Merge master into staging-next

2025-02-19 18:44:13 +00:00 · 2024-12-09 18:05:05 +00:00 · 2024-12-09 18:05:05 +00:00 · ceb62729d2
commit ceb62729d2
parent 2ed552b719 f602946645
92 changed files with 2149 additions and 12646 deletions
--- a/doc/build-helpers/images/dockertools.section.md
+++ b/doc/build-helpers/images/dockertools.section.md
@ -881,7 +881,7 @@ dockerTools.pullImage {
  imageDigest = "sha256:b8ea88f763f33dfda2317b55eeda3b1a4006692ee29e60ee54ccf6d07348c598";
  finalImageName = "nix";
  finalImageTag = "2.19.3";
-  sha256 = "zRwlQs1FiKrvHPaf8vWOR/Tlp1C5eLn1d9pE4BZg3oA=";
+  hash = "sha256-zRwlQs1FiKrvHPaf8vWOR/Tlp1C5eLn1d9pE4BZg3oA=";
 }
 ```
 :::
@ -898,7 +898,7 @@ dockerTools.pullImage {
  imageDigest = "sha256:24a23053f29266fb2731ebea27f915bb0fb2ae1ea87d42d890fe4e44f2e27c5d";
  finalImageName = "etcd";
  finalImageTag = "v3.5.11";
-  sha256 = "Myw+85f2/EVRyMB3axECdmQ5eh9p1q77FWYKy8YpRWU=";
+  hash = "sha256-Myw+85f2/EVRyMB3axECdmQ5eh9p1q77FWYKy8YpRWU=";
 }
 ```
 :::
@ -922,7 +922,7 @@ Writing manifest to image destination
 {
  imageName = "nixos/nix";
  imageDigest = "sha256:498fa2d7f2b5cb3891a4edf20f3a8f8496e70865099ba72540494cd3e2942634";
-  sha256 = "1q6cf2pdrasa34zz0jw7pbs6lvv52rq2aibgxccbwcagwkg2qj1q";
+  hash = "sha256-OEgs3uRPMb4Y629FJXAWZW9q9LqHS/A/GUqr3K5wzOA=";
  finalImageName = "nixos/nix";
  finalImageTag = "latest";
 }
--- a/lib/options.nix
+++ b/lib/options.nix
@ -420,20 +420,17 @@ rec {
     Placeholders will not be quoted as they are not actual values:
       (showOption ["foo" "*" "bar"]) == "foo.*.bar"
       (showOption ["foo" "<name>" "bar"]) == "foo.<name>.bar"
+       (showOption ["foo" "<myPlaceholder>" "bar"]) == "foo.<myPlaceholder>.bar"
  */
  showOption = parts: let
+    # If the part is a named placeholder of the form "<...>" don't escape it.
+    # It may cause misleading escaping if somebody uses literally "<...>" in their option names.
+    # This is the trade-off to allow for placeholders in option names.
+    isNamedPlaceholder = builtins.match "\<(.*)\>";
    escapeOptionPart = part:
-      let
-        # We assume that these are "special values" and not real configuration data.
-        # If it is real configuration data, it is rendered incorrectly.
-        specialIdentifiers = [
-          "<name>"          # attrsOf (submodule {})
-          "*"               # listOf (submodule {})
-          "<function body>" # functionTo
-        ];
-      in if builtins.elem part specialIdentifiers
-         then part
-         else lib.strings.escapeNixIdentifier part;
+      if part == "*" || isNamedPlaceholder part != null
+        then part
+        else lib.strings.escapeNixIdentifier part;
    in (concatStringsSep ".") (map escapeOptionPart parts);
  showFiles = files: concatStringsSep " and " (map (f: "`${f}'") files);

--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@ -1877,6 +1877,44 @@ runTests {
    expected = [ [ "_module" "args" ] [ "foo" ] [ "foo" "<name>" "bar" ] [ "foo" "bar" ] ];
  };

+  testAttrsWithName = {
+    expr = let
+      eval =  evalModules {
+        modules = [
+          {
+            options = {
+              foo = lib.mkOption {
+                type = lib.types.attrsWith {
+                  placeholder = "MyCustomPlaceholder";
+                  elemType = lib.types.submodule {
+                    options.bar = lib.mkOption {
+                      type = lib.types.int;
+                      default = 42;
+                    };
+                  };
+                };
+              };
+            };
+          }
+        ];
+      };
+      opt = eval.options.foo;
+    in
+      (opt.type.getSubOptions opt.loc).bar.loc;
+    expected = [
+      "foo"
+      "<MyCustomPlaceholder>"
+      "bar"
+    ];
+  };
+
+  testShowOptionWithPlaceholder = {
+    # <name>, *, should not be escaped. It is used as a placeholder by convention.
+    # Other symbols should be escaped. `{}`
+    expr = lib.showOption ["<name>" "<myName>" "*" "{foo}"];
+    expected = "<name>.<myName>.*.\"{foo}\"";
+  };
+
  testCartesianProductOfEmptySet = {
    expr = cartesianProduct {};
    expected = [ {} ];
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@ -190,6 +190,9 @@ checkConfigOutput '^420$' config.bare-submodule.deep ./declare-bare-submodule.ni
 checkConfigOutput '^2$' config.bare-submodule.deep ./declare-bare-submodule.nix ./declare-bare-submodule-deep-option.nix ./define-shorthandOnlyDefinesConfig-true.nix
 checkConfigError 'The option .bare-submodule.deep. in .*/declare-bare-submodule-deep-option.nix. is already declared in .*/declare-bare-submodule-deep-option-duplicate.nix' config.bare-submodule.deep ./declare-bare-submodule.nix ./declare-bare-submodule-deep-option.nix  ./declare-bare-submodule-deep-option-duplicate.nix

+# Check that strMatching can be merged
+checkConfigOutput '^"strMatching.*"$' options.sm.type.name ./strMatching-merge.nix
+
 # Check integer types.
 # unsigned
 checkConfigOutput '^42$' config.value ./declare-int-unsigned-value.nix ./define-value-int-positive.nix
@ -391,6 +394,10 @@ checkConfigError 'The option `mergedLazyNonLazy'\'' in `.*'\'' is already declar
 checkConfigOutput '^11$' config.lazyResult ./lazy-attrsWith.nix
 checkConfigError 'infinite recursion encountered' config.nonLazyResult ./lazy-attrsWith.nix

+# AttrsWith placeholder tests
+checkConfigOutput '^"mergedName.<id>.nested"$' config.result ./name-merge-attrsWith-1.nix
+checkConfigError 'The option .mergedName. in .*\.nix. is already declared in .*\.nix' config.mergedName ./name-merge-attrsWith-2.nix
+
 # Even with multiple assignments, a type error should be thrown if any of them aren't valid
 checkConfigError 'A definition for option .* is not of type .*' \
  config.value ./declare-int-unsigned-value.nix ./define-value-list.nix ./define-value-int-positive.nix
--- a/lib/tests/modules/name-merge-attrsWith-1.nix
+++ b/lib/tests/modules/name-merge-attrsWith-1.nix
@ -0,0 +1,51 @@
+{ lib, ... }:
+let
+  inherit (lib) types mkOption;
+in
+{
+  imports = [
+    # Module A
+    (
+      { ... }:
+      {
+        options.mergedName = mkOption {
+          default = { };
+          type = types.attrsWith {
+            placeholder = "id"; # <- This is beeing tested
+            elemType = types.submodule {
+              options.nested = mkOption {
+                type = types.int;
+                default = 1;
+              };
+            };
+          };
+        };
+      }
+    )
+    # Module B
+    (
+      { ... }:
+      {
+        # defines the default placeholder "name"
+        # type merging should resolve to "id"
+        options.mergedName = mkOption {
+          type = types.attrsOf (types.submodule { });
+        };
+      }
+    )
+
+    # Output
+    (
+      {
+        options,
+        ...
+      }:
+      {
+        options.result = mkOption {
+          default = lib.concatStringsSep "." (options.mergedName.type.getSubOptions options.mergedName.loc)
+          .nested.loc;
+        };
+      }
+    )
+  ];
+}
--- a/lib/tests/modules/name-merge-attrsWith-2.nix
+++ b/lib/tests/modules/name-merge-attrsWith-2.nix
@ -0,0 +1,38 @@
+{ lib, ... }:
+let
+  inherit (lib) types mkOption;
+in
+{
+  imports = [
+    # Module A
+    (
+      { ... }:
+      {
+        options.mergedName = mkOption {
+          default = { };
+          type = types.attrsWith {
+            placeholder = "id"; # <- this is beeing tested
+            elemType = types.submodule {
+              options.nested = mkOption {
+                type = types.int;
+                default = 1;
+              };
+            };
+          };
+        };
+      }
+    )
+    # Module B
+    (
+      { ... }:
+      {
+        options.mergedName = mkOption {
+          type = types.attrsWith {
+            placeholder = "other"; # <- define placeholder = "other" (conflict)
+            elemType = types.submodule { };
+          };
+        };
+      }
+    )
+  ];
+}
--- a/lib/tests/modules/strMatching-merge.nix
+++ b/lib/tests/modules/strMatching-merge.nix
@ -0,0 +1,15 @@
+{ lib, ... }:
+{
+  imports = [
+    {
+      options.sm = lib.mkOption {
+        type = lib.types.strMatching "\(.*\)";
+      };
+    }
+    {
+      options.sm = lib.mkOption {
+        type = lib.types.strMatching "\(.*\)";
+      };
+    }
+  ];
+}
--- a/lib/types.nix
+++ b/lib/types.nix
@ -461,6 +461,11 @@ rec {
      descriptionClass = "noun";
      check = x: str.check x && builtins.match pattern x != null;
      inherit (str) merge;
+      functor = defaultFunctor "strMatching" // {
+        type = payload: strMatching payload.pattern;
+        payload = { inherit pattern; };
+        binOp = lhs: rhs: if lhs == rhs then lhs else null;
+      };
    };

    # Merge multiple definitions by concatenating them (with the given
@ -475,9 +480,10 @@ rec {
      check = isString;
      merge = loc: defs: concatStringsSep sep (getValues defs);
      functor = (defaultFunctor name) // {
-        payload = sep;
-        binOp = sepLhs: sepRhs:
-          if sepLhs == sepRhs then sepLhs
+        payload = { inherit sep; };
+        type = payload: types.separatedString payload.sep;
+        binOp = lhs: rhs:
+          if lhs.sep == rhs.sep then { inherit (lhs) sep; }
          else null;
      };
    };
@ -608,17 +614,27 @@ rec {
              lhs.lazy
            else
              null;
+          placeholder =
+            if lhs.placeholder == rhs.placeholder then
+              lhs.placeholder
+            else if lhs.placeholder == "name" then
+              rhs.placeholder
+            else if rhs.placeholder == "name" then
+              lhs.placeholder
+            else
+              null;
        in
-        if elemType == null || lazy == null then
+        if elemType == null || lazy == null || placeholder == null then
          null
        else
          {
-            inherit elemType lazy;
+            inherit elemType lazy placeholder;
          };
    in
    {
      elemType,
      lazy ? false,
+      placeholder ? "name",
    }:
    mkOptionType {
      name = if lazy then "lazyAttrsOf" else "attrsOf";
@ -645,16 +661,16 @@ rec {
          (pushPositions defs)))
      );
      emptyValue = { value = {}; };
-      getSubOptions = prefix: elemType.getSubOptions (prefix ++ ["<name>"]);
+      getSubOptions = prefix: elemType.getSubOptions (prefix ++ ["<${placeholder}>"]);
      getSubModules = elemType.getSubModules;
-      substSubModules = m: attrsWith { elemType = elemType.substSubModules m; inherit lazy; };
+      substSubModules = m: attrsWith { elemType = elemType.substSubModules m; inherit lazy placeholder; };
      functor = defaultFunctor "attrsWith" // {
        wrappedDeprecationMessage = { loc }: lib.warn ''
          The deprecated `type.functor.wrapped` attribute of the option `${showOption loc}` is accessed, use `type.nestedTypes.elemType` instead.
        '' elemType;
        payload = {
          # Important!: Add new function attributes here in case of future changes
-          inherit elemType lazy;
+          inherit elemType lazy placeholder;
        };
        inherit binOp;
      };
@ -1014,7 +1030,11 @@ rec {
          else "conjunction";
        check = flip elem values;
        merge = mergeEqualOption;
-        functor = (defaultFunctor name) // { payload = values; binOp = a: b: unique (a ++ b); };
+        functor = (defaultFunctor name) // {
+          payload = { inherit values; };
+          type = payload: types.enum payload.values;
+          binOp = a: b: { values = unique (a.values ++ b.values); };
+        };
      };

    # Either value of type `t1` or `t2`.
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -7335,6 +7335,17 @@
    githubId = 1633361;
    name = "Iztok Fister Jr.";
  };
+  FirelightFlagboy = {
+    email = "firelight.flagboy+nixpkgs@gmail.com";
+    github = "FirelightFlagboy";
+    githubId = 30697622;
+    name = "Firelight Flagboy";
+    keys = [
+      {
+        fingerprint = "D6E2 4BD5 680C 609D D146  99B4 4304 CE0B A5E8 67D1";
+      }
+    ];
+  };
  FireyFly = {
    email = "nix@firefly.nu";
    github = "FireyFly";
@ -10263,7 +10274,7 @@
    name = "jdev082";
  };
  jdreaver = {
-    email = "johndreaver@gmail.com";
+    email = "me@davidreaver.com";
    github = "jdreaver";
    githubId = 1253071;
    name = "David Reaver";
--- a/nixos/doc/manual/development/option-types.section.md
+++ b/nixos/doc/manual/development/option-types.section.md
@ -399,7 +399,7 @@ Composed types are types that take a type as parameter. `listOf
    returned instead for the same `mkIf false` definition.
    :::

-`types.attrsWith` { *`elemType`*, *`lazy`* ? false }
+`types.attrsWith` { *`elemType`*, *`lazy`* ? false, *`placeholder`* ? "name" }

 :   An attribute set of where all the values are of *`elemType`* type.

@ -411,10 +411,18 @@ Composed types are types that take a type as parameter. `listOf
    `lazy`
    : Determines whether the attribute set is lazily evaluated. See: `types.lazyAttrsOf`

+    `placeholder` (`String`, default: `name` )
+    : Placeholder string in documentation for the attribute names.
+      The default value `name` results in the placeholder `<name>`
+
    **Behavior**

    - `attrsWith { elemType = t; }` is equivalent to `attrsOf t`
    - `attrsWith { lazy = true; elemType = t; }` is equivalent to `lazyAttrsOf t`
+    - `attrsWith { placeholder = "id"; elemType = t; }`
+
+      Displays the option as `foo.<id>` in the manual.
+

 `types.uniq` *`t`*

--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@ -1844,6 +1844,12 @@
  "sec-release-25.05-notable-changes": [
    "release-notes.html#sec-release-25.05-notable-changes"
  ],
+  "sec-release-25.05-lib": [
+    "release-notes.html#sec-release-25.05-lib"
+  ],
+  "sec-release-25.05-lib-breaking": [
+    "release-notes.html#sec-release-25.05-lib-breaking"
+  ],
  "sec-release-24.11": [
    "release-notes.html#sec-release-24.11"
  ],
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@ -129,3 +129,11 @@
 - `bind.cacheNetworks` now only controls access for recursive queries, where it previously controlled access for all queries.

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+## Nixpkgs Library {#sec-release-25.05-lib}
+
+### Breaking changes {#sec-release-25.05-lib-breaking}
+
+- Structure of the `functor` of some types has changed. `functor` is an implementation detail and should not be relied upon. If you did rely on it let us know in this [PR](https://github.com/NixOS/nixpkgs/pull/363565).
+  - [`lib.types.enum`](https://nixos.org/manual/nixos/unstable/#sec-option-types-basic): Previously the `functor.payload` was the list of enum values directly. Now it is an attribute set containing the values in the `values` attribute.
+  - [`lib.types.separatedString`](https://nixos.org/manual/nixos/unstable/#sec-option-types-string): Previously the `functor.payload` was the seperator directly. Now it is an attribute set containing the seperator in the `sep` attribute.
--- a/nixos/modules/services/cluster/k3s/default.nix
+++ b/nixos/modules/services/cluster/k3s/default.nix
@ -372,7 +372,7 @@ in
          (pkgs.dockerTools.pullImage {
            imageName = "docker.io/bitnami/keycloak";
            imageDigest = "sha256:714dfadc66a8e3adea6609bda350345bd3711657b7ef3cf2e8015b526bac2d6b";
-            sha256 = "0imblp0kw9vkcr7sp962jmj20fpmb3hvd3hmf4cs4x04klnq3k90";
+            hash = "sha256-IM2BLZ0EdKIZcRWOtuFY9TogZJXCpKtPZnMnPsGlq0Y=";
            finalImageTag = "21.1.2-debian-11-r0";
          })

--- a/nixos/modules/services/monitoring/librenms.nix
+++ b/nixos/modules/services/monitoring/librenms.nix
@ -14,6 +14,7 @@ let
    log_errors = on
    post_max_size = 100M
    upload_max_filesize = 100M
+    memory_limit = ${toString cfg.settings.php_memory_limit}M
    date.timezone = "${config.time.timeZone}"
  '';
  phpIni = pkgs.runCommand "php.ini"
@ -101,11 +102,21 @@ in
      '';
    };

+    enableLocalBilling = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Enable billing Cron-Jobs on the local instance. Enabled by default, but you may disable it
+        on some nodes within a distributed poller setup. See [the docs](https://docs.librenms.org/Extensions/Distributed-Poller/#discovery)
+        for more informations about billing with distributed pollers.
+      '';
+    };
+
    useDistributedPollers = mkOption {
      type = types.bool;
      default = false;
      description = ''
-        Enables (distributed pollers)[https://docs.librenms.org/Extensions/Distributed-Poller/]
+        Enables [distributed pollers](https://docs.librenms.org/Extensions/Distributed-Poller/)
        for this LibreNMS instance. This will enable a local `rrdcached` and `memcached` server.

        To use this feature, make sure to configure your firewall that the distributed pollers
@ -118,7 +129,7 @@ in
        type = types.bool;
        default = false;
        description = ''
-          Configure this LibreNMS instance as a (distributed poller)[https://docs.librenms.org/Extensions/Distributed-Poller/].
+          Configure this LibreNMS instance as a [distributed poller](https://docs.librenms.org/Extensions/Distributed-Poller/).
          This will disable all web features and just configure the poller features.
          Use the `mysql` database of your main LibreNMS instance in the database settings.
        '';
@ -146,6 +157,10 @@ in
        default = false;
        description = ''
          Enable distributed billing on this poller.
+
+          Note: according to [the docs](https://docs.librenms.org/Extensions/Distributed-Poller/#discovery),
+          billing should only be calculated on a single node per poller group. You can disable billing on
+          some nodes with the `services.librenms.enableLocalBilling` option.
        '';
      };

@ -376,6 +391,9 @@ in
      # enable fast ping by default
      "ping_rrd_step" = 60;

+      # set default memory limit to 1G
+      "php_memory_limit" = lib.mkDefault 1024;
+
      # one minute polling
      "rrd.step" = if cfg.enableOneMinutePolling then 60 else 300;
      "rrd.heartbeat" = if cfg.enableOneMinutePolling then 120 else 600;
@ -609,8 +627,6 @@ in
          "${if cfg.enableOneMinutePolling then "*" else "*/5"} * * * * ${cfg.user} ${env} ${package}/cronic ${package}/poller-wrapper.py ${toString cfg.pollerThreads}"
          "* * * * * ${cfg.user} ${env} ${package}/alerts.php >> /dev/null 2>&1"

-          "*/5 * * * * ${cfg.user} ${env} ${package}/poll-billing.php >> /dev/null 2>&1"
-          "01 * * * * ${cfg.user} ${env} ${package}/billing-calculate.php >> /dev/null 2>&1"
          "*/5 * * * * ${cfg.user} ${env} ${package}/check-services.php >> /dev/null 2>&1"

          # extra: fast ping
@ -621,6 +637,9 @@ in
          "19 0 * * * ${cfg.user} ${env} ${package}/daily.sh notifications >> /dev/null 2>&1"
          "19 0 * * * ${cfg.user} ${env} ${package}/daily.sh peeringdb >> /dev/null 2>&1"
          "19 0 * * * ${cfg.user} ${env} ${package}/daily.sh mac_oui >> /dev/null 2>&1"
+        ] ++ lib.optionals cfg.enableLocalBilling [
+          "*/5 * * * * ${cfg.user} ${env} ${package}/poll-billing.php >> /dev/null 2>&1"
+          "01 * * * * ${cfg.user} ${env} ${package}/billing-calculate.php >> /dev/null 2>&1"
        ];
    };

@ -659,5 +678,5 @@ in

  };

-  meta.maintainers = lib.teams.wdz.members;
+  meta.maintainers = with lib.maintainers; [ netali ] ++ lib.teams.wdz.members;
 }
--- a/nixos/tests/prowlarr.nix
+++ b/nixos/tests/prowlarr.nix
@ -2,7 +2,7 @@ import ./make-test-python.nix ({ lib, ... }:

 {
  name = "prowlarr";
-  meta.maintainers = with lib.maintainers; [ jdreaver ];
+  meta.maintainers = with lib.maintainers; [ ];

  nodes.machine =
    { pkgs, ... }:
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -9163,12 +9163,12 @@ final: prev:

  nvim-lspconfig = buildVimPlugin {
    pname = "nvim-lspconfig";
-    version = "2024-12-02";
+    version = "2024-12-08";
    src = fetchFromGitHub {
      owner = "neovim";
      repo = "nvim-lspconfig";
-      rev = "1aa9f36b6d542dafc0b4a38c48969d036003b00a";
-      sha256 = "1nhvsi0y4fb514ji3zw5d04qwidalajsv51j7748fsr023nnvfzs";
+      rev = "fc16fd4f9c5d72b45db0f45ee275db3a9a30481a";
+      sha256 = "1jriaindyc1mk2vqxn5wsds0zsqjsmsr302qb72262z0jg1ix5aa";
    };
    meta.homepage = "https://github.com/neovim/nvim-lspconfig/";
  };
--- a/pkgs/applications/emulators/box86/default.nix
+++ b/pkgs/applications/emulators/box86/default.nix
@ -15,13 +15,13 @@ assert withDynarec -> stdenv.hostPlatform.isAarch32;

 stdenv.mkDerivation (finalAttrs: {
  pname = "box86";
-  version = "0.3.6";
+  version = "0.3.8";

  src = fetchFromGitHub {
    owner = "ptitSeb";
    repo = "box86";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-Ywsf+q7tWcAbrwbE/KvM6AJFNMJvqHKWD6tuANxrUt8=";
+    hash = "sha256-/xeyb4NK5ZzPevlAjjSnc6JAmsmqnx3slaMfPLL9dYI=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/gimp/plugins/default.nix
+++ b/pkgs/applications/graphics/gimp/plugins/default.nix
@ -90,8 +90,17 @@ in
      })
    ];

+    postPatch = ''
+      substituteInPlace Makefile \
+        --replace-fail "gcc" "${stdenv.cc.targetPrefix}cc"
+    '';
+
    nativeBuildInputs = with pkgs; [ which ];

+    env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.cc.isClang [
+      "-Wno-error=incompatible-function-pointer-types"
+    ]);
+
    installFlags = [
      "SYSTEM_INSTALL_DIR=${placeholder "out"}/${gimp.targetPluginDir}/bimp"
    ];
@ -138,7 +147,11 @@ in
      ffmpegSrc=$(realpath extern_libs/ffmpeg)
    '';

-    configureFlags = ["--with-ffmpegsrcdir=${placeholder "ffmpegSrc"}"];
+    configureFlags = [
+      "--with-ffmpegsrcdir=${placeholder "ffmpegSrc"}"
+    ] ++ lib.optionals (!stdenv.hostPlatform.isx86) [
+      "--disable-libavformat"
+    ];

    hardeningDisable = [ "format" ];

@ -152,6 +165,8 @@ in
      # The main code is given in GPLv3, but it has ffmpeg in it, and I think ffmpeg license
      # falls inside "free".
      license = with licenses; [ gpl3 free ];
+      # Depends on linux/soundcard.h
+      platforms = platforms.linux;
    };
  };

--- a/pkgs/applications/misc/prusa-slicer/default.nix
+++ b/pkgs/applications/misc/prusa-slicer/default.nix
@ -91,7 +91,8 @@ stdenv.mkDerivation (finalAttrs: {
  };

  # required for GCC 14
-  postPatch = ''
+  # (not applicable to super-slicer fork)
+  postPatch = lib.optionalString (finalAttrs.pname == "prusa-slicer") ''
    substituteInPlace src/libslic3r/Arrange/Core/DataStoreTraits.hpp \
      --replace-fail \
      "WritableDataStoreTraits<ArrItem>::template set" \
--- a/pkgs/applications/misc/prusa-slicer/meshboolean-const.patch
+++ b/pkgs/applications/misc/prusa-slicer/meshboolean-const.patch
@ -1,19 +0,0 @@
-diff --git a/src/libslic3r/MeshBoolean.cpp b/src/libslic3r/MeshBoolean.cpp
-index 31fdc35..32acbf8 100644
--- a/src/libslic3r/MeshBoolean.cpp
-+++ b/src/libslic3r/MeshBoolean.cpp
-@@ -147,12 +147,12 @@ template<class _Mesh> TriangleMesh cgal_to_triangle_mesh(const _Mesh &cgalmesh)
-     const auto &vertices = cgalmesh.vertices();
-     int vsize = int(vertices.size());
- 
-    for (auto &vi : vertices) {
-+    for (const auto &vi : vertices) {
-         auto &v = cgalmesh.point(vi); // Don't ask...
-         its.vertices.emplace_back(to_vec3f(v));
-     }
- 
-    for (auto &face : faces) {
-+    for (const auto &face : faces) {
-         auto vtc = cgalmesh.vertices_around_face(cgalmesh.halfedge(face));
- 
-         int i = 0;
--- a/pkgs/applications/misc/prusa-slicer/super-slicer.nix
+++ b/pkgs/applications/misc/prusa-slicer/super-slicer.nix
@ -16,7 +16,6 @@ let
      ];
      hash = "sha256-v0q2MhySayij7+qBTE5q01IOq/DyUcWnjpbzB/AV34c=";
    })
-    ./meshboolean-const.patch
    # Drop if this fix gets merged upstream
    (fetchpatch {
      url = "https://github.com/supermerill/SuperSlicer/commit/fa7c545efa5d1880cf24af32083094fc872d3692.patch";
@ -55,13 +54,18 @@ let

    # - wxScintilla is not used on macOS
    # - Partially applied upstream changes cause a bug when trying to link against a nonexistent libexpat
-    prePatch = super.prePatch + ''
+    postPatch = super.postPatch + ''
      substituteInPlace src/CMakeLists.txt \
        --replace "scintilla" "" \
        --replace "list(APPEND wxWidgets_LIBRARIES libexpat)" "list(APPEND wxWidgets_LIBRARIES EXPAT::EXPAT)"

      substituteInPlace src/libslic3r/CMakeLists.txt \
        --replace "libexpat" "EXPAT::EXPAT"
+
+      # fixes GCC 14 error
+      substituteInPlace src/libslic3r/MeshBoolean.cpp \
+        --replace-fail 'auto &face' 'auto face' \
+        --replace-fail 'auto &vi' 'auto vi'
    '';

    # We don't need PS overrides anymore, and gcode-viewer is embedded in the binary.
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -90,13 +90,13 @@
    "vendorHash": "sha256-RtBEXTkmPPccNmbPLNAnF1L8kinL46uBLZVMqO3887I="
  },
  "auth0": {
-    "hash": "sha256-1Dvqvv/hWZtavEJgBQrvaAgAF3yxruPo26jPVNk2BBE=",
+    "hash": "sha256-x4fi3huCQ82MBdy75+je6x4bj4yxyoaJM1GyQ29R1GA=",
    "homepage": "https://registry.terraform.io/providers/auth0/auth0",
    "owner": "auth0",
    "repo": "terraform-provider-auth0",
-    "rev": "v1.7.3",
+    "rev": "v1.8.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Qjaw43kMlTL2eceQwlZpgaA42YDuxq59F/m2qLqvl8s="
+    "vendorHash": "sha256-TK9JPkwcrBAjC4D96Lsjldt7OegHZ/l9UjP7YG7BPhA="
  },
  "avi": {
    "hash": "sha256-OKUxIJO5WR8ZVkhst1xIgxKsAy+9PNHOmG2NsaRUxFY=",
@ -723,11 +723,11 @@
    "vendorHash": "sha256-MfXuVZC7aroO83CJTNCh5YfbmMlUG1CiPeGgxhUFjN0="
  },
  "launchdarkly": {
-    "hash": "sha256-ca8eXj+eOTNoR00c4nBLoghoPsO2PJ3dYOMOv5cXzO4=",
+    "hash": "sha256-ONASsswVYyugvSpACCmWIcuhnbueW++/s8F7c91PkeQ=",
    "homepage": "https://registry.terraform.io/providers/launchdarkly/launchdarkly",
    "owner": "launchdarkly",
    "repo": "terraform-provider-launchdarkly",
-    "rev": "v2.21.0",
+    "rev": "v2.21.2",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-v9N7lj7bEgR5HZm1SO0+DSCmQFVnsRvHPMycYMfpYwo="
  },
@ -777,11 +777,11 @@
    "vendorHash": "sha256-JIFYDh3EzsCNwY8Hg8aVnUIuhP+MJpygbmwTyRryM0w="
  },
  "mailgun": {
-    "hash": "sha256-Sj6iejtaSdAPg2tI5f0b88Lni431cervHxlQWwGl8Bo=",
+    "hash": "sha256-fuJnzloJa0S1r3/22Wecbq1oF8oRQP2nrrmwCONHITA=",
    "homepage": "https://registry.terraform.io/providers/wgebis/mailgun",
    "owner": "wgebis",
    "repo": "terraform-provider-mailgun",
-    "rev": "v0.7.6",
+    "rev": "v0.7.7",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-Y6zsbhLNehO3i/BRjKggVhcM15Qesbd6HbARFH/arM8="
  },
@ -967,11 +967,11 @@
    "vendorHash": null
  },
  "ovh": {
-    "hash": "sha256-GabcX9KyUzwXke7h8hDYeDkA69D8S2IxwIK7LQynBlU=",
+    "hash": "sha256-zLTtr1S7A3ULi+sPBO3LYVhHx6OElRVJcvjK5cfrFLI=",
    "homepage": "https://registry.terraform.io/providers/ovh/ovh",
    "owner": "ovh",
    "repo": "terraform-provider-ovh",
-    "rev": "v1.0.0",
+    "rev": "v1.1.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -1337,13 +1337,13 @@
    "vendorHash": "sha256-zJtVKDaqOMQqyAzq4VtVv5MgXS999BwxeWhXQI6McC4="
  },
  "vault": {
-    "hash": "sha256-EiCLz5Z0ztwWrn8yHG9JnuIizicpi3WtvDSGyBtzgSY=",
+    "hash": "sha256-vMt7FyNY+Tv7C+YT4h6BOn4EDU5ypOHQvtW0VtQiifg=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/vault",
    "owner": "hashicorp",
    "repo": "terraform-provider-vault",
-    "rev": "v4.4.0",
+    "rev": "v4.5.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-z9qg6NVKYIU2OQTW8g72t6B69aTL/BeLCUFeoII75cE="
+    "vendorHash": "sha256-tg1LBq8K8loMkPUXPMEi9Y4Epg0ZfpaYADfWLaZ2k3U="
  },
  "vcd": {
    "hash": "sha256-lWpJb2Dsx2wljQEignrbudFP/K2X8IfkY0IHLnO/Gtw=",
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@ -128,50 +128,53 @@ rec {
    let
      fixName = name: builtins.replaceStrings [ "/" ":" ] [ "-" "-" ] name;
    in
-    { imageName
-      # To find the digest of an image, you can use skopeo:
-      # see doc/functions.xml
-    , imageDigest
-    , sha256
-    , os ? "linux"
-    , # Image architecture, defaults to the architecture of the `hostPlatform` when unset
-      arch ? defaultArchitecture
-      # This is used to set name to the pulled image
-    , finalImageName ? imageName
-      # This used to set a tag to the pulled image
-    , finalImageTag ? "latest"
-      # This is used to disable TLS certificate verification, allowing access to http registries on (hopefully) trusted networks
-    , tlsVerify ? true
+    lib.fetchers.withNormalizedHash { } (
+      { imageName
+        # To find the digest of an image, you can use skopeo:
+        # see doc/functions.xml
+      , imageDigest
+      , outputHash
+      , outputHashAlgo
+      , os ? "linux"
+      , # Image architecture, defaults to the architecture of the `hostPlatform` when unset
+        arch ? defaultArchitecture
+        # This is used to set name to the pulled image
+      , finalImageName ? imageName
+        # This used to set a tag to the pulled image
+      , finalImageTag ? "latest"
+        # This is used to disable TLS certificate verification, allowing access to http registries on (hopefully) trusted networks
+      , tlsVerify ? true

-    , name ? fixName "docker-image-${finalImageName}-${finalImageTag}.tar"
-    }:
+      , name ? fixName "docker-image-${finalImageName}-${finalImageTag}.tar"
+      }:

-    runCommand name
-      {
-        inherit imageDigest;
-        imageName = finalImageName;
-        imageTag = finalImageTag;
-        impureEnvVars = lib.fetchers.proxyImpureEnvVars;
-        outputHashMode = "flat";
-        outputHashAlgo = "sha256";
-        outputHash = sha256;
+      runCommand name
+        {
+          inherit imageDigest;
+          imageName = finalImageName;
+          imageTag = finalImageTag;
+          impureEnvVars = lib.fetchers.proxyImpureEnvVars;

-        nativeBuildInputs = [ skopeo ];
-        SSL_CERT_FILE = "${cacert.out}/etc/ssl/certs/ca-bundle.crt";
+          inherit outputHash outputHashAlgo;
+          outputHashMode = "flat";

-        sourceURL = "docker://${imageName}@${imageDigest}";
-        destNameTag = "${finalImageName}:${finalImageTag}";
-      } ''
-      skopeo \
-        --insecure-policy \
-        --tmpdir=$TMPDIR \
-        --override-os ${os} \
-        --override-arch ${arch} \
-        copy \
-        --src-tls-verify=${lib.boolToString tlsVerify} \
-        "$sourceURL" "docker-archive://$out:$destNameTag" \
-        | cat  # pipe through cat to force-disable progress bar
-    '';
+          nativeBuildInputs = [ skopeo ];
+          SSL_CERT_FILE = "${cacert.out}/etc/ssl/certs/ca-bundle.crt";
+
+          sourceURL = "docker://${imageName}@${imageDigest}";
+          destNameTag = "${finalImageName}:${finalImageTag}";
+        } ''
+        skopeo \
+          --insecure-policy \
+          --tmpdir=$TMPDIR \
+          --override-os ${os} \
+          --override-arch ${arch} \
+          copy \
+          --src-tls-verify=${lib.boolToString tlsVerify} \
+          "$sourceURL" "docker-archive://$out:$destNameTag" \
+          | cat  # pipe through cat to force-disable progress bar
+      ''
+    );

  # We need to sum layer.tar, not a directory, hence tarsum instead of nix-hash.
  # And we cannot untar it, because then we cannot preserve permissions etc.
--- a/pkgs/build-support/docker/examples.nix
+++ b/pkgs/build-support/docker/examples.nix
@ -115,7 +115,7 @@ rec {
  nixFromDockerHub = pullImage {
    imageName = "nixos/nix";
    imageDigest = "sha256:85299d86263a3059cf19f419f9d286cc9f06d3c13146a8ebbb21b3437f598357";
-    sha256 = "19fw0n3wmddahzr20mhdqv6jkjn1kanh6n2mrr08ai53dr8ph5n7";
+    hash = "sha256-xxZ4UW6jRIVAzlVYA62awcopzcYNViDyh6q1yocF3KU=";
    finalImageTag = "2.2.1";
    finalImageName = "nix";
  };
@ -124,7 +124,7 @@ rec {
  testNixFromDockerHub = pkgs.testers.invalidateFetcherByDrvHash pullImage {
    imageName = "nixos/nix";
    imageDigest = "sha256:85299d86263a3059cf19f419f9d286cc9f06d3c13146a8ebbb21b3437f598357";
-    sha256 = "19fw0n3wmddahzr20mhdqv6jkjn1kanh6n2mrr08ai53dr8ph5n7";
+    hash = "sha256-xxZ4UW6jRIVAzlVYA62awcopzcYNViDyh6q1yocF3KU=";
    finalImageTag = "2.2.1";
    finalImageName = "nix";
  };
--- a/pkgs/build-support/docker/nix-prefetch-docker
+++ b/pkgs/build-support/docker/nix-prefetch-docker
@ -133,7 +133,7 @@ else
 fi

 # Compute the hash.
-imageHash=$(nix-hash --flat --type $hashType --base32 "$tmpFile")
+imageHash=$(nix-hash --flat --type $hashType --sri "$tmpFile")

 # Add the downloaded file to Nix store.
 finalPath=$(nix-store --add-fixed "$hashType" "$tmpFile")
@ -152,7 +152,7 @@ cat <<EOF
 {
  imageName = "$imageName";
  imageDigest = "$imageDigest";
-  sha256 = "$imageHash";
+  hash = "$imageHash";
  finalImageName = "$finalImageName";
  finalImageTag = "$finalImageTag";
 }
@ -164,7 +164,7 @@ cat <<EOF
 {
  "imageName": "$imageName",
  "imageDigest": "$imageDigest",
-  "sha256": "$imageHash",
+  "hash": "$imageHash",
  "finalImageName": "$finalImageName",
  "finalImageTag": "$finalImageTag"
 }
--- a/pkgs/by-name/ar/arti/package.nix
+++ b/pkgs/by-name/ar/arti/package.nix
@ -11,7 +11,7 @@

 rustPlatform.buildRustPackage rec {
  pname = "arti";
-  version = "1.3.0";
+  version = "1.3.1";

  src = fetchFromGitLab {
    domain = "gitlab.torproject.org";
@ -19,10 +19,10 @@ rustPlatform.buildRustPackage rec {
    owner = "core";
    repo = "arti";
    rev = "arti-v${version}";
-    hash = "sha256-zGaNA6LdW2jZ6NyySklFCsLm2b5xk44E8ecJDV393c4=";
+    hash = "sha256-Nb1lZszq09yW16/Kr5SuxW767iYGPsUhNN7p7bTpBzs=";
  };

-  cargoHash = "sha256-9BvIQdhY/7i0X8w6XJZZeWzxEfqJlquO/qOWvvhCWaA=";
+  cargoHash = "sha256-ESZKUOPzax+RVI4G3ioZE08sqB7wtPmrFUkQ7qZOg/o=";

  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ];

--- a/pkgs/by-name/bu/butane/package.nix
+++ b/pkgs/by-name/bu/butane/package.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "butane";
-  version = "0.22.0";
+  version = "0.23.0";

  src = fetchFromGitHub {
    owner = "coreos";
    repo = "butane";
    rev = "v${version}";
-    hash = "sha256-ELCERcgw01RcSMQjM0PL8CyTKrdfEPV9U8/RSf7YxCs=";
+    hash = "sha256-UJRHqvfCeKxbE+SRQZEm797WqwGpwjlqol8z36l3nS4=";
  };

  vendorHash = null;
--- a/pkgs/by-name/ca/cargo-aoc/package.nix
+++ b/pkgs/by-name/ca/cargo-aoc/package.nix
@ -0,0 +1,35 @@
+{
+  lib,
+  rustPlatform,
+  fetchCrate,
+  testers,
+  nix-update-script,
+  cargo-aoc,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "cargo-aoc";
+  version = "0.3.8";
+
+  src = fetchCrate {
+    inherit pname version;
+    hash = "sha256-5CjY91515GeLzmLJiGjfbBfIMPr32EA65X/rriKPWRY=";
+  };
+
+  cargoHash = "sha256-LhPsiO0Fnx9Tf+itaaVaO1XgqM00m+UQMlUJYY8isXY=";
+
+  passthru = {
+    tests.version = testers.testVersion { package = cargo-aoc; };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Simple CLI tool that aims to be a helper for Advent of Code";
+    homepage = "https://github.com/gobanos/cargo-aoc";
+    license = with lib.licenses; [
+      mit
+      asl20
+    ];
+    maintainers = with lib.maintainers; [ defelo ];
+    mainProgram = "cargo-aoc";
+  };
+}
--- a/pkgs/by-name/ca/cargo-deny/package.nix
+++ b/pkgs/by-name/ca/cargo-deny/package.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-deny";
-  version = "0.16.2";
+  version = "0.16.3";

  src = fetchFromGitHub {
    owner = "EmbarkStudios";
    repo = "cargo-deny";
    rev = version;
-    hash = "sha256-xZ88TaodLVZ4p0PU2ocwt8isj/WTVxcmwBUrKCQG5GE=";
+    hash = "sha256-vU1MUmMzyKcCi1HR0089+MTtpy0Y+zzK5XC5/jIEhok=";
  };

-  cargoHash = "sha256-cU9idGvbn2KcvI7G7Az3CYFGlIxPXrs5Bq0su4FTOvg=";
+  cargoHash = "sha256-jNNmTMeNgUq7uBp2eGrSl5afcKrTUXG2Wr8peEcmG7s=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/ci/cilium-cli/package.nix
+++ b/pkgs/by-name/ci/cilium-cli/package.nix
@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "cilium-cli";
-  version = "0.16.20";
+  version = "0.16.21";

  src = fetchFromGitHub {
    owner = "cilium";
    repo = "cilium-cli";
    rev = "refs/tags/v${version}";
-    hash = "sha256-aTCMYVvbVKhM2Nm1mYw8beEIb3sdDwjcigFvEum86s8=";
+    hash = "sha256-CduyQeUIh+FK1yS/3uLjBKDWkVF5f6FSlRG9+A+EI/I=";
  };

  nativeBuildInputs = [ installShellFiles ];
@ -25,8 +25,9 @@ buildGoModule rec {
  subPackages = [ "cmd/cilium" ];

  ldflags = [
-    "-s" "-w"
-    "-X=github.com/cilium/cilium-cli/defaults.CLIVersion=${version}"
+    "-s"
+    "-w"
+    "-X=github.com/cilium/cilium/cilium-cli/defaults.CLIVersion=${version}"
  ];

  # Required to workaround install check error:
@ -51,7 +52,11 @@ buildGoModule rec {
    homepage = "https://www.cilium.io/";
    changelog = "https://github.com/cilium/cilium-cli/releases/tag/v${version}";
    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ bryanasdev000 humancalico qjoly ];
+    maintainers = with lib.maintainers; [
+      bryanasdev000
+      humancalico
+      qjoly
+    ];
    mainProgram = "cilium";
  };
 }
--- a/pkgs/by-name/cl/clightning/package.nix
+++ b/pkgs/by-name/cl/clightning/package.nix
@ -24,11 +24,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "clightning";
-  version = "24.08.2";
+  version = "24.11";

  src = fetchurl {
    url = "https://github.com/ElementsProject/lightning/releases/download/v${version}/clightning-v${version}.zip";
-    hash = "sha256-U54HNOreulhvCYeULyBbl/WHQ7F9WQnSCSMGg5WUAdg=";
+    hash = "sha256-MWTzUn5kCBMr6u5k3qD7bVZjd7d+C+Z6I1noDcvXup4=";
  };

  # when building on darwin we need cctools to provide the correct libtool
--- a/pkgs/by-name/co/conda/package.nix
+++ b/pkgs/by-name/co/conda/package.nix
@ -1,20 +1,32 @@
-{ lib
-, stdenv
-, fetchurl
-, runCommand
-, makeWrapper
-, buildFHSEnv
-, libselinux
-, libarchive
-, libGL
-, xorg
-, zlib
-# Conda installs its packages and environments under this directory
-, installationPath ? "~/.conda"
-# Conda manages most pkgs itself, but expects a few to be on the system.
-, condaDeps ? [ stdenv.cc xorg.libSM xorg.libICE xorg.libX11 xorg.libXau xorg.libXi xorg.libXrender libselinux libGL zlib]
-# Any extra nixpkgs you'd like available in the FHS env for Conda to use
-, extraPkgs ? [ ]
+{
+  lib,
+  stdenv,
+  fetchurl,
+  runCommand,
+  makeWrapper,
+  buildFHSEnv,
+  libselinux,
+  libarchive,
+  libGL,
+  xorg,
+  zlib,
+  # Conda installs its packages and environments under this directory
+  installationPath ? "~/.conda",
+  # Conda manages most pkgs itself, but expects a few to be on the system.
+  condaDeps ? [
+    stdenv.cc
+    xorg.libSM
+    xorg.libICE
+    xorg.libX11
+    xorg.libXau
+    xorg.libXi
+    xorg.libXrender
+    libselinux
+    libGL
+    zlib
+  ],
+  # Any extra nixpkgs you'd like available in the FHS env for Conda to use
+  extraPkgs ? [ ],
 }:

 # How to use this package?
@ -31,10 +43,10 @@
 # $ conda-shell
 # $ conda install spyder
 let
-  version = "4.11.0";
+  version = "24.9.2";
  src = fetchurl {
-      url = "https://repo.continuum.io/miniconda/Miniconda3-py39_${version}-Linux-x86_64.sh";
-      sha256 = "sha256-TunDqlMynNemO0mHfAurtJsZt+WvKYB7eTp2vbHTYrQ=";
+    url = "https://repo.anaconda.com/miniconda/Miniconda3-py312_${version}-0-Linux-x86_64.sh";
+    hash = "sha256-jZNrpgAwDgjso9h03uiMYcbzkwNZeytmuu5Ur097QSI=";
  };
  conda = (
    let
@ -42,57 +54,68 @@ let
        zlib # libz.so.1
      ];
    in
-      runCommand "conda-install" { nativeBuildInputs = [ makeWrapper ]; buildInputs = [ zlib]; }
-        # on line 10, we have 'unset LD_LIBRARY_PATH'
-        # we have to comment it out however in a way that the number of bytes in the
-        # file does not change. So we replace the 'u' in the line with a '#'
-        # The reason is that the binary payload is encoded as number
-        # of bytes from the top of the installer script
-        # and unsetting the library path prevents the zlib library from being discovered
-        ''
-          mkdir -p $out/bin
+    runCommand "conda-install"
+      {
+        nativeBuildInputs = [ makeWrapper ];
+        buildInputs = [ zlib ];
+      }
+      # on line 10, we have 'unset LD_LIBRARY_PATH'
+      # we have to comment it out however in a way that the number of bytes in the
+      # file does not change. So we replace the 'u' in the line with a '#'
+      # The reason is that the binary payload is encoded as number
+      # of bytes from the top of the installer script
+      # and unsetting the library path prevents the zlib library from being discovered
+      ''
+        mkdir -p $out/bin

-          sed 's/unset LD_LIBRARY_PATH/#nset LD_LIBRARY_PATH/' ${src} > $out/bin/miniconda-installer.sh
-          chmod +x $out/bin/miniconda-installer.sh
+        sed 's/unset LD_LIBRARY_PATH/#nset LD_LIBRARY_PATH/' ${src} > $out/bin/miniconda-installer.sh
+        chmod +x $out/bin/miniconda-installer.sh

-          makeWrapper                            \
-            $out/bin/miniconda-installer.sh      \
-            $out/bin/conda-install               \
-            --add-flags "-p ${installationPath}" \
-            --add-flags "-b"                     \
-            --prefix "LD_LIBRARY_PATH" : "${libPath}"
-        '');
+        makeWrapper                            \
+          $out/bin/miniconda-installer.sh      \
+          $out/bin/conda-install               \
+          --add-flags "-p ${installationPath}" \
+          --add-flags "-b"                     \
+          --prefix "LD_LIBRARY_PATH" : "${libPath}"
+      ''
+  );
 in
-  buildFHSEnv {
-    pname = "conda-shell";
-    inherit version;
-    targetPkgs = pkgs: (builtins.concatLists [ [ conda ] condaDeps extraPkgs]);
-    profile = ''
-      # Add conda to PATH
-      export PATH=${installationPath}/bin:$PATH
-      # Paths for gcc if compiling some C sources with pip
-      export NIX_CFLAGS_COMPILE="-I${installationPath}/include"
-      export NIX_CFLAGS_LINK="-L${installationPath}lib"
-      # Some other required environment variables
-      export FONTCONFIG_FILE=/etc/fonts/fonts.conf
-      export QTCOMPOSE=${xorg.libX11}/share/X11/locale
-      export LIBARCHIVE=${libarchive.lib}/lib/libarchive.so
-      # Allows `conda activate` to work properly
-      condaSh=${installationPath}/etc/profile.d/conda.sh
-      if [ ! -f $condaSh ]; then
-        conda-install
-      fi
-      source $condaSh
-    '';
+buildFHSEnv {
+  pname = "conda-shell";
+  inherit version;
+  targetPkgs =
+    pkgs:
+    (builtins.concatLists [
+      [ conda ]
+      condaDeps
+      extraPkgs
+    ]);
+  profile = ''
+    # Add conda to PATH
+    export PATH=${installationPath}/bin:$PATH
+    # Paths for gcc if compiling some C sources with pip
+    export NIX_CFLAGS_COMPILE="-I${installationPath}/include"
+    export NIX_CFLAGS_LINK="-L${installationPath}lib"
+    # Some other required environment variables
+    export FONTCONFIG_FILE=/etc/fonts/fonts.conf
+    export QTCOMPOSE=${xorg.libX11}/share/X11/locale
+    export LIBARCHIVE=${libarchive.lib}/lib/libarchive.so
+    # Allows `conda activate` to work properly
+    condaSh=${installationPath}/etc/profile.d/conda.sh
+    if [ ! -f $condaSh ]; then
+      conda-install
+    fi
+    source $condaSh
+  '';

-    runScript = "bash -l";
+  runScript = "bash -l";

-    meta = {
-      description = "Conda is a package manager for Python";
-      mainProgram = "conda-shell";
-      homepage = "https://conda.io/";
-      platforms = lib.platforms.linux;
-      license = lib.licenses.bsd3;
-      maintainers = with lib.maintainers; [ jluttine bhipple ];
-    };
-  }
+  meta = {
+    description = "Conda is a package manager for Python";
+    mainProgram = "conda-shell";
+    homepage = "https://conda.io/";
+    platforms = lib.platforms.linux;
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ jluttine ];
+  };
+}
--- a/pkgs/by-name/cs/csvlens/package.nix
+++ b/pkgs/by-name/cs/csvlens/package.nix
@ -7,20 +7,20 @@

 rustPlatform.buildRustPackage rec {
  pname = "csvlens";
-  version = "0.10.1";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "YS-L";
    repo = "csvlens";
    rev = "refs/tags/v${version}";
-    hash = "sha256-q4d3BE11LVAwA16+VEWLbZW/+pkbQ5/rp+pIAiuFTyg=";
+    hash = "sha256-JlyDw+VL/vpKTvvBlDIwVIovhKJX2pV4UTY47cLR1IE=";
  };

  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
    darwin.apple_sdk.frameworks.AppKit
  ];

-  cargoHash = "sha256-eKREGxIBjzI3viieOnRRUAf+4zqKLi24Hn1aOFns8IQ=";
+  cargoHash = "sha256-PhAEVTlrTF5tj08x8B2vvfEtJadqWtC9rZT8qr0UXB4=";

  meta = with lib; {
    description = "Command line csv viewer";
--- a/pkgs/by-name/de/deno/package.nix
+++ b/pkgs/by-name/de/deno/package.nix
@ -19,16 +19,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "deno";
-  version = "2.1.2";
+  version = "2.1.3";

  src = fetchFromGitHub {
    owner = "denoland";
    repo = "deno";
    rev = "refs/tags/v${version}";
-    hash = "sha256-jbIJmJV1ez+K+48LZPOqgd1d8UABZBK6/6AVc9wdTe4=";
+    hash = "sha256-q4cBkmNekJnFVirD1r5LVFq94ZXOk8wnWoxw0+9LdNQ=";
  };

-  cargoHash = "sha256-adAj4l0LEedsdOUgOFzmdIPvXukAhsjxc75srvN1RRU=";
+  cargoHash = "sha256-/HKXRQjQ1ToA80jouWXL0lDY19fnqDCjRifjpce9tTw=";

  postPatch = ''
    # upstream uses lld on aarch64-darwin for faster builds
--- a/pkgs/by-name/do/dooit/package.nix
+++ b/pkgs/by-name/do/dooit/package.nix
@ -12,14 +12,14 @@ let
 in
 python3.pkgs.buildPythonApplication rec {
  pname = "dooit";
-  version = "3.0.4";
+  version = "3.1.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "dooit-org";
    repo = "dooit";
    rev = "refs/tags/v${version}";
-    hash = "sha256-gWpmjpgAn37hfNv4aCCb+7pW/39Ngo8/Za9AdU4YCKA=";
+    hash = "sha256-tqSWDW3nj+nMt7t5vgSqWvtx7YA3y2GV29gI1MYFMhc=";
  };

  build-system = with python3.pkgs; [ poetry-core ];
--- a/pkgs/by-name/dr/drm_info/package.nix
+++ b/pkgs/by-name/dr/drm_info/package.nix
@ -1,28 +1,52 @@
-{ lib, stdenv, fetchFromGitHub
-, libdrm, json_c, pciutils
-, meson, ninja, pkg-config
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  libdrm,
+  json_c,
+  pciutils,
+  meson,
+  ninja,
+  pkg-config,
+  scdoc,
+  nix-update-script,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "drm_info";
-  version = "2.3.0";
+  version = "2.7.0";

-  src = fetchFromGitHub {
-    owner = "ascent12";
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "emersion";
    repo = "drm_info";
-    rev = "v${version}";
-    sha256 = "sha256-UTDYLe3QezPCyG9CIp+O+KX716JDTL9mn+OEjjyTwlg=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-pgYhZtmyhuhxBiiTRdrEp/YsuwrD6KK/ahfO2L3mfM8=";
  };

-  nativeBuildInputs = [ meson ninja pkg-config ];
-  buildInputs = [ libdrm json_c pciutils ];
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    scdoc
+  ];
+
+  buildInputs = [
+    libdrm
+    json_c
+    pciutils
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };

  meta = with lib; {
    description = "Small utility to dump info about DRM devices";
    mainProgram = "drm_info";
-    homepage = "https://github.com/ascent12/drm_info";
-    license = licenses.mit;
-    maintainers = [ ];
+    homepage = "https://gitlab.freedesktop.org/emersion/drm_info";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ kiskae ];
    platforms = platforms.linux;
  };
-}
+})
--- a/pkgs/by-name/ga/gama-tui/package.nix
+++ b/pkgs/by-name/ga/gama-tui/package.nix
@ -0,0 +1,36 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "gama-tui";
+  version = "1.1.4";
+
+  src = fetchFromGitHub {
+    owner = "termkit";
+    repo = "gama";
+    tag = "v${version}";
+    hash = "sha256-laE3lW2MX3vYxsF5iHl0sLKCAPRAIZGQs72+vdbX4t0=";
+  };
+
+  vendorHash = "sha256-rx18df0iiYqQToydXcA6Kqsn3lePIL1RNMSvD+a4WrI=";
+
+  ldflags = [
+    "-s"
+    "-X main.Version=v${version}"
+  ];
+
+  # requires network access
+  doCheck = false;
+
+  meta = {
+    description = "Manage your GitHub Actions from Terminal with great UI";
+    homepage = "https://github.com/termkit/gama";
+    changelog = "https://github.com/termkit/gama/releases";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ phanirithvij ];
+    mainProgram = "gama";
+  };
+}
--- a/pkgs/by-name/gi/github-runner/package.nix
+++ b/pkgs/by-name/gi/github-runner/package.nix
@ -243,7 +243,7 @@ buildDotnetModule rec {
    + lib.optionalString stdenv.hostPlatform.isLinux ''
      substituteInPlace $out/lib/github-runner/config.sh \
        --replace 'command -v ldd' 'command -v ${glibc.bin}/bin/ldd' \
-        --replace 'ldd ./bin' '${glibc.bin}/bin/ldd ${dotnet-runtime}/shared/Microsoft.NETCore.App/${dotnet-runtime.version}/' \
+        --replace 'ldd ./bin' '${glibc.bin}/bin/ldd ${dotnet-runtime}/share/dotnet/shared/Microsoft.NETCore.App/${dotnet-runtime.version}/' \
        --replace '/sbin/ldconfig' '${glibc.bin}/bin/ldconfig'
    ''
    + ''
--- a/pkgs/by-name/go/gocovsh/package.nix
+++ b/pkgs/by-name/go/gocovsh/package.nix
@ -0,0 +1,41 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  testers,
+  gocovsh, # self
+}:
+
+buildGoModule rec {
+  pname = "gocovsh";
+  version = "0.6.1";
+
+  src = fetchFromGitHub {
+    owner = "orlangure";
+    repo = "gocovsh";
+    tag = "v${version}";
+    hash = "sha256-VZNu1uecFVVDgF4xDLTgkCahUWbM+1XASV02PEUfmr0=";
+  };
+
+  vendorHash = "sha256-Fb7BIWojOSUIlBdjIt57CSvF1a+x33sB45Z0a86JMUg=";
+
+  ldflags = [
+    "-s"
+    "-X main.version=${version}"
+    "-X main.commit=v${version}"
+    "-X main.date=19700101T000000Z"
+  ];
+
+  passthru.tests.version = testers.testVersion { package = gocovsh; };
+
+  meta = {
+    description = "Go Coverage in your terminal: a tool for exploring Go Coverage reports from the command line";
+    homepage = "https://github.com/orlangure/gocovsh";
+    changelog = "https://github.com/orlangure/gocovsh/releases";
+    # https://github.com/orlangure/gocovsh/blob/8880bc63283c13a1d630ce3817c7165a6c210d46/.goreleaser.yaml#L33
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ phanirithvij ];
+    mainProgram = "gocovsh";
+  };
+}
--- a/pkgs/by-name/go/golds/info_module-gover.patch
+++ b/pkgs/by-name/go/golds/info_module-gover.patch
@ -0,0 +1,25 @@
+diff --git a/internal/server/info_module.go b/internal/server/info_module.go
+index d2513bd..ad2921e 100644
+--- a/internal/server/info_module.go
+++ b/internal/server/info_module.go
+@@ -8,6 +8,7 @@ import (
+ 	"io/ioutil"
+ 	"log"
+ 	"os"
+	"os/exec"
+ 	"path/filepath"
+ 	"regexp"
+ 	"strings"
+@@ -756,7 +757,11 @@ func findGoToolchainVersionFromGoRoot(goroot string) (string, error) {
+ 		versionData, err = ioutil.ReadFile(filepath.Join(goroot, "VERSION.cache"))
+ 	}
+ 	if err != nil {
+-		return "", fmt.Errorf("failed to get Go toolchain version in GOROOT (%s)", goroot)
+		cmd := exec.Command("go", "env", "GOVERSION")
+		versionData, err = cmd.Output()
+		if err != nil {
+			return "", fmt.Errorf("failed to get Go toolchain version in GOROOT (%s)", goroot)
+		}
+ 	}
+ 	matches := findGoVersionRegexp.FindSubmatch(versionData)
+ 	if len(matches) >= 1 {
--- a/pkgs/by-name/go/golds/package.nix
+++ b/pkgs/by-name/go/golds/package.nix
@ -0,0 +1,42 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  testers,
+  golds, # self
+}:
+
+buildGoModule rec {
+  pname = "golds";
+  version = "0.7.1";
+
+  src = fetchFromGitHub {
+    owner = "go101";
+    repo = "golds";
+    tag = "v${version}";
+    hash = "sha256-6YkyKJtSAFFYidMlZXSjNpjyIIaTlibg/QMMin/NbU0=";
+  };
+
+  # nixpkgs is not using the go distpack archive and missing a VERSION file in the source
+  # but we can use go env to get the same information
+  # https://github.com/NixOS/nixpkgs/pull/358316#discussion_r1855322027
+  patches = [ ./info_module-gover.patch ];
+
+  vendorHash = "sha256-omjHRZB/4VzPhc6RrFY11s6BRD69+Y4RRZ2XdeKbZf0=";
+
+  ldflags = [ "-s" ];
+
+  passthru.tests.version = testers.testVersion {
+    package = golds;
+    version = "v${version}";
+  };
+
+  meta = {
+    description = "Experimental Go local docs server/generator and code reader implemented with some fresh ideas";
+    homepage = "https://github.com/go101/golds";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ phanirithvij ];
+    mainProgram = "golds";
+  };
+}
--- a/pkgs/by-name/im/immich/sources.json
+++ b/pkgs/by-name/im/immich/sources.json
@ -1,22 +1,22 @@
 {
-  "version": "1.122.1",
-  "hash": "sha256-wpqmaMT2yIlwihUB3q8TKCrhhikf09pNJQJ9HsloHR4=",
+  "version": "1.122.2",
+  "hash": "sha256-A6FmveHN+Kp8SFmdaMLiwZ5SLuqQSWMwZVVpMBvfoAU=",
  "components": {
    "cli": {
-      "npmDepsHash": "sha256-a6BK3A9Qlm0ygTRXSgqwzLv/KGyKFdeDfvSraayRC2U=",
-      "version": "2.2.34"
+      "npmDepsHash": "sha256-ItF8xSvxjbRV57Q2B0c7zSTULIWilvDjndmt9mfm7sE=",
+      "version": "2.2.35"
    },
    "server": {
-      "npmDepsHash": "sha256-dTKtuMhO1K/inQZFLCGxg6VlBDPC35x+AEMFLR3kH9w=",
-      "version": "1.122.1"
+      "npmDepsHash": "sha256-LuQNK0RsmCNcxullGZw2YD92j6mbKrgiHjQB6g5Z4bo=",
+      "version": "1.122.2"
    },
    "web": {
-      "npmDepsHash": "sha256-YKEbylbrsrjnUKDBSOZLz8iZWpcKfQtyRxrKG0TR4y0=",
-      "version": "1.122.1"
+      "npmDepsHash": "sha256-G1Q3jxNrH2XnYdcu33hu4XQnhxPlxoFQYgMB0E/K6nw=",
+      "version": "1.122.2"
    },
    "open-api/typescript-sdk": {
-      "npmDepsHash": "sha256-ou/o1NNpA3rOZTBwxXDmegUelC6praXB1muiu391BzM=",
-      "version": "1.122.1"
+      "npmDepsHash": "sha256-qK6rT1W/aDU8DlIFbSZ0gqCIohr7DWsdVknmvehwpJE=",
+      "version": "1.122.2"
    }
  }
 }
--- a/pkgs/by-name/jo/jotdown/package.nix
+++ b/pkgs/by-name/jo/jotdown/package.nix
@ -5,16 +5,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "jotdown";
-  version = "0.6.0";
+  version = "0.7.0";

  src = fetchFromGitHub {
    owner = "hellux";
    repo = "jotdown";
    rev = version;
-    hash = "sha256-67foqp8i5JqvtKeq8gibFhd59V8Nf8wkaINe2gd5Huk=";
+    hash = "sha256-1s0J6TF/iDSqKUF4/sgq2irSPENjinftPFZnMgE8Dn8=";
  };

-  cargoHash = "sha256-ckcjd8ZiJxfKEkpfGvTSKv3ReWn3lIK+/fBnj/kk2F0=";
+  cargoHash = "sha256-gsrwC7X1pnr9ZQDqq0SnNxYHFdRI9VRuIQtA1s7Yz7A=";

  meta = with lib; {
    description = "Minimal Djot CLI";
--- a/pkgs/by-name/ke/keka/package.nix
+++ b/pkgs/by-name/ke/keka/package.nix
@ -1,38 +1,37 @@
-{ lib
-, stdenvNoCC
-, fetchurl
-, unzip
-, makeWrapper
+{
+  lib,
+  stdenvNoCC,
+  fetchzip,
+  makeWrapper,
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "keka";
-  version = "1.3.2";
+  version = "1.4.6";

-  src = fetchurl {
+  src = fetchzip {
    url = "https://github.com/aonez/Keka/releases/download/v${finalAttrs.version}/Keka-${finalAttrs.version}.zip";
-    sha256 = "0id8j639kba5yc0z34lgvadzgv9z9s2573nn6dx9m6gd8qpnk2x7";
+    hash = "sha256-IgPnXHVtAaSOsaAYvo0ELRqvXpF2qAnJ/1QZ+FHzqn4=";
  };
-  dontUnpack = true;

-  nativeBuildInputs = [ unzip makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];

  installPhase = ''
    runHook preInstall

    mkdir -p $out/Applications $out/bin
-    unzip -d $out/Applications $src
+    cp -r . $out/Applications/Keka.app
    makeWrapper $out/Applications/Keka.app/Contents/MacOS/Keka $out/bin/keka \
      --add-flags "--cli"

    runHook postInstall
  '';

-  meta = with lib; {
+  meta = {
    description = "macOS file archiver";
    homepage = "https://www.keka.io";
-    license = licenses.unfree;
+    license = lib.licenses.unfree;
    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    maintainers = with maintainers; [ emilytrau ];
-    platforms = platforms.darwin;
+    maintainers = with lib.maintainers; [ emilytrau ];
+    platforms = lib.platforms.darwin;
  };
 })
--- a/pkgs/by-name/ke/keymapper/package.nix
+++ b/pkgs/by-name/ke/keymapper/package.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "keymapper";
-  version = "4.9.0";
+  version = "4.9.1";

  src = fetchFromGitHub {
    owner = "houmain";
    repo = "keymapper";
    rev = finalAttrs.version;
-    hash = "sha256-GckqlKpF1N7Khq/9ju1IG1+jfPBuWhFAHhYnlCMC5Cw=";
+    hash = "sha256-i/iAOj2fdC4XeC3XbQU0BPoY36Ccva5YaYIvDdrmCD8=";
  };

  # all the following must be in nativeBuildInputs
--- a/pkgs/by-name/ki/kimai/package.nix
+++ b/pkgs/by-name/ki/kimai/package.nix
@ -7,13 +7,13 @@

 php.buildComposerProject (finalAttrs: {
  pname = "kimai";
-  version = "2.24.0";
+  version = "2.26.0";

  src = fetchFromGitHub {
    owner = "kimai";
    repo = "kimai";
    rev = finalAttrs.version;
-    hash = "sha256-C6i263sAfZwZELUIcZh/OmXZqgCKifjPYBafnH0wMC4=";
+    hash = "sha256-594oc7vAa5BPnk7RaSbWTFreu/DDIYE1lxpPQ+aZsn0=";
  };

  php = php.buildEnv {
@ -39,7 +39,7 @@ php.buildComposerProject (finalAttrs: {
    '';
  };

-  vendorHash = "sha256-3y3FfSUuDyBGP1dsuzDORDqFNj3jYix5ArM+2FS4gn4=";
+  vendorHash = "sha256-OIIzpdH/kU8l4X3ClYh8lQ/XGh/2/LljSFI03rUjnuI=";

  composerNoPlugins = false;
  composerNoScripts = false;
--- a/pkgs/by-name/ku/kubectl-explore/package.nix
+++ b/pkgs/by-name/ku/kubectl-explore/package.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "kubectl-explore";
-  version = "0.10.0";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "keisku";
    repo = "kubectl-explore";
    rev = "v${version}";
-    hash = "sha256-2X32OYapJsxyctRMdT6WY+eni8y+jzd/6q7JNubJ/H4=";
+    hash = "sha256-RCLOqe4Ptac2YVDjWYG5H5geUMUsmh6klQfk92XvjI4=";
  };

  vendorHash = "sha256-7KTs41zPf07FdUibsq57vJ2fkqOaVeBR6iSTJm5Fth0=";
--- a/pkgs/by-name/ku/kubeshark/package.nix
+++ b/pkgs/by-name/ku/kubeshark/package.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "kubeshark";
-  version = "52.3.89";
+  version = "52.3.91";

  src = fetchFromGitHub {
    owner = "kubeshark";
    repo = "kubeshark";
    rev = "v${version}";
-    hash = "sha256-v5XxvY3omO9h1xtm+VSVP/zrU8uRJXvwSdxScAujWOU=";
+    hash = "sha256-xkfEhCkG2qnoMZ7l48mK56PemtQBHK46p4jLxR9GHxc=";
  };

  vendorHash = "sha256-kzyQW4bVE7oMOlHVG7LKG1AMTRYa5GLiiEhdarIhMSo=";
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@ -69,13 +69,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
  pname = "llama-cpp";
-  version = "4154";
+  version = "4293";

  src = fetchFromGitHub {
    owner = "ggerganov";
    repo = "llama.cpp";
    rev = "refs/tags/b${finalAttrs.version}";
-    hash = "sha256-rttgk8mF9s3R53+TN5+PdDtkTG5cohn/9wz9Z5gRpdM=";
+    hash = "sha256-ab45VNNJvzp6t8Bk2GSuTBsP4bWcyOT4d+TvaIHs5qo=";
    leaveDotGit = true;
    postFetch = ''
      git -C "$out" rev-parse --short HEAD > $out/COMMIT
--- a/pkgs/by-name/lt/ltex-ls-plus/package.nix
+++ b/pkgs/by-name/lt/ltex-ls-plus/package.nix
@ -0,0 +1,45 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  makeBinaryWrapper,
+  jre_headless,
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "ltex-ls-plus";
+  version = "18.3.0";
+
+  src = fetchurl {
+    url = "https://github.com/ltex-plus/ltex-ls-plus/releases/download/${version}/ltex-ls-plus-${version}.tar.gz";
+    sha256 = "sha256-TV8z8nYz2lFsL86yxpIWDh3hDEZn/7P0kax498oicls=";
+  };
+
+  nativeBuildInputs = [ makeBinaryWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    cp -rfv bin/ lib/ $out
+    rm -fv $out/bin/.lsp-cli.json $out/bin/*.bat
+    for file in $out/bin/{ltex-ls-plus,ltex-cli-plus}; do
+      wrapProgram $file --set JAVA_HOME "${jre_headless}"
+    done
+
+    runHook postInstall
+  '';
+
+  meta =
+    let
+      inherit (lib) licenses maintainers;
+    in
+    {
+      homepage = "https://ltex-plus.github.io/ltex-plus/";
+      description = "LSP language server for LanguageTool";
+      license = licenses.mpl20;
+      mainProgram = "ltex-cli-plus";
+      maintainers = [ maintainers.FirelightFlagboy ];
+      platforms = jre_headless.meta.platforms;
+    };
+}
--- a/pkgs/by-name/mg/mgba/package.nix
+++ b/pkgs/by-name/mg/mgba/package.nix
@ -27,13 +27,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "mgba";
-  version = "0.10.3";
+  version = "0.10.4";

  src = fetchFromGitHub {
    owner = "mgba-emu";
    repo = "mgba";
    rev = finalAttrs.version;
-    hash = "sha256-wSt3kyjRxKBnDOVY10jq4cpv7uIaBUIcsZr6aU7XnMA=";
+    hash = "sha256-GATjKpY4EYgep4uquBuaxDsS13aIoxVicAYs/KAs1lE=";
  };

  outputs = [ "out" "dev" "doc" "lib" "man" ];
--- a/pkgs/by-name/mo/mopac/package.nix
+++ b/pkgs/by-name/mo/mopac/package.nix
@ -12,13 +12,13 @@ assert blas.isILP64 == lapack.isILP64;

 stdenv.mkDerivation rec {
  pname = "mopac";
-  version = "23.0.2";
+  version = "23.0.3";

  src = fetchFromGitHub {
    owner = "openmopac";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-FHJ8R8s82qSt4l6IawODkHhk2jitcxjUXCgZOU9iXDM=";
+    hash = "sha256-y9/b+ro9CgDo0ld9q+3xaCFE9J5ssZp6W9ct6WQgD/o=";
  };

  nativeBuildInputs = [ gfortran cmake ];
--- a/pkgs/by-name/my/mystmd/package.nix
+++ b/pkgs/by-name/my/mystmd/package.nix
@ -2,16 +2,16 @@

 buildNpmPackage rec {
  pname = "mystmd";
-  version = "1.3.17";
+  version = "1.3.18";

  src = fetchFromGitHub {
    owner = "executablebooks";
    repo = "mystmd";
    rev = "mystmd@${version}";
-    hash = "sha256-T6Yx4CU1JMCbX0YLF0WnmFPo5DfX/yFrUDUhVn37o3s=";
+    hash = "sha256-20Cxs4ib7xRn4UC9ShiQ+KnyrTCmW/vII7QN9BObY78=";
  };

-  npmDepsHash = "sha256-FMyIESq78/Uky0ko3B/mn0d0xKBxIzvwGOpxvVm5/7U=";
+  npmDepsHash = "sha256-dcjOxEYTG/EnBRu+RE7cpSEvNmG32QsDDYzItaNTpa0=";

  dontNpmInstall = true;

--- a/pkgs/by-name/ni/nixpacks/package.nix
+++ b/pkgs/by-name/ni/nixpacks/package.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "nixpacks";
-  version = "1.29.1";
+  version = "1.30.0";

  src = fetchFromGitHub {
    owner = "railwayapp";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-n4qPr3YL2DnnnUX/HqZ/2h7I4N8Du/dZ5Q2/N31q4R4=";
+    sha256 = "sha256-UFpTDZAPFZIoI0pOWZDhx7t/GhXNY4Xy1DtwvjPzSGs=";
  };

-  cargoHash = "sha256-Qo+yapjCrtov71dYRrKuWFsrUtlbOHsvsoMPzCBTIxI=";
+  cargoHash = "sha256-ecrAaix3dsCa6nTvZ1jqAwW5N/7lF+0MclXkk7zt2zk=";

  # skip test due FHS dependency
  doCheck = false;
--- a/pkgs/by-name/ny/nym/Cargo.lock
+++ b/pkgs/by-name/ny/nym/Cargo.lock
--- a/pkgs/by-name/ny/nym/package.nix
+++ b/pkgs/by-name/ny/nym/package.nix
@ -13,13 +13,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "nym";
-  version = "2024.12-aero";
+  version = "2024.13-magura-patched";

  src = fetchFromGitHub {
    owner = "nymtech";
    repo = "nym";
-    rev = "nym-binaries-v${version}";
-    hash = "sha256-bUY0ctfE1i0pjqdT/LT43FB9rDO5OKBVaTckm5qxnms=";
+    tag = "nym-binaries-v${version}";
+    hash = "sha256-N9nnDtTIvKJX1wpiAEJ2X7Dv5Qc5V6CiTR/TjJAnv3s=";
  };

  swagger-ui = fetchurl {
@ -27,36 +27,21 @@ rustPlatform.buildRustPackage rec {
    hash = "sha256-SBJE0IEgl7Efuu73n3HZQrFxYX+cn5UU5jrL4T5xzNw=";
  };

-  cargoLock = {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "bls12_381-0.8.0" = "sha256-4+X/ZQ5Z+Nax4Ot1JWWvvLxuIUaucHkfnDB2L+Ak7Ro=";
-      "cosmos-sdk-proto-0.22.0-pre" = "sha256-nRfcAbjFcvAqool+6heYK8joiU5YaSWITnO6S5MRM1E=";
-      "defguard_wireguard_rs-0.4.7" = "sha256-+5m1+XGJ6Fi8v6rgjt0jRmwIruIL+OPP7zq/+166WMw=";
-      "indexed_db_futures-0.4.2" = "sha256-vVqrD40CBdSSEtU+kQeuZUfsgpJdl8ks+os0Fct8Ung=";
-    };
-  };
+  cargoHash = "sha256-tkP65GG1E5356lePLVrZdPqx/b9k1lgJ1LoxCgQf08k=";
+  useFetchCargoVendor = true;

  env = {
    SWAGGER_UI_DOWNLOAD_URL = "file://${swagger-ui}";
+    OPENSSL_NO_VENDOR = true;
  };

  nativeBuildInputs = [
    pkg-config
  ];

-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        Security
-        SystemConfiguration
-        CoreServices
-      ]
-    );
+  buildInputs = [
+    openssl
+  ];

  checkType = "debug";

@ -82,6 +67,7 @@ rustPlatform.buildRustPackage rec {
      Nym routes IP packets through other participating nodes to hide their source and destination.
      In contrast with Tor, it prevents timing attacks at the cost of latency.
    '';
+    changelog = "https://github.com/nymtech/nym/releases/tag/nym-binaries-v${version}";
    homepage = "https://nymtech.net";
    license = lib.licenses.asl20;
    platforms = lib.platforms.all;
--- a/pkgs/by-name/pi/picocrypt-cli/package.nix
+++ b/pkgs/by-name/pi/picocrypt-cli/package.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "picocrypt-cli";
-  version = "2.09";
+  version = "2.10";

  src = fetchFromGitHub {
    owner = "Picocrypt";
    repo = "CLI";
    rev = version;
-    hash = "sha256-DV+L3s479PqSiqi2xigZWwXVNCdkayD0wCpnlR0TljY=";
+    hash = "sha256-a9fRbI3yv+K44/TIMqZMgZXRKN/Rh2AJyeTDhJynr4M=";
  };

  sourceRoot = "${src.name}/picocrypt";
--- a/pkgs/by-name/pk/pkgsite/package.nix
+++ b/pkgs/by-name/pk/pkgsite/package.nix
@ -0,0 +1,34 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildGoModule rec {
+  pname = "pkgsite";
+  version = "0-unstable-2024-12-06";
+
+  src = fetchFromGitHub {
+    owner = "golang";
+    repo = "pkgsite";
+    rev = "37884bfc1a9e2aa46989ac56e671bcbd240bb4f7";
+    hash = "sha256-RZTRfB1mEM13x/vLrxu7877C7Zh/kJxpYMP9xR2OOXw=";
+  };
+
+  vendorHash = "sha256-Ijcj1Nq4WjXcUqmoDkpO9I4rl/4/TMXFMQVAlEK11R8=";
+
+  subPackages = [ "cmd/pkgsite" ];
+
+  ldflags = [ "-s" ];
+
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+
+  meta = {
+    description = "Official tool to extract and generate documentation for Go projects like pkg.go.dev";
+    homepage = "https://github.com/golang/pkgsite";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ phanirithvij ];
+    mainProgram = "pkgsite";
+  };
+}
--- a/pkgs/by-name/po/pocketbase/package.nix
+++ b/pkgs/by-name/po/pocketbase/package.nix
@ -1,21 +1,22 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
-, nix-update-script
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
 }:

 buildGoModule rec {
  pname = "pocketbase";
-  version = "0.23.1";
+  version = "0.23.4";

  src = fetchFromGitHub {
    owner = "pocketbase";
    repo = "pocketbase";
    rev = "v${version}";
-    hash = "sha256-he4lvlIqbIozbtMizZEjfnBbXXd6+LfZqKD95UE8sPI=";
+    hash = "sha256-FBxMDEqq1ZsGIVCiW7FQrrCeIupVxooZ/TcVCACdQdQ=";
  };

-  vendorHash = "sha256-zMHEArUS4/r7nkZfDK8BwGMLrpkBihxhkBoO/p6auTk=";
+  vendorHash = "sha256-VRJj/NQyHECokPgrqT1piumAKCZLgorPov7AqSbEAxo=";

  # This is the released subpackage from upstream repo
  subPackages = [ "examples/base" ];
@ -39,7 +40,10 @@ buildGoModule rec {
    description = "Open Source realtime backend in 1 file";
    homepage = "https://github.com/pocketbase/pocketbase";
    license = licenses.mit;
-    maintainers = with maintainers; [ dit7ya thilobillerbeck ];
+    maintainers = with maintainers; [
+      dit7ya
+      thilobillerbeck
+    ];
    mainProgram = "pocketbase";
  };
 }
--- a/pkgs/by-name/pu/puncia/package.nix
+++ b/pkgs/by-name/pu/puncia/package.nix
@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "puncia";
-  version = "0.24";
+  version = "0.25";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "ARPSyndicate";
    repo = "puncia";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-4PJyAYPRsqay5Y9RxhOpUgIJvntVKokqYhE1b+hVc44=";
+    tag = "v${version}";
+    hash = "sha256-+RA7vAp2bjyZYIe0oyDeTQx89Gl3UEP4D3uSNVlF3i0=";
  };

  build-system = with python3.pkgs; [ setuptools ];
--- a/pkgs/by-name/py/pyspread/package.nix
+++ b/pkgs/by-name/py/pyspread/package.nix
@ -9,10 +9,10 @@
 let
  # get rid of rec
  pname = "pyspread";
-  version = "2.3";
+  version = "2.3.1";
  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-vbDZo/kYtnxmOd3JSEG9+0yD0nfM/BGcAySfBD2xogw=";
+    hash = "sha256-l6b02CIUqPnT16zqOWl6gDdAobkhiqBMFvT+R1Dvtek=";
  };
  inherit (libsForQt5)
    qtsvg
--- a/pkgs/by-name/ra/railway/package.nix
+++ b/pkgs/by-name/ra/railway/package.nix
@ -12,16 +12,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "railway";
-  version = "3.18.0";
+  version = "3.19.1";

  src = fetchFromGitHub {
    owner = "railwayapp";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-KMmiVA6ubwX8n2MVBOTfsT+05ii89DToMSxpINuizEc=";
+    hash = "sha256-eV66O5JG5ME046/1rM9GjF3rWioXq2RspFJxMWf5l/k=";
  };

-  cargoHash = "sha256-sDDNZAUt+4H1smA+8Pynu1EQtAdP2U6nHwC7AWo5gnk=";
+  cargoHash = "sha256-p6FZCJ+Uwkf7CLTsVKn4eYGCmgmlzCDpt6tylM5FWzo=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/by-name/ro/rocksdb/package.nix
+++ b/pkgs/by-name/ro/rocksdb/package.nix
@ -19,13 +19,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "rocksdb";
-  version = "9.7.3";
+  version = "9.7.4";

  src = fetchFromGitHub {
    owner = "facebook";
    repo = "rocksdb";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-HeC7m9ZK7SIU7adkQEurzHf+MY7AiEwXZQaz9uZZncU=";
+    hash = "sha256-u5uuShM2SxHc9/zL4UU56IhCcR/ZQbzde0LgOYS44bM=";
  };

  patches = lib.optional (lib.versionAtLeast finalAttrs.version "6.29.3" && enableLiburing) ./fix-findliburing.patch;
--- a/pkgs/by-name/se/secp256k1/package.nix
+++ b/pkgs/by-name/se/secp256k1/package.nix
@ -7,13 +7,13 @@
 stdenv.mkDerivation rec {
  pname = "secp256k1";

-  version = "0.5.1";
+  version = "0.6.0";

  src = fetchFromGitHub {
    owner = "bitcoin-core";
    repo = "secp256k1";
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-IYvvBob8e82EiPLX9yA8fd+KWrMri1rI5csp81rAdrg=";
+    sha256 = "sha256-pCSNUSrPyN/lLYZm7zK/b9LICkThXOr6JAyFvHZSPW0=";
  };

  nativeBuildInputs = [ autoreconfHook ];
--- a/pkgs/by-name/sh/shotcut/package.nix
+++ b/pkgs/by-name/sh/shotcut/package.nix
@ -19,13 +19,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "shotcut";
-  version = "24.10.13";
+  version = "24.11.17";

  src = fetchFromGitHub {
    owner = "mltframework";
    repo = "shotcut";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-lt8NXjh222h6l+zfGNKGntUNPya4TUjwqA74DDdWzQo=";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-sOBGLQYRGHcXNoKTmqbBqmheUFHe7p696BTCiwtF5JY=";
  };

  nativeBuildInputs = [
@ -49,6 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Cocoa ];

  env.NIX_CFLAGS_COMPILE = "-DSHOTCUT_NOUPGRADE";
+
  cmakeFlags = [ "-DSHOTCUT_VERSION=${finalAttrs.version}" ];

  patches = [
@ -74,7 +75,7 @@ stdenv.mkDerivation (finalAttrs: {

  passthru.updateScript = gitUpdater { rev-prefix = "v"; };

-  meta = with lib; {
+  meta = {
    description = "Free, open source, cross-platform video editor";
    longDescription = ''
      An official binary for Shotcut, which includes all the
@ -86,12 +87,12 @@ stdenv.mkDerivation (finalAttrs: {
      please use the official build from shotcut.org instead.
    '';
    homepage = "https://shotcut.org";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [
      woffs
      peti
    ];
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
    mainProgram = "shotcut";
  };
 })
--- a/pkgs/by-name/sm/smbclient-ng/package.nix
+++ b/pkgs/by-name/sm/smbclient-ng/package.nix
@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "smbclient-ng";
-  version = "2.1.6";
+  version = "2.1.7";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "p0dalirius";
    repo = "smbclient-ng";
-    rev = "refs/tags/${version}";
-    hash = "sha256-T1OAiRL7AGMz12dFIPOESS77lVd62iaBt9vXCdzqJBQ=";
+    tag = version;
+    hash = "sha256-gZbXtgxB5GkypU6U2oe9miobBbwnz/eXs/yWkzVUCcc=";
  };

  pythonRelaxDeps = [
--- a/pkgs/by-name/so/sof-firmware/package.nix
+++ b/pkgs/by-name/so/sof-firmware/package.nix
@ -5,11 +5,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "sof-firmware";
-  version = "2024.09";
+  version = "2024.09.2";

  src = fetchurl {
    url = "https://github.com/thesofproject/sof-bin/releases/download/v${version}/sof-bin-${version}.tar.gz";
-    sha256 = "sha256-6kfZn4E1kAjQdhi8oQPPePgthOlAv+lBoor+B8jLxiA=";
+    sha256 = "sha256-huaEGlXx1tHJFQOoSCwbR128rezbYVG/oKwAldHYpSo=";
  };

  dontFixup = true; # binaries must not be stripped or patchelfed
--- a/pkgs/by-name/so/sopwith/package.nix
+++ b/pkgs/by-name/so/sopwith/package.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "sopwith";
-  version = "2.6.0";
+  version = "2.7.0";

  src = fetchFromGitHub {
    owner = "fragglet";
    repo = "sdl-sopwith";
    rev = "refs/tags/sdl-sopwith-${version}";
-    hash = "sha256-sjg61QgcQDSQ/qrR+4PEZIf8OOnGBZvUSLCKGpS1bwg=";
+    hash = "sha256-Ah6Nv39HkYvtD/Go37G3tHowEVGLvtueoBRpi7i9HLY=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/tc/tcount/package.nix
+++ b/pkgs/by-name/tc/tcount/package.nix
@ -0,0 +1,32 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "tcount";
+  version = "0-unstable-2023-04-20";
+
+  src = fetchFromGitHub {
+    owner = "rrethy";
+    repo = "tcount";
+    rev = "341d9aa29512257bf7dfd7e843d02fdcfd583387";
+    hash = "sha256-M4EvaX9qDBYeapeegp6Ki7FJLFosVR1B42QRAh5Eugo=";
+  };
+
+  useFetchCargoVendor = true;
+
+  cargoHash = "sha256-Sn7hu+2jQFd2u8tpfTxnEO+syrO96gfgz6ouHxJnpLg=";
+
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+
+  meta = {
+    description = "Count your code by tokens and patterns in the syntax tree. A tokei/scc/cloc alternative";
+    homepage = "https://github.com/rrethy/tcount";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ phanirithvij ];
+    mainProgram = "tcount";
+  };
+}
--- a/pkgs/by-name/ti/tippecanoe/package.nix
+++ b/pkgs/by-name/ti/tippecanoe/package.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "tippecanoe";
-  version = "2.70.0";
+  version = "2.72.0";

  src = fetchFromGitHub {
    owner = "felt";
    repo = "tippecanoe";
    rev = finalAttrs.version;
-    hash = "sha256-v2dLYW05SlUhLHdUfuf211vQe2xg+IIMS4mJteCzWLk=";
+    hash = "sha256-5Ox/2K9cls8lZ+C/Fh5VQmgNEtbdMW0mh4fhBl6ecP8=";
  };

  buildInputs = [ sqlite zlib ];
--- a/pkgs/by-name/to/toot/package.nix
+++ b/pkgs/by-name/to/toot/package.nix
@ -7,14 +7,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "toot";
-  version = "0.47.0";
+  version = "0.47.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "ihabunek";
    repo = "toot";
-    rev = "refs/tags/${version}";
-    hash = "sha256-TG98e/3X+bcNsx8ZR0Nv0VWlR/cJ7tzz46K7tYyoKsM=";
+    tag = version;
+    hash = "sha256-cdlLZL3XZDgEXbac3Kgm9o61SOpoZzWD6C1DDwj6eNo=";
  };

  nativeCheckInputs = with python3Packages; [ pytest ];
--- a/pkgs/by-name/ux/uxn/package.nix
+++ b/pkgs/by-name/ux/uxn/package.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "uxn";
-  version = "1.0-unstable-2024-10-19";
+  version = "1.0-unstable-2024-11-30";

  src = fetchFromSourcehut {
    owner = "~rabbits";
    repo = "uxn";
-    rev = "30ac4bdcb1efed3680f746fd8290f1aeb7a6fd27";
-    hash = "sha256-p+N5zOl9Gjd3C0Vx8t4B9njO1aQ8PTcik6WlsQPGKyU=";
+    rev = "ac3f9ccb20dcbd63180d121d0df43efa01a91a8f";
+    hash = "sha256-YHRdELTVf6BNa7HFu1buAG9HKRdpx++XjU60P2huY/Q=";
  };

  outputs = [ "out" "projects" ];
--- a/pkgs/by-name/v2/v2ray/package.nix
+++ b/pkgs/by-name/v2/v2ray/package.nix
@ -6,18 +6,18 @@

 buildGoModule rec {
  pname = "v2ray-core";
-  version = "5.20.0";
+  version = "5.22.0";

  src = fetchFromGitHub {
    owner = "v2fly";
    repo = "v2ray-core";
    rev = "v${version}";
-    hash = "sha256-9YPFgsU1XpdT+fRaJmEB3z5sKjkrG3aiRIV3r4cDLfE=";
+    hash = "sha256-fDlZFBq5TiyLEriZdPonF/ifwiOu3vYtXWzNlmAik38=";
  };

  # `nix-update` doesn't support `vendorHash` yet.
  # https://github.com/Mic92/nix-update/pull/95
-  vendorHash = "sha256-Z+jM02SzmpuZ3PXXqrLDIOWDhIh8AxMUr1S4A+du5LU=";
+  vendorHash = "sha256-9JJjpAvmeXBAauu58eQuE262XN1TIK2SwLUlPQBbwYA=";

  ldflags = [ "-s" "-w" ];

--- a/pkgs/by-name/vt/vtfedit/mimetype.xml
+++ b/pkgs/by-name/vt/vtfedit/mimetype.xml
@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<mime-info xmlns="http://www.freedesktop.org/standards/shared-mime-info">
+  <mime-type type="application/x-vtfedit">
+    <comment xml:lang="en">Valve Texture Format</comment>
+    <glob pattern="*.vtf"/>
+  </mime-type>
+</mime-info>
--- a/pkgs/by-name/vt/vtfedit/package.nix
+++ b/pkgs/by-name/vt/vtfedit/package.nix
@ -0,0 +1,80 @@
+{
+  lib,
+  stdenv,
+  fetchzip,
+  fetchurl,
+  makeDesktopItem,
+
+  copyDesktopItems,
+  makeWrapper,
+  wine,
+  winetricks,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "vtfedit";
+  version = "1.3.3";
+
+  src = fetchzip {
+    url = "https://nemstools.github.io/files/vtfedit${lib.replaceStrings [ "." ] [ "" ] version}.zip";
+    hash = "sha256-6a8YuxgYm7FB+2pFcZAMtE1db4hqpEk0z5gv2wHl9bI=";
+    stripRoot = false;
+  };
+
+  icon = fetchurl {
+    url = "https://web.archive.org/web/20230906220249im_/https://valvedev.info/tools/vtfedit/thumb.png";
+    hash = "sha256-Jpqo/s1wO2U5Z1DSZvADTfdH+8ycr0KF6otQbAE+jts=";
+  };
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    makeWrapper
+  ];
+
+  nativeRuntimeInputs = lib.makeBinPath [
+    wine
+    winetricks
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    mkdir -p $out/share/icons/hicolor/256x256/apps
+    mkdir -p $out/share/lib
+    mkdir -p $out/share/mime/packages
+
+    substitute ${./vtfedit.bash} $out/bin/vtfedit \
+      --replace-fail "@out@" "${placeholder "out"}" \
+      --replace-fail "@path@" "${nativeRuntimeInputs}"
+    chmod +x $out/bin/vtfedit
+
+    cp ${icon} $out/share/icons/hicolor/256x256/apps/vtfedit.png
+    cp -r ${if wine.meta.mainProgram == "wine64" then "x64" else "x86"}/* $out/share/lib
+    cp ${./mimetype.xml} $out/share/mime/packages/vtfedit.xml
+
+    runHook postInstall
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = pname;
+      desktopName = "VTFEdit";
+      exec = "vtfedit %f";
+      icon = "vtfedit";
+      terminal = false;
+      categories = [ "Graphics" ];
+      comment = meta.description;
+      mimeTypes = [ "application/x-vtfedit" ];
+    })
+  ];
+
+  meta = {
+    description = "VTF file viewer/editor";
+    homepage = "https://nemstools.github.io/pages/VTFLib.html";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.lgpl21Plus;
+    inherit (wine.meta) platforms;
+    maintainers = with lib.maintainers; [ paveloom ];
+  };
+}
--- a/pkgs/by-name/vt/vtfedit/vtfedit.bash
+++ b/pkgs/by-name/vt/vtfedit/vtfedit.bash
@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+
+set -e
+
+OUT="@out@"
+PATH="@path@:$PATH"
+
+PKGNAME="vtfedit"
+PKGBIN="$OUT/share/lib/VTFEdit.exe"
+
+export WINEDEBUG="-all"
+export WINEPREFIX="$HOME/.local/share/$PKGNAME/wine"
+
+if [[ ! -d "$WINEPREFIX" ]]; then
+  echo "Initialising the Wine prefix..."
+  WINEDLLOVERRIDES="mscoree=" winetricks -q winxp
+  echo "Installing DLLs..."
+  winetricks -q dlls dotnet20 vcrun2005
+fi
+
+wine "$PKGBIN" "$@"
--- a/pkgs/by-name/wl/wlink/package.nix
+++ b/pkgs/by-name/wl/wlink/package.nix
@ -12,14 +12,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "wlink";
-  version = "0.1.0";
+  version = "0.1.1";

  src = fetchCrate {
    inherit pname version;
-    hash = "sha256-YiplnKcebDVEHoSP8XTPl0qXUwu2g32M864wbc3dyX8=";
+    hash = "sha256-YxozhEJh/KBirlA6ymIEbJY3r7wYSeTL40W2xQLyue0=";
  };

-  cargoHash = "sha256-JZ10VhFbrjIOiKRrYltdcVnv315QasgmDWlMzUUmNhw=";
+  cargoHash = "sha256-l9oBwnI26hUgc0hStd7piYc4XD+9nFX6ylScmlhbA0w=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/by-name/ya/yadm/package.nix
+++ b/pkgs/by-name/ya/yadm/package.nix
@ -29,7 +29,7 @@ to support their use in yadm.

 resholve.mkDerivation rec {
  pname = "yadm";
-  version = "3.2.2";
+  version = "3.3.0";

  nativeBuildInputs = [ installShellFiles ];

@ -37,7 +37,7 @@ resholve.mkDerivation rec {
    owner  = "TheLocehiliosan";
    repo   = "yadm";
    rev    = version;
-    hash   = "sha256-GcuqMlE8oef9+LIqKoCotktU7GcgPBE9CTVrZ8bKhv4=";
+    hash   = "sha256-VQhfRtg9wtquJGjhB8fFQqHIJ5GViMfNQQep13ZH5SE=";
  };

  dontConfigure = true;
--- a/pkgs/desktops/mate/atril/default.nix
+++ b/pkgs/desktops/mate/atril/default.nix
@ -29,11 +29,11 @@

 stdenv.mkDerivation rec {
  pname = "atril";
-  version = "1.28.0";
+  version = "1.28.1";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "ztRyX26bccTqY2dr/DzDvgnSnboIqnp6uXlk4LQ1UWI=";
+    sha256 = "dMT0KXnz6tUt7yN2dEjQatf3FUIeA8m1CUBLCW3oGT4=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/compilers/graalvm/community-edition/graalvm-ce/hashes.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/graalvm-ce/hashes.nix
@ -1,22 +1,22 @@
 # Generated by update.sh script
 {
-  "version" = "23.0.0";
+  "version" = "23.0.1";
  "hashes" = {
    "aarch64-linux" = {
-      sha256 = "084b0xwadq3ppk1wfn56z17hm02vlqq6vzhj7vmqcb8injym7bj2";
-      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-23.0.0/graalvm-community-jdk-23.0.0_linux-aarch64_bin.tar.gz";
+      sha256 = "0q2y6dh09k9rnr8bfhshgzpjag9i34y703nmmmgvx29a2swnsias";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-23.0.1/graalvm-community-jdk-23.0.1_linux-aarch64_bin.tar.gz";
    };
    "x86_64-linux" = {
-      sha256 = "180jhfkdbpkh5znwmncyxrfcyv0ail16l8vxz6371ws8ym5vc3j4";
-      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-23.0.0/graalvm-community-jdk-23.0.0_linux-x64_bin.tar.gz";
+      sha256 = "0l996ahsyynj76qn7q3baxzzawdjqdy4vwmmav08j5jb0rs0lsp2";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-23.0.1/graalvm-community-jdk-23.0.1_linux-x64_bin.tar.gz";
    };
    "x86_64-darwin" = {
-      sha256 = "1ajdkm0f1gckyss9rp7i7gay8dh25azr37pd8f36hif8wlwbhf0k";
-      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-23.0.0/graalvm-community-jdk-23.0.0_macos-x64_bin.tar.gz";
+      sha256 = "045j0vcppq8znkdw4bzy483hcby54llh2ip1pj5r0s1a4clnq86q";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-23.0.1/graalvm-community-jdk-23.0.1_macos-x64_bin.tar.gz";
    };
    "aarch64-darwin" = {
-      sha256 = "16rapbc1az3c8dx83961yjra1j1rwg3i24dvgwixqd2is7v8g9fd";
-      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-23.0.0/graalvm-community-jdk-23.0.0_macos-aarch64_bin.tar.gz";
+      sha256 = "13zlaplrxq8bk61q1qmdflnzw7c2h8cy6rzyrmby8xb7sgryqhni";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-23.0.1/graalvm-community-jdk-23.0.1_macos-aarch64_bin.tar.gz";
    };
  };
 }
--- a/pkgs/development/libraries/c-blosc/2.nix
+++ b/pkgs/development/libraries/c-blosc/2.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "c-blosc2";
-  version = "2.15.1";
+  version = "2.15.2";

  src = fetchFromGitHub {
    owner = "Blosc";
    repo = "c-blosc2";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-g/MUgVWeVVREiHX59XYbhXjtigJesyooxjnEdKA844M=";
+    sha256 = "sha256-Xac0meyaHfdCIu0ut2ioPDFYtAGpOBRb/G8ZK/jmeJ4=";
  };

  # https://github.com/NixOS/nixpkgs/issues/144170
--- a/pkgs/development/python-modules/coincurve/default.nix
+++ b/pkgs/development/python-modules/coincurve/default.nix
@ -35,12 +35,6 @@ buildPythonPackage rec {
    hash = "sha256-NKx/iLuzFEu1UBuwa14x55Ab3laVAKEtX6dtoWi0dOg=";
  };

-  postPatch = ''
-    # don't try to load .dll files
-    cp -r --no-preserve=mode ${secp256k1.src} libsecp256k1
-    patchShebangs secp256k1/autogen.sh
-  '';
-
  build-system = [
    hatchling
    cffi
--- a/pkgs/development/python-modules/execnb/default.nix
+++ b/pkgs/development/python-modules/execnb/default.nix
@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "execnb";
-  version = "0.1.8";
+  version = "0.1.11";
  pyproject = true;

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-ZPSuqIkSVnmAA1HYNMUOTw+5Al9hKxo0ZQPvnVshgxI=";
+    hash = "sha256-67N2iK21Q0MAwlhnxpRLfKDFsAPLf1/az4nrff5M+Og=";
  };

  build-system = [ setuptools ];
--- a/pkgs/games/doom-ports/doomrunner/default.nix
+++ b/pkgs/games/doom-ports/doomrunner/default.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "doomrunner";
-  version = "1.8.2";
+  version = "1.8.3";

  src = fetchFromGitHub {
    owner = "Youda008";
    repo = "DoomRunner";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-IUc7qGW4ni/6IwEfY4wpQxKiR14uzKuvTZvHZ3aF++s=";
+    hash = "sha256-NpNhl3cGXpxI8Qu4l8PjojCCXCZdGBEkBzz5XxLm/mY=";
  };

  buildInputs = [ qtbase ];
--- a/pkgs/games/quakespasm/default.nix
+++ b/pkgs/games/quakespasm/default.nix
@ -6,11 +6,11 @@

 stdenv.mkDerivation rec {
  pname = "quakespasm";
-  version = "0.96.0";
+  version = "0.96.3";

  src = fetchurl {
    url = "mirror://sourceforge/quakespasm/quakespasm-${version}.tar.gz";
-    sha256 = "sha256-Sa4lLALB3xpMGVjpKnzGl1OBEJcLOHDcFGEFsO0wwOw=";
+    sha256 = "sha256-tXjWzkpPf04mokRY8YxLzI04VK5iUuuZgu6B2V5QGA4=";
  };

  sourceRoot = "${pname}-${version}/Quake";
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@ -8,7 +8,7 @@

 buildGoModule rec {
  pname = "grafana";
-  version = "11.3.1";
+  version = "11.4.0";

  subPackages = [ "pkg/cmd/grafana" "pkg/cmd/grafana-server" "pkg/cmd/grafana-cli" ];

@ -16,7 +16,7 @@ buildGoModule rec {
    owner = "grafana";
    repo = "grafana";
    rev = "v${version}";
-    hash = "sha256-r8+GdAI1W7Y4wLL8GTLzXUTaOzvLb/YQ4XWHmYs1biI=";
+    hash = "sha256-47jQ+ksq6zdS73o884q0xKLtOHssTnaIPdDOejlv/gU=";
  };

  # borrowed from: https://github.com/NixOS/nixpkgs/blob/d70d9425f49f9aba3c49e2c389fe6d42bac8c5b0/pkgs/development/tools/analysis/snyk/default.nix#L20-L22
@ -51,9 +51,9 @@ buildGoModule rec {
    dontFixup = true;
    outputHashMode = "recursive";
    outputHash = rec {
-      x86_64-linux = "sha256-s9PGuuGwB4Ixw0cekrg0oldQxRU6xmb3KjFrNPRiGLs=";
+      x86_64-linux = "sha256-5/l0vXVjHC4oG7ahVscJOwS74be7F8jei9nq6m2v2tQ=";
      aarch64-linux = x86_64-linux;
-      aarch64-darwin = "sha256-NVx+ipUPova7yN56Ag0b13Jb6CsD0fwHfPpwyDbQs+Y=";
+      aarch64-darwin = "sha256-+texKSlcvtoi83ySEXy2E4SqnfyQ0l4MixTBpdemWvI=";
      x86_64-darwin = aarch64-darwin;
    }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  };
--- a/pkgs/servers/prowlarr/default.nix
+++ b/pkgs/servers/prowlarr/default.nix
@ -62,7 +62,7 @@ in stdenv.mkDerivation rec {
    homepage = "https://wiki.servarr.com/prowlarr";
    changelog = "https://github.com/Prowlarr/Prowlarr/releases/tag/v${version}";
    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ jdreaver ];
+    maintainers = with maintainers; [ ];
    mainProgram = "Prowlarr";
    platforms = [
      "aarch64-darwin"
--- a/pkgs/tools/admin/meshcentral/default.nix
+++ b/pkgs/tools/admin/meshcentral/default.nix
@ -8,23 +8,15 @@
 }:

 yarn2nix-moretea.mkYarnPackage {
-  version = "1.1.33";
+  version = "1.1.35";

  src = fetchzip {
-    url = "https://registry.npmjs.org/meshcentral/-/meshcentral-1.1.33.tgz";
-    sha256 = "0s362iwnwmfpz5gbjnvjwccchx03hl53v6yqyyy34vy4f1mxvyim";
+    url = "https://registry.npmjs.org/meshcentral/-/meshcentral-1.1.35.tgz";
+    sha256 = "0y0c6r8bijkz2pwc9mgkkg3fi7sbaawcarvcjf47xa5zkl65a2qf";
  };

  patches = [
    ./fix-js-include-paths.patch
-
-    # With this change, meshcentral fails to detect installed dependencies
-    # and tries to install those at runtime. Hence, reverting.
-    (fetchpatch {
-      hash = "sha256-MtFnU1FI7wNBiTGmW67Yn4oszviODcAJOL1PIi78+ic=";
-      url = "https://github.com/Ylianst/MeshCentral/commit/cfe9345b53fcd660985d7ce7b82278182b40f41e.patch";
-      revert = true;
-    })
  ];

  packageJSON = ./package.json;
@ -32,7 +24,7 @@ yarn2nix-moretea.mkYarnPackage {

  offlineCache = fetchYarnDeps {
    yarnLock = ./yarn.lock;
-    hash = "sha256-W1MMZRDoeBJ3nGzXFVPGsrAtk4FlQGTUhFpPCdpdHPI=";
+    hash = "sha256-wK3w5y0Ic9g6iBOUG7KseA1lPW2wzPMbJqb0YWiZJTM=";
  };

  # Tarball has CRLF line endings. This makes patching difficult, so let's convert them.
--- a/pkgs/tools/admin/meshcentral/package.json
+++ b/pkgs/tools/admin/meshcentral/package.json
@ -1,6 +1,6 @@
 {
  "name": "meshcentral",
-  "version": "1.1.33",
+  "version": "1.1.35",
  "keywords": [
    "Remote Device Management",
    "Remote Device Monitoring",
@ -37,7 +37,7 @@
    "sample-config-advanced.json"
  ],
  "dependencies": {
-    "@yetzt/nedb": "1.8.0",
+    "@seald-io/nedb": "4.0.4",
    "archiver": "7.0.1",
    "body-parser": "1.20.3",
    "cbor": "5.2.0",
@ -70,7 +70,7 @@
    "passport-github2": "*",
    "passport-azure-oauth2": "*",
    "jwt-simple": "*",
-    "openid-client": "5.7.0",
+    "openid-client": "5.7.1",
    "passport-saml": "*",
    "archiver": "7.0.1",
    "body-parser": "1.20.3",
@ -83,7 +83,7 @@
    "ipcheck": "0.1.0",
    "minimist": "1.2.8",
    "multiparty": "4.2.3",
-    "@yetzt/nedb": "*",
+    "@seald-io/nedb": "*",
    "node-forge": "1.3.1",
    "ua-parser-js": "1.0.39",
    "ws": "8.18.0",
@ -97,15 +97,14 @@
    "image-size": "1.1.1",
    "acme-client": "4.2.5",
    "aedes": "0.39.0",
-    "mysql2": "3.6.2",
+    "mysql2": "3.11.4",
    "@mysql/xdevapi": "8.0.33",
    "mongodb": "4.13.0",
    "saslprep": "1.0.3",
-    "pg": "8.7.1",
-    "pgtools": "0.3.2",
-    "mariadb": "3.2.2",
+    "pg": "8.13.1",
+    "mariadb": "3.4.0",
    "acebase": "1.29.5",
-    "sqlite3": "5.1.6",
+    "sqlite3": "5.1.7",
    "node-vault": "0.10.2",
    "semver": "7.5.4",
    "https-proxy-agent": "7.0.2",
@ -118,7 +117,7 @@
    "@crowdsec/express-bouncer": "0.1.0",
    "archiver-zip-encrypted": "2.0.0",
    "googleapis": "128.0.0",
-    "webdav": "4.11.3",
+    "webdav": "4.11.4",
    "minio": "8.0.1",
    "wildleek": "2.0.0",
    "yubikeyotp": "0.2.0",
@ -133,7 +132,7 @@
    "node-pushover": "1.0.0",
    "zulip": "0.1.0",
    "web-push": "3.6.6",
-    "node-xcs": "0.1.7",
+    "node-xcs": "0.1.8",
    "modern-syslog": "1.2.0",
    "syslog": "0.1.1-1",
    "heapdump": "0.3.15"
--- a/pkgs/tools/admin/meshcentral/yarn.lock
+++ b/pkgs/tools/admin/meshcentral/yarn.lock
--- a/pkgs/tools/package-management/nix-prefetch-scripts/default.nix
+++ b/pkgs/tools/package-management/nix-prefetch-scripts/default.nix
@ -1,12 +1,14 @@
 { lib, stdenv, makeWrapper, buildEnv
-, breezy, coreutils, cvs, findutils, gawk, git, git-lfs, gnused, mercurial, nix, subversion
+, bash, breezy, coreutils, cvs, findutils, gawk, git, git-lfs, gnused, mercurial, nix, subversion
 }:

 let mkPrefetchScript = tool: src: deps:
  stdenv.mkDerivation {
    name = "nix-prefetch-${tool}";

+    strictDeps = true;
    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ bash ];

    dontUnpack = true;

--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -10974,6 +10974,10 @@ with pkgs;
    gtkVersion = "4";
  };

+  vtfedit = callPackage ../by-name/vt/vtfedit/package.nix {
+    wine = wineWowPackages.staging;
+  };
+
  vtk_9 = libsForQt5.callPackage ../development/libraries/vtk/9.x.nix { };

  vtk_9_withQt5 = vtk_9.override { enableQt = true; };