Merge staging-next into staging

2025-02-04 03:03:42 +00:00 · 2023-09-28 18:01:26 +00:00 · 2023-09-28 18:01:26 +00:00 · 7fb0efd757
commit 7fb0efd757
parent 07387cace9 bd2b03a095
84 changed files with 1279 additions and 1592 deletions
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@ -91,6 +91,9 @@ checkConfigOutput '^true$' config.result ./test-mergeAttrDefinitionsWithPrio.nix
 # is the option.
 checkConfigOutput '^true$' config.result ./module-argument-default.nix

+# gvariant
+checkConfigOutput '^true$' config.assertion ./gvariant.nix
+
 # types.pathInStore
 checkConfigOutput '".*/store/0lz9p8xhf89kb1c1kk6jxrzskaiygnlh-bash-5.2-p15.drv"' config.pathInStore.ok1 ./types.nix
 checkConfigOutput '".*/store/0fb3ykw9r5hpayd05sr0cizwadzq1d8q-bash-5.2-p15"' config.pathInStore.ok2 ./types.nix
--- a/lib/tests/modules/gvariant.nix
+++ b/lib/tests/modules/gvariant.nix
@ -1,93 +1,61 @@
 { config, lib, ... }:

-let inherit (lib) concatStringsSep mapAttrsToList mkMerge mkOption types gvariant;
-in {
-  options.examples = mkOption { type = types.attrsOf gvariant; };
+{
+  options = {
+    examples = lib.mkOption { type = lib.types.attrs; };
+    assertion = lib.mkOption { type = lib.types.bool; };
+  };

  config = {
-    examples = with gvariant;
-      mkMerge [
-        { bool = true; }
-        { bool = true; }
+    examples = with lib.gvariant; {
+      bool = true;
+      float = 3.14;
+      int32 = mkInt32 (- 42);
+      uint32 = mkUint32 42;
+      int16 = mkInt16 (-42);
+      uint16 = mkUint16 42;
+      int64 = mkInt64 (-42);
+      uint64 = mkUint64 42;
+      array1 = [ "one" ];
+      array2 = mkArray [ (mkInt32 1) ];
+      array3 = mkArray [ (mkUint32 2) ];
+      emptyArray = mkEmptyArray type.uint32;
+      string = "foo";
+      escapedString = ''
+        '\
+      '';
+      tuple = mkTuple [ (mkInt32 1) [ "foo" ] ];
+      maybe1 = mkNothing type.string;
+      maybe2 = mkJust (mkUint32 4);
+      variant = mkVariant "foo";
+      dictionaryEntry = mkDictionaryEntry (mkInt32 1) [ "foo" ];
+    };

-        { float = 3.14; }
-
-        { int32 = mkInt32 (- 42); }
-        { int32 = mkInt32 (- 42); }
-
-        { uint32 = mkUint32 42; }
-        { uint32 = mkUint32 42; }
-
-        { int16 = mkInt16 (-42); }
-        { int16 = mkInt16 (-42); }
-
-        { uint16 = mkUint16 42; }
-        { uint16 = mkUint16 42; }
-
-        { int64 = mkInt64 (-42); }
-        { int64 = mkInt64 (-42); }
-
-        { uint64 = mkUint64 42; }
-        { uint64 = mkUint64 42; }
-
-        { array1 = [ "one" ]; }
-        { array1 = mkArray [ "two" ]; }
-        { array2 = mkArray [ (mkInt32 1) ]; }
-        { array2 = mkArray [ (nkUint32 2) ]; }
-
-        { emptyArray1 = [ ]; }
-        { emptyArray2 = mkEmptyArray type.uint32; }
-
-        { string = "foo"; }
-        { string = "foo"; }
-        {
-          escapedString = ''
-            '\
-          '';
-        }
-
-        { tuple = mkTuple [ (mkInt32 1) [ "foo" ] ]; }
-
-        { maybe1 = mkNothing type.string; }
-        { maybe2 = mkJust (mkUint32 4); }
-
-        { variant1 = mkVariant "foo"; }
-        { variant2 = mkVariant 42; }
-
-        { dictionaryEntry = mkDictionaryEntry (mkInt32 1) [ "foo" ]; }
-      ];
-
-    assertions = [
-      {
-        assertion = (
-          let
-            mkLine = n: v: "${n} = ${toString (gvariant.mkValue v)}";
-            result = concatStringsSep "\n" (mapAttrsToList mkLine config.examples);
-          in
-          result + "\n"
-        ) == ''
-          array1 = @as ['one','two']
-          array2 = @au [1,2]
-          bool = true
-          dictionaryEntry = @{ias} {1,@as ['foo']}
-          emptyArray1 = @as []
-          emptyArray2 = @au []
-          escapedString = '\'\\\n'
-          float = 3.140000
-          int = -42
-          int16 = @n -42
-          int64 = @x -42
-          maybe1 = @ms nothing
-          maybe2 = just @u 4
-          string = 'foo'
-          tuple = @(ias) (1,@as ['foo'])
-          uint16 = @q 42
-          uint32 = @u 42
-          uint64 = @t 42
-          variant1 = @v <'foo'>
-          variant2 = @v <42>
-        '';
-      }
-    ];
+    assertion =
+      let
+        mkLine = n: v: "${n} = ${toString (lib.gvariant.mkValue v)}";
+        result = lib.concatStringsSep "\n" (lib.mapAttrsToList mkLine config.examples);
+      in
+      (result + "\n") == ''
+        array1 = @as ['one']
+        array2 = @ai [1]
+        array3 = @au [@u 2]
+        bool = true
+        dictionaryEntry = @{ias} {1,@as ['foo']}
+        emptyArray = @au []
+        escapedString = '\'\\\n'
+        float = 3.140000
+        int16 = @n -42
+        int32 = -42
+        int64 = @x -42
+        maybe1 = @ms nothing
+        maybe2 = just @u 4
+        string = 'foo'
+        tuple = @(ias) (1,@as ['foo'])
+        uint16 = @q 42
+        uint32 = @u 42
+        uint64 = @t 42
+        variant = <'foo'>
+      '';
  };
 }
--- a/nixos/modules/misc/nixpkgs.nix
+++ b/nixos/modules/misc/nixpkgs.nix
@ -176,16 +176,12 @@ in
        '';
      type = types.listOf overlayType;
      description = lib.mdDoc ''
-        List of overlays to use with the Nix Packages collection.
-        (For details, see the Nixpkgs documentation.)  It allows
-        you to override packages globally. Each function in the list
-        takes as an argument the *original* Nixpkgs.
-        The first argument should be used for finding dependencies, and
-        the second should be used for overriding recipes.
+        List of overlays to apply to Nixpkgs.
+        This option allows modifying the Nixpkgs package set accessed through the `pkgs` module argument.

-        If `nixpkgs.pkgs` is set, overlays specified here
-        will be applied after the overlays that were already present
-        in `nixpkgs.pkgs`.
+        For details, see the [Overlays chapter in the Nixpkgs manual](https://nixos.org/manual/nixpkgs/stable/#chap-overlays).
+
+        If the {option}`nixpkgs.pkgs` option is set, overlays specified using `nixpkgs.overlays` will be applied after the overlays that were already included in `nixpkgs.pkgs`.
      '';
    };

--- a/pkgs/applications/audio/g4music/default.nix
+++ b/pkgs/applications/audio/g4music/default.nix
@ -2,6 +2,7 @@
 , stdenv
 , fetchFromGitLab
 , desktop-file-utils
+, gitUpdater
 , gobject-introspection
 , gst_all_1
 , gtk4
@ -14,14 +15,14 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "g4music";
-  version = "3.2";
+  version = "3.3";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "neithern";
    repo = "g4music";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-BlHOYD4sOmJPNMzM5QA97Ah1N9tIat0Y6qxN6c5pmsw=";
+    hash = "sha256-sajA8+G1frQA0p+8RK84hvh2P36JaarmSZx/sxMoFqo=";
  };

  nativeBuildInputs = [
@ -44,6 +45,10 @@ stdenv.mkDerivation (finalAttrs: {
    gstreamer
  ]);

+  passthru.updateScript = gitUpdater {
+    rev-prefix = "v";
+  };
+
  meta = with lib; {
    description = "A beautiful, fast, fluent, light weight music player written in GTK4";
    homepage = "https://gitlab.gnome.org/neithern/g4music";
--- a/pkgs/applications/audio/helvum/default.nix
+++ b/pkgs/applications/audio/helvum/default.nix
@ -5,6 +5,7 @@
 , fetchFromGitLab
 , glib
 , gtk4
+, libadwaita
 , meson
 , ninja
 , pipewire
@ -17,20 +18,20 @@

 stdenv.mkDerivation rec {
  pname = "helvum";
-  version = "0.4.1";
+  version = "0.5.1";

  src = fetchFromGitLab {
    domain = "gitlab.freedesktop.org";
    owner = "pipewire";
    repo = pname;
    rev = version;
-    hash = "sha256-nBU8dk22tzVf60yznTYJBYRKG+ctwWl1epU90R0zXr0=";
+    hash = "sha256-9vlzLPpyZ9qtCEbCDvYhWDcV+8T63ukdos1l2U6fD+E=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-kzu8dzKob9KxKEP3ElUYCCTdyvbzi+jSXTaaaaPMhYg=";
+    hash = "sha256-Xebm3XlsO6kBoMnxJsOk/3SO7avVoaGqi2CVWBRzr88=";
  };

  nativeBuildInputs = [
@ -49,6 +50,7 @@ stdenv.mkDerivation rec {
    desktop-file-utils
    glib
    gtk4
+    libadwaita
    pipewire
  ];

--- a/pkgs/applications/editors/rstudio/default.nix
+++ b/pkgs/applications/editors/rstudio/default.nix
@ -16,13 +16,13 @@
 , qtsensors
 , qtwebengine
 , qtwebchannel
+, quarto
 , libuuid
 , hunspellDicts
 , unzip
 , ant
 , jdk
 , gnumake
-, makeWrapper
 , pandoc
 , llvmPackages
 , yaml-cpp
@ -40,39 +40,39 @@

 let
  pname = "RStudio";
-  version = "2022.07.1+554";
-  RSTUDIO_VERSION_MAJOR  = "2022";
-  RSTUDIO_VERSION_MINOR  = "07";
-  RSTUDIO_VERSION_PATCH  = "1";
-  RSTUDIO_VERSION_SUFFIX = "+554";
+  version =
+  "${RSTUDIO_VERSION_MAJOR}.${RSTUDIO_VERSION_MINOR}.${RSTUDIO_VERSION_PATCH}${RSTUDIO_VERSION_SUFFIX}";
+  RSTUDIO_VERSION_MAJOR  = "2023";
+  RSTUDIO_VERSION_MINOR  = "09";
+  RSTUDIO_VERSION_PATCH  = "0";
+  RSTUDIO_VERSION_SUFFIX = "+463";

  src = fetchFromGitHub {
    owner = "rstudio";
    repo = "rstudio";
    rev = "v${version}";
-    sha256 = "0rmdqxizxqg2vgr3lv066cjmlpjrxjlgi0m97wbh6iyhkfm2rrj1";
+    hash = "sha256-FwNuU2rbE3GEhuwphvZISUMhvSZJ6FjjaZ1oQ9F8NWc=";
  };

  mathJaxSrc = fetchurl {
    url = "https://s3.amazonaws.com/rstudio-buildtools/mathjax-27.zip";
-    sha256 = "sha256-xWy6psTOA8H8uusrXqPDEtL7diajYCVHcMvLiPsgQXY=";
+    hash = "sha256-xWy6psTOA8H8uusrXqPDEtL7diajYCVHcMvLiPsgQXY=";
  };

  rsconnectSrc = fetchFromGitHub {
    owner = "rstudio";
    repo = "rsconnect";
-    rev = "e287b586e7da03105de3faa8774c63f08984eb3c";
-    sha256 = "sha256-ULyWdSgGPSAwMt0t4QPuzeUE6Bo6IJh+5BMgW1bFN+Y=";
+    rev = "5175a927a41acfd9a21d9fdecb705ea3292109f2";
+    hash = "sha256-c1fFcN6KAfxXv8bv4WnIqQKg1wcNP2AywhEmIbyzaBA=";
  };

-  panmirrorModules = mkYarnModules rec {
-    inherit pname version;
-    packageJSON = ./package.json;
-    yarnLock = "${src}/src/gwt/panmirror/src/editor/yarn.lock";
-    offlineCache = fetchYarnDeps {
-      inherit yarnLock;
-      hash = "sha256-v05Up6VMlYlvgUYQVYo+YfpcsMohliNfMgyjq6QymCI=";
-    };
+  # Ideally, rev should match the rstudio release name.
+  # e.g. release/rstudio-mountain-hydrangea
+  quartoSrc = fetchFromGitHub {
+    owner = "quarto-dev";
+    repo = "quarto";
+    rev = "bb264a572c6331d46abcf087748c021d815c55d7";
+    hash = "sha256-lZnZvioztbBWWa6H177X6rRrrgACx2gMjVFDgNup93g=";
  };

  description = "Set of integrated tools for the R language";
@ -86,7 +86,6 @@ in
      unzip
      ant
      jdk
-      makeWrapper
      pandoc
      nodejs
    ] ++ lib.optionals (!server) [
@ -102,6 +101,7 @@ in
      yaml-cpp
      soci
      postgresql
+      quarto
    ] ++ (if server then [
      sqlite.dev
      pam
@ -118,7 +118,7 @@ in
      "-DRSTUDIO_USE_SYSTEM_SOCI=ON"
      "-DRSTUDIO_USE_SYSTEM_BOOST=ON"
      "-DRSTUDIO_USE_SYSTEM_YAML_CPP=ON"
-      "-DQUARTO_ENABLED=FALSE"
+      "-DQUARTO_ENABLED=TRUE"
      "-DPANDOC_VERSION=${pandoc.version}"
      "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}/lib/rstudio"
    ] ++ lib.optionals (!server) [
@ -132,8 +132,7 @@ in
      ./use-system-node.patch
      ./fix-resources-path.patch
      ./pandoc-nix-path.patch
-      ./remove-quarto-from-generator.patch
-      ./do-not-install-pandoc.patch
+      ./use-system-quarto.patch
    ];

    postPatch = ''
@ -143,16 +142,20 @@ in
        --replace 'SOCI_LIBRARY_DIR "/usr/lib"' 'SOCI_LIBRARY_DIR "${soci}/lib"'

      substituteInPlace src/gwt/build.xml \
-        --replace '@node@' ${nodejs}
+        --replace '@node@' ${nodejs} \
+        --replace './lib/quarto' ${quartoSrc}

      substituteInPlace src/cpp/core/libclang/LibClang.cpp \
        --replace '@libclang@' ${llvmPackages.libclang.lib} \
        --replace '@libclang.so@' ${llvmPackages.libclang.lib}/lib/libclang.so

-      substituteInPlace src/cpp/session/include/session/SessionConstants.hpp \
-        --replace '@pandoc@' ${pandoc}/bin/pandoc
+      substituteInPlace src/cpp/session/CMakeLists.txt \
+        --replace '@pandoc@' ${pandoc} \
+        --replace '@quarto@' ${quarto}

-      sed '1i#include <set>' -i src/cpp/core/include/core/Thread.hpp
+      substituteInPlace src/cpp/session/include/session/SessionConstants.hpp \
+        --replace '@pandoc@' ${pandoc}/bin \
+        --replace '@quarto@' ${quarto}
    '';

    hunspellDictionaries = with lib; filter isDerivation (unique (attrValues hunspellDicts));
@ -180,8 +183,6 @@ in

      cp -r ${rsconnectSrc} dependencies/rsconnect
      ( cd dependencies && ${R}/bin/R CMD build -d --no-build-vignettes rsconnect )
-
-      cp -r "${panmirrorModules}" src/gwt/panmirror/src/editor/node_modules
    '';

    postInstall = ''
@ -205,14 +206,14 @@ in
      rm -r $out/lib/rstudio/{INSTALL,COPYING,NOTICE,README.md,SOURCE,VERSION}
    '';

-    meta = with lib; {
+    meta = {
      broken = (stdenv.isLinux && stdenv.isAarch64);
      inherit description;
      homepage = "https://www.rstudio.com/";
-      license = licenses.agpl3Only;
-      maintainers = with maintainers; [ ciil cfhammill ];
+      license = lib.licenses.agpl3Only;
+      maintainers = with lib.maintainers; [ ciil cfhammill ];
      mainProgram = "rstudio" + lib.optionalString server "-server";
-      platforms = platforms.linux;
+      platforms = lib.platforms.linux;
    };

    passthru = {
--- a/pkgs/applications/editors/rstudio/do-not-install-pandoc.patch
+++ b/pkgs/applications/editors/rstudio/do-not-install-pandoc.patch
@ -1,13 +0,0 @@
--- a/src/cpp/session/CMakeLists.txt
-+++ b/src/cpp/session/CMakeLists.txt
-@@ -60,8 +60,7 @@
- 
- # validate our dependencies exist
- foreach(VAR RSTUDIO_DEPENDENCIES_DICTIONARIES_DIR
-            RSTUDIO_DEPENDENCIES_MATHJAX_DIR
-            RSTUDIO_DEPENDENCIES_PANDOC_DIR)
-+            RSTUDIO_DEPENDENCIES_MATHJAX_DIR)
- 
-    # validate existence
-    if(NOT EXISTS "${${VAR}}")
-
--- a/pkgs/applications/editors/rstudio/package.json
+++ b/pkgs/applications/editors/rstudio/package.json
@ -1,85 +0,0 @@
-{
-  "name": "panmirror",
-  "version": "0.1.0",
-  "private": true,
-  "license": "agpl-3.0",
-  "dependencies": {
-    "@types/ace": "^0.0.43",
-    "@types/clipboard": "^2.0.7",
-    "@types/diff-match-patch": "^1.0.32",
-    "@types/js-yaml": "^4.0.3",
-    "@types/lodash.debounce": "^4.0.6",
-    "@types/lodash.orderby": "^4.6.6",
-    "@types/lodash.uniqby": "^4.7.6",
-    "@types/orderedmap": "^1.0.0",
-    "@types/pinyin": "^2.10.0",
-    "@types/prosemirror-commands": "^1.0.4",
-    "@types/prosemirror-dropcursor": "^1.0.3",
-    "@types/prosemirror-gapcursor": "^1.0.4",
-    "@types/prosemirror-history": "^1.0.3",
-    "@types/prosemirror-inputrules": "^1.0.4",
-    "@types/prosemirror-keymap": "^1.0.4",
-    "@types/prosemirror-schema-list": "^1.0.3",
-    "@types/prosemirror-tables": "^0.9.1",
-    "@types/react": "^17.0.20",
-    "@types/react-dom": "^17.0.9",
-    "@types/react-window": "^1.8.5",
-    "@types/transliteration": "^1.6.6",
-    "@types/zenscroll": "^4.0.1",
-    "biblatex-csl-converter": "^2.0.2",
-    "clipboard": "^2.0.8",
-    "diff-match-patch": "^1.0.5",
-    "fuse.js": "^6.4.6",
-    "js-yaml": "^4.1.0",
-    "lodash.debounce": "^4.0.8",
-    "lodash.orderby": "^4.6.0",
-    "lodash.uniqby": "^4.7.0",
-    "orderedmap": "^1.0.0",
-    "pinyin": "^2.10.2",
-    "prosemirror-changeset": "^2.1.2",
-    "prosemirror-commands": "^1.1.10",
-    "prosemirror-dev-tools": "^2.1.1",
-    "prosemirror-dropcursor": "^1.3.5",
-    "prosemirror-gapcursor": "^1.1.5",
-    "prosemirror-history": "^1.2.0",
-    "prosemirror-inputrules": "^1.1.3",
-    "prosemirror-keymap": "^1.1.4",
-    "prosemirror-model": "^1.14.3",
-    "prosemirror-schema-list": "^1.1.5",
-    "prosemirror-state": "^1.3.4",
-    "prosemirror-tables": "^1.1.1",
-    "prosemirror-transform": "^1.3.2",
-    "prosemirror-utils": "^0.9.6",
-    "prosemirror-view": "^1.20.1",
-    "react": "^17.0.2",
-    "react-dom": "^17.0.2",
-    "react-window": "^1.8.6",
-    "sentence-splitter": "^3.2.2",
-    "thenby": "^1.3.3",
-    "tlite": "^0.1.9",
-    "transliteration": "^2.2.0",
-    "typescript": "3.8.3",
-    "zenscroll": "^4.0.2"
-  },
-  "scripts": {
-    "format": "prettier --write \"src/**/*.ts\" \"src/**/*.tsx\"",
-    "lint": "tslint -c tslint.json 'src/**/*.{ts,tsx}'",
-    "watch": "tsc --watch --noEmit --project './tsconfig.json'",
-    "generate-symbols": "ts-node tools/generate-symbols.ts"
-  },
-  "devDependencies": {
-    "@types/node": "^14.0.4",
-    "@types/unzip": "^0.1.1",
-    "fast-xml-parser": "^3.17.1",
-    "fuse-box": "^3.7.1",
-    "prettier": "^1.18.2",
-    "terser": "^4.6.2",
-    "ts-node": "^8.10.2",
-    "tslint": "^5.20.0",
-    "tslint-config-prettier": "^1.18.0",
-    "tslint-react": "^5.0.0",
-    "typescript-tslint-plugin": "^0.5.5",
-    "uglify-js": "^3.7.4",
-    "unzip": "^0.1.11"
-  }
-}
--- a/pkgs/applications/editors/rstudio/pandoc-nix-path.patch
+++ b/pkgs/applications/editors/rstudio/pandoc-nix-path.patch
@ -1,11 +1,18 @@
 --- a/src/cpp/session/include/session/SessionConstants.hpp
 +++ b/src/cpp/session/include/session/SessionConstants.hpp
-@@ -140,7 +140,7 @@
+@@ -142,13 +142,13 @@
+ #define kSessionTmpDir             "rstudio-rsession"
+ 
 #ifdef QUARTO_ENABLED
- # define kDefaultPandocPath        "bin/quarto/bin"
- #else
-# define kDefaultPandocPath        "bin/pandoc"
+-# define kDefaultPandocPath        "bin/quarto/bin/tools"
 +# define kDefaultPandocPath        "@pandoc@"
+ #else
+ # define kDefaultPandocPath        "bin/pandoc"
 #endif
 
- #define kDefaultQuartoPath         "bin/quarto"
+ #define kDefaultNodePath           "bin/node"
+-#define kDefaultQuartoPath         "bin/quarto"
+#define kDefaultQuartoPath         "@quarto@"
+ #define kDefaultRsclangPath        "bin/rsclang"
+ 
+ #ifdef _WIN32
--- a/pkgs/applications/editors/rstudio/remove-quarto-from-generator.patch
+++ b/pkgs/applications/editors/rstudio/remove-quarto-from-generator.patch
@ -1,32 +0,0 @@
--- a/src/cpp/session/CMakeLists.txt
-+++ b/src/cpp/session/CMakeLists.txt
-@@ -43,12 +43,6 @@
-       set(RSTUDIO_DEPENDENCIES_MATHJAX_DIR "${RSTUDIO_DEPENDENCIES_DIR}/mathjax-27")
-    endif()
- 
-   if(EXISTS "${RSTUDIO_TOOLS_ROOT}/quarto")
-      set(RSTUDIO_DEPENDENCIES_QUARTO_DIR "${RSTUDIO_TOOLS_ROOT}/quarto")
-   else()
-      set(RSTUDIO_DEPENDENCIES_QUARTO_DIR "${RSTUDIO_DEPENDENCIES_DIR}/quarto")
-   endif()
-
- endif()
- 
- 
-@@ -67,14 +61,7 @@
- # validate our dependencies exist
- foreach(VAR RSTUDIO_DEPENDENCIES_DICTIONARIES_DIR
-             RSTUDIO_DEPENDENCIES_MATHJAX_DIR
-            RSTUDIO_DEPENDENCIES_PANDOC_DIR
-            RSTUDIO_DEPENDENCIES_QUARTO_DIR)
-
- 
-   # skip quarto if not enabled
-   if("${VAR}" STREQUAL "RSTUDIO_DEPENDENCIES_QUARTO_DIR" AND NOT QUARTO_ENABLED)
-      continue()
-   endif()
-+            RSTUDIO_DEPENDENCIES_PANDOC_DIR)
- 
-    # validate existence
-    if(NOT EXISTS "${${VAR}}")
-
--- a/pkgs/applications/editors/rstudio/use-system-node.patch
+++ b/pkgs/applications/editors/rstudio/use-system-node.patch
@ -1,29 +1,60 @@
+diff --git a/src/gwt/build.xml b/src/gwt/build.xml
+index 83e9433..f1ee63d 100644
 --- a/src/gwt/build.xml
 +++ b/src/gwt/build.xml
-@@ -83,24 +83,7 @@
-       <echo>Concatenated acesupport files to 'acesupport.js'</echo>
-    </target>
- 
-   <!-- panmirror typescript library -->
-   <!-- ensure version matches RSTUDIO_NODE_VERSION -->
-   <property name="node.version" value="16.14.0"/>
-   <property name="node.dir" value="../../dependencies/common/node/${node.version}"/>
-   <condition property="node.bin" value="../../../${node.dir}/bin/node">
+@@ -87,29 +87,7 @@
+    <!-- ensure version matches RSTUDIO_NODE_VERSION -->
+    <property name="node.version" value="16.14.0"/>
+    <property name="node.dir" value="../../dependencies/common/node/${node.version}"/>
+-   <!-- use yarn from system but will prefer yarn from dependencies if available -->
+-   <condition property="yarn.bin" value="yarn">
 -     <not>
 -        <os family="windows" />
 -     </not>
 -   </condition>
-   <condition property="node.bin" value="${node.dir}/node.exe">
+-   <available
+-      property="yarn.bin"
+-      value="${node.dir}/bin/yarn"
+-      file="${node.dir}/bin/yarn"/>
+-   <condition property="yarn.bin" value="${node.dir}/node_modules/yarn/bin/yarn.cmd">
 -     <os family="windows" />
 -   </condition>
-
-   <!-- use node from /opt/rstudio-tools if installed (typical for Docker) -->
+-   <!-- use yarn from /opt/rstudio-tools if installed (typical for Docker) -->
 -   <available
-      property="node.bin"
-      value="/opt/rstudio-tools/dependencies/common/node/${node.version}/bin/node"
-      file="/opt/rstudio-tools/dependencies/common/node/${node.version}/bin/node"/>
-+    <property name="node.bin" value="@node@/bin/node"/>
+-      property="yarn.bin"
+-      value="/opt/rstudio-tools/dependencies/common/node/${node.version}/bin/yarn"
+-      file="/opt/rstudio-tools/dependencies/common/node/${node.version}/bin/yarn"/>
+-   <!-- use yarn from c:/rstudio-tools if installed (typical for Docker on Windows) -->
+-   <available
+-      property="yarn.bin"
+-      value="c:\rstudio-tools\dependencies\common\node\${node.version}\node_modules\yarn\bin\yarn.cmd"
+-      file="c:\rstudio-tools\dependencies\common\node\${node.version}\node_modules\yarn\bin\yarn.cmd"/>
+   <property name="node.bin" value="@node@/bin/node"/>
 
-    <property name="panmirror.dir" value="./panmirror/src/editor"/>
+    <property name="panmirror.dir" value="./lib/quarto/apps/panmirror"/>
    <property name="panmirror.build.dir" value="./www/js/panmirror"/>
-
+@@ -126,21 +104,11 @@
+       file="c:\rstudio-tools\src\gwt\lib\quarto\apps\panmirror"/>
+ 
+    <target name="panmirror" description="Compile panmirror library">
+-      <echo message="yarn location: ${yarn.bin}"/>
+-      <echo message="panmirror location: ${panmirror.dir}"/>
+       <mkdir dir="${panmirror.build.dir}"/>
+-      <exec executable="${yarn.bin}" dir="${panmirror.dir}" resolveexecutable="true" failonerror="true">
+-         <arg value="install"/>
+-         <arg value="--network-timeout"/>
+-         <arg value="240000"/>
+-      </exec>
+-      <exec executable="${yarn.bin}" dir="${panmirror.dir}" resolveexecutable="true" failonerror="true">
+-         <arg value="build"/>
+-         <env key="PANMIRROR_OUTDIR" value="dist-rstudio"/>
+      <exec executable="${node.bin}" dir="${panmirror.dir}" spawn="${panmirror.spawn}">
+         <arg value="fuse"/>
+         <arg value="${panmirror.target}"/>
+       </exec>
+-      <copy todir="${panmirror.build.dir}">
+-         <fileset dir="${panmirror.dir}/dist-rstudio"/>
+-      </copy>
+    </target>
+ 
+    <target name="javac" description="Compile java source">
--- a/pkgs/applications/editors/rstudio/use-system-quarto.patch
+++ b/pkgs/applications/editors/rstudio/use-system-quarto.patch
@ -0,0 +1,46 @@
+--- a/src/cpp/session/CMakeLists.txt
+++ b/src/cpp/session/CMakeLists.txt
+@@ -36,18 +36,14 @@
+    else()
+       set(RSTUDIO_DEPENDENCIES_DICTIONARIES_DIR "${RSTUDIO_DEPENDENCIES_DIR}/dictionaries")
+    endif()
+-   
+
+    if(EXISTS "${RSTUDIO_TOOLS_ROOT}/mathjax-27")
+       set(RSTUDIO_DEPENDENCIES_MATHJAX_DIR "${RSTUDIO_TOOLS_ROOT}/mathjax-27")
+    else()
+       set(RSTUDIO_DEPENDENCIES_MATHJAX_DIR "${RSTUDIO_DEPENDENCIES_DIR}/mathjax-27")
+    endif()
+ 
+-   if(EXISTS "${RSTUDIO_TOOLS_ROOT}/quarto")
+-      set(RSTUDIO_DEPENDENCIES_QUARTO_DIR "${RSTUDIO_TOOLS_ROOT}/quarto")
+-   else()
+-      set(RSTUDIO_DEPENDENCIES_QUARTO_DIR "${RSTUDIO_DEPENDENCIES_DIR}/quarto")
+-   endif()
+   set(RSTUDIO_DEPENDENCIES_QUARTO_DIR "@quarto@")
+ 
+ endif()
+ 
+@@ -56,7 +52,7 @@
+ # - by default, we use quarto + quarto's bundled pandoc
+ # - if quarto is not enabled, use pandoc fallback
+ if(QUARTO_ENABLED)
+-   set(RSTUDIO_DEPENDENCIES_PANDOC_DIR "${RSTUDIO_DEPENDENCIES_QUARTO_DIR}/bin/tools")
+   set(RSTUDIO_DEPENDENCIES_PANDOC_DIR "@pandoc@/bin")
+ elseif(EXISTS "${RSTUDIO_TOOLS_ROOT}/pandoc/${PANDOC_VERSION}")
+    set(RSTUDIO_DEPENDENCIES_PANDOC_DIR "${RSTUDIO_TOOLS_ROOT}/pandoc/${PANDOC_VERSION}")
+ else()
+@@ -66,11 +62,9 @@
+ 
+ # validate our dependencies exist
+ foreach(VAR RSTUDIO_DEPENDENCIES_DICTIONARIES_DIR
+-            RSTUDIO_DEPENDENCIES_MATHJAX_DIR
+-            RSTUDIO_DEPENDENCIES_PANDOC_DIR
+-            RSTUDIO_DEPENDENCIES_QUARTO_DIR)
+            RSTUDIO_DEPENDENCIES_MATHJAX_DIR)
+
+ 
+- 
+    # skip quarto if not enabled
+    if("${VAR}" STREQUAL "RSTUDIO_DEPENDENCIES_QUARTO_DIR" AND NOT QUARTO_ENABLED)
+       continue()
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@ -30,11 +30,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: rec {
  pname = "blender";
-  version = "3.6.3";
+  version = "3.6.4";

  src = fetchurl {
    url = "https://download.blender.org/source/${pname}-${version}.tar.xz";
-    hash = "sha256-iRIwPrvPHwiIxHr7hpmG6NjS/liJkxcAgrzlk8LEFPg=";
+    hash = "sha256-zFL0GRWAtNC3C+SAspWZmGa8US92EiYQgVfiOsCJRx4=";
  };

  patches = [
--- a/pkgs/applications/misc/lunatask/default.nix
+++ b/pkgs/applications/misc/lunatask/default.nix
@ -1,12 +1,12 @@
 { lib, appimageTools, fetchurl }:

 let
-  version = "1.6.4";
+  version = "1.7.5";
  pname = "lunatask";

  src = fetchurl {
    url = "https://lunatask.app/download/Lunatask-${version}.AppImage";
-    sha256 = "sha256-rvjjzVgtDNryj7GO+ZfK92nZvWRnRPFoy9hEIGjviqQ=";
+    sha256 = "sha256-J8Kj7b4x3WD/aEO4J9A+iP068Ax4ayhYBDgH2vmtlfk=";
  };

  appimageContents = appimageTools.extractType2 {
@ -17,9 +17,11 @@ in appimageTools.wrapType2 rec {
  inherit pname version src;

  extraInstallCommands = ''
-    install -m 444 -D ${appimageContents}/lunatask.desktop $out/share/applications/lunatask.desktop
-    install -m 444 -D ${appimageContents}/lunatask.png $out/share/icons/hicolor/0x0/apps/lunatask.png
-    substituteInPlace $out/share/applications/lunatask.desktop \
+    mv $out/bin/${pname}-${version} $out/bin/${pname}
+
+    install -m 444 -D ${appimageContents}/${pname}.desktop $out/share/applications/${pname}.desktop
+    install -m 444 -D ${appimageContents}/${pname}.png $out/share/icons/hicolor/512x512/apps/${pname}.png
+    substituteInPlace $out/share/applications/${pname}.desktop \
      --replace 'Exec=AppRun' 'Exec=${pname}'
  '';

--- a/pkgs/applications/misc/obsidian/default.nix
+++ b/pkgs/applications/misc/obsidian/default.nix
@ -12,7 +12,7 @@
 let
  inherit (stdenv.hostPlatform) system;
  pname = "obsidian";
-  version = "1.4.13";
+  version = "1.4.14";
  appname = "Obsidian";
  meta = with lib; {
    description = "A powerful knowledge base that works on top of a local folder of plain text Markdown files";
@ -25,12 +25,12 @@ let
  filename = if stdenv.isDarwin then "Obsidian-${version}-universal.dmg" else "obsidian-${version}.tar.gz";
  src = fetchurl {
    url = "https://github.com/obsidianmd/obsidian-releases/releases/download/v${version}/${filename}";
-    sha256 = if stdenv.isDarwin then "sha256-FMaEq99D8bCQF91drHrB5icXyQIdnWIwhAM9yuG97aA=" else "sha256-TWDmoXpBhBrrdbqS6dbFq4BxC2Bshap3gbnB4/ONrQE=";
+    hash = if stdenv.isDarwin then "sha256-5cVKlZJDtXOkil+RohijCcqyJVTrysmqyTvJR0dDAuc=" else "sha256-qFSQer37Nkh3A3oVAFP/0qXzPWJ7SqY2GYA6b1iaYmE=";
  };

  icon = fetchurl {
    url = "https://obsidian.md/images/obsidian-logo-gradient.svg";
-    sha256 = "100j8fcrc5q8zv525siapminffri83s2khs2hw4kdxwrdjwh36qi";
+    hash = "sha256-EZsBuWyZ9zYJh0LDKfRAMTtnY70q6iLK/ggXlplDEoA=";
  };

  desktopItem = makeDesktopItem {
--- a/pkgs/applications/misc/oranda/default.nix
+++ b/pkgs/applications/misc/oranda/default.nix
@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "oranda";
-  version = "0.4.0";
+  version = "0.4.1";

  src = fetchFromGitHub {
    owner = "axodotdev";
    repo = "oranda";
    rev = "v${version}";
-    hash = "sha256-PHaqWKsZyNZnEAzEWMzJK6MD0b4O6pkYQG403ONIj0w=";
+    hash = "sha256-k4xrgRanQmkjmXGvfeaGU61+GP8asYPq4RQrao3rd4Q=";
  };

-  cargoHash = "sha256-zV7vG1mcgVusWCa4jKNLD+SqzReLZQRotk6nvzPYCU4=";
+  cargoHash = "sha256-CLMhzPM11LnQdCVD66xC4Fk+8LnfRfFzk3FwQeXboes=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/applications/misc/remnote/default.nix
+++ b/pkgs/applications/misc/remnote/default.nix
@ -6,11 +6,11 @@ stdenv.mkDerivation (finalAttrs: let
 in
 {
  pname = "remnote";
-  version = "1.12.36";
+  version = "1.12.43";

  src = fetchurl {
    url = "https://download.remnote.io/remnote-desktop/RemNote-${version}.AppImage";
-    hash = "sha256-uVncAEKCuUvJCeKMqflWq3R6BVHfbt1Bo+PwNk/pOu4=";
+    hash = "sha256-3GNp+0ZUZbUcBkE8DbIEDRYlWfG3HDTTS6wK3u42jJg=";
  };
  appexec = appimageTools.wrapType2 {
    inherit pname version src;
--- a/pkgs/applications/networking/cluster/cloudfoundry-cli/default.nix
+++ b/pkgs/applications/networking/cluster/cloudfoundry-cli/default.nix
@ -2,15 +2,15 @@

 buildGoModule rec {
  pname = "cloudfoundry-cli";
-  version = "8.7.2";
+  version = "8.7.3";

  src = fetchFromGitHub {
    owner = "cloudfoundry";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "sha256-6Ce9fmL0wZXCCRbJMqSD6xZQfDZl6EsiPpmfvYFT2tA=";
+    sha256 = "sha256-2ABsxoGRRUfa09tVPmn1IXDR2IXIewg/b/fmQnaKLoY=";
  };
-  vendorHash = "sha256-5/aGyJ+SksnjuKsWVyz60OsAcz3z/BP+wCwlKEmxHb4=";
+  vendorHash = "sha256-k2NI9zyeQM4PJo2wE3WkG5sntJGISwmz4xqQVChu8WQ=";

  subPackages = [ "." ];

--- a/pkgs/applications/networking/cluster/helmfile/default.nix
+++ b/pkgs/applications/networking/cluster/helmfile/default.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "helmfile";
-  version = "0.156.0";
+  version = "0.157.0";

  src = fetchFromGitHub {
    owner = "helmfile";
    repo = "helmfile";
    rev = "v${version}";
-    sha256 = "sha256-MrDhOsjXo4aaeWSo/WNheUqom7kF2MzyaqeZXVAAzz4=";
+    sha256 = "sha256-M0XhkmYdmKpaA1gTXGgI7XNqIAuerV2NqfUI7sIgIiw=";
  };

-  vendorHash = "sha256-hMoBwA9KmQSBJkEu3UAxM1wi6RRHZdUhYqri5JGwEmw=";
+  vendorHash = "sha256-RRnziHhM3pxoi5dZSZI5bkGWIp3Nx0TU3mVsOoU/CCM=";

  doCheck = false;

--- a/pkgs/applications/networking/deck/default.nix
+++ b/pkgs/applications/networking/deck/default.nix
@ -1,15 +1,14 @@
 { buildGoModule, lib, installShellFiles, fetchFromGitHub }:
-let
-  short_hash = "63b9742";
-in buildGoModule rec {
+
+buildGoModule rec {
  pname = "deck";
-  version = "1.26.0";
+  version = "1.27.0";

  src = fetchFromGitHub {
    owner = "Kong";
    repo = "deck";
    rev = "v${version}";
-    hash = "sha256-DxmIHJfvRZKsMyFllbfpriT4Ts9f7ha4aZcfVr/b9eA=";
+    hash = "sha256-QP267H1vfsIo1EhV9vAWt03ewGufPHT8sZWcj/AHuxw=";
  };

  nativeBuildInputs = [ installShellFiles ];
@ -18,10 +17,11 @@ in buildGoModule rec {

  ldflags = [
    "-s -w -X github.com/kong/deck/cmd.VERSION=${version}"
-    "-X github.com/kong/deck/cmd.COMMIT=${short_hash}"
+    "-X github.com/kong/deck/cmd.COMMIT=${src.rev}"
  ];

-  vendorHash = "sha256-jhLZvusYpX5fW1NCmJtwE/p9/wTwzA2hbwt657VsZts=";
+  proxyVendor = true; # darwin/linux hash mismatch
+  vendorHash = "sha256-ikgD17+lnKpxCzrIkOXOq332X48qEdSWXIIRoq76fB4=";

  postInstall = ''
    installShellCompletion --cmd deck \
--- a/pkgs/applications/networking/feedreaders/newsboat/default.nix
+++ b/pkgs/applications/networking/feedreaders/newsboat/default.nix
@ -3,16 +3,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "newsboat";
-  version = "2.32";
+  version = "2.33";

  src = fetchFromGitHub {
    owner = "newsboat";
    repo = "newsboat";
    rev = "r${version}";
-    hash = "sha256-ACPnCm2cu9BEpMd02t+G4mg6DZ8jCydfK4p+Ad87Hek=";
+    hash = "sha256-p9cyH5jANkB+PuvAq6KjaelgPwj1f7XNxuKMpT7jjpg=";
  };

-  cargoHash = "sha256-HHc8HSNWoBkDR7lQgvXUML5ly8sShDn16DWNf/Jig2g=";
+  cargoHash = "sha256-95xM4kZZ70xhfx+EvqFecYbVdisq9hpgp0t+s5Cp8QQ=";

  # TODO: Check if that's still needed
  postPatch = lib.optionalString stdenv.isDarwin ''
@ -59,12 +59,12 @@ rustPlatform.buildRustPackage rec {
    updateScript = nix-update-script { };
  };

-  meta = with lib; {
+  meta = {
    homepage    = "https://newsboat.org/";
    changelog   = "https://github.com/newsboat/newsboat/blob/${src.rev}/CHANGELOG.md";
    description = "A fork of Newsbeuter, an RSS/Atom feed reader for the text console";
-    maintainers = with maintainers; [ dotlambda nicknovitski ];
-    license     = licenses.mit;
-    platforms   = platforms.unix;
+    maintainers = with lib.maintainers; [ dotlambda nicknovitski ];
+    license     = lib.licenses.mit;
+    platforms   = lib.platforms.unix;
  };
 }
--- a/pkgs/applications/networking/remote/xrdp/default.nix
+++ b/pkgs/applications/networking/remote/xrdp/default.nix
@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, applyPatches, pkg-config, which, perl, autoconf, automake, libtool, openssl, systemd, pam, fuse, libjpeg, libopus, nasm, xorg }:

 let
-  version = "0.9.23";
+  version = "0.9.23.1";
  patchedXrdpSrc = applyPatches {
    patches = [ ./dynamic_config.patch ];
    name = "xrdp-patched-${version}";
@ -10,7 +10,7 @@ let
      repo = "xrdp";
      rev = "v${version}";
      fetchSubmodules = true;
-      hash = "sha256-14qsRfLn+26rm+vyMmOtaBEs8mWfSTIsIVseSC2FjXc=";
+      hash = "sha256-fJKSEHB5X5QydKgRPjIMJzNaAy1EVJifHETSGmlJttQ=";
    };
  };

--- a/pkgs/applications/version-management/commitizen/default.nix
+++ b/pkgs/applications/version-management/commitizen/default.nix
@ -5,19 +5,22 @@
 , python3
 , stdenv
 , installShellFiles
+, nix-update-script
 , testers
 }:

 python3.pkgs.buildPythonApplication rec {
  pname = "commitizen";
-  version = "3.7.0";
+  version = "3.10.0";
  format = "pyproject";

+  disabled = python3.pythonOlder "3.8";
+
  src = fetchFromGitHub {
    owner = "commitizen-tools";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-KfPIGQ4kIjV/Vuza5wdzp0R62LUluJQ5tY6I8BPFmGk=";
+    hash = "sha256-faHZBH/JrCDRQqZT9v6hsj4C9/PbLQxIr+6hNFzsEcg=";
  };

  pythonRelaxDeps = [
@ -93,6 +96,7 @@ python3.pkgs.buildPythonApplication rec {
      '';

  passthru = {
+    updateScript = nix-update-script { };
    tests.version = testers.testVersion {
      package = commitizen;
      command = "cz version";
@ -104,6 +108,7 @@ python3.pkgs.buildPythonApplication rec {
    homepage = "https://github.com/commitizen-tools/commitizen";
    changelog = "https://github.com/commitizen-tools/commitizen/blob/v${version}/CHANGELOG.md";
    license = licenses.mit;
+    mainProgram = "cz";
    maintainers = with maintainers; [ lovesegfault anthonyroussel ];
  };
 }
--- a/pkgs/applications/version-management/git-mit/default.nix
+++ b/pkgs/applications/version-management/git-mit/default.nix
@ -10,7 +10,7 @@
 }:

 let
-  version = "5.12.149";
+  version = "5.12.152";
 in
 rustPlatform.buildRustPackage {
  pname = "git-mit";
@ -20,10 +20,10 @@ rustPlatform.buildRustPackage {
    owner = "PurpleBooth";
    repo = "git-mit";
    rev = "v${version}";
-    hash = "sha256-8e7tuNXgYT4wkTbxEz+Sqp0zVody0QC+yK8gcjR3Pww=";
+    hash = "sha256-FW7vstYJNJ29v3BNsyRFk57sW3jjA7aurXzz6je1nuo=";
  };

-  cargoHash = "sha256-V5c/UsNFWogCgyHSDwsOm2Nfsl/vBUClKQGmwzYqNz0=";
+  cargoHash = "sha256-FQmWAvSuif0/mTVl2xzI4JVLCxn7CXYubGdi55kk2Mk=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/applications/version-management/git-workspace/default.nix
+++ b/pkgs/applications/version-management/git-workspace/default.nix
@ -6,29 +6,33 @@
 , Security
 , pkg-config
 , openssl
+, nix-update-script
 , testers
 , git-workspace
 }:

 rustPlatform.buildRustPackage rec {
  pname = "git-workspace";
-  version = "1.2.1";
+  version = "1.3.0";

  src = fetchFromGitHub {
    owner = "orf";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Ppb42u31/iJd743vKX+5RdI7aITsWg9Jg0Aheguep5s=";
+    sha256 = "sha256-dtOYMZGBnFwas/k3yHSNnKlVwwLUOx7QseshJWY1X4o=";
  };

-  cargoSha256 = "sha256-O0wyNdgY1meEBJh/tEHxwzjNQdzxbKn5Ji+gdd146vQ=";
+  cargoSha256 = "sha256-4zqbNhR8A0yPD/qIJgP6049bUunAKRyGmlNmC3yPc5Q=";

  nativeBuildInputs = [ pkg-config ];

  buildInputs = [ openssl ]
    ++ lib.optionals stdenv.isDarwin [ libiconv Security ];

-  passthru.tests.version = testers.testVersion { package = git-workspace; };
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.version = testers.testVersion { package = git-workspace; };
+  };

  meta = with lib; {
    description = "Sync personal and work git repositories from multiple providers";
--- a/pkgs/applications/video/hypnotix/default.nix
+++ b/pkgs/applications/video/hypnotix/default.nix
@ -3,6 +3,7 @@
 , fetchFromGitHub
 , substituteAll
 , cinnamon
+, circle-flags
 , gettext
 , gobject-introspection
 , mpv
@ -31,6 +32,7 @@ stdenv.mkDerivation rec {
  postPatch = ''
    substituteInPlace usr/lib/hypnotix/hypnotix.py \
      --replace __DEB_VERSION__ ${version} \
+      --replace /usr/share/circle-flags-svg ${circle-flags}/share/circle-flags-svg \
      --replace /usr/share/hypnotix $out/share/hypnotix
  '';

--- a/pkgs/build-support/appimage/default.nix
+++ b/pkgs/build-support/appimage/default.nix
@ -206,6 +206,7 @@ rec {
      libtool.lib # for Synfigstudio
      xorg.libxshmfence # for apple-music-electron
      at-spi2-core
+      pciutils # for FreeCAD
    ];
  };
 }
--- a/pkgs/build-support/ocaml/topkg.nix
+++ b/pkgs/build-support/ocaml/topkg.nix
@ -0,0 +1,28 @@
+{ lib, stdenv, fetchurl, ocaml, findlib, topkg, ocamlbuild, cmdliner, odoc, b0
+}:
+
+{ pname, version, nativeBuildInputs ? [ ], buildInputs ? [ ], ... }@args:
+
+lib.throwIf (args ? minimalOCamlVersion
+  && lib.versionOlder ocaml.version args.minimalOCamlVersion)
+"${pname}-${version} is not available for OCaml ${ocaml.version}"
+
+stdenv.mkDerivation ({
+
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [ ];
+  strictDeps = true;
+  inherit (topkg) buildPhase installPhase;
+
+} // (builtins.removeAttrs args [ "minimalOCamlVersion" ]) // {
+
+  name = "ocaml${ocaml.version}-${pname}-${version}";
+
+  nativeBuildInputs = [ ocaml findlib ocamlbuild topkg ] ++ nativeBuildInputs;
+  buildInputs = [ topkg ] ++ buildInputs;
+
+  meta = (args.meta or { }) // {
+    platforms = args.meta.platforms or ocaml.meta.platforms;
+  };
+
+})
--- a/pkgs/by-name/ci/circle-flags/package.nix
+++ b/pkgs/by-name/ci/circle-flags/package.nix
@ -0,0 +1,36 @@
+{ stdenvNoCC
+, lib
+, fetchFromGitHub
+, nix-update-script
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "circle-flags";
+  version = "2.7.0";
+
+  src = fetchFromGitHub {
+    owner = "HatScripts";
+    repo = "circle-flags";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-/+f5MDRW+tRH+jMtl3XuVPBShgy2PlD3NY+74mJa2Qk=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share
+    mv flags $out/share/circle-flags-svg
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = with lib; {
+    homepage = "https://github.com/HatScripts/circle-flags";
+    description = "Collection of 400+ minimal circular SVG country and state flags";
+    license = licenses.mit;
+    maintainers = with maintainers; [ bobby285271 ];
+    platforms = platforms.all;
+  };
+})
--- a/pkgs/data/fonts/unifont/default.nix
+++ b/pkgs/data/fonts/unifont/default.nix
@ -4,16 +4,16 @@

 stdenv.mkDerivation rec {
  pname = "unifont";
-  version = "15.1.01";
+  version = "15.1.02";

  otf = fetchurl {
    url = "mirror://gnu/unifont/${pname}-${version}/${pname}-${version}.otf";
-    hash = "sha256-JJi4D5Zk/vkeaYjX4IIUaiCCp+e7Si3rL7+aNlqilww=";
+    hash = "sha256-fmhm74zc6wJK2f5XkDq/BRc5Lv+rCvcDRodgHCSiUQA=";
  };

  pcf = fetchurl {
    url = "mirror://gnu/unifont/${pname}-${version}/${pname}-${version}.pcf.gz";
-    hash = "sha256-8ggUx6X1kwwd2qGl/XcqxkN35kaJbQYxoCMGIV0N6zU=";
+    hash = "sha256-cCDXjSbpCe1U+Fx/xH/9NXWg6bkdRBV5AawFR0NyOHM=";
  };

  nativeBuildInputs = [ libfaketime xorg.fonttosfnt xorg.mkfontscale ];
--- a/pkgs/data/fonts/unifont_upper/default.nix
+++ b/pkgs/data/fonts/unifont_upper/default.nix
@ -2,11 +2,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "unifont_upper";
-  version = "15.1.01";
+  version = "15.1.02";

  src = fetchurl {
    url = "mirror://gnu/unifont/unifont-${version}/${pname}-${version}.otf";
-    hash = "sha256-+aSVF8taBuAmkrQDvCH5bqdnEo21LwidMSYaiWjTrOg=";
+    hash = "sha256-OTIwWA2p+7ldqEB5O6J18zU5RVoswC0t1G72fFeCKpU=";
  };

  dontUnpack = true;
--- a/pkgs/development/embedded/svdtools/default.nix
+++ b/pkgs/development/embedded/svdtools/default.nix
@ -5,14 +5,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "svdtools";
-  version = "0.3.0";
+  version = "0.3.1";

  src = fetchCrate {
    inherit version pname;
-    hash = "sha256-B+G2HIGbuKeiys3bLR2U+P40TD8YpqzAb4oENNb8gYg=";
+    hash = "sha256-oj09Huy38Nf7L6SSM5CIq2rzATrFB5FcTntXqB2dZHE=";
  };

-  cargoHash = "sha256-W6/LZE98V1teiv9Wp9tsIqlY18MoMiNZ+fqTJ567xrg=";
+  cargoHash = "sha256-lZk8QChDLfhv3iB0INGKgS5tM/ETdpdUpbq6egPS1uI=";

  meta = with lib; {
    description = "Tools to handle vendor-supplied, often buggy SVD files";
--- a/pkgs/development/libraries/boringssl/default.nix
+++ b/pkgs/development/libraries/boringssl/default.nix
@ -10,17 +10,18 @@
 # reference: https://boringssl.googlesource.com/boringssl/+/2661/BUILDING.md
 buildGoModule {
  pname = "boringssl";
-  version = "2021-07-09";
+  version = "unstable-2023-09-27";

  src = fetchgit {
-    url    = "https://boringssl.googlesource.com/boringssl";
-    rev    = "268a4a6ff3bd656ae65fe41ef1185daa85cfae21";
-    sha256 = "04fja4fdwhc69clmvg8i12zm6ks3sfl3r8i5bxn4x63b9dj5znlx";
+    url = "https://boringssl.googlesource.com/boringssl";
+    rev = "d24a38200fef19150eef00cad35b138936c08767";
+    hash = "sha256-FBQ7y4N2rCM/Cyd6LBnDUXpSa2O3osUXukECTBjZL6s=";
  };

  nativeBuildInputs = [ cmake ninja perl ];

-  vendorHash = null;
+  vendorHash = "sha256-EJPcx07WuvHPAgiS1ASU6WHlHkxjUOO72if4TkmrqwY=";
+  proxyVendor = true;

  # hack to get both go and cmake configure phase
  # (if we use postConfigure then cmake will loop runHook postConfigure)
--- a/pkgs/development/libraries/capnproto/default.nix
+++ b/pkgs/development/libraries/capnproto/default.nix
@ -8,14 +8,14 @@

 stdenv.mkDerivation rec {
  pname = "capnproto";
-  version = "0.10.4";
+  version = "1.0.1";

  # release tarballs are missing some ekam rules
  src = fetchFromGitHub {
    owner = "capnproto";
    repo = "capnproto";
    rev = "v${version}";
-    sha256 = "sha256-45sxnVyyYIw9i3sbFZ1naBMoUzkpP21WarzR5crg4X8=";
+    sha256 = "sha256-ZruJikcMZuUBmNq+f6+wUl4Rr6MVFxmgcj1TSOKM1ZE=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/drogon/default.nix
+++ b/pkgs/development/libraries/drogon/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "drogon";
-  version = "1.8.6";
+  version = "1.8.7";

  src = fetchFromGitHub {
    owner = "drogonframework";
    repo = "drogon";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-BYZoMesDquXaphZvnf2Vd/RuOC9jsOjZsGNbDmQ3u+c=";
+    sha256 = "sha256-lKV4dRIIkCn/qW8DyqDRHADh0tW0/ocf/29ox9aC0Yo=";
    fetchSubmodules = true;
  };

--- a/pkgs/development/libraries/mongoc/default.nix
+++ b/pkgs/development/libraries/mongoc/default.nix
@ -14,13 +14,13 @@

 stdenv.mkDerivation rec {
  pname = "mongoc";
-  version = "1.24.3";
+  version = "1.24.4";

  src = fetchFromGitHub {
    owner = "mongodb";
    repo = "mongo-c-driver";
    rev = "refs/tags/${version}";
-    hash = "sha256-zEIdK994aebLeKe4g6/ByWvaoGNBB0ODXRpczrCEkB8=";
+    hash = "sha256-cOPZ4o9q/cOBtGXFv6mOenTSyU/L2U6DZB4UmMnhtes=";
  };

  postPatch = ''
--- a/pkgs/development/ocaml-modules/b0/default.nix
+++ b/pkgs/development/ocaml-modules/b0/default.nix
@ -0,0 +1,46 @@
+{ lib, stdenv, fetchurl, ocaml, findlib, topkg, ocamlbuild, cmdliner }:
+
+let
+
+in lib.throwIfNot (lib.versionAtLeast ocaml.version "4.08")
+"b0 is not available for OCaml ${ocaml.version}"
+
+stdenv.mkDerivation rec {
+
+  pname = "ocaml${ocaml.version}-b0";
+  version = "0.0.5";
+
+  src = fetchurl {
+    url = "${meta.homepage}/releases/b0-${version}.tbz";
+    sha256 = "sha256-ty04JQcP4RCme/VQw0ko2IBebWWX5cBU6nRTTeV1I/I=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ ocaml findlib ocamlbuild topkg ];
+  buildInputs = [ topkg cmdliner ];
+
+  inherit (topkg) buildPhase installPhase;
+
+  meta = with lib; {
+    description = "Software construction and deployment kit";
+    longDescription = ''
+      WARNING this package is unstable and work in progress, do not depend on
+      it.
+      B0 describes software construction and deployments using modular and
+      customizable definitions written in OCaml. B0 describes:
+      * Build environments.
+      * Software configuration, build and testing.
+      * Source and binary deployments.
+      * Software life-cycle procedures.
+      B0 also provides the B00 build library which provides abitrary build
+      abstraction with reliable and efficient incremental rebuilds. The B00
+      library can be – and has been – used on its own to devise domain specific
+      build systems.
+    '';
+    homepage = "https://erratique.ch/software/b0";
+    inherit (ocaml.meta) platforms;
+    license = licenses.isc;
+    maintainers = [ maintainers.Julow ];
+  };
+}
--- a/pkgs/development/ocaml-modules/odig/default.nix
+++ b/pkgs/development/ocaml-modules/odig/default.nix
@ -0,0 +1,25 @@
+{ lib, stdenv, fetchurl, buildTopkgPackage, cmdliner, odoc, b0 }:
+
+buildTopkgPackage rec {
+  pname = "odig";
+  version = "0.0.9";
+
+  src = fetchurl {
+    url = "${meta.homepage}/releases/odig-${version}.tbz";
+    sha256 = "sha256-sYKvGYkxeF5FmrNQdOyMAtlsJqhlmUESi9SkPn/cjM4=";
+  };
+
+  buildInputs = [ cmdliner odoc b0 ];
+
+  meta = with lib; {
+    description = "Lookup documentation of installed OCaml packages";
+    longDescription = ''
+      odig is a command line tool to lookup documentation of installed OCaml
+      packages. It shows package metadata, readmes, change logs, licenses,
+      cross-referenced `odoc` API documentation and manuals.
+    '';
+    homepage = "https://erratique.ch/software/odig";
+    license = licenses.isc;
+    maintainers = [ maintainers.Julow ];
+  };
+}
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "botocore-stubs";
-  version = "1.31.55";
+  version = "1.31.56";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -17,7 +17,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "botocore_stubs";
    inherit version;
-    hash = "sha256-51xyWEGm/a/+Kznr+JKCjOaQEy6+q1vjCnVoZB5+rhA=";
+    hash = "sha256-4VEL02Gs91XsrOQu6YQoGt/qb5ZpXtIqCKTO6r/mb18=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/edk2-pytool-library/default.nix
+++ b/pkgs/development/python-modules/edk2-pytool-library/default.nix
@ -14,14 +14,14 @@

 buildPythonPackage rec {
  pname = "edk2-pytool-library";
-  version = "0.18.0";
+  version = "0.18.1";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "tianocore";
    repo = "edk2-pytool-library";
    rev = "v${version}";
-    hash = "sha256-O7K439nAIHHTWSoR8mZWEu9sXcrhYfZto3RTgHZcOuA=";
+    hash = "sha256-Ps1gXeaatZ3wIPcJybpj5y9q5kpaiTc8IuEkGAV48OA=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/google-ai-generativelanguage/default.nix
+++ b/pkgs/development/python-modules/google-ai-generativelanguage/default.nix
@ -15,14 +15,14 @@

 buildPythonPackage rec {
  pname = "google-ai-generativelanguage";
-  version = "0.3.2";
+  version = "0.3.3";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-PkQpWHUzvTnv7Ky+cRSHzaXTwh2rDvD0qq53tbxPBME=";
+    hash = "sha256-S1mZPg/WNZMXHLsInn929xpDM6YnQdOSkVmusuNTKoM=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "hahomematic";
-  version = "2023.9.3";
+  version = "2023.9.5";
  format = "pyproject";

  disabled = pythonOlder "3.11";
@ -26,9 +26,15 @@ buildPythonPackage rec {
    owner = "danielperna84";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-j8uM/vEfZO1C4jsYU68nTt/cmhRKsW2MTFG84g53vE4=";
+    hash = "sha256-bs9rAlEgRYjQ2vEPfGxWo4sAn48hiC3IFh9VKVY33KY=";
  };

+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "setuptools~=68.2" "setuptools" \
+      --replace "wheel~=0.41.2" "wheel"
+  '';
+
  nativeBuildInputs = [
    setuptools
    wheel
--- a/pkgs/development/python-modules/podman/default.nix
+++ b/pkgs/development/python-modules/podman/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "podman";
-  version = "4.6.0";
+  version = "4.7.0";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "containers";
    repo = "podman-py";
    rev = "refs/tags/v${version}";
-    hash = "sha256-76mLgkQgYbm04bj1VX7SC/kW8JEbYjbK3x6Xb612wnk=";
+    hash = "sha256-0p3o1pTqD5Y2JmyLcGS/OCb3HmRu5iqeFqoPlwAkNfY=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/psychrolib/default.nix
+++ b/pkgs/development/python-modules/psychrolib/default.nix
@ -0,0 +1,43 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, setuptools
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "psychrolib";
+  version = "2.5.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "psychrometrics";
+    repo = "psychrolib";
+    rev = "refs/tags/${version}";
+    hash = "sha256-OkjoYIakF7NXluNTaJnUHk5cI5t8GnpqrbqHYwnLOts=";
+  };
+
+  sourceRoot = "${src.name}/src/python";
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "psychrolib"
+  ];
+
+  meta = with lib; {
+    description = "Library of psychrometric functions to calculate thermodynamic properties";
+    homepage = "https://github.com/psychrometrics/psychrolib";
+    changelog = "https://github.com/psychrometrics/psychrolib/releases/tag/${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/pyweatherflowudp/default.nix
+++ b/pkgs/development/python-modules/pyweatherflowudp/default.nix
@ -0,0 +1,62 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pint
+, poetry-core
+, psychrolib
+, pytest-asyncio
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "pyweatherflowudp";
+  version = "1.4.4";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "briis";
+    repo = "pyweatherflowudp";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-5WdkT4U/+uO9UUIxumrxCKZnK9MdQcvfaO9UfpmpxJE=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    pint
+    psychrolib
+  ];
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "pyweatherflowudp"
+  ];
+
+  disabledTests = [
+    # Tests require network access
+    "test_flow_control"
+    "test_listen_and_stop"
+    "test_repetitive_listen_and_stop"
+    "test_process_message"
+    "test_listener_connection_errors"
+    "test_invalid_messages"
+  ];
+
+  meta = with lib; {
+    description = "Library to receive UDP Packets from Weatherflow Weatherstations";
+    homepage = "https://github.com/briis/pyweatherflowudp";
+    changelog = "https://github.com/briis/pyweatherflowudp/blob/${version}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
+
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@ -22,14 +22,14 @@ with py.pkgs;

 buildPythonApplication rec {
  pname = "checkov";
-  version = "2.4.50";
+  version = "2.4.51";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "bridgecrewio";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-+Rzs5+girXp6UqlX+VrWfI4ZGn8u6ZMPxSpRh5Zl5LQ=";
+    hash = "sha256-Ln+3LY/O0f4eSWDLmrO9ONGFTxE0icdA3qdXrJ9PoO4=";
  };

  patches = [
--- a/pkgs/development/tools/analysis/codeql/default.nix
+++ b/pkgs/development/tools/analysis/codeql/default.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "codeql";
-  version = "2.14.3";
+  version = "2.14.5";

  dontConfigure = true;
  dontBuild = true;
@ -10,7 +10,7 @@ stdenv.mkDerivation rec {

  src = fetchzip {
    url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    sha256 = "sha256-GungnnWT4SoAGRmgFXooAwtha8hlEARNgUlqSrYHQ7o=";
+    sha256 = "sha256-axB3BmHmyBDHxBeiwxUpSnhXpdZHfvYQkae7oW1OSzg=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/tools/build-managers/mill/default.nix
+++ b/pkgs/development/tools/build-managers/mill/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "mill";
-  version = "0.11.2";
+  version = "0.11.4";

  src = fetchurl {
    url = "https://github.com/com-lihaoyi/mill/releases/download/${version}/${version}-assembly";
-    hash = "sha256-7RYMj/vfyzBQhZUpWzEaZYN27ZhYCRyKhQUhlH8tE0U=";
+    hash = "sha256-4X+ufTHECOmM797SN0VFAE8b9mnHkdOqSJ8h29PujLU=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/development/tools/espup/default.nix
+++ b/pkgs/development/tools/espup/default.nix
@ -9,7 +9,7 @@
 , zstd
 , stdenv
 , darwin
-, runCommand
+, testers
 , espup
 }:

@ -62,15 +62,8 @@ rustPlatform.buildRustPackage rec {
      --zsh <($out/bin/espup completions zsh)
  '';

-  passthru.tests = {
-    simple = runCommand "${pname}-test" { } ''
-      if [[ `${espup}/bin/espup --version` != *"${version}"*  ]]; then
-        echo "Error: program version does not match package version"
-        exit 1
-      fi
-
-      touch $out
-    '';
+  passthru.tests.version = testers.testVersion {
+    package = espup;
  };

  meta = with lib; {
@ -78,5 +71,6 @@ rustPlatform.buildRustPackage rec {
    homepage = "https://github.com/esp-rs/espup/";
    license = with licenses; [ mit asl20 ];
    maintainers = with maintainers; [ knightpp ];
+    mainProgram = "espup";
  };
 }
--- a/pkgs/development/tools/hclfmt/default.nix
+++ b/pkgs/development/tools/hclfmt/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "hclfmt";
-  version = "2.17.0";
+  version = "2.18.0";

  src = fetchFromGitHub {
    owner = "hashicorp";
    repo = "hcl";
    rev = "v${version}";
-    hash = "sha256-6OALbouj1b6Jbtv0znpkfgYS4MyBpxQ56Sen3OJYaHs=";
+    hash = "sha256-X2XHsw30rWRUJCNRGc+UKqmZGtl3dx3TLFtjtr63uVM=";
  };

-  vendorHash = "sha256-SjewF3q4vQ3oWR+vxqpZVP6St8db/GXezTDWYUeK2g8=";
+  vendorHash = "sha256-DA1IKaC+YSBzCfEMqHsHfwu1o5qvYFaFgDoGG0RZnoo=";

  # The code repository includes other tools which are not useful. Only build
  # hclfmt.
--- a/pkgs/development/tools/misc/one_gadget/Gemfile.lock
+++ b/pkgs/development/tools/misc/one_gadget/Gemfile.lock
@ -1,10 +1,10 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    bindata (2.4.4)
-    elftools (1.1.0)
+    bindata (2.4.15)
+    elftools (1.1.3)
      bindata (~> 2)
-    one_gadget (1.7.2)
+    one_gadget (1.8.1)
      elftools (>= 1.0.2, < 1.2.0)

 PLATFORMS
@ -14,4 +14,4 @@ DEPENDENCIES
  one_gadget

 BUNDLED WITH
-   2.1.4
+   2.4.19
--- a/pkgs/development/tools/misc/one_gadget/default.nix
+++ b/pkgs/development/tools/misc/one_gadget/default.nix
@ -1,10 +1,16 @@
-{ lib, bundlerApp, bundlerUpdateScript }:
+{ lib, binutils, bundlerApp, bundlerUpdateScript, makeWrapper }:

 bundlerApp {
  pname = "one_gadget";
  gemdir = ./.;
  exes = [ "one_gadget" ];

+  nativeBuildInputs = [ makeWrapper ];
+
+  postBuild = ''
+    wrapProgram $out/bin/one_gadget --prefix PATH : ${binutils}/bin
+  '';
+
  passthru.updateScript = bundlerUpdateScript "one_gadget";

  meta = with lib; {
--- a/pkgs/development/tools/misc/one_gadget/gemset.nix
+++ b/pkgs/development/tools/misc/one_gadget/gemset.nix
@ -4,10 +4,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0kz42nvxnk1j9cj0i8lcnhprcgdqsqska92g6l19ziadydfk2gqy";
+      sha256 = "04y4zgh4bbcb8wmkxwfqg4saky1d1f3xw8z6yk543q13h8ky8rz5";
      type = "gem";
    };
-    version = "2.4.4";
+    version = "2.4.15";
  };
  elftools = {
    dependencies = ["bindata"];
@ -15,10 +15,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0kdf0ck4rzxpd006y09rfwppdrqb3sxww4gzfpv2053yq4mkimbn";
+      sha256 = "0p96wj4sz3sfv9yxyl8z530554bkbf82vj24w6x7yf91qa1p8z6i";
      type = "gem";
    };
-    version = "1.1.0";
+    version = "1.1.3";
  };
  one_gadget = {
    dependencies = ["elftools"];
@ -26,9 +26,9 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "07s2nigjw1yik895gliz3a7ps0m9j5nccq82zwdd30sv740jmf5b";
+      sha256 = "0dwsmjhr9i8gwwbbpiyddbhcx74cvqqk90a5l8zbsjhjfs679irc";
      type = "gem";
    };
-    version = "1.7.2";
+    version = "1.8.1";
  };
 }
--- a/pkgs/development/tools/osslsigncode/default.nix
+++ b/pkgs/development/tools/osslsigncode/default.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "osslsigncode";
-  version = "2.6";
+  version = "2.7";

  src = fetchFromGitHub {
    owner = "mtrojnar";
    repo = pname;
    rev = version;
-    sha256 = "sha256-Lt99RO/pTEtksIuulkKTm48+1xUKZOHrnlbDZGi3VWk=";
+    sha256 = "sha256-TW4/alnAW3vifAKf02RlnpOq1uW7nc+Sjs0g1BfplLk=";
  };

  nativeBuildInputs = [ cmake pkg-config python3 ];
--- a/pkgs/development/tools/typos/default.nix
+++ b/pkgs/development/tools/typos/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "typos";
-  version = "1.16.14";
+  version = "1.16.15";

  src = fetchFromGitHub {
    owner = "crate-ci";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-GFr5YpXWSQLvsX2FWLwK5MuIXAhWJ1DjEqvqM3lGEMY=";
+    hash = "sha256-UniMMZVvhk1ImS5brgdiG162jl+W/V6UQ/Fvl9EopVc=";
  };

-  cargoHash = "sha256-M+WM8MxCbW1gh4IMyAsIP+Jtyuu35AUedF0TCzk67Fg=";
+  cargoHash = "sha256-SfcAQekGzE6H59czzbuc9BvHnm1N1SL5DxWva10zNgo=";

  meta = with lib; {
    description = "Source code spell checker";
--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "flyctl";
-  version = "0.1.101";
+  version = "0.1.102";

  src = fetchFromGitHub {
    owner = "superfly";
    repo = "flyctl";
    rev = "v${version}";
-    hash = "sha256-gXG8xgRF1AG/n4o2oDaYCVEOwjJLp6VMJ5LKPXu/gak=";
+    hash = "sha256-OIqAX/Cgh+jpHbjIg7wApTlKGChYx82oq8oUGguDsrE=";
  };

-  vendorHash = "sha256-RGA0tjvVo0uAFNqrEEYWejj0qwYxpiUZzExZHhMqItc=";
+  vendorHash = "sha256-XECl5evFO9ml28sILdWS2sQfNDf8ixsvQhiTShOcKKQ=";

  subPackages = [ "." ];

--- a/pkgs/development/web/function-runner/default.nix
+++ b/pkgs/development/web/function-runner/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "function-runner";
-  version = "3.6.0";
+  version = "4.0.0";

  src = fetchFromGitHub {
    owner = "Shopify";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-z03+3x1xGYSa+WVEuHBgUQ9NdqG3rCziNYcwTjWBNV8=";
+    sha256 = "sha256-cKlzv9mL6UGXHvYbQR4OcZgdjZLV5Q7EoQbW7Fx8ESo=";
  };

-  cargoHash = "sha256-4sgf7WfaX7jnV8YynZNLi/N8MfkuAc4tk/8eiKEyyxI=";
+  cargoHash = "sha256-/4/zaeNQ45YYBILxm11qD9rPFZxilA8kLoyWG370Knk=";

  meta = with lib; {
    description = "A CLI tool which allows you to run Wasm Functions intended for the Shopify Functions infrastructure";
--- a/pkgs/games/aaaaxy/default.nix
+++ b/pkgs/games/aaaaxy/default.nix
@ -19,17 +19,17 @@

 buildGoModule rec {
  pname = "aaaaxy";
-  version = "1.4.45";
+  version = "1.4.50";

  src = fetchFromGitHub {
    owner = "divVerent";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-93ffxzYSVumfk7J8K9Ma2WYWaGQLBIxSkds8OKzOCcw=";
+    hash = "sha256-J4SCmIwGlVD8MHs13NO3JFKfH1rvh2dgVV0/8BX9IcY=";
    fetchSubmodules = true;
  };

-  vendorHash = "sha256-wUH0ohccMjdeGpm9bcw8K7Ss0FZGXaPfxeJCKYkEhJ8=";
+  vendorHash = "sha256-dugSK/5mowBfRqnzI3sZqCm69E0WtX2Tydh6Q06+vLU=";

  buildInputs = [
    alsa-lib
--- a/pkgs/misc/vencord/default.nix
+++ b/pkgs/misc/vencord/default.nix
@ -6,8 +6,8 @@
 , buildWebExtension ? false
 }:
 let
-  version = "1.4.7";
-  gitHash = "25a1d93";
+  version = "1.5.3";
+  gitHash = "6227777";
 in
 buildNpmPackage rec {
  pname = "vencord";
@ -17,7 +17,7 @@ buildNpmPackage rec {
    owner = "Vendicated";
    repo = "Vencord";
    rev = "v${version}";
-    sha256 = "sha256-bSLPZJyBKws+6IE4YTgQTMau5yKpHJdq5tw6Jg1Uc/s=";
+    sha256 = "sha256-yRbFXjPJq0Ui7JW6YhlfnDf+YWyO5qzJTntEyFLVcVY=";
  };

  ESBUILD_BINARY_PATH = lib.getExe (esbuild.override {
@ -36,13 +36,15 @@ buildNpmPackage rec {
  # Supresses an error about esbuild's version.
  npmRebuildFlags = [ "|| true" ];

-  npmDepsHash = "sha256-GoVVOLg20oi0MJGLqevpiqHDM/7yaRJSQnM/tt+AkQ8=";
+  makeCacheWritable = true;
+  npmDepsHash = "sha256-/aEyvEmVCqKKgRvqoz7CSz17HTAxPMBBL47JsE3RcI4=";
  npmFlags = [ "--legacy-peer-deps" ];
  npmBuildScript = if buildWebExtension then "buildWeb" else "build";
  npmBuildFlags = [ "--" "--standalone" "--disable-updater" ];

  prePatch = ''
    cp ${./package-lock.json} ./package-lock.json
+    chmod +w ./package-lock.json
  '';

  VENCORD_HASH = gitHash;
--- a/pkgs/misc/vencord/package-lock.json
+++ b/pkgs/misc/vencord/package-lock.json
--- a/pkgs/os-specific/darwin/coconutbattery/default.nix
+++ b/pkgs/os-specific/darwin/coconutbattery/default.nix
@ -5,11 +5,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "coconutbattery";
-  version = "3.9.12";
+  version = "3.9.14";

  src = fetchzip {
    url = "https://coconut-flavour.com/downloads/coconutBattery_${builtins.replaceStrings [ "." ] [ "" ] finalAttrs.version}.zip";
-    hash = "sha256-8WxGjZbxUqchSIfvpK2RLifn7/TD5nau5hgMzLUiV2o=";
+    hash = "sha256-zKSPKwDBwxlyNJFurCLLGtba9gpizJCjOOAd81vdD5Q=";
  };

  dontPatch = true;
--- a/pkgs/os-specific/darwin/rectangle/default.nix
+++ b/pkgs/os-specific/darwin/rectangle/default.nix
@ -7,11 +7,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "rectangle";
-  version = "0.72";
+  version = "0.73";

  src = fetchurl {
    url = "https://github.com/rxhanson/Rectangle/releases/download/v${version}/Rectangle${version}.dmg";
-    hash = "sha256-fFJBlMtT9aTbo/XxwUsTlDxcvxqrjdqpk4OvEQXb3s0=";
+    hash = "sha256-D+heCrJVo2xsKY9XtEuhrG/59yFIJTGhKJIfN9Vhc+M=";
  };

  sourceRoot = ".";
--- a/pkgs/servers/gotosocial/default.nix
+++ b/pkgs/servers/gotosocial/default.nix
@ -9,11 +9,11 @@ let
  owner = "superseriousbusiness";
  repo = "gotosocial";

-  version = "0.11.0";
+  version = "0.11.1";

  web-assets = fetchurl {
    url = "https://github.com/${owner}/${repo}/releases/download/v${version}/${repo}_${version}_web-assets.tar.gz";
-    hash = "sha256-NK5m+ERZQtl5Stq2+bWw0LS2SbmlhEJDZjTTxYciemE=";
+    hash = "sha256-xPdSwsXjyjodgEHlwl4X32Pb6TniwM9Q+u56xAoY7SQ=";
  };
 in
 buildGoModule rec {
@ -23,7 +23,7 @@ buildGoModule rec {
  src = fetchFromGitHub {
    inherit owner repo;
    rev = "refs/tags/v${version}";
-    hash = "sha256-qbq5pDvG2L1s6BG+sh7eagcFNH/DWyANMQaAl2WcQzE=";
+    hash = "sha256-qsgrHPQae1+LKF2y6e256ZfYR+a9ffe7oq1W3GJA1do=";
  };

  vendorHash = null;
--- a/pkgs/servers/jackett/default.nix
+++ b/pkgs/servers/jackett/default.nix
@ -9,13 +9,13 @@

 buildDotnetModule rec {
  pname = "jackett";
-  version = "0.21.904";
+  version = "0.21.932";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    hash = "sha512-h1cvAENQOWale6f2wVepHp/qNLY32n89mWNnSiGWETCBgMUe2nozq5BzqQcy34WHb5oZBmj/xpV9/P7QkBexPw==";
+    hash = "sha512-aGuaOLx43P2GzH1BYhLYd9wkkEhuDBH7bdtXlC2kgxcS5GCbn8pVro4VYVxkzh1P3WxpkMoD8A5bDPCHBebX4w==";
  };

  projectFile = "src/Jackett.Server/Jackett.Server.csproj";
--- a/pkgs/servers/mastodon/update.sh
+++ b/pkgs/servers/mastodon/update.sh
@ -77,7 +77,7 @@ trap cleanup EXIT

 echo "Fetching source code $REVISION"
 JSON=$(nix-prefetch-github "$OWNER" "$REPO" --rev "$REVISION" 2> $WORK_DIR/nix-prefetch-git.out)
-HASH="$(echo "$JSON" | jq -r .sha256)"
+HASH="$(echo "$JSON" | jq -r .hash)"
 HASH="$(nix hash to-sri --type sha256 "$HASH")"

 echo "Creating version.nix"
--- a/pkgs/servers/matrix-synapse/sliding-sync/default.nix
+++ b/pkgs/servers/matrix-synapse/sliding-sync/default.nix
@ -31,7 +31,7 @@ buildGoModule rec {
    description = "A sliding sync implementation of MSC3575 for matrix";
    homepage = "https://github.com/matrix-org/sliding-sync";
    license = with licenses; [ asl20 ];
-    maintainers = with maintainers; [ emilylange ];
+    maintainers = with maintainers; [ emilylange yayayayaka ];
    mainProgram = "syncv3";
  };
 }
--- a/pkgs/servers/readarr/default.nix
+++ b/pkgs/servers/readarr/default.nix
@ -8,13 +8,13 @@ let
    x86_64-darwin = "x64";
  }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  hash = {
-    x64-linux_hash = "sha256-CkbgY/ZP9Eh+Ivxk/BEZFuurBpoxM5tpdn0ul2oFIgU=";
-    arm64-linux_hash = "sha256-EXiWRfrsazHhZwMS08Ol0vA9N+Gho5x/03xbqOm5OQ0=";
-    x64-osx_hash = "sha256-/LaoVBlvl0c3SfPoaV089UNcy7eIUIzLl/whyN3n8vc=";
+    x64-linux_hash = "sha256-H48WjqRAG7I+IPhCANuJ137IwCXkTa5vrfh5Wm4tOyE=";
+    arm64-linux_hash = "sha256-lBclZfdYuI/ICgEpnekxNdMB6lvsJfK6Wzf/mMmtafU=";
+    x64-osx_hash = "sha256-1UUK0xU0WdLMjkbIEWVqpwa74tir9CkTSq63uqq9ygY=";
  }."${arch}-${os}_hash";
 in stdenv.mkDerivation rec {
  pname = "readarr";
-  version = "0.3.5.2217";
+  version = "0.3.6.2232";

  src = fetchurl {
    url = "https://github.com/Readarr/Readarr/releases/download/v${version}/Readarr.develop.${version}.${os}-core-${arch}.tar.gz";
--- a/pkgs/servers/tailscale/default.nix
+++ b/pkgs/servers/tailscale/default.nix
@ -1,7 +1,7 @@
 { lib, stdenv, buildGoModule, fetchFromGitHub, makeWrapper, iptables, iproute2, procps, shadow, getent }:

 let
-  version = "1.48.2";
+  version = "1.50.0";
 in
 buildGoModule {
  pname = "tailscale";
@ -11,9 +11,9 @@ buildGoModule {
    owner = "tailscale";
    repo = "tailscale";
    rev = "v${version}";
-    hash = "sha256-5Usi7W4y6JniyxBIfQid1XjDIZRS5oIw+KUMMiFRBwk=";
+    hash = "sha256-twHQVZ7ahlyQEhFyHm4vaBSilWUmSa29LjOX5oD9U6M=";
  };
-  vendorHash = "sha256-Fr4VZcKrXnT1PZuEG110KBefjcZzRsQRBSvByELKAy4=";
+  vendorHash = "sha256-aVtlDzC+sbEWlUAzPkAryA/+dqSzoAFc02xikh6yhf8=";

  nativeBuildInputs = lib.optionals stdenv.isLinux [ makeWrapper ];

--- a/pkgs/servers/web-apps/engelsystem/default.nix
+++ b/pkgs/servers/web-apps/engelsystem/default.nix
@ -6,11 +6,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "engelsystem";
-  version = "3.3.0";
+  version = "3.4.0";

  src = fetchzip {
    url = "https://github.com/engelsystem/engelsystem/releases/download/v${version}/engelsystem-v${version}.zip";
-    hash = "sha256-DS0klm26udXsiiFToeOJooA1WUR8gk0qf/UJL8E77ps=";
+    hash = "sha256-Z0p+6QlMrj5OtiwFKBfWxkkd/kbL2dxDSKvljcTXWo0=";
  };

  buildInputs = [ phpExt ];
--- a/pkgs/servers/web-apps/lemmy/ui.nix
+++ b/pkgs/servers/web-apps/lemmy/ui.nix
@ -24,7 +24,7 @@ let
      '';
    };
    sharp = {
-      nativeBuildInputs = [ pkg-config nodePackages.semver ];
+      nativeBuildInputs = [ pkg-config nodePackages.node-gyp nodePackages.semver ];
      buildInputs = [ vips ];
      postInstall = ''
        yarn --offline run install
--- a/pkgs/shells/fish/plugins/done.nix
+++ b/pkgs/shells/fish/plugins/done.nix
@ -2,13 +2,13 @@

 buildFishPlugin rec {
  pname = "done";
-  version = "1.16.5";
+  version = "1.17.0";

  src = fetchFromGitHub {
    owner = "franciscolourenco";
    repo = "done";
    rev = version;
-    sha256 = "E0wveeDw1VzEH2kzn63q9hy1xkccfxQHBV2gVpu2IdQ=";
+    hash = "sha256-H+PVoZZ0JdGPcQBib600dzaymlU6rPCSEi8VZXyi/Xc=";
  };

  checkPlugins = [ fishtape ];
--- a/pkgs/tools/admin/ansible/lint.nix
+++ b/pkgs/tools/admin/ansible/lint.nix
@ -6,12 +6,12 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "ansible-lint";
-  version = "6.19.0";
+  version = "6.20.0";
  format = "pyproject";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-JsOqEkljatkIRJ7yBL4KBDpa8R6jvUWUnI5KaA8hfn4=";
+    hash = "sha256-7BO/LrZUd/Rkq468YiNVKr/mjLP2WD3JEdhGAP0ZGts=";
  };

  postPatch = ''
--- a/pkgs/tools/admin/exoscale-cli/default.nix
+++ b/pkgs/tools/admin/exoscale-cli/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "exoscale-cli";
-  version = "1.72.2";
+  version = "1.73.0";

  src = fetchFromGitHub {
    owner = "exoscale";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "sha256-EUHjkhorfqRPStwThO5rdBVtl+NltEv18Bno4zu+5Us=";
+    sha256 = "sha256-46NRA+5SOJ451jF0KlTWu4STiTmRD1BjL3iQcGjdu2c=";
  };

  vendorHash = null;
--- a/pkgs/tools/misc/phrase-cli/default.nix
+++ b/pkgs/tools/misc/phrase-cli/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "phrase-cli";
-  version = "2.11.0";
+  version = "2.12.0";

  src = fetchFromGitHub {
    owner = "phrase";
    repo = "phrase-cli";
    rev = version;
-    sha256 = "sha256-8LhXsrO0sXMu7cXNoLafwNgCO99zGcQBYcCmqJfM2KY=";
+    sha256 = "sha256-VGuVDlIn0SnE3ZHcYbfQ0lWESf0tEyb6CTk8G8jnRlg=";
  };

-  vendorHash = "sha256-lbJetTERQKnDKmM1VqRWU0OjZPm+bfeQ9ZThs/TzxIU=";
+  vendorHash = "sha256-YzOPt02zbgT0wglWGEkUiDJhSNQnzazPs5nnNFDI0+g=";

  ldflags = [ "-X=github.com/phrase/phrase-cli/cmd.PHRASE_CLIENT_VERSION=${version}" ];

@ -22,6 +22,7 @@ buildGoModule rec {
  meta = with lib; {
    homepage = "http://docs.phraseapp.com";
    description = "PhraseApp API v2 Command Line Client";
+    changelog = "https://github.com/phrase/phrase-cli/blob/${version}/CHANGELOG.md";
    license = licenses.mit;
    maintainers = with maintainers; [ juboba ];
  };
--- a/pkgs/tools/misc/twm/default.nix
+++ b/pkgs/tools/misc/twm/default.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "twm";
-  version = "0.6.0";
+  version = "0.7.0";

  src = fetchFromGitHub {
    owner = "vinnymeller";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-OUaT/JMh4JgFbzIYlU34EN7gxEydNKBXSLJfYKOeck4=";
+    sha256 = "sha256-Q8WdNmO5uSm4PvitBXQ7YEkjJhlCz4qfJO/F6+XckXY=";
  };

-  cargoHash = "sha256-VGbY3QRkO4znEGs2daUhpDeNntONwvGeUg1ryFyWmjE=";
+  cargoHash = "sha256-fxDUUfC7mBgVHN+M6pb5leRp28wzO69ZdStdYmQFxQE=";

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security ];
--- a/pkgs/tools/misc/twspace-crawler/default.nix
+++ b/pkgs/tools/misc/twspace-crawler/default.nix
@ -2,16 +2,16 @@

 buildNpmPackage rec {
  pname = "twspace-crawler";
-  version = "1.12.8";
+  version = "1.12.9";

  src = fetchFromGitHub {
    owner = "HitomaruKonpaku";
    repo = "twspace-crawler";
-    rev = "3909facc10fe0308d425b609675919e1b9d1b06e"; # version not tagged
-    hash = "sha256-qAkrNWy7ofT2klgxU4lbZNfiPvF9gLpgkhaTW1xMcAc=";
+    rev = "7875e534b257d4ba5a0cf8179a4772c87005fee6"; # version not tagged
+    hash = "sha256-pA31ak0Rwy4Rc1fVz+4QV1lcTYGUmPOd61FtLQGN1ek=";
  };

-  npmDepsHash = "sha256-m0xszerBSx6Ovs/S55lT4CqPRls7aSw4bjONV7BZ8xE=";
+  npmDepsHash = "sha256-2fsYeSZYzadLmikUJbuHE4XMAp38jTZvtRo9xgaZVzg=";

  meta = with lib; {
    description = "Script to monitor & download Twitter Spaces 24/7";
--- a/pkgs/tools/networking/clash-meta/default.nix
+++ b/pkgs/tools/networking/clash-meta/default.nix
@ -10,7 +10,7 @@ buildGoModule rec {
    owner = "MetaCubeX";
    repo = "Clash.Meta";
    rev = "v${version}";
-    hash = "sha256-N7uCvzKBqOWYBfY1FBS9TjuHUfoKeMJF6o4k8C3f4z4=";
+    hash = "sha256-ORyjCYf2OPrSt/juiBk0Gf2Az4XoZipKBWWFXf8nIqE=";
  };

  vendorHash = "sha256-ySCmHLuMTCxBcAYo7YD8zOpUAa90PQmeLLt+uOn40Pk=";
--- a/pkgs/tools/networking/flannel/default.nix
+++ b/pkgs/tools/networking/flannel/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "flannel";
-  version = "0.22.2";
+  version = "0.22.3";
  rev = "v${version}";

-  vendorHash = "sha256-sObAXI9U5U1JXWNzaBNNGfklnfh/G3aUye/MINWwU4s=";
+  vendorHash = "sha256-2P9gEbItK7rCtveXIZkFMcvppjK4GLzTSoLrkMPeCig=";

  src = fetchFromGitHub {
    inherit rev;
    owner = "flannel-io";
    repo = "flannel";
-    sha256 = "sha256-ZQyBPsYIOQq6oonn661sIBpccV9uxoXlieOhbIIv5AE=";
+    sha256 = "sha256-sO3iFs6pAmnqpc9+hxx2WZQWOP37/4XS1m5U4nerVLI=";
  };

  ldflags = [ "-X github.com/flannel-io/flannel/pkg/version.Version=${rev}" ];
--- a/pkgs/tools/networking/sing-box/default.nix
+++ b/pkgs/tools/networking/sing-box/default.nix
@ -11,16 +11,16 @@

 buildGoModule rec {
  pname = "sing-box";
-  version = "1.4.5";
+  version = "1.4.6";

  src = fetchFromGitHub {
    owner = "SagerNet";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-Tb+4k0fwb22gif4SSNDmIBDq346CinhyqxwE0fhkXq4=";
+    hash = "sha256-8T/jcf8t0VtM1/o3rDsuUVElpUVwPPu7Omv985SILQY=";
  };

-  vendorHash = "sha256-EZ+ehh/FuQWNHqfXWMoSI+z9+OKDTVzRn51CYR/ezZw=";
+  vendorHash = "sha256-e211xmxU8cmx5f8cDvzSg7l8ljvbLv5Dw+sWy35oEiM=";

  tags = [
    "with_quic"
--- a/pkgs/tools/text/hcledit/default.nix
+++ b/pkgs/tools/text/hcledit/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "hcledit";
-  version = "0.2.9";
+  version = "0.2.10";

  src = fetchFromGitHub {
    owner = "minamijoyo";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-9FxQ/Y2vMyc4gLbKjhts36wtBIt90gkQZ9LQ3FO/Jig=";
+    hash = "sha256-rXmbRbM6U1JtV3t8C0LlLAdYpxd4UjxrbrPVHdqiCJ8=";
  };

-  vendorHash = "sha256-HWwZd5AUo1cysT4WYylQ2+JPBBr/qYNVC4JcJyUiBag=";
+  vendorHash = "sha256-9ND/vDPDn3rn213Jn1UPMmYAkMI86gYx9QLcV/oFGh4=";

  meta = with lib; {
    description = "A command line editor for HCL";
--- a/pkgs/tools/virtualization/mkosi/default.nix
+++ b/pkgs/tools/virtualization/mkosi/default.nix
@ -1,44 +1,84 @@
 { lib
 , fetchFromGitHub
+, fetchpatch
+, stdenv
+, python3
+, bubblewrap
+, systemd
+
+  # Python packages
 , setuptools
 , setuptools-scm
 , wheel
 , buildPythonApplication
 , pytestCheckHook
-, bubblewrap
-, systemd
-, stdenv
+, pefile
+
+  # Optional dependencies
+, withQemu ? false
+, qemu
+, OVMF
 }:
 let
  # For systemd features used by mkosi, see
  # https://github.com/systemd/mkosi/blob/19bb5e274d9a9c23891905c4bcbb8f68955a701d/action.yaml#L64-L72
-  systemdForMkosi = systemd.override {
-    # Will be added in #243242
-    # withRepart = true;
-    # withBootloader = true;
+  systemdForMkosi = (systemd.overrideAttrs (oldAttrs: {
+    patches = oldAttrs.patches ++ [
+      # Enable setting a deterministic verity seed for systemd-repart. Remove when upgrading to systemd 255.
+      (fetchpatch {
+        url = "https://github.com/systemd/systemd/commit/81e04781106e3db24e9cf63c1d5fdd8215dc3f42.patch";
+        hash = "sha256-KO3poIsvdeepPmXWQXNaJJCPpmBb4sVmO+ur4om9f5k=";
+      })
+      # Propagate SOURCE_DATE_EPOCH to mcopy. Remove when upgrading to systemd 255.
+      (fetchpatch {
+        url = "https://github.com/systemd/systemd/commit/4947de275a5553399854cc748f4f13e4ae2ba069.patch";
+        hash = "sha256-YIZZyc3f8pQO9fMAxiNhDdV8TtL4pXoh+hwHBzRWtfo=";
+      })
+    ];
+  })).override {
+    withRepart = true;
+    withBootloader = true;
+    withSysusers = true;
+    withFirstboot = true;
    withEfi = true;
    withUkify = true;
  };
+
+  python3pefile = python3.withPackages (ps: with ps; [
+    pefile
+  ]);
 in
 buildPythonApplication rec {
  pname = "mkosi";
-  version = "15.2-pre"; # 15.1 is the latest release, but we require a newer commit
+  version = "17.1";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "systemd";
    repo = "mkosi";
-    # Fix from the commit is needed to run on NixOS,
-    # see https://github.com/systemd/mkosi/issues/1792
-    rev = "ca9673cbcbd9f293e5566cec4a1ba14bbcd075b8";
-    hash = "sha256-y5gG/g33HBpH1pTXfjHae25bc5p/BvlCm9QxOIYtcA8=";
+    rev = "v${version}";
+    hash = "sha256-v6so6MFOkxPOnPDgAgni517NX4vUnkPd7o4UMSUHL24=";
  };

+  patches = [
+    (fetchpatch {
+      # Fix tests. Remove in next release.
+      url = "https://github.com/systemd/mkosi/commit/3e2642c743b2ccb78fd0a99e75993824034f7124.patch";
+      hash = "sha256-x9xb8Pz7l2FA8pfhQd7KqITxbnjjwBUh0676uggcukI=";
+    })
+  ];
+
  # Fix ctypes finding library
  # https://github.com/NixOS/nixpkgs/issues/7307
-  patchPhase = lib.optionalString stdenv.isLinux ''
-    substituteInPlace mkosi/run.py --replace \
-      'ctypes.util.find_library("c")' "'${stdenv.cc.libc}/lib/libc.so.6'"
+  postPatch = lib.optionalString stdenv.isLinux ''
+    substituteInPlace mkosi/run.py \
+      --replace 'ctypes.util.find_library("c")' "'${stdenv.cc.libc}/lib/libc.so.6'"
+    substituteInPlace mkosi/__init__.py \
+      --replace '/usr/lib/systemd/ukify' "${systemdForMkosi}/lib/systemd/ukify"
+  '' + lib.optionalString withQemu ''
+    substituteInPlace mkosi/qemu.py \
+      --replace '/usr/share/ovmf/x64/OVMF_VARS.fd' "${OVMF.variables}" \
+      --replace '/usr/share/ovmf/x64/OVMF_CODE.fd' "${OVMF.firmware}"
  '';

  nativeBuildInputs = [
@ -47,9 +87,15 @@ buildPythonApplication rec {
    wheel
  ];

+  makeWrapperArgs = [
+    "--set MKOSI_INTERPRETER ${python3pefile}/bin/python3"
+  ];
+
  propagatedBuildInputs = [
    systemdForMkosi
    bubblewrap
+  ] ++ lib.optional withQemu [
+    qemu
  ];

  postInstall = ''
@ -64,6 +110,7 @@ buildPythonApplication rec {
  meta = with lib; {
    description = "Build legacy-free OS images";
    homepage = "https://github.com/systemd/mkosi";
+    changelog = "https://github.com/systemd/mkosi/releases/tag/v${version}";
    license = licenses.lgpl21Only;
    mainProgram = "mkosi";
    maintainers = with maintainers; [ malt3 katexochen ];
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -1914,6 +1914,8 @@ with pkgs;

  mkosi = python3Packages.callPackage ../tools/virtualization/mkosi { inherit systemd; };

+  mkosi-full = mkosi.override { withQemu = true; };
+
  monica = callPackage ../servers/web-apps/monica { };

  mpremote = python3Packages.callPackage ../tools/misc/mpremote { };
@ -16863,6 +16865,8 @@ with pkgs;
    ocamlformat_0_22_4 ocamlformat_0_23_0 ocamlformat_0_24_1 ocamlformat_0_25_1
    ocamlformat_0_26_0;

+  inherit (ocamlPackages) odig;
+
  orc = callPackage ../development/compilers/orc { };

  orocos-kdl = callPackage ../development/libraries/orocos-kdl { };
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@ -60,6 +60,8 @@ let

    ### B ###

+    b0 = callPackage ../development/ocaml-modules/b0 { };
+
    bap = janeStreet_0_15.bap;

    base64 = callPackage ../development/ocaml-modules/base64 { };
@ -1330,6 +1332,8 @@ let

    odate = callPackage ../development/ocaml-modules/odate { };

+    odig = callPackage ../development/ocaml-modules/odig { };
+
    odoc = callPackage ../development/ocaml-modules/odoc { };

    odoc-parser = callPackage ../development/ocaml-modules/odoc-parser { };
@ -1888,6 +1892,8 @@ let

    buildOasisPackage = callPackage ../build-support/ocaml/oasis.nix { };

+    buildTopkgPackage = callPackage ../build-support/ocaml/topkg.nix { };
+
    # Apps from all-packages, to be eventually removed

    google-drive-ocamlfuse = callPackage ../applications/networking/google-drive-ocamlfuse { };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -8755,6 +8755,8 @@ self: super: with self; {

  psutil-home-assistant = callPackage ../development/python-modules/psutil-home-assistant { };

+  psychrolib = callPackage ../development/python-modules/psychrolib { };
+
  psycopg = callPackage ../development/python-modules/psycopg { };

  psycopg2 = callPackage ../development/python-modules/psycopg2 { };
@ -10935,6 +10937,8 @@ self: super: with self; {

  pyweatherflowrest = callPackage ../development/python-modules/pyweatherflowrest { };

+  pyweatherflowudp = callPackage ../development/python-modules/pyweatherflowudp { };
+
  pywebpush = callPackage ../development/python-modules/pywebpush { };

  pywebview = callPackage ../development/python-modules/pywebview { };