Merge staging-next into staging

2024-11-25 08:23:09 +00:00 · 2024-11-17 18:04:29 +00:00 · 2024-11-17 18:04:29 +00:00 · 8531fec3b9
commit 8531fec3b9
parent a2f60bb52e 3b28568c6d
81 changed files with 15794 additions and 2120 deletions
--- a/doc/build-helpers/fetchers.chapter.md
+++ b/doc/build-helpers/fetchers.chapter.md
@ -755,25 +755,63 @@ Used with Subversion. Expects `url` to a Subversion directory, `rev`, and `hash`

 Used with Git. Expects `url` to a Git repo, `rev`, and `hash`. `rev` in this case can be full the git commit id (SHA1 hash) or a tag name like `refs/tags/v1.0`.

-Additionally, the following optional arguments can be given: `fetchSubmodules = true` makes `fetchgit` also fetch the submodules of a repository. If `deepClone` is set to true, the entire repository is cloned as opposing to just creating a shallow clone. `deepClone = true` also implies `leaveDotGit = true` which means that the `.git` directory of the clone won't be removed after checkout.
+Additionally, the following optional arguments can be given:

-If only parts of the repository are needed, `sparseCheckout` can be used. This will prevent git from fetching unnecessary blobs from server, see [git sparse-checkout](https://git-scm.com/docs/git-sparse-checkout) for more information:
+*`fetchSubmodules`* (Boolean)

-```nix
-{ stdenv, fetchgit }:
+: Whether to also fetch the submodules of a repository.

-stdenv.mkDerivation {
-  name = "hello";
-  src = fetchgit {
-    url = "https://...";
-    sparseCheckout = [
-      "directory/to/be/included"
-      "another/directory"
-    ];
-    hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
-  };
-}
-```
+*`fetchLFS`* (Boolean)
+
+: Whether to fetch LFS objects.
+
+*`postFetch`* (String)
+
+: Shell code executed after the file has been fetched successfully.
+  This can do things like check or transform the file.
+
+*`leaveDotGit`* (Boolean)
+
+: Whether the `.git` directory of the clone should *not* be removed after checkout.
+
+  Be warned though that the git repository format is not stable and this flag is therefore not suitable for actual use by itself.
+  Only use this for testing purposes or in conjunction with removing the `.git` directory in `postFetch`.
+
+*`deepClone`* (Boolean)
+
+: Clone the entire repository as opposing to just creating a shallow clone.
+  This implies `leaveDotGit`.
+
+*`sparseCheckout`* (List of String)
+
+: Prevent git from fetching unnecessary blobs from server.
+  This is useful if only parts of the repository are needed.
+
+  ::: {.example #ex-fetchgit-sparseCheckout}
+
+  # Use `sparseCheckout` to only include some directories:
+
+  ```nix
+  { stdenv, fetchgit }:
+
+  stdenv.mkDerivation {
+    name = "hello";
+    src = fetchgit {
+      url = "https://...";
+      sparseCheckout = [
+        "directory/to/be/included"
+        "another/directory"
+      ];
+      hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+    };
+  }
+  ```
+  :::
+
+  See [git sparse-checkout](https://git-scm.com/docs/git-sparse-checkout) for more information.
+
+Some additional parameters for niche use-cases can be found listed in the function parameters in the declaration of `fetchgit`: `pkgs/build-support/fetchgit/default.nix`.
+Future parameters additions might also happen without immediately being documented here.

 ## `fetchfossil` {#fetchfossil}

--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@ -139,6 +139,8 @@

 - [zeronsd](https://github.com/zerotier/zeronsd), a DNS server for ZeroTier users. Available with [services.zeronsd.servedNetworks](#opt-services.zeronsd.servedNetworks).

+- [agorakit](https://github.com/agorakit/agorakit), an organization tool for citizens' collectives. Available with [services.agorakit](#opt-services.agorakit.enable).
+
 - [Collabora Online](https://www.collaboraonline.com/), a collaborative online office suite based on LibreOffice technology. Available as [services.collabora-online](options.html#opt-services.collabora-online.enable).

 - [wg-access-server](https://github.com/freifunkMUC/wg-access-server/), an all-in-one WireGuard VPN solution with a WebUI for connecting devices. Available as [services.wg-access-server](#opt-services.wg-access-server.enable).
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1393,6 +1393,7 @@
  ./services/wayland/cage.nix
  ./services/wayland/hypridle.nix
  ./services/web-apps/akkoma.nix
+  ./services/web-apps/agorakit.nix
  ./services/web-apps/alps.nix
  ./services/web-apps/anuko-time-tracker.nix
  ./services/web-apps/artalk.nix
--- a/nixos/modules/services/hardware/g810-led.nix
+++ b/nixos/modules/services/hardware/g810-led.nix
@ -36,9 +36,9 @@ in
  };

  config = lib.mkIf cfg.enable {
-    environment.etc."g810-led/profile" = lib.mkIf (cfg.profile != null) cfg.profile;
+    environment.etc."g810-led/profile".text = lib.mkIf (cfg.profile != null) cfg.profile;

-    services.udev.packages = [ config.package ];
+    services.udev.packages = [ cfg.package ];
  };

  meta.maintainers = with lib.maintainers; [ GaetanLepage ];
--- a/nixos/modules/services/web-apps/agorakit.nix
+++ b/nixos/modules/services/web-apps/agorakit.nix
@ -0,0 +1,482 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib;
+let
+  cfg = config.services.agorakit;
+  agorakit = pkgs.agorakit.override { dataDir = cfg.dataDir; };
+  db = cfg.database;
+  mail = cfg.mail;
+
+  user = cfg.user;
+  group = cfg.group;
+
+  # shell script for local administration
+  artisan = pkgs.writeScriptBin "agorakit" ''
+    #! ${pkgs.runtimeShell}
+    cd ${agorakit}
+    sudo() {
+      if [[ "$USER" != ${user} ]]; then
+        exec /run/wrappers/bin/sudo -u ${user} "$@"
+      else
+        exec "$@"
+      fi
+    }
+    sudo ${lib.getExe pkgs.php} artisan "$@"
+  '';
+
+  tlsEnabled = cfg.nginx.addSSL || cfg.nginx.forceSSL || cfg.nginx.onlySSL || cfg.nginx.enableACME;
+in
+{
+  options.services.agorakit = {
+    enable = mkEnableOption "agorakit";
+
+    user = mkOption {
+      default = "agorakit";
+      description = "User agorakit runs as.";
+      type = types.str;
+    };
+
+    group = mkOption {
+      default = "agorakit";
+      description = "Group agorakit runs as.";
+      type = types.str;
+    };
+
+    appKeyFile = mkOption {
+      description = ''
+        A file containing the Laravel APP_KEY - a 32 character long,
+        base64 encoded key used for encryption where needed. Can be
+        generated with <code>head -c 32 /dev/urandom | base64</code>.
+      '';
+      example = "/run/keys/agorakit-appkey";
+      type = types.path;
+    };
+
+    hostName = lib.mkOption {
+      type = lib.types.str;
+      default =
+        if config.networking.domain != null then config.networking.fqdn else config.networking.hostName;
+      defaultText = lib.literalExpression "config.networking.fqdn";
+      example = "agorakit.example.com";
+      description = ''
+        The hostname to serve agorakit on.
+      '';
+    };
+
+    appURL = mkOption {
+      description = ''
+        The root URL that you want to host agorakit on. All URLs in agorakit will be generated using this value.
+        If you change this in the future you may need to run a command to update stored URLs in the database.
+        Command example: <code>php artisan agorakit:update-url https://old.example.com https://new.example.com</code>
+      '';
+      default = "http${lib.optionalString tlsEnabled "s"}://${cfg.hostName}";
+      defaultText = ''http''${lib.optionalString tlsEnabled "s"}://''${cfg.hostName}'';
+      example = "https://example.com";
+      type = types.str;
+    };
+
+    dataDir = mkOption {
+      description = "agorakit data directory";
+      default = "/var/lib/agorakit";
+      type = types.path;
+    };
+
+    database = {
+      host = mkOption {
+        type = types.str;
+        default = "localhost";
+        description = "Database host address.";
+      };
+      port = mkOption {
+        type = types.port;
+        default = 3306;
+        description = "Database host port.";
+      };
+      name = mkOption {
+        type = types.str;
+        default = "agorakit";
+        description = "Database name.";
+      };
+      user = mkOption {
+        type = types.str;
+        default = user;
+        defaultText = lib.literalExpression "user";
+        description = "Database username.";
+      };
+      passwordFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
+        example = "/run/keys/agorakit-dbpassword";
+        description = ''
+          A file containing the password corresponding to
+          <option>database.user</option>.
+        '';
+      };
+      createLocally = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Create the database and database user locally.";
+      };
+    };
+
+    mail = {
+      driver = mkOption {
+        type = types.enum [
+          "smtp"
+          "sendmail"
+        ];
+        default = "smtp";
+        description = "Mail driver to use.";
+      };
+      host = mkOption {
+        type = types.str;
+        default = "localhost";
+        description = "Mail host address.";
+      };
+      port = mkOption {
+        type = types.port;
+        default = 1025;
+        description = "Mail host port.";
+      };
+      fromName = mkOption {
+        type = types.str;
+        default = "agorakit";
+        description = "Mail \"from\" name.";
+      };
+      from = mkOption {
+        type = types.str;
+        default = "mail@agorakit.com";
+        description = "Mail \"from\" email.";
+      };
+      user = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        example = "agorakit";
+        description = "Mail username.";
+      };
+      passwordFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
+        example = "/run/keys/agorakit-mailpassword";
+        description = ''
+          A file containing the password corresponding to
+          <option>mail.user</option>.
+        '';
+      };
+      encryption = mkOption {
+        type = with types; nullOr (enum [ "tls" ]);
+        default = null;
+        description = "SMTP encryption mechanism to use.";
+      };
+    };
+
+    maxUploadSize = mkOption {
+      type = types.str;
+      default = "18M";
+      example = "1G";
+      description = "The maximum size for uploads (e.g. images).";
+    };
+
+    poolConfig = mkOption {
+      type =
+        with types;
+        attrsOf (oneOf [
+          str
+          int
+          bool
+        ]);
+      default = {
+        "pm" = "dynamic";
+        "pm.max_children" = 32;
+        "pm.start_servers" = 2;
+        "pm.min_spare_servers" = 2;
+        "pm.max_spare_servers" = 4;
+        "pm.max_requests" = 500;
+      };
+      description = ''
+        Options for the agorakit PHP pool. See the documentation on <literal>php-fpm.conf</literal>
+        for details on configuration directives.
+      '';
+    };
+
+    nginx = mkOption {
+      type = types.submodule (
+        recursiveUpdate (import ../web-servers/nginx/vhost-options.nix {
+          inherit config lib;
+        }) { }
+      );
+      default = { };
+      example = ''
+        {
+          serverAliases = [
+            "agorakit.''${config.networking.domain}"
+          ];
+          # To enable encryption and let let's encrypt take care of certificate
+          forceSSL = true;
+          enableACME = true;
+        }
+      '';
+      description = ''
+        With this option, you can customize the nginx virtualHost settings.
+      '';
+    };
+
+    config = mkOption {
+      type =
+        with types;
+        attrsOf (
+          nullOr (
+            either
+              (oneOf [
+                bool
+                int
+                port
+                path
+                str
+              ])
+              (submodule {
+                options = {
+                  _secret = mkOption {
+                    type = nullOr str;
+                    description = ''
+                      The path to a file containing the value the
+                      option should be set to in the final
+                      configuration file.
+                    '';
+                  };
+                };
+              })
+          )
+        );
+      default = { };
+      example = ''
+        {
+          ALLOWED_IFRAME_HOSTS = "https://example.com";
+          AUTH_METHOD = "oidc";
+          OIDC_NAME = "MyLogin";
+          OIDC_DISPLAY_NAME_CLAIMS = "name";
+          OIDC_CLIENT_ID = "agorakit";
+          OIDC_CLIENT_SECRET = {_secret = "/run/keys/oidc_secret"};
+          OIDC_ISSUER = "https://keycloak.example.com/auth/realms/My%20Realm";
+          OIDC_ISSUER_DISCOVER = true;
+        }
+      '';
+      description = ''
+        Agorakit configuration options to set in the
+        <filename>.env</filename> file.
+
+        Refer to <link xlink:href="https://github.com/agorakit/agorakit"/>
+        for details on supported values.
+
+        Settings containing secret data should be set to an attribute
+        set containing the attribute <literal>_secret</literal> - a
+        string pointing to a file containing the value the option
+        should be set to. See the example to get a better picture of
+        this: in the resulting <filename>.env</filename> file, the
+        <literal>OIDC_CLIENT_SECRET</literal> key will be set to the
+        contents of the <filename>/run/keys/oidc_secret</filename>
+        file.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = db.createLocally -> db.user == user;
+        message = "services.agorakit.database.user must be set to ${user} if services.agorakit.database.createLocally is set true.";
+      }
+      {
+        assertion = db.createLocally -> db.passwordFile == null;
+        message = "services.agorakit.database.passwordFile cannot be specified if services.agorakit.database.createLocally is set to true.";
+      }
+    ];
+
+    services.agorakit.config = {
+      APP_ENV = "production";
+      APP_KEY._secret = cfg.appKeyFile;
+      APP_URL = cfg.appURL;
+      DB_HOST = db.host;
+      DB_PORT = db.port;
+      DB_DATABASE = db.name;
+      DB_USERNAME = db.user;
+      MAIL_DRIVER = mail.driver;
+      MAIL_FROM_NAME = mail.fromName;
+      MAIL_FROM = mail.from;
+      MAIL_HOST = mail.host;
+      MAIL_PORT = mail.port;
+      MAIL_USERNAME = mail.user;
+      MAIL_ENCRYPTION = mail.encryption;
+      DB_PASSWORD._secret = db.passwordFile;
+      MAIL_PASSWORD._secret = mail.passwordFile;
+      APP_SERVICES_CACHE = "/run/agorakit/cache/services.php";
+      APP_PACKAGES_CACHE = "/run/agorakit/cache/packages.php";
+      APP_CONFIG_CACHE = "/run/agorakit/cache/config.php";
+      APP_ROUTES_CACHE = "/run/agorakit/cache/routes-v7.php";
+      APP_EVENTS_CACHE = "/run/agorakit/cache/events.php";
+      SESSION_SECURE_COOKIE = tlsEnabled;
+    };
+
+    environment.systemPackages = [ artisan ];
+
+    services.mysql = mkIf db.createLocally {
+      enable = true;
+      package = mkDefault pkgs.mysql;
+      ensureDatabases = [ db.name ];
+      ensureUsers = [
+        {
+          name = db.user;
+          ensurePermissions = {
+            "${db.name}.*" = "ALL PRIVILEGES";
+          };
+        }
+      ];
+    };
+
+    services.phpfpm.pools.agorakit = {
+      inherit user group;
+      phpOptions = ''
+        log_errors = on
+        post_max_size = ${cfg.maxUploadSize}
+        upload_max_filesize = ${cfg.maxUploadSize}
+      '';
+      settings = {
+        "listen.mode" = "0660";
+        "listen.owner" = user;
+        "listen.group" = group;
+      } // cfg.poolConfig;
+    };
+
+    services.nginx = {
+      enable = mkDefault true;
+      recommendedTlsSettings = true;
+      recommendedOptimisation = true;
+      recommendedGzipSettings = true;
+      recommendedBrotliSettings = true;
+      recommendedProxySettings = true;
+      virtualHosts.${cfg.hostName} = mkMerge [
+        cfg.nginx
+        {
+          root = mkForce "${agorakit}/public";
+          locations = {
+            "/" = {
+              index = "index.php";
+              tryFiles = "$uri $uri/ /index.php?$query_string";
+            };
+            "~ \.php$".extraConfig = ''
+              fastcgi_pass unix:${config.services.phpfpm.pools."agorakit".socket};
+            '';
+            "~ \.(js|css|gif|png|ico|jpg|jpeg)$" = {
+              extraConfig = "expires 365d;";
+            };
+          };
+        }
+      ];
+    };
+
+    systemd.services.agorakit-setup = {
+      description = "Preparation tasks for agorakit";
+      before = [ "phpfpm-agorakit.service" ];
+      after = optional db.createLocally "mysql.service";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        User = user;
+        UMask = 77;
+        WorkingDirectory = "${agorakit}";
+        RuntimeDirectory = "agorakit/cache";
+        RuntimeDirectoryMode = 700;
+      };
+      path = [ pkgs.replace-secret ];
+      script =
+        let
+          isSecret = v: isAttrs v && v ? _secret && isString v._secret;
+          agorakitEnvVars = lib.generators.toKeyValue {
+            mkKeyValue = lib.flip lib.generators.mkKeyValueDefault "=" {
+              mkValueString =
+                v:
+                with builtins;
+                if isInt v then
+                  toString v
+                else if isString v then
+                  v
+                else if true == v then
+                  "true"
+                else if false == v then
+                  "false"
+                else if isSecret v then
+                  hashString "sha256" v._secret
+                else
+                  throw "unsupported type ${typeOf v}: ${(lib.generators.toPretty { }) v}";
+            };
+          };
+          secretPaths = lib.mapAttrsToList (_: v: v._secret) (lib.filterAttrs (_: isSecret) cfg.config);
+          mkSecretReplacement = file: ''
+            replace-secret ${
+              escapeShellArgs [
+                (builtins.hashString "sha256" file)
+                file
+                "${cfg.dataDir}/.env"
+              ]
+            }
+          '';
+          secretReplacements = lib.concatMapStrings mkSecretReplacement secretPaths;
+          filteredConfig = lib.converge (lib.filterAttrsRecursive (
+            _: v:
+            !elem v [
+              { }
+              null
+            ]
+          )) cfg.config;
+          agorakitEnv = pkgs.writeText "agorakit.env" (agorakitEnvVars filteredConfig);
+        in
+        ''
+          # error handling
+          set -euo pipefail
+
+          # create .env file
+          install -T -m 0600 -o ${user} ${agorakitEnv} "${cfg.dataDir}/.env"
+          ${secretReplacements}
+          if ! grep 'APP_KEY=base64:' "${cfg.dataDir}/.env" >/dev/null; then
+            sed -i 's/APP_KEY=/APP_KEY=base64:/' "${cfg.dataDir}/.env"
+          fi
+
+          # migrate & seed db
+          ${pkgs.php}/bin/php artisan key:generate --force
+          ${pkgs.php}/bin/php artisan migrate --force
+          ${pkgs.php}/bin/php artisan config:cache
+        '';
+    };
+
+    systemd.tmpfiles.rules = [
+      "d ${cfg.dataDir}                            0710 ${user} ${group} - -"
+      "d ${cfg.dataDir}/public                     0750 ${user} ${group} - -"
+      "d ${cfg.dataDir}/public/uploads             0750 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage                    0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/app                0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/fonts              0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/framework          0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/framework/cache    0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/framework/sessions 0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/framework/views    0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/logs               0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/uploads            0700 ${user} ${group} - -"
+    ];
+
+    users = {
+      users = mkIf (user == "agorakit") {
+        agorakit = {
+          inherit group;
+          isSystemUser = true;
+        };
+        "${config.services.nginx.user}".extraGroups = [ group ];
+      };
+      groups = mkIf (group == "agorakit") { agorakit = { }; };
+    };
+  };
+}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -111,6 +111,7 @@ in {
  aesmd = runTestOn ["x86_64-linux"] ./aesmd.nix;
  agate = runTest ./web-servers/agate.nix;
  agda = handleTest ./agda.nix {};
+  agorakit = runTest ./web-apps/agorakit.nix;
  airsonic = handleTest ./airsonic.nix {};
  akkoma = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./akkoma.nix {};
  akkoma-confined = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./akkoma.nix { confined = true; };
--- a/nixos/tests/web-apps/agorakit.nix
+++ b/nixos/tests/web-apps/agorakit.nix
@ -0,0 +1,43 @@
+{ pkgs, ... }:
+{
+  name = "agorakit";
+
+  meta.maintainers = with pkgs.lib.maintainers; [ julienmalka ];
+
+  nodes = {
+    agorakit =
+      { ... }:
+      {
+        services.agorakit = {
+          enable = true;
+          appKeyFile = toString (
+            pkgs.writeText "agorakit-app-key" "uTqGUN5GUmUrh/zSAYmhyzRk62pnpXICyXv9eeITI8k="
+          );
+          hostName = "localhost";
+          database.createLocally = true;
+          mail = {
+            driver = "smtp";
+            encryption = "tls";
+            host = "localhost";
+            port = 1025;
+            fromName = "Agorakit";
+            from = "agorakit@localhost";
+            user = "agorakit@localhost";
+            passwordFile = toString (pkgs.writeText "agorakit-mail-pass" "a-secure-mail-password");
+          };
+        };
+      };
+  };
+
+  testScript = ''
+    start_all()
+
+    agorakit.wait_for_unit("nginx.service")
+    agorakit.wait_for_unit("agorakit-setup.service")
+
+    # Login page should now contain the configured site name
+
+    agorakit.succeed("curl http://localhost/login | grep Agorakit")
+
+  '';
+}
--- a/nixos/tests/web-apps/gotosocial.nix
+++ b/nixos/tests/web-apps/gotosocial.nix
@ -21,7 +21,6 @@
    machine.wait_for_open_port(8081)

    # check user registration via cli
-    machine.succeed("curl -sS -f http://localhost:8081/nodeinfo/2.0 | jq '.usage.users.total' | grep -q '^0$'")
    machine.succeed("gotosocial-admin account create --username nickname --email email@example.com --password kurtz575VPeBgjVm")
    machine.succeed("curl -sS -f http://localhost:8081/nodeinfo/2.0 | jq '.usage.users.total' | grep -q '^1$'")
  '';
--- a/pkgs/applications/graphics/vengi-tools/default.nix
+++ b/pkgs/applications/graphics/vengi-tools/default.nix
@ -35,13 +35,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "vengi-tools";
-  version = "0.0.33";
+  version = "0.0.34";

  src = fetchFromGitHub {
    owner = "mgerhardy";
    repo = "vengi";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-ljB36A5b8K1KBBuQVISb1fkWxb/tTTwojE31KPMg1xQ=";
+    hash = "sha256-a78Oiwln3vyzCyjNewbK1/05bnGcSixxzKIgz4oiDmA=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -723,11 +723,11 @@
    "vendorHash": "sha256-MfXuVZC7aroO83CJTNCh5YfbmMlUG1CiPeGgxhUFjN0="
  },
  "launchdarkly": {
-    "hash": "sha256-ke7o4I6d1JSsk+/6hk0EXUatnyCnXzb8xdgPX/cr4eM=",
+    "hash": "sha256-ca8eXj+eOTNoR00c4nBLoghoPsO2PJ3dYOMOv5cXzO4=",
    "homepage": "https://registry.terraform.io/providers/launchdarkly/launchdarkly",
    "owner": "launchdarkly",
    "repo": "terraform-provider-launchdarkly",
-    "rev": "v2.20.2",
+    "rev": "v2.21.0",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-v9N7lj7bEgR5HZm1SO0+DSCmQFVnsRvHPMycYMfpYwo="
  },
--- a/pkgs/applications/video/kodi/addons/radioparadise/default.nix
+++ b/pkgs/applications/video/kodi/addons/radioparadise/default.nix
@ -3,11 +3,11 @@
 buildKodiAddon rec {
  pname = "radioparadise";
  namespace = "script.radioparadise";
-  version = "2.0.1";
+  version = "2.1.1";

  src = fetchzip {
    url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/script.radioparadise/script.radioparadise-${version}.zip";
-    sha256 = "sha256-osQoOFr1vyTgZdlq1gNmhhDY37e+4SFqN3uX3yT8NQE=";
+    sha256 = "sha256-jlEwqHkc3iiwc31DRnVPh5/AuPys9g/QApRUDweFt+E=";
  };

  propagatedBuildInputs = [
--- a/pkgs/build-support/fetchgit/default.nix
+++ b/pkgs/build-support/fetchgit/default.nix
@ -11,6 +11,8 @@
  in "${if matched == null then base else builtins.head matched}${appendShort}";
 in
 lib.makeOverridable (lib.fetchers.withNormalizedHash { } (
+# NOTE Please document parameter additions or changes in
+#   doc/build-helpers/fetchers.chapter.md
 { url, rev ? "HEAD", leaveDotGit ? deepClone
 , outputHash ? lib.fakeHash, outputHashAlgo ? null
 , fetchSubmodules ? true, deepClone ? false
--- a/pkgs/build-support/writers/scripts.nix
+++ b/pkgs/build-support/writers/scripts.nix
@ -587,8 +587,8 @@ rec {
    ''
      (println "hello world")
    ''
-    :::
    ```
+    :::
  */
  writeBabashka =
    name:
--- a/pkgs/by-name/ag/agorakit/package.nix
+++ b/pkgs/by-name/ag/agorakit/package.nix
@ -0,0 +1,40 @@
+{
+  lib,
+  fetchFromGitHub,
+  php,
+  dataDir ? "/var/lib/agorakit",
+}:
+
+php.buildComposerProject (finalAttrs: {
+  pname = "agorakit";
+  version = "1.9.2";
+
+  src = fetchFromGitHub {
+    owner = finalAttrs.pname;
+    repo = finalAttrs.pname;
+    rev = finalAttrs.version;
+    sha256 = "sha256-6T7AksvBxUpv8TkPicnlCE5KZS/ydPB5Bq1MJcWoZds=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out
+    cp -R * $out
+    rm -rf $out/storage
+    ln -s ${dataDir}/.env $out/.env
+    ln -s ${dataDir}/storage $out/storage
+    runHook postInstall
+  '';
+
+  vendorHash = "sha256-5ypBA9Qb8jHzAtvNBHkJfsLIf3Pfw1LvYmHP/hED2ig=";
+  composerStrictValidation = false;
+
+  meta = {
+    description = "Web-based, open-source groupware";
+    longDescription = "AgoraKit is web-based, open-source groupware for citizens' initiatives. By creating collaborative groups, people can discuss topics, organize events, store files and keep everyone updated as needed. AgoraKit is a forum, calendar, file manager and email notifier.";
+    homepage = "https://github.com/agorakit/agorakit";
+    license = lib.licenses.agpl3Only;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ shogo ];
+  };
+})
--- a/pkgs/by-name/al/alt-tab-macos/package.nix
+++ b/pkgs/by-name/al/alt-tab-macos/package.nix
@ -8,11 +8,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "alt-tab-macos";
-  version = "7.2.0";
+  version = "7.4.0";

  src = fetchurl {
    url = "https://github.com/lwouis/alt-tab-macos/releases/download/v${finalAttrs.version}/AltTab-${finalAttrs.version}.zip";
-    hash = "sha256-70ODYDPcE5UT6bVY3H2J7RvqB3sDpPoeOpkqhwVkxJ0=";
+    hash = "sha256-uCernCv52gZUxyn9LxsZGxd33z0y0YoEHEZ4mf4Ve4Y=";
  };

  sourceRoot = ".";
--- a/pkgs/by-name/at/atlauncher/package.nix
+++ b/pkgs/by-name/at/atlauncher/package.nix
@ -21,13 +21,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "atlauncher";
-  version = "3.4.37.4";
+  version = "3.4.38.0";

  src = fetchFromGitHub {
    owner = "ATLauncher";
    repo = "ATLauncher";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-3Rs6XtqhD9PKz8ekF0STaANvPQ73KSUS8GIPvn9DmbQ=";
+    hash = "sha256-0cn4qTdNH8VHRuypdRInrmU7gh792NSYL7P2rkz/4xc=";
  };

  postPatch = ''
@ -96,6 +96,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    '';

  meta = {
+    broken = stdenvNoCC.hostPlatform.isDarwin; # https://github.com/NixOS/nixpkgs/issues/356259
    changelog = "https://github.com/ATLauncher/ATLauncher/blob/v${finalAttrs.version}/CHANGELOG.md";
    description = "Simple and easy to use Minecraft launcher which contains many different modpacks for you to choose from and play";
    downloadPage = "https://atlauncher.com/downloads";
--- a/pkgs/by-name/bu/bun/package.nix
+++ b/pkgs/by-name/bu/bun/package.nix
@ -12,7 +12,7 @@
 }:

 stdenvNoCC.mkDerivation rec {
-  version = "1.1.31";
+  version = "1.1.34";
  pname = "bun";

  src = passthru.sources.${stdenvNoCC.hostPlatform.system} or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}");
@ -51,19 +51,19 @@ stdenvNoCC.mkDerivation rec {
    sources = {
      "aarch64-darwin" = fetchurl {
        url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-aarch64.zip";
-        hash = "sha256-dOQFfkxCiOFmAr11CjSdSKNpiLERkbVWawAuy8ASkJE=";
+        hash = "sha256-unFn4bexupfjtFA6Nxzi/vC1stzuBXYP5jPfwXbZDig=";
      };
      "aarch64-linux" = fetchurl {
        url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-aarch64.zip";
-        hash = "sha256-ZuU14GvAtf1n1sA8amtZUSGp5iJ5qp/SI2wrw4Gwe/4=";
+        hash = "sha256-BIYlEyRuyUdvipsCVEHTORlJoAnH+rv1ogv10JUHyOA=";
      };
      "x86_64-darwin" = fetchurl {
        url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-x64-baseline.zip";
-        hash = "sha256-qN8ciVHzHH8GgR89GDgfvteMV+YawMUQLiXNwYyN+wU=";
+        hash = "sha256-gpcDIY1IYHO0N9Quw79VonhFHdgb/NFZns2hGNuQe9g=";
      };
      "x86_64-linux" = fetchurl {
        url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-x64.zip";
-        hash = "sha256-zHitG4Ktt+iCKk9GrC3C4MRSWhUxh89kW9bUeHzqNJs=";
+        hash = "sha256-S8AA/1CWxTSHZ60E2ZNQXyEAOalYgCc6dte9CvD8Lx8=";
      };
    };
    updateScript = writeShellScript "update-bun" ''
--- a/pkgs/by-name/de/deskflow/package.nix
+++ b/pkgs/by-name/de/deskflow/package.nix
@ -0,0 +1,108 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  ninja,
+  pkg-config,
+  tomlplusplus,
+  cli11,
+  gtest,
+  libei,
+  libportal,
+  libX11,
+  libxkbfile,
+  libXtst,
+  libXinerama,
+  libXi,
+  libXrandr,
+  libxkbcommon,
+  pugixml,
+  python3,
+  gdk-pixbuf,
+  libnotify,
+  qt6,
+  xkeyboard_config,
+  openssl,
+  wayland-protocols,
+  wayland,
+  libsysprof-capture,
+  lerc,
+  doxygen,
+}:
+stdenv.mkDerivation rec {
+  pname = "deskflow";
+  version = "1.17.1";
+
+  src = fetchFromGitHub {
+    owner = "deskflow";
+    repo = "deskflow";
+    rev = "v${version}";
+    hash = "sha256-cEKG9MwENbZqrfRdwiZtRWmIfRndrWUoaZQ5O7YRpBs=";
+  };
+
+  postPatch = ''
+    substituteInPlace src/lib/deskflow/unix/AppUtilUnix.cpp \
+      --replace-fail "/usr/share/X11/xkb/rules/evdev.xml" "${xkeyboard_config}/share/X11/xkb/rules/evdev.xml"
+    substituteInPlace src/lib/gui/tls/TlsCertificate.cpp \
+      --replace-fail "\"openssl\"" "\"${lib.getBin openssl}/bin/openssl\""
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    pkg-config
+    qt6.wrapQtAppsHook
+    doxygen # docs
+  ];
+
+  cmakeFlags = [
+    "-DCMAKE_SKIP_RPATH=ON" # Avoid generating incorrect RPATH
+  ];
+
+  strictDeps = true;
+
+  buildInputs = [
+    tomlplusplus
+    cli11
+    gtest
+    libei
+    libportal
+    libX11
+    libxkbfile
+    libXinerama
+    libXi
+    libXrandr
+    libXtst
+    libxkbcommon
+    pugixml
+    gdk-pixbuf
+    libnotify
+    python3
+    qt6.qtbase
+    wayland-protocols
+    qt6.qtwayland
+    wayland
+    libsysprof-capture
+    lerc
+  ];
+
+  postInstall = ''
+    substituteInPlace $out/share/applications/deskflow.desktop \
+        --replace-fail "Path=/usr/bin" "Path=$out/bin" \
+        --replace-fail "Exec=/usr/bin/deskflow" "Exec=deskflow"
+  '';
+
+  qtWrapperArgs = [
+    "--set QT_QPA_PLATFORM_PLUGIN_PATH ${qt6.qtwayland}/${qt6.qtbase.qtPluginPrefix}/platforms"
+  ];
+
+  meta = {
+    homepage = "https://github.com/deskflow/deskflow";
+    description = "Share one mouse and keyboard between multiple computers on Windows, macOS and Linux";
+    mainProgram = "deskflow";
+    maintainers = with lib.maintainers; [ aucub ];
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/by-name/fa/fanficfare/package.nix
+++ b/pkgs/by-name/fa/fanficfare/package.nix
@ -2,12 +2,12 @@

 python3Packages.buildPythonApplication rec {
  pname = "fanficfare";
-  version = "4.39.0";
+  version = "4.40.0";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-F6+mWCFQHdE4qvnZ8FH2XgXwET76j3hy22bK5BELHtY=";
+    hash = "sha256-5WquEgSqPFMq+HU0K94QiC9WsP6Iv+CpE1ZsBgdYGFI=";
  };

  nativeBuildInputs = with python3Packages; [
--- a/pkgs/by-name/fc/fcitx5-mozc/package.nix
+++ b/pkgs/by-name/fc/fcitx5-mozc/package.nix
@ -1,5 +1,5 @@
 {
-  bazel_7,
+  bazel_6,
  buildBazelPackage,
  fcitx5,
  fetchFromGitHub,
@ -41,7 +41,7 @@ buildBazelPackage {
    sed -i -e 's|^\(LINUX_MOZC_SERVER_DIR = \).\+|\1"${mozc}/lib/mozc"|' src/config.bzl
  '';

-  bazel = bazel_7;
+  bazel = bazel_6;
  removeRulesCC = false;
  dontAddBazelOpts = true;

@ -62,7 +62,7 @@ buildBazelPackage {
      rm -rf $bazelOut/external/fcitx5
    '';

-    sha256 = "sha256-wz2lJckr7Pu4jtoejjFv8LdjVO2+ferrS473M4jc86I=";
+    sha256 = "sha256-rrRp/v1pty7Py80/6I8rVVQvkeY72W+nlixUeYkjp+o=";
  };

  preConfigure = ''
--- a/pkgs/by-name/fc/fcitx5-pinyin-moegirl/package.nix
+++ b/pkgs/by-name/fc/fcitx5-pinyin-moegirl/package.nix
@ -6,11 +6,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "fcitx5-pinyin-moegirl";
-  version = "20241009";
+  version = "20241109";

  src = fetchurl {
    url = "https://github.com/outloudvi/mw2fcitx/releases/download/${finalAttrs.version}/moegirl.dict";
-    hash = "sha256-tb+Z7ja6yG7n6DcxSvdFhMq2xTNs6mJ6pdPfEKeRUww=";
+    hash = "sha256-Vg1Kx/7m1gNEJAe3bhxoIogXsNV8I0NYyhGt9SvqfM4=";
  };

  dontUnpack = true;
--- a/pkgs/by-name/fi/files-cli/package.nix
+++ b/pkgs/by-name/fi/files-cli/package.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "files-cli";
-  version = "2.13.148";
+  version = "2.13.180";

  src = fetchFromGitHub {
    repo = "files-cli";
    owner = "files-com";
    rev = "v${version}";
-    hash = "sha256-r3pYDBE1YaKuFdxxpDVcMGfX5vOLt4xh3eY0fgLIGk0=";
+    hash = "sha256-qjrmU8IAxMzggAcuw0ONep6c/b4fx6ZuPQtOatTHBJU=";
  };

-  vendorHash = "sha256-/w1uo3SmCUjKp1FcB2NfhrFCLh5zCP+6uf03uwb+SvU=";
+  vendorHash = "sha256-ZBn/wKT+AR/jb2fbkU+cEgHH5nB/kl6p3s7n1iV9aAI=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/gh/ghc_filesystem/package.nix
+++ b/pkgs/by-name/gh/ghc_filesystem/package.nix
@ -1,22 +1,39 @@
-{ stdenv, lib, cmake, fetchFromGitHub }:
+{
+  lib,
+  stdenv,
+  apple-sdk_11,
+  cmake,
+  fetchFromGitHub,
+  nix-update-script,
+}:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "filesystem";
  version = "1.5.14";

  src = fetchFromGitHub {
    owner = "gulrak";
    repo = "filesystem";
-    rev = "v${version}";
+    rev = "refs/tags/v${finalAttrs.version}";
    hash = "sha256-XZ0IxyNIAs2tegktOGQevkLPbWHam/AOFT+M6wAWPFg=";
  };

  nativeBuildInputs = [ cmake ];

-  meta = with lib; {
+  buildInputs = lib.optional stdenv.hostPlatform.isDarwin apple-sdk_11;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
    description = "header-only single-file C++ std::filesystem compatible helper library";
    homepage = "https://github.com/gulrak/filesystem";
-    license = licenses.mit;
-    maintainers = with maintainers; [ bbjubjub ];
+    changelog = "https://github.com/gulrak/filesystem/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      bbjubjub
+      getchoo
+    ];
  };
-}
+})
--- a/pkgs/by-name/go/go-critic/package.nix
+++ b/pkgs/by-name/go/go-critic/package.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "go-critic";
-  version = "0.11.4";
+  version = "0.11.5";

  src = fetchFromGitHub {
    owner = "go-critic";
    repo = "go-critic";
    rev = "v${version}";
-    hash = "sha256-v/7fc3MRQoMQCKqZQVuZEm5R9ha5wusN+hEzp7aBpNk=";
+    hash = "sha256-KH7jawMd73qdl1S+YQlQGW/2Vj8XjMLJ15Hz0cdwDO4=";
  };

-  vendorHash = "sha256-Qw4t2v/5IZnpZX8sR26DL0SYrjvfuJSzDUpZ4G0u6hU=";
+  vendorHash = "sha256-vBGCFnKKpMcM7RWmT05oPwCItR4QMHhTAZ8x2ejJpcI=";

  subPackages = [
    "cmd/gocritic"
--- a/pkgs/by-name/go/golem/Cargo.lock
+++ b/pkgs/by-name/go/golem/Cargo.lock
--- a/pkgs/by-name/go/golem/package.nix
+++ b/pkgs/by-name/go/golem/package.nix
@ -0,0 +1,76 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  pkg-config,
+  openssl,
+  protobuf,
+  redis,
+  fontconfig,
+  versionCheckHook,
+  nix-update-script,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "golem";
+  version = "1.0.26";
+
+  src = fetchFromGitHub {
+    owner = "golemcloud";
+    repo = "golem";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-q2DZrJIegu6X89tVLJE+OY7XRpqY2nGmTE699UhMP2E=";
+  };
+
+  # Taker from https://github.com/golemcloud/golem/blob/v1.0.26/Makefile.toml#L399
+  postPatch = ''
+    grep -rl --include 'Cargo.toml' '0\.0\.0' | xargs sed -i "s/0\.0\.0/${version}/g"
+  '';
+
+  nativeBuildInputs = [
+    pkg-config
+    protobuf
+    rustPlatform.bindgenHook
+  ];
+
+  buildInputs = [
+    fontconfig
+    (lib.getDev openssl)
+  ];
+
+  # Required for golem-wasm-rpc's build.rs to find the required protobuf files
+  # https://github.com/golemcloud/wasm-rpc/blob/v1.0.6/wasm-rpc/build.rs#L7
+  GOLEM_WASM_AST_ROOT = "../golem-wasm-ast-1.0.1";
+  # Required for golem-examples's build.rs to find the required Wasm Interface Type (WIT) files
+  # https://github.com/golemcloud/golem-examples/blob/v1.0.6/build.rs#L9
+  GOLEM_WIT_ROOT = "../golem-wit-1.0.3";
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "cranelift-bforest-0.108.1" = "sha256-WVRj6J7yXLFOsud9qKugmYja0Pe7AqZ0O2jgkOtHRg8=";
+    };
+  };
+
+  # Tests are failing in the sandbox because of some redis integration tests
+  doCheck = false;
+  checkInputs = [ redis ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgram = [ "${placeholder "out"}/bin/golem-cli" ];
+  versionCheckProgramArg = [ "--version" ];
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Open source durable computing platform that makes it easy to build and deploy highly reliable distributed systems";
+    changelog = "https://github.com/golemcloud/golem/releases/tag/v${version}";
+    homepage = "https://www.golem.cloud/";
+    license = lib.licenses.asl20;
+    mainProgram = "golem-cli";
+  };
+}
--- a/pkgs/by-name/go/gotosocial/package.nix
+++ b/pkgs/by-name/go/gotosocial/package.nix
@ -9,11 +9,11 @@ let
  owner = "superseriousbusiness";
  repo = "gotosocial";

-  version = "0.17.0";
+  version = "0.17.3";

  web-assets = fetchurl {
    url = "https://github.com/${owner}/${repo}/releases/download/v${version}/${repo}_${version}_web-assets.tar.gz";
-    hash = "sha256-ASqPIf98qdnkh3j72ifQN3mWnzNCTRcUegmrStvQ08Q=";
+    hash = "sha256-85CmcWjcX8a+hZxkyRTfXErmkIx64R2scaaS2Fpf668";
  };
 in
 buildGoModule rec {
@ -23,7 +23,7 @@ buildGoModule rec {
  src = fetchFromGitHub {
    inherit owner repo;
    rev = "refs/tags/v${version}";
-    hash = "sha256-uyqP3zhjcXKejGFAwZoTn2kY8IpX0QAAXNzb1VG6ve8=";
+    hash = "sha256-ql0tDaMc/1NgsLUpPHZB6GoXJj9DwUpadTX3AYufR/o=";
  };

  vendorHash = null;
--- a/pkgs/by-name/gr/granted/package.nix
+++ b/pkgs/by-name/gr/granted/package.nix
@ -1,5 +1,4 @@
 {
-  bash,
  buildGoModule,
  fetchFromGitHub,
  nix-update-script,
@ -15,16 +14,16 @@

 buildGoModule rec {
  pname = "granted";
-  version = "0.36.1";
+  version = "0.36.3";

  src = fetchFromGitHub {
    owner = "common-fate";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-sIn6D0696QPo4fs7HzvQNIopIfYYV4fYLmVdwQZnZag=";
+    sha256 = "sha256-fLnrc+Aek2bFrJfCCwI9HRAocokb3IlGZbjYzur7LHk=";
  };

-  vendorHash = "sha256-QswW1PyxrVWf6ZAPKW69q0JIXpyhSHucE5A7hkr8uxw=";
+  vendorHash = "sha256-imArhe/TjrXv68ZF7moOcKjvxAvQzm7XfBkyWfwNJJs=";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/by-name/it/itsycal/package.nix
+++ b/pkgs/by-name/it/itsycal/package.nix
@ -6,18 +6,18 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "itsycal";
-  version = "0.15.4";
+  version = "0.15.5";

  src = fetchzip {
    url = "https://itsycal.s3.amazonaws.com/Itsycal-${finalAttrs.version}.zip";
-    hash = "sha256-+Pi74xP5BcjhgtR3YCqJknl54wdNIU8ekEwQUaFp4T8=";
+    hash = "sha256-kRO9zcyi8Di0NNuT158htKXt4wo7nVys+AV+1EgS1ZI=";
  };

  installPhase = ''
    runHook preInstall

-    mkdir -p $out/Applications/Itsycal.app
-    cp -R . $out/Applications/Itsycal.app
+    mkdir -p "$out/Applications/Itsycal.app"
+    cp -R . "$out/Applications/Itsycal.app"

    runHook postInstall
  '';
--- a/pkgs/by-name/kd/kdlfmt/package.nix
+++ b/pkgs/by-name/kd/kdlfmt/package.nix
@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "kdlfmt";
-  version = "0.0.3";
+  version = "0.0.6";

  src = fetchFromGitHub {
    owner = "hougesen";
    repo = "kdlfmt";
    rev = "v${version}";
-    hash = "sha256-qD1NYLHGmVRgV6pPXbvJ9NWDg/wVLWJY4hUsOLDlKh0=";
+    hash = "sha256-Lv4BMhMsi2GBzIsFS2HGZcwENgU1vvgPDZUPBb9ucfo=";
  };

-  cargoHash = "sha256-7HSDz/JI5VuTdM/Hv+nq+ddpQg31Q1v7Ct5gz2PfdmE=";
+  cargoHash = "sha256-2Lh5jtLsY67e38Xa+GGRBg9L/WIE/Nnd6XDI4crtrTc=";

  meta = {
    description = "Formatter for kdl documents";
--- a/pkgs/by-name/le/lektor/package.nix
+++ b/pkgs/by-name/le/lektor/package.nix
@ -2,6 +2,7 @@
 , fetchFromGitHub
 , fetchNpmDeps
 , fetchPypi
+, fetchpatch
 , nodejs
 , npmHooks
 , python3
@ -38,6 +39,16 @@ python.pkgs.buildPythonApplication rec {
    hash = "sha256-y0/fYuiIB/O5tsYKjzOPnCafOIZCn4Z5OITPMcnHd/M=";
  };

+  patches = [
+    # Fixes test_thumbnail.py with Pillow 11.0
+    # see lektor/lektor #1202
+    (fetchpatch {
+      name = "lektor-pillow-11.patch";
+      url = "https://github.com/lektor/lektor/commit/af99ea4265e05227d7452977949475196a58edfa.patch";
+      hash = "sha256-PmSmX9Ku5rAzN2FzLwvXYeUqN683opLRt9J35w56cfg=";
+    })
+  ];
+
  npmDeps = fetchNpmDeps {
    src = "${src}/${npmRoot}";
    hash = "sha256-LXe5/u4nAGig8RSu6r8Qsr3p3Od8eoMxukW8Z4HkJ44=";
--- a/pkgs/by-name/ma/markdown-link-check/package.nix
+++ b/pkgs/by-name/ma/markdown-link-check/package.nix
@ -7,16 +7,16 @@

 buildNpmPackage rec {
  pname = "markdown-link-check";
-  version = "3.12.2";
+  version = "3.13.6";

  src = fetchFromGitHub {
    owner = "tcort";
    repo = "markdown-link-check";
    rev = "v${version}";
-    hash = "sha256-xeqvKPIJUDNEX9LdXpxoA7ECjGlfp/wwlCw/USZN47c=";
+    hash = "sha256-UuzfIJL3nHIbGFQrs9ya+QiS/sM0z1GCHbJGLQBN5pE=";
  };

-  npmDepsHash = "sha256-J11NJRmXg2tj5BqGSQ8bMRJQUOCOZ9dEfa4Gzrf38t4=";
+  npmDepsHash = "sha256-Lxywr3M/4+DwVWxkWZHHn02K7RNWSI5LyMm12lyZT8w=";

  dontNpmBuild = true;

--- a/pkgs/by-name/ma/mattermost/package.nix
+++ b/pkgs/by-name/ma/mattermost/package.nix
@ -12,13 +12,13 @@ buildGoModule rec {
  # See https://docs.mattermost.com/upgrade/extended-support-release.html
  # When a new ESR version is available (e.g. 8.1.x -> 9.5.x), update
  # the version regex in passthru.updateScript as well.
-  version = "9.11.3";
+  version = "9.11.5";

  src = fetchFromGitHub {
    owner = "mattermost";
    repo = "mattermost";
    rev = "v${version}";
-    hash = "sha256-CuFkydl1ZZUAWmrDIV1Jp9S6jIKYmglAe5XW2lTRgtQ=";
+    hash = "sha256-bLZFeG6kBVP0ws50wtBam/bO206sQnz6va8PATAoRAQ=";
  };

  # Needed because buildGoModule does not support go workspaces yet.
@ -34,7 +34,7 @@ buildGoModule rec {

  webapp = fetchurl {
    url = "https://releases.mattermost.com/${version}/mattermost-${version}-linux-amd64.tar.gz";
-    hash = "sha256-4JzhL2+G3T98pNFgKugs/eoSrbm7QSk5grVlprrIKEI=";
+    hash = "sha256-jyaJUN8wpuBivKNdm7f1mYwygO8xC+Zxy0SdkDovdsA=";
  };

  # Makes nix-update-script pick up the fetchurl for the webapp.
--- a/pkgs/by-name/me/memtest86plus/package.nix
+++ b/pkgs/by-name/me/memtest86plus/package.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "memtest86+";
-  version = "7.00";
+  version = "7.20";

  src = fetchFromGitHub {
    owner = "memtest86plus";
    repo = "memtest86plus";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-DVYiE9yi20IR2AZs8bya1h9vK4si7nKdg9Nqef4WTrw=";
+    hash = "sha256-JZ6feyk66DLKEnugc+yXN4KckQrCTMNqQL4TvCTw1EU=";
  };

  # Binaries are booted directly by BIOS/UEFI or bootloader
--- a/pkgs/by-name/mo/modrinth-app-unwrapped/Cargo.lock
+++ b/pkgs/by-name/mo/modrinth-app-unwrapped/Cargo.lock
--- a/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
+++ b/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
@ -1,19 +1,19 @@
 {
  lib,
  stdenv,
-  fetchFromGitHub,
-  rustPlatform,
+  apple-sdk_11,
  cacert,
-  cargo-tauri_1,
-  darwin,
+  cargo-tauri,
  desktop-file-utils,
-  libsoup,
+  fetchFromGitHub,
+  makeBinaryWrapper,
  nodejs,
  openssl,
  pkg-config,
  pnpm_9,
+  rustPlatform,
  turbo,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
 }:

 let
@ -21,52 +21,40 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "modrinth-app-unwrapped";
-  version = "0.8.2";
+  version = "0.8.9";

  src = fetchFromGitHub {
    owner = "modrinth";
    repo = "code";
-    rev = "a0bd011b808cdc998ef27960f610a8d99550c914";
-    hash = "sha256-zpFJq7if5gOx7jvwpE73lqH4Vpif0MJMPIGsgtThKVk=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-DR1aPbSqAVhL/m/Maa3mPzNWwK4A1WvDd/PwEMVYn5g=";
  };

  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "sqlx-0.8.0-alpha.0" = "sha256-M1bumCMTzgDcQlgSYB6ypPp794e35ZSQCLzkbrFV4qY=";
-      "tauri-plugin-single-instance-0.0.0" = "sha256-DZWTO2/LevbQJCJbeHbTc2rhesV3bNrs+BoYm2eMakA=";
+      "wry-0.44.1" = "sha256-I1qkUVTu+Yqk1Imo1w5rG/lRSPLITF5BdcjBsPe+jXU=";
    };
  };

  pnpmDeps = pnpm.fetchDeps {
    inherit pname version src;
-    hash = "sha256-Ye9GHvkO+xZj87NIc1JLmhIJFqdkJMg7HvfTltx9krw=";
+    hash = "sha256-murZ82LV2pGng/Cg08NoWr/mDIVECrf00utVrs6PKRg=";
  };

  nativeBuildInputs = [
-    cacert # required for turbo
-    cargo-tauri_1.hook
+    cacert # Required for turbo
+    cargo-tauri.hook
    desktop-file-utils
    nodejs
    pkg-config
    pnpm.configHook
-  ];
+  ] ++ lib.optional stdenv.hostPlatform.isDarwin makeBinaryWrapper;

  buildInputs =
    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [
-      libsoup
-      webkitgtk_4_0
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        AppKit
-        CoreServices
-        Security
-        WebKit
-      ]
-    );
+    ++ lib.optional stdenv.hostPlatform.isDarwin apple-sdk_11
+    ++ lib.optional stdenv.hostPlatform.isLinux webkitgtk_4_1;

  env = {
    TURBO_BINARY_PATH = lib.getExe turbo;
@ -74,9 +62,7 @@ rustPlatform.buildRustPackage rec {

  postInstall =
    lib.optionalString stdenv.hostPlatform.isDarwin ''
-      mkdir -p "$out"/bin
-      mv "$out"/Applications/Modrinth\ App.app/Contents/MacOS/Modrinth\ App "$out"/bin/modrinth-app
-      ln -s "$out"/bin/modrinth-app "$out"/Applications/Modrinth\ App.app/Contents/MacOS/Modrinth\ App
+      makeBinaryWrapper "$out"/Applications/Modrinth\ App.app/Contents/MacOS/Modrinth\ App "$out"/bin/ModrinthApp
    ''
    + lib.optionalString stdenv.hostPlatform.isLinux ''
      desktop-file-edit \
@ -85,7 +71,7 @@ rustPlatform.buildRustPackage rec {
        --set-key="Categories" --set-value="Game;ActionGame;AdventureGame;Simulation;" \
        --set-key="Keywords" --set-value="game;minecraft;mc;" \
        --set-key="StartupWMClass" --set-value="ModrinthApp" \
-        $out/share/applications/modrinth-app.desktop
+        $out/share/applications/Modrinth\ App.desktop
    '';

  meta = {
@ -100,7 +86,7 @@ rustPlatform.buildRustPackage rec {
      unfreeRedistributable
    ];
    maintainers = with lib.maintainers; [ getchoo ];
-    mainProgram = "modrinth-app";
+    mainProgram = "ModrinthApp";
    platforms = with lib; platforms.linux ++ platforms.darwin;
    # This builds on architectures like aarch64, but the launcher itself does not support them yet.
    # Darwin is the only exception
--- a/pkgs/by-name/mo/modrinth-app/package.nix
+++ b/pkgs/by-name/mo/modrinth-app/package.nix
@ -1,15 +1,13 @@
 {
  lib,
  stdenv,
-  symlinkJoin,
-  modrinth-app-unwrapped,
  addDriverRunpath,
  alsa-lib,
  flite,
  glib-networking,
-  jdk8,
  jdk17,
  jdk21,
+  jdk8,
  jdks ? [
    jdk8
    jdk17
@ -18,9 +16,11 @@
  libGL,
  libjack2,
  libpulseaudio,
+  modrinth-app-unwrapped,
  pipewire,
+  symlinkJoin,
  udev,
-  wrapGAppsHook3,
+  wrapGAppsHook4,
  xorg,
 }:

@ -31,7 +31,7 @@ symlinkJoin rec {

  paths = [ modrinth-app-unwrapped ];

-  nativeBuildInputs = [ wrapGAppsHook3 ];
+  nativeBuildInputs = [ wrapGAppsHook4 ];

  buildInputs = [ glib-networking ];

--- a/pkgs/by-name/nh/nh/package.nix
+++ b/pkgs/by-name/nh/nh/package.nix
@ -10,7 +10,7 @@
 , nix-output-monitor
 }:
 let
-  version = "3.5.26";
+  version = "3.6.0";
  runtimeDeps = [ nvd nix-output-monitor ];
 in
 rustPlatform.buildRustPackage {
@ -21,7 +21,7 @@ rustPlatform.buildRustPackage {
    owner = "viperML";
    repo = "nh";
    rev = "refs/tags/v${version}";
-    hash = "sha256-p38Uini6lChBCF0mZndHXTAy7ZH/OQLY696BFCHg92g=";
+    hash = "sha256-k8rz5RF1qi7RXzQYWGbw5pJRNRFIdX85SIYN+IHiVL4=";
  };

  strictDeps = true;
@ -47,7 +47,7 @@ rustPlatform.buildRustPackage {
      --prefix PATH : ${lib.makeBinPath runtimeDeps}
  '';

-  cargoHash = "sha256-ejjgtjDNB7XBKi83R48xG3HLhTmm26Sdqdgh0xRVtNA=";
+  cargoHash = "sha256-HfPzoAai6wK5IqNQY7yFVXatMcia9z0I84QNmNzHRoc=";

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/ni/nihstro/package.nix
+++ b/pkgs/by-name/ni/nihstro/package.nix
@ -0,0 +1,47 @@
+{
+  lib,
+  stdenv,
+  boost,
+  cmake,
+  fetchFromGitHub,
+  ninja,
+  unstableGitUpdater,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "nihstro";
+  version = "0-unstable-2024-05-05";
+
+  src = fetchFromGitHub {
+    owner = "neobrain";
+    repo = "nihstro";
+    rev = "f4d8659decbfe5d234f04134b5002b82dc515a44";
+    hash = "sha256-ZHgWyZFW7t2VTibH7WeuU8+I12bb95I9NcHI5s4U3VU=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+  ];
+
+  buildInputs = [ boost ];
+
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+
+  passthru = {
+    updateScript = unstableGitUpdater {
+      hardcodeZeroVersion = true;
+    };
+  };
+
+  meta = {
+    description = "3DS shader assembler and disassembler";
+    homepage = "https://github.com/neobrain/nihstro";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ getchoo ];
+    mainProgram = "nihstro-assemble";
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+})
--- a/pkgs/by-name/nu/numix-icon-theme-circle/package.nix
+++ b/pkgs/by-name/nu/numix-icon-theme-circle/package.nix
@ -2,13 +2,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "numix-icon-theme-circle";
-  version = "24.10.01";
+  version = "24.10.22";

  src = fetchFromGitHub {
    owner = "numixproject";
    repo = pname;
    rev = version;
-    sha256 = "sha256-6+JzTVhhQBbEjQ85ZIBh04KZUFcHwDo8tdA0ruUEqT8=";
+    sha256 = "sha256-x5K0f+JBzke+37xrjkAza+FCig/kE5mMa2iUTf6UKNY=";
  };

  nativeBuildInputs = [ gtk3 ];
--- a/pkgs/by-name/pm/pmix/package.nix
+++ b/pkgs/by-name/pm/pmix/package.nix
@ -21,13 +21,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "pmix";
-  version = "5.0.3";
+  version = "5.0.4";

  src = fetchFromGitHub {
    repo = "openpmix";
    owner = "openpmix";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-5qBZj4L0Qu/RvNj8meL0OlLCdfGvBP0D916Mr+0XOCQ=";
+    hash = "sha256-QsJm+4GnV5qrXVG3AwQxWas51AHcqycKjTpSG2/oOGU=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/pr/prometheus-nvidia-gpu-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-nvidia-gpu-exporter/package.nix
@ -0,0 +1,37 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "prometheus-nvidia-gpu-exporter";
+  version = "1.2.1";
+
+  src = fetchFromGitHub {
+    owner = "utkuozdemir";
+    repo = "nvidia_gpu_exporter";
+    rev = "v${version}";
+    hash = "sha256-+YmZ25OhOeIulkOH/Apqh3jGQ4Vanv0GIuc/EjBiZ+w=";
+  };
+
+  vendorHash = "sha256-Dsp98EWRiRaawYmdr3KR2YTteeD9cmHUHQoq5CnH9gA=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=github.com/prometheus/common/version.Version=${version}"
+    "-X=github.com/prometheus/common/version.Revision=${src.rev}"
+    "-X=github.com/prometheus/common/version.Branch=${src.rev}"
+    "-X=github.com/prometheus/common/version.BuildUser=goreleaser"
+    "-X=github.com/prometheus/common/version.BuildDate=1970-01-01T00:00:00Z"
+  ];
+
+  meta = {
+    description = "Nvidia GPU exporter for prometheus using nvidia-smi binary";
+    homepage = "https://github.com/utkuozdemir/nvidia_gpu_exporter";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ck3d ];
+    mainProgram = "nvidia_gpu_exporter";
+  };
+}
--- a/pkgs/by-name/qq/qq/sources.nix
+++ b/pkgs/by-name/qq/qq/sources.nix
@ -1,9 +1,9 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2024-10-25
+# Last updated: 2024-11-17
 {
-  version = "3.2.13-2024.10.23";
-  amd64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.13_241023_amd64_01.deb";
-  arm64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.13_241023_arm64_01.deb";
-  arm64_hash = "sha256-n2ezKgLfmugUZYvGzDvaLKy+Tf8ooUC6Oc6xCDp5rYA=";
-  amd64_hash = "sha256-H5ACKFVV4AQ3de9UV4i9ejL1WjuuPJhTLTVqK5EcssM=";
+  version = "3.2.13-2024.11.12";
+  amd64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.13_241112_amd64_01.deb";
+  arm64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.13_241112_arm64_01.deb";
+  arm64_hash = "sha256-eAWneMK6aJUVudQemganaRiDnEGtDcJB9z0OIehlD48=";
+  amd64_hash = "sha256-ycGNihLYcemA37PGpGT5hCaiq5nD4KumqSMF7TKk4iI=";
 }
--- a/pkgs/by-name/rn/rnote/package.nix
+++ b/pkgs/by-name/rn/rnote/package.nix
@ -1,28 +1,28 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, alsa-lib
-, appstream
-, appstream-glib
-, cargo
-, cmake
-, desktop-file-utils
-, dos2unix
-, glib
-, gst_all_1
-, gtk4
-, libadwaita
-, libxml2
-, meson
-, ninja
-, pkg-config
-, poppler
-, python3
-, rustPlatform
-, rustc
-, shared-mime-info
-, wrapGAppsHook4
-, darwin
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  alsa-lib,
+  appstream,
+  appstream-glib,
+  cargo,
+  cmake,
+  desktop-file-utils,
+  dos2unix,
+  glib,
+  gst_all_1,
+  gtk4,
+  libadwaita,
+  libxml2,
+  meson,
+  ninja,
+  pkg-config,
+  poppler,
+  python3,
+  rustPlatform,
+  rustc,
+  shared-mime-info,
+  wrapGAppsHook4,
 }:

 stdenv.mkDerivation rec {
@ -67,33 +67,39 @@ stdenv.mkDerivation rec {
    (lib.mesonBool "cli" true)
  ];

-  buildInputs = [
-    appstream
-    glib
-    gst_all_1.gstreamer
-    gtk4
-    libadwaita
-    libxml2
-    poppler
-  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
-    alsa-lib
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.AudioUnit
-  ];
+  buildInputs =
+    [
+      appstream
+      glib
+      gst_all_1.gstreamer
+      gtk4
+      libadwaita
+      libxml2
+      poppler
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      alsa-lib
+    ];

  postPatch = ''
    chmod +x build-aux/*.py
    patchShebangs build-aux
  '';

+  env = lib.optionalAttrs stdenv.cc.isClang {
+    NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-function-pointer-types";
+  };
+
  meta = with lib; {
    homepage = "https://github.com/flxzt/rnote";
    changelog = "https://github.com/flxzt/rnote/releases/tag/${src.rev}";
    description = "Simple drawing application to create handwritten notes";
    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ dotlambda gepbird yrd ];
+    maintainers = with maintainers; [
+      dotlambda
+      gepbird
+      yrd
+    ];
    platforms = platforms.unix;
-    # compiler error since 2023-11-17
-    broken = stdenv.hostPlatform.isDarwin;
  };
 }
--- a/pkgs/by-name/rs/rsgain/package.nix
+++ b/pkgs/by-name/rs/rsgain/package.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
    pname = "rsgain";
-    version = "3.5.2";
+    version = "3.5.3";

    src = fetchFromGitHub {
      owner = "complexlogic";
      repo = "rsgain";
      rev = "v${version}";
-      hash = "sha256-kTvIMsRI99U2ovkN5pC4OUS/bJWpRYSuRcvObvQRnbQ=";
+      hash = "sha256-4LEvcuP2Eyco3iQvT6rZhbfY02Y70rW2n5PaS+rGDkQ=";
    };

    nativeBuildInputs = [pkg-config cmake];
--- a/pkgs/development/tools/rust/rust-analyzer/default.nix
+++ b/pkgs/development/tools/rust/rust-analyzer/default.nix
@ -1,30 +1,39 @@
-{ lib
-, stdenv
-, callPackage
-, fetchFromGitHub
-, rustPlatform
-, CoreServices
-, cmake
-, libiconv
-, useMimalloc ? false
-, doCheck ? true
-, nix-update-script
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  rustPlatform,
+  cmake,
+  libiconv,
+  useMimalloc ? false,
+  doCheck ? true,
+  nix-update-script,
 }:

 rustPlatform.buildRustPackage rec {
  pname = "rust-analyzer-unwrapped";
-  version = "2024-09-02";
-  cargoHash = "sha256-t45RzYkuywGByGWwUON3dW0aKjLYcFXB8uy4CybPuf4=";
+  version = "2024-11-11";
+  cargoHash = "sha256-lzbk/APerZih7+1ZxBKl0rUHCJJA8W8RIqalEfu+MFI=";

  src = fetchFromGitHub {
    owner = "rust-lang";
    repo = "rust-analyzer";
    rev = version;
-    hash = "sha256-YH0kH5CSOnAuPUB1BUzUqvnKiv5SgDhfMNjrkki9Ahk=";
+    hash = "sha256-TDI1s2Sc/rpMLwful1NcTjYBbqzbQ4Mjw5PPOuOXVfg=";
  };

-  cargoBuildFlags = [ "--bin" "rust-analyzer" "--bin" "rust-analyzer-proc-macro-srv" ];
-  cargoTestFlags = [ "--package" "rust-analyzer" "--package" "proc-macro-srv-cli" ];
+  cargoBuildFlags = [
+    "--bin"
+    "rust-analyzer"
+    "--bin"
+    "rust-analyzer-proc-macro-srv"
+  ];
+  cargoTestFlags = [
+    "--package"
+    "rust-analyzer"
+    "--package"
+    "proc-macro-srv-cli"
+  ];

  # Code format check requires more dependencies but don't really matter for packaging.
  # So just ignore it.
@ -33,7 +42,6 @@ rustPlatform.buildRustPackage rec {
  nativeBuildInputs = lib.optional useMimalloc cmake;

  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    CoreServices
    libiconv
  ];

@ -58,13 +66,18 @@ rustPlatform.buildRustPackage rec {
  passthru = {
    updateScript = nix-update-script { };
    # FIXME: Pass overrided `rust-analyzer` once `buildRustPackage` also implements #119942
-    tests.neovim-lsp = callPackage ./test-neovim-lsp.nix { };
+    # FIXME: test script can't find rust std lib so hover doesn't return expected result
+    # https://github.com/NixOS/nixpkgs/pull/354304
+    # tests.neovim-lsp = callPackage ./test-neovim-lsp.nix { };
  };

  meta = with lib; {
    description = "Modular compiler frontend for the Rust language";
    homepage = "https://rust-analyzer.github.io";
-    license = with licenses; [ mit asl20 ];
+    license = with licenses; [
+      mit
+      asl20
+    ];
    maintainers = with maintainers; [ oxalica ];
    mainProgram = "rust-analyzer";
  };
--- a/pkgs/by-name/ru/rust-analyzer-unwrapped/test-neovim-lsp.nix
+++ b/pkgs/by-name/ru/rust-analyzer-unwrapped/test-neovim-lsp.nix
@ -0,0 +1,75 @@
+{
+  runCommand,
+  cargo,
+  neovim,
+  rust-analyzer,
+  rustc,
+}:
+runCommand "test-neovim-rust-analyzer"
+  {
+    nativeBuildInputs = [
+      cargo
+      neovim
+      rust-analyzer
+      rustc
+    ];
+
+    testRustSrc = ''
+      fn main() {
+        let mut var = vec![None];
+        var.push(Some("hello".to_owned()));
+      }
+    '';
+
+    # NB. Wait for server done type calculations before sending `hover` request,
+    # otherwise it would return `{unknown}`.
+    # Ref: https://github.com/rust-lang/rust-analyzer/blob/7b11fdeb681c12002861b9804a388efde81c9647/docs/dev/lsp-extensions.md#server-status
+    nvimConfig = ''
+      local caps = vim.lsp.protocol.make_client_capabilities()
+      caps["experimental"] = { serverStatusNotification = true }
+      vim.lsp.buf_attach_client(vim.api.nvim_get_current_buf(), vim.lsp.start_client({
+        cmd = { "rust-analyzer" },
+        capabilities = caps,
+        handlers = {
+          ["experimental/serverStatus"] = function(_, msg, ctx)
+            if msg.health == "ok" then
+              if msg.quiescent then
+                vim.cmd("goto 23") -- let mut |var =...
+                vim.lsp.buf.hover()
+              end
+            else
+              print("error: server status is not ok: ")
+              vim.cmd("q")
+            end
+          end,
+          ["textDocument/hover"] = function(_, msg, ctx)
+            if msg then
+              -- Keep newlines.
+              io.write(msg.contents.value)
+              vim.cmd("q")
+            end
+          end,
+        },
+        on_error = function(code)
+          print("error: " .. code)
+          vim.cmd("q")
+        end
+      }))
+    '';
+
+  }
+  ''
+    # neovim requires a writable HOME.
+    export HOME="$(pwd)"
+
+    cargo new --bin test-rust-analyzer
+    cd test-rust-analyzer
+    cat <<<"$testRustSrc" >src/main.rs
+    cat <<<"$nvimConfig" >script.lua
+
+    # `-u` doesn't work
+    result="$(nvim --headless +'lua dofile("script.lua")' src/main.rs)"
+    echo "$result"
+    [[ "$result" == *"var: Vec<Option<String>>"* ]]
+    touch $out
+  ''
--- a/pkgs/by-name/ru/rust-analyzer/package.nix
+++ b/pkgs/by-name/ru/rust-analyzer/package.nix
@ -0,0 +1,21 @@
+{
+  rustPlatform,
+  runCommand,
+  makeWrapper,
+  rust-analyzer-unwrapped,
+  pname ? "rust-analyzer",
+  version ? rust-analyzer-unwrapped.version,
+  # Use name from `RUST_SRC_PATH`
+  rustSrc ? rustPlatform.rustLibSrc,
+}:
+runCommand "${pname}-${version}"
+  {
+    inherit pname version;
+    inherit (rust-analyzer-unwrapped) src meta;
+    nativeBuildInputs = [ makeWrapper ];
+  }
+  ''
+    mkdir -p $out/bin
+    makeWrapper ${rust-analyzer-unwrapped}/bin/rust-analyzer $out/bin/rust-analyzer \
+      --set-default RUST_SRC_PATH "${rustSrc}"
+  ''
--- a/pkgs/by-name/sn/snallygaster/package.nix
+++ b/pkgs/by-name/sn/snallygaster/package.nix
@ -1,28 +1,30 @@
-{ lib
-, python3Packages
-, fetchFromGitHub
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
 }:

 python3Packages.buildPythonApplication rec {
  pname = "snallygaster";
-  version = "0.0.12";
+  version = "0.0.13";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "hannob";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-JXuRCUWpoGhBbU38XMEQovCiVfbyBMJ+SIrt3iqFuAo=";
+    repo = "snallygaster";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-d94Z/vLOcOa9N8WIgCkiZAciNUzdI4qbGXQOc8KNDEE=";
  };

-  propagatedBuildInputs = with python3Packages; [
-    urllib3
+  build-system = with python3Packages; [ setuptools ];
+
+  dependencies = with python3Packages; [
    beautifulsoup4
    dnspython
+    urllib3
  ];

-  nativeCheckInputs = with python3Packages; [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = with python3Packages; [ pytestCheckHook ];

  pytestFlagsArray = [
    # we are not interested in linting the project
@ -31,9 +33,9 @@ python3Packages.buildPythonApplication rec {

  meta = with lib; {
    description = "Tool to scan for secret files on HTTP servers";
-    mainProgram = "snallygaster";
    homepage = "https://github.com/hannob/snallygaster";
-    license = licenses.cc0;
-    maintainers = [ ];
+    license = licenses.bsd0;
+    maintainers = with maintainers; [ fab ];
+    mainProgram = "snallygaster";
  };
 }
--- a/pkgs/by-name/sn/snapper/package.nix
+++ b/pkgs/by-name/sn/snapper/package.nix
@ -1,36 +1,72 @@
-{ lib, stdenv, fetchFromGitHub
-, autoreconfHook, pkg-config, docbook_xsl, libxslt, docbook_xml_dtd_45
-, acl, attr, boost, btrfs-progs, coreutils, dbus, diffutils, e2fsprogs, libxml2
-, lvm2, pam, util-linux, json_c, nixosTests
-, ncurses, zlib }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  pkg-config,
+  docbook_xsl,
+  libxslt,
+  docbook_xml_dtd_45,
+  acl,
+  attr,
+  boost,
+  btrfs-progs,
+  coreutils,
+  dbus,
+  diffutils,
+  e2fsprogs,
+  libxml2,
+  lvm2,
+  pam,
+  util-linux,
+  json_c,
+  nixosTests,
+  ncurses,
+  zlib,
+}:

 stdenv.mkDerivation rec {
  pname = "snapper";
-  version = "0.11.2";
+  version = "0.12.0";

  src = fetchFromGitHub {
    owner = "openSUSE";
    repo = "snapper";
    rev = "v${version}";
-    sha256 = "sha256-U948AmyQ6c5+FCrDijOVLc/p2wwbq5IWwS66x+O960Y=";
+    sha256 = "sha256-Hh5etDx7nLBYC6VLeZS4F52w2VpaA4aZRvGUQ0QGBJc=";
  };

  strictDeps = true;

  nativeBuildInputs = [
-    autoreconfHook pkg-config
-    docbook_xsl libxslt docbook_xml_dtd_45
+    autoreconfHook
+    pkg-config
+    docbook_xsl
+    libxslt
+    docbook_xml_dtd_45
  ];
  buildInputs = [
-    acl attr boost btrfs-progs dbus diffutils e2fsprogs libxml2
-    lvm2 pam util-linux json_c ncurses zlib
+    acl
+    attr
+    boost
+    btrfs-progs
+    dbus
+    diffutils
+    e2fsprogs
+    libxml2
+    lvm2
+    pam
+    util-linux
+    json_c
+    ncurses
+    zlib
  ];

  passthru.tests.snapper = nixosTests.snapper;

  postPatch = ''
    # Hard-coded root paths, hard-coded root paths everywhere...
-    for file in {client,data,pam,scripts,zypp-plugin}/Makefile.am; do
+    for file in {client,client/installation-helper,client/systemd-helper,data,pam,scripts,zypp-plugin}/Makefile.am; do
      substituteInPlace $file \
        --replace '$(DESTDIR)/usr' "$out" \
        --replace "DESTDIR" "out" \
@ -41,15 +77,13 @@ stdenv.mkDerivation rec {
  '';

  configureFlags = [
-    "--disable-ext4"	# requires patched kernel & e2fsprogs
+    "--disable-ext4" # requires patched kernel & e2fsprogs
    "DIFFBIN=${diffutils}/bin/diff"
    "RMBIN=${coreutils}/bin/rm"
  ];

  enableParallelBuilding = true;

-  env.NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
-
  postInstall = ''
    rm -r $out/etc/cron.*
    patchShebangs $out/lib/zypp/plugins/commit/*
@ -62,12 +96,12 @@ stdenv.mkDerivation rec {
    done
  '';

-  meta = with lib; {
+  meta = {
    description = "Tool for Linux filesystem snapshot management";
    homepage = "http://snapper.io";
-    license = licenses.gpl2Only;
+    license = lib.licenses.gpl2Only;
    mainProgram = "snapper";
-    maintainers = with maintainers; [ markuskowa ];
-    platforms = platforms.linux;
+    maintainers = with lib.maintainers; [ markuskowa ];
+    platforms = lib.platforms.linux;
  };
 }
--- a/pkgs/by-name/sp/spotify-player/package.nix
+++ b/pkgs/by-name/sp/spotify-player/package.nix
@ -1,39 +1,50 @@
-{ lib
-, rustPlatform
-, fetchFromGitHub
-, pkg-config
-, openssl
-, cmake
-# deps for audio backends
-, alsa-lib
-, libpulseaudio
-, portaudio
-, libjack2
-, SDL2
-, gst_all_1
-, dbus
-, fontconfig
-, libsixel
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  openssl,
+  cmake,
+  # deps for audio backends
+  alsa-lib,
+  libpulseaudio,
+  portaudio,
+  libjack2,
+  SDL2,
+  gst_all_1,
+  dbus,
+  fontconfig,
+  libsixel,
+  apple-sdk_11,

-# build options
-, withStreaming ? true
-, withDaemon ? true
-, withAudioBackend ? "rodio" # alsa, pulseaudio, rodio, portaudio, jackaudio, rodiojack, sdl
-, withMediaControl ? true
-, withLyrics ? true
-, withImage ? true
-, withNotify ? true
-, withSixel ? true
-, withFuzzy ? true
-, stdenv
-, darwin
-, makeBinaryWrapper
+  # build options
+  withStreaming ? true,
+  withDaemon ? true,
+  withAudioBackend ? "rodio", # alsa, pulseaudio, rodio, portaudio, jackaudio, rodiojack, sdl
+  withMediaControl ? true,
+  withLyrics ? true,
+  withImage ? true,
+  withNotify ? true,
+  withSixel ? true,
+  withFuzzy ? true,
+  stdenv,
+  makeBinaryWrapper,

-# passthru
-, nix-update-script
+  # passthru
+  nix-update-script,
 }:

-assert lib.assertOneOf "withAudioBackend" withAudioBackend [ "" "alsa" "pulseaudio" "rodio" "portaudio" "jackaudio" "rodiojack" "sdl" "gstreamer" ];
+assert lib.assertOneOf "withAudioBackend" withAudioBackend [
+  ""
+  "alsa"
+  "pulseaudio"
+  "rodio"
+  "portaudio"
+  "jackaudio"
+  "rodiojack"
+  "sdl"
+  "gstreamer"
+];

 rustPlatform.buildRustPackage rec {
  pname = "spotify-player";
@ -48,38 +59,47 @@ rustPlatform.buildRustPackage rec {

  cargoHash = "sha256-VlJ8Bz4EY2rERyOn6ifC7JAL5Mvjt0ZOzlPBOwiH6WA=";

-  nativeBuildInputs = [
-    pkg-config
-    cmake
-    rustPlatform.bindgenHook
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    makeBinaryWrapper
-  ];
+  nativeBuildInputs =
+    [
+      pkg-config
+      cmake
+      rustPlatform.bindgenHook
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      makeBinaryWrapper
+    ];

-  buildInputs = [
-    openssl
-    dbus
-    fontconfig
-  ]
+  buildInputs =
+    [
+      openssl
+      dbus
+      fontconfig
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      apple-sdk_11 # can be removed once x86_64-darwin defaults to a newer SDK
+    ]
    ++ lib.optionals withSixel [ libsixel ]
    ++ lib.optionals (withAudioBackend == "alsa") [ alsa-lib ]
    ++ lib.optionals (withAudioBackend == "pulseaudio") [ libpulseaudio ]
    ++ lib.optionals (withAudioBackend == "rodio" && stdenv.hostPlatform.isLinux) [ alsa-lib ]
    ++ lib.optionals (withAudioBackend == "portaudio") [ portaudio ]
    ++ lib.optionals (withAudioBackend == "jackaudio") [ libjack2 ]
-    ++ lib.optionals (withAudioBackend == "rodiojack") [ alsa-lib libjack2 ]
+    ++ lib.optionals (withAudioBackend == "rodiojack") [
+      alsa-lib
+      libjack2
+    ]
    ++ lib.optionals (withAudioBackend == "sdl") [ SDL2 ]
-    ++ lib.optionals (withAudioBackend == "gstreamer") [ gst_all_1.gstreamer gst_all_1.gst-devtools gst_all_1.gst-plugins-base gst_all_1.gst-plugins-good ]
-    ++ lib.optionals (stdenv.hostPlatform.isDarwin && withMediaControl) [ darwin.apple_sdk.frameworks.MediaPlayer ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (with darwin.apple_sdk.frameworks; [
-      AppKit
-      AudioUnit
-      Cocoa
-    ]);
+    ++ lib.optionals (withAudioBackend == "gstreamer") [
+      gst_all_1.gstreamer
+      gst_all_1.gst-devtools
+      gst_all_1.gst-plugins-base
+      gst_all_1.gst-plugins-good
+    ];

  buildNoDefaultFeatures = true;

-  buildFeatures = [ ]
+  buildFeatures =
+    [ ]
    ++ lib.optionals (withAudioBackend != "") [ "${withAudioBackend}-backend" ]
    ++ lib.optionals withMediaControl [ "media-control" ]
    ++ lib.optionals withImage [ "image" ]
@ -93,7 +113,7 @@ rustPlatform.buildRustPackage rec {
  # sixel-sys is dynamically linked to libsixel
  postInstall = lib.optionals (stdenv.hostPlatform.isDarwin && withSixel) ''
    wrapProgram $out/bin/spotify_player \
-      --prefix DYLD_LIBRARY_PATH : "${lib.makeLibraryPath [libsixel]}"
+      --prefix DYLD_LIBRARY_PATH : "${lib.makeLibraryPath [ libsixel ]}"
  '';

  passthru = {
@ -106,6 +126,11 @@ rustPlatform.buildRustPackage rec {
    changelog = "https://github.com/aome510/spotify-player/releases/tag/v${version}";
    mainProgram = "spotify_player";
    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ dit7ya xyven1 _71zenith caperren ];
+    maintainers = with lib.maintainers; [
+      dit7ya
+      xyven1
+      _71zenith
+      caperren
+    ];
  };
 }
--- a/pkgs/by-name/te/tetrio-plus/package.nix
+++ b/pkgs/by-name/te/tetrio-plus/package.nix
@ -2,74 +2,25 @@
  lib,
  stdenv,
  fetchFromGitLab,
-  rustPlatform,
-  rustc,
-  wasm-pack,
-  wasm-bindgen-cli,
-  binaryen,
-
  fetchYarnDeps,
  yarn,
  fixup-yarn-lock,
  nodejs,
  asar,

+  tpsecore,
  tetrio-desktop,
 }:

 let
-  version = "0.27.4";
+  version = "0.27.5";
  rev = "electron-v${version}-tetrio-v${tetrio-desktop.version}";

  src = fetchFromGitLab {
    owner = "UniQMG";
    repo = "tetrio-plus";
    inherit rev;
-    hash = "sha256-HwGFg8dxqtqghdP+PXWXr6Fi5vfgopThs+QNa3N1awk=";
-    fetchSubmodules = true;
-  };
-
-  wasm-bindgen-82 = wasm-bindgen-cli.override {
-    version = "0.2.82";
-    hash = "sha256-BQ8v3rCLUvyCCdxo5U+NHh30l9Jwvk9Sz8YQv6fa0SU=";
-    cargoHash = "sha256-mP85+qi2KA0GieaBzbrQOBqYxBZNRJipvd2brCRGyOM=";
-  };
-
-  tpsecore = rustPlatform.buildRustPackage {
-    pname = "tpsecore";
-    inherit version src;
-
-    sourceRoot = "${src.name}/tpsecore";
-
-    cargoHash = "sha256-zqeoPeGZvSz7W3c7MXnvvq73hvavg1RGzPc3iTqAjBo=";
-
-    nativeBuildInputs = [
-      wasm-pack
-      wasm-bindgen-82
-      binaryen
-      rustc.llvmPackages.lld
-    ];
-
-    buildPhase = ''
-      HOME=$(mktemp -d) wasm-pack build --target web --release
-    '';
-
-    installPhase = ''
-      cp -r pkg/ $out
-    '';
-
-    doCheck = false;
-
-    meta = {
-      description = "Self contained toolkit for creating, editing, and previewing TPSE files";
-      homepage = "https://gitlab.com/UniQMG/tpsecore";
-      license = lib.licenses.mit;
-      maintainers = with lib.maintainers; [
-        huantian
-        wackbyte
-      ];
-      platforms = lib.platforms.linux;
-    };
+    hash = "sha256-hbHofrC2dJOh2kh3VLb/d0dHrcszyqTyID1PAaGApxY=";
  };

  offlineCache = fetchYarnDeps {
@ -119,16 +70,12 @@ stdenv.mkDerivation (finalAttrs: {
    # Actually install tetrio-plus where the above patch script expects
    cp -r $src out/tetrioplus
    chmod -R u+w out/tetrioplus
-
    # Install tpsecore
    cp ${tpsecore}/{tpsecore_bg.wasm,tpsecore.js} out/tetrioplus/source/lib/
-    # Remove uneeded tpsecore source code
-    rm -rf out/tetrioplus/tpsecore/

    # Disable useless uninstall button in the tetrio-plus popup
    substituteInPlace out/tetrioplus/desktop-manifest.js \
      --replace-fail '"show_uninstaller_button": true' '"show_uninstaller_button": false'
-
    # Display 'nixpkgs' next to version in tetrio-plus popup
    echo "nixpkgs" > out/tetrioplus/resources/override-commit

--- a/pkgs/by-name/tp/tpsecore/package.nix
+++ b/pkgs/by-name/tp/tpsecore/package.nix
@ -0,0 +1,68 @@
+{
+  lib,
+  fetchFromGitLab,
+  rustPlatform,
+  rustc,
+  wasm-pack,
+  wasm-bindgen-cli,
+  binaryen,
+}:
+
+let
+  version = "0.1.1";
+
+  wasm-bindgen-cli-95 = wasm-bindgen-cli.override {
+    version = "0.2.95";
+    hash = "sha256-prMIreQeAcbJ8/g3+pMp1Wp9H5u+xLqxRxL+34hICss=";
+    cargoHash = "sha256-6iMebkD7FQvixlmghGGIvpdGwFNLfnUcFke/Rg8nPK4=";
+  };
+in
+rustPlatform.buildRustPackage {
+  pname = "tpsecore";
+  inherit version;
+
+  src = fetchFromGitLab {
+    owner = "UniQMG";
+    repo = "tpsecore";
+    rev = "v${version}";
+    hash = "sha256-+OynnLMBEiYwdFzxGzgkcBN6xrHoH1Q6O5i+OW7RBLo=";
+  };
+
+  cargoHash = "sha256-mPaWXiDjJd/uTBpktauKWg8X9sNBb3FXw5BSGB33NxI=";
+
+  nativeBuildInputs = [
+    wasm-pack
+    wasm-bindgen-cli-95
+    binaryen
+    rustc.llvmPackages.lld
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    HOME=$(mktemp -d) wasm-pack build --target web --release
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    cp -r pkg/ $out
+
+    runHook postInstall
+  '';
+
+  doCheck = false;
+
+  meta = {
+    description = "Self contained toolkit for creating, editing, and previewing TPSE files";
+    homepage = "https://gitlab.com/UniQMG/tpsecore";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      huantian
+      wackbyte
+    ];
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/by-name/v2/v2ray-domain-list-community/package.nix
+++ b/pkgs/by-name/v2/v2ray-domain-list-community/package.nix
@ -3,12 +3,12 @@
 let
  generator = pkgsBuildBuild.buildGoModule rec {
    pname = "v2ray-domain-list-community";
-    version = "20241013063848";
+    version = "20241112092643";
    src = fetchFromGitHub {
      owner = "v2fly";
      repo = "domain-list-community";
      rev = version;
-      hash = "sha256-YFsz+fT2LPU4TakQ2V1PtETmnXI5r3qAaERAqM9mX5g=";
+      hash = "sha256-+S93tyYzkEMous+PkpR1yMAZmfSEc/HRqxUjXOeWIGk=";
    };
    vendorHash = "sha256-NLh14rXRci4hgDkBJVJDIDvobndB7KYRKAX7UjyqSsg=";
    meta = with lib; {
--- a/pkgs/by-name/va/vale/styles.nix
+++ b/pkgs/by-name/va/vale/styles.nix
@ -45,12 +45,12 @@ in
 {
  alex = buildStyle rec {
    name = "alex";
-    version = "0.2.2";
+    version = "0.2.3";
    src = fetchFromGitHub {
      owner = "errata-ai";
      repo = "alex";
      rev = "v${version}";
-      hash = "sha256-mfeMa+KlkqwyS+h+oo5p5+P2bsmZ0BOph2nbQiaoNqM=";
+      hash = "sha256-p0CQg6ZLusSKr57SugwlnoDEoPNVY3UIM8rHHxOL2l0=";
    };
    meta = {
      description = "Vale-compatible implementation of the guidelines enforced by the alex linter";
@ -61,12 +61,12 @@ in

  google = buildStyle rec {
    name = "Google";
-    version = "0.6.1";
+    version = "0.6.2";
    src = fetchFromGitHub {
      owner = "errata-ai";
      repo = "Google";
      rev = "v${version}";
-      hash = "sha256-jSmfUgzlIbDVh2zLtnTNpM/z6dHMp358F9adLZ5+qcw=";
+      hash = "sha256-ldwK9tMA04H/jTd3dQeRX/sZOwZcyPb+I56cDg0vZDg=";
    };
    meta = {
      description = "Vale-compatible implementation of the Google Developer Documentation Style Guide";
--- a/pkgs/by-name/va/vapoursynth-bestsource/package.nix
+++ b/pkgs/by-name/va/vapoursynth-bestsource/package.nix
@ -0,0 +1,60 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  ninja,
+  cmake,
+  pkg-config,
+  vapoursynth,
+  ffmpeg,
+  xxHash,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "vapoursynth-bestsource";
+  version = "6";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchFromGitHub {
+    fetchSubmodules = true;
+    owner = "vapoursynth";
+    repo = "bestsource";
+    rev = "refs/tags/R${finalAttrs.version}";
+    hash = "sha256-ICkdIomlkHUdK6kMeui45fvUn4OMxSrP8svB2IN+GCg=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    vapoursynth
+    ffmpeg
+    xxHash
+  ];
+
+  postPatch = ''
+    substituteInPlace meson.build \
+      --replace-fail "vapoursynth_dep.get_variable(pkgconfig: 'libdir')" "get_option('libdir')"
+  '';
+
+  meta = {
+    description = "Wrapper library around FFmpeg that ensures sample and frame accurate access to audio and video";
+    homepage = "https://github.com/vapoursynth/bestsource";
+    license = with lib.licenses; [
+      mit
+      wtfpl
+      gpl2Plus
+    ];
+    maintainers = with lib.maintainers; [ snaki ];
+    platforms = lib.platforms.x86_64;
+  };
+})
--- a/pkgs/by-name/va/vapoursynth-eedi3/package.nix
+++ b/pkgs/by-name/va/vapoursynth-eedi3/package.nix
@ -0,0 +1,56 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  ninja,
+  pkg-config,
+  boost,
+  vapoursynth,
+  opencl-headers,
+  ocl-icd,
+  openclSupport ? true,
+}:
+
+stdenv.mkDerivation {
+  pname = "vapoursynth-eedi3";
+  version = "unstable-2019-09-30";
+
+  src = fetchFromGitHub {
+    owner = "HomeOfVapourSynthEvolution";
+    repo = "VapourSynth-EEDI3";
+    rev = "d11bdb37c7a7118cd095b53d9f8fbbac02a06ac0";
+    hash = "sha256-MIUf6sOnJ2uqGw3ixEHy1ijzlLFkQauwtm1vfgmYmcg=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs =
+    [
+      boost
+      vapoursynth
+    ]
+    ++ lib.optionals openclSupport [
+      ocl-icd
+      opencl-headers
+    ];
+
+  postPatch = ''
+    substituteInPlace meson.build \
+      --replace-fail "vapoursynth_dep.get_pkgconfig_variable('libdir')" "get_option('libdir')"
+  '';
+
+  mesonFlags = [ (lib.mesonBool "opencl" openclSupport) ];
+
+  meta = {
+    description = "Filter for VapourSynth";
+    homepage = "https://github.com/HomeOfVapourSynthEvolution/VapourSynth-EEDI3";
+    license = with lib.licenses; [ gpl2Plus ];
+    maintainers = with lib.maintainers; [ snaki ];
+    platforms = lib.platforms.x86_64;
+  };
+}
--- a/pkgs/by-name/va/vapoursynth-nnedi3/package.nix
+++ b/pkgs/by-name/va/vapoursynth-nnedi3/package.nix
@ -0,0 +1,45 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  pkg-config,
+  vapoursynth,
+  yasm,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "vapoursynth-nnedi3";
+  version = "12";
+
+  src = fetchFromGitHub {
+    owner = "dubhater";
+    repo = "vapoursynth-nnedi3";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-jd/PCXhbCZGMsoXjekbeqMSRVBJAy4INdpkTbZFjVO0=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+
+  buildInputs = [
+    vapoursynth
+    yasm
+  ];
+
+  configureFlags = [ "--libdir=$(out)/lib/vapoursynth" ];
+
+  postInstall = ''
+    rm -f $out/lib/vapoursynth/*.la
+  '';
+
+  meta = {
+    description = "Filter for VapourSynth";
+    homepage = "https://github.com/dubhater/vapoursynth-nnedi3";
+    license = with lib.licenses; [ gpl2Plus ];
+    maintainers = with lib.maintainers; [ snaki ];
+    platforms = with lib.platforms; x86_64 ++ aarch64;
+  };
+})
--- a/pkgs/by-name/va/vapoursynth-nnedi3cl/package.nix
+++ b/pkgs/by-name/va/vapoursynth-nnedi3cl/package.nix
@ -0,0 +1,50 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  ninja,
+  pkg-config,
+  boost,
+  vapoursynth,
+  opencl-headers,
+  ocl-icd,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "vapoursynth-nnedi3cl";
+  version = "8";
+
+  src = fetchFromGitHub {
+    owner = "HomeOfVapourSynthEvolution";
+    repo = "VapourSynth-NNEDI3CL";
+    rev = "refs/tags/r${finalAttrs.version}";
+    hash = "sha256-zW/qEtZTDJOTarXbXhv+nks25eePutLDpLck4TuMKUk=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    boost
+    vapoursynth
+    ocl-icd
+    opencl-headers
+  ];
+
+  postPatch = ''
+    substituteInPlace meson.build \
+      --replace-fail "vapoursynth_dep.get_pkgconfig_variable('libdir')" "get_option('libdir')"
+  '';
+
+  meta = {
+    description = "Filter for VapourSynth";
+    homepage = "https://github.com/HomeOfVapourSynthEvolution/VapourSynth-NNEDI3CL";
+    license = with lib.licenses; [ gpl2Plus ];
+    maintainers = with lib.maintainers; [ snaki ];
+    platforms = lib.platforms.x86_64;
+  };
+})
--- a/pkgs/by-name/va/vapoursynth-znedi3/package.nix
+++ b/pkgs/by-name/va/vapoursynth-znedi3/package.nix
@ -0,0 +1,54 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  vapoursynth,
+}:
+
+stdenv.mkDerivation {
+  pname = "vapoursynth-znedi3";
+  version = "unstable-2023-07-09";
+
+  src = fetchFromGitHub {
+    fetchSubmodules = true;
+    owner = "sekrit-twc";
+    repo = "znedi3";
+    rev = "68dc130bc37615fd912d1dc1068261f00f54b146";
+    hash = "sha256-QC+hMMfp6XwW4PqsN6sip1Y7ttiYn/xuxq/pUg/trog=";
+  };
+
+  buildInputs = [ vapoursynth ];
+
+  postPatch = ''
+    rm -rf vsxx/vapoursynth
+    ln -s ${vapoursynth}/include/vapoursynth vsxx/vapoursynth
+  '';
+
+  makeFlags =
+    [ "CPPFLAGS=-DNNEDI3_WEIGHTS_PATH='\"$(out)/share/nnedi3/nnedi3_weights.bin\"'" ]
+    ++ lib.optionals stdenv.hostPlatform.isx86 [
+      "X86=1"
+      "X86_AVX512=1"
+    ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -t $out/lib/vapoursynth vsznedi3${stdenv.hostPlatform.extensions.sharedLibrary}
+    install -D -m644 -t $out/share/nnedi3 nnedi3_weights.bin
+
+    runHook postInstall
+  '';
+
+  meta = {
+    inherit (vapoursynth.meta) platforms;
+    description = "Filter for VapourSynth";
+    homepage = "https://github.com/sekrit-twc/znedi3";
+    license = with lib.licenses; [
+      gpl2Plus
+      wtfpl
+      lgpl21
+    ];
+    maintainers = with lib.maintainers; [ snaki ];
+  };
+}
--- a/pkgs/development/libraries/libcxxrt/default.nix
+++ b/pkgs/development/libraries/libcxxrt/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation {
  pname = "libcxxrt";
-  version = "4.0.10-unstable-2024-09-24";
+  version = "4.0.10-unstable-2024-10-30";

  src = fetchFromGitHub {
    owner = "libcxxrt";
    repo = "libcxxrt";
-    rev = "40e4fa2049930412a2c43cdf0c39b6b5aa735341";
-    sha256 = "2rEbRTr8RLl8EKrDq210baCPDt9OppdL7zloNjGOZME=";
+    rev = "6f2fdfebcd6291d763de8b17740d636f01761890";
+    sha256 = "iUuIhwFg1Ys9DDoyDFTjEIlCVDdA1TACwtYXSRr5+2g=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/php-packages/psalm/default.nix
+++ b/pkgs/development/php-packages/psalm/default.nix
@ -11,14 +11,14 @@ php.buildComposerProject2 (finalAttrs: {
  src = fetchFromGitHub {
    owner = "vimeo";
    repo = "psalm";
-    rev = finalAttrs.version;
+    rev = "refs/tags/${finalAttrs.version}";
    hash = "sha256-ecORCwTnTKzy/pgfODu9W9I/5xL+8Fo4OgZ5LsYDYLQ=";
  };

  # Missing `composer.lock` from the repository.
  # Issue open at https://github.com/vimeo/psalm/issues/10446
  composerLock = ./composer.lock;
-  vendorHash = "sha256-8SsGwKeE4b9sRD2STRMjWW50UVy9x8HZsZhT0sIC/Cg=";
+  vendorHash = "sha256-lPUwhEUFIyFZPHFxQTE0l7GkkJxGCcSGSYqaVOohSgs=";

  meta = {
    changelog = "https://github.com/vimeo/psalm/releases/tag/${finalAttrs.version}";
--- a/pkgs/development/python-modules/amqp/default.nix
+++ b/pkgs/development/python-modules/amqp/default.nix
@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "amqp";
-  version = "5.2.0";
+  version = "5.3.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-oez/QlrQY61CpIbJAoB9FIIxFIHIrZWnJpSyl1519/0=";
+    hash = "sha256-ET5mMQai+wEjyQMNQr85WbliSSg/8UI6sH9crQYtNvc=";
  };

  propagatedBuildInputs = [ vine ];
--- a/pkgs/development/python-modules/gradio/client.nix
+++ b/pkgs/development/python-modules/gradio/client.nix
@ -105,7 +105,10 @@ buildPythonPackage rec {
  __darwinAllowLocalNetworking = true;

  passthru.updateScript = nix-update-script {
-    extraArgs = [ "--version-regex" "gradio_client@(.*)" ];
+    extraArgs = [
+      "--version-regex"
+      "gradio_client@(.*)"
+    ];
  };

  meta = {
--- a/pkgs/development/python-modules/gradio/default.nix
+++ b/pkgs/development/python-modules/gradio/default.nix
@ -87,6 +87,7 @@ buildPythonPackage rec {
    "tomlkit"
    "aiofiles"
    "markupsafe"
+    "pillow"
  ];

  pythonRemoveDeps = [
@ -169,87 +170,89 @@ buildPythonPackage rec {
      ulimit -n 4096
    '';

-  disabledTests = [
-    # Actually broken
-    "test_mount_gradio_app"
-    "test_processing_utils_backwards_compatibility" # type error
+  disabledTests =
+    [
+      # Actually broken
+      "test_mount_gradio_app"
+      "test_processing_utils_backwards_compatibility" # type error

-    # requires network, it caught our xfail exception
-    "test_error_analytics_successful"
+      # requires network, it caught our xfail exception
+      "test_error_analytics_successful"

-    # Flaky, tries to pin dependency behaviour. Sensitive to dep versions
-    # These error only affect downstream use of the check dependencies.
-    "test_no_color"
-    "test_in_interface_as_output"
-    "test_should_warn_url_not_having_version"
+      # Flaky, tries to pin dependency behaviour. Sensitive to dep versions
+      # These error only affect downstream use of the check dependencies.
+      "test_no_color"
+      "test_in_interface_as_output"
+      "test_should_warn_url_not_having_version"

-    # Flaky, unknown reason
-    "test_in_interface"
+      # Flaky, unknown reason
+      "test_in_interface"

-    # shap is too often broken in nixpkgs
-    "test_shapley_text"
+      # shap is too often broken in nixpkgs
+      "test_shapley_text"

-    # fails without network
-    "test_download_if_url_correct_parse"
+      # fails without network
+      "test_download_if_url_correct_parse"

-    # flaky: OSError: Cannot find empty port in range: 7860-7959
-    "test_docs_url"
-    "test_orjson_serialization"
-    "test_dataset_is_updated"
-    "test_multimodal_api"
+      # flaky: OSError: Cannot find empty port in range: 7860-7959
+      "test_docs_url"
+      "test_orjson_serialization"
+      "test_dataset_is_updated"
+      "test_multimodal_api"

-    # tests if pip and other tools are installed
-    "test_get_executable_path"
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    # flaky on darwin (depend on port availability)
-    "test_all_status_messages"
-    "test_async_generators"
-    "test_async_generators_interface"
-    "test_async_iterator_update_with_new_component"
-    "test_concurrency_limits"
-    "test_default_concurrency_limits"
-    "test_default_flagging_callback"
-    "test_end_to_end"
-    "test_end_to_end_cache_examples"
-    "test_event_data"
-    "test_every_does_not_block_queue"
-    "test_example_caching_relaunch"
-    "test_example_caching_relaunch"
-    "test_exit_called_at_launch"
-    "test_file_component_uploads"
-    "test_files_saved_as_file_paths"
-    "test_flagging_does_not_create_unnecessary_directories"
-    "test_flagging_no_permission_error_with_flagging_disabled"
-    "test_info_and_warning_alerts"
-    "test_info_isolation"
-    "test_launch_analytics_does_not_error_with_invalid_blocks"
-    "test_no_empty_audio_files"
-    "test_no_empty_image_files"
-    "test_no_empty_video_files"
-    "test_non_streaming_api"
-    "test_non_streaming_api_async"
-    "test_pil_images_hashed"
-    "test_progress_bar"
-    "test_progress_bar_track_tqdm"
-    "test_queue_when_using_auth"
-    "test_restart_after_close"
-    "test_set_share_in_colab"
-    "test_show_error"
-    "test_simple_csv_flagging_callback"
-    "test_single_request"
-    "test_socket_reuse"
-    "test_start_server"
-    "test_state_holder_is_used_in_postprocess"
-    "test_state_stored_up_to_capacity"
-    "test_static_files_single_app"
-    "test_streaming_api"
-    "test_streaming_api_async"
-    "test_streaming_api_with_additional_inputs"
-    "test_sync_generators"
-    "test_time_to_live_and_delete_callback_for_state"
-    "test_updates_stored_up_to_capacity"
-    "test_varying_output_forms_with_generators"
-  ];
+      # tests if pip and other tools are installed
+      "test_get_executable_path"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # flaky on darwin (depend on port availability)
+      "test_all_status_messages"
+      "test_async_generators"
+      "test_async_generators_interface"
+      "test_async_iterator_update_with_new_component"
+      "test_concurrency_limits"
+      "test_default_concurrency_limits"
+      "test_default_flagging_callback"
+      "test_end_to_end"
+      "test_end_to_end_cache_examples"
+      "test_event_data"
+      "test_every_does_not_block_queue"
+      "test_example_caching_relaunch"
+      "test_example_caching_relaunch"
+      "test_exit_called_at_launch"
+      "test_file_component_uploads"
+      "test_files_saved_as_file_paths"
+      "test_flagging_does_not_create_unnecessary_directories"
+      "test_flagging_no_permission_error_with_flagging_disabled"
+      "test_info_and_warning_alerts"
+      "test_info_isolation"
+      "test_launch_analytics_does_not_error_with_invalid_blocks"
+      "test_no_empty_audio_files"
+      "test_no_empty_image_files"
+      "test_no_empty_video_files"
+      "test_non_streaming_api"
+      "test_non_streaming_api_async"
+      "test_pil_images_hashed"
+      "test_progress_bar"
+      "test_progress_bar_track_tqdm"
+      "test_queue_when_using_auth"
+      "test_restart_after_close"
+      "test_set_share_in_colab"
+      "test_show_error"
+      "test_simple_csv_flagging_callback"
+      "test_single_request"
+      "test_socket_reuse"
+      "test_start_server"
+      "test_state_holder_is_used_in_postprocess"
+      "test_state_stored_up_to_capacity"
+      "test_static_files_single_app"
+      "test_streaming_api"
+      "test_streaming_api_async"
+      "test_streaming_api_with_additional_inputs"
+      "test_sync_generators"
+      "test_time_to_live_and_delete_callback_for_state"
+      "test_updates_stored_up_to_capacity"
+      "test_varying_output_forms_with_generators"
+    ];
  disabledTestPaths = [
    # 100% touches network
    "test/test_networking.py"
--- a/pkgs/development/python-modules/immutabledict/default.nix
+++ b/pkgs/development/python-modules/immutabledict/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "immutabledict";
-  version = "4.2.0";
+  version = "4.2.1";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "corenting";
    repo = "immutabledict";
    rev = "refs/tags/v${version}";
-    hash = "sha256-NpNS8HAacgXm3rFtyd5uFgSURNbDf+YVS1aFx51kwEA=";
+    hash = "sha256-v2oOzvAa8KONZDQuxouai2B9d1RY4kZG/px2wl0KAyM=";
  };

  nativeBuildInputs = [ poetry-core ];
--- a/pkgs/development/python-modules/pyee/default.nix
+++ b/pkgs/development/python-modules/pyee/default.nix
@ -16,14 +16,14 @@

 buildPythonPackage rec {
  pname = "pyee";
-  version = "12.0.0";
+  version = "12.1.1";
  format = "pyproject";

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-xIBgP0qikn1HZutB+oJ5P+YKgsv9uNaI4NCMVaU04UU=";
+    hash = "sha256-u8M8CeL/gn90GR4+W7xr59oC9ie37DDYb1zhpvskJKM=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pyslurm/default.nix
+++ b/pkgs/development/python-modules/pyslurm/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "pyslurm";
-  version = "23.11.0";
+  version = "24.5.0";
  pyproject = true;

  disabled = pythonOlder "3.6";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    repo = "pyslurm";
    owner = "PySlurm";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Qi0XftneKj7hdDiLY2hoRONRrPv49mfQlvlNkudH54Y=";
+    hash = "sha256-EJTzaoHBidnaHxFLw8FrjJITUxioRGEhl1yvm/QDpXc=";
  };

  nativeBuildInputs = [ setuptools ];
--- a/pkgs/development/python-modules/stim/default.nix
+++ b/pkgs/development/python-modules/stim/default.nix
@ -34,15 +34,26 @@ buildPythonPackage rec {
    # asked to relax this in https://github.com/quantumlib/Stim/issues/623
    substituteInPlace pyproject.toml \
      --replace-quiet "pybind11~=" "pybind11>="
+
+    # Simple workgroud about https://github.com/networkx/networkx/pull/4829
+    # https://github.com/quantumlib/Stim/commit/c0dd0b1c8125b2096cd54b6f72884a459e47fe3e
+    substituteInPlace glue/lattice_surgery/stimzx/_zx_graph_solver.py \
+      --replace-fail "networkx.testing.assert_graphs_equal" "assert networkx.utils.edges_equal"
+
+    substituteInPlace glue/lattice_surgery/stimzx/_text_diagram_parsing.py \
+      --replace-fail "nx.testing.assert_graphs_equal" "assert nx.utils.edges_equal"
+
+    substituteInPlace glue/lattice_surgery/stimzx/_text_diagram_parsing_test.py \
+      --replace-fail "nx.testing.assert_graphs_equal" "assert nx.utils.edges_equal"
  '';

-  nativeBuildInputs = [
+  build-system = [
    pybind11
    setuptools
    wheel
  ];

-  propagatedBuildInputs = [ numpy ];
+  dependencies = [ numpy ];

  nativeCheckInputs = [
    cirq-core
@ -58,17 +69,18 @@ buildPythonPackage rec {

  enableParallelBuilding = true;

-  disabledTestPaths = [
-    # Don't test sample
-    "glue/sample/"
+  pytestFlagsArray = [
+    # From .github/workflows
+    "src/"
+    "glue/cirq"
  ];

-  meta = with lib; {
+  meta = {
    description = "Tool for high performance simulation and analysis of quantum stabilizer circuits, especially quantum error correction (QEC) circuits";
    mainProgram = "stim";
    homepage = "https://github.com/quantumlib/stim";
    changelog = "https://github.com/quantumlib/Stim/releases/tag/v${version}";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ chrispattison ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ chrispattison ];
  };
 }
--- a/pkgs/development/tools/database/replibyte/Cargo.lock
+++ b/pkgs/development/tools/database/replibyte/Cargo.lock
--- a/pkgs/development/tools/rust/rust-analyzer/test-neovim-lsp.nix
+++ b/pkgs/development/tools/rust/rust-analyzer/test-neovim-lsp.nix
@ -1,62 +0,0 @@
-{ runCommand, cargo, neovim, rust-analyzer, rustc }:
-runCommand "test-neovim-rust-analyzer" {
-  nativeBuildInputs = [ cargo neovim rust-analyzer rustc ];
-
-  testRustSrc = /* rust */ ''
-    fn main() {
-      let mut var = vec![None];
-      var.push(Some("hello".to_owned()));
-    }
-  '';
-
-  # NB. Wait for server done type calculations before sending `hover` request,
-  # otherwise it would return `{unknown}`.
-  # Ref: https://github.com/rust-lang/rust-analyzer/blob/7b11fdeb681c12002861b9804a388efde81c9647/docs/dev/lsp-extensions.md#server-status
-  nvimConfig = /* lua */ ''
-    local caps = vim.lsp.protocol.make_client_capabilities()
-    caps["experimental"] = { serverStatusNotification = true }
-    vim.lsp.buf_attach_client(vim.api.nvim_get_current_buf(), vim.lsp.start_client({
-      cmd = { "rust-analyzer" },
-      capabilities = caps,
-      handlers = {
-        ["experimental/serverStatus"] = function(_, msg, ctx)
-          if msg.health == "ok" then
-            if msg.quiescent then
-              vim.cmd("goto 23") -- let mut |var =...
-              vim.lsp.buf.hover()
-            end
-          else
-            print("error: server status is not ok: ")
-            vim.cmd("q")
-          end
-        end,
-        ["textDocument/hover"] = function(_, msg, ctx)
-          if msg then
-            -- Keep newlines.
-            io.write(msg.contents.value)
-            vim.cmd("q")
-          end
-        end,
-      },
-      on_error = function(code)
-        print("error: " .. code)
-        vim.cmd("q")
-      end
-    }))
-  '';
-
-} ''
-  # neovim requires a writable HOME.
-  export HOME="$(pwd)"
-
-  cargo new --bin test-rust-analyzer
-  cd test-rust-analyzer
-  cat <<<"$testRustSrc" >src/main.rs
-  cat <<<"$nvimConfig" >script.lua
-
-  # `-u` doesn't work
-  result="$(nvim --headless +'lua dofile("script.lua")' src/main.rs)"
-  echo "$result"
-  [[ "$result" == *"var: Vec<Option<String>>"* ]]
-  touch $out
-''
--- a/pkgs/development/tools/rust/rust-analyzer/wrapper.nix
+++ b/pkgs/development/tools/rust/rust-analyzer/wrapper.nix
@ -1,15 +0,0 @@
-{ rustPlatform, runCommand, makeWrapper, rust-analyzer-unwrapped
-, pname ? "rust-analyzer"
-, version ? rust-analyzer-unwrapped.version
-  # Use name from `RUST_SRC_PATH`
-, rustSrc ? rustPlatform.rustLibSrc
-}:
-runCommand "${pname}-${version}" {
-  inherit pname version;
-  inherit (rust-analyzer-unwrapped) src meta;
-  nativeBuildInputs = [ makeWrapper ];
-} ''
-  mkdir -p $out/bin
-  makeWrapper ${rust-analyzer-unwrapped}/bin/rust-analyzer $out/bin/rust-analyzer \
-    --set-default RUST_SRC_PATH "${rustSrc}"
-''
--- a/pkgs/servers/sql/postgresql/ext/default.nix
+++ b/pkgs/servers/sql/postgresql/ext/default.nix
@ -1,4 +1,6 @@
-self: super: {
+self: super: let
+  inherit (self) lib config;
+in {

    age = super.callPackage ./age.nix { };

@ -26,8 +28,6 @@ self: super: {

    pg_ed25519 = super.callPackage ./pg_ed25519.nix { };

-    pg_embedding = super.callPackage ./pg_embedding.nix { };
-
    pg_hint_plan = super.callPackage ./pg_hint_plan.nix { };

    pg_ivm = super.callPackage ./pg_ivm.nix { };
@ -107,7 +107,11 @@ self: super: {

    rum = super.callPackage ./rum.nix { };

+    sqlite_fdw = super.callPackage ./sqlite_fdw.nix { };
+
    tsja = super.callPackage ./tsja.nix { };

    wal2json = super.callPackage ./wal2json.nix { };
+} // lib.optionalAttrs config.allowAliases {
+  pg_embedding = throw "PostgreSQL extension `pg_embedding` has been removed since the project has been abandoned. Upstream's recommendation is to use pgvector instead (https://neon.tech/docs/extensions/pg_embedding#migrate-from-pg_embedding-to-pgvector)";
 }
--- a/pkgs/servers/sql/postgresql/ext/pg_embedding.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_embedding.nix
@ -1,22 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, postgresql, buildPostgresqlExtension }:
-
-buildPostgresqlExtension rec {
-  pname = "pg_embedding";
-  version = "0.3.6";
-
-  src = fetchFromGitHub {
-    owner = "neondatabase";
-    repo = pname;
-    rev = version;
-    hash = "sha256-NTBxsQB8mR7e/CWwkCEyDiYhi3Nxl/aKgRBwqc0THcI=";
-  };
-
-  meta = with lib; {
-    description = "PostgreSQL extension implementing the HNSW algorithm for vector similarity search";
-    homepage = "https://github.com/neondatabase/pg_embedding";
-    maintainers = with maintainers; [ ];
-    platforms = postgresql.meta.platforms;
-    license = licenses.asl20;
-    knownVulnerabilities = [ "As of Sept 29, 2023, the authors have abandoned the project and strongly encourage using pgvector, which is faster, has more functionality, and is actively maintained: check out the author's instructions to migrate at https://neon.tech/docs/extensions/pg_embedding#migrate-from-pg_embedding-to-pgvector" ];
-  };
-}
--- a/pkgs/servers/sql/postgresql/ext/sqlite_fdw.nix
+++ b/pkgs/servers/sql/postgresql/ext/sqlite_fdw.nix
@ -0,0 +1,34 @@
+{
+  lib,
+  fetchFromGitHub,
+  sqlite,
+  postgresql,
+  buildPostgresqlExtension,
+}:
+
+buildPostgresqlExtension rec {
+  pname = "sqlite_fdw";
+  # TODO: Check whether PostgreSQL 17 is still broken after next update.
+  version = "2.4.0";
+
+  src = fetchFromGitHub {
+    owner = "pgspider";
+    repo = "sqlite_fdw";
+    rev = "v${version}";
+    hash = "sha256-u51rcKUH2nZyZbI2g3crzHt5jiacbTq4xmfP3JgqnnM=";
+  };
+
+  buildInputs = [ sqlite ];
+
+  makeFlags = [ "USE_PGXS=1" ];
+
+  meta = {
+    description = "SQLite Foreign Data Wrapper for PostgreSQL";
+    homepage = "https://github.com/pgspider/sqlite_fdw";
+    changelog = "https://github.com/pgspider/sqlite_fdw/releases/tag/v${version}";
+    maintainers = with lib.maintainers; [ apfelkuchen6 ];
+    platforms = lib.platforms.unix;
+    license = lib.licenses.postgresql;
+    broken = lib.versionAtLeast postgresql.version "17";
+  };
+}
--- a/pkgs/servers/web-apps/lemmy/pin.json
+++ b/pkgs/servers/web-apps/lemmy/pin.json
@ -1,8 +1,8 @@
 {
-  "serverVersion": "0.19.5",
-  "uiVersion": "0.19.5",
-  "serverHash": "sha256-ellHimZdbB5EQSHVsppBNYyZOODpUADvUn7u6JOu1ns=",
-  "serverCargoHash": "sha256-UdFw8RPKYLqY98So8z9kiaVCl3b8KaqIoUMK/EV2uNM=",
-  "uiHash": "sha256-bhbZQ8tDnJ6TWYj+ki/JQW8cbVjRfLzxaXRDX9JAIm4=",
-  "uiPNPMDepsHash": "sha256-+L6evDPMlEwWk/5qedvITHYRzu1jzB1cLiCTsauPbUI="
+  "serverVersion": "0.19.7",
+  "uiVersion": "0.19.7",
+  "serverHash": "sha256-f1KpjXfGIOzO4L6sjohq2EBJEAqZaPS7osu05RwDs6M=",
+  "serverCargoHash": "sha256-vpjRZ1bFa6If8XX2lfn5QJLpwxeRs8CJui6i/KwozH0=",
+  "uiHash": "sha256-nDO+Cp/DHgw9JuRRAx3IBFIrmhtYDidNKOdtiwZk0N8=",
+  "uiPNPMDepsHash": "sha256-sEN8NUlXWuvfmuAaoy/Vx3X+xG/TbeAdYG2LfctcOGc="
 }
--- a/pkgs/servers/web-apps/lemmy/server.nix
+++ b/pkgs/servers/web-apps/lemmy/server.nix
@ -53,7 +53,7 @@ rustPlatform.buildRustPackage rec {

    # tests require network access
    "--skip=scheduled_tasks::tests::test_nodeinfo_mastodon_social"
-    "--skip=scheduled_tasks::tests::test_nodeinfo_voyager_lemmy_ml"
+    "--skip=scheduled_tasks::tests::test_nodeinfo_lemmy_ml"
  ];

  passthru.updateScript = ./update.py;
--- a/pkgs/tools/filesystems/afsctool/default.nix
+++ b/pkgs/tools/filesystems/afsctool/default.nix
@ -6,22 +6,21 @@
 , git
 , zlib
 , sparsehash
-, CoreServices
 }:

 stdenv.mkDerivation rec {
  pname = "afsctool";
-  version = "1.7.0";
+  version = "1.7.3";

  src = fetchFromGitHub {
    owner = "RJVB";
    repo = pname;
-    rev = version;
-    hash = "sha256-rqca7gpH46hk4MEPMHqYnteYJnGpLS/gu4XP7xWqDzo=";
+    rev = "v${version}";
+    hash = "sha256-cZ0P9cygj+5GgkDRpQk7P9z8zh087fpVfrYXMRRVUAI=";
  };

  nativeBuildInputs = [ pkg-config cmake git ];
-  buildInputs = [ zlib sparsehash CoreServices ];
+  buildInputs = [ zlib sparsehash ];

  meta = with lib; {
    description = "Utility that allows end-users to leverage HFS+/APFS compression";
--- a/pkgs/tools/inputmethods/ibus/default.nix
+++ b/pkgs/tools/inputmethods/ibus/default.nix
@ -58,13 +58,13 @@ in

 stdenv.mkDerivation rec {
  pname = "ibus";
-  version = "1.5.30";
+  version = "1.5.31";

  src = fetchFromGitHub {
    owner = "ibus";
    repo = "ibus";
    rev = version;
-    sha256 = "sha256-VgSjeKF9DCkDfE9lHEaWpgZb6ibdgoDf/I6qeJf8Ah4=";
+    sha256 = "sha256-YMCtLIK/9iUdS37Oiow7WMhFFPKhomNXvzWbLzlUkdQ=";
  };

  patches = [
--- a/pkgs/tools/inputmethods/ibus/fix-paths.patch
+++ b/pkgs/tools/inputmethods/ibus/fix-paths.patch
@ -2,12 +2,13 @@ diff --git a/configure.ac b/configure.ac
 index a3cdb2da..cade9466 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -469,11 +469,11 @@ PKG_CHECK_EXISTS([pygobject-3.0 >= $PYGOBJECT_REQUIRED],
- if test "x$enable_pygobject" = "xyes"; then
+@@ -531,12 +531,12 @@
     PKG_CHECK_MODULES(PYTHON, [pygobject-3.0 >= $PYGOBJECT_REQUIRED])
 
-    pyoverridesdir=`$PYTHON -c "import gi; print(gi._overridesdir)"`
-+    pyoverridesdir="$prefix/@pythonSitePackages@/gi/overrides"
+     if test x"$pyoverridesdir" = x""; then
+-        pyoverridesdir=`$PYTHON -c "import gi; print(gi._overridesdir)"`
+        pyoverridesdir="$prefix/@pythonSitePackages@/gi/overrides"
+     fi
     AC_SUBST(pyoverridesdir)
 
     if test x"$enable_python2" = x"yes"; then
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -946,9 +946,7 @@ with pkgs;

  libdislocator = callPackage ../tools/security/aflplusplus/libdislocator.nix { };

-  afsctool = callPackage ../tools/filesystems/afsctool {
-    inherit (darwin.apple_sdk.frameworks) CoreServices;
-  };
+  afsctool = callPackage ../tools/filesystems/afsctool { };

  aioblescan = with python3Packages; toPythonApplication aioblescan;

@ -7075,10 +7073,6 @@ with pkgs;
  opensyclWithRocm = opensycl.override { rocmSupport = true; };

  rustfmt = rustPackages.rustfmt;
-  rust-analyzer-unwrapped = callPackage ../development/tools/rust/rust-analyzer {
-    inherit (darwin.apple_sdk.frameworks) CoreServices;
-  };
-  rust-analyzer = callPackage ../development/tools/rust/rust-analyzer/wrapper.nix { };
  rust-bindgen-unwrapped = callPackage ../development/tools/rust/bindgen/unwrapped.nix { };
  rust-bindgen = callPackage ../development/tools/rust/bindgen { };
  rust-cbindgen = callPackage ../development/tools/rust/cbindgen {