
--- a/pkgs/development/python-modules/tpm2-pytss/pr576-backport.patch
+++ b/pkgs/development/python-modules/tpm2-pytss/pr576-backport.patch
@ -1,117 +0,0 @@
-Backport for https://github.com/tpm2-software/tpm2-pytss/pull/576 on 2.2.1
-
-diff --git a/scripts/prepare_headers.py b/scripts/prepare_headers.py
-index 6ca9b64..a7529b3 100644
--- a/scripts/prepare_headers.py
-+++ b/scripts/prepare_headers.py
-@@ -32,6 +32,7 @@ def remove_common_guards(s):
- 
-     # Restructure #defines with ...
-     s = re.sub("(#define [A-Za-z0-9_]+) +\(\(.*?\) \(.*?\)\)", "\g<1>...", s)
-+    s = re.sub("(#define [A-Za-z0-9_]+) +\(\(\(.*?\) .*\)", "\g<1>...", s)
-     s = re.sub("(#define [A-Za-z0-9_]+) +\(\(.*?\).*?\) ", "\g<1>...", s)
-     s = re.sub(
-         "(#define [A-Za-z0-9_]+) .*\n.*?.*\)\)", "\g<1>...", s, flags=re.MULTILINE
-diff --git a/src/tpm2_pytss/internal/crypto.py b/src/tpm2_pytss/internal/crypto.py
-index 42030c5..f9d8c34 100644
--- a/src/tpm2_pytss/internal/crypto.py
-+++ b/src/tpm2_pytss/internal/crypto.py
-@@ -25,6 +25,7 @@ from cryptography.hazmat.backends import default_backend
- from cryptography.exceptions import UnsupportedAlgorithm, InvalidSignature
- from typing import Tuple, Type, Any
- import secrets
-+import inspect
- import sys
- 
- _curvetable = (
-diff --git a/test/test_encoding.py b/test/test_encoding.py
-index 1f58562..8cf4b51 100644
--- a/test/test_encoding.py
-+++ b/test/test_encoding.py
-@@ -1406,7 +1406,7 @@ class ToolsTest(TSS2_BaseTest):
-     def test_tools_decode_tpm2b_name(self):
-         if not self.has_tools:
-             self.skipTest("tools not in path")
-        key = ec.generate_private_key(ec.SECP256R1).public_key()
-+        key = ec.generate_private_key(ec.SECP256R1()).public_key()
-         kb = key.public_bytes(
-             serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo
-         )
-diff --git a/test/test_fapi.py b/test/test_fapi.py
-index f702fc9..6b77c66 100644
--- a/test/test_fapi.py
-+++ b/test/test_fapi.py
-@@ -13,7 +13,7 @@ from cryptography.hazmat.primitives.asymmetric.padding import PSS
- 
- from tpm2_pytss import *
- 
-from tpm2_pytss.internal.utils import is_bug_fixed, _lib_version_atleast
-+from tpm2_pytss.internal.utils import is_bug_fixed
- 
- from .TSS2_BaseTest import TpmSimulator
- from tpm2_pytss.TSS2_Exception import TSS2_Exception
-@@ -614,8 +614,7 @@ class Common:
-         self.fapi.sign(key_path, b"\x22" * 32)
- 
-     @pytest.mark.skipif(
-        _lib_version_atleast("tss2-fapi", "4.0.1-170")
-        or not is_bug_fixed(fixed_in="3.2", backports=["2.4.7", "3.0.5", "3.1.1"]),
-+        not is_bug_fixed(fixed_in="3.2", backports=["2.4.7", "3.0.5", "3.1.1"]),
-         reason="tpm2-tss bug, see #2084",
-     )
-     def test_write_authorize_nv(self, esys):
-@@ -662,8 +661,7 @@ class Common:
-             self.fapi.quote(path=key_path, pcrs=[7, 9])
- 
-     @pytest.mark.skipif(
-        _lib_version_atleast("tss2-fapi", "4.0.1-170")
-        or not is_bug_fixed(fixed_in="3.2", backports=["2.4.7", "3.0.5", "3.1.1"]),
-+        not is_bug_fixed(fixed_in="3.2", backports=["2.4.7", "3.0.5", "3.1.1"]),
-         reason="tpm2-tss bug, see #2084",
-     )
-     def test_authorize_policy(self, sign_key):
-@@ -728,9 +726,7 @@ class Common:
-             self.fapi.quote(path=key_path, pcrs=[7, 9])
- 
-     @pytest.mark.skipif(
-        _lib_version_atleast("tss2-fapi", "4.0.1-170")
-        or not is_bug_fixed(fixed_in="3.2"),
-        reason="tpm2-tss bug, see #2080",
-+        not is_bug_fixed(fixed_in="3.2"), reason="tpm2-tss bug, see #2080"
-     )
-     def test_policy_signed(self, cryptography_key):
-         # create external signing key used by the signing authority external to the TPM
-@@ -792,10 +788,6 @@ class Common:
-         with pytest.raises(TSS2_Exception):
-             self.fapi.sign(path=key_path, digest=b"\x11" * 32)
- 
-    @pytest.mark.skipif(
-        _lib_version_atleast("tss2-fapi", "4.0.1-170"),
-        reason="issue on master branch.",
-    )
-     def test_policy_branched(self):
-         pcr_index = 15
-         pcr_data = b"ABCDEF"
-@@ -913,8 +905,7 @@ class Common:
-         self.fapi.delete(path=nv_path)
- 
-     @pytest.mark.skipif(
-        _lib_version_atleast("tss2-fapi", "4.0.1-170")
-        or not is_bug_fixed(fixed_in="3.2", backports=["2.4.7", "3.0.5", "3.1.1"]),
-+        not is_bug_fixed(fixed_in="3.2", backports=["2.4.7", "3.0.5", "3.1.1"]),
-         reason="tpm2-tss bug, see #2089",
-     )
-     def test_policy_action(self):
-diff --git a/test/test_policy.py b/test/test_policy.py
-index f18aa8a..5f56e21 100644
--- a/test/test_policy.py
-+++ b/test/test_policy.py
-@@ -47,7 +47,7 @@ class TestPolicy(TSS2_EsapiTest):
-         super().setUp()
-         self._has_secp192r1 = True
-         try:
-            ec.generate_private_key(ec.SECP192R1)
-+            ec.generate_private_key(ec.SECP192R1())
-         except Exception:
-             self._has_secp192r1 = False
- 
--- a/pkgs/development/python-modules/zipfile2/default.nix
+++ b/pkgs/development/python-modules/zipfile2/default.nix
@ -1,31 +1,43 @@
 {
+  lib,
  buildPythonPackage,
  fetchFromGitHub,
-  lib,
-  pythonAtLeast,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
 }:

 buildPythonPackage rec {
  pname = "zipfile2";
-  version = "0.0.12";
-  format = "setuptools";
+  version = "0.0.12-unstable-2024-09-28";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "cournape";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-BwcEgW4XrQqz0Jmtbyxf8q0mWTJXv2dL3Tk7N/IYuMI=";
+    repo = "zipfile2";
+    #rev = "refs/tags/v${version}";
+    rev = "8823f7253772e5c5811343306a591c00c764c6d0";
+    hash = "sha256-jDOyIj0sQS1dIsar4nyk5V2mme3Zc6VTms49/4n93ho=";
  };

-  patches = [ ./no-setuid.patch ];
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [ pytestCheckHook ];

  pythonImportsCheck = [ "zipfile2" ];

+  disabledTests = [
+    # PermissionError: [Errno 1] Operation not ...
+    "test_extract"
+  ];
+
  meta = with lib; {
-    homepage = "https://github.com/cournape/zipfile2";
    description = "Backwards-compatible improved zipfile class";
-    maintainers = with maintainers; [ genericnerdyusername ];
+    homepage = "https://github.com/cournape/zipfile2";
+    changelog = "https://github.com/itziakos/zipfile2/releases/tag/v${version}";
    license = licenses.psfl;
-    broken = pythonAtLeast "3.12"; # tests are failing because the signature of ZipInfo._decodeExtra changed
+    maintainers = with maintainers; [ genericnerdyusername ];
  };
 }
--- a/pkgs/development/tools/build-managers/gradle/default.nix
+++ b/pkgs/development/tools/build-managers/gradle/default.nix
@ -180,8 +180,8 @@ rec {
  # https://docs.gradle.org/current/userguide/compatibility.html

  gradle_8 = gen {
-    version = "8.10";
-    hash = "sha256-W5xes/n8LJSrrqV9kL14dHyhF927+WyFnTdBGBoSvyo=";
+    version = "8.10.2";
+    hash = "sha256-McVXE+QCM6gwOCfOtCykikcmegrUurkXcSMSHnFSTCY=";
    defaultJava = jdk21;
  };

--- a/pkgs/development/web/nodejs/v22.nix
+++ b/pkgs/development/web/nodejs/v22.nix
@ -5,14 +5,11 @@ let
    inherit openssl;
    python = python3;
  };
-
-  gypPatches = callPackage ./gyp-patches.nix { } ++ [
-  ];
 in
 buildNodejs {
  inherit enableNpm;
-  version = "22.9.0";
-  sha256 = "a55aeb368dee93432f610127cf94ce682aac07b93dcbbaadd856df122c9239df";
+  version = "22.10.0";
+  sha256 = "3180710d3130ad9df01466abf010e408d41b374be54301d1480d10eca73558e0";
  patches = [
    ./configure-emulator.patch
    ./configure-armv6-vfpv2.patch
@ -21,32 +18,5 @@ buildNodejs {
    ./node-npm-build-npm-package-logic.patch
    ./use-correct-env-in-tests.patch
    ./bin-sh-node-run-v22.patch
-
-    # Patches for OpenSSL 3.2
-    # Patches not yet released
-    (fetchpatch2 {
-      url = "https://github.com/nodejs/node/commit/f8b7a171463e775da304bccf4cf165e634525c7e.patch?full_index=1";
-      hash = "sha256-imptUwt2oG8pPGKD3V6m5NQXuahis71UpXiJm4C0E6o=";
-    })
-    (fetchpatch2 {
-      url = "https://github.com/nodejs/node/commit/6dfa3e46d3d2f8cfba7da636d48a5c41b0132cd7.patch?full_index=1";
-      hash = "sha256-ITtGsvZI6fliirCKvbMH9N2Xoy3001bz+hS3NPoqvzg=";
-    })
-    (fetchpatch2 {
-      url = "https://github.com/nodejs/node/commit/29b9c72b05786061cde58a5ae11cfcb580ab6c28.patch?full_index=1";
-      hash = "sha256-xaqtwsrOIyRV5zzccab+nDNG8kUgO6AjrVYJNmjeNP0=";
-    })
-    (fetchpatch2 {
-      url = "https://github.com/nodejs/node/commit/cfe58cfdc488da71e655d3da709292ce6d9ddb58.patch?full_index=1";
-      hash = "sha256-9GblpbQcYfoiE5R7fETsdW7v1Mm2Xdr4+xRNgUpLO+8=";
-    })
-    (fetchpatch2 {
-      url = "https://github.com/nodejs/node/commit/2cec716c48cea816dcd5bf4997ae3cdf1fe4cd90.patch?full_index=1";
-      hash = "sha256-ExIkAj8yRJEK39OfV6A53HiuZsfQOm82/Tvj0nCaI8A=";
-    })
-    (fetchpatch2 {
-      url = "https://github.com/nodejs/node/commit/0f7bdcc17fbc7098b89f238f4bd8ecad9367887b.patch?full_index=1";
-      hash = "sha256-lXx6QyD2anlY9qAwjNMFM2VcHckBshghUF1NaMoaNl4=";
-    })
-  ] ++ gypPatches;
+  ];
 }
--- a/pkgs/servers/limesurvey/default.nix
+++ b/pkgs/servers/limesurvey/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "limesurvey";
-  version = "6.4.1+240108";
+  version = "6.6.5+240924";

  src = fetchFromGitHub {
    owner = "LimeSurvey";
    repo = "LimeSurvey";
    rev = version;
-    hash = "sha256-Cpf8X6igF7LdRbFihGudFmx/8aY0Kf0BE7jHnEF1DYA=";
+    hash = "sha256-CuuTFCDY7jnF2njZdyB6e8/nRf0n0ybKgZ0QscC2IAI=";
  };

  phpConfig = writeText "config.php" ''
--- a/pkgs/servers/sql/pgpool/default.nix
+++ b/pkgs/servers/sql/pgpool/default.nix
@ -10,12 +10,12 @@

 stdenv.mkDerivation rec {
  pname = "pgpool-II";
-  version = "4.5.2";
+  version = "4.5.4";

  src = fetchurl {
    url = "https://www.pgpool.net/mediawiki/download.php?f=pgpool-II-${version}.tar.gz";
    name = "pgpool-II-${version}.tar.gz";
-    hash = "sha256-SArCPwHNfWyFayk4a/F6hIcS+0tAV9TIq9XIv4Gb3wY=";
+    hash = "sha256-0TkudM4oB/iuYohyyxq3kUJJkhGA3JnfQKHWAmR6EP0=";
  };

  buildInputs = [
--- a/pkgs/tools/cd-dvd/cdrkit/default.nix
+++ b/pkgs/tools/cd-dvd/cdrkit/default.nix
@ -1,4 +1,4 @@
-{lib, stdenv, fetchurl, cmake, libcap, zlib, bzip2, perl, iconv, darwin}:
+{lib, stdenv, fetchurl, cmake, libcap, zlib, bzip2, perl}:

 stdenv.mkDerivation rec {
  pname = "cdrkit";
@ -11,8 +11,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ cmake ];
  buildInputs = [ zlib bzip2 perl ] ++
-    lib.optionals stdenv.hostPlatform.isLinux [ libcap ] ++
-    lib.optionals stdenv.hostPlatform.isDarwin (with darwin.apple_sdk.frameworks; [ Carbon IOKit iconv ]);
+    lib.optionals stdenv.hostPlatform.isLinux [ libcap ];

  hardeningDisable = [ "format" ];
  env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.hostPlatform.isMusl [
@ -44,10 +43,8 @@ stdenv.mkDerivation rec {
  '';

  postConfigure = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    for f in */CMakeFiles/*.dir/link.txt ; do
-      substituteInPlace "$f" \
-        --replace "-lrt" "-framework IOKit"
-    done
+    substituteInPlace  */CMakeFiles/*.dir/link.txt \
+      --replace-warn "-lrt" "-framework IOKit -framework CoreFoundation"
  '';

  postInstall = ''
--- a/pkgs/tools/inputmethods/libinput-gestures/default.nix
+++ b/pkgs/tools/inputmethods/libinput-gestures/default.nix
@ -1,17 +1,24 @@
-{ lib, stdenv, fetchFromGitHub, makeWrapper,
-  libinput, wmctrl, python3,
-  coreutils, xdotool ? null,
-  extraUtilsPath ? lib.optional (xdotool != null) xdotool
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  makeWrapper,
+  libinput,
+  wmctrl,
+  python3,
+  coreutils,
+  xdotool ? null,
+  extraUtilsPath ? lib.optional (xdotool != null) xdotool,
 }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "libinput-gestures";
-  version = "2.76";
+  version = "2.77";

  src = fetchFromGitHub {
    owner = "bulletmark";
    repo = "libinput-gestures";
-    rev = version;
-    sha256 = "sha256-Tb/gQ/2Ul4JzEiLEUPJBj9T6ZAqzMSPdgiofdnDj73Q=";
+    rev = "ref/tags/${finalAttrs.version}";
+    hash = "sha256-eMXNlSgQSuN+/5SXJQjsylC1ygHS87sIEmnVGFk3pzA=";
  };
  patches = [
    ./0001-hardcode-name.patch
@ -21,36 +28,35 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ makeWrapper ];
  buildInputs = [ python3 ];

-  postPatch =
-    ''
-      substituteInPlace libinput-gestures-setup --replace /usr/ /
+  postPatch = ''
+    substituteInPlace libinput-gestures-setup --replace-fail /usr/ /

-      substituteInPlace libinput-gestures \
-        --replace      /etc     "$out/etc" \
-        --subst-var-by libinput "${libinput}/bin/libinput" \
-        --subst-var-by wmctrl   "${wmctrl}/bin/wmctrl"
-    '';
-  installPhase =
-    ''
-      runHook preInstall
-      ${stdenv.shell} libinput-gestures-setup -d "$out" install
-      runHook postInstall
-    '';
-  postFixup =
-    ''
-      rm "$out/bin/libinput-gestures-setup"
-      substituteInPlace "$out/share/systemd/user/libinput-gestures.service" --replace "/usr" "$out"
-      substituteInPlace "$out/share/applications/libinput-gestures.desktop" --replace "/usr" "$out"
-      chmod +x "$out/share/applications/libinput-gestures.desktop"
-      wrapProgram "$out/bin/libinput-gestures" --prefix PATH : "${lib.makeBinPath ([coreutils] ++ extraUtilsPath)}"
-    '';
+    substituteInPlace libinput-gestures \
+      --replace-fail      /etc     "$out/etc" \
+      --subst-var-by libinput "${libinput}/bin/libinput" \
+      --subst-var-by wmctrl   "${wmctrl}/bin/wmctrl"
+  '';
+  installPhase = ''
+    runHook preInstall
+    ${stdenv.shell} libinput-gestures-setup -d "$out" install
+    runHook postInstall
+  '';
+  postFixup = ''
+    rm "$out/bin/libinput-gestures-setup"
+    substituteInPlace "$out/share/systemd/user/libinput-gestures.service" --replace "/usr" "$out"
+    substituteInPlace "$out/share/applications/libinput-gestures.desktop" --replace "/usr" "$out"
+    chmod +x "$out/share/applications/libinput-gestures.desktop"
+    wrapProgram "$out/bin/libinput-gestures" --prefix PATH : "${
+      lib.makeBinPath ([ coreutils ] ++ extraUtilsPath)
+    }"
+  '';

-  meta = with lib; {
+  meta = {
    homepage = "https://github.com/bulletmark/libinput-gestures";
    description = "Gesture mapper for libinput";
    mainProgram = "libinput-gestures";
-    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ teozkr ];
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ teozkr ];
  };
-}
+})
--- a/pkgs/tools/misc/svtplay-dl/default.nix
+++ b/pkgs/tools/misc/svtplay-dl/default.nix
@ -21,7 +21,7 @@ let
    requests-mock
    ;

-  version = "4.97.1";
+  version = "4.101";

 in

@ -34,7 +34,7 @@ buildPythonApplication {
    owner = "spaam";
    repo = "svtplay-dl";
    rev = version;
-    hash = "sha256-9h3hHRRL7DKeCpEXL5w72hYi1nTS+a+x5e9ArMmVgYQ=";
+    hash = "sha256-bHUrpkGBguI8oZB1h1ToFkFsGiMeyV7TyDtgJ8+2TzI=";
  };

  build-system = [ setuptools ];
--- a/pkgs/tools/networking/i2pd/default.nix
+++ b/pkgs/tools/networking/i2pd/default.nix
@ -3,7 +3,6 @@
 , boost, zlib, openssl
 , upnpSupport ? true, miniupnpc
 , aesniSupport ? stdenv.hostPlatform.aesSupport
-, avxSupport   ? stdenv.hostPlatform.avxSupport
 }:

 stdenv.mkDerivation rec {
@ -27,7 +26,6 @@ stdenv.mkDerivation rec {
  makeFlags =
    let ynf = a: b: a + "=" + (if b then "yes" else "no"); in
    [ (ynf "USE_AESNI" aesniSupport)
-      (ynf "USE_AVX"   avxSupport)
      (ynf "USE_UPNP"  upnpSupport)
    ];

@ -46,5 +44,6 @@ stdenv.mkDerivation rec {
    maintainers = with maintainers; [ edwtjo ];
    platforms = platforms.unix;
    mainProgram = "i2pd";
+    broken = stdenv.hostPlatform.isDarwin;
  };
 }
--- a/pkgs/tools/system/fakeroot/default.nix
+++ b/pkgs/tools/system/fakeroot/default.nix
@ -13,7 +13,7 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "1.32.2";
+  version = "1.36";
  pname = "fakeroot";

  src = fetchFromGitLab {
@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
    repo = "fakeroot";
    rev = "upstream/${finalAttrs.version}";
    domain = "salsa.debian.org";
-    hash = "sha256-j1qSMPNCtAxClqYqWkRNQmtxkitYi7g/9KtQ5XqcX3w=";
+    hash = "sha256-QNScrkX2Vffsj/I5EJO8qs5AHQ9b5s6nHLHQKUdRzLE=";
  };

  patches = lib.optionals stdenv.hostPlatform.isLinux [
@ -29,22 +29,11 @@ stdenv.mkDerivation (finalAttrs: {

    # patches needed for musl libc, borrowed from alpine packaging.
    # it is applied regardless of the environment to prevent patchrot
-    (fetchpatch {
-      name = "do-not-redefine-id_t.patch";
-      url = "https://git.alpinelinux.org/aports/plain/main/fakeroot/do-not-redefine-id_t.patch?id=f68c541324ad07cc5b7f5228501b5f2ce4b36158";
-      sha256 = "sha256-i9PoWriSrQ7kLZzbvZT3Kq1oXzK9mTyBqq808BGepOw=";
-    })
    (fetchpatch {
      name = "fakeroot-no64.patch";
      url = "https://git.alpinelinux.org/aports/plain/main/fakeroot/fakeroot-no64.patch?id=f68c541324ad07cc5b7f5228501b5f2ce4b36158";
      sha256 = "sha256-NCDaB4nK71gvz8iQxlfaQTazsG0SBUQ/RAnN+FqwKkY=";
    })
-  ] ++ [
-    (fetchpatch {
-      name = "addendum-charset-conversion.patch";
-      url = "https://salsa.debian.org/clint/fakeroot/-/commit/b769fb19fd89d696a5e0fd70b974f833f6a0655a.patch";
-      hash = "sha256-3z1g+xzlyTpa055kpsoumP/E8srDlZss6B7Fv5A0QkU=";
-    })
  ];

  nativeBuildInputs = [ autoreconfHook po4a ];
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -60,6 +60,9 @@ mapAliases {
  forceSystem = system: _:
    (import self.path { localSystem = { inherit system; }; });

+  ### _ ###
+  _1password = lib.warn "_1password has been renamed to _1password-cli to better follow upstream name usage" _1password-cli; # Added 2024-10-24
+
  ### A ###

  AusweisApp2 = ausweisapp; # Added 2023-11-08
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -15316,11 +15316,14 @@ with pkgs;

  muonlang = callPackage ../development/compilers/muonlang { };

-  inherit (callPackages ../development/compilers/nim
-                        { inherit (darwin) Security;  }
-          ) nim-unwrapped-1 nim-unwrapped-2 nim1 nim2;
  nim = nim2;
-  buildNimPackage = callPackage ../development/compilers/nim/build-nim-package.nix { };
+  nim1 = nim-1_0;
+  nim2 = nim-2_2;
+  nim-unwrapped = nim-unwrapped-2_2;
+  nim-unwrapped-1 = nim-unwrapped-1_0;
+  nim-unwrapped-2 = nim-unwrapped-2_2;
+
+  buildNimPackage = callPackage ../build-support/build-nim-package.nix { };
  nimOverrides = callPackage ./nim-overrides.nix { };

  neko = callPackage ../development/compilers/neko { };
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@ -913,6 +913,8 @@ let

    kcas = callPackage ../development/ocaml-modules/kcas { };

+    kdf = callPackage ../development/ocaml-modules/kdf { };
+
    ke = callPackage ../development/ocaml-modules/ke { };

    kicadsch = callPackage ../development/ocaml-modules/kicadsch { };
--- a/pkgs/top-level/ruby-packages.nix
+++ b/pkgs/top-level/ruby-packages.nix
@ -2796,10 +2796,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0i2vaww6qcazj0ywva1plmjnj6rk23b01szswc5jhcq7s2cikd1y";
+      sha256 = "sha256-JKRkXABoEdg/JIAFfR9UqW52J7a5DhyZsmC53GMOtD4=";
      type = "gem";
    };
-    version = "6.4.2";
+    version = "6.4.3";
  };
  pwntools = {
    dependencies = ["crabstone" "dentaku" "elftools" "keystone-engine" "method_source" "one_gadget" "rainbow" "ruby2ruby" "rubyserial"];