Merge staging-next into staging

2025-02-23 20:44:12 +00:00 · 2024-06-29 12:01:56 +00:00 · 2024-06-29 12:01:56 +00:00 · 9b085c43da
commit 9b085c43da
parent e2cb76e4ce f018e44bd1
316 changed files with 1994 additions and 4017 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@ -115,8 +115,8 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @raitobezarius
 /nixos/modules/system/boot/loader/systemd-boot      @JulienMalka

 # Images and installer media
-/nixos/modules/installer/cd-dvd/            @samueldr
-/nixos/modules/installer/sd-card/           @samueldr
+/nixos/modules/installer/cd-dvd/
+/nixos/modules/installer/sd-card/

 # Updaters
 ## update.nix
@ -313,10 +313,10 @@ nixos/modules/services/misc/forgejo.nix @adamcstephens @bendlas @emilylange
 pkgs/by-name/fo/forgejo/package.nix     @adamcstephens @bendlas @emilylange

 # Dotnet
-/pkgs/build-support/dotnet                  @IvarWithoutBones
-/pkgs/development/compilers/dotnet          @IvarWithoutBones
-/pkgs/test/dotnet                           @IvarWithoutBones
-/doc/languages-frameworks/dotnet.section.md @IvarWithoutBones
+/pkgs/build-support/dotnet                  @corngood
+/pkgs/development/compilers/dotnet          @corngood
+/pkgs/test/dotnet                           @corngood
+/doc/languages-frameworks/dotnet.section.md @corngood

 # Node.js
 /pkgs/build-support/node/build-npm-package      @lilyinstarlight @winterqt
--- a/lib/cli.nix
+++ b/lib/cli.nix
@ -7,8 +7,6 @@ rec {
    This helps protect against malformed command lines and also to reduce
    boilerplate related to command-line construction for simple use cases.

-    `toGNUCommandLine` returns a list of nix strings.
-
    `toGNUCommandLineShell` returns an escaped shell string.


@ -16,17 +14,86 @@ rec {

    `options`

-    : 1\. Function argument
+    : How to format the arguments, see `toGNUCommandLine`

    `attrs`

-    : 2\. Function argument
+    : The attributes to transform into arguments.


    # Examples
    :::{.example}
    ## `lib.cli.toGNUCommandLineShell` usage example

+    ```nix
+    cli.toGNUCommandLineShell {} {
+      data = builtins.toJSON { id = 0; };
+      X = "PUT";
+      retry = 3;
+      retry-delay = null;
+      url = [ "https://example.com/foo" "https://example.com/bar" ];
+      silent = false;
+      verbose = true;
+    }
+    => "'-X' 'PUT' '--data' '{\"id\":0}' '--retry' '3' '--url' 'https://example.com/foo' '--url' 'https://example.com/bar' '--verbose'";
+    ```
+
+    :::
+  */
+  toGNUCommandLineShell =
+    options: attrs: lib.escapeShellArgs (toGNUCommandLine options attrs);
+
+  /**
+    Automatically convert an attribute set to a list of command-line options.
+
+    `toGNUCommandLine` returns a list of string arguments.
+
+
+    # Inputs
+
+    `options`
+
+    : How to format the arguments, see below.
+
+    `attrs`
+
+    : The attributes to transform into arguments.
+
+    # Options
+
+    `mkOptionName`
+
+    : How to string-format the option name;
+    By default one character is a short option (`-`), more than one characters a long option (`--`).
+
+    `mkBool`
+
+    : How to format a boolean value to a command list;
+    By default it’s a flag option (only the option name if true, left out completely if false).
+
+    `mkList`
+
+    : How to format a list value to a command list;
+    By default the option name is repeated for each value and `mkOption` is applied to the values themselves.
+
+
+    `mkOption`
+
+    : How to format any remaining value to a command list;
+    On the toplevel, booleans and lists are handled by `mkBool` and `mkList`, though they can still appear as values of a list.
+    By default, everything is printed verbatim and complex types are forbidden (lists, attrsets, functions). `null` values are omitted.
+
+    `optionValueSeparator`
+
+    : How to separate an option from its flag;
+    By default, there is no separator, so option `-c` and value `5` would become ["-c" "5"].
+    This is useful if the command requires equals, for example, `-c=5`.
+
+
+    # Examples
+    :::{.example}
+    ## `lib.cli.toGNUCommandLine` usage example
+
    ```nix
    cli.toGNUCommandLine {} {
      data = builtins.toJSON { id = 0; };
@ -45,48 +112,20 @@ rec {
      "--url" "https://example.com/bar"
      "--verbose"
    ]
-
-    cli.toGNUCommandLineShell {} {
-      data = builtins.toJSON { id = 0; };
-      X = "PUT";
-      retry = 3;
-      retry-delay = null;
-      url = [ "https://example.com/foo" "https://example.com/bar" ];
-      silent = false;
-      verbose = true;
-    }
-    => "'-X' 'PUT' '--data' '{\"id\":0}' '--retry' '3' '--url' 'https://example.com/foo' '--url' 'https://example.com/bar' '--verbose'";
    ```

    :::
  */
-  toGNUCommandLineShell =
-    options: attrs: lib.escapeShellArgs (toGNUCommandLine options attrs);
-
  toGNUCommandLine = {
-    # how to string-format the option name;
-    # by default one character is a short option (`-`),
-    # more than one characters a long option (`--`).
    mkOptionName ?
      k: if builtins.stringLength k == 1
          then "-${k}"
          else "--${k}",

-    # how to format a boolean value to a command list;
-    # by default it’s a flag option
-    # (only the option name if true, left out completely if false).
    mkBool ? k: v: lib.optional v (mkOptionName k),

-    # how to format a list value to a command list;
-    # by default the option name is repeated for each value
-    # and `mkOption` is applied to the values themselves.
    mkList ? k: v: lib.concatMap (mkOption k) v,

-    # how to format any remaining value to a command list;
-    # on the toplevel, booleans and lists are handled by `mkBool` and `mkList`,
-    # though they can still appear as values of a list.
-    # By default, everything is printed verbatim and complex types
-    # are forbidden (lists, attrsets, functions). `null` values are omitted.
    mkOption ?
      k: v: if v == null
            then []
@ -95,10 +134,6 @@ rec {
            else
              [ "${mkOptionName k}${optionValueSeparator}${lib.generators.mkValueStringDefault {} v}" ],

-    # how to separate an option from its flag;
-    # by default, there is no separator, so option `-c` and value `5`
-    # would become ["-c" "5"].
-    # This is useful if the command requires equals, for example, `-c=5`.
    optionValueSeparator ? null
    }:
    options:
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -97,6 +97,12 @@
    githubId = 9675338;
    keys = [ { fingerprint = "F466 A548 AD3F C1F1 8C88  4576 8702 7528 B006 D66D"; } ];
  };
+  _0x5a4 = {
+    email = "bej86nug@hhu.de";
+    name = "0x5a4";
+    github = "0x5a4";
+    githubId = 54070204;
+  };
  _0xB10C = {
    email = "nixpkgs@b10c.me";
    name = "0xB10C";
@ -2663,6 +2669,12 @@
    githubId = 37907;
    name = "Julian Stecklina";
  };
+  bloeckchengrafik = {
+    email = "christian.bergschneider@gmx.de";
+    github = "Bloeckchengrafik";
+    githubId = 37768199;
+    name = "Christian Bergschneider";
+  };
  bloveless = {
    email = "brennon.loveless@gmail.com";
    github = "bloveless";
@ -8751,12 +8763,6 @@
    githubId = 650601;
    name = "Ivan Tkatchev";
  };
-  ivar = {
-    email = "ivar.scholten@protonmail.com";
-    github = "IvarWithoutBones";
-    githubId = 41924494;
-    name = "Ivar";
-  };
  ivarmedi = {
    email = "ivar@larsson.me";
    github = "ivarmedi";
@ -13343,6 +13349,12 @@
    githubId = 5698461;
    name = "Maciej Kazulak";
  };
+  mkez = {
+    email = "matias.zwinger+nix@protonmail.com";
+    github = "mk3z";
+    githubId = 52108954;
+    name = "Matias Zwinger";
+  };
  mkf = {
    email = "m@mikf.pl";
    github = "mkf";
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@ -192,7 +192,6 @@ with lib.maintainers;

  dotnet = {
    members = [
-      ivar
      mdarocha
      corngood
      ggg
--- a/nixos/modules/services/networking/scion/scion-control.nix
+++ b/nixos/modules/services/networking/scion/scion-control.nix
@ -12,13 +12,13 @@ let
      reconnect_to_dispatcher = true;
    };
    beacon_db = {
-      connection = "/var/lib/scion-control/control.beacon.db";
+      connection = "/run/scion-control/control.beacon.db";
    };
    path_db = {
-      connection = "/var/lib/scion-control/control.path.db";
+      connection = "/run/scion-control/control.path.db";
    };
    trust_db = {
-      connection = "/var/lib/scion-control/control.trust.db";
+      connection = "/run/scion-control/control.trust.db";
    };
    log.console = {
      level = "info";
@ -35,7 +35,7 @@ in
      example = literalExpression ''
        {
          path_db = {
-            connection = "/var/lib/scion-control/control.path.db";
+            connection = "/run/scion-control/control.path.db";
          };
          log.console = {
            level = "info";
@ -62,7 +62,7 @@ in
        DynamicUser = true;
        Restart = "on-failure";
        BindPaths = [ "/dev/shm:/run/shm" ];
-        StateDirectory = "scion-control";
+        RuntimeDirectory = "scion-control";
      };
    };
  };
--- a/nixos/modules/services/networking/scion/scion-daemon.nix
+++ b/nixos/modules/services/networking/scion/scion-daemon.nix
@ -12,10 +12,10 @@ let
      reconnect_to_dispatcher = true;
    };
    path_db = {
-      connection = "/var/lib/scion-daemon/sd.path.db";
+      connection = "/run/scion-daemon/sd.path.db";
    };
    trust_db = {
-      connection = "/var/lib/scion-daemon/sd.trust.db";
+      connection = "/run/scion-daemon/sd.trust.db";
    };
    log.console = {
      level = "info";
@ -32,7 +32,7 @@ in
      example = literalExpression ''
        {
          path_db = {
-            connection = "/var/lib/scion-daemon/sd.path.db";
+            connection = "/run/scion-daemon/sd.path.db";
          };
          log.console = {
            level = "info";
@ -57,7 +57,7 @@ in
        ExecStart = "${pkgs.scion}/bin/scion-daemon --config ${configFile}";
        Restart = "on-failure";
        DynamicUser = true;
-        StateDirectory = "scion-daemon";
+        RuntimeDirectory = "scion-daemon";
      };
    };
  };
--- a/nixos/modules/services/networking/scion/scion-dispatcher.nix
+++ b/nixos/modules/services/networking/scion/scion-dispatcher.nix
@ -66,7 +66,7 @@ in
        ExecStartPre = "${pkgs.coreutils}/bin/rm -rf /run/shm/dispatcher";
        ExecStart = "${pkgs.scion}/bin/scion-dispatcher --config ${configFile}";
        Restart = "on-failure";
-        StateDirectory = "scion-dispatcher";
+        RuntimeDirectory = "scion-dispatcher";
      };
    };
  };
--- a/nixos/modules/services/networking/scion/scion-router.nix
+++ b/nixos/modules/services/networking/scion/scion-router.nix
@ -42,7 +42,7 @@ in
        ExecStart = "${pkgs.scion}/bin/scion-router --config ${configFile}";
        Restart = "on-failure";
        DynamicUser = true;
-        StateDirectory = "scion-router";
+        RuntimeDirectory = "scion-router";
      };
    };
  };
--- a/nixos/modules/services/search/hound.nix
+++ b/nixos/modules/services/search/hound.nix
@ -1,71 +1,66 @@
 { config, lib, pkgs, ... }:
-with lib;
 let
  cfg = config.services.hound;
+  settingsFormat = pkgs.formats.json { };
 in {
  imports = [
    (lib.mkRemovedOptionModule [ "services" "hound" "extraGroups" ] "Use users.users.hound.extraGroups instead")
+    (lib.mkChangedOptionModule [ "services" "hound" "config" ] [ "services" "hound" "settings" ] (config: builtins.fromJSON config.services.hound.config))
  ];

-  meta.maintainers = with maintainers; [ SuperSandro2000 ];
+  meta.maintainers = with lib.maintainers; [ SuperSandro2000 ];

  options = {
    services.hound = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Whether to enable the hound code search daemon.
-        '';
-      };
+      enable = lib.mkEnableOption "hound";

-      package = mkPackageOption pkgs "hound" { };
+      package = lib.mkPackageOption pkgs "hound" { };

-      user = mkOption {
+      user = lib.mkOption {
        default = "hound";
-        type = types.str;
+        type = lib.types.str;
        description = ''
          User the hound daemon should execute under.
        '';
      };

-      group = mkOption {
+      group = lib.mkOption {
        default = "hound";
-        type = types.str;
+        type = lib.types.str;
        description = ''
          Group the hound daemon should execute under.
        '';
      };

-      home = mkOption {
+      home = lib.mkOption {
        default = "/var/lib/hound";
-        type = types.path;
+        type = lib.types.path;
        description = ''
          The path to use as hound's $HOME.
          If the default user "hound" is configured then this is the home of the "hound" user.
        '';
      };

-      config = mkOption {
-        type = types.str;
-        description = ''
-          The full configuration of the Hound daemon. Note the dbpath
-          should be an absolute path to a writable location on disk.
-        '';
-        example = literalExpression ''
+      settings = lib.mkOption {
+        type = settingsFormat.type;
+        example = lib.literalExpression ''
          {
-            "max-concurrent-indexers" : 2,
-            "repos" : {
-                "nixpkgs": {
-                  "url" : "https://www.github.com/NixOS/nixpkgs.git"
-                }
-            }
+            max-concurrent-indexers = 2;
+            repos.nixpkgs.url = "https://www.github.com/NixOS/nixpkgs.git";
          }
        '';
+        description = ''
+          The full configuration of the Hound daemon.
+          See the upstream documentation <https://github.com/hound-search/hound/blob/main/docs/config-options.md> for details.
+
+          :::{.note}
+          The `dbpath` should be an absolute path to a writable directory.
+          :::.com/hound-search/hound/blob/main/docs/config-options.md>.
+        '';
      };

-      listen = mkOption {
-        type = types.str;
+      listen = lib.mkOption {
+        type = lib.types.str;
        default = "0.0.0.0:6080";
        example = ":6080";
        description = ''
@ -75,7 +70,7 @@ in {
    };
  };

-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
    users.groups = lib.mkIf (cfg.group == "hound") {
      hound = { };
    };
@ -89,16 +84,19 @@ in {
      };
    };

-    systemd.services.hound = let
-      configFile = pkgs.writeTextFile {
-        name = "hound.json";
-        text = cfg.config;
-        checkPhase = ''
-          # check if the supplied text is valid json
-          ${lib.getExe pkgs.jq} . $target > /dev/null
-        '';
-      };
-    in {
+    environment.etc."hound/config.json".source = pkgs.writeTextFile {
+      name = "hound-config";
+      text = builtins.toJSON cfg.settings;
+      checkPhase = ''
+        ${cfg.package}/bin/houndd -check-conf -conf $out
+      '';
+    };
+
+    services.hound.settings = {
+      dbpath = "${config.services.hound.home}/data";
+    };
+
+    systemd.services.hound = {
      description = "Hound Code Search";
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
@ -107,7 +105,7 @@ in {
        Group = cfg.group;
        WorkingDirectory = cfg.home;
        ExecStartPre = "${pkgs.git}/bin/git config --global --replace-all http.sslCAinfo /etc/ssl/certs/ca-certificates.crt";
-        ExecStart = "${cfg.package}/bin/houndd -addr ${cfg.listen} -conf ${configFile}";
+        ExecStart = "${cfg.package}/bin/houndd -addr ${cfg.listen} -conf /etc/hound/config.json";
      };
    };
  };
--- a/nixos/modules/services/web-apps/healthchecks.nix
+++ b/nixos/modules/services/web-apps/healthchecks.nix
@ -11,7 +11,7 @@ let
  environment = {
    PYTHONPATH = pkg.pythonPath;
    STATIC_ROOT = cfg.dataDir + "/static";
-  } // cfg.settings;
+  } // lib.filterAttrs (_: v: !builtins.isNull v) cfg.settings;

  environmentFile = pkgs.writeText "healthchecks-environment" (lib.generators.toKeyValue { } environment);

@ -21,6 +21,7 @@ let
      sudo='exec /run/wrappers/bin/sudo -u ${cfg.user} --preserve-env --preserve-env=PYTHONPATH'
    fi
    export $(cat ${environmentFile} | xargs)
+    ${lib.optionalString (cfg.settingsFile != null) "export $(cat ${cfg.settingsFile} | xargs)"}
    $sudo ${pkg}/opt/healthchecks/manage.py "$@"
  '';
 in
@ -89,6 +90,12 @@ in
      '';
    };

+    settingsFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = opt.settings.description;
+    };
+
    settings = lib.mkOption {
      description = ''
        Environment variables which are read by healthchecks `(local)_settings.py`.
@ -109,6 +116,8 @@ in
          have support for a `_FILE` variant, run:
          - `nix-instantiate --eval --expr '(import <nixpkgs> {}).healthchecks.secrets'`
          - or `nix eval 'nixpkgs#healthchecks.secrets'` if the flake support has been enabled.
+
+        If the same variable is set in both `settings` and `settingsFile` the value from `settingsFile` has priority.
      '';
      type = types.submodule (settings: {
        freeformType = types.attrsOf types.str;
@ -121,8 +130,9 @@ in
          };

          SECRET_KEY_FILE = mkOption {
-            type = types.path;
+            type = types.nullOr types.path;
            description = "Path to a file containing the secret key.";
+            default = null;
          };

          DEBUG = mkOption {
@ -186,7 +196,9 @@ in
          WorkingDirectory = cfg.dataDir;
          User = cfg.user;
          Group = cfg.group;
-          EnvironmentFile = [ environmentFile ];
+          EnvironmentFile = [
+            environmentFile
+          ] ++ lib.optional (cfg.settingsFile != null) cfg.settingsFile;
          StateDirectory = mkIf (cfg.dataDir == "/var/lib/healthchecks") "healthchecks";
          StateDirectoryMode = mkIf (cfg.dataDir == "/var/lib/healthchecks") "0750";
        };
--- a/nixos/modules/services/web-apps/limesurvey.nix
+++ b/nixos/modules/services/web-apps/limesurvey.nix
@ -18,7 +18,15 @@ let

  limesurveyConfig = pkgs.writeText "config.php" ''
    <?php
-      return json_decode('${builtins.toJSON cfg.config}', true);
+      return \array_merge(
+        \json_decode('${builtins.toJSON cfg.config}', true),
+        [
+          'config' => [
+            'encryptionnonce' => \trim(\file_get_contents(\getenv('CREDENTIALS_DIRECTORY') . DIRECTORY_SEPARATOR . 'encryption_nonce')),
+            'encryptionsecretboxkey' => \trim(\file_get_contents(\getenv('CREDENTIALS_DIRECTORY') . DIRECTORY_SEPARATOR . 'encryption_key')),
+          ]
+        ]
+      );
    ?>
  '';

@ -35,8 +43,9 @@ in
    package = mkPackageOption pkgs "limesurvey" { };

    encryptionKey = mkOption {
-      type = types.str;
-      default = "E17687FC77CEE247F0E22BB3ECF27FDE8BEC310A892347EC13013ABA11AA7EB5";
+      type = types.nullOr types.str;
+      default = null;
+      visible = false;
      description = ''
        This is a 32-byte key used to encrypt variables in the database.
        You _must_ change this from the default value.
@ -44,14 +53,35 @@ in
    };

    encryptionNonce = mkOption {
-      type = types.str;
-      default = "1ACC8555619929DB91310BE848025A427B0F364A884FFA77";
+      type = types.nullOr types.str;
+      default = null;
+      visible = false;
      description = ''
        This is a 24-byte nonce used to encrypt variables in the database.
        You _must_ change this from the default value.
      '';
    };

+    encryptionKeyFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        32-byte key used to encrypt variables in the database.
+
+        Note: It should be string not a store path in order to prevent the password from being world readable
+      '';
+    };
+
+    encryptionNonceFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        24-byte used to encrypt variables in the database.
+
+        Note: It should be string not a store path in order to prevent the password from being world readable
+      '';
+    };
+
    database = {
      type = mkOption {
        type = types.enum [ "mysql" "pgsql" "odbc" "mssql" ];
@ -183,6 +213,22 @@ in
      { assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;
        message = "a password cannot be specified if services.limesurvey.database.createLocally is set to true";
      }
+      { assertion = cfg.encryptionKey != null || cfg.encryptionKeyFile != null;
+        message = ''
+          You must set `services.limesurvey.encryptionKeyFile` to a file containing a 32-character uppercase hex string.
+
+          If this message appears when updating your system, please turn off encryption
+          in the LimeSurvey interface and create backups before filling the key.
+        '';
+      }
+      { assertion = cfg.encryptionNonce != null || cfg.encryptionNonceFile != null;
+        message = ''
+          You must set `services.limesurvey.encryptionNonceFile` to a file containing a 24-character uppercase hex string.
+
+          If this message appears when updating your system, please turn off encryption
+          in the LimeSurvey interface and create backups before filling the nonce.
+        '';
+      }
    ];

    services.limesurvey.config = mapAttrs (name: mkDefault) {
@ -204,8 +250,6 @@ in
      config = {
        tempdir = "${stateDir}/tmp";
        uploaddir = "${stateDir}/upload";
-        encryptionnonce = cfg.encryptionNonce;
-        encryptionsecretboxkey = cfg.encryptionKey;
        force_ssl = mkIf (cfg.virtualHost.addSSL || cfg.virtualHost.forceSSL || cfg.virtualHost.onlySSL) "on";
        config.defaultlang = "en";
      };
@ -229,11 +273,26 @@ in
      phpPackage = pkgs.php81;
      phpEnv.DBENGINE = "${cfg.database.dbEngine}";
      phpEnv.LIMESURVEY_CONFIG = "${limesurveyConfig}";
+      # App code cannot access credentials directly since the service starts
+      # with the root user so we copy the credentials to a place accessible to Limesurvey
+      phpEnv.CREDENTIALS_DIRECTORY = "${stateDir}/credentials";
      settings = {
        "listen.owner" = config.services.httpd.user;
        "listen.group" = config.services.httpd.group;
      } // cfg.poolConfig;
    };
+    systemd.services.phpfpm-limesurvey.serviceConfig = {
+      ExecStartPre = pkgs.writeShellScript "limesurvey-phpfpm-exec-pre" ''
+        cp -f "''${CREDENTIALS_DIRECTORY}"/encryption_key "${stateDir}/credentials/encryption_key"
+        chown ${user}:${group} "${stateDir}/credentials/encryption_key"
+        cp -f "''${CREDENTIALS_DIRECTORY}"/encryption_nonce "${stateDir}/credentials/encryption_nonce"
+        chown ${user}:${group} "${stateDir}/credentials/encryption_nonce"
+      '';
+      LoadCredential = [
+        "encryption_key:${if cfg.encryptionKeyFile != null then cfg.encryptionKeyFile else pkgs.writeText "key" cfg.encryptionKey}"
+        "encryption_nonce:${if cfg.encryptionNonceFile != null then cfg.encryptionNonceFile else pkgs.writeText "nonce" cfg.encryptionKey}"
+      ];
+    };

    services.httpd = {
      enable = true;
@ -277,6 +336,7 @@ in
      "d ${stateDir}/tmp/assets 0750 ${user} ${group} - -"
      "d ${stateDir}/tmp/runtime 0750 ${user} ${group} - -"
      "d ${stateDir}/tmp/upload 0750 ${user} ${group} - -"
+      "d ${stateDir}/credentials 0700 ${user} ${group} - -"
      "C ${stateDir}/upload 0750 ${user} ${group} - ${cfg.package}/share/limesurvey/upload"
    ];

@ -295,6 +355,10 @@ in
        User = user;
        Group = group;
        Type = "oneshot";
+        LoadCredential = [
+          "encryption_key:${if cfg.encryptionKeyFile != null then cfg.encryptionKeyFile else pkgs.writeText "key" cfg.encryptionKey}"
+          "encryption_nonce:${if cfg.encryptionNonceFile != null then cfg.encryptionNonceFile else pkgs.writeText "nonce" cfg.encryptionKey}"
+        ];
      };
    };

--- a/nixos/modules/services/web-apps/peering-manager.nix
+++ b/nixos/modules/services/web-apps/peering-manager.nix
@ -16,6 +16,8 @@ let
      ln -s ${configFile} $out/opt/peering-manager/peering_manager/configuration.py
    '' + lib.optionalString cfg.enableLdap ''
      ln -s ${cfg.ldapConfigPath} $out/opt/peering-manager/peering_manager/ldap_config.py
+    '' + lib.optionalString cfg.enableOidc ''
+      ln -s ${cfg.oidcConfigPath} $out/opt/peering-manager/peering_manager/oidc_config.py
    '';
  })).override {
    inherit (cfg) plugins;
@ -139,6 +141,24 @@ in {
        See the [documentation](https://peering-manager.readthedocs.io/en/stable/setup/6-ldap/#configuration) for possible options.
      '';
    };
+
+    enableOidc = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Enable OIDC-Authentication for Peering Manager.
+
+        This requires a configuration file being pass through `oidcConfigPath`.
+      '';
+    };
+
+    oidcConfigPath = mkOption {
+      type = types.path;
+      description = ''
+        Path to the Configuration-File for OIDC-Authentication, will be loaded as `oidc_config.py`.
+        See the [documentation](https://peering-manager.readthedocs.io/en/stable/setup/6b-oidc/#configuration) for possible options.
+      '';
+    };
  };

  config = lib.mkIf cfg.enable {
@ -173,7 +193,10 @@ in {
          PEERINGDB_API_KEY = file.readline()
      '';

-      plugins = lib.mkIf cfg.enableLdap (ps: [ ps.django-auth-ldap ]);
+      plugins = (ps:
+        (lib.optionals cfg.enableLdap [ ps.django-auth-ldap ]) ++
+        (lib.optionals cfg.enableOidc (with ps; [ mozilla-django-oidc pyopenssl josepy ]))
+      );
    };

    system.build.peeringManagerPkg = pkg;
--- a/nixos/modules/services/x11/desktop-managers/xfce.nix
+++ b/nixos/modules/services/x11/desktop-managers/xfce.nix
@ -165,6 +165,7 @@ in
    services.tumbler.enable = true;
    services.system-config-printer.enable = (mkIf config.services.printing.enable (mkDefault true));
    services.libinput.enable = mkDefault true; # used in xfce4-settings-manager
+    services.colord.enable = mkDefault true;

    # Enable default programs
    programs.dconf.enable = true;
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@ -489,7 +489,7 @@ in
    system.nssModules = [ cfg.package.out ];
    system.nssDatabases = {
      hosts = (mkMerge [
-        (mkOrder 400 ["mymachines"]) # 400 to ensure it comes before resolve (which is mkBefore'd)
+        (mkOrder 400 ["mymachines"]) # 400 to ensure it comes before resolve (which is 501)
        (mkOrder 999 ["myhostname"]) # after files (which is 998), but before regular nss modules
      ]);
      passwd = (mkMerge [
--- a/nixos/modules/virtualisation/libvirtd.nix
+++ b/nixos/modules/virtualisation/libvirtd.nix
@ -545,9 +545,10 @@ in
    };

    system.nssModules = optional (cfg.nss.enable or cfg.nss.enableGuest) cfg.package;
-    system.nssDatabases.hosts = builtins.concatLists [
-      (optional cfg.nss.enable "libvirt")
-      (optional cfg.nss.enableGuest "libvirt_guest")
+    system.nssDatabases.hosts = mkMerge [
+      # ensure that the NSS modules come between mymachines (which is 400) and resolve (which is 501)
+      (mkIf cfg.nss.enable (mkOrder 430 [ "libvirt" ]))
+      (mkIf cfg.nss.enableGuest (mkOrder 432 [ "libvirt_guest" ]))
    ];
  };
 }
--- a/nixos/tests/limesurvey.nix
+++ b/nixos/tests/limesurvey.nix
@ -1,6 +1,6 @@
-import ./make-test-python.nix ({ pkgs, ... }: {
+import ./make-test-python.nix ({ lib, pkgs, ... }: {
  name = "limesurvey";
-  meta.maintainers = [ pkgs.lib.maintainers.aanderse ];
+  meta.maintainers = [ lib.maintainers.aanderse ];

  nodes.machine = { ... }: {
    services.limesurvey = {
@ -9,6 +9,8 @@ import ./make-test-python.nix ({ pkgs, ... }: {
        hostName = "example.local";
        adminAddr = "root@example.local";
      };
+      encryptionKeyFile = pkgs.writeText "key" (lib.strings.replicate 32 "0");
+      encryptionNonceFile = pkgs.writeText "nonce" (lib.strings.replicate 24 "0");
    };

    # limesurvey won't work without a dot in the hostname
--- a/pkgs/applications/blockchains/bisq-desktop/default.nix
+++ b/pkgs/applications/blockchains/bisq-desktop/default.nix
@ -38,11 +38,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "bisq-desktop";
-  version = "1.9.16";
+  version = "1.9.17";

  src = fetchurl {
    url = "https://github.com/bisq-network/bisq/releases/download/v${version}/Bisq-64bit-${version}.deb";
-    sha256 = "sha256-DxYgZgDa3vOHj7svJqu/pdyXKZ+uBTy35Fchw49xxoA=";
+    sha256 = "1wqzgxsm9p6lh0bmvw0byaxx1r5v64d024jf1pg9mykb1dnnx0wy";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/blockchains/lndhub-go/default.nix
+++ b/pkgs/applications/blockchains/lndhub-go/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "lndhub-go";
-  version = "1.0.1";
+  version = "1.0.2";

  src = fetchFromGitHub {
    owner = "getAlby";
    repo = "lndhub.go";
    rev = version;
-    sha256 = "sha256-YOLqMIfZSGD+AOng1XWCBlzaHkPnQc+2kmDXF2fh+ps=";
+    sha256 = "sha256-17vvC6J0VdXouGfX4k1kCVRlkXbNSX3AT8QIY8uKDUE=";
  };

  vendorHash = "sha256-Vo29w04cRW0syD2tjieKVeZ3srFNuEC3T17birVWn6k=";
--- a/pkgs/applications/blockchains/trezor-suite/default.nix
+++ b/pkgs/applications/blockchains/trezor-suite/default.nix
@ -8,7 +8,7 @@

 let
  pname = "trezor-suite";
-  version = "24.5.4";
+  version = "24.6.2";
  name = "${pname}-${version}";

  suffix = {
@ -18,9 +18,9 @@ let

  src = fetchurl {
    url = "https://github.com/trezor/${pname}/releases/download/v${version}/Trezor-Suite-${version}-${suffix}.AppImage";
-    hash = { # curl -Lfs https://github.com/trezor/trezor-suite/releases/latest/download/latest-linux{-arm64,}.yml | grep ^sha512 | sed 's/: /-/'
-      aarch64-linux = "sha512-gkN6e4Ndc96FT6vaCmSxuViTKuOc5vnCqptPN8IRno9Nv8L0k6hB7O+0g5E+9hd+3o5WASXKefYIOZAnPI3RZA==";
-      x86_64-linux  = "sha512-uHMI0fm02XdOyt6mAXEZuTZkNlNykTQbJNeGATBrlLLR98cxrOj8DQ1S7gPd5dkQCJzdmR7ydylj/XPOHsV2Ug==";
+    hash = { # curl -Lfs https://github.com/trezor/trezor-suite/releases/download/v${version}/latest-linux{-arm64,}.yml | grep ^sha512 | sed 's/: /-/'
+      aarch64-linux = "sha512-fJnka//9DbvTTq7GEN++6thU8f8BL4cHh1J4P/Tu9Eu94KWCHDG2IwFALOXEvZnwLbxFYiu3Cqldp2RIxYFXTA==";
+      x86_64-linux  = "sha512-/gRQR1EriiwrDj04BTnhXlsawJgHp6TqgHpgVCMO1r+U2zGiFLdNfwG/SYwARE+55X8Umls5hCt/wuCpTEPkEg==";
    }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  };

--- a/pkgs/applications/display-managers/greetd/tuigreet.nix
+++ b/pkgs/applications/display-managers/greetd/tuigreet.nix
@ -21,7 +21,7 @@ rustPlatform.buildRustPackage rec {
    homepage = "https://github.com/apognu/tuigreet";
    changelog = "https://github.com/apognu/tuigreet/releases/tag/${version}";
    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ luc65r ivar ];
+    maintainers = with lib.maintainers; [ luc65r ];
    platforms = lib.platforms.linux;
    mainProgram = "tuigreet";
  };
--- a/pkgs/applications/editors/tijolo/default.nix
+++ b/pkgs/applications/editors/tijolo/default.nix
@ -15,13 +15,13 @@

 crystal.buildCrystalPackage rec {
  pname = "tijolo";
-  version = "0.8.1";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "hugopl";
    repo = "tijolo";
    rev = "v${version}";
-    hash = "sha256-+sRcS5bVH6WLmSDLiPw608OB6OjBVwLqWxGT5Y6caBc=";
+    hash = "sha256-RVdZce9csnhJx5p+jBANDCsz2eB/l3EHExwKMbKL9y0=";
  };

  postPatch = ''
--- a/pkgs/applications/editors/typora/default.nix
+++ b/pkgs/applications/editors/typora/default.nix
@ -22,10 +22,10 @@

 let
  pname = "typora";
-  version = "1.8.10";
+  version = "1.9.3";
  src = fetchurl {
    url = "https://download.typora.io/linux/typora_${version}_amd64.deb";
-    hash = "sha256-5ZLSzDUcF0OZUuWVX/iG+4ccTlCPdYxy7zl0wDHlxNQ=";
+    hash = "sha256-3rR/CvFFjRPkz27mm1Wt5hwgRUnLL7lpLFKA2moILx8=";
  };

  typoraBase = stdenv.mkDerivation {
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -1229,6 +1229,10 @@
    dependencies = with self; [ (nvim-treesitter.withPlugins (p: [ p.org ])) ];
  };

+  otter-nvim = super.otter-nvim.overrideAttrs {
+    dependencies = [ self.nvim-lspconfig ];
+  };
+
  overseer-nvim = super.overseer-nvim.overrideAttrs {
    doCheck = true;
    checkPhase = ''
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -1173,6 +1173,23 @@ let
        };
      };

+      danielsanmedium.dscodegpt = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          publisher = "DanielSanMedium";
+          name = "dscodegpt";
+          version = "3.4.10";
+          hash = "sha256-zjaM9YME0wfBOwhJTacnQbQvw35QL5NvXIBAx5d/bjI=";
+        };
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/DanielSanMedium.dscodegpt/changelog";
+          description = "Easily connect to AI providers using their official APIs in VSCode";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=DanielSanMedium.dscodegpt";
+          homepage = "https://codegpt.co";
+          license = lib.licenses.unfree;
+          maintainers = [ lib.maintainers.onny ];
+        };
+      };
+
      daohong-emilio.yash = buildVscodeMarketplaceExtension {
        mktplcRef = {
          publisher = "daohong-emilio";
--- a/pkgs/applications/emulators/dolphin-emu/default.nix
+++ b/pkgs/applications/emulators/dolphin-emu/default.nix
@ -190,7 +190,6 @@ stdenv.mkDerivation rec {
    platforms = platforms.unix;
    maintainers = with maintainers; [
      ashkitten
-      ivar
    ];
  };
 }
--- a/pkgs/applications/emulators/flycast/default.nix
+++ b/pkgs/applications/emulators/flycast/default.nix
@ -59,6 +59,6 @@ stdenv.mkDerivation rec {
    mainProgram = "flycast";
    license = licenses.gpl2Only;
    platforms = platforms.unix;
-    maintainers = [ maintainers.ivar ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/applications/emulators/goldberg-emu/default.nix
+++ b/pkgs/applications/emulators/goldberg-emu/default.nix
@ -53,6 +53,6 @@ stdenv.mkDerivation rec {
    mainProgram = "lobby_connect";
    license = licenses.lgpl3Only;
    platforms = platforms.unix;
-    maintainers = [ maintainers.ivar ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/applications/emulators/simplenes/default.nix
+++ b/pkgs/applications/emulators/simplenes/default.nix
@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/amhndu/SimpleNES";
    description = "NES emulator written in C++";
    license = licenses.gpl3;
-    maintainers = with maintainers; [ ivar ];
+    maintainers = with maintainers; [ ];
    platforms = platforms.linux;
    mainProgram = "SimpleNES";
  };
--- a/pkgs/applications/gis/qgis/set-pyqt-package-dirs.patch
+++ b/pkgs/applications/gis/qgis/set-pyqt-package-dirs.patch
@ -11,16 +11,6 @@ index b51fd0075e..87ee317e05 100644
     IF(_pyqt5_metadata)
       FILE(READ ${_pyqt5_metadata} _pyqt5_metadata_contents)
       STRING(REGEX REPLACE ".*\nVersion: ([^\n]+).*$" "\\1" PYQT5_VERSION_STR ${_pyqt5_metadata_contents})
-@@ -34,8 +34,8 @@ ELSE(EXISTS PYQT5_VERSION_STR)
-     ENDIF(_pyqt5_metadata)
- 
-     IF(PYQT5_VERSION_STR)
-      SET(PYQT5_MOD_DIR "${Python_SITEARCH}/PyQt5")
-      SET(PYQT5_SIP_DIR "${Python_SITEARCH}/PyQt5/bindings")
-+      SET(PYQT5_MOD_DIR "@pyQt5PackageDir@/PyQt5")
-+      SET(PYQT5_SIP_DIR "@pyQt5PackageDir@/PyQt5/bindings")
-       FIND_PROGRAM(__pyuic5 "pyuic5")
-       GET_FILENAME_COMPONENT(PYQT5_BIN_DIR ${__pyuic5} DIRECTORY)
 
 diff --git a/cmake/FindQsci.cmake b/cmake/FindQsci.cmake
 index 69e41c1fe9..5456c3d59b 100644
--- a/pkgs/applications/gis/qgis/unwrapped-ltr.nix
+++ b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
@ -77,14 +77,14 @@ let
    urllib3
  ];
 in mkDerivation rec {
-  version = "3.34.7";
+  version = "3.34.8";
  pname = "qgis-ltr-unwrapped";

  src = fetchFromGitHub {
    owner = "qgis";
    repo = "QGIS";
    rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-6fIBmIoCVo0AtkjC4Vn3jMjz93gZmvkFAgo+KnasyXo=";
+    hash = "sha256-UeyGx+C7szXv++hXFV006Xk4oSKfSj4teJIwaD4ODVk=";
  };

  passthru = {
@ -147,9 +147,7 @@ in mkDerivation rec {

  # Add path to Qt platform plugins
  # (offscreen is needed by "${APIS_SRC_DIR}/generate_console_pap.py")
-  preBuild = ''
-    export QT_QPA_PLATFORM_PLUGIN_PATH=${qtbase.bin}/lib/qt-${qtbase.version}/plugins/platforms
-  '';
+  env.QT_QPA_PLATFORM_PLUGIN_PATH="${qtbase}/${qtbase.qtPluginPrefix}/platforms";

  cmakeFlags = [
    "-DCMAKE_BUILD_TYPE=Release"
@ -164,7 +162,7 @@ in mkDerivation rec {
    );

  qtWrapperArgs = [
-    "--set QT_QPA_PLATFORM_PLUGIN_PATH ${qtbase.bin}/lib/qt-${qtbase.version}/plugins/platforms"
+    "--set QT_QPA_PLATFORM_PLUGIN_PATH ${qtbase}/${qtbase.qtPluginPrefix}/platforms"
  ];

  dontWrapGApps = true; # wrapper params passed below
--- a/pkgs/applications/gis/qgis/unwrapped.nix
+++ b/pkgs/applications/gis/qgis/unwrapped.nix
@ -78,14 +78,14 @@ let
    urllib3
  ];
 in mkDerivation rec {
-  version = "3.36.3";
+  version = "3.38.0";
  pname = "qgis-unwrapped";

  src = fetchFromGitHub {
    owner = "qgis";
    repo = "QGIS";
    rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-uPyW/zzoyyd3SXvP+h9joJEv9DjRNJSaorx1rNmAaFQ=";
+    hash = "sha256-vL9Go8Kn6VFOeztD/LZi5QHpZVPFfOFarTsCLTf4D2s=";
  };

  passthru = {
@ -148,15 +148,14 @@ in mkDerivation rec {

  # Add path to Qt platform plugins
  # (offscreen is needed by "${APIS_SRC_DIR}/generate_console_pap.py")
-  preBuild = ''
-    export QT_QPA_PLATFORM_PLUGIN_PATH=${qtbase.bin}/lib/qt-${qtbase.version}/plugins/platforms
-  '';
+  env.QT_QPA_PLATFORM_PLUGIN_PATH="${qtbase}/${qtbase.qtPluginPrefix}/platforms";

  cmakeFlags = [
    "-DCMAKE_BUILD_TYPE=Release"
    "-DWITH_3D=True"
    "-DWITH_PDAL=True"
    "-DENABLE_TESTS=False"
+    "-DQT_PLUGINS_DIR=${qtbase}/${qtbase.qtPluginPrefix}"
  ] ++ lib.optional (!withWebKit) "-DWITH_QTWEBKIT=OFF"
    ++ lib.optional withGrass (let
        gmajor = lib.versions.major grass.version;
@ -165,7 +164,7 @@ in mkDerivation rec {
    );

  qtWrapperArgs = [
-    "--set QT_QPA_PLATFORM_PLUGIN_PATH ${qtbase.bin}/lib/qt-${qtbase.version}/plugins/platforms"
+    "--set QT_QPA_PLATFORM_PLUGIN_PATH ${qtbase}/${qtbase.qtPluginPrefix}/platforms"
  ];

  dontWrapGApps = true; # wrapper params passed below
--- a/pkgs/applications/graphics/komikku/default.nix
+++ b/pkgs/applications/graphics/komikku/default.nix
@ -19,7 +19,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "komikku";
-  version = "1.48.1";
+  version = "1.49.0";

  format = "other";

@ -28,7 +28,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "valos";
    repo = "Komikku";
    rev = "v${version}";
-    hash = "sha256-U4MmVK75tPYJStJ0RRjfbzSbpGLJ07rJg6ClHI+tAfM=";
+    hash = "sha256-AMlhhsbwLhofV/Sy/EXuE4l0UAwZf2Gxn9+x3MHno4Y=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/albert/default.nix
+++ b/pkgs/applications/misc/albert/default.nix
@ -1,32 +1,33 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, cmake
-, libqalculate
-, muparser
-, libarchive
-, python3Packages
-, qtbase
-, qtscxml
-, qtsvg
-, qtdeclarative
-, qtwayland
-, qt5compat
-, qttools
-, wrapQtAppsHook
-, nix-update-script
-, pkg-config
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  libqalculate,
+  muparser,
+  libarchive,
+  python3Packages,
+  qtbase,
+  qtscxml,
+  qtsvg,
+  qtdeclarative,
+  qtwayland,
+  qt5compat,
+  qttools,
+  wrapQtAppsHook,
+  nix-update-script,
+  pkg-config,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "albert";
-  version = "0.23.0";
+  version = "0.24.1";

  src = fetchFromGitHub {
    owner = "albertlauncher";
    repo = "albert";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-L6qHaksArgwySk6J7N5zamUDWh5qa6zTtPFdpxU2NTM=";
+    sha256 = "sha256-vlap8gTZYoQS70Co99bZ16Fv9eq1N3rH7skjwrLDWiM=";
    fetchSubmodules = true;
  };

@ -36,24 +37,31 @@ stdenv.mkDerivation (finalAttrs: {
    wrapQtAppsHook
  ];

-  buildInputs = [
-    libqalculate
-    libarchive
-    muparser
-    qtbase
-    qtscxml
-    qtsvg
-    qtdeclarative
-    qtwayland
-    qt5compat
-    qttools
-  ] ++ (with python3Packages; [ python pybind11 ]);
+  buildInputs =
+    [
+      libqalculate
+      libarchive
+      muparser
+      qtbase
+      qtscxml
+      qtsvg
+      qtdeclarative
+      qtwayland
+      qt5compat
+      qttools
+    ]
+    ++ (with python3Packages; [
+      python
+      pybind11
+    ]);

  postPatch = ''
    find -type f -name CMakeLists.txt -exec sed -i {} -e '/INSTALL_RPATH/d' \;

-    sed -i src/qtpluginprovider.cpp \
-      -e "/QStringList dirs = {/a    QFileInfo(\"$out/lib\").canonicalFilePath(),"
+    # WARN: This is necessary for albert to detect the package libraries.
+    # Please check if the file below has changed upstream before updating.
+    sed -i src/app/qtpluginprovider.cpp \
+      -e "/QStringList install_paths;/a    install_paths << QFileInfo(\"$out/lib\").canonicalFilePath();"
  '';

  postFixup = ''
@ -77,7 +85,11 @@ stdenv.mkDerivation (finalAttrs: {
    changelog = "https://github.com/albertlauncher/albert/blob/${finalAttrs.src.rev}/CHANGELOG.md";
    # See: https://github.com/NixOS/nixpkgs/issues/279226
    license = licenses.unfree;
-    maintainers = with maintainers; [ ericsagnes synthetica ];
+    maintainers = with maintainers; [
+      ericsagnes
+      synthetica
+      eljamm
+    ];
    mainProgram = "albert";
    platforms = platforms.linux;
  };
--- a/pkgs/applications/misc/dasel/default.nix
+++ b/pkgs/applications/misc/dasel/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "dasel";
-  version = "2.7.0";
+  version = "2.8.0";

  src = fetchFromGitHub {
    owner = "TomWright";
    repo = "dasel";
    rev = "v${version}";
-    hash = "sha256-N3WeU+8KJwYKvuN4I1ZNEtIgLTmh/XgnhwATwV7dsvY=";
+    hash = "sha256-j9gwE/iLbBM8sdNZgc7hYnKhJEMkLn/g9HVlsKn4moo=";
  };

-  vendorHash = "sha256-G9IdTMF5Lnwq38rdJtuvUjD4RBaSmCYs3g+ETz29Mec=";
+  vendorHash = "sha256-edyFs5oURklkqsTF7JA1in3XteSBx/6YEVu4MjIcGN4=";

  ldflags = [
    "-s" "-w" "-X github.com/tomwright/dasel/v2/internal.Version=${version}"
--- a/pkgs/applications/misc/octoprint/default.nix
+++ b/pkgs/applications/misc/octoprint/default.nix
@ -116,13 +116,13 @@ let
          self: super: {
            octoprint = self.buildPythonPackage rec {
              pname = "OctoPrint";
-              version = "1.10.1";
+              version = "1.10.2";

              src = fetchFromGitHub {
                owner = "OctoPrint";
                repo = "OctoPrint";
                rev = version;
-                hash = "sha256-kJTYIsbNr6cLzti8yg+IlXjbKwXuwumE3Wydy+oTeK4=";
+                hash = "sha256-vISMps2v18A7MkF24SyIcK5yOQsTxBQLnKybVd8R2FU=";
              };

              propagatedBuildInputs = with self; [
--- a/pkgs/applications/misc/pwsafe/default.nix
+++ b/pkgs/applications/misc/pwsafe/default.nix
@ -97,7 +97,7 @@ stdenv.mkDerivation rec {
  installFlags = [ "PREFIX=${placeholder "out"}" ];

  passthru.updateScript = gitUpdater {
-    ignoredVersions = "^([^1]|1[^.])"; # ignore anything other than 1.x
+    allowedVersions = "^1\\.";
    url = src.gitRepoUrl;
  };

--- a/pkgs/applications/misc/synergy/default.nix
+++ b/pkgs/applications/misc/synergy/default.nix
@ -141,7 +141,7 @@ stdenv.mkDerivation rec {
    changelog = "https://github.com/symless/synergy-core/blob/${version}/ChangeLog";
    mainProgram = lib.optionalString (!withGUI) "synergyc";
    license = licenses.gpl2Only;
-    maintainers = with maintainers; [ talyz ivar ];
+    maintainers = with maintainers; [ talyz ];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/networking/cluster/glooctl/default.nix
+++ b/pkgs/applications/networking/cluster/glooctl/default.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "glooctl";
-  version = "1.16.16";
+  version = "1.16.17";

  src = fetchFromGitHub {
    owner = "solo-io";
    repo = "gloo";
    rev = "v${version}";
-    hash = "sha256-N7Yao/lRyzmbFDIqfvQoZXKGbYPxlA8HCD3tPkl8RKk=";
+    hash = "sha256-18ZvxXAE83/NT/Syv/wshTiulTMroAaamxYtfuYIuR4=";
  };

  vendorHash = "sha256-wLB+sUaSOBb1VLx/iwlU4U6LKakUP+GbhdWfjlvCu84=";
--- a/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix
+++ b/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix
@ -2,16 +2,16 @@

 buildGo122Module rec {
  pname = "helm-diff";
-  version = "3.9.5";
+  version = "3.9.8";

  src = fetchFromGitHub {
    owner = "databus23";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-6XkiGSbZzkYnqaHcoZQckADGVcWmSWL87MVzqb98lMQ=";
+    hash = "sha256-HGQTnvtL9hksy0B9U6jK8kkyoc3g0lmuBRV3vsg9Yao=";
  };

-  vendorHash = "sha256-E0ERop/TBr36sfTKCD+DdZwHSkhYdGmvKoJF2gl3gwE=";
+  vendorHash = "sha256-4bYepEVeVg+X0WicktE8BorwgsLGh2cZUn8rgfMExpk=";

  ldflags = [ "-s" "-w" "-X github.com/databus23/helm-diff/v3/cmd.Version=${version}" ];

--- a/pkgs/applications/networking/cluster/helm/plugins/helm-secrets.nix
+++ b/pkgs/applications/networking/cluster/helm/plugins/helm-secrets.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, makeWrapper, coreutils, findutils, getopt, gnugrep, gnused, sops, vault }:
+{ lib, stdenv, fetchFromGitHub, makeWrapper, coreutils, findutils, getopt, gnugrep, gnused, sops }:

 stdenv.mkDerivation rec {
  pname = "helm-secrets";
@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
    install -m644 -Dt $out/${pname} plugin.yaml
    cp -r scripts/* $out/${pname}/scripts
    wrapProgram $out/${pname}/scripts/run.sh \
-        --prefix PATH : ${lib.makeBinPath [ coreutils findutils getopt gnugrep gnused sops vault ]}
+        --prefix PATH : ${lib.makeBinPath [ coreutils findutils getopt gnugrep gnused sops ]}

    runHook postInstall
  '';
--- a/pkgs/applications/networking/cluster/istioctl/default.nix
+++ b/pkgs/applications/networking/cluster/istioctl/default.nix
@ -2,15 +2,15 @@

 buildGoModule rec {
  pname = "istioctl";
-  version = "1.22.1";
+  version = "1.22.2";

  src = fetchFromGitHub {
    owner = "istio";
    repo = "istio";
    rev = version;
-    hash = "sha256-KU0AvGecEvbkQ6PSjCMxpisx5UsFr1gLYXL4GzJ6zrU=";
+    hash = "sha256-tw9G7VhrBMdSbZ4ZZgMlKEDfhZE5dSPd2HUgfkDA8vo=";
  };
-  vendorHash = "sha256-arY8RLlHCPgRWnk6LLXlORiLr7afJj4OhfPMA+9UQ0M=";
+  vendorHash = "sha256-Fso55G5j8MUQSqhCr6BT8epwgV1NznQXkPPQFL9TZFw=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/networking/cluster/k0sctl/default.nix
+++ b/pkgs/applications/networking/cluster/k0sctl/default.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "k0sctl";
-  version = "0.18.0";
+  version = "0.18.1";

  src = fetchFromGitHub {
    owner = "k0sproject";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-bFNlNNc5PGim2yCX8YmWzPp1EzMrsSF3d/E+mf9Pw20=";
+    hash = "sha256-lZCD8hBe6SKKjTvEKNg/lr7NXrAPqFQoh9iQg0O6jhc=";
  };

-  vendorHash = "sha256-pKvb7pKuGfa8Y+FvLwyWcYuuSszLin2+jFCQ7cPkkwQ=";
+  vendorHash = "sha256-FobBn7rbRVfnW8Zd982vkSuKpPj4gGK4b41o9OK/CCY=";

  ldflags = [
    "-s"
--- a/pkgs/applications/networking/cluster/spark/default.nix
+++ b/pkgs/applications/networking/cluster/spark/default.nix
@ -77,7 +77,7 @@ in
  };
  spark_3_4 = spark rec {
    pname = "spark";
-    version = "3.4.2";
-    hash = "sha256-qr0tRuzzEcarJznrQYkaQzGqI7tugp/XJpoZxL7tJwk=";
+    version = "3.4.3";
+    hash = "sha256-ifeytk08oaEyiEawwWbUWWuoynGTJNvnrkOW/CjeaSk=";
  };
 }
--- a/pkgs/applications/networking/cluster/terraform-docs/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-docs/default.nix
@ -1,22 +1,20 @@
-{ lib, buildGoModule, fetchFromGitHub, go_1_21 }:
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
 buildGoModule rec {
  pname = "terraform-docs";
-  version = "0.17.0";
-
-  go = go_1_21;
+  version = "0.18.0";

  src = fetchFromGitHub {
    owner = "terraform-docs";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-HkkW6JX5wcGElmr6CiSukyeS/8rz4CUThy8rZfx4hbo=";
+    hash = "sha256-XZS+mGp2QsrKS3fPZd0ja4w/CAfPcyzSgwolQ+StER0=";
  };

-  patches = [ ./update-to-go-1.21.patch ];
-
-  vendorHash = "sha256-ZHWAiXJG8vCmUkf6GNxoIJbIEjEWukLdrmdIb64QleI=";
-
-  subPackages = [ "." ];
+  vendorHash = "sha256-aweKTHQBYYqSp8CymwhnVv1WNQ7cZ1/bJNz7DSo7PKc=";

  meta = with lib; {
    description = "Utility to generate documentation from Terraform modules in various output formats";
--- a/pkgs/applications/networking/cluster/terraform-docs/update-to-go-1.21.patch
+++ b/pkgs/applications/networking/cluster/terraform-docs/update-to-go-1.21.patch
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@ -2,52 +2,52 @@
 let
  versions =
    if stdenv.isLinux then {
-      stable = "0.0.56";
-      ptb = "0.0.90";
-      canary = "0.0.431";
-      development = "0.0.19";
+      stable = "0.0.58";
+      ptb = "0.0.92";
+      canary = "0.0.438";
+      development = "0.0.21";
    } else {
-      stable = "0.0.307";
-      ptb = "0.0.119";
-      canary = "0.0.531";
-      development = "0.0.41";
+      stable = "0.0.309";
+      ptb = "0.0.121";
+      canary = "0.0.547";
+      development = "0.0.43";
    };
  version = versions.${branch};
  srcs = rec {
    x86_64-linux = {
      stable = fetchurl {
        url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-HpdsvzWtB4AoqZXf7LV0J50/OQDsYgK8bkQ1HGvu7Ec=";
+        hash = "sha256-YkyniFgkD4GMxUya+/Ke5fxosZKHKyc4+cAx3HI4w8c=";
      };
      ptb = fetchurl {
        url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-75YnLhgNTd7pwpTE9qSIF0rzBwmGJ/CYa+YgN3OQZ2w=";
+        hash = "sha256-1HbTRWl1w9cu7D4NNFGVbHk1hvRmMywH+q2qA4+nokc=";
      };
      canary = fetchurl {
        url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-59Sv3U3osfk+QoXgorpqK7CU0nJBdpFOMkoGRgHN3v8=";
+        hash = "sha256-z2SsI1vmaW1HjBDkJEH468xPuyAqigOIbRDtaL4Lgxc=";
      };
      development = fetchurl {
        url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-        hash = "sha256-RP6SUM4DW3JhddSbJX6Xg8EE4iqCkSOgBL1oa7Zwp/E=";
+        hash = "sha256-LgRrQ2z0/mx9Xvkb7hOrhmOqaETiBITgJDO9vce/wtk=";
      };
    };
    x86_64-darwin = {
      stable = fetchurl {
        url = "https://dl.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-FBYxQhtwctMQ8ByOgAVncWh5297k1Vh95w/rWnZg9Fw=";
+        hash = "sha256-9Tfn+dxvhgNjSdfj8Irb/5VU3kn39DX6hdKkppJ6HeU=";
      };
      ptb = fetchurl {
        url = "https://dl-ptb.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-Y5t6ndecfRf3zVfYEvFGiFinQxRSa7VyfnkAors8VPY=";
+        hash = "sha256-3Lk+kPZcBqznIELVMdA6dRpCOaOuRrchmfHv/EAyyOQ=";
      };
      canary = fetchurl {
        url = "https://dl-canary.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-eMJ/OKi+k92QEk140UW3RIi5G/UFlR6mW9f8kPZbFaw=";
+        hash = "sha256-ec2XF3023bQn/85i1xO8tTuYuprtsaL9exqRiZam36A=";
      };
      development = fetchurl {
        url = "https://dl-development.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-RiGyca/zjPpENgcq9KnRh5G4YArrUOQeueUdUBgZgjo=";
+        hash = "sha256-PZS7LHJExi+fb7G4CnIFk4KQx9/cL4ALXwzOcLx4sWU=";
      };
    };
    aarch64-darwin = x86_64-darwin;
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "signalbackup-tools";
-  version = "20240625";
+  version = "20240627";

  src = fetchFromGitHub {
    owner = "bepaald";
    repo = pname;
    rev = version;
-    hash = "sha256-sEuSVyfbHqljXz0mHX0loIkw/OCwcBXE/iGD+55GRng=";
+    hash = "sha256-Kvz2Ft7gcvyQr8CxTZ7bHVn7q0yItGsK6/rChz0eras=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/instant-messengers/viber/default.nix
+++ b/pkgs/applications/networking/instant-messengers/viber/default.nix
@ -1,17 +1,54 @@
-{fetchurl, lib, stdenv, dpkg, makeWrapper,
- alsa-lib, cups, curl, dbus, expat, fontconfig, freetype, glib, gst_all_1,
- harfbuzz, libcap, libGL, libGLU, libpulseaudio, libxkbcommon, libxml2, libxslt,
- nspr, nss, openssl_1_1, systemd, wayland, xorg, zlib, ...
+{
+  fetchurl,
+  lib,
+  stdenv,
+  dpkg,
+  makeWrapper,
+  alsa-lib,
+  brotli,
+  cups,
+  curl,
+  dbus,
+  expat,
+  fontconfig,
+  freetype,
+  glib,
+  gst_all_1,
+  harfbuzz,
+  lcms,
+  libcap,
+  libevent,
+  libGL,
+  libGLU,
+  libkrb5,
+  libopus,
+  libpulseaudio,
+  libxkbcommon,
+  libxkbfile,
+  libxml2,
+  libxslt,
+  libwebp,
+  mesa,
+  nspr,
+  nss,
+  openssl,
+  snappy,
+  systemd,
+  wayland,
+  xorg,
+  zlib,
+  zstd,
+  ...
 }:

 stdenv.mkDerivation {
  pname = "viber";
-  version = "16.1.0.37";
+  version = "21.8.0.11";

  src = fetchurl {
    # Official link: https://download.cdn.viber.com/cdn/desktop/Linux/viber.deb
-    url = "https://web.archive.org/web/20211119123858/https://download.cdn.viber.com/cdn/desktop/Linux/viber.deb";
-    sha256 = "sha256-hOz+EQc2OOlLTPa2kOefPJMUyWvSvrgqgPgBKjWE3p8=";
+    url = "https://download.cdn.viber.com/cdn/desktop/Linux/viber.deb";
+    hash = "sha256-RrObmN21QOm5nk0R2avgCH0ulrfiUIo2PnyYWvQaGVw=";
  };

  nativeBuildInputs = [ makeWrapper ];
@ -20,51 +57,61 @@ stdenv.mkDerivation {
  dontUnpack = true;

  libPath = lib.makeLibraryPath [
-      alsa-lib
-      cups
-      curl
-      dbus
-      expat
-      fontconfig
-      freetype
-      glib
-      gst_all_1.gst-plugins-base
-      gst_all_1.gstreamer
-      harfbuzz
-      libcap
-      libGLU libGL
-      libpulseaudio
-      libxkbcommon
-      libxml2
-      libxslt
-      nspr
-      nss
-      openssl_1_1
-      stdenv.cc.cc
-      systemd
-      wayland
-      zlib
+    alsa-lib
+    brotli
+    cups
+    curl
+    dbus
+    expat
+    fontconfig
+    freetype
+    glib
+    gst_all_1.gst-plugins-base
+    gst_all_1.gstreamer
+    harfbuzz
+    lcms
+    libcap
+    libevent
+    libGLU
+    libGL
+    libkrb5
+    libopus
+    libpulseaudio
+    libxkbcommon
+    libxkbfile
+    libxml2
+    libxslt
+    libwebp
+    mesa
+    nspr
+    nss
+    openssl
+    snappy
+    stdenv.cc.cc
+    systemd
+    wayland
+    zlib
+    zstd

-      xorg.libICE
-      xorg.libSM
-      xorg.libX11
-      xorg.libxcb
-      xorg.libXcomposite
-      xorg.libXcursor
-      xorg.libXdamage
-      xorg.libXext
-      xorg.libXfixes
-      xorg.libXi
-      xorg.libXrandr
-      xorg.libXrender
-      xorg.libXScrnSaver
-      xorg.libXtst
-      xorg.xcbutilimage
-      xorg.xcbutilkeysyms
-      xorg.xcbutilrenderutil
-      xorg.xcbutilwm
-  ]
-  ;
+    xorg.libICE
+    xorg.libSM
+    xorg.libX11
+    xorg.libxcb
+    xorg.libXcomposite
+    xorg.libXcursor
+    xorg.libXdamage
+    xorg.libXext
+    xorg.libXfixes
+    xorg.libXi
+    xorg.libXrandr
+    xorg.libXrender
+    xorg.libXScrnSaver
+    xorg.libXtst
+    xorg.xcbutilimage
+    xorg.xcbutilkeysyms
+    xorg.xcbutilrenderutil
+    xorg.xcbutilwm
+  ];

  installPhase = ''
    dpkg-deb -x $src $out
--- a/pkgs/applications/networking/opsdroid/default.nix
+++ b/pkgs/applications/networking/opsdroid/default.nix
@ -1,36 +1,80 @@
-{ lib, fetchFromGitHub, python3Packages }:
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+}:

 python3Packages.buildPythonPackage rec {
  pname = "opsdroid";
-  version = "0.25.0";
+  version = "0.30.0";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "opsdroid";
    repo = "opsdroid";
-    rev = "v${version}";
-    sha256 = "0f32jf2rds9543akysxinf3hsgzr0w880xwcrcm1r2r0nhp8b8s5";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-7H44wdhJD4Z6OP1sUmSGlepuvx+LlwKLq7iR8cwqR24=";
  };

-  disabled = !python3Packages.isPy3k;
+  build-system = with python3Packages; [ setuptools ];

-  # tests folder is not included in release
-  doCheck = false;
-
-  propagatedBuildInputs = with python3Packages; [
-    click babel opsdroid-get-image-size slackclient webexteamssdk bleach
-    parse emoji puremagic yamale nbformat websockets pycron nbconvert
-    aiohttp matrix-api-async aioredis aiosqlite arrow pyyaml motor regex
-    mattermostdriver setuptools voluptuous ibm-watson tailer multidict
-    watchgod get-video-properties appdirs bitstring matrix-nio
-  ] ++ matrix-nio.optional-dependencies.e2e;
+  dependencies =
+    with python3Packages;
+    [
+      aiohttp
+      aiohttp-middlewares
+      aioredis
+      aiosqlite
+      appdirs
+      arrow
+      babel
+      bitstring
+      bleach
+      # botbuilder-core, connector for teams
+      certifi
+      click
+      # dialogflow, connector for Dialogflow
+      dnspython
+      emoji
+      get-video-properties
+      ibm-watson
+      matrix-nio
+      mattermostdriver
+      motor
+      multidict
+      nbconvert
+      nbformat
+      opsdroid-get-image-size
+      parse
+      puremagic
+      pycron
+      python-olm
+      pyyaml
+      regex
+      rich
+      slack-sdk
+      tailer
+      voluptuous
+      watchgod
+      webexteamssdk
+      wrapt
+    ]
+    ++ matrix-nio.optional-dependencies.e2e;

  passthru.python = python3Packages.python;

+  # Tests are not included in releases
+  doCheck = false;
+
  meta = with lib; {
    description = "Open source chat-ops bot framework";
    homepage = "https://opsdroid.dev";
-    maintainers = with maintainers; [ globin willibutz ];
+    changelog = "https://github.com/opsdroid/opsdroid/releases/tag/v${version}";
    license = licenses.asl20;
+    maintainers = with maintainers; [
+      globin
+      willibutz
+    ];
    platforms = platforms.unix;
    mainProgram = "opsdroid";
  };
--- a/pkgs/applications/office/appflowy/default.nix
+++ b/pkgs/applications/office/appflowy/default.nix
@ -13,11 +13,11 @@

 stdenv.mkDerivation rec {
  pname = "appflowy";
-  version = "0.5.7";
+  version = "0.6.1";

  src = fetchzip {
    url = "https://github.com/AppFlowy-IO/appflowy/releases/download/${version}/AppFlowy-${version}-linux-x86_64.tar.gz";
-    hash = "sha256-SVtAx/yllHugBys506pT/5n6IDEZvPEeCHRjFHLMZ0A=";
+    hash = "sha256-a8oupvBtT3sKhboSeS/GbVSauKXx54J4WZd+PyIbuzU=";
    stripRoot = false;
  };

--- a/pkgs/applications/office/treesheets/default.nix
+++ b/pkgs/applications/office/treesheets/default.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "treesheets";
-  version = "0-unstable-2024-06-20";
+  version = "0-unstable-2024-06-23";

  src = fetchFromGitHub {
    owner = "aardappel";
    repo = "treesheets";
-    rev = "d363b4207281caaa6f3b84af93b0cd56c1855692";
-    hash = "sha256-aZIt0DAGDQmIeLZHXjYao5CUhjLp9pjTiXJyoDi0kpQ=";
+    rev = "91dea2ba714e9b1fb6ab660ddd295653218bdebc";
+    hash = "sha256-pn+Ki60lBL+2sKXnhYEly8/Yi94mhiMDxTnWZi4ZFOk=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/radio/multimon-ng/default.nix
+++ b/pkgs/applications/radio/multimon-ng/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "multimon-ng";
-  version = "1.3.0";
+  version = "1.3.1";

  src = fetchFromGitHub {
    owner = "EliasOenal";
    repo = "multimon-ng";
    rev = version;
-    sha256 = "sha256-IJnvOVajkcjaa0DDo8hbkkVvBnDqPKQUN8wJHlafo70=";
+    sha256 = "sha256-irKpVerxzjJIiLofoTdySk/PzojuVLgMq2DYF0qPaAM=";
  };

  buildInputs = lib.optionals stdenv.isLinux [ libpulseaudio libX11 ];
--- a/pkgs/applications/science/astronomy/stellarium/default.nix
+++ b/pkgs/applications/science/astronomy/stellarium/default.nix
@ -24,13 +24,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "stellarium";
-  version = "24.1";
+  version = "24.2";

  src = fetchFromGitHub {
    owner = "Stellarium";
    repo = "stellarium";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-t3eFmiG9X2cmnjc/PQwZ2bw1SCHaNRA83wiT1cPbKJc=";
+    hash = "sha256-tqyLwlf8hugixZSsFCZPTtchO3VXk3m/nX1kuDoLOAY=";
  };

  patches = [
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@ -59,6 +59,7 @@ let
   "8.19.0".sha256   = "sha256-ixsYCvCXpBHqJ71hLQklphlwoOO3i/6w2PJjllKqf9k=";
   "8.19.1".sha256   = "sha256-kmZ8Uk8jpzjOd67aAPp3C+vU2oNaBw9pr7+Uixcgg94=";
   "8.19.2".sha256   = "sha256-q+i07JsMZp83Gqav6v1jxsgPLN7sPvp5/oszVnavmz0=";
+   "8.20+rc1".sha256 = "sha256-OLGPMvvA3hc42zdgWSOnOkN0/WwzBpneUcUVRNcNVms=";
  };
  releaseRev = v: "V${v}";
  fetched = import ../../../../build-support/coq/meta-fetch/default.nix
--- a/pkgs/applications/science/physics/nnpdf/default.nix
+++ b/pkgs/applications/science/physics/nnpdf/default.nix
@ -60,7 +60,5 @@ stdenv.mkDerivation rec {
    license = licenses.gpl3Only;
    maintainers = [ maintainers.veprbl ];
    platforms = platforms.unix;
-    # never built on aarch64-darwin since first introduction in nixpkgs
-    broken = (stdenv.isDarwin && stdenv.isAarch64) || (stdenv.isLinux && stdenv.isAarch64);
  };
 }
--- a/pkgs/applications/terminal-emulators/xterm/default.nix
+++ b/pkgs/applications/terminal-emulators/xterm/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, xorg, ncurses, freetype, fontconfig
+{ lib, stdenv, fetchurl, xorg, ncurses, freetype, fontconfig
 , pkg-config, makeWrapper, nixosTests, gitUpdater
 , nix, gnused, coreutils, enableDecLocator ? true }:

@ -14,6 +14,8 @@ stdenv.mkDerivation rec {
    hash = "sha256-TVc3LvCOr6n7doLbjQe+D+BRPljoR4wuyOm2JIbn/l4=";
  };

+  patches = [ ./sixel-256.support.patch ];
+
  strictDeps = true;

  nativeBuildInputs = [ makeWrapper pkg-config fontconfig ];
@ -32,14 +34,6 @@ stdenv.mkDerivation rec {
    xorg.luit
  ];

-  patches = [ ./sixel-256.support.patch ]
-    ++ lib.optional stdenv.hostPlatform.isMusl (fetchpatch {
-      name = "posix-ptys.patch";
-      url =
-        "https://git.alpinelinux.org/aports/plain/community/xterm/posix-ptys.patch?id=3aa532e77875fa1db18c7fcb938b16647031bcc1";
-      sha256 = "0czgnsxkkmkrk1idw69qxbprh0jb4sw3c24zpnqq2v76jkl7zvlr";
-    });
-
  configureFlags = [
    "--enable-wide-chars"
    "--enable-256-color"
--- a/pkgs/applications/version-management/ghr/default.nix
+++ b/pkgs/applications/version-management/ghr/default.nix
@ -31,7 +31,7 @@ buildGoModule rec {
    homepage = "https://github.com/tcnksm/ghr";
    description = "Upload multiple artifacts to GitHub Release in parallel";
    license = licenses.mit;
-    maintainers = [ maintainers.ivar ];
+    maintainers = [ ];
    mainProgram = "ghr";
  };
 }
--- a/pkgs/applications/video/flirc/default.nix
+++ b/pkgs/applications/video/flirc/default.nix
@ -1,21 +1,22 @@
-{ lib
-, stdenv
-, fetchurl
-, autoPatchelfHook
-, wrapQtAppsHook
-, hidapi
-, readline
-, qtsvg
-, qtxmlpatterns
+{
+  lib,
+  stdenv,
+  fetchurl,
+  autoPatchelfHook,
+  wrapQtAppsHook,
+  hidapi,
+  readline,
+  qtsvg,
+  qtxmlpatterns,
 }:

 stdenv.mkDerivation {
  pname = "flirc";
-  version = "3.27.10";
+  version = "3.27.15";

  src = fetchurl {
-    url = "https://web.archive.org/web/20240110170238/http://apt.flirc.tv/arch/x86_64/flirc.latest.x86_64.tar.gz";
-    hash = "sha256-iTr4vzFQ/+dsbsYD6sc8aTHctTkLKf5HnHBnO7cX5qc=";
+    url = "https://web.archive.org/web/20240626115121/http://apt.flirc.tv/arch/x86_64/flirc.latest.x86_64.tar.gz";
+    hash = "sha256-8bUsOsp5obJJdZU9QHfJnZKNAXJwi0nrHkSeDTE1Xa4=";
  };

  nativeBuildInputs = [
@ -46,6 +47,7 @@ stdenv.mkDerivation {
    maintainers = with maintainers; [ aanderse ];
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
    license = licenses.unfree;
+    mainProgram = "Flirc";
    platforms = [ "x86_64-linux" ];
  };
 }
--- a/pkgs/applications/virtualization/singularity/packages.nix
+++ b/pkgs/applications/virtualization/singularity/packages.nix
@ -47,20 +47,20 @@ let
    callPackage
      (import ./generic.nix rec {
        pname = "singularity-ce";
-        version = "4.1.3";
+        version = "4.1.4";
        projectName = "singularity";

        src = fetchFromGitHub {
          owner = "sylabs";
          repo = "singularity";
          rev = "refs/tags/v${version}";
-          hash = "sha256-pR8zyMr23wcbDCXAysVEgGUDHkrfhLoVF3fjMLgZFYs=";
+          hash = "sha256-+qwPzgwfF6A1c/rmSM/5T2N9/wVeWhMoAthj3eSQmh8=";
        };

        # Update by running
        # nix-prefetch -E "{ sha256 }: ((import ./. { }).singularity.override { vendorHash = sha256; }).goModules"
        # at the root directory of the Nixpkgs repository
-        vendorHash = "sha256-332GFL04aE6B6vxgtJJH4TeI6YJCDBpCClJ3sc5gN3A=";
+        vendorHash = "sha256-dTqOSk8APLOsqwEiZ/IL8Zu1SR48MyEYPgRe6PC2nd8=";

        # Do not build conmon and squashfuse from the Git submodule sources,
        # Use Nixpkgs provided version
--- a/pkgs/applications/window-managers/i3/swallow.nix
+++ b/pkgs/applications/window-managers/i3/swallow.nix
@ -39,6 +39,6 @@ buildPythonApplication rec {
    license = licenses.mit;
    platforms = platforms.linux;
    mainProgram = "swallow";
-    maintainers = [ maintainers.ivar ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/by-name/af/affine/package.nix
+++ b/pkgs/by-name/af/affine/package.nix
@ -18,10 +18,10 @@ stdenvNoCC.mkDerivation (finalAttrs: let
  };
 in {
  pname = "affine";
-  version = "0.14.3";
+  version = "0.14.9";
  src = fetchurl {
    url = "https://github.com/toeverything/AFFiNE/releases/download/v${finalAttrs.version}/affine-${finalAttrs.version}-stable-linux-x64.zip";
-    hash = "sha256-/dKvRr0cH9mLF1y6FGFRDlsFXaymEmb55AZ37Ti0PU4=";
+    hash = "sha256-JGWkmvcdgkvWDAffInzf2lUFHVjkU/a4m25f8BtQqZc=";
  };
  nativeBuildInputs = [
    copyDesktopItems
--- a/pkgs/by-name/am/amber-lang/package.nix
+++ b/pkgs/by-name/am/amber-lang/package.nix
@ -1,36 +1,43 @@
-{ lib,
+{
+  lib,
  fetchFromGitHub,
  rustPlatform,
  bc,
+  util-linux,
  makeWrapper,
  runCommand,
-  amber-lang
+  amber-lang,
 }:

 rustPlatform.buildRustPackage rec {
  pname = "amber-lang";
-  version = "0.3.1-alpha";
+  version = "0.3.3-alpha";

  src = fetchFromGitHub {
    owner = "Ph0enixKM";
    repo = "Amber";
    rev = version;
-    hash = "sha256-VSlLPgoi+KPnUQJEb6m0VZQVs1zkxEnfqs3fAp8m1o4=";
+    hash = "sha256-Al1zTwQufuVGSlttf02s5uI3cyCNDShhzMT3l9Ctv3Y=";
  };

-  cargoHash = "sha256-NzcyX/1yeFcI80pNxx/OTkaI82qyQFJW8U0vPbqSU7g=";
-
-  buildInputs = [ makeWrapper ];
-
-  nativeCheckInputs = [ bc ];
+  cargoHash = "sha256-HbkIkCVy2YI+nP5t01frXBhlp/rCsB6DwLL53AHJ4vE=";

  preConfigure = ''
    substituteInPlace src/compiler.rs \
-      --replace-fail "/bin/bash" "bash"
+      --replace-fail 'Command::new("/usr/bin/env")' 'Command::new("env")'
  '';

+  nativeBuildInputs = [ makeWrapper ];
+
+  nativeCheckInputs = [
+    bc
+    # 'rev' in generated bash script of test
+    # tests::validity::variable_ref_function_invocation
+    util-linux
+  ];
+
  postInstall = ''
-    wrapProgram "$out/bin/amber" --prefix PATH : "${lib.makeBinPath [bc]}"
+    wrapProgram "$out/bin/amber" --prefix PATH : "${lib.makeBinPath [ bc ]}"
  '';

  passthru.tests.run = runCommand "amber-lang-eval-test" { nativeBuildInputs = [ amber-lang ]; } ''
@ -43,7 +50,11 @@ rustPlatform.buildRustPackage rec {
    homepage = "https://amber-lang.com";
    license = licenses.gpl3Plus;
    mainProgram = "amber";
-    maintainers = with maintainers; [ cafkafk uncenter ];
+    maintainers = with maintainers; [
+      cafkafk
+      uncenter
+      aleksana
+    ];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
+++ b/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation {
  pname = "ananicy-rules-cachyos";
-  version = "0-unstable-2024-06-19";
+  version = "0-unstable-2024-06-22";

  src = fetchFromGitHub {
    owner = "CachyOS";
    repo = "ananicy-rules";
-    rev = "167915d1c6e4f46932a9857b1a4aeb3e813a8538";
-    hash = "sha256-hIrjc80DuuENLbD5MxAku6aY05kdfXWLPSCSssadmr8=";
+    rev = "049badd3263ed2af20c9e98b062f8c31cf74cec6";
+    hash = "sha256-KEFXCaLZL3D7ue4W+MqODg/F633sU8JzDMKM2ebUoD8=";
  };

  dontConfigure = true;
--- a/pkgs/by-name/ar/arcan/package.nix
+++ b/pkgs/by-name/ar/arcan/package.nix
@ -1,106 +1,69 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, SDL2
-, callPackage
-, cmake
-, espeak-ng
-, ffmpeg
-, file
-, freetype
-, glib
-, gumbo
-, harfbuzz
-, jbig2dec
-, leptonica
-, libGL
-, libX11
-, libXau
-, libXcomposite
-, libXdmcp
-, libXfixes
-, libdrm
-, libffi
-, libjpeg
-, libusb1
-, libuvc
-, libvlc
-, libvncserver
-, libxcb
-, libxkbcommon
-, makeWrapper
-, mesa
-, mupdf
-, openal
-, openjpeg
-, pcre2
-, pkg-config
-, ruby
-, sqlite
-, tesseract
-, valgrind
-, wayland
-, wayland-protocols
-, xcbutil
-, xcbutilwm
-, xz
-, buildManPages ? true
-, useBuiltinLua ? true
-, useEspeak ? !stdenv.isDarwin
-, useStaticLibuvc ? true
-, useStaticOpenAL ? true
-, useStaticSqlite ? true
-, useTracy ? true
+{
+  lib,
+  SDL2,
+  callPackage,
+  cmake,
+  espeak-ng,
+  ffmpeg,
+  file,
+  freetype,
+  glib,
+  gumbo,
+  harfbuzz,
+  jbig2dec,
+  leptonica,
+  libGL,
+  libX11,
+  libXau,
+  libXcomposite,
+  libXdmcp,
+  libXfixes,
+  libdrm,
+  libffi,
+  libjpeg,
+  libusb1,
+  libuvc,
+  libvlc,
+  libvncserver,
+  libxcb,
+  libxkbcommon,
+  makeWrapper,
+  mesa,
+  mupdf,
+  openal,
+  openjpeg,
+  pcre2,
+  pkg-config,
+  ruby,
+  sqlite,
+  stdenv,
+  tesseract,
+  valgrind,
+  wayland,
+  wayland-protocols,
+  xcbutil,
+  xcbutilwm,
+  xz,
+  # Boolean flags
+  buildManPages ? true,
+  useBuiltinLua ? true,
+  useEspeak ? !stdenv.isDarwin,
+  useStaticLibuvc ? true,
+  useStaticOpenAL ? true,
+  useStaticSqlite ? true,
+  useTracy ? true,
+  # Configurable options
+  sources ? callPackage ./sources.nix { },
 }:

-let
-  allSources = {
-    letoram-arcan = {
-      pname = "arcan";
-      version = "0.6.2.1-unstable-2023-11-18";
-      src = fetchFromGitHub {
-        owner = "letoram";
-        repo = "arcan";
-        rev = "0950ee236f96a555729498d0fdf91c16901037f5";
-        hash = "sha256-TxadRlidy4KRaQ4HunPO6ISJqm6JwnMRM8y6dX6vqJ4=";
-      };
-    };
-    letoram-openal-src = fetchFromGitHub {
-      owner = "letoram";
-      repo = "openal";
-      rev = "81e1b364339b6aa2b183f39fc16c55eb5857e97a";
-      hash = "sha256-X3C3TDZPiOhdZdpApC4h4KeBiWFMxkFsmE3gQ1Rz420=";
-    };
-    libuvc-src = fetchFromGitHub {
-      owner = "libuvc";
-      repo = "libuvc";
-      rev = "68d07a00e11d1944e27b7295ee69673239c00b4b";
-      hash = "sha256-IdV18mnPTDBODpS1BXl4ulkFyf1PU2ZmuVGNOIdQwzE=";
-    };
-    luajit-src = fetchFromGitHub {
-      owner = "LuaJIT";
-      repo = "LuaJIT";
-      rev = "656ecbcf8f669feb94e0d0ec4b4f59190bcd2e48";
-      hash = "sha256-/gGQzHgYuWGqGjgpEl18Rbh3Sx2VP+zLlx4N9/hbYLc=";
-    };
-    tracy-src = fetchFromGitHub {
-      owner = "wolfpld";
-      repo = "tracy";
-      rev = "93537dff336e0796b01262e8271e4d63bf39f195";
-      hash = "sha256-FNB2zTbwk8hMNmhofz9GMts7dvH9phBRVIdgVjRcyQM=";
-    };
-  };
-in
 stdenv.mkDerivation (finalAttrs: {
-  inherit (allSources.letoram-arcan) pname version src;
+  inherit (sources.letoram-arcan) pname version src;

  nativeBuildInputs = [
    cmake
    makeWrapper
    pkg-config
-  ] ++ lib.optionals buildManPages [
-    ruby
-  ];
+  ] ++ lib.optionals buildManPages [ ruby ];

  buildInputs = [
    SDL2
@ -140,47 +103,7 @@ stdenv.mkDerivation (finalAttrs: {
    xcbutil
    xcbutilwm
    xz
-  ]
-  ++ lib.optionals useEspeak [
-    espeak-ng
-  ];
-
-  # Emulate external/git/clone.sh
-  postUnpack = let
-    inherit (allSources)
-      letoram-openal-src libuvc-src luajit-src tracy-src;
-    prepareSource = flag: source: destination:
-      lib.optionalString flag ''
-        cp -va ${source}/ ${destination}
-        chmod --recursive 744 ${destination}
-      '';
-  in
-    ''
-      pushd $sourceRoot/external/git/
-    ''
-    + prepareSource useStaticOpenAL letoram-openal-src "openal"
-    + prepareSource useStaticLibuvc libuvc-src "libuvc"
-    + prepareSource useBuiltinLua luajit-src "luajit"
-    + prepareSource useTracy tracy-src "tracy"
-    + ''
-      popd
-    '';
-
-  postPatch = ''
-    substituteInPlace ./src/platform/posix/paths.c \
-      --replace "/usr/bin" "$out/bin" \
-      --replace "/usr/share" "$out/share"
-    substituteInPlace ./src/CMakeLists.txt \
-      --replace "SETUID" "# SETUID"
-  '';
-
-  # INFO: Arcan build scripts require the manpages to be generated *before* the
-  # `configure` phase
-  preConfigure = lib.optionalString buildManPages ''
-    pushd doc
-    ruby docgen.rb mangen
-    popd
-  '';
+  ] ++ lib.optionals useEspeak [ espeak-ng ];

  cmakeFlags = [
    # The upstream project recommends tagging the distribution
@ -195,11 +118,57 @@ stdenv.mkDerivation (finalAttrs: {
    "../src"
  ];

-  hardeningDisable = [
-    "format"
-  ];
+  outputs = [ "out" "dev" "lib" "man" ];
+
+  hardeningDisable = [ "format" ];
+
+  strictDeps = true;
+
+  # Emulate external/git/clone.sh
+  postUnpack =
+    let
+      inherit (sources)
+        letoram-openal
+        libuvc
+        luajit
+        tracy
+        ;
+      prepareSource =
+        flag: source: destination:
+        lib.optionalString flag ''
+          cp -va ${source}/ ${destination}
+          chmod --recursive 744 ${destination}
+        '';
+    in
+    ''
+      pushd $sourceRoot/external/git/
+    ''
+    + prepareSource useStaticOpenAL letoram-openal.src "openal"
+    + prepareSource useStaticLibuvc libuvc.src "libuvc"
+    + prepareSource useBuiltinLua luajit.src "luajit"
+    + prepareSource useTracy tracy.src "tracy"
+    + ''
+      popd
+    '';
+
+  postPatch = ''
+    substituteInPlace ./src/platform/posix/paths.c \
+      --replace-fail "/usr/bin" "$out/bin" \
+      --replace-fail "/usr/share" "$out/share"
+    substituteInPlace ./src/CMakeLists.txt \
+      --replace-fail "SETUID" "# SETUID"
+  '';
+
+  # INFO: Arcan build scripts require the manpages to be generated *before* the
+  # `configure` phase
+  preConfigure = lib.optionalString buildManPages ''
+    pushd doc
+    ruby docgen.rb mangen
+    popd
+  '';

  passthru = {
+    inherit sources;
    wrapper = callPackage ./wrapper.nix { };
  };

@ -212,7 +181,11 @@ stdenv.mkDerivation (finalAttrs: {
      e.g. game development, real-time streaming video, monitoring and
      surveillance, up to and including desktop compositors and window managers.
    '';
-    license = with lib.licenses; [ bsd3 gpl2Plus lgpl2Plus ];
+    license = with lib.licenses; [
+      bsd3
+      gpl2Plus
+      lgpl2Plus
+    ];
    maintainers = with lib.maintainers; [ AndersonTorres ];
    platforms = lib.platforms.unix;
  };
--- a/pkgs/by-name/ar/arcan/sources.nix
+++ b/pkgs/by-name/ar/arcan/sources.nix
@ -0,0 +1,80 @@
+{
+  fetchFromGitHub,
+}:
+
+{
+  letoram-arcan = let
+    self = {
+      pname = "arcan";
+      version = "0.6.3";
+
+      src = fetchFromGitHub {
+        owner = "letoram";
+        repo = "arcan";
+        rev = self.version;
+        hash = "sha256-ZSKOkNrFa2QgmXmmXnLkB1pehmVJbEFVeNs43Z2DSKo=";
+      };
+    };
+  in
+    self;
+
+  letoram-openal = {
+    pname = "letoram-openal";
+    version = "0.6.2";
+
+    src = fetchFromGitHub {
+      owner = "letoram";
+      repo = "openal";
+      rev = "81e1b364339b6aa2b183f39fc16c55eb5857e97a";
+      hash = "sha256-X3C3TDZPiOhdZdpApC4h4KeBiWFMxkFsmE3gQ1Rz420=";
+    };
+  };
+
+  libuvc = {
+    pname = "libuvc";
+    version = "0.0.7-unstable-2024-03-05";
+
+    src = fetchFromGitHub {
+      owner = "libuvc";
+      repo = "libuvc";
+      rev = "047920bcdfb1dac42424c90de5cc77dfc9fba04d";
+      hash = "sha256-Ds4N9ezdO44eBszushQVvK0SUVDwxGkUty386VGqbT0=";
+    };
+  };
+
+  luajit = {
+    pname = "luajit";
+    version = "2.1-unstable-2024-04-19";
+
+    src = fetchFromGitHub {
+      owner = "LuaJIT";
+      repo = "LuaJIT";
+      rev = "9b5e837ac2dfdc0638830c048a47ca9378c504d3";
+      hash = "sha256-GflF/sELSNanc9G4WMzoOadUBOFSs6OwqhAXa4sudWA=";
+    };
+  };
+
+  tracy = {
+    pname = "tracy";
+    version = "0.9.1-unstable-2023-10-09";
+
+    src = fetchFromGitHub {
+      owner = "wolfpld";
+      repo = "tracy";
+      rev = "93537dff336e0796b01262e8271e4d63bf39f195";
+      hash = "sha256-FNB2zTbwk8hMNmhofz9GMts7dvH9phBRVIdgVjRcyQM=";
+    };
+  };
+
+  letoram-tracy = {
+    pname = "letoram-tracy";
+    version = "0-unstable-2024-04-12";
+
+    src = fetchFromGitHub {
+      owner = "letoram";
+      repo = "tracy";
+      rev = "5b3513d9838317bfc0e72344b94aa4443943c2fd";
+      hash = "sha256-hUdYC4ziQ7V7T7k99MERp81F5mPHzFtPFrqReWsTjOQ=";
+    };
+  };
+}
--- a/pkgs/by-name/ba/babeltrace/package.nix
+++ b/pkgs/by-name/ba/babeltrace/package.nix
@ -64,7 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
    url = "https://git.efficios.com/babeltrace.git";
    rev-prefix = "v";
    # Versions 2.x are packaged independently as babeltrace2
-    ignoredVersions = "^[^1]";
+    allowedVersions = "^1\\.";
  };

  meta = {
--- a/pkgs/by-name/be/beekeeper-studio/package.nix
+++ b/pkgs/by-name/be/beekeeper-studio/package.nix
@ -7,7 +7,7 @@

 let
  pname = "beekeeper-studio";
-  version = "4.6.0";
+  version = "4.6.2";

  plat = {
    aarch64-linux = "-arm64";
@ -16,7 +16,7 @@ let

  hash = {
    aarch64-linux = "sha256-ZxqwxCON21S+RPG0/M2TtcI2Ave7ZT05lKQdyysQFUk=";
-    x86_64-linux = "sha256-y4Muap7X4YyeIftRGC+NrDt3wjqOPi1lt+tsHhKmx4M=";
+    x86_64-linux = "sha256-8sGFNoAsX+X3IJDXpwlYRt78nokauPYz88yDEYy6NP8=";
  }.${stdenv.hostPlatform.system};

  src = fetchurl {
--- a/pkgs/by-name/bi/binary/package.nix
+++ b/pkgs/by-name/bi/binary/package.nix
@ -0,0 +1,55 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+  appstream,
+  desktop-file-utils,
+  glib,
+  gobject-introspection,
+  libadwaita,
+  meson,
+  ninja,
+  pkg-config,
+  wrapGAppsHook4,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "binary";
+  version = "0.3";
+  format = "other";
+
+  src = fetchFromGitHub {
+    owner = "fizzyizzy05";
+    repo = "binary";
+    rev = "refs/tags/${version}";
+    hash = "sha256-bR0oCqbnyUTCueT4f0Ij7qbwjNnN4eMDAOUK9MnCEJ0=";
+  };
+
+  nativeBuildInputs = [
+    appstream
+    desktop-file-utils
+    glib # need glib-compile-schemas
+    gobject-introspection
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [ libadwaita ];
+
+  dependencies = with python3Packages; [ pygobject3 ];
+
+  dontWrapGApps = true;
+  makeWrapperArgs = [ "\${gappsWrapperArgs[@]}" ];
+
+  meta = {
+    description = "Small and simple app to convert numbers to a different base";
+    homepage = "https://github.com/fizzyizzy05/binary";
+    changelog = "https://github.com/fizzyizzy05/binary/releases/tag/${version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ getchoo ];
+    mainProgram = "binary";
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/by-name/bm/bmake/package.nix
+++ b/pkgs/by-name/bm/bmake/package.nix
@ -11,11 +11,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bmake";
-  version = "20240520";
+  version = "20240625";

  src = fetchurl {
    url = "https://www.crufty.net/ftp/pub/sjg/bmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-IhDM1FWwCN95Ufbb00e/zBg3xGRzAU5LjdX/MJGuKJQ=";
+    hash = "sha256-tcBsLyiWtOTZtERLFV3IWxXJDkAlPsw4iakspFevcWQ=";
  };

  patches = [
--- a/pkgs/by-name/bo/boilr/package.nix
+++ b/pkgs/by-name/bo/boilr/package.nix
@ -0,0 +1,68 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, clangStdenv
+, gtk3
+, xorg
+, perl
+, openssl
+, speechd
+, libxkbcommon
+, libGL
+, wayland
+}:
+let
+  rpathLibs = [
+    speechd
+    openssl
+    gtk3
+    libxkbcommon
+    libGL
+
+    # WINIT_UNIX_BACKEND=wayland
+    wayland
+
+    # WINIT_UNIX_BACKEND=x11
+    xorg.libXcursor
+    xorg.libXrandr
+    xorg.libXi
+    xorg.libX11
+    xorg.libxcb
+  ];
+in
+rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } rec {
+  pname = "BoilR";
+  version = "1.9.4";
+
+  src = fetchFromGitHub {
+    owner = "PhilipK";
+    repo = "BoilR";
+    rev = "v.${version}";
+    hash = "sha256-bwCTsoZ/9TeO3wyEcOqxKePnj9glsDXWUBCLd3nVT80=";
+  };
+
+  cargoHash = "sha256-nAZU1xVpeRXubotla4I6InGMH4lisPMOnoqaK5mBPCM=";
+
+  nativeBuildInputs = [ perl ];
+
+  buildInputs = rpathLibs;
+
+  postInstall = ''
+    patchelf --add-rpath "${lib.makeLibraryPath rpathLibs}" $out/bin/boilr
+    install -Dpm 0644 flatpak/io.github.philipk.boilr.desktop $out/share/applications/boilr.desktop
+    install -Dpm 0644 resources/io.github.philipk.boilr.png $out/share/pixmaps/io.github.philipk.boilr.png
+  '';
+
+  dontPatchELF = true;
+
+  meta = {
+    description =
+      "Automatically adds (almost) all your games to your Steam library (including image art)";
+    homepage = "https://github.com/PhilipK/BoilR";
+    license = with lib.licenses; [ asl20 mit ];
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ foolnotion ];
+    mainProgram = "boilr";
+  };
+}
--- a/pkgs/by-name/ca/cat9/package.nix
+++ b/pkgs/by-name/ca/cat9/package.nix
@ -1,17 +1,18 @@
-{ lib
-, stdenvNoCC
-, fetchFromGitHub
+{
+  lib,
+  fetchFromGitHub,
+  stdenvNoCC,
 }:

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "cat9";
-  version = "unstable-2023-11-06";
+  version = "0-unstable-2024-06-17";

  src = fetchFromGitHub {
    owner = "letoram";
    repo = "cat9";
-    rev = "a807776a85237ab0bdd0a712fb33c176fc295e30";
-    hash = "sha256-OlH8FgVBk76Qw+5mnsrryXOL9GbPJWlwUGtYlLuAPxQ=";
+    rev = "f00e8791c1826065d4a93ace12e55ab5732d17a7";
+    hash = "sha256-xFw6r7SQK0T5j7hVK3U39U2Q/qZow6Ad/R0Cl6nqUQw=";
  };

  dontConfigure = true;
--- a/pkgs/by-name/ce/celluloid/package.nix
+++ b/pkgs/by-name/ce/celluloid/package.nix
@ -21,13 +21,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "celluloid";
-  version = "0.26";
+  version = "0.27";

  src = fetchFromGitHub {
    owner = "celluloid-player";
    repo = "celluloid";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-npaagLlkwDe0r0hqj7buM4B9sbLCX1sR2yFXXj+obdE=";
+    hash = "sha256-zuYt7taIb4w3NIszUpnSYvLIdYQH492tBwhLa6IgWDw=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/db/dbeaver-bin/package.nix
+++ b/pkgs/by-name/db/dbeaver-bin/package.nix
@ -12,7 +12,7 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "dbeaver-bin";
-  version = "24.1.0";
+  version = "24.1.1";

  src =
    let
@ -25,10 +25,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
        aarch64-darwin = "macos-aarch64.dmg";
      };
      hash = selectSystem {
-        x86_64-linux = "sha256-cJcjUoZSpD87jy4GGIxMinZW4gxRZfcGO0GdGUGXI6g=";
-        aarch64-linux = "sha256-96t/T/VzzzaSWJbPBb1CH2FXqfhiH1d0MjRoPsRMRwo=";
-        x86_64-darwin = "sha256-8xqSL8fTveg1Y5huBTYZLyubajt27h4XUBzyYVF394A=";
-        aarch64-darwin = "sha256-r7WqJrNF1IgQHx3Na1fGk0ywsfh5t4Dl/u8hH6CPuoE=";
+        x86_64-linux = "sha256-33W7uDxzfAQ5gH10sI4IbzmHl8SxQLYj88C/BGOoRks=";
+        aarch64-linux = "sha256-ZAr9vymCdLFAYiXEXtT+97x1tY5mrbr2N6INj4Bp4Nk=";
+        x86_64-darwin = "sha256-dgOtufARRVmwtXl+csmr2sMBzDvq+5XRotOQrTz8jys=";
+        aarch64-darwin = "sha256-R5TQJq+sRUFHH8EuaXgeSJUOnhepbCJLTUmO0FMOgzE=";
      };
    in
    fetchurl {
--- a/pkgs/by-name/di/discordchatexporter-cli/package.nix
+++ b/pkgs/by-name/di/discordchatexporter-cli/package.nix
@ -39,7 +39,7 @@ buildDotnetModule rec {
    homepage = "https://github.com/Tyrrrz/DiscordChatExporter";
    license = licenses.gpl3Plus;
    changelog = "https://github.com/Tyrrrz/DiscordChatExporter/blob/${version}/Changelog.md";
-    maintainers = with maintainers; [ eclairevoyant ivar ];
+    maintainers = with maintainers; [ eclairevoyant ];
    platforms = [ "x86_64-linux" ];
    mainProgram = "discordchatexporter-cli";
  };
--- a/pkgs/by-name/do/dosbox-staging/package.nix
+++ b/pkgs/by-name/do/dosbox-staging/package.nix
@ -1,14 +1,14 @@
 {
  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchpatch,
  SDL2,
  SDL2_image,
  SDL2_net,
  alsa-lib,
  darwin,
+  fetchFromGitHub,
+  fetchpatch,
  fluidsynth,
+  gitUpdater,
  glib,
  gtest,
  iir1,
@ -18,7 +18,6 @@
  libmt32emu,
  libogg,
  libpng,
-  zlib-ng,
  libpulseaudio,
  libslirp,
  libsndfile,
@ -28,7 +27,9 @@
  opusfile,
  pkg-config,
  speexdsp,
-  nix-update-script,
+  stdenv,
+  testers,
+  zlib-ng,
 }:

 stdenv.mkDerivation (finalAttrs: {
@ -60,6 +61,9 @@ stdenv.mkDerivation (finalAttrs: {

  buildInputs =
    [
+      SDL2
+      SDL2_image
+      SDL2_net
      fluidsynth
      glib
      iir1
@ -69,15 +73,12 @@ stdenv.mkDerivation (finalAttrs: {
      libmt32emu
      libogg
      libpng
-      zlib-ng
      libpulseaudio
      libslirp
      libsndfile
      opusfile
-      SDL2
-      SDL2_image
-      SDL2_net
      speexdsp
+      zlib-ng
    ]
    ++ lib.optionals stdenv.isLinux [ alsa-lib ]
    ++ lib.optionals stdenv.isDarwin (
@ -89,29 +90,40 @@ stdenv.mkDerivation (finalAttrs: {
      ]
    );

+  outputs = [ "out" "man" ];
+
  postInstall = ''
    install -Dm644 $src/contrib/linux/dosbox-staging.desktop $out/share/applications/
  '';

+  # Rename binary, add a wrapper, and copy manual to avoid conflict with
+  # original dosbox. Doing it this way allows us to work with frontends and
+  # launchers that expect the binary to be named dosbox, but get out of the way
+  # of vanilla dosbox if the user desires to install that as well.
  postFixup = ''
-    # Rename binary, add a wrapper, and copy manual to avoid conflict with
-    # original dosbox. Doing it this way allows us to work with frontends and
-    # launchers that expect the binary to be named dosbox, but get out of the
-    # way of vanilla dosbox if the user desires to install that as well.
    mv $out/bin/dosbox $out/bin/dosbox-staging
    makeWrapper $out/bin/dosbox-staging $out/bin/dosbox

-    # Create a symlink to dosbox manual instead of copying it
-    pushd $out/share/man/man1/
+    pushd $man/share/man/man1/
    ln -s dosbox.1.gz dosbox-staging.1.gz
    popd
  '';

-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    tests = {
+      version = testers.testVersion {
+        package = finalAttrs.finalPackage;
+        command = "dosbox --version";
+      };
+    };
+    updateScript = gitUpdater {
+      rev-prefix = "v";
+    };
+  };

  meta = {
    homepage = "https://dosbox-staging.github.io/";
-    description = "Modernized DOS emulator";
+    description = "Modernized DOS emulator; DOSBox fork";
    longDescription = ''
      DOSBox Staging is an attempt to revitalize DOSBox's development
      process. It's not a rewrite, but a continuation and improvement on the
--- a/pkgs/by-name/du/durden/package.nix
+++ b/pkgs/by-name/du/durden/package.nix
@ -1,17 +1,18 @@
-{ lib
-, stdenvNoCC
-, fetchFromGitHub
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
 }:

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "durden";
-  version = "unstable-2023-10-23";
+  version = "0-unstable-2024-06-23";

  src = fetchFromGitHub {
    owner = "letoram";
    repo = "durden";
-    rev = "347dba6da011bbaa70c6edaf82a2d915f4057db3";
-    hash = "sha256-iNf7fOzz7mf1CXG5leCenkSTrdCc9/KL8VLw8gUIyKE=";
+    rev = "dffb94b69355ffa9cda074c1d0a48af74b78c220";
+    hash = "sha256-sBhlBk4vAYwedw4VerUfY80SXbVoEDid54si6qwDeXs=";
  };

  dontConfigure = true;
--- a/pkgs/by-name/fa/fastfetch/package.nix
+++ b/pkgs/by-name/fa/fastfetch/package.nix
@ -47,13 +47,13 @@ let
 in
 stdenv'.mkDerivation (finalAttrs: {
  pname = "fastfetch";
-  version = "2.16.0";
+  version = "2.17.0";

  src = fetchFromGitHub {
    owner = "fastfetch-cli";
    repo = "fastfetch";
    rev = finalAttrs.version;
-    hash = "sha256-dfgRRh8yJUDkMgl32ddx8iQElwRt0hCBsObud7rbTYQ=";
+    hash = "sha256-QK3AlB6tT1pl2qNX/DWPQzpjs9+EhJO9gHtNTNOE41E=";
  };

  outputs = [ "out" "man" ];
--- a/pkgs/by-name/gl/glasskube/package.nix
+++ b/pkgs/by-name/gl/glasskube/package.nix
@ -7,12 +7,12 @@
 }:

 let
-  version = "0.2.1";
+  version = "0.11.0";
  gitSrc = fetchFromGitHub {
    owner = "glasskube";
    repo = "glasskube";
    rev = "refs/tags/v${version}";
-    hash = "sha256-yHktQZ/s3RYcRQd0U+0VTnLOMTyRmlny9RtAdfFT6J8=";
+    hash = "sha256-onpW7YolM05C1BKb7vgH6Y2XFNbigRTueMqjzuFWERo=";
  };
  web-bundle = buildNpmPackage rec {
    inherit version;
@ -20,7 +20,7 @@ let

    src = gitSrc;

-    npmDepsHash = "sha256-WKwEAVMG6r/ZFmxgLR+zJCW8F2DOHxpWDYqhX/vcdrs=";
+    npmDepsHash = "sha256-V4lB+lgnurEo4BPVQDIYxdzKczPPDa6QEFaTAm+go88=";

    dontNpmInstall = true;

@ -40,7 +40,7 @@ in buildGoModule rec {

  src = gitSrc;

-  vendorHash = "sha256-ADa3nQZ/5K9m0aB5NwGQpjqhGwAne5pN2Z5RUb3eEcU=";
+  vendorHash = "sha256-besBympQMvdsD25nndyRkcA8v3wMQUb52VCwvtopgPc=";

  CGO_ENABLED = 0;

--- a/pkgs/by-name/gr/grafana-alloy/package.nix
+++ b/pkgs/by-name/gr/grafana-alloy/package.nix
@ -16,17 +16,17 @@

 buildGoModule rec {
  pname = "grafana-alloy";
-  version = "1.1.1";
+  version = "1.2.0";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "grafana";
    repo = "alloy";
-    hash = "sha256-jaOQG+QkVi10lUp6izvSGE9j76ULc4yKbxdDhLHykYI=";
+    hash = "sha256-0AR7JE79QHA6nO6Wu3ebousH2pyeDiP4+9DnUL/OSYI=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-6Xc2siImM1Dl716uGhtAGcn+PO2OLuYLxanzg8Ho6SA=";
+  vendorHash = "sha256-Pnf/oiwldRIjvVa85igwQ/AoT/iups7LQ46T2iGAIlM=";

  nativeBuildInputs = [ fixup-yarn-lock yarn nodejs installShellFiles ];

@ -57,7 +57,7 @@ buildGoModule rec {

  yarnOfflineCache = fetchYarnDeps {
    yarnLock = "${src}/internal/web/ui/yarn.lock";
-    sha256 = "sha256-o3vCI9GHCr4SjYsiT0wQ4mN76QeAGwOfLVCzGp7NMf4=";
+    hash = "sha256-8/siWMFoUokMXJ13QT8050AXynsApiC67TP/7Hvugsk=";
  };

  preBuild = ''
@ -107,7 +107,6 @@ buildGoModule rec {
      inherit (nixosTests) alloy;
      version = testers.testVersion {
        version = "v${version}";
-        command = "${lib.getExe grafana-alloy} --version";
        package = grafana-alloy;
      };
    };
@ -121,7 +120,7 @@ buildGoModule rec {
    mainProgram = "alloy";
    license = licenses.asl20;
    homepage = "https://grafana.com/oss/alloy";
-    maintainers = with maintainers; [ flokli emilylange hbjydev ];
-    platforms = lib.platforms.unix;
+    maintainers = with maintainers; [ azahi flokli emilylange hbjydev ];
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/by-name/hp/hpp2plantuml/package.nix
+++ b/pkgs/by-name/hp/hpp2plantuml/package.nix
@ -0,0 +1,33 @@
+{
+  lib,
+  python3Packages,
+  fetchPypi,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "hpp2plantuml";
+  version = "0.8.5";
+  format = "wheel";
+
+  src = fetchPypi {
+    inherit pname version format;
+    hash = "sha256-PfTJmBypI21AAK3sMojygQfrhnRqcMmVCW4dxGfDfQg=";
+  };
+
+  propagatedBuildInputs = with python3Packages; [
+    jinja2
+    cppheaderparser
+  ];
+
+  pythonImportsCheck = [ "hpp2plantuml" ];
+
+  nativeCheckInputs = with python3Packages; [ pytest ];
+
+  meta = {
+    description = "Convert C++ header files to PlantUML";
+    homepage = "https://github.com/thibaultmarin/hpp2plantuml";
+    license = lib.licenses.mit;
+    mainProgram = "hpp2plantuml";
+    maintainers = with lib.maintainers; [ eymeric ];
+  };
+}
--- a/pkgs/by-name/hy/hyprnotify/package.nix
+++ b/pkgs/by-name/hy/hyprnotify/package.nix
@ -0,0 +1,34 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  pkg-config,
+  alsa-lib
+}:
+
+buildGoModule rec {
+  pname = "hyprnotify";
+  version = "0.7.0";
+
+  src = fetchFromGitHub {
+    owner = "codelif";
+    repo = "hyprnotify";
+    rev = "v${version}";
+    hash = "sha256-dL+W+iMwRNw9042bs2XUFPMCCqIvDENXOMzhcLh+RL4=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ alsa-lib ];
+
+  vendorHash = "sha256-AZDtaiSNq7em876Q9f+YeDxboqVwA8IE9dDM6zggFXs=";
+
+  meta = {
+    description = "DBus Implementation of Freedesktop Notification spec for 'hyprctl notify'";
+    homepage = "https://github.com/codelif/hyprnotify";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ bloeckchengrafik ];
+    mainProgram = "hyprnotify";
+  };
+}
--- a/pkgs/by-name/jo/job-security/package.nix
+++ b/pkgs/by-name/jo/job-security/package.nix
@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "job-security";
-  version = "unstable-0-2024-03-24";
+  version = "0-unstable-2024-04-07";

  src = fetchFromGitHub {
    owner = "yshui";
    repo = "job-security";
-    rev = "3881a4a0e66afe19cbdba3f43d0f85732796f977";
-    hash = "sha256-mXmDzBsHdiim0bWrs0SvgtMZmKnYVz/RV9LNqPHHlnk=";
+    rev = "9b621cb0be437c709e398d31934b864a09d2a1d5";
+    hash = "sha256-KPnLVKz10SuVcG0CCFWxWnjhf9gHHPCRZw6AW9/gAmk=";
  };

-  cargoHash = "sha256-W5evL36ByUUjvSwa3Nmf4MT2oZYoQ8kmchNOxUwmpuE=";
+  cargoHash = "sha256-YwlI+Z3Zry3i3amz3DufvKzSS1Hrp2kPG76aH5tMJ2g=";

  meta = {
    description = "Job control from anywhere";
--- a/pkgs/by-name/ks/kshutdown/package.nix
+++ b/pkgs/by-name/ks/kshutdown/package.nix
@ -1,24 +1,24 @@
 { stdenv
 , lib
 , fetchurl
-, extra-cmake-modules
+, cmake
 , unzip
-, libsForQt5
+, kdePackages
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "kshutdown";
-  version = "5.91-beta";
+  version = "5.92-beta";

  src = fetchurl {
    url = "mirror://sourceforge/project/kshutdown/KShutdown/${finalAttrs.version}/kshutdown-source-${finalAttrs.version}.zip";
-    hash = "sha256-gWXpVBhoZ57kaQV1C+xCBYc2gZjzJfFViD/SI9D+BRc=";
+    hash = "sha256-EYgb2jeUoLNSPFIzlicnrmsccGc1nvoE5iDVt9x83ns=";
    name = "kshutdown-source-${finalAttrs.version}.zip";
  };

-  nativeBuildInputs = [ extra-cmake-modules unzip libsForQt5.wrapQtAppsHook ];
+  nativeBuildInputs = [ cmake unzip kdePackages.wrapQtAppsHook ];

-  buildInputs = with libsForQt5; [ qtbase kxmlgui knotifyconfig kidletime ];
+  buildInputs = with kdePackages; [ qtbase kxmlgui knotifyconfig kidletime kstatusnotifieritem ];

  meta = with lib; {
    homepage = "https://kshutdown.sourceforge.io/";
@ -29,4 +29,3 @@ stdenv.mkDerivation (finalAttrs: {
    platforms = platforms.linux;
  };
 })
-
--- a/pkgs/by-name/la/lanraragi/install.patch
+++ b/pkgs/by-name/la/lanraragi/install.patch
@ -1,5 +1,5 @@
 diff --git a/tools/install.pl b/tools/install.pl
-index dbeb7c11..06e4c675 100755
+index b7c7adb..a63de58 100644
 --- a/tools/install.pl
 +++ b/tools/install.pl
@@ -9,6 +9,7 @@ use Config;
@ -10,7 +10,7 @@ index dbeb7c11..06e4c675 100755
 
 #Vendor dependencies
 my @vendor_css = (
-@@ -91,32 +92,6 @@ if ( $ENV{HOMEBREW_FORMULA_PREFIX} ) {
+@@ -90,34 +91,6 @@ if ( $ENV{HOMEBREW_FORMULA_PREFIX} ) {
     $cpanopt = " -l " . $ENV{HOMEBREW_FORMULA_PREFIX} . "/libexec";
 }
 
@ -30,9 +30,11 @@ index dbeb7c11..06e4c675 100755
 -
 -#Check for GhostScript
 -say("Checking for GhostScript...");
-can_run('gs')
-  or warn 'NOT FOUND! PDF support will not work properly. Please install the "gs" tool.';
-say("OK!");
+-if ( can_run('gs') ) {
+-    say("OK!");
+-} else {
+-    warn 'NOT FOUND! PDF support will not work properly. Please install the "gs" tool.';
+-}
 -
 -#Check for libarchive
 -say("Checking for libarchive...");
@ -43,7 +45,7 @@ index dbeb7c11..06e4c675 100755
 #Check for PerlMagick
 say("Checking for ImageMagick/PerlMagick...");
 my $imgk;
-@@ -136,36 +111,11 @@ if ($@) {
+@@ -137,37 +110,11 @@ if ($@) {
     say("OK!");
 }
 
@ -67,7 +69,8 @@ index dbeb7c11..06e4c675 100755
 
 -    say("\r\nObtaining remote Web dependencies...\r\n");
 -
-    if ( system("npm ci") != 0 ) {
+-    my $npmcmd = $legacy ? "npm install" : "npm ci";
+-    if ( system($npmcmd) != 0 ) {
 -        die "Something went wrong while obtaining node modules - Bailing out.";
 -    }
 -
@ -80,7 +83,7 @@ index dbeb7c11..06e4c675 100755
     make_path getcwd . "/public/css/vendor";
     make_path getcwd . "/public/css/webfonts";
     make_path getcwd . "/public/js/vendor";
-@@ -212,19 +162,3 @@ sub cp_node_module {
+@@ -214,19 +161,3 @@ sub cp_node_module {
 
 }
 
--- a/pkgs/by-name/la/lanraragi/package.nix
+++ b/pkgs/by-name/la/lanraragi/package.nix
@ -2,7 +2,6 @@
 , stdenv
 , buildNpmPackage
 , fetchFromGitHub
-, fetchpatch
 , makeBinaryWrapper
 , perl
 , ghostscript
@ -11,32 +10,22 @@

 buildNpmPackage rec {
  pname = "lanraragi";
-  version = "0.9.0";
+  version = "0.9.10";

  src = fetchFromGitHub {
    owner = "Difegue";
    repo = "LANraragi";
    rev = "v.${version}";
-    hash = "sha256-euZotpXTUSmxlA5rbTUhHpHH0Ojd3AZjGasxYZ+L7NY=";
+    hash = "sha256-mW2cVd+SPbjc/+b0KY3je1eqw5ZT/GKFruE4Y/eFdD4=";
  };

  patches = [
-    (fetchpatch {
-      name = "fix-redis-auth.patch";
-      url = "https://github.com/Difegue/LANraragi/commit/1711b39759ad02ab2a8863ce1f35f6479c9a2917.patch";
-      hash = "sha256-WfKeieysIlS64qgVEc75JFKjxXuvZN85M6US/gwjTzw=";
-    })
-    (fetchpatch {
-      name = "fix-ghostscript-device.patch";
-      url = "https://github.com/Difegue/LANraragi/commit/087d63b11c89fda8cb3a30cdb2e86ecd6be66bb7.patch";
-      hash = "sha256-Cu9d/dDlO0yuFCTKOyg5A0gIuiA+FcWD9PjexB/BK0U=";
-    })
    ./install.patch
    ./fix-paths.patch
    ./expose-password-hashing.patch # Used by the NixOS module
  ];

-  npmDepsHash = "sha256-/F/lhQIVGbbFxFuQXXwHUVlV2jhHt0hFf94v0FrTKt8=";
+  npmDepsHash = "sha256-RAjZGuK0C6R22fVFq82GPQoD1HpRs3MYMluUAV5ZEc8=";

  nativeBuildInputs = [ perl makeBinaryWrapper ];

@ -59,6 +48,7 @@ buildNpmPackage rec {
    MojoliciousPluginTemplateToolkit
    MojoliciousPluginRenderFile
    MojoliciousPluginStatus
+    IOSocketSocks
    IOSocketSSL
    CpanelJSONXS
    Minion
@ -69,9 +59,9 @@ buildNpmPackage rec {
    FileChangeNotify
    ModulePluggable
    TimeLocal
-    YAMLSyck
+    YAMLPP
    StringSimilarity
-  ] ++ lib.optional stdenv.isLinux LinuxInotify2;
+  ] ++ lib.optionals stdenv.isLinux [ LinuxInotify2 ];

  buildPhase = ''
    runHook preBuild
@ -135,4 +125,3 @@ buildNpmPackage rec {
    platforms = lib.platforms.unix;
  };
 }
-
--- a/pkgs/by-name/lp/lpairs2/package.nix
+++ b/pkgs/by-name/lp/lpairs2/package.nix
@ -10,11 +10,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "lpairs2";
-  version = "2.3";
+  version = "2.3.1";

  src = fetchurl {
    url = "mirror://sourceforge/lgames/lpairs2-${finalAttrs.version}.tar.gz";
-    hash = "sha256-gw1BNkcztyTuoXRdx5+TBZNJEJNrLCfEUCQ1JzROogA=";
+    hash = "sha256-ES5RGr817vc8t2DFNeETTqrm0uwk3JuTypSZjXK86Bg=";
  };

  buildInputs = [
--- a/pkgs/by-name/lu/lunar-client/package.nix
+++ b/pkgs/by-name/lu/lunar-client/package.nix
@ -6,11 +6,11 @@

 appimageTools.wrapType2 rec {
  pname = "lunar-client";
-  version = "3.2.10";
+  version = "3.2.11";

  src = fetchurl {
    url = "https://launcherupdates.lunarclientcdn.com/Lunar%20Client-${version}.AppImage";
-    hash = "sha512-XsHMe4+TeTowxnMRby4W44YRa3Q/OgDf2QOVMjPel4wy3O9TSfNBTzpP7NM07BKVDmNJ7GJrF8WMXewfT3YU8g==";
+    hash = "sha512-qRucW9x4LMmTb8pw0zY1EKXkPfjdahCi2PN/bfdB8CYA4wZp0bfZNaGtPpI/BKPlnR/nfpypEdnHsoqlL9KiCg==";
  };

  extraInstallCommands =
--- a/pkgs/by-name/lw/lwgrp/package.nix
+++ b/pkgs/by-name/lw/lwgrp/package.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "lwgrp";
-  version = "1.0.5";
+  version = "1.0.6";

  src = fetchFromGitHub {
    owner = "LLNL";
    repo = "lwgrp";
    rev = "v${version}";
-    hash = "sha256-f0tYn9FbrOz8iMoG8Is8vYDNfYHTfxLKNnyxJA+Msdk=";
+    hash = "sha256-ZpxxcCqK+qdvnCvobeBV6htRF8wThiQgVFYgEigqmIE=";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/by-name/me/melonDS/package.nix
+++ b/pkgs/by-name/me/melonDS/package.nix
@ -23,13 +23,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "melonDS";
-  version = "0.9.5-unstable-2024-06-18";
+  version = "0.9.5-unstable-2024-06-24";

  src = fetchFromGitHub {
    owner = "melonDS-emu";
    repo = "melonDS";
-    rev = "cbb0f4b872ea8a5e2348c7f1a22695056968192f";
-    hash = "sha256-J1i7+VrOVQruHFhzjBnSf+DbmIa3o+rWISsdm8kMRC8=";
+    rev = "db20771ef36bfa5bc0dc624cf245844507724107";
+    hash = "sha256-XGDMA+0IOvl1UN2HgfLikpxHXl/p0z+Yv6fJs5xv08Y=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/mi/millipixels/package.nix
+++ b/pkgs/by-name/mi/millipixels/package.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitLab
+, fetchpatch
 , glib
 , meson
 , ninja
@ -32,6 +33,13 @@ stdenv.mkDerivation rec {
    domain = "source.puri.sm";
    hash = "sha256-pRREQRYyD9+dpRvcfsNiNthFy08Yeup9xDn+x+RWDrE=";
  };
+  patches = [
+    # fix for https://source.puri.sm/Librem5/millipixels/-/issues/87, can be removed with the next release (if there ever will be one)
+    (fetchpatch {
+      url = "https://source.puri.sm/Librem5/millipixels/-/commit/5a0776993051a0af54c148702f36dbbf1064b917.patch?merge_request_iid=105";
+      hash = "sha256-OdjTFHMx64eb94/kSCaxeM/Ju/JxOPoorw2ogwTPP3s=";
+    })
+  ];

  nativeBuildInputs = [
    glib
--- a/pkgs/by-name/mi/miru/darwin.nix
+++ b/pkgs/by-name/mi/miru/darwin.nix
@ -13,7 +13,7 @@ stdenvNoCC.mkDerivation rec {

  src = fetchurl {
    url = "https://github.com/ThaUnknown/miru/releases/download/v${version}/mac-Miru-${version}-mac.zip";
-    hash = "sha256-OakGB5Fz1Tlxa/Uu7xHlKoEF9VRfWFQ9CjsR0eCRyQw=";
+    hash = "sha256-N4+WDXhu62QUFqdCcPPfYEOd2OImg/Moj+UT0xK2oGE=";
  };

  sourceRoot = ".";
--- a/pkgs/by-name/mi/miru/linux.nix
+++ b/pkgs/by-name/mi/miru/linux.nix
@ -13,7 +13,7 @@ appimageTools.wrapType2 rec {
  src = fetchurl {
    url = "https://github.com/ThaUnknown/miru/releases/download/v${version}/linux-Miru-${version}.AppImage";
    name = "${pname}-${version}.AppImage";
-    sha256 = "sha256-aPutbJthUhZtBYkYuUB5v88OdhOrcnqw4AhnepfO1B4=";
+    sha256 = "sha256-wnqCKnZKt0Fj8TasdRVzI558W7aIB5FLkcDEiZfz3ZQ=";
  };

  extraInstallCommands =
--- a/pkgs/by-name/mi/miru/package.nix
+++ b/pkgs/by-name/mi/miru/package.nix
@ -5,7 +5,7 @@
 }:
 let
  pname = "miru";
-  version = "5.1.4";
+  version = "5.1.6";
  meta = with lib; {
    description = "Stream anime torrents, real-time with no waiting for downloads";
    homepage = "https://miru.watch";
--- a/pkgs/by-name/mo/mods/package.nix
+++ b/pkgs/by-name/mo/mods/package.nix
@ -1,6 +1,7 @@
 {
  lib,
  buildGoModule,
+  installShellFiles,
  fetchFromGitHub,
  gitUpdater,
  testers,
@ -9,16 +10,20 @@

 buildGoModule rec {
  pname = "mods";
-  version = "1.4.0";
+  version = "1.4.1";

  src = fetchFromGitHub {
    owner = "charmbracelet";
    repo = "mods";
    rev = "v${version}";
-    hash = "sha256-MlFWYoSyk1i2uaD04chajsxKlRMtRceJOCrADMrEL60=";
+    hash = "sha256-s2yzrOfZievm7t9NzHojVDNpHkQdZsqdq7zJNO7/SM8=";
  };

-  vendorHash = "sha256-bfo91VGwLvCGS+BSfe+9/voTFfG4lMOOfK72gSLyv9c=";
+  vendorHash = "sha256-Q+lpf35tAIZSHV8FBmYrgKbg5RTJzS33Zv8AH9bVxLY=";
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];

  ldflags = [
    "-s"
@ -41,11 +46,22 @@ buildGoModule rec {
    };
  };

+  postInstall = ''
+    export HOME=$(mktemp -d)
+    $out/bin/mods man > mods.1
+    $out/bin/mods completion bash > mods.bash
+    $out/bin/mods completion fish > mods.fish
+    $out/bin/mods completion zsh > mods.zsh
+
+    installManPage mods.1
+    installShellCompletion mods.{bash,fish,zsh}
+  '';
+
  meta = with lib; {
    description = "AI on the command line";
    homepage = "https://github.com/charmbracelet/mods";
    license = licenses.mit;
-    maintainers = with maintainers; [ dit7ya ];
+    maintainers = with maintainers; [ dit7ya caarlos0 ];
    mainProgram = "mods";
  };
 }
--- a/pkgs/by-name/mo/mold/package.nix
+++ b/pkgs/by-name/mo/mold/package.nix
@ -23,13 +23,13 @@

 stdenv.mkDerivation rec {
  pname = "mold";
-  version = "2.32.0";
+  version = "2.32.1";

  src = fetchFromGitHub {
    owner = "rui314";
    repo = "mold";
    rev = "v${version}";
-    hash = "sha256-0cidxsr7mZLtEMSXc+ZFH9l3pXNi4Fyv27XDks+th/I=";
+    hash = "sha256-pKq4Vw7vPoT76OvCAeh+XEwI5klz2LPxXAWsr+RsTeU=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/mo/movim/package.nix
+++ b/pkgs/by-name/mo/movim/package.nix
@ -38,13 +38,13 @@ let
 in
 php.buildComposerProject (finalAttrs: {
  pname = "movim";
-  version = "0.24.1";
+  version = "0.25.1";

  src = fetchFromGitHub {
    owner = "movim";
    repo = "movim";
    rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-Ai82d1VwtAlKmM8N/hazMWsn5F6HS4I1do3VkpLPlBo=";
+    hash = "sha256-VshDFHDCfemHS/TN5qEe8CGizZksf44xENSmvX44uAc=";
  };

  php = php.buildEnv ({
@ -67,7 +67,7 @@ php.buildComposerProject (finalAttrs: {
  # pinned commonmark
  composerStrictValidation = false;

-  vendorHash = "sha256-1sQm+eRrs9m52CepPXahsOJhyLZ68+FIDNHyY33IoD4=";
+  vendorHash = "sha256-nxbsw0re/7zKhpWxtA8JAf7JL3RLghqaYsi4rkM6VZg=";

  postPatch = ''
    # Our modules are already wrapped, removes missing *.so warnings;
--- a/pkgs/by-name/om/omnictl/package.nix
+++ b/pkgs/by-name/om/omnictl/package.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "omnictl";
-  version = "0.38.1";
+  version = "0.38.2";

  src = fetchFromGitHub {
    owner = "siderolabs";
    repo = "omni";
    rev = "v${version}";
-    hash = "sha256-fPhirFk6JIybBnDwcvYC/oWizhQSEGsosFuh+n/r/Pg=";
+    hash = "sha256-Qm5Q+yZq6m/3xAAMdz57fXC13lLDMu5GY1xs5vHAFoo=";
  };

  vendorHash = "sha256-BF/F/siVIYJT4abOlwQjpnQpmNFdOo566VGPIo08PO0=";
--- a/pkgs/by-name/op/opentelemetry-collector-builder/package.nix
+++ b/pkgs/by-name/op/opentelemetry-collector-builder/package.nix
@ -0,0 +1,43 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+buildGoModule rec {
+  pname = "ocb";
+  version = "0.101.0";
+
+  src = fetchFromGitHub {
+    owner = "open-telemetry";
+    repo = "opentelemetry-collector";
+    rev = "cmd/builder/v${version}";
+    hash = "sha256-Ucp00OjyPtHA6so/NOzTLtPSuhXwz6A2708w2WIZb/E=";
+  };
+
+  sourceRoot = "${src.name}/cmd/builder";
+  vendorHash = "sha256-MTwD9xkrq3EudppLSoONgcPCBWlbSmaODLH9NtYgVOk=";
+
+  CGO_ENABLED = 0;
+  ldflags = [
+    "-s"
+    "-w"
+    "-X go.opentelemetry.io/collector/cmd/builder/internal.version=${version}"
+  ];
+
+  # The TestGenerateAndCompile tests download new dependencies for a modified go.mod. Nix doesn't allow network access so skipping.
+  checkFlags = [ "-skip TestGenerateAndCompile" ];
+
+  # Rename the to ocb (it's generated as "builder")
+  postInstall = ''
+    mv $out/bin/builder $out/bin/ocb
+  '';
+
+  meta = {
+    description = "OpenTelemetry Collector";
+    homepage = "https://github.com/open-telemetry/opentelemetry-collector.git";
+    changelog = "https://github.com/open-telemetry/opentelemetry-collector/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ davsanchez ];
+    mainProgram = "ocb";
+  };
+}
--- a/pkgs/by-name/pi/piv-agent/package.nix
+++ b/pkgs/by-name/pi/piv-agent/package.nix
@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "piv-agent";
-  version = "0.21.0";
+  version = "0.21.1";

  src = fetchFromGitHub {
    owner = "smlx";
    repo = "piv-agent";
    rev = "v${version}";
-    hash = "sha256-aukcnubhB8kbAl22eeFKzLPvVcYdgcEQ1gy3n6KWG00=";
+    hash = "sha256-M6klwP85Ujd/DtWh4AwCVrqk6GYqxdz0DrnKKbmdtX4=";
  };

-  vendorHash = "sha256-1d6EKEvo4XNDXRtbdnKkqyF9y0LPPHWKu9X/wYnbmas=";
+  vendorHash = "sha256-L5HuTYA01w3LUtSy7OVxG6QN5uQZ8LVYyrBcJQTkIUA=";

  subPackages = [ "cmd/piv-agent" ];

--- a/pkgs/by-name/po/posy-cursors/package.nix
+++ b/pkgs/by-name/po/posy-cursors/package.nix
@ -0,0 +1,28 @@
+{ lib, stdenvNoCC, fetchFromGitHub }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "posy-cursors";
+  version = "1.6";
+
+  src = fetchFromGitHub {
+    owner = "simtrami";
+    repo = "posy-improved-cursor-linux";
+    rev = "refs/tags/${version}";
+    hash = "sha256-i0N/QB5uzqHapMCDl6h6PWPJ4GOAyB1ds9qlqmZacLY=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/share/icons
+    cp -r Posy_Cursor* $out/share/icons
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Posy's Improved Cursors for Linux";
+    homepage = "https://github.com/simtrami/posy-improved-cursor-linux";
+    platforms = platforms.unix;
+    license = licenses.unfree;
+    maintainers = with maintainers; [ mkez ];
+  };
+}
--- a/Show More
+++ b/Show More