Merge master into haskell-updates

2024-11-27 01:13:05 +00:00 · 2024-05-06 00:13:33 +00:00 · 2024-05-06 00:13:33 +00:00 · 637e4e5589
commit 637e4e5589
parent 6c57b38717 48705e5f4d
333 changed files with 17670 additions and 8363 deletions
--- a/.github/workflows/check-nix-format.yml
+++ b/.github/workflows/check-nix-format.yml
@ -39,6 +39,8 @@ jobs:
            pkgs/test/cuda
            pkgs/top-level/cuda-packages.nix
          NIX_FMT_PATHS_VSCODE_EXTS: pkgs/applications/editors/vscode/extensions
+          NIX_FMT_PATHS_PHP_PACKAGES: pkgs/development/php-packages
+          NIX_FMT_PATHS_BUILD_SUPPORT_PHP: pkgs/build-support/php
        # Iterate over all environment variables beginning with NIX_FMT_PATHS_.
        run: |
          for env_var in "${!NIX_FMT_PATHS_@}"; do
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -133,7 +133,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - [mautrix-meta](https://github.com/mautrix/meta), a Matrix <-> Facebook and Matrix <-> Instagram hybrid puppeting/relaybot bridge. Available as services.mautrix-meta

- [Jottacloud Command-line Tool](https://docs.jottacloud.com/en/articles/1436834-jottacloud-command-line-tool), a CLI for the [Jottacloud](https://jottacloud.com/) cloud storage provider. Available as [user.services.jotta-cli](#opt-user.services.jotta-cli.enable).
+- [Jottacloud Command-line Tool](https://docs.jottacloud.com/en/articles/1436834-jottacloud-command-line-tool), a CLI for the [Jottacloud](https://jottacloud.com/) cloud storage provider. Available as [services.jotta-cli](#opt-services.jotta-cli.enable).

 - [transfer-sh](https://github.com/dutchcoders/transfer.sh), a tool that supports easy and fast file sharing from the command-line. Available as [services.transfer-sh](#opt-services.transfer-sh.enable).

@ -269,6 +269,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - `mongodb-4_4` has been removed as it has reached end of life. Consequently, `unifi7` and `unifi8` now use MongoDB 5.0 by default.

+- `mongodb-5_0` and newer requires a cpu with the avx instruction set to run.
+
 - `nitter` requires a `guest_accounts.jsonl` to be provided as a path or loaded into the default location at `/var/lib/nitter/guest_accounts.jsonl`. See [Guest Account Branch Deployment](https://github.com/zedeus/nitter/wiki/Guest-Account-Branch-Deployment) for details.

 - `boot.supportedFilesystems` and `boot.initrd.supportedFilesystems` are now attribute sets instead of lists. Assignment from lists as done previously is still supported, but checking whether a filesystem is enabled must now by done using `supportedFilesystems.fs or false` instead of using `lib.elem "fs" supportedFilesystems` as was done previously.
@ -351,7 +353,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - `optparse-bash` is now dropped due to upstream inactivity. Alternatives available in Nixpkgs include [`argc`](https://github.com/sigoden/argc), [`argbash`](https://github.com/matejak/argbash), [`bashly`](https://github.com/DannyBen/bashly) and [`gum`](https://github.com/charmbracelet/gum), to name a few.

- `kanata` package has been updated to v1.6.0, which includes breaking changes.  Check out the changelog of [v1.5.0](https://github.com/jtroo/kanata/releases/tag/v1.5.0) and [v1.6.0](https://github.com/jtroo/kanata/releases/tag/v1.6.0) for details.
+- `kanata` package has been updated to v1.6.1, which includes breaking changes.  Check out the changelog of [v1.5.0](https://github.com/jtroo/kanata/releases/tag/v1.5.0) and [v1.6.0](https://github.com/jtroo/kanata/releases/tag/v1.6.0) for details.

 - `craftos-pc` package has been updated to v2.8, which includes [breaking changes](https://github.com/MCJack123/craftos2/releases/tag/v2.8).
  - Files are now handled in binary mode; this could break programs with embedded UTF-8 characters.
--- a/nixos/modules/services/desktop-managers/plasma6.nix
+++ b/nixos/modules/services/desktop-managers/plasma6.nix
@ -286,6 +286,15 @@ in {
      kde-smartcard = lib.mkIf config.security.pam.p11.enable { p11Auth = true; };
    };

+    security.wrappers = {
+      kwin_wayland = {
+        owner = "root";
+        group = "root";
+        capabilities = "cap_sys_nice+ep";
+        source = "${lib.getBin pkgs.kdePackages.kwin}/bin/kwin_wayland";
+      };
+    };
+
    programs.dconf.enable = true;

    programs.firefox.nativeMessagingHosts.packages = [kdePackages.plasma-browser-integration];
--- a/nixos/modules/services/display-managers/default.nix
+++ b/nixos/modules/services/display-managers/default.nix
@ -116,7 +116,7 @@ in
            lib.assertMsg (d != null -> (lib.types.str.check d && lib.elem d config.services.displayManager.sessionData.sessionNames)) ''
                Default graphical session, '${d}', not found.
                Valid names for 'services.displayManager.defaultSession' are:
-                  ${lib.concatStringsSep "\n  " cfg.displayManager.sessionData.sessionNames}
+                  ${lib.concatStringsSep "\n  " cfg.sessionData.sessionNames}
              '';
        };
        default = null;
--- a/nixos/modules/services/networking/jotta-cli.md
+++ b/nixos/modules/services/networking/jotta-cli.md
@ -6,7 +6,7 @@ The [Jottacloud Command-line Tool](https://docs.jottacloud.com/en/articles/14368

 ```nix
 {
-  user.services.jotta-cli.enable = true;
+  services.jotta-cli.enable = true;
 }
 ```

@ -15,7 +15,7 @@ This adds `jotta-cli` to `environment.systemPackages` and starts a user service
 ## Example Configuration {#module-services-jotta-cli-example-configuration}

 ```nix
-user.services.jotta-cli = {
+services.jotta-cli = {
  enable = true;
  options = [ "slow" ];
  package = pkgs.jotta-cli;
--- a/nixos/modules/services/networking/jotta-cli.nix
+++ b/nixos/modules/services/networking/jotta-cli.nix
@ -2,10 +2,10 @@

 with lib;

-let cfg = config.user.services.jotta-cli;
+let cfg = config.services.jotta-cli;
 in {
  options = {
-    user.services.jotta-cli = {
+    services.jotta-cli = {

      enable = mkEnableOption "Jottacloud Command-line Tool";

--- a/nixos/modules/services/networking/sunshine.nix
+++ b/nixos/modules/services/networking/sunshine.nix
@ -1,6 +1,6 @@
 { config, lib, pkgs, utils, ... }:
 let
-  inherit (lib) mkEnableOption mkPackageOption mkOption mkIf mkDefault types optionals getExe;
+  inherit (lib) mkEnableOption mkPackageOption mkOption literalExpression mkIf mkDefault types optionals getExe;
  inherit (utils) escapeSystemdExecArgs;
  cfg = config.services.sunshine;

@ -46,7 +46,7 @@ in

        See https://docs.lizardbyte.dev/projects/sunshine/en/latest/about/advanced_usage.html#configuration for syntax.
      '';
-      example = ''
+      example = literalExpression ''
        {
          sunshine_name = "nixos";
        }
@ -67,7 +67,7 @@ in
      description = ''
        Configuration for applications to be exposed to Moonlight. If this is set, no configuration is possible from the web UI, and must be by the `settings` option.
      '';
-      example = ''
+      example = literalExpression ''
        {
          env = {
            PATH = "$(PATH):$(HOME)/.local/bin";
--- a/nixos/modules/services/system/dbus.nix
+++ b/nixos/modules/services/system/dbus.nix
@ -147,6 +147,10 @@ in
      };

      systemd.services.dbus = {
+        aliases = [
+          # hack aiding to prevent dbus from restarting when switching from dbus-broker back to dbus
+          "dbus-broker.service"
+        ];
        # Don't restart dbus-daemon. Bad things tend to happen if we do.
        reloadIfChanged = true;
        restartTriggers = [
@ -158,6 +162,10 @@ in
      };

      systemd.user.services.dbus = {
+        aliases = [
+          # hack aiding to prevent dbus from restarting when switching from dbus-broker back to dbus
+          "dbus-broker.service"
+        ];
        # Don't restart dbus-daemon. Bad things tend to happen if we do.
        reloadIfChanged = true;
        restartTriggers = [
@ -184,6 +192,8 @@ in
      # https://github.com/NixOS/nixpkgs/issues/108643
      systemd.services.dbus-broker = {
        aliases = [
+          # allow other services to just depend on dbus,
+          # but also a hack aiding to prevent dbus from restarting when switching from dbus-broker back to dbus
          "dbus.service"
        ];
        unitConfig = {
@ -203,6 +213,8 @@ in

      systemd.user.services.dbus-broker = {
        aliases = [
+          # allow other services to just depend on dbus,
+          # but also a hack aiding to prevent dbus from restarting when switching from dbus-broker back to dbus
          "dbus.service"
        ];
        # Don't restart dbus. Bad things tend to happen if we do.
--- a/nixos/modules/services/web-apps/keycloak.nix
+++ b/nixos/modules/services/web-apps/keycloak.nix
@ -663,7 +663,7 @@ in
            '' + ''
              export KEYCLOAK_ADMIN=admin
              export KEYCLOAK_ADMIN_PASSWORD=${escapeShellArg cfg.initialAdminPassword}
-              kc.sh start --optimized
+              kc.sh --verbose start --optimized
            '';
          };

--- a/nixos/modules/system/activation/switch-to-configuration.pl
+++ b/nixos/modules/system/activation/switch-to-configuration.pl
@ -472,6 +472,9 @@ sub handle_modified_unit { ## no critic(Subroutines::ProhibitManyArgs, Subroutin
            $units_to_reload->{$unit} = 1;
            record_unit($reload_list_file, $unit);
        }
+        elsif ($unit eq "dbus.service" || $unit eq "dbus-broker.service") {
+            # dbus service should only ever be reloaded, not started/stoped/restarted as that would break the system.
+        }
        elsif (!parse_systemd_bool(\%new_unit_info, "Service", "X-RestartIfChanged", 1) || parse_systemd_bool(\%new_unit_info, "Unit", "RefuseManualStop", 0) || parse_systemd_bool(\%new_unit_info, "Unit", "X-OnlyManualStart", 0)) {
            $units_to_skip->{$unit} = 1;
        } else {
--- a/nixos/tests/jotta-cli.nix
+++ b/nixos/tests/jotta-cli.nix
@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
  meta.maintainers = with pkgs.lib.maintainers; [ evenbrenden ];

  nodes.machine = { pkgs, ... }: {
-    user.services.jotta-cli.enable = true;
+    services.jotta-cli.enable = true;
    imports = [ ./common/user-account.nix ];
  };

--- a/pkgs/applications/accessibility/wvkbd/default.nix
+++ b/pkgs/applications/accessibility/wvkbd/default.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "wvkbd";
-  version = "0.14.4";
+  version = "0.15";

  src = fetchFromGitHub {
    owner = "jjsullivan5196";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-1ySKsWgSCqsWV0RnR+wZt7+hWVWUqXrQLd1H6FqYzc8=";
+    sha256 = "sha256-9gDxMH1hghqjcXlbda7CHjDdjcjApjjie7caihKIg9M=";
  };

  postPatch = ''
--- a/pkgs/applications/audio/ardour/default.nix
+++ b/pkgs/applications/audio/ardour/default.nix
@ -64,14 +64,14 @@
 }:
 stdenv.mkDerivation rec {
  pname = "ardour";
-  version = "8.4";
+  version = "8.6";

  # We can't use `fetchFromGitea` here, as attempting to fetch release archives from git.ardour.org
  # result in an empty archive. See https://tracker.ardour.org/view.php?id=7328 for more info.
  src = fetchgit {
    url = "git://git.ardour.org/ardour/ardour.git";
    rev = version;
-    hash = "sha256-6qx/elkj4Kb4YK1JZG/S036WdUO7wEE6/yf4pZQP8J0=";
+    hash = "sha256-sMp24tjtX8fZJWc7dvb+9e6pEflT4ugoOZjDis6/3nM=";
  };

  bundledContent = fetchzip {
--- a/pkgs/applications/audio/soundsource/default.nix
+++ b/pkgs/applications/audio/soundsource/default.nix
@ -5,11 +5,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "soundsource";
-  version = "5.6.0";
+  version = "5.6.3";

  src = fetchurl {
-    url = "https://web.archive.org/web/20230707140658/https://rogueamoeba.com/soundsource/download/SoundSource.zip";
-    sha256 = "1avm1jr75mjbps0fad3glshrwl42vnhc0f9sak038ny85f3apyi0";
+    url = "https://web.archive.org/web/20240505002011/https://rogueamoeba.com/soundsource/download/SoundSource.zip";
+    sha256 = "sha256-uXQw4MEV4hkrd7tjNCxtuXpbfmdW8bilI5ZmXwn9BLM=";
  };
  dontUnpack = true;

--- a/pkgs/applications/blockchains/sparrow/default.nix
+++ b/pkgs/applications/blockchains/sparrow/default.nix
@ -1,4 +1,5 @@
 { stdenv
+, stdenvNoCC
 , lib
 , makeWrapper
 , fetchurl
@ -17,17 +18,54 @@
 , hwi
 , imagemagick
 , gzip
+, gnupg
 }:

 let
  pname = "sparrow";
-  version = "1.8.4";
+  version = "1.9.0";

  src = fetchurl {
    url = "https://github.com/sparrowwallet/${pname}/releases/download/${version}/${pname}-${version}-x86_64.tar.gz";
-    sha256 = "0w6z84w9spwfpqrf5m9bcq30xqp94c27jw3qzxfdyisp8n22xvd8";
+    sha256 = "sha256-UbFijiPOfVuJP9q6S5odkrhLJ2BUResbJK09Dn9PyCw=";
+
+    # nativeBuildInputs, downloadToTemp, and postFetch are used to verify the signed upstream package.
+    # The signature is not a self-contained file. Instead the SHA256 of the package is added to a manifest file.
+    # The manifest file is signed by the owner of the public key, Craig Raw.
+    # Thus to verify the signed package, the manifest is verified with the public key,
+    # and then the package is verified against the manifest.
+    # The public key is obtained from https://keybase.io/craigraw/pgp_keys.asc
+    # and is included in this repo to provide reproducibility.
+    nativeBuildInputs = [ gnupg ];
+    downloadToTemp = true;
+
+    postFetch = ''
+      pushd $(mktemp -d)
+      export GNUPGHOME=$PWD/gnupg
+      mkdir -m 700 -p $GNUPGHOME
+      ln -s ${manifest} ./manifest.txt
+      ln -s ${manifestSignature} ./manifest.txt.asc
+      ln -s $downloadedFile ./${pname}-${version}-x86_64.tar.gz
+      gpg --import ${publicKey}
+      gpg --verify manifest.txt.asc manifest.txt
+      sha256sum -c --ignore-missing manifest.txt
+      popd
+      mv $downloadedFile $out
+    '';
  };

+  manifest = fetchurl {
+    url = "https://github.com/sparrowwallet/${pname}/releases/download/${version}/${pname}-${version}-manifest.txt";
+    sha256 = "sha256-x50wkQKlh7r4PM5YwhQaz6tnJpByQDMAmYsp1HafX2c=";
+  };
+
+  manifestSignature = fetchurl {
+    url = "https://github.com/sparrowwallet/${pname}/releases/download/${version}/${pname}-${version}-manifest.txt.asc";
+    sha256 = "sha256-Nb5tQogQFMObd+nR/eUpEFUoCh1AnTX3s/jICJbvqqo=";
+  };
+
+  publicKey = ./publickey.asc;
+
  launcher = writeScript "sparrow" ''
    #! ${bash}/bin/bash
    params=(
@ -74,7 +112,7 @@ let
    exec ${tor}/bin/tor "$@"
  '';

-  jdk-modules = stdenv.mkDerivation {
+  jdk-modules = stdenvNoCC.mkDerivation {
    name = "jdk-modules";
    nativeBuildInputs = [ openjdk ];
    dontUnpack = true;
@ -95,7 +133,7 @@ let
    '';
  };

-  sparrow-modules = stdenv.mkDerivation {
+  sparrow-modules = stdenvNoCC.mkDerivation {
    pname = "sparrow-modules";
    inherit version src;
    nativeBuildInputs = [ makeWrapper gzip gnugrep openjdk autoPatchelfHook stdenv.cc.cc.lib zlib ];
@ -150,7 +188,6 @@ let
      # with one from Nixpkgs.
      gzip -c ${torWrapper}  > tor.gz
      cp tor.gz modules/kmp.tor.binary.linuxx64/kmptor/linux/x64/tor.gz
-      find modules
    '';

    installPhase = ''
@ -162,7 +199,7 @@ let
    '';
  };
 in
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
  inherit version src;
  pname = "sparrow-unwrapped";
  nativeBuildInputs = [ makeWrapper copyDesktopItems ];
@ -180,7 +217,7 @@ stdenv.mkDerivation rec {
    })
  ];

-  sparrow-icons = stdenv.mkDerivation {
+  sparrow-icons = stdenvNoCC.mkDerivation {
    inherit version src;
    pname = "sparrow-icons";
    nativeBuildInputs = [ imagemagick ];
@ -212,8 +249,6 @@ stdenv.mkDerivation rec {
    runHook postInstall
  '';

-  passthru.updateScript = ./update.sh;
-
  meta = with lib; {
    description = "A modern desktop Bitcoin wallet application supporting most hardware wallets and built on common standards such as PSBT, with an emphasis on transparency and usability.";
    homepage = "https://sparrowwallet.com";
--- a/pkgs/applications/blockchains/sparrow/publickey.asc
+++ b/pkgs/applications/blockchains/sparrow/publickey.asc
@ -0,0 +1,90 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Comment: GPGTools - http://gpgtools.org
+
+mQINBF2V8eEBEADmjYzGOpxEI0J7jQ1qFzlsrjF6NaBSq+UqKwPOL917pvI/8b/d
+bI1gLV1kgIMAnwf3/JWkF4Ind0pk3g3Vj/jzTYg/ePSwjAhvhowoDo4va+AtV066
+tRf3FjQYFCWR6ccN4zxmQxZ9QPOp4XIcXwu7Ce+ORRRiU9gkWXfiU64pmpzH89gz
+LF35r+98+d9Ov6nAPhRSUlj+vk85mu6Lk8J26srHKWB7iXat1rl4lEAPpFtyvU6L
+oO5XZoRPvXce3mByyuh8SDYTr6GVYjfPHWPaxcGrS/qTe2RCn3ec3xWSGT/U4xH0
+TwagphjxlSnpeHDxZXG6wpgyVEcjpQ1M9hIK7z1G+SHuW4EoyaZf2llTsNbKvbV8
+UOao6g5uAYeLQyBJPKExocNj7+DvbNrpRXYy1levrWtnkNS/oPx3wJgxeXL55uXC
+MCcc5X5T6GNNAtBubAxtYRt65Q6Lvga7v6dWTDtvwufxfjtXZGFO/Hut4wS6IyTt
+77i4GB/WeAQGGhPHGssVECd80u7/DEZ1EMcfTexsDJ9T1ZeM6orvAQ3i2DGdoiYt
+/pJPd2g0LE1Q0HhSVC74JP0pUPJ7V/nzBVPXbYQTQWxESce+NUpnONs2uW+XNSxb
+i0PoUwyDZsRQ7SZJZuOStBWqUXC8TUoGtkaRQHtBgumW0zHasgShVpkU+wARAQAB
+tCNDcmFpZyBSYXcgPGNyYWlnQHNwYXJyb3d3YWxsZXQuY29tPokCVAQTAQoAPgIb
+AwULCQgHAwUVCgkICwUWAgMBAAIeBQIXgBYhBNTQ0yAvwGhJolezjelGGDNMZ0tA
+BQJlCacEBQkO+IMiAAoJEOlGGDNMZ0tAMZ0QAJtLTl8n/H2nn3nnuHMV18lLya+F
+92/7Q5cSls+EPDzmhZnOY13aVlzL0y9++snRA6QrajyF5pxk5/t6OUcztg9PSSzz
+dJ4SrjqF7nxSWXAybQLSWK0NmAZGC4cCkHuFwOOpTYTsGjUH0lMnvGF7PllQK0L7
+8zKrNUpHHLWpkPBHfJEnGbv3XVG4DVWfdTAmpgSP/Lma3qRs5TRlr4pWbCQxUjd3
+8QCw25PGT4xQ9g/yCWY1rBq2x7MzHsiuNmd/qCuwcXiSCChrlGUUVYWwp7FXkVFq
+9wIJB7lYxOKbrwL8KcA2jQL0ZH9421+xfThCruMEnb3fPiW7y5VAbJKNLvk+WHa6
+Vfj12+R3a3ZM2P8iExS6+d04xM0AXK4J5bIcpFW0D8GdjJyED6I7cAPF723xSws1
+t9RD1rVslOlCvOJtoqATuWqGoTVAR4cdpdpnTywKZpjQowLdIcUPbW58zJQxmONh
+vXoTzqvhQV2b9wRlrT+8gwlYmGh+P+xpR8nlHD7GQWoUC/mfWm4w6rMfX6xHBylC
+SHB+teH+9lqUaefbbxKQlAbLL+3q7M4O4Dx224OZBvRN7MFnvBWJimhj8n7lJwfY
+Pl7l/ZENqigiosH5XPLIXE8WhbT2SLh9a2Lp+qH8xrEcsUlUST+F0gE9qawTTl9X
+RGfvr16YhNpScpBptB5DcmFpZyBSYXcgPGNyYWlncmF3QGdtYWlsLmNvbT6JAjYE
+MAEKACAWIQTU0NMgL8BoSaJXs43pRhgzTGdLQAUCZQmpwgIdIAAKCRDpRhgzTGdL
+QNX9D/4kl6JOsL4/P88m8i3SYW1N+FzCrr486Ak8zmfoPjtoSytk0+QIsjb5Esn4
+ltU2UD7MPoPplky3TykNUbVqPr1LtSoabbxOOpz3kpHgkYN2KvH6Bv2H81kBF0k9
+a8XYY92/73q7n7QiMmm6SNm0LO0QvHRu5KoCVQ+FyeLu4h4UqpK0RWtjIUUo6whO
+hXO1ZkkAcV38gewbU92bQBnhLxQNm/EHs9g3Dx+dmhmym4yn0sfNxX+4MsLNMa6E
+jcQ0YF+EgrQk9r8MF3NtPPFfzxswOThXNlEzie5ETAqcouT6mnlfTnB8UL4wjBoP
+GueatUqvtO99RUZbM2otZdz1bBAmOQ/R92wcqsC46zY+PdIXX3YuiGVEfZHjuAU7
+3FlajlZeWvp2NgZzLHFAjjWt67IeYkvfsv4bvq9EANXebI0Srq/g0o2Ego+kfBsZ
+Ca+2jMgxo9+6X69+WJEe46G9bHatpl2dStylgWRhroEbkV83bIFwwE8Q9QOX4uJW
+FB16kl/qTuBiG/rDgVT8eZuCYJXFKQtgPoslEramQuURyUfKFrOAyL7mQHHGSZab
+mgI8kKI//DvTD3t/BspikmdgZLQL4zoXKIFFPuES+TQO+BHoB+TikjZC81mcyZOX
+Sh+Eg21pO3B+HMOXkpv0aj3ZCUt55hslWUom8huQxY7sUdg4KIkCNgQwAQoAIBYh
+BNTQ0yAvwGhJolezjelGGDNMZ0tABQJlCaa2Ah0gAAoJEOlGGDNMZ0tA4uYQAJuP
+GEiE6/XO10lG8feXk5EIpTgFT8XiF7/CEFrGdPOgb/2HQ2G0QXGfrYI5VTJPdgsG
+Mj2JgTcFX12fyKvGpb0HXMdvqNEtNUV4z5wrhUkItPFF4wJ2YAeFuJpdgsTU3RYL
+mct30Dcr79M0JSsOO3erjAqsMj+GlTWbHMEzM86regfe0KTU9f4G8DIYRoM+Zu3E
+P3BgpKm2miyEW++vuK+/Q+cWPSi7ztRPQ9CoswPb/xEFuxnzRCbdmwGqRUJzFfQJ
+3uMTSt5JACn1mn/Bojn8IcAhCKJsBNL3MHAqkJVPdzzQhsr2z0bevVBhhbBabaub
+zbFOIHluSge5/IGr7bFjldql/UflYavrV1+aH2CzI/YEgBxZZoIgYl9N5n+vO1GI
+Xn39axQ4Lhf7mJc5Y89ojZkhT7sHgpCceyzsFWrBrcLXhhFCafTBcVQd+U1xk5Xf
+SV+3TTbWz1woIzVJ6ef5wUYI0qZBuXDef6kIEBnFUwbn5Iu834NtthSkam9LeDcJ
+NDISaoCOd+cRgKSTrGkLEIF7hzlF901S/jTDDaKGs9JnruhokxjmyxJvFcowP4Lo
+O8J+782+e1QiL49M97tvnYwzLU/iGieG6kWgQcJHVy5ZJdDNMfkZMNR6Ek4dzBVQ
+c5pgVp882o9l61xdCQq6o/oSBSCbOGe8Ujr1tGpXiQJUBBMBCgA+AhsDBQsJCAcD
+BRUKCQgLBRYCAwEAAh4BAheAFiEE1NDTIC/AaEmiV7ON6UYYM0xnS0AFAmUJpwMF
+CQ74gyIACgkQ6UYYM0xnS0Dnww//fMTpZ66XJK15CqbqqFHOlkneoV/X2Oo1CN/t
+qIiG6s1TMA/ZwF1dmHSZh46tAd2TK0qTxR4kxXlVq5oO5HbzIA9n/hvJJA8ZXk3g
+QieX4L5uITdHmAzChhf0N0jAQT8Oe72SocRMgPCI8c3ZKhBHYqI1PCTUSQKD6+dS
+D0zHGZhtPJctDBJGVDCT8jaS4JeDVBU0UijzxLo6qkZvSIXoTxjQHQILFZq4biCs
+2gLQ6aJ870TtQz/PiZkL+o5XImY+nPoAyEIC+mDSgO4kb5ELJ5U66vDMpR75FFpW
+t/wU0/0q7W9wIzifdRuctVDyh88/5ycg4zrVyX0PmNrx27EGIhL1sEPfLnzMU7am
+FqffWVtjvWrPtOiJE6vYRZA1IhallNY1eVI2NcEAj3+gSUsQx5rl7loP+axB7eSM
+BKNUBlTptKrCMCWiYVrIFHDG7rHpNc/8G7mpjQCZtUyTNfRG87991JI9nAXHqntr
+Slvr2t1TBaNkJQn06/Vx4StR8dNHvN09OzmriPibjxVXfW1fbiPD8mNPM1q1ll37
+15IaZJLJfxA0tz5hhK1J9/asM80GMRfJmbGprZqkbDEFoi4QlLGJfYM5YeHi/TKB
+j0IBS7Kh0rZ0y2YpwYRGJjeL+RMwRdbFV0vIayyZ8AS6mXbYVFfpgDnQQ2mJUkm2
+XNpucCm5Ag0EXZXx4QEQAMkaRHXCSMDjBJ+7hQp5+OW7vhRb3jJ5RvveGJpMaV9z
+/6UTo+VhI1AzkKKFZ/gwk7fJWm5cuE9fA6rc+h5eHbTtDkcPxAQk58YJyNdKj1t+
+XncvU3Nhb8C/+cChQrnxAlQeFeSk2VUnxh7eTU4jwZo89N+cLJCzz0gIBbmOtTS6
+zcdVaAhi0ePmD496kFxOz0ccGtukeXE38VdUM5PfSSEE8Cy+pokgFjyUSXBefW9u
+XsETpw12KvF6xBizFYBTsMmGQQqxtk5bO/bQly61798gcFsxnrMPxBDyENJPkNEJ
+s7tdCWEQB2dA8BZw7tN7sItVQabTmz4gUlmRSfsZfZbNZy7nL3zIBXRBZ6I9OPOp
+m7BCUlOEQgJQru3RJdfnFVaNUURTd0Up+t+lACuUXXuMlrDbjAFlIGN0YR86JN6b
+yAv2s9V5U/3R6QV50BRkj1qQehwUKRQYNMMeSs0I63zHgWOLjXwqr1O0U2/x+8o+
+UOUVCvsicQcl2CDLbC4C+xntZSKUwYmWtAWjkiDp5Fk2Fxyj9vK5TSym+ur3AAH
+gZVugkoM5yMhiOIJVPKGB1aAnQNmQVYREEpJBTtFqbURraqObqiHKPF6MKAL+AW4
+jv2Lms0gJ2S5rSmP/Zi0CiABYg1pppojYlrHp1vXb251o7WlPgwf6nKKLTi8byTN
+ABEBAAGJAjwEGAEKACYCGwwWIQTU0NMgL8BoSaJXs43pRhgzTGdLQAUCZQmnLAUJ
+DviDSwAKCRDpRhgzTGdLQNAwD/0ThrnXqwZ+dyFK4M73nqSXwWjED/xHAQYmrEAr
+kVoox3GZYlTFlQlCQZTi+yOsrFdiP7EfWM8jbc6BqEh4fhn1f+wUIiZQELl+6M/U
+rHrPz5h4c9rD/+M62awPa6HdauaHkUrF3nAax9EOTVQJvxKLpuaE9Ki9p2ZMEQOK
+HakTDtLL2BeXiJG1I/SH1thBPuGL4hReY8qrj0ryYMrlYdu7l+RJrQUemLVD/eQI
+S8MqH8E5HjZKS7QNSCEEeHgFw1Yu28C+AnjHQHS5gDugw8ire/NetFxI8Wx5nOOU
+oCRR3P1U5IFWqj+Yukc3rB0z9+kSK3cic1jdCRy26JYxz9xuBbAqcnKoGtrB3HVI
+Y2pdQKN4kTpifGDriSEe6epuEvvObBovYJE3lc4AWr8VNFJd4UYphJ/9Px+5xajo
+ZBicNI9pGq0gTDuBb+tBwTt2dw8tFSCLyJ+C1dFRZX8NM3FlnpjeJQb7SCcLT4PZ
+h4+CyElfF/HkcVZHjjanpXZdP91clgmRidnlDBQ07BmaTgvxdlkwHJFGqGcuZn1A
+y1p23CECTYiFxFxgMvVjNHSPSyrEnNC0ash+BIGuxvYfm/7CioThFXw9TbwQXn6C
+IsgINPAvnKVmW6Ui0jLvtlIWV/TW2yDFjPoC2ilVexwt9QdvtBf5baT8GCilb5Yo
+EmR2yA==
+=t5JY
+-----END PGP PUBLIC KEY BLOCK-----
--- a/pkgs/applications/blockchains/sparrow/update.sh
+++ b/pkgs/applications/blockchains/sparrow/update.sh
@ -1,26 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p coreutils curl jq gnused gnupg common-updater-scripts
-
-set -eu -o pipefail
-
-version="$(curl -s https://api.github.com/repos/sparrowwallet/sparrow/releases| jq '.[] | {name} | limit(1;.[])' | sed 's/[\"v]//g' | head -n 1)"
-depname="sparrow-$version-x86_64.tar.gz"
-src_root="https://github.com/sparrowwallet/sparrow/releases/download/$version";
-src="$src_root/$depname";
-manifest="$src_root/sparrow-$version-manifest.txt"
-signature="$src_root/sparrow-$version-manifest.txt.asc"
-key="D4D0 D320 2FC0 6849 A257 B38D E946 1833 4C67 4B40"
-
-pushd $(mktemp -d --suffix=-sparrow-updater)
-export GNUPGHOME=$PWD/gnupg
-mkdir -m 700 -p "$GNUPGHOME"
-curl -L -o "$depname" -- "$src"
-curl -L -o manifest.txt -- "$manifest"
-curl -L -o signature.asc -- "$signature"
-gpg --batch --recv-keys "$key"
-gpg --batch --verify signature.asc manifest.txt
-sha256sum -c --ignore-missing manifest.txt
-sha256=$(nix-prefetch-url --type sha256 "file://$PWD/$depname")
-popd
-
-update-source-version sparrow-unwrapped "$version" "$sha256"
--- a/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix
@ -67,7 +67,7 @@ let
      cp $out/lib/* $out/share/adapter
      cp -r adapter/scripts $out/share/adapter
      cp -t $out/share/formatters formatters/*.py
-      ln -s ${lldb.lib} $out/share/lldb
+      ln -s ${lib.getLib lldb} $out/share/lldb
      makeWrapper $out/share/adapter/codelldb $out/bin/codelldb \
        --set-default LLDB_DEBUGSERVER_PATH "${lldb.out}/bin/lldb-server"
    '';
--- a/pkgs/applications/emulators/craftos-pc/default.nix
+++ b/pkgs/applications/emulators/craftos-pc/default.nix
@ -3,6 +3,7 @@
 , fetchFromGitHub
 , callPackage
 , patchelf
+, unzip
 , poco
 , openssl
 , SDL2
@ -40,7 +41,9 @@ stdenv.mkDerivation rec {
    hash = "sha256-ozebHgUgwdqYtWAyL+EdwpjEvZC+PkWcLYCPWz2FjSw=";
  };

-  buildInputs = [ patchelf poco openssl SDL2 SDL2_mixer ncurses libpng pngpp libwebp ];
+  nativeBuildInputs = [ patchelf unzip ];
+  buildInputs = [ poco openssl SDL2 SDL2_mixer ncurses libpng pngpp libwebp ];
+  strictDeps = true;

  preBuild = ''
    cp -R ${craftos2-lua}/* ./craftos2-lua/
@ -63,6 +66,17 @@ stdenv.mkDerivation rec {
    patchelf --replace-needed craftos2-lua/src/liblua.so liblua.so $out/bin/craftos
    cp -R api $out/include/CraftOS-PC
    cp -R ${craftos2-rom}/* $out/share/craftos
+
+    mkdir -p resources/linux-icons
+    unzip resources/linux-icons.zip -d resources/linux-icons
+    for dim in 16 24 32 48 64 96 128 256 1024; do
+      dir="$out/share/icons/hicolor/$dimx$dim/apps"
+      mkdir -p "$dir"
+      cp "resources/linux-icons/$dim.png" "$dir/craftos.png"
+    done
+
+    mkdir -p $out/share/applications
+    cp resources/linux-icons/CraftOS-PC.desktop $out/share/applications/CraftOS-PC.desktop
  '';

  passthru.tests = {
--- a/pkgs/applications/graphics/emulsion/default.nix
+++ b/pkgs/applications/graphics/emulsion/default.nix
@ -37,16 +37,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "emulsion";
-  version = "10.5";
+  version = "11.0";

  src = fetchFromGitHub {
    owner = "ArturKovacs";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Wrb5jHr2rXDpXF/uHpNLKSc//Xdj0/VsXQcytit0hKY=";
+    sha256 = "sha256-0t+MUZu1cvkJSL9Ly9kblH8fMr05KuRpOo+JDn/VUc8=";
  };

-  cargoHash = "sha256-zfR4sp/AmK3+UcFdqMMZE9O9+oGathqmuqFw11SmUWI=";
+  cargoHash = "sha256-detJZRnxT3FubaF/A4w2pFdhW03BH0gsaeuNFYu+cBw=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/applications/misc/cartridges/default.nix
+++ b/pkgs/applications/misc/cartridges/default.nix
@ -13,13 +13,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "cartridges";
-  version = "2.7.4";
+  version = "2.8.4";

  src = fetchFromGitHub {
    owner = "kra-mo";
    repo = "cartridges";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-AfO+vLJSWdaMqqbzRZWrY94nu/9BM7mqdad9rkiq1pg=";
+    hash = "sha256-x6utIvU4LxM/CJogy5JrFrDTLFmXbgItgqtT+lM7FGA=";
  };

  pythonPath = with python3Packages; [
@ -67,7 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
      and more with no login necessary.
      You can sort and hide games or download cover art from SteamGridDB.
    '';
-    homepage = "https://apps.gnome.org/app/hu.kramo.Cartridges/";
+    homepage = "https://apps.gnome.org/Cartridges/";
    license = licenses.gpl3Plus;
    maintainers = [ maintainers.getchoo ];
    platforms = platforms.linux;
--- a/pkgs/applications/misc/font-manager/default.nix
+++ b/pkgs/applications/misc/font-manager/default.nix
@ -16,6 +16,7 @@
 , gtk3
 , gnome
 , desktop-file-utils
+, fetchpatch2
 , wrapGAppsHook3
 , gobject-introspection
 # withWebkit enables the "webkit" feature, also known as Google Fonts
@ -33,6 +34,16 @@ stdenv.mkDerivation rec {
    hash = "sha256-M13Q9d2cKhc0tudkvw0zgqPAFTlmXwK+LltXeuDPWxo=";
  };

+  patches = [
+    # see https://github.com/FontManager/font-manager/issues/355
+    # should be removed on next release
+    (fetchpatch2 {
+      name = "fix-build-with-newer-vala.patch";
+      url = "https://github.com/FontManager/font-manager/commit/600f498946c3904064b4e4fdf96e5841f6a827e4.patch";
+      hash = "sha256-DC9+pvG88t+PPdGQ2oemeEYK9PaD0C2yWBYYCh4Wn9g=";
+    })
+  ];
+
  nativeBuildInputs = [
    pkg-config
    meson
--- a/pkgs/applications/misc/gpu-viewer/default.nix
+++ b/pkgs/applications/misc/gpu-viewer/default.nix
@ -19,7 +19,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "gpu-viewer";
-  version = "3.02";
+  version = "3.04";

  format = "other";

@ -27,7 +27,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "arunsivaramanneo";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-/m8kXCICvWDqKIC6DbhUAXsjT+RNLMTsvlVTx85AJhE=";
+    hash = "sha256-+FDBHSVBTUHnhu2n7i9W1zIZe2wjY+OuFwQOJZojuzs=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/jrnl/default.nix
+++ b/pkgs/applications/misc/jrnl/default.nix
@ -44,7 +44,7 @@ python3.pkgs.buildPythonApplication rec {
  nativeCheckInputs = with python3.pkgs; [
    pytest-bdd
    pytest-xdist
-    pytestCheckHook
+    (pytestCheckHook.override { pytest = pytest_7; })
    toml
  ];

--- a/pkgs/applications/misc/mission-center/Cargo.lock
+++ b/pkgs/applications/misc/mission-center/Cargo.lock
--- a/pkgs/applications/misc/mission-center/default.nix
+++ b/pkgs/applications/misc/mission-center/default.nix
@ -45,13 +45,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "mission-center";
-  version = "0.4.4";
+  version = "0.4.5";

  src = fetchFromGitLab {
    owner = "mission-center-devs";
    repo = "mission-center";
    rev = "v${version}";
-    hash = "sha256-J0wSu/jWpUJ7Ga6RecY4yLT7i5Ry1HiI+t30SAHOkMw=";
+    hash = "sha256-e5+uB2vzwRqjUiR+gxpSARHPqG+1iX3yifsfwv5LnZI=";
  };

  cargoDeps = symlinkJoin {
@ -59,9 +59,6 @@ stdenv.mkDerivation rec {
    paths = [
      (rustPlatform.importCargoLock {
        lockFile = ./Cargo.lock;
-        outputHashes = {
-          "pathfinder_canvas-0.5.0" = "sha256-qEp16TVggPtvFvDuUyWsS6rH6MeO6FW0K6BnACghaCg=";
-        };
      })
      (rustPlatform.importCargoLock {
        lockFile = ./gatherer-Cargo.lock;
--- a/pkgs/applications/misc/mission-center/gatherer-Cargo.lock
+++ b/pkgs/applications/misc/mission-center/gatherer-Cargo.lock
--- a/pkgs/applications/misc/nwg-displays/default.nix
+++ b/pkgs/applications/misc/nwg-displays/default.nix
@ -14,13 +14,13 @@

 python310Packages.buildPythonApplication rec {
  pname = "nwg-displays";
-  version = "0.3.16";
+  version = "0.3.18";

  src = fetchFromGitHub {
    owner = "nwg-piotr";
    repo = "nwg-displays";
    rev = "refs/tags/v${version}";
-    hash = "sha256-rnaBYDGEsc8oGw4yZ60NQFbNf+L0tmHYDYf+UDoDmSI=";
+    hash = "sha256-wf72x3lXNAJ6Y4zJmYgwJrL1gWJBvTYUcXasT5zlXCM=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/nwg-dock-hyprland/default.nix
+++ b/pkgs/applications/misc/nwg-dock-hyprland/default.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "nwg-dock-hyprland";
-  version = "0.1.7";
+  version = "0.1.8";

  src = fetchFromGitHub {
    owner = "nwg-piotr";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Lekvk3tQfeOR+Ltbc5b7TMiUZpktZ2nvCtUncrFb+Kc=";
+    sha256 = "sha256-cdNxaOnm98RcPG2o0GaBETpd+Zo2nlgrFv+2PiHOwUI=";
  };

-  vendorHash = "sha256-5fN/6HASfTMb80YYAIoWRqnRGMvvX4d8C2UvOc0jQU0=";
+  vendorHash = "sha256-JEzc950c4EGOYMLgpL8PXENkGlWSX8Z4A4jCx1B99X8=";

  ldflags = [ "-s" "-w" ];

--- a/pkgs/applications/misc/rofi-rbw/default.nix
+++ b/pkgs/applications/misc/rofi-rbw/default.nix
@ -17,14 +17,14 @@

 buildPythonApplication rec {
  pname = "rofi-rbw";
-  version = "1.4.0";
+  version = "1.4.2";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "fdw";
    repo = "rofi-rbw";
    rev = "refs/tags/${version}";
-    hash = "sha256-1xbdZlZa3YPz+33AMgvhiMO12vc/ej0RybypQUzEn+8=";
+    hash = "sha256-wUb89GkNB2lEfb42hMvcxpbjc1O+wx8AkFjq7aJwAko=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/wofi-emoji/default.nix
+++ b/pkgs/applications/misc/wofi-emoji/default.nix
@ -1,22 +1,37 @@
-{ stdenv, lib, fetchurl, fetchFromGitHub, jq, wofi, wtype, wl-clipboard }:
+{
+  stdenv,
+  lib,
+  fetchurl,
+  fetchFromGitHub,
+  jq,
+  wofi,
+  wtype,
+  wl-clipboard,
+}:

-let emojiJSON = fetchurl {
-  url = "https://raw.githubusercontent.com/muan/emojilib/v3.0.10/dist/emoji-en-US.json";
-  hash = "sha256-UhAB5hVp5vV2d1FjIb2TBd2FJ6OPBbiP31HGAEDQFnA=";};
+let
+  emojiJSON = fetchurl {
+    url = "https://raw.githubusercontent.com/muan/emojilib/v3.0.11/dist/emoji-en-US.json";
+    hash = "sha256-WHqCSNgDzc6ZASdVrwPvsU4MtBcYLKDp2D2Hykrq1sI=";
+  };
 in
 stdenv.mkDerivation rec {
  pname = "wofi-emoji";
-  version = "unstable-2023-12-22";
+  version = "1.0.0";

  src = fetchFromGitHub {
    owner = "Zeioth";
-    repo = pname;
-    rev = "2cc95880848134a3bbe0675bcb62a0dae1d0f572";
-    hash = "sha256-t9M8z8JxuvBDzNs98L7YTNUfTK23W1DYGdHDiXNQOgk=";
+    repo = "wofi-emoji";
+    rev = "v${version}";
+    hash = "sha256-wLZK7RcDxxlYuu27WNj+SoRoBiCqk9whp4Fyg0SOoPA=";
  };

  nativeBuildInputs = [ jq ];
-  buildInputs = [ wofi wtype wl-clipboard ];
+  buildInputs = [
+    wofi
+    wtype
+    wl-clipboard
+  ];

  postPatch = ''
    substituteInPlace build.sh \
@ -44,12 +59,12 @@ stdenv.mkDerivation rec {
    runHook postInstall
  '';

-  meta = with lib; {
+  meta = {
    description = "Simple emoji selector for Wayland using wofi and wl-clipboard";
    homepage = "https://github.com/Zeioth/wofi-emoji";
-    license = licenses.mit;
-    maintainers = [ maintainers.ymarkus ];
-    platforms = platforms.all;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ johnrtitor ymarkus ];
+    platforms = lib.platforms.all;
    mainProgram = "wofi-emoji";
  };
 }
--- a/pkgs/applications/networking/browsers/yandex-browser/default.nix
+++ b/pkgs/applications/networking/browsers/yandex-browser/default.nix
@ -54,15 +54,15 @@

 let
  version = {
-    corporate = "23.11.1.822-1";
-    beta = "24.1.1.939-1";
-    stable = "24.1.1.940-1";
+    corporate = "24.1.3.843-1";
+    beta = "24.4.1.918-1";
+    stable = "24.4.1.915-1";
  }.${edition};

  hash = {
-    corporate = "sha256-OOcz2dQeVea0vBjF1FyrCsnRR+WrCzfLTd+YXpLJCsI=";
-    beta = "sha256-Meswp1aeNTBr79l7XGWqJT9qqUdOfSzIpdL1L29UfJw=";
-    stable = "sha256-FZHoCRedpHHVwibSXts2DncUN83PZ9UlVOSXPjgAaNs=";
+    corporate = "sha256-rI19YmsC2p2Dsi6Grd8IyNdpjMHWwET3wcVw5r7545M=";
+    beta = "sha256-EQjjaTMPQKaULITEF+MQuY1lRVXuOjyiGWuGQtIpIz0=";
+    stable = "sha256-2IIIADFG9kCtzB0X4AfrFI+btqoUzKwd6NlZt7qtL/M=";
  }.${edition};

  app = {
--- a/pkgs/applications/networking/cluster/k3s/1_27/chart-versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_27/chart-versions.nix
@ -1,10 +1,10 @@
 {
    traefik-crd  = {
-        url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-25.0.2+up25.0.0.tgz";
-        sha256 = "0jygzsn5pxzf7423x5iqfffgx5xvm7c7hfck46y7vpv1fdkiipcq";
+        url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-25.0.3+up25.0.0.tgz";
+        sha256 = "1z693i4kd3jyf26ccnb0sxjyxadipl6k13n7jyg5v4y93fv1rpdw";
    };
    traefik = {
-        url = "https://k3s.io/k3s-charts/assets/traefik/traefik-25.0.2+up25.0.0.tgz";
-        sha256 = "1g9n19lnqdkmbbr3rnbwc854awha0kqqfwyxanyx1lg5ww8ldp89";
+        url = "https://k3s.io/k3s-charts/assets/traefik/traefik-25.0.3+up25.0.0.tgz";
+        sha256 = "1a24qlp7c6iri72ka1i37l1lzn13xibrd26dy295z2wzr55gg7if";
    };
 }
--- a/pkgs/applications/networking/cluster/k3s/1_27/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_27/versions.nix
@ -1,14 +1,14 @@
 {
-  k3sVersion = "1.27.12+k3s1";
-  k3sCommit = "78ad57567c9eb1fd1831986f5fd7b4024add1767";
-  k3sRepoSha256 = "1j6xb3af4ypqq5m6a8x2yc2515zvlgqzfsfindjm9cbmq5iisphq";
-  k3sVendorHash = "sha256-65cmpRwD9C+fcbBSv1YpeukO7bfGngsLv/rk6sM59gU=";
+  k3sVersion = "1.27.13+k3s1";
+  k3sCommit = "b23f142da8589854cc7ee45da08d96b5ad1ee1ff";
+  k3sRepoSha256 = "052998644il0qra7cdpvmy007gw16k2rvyg418m1j02pm9a3zn10";
+  k3sVendorHash = "sha256-rQZZnleRekkU1+I38LmFnnatZPuS+K1jbBwA+Dmc0jo=";
  chartVersions = import ./chart-versions.nix;
  k3sRootVersion = "0.12.2";
  k3sRootSha256 = "1gjynvr350qni5mskgm7pcc7alss4gms4jmkiv453vs8mmma9c9k";
  k3sCNIVersion = "1.4.0-k3s2";
  k3sCNISha256 = "17dg6jgjx18nrlyfmkv14dhzxsljz4774zgwz5dchxcf38bvarqa";
-  containerdVersion = "1.7.11-k3s2.27";
-  containerdSha256 = "0xjxc5dgh3drk2glvcabd885damjffp9r4cs0cm1zgnrrbhlipra";
+  containerdVersion = "1.7.15-k3s1.27";
+  containerdSha256 = "0bjxw174prhq8izmgrmpyljfxzrj0lh5d0w04g3lyn0rp3kwxqsl";
  criCtlVersion = "1.26.0-rc.0-k3s1";
 }
--- a/pkgs/applications/networking/cluster/k3s/1_28/chart-versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_28/chart-versions.nix
@ -1,10 +1,10 @@
 {
    traefik-crd  = {
-        url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-25.0.2+up25.0.0.tgz";
-        sha256 = "0jygzsn5pxzf7423x5iqfffgx5xvm7c7hfck46y7vpv1fdkiipcq";
+        url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-25.0.3+up25.0.0.tgz";
+        sha256 = "1z693i4kd3jyf26ccnb0sxjyxadipl6k13n7jyg5v4y93fv1rpdw";
    };
    traefik = {
-        url = "https://k3s.io/k3s-charts/assets/traefik/traefik-25.0.2+up25.0.0.tgz";
-        sha256 = "1g9n19lnqdkmbbr3rnbwc854awha0kqqfwyxanyx1lg5ww8ldp89";
+        url = "https://k3s.io/k3s-charts/assets/traefik/traefik-25.0.3+up25.0.0.tgz";
+        sha256 = "1a24qlp7c6iri72ka1i37l1lzn13xibrd26dy295z2wzr55gg7if";
    };
 }
--- a/pkgs/applications/networking/cluster/k3s/1_28/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_28/versions.nix
@ -1,14 +1,14 @@
 {
-  k3sVersion = "1.28.8+k3s1";
-  k3sCommit = "653dd61aaa2d0ef8bd83ac4dbc6d150dde792efc";
-  k3sRepoSha256 = "0pf8xw1m56m2s8i99vxj4i2l7fz7388kiynwzfrck43jb7v7kbbw";
-  k3sVendorHash = "sha256-wglwRW2RO9QJI6CRLgkVg5Upt6R0M3gX76zy0kT02ec=";
+  k3sVersion = "1.28.9+k3s1";
+  k3sCommit = "289a1a3edbc0f6ee5a7f91bf96aa1ed1b743bd1f";
+  k3sRepoSha256 = "0kms6r10k6v037r5lxxrp90bnynrgyrn61kqnzy2f5avny4blikh";
+  k3sVendorHash = "sha256-iUp2Maua3BnrC4Jq2ij0uOW5gYYZfz6e+TEdDtN0PT8=";
  chartVersions = import ./chart-versions.nix;
  k3sRootVersion = "0.12.2";
  k3sRootSha256 = "1gjynvr350qni5mskgm7pcc7alss4gms4jmkiv453vs8mmma9c9k";
  k3sCNIVersion = "1.4.0-k3s2";
  k3sCNISha256 = "17dg6jgjx18nrlyfmkv14dhzxsljz4774zgwz5dchxcf38bvarqa";
-  containerdVersion = "1.7.11-k3s2";
-  containerdSha256 = "0279sil02wz7310xhrgmdbc0r2qibj9lafy0i9k24jdrh74icmib";
+  containerdVersion = "1.7.15-k3s1";
+  containerdSha256 = "18hlj4ixjk7wvamfd66xyc0cax2hs9s7yjvlx52afxdc73194y0f";
  criCtlVersion = "1.26.0-rc.0-k3s1";
 }
--- a/pkgs/applications/networking/cluster/k3s/1_29/chart-versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_29/chart-versions.nix
@ -1,10 +1,10 @@
 {
    traefik-crd  = {
-        url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-25.0.2+up25.0.0.tgz";
-        sha256 = "0jygzsn5pxzf7423x5iqfffgx5xvm7c7hfck46y7vpv1fdkiipcq";
+        url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-25.0.3+up25.0.0.tgz";
+        sha256 = "1z693i4kd3jyf26ccnb0sxjyxadipl6k13n7jyg5v4y93fv1rpdw";
    };
    traefik = {
-        url = "https://k3s.io/k3s-charts/assets/traefik/traefik-25.0.2+up25.0.0.tgz";
-        sha256 = "1g9n19lnqdkmbbr3rnbwc854awha0kqqfwyxanyx1lg5ww8ldp89";
+        url = "https://k3s.io/k3s-charts/assets/traefik/traefik-25.0.3+up25.0.0.tgz";
+        sha256 = "1a24qlp7c6iri72ka1i37l1lzn13xibrd26dy295z2wzr55gg7if";
    };
 }
--- a/pkgs/applications/networking/cluster/k3s/1_29/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_29/versions.nix
@ -1,14 +1,14 @@
 {
-  k3sVersion = "1.29.3+k3s1";
-  k3sCommit = "8aecc26b0f167d5e9e4e9fbcfd5a471488bf5957";
-  k3sRepoSha256 = "12285mhwi6cifsw3gjxxmd1g2i5f7vkdgzdc6a78rkvnx7z1j3p3";
-  k3sVendorHash = "sha256-pID2h/rvvKyfHWoglYPbbliAby+9R2zoh7Ajd36qjVQ=";
+  k3sVersion = "1.29.4+k3s1";
+  k3sCommit = "94e29e2ef5d79904f730e2024c8d1682b901b2d5";
+  k3sRepoSha256 = "0kkhd2fnlmjanzvwgdclmbg6azw3r1a2lj5207716pavxmb9ld7y";
+  k3sVendorHash = "sha256-wOX+ktGPFYUKLZBK/bQhWWG+SnRCkNYnk3Tz8wpMo5A=";
  chartVersions = import ./chart-versions.nix;
-  k3sRootVersion = "0.12.2";
-  k3sRootSha256 = "1gjynvr350qni5mskgm7pcc7alss4gms4jmkiv453vs8mmma9c9k";
+  k3sRootVersion = "0.13.0";
+  k3sRootSha256 = "1jq5f0lm08abx5ikarf92z56fvx4kjpy2nmzaazblb34lajw87vj";
  k3sCNIVersion = "1.4.0-k3s2";
  k3sCNISha256 = "17dg6jgjx18nrlyfmkv14dhzxsljz4774zgwz5dchxcf38bvarqa";
-  containerdVersion = "1.7.11-k3s2";
-  containerdSha256 = "0279sil02wz7310xhrgmdbc0r2qibj9lafy0i9k24jdrh74icmib";
+  containerdVersion = "1.7.15-k3s1";
+  containerdSha256 = "18hlj4ixjk7wvamfd66xyc0cax2hs9s7yjvlx52afxdc73194y0f";
  criCtlVersion = "1.29.0-k3s1";
 }
--- a/pkgs/applications/networking/cluster/k3s/builder.nix
+++ b/pkgs/applications/networking/cluster/k3s/builder.nix
@ -30,7 +30,6 @@ lib:
 # It is likely we will have to split out additional builders for additional
 # versions in the future, or customize this one further.
 { lib
-, fetchpatch
 , makeWrapper
 , socat
 , iptables
@ -56,6 +55,7 @@ lib:
 , sqlite
 , nixosTests
 , pkgsBuildBuild
+, go
 }:

 # k3s is a kinda weird derivation. One of the main points of k3s is the
@ -93,8 +93,9 @@ let

  # https://github.com/k3s-io/k3s/blob/5fb370e53e0014dc96183b8ecb2c25a61e891e76/scripts/build#L19-L40
  versionldflags = [
-    "-X github.com/rancher/k3s/pkg/version.Version=v${k3sVersion}"
-    "-X github.com/rancher/k3s/pkg/version.GitCommit=${lib.substring 0 8 k3sCommit}"
+    "-X github.com/k3s-io/k3s/pkg/version.Version=v${k3sVersion}"
+    "-X github.com/k3s-io/k3s/pkg/version.GitCommit=${lib.substring 0 8 k3sCommit}"
+    "-X github.com/k3s-io/k3s/pkg/version.UpstreamGolang=go${go.version}"
    "-X k8s.io/client-go/pkg/version.gitVersion=v${k3sVersion}"
    "-X k8s.io/client-go/pkg/version.gitCommit=${k3sCommit}"
    "-X k8s.io/client-go/pkg/version.gitTreeState=clean"
@ -185,15 +186,6 @@ let
    src = k3sRepo;
    vendorHash = k3sVendorHash;

-    patches =
-      # Disable: Add runtime checking of golang version
-      (fetchpatch {
-        # https://github.com/k3s-io/k3s/pull/9054
-        url = "https://github.com/k3s-io/k3s/commit/b297996b9252b02e56e9425f55f6becbf6bb7832.patch";
-        hash = "sha256-xBOY2jnLhT9dtVKtq26V9QUnuX1q6E/9UcO9IaU719U=";
-        revert = true;
-      });
-
    nativeBuildInputs = [ pkg-config ];
    buildInputs = [ libseccomp sqlite.dev ];

--- a/pkgs/applications/networking/hpmyroom/default.nix
+++ b/pkgs/applications/networking/hpmyroom/default.nix
@ -4,11 +4,11 @@
 }:
 mkDerivation rec {
  pname = "hpmyroom";
-  version = "12.9.0.0601";
+  version = "12.13.0.0749";

  src = fetchurl {
    url = "https://www.myroom.hpe.com/downloadfiles/${pname}-${version}.x86_64.rpm";
-    sha256 = "sha256-1BC4EjCCLAuCIOV+jJn3pfKKW7UJI5tfC+wg0FUgB64=";
+    sha256 = "sha256-Ff3j14rC2ZHhNJLPxvKn9Sxyv351HuHbggclwOuFfX4=";
  };

  nativeBuildInputs = [
@ -56,5 +56,6 @@ mkDerivation rec {
    # TODO: A Darwin binary is available upstream
    platforms = [ "x86_64-linux" ];
    mainProgram = "hpmyroom";
+    broken = true; # requires libpng15
  };
 }
--- a/pkgs/applications/networking/instant-messengers/dino/default.nix
+++ b/pkgs/applications/networking/instant-messengers/dino/default.nix
@ -34,6 +34,12 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-smy/t6wTCnG0kuRFKwyeLENKqOQDhL0fZTtj3BHo6kw=";
  };

+  patches = [
+    # fixes build failure https://github.com/dino/dino/issues/1576
+    # backport of https://github.com/dino/dino/commit/657502955567dd538e56f300e075c7db52e25d74
+    ./fix-compile-new-vala-c.diff
+  ];
+
  postPatch = ''
    # don't overwrite manually set version information
    substituteInPlace CMakeLists.txt \
--- a/pkgs/applications/networking/instant-messengers/dino/fix-compile-new-vala-c.diff
+++ b/pkgs/applications/networking/instant-messengers/dino/fix-compile-new-vala-c.diff
@ -0,0 +1,16 @@
+diff --git a/plugins/gpgme-vala/vapi/gpgme_public.vapi b/plugins/gpgme-vala/vapi/gpgme_public.vapi
+index bcf12569..b32efd03 100644
+--- a/plugins/gpgme-vala/vapi/gpgme_public.vapi
+++ b/plugins/gpgme-vala/vapi/gpgme_public.vapi
+@@ -22,9 +22,9 @@ public class Key {
+     public string issuer_name;
+     public string chain_id;
+     public Validity owner_trust;
+-    [CCode(array_null_terminated = true)]
+    [CCode(array_length = false, array_null_terminated = true)]
+     public SubKey[] subkeys;
+-    [CCode(array_null_terminated = true)]
+    [CCode(array_length = false, array_null_terminated = true)]
+     public UserID[] uids;
+     public KeylistMode keylist_mode;
+     // public string fpr; // requires gpgme >= 1.7.0
--- a/pkgs/applications/networking/instant-messengers/fractal/Cargo.lock
+++ b/pkgs/applications/networking/instant-messengers/fractal/Cargo.lock
--- a/pkgs/applications/networking/instant-messengers/fractal/default.nix
+++ b/pkgs/applications/networking/instant-messengers/fractal/default.nix
@ -25,20 +25,23 @@

 stdenv.mkDerivation rec {
  pname = "fractal";
-  version = "6";
+  version = "7";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
-    owner = "GNOME";
+    owner = "World";
    repo = "fractal";
-    rev = version;
-    hash = "sha256-J4Jb7G5Rfou3N7mytetIdLl0dGY5dSvTjnu8aj4kWXQ=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-IfcThpsGATMD3Uj9tvw/aK7IVbiVT8sdZ088gRUqnlg=";
  };

  cargoDeps = rustPlatform.importCargoLock {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "matrix-sdk-0.6.2" = "sha256-CY0Ylrd3NkP1IevyQa351IS/+evG2GgrjPnR/ZDFR9Q=";
+      "mas-http-0.8.0" = "sha256-IiYxF9qT/J/n8t/cVT/DRV3gl2MTA6/YfjshVIic/n4=";
+      "matrix-sdk-0.7.1" = "sha256-quwt9Dx0K6LDMwHBipc52Ek59zz5mlTAdOj+RXZBU3Q=";
+      "ruma-0.9.4" = "sha256-tp0EFS39UTXZJQPUDjeQixb8wzsMCzyFggVj6M8TRYg=";
+      "vodozemac-0.5.1" = "sha256-Hm0C696RmNX6n1Jx+hqkKMjpdbArliuzdiS4wCv3OIM=";
    };
  };

--- a/pkgs/applications/networking/instant-messengers/signal-desktop/generic.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/generic.nix
@ -57,7 +57,8 @@
 let
  inherit (stdenv) targetPlatform;
  ARCH = if targetPlatform.isAarch64 then "arm64" else "x64";
-in stdenv.mkDerivation rec {
+in
+stdenv.mkDerivation rec {
  inherit pname version;

  # Please backport all updates to the stable channel.
@ -155,10 +156,9 @@ in stdenv.mkDerivation rec {
      --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
    )

-    # Fix the desktop link and fix showing application icon in tray
+    # Fix the desktop link
    substituteInPlace $out/share/applications/${pname}.desktop \
-      --replace "/opt/${dir}/${pname}" $out/bin/${pname} \
-      ${if pname == "signal-desktop" then "--replace \"bin/signal-desktop\" \"bin/signal-desktop --use-tray-icon\"" else ""}
+      --replace "/opt/${dir}/${pname}" $out/bin/${pname}

    # Note: The following path contains bundled libraries:
    # $out/lib/${dir}/resources/app.asar.unpacked/node_modules/
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
@ -2,7 +2,7 @@
 callPackage ./generic.nix { } rec {
  pname = "signal-desktop";
  dir = "Signal";
-  version = "7.6.0";
+  version = "7.7.0";
  url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-  hash = "sha256-sGOWsFZTO9VQDkCqhsOkW5aY+sh0fLH7kPPe/bAzGvg=";
+  hash = "sha256-UESpbYZ4oRhhQF8GYrbKnNkqmefCfTE1jfCCK7ctIKk=";
 }
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "signalbackup-tools";
-  version = "20240425-1";
+  version = "20240504";

  src = fetchFromGitHub {
    owner = "bepaald";
    repo = pname;
    rev = version;
-    hash = "sha256-CulgcWcAX/42jB3kCmxLAFioyNtMJV80dW3ofp7Yw6o=";
+    hash = "sha256-ojV/taYV5J4nHfDg//lJ78ltJv7nIG1H9iXo95nA/n8=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/mailreaders/notmuch/default.nix
+++ b/pkgs/applications/networking/mailreaders/notmuch/default.nix
@ -1,4 +1,4 @@
-{ fetchurl, lib, stdenv, makeWrapper
+{ fetchurl, lib, stdenv, makeWrapper, buildEnv
 , pkg-config, gnupg
 , xapian, gmime3, sfsexp, talloc, zlib
 , doxygen, perl, texinfo
@ -12,14 +12,15 @@
 , withEmacs ? true
 , withRuby ? true
 , withSfsexp ? true # also installs notmuch-git, which requires sexp-support
+, withVim ? true
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "notmuch";
  version = "0.38.3";

  src = fetchurl {
-    url = "https://notmuchmail.org/releases/notmuch-${version}.tar.xz";
+    url = "https://notmuchmail.org/releases/notmuch-${finalAttrs.version}.tar.xz";
    hash = "sha256-mvRsyA2li0MByiuu/MJaQNES0DFVB+YywPPw8IMo0FQ=";
  };

@ -76,8 +77,7 @@ stdenv.mkDerivation rec {
  '';

  outputs = [ "out" "man" "info" "bindingconfig" ]
-    ++ lib.optional withEmacs "emacs"
-    ++ lib.optional withRuby "ruby";
+    ++ lib.optional withEmacs "emacs";

  # if notmuch is built with s-expression support, the testsuite (T-850.sh) only
  # passes if notmuch-git can be executed, so we need to patch its shebang.
@ -123,7 +123,7 @@ stdenv.mkDerivation rec {
    moveToOutput bin/notmuch-emacs-mua $emacs
  '' + lib.optionalString withRuby ''
    make -C bindings/ruby install \
-      vendordir=$ruby/lib/ruby \
+      vendordir=$out/lib/ruby \
      SHELL=$SHELL \
      $makeFlags "''${makeFlagsArray[@]}" \
      $installFlags "''${installFlagsArray[@]}"
@ -133,12 +133,31 @@ stdenv.mkDerivation rec {
  + lib.optionalString withSfsexp ''
    cp notmuch-git $out/bin/notmuch-git
    wrapProgram $out/bin/notmuch-git --prefix PATH : $out/bin:${lib.getBin git}/bin
+  '' + lib.optionalString withVim ''
+    make -C vim DESTDIR="$out/share/vim-plugins/notmuch" prefix="" install
+    mkdir -p $out/share/nvim
+    ln -s $out/share/vim-plugins/notmuch $out/share/nvim/site
+  '' + lib.optionalString (withVim && withRuby) ''
+    PLUG=$out/share/vim-plugins/notmuch/plugin/notmuch.vim
+    cat >> $PLUG << EOF
+      let \$GEM_PATH=\$GEM_PATH . ":${finalAttrs.passthru.gemEnv}/${ruby.gemPath}"
+      let \$RUBYLIB=\$RUBYLIB . ":$out/${ruby.libPath}/${ruby.system}"
+      if has('nvim')
+    EOF
+    for gem in ${finalAttrs.passthru.gemEnv}/${ruby.gemPath}/gems/*/lib; do
+      echo "ruby \$LOAD_PATH.unshift('$gem')" >> $PLUG
+    done
+    echo 'endif' >> $PLUG
  '';

  passthru = {
-    pythonSourceRoot = "notmuch-${version}/bindings/python";
+    pythonSourceRoot = "notmuch-${finalAttrs.version}/bindings/python";
+    gemEnv = buildEnv {
+      name = "notmuch-vim-gems";
+      paths = with ruby.gems; [ mail ];
+      pathsToLink = [ "/lib" "/nix-support" ];
+    };
    tests.version = testers.testVersion { package = notmuch; };
-    inherit version;

    updateScript = gitUpdater {
      url = "https://git.notmuchmail.org/git/notmuch";
@ -155,4 +174,4 @@ stdenv.mkDerivation rec {
    platforms   = platforms.unix;
    mainProgram = "notmuch";
  };
-}
+})
--- a/pkgs/applications/networking/nextdns/default.nix
+++ b/pkgs/applications/networking/nextdns/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "nextdns";
-  version = "1.43.0";
+  version = "1.43.3";

  src = fetchFromGitHub {
    owner = "nextdns";
    repo = "nextdns";
    rev = "v${version}";
-    sha256 = "sha256-5aznAAO53EFeq/fap10ARGerKzQAvLx0zOeG6OWkymw=";
+    sha256 = "sha256-sltTvjEfUZsmXDEyN+Zyck7oqZ+Xu8xScNnitt/0eic=";
  };

  vendorHash = "sha256-U5LJF1RX0ZS0PhjQTZKXrJo89WPfSZaVbgskWcYNlJY=";
--- a/pkgs/applications/radio/fldigi/default.nix
+++ b/pkgs/applications/radio/fldigi/default.nix
@ -18,11 +18,11 @@

 stdenv.mkDerivation rec {
  pname = "fldigi";
-  version = "4.2.04";
+  version = "4.2.05";

  src = fetchurl {
    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
-    hash = "sha256-crVeX9vtvn1O5ah1dc74425qUKcozKlDMVeIefMpktY=";
+    hash = "sha256-rBGJ+63Szhy37LQw0LpE2/lLyP5lwK7hsz/uq453iHY=";
  };

  nativeBuildInputs = [ pkg-config ];
@ -39,6 +39,8 @@ stdenv.mkDerivation rec {
    libsamplerate
  ] ++ lib.optionals (stdenv.isLinux) [ libpulseaudio alsa-lib udev ];

+  env.CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++14";
+
  enableParallelBuilding = true;

  meta = with lib; {
@ -47,8 +49,5 @@ stdenv.mkDerivation rec {
    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ relrod ftrvxmtrx ];
    platforms = platforms.unix;
-    # unable to execute command: posix_spawn failed: Argument list too long
-    # Builds fine on aarch64-darwin
-    broken = stdenv.system == "x86_64-darwin";
  };
 }
--- a/pkgs/applications/science/math/eigenmath/default.nix
+++ b/pkgs/applications/science/math/eigenmath/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "eigenmath";
-  version = "0-unstable-2024-04-26";
+  version = "0-unstable-2024-05-03";

  src = fetchFromGitHub {
    owner = "georgeweigt";
    repo = pname;
-    rev = "14a55ff60d078b752033b4ae29d332b04b6e8912";
-    hash = "sha256-p7wcLmssTqs3LCkZWB9rhCXEc4IVgZJNBvRhS51oH5E=";
+    rev = "69ebfbaa7f328ddc9d97b7c404369818a5febe4a";
+    hash = "sha256-lHxVyUXIY9+YIStA6202Bhy/b0xaxJbW/VPI7FbNJk0=";
  };

  checkPhase = let emulator = stdenv.hostPlatform.emulator buildPackages; in ''
--- a/pkgs/applications/science/math/getdp/default.nix
+++ b/pkgs/applications/science/math/getdp/default.nix
@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
  version = "3.6.0";
  src = fetchurl {
    url = "http://getdp.info/src/getdp-${version}-source.tgz";
-    sha256 = "sha256-N1cb72W77Dr+TzeHpLgv5FuFb+SJqyGcfn+kOfEvZgA=";
+    hash = "sha256-nzefwCV+Z9BHDofuTfhR+vhqm3cCSiUT+7cbtn601N8=";
  };

  inherit (petsc) mpiSupport;
--- a/pkgs/applications/terminal-emulators/blackbox-terminal/default.nix
+++ b/pkgs/applications/terminal-emulators/blackbox-terminal/default.nix
@ -72,6 +72,9 @@ stdenv.mkDerivation rec {
        rev = "3c8f66be867aca6656e4109ce880b6ea7431b895";
        hash = "sha256-vz9ircmPy2Q4fxNnjurkgJtuTSS49rBq/m61p1B43eU=";
      };
+      postPatch = (old.postPatch or "") + ''
+        patchShebangs src/box_drawing_generate.sh
+      '';
    } // lib.optionalAttrs sixelSupport {
      buildInputs = old.buildInputs ++ [ libsixel ];
      mesonFlags = old.mesonFlags ++ [ "-Dsixel=true" ];
--- a/pkgs/applications/version-management/commitizen/default.nix
+++ b/pkgs/applications/version-management/commitizen/default.nix
@ -11,7 +11,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "commitizen";
-  version = "3.24.0";
+  version = "3.25.0";
  format = "pyproject";

  disabled = python3.pythonOlder "3.8";
@ -20,7 +20,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "commitizen-tools";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-kGrXy2V5yFv7MQUKjmE89tRnG+3b73GPVHqGZ3XO0nY=";
+    hash = "sha256-9vaQO0KBL4RgWS8mNSZlnpm1qH+l5TjCa5JndQ1Q36Q=";
  };

  pythonRelaxDeps = [
--- a/pkgs/applications/version-management/git-cliff/default.nix
+++ b/pkgs/applications/version-management/git-cliff/default.nix
@ -32,5 +32,6 @@ rustPlatform.buildRustPackage rec {
    changelog = "https://github.com/orhun/git-cliff/blob/v${version}/CHANGELOG.md";
    license = licenses.gpl3Only;
    maintainers = with maintainers; [ siraben ];
+    mainProgram = "git-cliff";
  };
 }
--- a/pkgs/applications/version-management/git-cola/default.nix
+++ b/pkgs/applications/version-management/git-cola/default.nix
@ -10,14 +10,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "git-cola";
-  version = "4.6.1";
+  version = "4.7.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "git-cola";
    repo = "git-cola";
    rev = "v${version}";
-    hash = "sha256-qAvoBVZt2IwrWFNzGWpCZqj8gbjysGlB/VXaa1CMH4o=";
+    hash = "sha256-BiSs3vWJacCtGthHi/nFJm4Hqt0uO6XXZi/Zqvjb928=";
  };

  buildInputs = lib.optionals stdenv.isLinux [
--- a/pkgs/applications/video/kodi/addons/pvr-hdhomerun/default.nix
+++ b/pkgs/applications/video/kodi/addons/pvr-hdhomerun/default.nix
@ -2,13 +2,13 @@
 buildKodiBinaryAddon rec {
  pname = "pvr-hdhomerun";
  namespace = "pvr.hdhomerun";
-  version = "20.4.0";
+  version = "21.0.1";

  src = fetchFromGitHub {
    owner = "kodi-pvr";
    repo = "pvr.hdhomerun";
    rev = "${version}-${rel}";
-    sha256 = "sha256-FKxoPD8t5JbouhvQtMVMFjk3O5zB9kVgrn0eC2RPDvQ=";
+    sha256 = "sha256-Hb8TcJxRUIKHbevAUgt5q6z26W3uX9NbVwYyvrLnf7U=";
  };

  extraBuildInputs = [ jsoncpp libhdhomerun ];
--- a/pkgs/applications/video/kodi/addons/pvr-vdr-vnsi/default.nix
+++ b/pkgs/applications/video/kodi/addons/pvr-vdr-vnsi/default.nix
@ -2,13 +2,13 @@
 buildKodiBinaryAddon rec {
  pname = "pvr-vdr-vnsi";
  namespace = "pvr.vdr.vnsi";
-  version = "20.4.1";
+  version = "21.1.1";

  src = fetchFromGitHub {
    owner = "kodi-pvr";
    repo = "pvr.vdr.vnsi";
    rev = "${version}-${rel}";
-    sha256 = "sha256-QooWK+LwlN5RAISjAQ2YiyDAjQQMzod8fFXpI0ll+hc=";
+    sha256 = "sha256-Bd/21y3oAhQMmvrZzrN5Z6jLHySBd2LXNbLt/Me4jSw=";
  };

  extraBuildInputs = [ libGL ];
--- a/pkgs/applications/video/mpv/scripts/default.nix
+++ b/pkgs/applications/video/mpv/scripts/default.nix
@ -99,6 +99,7 @@ let
      convert = callPackage ./convert.nix { };
      cutter = callPackage ./cutter.nix { };
      dynamic-crop = callPackage ./dynamic-crop.nix { };
+      evafast = callPackage ./evafast.nix { };
      inhibit-gnome = callPackage ./inhibit-gnome.nix { };
      memo = callPackage ./memo.nix { };
      manga-reader = callPackage ./manga-reader.nix { };
--- a/pkgs/applications/video/mpv/scripts/evafast.nix
+++ b/pkgs/applications/video/mpv/scripts/evafast.nix
@ -0,0 +1,27 @@
+{
+  fetchFromGitHub,
+  buildLua,
+  lib,
+  unstableGitUpdater,
+}:
+
+buildLua {
+  pname = "evafast";
+  version = "0-unstable-2024-02-09";
+
+  src = fetchFromGitHub {
+    owner = "po5";
+    repo = "evafast";
+    rev = "92af3e2e1c756ce83f9d0129c780caeef1131a0b";
+    hash = "sha256-BGWD2XwVu8zOSiDJ+9oWi8aPN2Wkw0Y0gF58X4f+tdI=";
+  };
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = with lib; {
+    description = "Seeking and hybrid fastforwarding like VHS";
+    homepage = "https://github.com/po5/evafast";
+    license = licenses.unfree; # no license; see https://github.com/po5/evafast/issues/15
+    maintainers = with lib.maintainers; [ purrpurrn ];
+  };
+}
--- a/pkgs/applications/video/obs-studio/plugins/obs-mute-filter.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-mute-filter.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "obs-mute-filter";
-  version = "0.2.2";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "norihiro";
    repo = "obs-mute-filter";
    rev = version;
-    sha256 = "sha256-SiutSmp+DnzMU62kxtBUL0xgMXTe0k+nKwSU3wQe4+g=";
+    sha256 = "sha256-UVYN9R7TnwD3a+KIYTXvxOQWfNUtR8cSWUoKZuNoBJc=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/window-managers/sommelier/default.nix
+++ b/pkgs/applications/window-managers/sommelier/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation {
  pname = "sommelier";
-  version = "123.0";
+  version = "124.0";

  src = fetchzip rec {
    url = "https://chromium.googlesource.com/chromiumos/platform2/+archive/${passthru.rev}/vm_tools/sommelier.tar.gz";
-    passthru.rev = "1abc91204f35cde76db37853ff3643c5cdb607e6";
+    passthru.rev = "0ced021a6b362f35592cca5a3915d0ed784615f2";
    stripRoot = false;
-    sha256 = "Wa30MU7iK1Y7pKNeC+FPFXDwDxFLWOZPG4jkm8cnWeg=";
+    sha256 = "zSiGhF4FhLUavC7YEOGGq4NE2hxK4YNXF3CpLptoZbM=";
  };

  nativeBuildInputs = [
--- a/pkgs/build-support/php/build-composer-project.nix
+++ b/pkgs/build-support/php/build-composer-project.nix
@ -1,7 +1,13 @@
-{ callPackage, stdenvNoCC, lib, writeTextDir, php, makeBinaryWrapper, fetchFromGitHub, fetchurl }:
+{
+  callPackage,
+  stdenvNoCC,
+  lib,
+  php,
+}:

 let
-  buildComposerProjectOverride = finalAttrs: previousAttrs:
+  buildComposerProjectOverride =
+    finalAttrs: previousAttrs:

    let
      phpDrv = finalAttrs.php or php;
@ -22,61 +28,73 @@ let
        phpDrv.composerHooks.composerInstallHook
      ];

-      buildInputs = (previousAttrs.buildInputs or [ ]) ++ [
-        phpDrv
-      ];
+      buildInputs = (previousAttrs.buildInputs or [ ]) ++ [ phpDrv ];

      patches = previousAttrs.patches or [ ];
      strictDeps = previousAttrs.strictDeps or true;

      # Should we keep these empty phases?
-      configurePhase = previousAttrs.configurePhase or ''
-        runHook preConfigure
+      configurePhase =
+        previousAttrs.configurePhase or ''
+          runHook preConfigure

-        runHook postConfigure
-      '';
+          runHook postConfigure
+        '';

-      buildPhase = previousAttrs.buildPhase or ''
-        runHook preBuild
+      buildPhase =
+        previousAttrs.buildPhase or ''
+          runHook preBuild

-        runHook postBuild
-      '';
+          runHook postBuild
+        '';

      doCheck = previousAttrs.doCheck or true;
-      checkPhase = previousAttrs.checkPhase or ''
-        runHook preCheck
+      checkPhase =
+        previousAttrs.checkPhase or ''
+          runHook preCheck

-        runHook postCheck
-      '';
+          runHook postCheck
+        '';

-      installPhase = previousAttrs.installPhase or ''
-        runHook preInstall
+      installPhase =
+        previousAttrs.installPhase or ''
+          runHook preInstall

-        runHook postInstall
-      '';
+          runHook postInstall
+        '';

      doInstallCheck = previousAttrs.doInstallCheck or false;
-      installCheckPhase = previousAttrs.installCheckPhase or ''
-        runHook preInstallCheck
+      installCheckPhase =
+        previousAttrs.installCheckPhase or ''
+          runHook preInstallCheck

-        runHook postInstallCheck
-      '';
+          runHook postInstallCheck
+        '';

-      composerRepository = phpDrv.mkComposerRepository {
-        inherit composer composer-local-repo-plugin;
-        inherit (finalAttrs) patches pname src vendorHash version;
+      composerRepository =
+        previousAttrs.composerRepository or (phpDrv.mkComposerRepository {
+          inherit composer composer-local-repo-plugin;
+          inherit (finalAttrs)
+            patches
+            pname
+            src
+            vendorHash
+            version
+            ;

-        composerLock = previousAttrs.composerLock or null;
-        composerNoDev = previousAttrs.composerNoDev or true;
-        composerNoPlugins = previousAttrs.composerNoPlugins or true;
-        composerNoScripts = previousAttrs.composerNoScripts or true;
-        composerStrictValidation = previousAttrs.composerStrictValidation or true;
+          composerLock = previousAttrs.composerLock or null;
+          composerNoDev = previousAttrs.composerNoDev or true;
+          composerNoPlugins = previousAttrs.composerNoPlugins or true;
+          composerNoScripts = previousAttrs.composerNoScripts or true;
+          composerStrictValidation = previousAttrs.composerStrictValidation or true;
+        });
+
+      env = {
+        COMPOSER_CACHE_DIR = "/dev/null";
+        COMPOSER_DISABLE_NETWORK = "1";
+        COMPOSER_MIRROR_PATH_REPOS = "1";
      };

-      COMPOSER_CACHE_DIR="/dev/null";
-      COMPOSER_DISABLE_NETWORK="1";
-      COMPOSER_MIRROR_PATH_REPOS="1";
-
      meta = previousAttrs.meta or { } // {
        platforms = lib.platforms.all;
      };
--- a/pkgs/build-support/php/build-composer-repository.nix
+++ b/pkgs/build-support/php/build-composer-repository.nix
@ -1,4 +1,9 @@
-{ callPackage, stdenvNoCC, lib, writeTextDir, fetchFromGitHub, php }:
+{
+  callPackage,
+  stdenvNoCC,
+  lib,
+  php,
+}:

 let
  mkComposerRepositoryOverride =
@ -22,12 +27,24 @@ let
      composer-local-repo-plugin = callPackage ./pkgs/composer-local-repo-plugin.nix { };
    in
    assert (lib.assertMsg (previousAttrs ? src) "mkComposerRepository expects src argument.");
-    assert (lib.assertMsg (previousAttrs ? vendorHash) "mkComposerRepository expects vendorHash argument.");
+    assert (
+      lib.assertMsg (previousAttrs ? vendorHash) "mkComposerRepository expects vendorHash argument."
+    );
    assert (lib.assertMsg (previousAttrs ? version) "mkComposerRepository expects version argument.");
    assert (lib.assertMsg (previousAttrs ? pname) "mkComposerRepository expects pname argument.");
-    assert (lib.assertMsg (previousAttrs ? composerNoDev) "mkComposerRepository expects composerNoDev argument.");
-    assert (lib.assertMsg (previousAttrs ? composerNoPlugins) "mkComposerRepository expects composerNoPlugins argument.");
-    assert (lib.assertMsg (previousAttrs ? composerNoScripts) "mkComposerRepository expects composerNoScripts argument.");
+    assert (
+      lib.assertMsg (previousAttrs ? composerNoDev) "mkComposerRepository expects composerNoDev argument."
+    );
+    assert (
+      lib.assertMsg (
+        previousAttrs ? composerNoPlugins
+      ) "mkComposerRepository expects composerNoPlugins argument."
+    );
+    assert (
+      lib.assertMsg (
+        previousAttrs ? composerNoScripts
+      ) "mkComposerRepository expects composerNoScripts argument."
+    );
    {
      composerNoDev = previousAttrs.composerNoDev or true;
      composerNoPlugins = previousAttrs.composerNoPlugins or true;
@ -51,45 +68,53 @@ let
      strictDeps = previousAttrs.strictDeps or true;

      # Should we keep these empty phases?
-      configurePhase = previousAttrs.configurePhase or ''
-        runHook preConfigure
+      configurePhase =
+        previousAttrs.configurePhase or ''
+          runHook preConfigure

-        runHook postConfigure
-      '';
+          runHook postConfigure
+        '';

-      buildPhase = previousAttrs.buildPhase or ''
-        runHook preBuild
+      buildPhase =
+        previousAttrs.buildPhase or ''
+          runHook preBuild

-        runHook postBuild
-      '';
+          runHook postBuild
+        '';

      doCheck = previousAttrs.doCheck or true;
-      checkPhase = previousAttrs.checkPhase or ''
-        runHook preCheck
+      checkPhase =
+        previousAttrs.checkPhase or ''
+          runHook preCheck

-        runHook postCheck
-      '';
+          runHook postCheck
+        '';

-      installPhase = previousAttrs.installPhase or ''
-        runHook preInstall
+      installPhase =
+        previousAttrs.installPhase or ''
+          runHook preInstall

-        runHook postInstall
-      '';
+          runHook postInstall
+        '';

      doInstallCheck = previousAttrs.doInstallCheck or false;
-      installCheckPhase = previousAttrs.installCheckPhase or ''
-        runHook preInstallCheck
+      installCheckPhase =
+        previousAttrs.installCheckPhase or ''
+          runHook preInstallCheck

-        runHook postInstallCheck
-      '';
+          runHook postInstallCheck
+        '';

-      COMPOSER_CACHE_DIR = "/dev/null";
-      COMPOSER_MIRROR_PATH_REPOS = "1";
-      COMPOSER_HTACCESS_PROTECT = "0";
-      COMPOSER_DISABLE_NETWORK = "0";
+      env = {
+        COMPOSER_CACHE_DIR = "/dev/null";
+        COMPOSER_MIRROR_PATH_REPOS = "1";
+        COMPOSER_HTACCESS_PROTECT = "0";
+        COMPOSER_DISABLE_NETWORK = "0";
+      };

      outputHashMode = "recursive";
-      outputHashAlgo = if (finalAttrs ? vendorHash && finalAttrs.vendorHash != "") then null else "sha256";
+      outputHashAlgo =
+        if (finalAttrs ? vendorHash && finalAttrs.vendorHash != "") then null else "sha256";
      outputHash = finalAttrs.vendorHash or "";
    };
 in
--- a/pkgs/build-support/php/build-pecl.nix
+++ b/pkgs/build-support/php/build-pecl.nix
@ -1,45 +1,69 @@
-{ stdenv, lib, php, autoreconfHook, fetchurl, re2c, nix-update-script }:
+{
+  stdenv,
+  lib,
+  php,
+  autoreconfHook,
+  fetchurl,
+  re2c,
+  nix-update-script,
+}:

-{ pname
-, version
-, internalDeps ? [ ]
-, peclDeps ? [ ]
-, buildInputs ? [ ]
-, nativeBuildInputs ? [ ]
-, postPhpize ? ""
-, makeFlags ? [ ]
-, src ? fetchurl ({
-    url = "https://pecl.php.net/get/${pname}-${version}.tgz";
-  } // lib.filterAttrs (attrName: _: lib.elem attrName [ "sha256" "hash" ]) args)
-, passthru ? { }
-, ...
+{
+  pname,
+  version,
+  internalDeps ? [ ],
+  peclDeps ? [ ],
+  buildInputs ? [ ],
+  nativeBuildInputs ? [ ],
+  postPhpize ? "",
+  makeFlags ? [ ],
+  src ? fetchurl (
+    {
+      url = "https://pecl.php.net/get/${pname}-${version}.tgz";
+    }
+    // lib.filterAttrs (
+      attrName: _:
+      lib.elem attrName [
+        "sha256"
+        "hash"
+      ]
+    ) args
+  ),
+  passthru ? { },
+  ...
 }@args:

-stdenv.mkDerivation (args // {
-  name = "php-${pname}-${version}";
-  extensionName = pname;
+stdenv.mkDerivation (
+  args
+  // {
+    name = "php-${pname}-${version}";
+    extensionName = pname;

-  inherit src;
+    inherit src;

-  nativeBuildInputs = [ autoreconfHook re2c ] ++ nativeBuildInputs;
-  buildInputs = [ php ] ++ peclDeps ++ buildInputs;
+    nativeBuildInputs = [
+      autoreconfHook
+      re2c
+    ] ++ nativeBuildInputs;
+    buildInputs = [ php ] ++ peclDeps ++ buildInputs;

-  makeFlags = [ "EXTENSION_DIR=$(out)/lib/php/extensions" ] ++ makeFlags;
+    makeFlags = [ "EXTENSION_DIR=$(out)/lib/php/extensions" ] ++ makeFlags;

-  autoreconfPhase = ''
-    phpize
-    ${postPhpize}
-    ${lib.concatMapStringsSep "\n"
-      (dep: "mkdir -p ext; ln -s ${dep.dev}/include ext/${dep.extensionName}")
-      internalDeps}
-  '';
-  checkPhase = "NO_INTERACTON=yes make test";
+    autoreconfPhase = ''
+      phpize
+      ${postPhpize}
+      ${lib.concatMapStringsSep "\n" (
+        dep: "mkdir -p ext; ln -s ${dep.dev}/include ext/${dep.extensionName}"
+      ) internalDeps}
+    '';
+    checkPhase = "NO_INTERACTON=yes make test";

-  passthru = passthru // {
-    # Thes flags were introduced for `nix-update` so that it can update
-    # PHP extensions correctly.
-    # See the corresponding PR: https://github.com/Mic92/nix-update/pull/123
-    isPhpExtension = true;
-    updateScript = nix-update-script {};
-  };
-})
+    passthru = passthru // {
+      # Thes flags were introduced for `nix-update` so that it can update
+      # PHP extensions correctly.
+      # See the corresponding PR: https://github.com/Mic92/nix-update/pull/123
+      isPhpExtension = true;
+      updateScript = nix-update-script { };
+    };
+  }
+)
--- a/pkgs/build-support/php/hooks/default.nix
+++ b/pkgs/build-support/php/hooks/default.nix
@ -1,11 +1,11 @@
-{ lib
-, makeSetupHook
-, diffutils
-, jq
-, writeShellApplication
-, moreutils
-, cacert
-, buildPackages
+{
+  lib,
+  makeSetupHook,
+  jq,
+  writeShellApplication,
+  moreutils,
+  cacert,
+  buildPackages,
 }:

 let
@ -16,24 +16,30 @@ let
  };
 in
 {
-  composerRepositoryHook = makeSetupHook
-    {
-      name = "composer-repository-hook.sh";
-      propagatedBuildInputs = [ jq moreutils cacert ];
-      substitutions = {
-        phpScriptUtils = lib.getExe php-script-utils;
-      };
-    } ./composer-repository-hook.sh;
+  composerRepositoryHook = makeSetupHook {
+    name = "composer-repository-hook.sh";
+    propagatedBuildInputs = [
+      jq
+      moreutils
+      cacert
+    ];
+    substitutions = {
+      phpScriptUtils = lib.getExe php-script-utils;
+    };
+  } ./composer-repository-hook.sh;

-  composerInstallHook = makeSetupHook
-    {
-      name = "composer-install-hook.sh";
-      propagatedBuildInputs = [ jq moreutils cacert ];
-      substitutions = {
-        # Specify the stdenv's `diff` by abspath to ensure that the user's build
-        # inputs do not cause us to find the wrong `diff`.
-        cmp = "${lib.getBin buildPackages.diffutils}/bin/cmp";
-        phpScriptUtils = lib.getExe php-script-utils;
-      };
-    } ./composer-install-hook.sh;
+  composerInstallHook = makeSetupHook {
+    name = "composer-install-hook.sh";
+    propagatedBuildInputs = [
+      jq
+      moreutils
+      cacert
+    ];
+    substitutions = {
+      # Specify the stdenv's `diff` by abspath to ensure that the user's build
+      # inputs do not cause us to find the wrong `diff`.
+      cmp = "${lib.getBin buildPackages.diffutils}/bin/cmp";
+      phpScriptUtils = lib.getExe php-script-utils;
+    };
+  } ./composer-install-hook.sh;
 }
--- a/pkgs/build-support/php/pkgs/composer-local-repo-plugin.nix
+++ b/pkgs/build-support/php/pkgs/composer-local-repo-plugin.nix
@ -1,9 +1,14 @@
-{ php, callPackage, stdenvNoCC, lib, fetchFromGitHub, makeBinaryWrapper }:
+{
+  php,
+  callPackage,
+  stdenvNoCC,
+  lib,
+  fetchFromGitHub,
+  makeBinaryWrapper,
+}:

 let
-  composer = callPackage ./composer-phar.nix {
-    inherit (php.packages.composer) version pharHash;
-  };
+  composer = callPackage ./composer-phar.nix { inherit (php.packages.composer) version pharHash; };

  composerKeys = stdenvNoCC.mkDerivation (finalComposerKeysAttrs: {
    pname = "composer-keys";
@ -38,18 +43,16 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    hash = "sha256-edbn07r/Uc1g0qOuVBZBs6N1bMN5kIfA1b4FCufdw5M=";
  };

-  COMPOSER_CACHE_DIR = "/dev/null";
-  COMPOSER_MIRROR_PATH_REPOS = "1";
-  COMPOSER_HTACCESS_PROTECT = "0";
-  COMPOSER_DISABLE_NETWORK = "1";
+  env = {
+    COMPOSER_CACHE_DIR = "/dev/null";
+    COMPOSER_MIRROR_PATH_REPOS = "1";
+    COMPOSER_HTACCESS_PROTECT = "0";
+    COMPOSER_DISABLE_NETWORK = "1";
+  };

-  nativeBuildInputs = [
-    makeBinaryWrapper
-  ];
+  nativeBuildInputs = [ makeBinaryWrapper ];

-  buildInputs = [
-    composer
-  ];
+  buildInputs = [ composer ];

  configurePhase = ''
    runHook preConfigure
--- a/pkgs/build-support/php/pkgs/composer-phar.nix
+++ b/pkgs/build-support/php/pkgs/composer-phar.nix
@ -1,17 +1,17 @@
 {
-  _7zz
-  , cacert
-  , curl
-  , fetchurl
-  , git
-  , lib
-  , makeBinaryWrapper
-  , php
-  , stdenvNoCC
-  , unzip
-  , xz
-  , version
-  , pharHash
+  _7zz,
+  cacert,
+  curl,
+  fetchurl,
+  git,
+  lib,
+  makeBinaryWrapper,
+  php,
+  stdenvNoCC,
+  unzip,
+  xz,
+  version,
+  pharHash,
 }:

 stdenvNoCC.mkDerivation (finalAttrs: {
@ -32,9 +32,18 @@ stdenvNoCC.mkDerivation (finalAttrs: {

    mkdir -p $out/bin
    install -D $src $out/libexec/composer/composer.phar
-    makeWrapper ${php}/bin/php $out/bin/composer \
+    makeWrapper ${lib.getExe php} $out/bin/composer \
      --add-flags "$out/libexec/composer/composer.phar" \
-      --prefix PATH : ${lib.makeBinPath [ _7zz cacert curl git unzip xz ]}
+      --prefix PATH : ${
+        lib.makeBinPath [
+          _7zz
+          cacert
+          curl
+          git
+          unzip
+          xz
+        ]
+      }

    runHook postInstall
  '';
@ -44,6 +53,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    description = "Dependency Manager for PHP, shipped from the PHAR file";
    homepage = "https://getcomposer.org/";
    license = lib.licenses.mit;
+    mainProgram = "composer";
    maintainers = with lib.maintainers; [ drupol ];
    platforms = lib.platforms.all;
  };
--- a/pkgs/by-name/an/ansel/package.nix
+++ b/pkgs/by-name/an/ansel/package.nix
@ -77,7 +77,7 @@ let
 in
 stdenv.mkDerivation {
  pname = "ansel";
-  version = "unstable-2024-02-23";
+  version = "0-unstable-2024-02-23";

  src = fetchFromGitHub {
    owner = "aurelienpierreeng";
@ -160,7 +160,10 @@ stdenv.mkDerivation {
    )
  '';

-  passthru.updateScript = unstableGitUpdater { };
+  passthru.updateScript = unstableGitUpdater {
+    # Tags inherited from Darktable, + a "nightly" 0.0.0 tag that new artefacts get attached to
+    hardcodeZeroVersion = true;
+  };

  meta = {
    description = "A darktable fork minus the bloat plus some design vision";
--- a/pkgs/by-name/bl/bluez-tools/package.nix
+++ b/pkgs/by-name/bl/bluez-tools/package.nix
@ -10,7 +10,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bluez-tools";
-  version = "unstable-2020-10-25";
+  version = "0-unstable-2020-10-24";

  src = fetchFromGitHub {
    owner = "khvzak";
--- a/pkgs/by-name/br/bruno/package.nix
+++ b/pkgs/by-name/br/bruno/package.nix
@ -27,13 +27,13 @@ let
 in
 buildNpmPackage' rec {
  pname = "bruno";
-  version = "1.16.0";
+  version = "1.16.1";

  src = fetchFromGitHub {
    owner = "usebruno";
    repo = "bruno";
    rev = "v${version}";
-    hash = "sha256-nhs44W7cOREdULdXFNZpFGeeZeVTGUffKOBhtL4zAaw=";
+    hash = "sha256-rP3PHS6kuJCgbCQy4h+bJksmJAJvHDBMSysLM5FxQjk=";

    postFetch = ''
      ${lib.getExe npm-lockfile-fix} $out/package-lock.json
--- a/pkgs/development/tools/darklua/default.nix
+++ b/pkgs/development/tools/darklua/default.nix
@ -1,8 +1,9 @@
-{ lib
-, stdenv
-, darwin
-, rustPlatform
-, fetchFromGitHub
+{
+  lib,
+  stdenv,
+  darwin,
+  rustPlatform,
+  fetchFromGitHub,
 }:

 rustPlatform.buildRustPackage rec {
@ -18,10 +19,7 @@ rustPlatform.buildRustPackage rec {

  cargoHash = "sha256-XrWhOosQM+BaqViIju7urCi1B8+6kq8Taxe5T8LFzVE=";

-  buildInputs = lib.optionals stdenv.isDarwin [
-    darwin.apple_sdk.frameworks.CoreServices
-  ];
-
+  buildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.CoreServices ];

  # error: linker `aarch64-linux-gnu-gcc` not found
  postPatch = ''
--- a/pkgs/by-name/do/docfd/package.nix
+++ b/pkgs/by-name/do/docfd/package.nix
@ -1,15 +1,16 @@
-{ lib
-, ocamlPackages
-, stdenv
-, overrideSDK
-, fetchFromGitHub
-, python3
-, dune_3
-, makeWrapper
-, pandoc
-, poppler_utils
-, testers
-, docfd
+{
+  lib,
+  ocamlPackages,
+  stdenv,
+  overrideSDK,
+  fetchFromGitHub,
+  python3,
+  dune_3,
+  makeWrapper,
+  pandoc,
+  poppler_utils,
+  testers,
+  docfd,
 }:

 let
@ -20,7 +21,7 @@ let
 in
 buildDunePackage' rec {
  pname = "docfd";
-  version = "4.0.0";
+  version = "5.1.0";

  minimalOCamlVersion = "5.1";

@ -28,10 +29,15 @@ buildDunePackage' rec {
    owner = "darrenldl";
    repo = "docfd";
    rev = version;
-    hash = "sha256-fgwUXRZ6k5i3XLxXpjbrl0TJZMT+NkGXf7KNwRgi+q8=";
+    hash = "sha256-54gsX5C8AJAOkqnBxHLI76k6cEqWqEydxbZjJZl7FjE=";
  };

-  nativeBuildInputs = [ python3 dune_3 makeWrapper ];
+  nativeBuildInputs = [
+    python3
+    dune_3
+    makeWrapper
+  ];
+
  buildInputs = with ocamlPackages; [
    cmdliner
    containers-data
@ -43,18 +49,24 @@ buildDunePackage' rec {
    notty
    ocolor
    oseq
+    ppx_deriving
+    ppxlib
+    re
    spelll
    timedesc
    yojson
  ];

  postInstall = ''
-    wrapProgram $out/bin/docfd --prefix PATH : "${lib.makeBinPath [ pandoc poppler_utils ]}"
+    wrapProgram $out/bin/docfd --prefix PATH : "${
+      lib.makeBinPath [
+        pandoc
+        poppler_utils
+      ]
+    }"
  '';

-  passthru.tests.version = testers.testVersion {
-    package = docfd;
-  };
+  passthru.tests.version = testers.testVersion { package = docfd; };

  meta = with lib; {
    description = "TUI multiline fuzzy document finder";
--- a/pkgs/by-name/ea/earlyoom/package.nix
+++ b/pkgs/by-name/ea/earlyoom/package.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "earlyoom";
-  version = "1.8";
+  version = "1.8.1";

  src = fetchFromGitHub {
    owner = "rfjakob";
    repo = "earlyoom";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-jgNoYOGor2i3ngDuU3It238n5ky+AppzlRKdkwXb2AI=";
+    hash = "sha256-7gVwR/D3HEMv2sRXYe/B2aluxncDkMGyiBklwAJkWjk=";
  };

  outputs = [ "out" ] ++ lib.optionals withManpage [ "man" ];
--- a/pkgs/by-name/fw/fwupd/package.nix
+++ b/pkgs/by-name/fw/fwupd/package.nix
@ -92,7 +92,7 @@ let

  test-firmware =
    let
-      version = "unstable-2022-04-02";
+      version = "0-unstable-2022-04-02";
      src = fetchFromGitHub {
        name = "fwupd-test-firmware-${version}";
        owner = "fwupd";
--- a/pkgs/by-name/gi/gickup/package.nix
+++ b/pkgs/by-name/gi/gickup/package.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "gickup";
-  version = "0.10.29";
+  version = "0.10.30";

  src = fetchFromGitHub {
    owner = "cooperspencer";
    repo = "gickup";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Y03SdmO/GJx1gans58IW/Q9N7spRswvjyNbzYLdkD80=";
+    hash = "sha256-knnc4FAzGk1hV/Pzoc+klm4dt1cFrn4BYZx1lY7iLp8=";
  };

  vendorHash = "sha256-XxDsEmi945CduurQRsH7rjFAEu/SMX3rSd63Dwq2r8A=";
--- a/pkgs/by-name/go/godns/package.nix
+++ b/pkgs/by-name/go/godns/package.nix
@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "godns";
-  version = "3.1.5";
+  version = "3.1.6";

  src = fetchFromGitHub {
    owner = "TimothyYe";
    repo = "godns";
    rev = "refs/tags/v${version}";
-    hash = "sha256-kdClyeU0hR0ymVLn9xe/kYVJE/9P/hAz/5UwRAQ2KCU=";
+    hash = "sha256-Kr+zMmjpHR2JtCaDyLMcQwOUXlPJeisu94zHRpEYV/I=";
  };

-  vendorHash = "sha256-kSREFNIGH0MXiyKMp1LmrLkhKBhovvNRz46LTXT2XME=";
+  vendorHash = "sha256-E15h5p4ppRb91EUoz5dyWNFl745rt419NMCSurMLxis=";
  npmDeps = fetchNpmDeps {
    src = "${src}/web";
    hash = "sha256-2yeqLly0guU/kpX+yH/QOoDGzyJTxkTaCt8EleJhybU=";
--- a/pkgs/by-name/gr/grafana-kiosk/package.nix
+++ b/pkgs/by-name/gr/grafana-kiosk/package.nix
@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, chromium, makeWrapper }:

 buildGoModule rec {
  pname = "grafana-kiosk";
@ -13,6 +13,11 @@ buildGoModule rec {

  vendorHash = "sha256-sXaxyPNuHDUOkYcWYm94YvJmr1mGe4HdzttWrNSK2Pw=";

+  nativeBuildInputs = [ makeWrapper ];
+  postFixup = ''
+    wrapProgram $out/bin/grafana-kiosk --prefix PATH : ${lib.makeBinPath [ chromium ]}
+  '';
+
  meta = with lib; {
    description = "Kiosk Utility for Grafana";
    homepage = "https://github.com/grafana/grafana-kiosk";
--- a/pkgs/development/tools/hatch/default.nix
+++ b/pkgs/development/tools/hatch/default.nix
@ -8,14 +8,19 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "hatch";
-  version = "1.9.0";
+  version = "1.9.7";
  format = "pyproject";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-4ealEeFS7HzU26vE9Pahh0hwvUnJfRfTkLkjLdpoXOM=";
+    hash = "sha256-Gae4IXn5Tyrd2612qn5lq5DK1VqxA9U4J2N5NcnmYkw=";
  };

+  postPatch = ''
+    # Loosen hatchling runtime version dependency
+    sed -i 's/hatchling<1.22/hatchling/' pyproject.toml
+  '';
+
  nativeBuildInputs = with python3.pkgs; [
    hatchling
    hatch-vcs
@ -69,19 +74,13 @@ python3.pkgs.buildPythonApplication rec {
    "test_editable_exact_force_include_option"
    "test_editable_exact_force_include_build_data_precedence"
    "test_editable_pth"
-    # AssertionError: assert len(extract_installed_requirements(output.splitlines())) > 0
-    "test_creation_allow_system_packages"
-    # cli table output mismatch
-    "test_context_formatting"
    # expects sh, finds bash
    "test_all"
    "test_already_installed_update_flag"
    "test_already_installed_update_prompt"
-    # unmet expectations about the binary module we provide
-    "test_dependency_not_found"
-    "test_marker_unmet"
-    # output capturing mismatch, likely stdout/stderr mixup
-    "test_no_compatibility_check_if_exists"
+    # Loosen hatchling runtime version dependency
+    "test_core"
+    "test_correct"
  ] ++ lib.optionals stdenv.isDarwin [
    # https://github.com/NixOS/nixpkgs/issues/209358
    "test_scripts_no_environment"
@ -90,6 +89,8 @@ python3.pkgs.buildPythonApplication rec {
    # It is not possible to run it in a nix build using a /nix/store shell.
    # See https://github.com/pypa/hatch/pull/709 for the relevant code.
    "test_populate_default_popen_kwargs_executable"
+  ] ++ lib.optionals stdenv.isAarch64 [
+    "test_resolve"
  ];

  meta = with lib; {
--- a/pkgs/by-name/ko/kotlin-interactive-shell/package.nix
+++ b/pkgs/by-name/ko/kotlin-interactive-shell/package.nix
@ -0,0 +1,45 @@
+{ lib, maven, fetchFromGitHub, makeWrapper, jre }:
+
+maven.buildMavenPackage rec {
+  pname = "kotlin-interactive-shell";
+  version = "0.5.2";
+
+  src = fetchFromGitHub {
+    owner = "Kotlin";
+    repo = "kotlin-interactive-shell";
+    rev = "v${version}";
+    hash = "sha256-3DTyo7rPswpEVzFkcprT6FD+ITGJ+qCXFKXEGoCK+oE=";
+  };
+
+  mvnHash = "sha256-m1o0m0foqJhEzWjC9behBeld5HT08WClcZN2xc3fZrI=";
+  mvnParameters = "-DskipTests compile";
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{bin,lib}
+    cp lib/ki-shell.jar $out/lib/ki-shell.jar
+    makeWrapper ${lib.getExe jre} $out/bin/ki \
+      --add-flags "-jar $out/lib/ki-shell.jar"
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Kotlin Language Interactive Shell";
+    longDescription = ''
+      The shell is an extensible implementation of Kotlin REPL with a rich set of features including:
+      - Syntax highlight
+      - Type inference command
+      - Downloading dependencies in runtime using Maven coordinates
+      - List declared symbols
+    '';
+    homepage = "https://github.com/Kotlin/kotlin-interactive-shell";
+    license = licenses.asl20;
+    maintainers = [ maintainers.starsep ];
+    platforms = jre.meta.platforms;
+    mainProgram = "ki";
+  };
+}
--- a/pkgs/by-name/la/labelle/package.nix
+++ b/pkgs/by-name/la/labelle/package.nix
@ -8,14 +8,14 @@
 }:
 python3Packages.buildPythonApplication rec {
  pname = "labelle";
-  version = "1.2.0";
+  version = "1.2.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "labelle-org";
    repo = "labelle";
-    rev = "v${version}";
-    hash = "sha256-fLlYqJs/V5t8IdfVkfBsjtjM1rRdCyTYF87G+h1VU5Y=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-Im1mZ9kJB+0uPAmEXpUWoOYBooejes05vTGLDqPCAN4=";
  };

  postPatch = ''
--- a/pkgs/by-name/la/labwc-gtktheme/package.nix
+++ b/pkgs/by-name/la/labwc-gtktheme/package.nix
@ -9,7 +9,7 @@

 python3Packages.buildPythonApplication rec {
  pname = "labwc-gtktheme";
-  version = "unstable-2022-07-17";
+  version = "0-unstable-2022-07-17";
  pyproject = false;

  src = fetchFromGitHub {
--- a/pkgs/by-name/la/labwc-menu-generator/package.nix
+++ b/pkgs/by-name/la/labwc-menu-generator/package.nix
@ -9,7 +9,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "labwc-menu-generator";
-  version = "unstable-2024-03-27";
+  version = "0-unstable-2024-03-27";

  src = fetchFromGitHub {
    owner = "labwc";
--- a/pkgs/by-name/le/lexical/package.nix
+++ b/pkgs/by-name/le/lexical/package.nix
@ -7,13 +7,13 @@

 beamPackages.mixRelease rec {
  pname = "lexical";
-  version = "0.6.0";
+  version = "0.6.1";

  src = fetchFromGitHub {
    owner = "lexical-lsp";
    repo = "lexical";
    rev = "refs/tags/v${version}";
-    hash = "sha256-20qfzYioR1PhA0ZBcft0nhcwxB95pw5L9zoPLWd7ZIE=";
+    hash = "sha256-gDiNjtYeEGoYoyoNmPh73EuYCvY36y9lUyLasbFrFgs=";
  };

  mixFodDeps = beamPackages.fetchMixDeps {
--- a/pkgs/by-name/li/libmamba/package.nix
+++ b/pkgs/by-name/li/libmamba/package.nix
@ -19,12 +19,12 @@
 }:
 stdenv.mkDerivation rec {
  pname = "libmamba";
-  version = "1.5.7";
+  version = "1.5.8";
  src = fetchFromGitHub {
    owner = "mamba-org";
    repo = "mamba";
    rev = "${pname}-${version}";
-    hash = "sha256-HfmvLi9IBWlaGAn2Ej4Bnm4b3l19jEXwNl5IUkdVxi0=";
+    hash = "sha256-sxZDlMFoMLq2EAzwBVO++xvU1C30JoIoZXEX/sqkXS0=";
  };
  nativeBuildInputs = [
    cmake
--- a/pkgs/by-name/li/libui-ng/package.nix
+++ b/pkgs/by-name/li/libui-ng/package.nix
@ -12,7 +12,7 @@

 stdenv.mkDerivation rec {
  pname = "libui-ng";
-  version = "unstable-2024-02-05";
+  version = "4.1-unstable-2024-02-05";

  src = fetchFromGitHub {
    owner = "libui-ng";
@ -47,7 +47,9 @@ stdenv.mkDerivation rec {
    (lib.mesonBool "examples" (!stdenv.isDarwin))
  ];

-  passthru.updateScript = unstableGitUpdater { };
+  passthru.updateScript = unstableGitUpdater {
+    tagPrefix = "alpha";
+  };

  meta = with lib; {
    description = "A portable GUI library for C";
--- a/pkgs/by-name/lo/louvain-community/package.nix
+++ b/pkgs/by-name/lo/louvain-community/package.nix
@ -7,7 +7,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "louvain-community";
-  version = "unstable-2024-01-30";
+  version = "0-unstable-2024-01-30";

  src = fetchFromGitHub {
    owner = "meelgroup";
--- a/pkgs/by-name/ni/nitter/package.nix
+++ b/pkgs/by-name/ni/nitter/package.nix
@ -8,7 +8,7 @@

 buildNimPackage (finalAttrs: prevAttrs: {
  pname = "nitter";
-  version = "unstable-2024-02-26";
+  version = "0-unstable-2024-02-26";

  src = fetchFromGitHub {
    owner = "zedeus";
--- a/pkgs/by-name/ni/nix-search-cli/package.nix
+++ b/pkgs/by-name/ni/nix-search-cli/package.nix
@ -6,7 +6,7 @@

 buildGoModule {
  pname = "nix-search-cli";
-  version = "unstable-2023-09-12";
+  version = "0-unstable-2023-09-12";

  src = fetchFromGitHub {
    owner = "peterldowns";
@ -17,7 +17,11 @@ buildGoModule {

  vendorHash = "sha256-JDOu7YdX9ztMZt0EFAMz++gD7n+Mn1VOe5g6XwrgS5M=";

-  passthru.updateScript = unstableGitUpdater { };
+  passthru.updateScript = unstableGitUpdater {
+    # Almost every commit is tagged as "release-<unix-time>-<commit>", software doesn't keep track of its version
+    # Using 0 feels closer to what the tagging is trying to express
+    hardcodeZeroVersion = true;
+  };

  meta = with lib; {
    description = "CLI for searching packages on search.nixos.org";
--- a/pkgs/by-name/pp/ppsspp/package.nix
+++ b/pkgs/by-name/pp/ppsspp/package.nix
@ -1,25 +1,29 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, SDL2
-, cmake
-, copyDesktopItems
-, ffmpeg_4
-, glew
-, libffi
-, libsForQt5
-, libzip
-, makeDesktopItem
-, makeWrapper
-, pkg-config
-, python3
-, snappy
-, vulkan-loader
-, wayland
-, zlib
-, enableQt ? false
-, enableVulkan ? true
-, forceWayland ? false
+{
+  lib,
+  SDL2,
+  cmake,
+  copyDesktopItems,
+  fetchFromGitHub,
+  ffmpeg,
+  glew,
+  libffi,
+  libsForQt5,
+  libzip,
+  makeDesktopItem,
+  makeWrapper,
+  pkg-config,
+  python3,
+  snappy,
+  stdenv,
+  vulkan-loader,
+  wayland,
+  zlib,
+
+  enableQt ? false,
+  enableVulkan ? true,
+  forceWayland ? false,
+  useSystemFfmpeg? false,
+  useSystemSnappy? true,
 }:

 let
@ -55,26 +59,33 @@ stdenv.mkDerivation (finalAttrs: {
    makeWrapper
    pkg-config
    python3
-  ] ++ lib.optionals enableQt [ wrapQtAppsHook ];
+  ]
+  ++ lib.optionals enableQt [ wrapQtAppsHook ];

  buildInputs = [
    SDL2
-    ffmpeg_4
-    (glew.override { enableEGL = forceWayland; })
+    glew
    libzip
-    snappy
    zlib
-  ] ++ lib.optionals enableQt [
+  ]
+  ++ lib.optionals useSystemFfmpeg [
+    ffmpeg
+  ]
+  ++ lib.optionals useSystemSnappy [
+    snappy
+  ]
+  ++ lib.optionals enableQt [
    qtbase
    qtmultimedia
-  ] ++ lib.optionals enableVulkan [ vulkan-loader ]
+  ]
+  ++ lib.optionals enableVulkan [ vulkan-loader ]
  ++ lib.optionals vulkanWayland [ wayland libffi ];

  cmakeFlags = [
    (lib.cmakeBool "HEADLESS" (!enableQt))
-    (lib.cmakeBool "USE_SYSTEM_FFMPEG" true)
+    (lib.cmakeBool "USE_SYSTEM_FFMPEG" useSystemFfmpeg)
    (lib.cmakeBool "USE_SYSTEM_LIBZIP" true)
-    (lib.cmakeBool "USE_SYSTEM_SNAPPY" true)
+    (lib.cmakeBool "USE_SYSTEM_SNAPPY" useSystemSnappy)
    (lib.cmakeBool "USE_WAYLAND_WSI" vulkanWayland)
    (lib.cmakeBool "USING_QT_UI" enableQt)
    (lib.cmakeFeature "OpenGL_GL_PREFERENCE" "GLVND")
@ -91,33 +102,40 @@ stdenv.mkDerivation (finalAttrs: {
    })
  ];

-  installPhase = let
-    vulkanPath = lib.makeLibraryPath [ vulkan-loader ];
-  in
-    ''
-      runHook preInstall
+  installPhase =
+    lib.concatStringsSep "\n" ([
+      ''runHook preInstall''
+    ]
+    ++ [
+      ''mkdir -p $out/share/{applications,ppsspp/bin,icons}''
+    ]
+    ++ (if enableQt then [
+      ''install -Dm555 PPSSPPQt $out/share/ppsspp/bin/''
+      ] else [
+        ''install -Dm555 PPSSPPHeadless $out/share/ppsspp/bin/''
+        ''makeWrapper $out/share/ppsspp/bin/PPSSPPHeadless $out/bin/ppsspp-headless''
+        ''install -Dm555 PPSSPPSDL $out/share/ppsspp/bin/''
+      ])
+    ++ [
+      ''mv assets $out/share/ppsspp''
+      ''mv ../icons/hicolor $out/share/icons''
+    ]
+    ++ [
+      ''runHook postInstall''
+    ]);

-      mkdir -p $out/share/{applications,ppsspp,icons}
-    ''
-    + (if enableQt then ''
-      install -Dm555 PPSSPPQt $out/bin/ppsspp
-      wrapProgram $out/bin/ppsspp \
-    '' else ''
-      install -Dm555 PPSSPPHeadless $out/bin/ppsspp-headless
-      install -Dm555 PPSSPPSDL $out/share/ppsspp/
-      makeWrapper $out/share/ppsspp/PPSSPPSDL $out/bin/ppsspp \
-        --set SDL_VIDEODRIVER ${if forceWayland then "wayland" else "x11"} \
-    '')
-    + lib.optionalString enableVulkan ''
-        --prefix LD_LIBRARY_PATH : ${vulkanPath} \
-    ''
-    + ''
-
-      mv assets $out/share/ppsspp
-      mv ../icons/hicolor $out/share/icons
-
-      runHook postInstall
-    '';
+  postFixup =
+    let
+      wrapperArgs =
+        lib.concatStringsSep " "
+          (lib.optionals enableVulkan [
+            "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ vulkan-loader ]}"
+          ] ++ lib.optionals (!enableQt) [
+            "--set SDL_VIDEODRIVER ${if forceWayland then "wayland" else "x11"}"
+          ]);
+      binToBeWrapped = if enableQt then "PPSSPPQt" else "PPSSPPSDL";
+    in
+      ''makeWrapper $out/share/ppsspp/bin/${binToBeWrapped} $out/bin/ppsspp ${wrapperArgs}'';

  meta = {
    homepage = "https://www.ppsspp.org/";
--- a/pkgs/by-name/pr/pretalx/package.nix
+++ b/pkgs/by-name/pr/pretalx/package.nix
@ -85,10 +85,16 @@ python.pkgs.buildPythonApplication rec {
  ]);

  pythonRelaxDeps = [
+    "celery"
+    "css-inline"
    "cssutils"
    "django-csp"
    "django-filter"
+    "django-hierarkey"
+    "markdown"
+    "pillow"
    "python-dateutil"
+    "reportlab"
  ];

  propagatedBuildInputs = with python.pkgs; [
--- a/pkgs/by-name/pr/pretix/package.nix
+++ b/pkgs/by-name/pr/pretix/package.nix
@ -29,13 +29,13 @@ let
  };

  pname = "pretix";
-  version = "2024.3.0";
+  version = "2024.4.0";

  src = fetchFromGitHub {
    owner = "pretix";
    repo = "pretix";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Wz1vZcqgwyS0xJgTtRxqfaJpJ1fAMhIyxvTvBT/ABSo=";
+    hash = "sha256-+F5EOMMkO1ngGeFscDipwbldsY0AhOUKbjqgNpuph4g=";
  };

  npmDeps = buildNpmPackage {
@ -43,7 +43,7 @@ let
    inherit version src;

    sourceRoot = "${src.name}/src/pretix/static/npm_dir";
-    npmDepsHash = "sha256-2fHlEEmYzpF3SyvF7+FbwCt+zQVGF0/kslDFnJ+DQGE=";
+    npmDepsHash = "sha256-0Q/BCRHlnyQJlCF3PgIP9q3Qyr/ff+GP0lPIwPsIMSU=";

    dontBuild = true;

@ -81,16 +81,15 @@ python.pkgs.buildPythonApplication rec {
      --replace-fail psycopg2-binary psycopg2 \
      --replace-fail vat_moss_forked==2020.3.20.0.11.0 vat-moss \
      --replace-fail "bleach==5.0.*" bleach \
+      --replace-fail "django-hierarkey==1.1.*" django-hierarkey \
+      --replace-fail "djangorestframework==3.15.*" djangorestframework \
      --replace-fail "dnspython==2.6.*" dnspython \
-      --replace-fail "django-countries==7.5.*" django-countries \
-      --replace-fail "django-filter==24.1" django-filter \
      --replace-fail "importlib_metadata==7.*" importlib_metadata \
      --replace-fail "markdown==3.6" markdown \
      --replace-fail "protobuf==5.26.*" protobuf \
      --replace-fail "pycryptodome==3.20.*" pycryptodome \
      --replace-fail "pypdf==3.9.*" pypdf \
      --replace-fail "python-dateutil==2.9.*" python-dateutil \
-      --replace-fail "sentry-sdk==1.42.*" sentry-sdk \
      --replace-fail "stripe==7.9.*" stripe
  '';

@ -175,6 +174,7 @@ python.pkgs.buildPythonApplication rec {
    text-unidecode
    tlds
    tqdm
+    ua-parser
    vat-moss
    vobject
    webauthn
--- a/pkgs/by-name/py/pyprland/package.nix
+++ b/pkgs/by-name/py/pyprland/package.nix
@ -1,8 +1,12 @@
-{ lib, fetchFromGitHub, python3Packages }:
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+}:

 python3Packages.buildPythonApplication rec {
  pname = "pyprland";
-  version = "2.2.15";
+  version = "2.2.16";
  format = "pyproject";

  disabled = python3Packages.pythonOlder "3.10";
@ -11,7 +15,7 @@ python3Packages.buildPythonApplication rec {
    owner = "hyprland-community";
    repo = "pyprland";
    rev = version;
-    hash = "sha256-ju/Xa3s0engE09q9EtKK/zhgimMmlTPXJrpwWQqUFLs=";
+    hash = "sha256-zT+ixOM+by13iM78CHkQqTS9LCLFspHNyEjd7P2psUE=";
  };

  nativeBuildInputs = with python3Packages; [ poetry-core ];
@ -58,7 +62,10 @@ python3Packages.buildPythonApplication rec {
    description = "An hyperland plugin system";
    homepage = "https://github.com/hyprland-community/pyprland";
    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ iliayar johnrtitor ];
+    maintainers = with lib.maintainers; [
+      iliayar
+      johnrtitor
+    ];
    platforms = lib.platforms.linux;
  };
 }
--- a/pkgs/by-name/re/redka/package.nix
+++ b/pkgs/by-name/re/redka/package.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "redka";
-  version = "0.3.0";
+  version = "0.4.0";

  src = fetchFromGitHub {
    owner = "nalgeon";
    repo = "redka";
    rev = "v${version}";
-    hash = "sha256-nE5JrKsvQeU/wDNl5HYFiK9ezyGpUqX4d4SaZhfURxo=";
+    hash = "sha256-Dm+QMmCYoYJWv+Crot0bwcSPHuUYQzhRgTO65jRjLLE=";
  };

  vendorHash = "sha256-aX0X6TWVEouo884LunCt+UzLyvDHgmvuxdV0wh0r7Ro=";
--- a/pkgs/by-name/re/renode-dts2repl/package.nix
+++ b/pkgs/by-name/re/renode-dts2repl/package.nix
@ -6,7 +6,7 @@

 python3.pkgs.buildPythonApplication {
  pname = "renode-dts2repl";
-  version = "unstable-2024-04-16";
+  version = "0-unstable-2024-04-16";
  pyproject = true;

  src = fetchFromGitHub {
--- a/pkgs/by-name/ri/river-bnf/package.nix
+++ b/pkgs/by-name/ri/river-bnf/package.nix
@ -8,7 +8,7 @@

 stdenv.mkDerivation rec {
  pname = "river-bnf";
-  version = "unstable-2023-10-10";
+  version = "0-unstable-2023-10-10";

  src = fetchFromSourcehut {
    owner = "~leon_plickat";
--- a/pkgs/by-name/rp/rpcs3/package.nix
+++ b/pkgs/by-name/rp/rpcs3/package.nix
@ -32,10 +32,10 @@

 let
  # Keep these separate so the update script can regex them
-  rpcs3GitVersion = "16377-08c3a38b6";
-  rpcs3Version = "0.0.31-16377-08c3a38b6";
-  rpcs3Revision = "08c3a38b6788d9cd4f0bb7310c22a7fd05dc3ba2";
-  rpcs3Hash = "sha256-GOKbznr1X+5nunbjfL9TZ9it/IPvV5mnpc0cbuGHDHw=";
+  rpcs3GitVersion = "16391-39e946630";
+  rpcs3Version = "0.0.31-16391-39e946630";
+  rpcs3Revision = "39e946630da8e23c4d2d2b763f63145eb9205e43";
+  rpcs3Hash = "sha256-CIPUmcpBc6iRMzZJZ5vKty/Uh4TYiR65xXD4aKRPSKc=";

  inherit (qt6Packages) qtbase qtmultimedia wrapQtAppsHook qtwayland;
 in
--- a/pkgs/by-name/sa/samrewritten/package.nix
+++ b/pkgs/by-name/sa/samrewritten/package.nix
@ -11,7 +11,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "samrewritten";
-  version = "unstable-2023-05-23";
+  version = "202008-unstable-2023-05-22";

  src = fetchFromGitHub {
    owner = "PaulCombal";
--- a/pkgs/by-name/si/siyuan/package-lock.json
+++ b/pkgs/by-name/si/siyuan/package-lock.json
--- a/pkgs/by-name/si/siyuan/package.nix
+++ b/pkgs/by-name/si/siyuan/package.nix
@ -0,0 +1,100 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+  buildNpmPackage,
+  substituteAll,
+  pandoc,
+  electron,
+}:
+
+buildNpmPackage rec {
+  pname = "siyuan";
+  version = "3.0.11";
+
+  src = fetchFromGitHub {
+    owner = "siyuan-note";
+    repo = "siyuan";
+    rev = "v${version}";
+    hash = "sha256-s82g5os944us85V2TBnm+HNd37vVzNjaOJYrbBrgLSI=";
+  };
+
+  kernel = buildGoModule {
+    name = "${pname}-${version}-kernel";
+    inherit src;
+    sourceRoot = "${src.name}/kernel";
+    vendorHash = "sha256-onZBrw0fDsjqXgQF06C40ArxNmsbFDIwD57fJ0jB0ls=";
+
+    patches = [
+      (substituteAll {
+        src = ./set-pandoc-path.patch;
+        pandoc_path = lib.getExe pandoc;
+      })
+    ];
+
+    # this patch makes it so that file permissions are not kept when copying files using the gulu package
+    # this fixes a problem where it was copying files from the store and keeping their permissions
+    # hopefully this doesn't break other functionality
+    modPostBuild = ''
+      chmod +w vendor/github.com/88250/gulu
+      substituteInPlace vendor/github.com/88250/gulu/file.go \
+          --replace-fail "os.Chmod(dest, sourceinfo.Mode())" "os.Chmod(dest, 0644)"
+    '';
+  };
+
+  sourceRoot = "${src.name}/app";
+
+  postPatch = ''
+    ln -s ${./package-lock.json} package-lock.json
+    # for some reason the default page is broken, use the redirection link automatically
+    substituteInPlace electron/main.js \
+        --replace-fail ' "/stage/build/app/index.html?v=" + new Date().getTime()' '"/stage/build/desktop"'
+  '';
+
+  npmDepsHash = "sha256-Yv/iOCyry3CNeKPxS206Y5y5mvzPU873PJdi0UQkVLs=";
+
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+
+  npmBuildScript = "build:desktop";
+
+  postBuild = ''
+    substituteInPlace electron-builder-linux.yml \
+        --replace-fail '- target: "AppImage"' "" \
+        --replace-fail '- target: "tar.gz"' '- target: "dir"'
+
+    # add extra fields to resolve the electron provided by nixpkgs
+    sed -e 1i'electronDist: ${electron}/libexec/electron' \
+        -e 1i'electronVersion: ${electron.version}' \
+        -i electron-builder-linux.yml
+
+    npm run dist-linux
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/siyuan
+    cp -r build/*-unpacked/{locales,resources{,.pak}} $out/share/siyuan
+
+    mkdir $out/share/siyuan/resources/kernel
+    ln -s ${kernel}/bin/kernel $out/share/siyuan/resources/kernel/SiYuan-Kernel
+
+    makeWrapper ${lib.getExe electron} $out/bin/siyuan \
+        --chdir $out/share/siyuan/resources \
+        --add-flags $out/share/siyuan/resources/app \
+        --set ELECTRON_FORCE_IS_PACKAGED 1 \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+        --inherit-argv0
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A privacy-first personal knowledge management system that supports complete offline usage, as well as end-to-end encrypted data sync";
+    homepage = "https://b3log.org/siyuan/";
+    license = lib.licenses.agpl3Plus;
+    mainProgram = "siyuan";
+    maintainers = with lib.maintainers; [ tomasajt ];
+    platforms = lib.platforms.linux;
+  };
+}
--- a/Show More
+++ b/Show More