Merge staging-next into staging

2024-11-26 08:53:21 +00:00 · 2024-04-18 00:02:44 +00:00 · 2024-04-18 00:02:44 +00:00 · a181110966
commit a181110966
parent 4a6511fb98 e2bf665bb2
115 changed files with 2779 additions and 5939 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -19412,6 +19412,12 @@
    github = "sweenu";
    githubId = 7051978;
  };
+  swendel = {
+    name = "Sebastian Wendel";
+    email = "nixpkgs.aiX5ph@srx.digital";
+    github = "SebastianWendel";
+    githubId = 919570;
+  };
  swesterfeld = {
    email = "stefan@space.twc.de";
    github = "swesterfeld";
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -131,12 +131,16 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - [transfer-sh](https://github.com/dutchcoders/transfer.sh), a tool that supports easy and fast file sharing from the command-line. Available as [services.transfer-sh](#opt-services.transfer-sh.enable).

+- [FCast Receiver](https://fcast.org), an open-source alternative to Chromecast and AirPlay. Available as [programs.fcast-receiver](#opt-programs.fcast-receiver.enable).
+
 - [MollySocket](https://github.com/mollyim/mollysocket) which allows getting Signal notifications via UnifiedPush.

 - [Suwayomi Server](https://github.com/Suwayomi/Suwayomi-Server), a free and open source manga reader server that runs extensions built for [Tachiyomi](https://tachiyomi.org). Available as [services.suwayomi-server](#opt-services.suwayomi-server.enable).

 - [ping_exporter](https://github.com/czerwonk/ping_exporter), a Prometheus exporter for ICMP echo requests. Available as [services.prometheus.exporters.ping](#opt-services.prometheus.exporters.ping.enable).

+- [Prometheus DNSSEC Exporter](https://github.com/chrj/prometheus-dnssec-exporter), check for validity and expiration in DNSSEC signatures and expose metrics for Prometheus. Available as [services.prometheus.exporters.dnssec](#opt-services.prometheus.exporters.dnssec.enable).
+
 - [TigerBeetle](https://tigerbeetle.com/), a distributed financial accounting database designed for mission critical safety and performance. Available as [services.tigerbeetle](#opt-services.tigerbeetle.enable).

 - [go-camo](https://github.com/cactus/go-camo), a secure image proxy server. Available as [services.go-camo](#opt-services.go-camo.enable).
@ -283,6 +287,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
  release notes of [v19](https://github.com/systemd/mkosi/releases/tag/v19) and
  [v20](https://github.com/systemd/mkosi/releases/tag/v20) for a list of changes.

+- `gonic` has been updated to v0.16.4. Config now requires `playlists-path` to be set. See the rest of the [v0.16.0 release notes](https://github.com/sentriz/gonic/releases/tag/v0.16.0) for more details.
+
 - The `services.vikunja` systemd service now uses `vikunja` as dynamic user instead of `vikunja-api`. Database users might need to be changed.

 - The `services.vikunja.setupNginx` setting has been removed. Users now need to setup the webserver configuration on their own with a proxy pass to the vikunja service.
--- a/nixos/modules/config/shells-environment.nix
+++ b/nixos/modules/config/shells-environment.nix
@ -42,8 +42,8 @@ in
        strings.  The latter is concatenated, interspersed with colon
        characters.
      '';
-      type = with types; attrsOf (oneOf [ (listOf str) str path ]);
-      apply = mapAttrs (n: v: if isList v then concatStringsSep ":" v else "${v}");
+      type = with types; attrsOf (oneOf [ (listOf (oneOf [ float int str ])) float int str path ]);
+      apply = mapAttrs (n: v: if isList v then concatMapStringsSep ":" toString v else toString v);
    };

    environment.profiles = mkOption {
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -179,6 +179,7 @@
  ./programs/environment.nix
  ./programs/evince.nix
  ./programs/extra-container.nix
+  ./programs/fcast-receiver.nix
  ./programs/feedbackd.nix
  ./programs/file-roller.nix
  ./programs/firefox.nix
--- a/nixos/modules/programs/fcast-receiver.nix
+++ b/nixos/modules/programs/fcast-receiver.nix
@ -0,0 +1,31 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.programs.fcast-receiver;
+in
+{
+  meta = {
+    maintainers = pkgs.fcast-receiver.meta.maintainers;
+  };
+
+  options.programs.fcast-receiver = {
+    enable = mkEnableOption (lib.mdDoc "FCast Receiver");
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Open ports needed for the functionality of the program.
+      '';
+    };
+    package = mkPackageOption pkgs "fcast-receiver" { };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ 46899 ];
+    };
+  };
+}
--- a/nixos/modules/programs/soundmodem.nix
+++ b/nixos/modules/programs/soundmodem.nix
@ -11,7 +11,7 @@ in
      enable = mkOption {
        type = types.bool;
        default = false;
-        description = lib.mdDoc ''
+        description = ''
          Whether to add Soundmodem to the global environment and configure a
          wrapper for 'soundmodemconfig' for users in the 'soundmodem' group.
        '';
@ -21,7 +21,7 @@ in
  };

  config = mkIf cfg.enable {
-    environment.systemPackages = [ soundmodem ];
+    environment.systemPackages = [ cfg.package ];
    users.groups.soundmodem = { };

    security.wrappers.soundmodemconfig = {
--- a/nixos/modules/services/audio/gonic.nix
+++ b/nixos/modules/services/audio/gonic.nix
@ -55,6 +55,9 @@ in
        RuntimeDirectory = "gonic";
        RootDirectory = "/run/gonic";
        ReadWritePaths = "";
+        BindPaths = [
+          cfg.settings.playlists-path
+        ];
        BindReadOnlyPaths = [
          # gonic can access scrobbling services
          "-/etc/resolv.conf"
--- a/nixos/modules/services/hardware/udev.nix
+++ b/nixos/modules/services/hardware/udev.nix
@ -401,17 +401,19 @@ in
      }))
    ];

-    environment.etc =
-      {
-        "udev/rules.d".source = udevRulesFor {
-          name = "udev-rules";
-          udevPackages = cfg.packages;
-          systemd = config.systemd.package;
-          binPackages = cfg.packages;
-          inherit udevPath udev;
-        };
-        "udev/hwdb.bin".source = hwdbBin;
+    environment.etc = {
+      "udev/rules.d".source = udevRulesFor {
+        name = "udev-rules";
+        udevPackages = cfg.packages;
+        systemd = config.systemd.package;
+        binPackages = cfg.packages;
+        inherit udevPath udev;
      };
+      "udev/hwdb.bin".source = hwdbBin;
+    } // lib.optionalAttrs config.boot.modprobeConfig.enable {
+      # We don't place this into `extraModprobeConfig` so that stage-1 ramdisk doesn't bloat.
+      "modprobe.d/firmware.conf".text = "options firmware_class path=${config.hardware.firmware}/lib/firmware";
+    };

    system.requiredKernelConfig = with config.lib.kernelConfig; [
      (isEnabled "UNIX")
@ -419,21 +421,17 @@ in
      (isYes "NET")
    ];

-    # We don't place this into `extraModprobeConfig` so that stage-1 ramdisk doesn't bloat.
-    environment.etc."modprobe.d/firmware.conf".text = "options firmware_class path=${config.hardware.firmware}/lib/firmware";
+    system.activationScripts.udevd = lib.mkIf config.boot.kernel.enable ''
+      # The deprecated hotplug uevent helper is not used anymore
+      if [ -e /proc/sys/kernel/hotplug ]; then
+        echo "" > /proc/sys/kernel/hotplug
+      fi

-    system.activationScripts.udevd =
-      ''
-        # The deprecated hotplug uevent helper is not used anymore
-        if [ -e /proc/sys/kernel/hotplug ]; then
-          echo "" > /proc/sys/kernel/hotplug
-        fi
-
-        # Allow the kernel to find our firmware.
-        if [ -e /sys/module/firmware_class/parameters/path ]; then
-          echo -n "${config.hardware.firmware}/lib/firmware" > /sys/module/firmware_class/parameters/path
-        fi
-      '';
+      # Allow the kernel to find our firmware.
+      if [ -e /sys/module/firmware_class/parameters/path ]; then
+        echo -n "${config.hardware.firmware}/lib/firmware" > /sys/module/firmware_class/parameters/path
+      fi
+    '';

    systemd.services.systemd-udevd =
      { restartTriggers = cfg.packages;
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@ -31,6 +31,7 @@ let
    "collectd"
    "dmarc"
    "dnsmasq"
+    "dnssec"
    "domain"
    "dovecot"
    "fastly"
--- a/nixos/modules/services/monitoring/prometheus/exporters/dnssec.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/dnssec.nix
@ -0,0 +1,90 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.prometheus.exporters.dnssec;
+  configFormat = pkgs.formats.toml { };
+  configFile = configFormat.generate "dnssec-checks.toml" cfg.configuration;
+in {
+  port = 9204;
+  extraOpts = {
+    configuration = lib.mkOption {
+      type = lib.types.nullOr lib.types.attrs;
+      default = null;
+      description = ''
+        dnssec exporter configuration as nix attribute set.
+
+        See <https://github.com/chrj/prometheus-dnssec-exporter/blob/master/README.md>
+        for the description of the configuration file format.
+      '';
+      example = lib.literalExpression ''
+        {
+          records = [
+            {
+              zone = "ietf.org";
+              record = "@";
+              type = "SOA";
+            }
+            {
+              zone = "verisigninc.com";
+              record = "@";
+              type = "SOA";
+            }
+          ];
+        }
+      '';
+    };
+
+    listenAddress = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      description = ''
+        Listen address as host IP and port definition.
+      '';
+      example = ":9204";
+    };
+
+    resolvers = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = ''
+        DNSSEC capable resolver to be used for the check.
+      '';
+      example = [ "0.0.0.0:53" ];
+    };
+
+    timeout = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      description = ''
+        DNS request timeout duration.
+      '';
+      example = "10s";
+    };
+
+    extraFlags = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = ''
+        Extra commandline options when launching Prometheus.
+      '';
+    };
+  };
+
+  serviceOpts = {
+    serviceConfig = let
+      startScript = pkgs.writeShellScriptBin "prometheus-dnssec-exporter-start"
+        "${lib.concatStringsSep " "
+        ([ "${pkgs.prometheus-dnssec-exporter}/bin/prometheus-dnssec-exporter" ]
+          ++ lib.optionals (cfg.configuration != null)
+          [ "-config ${configFile}" ]
+          ++ lib.optionals (cfg.listenAddress != null)
+          [ "-listen-address ${lib.escapeShellArg cfg.listenAddress}" ]
+          ++ lib.optionals (cfg.resolvers != [ ]) [
+            "-resolvers ${
+              lib.escapeShellArg (lib.concatStringsSep "," cfg.resolvers)
+            }"
+          ] ++ lib.optionals (cfg.timeout != null)
+          [ "-timeout ${lib.escapeShellArg cfg.timeout}" ] ++ cfg.extraFlags)}";
+    in { ExecStart = lib.getExe startScript; };
+  };
+}
+
--- a/nixos/modules/services/networking/deconz.nix
+++ b/nixos/modules/services/networking/deconz.nix
@ -93,6 +93,13 @@ in
        # be garbage collected. Ensure the file gets "refreshed" on every start.
        rm -f ${stateDir}/.local/share/dresden-elektronik/deCONZ/zcldb.txt
      '';
+      postStart = ''
+        # Delay signalling service readiness until it's actually up.
+        while ! "${lib.getExe pkgs.curl}" -sSfl -o /dev/null "http://${cfg.listenAddress}:${toString cfg.httpPort}"; do
+            echo "Waiting for TCP port ${toString cfg.httpPort} to be open..."
+            sleep 1
+        done
+      '';
      environment = {
        HOME = stateDir;
        XDG_RUNTIME_DIR = "/run/${name}";
--- a/nixos/modules/services/web-apps/freshrss.nix
+++ b/nixos/modules/services/web-apps/freshrss.nix
@ -268,11 +268,11 @@ in

          script =
            let
-              userScriptArgs = ''--user ${cfg.defaultUser} --password "$(cat ${cfg.passwordFile})"'';
-              updateUserScript = optionalString (cfg.authType == "form") ''
+              userScriptArgs = ''--user ${cfg.defaultUser} ${optionalString (cfg.authType == "form") ''--password "$(cat ${cfg.passwordFile})"''}'';
+              updateUserScript = optionalString (cfg.authType == "form" || cfg.authType == "none") ''
                ./cli/update-user.php ${userScriptArgs}
              '';
-              createUserScript = optionalString (cfg.authType == "form") ''
+              createUserScript = optionalString (cfg.authType == "form" || cfg.authType == "none") ''
                ./cli/create-user.php ${userScriptArgs}
              '';
            in
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@ -164,7 +164,7 @@ let
      ${commonHttpConfig}

      ${optionalString (cfg.resolver.addresses != []) ''
-        resolver ${toString cfg.resolver.addresses} ${optionalString (cfg.resolver.valid != "") "valid=${cfg.resolver.valid}"} ${optionalString (!cfg.resolver.ipv6) "ipv6=off"};
+        resolver ${toString cfg.resolver.addresses} ${optionalString (cfg.resolver.valid != "") "valid=${cfg.resolver.valid}"} ${optionalString (!cfg.resolver.ipv4) "ipv4=off"} ${optionalString (!cfg.resolver.ipv6) "ipv6=off"};
      ''}
      ${upstreamConfig}

@ -978,6 +978,15 @@ in
                An optional valid parameter allows overriding it
              '';
            };
+            ipv4 = mkOption {
+              type = types.bool;
+              default = true;
+              description = ''
+                By default, nginx will look up both IPv4 and IPv6 addresses while resolving.
+                If looking up of IPv4 addresses is not desired, the ipv4=off parameter can be
+                specified.
+              '';
+            };
            ipv6 = mkOption {
              type = types.bool;
              default = true;
@ -1179,6 +1188,13 @@ in
          to answer to ACME requests.
        '';
      }
+
+      {
+        assertion = cfg.resolver.ipv4 || cfg.resolver.ipv6;
+        message = ''
+          At least one of services.nginx.resolver.ipv4 and services.nginx.resolver.ipv6 must be true.
+        '';
+      }
    ] ++ map (name: mkCertOwnershipAssertion {
      inherit (cfg) group user;
      cert = config.security.acme.certs.${name};
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -330,6 +330,7 @@ in {
  freshrss-sqlite = handleTest ./freshrss-sqlite.nix {};
  freshrss-pgsql = handleTest ./freshrss-pgsql.nix {};
  freshrss-http-auth = handleTest ./freshrss-http-auth.nix {};
+  freshrss-none-auth = handleTest ./freshrss-none-auth.nix {};
  frigate = handleTest ./frigate.nix {};
  frp = handleTest ./frp.nix {};
  frr = handleTest ./frr.nix {};
--- a/nixos/tests/freshrss-none-auth.nix
+++ b/nixos/tests/freshrss-none-auth.nix
@ -0,0 +1,19 @@
+import ./make-test-python.nix ({ lib, pkgs, ... }: {
+  name = "freshrss";
+  meta.maintainers = with lib.maintainers; [ mattchrist ];
+
+  nodes.machine = { pkgs, ... }: {
+    services.freshrss = {
+      enable = true;
+      baseUrl = "http://localhost";
+      authType = "none";
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_open_port(80)
+    response = machine.succeed("curl -vvv -s http://127.0.0.1:80/i/")
+    assert '<title>Main stream · FreshRSS</title>' in response, "FreshRSS stream page didn't load successfully"
+  '';
+})
--- a/nixos/tests/gonic.nix
+++ b/nixos/tests/gonic.nix
@ -2,11 +2,19 @@ import ./make-test-python.nix ({ pkgs, ... }: {
  name = "gonic";

  nodes.machine = { ... }: {
+    systemd.tmpfiles.settings = {
+      "10-gonic" = {
+        "/tmp/music"."d" = {};
+        "/tmp/podcast"."d" = {};
+        "/tmp/playlists"."d" = {};
+      };
+    };
    services.gonic = {
      enable = true;
      settings = {
-        music-path = [ "/tmp" ];
-        podcast-path = "/tmp";
+        music-path = [ "/tmp/music" ];
+        podcast-path = "/tmp/podcast";
+        playlists-path = "/tmp/playlists";
      };
    };
  };
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@ -227,6 +227,54 @@ let
      '';
    };

+    dnssec = {
+      exporterConfig = {
+        enable = true;
+        configuration = {
+          records = [
+            {
+              zone = "example.com";
+              record = "@";
+              type = "SOA";
+            }
+          ];
+        };
+        resolvers = [ "127.0.0.1:53" ];
+      };
+      metricProvider = {
+        services.knot = {
+          enable = true;
+          settingsFile = pkgs.writeText "knot.conf" ''
+            server:
+              listen: 127.0.0.1@53
+            template:
+              - id: default
+                storage: ${pkgs.buildEnv {
+                  name = "zones";
+                  paths = [(pkgs.writeTextDir "example.com.zone" ''
+                    @ SOA ns1.example.com. noc.example.com. 2024032401 86400 7200 3600000 172800
+                    @       NS      ns1
+                    ns1     A       192.168.0.1
+                  '')];
+                }}
+                zonefile-load: difference
+                zonefile-sync: -1
+            zone:
+              - domain: example.com
+                file: example.com.zone
+                dnssec-signing: on
+          '';
+        };
+      };
+      exporterTest = ''
+        wait_for_unit("knot.service")
+        wait_for_open_port(53)
+        wait_for_unit("prometheus-dnssec-exporter.service")
+        wait_for_open_port(9204)
+        succeed("curl -sSf http://localhost:9204/metrics | grep 'example.com'")
+      '';
+    };
+
    # Access to WHOIS server is required to properly test this exporter, so
    # just perform basic sanity check that the exporter is running and returns
    # a failure.
--- a/pkgs/applications/audio/a2jmidid/default.nix
+++ b/pkgs/applications/audio/a2jmidid/default.nix
@ -1,15 +1,17 @@
-{ lib, stdenv, fetchFromGitHub, makeWrapper, pkg-config, alsa-lib, dbus, libjack2
-, python3Packages , meson, ninja }:
+{ lib, stdenv, fetchFromGitea, makeWrapper, pkg-config, alsa-lib, dbus, libjack2
+, python3Packages , meson, ninja, gitUpdater }:

 stdenv.mkDerivation rec {
  pname = "a2jmidid";
-  version = "9";
+  version = "12";

-  src = fetchFromGitHub {
-    owner = "linuxaudio";
-    repo = pname;
-    rev = version;
-    sha256 = "sha256-WNt74tSWV8bY4TnpLp86PsnrjkqWynJJt3Ra4gZl2fQ=";
+  src = fetchFromGitea {
+    domain = "gitea.ladish.org";
+    owner = "LADI";
+    repo = "a2jmidid";
+    rev = "refs/tags/${version}";
+    fetchSubmodules = true;
+    hash = "sha256-PZKGhHmPMf0AucPruOLB9DniM5A3BKdghFCrd5pTzeM=";
  };

  nativeBuildInputs = [ pkg-config makeWrapper meson ninja ];
@ -21,9 +23,12 @@ stdenv.mkDerivation rec {
    substituteInPlace $out/bin/a2j --replace "a2j_control" "$out/bin/a2j_control"
  '';

+  passthru.updateScript = gitUpdater { };
+
  meta = with lib; {
    description = "Daemon for exposing legacy ALSA sequencer applications in JACK MIDI system";
-    license = licenses.gpl2;
+    homepage = "https://a2jmidid.ladish.org/";
+    license = licenses.gpl2Only;
    maintainers = [ maintainers.goibhniu ];
    platforms = [ "i686-linux" "x86_64-linux" "aarch64-linux" ];
  };
--- a/pkgs/applications/audio/muzika/default.nix
+++ b/pkgs/applications/audio/muzika/default.nix
@ -2,7 +2,7 @@
 , desktop-file-utils
 , fetchFromGitHub
 , fetchYarnDeps
-, prefetch-yarn-deps
+, fixup-yarn-lock
 , gjs
 , glib-networking
 , gobject-introspection
@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
    ninja
    nodejs
    pkg-config
-    prefetch-yarn-deps
+    fixup-yarn-lock
    wrapGAppsHook4
    yarn
  ];
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@ -4,7 +4,7 @@
 , fetchYarnDeps
 , makeDesktopItem
 , copyDesktopItems
-, prefetch-yarn-deps
+, fixup-yarn-lock
 , makeWrapper
 , autoSignDarwinBinariesHook
 , nodejs
@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [
-    prefetch-yarn-deps
+    fixup-yarn-lock
    makeWrapper
    nodejs
    yarn
--- a/pkgs/applications/misc/tandoor-recipes/frontend.nix
+++ b/pkgs/applications/misc/tandoor-recipes/frontend.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchYarnDeps, prefetch-yarn-deps, callPackage, nodejs }:
+{ stdenv, fetchYarnDeps, fixup-yarn-lock, callPackage, nodejs }:
 let
  common = callPackage ./common.nix { };
 in
@ -14,7 +14,7 @@ stdenv.mkDerivation {
  };

  nativeBuildInputs = [
-    prefetch-yarn-deps
+    fixup-yarn-lock
    nodejs
    nodejs.pkgs.yarn
  ];
--- a/pkgs/applications/networking/browsers/mullvad-browser/default.nix
+++ b/pkgs/applications/networking/browsers/mullvad-browser/default.nix
@ -90,7 +90,7 @@ let
      ++ lib.optionals mediaSupport [ ffmpeg ]
  );

-  version = "13.0.13";
+  version = "13.0.14";

  sources = {
    x86_64-linux = fetchurl {
@ -102,7 +102,7 @@ let
        "https://tor.eff.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
        "https://tor.calyxinstitute.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
      ];
-      hash = "sha256-CAJJs14U9zsl5PiyZIwXYZG4dZz+Cqn7sD9u3S+/WvA=";
+      hash = "sha256-z7fZtq+jnoAi6G8RNahGtP1LXeOXU/2wYz5ha2ddAeM=";
    };
  };

--- a/pkgs/applications/networking/browsers/tor-browser/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser/default.nix
@ -101,7 +101,7 @@ lib.warnIf (useHardenedMalloc != null)
      ++ lib.optionals mediaSupport [ ffmpeg ]
  );

-  version = "13.0.13";
+  version = "13.0.14";

  sources = {
    x86_64-linux = fetchurl {
@ -111,7 +111,7 @@ lib.warnIf (useHardenedMalloc != null)
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
        "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
      ];
-      hash = "sha256-l7Ka8vjVX67ZPPzRnQixtki5/cYhP6P/J91CyGPnwfI=";
+      hash = "sha256-UWR2zMVXa6QMz1EIWJf43Vmj14ZIaug105esxeSd0KU=";
    };

    i686-linux = fetchurl {
@ -121,7 +121,7 @@ lib.warnIf (useHardenedMalloc != null)
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
        "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
      ];
-      hash = "sha256-Ro9F3SZiagtj3AnDOtHmyy1G/KOi/O9M3f775qrZig4=";
+      hash = "sha256-n+qj3IY4z+erOg4iUkQ4CP3rtJASTeKPg7beZRdesw4=";
    };
  };

--- a/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/default.nix
@ -20,13 +20,13 @@

 buildGoModule rec {
  pname = "kubernetes";
-  version = "1.29.3";
+  version = "1.29.4";

  src = fetchFromGitHub {
    owner = "kubernetes";
    repo = "kubernetes";
    rev = "v${version}";
-    hash = "sha256-mtYxFy2d892uMLrtaR6ao07gjbThuGa7bzauwvJ0WOo=";
+    hash = "sha256-7Rxbcsl77iFiHkU/ovyn74aXs/i5G/m5h5Ii0y1CRho=";
  };

  vendorHash = null;
--- a/pkgs/applications/networking/cluster/tilt/assets.nix
+++ b/pkgs/applications/networking/cluster/tilt/assets.nix
@ -2,7 +2,7 @@
 , stdenvNoCC
 , version, src
 , fetchYarnDeps
-, prefetch-yarn-deps, yarn, nodejs
+, fixup-yarn-lock, yarn, nodejs
 }:

 stdenvNoCC.mkDerivation rec {
@ -10,7 +10,7 @@ stdenvNoCC.mkDerivation rec {

  inherit src version;

-  nativeBuildInputs = [ prefetch-yarn-deps yarn nodejs ];
+  nativeBuildInputs = [ fixup-yarn-lock yarn nodejs ];

  yarnOfflineCache = fetchYarnDeps {
    yarnLock = "${src}/web/yarn.lock";
--- a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
@ -3,7 +3,7 @@
 , fetchFromGitHub
 , makeWrapper
 , makeDesktopItem
-, prefetch-yarn-deps
+, fixup-yarn-lock
 , yarn
 , nodejs
 , fetchYarnDeps
@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: builtins.removeAttrs pinData [ "hashes" ] // {
    sha256 = desktopYarnHash;
  };

-  nativeBuildInputs = [ yarn prefetch-yarn-deps nodejs makeWrapper jq ]
+  nativeBuildInputs = [ yarn fixup-yarn-lock nodejs makeWrapper jq ]
    ++ lib.optionals stdenv.isDarwin [ desktopToDarwinBundle ];

  inherit seshat;
--- a/pkgs/applications/networking/instant-messengers/element/element-web.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-web.nix
@ -6,7 +6,7 @@
 , writeText
 , jq
 , yarn
-, prefetch-yarn-deps
+, fixup-yarn-lock
 , nodejs
 , jitsi-meet
 }:
@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: builtins.removeAttrs pinData [ "hashes" ] // {
    sha256 = webYarnHash;
  };

-  nativeBuildInputs = [ yarn prefetch-yarn-deps jq nodejs ];
+  nativeBuildInputs = [ yarn fixup-yarn-lock jq nodejs ];

  buildPhase = ''
    runHook preBuild
--- a/pkgs/applications/networking/instant-messengers/element/seshat/default.nix
+++ b/pkgs/applications/networking/instant-messengers/element/seshat/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, rustPlatform, fetchFromGitHub, callPackage, sqlcipher, nodejs, python3, yarn, prefetch-yarn-deps, CoreServices, fetchYarnDeps, removeReferencesTo }:
+{ lib, stdenv, rustPlatform, fetchFromGitHub, callPackage, sqlcipher, nodejs, python3, yarn, fixup-yarn-lock, CoreServices, fetchYarnDeps, removeReferencesTo }:

 let
  pinData = lib.importJSON ./pin.json;
@ -16,7 +16,7 @@ in rustPlatform.buildRustPackage rec {

  sourceRoot = "${src.name}/seshat-node/native";

-  nativeBuildInputs = [ nodejs python3 yarn prefetch-yarn-deps ];
+  nativeBuildInputs = [ nodejs python3 yarn fixup-yarn-lock ];
  buildInputs = [ sqlcipher ] ++ lib.optional stdenv.isDarwin CoreServices;

  npm_config_nodedir = nodejs;
--- a/pkgs/applications/networking/instant-messengers/hydrogen-web/unwrapped.nix
+++ b/pkgs/applications/networking/instant-messengers/hydrogen-web/unwrapped.nix
@ -3,7 +3,7 @@
 , fetchFromGitHub
 , fetchYarnDeps
 , yarn
-, prefetch-yarn-deps
+, fixup-yarn-lock
 , nodejs
 }:

@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-N9lUAhfYLlEAIaWSNS3Ecq+aBTz+f7Z22Sclwj9rp6w=";
  };

-  nativeBuildInputs = [ yarn prefetch-yarn-deps nodejs ];
+  nativeBuildInputs = [ yarn fixup-yarn-lock nodejs ];

  configurePhase = ''
    runHook preConfigure
--- a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
@ -7,7 +7,7 @@
 , yarn
 , nodejs
 , fetchYarnDeps
-, prefetch-yarn-deps
+, fixup-yarn-lock
 , electron
 , libnotify
 , libpulseaudio
@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-jBwyIyiWeqNmOnxmVOr7c4oMWwHElEjM25sShhTMi78=";
  };

-  nativeBuildInputs = [ yarn prefetch-yarn-deps nodejs copyDesktopItems makeWrapper ];
+  nativeBuildInputs = [ yarn fixup-yarn-lock nodejs copyDesktopItems makeWrapper ];

  configurePhase = ''
    runHook preConfigure
--- a/pkgs/applications/networking/irc/thelounge/default.nix
+++ b/pkgs/applications/networking/irc/thelounge/default.nix
@ -4,7 +4,7 @@
 , fetchYarnDeps
 , nodejs
 , yarn
-, prefetch-yarn-deps
+, fixup-yarn-lock
 , python3
 , npmHooks
 , darwin
@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-MM6SgVT7Pjdu96A4eWRucEzT7uNPxBqUDgHKl8mH2C0=";
  };

-  nativeBuildInputs = [ nodejs yarn prefetch-yarn-deps python3 npmHooks.npmInstallHook ] ++ lib.optional stdenv.isDarwin darwin.cctools;
+  nativeBuildInputs = [ nodejs yarn fixup-yarn-lock python3 npmHooks.npmInstallHook ] ++ lib.optional stdenv.isDarwin darwin.cctools;
  buildInputs = [ sqlite ];

  configurePhase = ''
--- a/pkgs/applications/radio/openwebrx/default.nix
+++ b/pkgs/applications/radio/openwebrx/default.nix
@ -62,13 +62,13 @@ let
 in
 buildPythonApplication rec {
  pname = "openwebrx";
-  version = "1.2.0";
+  version = "1.2.2";

  src = fetchFromGitHub {
    owner = "jketterl";
    repo = pname;
    rev = version;
-    sha256 = "sha256-7gcgwa9vQT2u8PQusuXKted2Hk0K+Zk6ornSG1K/D4c=";
+    hash = "sha256-i3Znp5Sxs/KtJazHh2v9/2P+3cEocWB5wIpF7E4pK9s=";
  };

  propagatedBuildInputs = [
--- a/pkgs/applications/terminal-emulators/foot/default.nix
+++ b/pkgs/applications/terminal-emulators/foot/default.nix
@ -27,7 +27,7 @@
 }:

 let
-  version = "1.17.1";
+  version = "1.17.2";

  # build stimuli file for PGO build and the script to generate it
  # independently of the foot's build, so we can cache the result
@ -99,7 +99,7 @@ stdenv.mkDerivation {
    owner = "dnkl";
    repo = "foot";
    rev = version;
-    hash = "sha256-B6RhzsOPwczPLJRx3gBFZZvklwx9IwqplRG2vsAPIlg=";
+    hash = "sha256-p+qaWHBrUn6YpNyAmQf6XoQyO3degHP5oMN53/9gIr4=";
  };

  separateDebugInfo = true;
--- a/pkgs/applications/version-management/gitlab/default.nix
+++ b/pkgs/applications/version-management/gitlab/default.nix
@ -2,7 +2,7 @@
 , ruby_3_1, tzdata, git, nettools, nixosTests, nodejs, openssl
 , defaultGemConfig, buildRubyGem
 , gitlabEnterprise ? false, callPackage, yarn
-, prefetch-yarn-deps, replace, file, cacert, fetchYarnDeps, makeWrapper, pkg-config
+, fixup-yarn-lock, replace, file, cacert, fetchYarnDeps, makeWrapper, pkg-config
 , cargo, rustc, rustPlatform
 }:

@ -94,7 +94,7 @@ let
      sha256 = data.yarn_hash;
    };

-    nativeBuildInputs = [ rubyEnv.wrappedRuby rubyEnv.bundler nodejs yarn git cacert prefetch-yarn-deps ];
+    nativeBuildInputs = [ rubyEnv.wrappedRuby rubyEnv.bundler nodejs yarn git cacert fixup-yarn-lock ];

    patches = [
      # Since version 12.6.0, the rake tasks need the location of git,
--- a/pkgs/applications/version-management/sapling/default.nix
+++ b/pkgs/applications/version-management/sapling/default.nix
@ -13,7 +13,7 @@
 , fetchYarnDeps
 , yarn
 , nodejs
-, prefetch-yarn-deps
+, fixup-yarn-lock
 , glibcLocales
 , libiconv
 , Cocoa
@ -66,7 +66,7 @@ let
    inherit version;

    nativeBuildInputs = [
-      prefetch-yarn-deps
+      fixup-yarn-lock
      nodejs
      yarn
    ];
--- a/pkgs/applications/virtualization/podman-desktop/default.nix
+++ b/pkgs/applications/virtualization/podman-desktop/default.nix
@ -3,7 +3,7 @@
 , fetchFromGitHub
 , fetchYarnDeps
 , yarn
-, prefetch-yarn-deps
+, fixup-yarn-lock
 , nodejs
 , makeWrapper
 , copyDesktopItems
@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {

  nativeBuildInputs = [
    yarn
-    prefetch-yarn-deps
+    fixup-yarn-lock
    nodejs
    makeWrapper
    copyDesktopItems
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@ -17,9 +17,12 @@
 , makeWrapper
 , runtimeShell
 , symlinkJoin
+, substituteAll
 , extraPackages ? [ ]
 , runc
 , crun
+, gvisor
+, youki
 , conmon
 , slirp4netns
 , fuse-overlayfs
@ -30,6 +33,7 @@
 , gvproxy
 , aardvark-dns
 , netavark
+, passt
 , testers
 , podman
 }:
@ -37,9 +41,6 @@ let
  # do not add qemu to this wrapper, store paths get written to the podman vm config and break when GCed

  binPath = lib.makeBinPath (lib.optionals stdenv.isLinux [
-    runc
-    crun
-    conmon
    fuse-overlayfs
    util-linux
    iptables
@ -57,21 +58,27 @@ let
      catatonit # added here for the pause image and also set in `containersConf` for `init_path`
      netavark
      slirp4netns
+      passt
    ];
  };
 in
 buildGoModule rec {
  pname = "podman";
-  version = "4.9.3";
+  version = "5.0.1";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "podman";
    rev = "v${version}";
-    hash = "sha256-PdAXcXtc/Jl3ttWWB6TciiOwWescJ51Glhf2ZhOw550=";
+    hash = "sha256-XgLrPLswLmaB9FYXKEMLP+7KT/OY50z3JKz8DvMLrEE=";
  };

  patches = [
+    (substituteAll {
+      src = ./hardcode-paths.patch;
+      inherit crun runc gvisor youki conmon;
+    })
+
    # we intentionally don't build and install the helper so we shouldn't display messages to users about it
    ./rm-podman-mac-helper-msg.patch
  ];
--- a/pkgs/applications/virtualization/podman/hardcode-paths.patch
+++ b/pkgs/applications/virtualization/podman/hardcode-paths.patch
@ -0,0 +1,109 @@
+diff --git a/vendor/github.com/containers/common/pkg/config/default.go b/vendor/github.com/containers/common/pkg/config/default.go
+index 19c4bb6bf..2743de4b2 100644
+--- a/vendor/github.com/containers/common/pkg/config/default.go
+++ b/vendor/github.com/containers/common/pkg/config/default.go
+@@ -364,75 +364,34 @@ func defaultEngineConfig() (*EngineConfig, error) {
+ 	c.Retry = 3
+ 	c.OCIRuntimes = map[string][]string{
+ 		"crun": {
+-			"/usr/bin/crun",
+-			"/usr/sbin/crun",
+-			"/usr/local/bin/crun",
+-			"/usr/local/sbin/crun",
+-			"/sbin/crun",
+-			"/bin/crun",
+-			"/run/current-system/sw/bin/crun",
+			"@crun@/bin/crun",
+ 		},
+ 		"crun-vm": {
+-			"/usr/bin/crun-vm",
+-			"/usr/local/bin/crun-vm",
+-			"/usr/local/sbin/crun-vm",
+-			"/sbin/crun-vm",
+-			"/bin/crun-vm",
+-			"/run/current-system/sw/bin/crun-vm",
+			// TODO: "@crun-vm@/bin/crun-vm",
+ 		},
+ 		"crun-wasm": {
+-			"/usr/bin/crun-wasm",
+-			"/usr/sbin/crun-wasm",
+-			"/usr/local/bin/crun-wasm",
+-			"/usr/local/sbin/crun-wasm",
+-			"/sbin/crun-wasm",
+-			"/bin/crun-wasm",
+-			"/run/current-system/sw/bin/crun-wasm",
+			// TODO: "@crun-wasm@/bin/crun-wasm",
+ 		},
+ 		"runc": {
+-			"/usr/bin/runc",
+-			"/usr/sbin/runc",
+-			"/usr/local/bin/runc",
+-			"/usr/local/sbin/runc",
+-			"/sbin/runc",
+-			"/bin/runc",
+-			"/usr/lib/cri-o-runc/sbin/runc",
+-			"/run/current-system/sw/bin/runc",
+			"@runc@/bin/runc",
+ 		},
+ 		"runj": {
+-			"/usr/local/bin/runj",
+			// TODO: "@runj@/bin/runj",
+ 		},
+ 		"kata": {
+-			"/usr/bin/kata-runtime",
+-			"/usr/sbin/kata-runtime",
+-			"/usr/local/bin/kata-runtime",
+-			"/usr/local/sbin/kata-runtime",
+-			"/sbin/kata-runtime",
+-			"/bin/kata-runtime",
+-			"/usr/bin/kata-qemu",
+-			"/usr/bin/kata-fc",
+			// TODO: "@kata@/bin/kata",
+ 		},
+ 		"runsc": {
+-			"/usr/bin/runsc",
+-			"/usr/sbin/runsc",
+-			"/usr/local/bin/runsc",
+-			"/usr/local/sbin/runsc",
+-			"/bin/runsc",
+-			"/sbin/runsc",
+-			"/run/current-system/sw/bin/runsc",
+			"@gvisor@/bin/runsc",
+ 		},
+ 		"youki": {
+-			"/usr/local/bin/youki",
+-			"/usr/bin/youki",
+-			"/bin/youki",
+-			"/run/current-system/sw/bin/youki",
+			"@youki@/bin/youki",
+ 		},
+ 		"krun": {
+-			"/usr/bin/krun",
+-			"/usr/local/bin/krun",
+			// TODO: "@krun@/bin/krun",
+ 		},
+ 		"ocijail": {
+-			"/usr/local/bin/ocijail",
+			// TODO: "@ocijail@/bin/ocijail",
+ 		},
+ 	}
+ 	c.PlatformToOCIRuntime = map[string]string{
+@@ -443,16 +402,9 @@ func defaultEngineConfig() (*EngineConfig, error) {
+ 	// Needs to be called after populating c.OCIRuntimes.
+ 	c.OCIRuntime = c.findRuntime()
+ 
+-	c.ConmonEnvVars.Set([]string{"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"})
+	c.ConmonEnvVars.Set([]string{})
+ 	c.ConmonPath.Set([]string{
+-		"/usr/libexec/podman/conmon",
+-		"/usr/local/libexec/podman/conmon",
+-		"/usr/local/lib/podman/conmon",
+-		"/usr/bin/conmon",
+-		"/usr/sbin/conmon",
+-		"/usr/local/bin/conmon",
+-		"/usr/local/sbin/conmon",
+-		"/run/current-system/sw/bin/conmon",
+		"@conmon@/bin/conmon",
+ 	})
+ 	c.ConmonRsPath.Set([]string{
+ 		"/usr/libexec/podman/conmonrs",
--- a/pkgs/applications/virtualization/podman/rm-podman-mac-helper-msg.patch
+++ b/pkgs/applications/virtualization/podman/rm-podman-mac-helper-msg.patch
@ -1,8 +1,22 @@
 diff --git a/pkg/machine/machine_common.go b/pkg/machine/machine_common.go
-index 4e43dd54c..a981d93bf 100644
+index 1afc3d15b..a8aafcaae 100644
 --- a/pkg/machine/machine_common.go
 +++ b/pkg/machine/machine_common.go
-@@ -127,14 +127,6 @@ address can't be used by podman. `
+@@ -33,13 +33,8 @@ func GetDevNullFiles() (*os.File, *os.File, error) {
+ // WaitAPIAndPrintInfo prints info about the machine and does a ping test on the
+ // API socket
+ func WaitAPIAndPrintInfo(forwardState APIForwardingState, name, helper, forwardSock string, noInfo, rootful bool) {
+-	suffix := ""
+ 	var fmtString string
+ 
+-	if name != DefaultMachineName {
+-		suffix = " " + name
+-	}
+-
+ 	if forwardState == NoForwarding {
+ 		return
+ 	}
+@@ -61,14 +56,6 @@ address can't be used by podman. `
 
 				if len(helper) < 1 {
 					fmt.Print(fmtString)
@ -12,7 +26,7 @@ index 4e43dd54c..a981d93bf 100644
 -        sudo %s install
 -        podman machine stop%[2]s; podman machine start%[2]s
 -
-                `
+-`
 -					fmt.Printf(fmtString, helper, suffix)
 				}
 			case MachineLocal:
--- a/pkgs/build-support/node/fetch-yarn-deps/default.nix
+++ b/pkgs/build-support/node/fetch-yarn-deps/default.nix
@ -13,29 +13,49 @@ in {
    name = "prefetch-yarn-deps";

    dontUnpack = true;
+    dontBuild = true;

    nativeBuildInputs = [ makeWrapper ];
-    buildInputs = [ coreutils nix-prefetch-git nodejs-slim nix ];
-
-    buildPhase = ''
-      runHook preBuild
-
-      mkdir libexec
-      tar --strip-components=1 -xf ${yarnpkg-lockfile-tar} package/index.js
-      mv index.js libexec/yarnpkg-lockfile.js
-      cp ${./.}/*.js libexec/
-      patchShebangs libexec
-
-      runHook postBuild
-    '';
+    buildInputs = [ nodejs-slim ];

    installPhase = ''
      runHook preInstall

-      mkdir -p $out/bin
-      cp -r libexec $out
+      mkdir -p $out/bin $out/libexec
+
+      tar --strip-components=1 -xf ${yarnpkg-lockfile-tar} package/index.js
+      mv index.js $out/libexec/yarnpkg-lockfile.js
+      cp ${./.}/common.js ${./.}/index.js $out/libexec/
+
+      patchShebangs $out/libexec
      makeWrapper $out/libexec/index.js $out/bin/prefetch-yarn-deps \
        --prefix PATH : ${lib.makeBinPath [ coreutils nix-prefetch-git nix ]}
+
+      runHook postInstall
+    '';
+
+    passthru = { inherit tests; };
+  };
+
+  fixup-yarn-lock = stdenv.mkDerivation {
+    name = "fixup-yarn-lock";
+
+    dontUnpack = true;
+    dontBuild = true;
+
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ nodejs-slim ];
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/bin $out/libexec
+
+      tar --strip-components=1 -xf ${yarnpkg-lockfile-tar} package/index.js
+      mv index.js $out/libexec/yarnpkg-lockfile.js
+      cp ${./.}/common.js ${./.}/fixup.js $out/libexec/
+
+      patchShebangs $out/libexec
      makeWrapper $out/libexec/fixup.js $out/bin/fixup-yarn-lock

      runHook postInstall
--- a/pkgs/by-name/ae/aeron-cpp/package.nix
+++ b/pkgs/by-name/ae/aeron-cpp/package.nix
@ -1,5 +1,6 @@
 {
  autoPatchelfHook,
+  aeron,
  cmake,
  fetchFromGitHub,
  fetchMavenArtifact,
@ -14,23 +15,16 @@
 }:

 let
-  version = "1.42.1";
+  version = aeron.version;

-  aeronAll = fetchMavenArtifact {
-    artifactId = "aeron-all";
-    groupId = "io.aeron";
-    inherit version;
-    hash = "sha512-pjX+JopK6onDwElMIroj+ZXrKwdPj5H2uPg08XgNlrK1rAkHo9MUT8weBGbuFVFDLeqOZrHj0bt1wJ9XgYY5aA==";
-  };
-
-  sbeAll_1_29_0 = fetchMavenArtifact {
+  sbeAll_1_30_0 = fetchMavenArtifact {
    groupId = "uk.co.real-logic";
-    version = "1.29.0";
+    version = "1.30.0";
    artifactId = "sbe-all";
-    hash = "sha512-exklKS9MgOH369lyuv+5vAWRHt+Iwg/FmsWy8PsSMjenvjs8I2KA1VTa00pIXkw/YNqbUDBIWvS07b4mS8YdPQ==";
+    hash = "sha512-K/LMP6zNBHl2Wpvli/sH+ZsYwlTPJHHCKee7riOH6dR8nxTJgucnF7AsbVOpowR6xaV3wPjFh0iqWp/oerHKBg==";
  };

-  sbeAll = sbeAll_1_29_0;
+  sbeAll = sbeAll_1_30_0;

 in

@ -42,7 +36,7 @@ stdenv.mkDerivation {
    owner = "real-logic";
    repo = "aeron";
    rev = version;
-    hash = "sha256-ODJeJ4XLazPeNLdzaoclPnE59NpxFUqZu3Aw3iTVQT8=";
+    hash = "sha256-MY7I8Cw1izVLW3/JWav9zPIBJTGInZHwAZT2e7tI9F0=";
  };

  patches = [
@ -54,7 +48,6 @@ stdenv.mkDerivation {
  ];

  buildInputs = [
-    jdk11
    libbsd
    libuuid
    zlib
@ -63,6 +56,7 @@ stdenv.mkDerivation {
  nativeBuildInputs = [
    autoPatchelfHook
    cmake
+    jdk11
    makeWrapper
    patchelf
  ];
@ -89,7 +83,7 @@ stdenv.mkDerivation {
  buildPhase = ''
    runHook preBuild

-    ln --symbolic  "${aeronAll.jar}" ./aeron-all.jar
+    ln --symbolic  "${aeron.jar}" ./aeron-all.jar
    ln --symbolic  "${sbeAll.jar}" ./sbe.jar
    mkdir --parents aeron-all/build/libs
    (
--- a/pkgs/by-name/an/antares/package.nix
+++ b/pkgs/by-name/an/antares/package.nix
@ -0,0 +1,49 @@
+{ fetchFromGitHub
+, lib
+, buildNpmPackage
+, electron
+, nodejs
+}:
+
+buildNpmPackage rec {
+  pname = "antares";
+  version = "0.7.22";
+
+  src = fetchFromGitHub {
+    owner = "antares-sql";
+    repo = "antares";
+    rev = "v${version}";
+    hash = "sha256-SYnhrwxoyVw+bwfN1PGMsoul+mTfi8UkiP0fNOvVTBc=";
+  };
+
+  npmDepsHash = "sha256-5khFw8Igu2d5SYLh7OiCpUDMOVH5gAje+VnvoESQboo=";
+
+  buildInputs = [ nodejs ];
+
+  buildPhase = ''
+    runHook preBuild
+    npm run compile
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    npmInstallHook
+    cp -rf dist/* $out/lib/node_modules/antares
+    find -name "*.ts" | xargs rm -f
+    makeWrapper ${lib.getExe electron} $out/bin/antares \
+      --add-flags $out/lib/node_modules/antares/main.js
+    runHook postInstall
+  '';
+
+  dontNpmBuild = true;
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+  env.PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD = "1";
+
+  meta = with lib; {
+    description = "Modern, fast and productivity driven SQL client with a focus in UX";
+    homepage = "https://github.com/antares-sql/antares";
+    license = licenses.mit;
+    maintainers = with maintainers; [ eymeric ];
+  };
+}
--- a/pkgs/by-name/aw/aws-azure-login/package.nix
+++ b/pkgs/by-name/aw/aws-azure-login/package.nix
@ -6,7 +6,7 @@
 , fetchYarnDeps
 , makeWrapper
 , nodejs
-, prefetch-yarn-deps
+, fixup-yarn-lock
 , yarn
 }:
 stdenv.mkDerivation (finalAttrs: {
@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
  nativeBuildInputs = [
    makeWrapper
    nodejs
-    prefetch-yarn-deps
+    fixup-yarn-lock
    yarn
  ];

--- a/pkgs/by-name/cz/czkawka/package.nix
+++ b/pkgs/by-name/cz/czkawka/package.nix
@ -45,9 +45,10 @@ rustPlatform.buildRustPackage {
    glib
    gtk4
    pango
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Foundation
-  ];
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin (with darwin.apple_sdk.frameworks; [
+    Foundation
+    AppKit
+  ]);

  nativeCheckInputs = [
    xvfb-run
--- a/pkgs/by-name/de/devcontainer/package.nix
+++ b/pkgs/by-name/de/devcontainer/package.nix
@ -2,7 +2,7 @@
 , stdenv
 , fetchYarnDeps
 , fetchFromGitHub
-, prefetch-yarn-deps
+, fixup-yarn-lock
 , nodejs
 , python3
 , makeWrapper
@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-Wy0UP8QaQzZ1par7W5UhnRLc5DF2PAif0JIZJtRokBk=";
  };

-  nativeBuildInputs = [ yarn prefetch-yarn-deps python3 makeWrapper ];
+  nativeBuildInputs = [ yarn fixup-yarn-lock python3 makeWrapper ];

  buildPhase = ''
    runHook preBuild
--- a/pkgs/by-name/fc/fcast-receiver/package.nix
+++ b/pkgs/by-name/fc/fcast-receiver/package.nix
@ -0,0 +1,64 @@
+{ lib
+, buildNpmPackage
+, fetchFromGitLab
+, makeDesktopItem
+, copyDesktopItems
+, makeWrapper
+, electron
+}:
+
+buildNpmPackage rec {
+  pname = "fcast-receiver";
+  version = "1.0.14";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.futo.org";
+    owner = "videostreaming";
+    repo = "fcast";
+    rev = "c7a1cb27c470870df50dbf0de00a133061298d46";
+    hash = "sha256-9xF1DZ2wt6zMoUQywmvnNN3Z8m4GhOFJElENhozF9c8=";
+  };
+
+  sourceRoot = "${src.name}/receivers/electron";
+
+  makeCacheWritable = true;
+
+  npmDepsHash = "sha256-gpbFZ8rKYR/GUY1l4eH5io/lz6FpJLUTl5h8q3haxvw=";
+
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = pname;
+      desktopName = "FCast Receiver";
+      genericName = "Media Streaming Receiver";
+      exec = "fcast-receiver";
+      icon = "fcast-receiver";
+      comment = "FCast Receiver, an open-source media streaming receiver";
+    })
+  ];
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    makeWrapper
+  ];
+
+  postInstall = ''
+    install -Dm644 $out/lib/node_modules/fcast-receiver/app.png $out/share/pixmaps/fcast-receiver.png
+
+    makeWrapper ${electron}/bin/electron $out/bin/fcast-receiver \
+      --add-flags $out/lib/node_modules/fcast-receiver/dist/bundle.js
+  '';
+
+  meta = with lib; {
+    description = "FCast Receiver, an open-source media streaming receiver";
+    longDescription = ''
+      FCast Receiver is a receiver for an open-source media streaming protocol, FCast, an alternative to Chromecast and AirPlay.
+    '';
+    homepage = "https://fcast.org/";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ ymstnt ];
+    mainProgram = "fcast-receiver";
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/by-name/fe/fernglas/package.nix
+++ b/pkgs/by-name/fe/fernglas/package.nix
@ -3,7 +3,7 @@
 , rustPlatform
 , fetchFromGitHub
 , fetchYarnDeps
-, prefetch-yarn-deps
+, fixup-yarn-lock
 , python3
 , jq
 , yarn
@ -21,7 +21,7 @@ rustPlatform.buildRustPackage rec {
    hash = "sha256-0wj5AS8RLVr+S/QWWxCsMvmVjmXUWGfR9kPaZimJEss=";
  };

-  nativeBuildInputs = [ yarn nodejs-slim prefetch-yarn-deps python3 jq ];
+  nativeBuildInputs = [ yarn nodejs-slim fixup-yarn-lock python3 jq ];

  nlnog_communities = fetchFromGitHub {
    owner = "NLNOG";
--- a/pkgs/by-name/gi/gitmoji-cli/package.nix
+++ b/pkgs/by-name/gi/gitmoji-cli/package.nix
@ -4,7 +4,7 @@
 , fetchYarnDeps
 , makeWrapper
 , nodejs
-, prefetch-yarn-deps
+, fixup-yarn-lock
 , yarn
 , testers
 }:
@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
  nativeBuildInputs = [
    makeWrapper
    nodejs
-    prefetch-yarn-deps
+    fixup-yarn-lock
    yarn
  ];

--- a/pkgs/by-name/ha/handheld-daemon/package.nix
+++ b/pkgs/by-name/ha/handheld-daemon/package.nix
@ -1,21 +1,22 @@
-{ config
-, fetchFromGitHub
-, hidapi
-, kmod
-, lib
-, python3
-, toybox
+{
+  config,
+  fetchFromGitHub,
+  hidapi,
+  kmod,
+  lib,
+  python3,
+  toybox,
 }:
 python3.pkgs.buildPythonApplication rec {
  pname = "handheld-daemon";
-  version = "1.1.0";
+  version = "2.6.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "hhd-dev";
    repo = "hhd";
    rev = "v${version}";
-    hash = "sha256-ovLC1BQ98jUaDEMPBzWma4TYSzTF+yE/cMemFdJmqlE=";
+    hash = "sha256-S77APtE1GGfqnv1IkZdJOSlprPOBtrqVXV60yVMvopg=";
  };

  propagatedBuildInputs = with python3.pkgs; [
@ -26,17 +27,22 @@ python3.pkgs.buildPythonApplication rec {
    rich
    setuptools
    toybox
+    xlib
  ];

  # This package doesn't have upstream tests.
  doCheck = false;

-  # handheld-daemon contains a fork of the python module `hid`, so this hook
-  # is borrowed from the `hid` derivation.
  postPatch = ''
-    hidapi=${ hidapi }/lib/
+    # handheld-daemon contains a fork of the python module `hid`, so this hook
+    # is borrowed from the `hid` derivation.
+    hidapi=${hidapi}/lib/
    test -d $hidapi || { echo "ERROR: $hidapi doesn't exist, please update/fix this build expression."; exit 1; }
    sed -i -e "s|libhidapi|$hidapi/libhidapi|" src/hhd/controller/lib/hid.py
+
+    # The generated udev rules point to /bin/chmod, which does not exist in NixOS
+    chmod=${toybox}/bin/chmod
+    sed -i -e "s|/bin/chmod|$chmod|" src/hhd/controller/lib/hide.py
  '';

  postInstall = ''
--- a/pkgs/by-name/in/incus/ui.nix
+++ b/pkgs/by-name/in/incus/ui.nix
@ -3,7 +3,7 @@
 , fetchFromGitHub
 , fetchYarnDeps
 , nodejs
-, prefetch-yarn-deps
+, fixup-yarn-lock
 , yarn
 , nixosTests
 , git
@ -42,7 +42,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [
    nodejs
-    prefetch-yarn-deps
+    fixup-yarn-lock
    yarn
    git
  ];
--- a/pkgs/by-name/li/libsignal-ffi/Cargo.lock
+++ b/pkgs/by-name/li/libsignal-ffi/Cargo.lock
--- a/pkgs/by-name/li/libsignal-ffi/package.nix
+++ b/pkgs/by-name/li/libsignal-ffi/package.nix
@ -12,13 +12,13 @@ rustPlatform.buildRustPackage rec {
  pname = "libsignal-ffi";
  # must match the version used in mautrix-signal
  # see https://github.com/mautrix/signal/issues/401
-  version = "0.41.0";
+  version = "0.44.0";

  src = fetchFromGitHub {
    owner = "signalapp";
    repo = "libsignal";
    rev = "v${version}";
-    hash = "sha256-U/Wy7nzRQJLdc/dGmYR418Nt1KV70HbcgnDHmYxKytg=";
+    hash = "sha256-HqnxemAPjjKl/l4dVjEUIIvgW3ibNtQWnA10QYcd8Os=";
  };

  nativeBuildInputs = [ protobuf ] ++ lib.optionals stdenv.isDarwin [ xcodebuild ];
--- a/pkgs/by-name/lx/lxd-ui/package.nix
+++ b/pkgs/by-name/lx/lxd-ui/package.nix
@ -4,7 +4,7 @@
  fetchFromGitHub,
  fetchYarnDeps,
  nodejs,
-  prefetch-yarn-deps,
+  fixup-yarn-lock,
  yarn,
  nixosTests,
  nix-update-script,
@ -28,7 +28,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [
    nodejs
-    prefetch-yarn-deps
+    fixup-yarn-lock
    yarn
  ];

--- a/pkgs/by-name/me/mealie/mealie-frontend.nix
+++ b/pkgs/by-name/me/mealie/mealie-frontend.nix
@ -1,5 +1,5 @@
 src: version:
-{ lib, fetchYarnDeps, nodejs_18, prefetch-yarn-deps, stdenv }: stdenv.mkDerivation {
+{ lib, fetchYarnDeps, nodejs_18, fixup-yarn-lock, stdenv }: stdenv.mkDerivation {
  name = "mealie-frontend";
  inherit version;
  src = "${src}/frontend";
@ -10,7 +10,7 @@ src: version:
  };

  nativeBuildInputs = [
-    prefetch-yarn-deps
+    fixup-yarn-lock
    nodejs_18
    nodejs_18.pkgs.yarn
  ];
--- a/pkgs/by-name/me/mermaid-cli/package.nix
+++ b/pkgs/by-name/me/mermaid-cli/package.nix
@ -4,7 +4,7 @@
 , fetchYarnDeps
 , makeWrapper
 , nodejs
-, prefetch-yarn-deps
+, fixup-yarn-lock
 , yarn
 , chromium
 }:
@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs  = [
    makeWrapper
    nodejs
-    prefetch-yarn-deps
+    fixup-yarn-lock
    yarn
  ];

--- a/pkgs/by-name/no/node-hp-scan-to/package.nix
+++ b/pkgs/by-name/no/node-hp-scan-to/package.nix
@ -4,7 +4,7 @@
 , fetchYarnDeps
 , makeWrapper
 , nodejs
-, prefetch-yarn-deps
+, fixup-yarn-lock
 , yarn
 }:

@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
  nativeBuildInputs = [
    makeWrapper
    nodejs
-    prefetch-yarn-deps
+    fixup-yarn-lock
    yarn
  ];

--- a/pkgs/by-name/no/nomnatong/package.nix
+++ b/pkgs/by-name/no/nomnatong/package.nix
@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "nomnatong";
-  version = "5.09";
+  version = "5.10";

  src = fetchFromGitHub {
    owner = "nomfoundation";
    repo = "font";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-WkDvneCWuAS0/D+WUhd1F6dqpIuSAMK598mSRbNf6/8=";
+    hash = "sha256-e7LT6lwm4jbqL+mtvfZsCC7F6KOVYD/lAGRPAgyyMxc=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/no/noto-fonts-monochrome-emoji/noto-emoji.hashes.json
+++ b/pkgs/by-name/no/noto-fonts-monochrome-emoji/noto-emoji.hashes.json
@ -1,7 +0,0 @@
-{
-  "http://fonts.gstatic.com/s/notoemoji/v47/bMrnmSyK7YY-MEu6aWjPDs-ar6uWaGWuob_10jwvS-FGJCMY.ttf": "sha256-B8XBpYycOYBjrhjlnyiz42YukIoOjGTd3NN3EY00NiQ=",
-  "http://fonts.gstatic.com/s/notoemoji/v47/bMrnmSyK7YY-MEu6aWjPDs-ar6uWaGWuob-r0jwvS-FGJCMY.ttf": "sha256-Zfwh9q2GrL5Dwp+J/8Ddd2IXCaUXpQ7dE3CqgCMMyPs=",
-  "http://fonts.gstatic.com/s/notoemoji/v47/bMrnmSyK7YY-MEu6aWjPDs-ar6uWaGWuob-Z0jwvS-FGJCMY.ttf": "sha256-/O5b2DzM8g97NAdJgIC/RsQ7E5P7USKq7TXyDuUE3WQ=",
-  "http://fonts.gstatic.com/s/notoemoji/v47/bMrnmSyK7YY-MEu6aWjPDs-ar6uWaGWuob911TwvS-FGJCMY.ttf": "sha256-vrjB8GlhzWAe6jG/Srpy8R431VivNtWbCa5Uh4ATnmU=",
-  "http://fonts.gstatic.com/s/notoemoji/v47/bMrnmSyK7YY-MEu6aWjPDs-ar6uWaGWuob9M1TwvS-FGJCMY.ttf": "sha256-EbnZt8h4Lcl0yJoOKmXlF1nfcP5hZv7n4cEQ10yBkcg="
-}
--- a/pkgs/by-name/no/noto-fonts-monochrome-emoji/noto-emoji.json
+++ b/pkgs/by-name/no/noto-fonts-monochrome-emoji/noto-emoji.json
@ -1,30 +0,0 @@
-{
-  "kind": "webfonts#webfontList",
-  "items": [
-    {
-      "family": "Noto Emoji",
-      "variants": [
-        "300",
-        "regular",
-        "500",
-        "600",
-        "700"
-      ],
-      "subsets": [
-        "emoji"
-      ],
-      "version": "v47",
-      "lastModified": "2023-09-27",
-      "files": {
-        "300": "http://fonts.gstatic.com/s/notoemoji/v47/bMrnmSyK7YY-MEu6aWjPDs-ar6uWaGWuob_10jwvS-FGJCMY.ttf",
-        "regular": "http://fonts.gstatic.com/s/notoemoji/v47/bMrnmSyK7YY-MEu6aWjPDs-ar6uWaGWuob-r0jwvS-FGJCMY.ttf",
-        "500": "http://fonts.gstatic.com/s/notoemoji/v47/bMrnmSyK7YY-MEu6aWjPDs-ar6uWaGWuob-Z0jwvS-FGJCMY.ttf",
-        "600": "http://fonts.gstatic.com/s/notoemoji/v47/bMrnmSyK7YY-MEu6aWjPDs-ar6uWaGWuob911TwvS-FGJCMY.ttf",
-        "700": "http://fonts.gstatic.com/s/notoemoji/v47/bMrnmSyK7YY-MEu6aWjPDs-ar6uWaGWuob9M1TwvS-FGJCMY.ttf"
-      },
-      "category": "sans-serif",
-      "kind": "webfonts#webfont",
-      "menu": "http://fonts.gstatic.com/s/notoemoji/v47/bMrnmSyK7YY-MEu6aWjPDs-ar6uWaGWuob-r0gwuQeU.ttf"
-    }
-  ]
-}
--- a/pkgs/by-name/no/noto-fonts-monochrome-emoji/noto-emoji.py
+++ b/pkgs/by-name/no/noto-fonts-monochrome-emoji/noto-emoji.py
@ -1,183 +0,0 @@
-#!/usr/bin/env nix-shell
-#! nix-shell -i "python3 -I" -p python3
-
-from contextlib import contextmanager
-from pathlib import Path
-from typing import Iterable, Optional
-from urllib import request
-
-import hashlib, json
-
-
-def getMetadata(apiKey: str, family: str = "Noto Emoji"):
-    '''Fetch the Google Fonts metadata for a given family.
-
-    An API key can be obtained by anyone with a Google account (🚮) from
-      `https://developers.google.com/fonts/docs/developer_api#APIKey`
-    '''
-    from urllib.parse import urlencode
-
-    with request.urlopen(
-            "https://www.googleapis.com/webfonts/v1/webfonts?" +
-            urlencode({ 'key': apiKey, 'family': family })
-    ) as req:
-        return json.load(req)
-
-def getUrls(metadata) -> Iterable[str]:
-    '''Fetch all files' URLs from Google Fonts' metadata.
-
-    The metadata must obey the API v1 schema, and can be obtained from:
-      https://www.googleapis.com/webfonts/v1/webfonts?key=${GOOGLE_FONTS_TOKEN}&family=${FAMILY}
-    '''
-    return ( url for i in metadata['items'] for _, url in i['files'].items() )
-
-
-def hashUrl(url: str, *, hash: str = 'sha256'):
-    '''Compute the hash of the data from HTTP GETing a given `url`.
-
-    The `hash` must be an algorithm name `hashlib.new` accepts.
-    '''
-    with request.urlopen(url) as req:
-        return hashlib.new(hash, req.read())
-
-
-def sriEncode(h) -> str:
-    '''Encode a hash in the SRI format.
-
-    Takes a `hashlib` object, and produces a string that
-    nixpkgs' `fetchurl` accepts as `hash` parameter.
-    '''
-    from base64 import b64encode
-    return f"{h.name}-{b64encode(h.digest()).decode()}"
-
-def validateSRI(sri: Optional[str]) -> Optional[str]:
-    '''Decode an SRI hash, return `None` if invalid.
-
-    This is not a full SRI hash parser, hash options aren't supported.
-    '''
-    from base64 import b64decode
-
-    if sri is None:
-        return None
-
-    try:
-        hashName, b64 = sri.split('-', 1)
-
-        h = hashlib.new(hashName)
-        digest = b64decode(b64, validate=True)
-        assert len(digest) == h.digest_size
-
-    except:
-        return None
-    else:
-        return sri
-
-
-def hashUrls(
-    urls: Iterable[str],
-    knownHashes: dict[str, str] = {},
-) -> dict[str, str]:
-    '''Generate a `dict` mapping URLs to SRI-encoded hashes.
-
-    The `knownHashes` optional parameter can be used to avoid
-    re-downloading files whose URL have not changed.
-    '''
-    return {
-        url: validateSRI(knownHashes.get(url)) or sriEncode(hashUrl(url))
-        for url in urls
-    }
-
-
-@contextmanager
-def atomicFileUpdate(target: Path):
-    '''Atomically replace the contents of a file.
-
-    Yields an open file to write into; upon exiting the context,
-    the file is closed and (atomically) replaces the `target`.
-
-    Guarantees that the `target` was either successfully overwritten
-    with new content and no exception was raised, or the temporary
-    file was cleaned up.
-    '''
-    from tempfile import mkstemp
-    fd, _p = mkstemp(
-        dir = target.parent,
-        prefix = target.name,
-    )
-    tmpPath = Path(_p)
-
-    try:
-        with open(fd, 'w') as f:
-            yield f
-
-        tmpPath.replace(target)
-
-    except Exception:
-        tmpPath.unlink(missing_ok = True)
-        raise
-
-
-if __name__ == "__main__":
-    from os import environ
-    from urllib.error import HTTPError
-
-    environVar = 'GOOGLE_FONTS_TOKEN'
-    currentDir = Path(__file__).parent
-    metadataPath = currentDir / 'noto-emoji.json'
-
-    try:
-        apiToken = environ[environVar]
-        metadata = getMetadata(apiToken)
-
-    except (KeyError, HTTPError) as exn:
-        # No API key in the environment, or the query was rejected.
-        match exn:
-            case KeyError if exn.args[0] == environVar:
-                print(f"No '{environVar}' in the environment, "
-                       "skipping metadata update")
-
-            case HTTPError if exn.getcode() == 403:
-                print("Got HTTP 403 (Forbidden)")
-                if apiToken != '':
-                    print("Your Google API key appears to be valid "
-                          "but does not grant access to the fonts API.")
-                    print("Aborting!")
-                    raise SystemExit(1)
-
-            case HTTPError if exn.getcode() == 400:
-                # Printing the supposed token should be fine, as this is
-                #  what the API returns on invalid tokens.
-                print(f"Got HTTP 400 (Bad Request), is this really an API token: '{apiToken}' ?")
-            case _:
-                # Unknown error, let's bubble it up
-                raise
-
-        # In that case just use the existing metadata
-        with metadataPath.open() as metadataFile:
-            metadata = json.load(metadataFile)
-
-        lastModified = metadata["items"][0]["lastModified"];
-        print(f"Using metadata from file, last modified {lastModified}")
-
-    else:
-        # If metadata was successfully fetched, validate and persist it
-        lastModified = metadata["items"][0]["lastModified"];
-        print(f"Fetched current metadata, last modified {lastModified}")
-        with atomicFileUpdate(metadataPath) as metadataFile:
-            json.dump(metadata, metadataFile, indent = 2)
-            metadataFile.write("\n")  # Pacify nixpkgs' dumb editor config check
-
-    hashPath = currentDir / 'noto-emoji.hashes.json'
-    try:
-        with hashPath.open() as hashFile:
-            hashes = json.load(hashFile)
-    except FileNotFoundError:
-        hashes = {}
-
-    with atomicFileUpdate(hashPath) as hashFile:
-        json.dump(
-            hashUrls(getUrls(metadata), knownHashes = hashes),
-            hashFile,
-            indent = 2,
-        )
-        hashFile.write("\n")  # Pacify nixpkgs' dumb editor config check
--- a/pkgs/by-name/no/noto-fonts-monochrome-emoji/package.nix
+++ b/pkgs/by-name/no/noto-fonts-monochrome-emoji/package.nix
@ -1,46 +1,32 @@
 { lib
 , stdenvNoCC
-, fetchurl
+, fetchFromGitHub
+, rename
 }:

-# Metadata fetched from
-#  https://www.googleapis.com/webfonts/v1/webfonts?key=${GOOGLE_FONTS_TOKEN}&family=Noto+Emoji
-let
-  metadata = with builtins; head (fromJSON (readFile ./noto-emoji.json)).items;
-  urlHashes = with builtins; fromJSON (readFile ./noto-emoji.hashes.json);
-in
 stdenvNoCC.mkDerivation {
  pname = "noto-fonts-monochrome-emoji";
-  version = "${lib.removePrefix "v" metadata.version}.${metadata.lastModified}";
-  preferLocalBuild = true;
+  version = "3.000";

-  dontUnpack = true;
-  srcs =
-    let
-      weightNames = {
-        "300" = "Light";
-        regular = "Regular";
-        "500" = "Medium";
-        "600" = "SemiBold";
-        "700" = "Bold";
-      };
-    in
-    lib.mapAttrsToList
-      (variant: url: fetchurl {
-        name = "NotoEmoji-${weightNames.${variant}}.ttf";
-        hash = urlHashes.${url};
-        inherit url;
-      })
-      metadata.files;
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = "fonts";
+    rev = "a73b9ab0a5df191bcfed817159a903911ea7958a";
+    hash = "sha256-qVFU4uZius8oFPJCIL9ek2YdS3jru5mmTHp2L9RIXfg=";
+    sparseCheckout = [ "ofl/notoemoji" ];
+  };

  installPhase = ''
    runHook preInstall
-    for src in $srcs; do
-      install -D $src $out/share/fonts/noto/$(stripHash $src)
-    done
+
+    install -m444 -Dt $out/share/fonts/noto ofl/notoemoji/*.ttf
+    ${rename}/bin/rename 's/\[.*\]//' $out/share/fonts/noto/*
+
    runHook postInstall
  '';

+  passthru.updateScript = ./update.sh;
+
  meta = {
    description = "Monochrome emoji font";
    homepage = "https://fonts.google.com/noto/specimen/Noto+Emoji";
--- a/pkgs/by-name/no/noto-fonts-monochrome-emoji/update.sh
+++ b/pkgs/by-name/no/noto-fonts-monochrome-emoji/update.sh
@ -0,0 +1,25 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p common-updater-scripts git nix-prefetch
+
+tmpdir=$(mktemp -d)
+
+git -C "$tmpdir" init --initial-branch main
+git -C "$tmpdir" config core.sparseCheckout true
+git -C "$tmpdir" remote add origin https://github.com/google/fonts.git
+echo "ofl/notoemoji/*" > "$tmpdir/.git/info/sparse-checkout"
+git -C "$tmpdir" fetch origin main
+git -C "$tmpdir" checkout main
+
+newrev=$(git -C "$tmpdir" rev-list -1 HEAD "ofl/notoemoji/*.ttf")
+newver=$(grep 'archive:' "$tmpdir/ofl/notoemoji/upstream.yaml" | grep -oP '(?<=v)[0-9]+\.[0-9]+')
+newhash=$(nix-prefetch "{ stdenv, fetchurl }: stdenv.mkDerivation rec {
+  name = \"noto-fonts-cjk-serif\";
+  src = fetchFromGitHub {
+    owner = \"google\";
+    repo = \"fonts\";
+    rev = \"$newrev\";
+    sparseCheckout = [ \"ofl/notoemoji\" ];
+  };
+}")
+
+update-source-version noto-fonts-monochrome-emoji "$newver" "$newhash" --rev="$newrev"
--- a/pkgs/by-name/pr/prometheus-dnssec-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-dnssec-exporter/package.nix
@ -0,0 +1,22 @@
+{ lib, buildGoModule, fetchFromGitHub, }:
+buildGoModule {
+  pname = "prometheus-dnssec-exporter";
+  version = "0-unstable-2023-03-05";
+
+  src = fetchFromGitHub {
+    owner = "chrj";
+    repo = "prometheus-dnssec-exporter";
+    rev = "b638685ed8d5919a88b45e85b3aec702f0fcc393";
+    hash = "sha256-SGoQKSgTRfSyA65xEZ9P7Z956sLMhB88h3HaXmFywiQ=";
+  };
+
+  vendorHash = "sha256-u7X8v7h1aL8B1el4jFzGRKHvnaK+Rz0OCitaC6xgyjw=";
+
+  meta = with lib; {
+    homepage = "https://github.com/chrj/prometheus-dnssec-exporter";
+    description = "DNSSEC Exporter for Prometheus";
+    license = licenses.mit;
+    maintainers = with maintainers; [ swendel ];
+  };
+}
+
--- a/pkgs/by-name/px/pxder/package.nix
+++ b/pkgs/by-name/px/pxder/package.nix
@ -3,7 +3,7 @@
 , fetchFromGitHub
 , fetchYarnDeps
 , makeWrapper
-, prefetch-yarn-deps
+, fixup-yarn-lock
 , yarn
 , nodejs
 }:
@ -26,7 +26,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs  = [
    makeWrapper
-    prefetch-yarn-deps
+    fixup-yarn-lock
    yarn
  ];

--- a/pkgs/by-name/se/sendme/Cargo.lock
+++ b/pkgs/by-name/se/sendme/Cargo.lock
--- a/pkgs/by-name/se/sendme/package.nix
+++ b/pkgs/by-name/se/sendme/package.nix
@ -7,21 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "sendme";
-  version = "0.3.0";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "n0-computer";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-UaAiHGeSqy4kHO9CZX3kYeECZDo45web6yMbBRVnlhQ=";
+    hash = "sha256-y34x4XLIWsxS5+R+6rAejz0z6TCTxoQYPosXmpt9234=";
  };

-  # TODO: Remove lock file and use 'cargoHash' instead once `watchable` crate
-  # is upgraded past v1.1.1.
-  # See https://github.com/khonsulabs/watchable/issues/1
-  cargoLock = {
-    lockFile = ./Cargo.lock;
-  };
+  cargoHash = "sha256-q4U4w4STs+34gJNyIibitf6RMvH6P/kBDZlOcwFrOxw=";

  buildInputs = lib.optionals stdenv.isDarwin (
    with darwin.apple_sdk.frameworks; [
--- a/pkgs/by-name/sh/shepherd/package.nix
+++ b/pkgs/by-name/sh/shepherd/package.nix
@ -4,7 +4,7 @@
 , fetchYarnDeps
 , makeWrapper
 , nodejs
-, prefetch-yarn-deps
+, fixup-yarn-lock
 , yarn
 }:

@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs  = [
    makeWrapper
    nodejs
-    prefetch-yarn-deps
+    fixup-yarn-lock
    yarn
  ];

--- a/pkgs/by-name/ve/vercel-pkg/package.nix
+++ b/pkgs/by-name/ve/vercel-pkg/package.nix
@ -4,7 +4,7 @@
 , fetchYarnDeps
 , makeWrapper
 , nodejs
-, prefetch-yarn-deps
+, fixup-yarn-lock
 , yarn
 }:

@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs  = [
    makeWrapper
    nodejs
-    prefetch-yarn-deps
+    fixup-yarn-lock
    yarn
  ];

--- a/pkgs/development/mobile/androidenv/compose-android-packages.nix
+++ b/pkgs/development/mobile/androidenv/compose-android-packages.nix
@ -2,12 +2,12 @@
 , licenseAccepted ? false
 }:

-{ cmdLineToolsVersion ? "11.0"
+{ cmdLineToolsVersion ? "13.0"
 , toolsVersion ? "26.1.1"
-, platformToolsVersion ? "34.0.5"
+, platformToolsVersion ? "35.0.1"
 , buildToolsVersions ? [ "34.0.0" ]
 , includeEmulator ? false
-, emulatorVersion ? "34.1.9"
+, emulatorVersion ? "35.1.4"
 , platformVersions ? []
 , includeSources ? false
 , includeSystemImages ? false
@ -15,7 +15,7 @@
 , abiVersions ? [ "armeabi-v7a" "arm64-v8a" ]
 , cmakeVersions ? [ ]
 , includeNDK ? false
-, ndkVersion ? "26.1.10909125"
+, ndkVersion ? "26.3.11579264"
 , ndkVersions ? [ndkVersion]
 , useGoogleAPIs ? false
 , useGoogleTVAddOns ? false
--- a/pkgs/development/mobile/androidenv/emulator.nix
+++ b/pkgs/development/mobile/androidenv/emulator.nix
@ -9,9 +9,12 @@ deployAndroidPackage {
      libcxx
      libGL
      libpulseaudio
+      libtiff
      libuuid
      zlib
+      libbsd
      ncurses5
+      libdrm
      stdenv.cc.cc
      pkgsi686Linux.glibc
      expat
@ -30,6 +33,9 @@ deployAndroidPackage {
      libXi
      libXrender
      libXtst
+      libICE
+      libSM
+      libxkbfile
    ]);
  patchInstructions = lib.optionalString (os == "linux") ''
    addAutoPatchelfSearchPath $packageBaseDir/lib
@ -37,6 +43,12 @@ deployAndroidPackage {
    addAutoPatchelfSearchPath $packageBaseDir/lib64/qt/lib
    # autoPatchelf is not detecting libuuid :(
    addAutoPatchelfSearchPath ${pkgs.libuuid.out}/lib
+
+    # This library is linked against a version of libtiff that nixpkgs doesn't have
+    for file in $out/libexec/android-sdk/emulator/*/qt/plugins/imageformats/libqtiffAndroidEmu.so; do
+      patchelf --replace-needed libtiff.so.5 libtiff.so "$file" || true
+    done
+
    autoPatchelf $out

    # Wrap emulator so that it can load required libraries at runtime
--- a/pkgs/development/mobile/androidenv/examples/shell.nix
+++ b/pkgs/development/mobile/androidenv/examples/shell.nix
@ -25,14 +25,14 @@ let
  # versions may be used in multiple places in this Nix expression.
  android = {
    versions = {
-      cmdLineToolsVersion = "11.0";
-      platformTools = "34.0.5";
+      cmdLineToolsVersion = "13.0";
+      platformTools = "35.0.1";
      buildTools = "34.0.0";
      ndk = [
-        "26.1.10909125"
+        "26.3.11579264"
      ];
      cmake = "3.6.4111459";
-      emulator = "34.1.9";
+      emulator = "35.1.4";
    };

    platforms = [ "23" "24" "25" "26" "27" "28" "29" "30" "31" "32" "33" "34" ];
--- a/pkgs/development/mobile/androidenv/ndk-bundle/default.nix
+++ b/pkgs/development/mobile/androidenv/ndk-bundle/default.nix
@ -11,8 +11,8 @@ deployAndroidPackage rec {
  inherit package os;
  nativeBuildInputs = [ makeWrapper ]
    ++ lib.optionals stdenv.isLinux [ autoPatchelfHook ];
-  autoPatchelfIgnoreMissingDeps = true;
-  buildInputs = lib.optionals (os == "linux") [ pkgs.zlib ];
+  autoPatchelfIgnoreMissingDeps = [ "*" ];
+  buildInputs = lib.optionals (os == "linux") [ pkgs.zlib pkgs.libcxx stdenv.cc.cc.lib ];

  patchElfBnaries = ''
    # Patch the executables of the toolchains, but not the libraries -- they are needed for crosscompiling
--- a/pkgs/development/mobile/androidenv/repo.json
+++ b/pkgs/development/mobile/androidenv/repo.json
--- a/pkgs/development/python-modules/aioopenexchangerates/default.nix
+++ b/pkgs/development/python-modules/aioopenexchangerates/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "aioopenexchangerates";
-  version = "0.4.10";
+  version = "0.4.11";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "MartinHjelmare";
    repo = "aioopenexchangerates";
    rev = "refs/tags/v${version}";
-    hash = "sha256-keZebaqIs+xaGy5O1551w05fV301XHzJpPDwvY4Tjnk=";
+    hash = "sha256-8AScYCDgv8Dkjt/0WJ4P2q2H9dykuq3w00qDDP8PiSs=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/aiortm/default.nix
+++ b/pkgs/development/python-modules/aiortm/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "aiortm";
-  version = "0.8.11";
+  version = "0.8.12";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "MartinHjelmare";
    repo = "aiortm";
    rev = "refs/tags/v${version}";
-    hash = "sha256-VvpdeupBW8wZyNnAx9cvp0Li5z3D/AnqipTEGTsd2IE=";
+    hash = "sha256-X7MqBDmVfLy5ajqhFcvA8oCaoxy3zLusXkB659qWR5E=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/automx2/default.nix
+++ b/pkgs/development/python-modules/automx2/default.nix
@ -6,22 +6,27 @@
 , ldap3
 , pytestCheckHook
 , pythonOlder
+, setuptools
 }:

 buildPythonPackage rec {
  pname = "automx2";
-  version = "unstable-2023-08-23";
-  format = "setuptools";
+  version = "2024.1";
+  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "rseichter";
-    repo = pname;
-    rev = "f3e3fc8e769c3799361001d51b7d9335a6a9d1a8";
-    hash = "sha256-NkeazjjGDYUXfoydvEfww6e7SkSZ8rMRlML+oOaf374=";
+    repo = "automx2";
+    rev = version;
+    hash = "sha256-s/kd9A/d3SPMZC9+B4DdcXVi77WLH/SBwXIdaKHUj34=";
  };

+  nativeBuildInputs = [
+    setuptools
+  ];
+
  propagatedBuildInputs = [
    flask
    flask-migrate
--- a/pkgs/development/python-modules/base64io/default.nix
+++ b/pkgs/development/python-modules/base64io/default.nix
@ -1,25 +1,38 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , mock
 , pytestCheckHook
+, pythonOlder
+, setuptools
+, unstableGitUpdater
 }:

 buildPythonPackage rec {
  pname = "base64io";
-  version = "1.0.3";
-  format = "setuptools";
+  version = "1.0.3-unstable-2023-10-30";
+  pyproject = true;

-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-JPLQ/nZcNTOeGy0zqpX5E3sbdltZQWT60QFsFYJ6cHM=";
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "aws";
+    repo = "base64io-python";
+    rev = "604817576e607d1f7f8af1ffa1530522fd4e4be2";
+    hash = "sha256-RFl0iuyHdPf3VpBxH4m/N2yaKEBxkNMT1ldZP9VGGOk=";
  };

+  build-system = [
+    setuptools
+  ];
+
  nativeCheckInputs = [
    mock
    pytestCheckHook
  ];

+  passthru.updateScript = unstableGitUpdater { };
+
  meta = with lib; {
    homepage = "https://base64io-python.readthedocs.io/";
    changelog = "https://github.com/aws/base64io-python/blob/${version}/CHANGELOG.rst";
--- a/pkgs/development/python-modules/dash/default.nix
+++ b/pkgs/development/python-modules/dash/default.nix
@ -6,7 +6,7 @@
 , setuptools
 , nodejs
 , yarn
-, prefetch-yarn-deps
+, fixup-yarn-lock
 , fetchYarnDeps

 , flask
@ -52,7 +52,7 @@ buildPythonPackage rec {
    setuptools
    nodejs
    yarn
-    prefetch-yarn-deps
+    fixup-yarn-lock
  ];

  yarnOfflineCache = fetchYarnDeps {
--- a/pkgs/development/python-modules/jenkinsapi/default.nix
+++ b/pkgs/development/python-modules/jenkinsapi/default.nix
@ -8,6 +8,7 @@
 , pytestCheckHook
 , pytz
 , requests
+, setuptools
 , six
 }:

@ -21,6 +22,10 @@ buildPythonPackage rec {
    hash = "sha256-JGqYpj5h9UoV0WEFyxVIjFZwc030HobHrw1dnAryQLk=";
  };

+  patches = [
+    ./pytest-warn-none.patch
+  ];
+
  nativeBuildInputs = [
    flit-core
    pbr
@ -29,6 +34,7 @@ buildPythonPackage rec {
  propagatedBuildInputs = [
    pytz
    requests
+    setuptools
    six
  ];

@ -41,7 +47,11 @@ buildPythonPackage rec {
  # don't run tests that try to spin up jenkins
  disabledTests = [ "systests" ];

-  pythonImportsCheck = [ "jenkinsapi" ];
+  pythonImportsCheck = [
+    "jenkinsapi"
+    "jenkinsapi.utils"
+    "jenkinsapi.utils.jenkins_launcher"
+  ];

  meta = with lib; {
    description = "A Python API for accessing resources on a Jenkins continuous-integration server";
--- a/pkgs/development/python-modules/jenkinsapi/pytest-warn-none.patch
+++ b/pkgs/development/python-modules/jenkinsapi/pytest-warn-none.patch
@ -0,0 +1,30 @@
+diff --git a/jenkinsapi_tests/unittests/test_build.py b/jenkinsapi_tests/unittests/test_build.py
+index 2e2c2f4..9de816a 100644
+--- a/jenkinsapi_tests/unittests/test_build.py
+++ b/jenkinsapi_tests/unittests/test_build.py
+@@ -3,6 +3,7 @@ import pytest
+ import pytz
+ from . import configs
+ import datetime
+import warnings
+ from jenkinsapi.build import Build
+ from jenkinsapi.job import Job
+ 
+@@ -252,7 +253,7 @@ def test_build_env_vars_wo_injected_env_vars_plugin(monkeypatch, build):
+     monkeypatch.setattr(Build, "get_data", fake_get_data)
+ 
+     with pytest.raises(requests.HTTPError) as excinfo:
+-        with pytest.warns(None) as record:
+        with warnings.catch_warnings(record=True) as record:
+             build.get_env_vars()
+     assert "404" == str(excinfo.value)
+     assert len(record) == 1
+@@ -269,7 +270,7 @@ def test_build_env_vars_other_exception(monkeypatch, build):
+     monkeypatch.setattr(Build, "get_data", fake_get_data)
+ 
+     with pytest.raises(Exception) as excinfo:
+-        with pytest.warns(None) as record:
+        with warnings.catch_warnings(record=True) as record:
+             build.get_env_vars()
+     assert "" == str(excinfo.value)
+     assert len(record) == 0
--- a/pkgs/development/python-modules/jsonslicer/default.nix
+++ b/pkgs/development/python-modules/jsonslicer/default.nix
@ -0,0 +1,32 @@
+{
+  stdenv,
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pkg-config,
+  yajl,
+}:
+
+buildPythonPackage rec {
+  pname = "jsonslicer";
+  version = "0.1.7";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "AMDmi3";
+    repo = "jsonslicer";
+    rev = version;
+    hash = "sha256-uKIe/nJLCTe8WFIMB7+g3c0Yv3addgZEKYaBI6EpBSY=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ yajl ];
+
+  meta = with lib; {
+    description = "Stream JSON parser for Python ";
+    homepage = "https://github.com/AMDmi3/jsonslicer";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jopejoe1 ];
+  };
+}
--- a/pkgs/development/python-modules/litellm/default.nix
+++ b/pkgs/development/python-modules/litellm/default.nix
@ -33,7 +33,7 @@

 buildPythonPackage rec {
  pname = "litellm";
-  version = "1.35.4";
+  version = "1.35.8";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -42,7 +42,7 @@ buildPythonPackage rec {
    owner = "BerriAI";
    repo = "litellm";
    rev = "refs/tags/v${version}";
-    hash = "sha256-5z2qyzDMfksxlj2KxAGw5TYn3aXbeUHZvwHiNjeWmLA=";
+    hash = "sha256-/gj3WTsxFxw2VPqYCQdnSi83RjjPHZ/I1nR163u3pb0=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/ocrmypdf/default.nix
+++ b/pkgs/development/python-modules/ocrmypdf/default.nix
@ -30,7 +30,7 @@

 buildPythonPackage rec {
  pname = "ocrmypdf";
-  version = "16.1.1";
+  version = "16.1.2";

  disabled = pythonOlder "3.10";

@ -46,7 +46,7 @@ buildPythonPackage rec {
    postFetch = ''
      rm "$out/.git_archival.txt"
    '';
-    hash = "sha256-XCYNz1QQodUEidz1+A79yleqOnOCK3zJ8mBIPU5JEQg=";
+    hash = "sha256-nZvfkfO5u3iuN0g/KITWbhYCRAJngEOKCW48z6IEPMI=";
  };

  patches = [
--- a/pkgs/development/tools/electron-fiddle/default.nix
+++ b/pkgs/development/tools/electron-fiddle/default.nix
@ -3,7 +3,7 @@
 , fetchFromGitHub
 , fetchYarnDeps
 , fetchurl
-, prefetch-yarn-deps
+, fixup-yarn-lock
 , git
 , lib
 , makeDesktopItem
@ -51,7 +51,7 @@ let
    pname = "${pname}-unwrapped";
    inherit version src;

-    nativeBuildInputs = [ prefetch-yarn-deps git nodejs util-linux yarn zip ];
+    nativeBuildInputs = [ fixup-yarn-lock git nodejs util-linux yarn zip ];

    configurePhase = ''
      export HOME=$TMPDIR
--- a/pkgs/development/tools/electron/common.nix
+++ b/pkgs/development/tools/electron/common.nix
@ -5,7 +5,7 @@
 , python3
 , fetchYarnDeps
 , fetchNpmDeps
-, prefetch-yarn-deps
+, fixup-yarn-lock
 , npmHooks
 , yarn
 , substituteAll
@ -29,7 +29,7 @@ in (chromium.override { upstream-info = info.chromium; }).mkDerivation (base: {
  inherit (info) version;
  buildTargets = [ "electron:electron_dist_zip" ];

-  nativeBuildInputs = base.nativeBuildInputs ++ [ nodejs yarn prefetch-yarn-deps unzip npmHooks.npmConfigHook ];
+  nativeBuildInputs = base.nativeBuildInputs ++ [ nodejs yarn fixup-yarn-lock unzip npmHooks.npmConfigHook ];
  buildInputs = base.buildInputs ++ [ libnotify ];

  electronOfflineCache = fetchYarnDeps {
--- a/pkgs/development/tools/fermyon-spin/default.nix
+++ b/pkgs/development/tools/fermyon-spin/default.nix
@ -1,6 +1,6 @@
 { lib
 , stdenv
-, fetchzip
+, fetchurl
 , autoPatchelfHook
 , gcc-unwrapped
 , zlib
@ -17,22 +17,26 @@ let
  }.${system} or (throw "Unsupported system: ${system}");

  packageHash = {
-    x86_64-linux = "sha256-Y0Inew0PncpnEpdLWtl/85t93eGSRewKh5mvGnn+yck=";
-    aarch64-linux = "sha256-HEm3TaLeaws8G73CU9BmxeplQdeF9nQbBSnbctaVhqI=";
-    x86_64-darwin = "sha256-mlshpN/4Od4qrXiqIEYo7G84Dtb+tp2nK2VnrRG2rto=";
-    aarch64-darwin = "sha256-aJH/vOidj0vbkttGDgelaAC/dMYguQPLjxl+V3pOVzI=";
+    x86_64-linux = "sha256-LHiLkZ+VN+wPnq6OukXozQWKh7ewNaFor1ndCUlCBtU=";
+    aarch64-linux = "sha256-1+rLGnm+LhbYigYUcmuLICLFXUk3wjOkmxuCuuI+Xqc=";
+    x86_64-darwin = "sha256-mJA3VXfNr6578Q2xw0xOZccloQpeCIsjn3dVdlsnTVs=";
+    aarch64-darwin = "sha256-FNl3UefJWA8yJ2B44GUEK6py7DLikJrygIwsqdIjW9c=";
  }.${system} or (throw "Unsupported system: ${system}");

 in stdenv.mkDerivation rec {
  pname = "fermyon-spin";
-  version = "2.2.0";
+  version = "2.4.2";

-  src = fetchzip {
+  # Use fetchurl rather than fetchzip as these tarballs are built by the project
+  # and not by GitHub (and thus are stable) - this simplifies the update script
+  # by allowing it to use the output of `nix store prefetch-file`.
+  src = fetchurl {
    url = "https://github.com/fermyon/spin/releases/download/v${version}/spin-v${version}-${platform}.tar.gz";
-    stripRoot = false;
    hash = packageHash;
  };

+  sourceRoot = ".";
+
  nativeBuildInputs = lib.optionals stdenv.isLinux [
    autoPatchelfHook
  ];
@ -46,7 +50,7 @@ in stdenv.mkDerivation rec {
    runHook preInstall

    mkdir -p $out/bin
-    cp $src/* $out/bin
+    cp ./spin $out/bin

    runHook postInstall
  '';
--- a/pkgs/development/tools/fermyon-spin/update.sh
+++ b/pkgs/development/tools/fermyon-spin/update.sh
@ -0,0 +1,31 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p jq
+#shellcheck shell=bash
+
+CURRENT_HASH=""
+
+print_hash() {
+    OS="$1"
+    ARCH="$2"
+    VERSION="$3"
+
+    URL="https://github.com/fermyon/spin/releases/download/v${VERSION}/spin-v${VERSION}-${OS}-${ARCH}.tar.gz"
+    echo
+    CURRENT_HASH=$(nix store prefetch-file "$URL" --json | jq -r '.hash')
+
+    echo "${ARCH}-${OS}: $CURRENT_HASH"
+}
+
+if [[ -z "$VER" && -n "$1" ]]; then
+    VER="$1"
+fi
+
+if [[ -z "$VER" ]]; then
+    echo "No 'VER' environment variable provided, skipping"
+else
+    print_hash "linux"  "amd64"   "$VER"
+    print_hash "linux"  "aarch64" "$VER"
+    print_hash "macos" "amd64"   "$VER"
+    print_hash "macos" "aarch64" "$VER"
+fi
+
--- a/pkgs/development/tools/ruff/default.nix
+++ b/pkgs/development/tools/ruff/default.nix
@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "ruff";
-  version = "0.3.5";
+  version = "0.3.7";

  src = fetchFromGitHub {
    owner = "astral-sh";
    repo = "ruff";
    rev = "refs/tags/v${version}";
-    hash = "sha256-sGmNrkZv03yzEm9fM00H/BZnVr915LW3qGWjci1QACc=";
+    hash = "sha256-PS4YJpVut+KtEgSlTVtoVdlu6FVipPIzsl01/Io5N64=";
  };

-  cargoHash = "sha256-6ZqbyM8MXN916HPG86PZAtAPFkXGvMD27Y5ql6o/tUQ=";
+  cargoHash = "sha256-kxzI/MlhboF0cWnyciK4vewWGXijPsOV0tPzfo1DHWc=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/games/anki/default.nix
+++ b/pkgs/games/anki/default.nix
@ -12,7 +12,7 @@
 , nixosTests
 , nodejs
 , nodejs-slim
-, prefetch-yarn-deps
+, fixup-yarn-lock
 , protobuf
 , python3
 , qt6
@ -103,7 +103,7 @@ let

    nativeBuildInputs = [
      nodejs-slim
-      prefetch-yarn-deps
+      fixup-yarn-lock
      yarn
    ];

@ -138,7 +138,7 @@ python3.pkgs.buildPythonApplication {
  nativeBuildInputs = [
    fakeGit
    offlineYarn
-    prefetch-yarn-deps
+    fixup-yarn-lock

    cargo
    installShellFiles
--- a/pkgs/games/heroic/default.nix
+++ b/pkgs/games/heroic/default.nix
@ -3,7 +3,7 @@
 , fetchFromGitHub
 , fetchYarnDeps
 , yarn
-, prefetch-yarn-deps
+, fixup-yarn-lock
 , nodejs
 , python3
 , makeWrapper
@ -33,7 +33,7 @@ in stdenv.mkDerivation rec {

  nativeBuildInputs = [
    yarn
-    prefetch-yarn-deps
+    fixup-yarn-lock
    nodejs
    python3
    makeWrapper
--- a/pkgs/games/r2modman/default.nix
+++ b/pkgs/games/r2modman/default.nix
@ -2,7 +2,7 @@
 , stdenv
 , yarn
 , fetchYarnDeps
-, prefetch-yarn-deps
+, fixup-yarn-lock
 , nodejs
 , electron
 , fetchFromGitHub
@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {

  nativeBuildInputs = [
    yarn
-    prefetch-yarn-deps
+    fixup-yarn-lock
    nodejs
    makeWrapper
    copyDesktopItems
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@ -33,12 +33,12 @@ rec {
  stable = if stdenv.hostPlatform.system == "i686-linux" then legacy_390 else latest;

  production = generic {
-    version = "550.67";
-    sha256_64bit = "sha256-mSAaCccc/w/QJh6w8Mva0oLrqB+cOSO1YMz1Se/32uI=";
-    sha256_aarch64 = "sha256-+UuK0UniAsndN15VDb/xopjkdlc6ZGk5LIm/GNs5ivA=";
-    openSha256 = "sha256-M/1qAQxTm61bznAtCoNQXICfThh3hLqfd0s1n1BFj2A=";
-    settingsSha256 = "sha256-FUEwXpeUMH1DYH77/t76wF1UslkcW721x9BHasaRUaM=";
-    persistencedSha256 = "sha256-ojHbmSAOYl3lOi2X6HOBlokTXhTCK6VNsH6+xfGQsyo=";
+    version = "550.76";
+    sha256_64bit = "sha256-2/wAmBNiePhX74FsV7j21LnCaubxMC/kAYMmf8kQt1s=";
+    sha256_aarch64 = "sha256-LhiyYCUTFwqzUITK6CKIqxOQp62wG1RuKOuP0fTKoVk=";
+    openSha256 = "sha256-RWaUXIr/yCRmX4yIyUxvBxrKCLKRKSi4lQJAYvrd2Kg=";
+    settingsSha256 = "sha256-Lv95+0ahvU1+X/twzWWVqQH4nqq491ALigH9TVBn+YY=";
+    persistencedSha256 = "sha256-rbgI9kGdVzGlPNEvaoOq2zrAMx+H8D+XEBah2eqZzuI=";
  };

  latest = selectHighestVersion production (generic {
--- a/pkgs/servers/aeron/default.nix
+++ b/pkgs/servers/aeron/default.nix
@ -8,7 +8,7 @@

 let
  pname = "aeron";
-  version = "1.42.1";
+  version = "1.43.0";
  groupId = "io.aeron";

  aeronAll_1_40_0 = fetchMavenArtifact {
@ -18,41 +18,6 @@ let
    hash = "sha512-NyhYaQqOWcSBwzwpje6DMAp36CEgGSNXBSdaRrDyP+Fn2Z0nvh5o2czog6GKKtbjH9inYfyyF/21gehfgLF6qA==";
  };

-  aeronAgent_1_40_0 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.40.0";
-    artifactId = "aeron-agent";
-    hash = "sha512-3XZ6XxPwlNchMe4p4MuDNTWntGokFPnetN7AUMlhXzIgeXBExXvn+BdxI2crfq/xgVGrF/hjHD2shwu2NBa0Tg==";
-  };
-
-  aeronArchive_1_40_0 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.40.0";
-    artifactId = "aeron-archive";
-    hash = "sha512-tmH+/020d1iNkGb8nvenDG9YU+H4PLuO2hSm2dULUIjSXX5AHLDkkrQ3uVQADV9koRNMtC4UXloqtqncay18kQ==";
-  };
-
-  aeronClient_1_40_0 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.40.0";
-    artifactId = "aeron-client";
-    hash = "sha512-y3/8Lu2EgMICRNPEWe0hrKpVhF35pDjCO6ip/Af9nPZ70ZRqGmlfEG7OzWVok11DuI8pYJ64jv6bEtUfSHTYXQ==";
-  };
-
-  aeronCluster_1_40_0 =fetchMavenArtifact {
-    inherit groupId;
-    version = "1.40.0";
-    artifactId = "aeron-cluster";
-    hash = "sha512-28m14Etjse3MVKBLvaQONujMfvdRQZG0ArezzVcjPEqVqTGd33mrqjPngALV8CG2nJTtcrJmsieRGLEosaXqTw==";
-  };
-
-  aeronDriver_1_40_0 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.40.0";
-    artifactId = "aeron-driver";
-    hash = "sha512-SRWHMHR6J1YEtCbSHqSLYm3vo8XgkVXGK3cFQbONT60TZvawP5UlZs7e3eFNpu3qQSA4prqEjjWO9Xc9M/sjKw==";
-  };
-
  aeronSamples_1_40_0 = fetchMavenArtifact {
    inherit groupId;
    version = "1.40.0";
@ -63,44 +28,10 @@ let
  aeronAll_1_42_1 = fetchMavenArtifact {
    inherit groupId;
    artifactId = "aeron-all";
-    inherit version;
+    version = "1.42.1";
    hash = "sha512-pjX+JopK6onDwElMIroj+ZXrKwdPj5H2uPg08XgNlrK1rAkHo9MUT8weBGbuFVFDLeqOZrHj0bt1wJ9XgYY5aA==";
  };

-  aeronAgent_1_42_1 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.42.1";
-    artifactId = "aeron-agent";
-    hash = "sha512-3XZ6XvPwlNdiMe4p4MuDNTWntGokFPnetN7AUMlhXzIgeXBExXvn+BdxI2crfq/xgVGrF/hjHD2shwu2NBa0Tg==";
-  };
-
-  aeronArchive_1_42_1 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.42.1";
-    artifactId = "aeron-archive";
-    hash = "sha512-1DmeI9flgfzanbP4jSNUSAQAv2SGBvnlb3G4LbO1m+BN/gPn/nahvVHzotvGJjJA5b65DE1Sc5tqPnItRTK0zQ==";
-  };
-
-  aeronClient_1_42_1 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.42.1";
-    artifactId = "aeron-client";
-    hash = "sha512-td2k2WNpaD3+2PNvlCCJ8cZRr615sFjngiQDKzuY2e9/de1OUwvER3zzVAFOonEIV+s5EhwVeQvWq3Wj5Uhadg==";
-  };
-
-  aeronCluster_1_42_1 =fetchMavenArtifact {
-    inherit groupId;
-    version = "1.42.1";
-    artifactId = "aeron-cluster";
-    hash = "sha512-RiqGeY3pRqN6wWpeJqbeB1SCxrZWnQghrJlCGhew2M/GZAaWHkhhJs5haJqRvR5oOAbaI4RfIWvi5U7TiUo88g==";
-  };
-
-  aeronDriver_1_42_1 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.42.1";
-    artifactId = "aeron-driver";
-    hash = "sha512-fKEN5oQCxD1h3qPODKkqFwYbKW6L03RFHNylpsYaNlztNODlCJd0CS5dBR6K8rbOdb2dVIXK/dW/IPBvOi5q/g==";
-  };
  aeronSamples_1_42_1 = fetchMavenArtifact {
    inherit groupId;
    version = "1.42.1";
@ -108,12 +39,22 @@ let
    hash = "sha512-4JnHn22vJf2lmOg6ev5PD+/YiaL3KgfuyWAK92djX3KBVXO7ERMY2kH79dveVCJG1rbekvE1j1pnjaAIxwJcqg==";
  };

-  aeronAll = aeronAll_1_42_1;
-  aeronArchive = aeronArchive_1_42_1;
-  aeronClient = aeronClient_1_42_1;
-  aeronCluster = aeronCluster_1_42_1;
-  aeronDriver= aeronDriver_1_42_1;
-  aeronSamples = aeronSamples_1_42_1;
+  aeronAll_1_43_0 = fetchMavenArtifact {
+    inherit groupId;
+    artifactId = "aeron-all";
+    version = "1.43.0";
+    hash = "sha512-ZKjUA1Kp++RLnCNUOi2K/iGc4zIIR4pC4j8qPfO+rcgp7ghZfgsXO8sB+JD307kzeikUXnPFX7ef28DlzI8s8Q==";
+  };
+
+  aeronSamples_1_43_0 = fetchMavenArtifact {
+    inherit groupId;
+    version = "1.43.0";
+    artifactId = "aeron-samples";
+    hash = "sha512-a/ti4Kd8WwzOzDGMgdYk0pxsu8vRA4kRD9cm4D3S+r6xc/rL8ECHVoogOMDeabDd1EYSIbx/sKE01BJOW7BVsg==";
+  };
+
+  aeronAll = aeronAll_1_43_0;
+  aeronSamples = aeronSamples_1_43_0;

 in stdenv.mkDerivation {

@ -121,10 +62,6 @@ in stdenv.mkDerivation {

  buildInputs = [
    aeronAll
-    aeronArchive
-    aeronClient
-    aeronCluster
-    aeronDriver
    aeronSamples
  ];

@ -141,10 +78,6 @@ in stdenv.mkDerivation {

    mkdir --parents "$out/share/java"
    ln --symbolic "${aeronAll.jar}" "$out/share/java/${pname}-all.jar"
-    ln --symbolic "${aeronArchive.jar}" "$out/share/java/${pname}-archive.jar"
-    ln --symbolic "${aeronClient.jar}" "$out/share/java/${pname}-client.jar"
-    ln --symbolic "${aeronCluster.jar}" "$out/share/java/${pname}-cluster.jar"
-    ln --symbolic "${aeronDriver.jar}" "$out/share/java/${pname}-driver.jar"
    ln --symbolic "${aeronSamples.jar}" "$out/share/java/${pname}-samples.jar"

    runHook postInstall
--- a/pkgs/servers/akkoma/admin-fe/default.nix
+++ b/pkgs/servers/akkoma/admin-fe/default.nix
@ -1,7 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitea, fetchYarnDeps
-, prefetch-yarn-deps, yarn, nodejs
+, fixup-yarn-lock, yarn, nodejs
 , python3, pkg-config, libsass
 }:

@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [
-    prefetch-yarn-deps
+    fixup-yarn-lock
    yarn
    nodejs
    pkg-config
--- a/pkgs/servers/akkoma/akkoma-fe/default.nix
+++ b/pkgs/servers/akkoma/akkoma-fe/default.nix
@ -1,7 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitea, fetchYarnDeps
-, prefetch-yarn-deps, yarn, nodejs
+, fixup-yarn-lock, yarn, nodejs
 , jpegoptim, oxipng, nodePackages
 }:

@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [
-    prefetch-yarn-deps
+    fixup-yarn-lock
    yarn
    nodejs
    jpegoptim
--- a/pkgs/servers/alice-lg/default.nix
+++ b/pkgs/servers/alice-lg/default.nix
@ -6,7 +6,7 @@
 , yarn
 , nodejs
 , nixosTests
-, prefetch-yarn-deps
+, fixup-yarn-lock
 }:

 buildGoModule rec {
@ -32,7 +32,7 @@ buildGoModule rec {
      hash = "sha256-PwByNIegKYTOT8Yg3nDMDFZiLRVkbX07z99YaDiBsIY=";
    };

-    nativeBuildInputs = [ nodejs yarn prefetch-yarn-deps ];
+    nativeBuildInputs = [ nodejs yarn fixup-yarn-lock ];
    configurePhase = ''
      runHook preConfigure

--- a/pkgs/servers/gonic/default.nix
+++ b/pkgs/servers/gonic/default.nix
@ -13,17 +13,17 @@

 buildGoModule rec {
  pname = "gonic";
-  version = "0.15.2";
+  version = "0.16.4";
  src = fetchFromGitHub {
    owner = "sentriz";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-lyKKD6Rxr4psFUxqGTtqQ3M/vQXoNPbcg0cTam9MkXk=";
+    sha256 = "sha256-+8rKODoADU2k1quKvbijjs/6S/hpkegHhG7Si0LSE0k=";
  };

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ taglib zlib ];
-  vendorHash = "sha256-+PUKPqW+ER7mmZXrDIc0cE4opoTxA3po3WXSeZO+Xwo=";
+  vendorHash = "sha256-6JkaiaAgtXYAZqVSRZJFObZvhEsHsbPaO9pwmKqIhYI=";

  # TODO(Profpatsch): write a test for transcoding support,
  # since it is prone to break
@ -39,6 +39,11 @@ buildGoModule rec {
      --replace \
        '"mpv"' \
        '"${lib.getBin mpv}/bin/mpv"'
+  '' + ''
+    substituteInPlace server/ctrlsubsonic/testdata/test* \
+      --replace \
+        '"audio/flac"' \
+        '"audio/x-flac"'
  '';

  passthru = {
@ -49,7 +54,7 @@ buildGoModule rec {
    homepage = "https://github.com/sentriz/gonic";
    description = "Music streaming server / subsonic server API implementation";
    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ ];
+    maintainers = with lib.maintainers; [ autrimpo ];
    platforms = lib.platforms.linux;
    mainProgram = "gonic";
  };
--- a/pkgs/servers/gotify/ui.nix
+++ b/pkgs/servers/gotify/ui.nix
@ -1,6 +1,6 @@
 { stdenv
 , yarn
-, prefetch-yarn-deps
+, fixup-yarn-lock
 , nodejs-slim
 , fetchFromGitHub
 , fetchYarnDeps
@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
    hash = "sha256-ejHzo6NHCMlNiYePWvfMY9Blb58pj3UQ5PFI0V84flI=";
  };

-  nativeBuildInputs = [ yarn prefetch-yarn-deps nodejs-slim ];
+  nativeBuildInputs = [ yarn fixup-yarn-lock nodejs-slim ];

  postPatch = ''
    export HOME=$NIX_BUILD_TOP/fake_home
--- a/pkgs/servers/mastodon/default.nix
+++ b/pkgs/servers/mastodon/default.nix
@ -1,6 +1,6 @@
 { lib, stdenv, nodejs-slim, bundlerEnv, nixosTests
 , yarn, callPackage, ruby, writeShellScript
-, fetchYarnDeps, prefetch-yarn-deps
+, fetchYarnDeps, fixup-yarn-lock
 , brotli

  # Allow building a fork or custom version of Mastodon:
@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
      hash = yarnHash;
    };

-    nativeBuildInputs = [ prefetch-yarn-deps nodejs-slim yarn mastodonGems mastodonGems.wrappedRuby brotli ];
+    nativeBuildInputs = [ fixup-yarn-lock nodejs-slim yarn mastodonGems mastodonGems.wrappedRuby brotli ];

    RAILS_ENV = "production";
    NODE_ENV = "production";
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@ -32,20 +32,20 @@ let
 in
 python.pkgs.buildPythonApplication rec {
  pname = "matrix-synapse";
-  version = "1.104.0";
+  version = "1.105.0";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "element-hq";
    repo = "synapse";
    rev = "v${version}";
-    hash = "sha256-/P7EBtXSYygUrqKQ4niI8J5zkBPZDgHCW/j2rFxRlsY=";
+    hash = "sha256-MydtP7jtTx9phmnoAajWvDI0sSqw+TScj+9n485L5qc=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-0lCbIlEM4wIG7W5BXWIZWkS6c/BkEG13xtcnPm3LjgY=";
+    hash = "sha256-yj3biat5znDqsen0mc8MNkXKhUftpb26VT7utWdpxvc=";
  };

  postPatch = ''
--- a/Show More
+++ b/Show More