Merge master into haskell-updates

2024-04-12 00:12:55 +00:00 · 2024-04-12 00:12:55 +00:00 · 0030939651
parent 07c5d2d3f9 d9110b9705
commit 0030939651
192 changed files with 4617 additions and 1216 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@ -359,3 +359,16 @@ pkgs/development/tools/continuous-integration/buildbot @Mic92 @zowoq
 pkgs/by-name/pr/pretix/ @mweinelt
 nixos/modules/services/web-apps/pretix.nix @mweinelt
 nixos/tests/web-apps/pretix.nix @mweinelt
+
+# incus/lxc/lxd
+nixos/maintainers/scripts/lxd/          @adamcstephens
+nixos/modules/virtualisation/incus.nix  @adamcstephens
+nixos/modules/virtualisation/lxc*       @adamcstephens
+nixos/modules/virtualisation/lxd*       @adamcstephens
+nixos/tests/incus/                      @adamcstephens
+nixos/tests/lxd/                        @adamcstephens
+pkgs/by-name/in/incus/                  @adamcstephens
+pkgs/by-name/lx/lxc*                    @adamcstephens
+pkgs/by-name/lx/lxd*                    @adamcstephens
+pkgs/os-specific/linux/lxc/             @adamcstephens
+
--- a/.github/workflows/manual-nixpkgs.yml
+++ b/.github/workflows/manual-nixpkgs.yml
@ -9,6 +9,7 @@ on:
    paths:
      - 'doc/**'
      - 'lib/**'
+      - 'pkgs/tools/nix/nixdoc/**'

 jobs:
  nixpkgs:
--- a/doc/build-helpers/fetchers.chapter.md
+++ b/doc/build-helpers/fetchers.chapter.md
@ -283,7 +283,7 @@ If `pname` and `version` are specified, `fetchurl` will use those values and wil

  _Default value:_ `""`.

-`recursiveHash` (Boolean; _optional_)
+`recursiveHash` (Boolean; _optional_) []{#sec-pkgs-fetchers-fetchurl-inputs-recursiveHash}
 : If set to `true`, will signal to Nix that the hash given to `fetchurl` was calculated using the `"recursive"` mode.
  See [the documentation on the Nix manual](https://nixos.org/manual/nix/stable/language/advanced-attributes.html#adv-attr-outputHashMode) for more information about the existing modes.

@ -296,7 +296,7 @@ If `pname` and `version` are specified, `fetchurl` will use those values and wil

  _Default value_: `false`.

-`downloadToTemp` (Boolean; _optional_)
+`downloadToTemp` (Boolean; _optional_) []{#sec-pkgs-fetchers-fetchurl-inputs-downloadToTemp}
 : If `true`, saves the downloaded file to a temporary location instead of the expected Nix store location.
  This is useful when used in conjunction with `postFetch` attribute, otherwise `fetchurl` will not produce any meaningful output.

@ -519,15 +519,81 @@ See [](#chap-pkgs-fetchers-caveats) for more details on how to work with the `ha

 ## `fetchzip` {#sec-pkgs-fetchers-fetchzip}

-Downloads content from a given URL (which is assumed to be an archive), and decompresses the archive for you, making files and directories directly accessible.
-`fetchzip` can only be used with archives.
-Despite its name, `fetchzip` is not limited to `.zip` files and can also be used with any tarball.
+Returns a [fixed-output derivation](https://nixos.org/manual/nix/stable/glossary.html#gloss-fixed-output-derivation) which downloads an archive from a given URL and decompresses it.

-It has two required arguments, a URL and a hash.
-The hash is typically `hash`, although many more hash algorithms are supported.
-Nixpkgs contributors are currently recommended to use `hash`.
-This hash will be used by Nix to identify your source.
-A typical usage of `fetchzip` is provided below.
+Despite its name, `fetchzip` is not limited to `.zip` files but can also be used with [various compressed tarball formats](#tar-files) by default.
+This can extended by specifying additional attributes, see [](#ex-fetchers-fetchzip-rar-archive) to understand how to do that.
+
+### Inputs {#sec-pkgs-fetchers-fetchzip-inputs}
+
+`fetchzip` requires an attribute set, and most attributes are passed to the underlying call to [`fetchurl`](#sec-pkgs-fetchers-fetchurl).
+
+The attributes below are treated differently by `fetchzip` when compared to what `fetchurl` expects:
+
+`name` (String; _optional_)
+: Works as defined in `fetchurl`, but has a different default value than `fetchurl`.
+
+  _Default value:_ `"source"`.
+
+`nativeBuildInputs` (List of Attribute Set; _optional_)
+: Works as defined in `fetchurl`, but it is also augmented by `fetchzip` to include packages to deal with additional archives (such as `.zip`).
+
+  _Default value:_ `[]`.
+
+`postFetch` (String; _optional_)
+: Works as defined in `fetchurl`, but it is also augmented with the code needed to make `fetchzip` work.
+
+  :::{.caution}
+  It is only safe to modify files in `$out` in `postFetch`.
+  Consult the implementation of `fetchzip` for anything more involved.
+  :::
+
+  _Default value:_ `""`.
+
+`stripRoot` (Boolean; _optional_)
+: If `true`, the decompressed contents are moved one level up the directory tree.
+
+  This is useful for archives that decompress into a single directory which commonly includes some values that change with time, such as version numbers.
+  When this is the case (and `stripRoot` is `true`), `fetchzip` will remove this directory and make the decompressed contents available in the top-level directory.
+
+  [](#ex-fetchers-fetchzip-simple-striproot) shows what this attribute does.
+
+  This attribute is **not** passed through to `fetchurl`.
+
+  _Default value:_ `true`.
+
+`extension` (String or Null; _optional_)
+: If set, the archive downloaded by `fetchzip` will be renamed to a filename with the extension specified in this attribute.
+
+  This is useful when making `fetchzip` support additional types of archives, because the implementation may use the extension of an archive to determine whether they can decompress it.
+  If the URL you're using to download the contents doesn't end with the extension associated with the archive, use this attribute to fix the filename of the archive.
+
+  This attribute is **not** passed through to `fetchurl`.
+
+  _Default value:_ `null`.
+
+`recursiveHash` (Boolean; _optional_)
+: Works [as defined in `fetchurl`](#sec-pkgs-fetchers-fetchurl-inputs-recursiveHash), but its default value is different than for `fetchurl`.
+
+  _Default value:_ `true`.
+
+`downloadToTemp` (Boolean; _optional_)
+: Works [as defined in `fetchurl`](#sec-pkgs-fetchers-fetchurl-inputs-downloadToTemp), but its default value is different than for `fetchurl`.
+
+  _Default value:_ `true`.
+
+`extraPostFetch` **DEPRECATED**
+: This attribute is deprecated.
+  Please use `postFetch` instead.
+
+  This attribute is **not** passed through to `fetchurl`.
+
+### Examples {#sec-pkgs-fetchers-fetchzip-examples}
+
+::::{.example #ex-fetchers-fetchzip-simple-striproot}
+# Using `fetchzip` to output contents directly
+
+The following recipe shows how to use `fetchzip` to decompress a `.tar.gz` archive:

 ```nix
 { fetchzip }:
@ -537,6 +603,80 @@ fetchzip {
 }
 ```

+This archive has all its contents in a directory named `patchelf-0.18.0`.
+This means that after decompressing, you'd have to enter this directory to see the contents of the archive.
+However, `fetchzip` makes this easier through the attribute `stripRoot` (enabled by default).
+
+After building the recipe, the derivation output will show all the files in the archive at the top level:
+
+```shell
+$ nix-build
+(output removed for clarity)
+/nix/store/1b7h3fvmgrcddvs0m299hnqxlgli1yjw-source
+
+$ ls /nix/store/1b7h3fvmgrcddvs0m299hnqxlgli1yjw-source
+aclocal.m4  completions  configure.ac  m4           Makefile.in  patchelf.spec     README.md  tests
+build-aux   configure    COPYING       Makefile.am  patchelf.1   patchelf.spec.in  src        version
+```
+
+If `stripRoot` is set to `false`, the derivation output will be the decompressed archive as-is:
+
+```nix
+{ fetchzip }:
+fetchzip {
+  url = "https://github.com/NixOS/patchelf/releases/download/0.18.0/patchelf-0.18.0.tar.gz";
+  hash = "sha256-uv3FuKE4DqpHT3yfE0qcnq0gYjDNQNKZEZt2+PUAneg=";
+  stripRoot = false;
+}
+```
+
+:::{.caution}
+The hash changed!
+Whenever changing attributes of a Nixpkgs fetcher, [remember to invalidate the hash](#chap-pkgs-fetchers-caveats), otherwise you won't get the results you're expecting!
+:::
+
+After building the recipe:
+
+```shell
+$ nix-build
+(output removed for clarity)
+/nix/store/2hy5bxw7xgbgxkn0i4x6hjr8w3dbx16c-source
+
+$ ls /nix/store/2hy5bxw7xgbgxkn0i4x6hjr8w3dbx16c-source
+patchelf-0.18.0
+```
+::::
+
+::::{.example #ex-fetchers-fetchzip-rar-archive}
+# Using `fetchzip` to decompress a `.rar` file
+
+The `unrar` package provides a [setup hook](#ssec-setup-hooks) to decompress `.rar` archives during the [unpack phase](#ssec-unpack-phase), which can be used with `fetchzip` to decompress those archives:
+
+```nix
+{ fetchzip, unrar }:
+fetchzip {
+  url = "https://archive.org/download/SpaceCadet_Plus95/Space_Cadet.rar";
+  hash = "sha256-fC+zsR8BY6vXpUkVd6i1jF0IZZxVKVvNi6VWCKT+pA4=";
+  stripRoot = false;
+  nativeBuildInputs = [ unrar ];
+}
+```
+
+Since this particular `.rar` file doesn't put its contents in a directory inside the archive, `stripRoot` must be set to `false`.
+
+After building the recipe, the derivation output will show the decompressed files:
+
+```shell
+$ nix-build
+(output removed for clarity)
+/nix/store/zpn7knxfva6rfjja2gbb4p3l9w1f0d36-source
+
+$ ls /nix/store/zpn7knxfva6rfjja2gbb4p3l9w1f0d36-source
+FONT.DAT      PINBALL.DAT  PINBALL.EXE	PINBALL2.MID  TABLE.BMP    WMCONFIG.EXE
+MSCREATE.DIR  PINBALL.DOC  PINBALL.MID	Sounds	     WAVEMIX.INF
+```
+::::
+
 ## `fetchpatch` {#fetchpatch}

 `fetchpatch` works very similarly to `fetchurl` with the same arguments expected. It expects patch files as a source and performs normalization on them before computing the checksum. For example, it will remove comments or other unstable parts that are sometimes added by version control systems and can change over time.
--- a/doc/packages/shell-helpers.section.md
+++ b/doc/packages/shell-helpers.section.md
@ -2,11 +2,11 @@

 Some packages provide the shell integration to be more useful. But unlike other systems, nix doesn't have a standard `share` directory location. This is why a bunch `PACKAGE-share` scripts are shipped that print the location of the corresponding shared folder. Current list of such packages is as following:

- `sk` : `sk-share`
+- `fzf` : `fzf-share`

-E.g. `sk` can then be used in the `.bashrc` like this:
+E.g. `fzf` can then be used in the `.bashrc` like this:

 ```bash
-source "$(sk-share)/completion.bash"
-source "$(sk-share)/key-bindings.bash"
+source "$(fzf-share)/completion.bash"
+source "$(fzf-share)/key-bindings.bash"
 ```
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1770,6 +1770,16 @@
    githubId = 11037075;
    name = "Ashley Hooper";
  };
+  ashuramaruzxc = {
+    email = "ashuramaru@tenjin-dk.com";
+    matrix = "@tenjin:mozilla.org";
+    github = "ashuramaruzxc";
+    githubId = 72100551;
+    name = "Mariia Holovata";
+    keys = [{
+      fingerprint = "409D 201E 9450 8732 A49E  D0FC 6BDA F874 0068 08DF";
+    }];
+  };
  ashvith-shetty = {
    github = "Ashvith10";
    githubId = 113123021;
@ -5379,6 +5389,12 @@
      fingerprint = "389A 78CB CD88 5E0C 4701  DEB9 FD42 C7D0 D414 94C8";
    }];
  };
+  dudymas = {
+    email = "jeremy.white@cloudposse.com";
+    github = "dudymas";
+    githubId = 928448;
+    name = "Jeremy White";
+  };
  dukc = {
    email = "ajieskola@gmail.com";
    github = "dukc";
@ -11403,6 +11419,13 @@
      fingerprint = "80EE AAD8 43F9 3097 24B5  3D7E 27E9 7B91 E63A 7FF8";
    }];
  };
+  link2xt = {
+    email = "link2xt@testrun.org";
+    githubId = 18373967;
+    github = "link2xt";
+    matrix = "@link2xt:matrix.org";
+    name = "link2xt";
+  };
  linquize = {
    email = "linquize@yahoo.com.hk";
    github = "linquize";
@ -11805,6 +11828,12 @@
    githubId = 30468956;
    name = "Lukas Heiligenbrunner";
  };
+  lukaslihotzki = {
+    email = "lukas@lihotzki.de";
+    github = "lukaslihotzki";
+    githubId = 10326063;
+    name = "Lukas Lihotzki";
+  };
  lukaswrz = {
    email = "lukas@wrz.one";
    github = "lukaswrz";
@ -14905,6 +14934,12 @@
    github = "ony";
    githubId = 11265;
  };
+  oo-infty = {
+    name = "Justin Chen";
+    email = "oo-infty@outlook.com";
+    github = "oo-infty";
+    githubId = 42143810;
+  };
  ooliver1 = {
    name = "Oliver Wilkes";
    email = "oliverwilkes2006@icloud.com";
@ -15486,6 +15521,12 @@
      fingerprint = "7756 E88F 3C6A 47A5 C5F0  CDFB AB54 6777 F93E 20BF";
    }];
  };
+  phdyellow = {
+    name = "Phil Dyer";
+    email = "phildyer@protonmail.com";
+    github = "PhDyellow";
+    githubId = 7740661;
+  };
  phfroidmont = {
    name = "Paul-Henri Froidmont";
    email = "nix.contact-j9dw4d@froidmont.org";
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@ -146,6 +146,15 @@ with lib.maintainers; {
    enableFeatureFreezePing = true;
  };

+  cloudposse = {
+    members = [
+      dudymas
+    ];
+    scope = "Maintain atmos and applications made by the Cloud Posse team.";
+    shortName = "CloudPosse";
+    enableFeatureFreezePing = true;
+  };
+
  coq = {
    members = [
      cohencyril
@ -475,6 +484,7 @@ with lib.maintainers; {
      ryantm
      lassulus
      yayayayaka
+      asymmetric
    ];
    scope = "Maintain Jitsi.";
    shortName = "Jitsi";
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -79,7 +79,7 @@ In addition to numerous new and updated packages, this release has the following

 - [frigate](https://frigate.video), an open source NVR built around real-time AI object detection. Available as [services.frigate](#opt-services.frigate.enable).

- [fzf](https://github.com/junegunn/fzf), a command line fuzzyfinder. Available as [programs.fzf](#opt-programs.fzf.enable).
+- [fzf](https://github.com/junegunn/fzf), a command line fuzzyfinder. Available as [programs.fzf](#opt-programs.fzf.fuzzyCompletion).

 - [gemstash](https://github.com/rubygems/gemstash), a RubyGems.org cache and private gem server. Available as [services.gemstash](#opt-services.gemstash.enable).

--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -90,6 +90,10 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi

 - [maubot](https://github.com/maubot/maubot), a plugin-based Matrix bot framework. Available as [services.maubot](#opt-services.maubot.enable).

+- [ryzen-monitor-ng](https://github.com/mann1x/ryzen_monitor_ng), a desktop AMD CPU power monitor and controller, similar to Ryzen Master but for Linux. Available as [programs.ryzen-monitor-ng](#opt-programs.ryzen-monitor-ng.enable)
+
+- [ryzen-smu](https://gitlab.com/leogx9r/ryzen_smu), Linux kernel driver to expose the SMU (System Management Unit) for certain AMD Ryzen Processors. Includes the userspace program `monitor_cpu`. Available at [hardward.cpu.amd.ryzen-smu](#opt-hardware.cpu.amd.ryzen-smu.enable)
+
 - systemd's gateway, upload, and remote services, which provides ways of sending journals across the network. Enable using [services.journald.gateway](#opt-services.journald.gateway.enable), [services.journald.upload](#opt-services.journald.upload.enable), and [services.journald.remote](#opt-services.journald.remote.enable).

 - [GNS3](https://www.gns3.com/), a network software emulator. Available as [services.gns3-server](#opt-services.gns3-server.enable).
@ -324,8 +328,6 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - `xxd` has been moved from `vim` default output to its own output to reduce closure size. The canonical way to reference it across all platforms is `unixtools.xxd`.

- `programs.fzf.keybindings` and `programs.fzf.fuzzyCompletion` got replaced by `programs.fzf.enable` as shell-completion is included in the fzf-binary now there is no easy option to load completion and keybindings separately. Please consult fzf-documentation on how to configure/disable certain keybindings.
-
 - The `stalwart-mail` package has been updated to v0.5.3, which includes [breaking changes](https://github.com/stalwartlabs/mail-server/blob/v0.5.3/UPGRADING.md).

 - `services.zope2` has been removed as `zope2` is unmaintained and was relying on Python2.
--- a/nixos/modules/hardware/cpu/amd-ryzen-smu.nix
+++ b/nixos/modules/hardware/cpu/amd-ryzen-smu.nix
@ -0,0 +1,26 @@
+{ config
+, lib
+, ...
+}:
+let
+  inherit (lib) mkEnableOption mkIf;
+  cfg = config.hardware.cpu.amd.ryzen-smu;
+  ryzen-smu = config.boot.kernelPackages.ryzen-smu;
+in
+{
+  options.hardware.cpu.amd.ryzen-smu = {
+    enable = mkEnableOption ''
+        ryzen_smu, a linux kernel driver that exposes access to the SMU (System Management Unit) for certain AMD Ryzen Processors.
+
+        WARNING: Damage cause by use of your AMD processor outside of official AMD specifications or outside of factory settings are not covered under any AMD product warranty and may not be covered by your board or system manufacturer's warranty
+      '';
+  };
+
+  config = mkIf cfg.enable {
+    boot.kernelModules = [ "ryzen-smu" ];
+    boot.extraModulePackages = [ ryzen-smu ];
+    environment.systemPackages = [ ryzen-smu ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ Cryolitia phdyellow ];
+}
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -54,6 +54,7 @@
  ./hardware/corectrl.nix
  ./hardware/cpu/amd-microcode.nix
  ./hardware/cpu/amd-sev.nix
+  ./hardware/cpu/amd-ryzen-smu.nix
  ./hardware/cpu/intel-microcode.nix
  ./hardware/cpu/intel-sgx.nix
  ./hardware/cpu/x86-msr.nix
@ -212,6 +213,8 @@
  ./programs/kbdlight.nix
  ./programs/kclock.nix
  ./programs/kdeconnect.nix
+  ./programs/lazygit.nix
+  ./programs/kubeswitch.nix
  ./programs/less.nix
  ./programs/liboping.nix
  ./programs/light.nix
@ -251,6 +254,7 @@
  ./programs/regreet.nix
  ./programs/rog-control-center.nix
  ./programs/rust-motd.nix
+  ./programs/ryzen-monitor-ng.nix
  ./programs/screen.nix
  ./programs/seahorse.nix
  ./programs/sedutil.nix
@ -1363,6 +1367,7 @@
  ./services/web-apps/miniflux.nix
  ./services/web-apps/monica.nix
  ./services/web-apps/moodle.nix
+  ./services/web-apps/movim.nix
  ./services/web-apps/netbox.nix
  ./services/web-apps/nextcloud.nix
  ./services/web-apps/nextcloud-notify_push.nix
--- a/nixos/modules/programs/fzf.nix
+++ b/nixos/modules/programs/fzf.nix
@ -1,46 +1,38 @@
 { pkgs, config, lib, ... }:

-with lib;
-
 let
  cfg = config.programs.fzf;
-
 in
 {
-  imports = [
-    (lib.mkRemovedOptionModule [ "programs" "fzf" "keybindings" ] ''
-      Use "programs.fzf.enable" instead, due to fzf upstream-change it's not possible to load shell-completion and keybindings separately.
-      If you want to change/disable certain keybindings please check the fzf-documentation.
-    '')
-    (lib.mkRemovedOptionModule [ "programs" "fzf" "fuzzyCompletion" ] ''
-      Use "programs.fzf.enable" instead, due to fzf upstream-change it's not possible to load shell-completion and keybindings separately.
-      If you want to change/disable certain keybindings please check the fzf-documentation.
-    '')
-  ];
-
  options = {
-    programs.fzf.enable = mkEnableOption (mdDoc "fuzzy completion with fzf and keybindings");
-  };
-
-  config = mkIf cfg.enable {
-    environment.systemPackages = [ pkgs.fzf ];
-
-    programs.bash.interactiveShellInit = ''
-      eval "$(${getExe pkgs.fzf} --bash)"
-    '';
-
-    programs.fish.interactiveShellInit = ''
-      ${getExe pkgs.fzf} --fish | source
-    '';
-
-    programs.zsh = {
-      interactiveShellInit = optionalString (!config.programs.zsh.ohMyZsh.enable) ''
-        eval "$(${getExe pkgs.fzf} --zsh)"
-      '';
-
-      ohMyZsh.plugins = mkIf (config.programs.zsh.ohMyZsh.enable) [ "fzf" ];
+    programs.fzf = {
+      fuzzyCompletion = lib.mkEnableOption (lib.mdDoc "fuzzy completion with fzf");
+      keybindings = lib.mkEnableOption (lib.mdDoc "fzf keybindings");
    };
  };

-  meta.maintainers = with maintainers; [ laalsaas ];
+  config = lib.mkIf (cfg.keybindings || cfg.fuzzyCompletion) {
+    environment.systemPackages = lib.mkIf (cfg.keybindings || cfg.fuzzyCompletion) [ pkgs.fzf ];
+
+    programs = {
+      bash.interactiveShellInit = lib.optionalString cfg.fuzzyCompletion ''
+        source ${pkgs.fzf}/share/fzf/completion.bash
+      '' + lib.optionalString cfg.keybindings ''
+        source ${pkgs.fzf}/share/fzf/key-bindings.bash
+      '';
+
+      zsh = {
+        interactiveShellInit = lib.optionalString (!config.programs.zsh.ohMyZsh.enable)
+        (lib.optionalString cfg.fuzzyCompletion ''
+          source ${pkgs.fzf}/share/fzf/completion.zsh
+        '' + lib.optionalString cfg.keybindings ''
+          source ${pkgs.fzf}/share/fzf/key-bindings.zsh
+        '');
+
+        ohMyZsh.plugins = lib.mkIf config.programs.zsh.ohMyZsh.enable [ "fzf" ];
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ laalsaas ];
 }
--- a/nixos/modules/programs/kubeswitch.nix
+++ b/nixos/modules/programs/kubeswitch.nix
@ -0,0 +1,56 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.programs.kubeswitch;
+in
+{
+  options = {
+    programs.kubeswitch = {
+      enable = lib.mkEnableOption (lib.mdDoc "kubeswitch");
+
+      commandName = lib.mkOption {
+        type = lib.types.str;
+        default = "kswitch";
+        description = "The name of the command to use";
+      };
+
+      package = lib.mkOption {
+        type = lib.types.package;
+        default = pkgs.kubeswitch;
+        defaultText = lib.literalExpression "pkgs.kubeswitch";
+        description = "The package to install for kubeswitch";
+      };
+    };
+  };
+
+  config =
+    let
+      shell_files = pkgs.stdenv.mkDerivation rec {
+        name = "kubeswitch-shell-files";
+        phases = [ "installPhase" ];
+        installPhase = ''
+          mkdir -p $out/share
+          for shell in bash zsh; do
+            ${cfg.package}/bin/switcher init $shell | sed 's/switch(/${cfg.commandName}(/' > $out/share/${cfg.commandName}_init.$shell
+            ${cfg.package}/bin/switcher --cmd ${cfg.commandName} completion $shell > $out/share/${cfg.commandName}_completion.$shell
+          done
+        '';
+      };
+    in
+    lib.mkIf cfg.enable {
+      environment.systemPackages = [ cfg.package ];
+
+      programs.bash.interactiveShellInit = ''
+        source ${shell_files}/share/${cfg.commandName}_init.bash
+        source ${shell_files}/share/${cfg.commandName}_completion.bash
+      '';
+      programs.zsh.interactiveShellInit = ''
+        source ${shell_files}/share/${cfg.commandName}_init.zsh
+        source ${shell_files}/share/${cfg.commandName}_completion.zsh
+      '';
+    };
+}
--- a/nixos/modules/programs/lazygit.nix
+++ b/nixos/modules/programs/lazygit.nix
@ -0,0 +1,37 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.programs.lazygit;
+
+  settingsFormat = pkgs.formats.yaml { };
+in
+{
+  options.programs.lazygit = {
+    enable = lib.mkEnableOption "lazygit, a simple terminal UI for git commands";
+
+    package = lib.mkPackageOption pkgs "lazygit" { };
+
+    settings = lib.mkOption {
+      inherit (settingsFormat) type;
+      default = { };
+      description = ''
+        Lazygit configuration.
+
+        See https://github.com/jesseduffield/lazygit/blob/master/docs/Config.md for documentation.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment = {
+      systemPackages = [ cfg.package ];
+      etc = lib.mkIf (cfg.settings != { }) {
+        "xdg/lazygit/config.yml".source = settingsFormat.generate "lazygit-config.yml" cfg.settings;
+      };
+    };
+  };
+
+  meta = {
+    maintainers = with lib.maintainers; [ linsui ];
+  };
+}
--- a/nixos/modules/programs/ryzen-monitor-ng.nix
+++ b/nixos/modules/programs/ryzen-monitor-ng.nix
@ -0,0 +1,35 @@
+{ pkgs
+, config
+, lib
+, ...
+}:
+let
+  inherit (lib) mkEnableOption mkPackageOption mkIf;
+  cfg = config.programs.ryzen-monitor-ng;
+in
+{
+  options = {
+    programs.ryzen-monitor-ng = {
+      enable =  mkEnableOption ''
+        ryzen_monitor_ng, a userspace application for setting and getting Ryzen SMU (System Management Unit) parameters via the ryzen_smu kernel driver.
+
+        Monitor power information of Ryzen processors via the PM table of the SMU.
+
+        SMU Set and Get for many parameters and CO counts.
+
+        https://github.com/mann1x/ryzen_monitor_ng
+
+        WARNING: Damage cause by use of your AMD processor outside of official AMD specifications or outside of factory settings are not covered under any AMD product warranty and may not be covered by your board or system manufacturer's warranty
+      '';
+
+      package = mkPackageOption pkgs "ryzen-monitor-ng" {};
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+    hardware.cpu.amd.ryzen-smu.enable = true;
+  };
+
+  meta.maintainers = with lib.maintainers; [ Cryolitia phdyellow ];
+}
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@ -220,15 +220,16 @@ in
  config = mkIf cfg.enable {
    services.redis.servers.paperless.enable = mkIf enableRedis true;

-    systemd.tmpfiles.rules = [
-      "d '${cfg.dataDir}' - ${cfg.user} ${config.users.users.${cfg.user}.group} - -"
-      "d '${cfg.mediaDir}' - ${cfg.user} ${config.users.users.${cfg.user}.group} - -"
-      (if cfg.consumptionDirIsPublic then
-        "d '${cfg.consumptionDir}' 777 - - - -"
-      else
-        "d '${cfg.consumptionDir}' - ${cfg.user} ${config.users.users.${cfg.user}.group} - -"
-      )
-    ];
+    systemd.tmpfiles.settings."10-paperless" = let
+      defaultRule = {
+        inherit (cfg) user;
+        inherit (config.users.users.${cfg.user}) group;
+      };
+    in {
+      "${cfg.dataDir}".d = defaultRule;
+      "${cfg.mediaDir}".d = defaultRule;
+      "${cfg.consumptionDir}".d = if cfg.consumptionDirIsPublic then { mode = "777"; } else defaultRule;
+    };

    systemd.services.paperless-scheduler = {
      description = "Paperless Celery Beat";
@ -238,6 +239,7 @@ in
        User = cfg.user;
        ExecStart = "${pkg}/bin/celery --app paperless beat --loglevel INFO";
        Restart = "on-failure";
+        LoadCredential = lib.optionalString (cfg.passwordFile != null) "PAPERLESS_ADMIN_PASSWORD:${cfg.passwordFile}";
      };
      environment = env;

@ -270,7 +272,7 @@ in
      ''
      + optionalString (cfg.passwordFile != null) ''
        export PAPERLESS_ADMIN_USER="''${PAPERLESS_ADMIN_USER:-admin}"
-        export PAPERLESS_ADMIN_PASSWORD=$(cat "${cfg.dataDir}/superuser-password")
+        export PAPERLESS_ADMIN_PASSWORD=$(cat $CREDENTIALS_DIRECTORY/PAPERLESS_ADMIN_PASSWORD)
        superuserState="$PAPERLESS_ADMIN_USER:$PAPERLESS_ADMIN_PASSWORD"
        superuserStateFile="${cfg.dataDir}/superuser-state"

@ -298,19 +300,6 @@ in
      environment = env;
    };

-    # Reading the user-provided password file requires root access
-    systemd.services.paperless-copy-password = mkIf (cfg.passwordFile != null) {
-      requiredBy = [ "paperless-scheduler.service" ];
-      before = [ "paperless-scheduler.service" ];
-      serviceConfig = {
-        ExecStart = ''
-          ${pkgs.coreutils}/bin/install --mode 600 --owner '${cfg.user}' --compare \
-            '${cfg.passwordFile}' '${cfg.dataDir}/superuser-password'
-        '';
-        Type = "oneshot";
-      };
-    };
-
    systemd.services.paperless-consumer = {
      description = "Paperless document consumer";
      # Bind to `paperless-scheduler` so that the consumer never runs
--- a/nixos/modules/services/networking/cloudflared.nix
+++ b/nixos/modules/services/networking/cloudflared.nix
@ -11,7 +11,7 @@ let
      default = null;
      example = "30s";
      description = lib.mdDoc ''
-        Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by [https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/local-management/ingress/#tlstimeout](tlsTimeout).
+        Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by [tlsTimeout](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/local-management/ingress/#tlstimeout).
      '';
    };

--- a/nixos/modules/services/networking/i2p.nix
+++ b/nixos/modules/services/networking/i2p.nix
@ -5,7 +5,8 @@ with lib;
 let
  cfg = config.services.i2p;
  homeDir = "/var/lib/i2p";
-in {
+in
+{
  ###### interface
  options.services.i2p.enable = mkEnableOption (lib.mdDoc "I2P router");

@ -27,7 +28,7 @@ in {
        User = "i2p";
        WorkingDirectory = homeDir;
        Restart = "on-abort";
-        ExecStart = "${pkgs.i2p}/bin/i2prouter-plain";
+        ExecStart = "${pkgs.i2p}/bin/i2prouter";
      };
    };
  };
--- a/nixos/modules/services/web-apps/movim.nix
+++ b/nixos/modules/services/web-apps/movim.nix
@ -0,0 +1,711 @@
+{ config, lib, pkgs, ... }:
+
+let
+  inherit (lib)
+    filterAttrsRecursive
+    generators
+    literalExpression
+    mkDefault
+    mkIf
+    mkOption
+    mkEnableOption
+    mkPackageOption
+    mkMerge
+    pipe
+    types
+    ;
+
+  cfg = config.services.movim;
+
+  defaultPHPCfg = {
+    "output_buffering" = 0;
+    "error_reporting" = "E_ALL & ~E_DEPRECATED & ~E_STRICT";
+    "opcache.enable_cli" = 1;
+    "opcache.interned_strings_buffer" = 8;
+    "opcache.max_accelerated_files" = 6144;
+    "opcache.memory_consumption" = 128;
+    "opcache.revalidate_freq" = 2;
+    "opcache.fast_shutdown" = 1;
+  };
+
+  phpCfg = generators.toKeyValue
+    { mkKeyValue = generators.mkKeyValueDefault { } " = "; }
+    (defaultPHPCfg // cfg.phpCfg);
+
+  podConfigFlags =
+    let
+      bevalue = a: lib.escapeShellArg (generators.mkValueStringDefault { } a);
+    in
+    lib.concatStringsSep " "
+      (lib.attrsets.foldlAttrs
+        (acc: k: v: acc ++ lib.optional (v != null) "--${k}=${bevalue v}")
+        [ ]
+        cfg.podConfig);
+
+  package =
+    let
+      p = cfg.package.override
+        ({
+          inherit phpCfg;
+          withPgsql = cfg.database.type == "pgsql";
+          withMysql = cfg.database.type == "mysql";
+          inherit (cfg) minifyStaticFiles;
+        } // lib.optionalAttrs (lib.isAttrs cfg.minifyStaticFiles) (with cfg.minifyStaticFiles; {
+          esbuild = esbuild.package;
+          lightningcss = lightningcss.package;
+          scour = scour.package;
+        }));
+    in
+    p.overrideAttrs (finalAttrs: prevAttrs:
+      let
+        appDir = "$out/share/php/${finalAttrs.pname}";
+
+        stateDirectories = ''
+          # Symlinking in our state directories
+          rm -rf $out/.env $out/cache ${appDir}/public/cache
+          ln -s ${cfg.dataDir}/.env ${appDir}/.env
+          ln -s ${cfg.dataDir}/public/cache ${appDir}/public/cache
+          ln -s ${cfg.logDir} ${appDir}/log
+          ln -s ${cfg.runtimeDir}/cache ${appDir}/cache
+        '';
+
+        exposeComposer = ''
+          # Expose PHP Composer for scripts
+          mkdir -p $out/bin
+          echo "#!${lib.getExe pkgs.dash}" > $out/bin/movim-composer
+          echo "${finalAttrs.php.packages.composer}/bin/composer --working-dir="${appDir}" \"\$@\"" >> $out/bin/movim-composer
+          chmod +x $out/bin/movim-composer
+        '';
+
+        podConfigInputDisableReplace = lib.optionalString (podConfigFlags != "")
+          (lib.concatStringsSep "\n"
+            (lib.attrsets.foldlAttrs
+              (acc: k: v:
+                acc ++ lib.optional (v != null)
+                  # Disable all Admin panel options that were set in the
+                  # `cfg.podConfig` to prevent confusing situtions where the
+                  # values are rewritten on server reboot
+                  ''
+                    substituteInPlace ${appDir}/app/widgets/AdminMain/adminmain.tpl \
+                      --replace-warn 'name="${k}"' 'name="${k}" disabled'
+                  '')
+              [ ]
+              cfg.podConfig));
+
+        precompressStaticFilesJobs =
+          let
+            inherit (cfg.precompressStaticFiles) brotli gzip;
+
+            findTextFileNames = lib.concatStringsSep " -o "
+              (builtins.map (n: ''-iname "*.${n}"'')
+                [ "css" "ini" "js" "json" "manifest" "mjs" "svg" "webmanifest" ]);
+          in
+          lib.concatStringsSep "\n" [
+            (lib.optionalString brotli.enable ''
+              echo -n "Precompressing static files with Brotli …"
+              find ${appDir}/public -type f ${findTextFileNames} \
+                | ${lib.getExe pkgs.parallel} ${lib.escapeShellArgs [
+                    "--will-cite"
+                    "-j $NIX_BUILD_CORES"
+                    "${lib.getExe brotli.package} --keep --quality=${builtins.toString brotli.compressionLevel} --output={}.br {}"
+                   ]}
+              echo " done."
+            '')
+            (lib.optionalString gzip.enable ''
+              echo -n "Precompressing static files with Gzip …"
+              find ${appDir}/public -type f ${findTextFileNames} \
+                | ${lib.getExe pkgs.parallel} ${lib.escapeShellArgs [
+                    "--will-cite"
+                    "-j $NIX_BUILD_CORES"
+                    "${lib.getExe gzip.package} -c -${builtins.toString gzip.compressionLevel} {} > {}.gz"
+                   ]}
+              echo " done."
+            '')
+          ];
+      in
+      {
+        postInstall = lib.concatStringsSep "\n\n" [
+          prevAttrs.postInstall
+          stateDirectories
+          exposeComposer
+          podConfigInputDisableReplace
+          precompressStaticFilesJobs
+        ];
+      });
+
+  configFile = pipe cfg.settings [
+    (filterAttrsRecursive (_: v: v != null))
+    (generators.toKeyValue { })
+    (pkgs.writeText "movim-env")
+  ];
+
+  pool = "movim";
+  fpm = config.services.phpfpm.pools.${pool};
+  phpExecutionUnit = "phpfpm-${pool}";
+
+  dbService = {
+    "postgresql" = "postgresql.service";
+    "mysql" = "mysql.service";
+  }.${cfg.database.type};
+in
+{
+  options.services = {
+    movim = {
+      enable = mkEnableOption "a Movim instance";
+      package = mkPackageOption pkgs "movim" { };
+      phpPackage = mkPackageOption pkgs "php" { };
+
+      phpCfg = mkOption {
+        type = with types; attrsOf (oneOf [ int str bool ]);
+        defaultText = literalExpression (generators.toPretty { } defaultPHPCfg);
+        default = { };
+        description = "Extra PHP INI options such as `memory_limit`, `max_execution_time`, etc.";
+      };
+
+      user = mkOption {
+        type = types.nonEmptyStr;
+        default = "movim";
+        description = "User running Movim service";
+      };
+
+      group = mkOption {
+        type = types.nonEmptyStr;
+        default = "movim";
+        description = "Group running Movim service";
+      };
+
+      dataDir = mkOption {
+        type = types.nonEmptyStr;
+        default = "/var/lib/movim";
+        description = "State directory of the `movim` user which holds the application’s state & data.";
+      };
+
+      logDir = mkOption {
+        type = types.nonEmptyStr;
+        default = "/var/log/movim";
+        description = "Log directory of the `movim` user which holds the application’s logs.";
+      };
+
+      runtimeDir = mkOption {
+        type = types.nonEmptyStr;
+        default = "/run/movim";
+        description = "Runtime directory of the `movim` user which holds the application’s caches & temporary files.";
+      };
+
+      domain = mkOption {
+        type = types.nonEmptyStr;
+        description = "Fully-qualified domain name (FQDN) for the Movim instance.";
+      };
+
+      port = mkOption {
+        type = types.port;
+        default = 8080;
+        description = "Movim daemon port.";
+      };
+
+      debug = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Debugging logs.";
+      };
+
+      verbose = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Verbose logs.";
+      };
+
+      minifyStaticFiles = mkOption {
+        type = with types; either bool (submodule {
+          options = {
+            script = mkOption {
+              type = types.submodule {
+                options = {
+                  enable = mkEnableOption "Script minification";
+                  package = mkPackageOption pkgs "esbuild" { };
+                  target = mkOption {
+                    type = with types; nullOr nonEmptyStr;
+                    default = null;
+                  };
+                };
+              };
+            };
+            style = mkOption {
+              type = types.submodule {
+                options = {
+                  enable = mkEnableOption "Script minification";
+                  package = mkPackageOption pkgs "lightningcss" { };
+                  target = mkOption {
+                    type = with types; nullOr nonEmptyStr;
+                    default = null;
+                  };
+                };
+              };
+            };
+            svg = mkOption {
+              type = types.submodule {
+                options = {
+                  enable = mkEnableOption "SVG minification";
+                  package = mkPackageOption pkgs "scour" { };
+                };
+              };
+            };
+          };
+        });
+        default = true;
+        description = "Do minification on public static files";
+      };
+
+      precompressStaticFiles = mkOption {
+        type = with types; submodule {
+          options = {
+            brotli = {
+              enable = mkEnableOption "Brotli precompression";
+              package = mkPackageOption pkgs "brotli" { };
+              compressionLevel = mkOption {
+                type = types.ints.between 0 11;
+                default = 11;
+                description = "Brotli compression level";
+              };
+            };
+            gzip = {
+              enable = mkEnableOption "Gzip precompression";
+              package = mkPackageOption pkgs "gzip" { };
+              compressionLevel = mkOption {
+                type = types.ints.between 1 9;
+                default = 9;
+                description = "Gzip compression level";
+              };
+            };
+          };
+        };
+        default = {
+          brotli.enable = true;
+          gzip.enable = false;
+        };
+        description = "Aggressively precompress static files";
+      };
+
+      podConfig = mkOption {
+        type = types.submodule {
+          options = {
+            info = mkOption {
+              type = with types; nullOr str;
+              default = null;
+              description = "Content of the info box on the login page";
+            };
+
+            description = mkOption {
+              type = with types; nullOr str;
+              default = null;
+              description = "General description of the instance";
+            };
+
+            timezone = mkOption {
+              type = with types; nullOr str;
+              default = null;
+              description = "The server timezone";
+            };
+
+            restrictsuggestions = mkOption {
+              type = with types; nullOr bool;
+              default = null;
+              description = "Only suggest chatrooms, Communities and other contents that are available on the user XMPP server and related services";
+            };
+
+            chatonly = mkOption {
+              type = with types; nullOr bool;
+              default = null;
+              description = "Disable all the social feature (Communities, Blog…) and keep only the chat ones";
+            };
+
+            disableregistration = mkOption {
+              type = with types; nullOr bool;
+              default = null;
+              description = "Remove the XMPP registration flow and buttons from the interface";
+            };
+
+            loglevel = mkOption {
+              type = with types; nullOr (ints.between 0 3);
+              default = null;
+              description = "The server loglevel";
+            };
+
+            locale = mkOption {
+              type = with types; nullOr str;
+              default = null;
+              description = "The server main locale";
+            };
+
+            xmppdomain = mkOption {
+              type = with types; nullOr str;
+              default = null;
+              description = "The default XMPP server domain";
+            };
+
+            xmppdescription = mkOption {
+              type = with types; nullOr str;
+              default = null;
+              description = "The default XMPP server description";
+            };
+
+            xmppwhitelist = mkOption {
+              type = with types; nullOr str;
+              default = null;
+              description = "The allowlisted XMPP servers";
+            };
+          };
+        };
+        default = { };
+        description = ''
+          Pod configuration (values from `php daemon.php config --help`).
+          Note that these values will now be disabled in the admin panel.
+        '';
+      };
+
+      settings = mkOption {
+        type = with types; attrsOf (nullOr (oneOf [ int str bool ]));
+        default = { };
+        description = ".env settings for Movim. Secrets should use `secretFile` option instead. `null`s will be culled.";
+      };
+
+      secretFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
+        description = "The secret file to be sourced for the .env settings.";
+      };
+
+      database = {
+        type = mkOption {
+          type = types.enum [ "mysql" "postgresql" ];
+          example = "mysql";
+          default = "postgresql";
+          description = "Database engine to use.";
+        };
+
+        name = mkOption {
+          type = types.str;
+          default = "movim";
+          description = "Database name.";
+        };
+
+        user = mkOption {
+          type = types.str;
+          default = "movim";
+          description = "Database username.";
+        };
+
+        createLocally = mkOption {
+          type = types.bool;
+          default = true;
+          description = "local database using UNIX socket authentication";
+        };
+      };
+
+      nginx = mkOption {
+        type = with types; nullOr (submodule
+          (import ../web-servers/nginx/vhost-options.nix {
+            inherit config lib;
+          }));
+        default = null;
+        example = lib.literalExpression /* nginx */ ''
+          {
+            serverAliases = [
+              "pics.''${config.networking.domain}"
+            ];
+            enableACME = true;
+            forceHttps = true;
+          }
+        '';
+        description = ''
+          With this option, you can customize an nginx virtual host which already has sensible defaults for Movim.
+          Set to `{ }` if you do not need any customization to the virtual host.
+          If enabled, then by default, the {option}`serverName` is `''${domain}`,
+          If this is set to null (the default), no nginx virtualHost will be configured.
+        '';
+      };
+
+      poolConfig = mkOption {
+        type = with types; attrsOf (oneOf [ int str bool ]);
+        default = { };
+        description = "Options for Movim’s PHP-FPM pool.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    users = {
+      users = {
+        movim = mkIf (cfg.user == "movim") {
+          isSystemUser = true;
+          group = cfg.group;
+        };
+        "${config.services.nginx.user}".extraGroups = [ cfg.group ];
+      };
+      groups = {
+        ${cfg.group} = { };
+      };
+    };
+
+    services = {
+      movim = {
+        settings = mkMerge [
+          {
+            DAEMON_URL = "//${cfg.domain}";
+            DAEMON_PORT = cfg.port;
+            DAEMON_INTERFACE = "127.0.0.1";
+            DAEMON_DEBUG = cfg.debug;
+            DAEMON_VERBOSE = cfg.verbose;
+          }
+          (mkIf cfg.database.createLocally {
+            DB_DRIVER = {
+              "postgresql" = "pgsql";
+              "mysql" = "mysql";
+            }.${cfg.database.type};
+            DB_HOST = "localhost";
+            DB_PORT = config.services.${cfg.database.type}.settings.port;
+            DB_DATABASE = cfg.database.name;
+            DB_USERNAME = cfg.database.user;
+            DB_PASSWORD = "";
+          })
+        ];
+
+        poolConfig = lib.mapAttrs' (n: v: lib.nameValuePair n (lib.mkDefault v)) {
+          "pm" = "dynamic";
+          "php_admin_value[error_log]" = "stderr";
+          "php_admin_flag[log_errors]" = true;
+          "catch_workers_output" = true;
+          "pm.max_children" = 32;
+          "pm.start_servers" = 2;
+          "pm.min_spare_servers" = 2;
+          "pm.max_spare_servers" = 8;
+          "pm.max_requests" = 500;
+        };
+      };
+
+      nginx = mkIf (cfg.nginx != null) {
+        enable = true;
+        recommendedOptimisation = true;
+        recommendedGzipSettings = true;
+        recommendedBrotliSettings = true;
+        recommendedProxySettings = true;
+        # TODO: recommended cache options already in Nginx⁇
+        appendHttpConfig = /* nginx */ ''
+          fastcgi_cache_path /tmp/nginx_cache levels=1:2 keys_zone=nginx_cache:100m inactive=60m;
+          fastcgi_cache_key "$scheme$request_method$host$request_uri";
+        '';
+        virtualHosts."${cfg.domain}" = mkMerge [
+          cfg.nginx
+          {
+            root = lib.mkForce "${package}/share/php/movim/public";
+            locations = {
+              "/favicon.ico" = {
+                priority = 100;
+                extraConfig = /* nginx */ ''
+                  access_log off;
+                  log_not_found off;
+                '';
+              };
+              "/robots.txt" = {
+                priority = 100;
+                extraConfig = /* nginx */ ''
+                  access_log off;
+                  log_not_found off;
+                '';
+              };
+              "~ /\\.(?!well-known).*" = {
+                priority = 210;
+                extraConfig = /* nginx */ ''
+                  deny all;
+                '';
+              };
+              # Ask nginx to cache every URL starting with "/picture"
+              "/picture" = {
+                priority = 400;
+                tryFiles = "$uri $uri/ /index.php$is_args$args";
+                extraConfig = /* nginx */ ''
+                  set $no_cache 0; # Enable cache only there
+                '';
+              };
+              "/" = {
+                priority = 490;
+                tryFiles = "$uri $uri/ /index.php$is_args$args";
+                extraConfig = /* nginx */ ''
+                  # https://github.com/movim/movim/issues/314
+                  add_header Content-Security-Policy "default-src 'self'; img-src 'self' aesgcm: https:; media-src 'self' aesgcm: https:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline';";
+                  set $no_cache 1;
+                '';
+              };
+              "~ \\.php$" = {
+                priority = 500;
+                tryFiles = "$uri =404";
+                extraConfig = /* nginx */ ''
+                  include ${config.services.nginx.package}/conf/fastcgi.conf;
+                  add_header X-Cache $upstream_cache_status;
+                  fastcgi_ignore_headers "Cache-Control" "Expires" "Set-Cookie";
+                  fastcgi_cache nginx_cache;
+                  fastcgi_cache_valid any 7d;
+                  fastcgi_cache_bypass $no_cache;
+                  fastcgi_no_cache $no_cache;
+                  fastcgi_split_path_info ^(.+\.php)(/.+)$;
+                  fastcgi_index index.php;
+                  fastcgi_pass unix:${fpm.socket};
+                '';
+              };
+              "/ws/" = {
+                priority = 900;
+                proxyPass = "http://${cfg.settings.DAEMON_INTERFACE}:${builtins.toString cfg.port}/";
+                proxyWebsockets = true;
+                recommendedProxySettings = true;
+                extraConfig = /* nginx */ ''
+                  proxy_set_header X-Forwarded-Proto $scheme;
+                  proxy_redirect off;
+                '';
+              };
+            };
+            extraConfig = /* ngnix */ ''
+              index index.php;
+            '';
+          }
+        ];
+      };
+
+      mysql = mkIf (cfg.database.createLocally && cfg.database.type == "mysql") {
+        enable = mkDefault true;
+        package = mkDefault pkgs.mariadb;
+        ensureDatabases = [ cfg.database.name ];
+        ensureUsers = [{
+          name = cfg.user;
+          ensureDBOwnership = true;
+        }];
+      };
+
+      postgresql = mkIf (cfg.database.createLocally && cfg.database.type == "postgresql") {
+        enable = mkDefault true;
+        ensureDatabases = [ cfg.database.name ];
+        ensureUsers = [{
+          name = cfg.user;
+          ensureDBOwnership = true;
+        }];
+        authentication = ''
+          host ${cfg.database.name} ${cfg.database.user} localhost trust
+        '';
+      };
+
+      phpfpm.pools.${pool} =
+        let
+          socketOwner =
+            if (cfg.nginx != null)
+            then config.services.nginx.user
+            else cfg.user;
+        in
+        {
+          phpPackage = package.php;
+          user = cfg.user;
+          group = cfg.group;
+
+          phpOptions = ''
+            error_log = 'stderr'
+            log_errors = on
+          '';
+
+          settings = {
+            "listen.owner" = socketOwner;
+            "listen.group" = cfg.group;
+            "listen.mode" = "0660";
+            "catch_workers_output" = true;
+          } // cfg.poolConfig;
+        };
+    };
+
+    systemd = {
+      services.movim-data-setup = {
+        description = "Movim setup: .env file, databases init, cache reload";
+        wantedBy = [ "multi-user.target" ];
+        requiredBy = [ "${phpExecutionUnit}.service" ];
+        before = [ "${phpExecutionUnit}.service" ];
+        after = lib.optional cfg.database.createLocally dbService;
+        requires = lib.optional cfg.database.createLocally dbService;
+
+        serviceConfig = {
+          Type = "oneshot";
+          User = cfg.user;
+          Group = cfg.group;
+          UMask = "077";
+        } // lib.optionalAttrs (cfg.secretFile != null) {
+          LoadCredential = "env-secrets:${cfg.secretFile}";
+        };
+
+        script = ''
+          # Env vars
+          rm -f ${cfg.dataDir}/.env
+          cp --no-preserve=all ${configFile} ${cfg.dataDir}/.env
+          echo -e '\n' >> ${cfg.dataDir}/.env
+          if [[ -f "$CREDENTIALS_DIRECTORY/env-secrets"  ]]; then
+            cat "$CREDENTIALS_DIRECTORY/env-secrets" >> ${cfg.dataDir}/.env
+            echo -e '\n' >> ${cfg.dataDir}/.env
+          fi
+
+          # Caches, logs
+          mkdir -p ${cfg.dataDir}/public/cache ${cfg.logDir} ${cfg.runtimeDir}/cache
+          chmod -R ug+rw ${cfg.dataDir}/public/cache
+          chmod -R ug+rw ${cfg.logDir}
+          chmod -R ug+rwx ${cfg.runtimeDir}/cache
+
+          # Migrations
+          MOVIM_VERSION="${package.version}"
+          if [[ ! -f "${cfg.dataDir}/.migration-version" ]] || [[ "$MOVIM_VERSION" != "$(<${cfg.dataDir}/.migration-version)" ]]; then
+            ${package}/bin/movim-composer movim:migrate && echo $MOVIM_VERSION > ${cfg.dataDir}/.migration-version
+          fi
+        ''
+        + lib.optionalString (podConfigFlags != "") (
+          let
+            flags = lib.concatStringsSep " "
+              ([ "--no-interaction" ]
+                ++ lib.optional cfg.debug "-vvv"
+                ++ lib.optional (!cfg.debug && cfg.verbose) "-v");
+          in
+          ''
+            ${lib.getExe package} config ${podConfigFlags}
+          ''
+        );
+      };
+
+      services.movim = {
+        description = "Movim daemon";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "movim-data-setup.service" ];
+        requires = [ "movim-data-setup.service" ]
+          ++ lib.optional cfg.database.createLocally dbService;
+        environment = {
+          PUBLIC_URL = "//${cfg.domain}";
+          WS_PORT = builtins.toString cfg.port;
+        };
+
+        serviceConfig = {
+          User = cfg.user;
+          Group = cfg.group;
+          WorkingDirectory = "${package}/share/php/movim";
+          ExecStart = "${lib.getExe package} start";
+        };
+      };
+
+      services.${phpExecutionUnit} = {
+        after = [ "movim-data-setup.service" ];
+        requires = [ "movim-data-setup.service" ]
+          ++ lib.optional cfg.database.createLocally dbService;
+      };
+
+      tmpfiles.settings."10-movim" = with cfg; {
+        "${dataDir}".d = { inherit user group; mode = "0710"; };
+        "${dataDir}/public".d = { inherit user group; mode = "0750"; };
+        "${dataDir}/public/cache".d = { inherit user group; mode = "0750"; };
+        "${runtimeDir}".d = { inherit user group; mode = "0700"; };
+        "${runtimeDir}/cache".d = { inherit user group; mode = "0700"; };
+        "${logDir}".d = { inherit user group; mode = "0700"; };
+      };
+    };
+  };
+}
--- a/nixos/modules/services/x11/desktop-managers/budgie.nix
+++ b/nixos/modules/services/x11/desktop-managers/budgie.nix
@ -43,6 +43,8 @@ let
  budgie-control-center = pkgs.budgie.budgie-control-center.override {
    enableSshSocket = config.services.openssh.startWhenNeeded;
  };
+
+  notExcluded = pkg: (!(lib.elem pkg config.environment.budgie.excludePackages));
 in {
  meta.maintainers = lib.teams.budgie.members;

@ -160,7 +162,7 @@ in {
      ++ cfg.sessionPath;

    # Both budgie-desktop-view and nemo defaults to this emulator.
-    programs.gnome-terminal.enable = mkDefault true;
+    programs.gnome-terminal.enable = mkDefault (notExcluded pkgs.gnome.gnome-terminal);

    # Fonts.
    fonts.packages = [
--- a/nixos/modules/services/x11/desktop-managers/cinnamon.nix
+++ b/nixos/modules/services/x11/desktop-managers/cinnamon.nix
@ -95,7 +95,7 @@ in
      '';

      # Default services
-      services.blueman.enable = mkDefault true;
+      services.blueman.enable = mkDefault (notExcluded pkgs.blueman);
      hardware.bluetooth.enable = mkDefault true;
      hardware.pulseaudio.enable = mkDefault true;
      security.polkit.enable = true;
@ -228,10 +228,10 @@ in
    })

    (mkIf serviceCfg.apps.enable {
-      programs.geary.enable = mkDefault true;
-      programs.gnome-disks.enable = mkDefault true;
-      programs.gnome-terminal.enable = mkDefault true;
-      programs.file-roller.enable = mkDefault true;
+      programs.geary.enable = mkDefault (notExcluded pkgs.gnome.geary);
+      programs.gnome-disks.enable = mkDefault (notExcluded pkgs.gnome.gnome-disk-utility);
+      programs.gnome-terminal.enable = mkDefault (notExcluded pkgs.gnome.gnome-terminal);
+      programs.file-roller.enable = mkDefault (notExcluded pkgs.gnome.file-roller);

      environment.systemPackages = with pkgs // pkgs.gnome // pkgs.cinnamon; utils.removePackagesByName [
        # cinnamon team apps
--- a/nixos/modules/services/x11/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/x11/desktop-managers/pantheon.nix
@ -12,6 +12,7 @@ let
    extraGSettingsOverrides = cfg.extraGSettingsOverrides;
  };

+  notExcluded = pkg: (!(lib.elem pkg config.environment.pantheon.excludePackages));
 in

 {
@ -288,8 +289,8 @@ in
    })

    (mkIf serviceCfg.apps.enable {
-      programs.evince.enable = mkDefault true;
-      programs.file-roller.enable = mkDefault true;
+      programs.evince.enable = mkDefault (notExcluded pkgs.gnome.evince);
+      programs.file-roller.enable = mkDefault (notExcluded pkgs.gnome.file-roller);

      environment.systemPackages = utils.removePackagesByName ([
        pkgs.gnome.gnome-font-viewer
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -558,6 +558,7 @@ in {
  morty = handleTest ./morty.nix {};
  mosquitto = handleTest ./mosquitto.nix {};
  moosefs = handleTest ./moosefs.nix {};
+  movim = discoverTests (import ./web-apps/movim { inherit handleTestOn; });
  mpd = handleTest ./mpd.nix {};
  mpv = handleTest ./mpv.nix {};
  mtp = handleTest ./mtp.nix {};
--- a/nixos/tests/budgie.nix
+++ b/nixos/tests/budgie.nix
@ -18,6 +18,10 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
      };
    };

+    # We don't ship gnome-text-editor in Budgie module, we add this line mainly
+    # to catch eval issues related to this option.
+    environment.budgie.excludePackages = [ pkgs.gnome-text-editor ];
+
    services.xserver.desktopManager.budgie = {
      enable = true;
      extraPlugins = [
--- a/nixos/tests/cinnamon.nix
+++ b/nixos/tests/cinnamon.nix
@ -8,6 +8,10 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
    services.xserver.enable = true;
    services.xserver.desktopManager.cinnamon.enable = true;

+    # We don't ship gnome-text-editor in Cinnamon module, we add this line mainly
+    # to catch eval issues related to this option.
+    environment.cinnamon.excludePackages = [ pkgs.gnome-text-editor ];
+
    # For the sessionPath subtest.
    services.xserver.desktopManager.cinnamon.sessionPath = [ pkgs.gnome.gpaste ];
  };
--- a/nixos/tests/pantheon.nix
+++ b/nixos/tests/pantheon.nix
@ -13,6 +13,13 @@ import ./make-test-python.nix ({ pkgs, lib, ...} :
    services.xserver.enable = true;
    services.xserver.desktopManager.pantheon.enable = true;

+    # We ship pantheon.appcenter by default when this is enabled.
+    services.flatpak.enable = true;
+
+    # We don't ship gnome-text-editor in Pantheon module, we add this line mainly
+    # to catch eval issues related to this option.
+    environment.pantheon.excludePackages = [ pkgs.gnome-text-editor ];
+
    environment.systemPackages = [ pkgs.xdotool ];
  };

--- a/nixos/tests/web-apps/movim/default.nix
+++ b/nixos/tests/web-apps/movim/default.nix
@ -0,0 +1,8 @@
+{ system ? builtins.currentSystem, handleTestOn }:
+
+let
+  supportedSystems = [ "x86_64-linux" "i686-linux" ];
+in
+{
+  standard = handleTestOn supportedSystems ./standard.nix { inherit system; };
+}
--- a/nixos/tests/web-apps/movim/standard.nix
+++ b/nixos/tests/web-apps/movim/standard.nix
@ -0,0 +1,102 @@
+import ../../make-test-python.nix ({ lib, pkgs, ... }:
+
+let
+  movim = {
+    domain = "movim.local";
+    info = "No ToS in tests";
+    description = "NixOS testing server";
+  };
+  xmpp = {
+    domain = "xmpp.local";
+    admin = rec {
+      JID = "${username}@${xmpp.domain}";
+      username = "romeo";
+      password = "juliet";
+    };
+  };
+in
+{
+  name = "movim-standard";
+
+  meta = {
+    maintainers = with pkgs.lib.maintainers; [ toastal ];
+  };
+
+  nodes = {
+    server = { pkgs, ... }: {
+      services.movim = {
+        inherit (movim) domain;
+        enable = true;
+        verbose = true;
+        podConfig = {
+          inherit (movim) description info;
+          xmppdomain = xmpp.domain;
+        };
+        nginx = { };
+      };
+
+      services.prosody = {
+        enable = true;
+        xmppComplianceSuite = false;
+        disco_items = [
+          { url = "upload.${xmpp.domain}"; description = "File Uploads"; }
+        ];
+        virtualHosts."${xmpp.domain}" = {
+          inherit (xmpp) domain;
+          enabled = true;
+          extraConfig = ''
+            Component "pubsub.${xmpp.domain}" "pubsub"
+                pubsub_max_items = 10000
+                expose_publisher = true
+
+            Component "upload.${xmpp.domain}" "http_file_share"
+                http_external_url = "http://upload.${xmpp.domain}"
+                http_file_share_expires_after = 300 * 24 * 60 * 60
+                http_file_share_size_limit = 1024 * 1024 * 1024
+                http_file_share_daily_quota = 4 * 1024 * 1024 * 1024
+          '';
+        };
+        extraConfig = ''
+          pep_max_items = 10000
+
+          http_paths = {
+              file_share = "/";
+          }
+        '';
+      };
+
+      networking.extraHosts = ''
+        127.0.0.1 ${movim.domain}
+        127.0.0.1 ${xmpp.domain}
+      '';
+    };
+  };
+
+  testScript = /* python */ ''
+    server.wait_for_unit("phpfpm-movim.service")
+    server.wait_for_unit("nginx.service")
+    server.wait_for_open_port(80)
+
+    server.wait_for_unit("prosody.service")
+    server.succeed('prosodyctl status | grep "Prosody is running"')
+    server.succeed("prosodyctl register ${xmpp.admin.username} ${xmpp.domain} ${xmpp.admin.password}")
+
+    server.wait_for_unit("movim.service")
+
+    # Test unauthenticated
+    server.fail("curl -L --fail-with-body --max-redirs 0 http://${movim.domain}/chat")
+
+    # Test basic Websocket
+    server.succeed("echo \"\" | ${lib.getExe pkgs.websocat} 'ws://${movim.domain}/ws/?path=login&offset=0' --origin 'http://${movim.domain}'")
+
+    # Test login + create cookiejar
+    login_html = server.succeed("curl --fail-with-body -c /tmp/cookies http://${movim.domain}/login")
+    assert "${movim.description}" in login_html
+    assert "${movim.info}" in login_html
+
+    # Test authentication POST
+    server.succeed("curl --fail-with-body -b /tmp/cookies -X POST --data-urlencode 'username=${xmpp.admin.JID}' --data-urlencode 'password=${xmpp.admin.password}' http://${movim.domain}/login")
+
+    server.succeed("curl -L --fail-with-body --max-redirs 1 -b /tmp/cookies http://${movim.domain}/chat")
+  '';
+})
--- a/pkgs/applications/editors/jetbrains/bin/versions.json
+++ b/pkgs/applications/editors/jetbrains/bin/versions.json
@ -3,18 +3,18 @@
    "clion": {
      "update-channel": "CLion RELEASE",
      "url-template": "https://download.jetbrains.com/cpp/CLion-{version}.tar.gz",
-      "version": "2023.3.4",
-      "sha256": "eae2e1646387ee36a2f24c10d924647fd3d00bb31dd42e9c17438ae7aecf79a8",
-      "url": "https://download.jetbrains.com/cpp/CLion-2023.3.4.tar.gz",
-      "build_number": "233.14475.31"
+      "version": "2024.1",
+      "sha256": "a753369d74832d15fcf082587291921e8a90be04529c05b8e9d64a3afb24120c",
+      "url": "https://download.jetbrains.com/cpp/CLion-2024.1.tar.gz",
+      "build_number": "241.14494.288"
    },
    "datagrip": {
      "update-channel": "DataGrip RELEASE",
      "url-template": "https://download.jetbrains.com/datagrip/datagrip-{version}.tar.gz",
-      "version": "2024.1",
-      "sha256": "cc77892adcbf28b1a2205908466cca9c80217162cdac020d25d258a84cbb88d3",
-      "url": "https://download.jetbrains.com/datagrip/datagrip-2024.1.tar.gz",
-      "build_number": "241.14494.251"
+      "version": "2024.1.1",
+      "sha256": "05c1f910126b8499d26ab52d333307d3b6df6a3fa06b5e0b1a79ff15caf40e0a",
+      "url": "https://download.jetbrains.com/datagrip/datagrip-2024.1.1.tar.gz",
+      "build_number": "241.14494.283"
    },
    "dataspell": {
      "update-channel": "DataSpell RELEASE",
@ -92,10 +92,10 @@
    "rider": {
      "update-channel": "Rider RELEASE",
      "url-template": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}.tar.gz",
-      "version": "2023.3.4",
-      "sha256": "fb137ea346d957f151cb0d7755661293ae5e33e36f306b6dc90fb42895443309",
-      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2023.3.4.tar.gz",
-      "build_number": "233.14475.66"
+      "version": "2024.1",
+      "sha256": "194096b0b550e1e320fc72aaf0510faeebf8737d05f6e02eecd72efe6f7cd757",
+      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2024.1.tar.gz",
+      "build_number": "241.14494.307"
    },
    "ruby-mine": {
      "update-channel": "RubyMine RELEASE",
@ -126,18 +126,18 @@
    "clion": {
      "update-channel": "CLion RELEASE",
      "url-template": "https://download.jetbrains.com/cpp/CLion-{version}-aarch64.tar.gz",
-      "version": "2023.3.4",
-      "sha256": "fa427be85ead8e2769aeadf19ce816cb7f02c3b08ec3b4cc7e0cddea44386dc8",
-      "url": "https://download.jetbrains.com/cpp/CLion-2023.3.4-aarch64.tar.gz",
-      "build_number": "233.14475.31"
+      "version": "2024.1",
+      "sha256": "f937b263bd697595427e3e1d04513f9b6a786d56214ce34fe7a038efa2e949cf",
+      "url": "https://download.jetbrains.com/cpp/CLion-2024.1-aarch64.tar.gz",
+      "build_number": "241.14494.288"
    },
    "datagrip": {
      "update-channel": "DataGrip RELEASE",
      "url-template": "https://download.jetbrains.com/datagrip/datagrip-{version}-aarch64.tar.gz",
-      "version": "2024.1",
-      "sha256": "b293ed99d29510422090736c4e30a0ccd3974fc01ecce7a9f5f497c34b8ea077",
-      "url": "https://download.jetbrains.com/datagrip/datagrip-2024.1-aarch64.tar.gz",
-      "build_number": "241.14494.251"
+      "version": "2024.1.1",
+      "sha256": "d269bfe10fb97572e785dce6e387d09f429396db002e12ecb9a44cced915c032",
+      "url": "https://download.jetbrains.com/datagrip/datagrip-2024.1.1-aarch64.tar.gz",
+      "build_number": "241.14494.283"
    },
    "dataspell": {
      "update-channel": "DataSpell RELEASE",
@ -215,10 +215,10 @@
    "rider": {
      "update-channel": "Rider RELEASE",
      "url-template": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}-aarch64.tar.gz",
-      "version": "2023.3.4",
-      "sha256": "99c80997bd0d2b8b918ef81fbbe7b422e165665c8fa3d108b1387ca0188c9558",
-      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2023.3.4-aarch64.tar.gz",
-      "build_number": "233.14475.66"
+      "version": "2024.1",
+      "sha256": "e196c8e70d7eb6f56a08df809f5de430bf5e61509abb13de8b301c036c4f446e",
+      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2024.1-aarch64.tar.gz",
+      "build_number": "241.14494.307"
    },
    "ruby-mine": {
      "update-channel": "RubyMine RELEASE",
@ -249,18 +249,18 @@
    "clion": {
      "update-channel": "CLion RELEASE",
      "url-template": "https://download.jetbrains.com/cpp/CLion-{version}.dmg",
-      "version": "2023.3.4",
-      "sha256": "2eb149d2bbf1c778f3386bc9cf7b11741b4372e69c680def31260b9aa213159e",
-      "url": "https://download.jetbrains.com/cpp/CLion-2023.3.4.dmg",
-      "build_number": "233.14475.31"
+      "version": "2024.1",
+      "sha256": "373c78ff045a17fdcae44cc9b76b41862d4bee9c8476813e518c7cc1de88b6a1",
+      "url": "https://download.jetbrains.com/cpp/CLion-2024.1.dmg",
+      "build_number": "241.14494.288"
    },
    "datagrip": {
      "update-channel": "DataGrip RELEASE",
      "url-template": "https://download.jetbrains.com/datagrip/datagrip-{version}.dmg",
-      "version": "2024.1",
-      "sha256": "8a76d76466b62da1a68d08a066a56319b81e3cab09b57ab11822bf4373def6ce",
-      "url": "https://download.jetbrains.com/datagrip/datagrip-2024.1.dmg",
-      "build_number": "241.14494.251"
+      "version": "2024.1.1",
+      "sha256": "232582204a6f810bcbd2387ba2cef824f0f81c3a7e022f7f2bebf643d32f866d",
+      "url": "https://download.jetbrains.com/datagrip/datagrip-2024.1.1.dmg",
+      "build_number": "241.14494.283"
    },
    "dataspell": {
      "update-channel": "DataSpell RELEASE",
@ -338,10 +338,10 @@
    "rider": {
      "update-channel": "Rider RELEASE",
      "url-template": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}.dmg",
-      "version": "2023.3.4",
-      "sha256": "00435dc8d9dd43bbd73a55be7d5b304be8ee124032a7485750aef86cddc53ba2",
-      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2023.3.4.dmg",
-      "build_number": "233.14475.66"
+      "version": "2024.1",
+      "sha256": "12155c779c7f11dd71b3573af266c0221960eaea8a442fda4faaec8ca6eefa95",
+      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2024.1.dmg",
+      "build_number": "241.14494.307"
    },
    "ruby-mine": {
      "update-channel": "RubyMine RELEASE",
@ -372,18 +372,18 @@
    "clion": {
      "update-channel": "CLion RELEASE",
      "url-template": "https://download.jetbrains.com/cpp/CLion-{version}-aarch64.dmg",
-      "version": "2023.3.4",
-      "sha256": "340d239008c38743a10e51ae609ec3bf3dd732cf2042ef997532c6b8ed272b1a",
-      "url": "https://download.jetbrains.com/cpp/CLion-2023.3.4-aarch64.dmg",
-      "build_number": "233.14475.31"
+      "version": "2024.1",
+      "sha256": "b1044fdbf9e3f93aaf8ca8ad2b7bc2eae165f86bc5cae6910f2ad0ee92c198a5",
+      "url": "https://download.jetbrains.com/cpp/CLion-2024.1-aarch64.dmg",
+      "build_number": "241.14494.288"
    },
    "datagrip": {
      "update-channel": "DataGrip RELEASE",
      "url-template": "https://download.jetbrains.com/datagrip/datagrip-{version}-aarch64.dmg",
-      "version": "2024.1",
-      "sha256": "a5e92addc3f098670814c4d5660f275f997eaa958e9eb24007f862cfb74b8118",
-      "url": "https://download.jetbrains.com/datagrip/datagrip-2024.1-aarch64.dmg",
-      "build_number": "241.14494.251"
+      "version": "2024.1.1",
+      "sha256": "c2545df9784fa1f8f9234dd93d1c513ed691c797f26471cb545188ce7f495864",
+      "url": "https://download.jetbrains.com/datagrip/datagrip-2024.1.1-aarch64.dmg",
+      "build_number": "241.14494.283"
    },
    "dataspell": {
      "update-channel": "DataSpell RELEASE",
@ -461,10 +461,10 @@
    "rider": {
      "update-channel": "Rider RELEASE",
      "url-template": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}-aarch64.dmg",
-      "version": "2023.3.4",
-      "sha256": "8ffd13dcc2207d4a781dc92e89643767e0dd6ef53024c92669f4daaf9cf929c0",
-      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2023.3.4-aarch64.dmg",
-      "build_number": "233.14475.66"
+      "version": "2024.1",
+      "sha256": "c2e0dadc6c7f924e849e87d1c04aeaa02d6a14d5868294dd36481a70cbd508cb",
+      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2024.1-aarch64.dmg",
+      "build_number": "241.14494.307"
    },
    "ruby-mine": {
      "update-channel": "RubyMine RELEASE",
--- a/pkgs/applications/editors/jetbrains/plugins/plugins.json
+++ b/pkgs/applications/editors/jetbrains/plugins/plugins.json
@ -18,8 +18,6 @@
      ],
      "builds": {
        "233.13135.979": "https://plugins.jetbrains.com/files/164/515255/IdeaVim-2.10.2-signed.zip",
-        "233.14475.31": "https://plugins.jetbrains.com/files/164/515255/IdeaVim-2.10.2-signed.zip",
-        "233.14475.66": "https://plugins.jetbrains.com/files/164/515255/IdeaVim-2.10.2-signed.zip",
        "233.15026.24": "https://plugins.jetbrains.com/files/164/515255/IdeaVim-2.10.2-signed.zip",
        "241.14494.234": "https://plugins.jetbrains.com/files/164/515255/IdeaVim-2.10.2-signed.zip",
        "241.14494.235": "https://plugins.jetbrains.com/files/164/515255/IdeaVim-2.10.2-signed.zip",
@ -27,7 +25,9 @@
        "241.14494.238": "https://plugins.jetbrains.com/files/164/515255/IdeaVim-2.10.2-signed.zip",
        "241.14494.240": "https://plugins.jetbrains.com/files/164/515255/IdeaVim-2.10.2-signed.zip",
        "241.14494.241": "https://plugins.jetbrains.com/files/164/515255/IdeaVim-2.10.2-signed.zip",
-        "241.14494.251": "https://plugins.jetbrains.com/files/164/515255/IdeaVim-2.10.2-signed.zip"
+        "241.14494.283": "https://plugins.jetbrains.com/files/164/515255/IdeaVim-2.10.2-signed.zip",
+        "241.14494.288": "https://plugins.jetbrains.com/files/164/515255/IdeaVim-2.10.2-signed.zip",
+        "241.14494.307": "https://plugins.jetbrains.com/files/164/515255/IdeaVim-2.10.2-signed.zip"
      },
      "name": "ideavim"
    },
@ -42,13 +42,32 @@
    },
    "6954": {
      "compatible": [
+        "clion",
+        "datagrip",
+        "goland",
        "idea-community",
        "idea-ultimate",
-        "mps"
+        "mps",
+        "phpstorm",
+        "pycharm-community",
+        "pycharm-professional",
+        "rider",
+        "ruby-mine",
+        "rust-rover",
+        "webstorm"
      ],
      "builds": {
        "233.13135.979": null,
-        "241.14494.240": null
+        "233.15026.24": null,
+        "241.14494.234": null,
+        "241.14494.235": null,
+        "241.14494.237": null,
+        "241.14494.238": null,
+        "241.14494.240": null,
+        "241.14494.241": null,
+        "241.14494.283": null,
+        "241.14494.288": null,
+        "241.14494.307": null
      },
      "name": "kotlin"
    },
@ -70,8 +89,6 @@
      ],
      "builds": {
        "233.13135.979": null,
-        "233.14475.31": null,
-        "233.14475.66": null,
        "233.15026.24": "https://plugins.jetbrains.com/files/6981/509027/ini-233.15026.15.zip",
        "241.14494.234": "https://plugins.jetbrains.com/files/6981/513562/ini-241.14494.240.zip",
        "241.14494.235": "https://plugins.jetbrains.com/files/6981/513562/ini-241.14494.240.zip",
@ -79,7 +96,9 @@
        "241.14494.238": "https://plugins.jetbrains.com/files/6981/513562/ini-241.14494.240.zip",
        "241.14494.240": "https://plugins.jetbrains.com/files/6981/513562/ini-241.14494.240.zip",
        "241.14494.241": "https://plugins.jetbrains.com/files/6981/513562/ini-241.14494.240.zip",
-        "241.14494.251": "https://plugins.jetbrains.com/files/6981/513562/ini-241.14494.240.zip"
+        "241.14494.283": "https://plugins.jetbrains.com/files/6981/513562/ini-241.14494.240.zip",
+        "241.14494.288": "https://plugins.jetbrains.com/files/6981/513562/ini-241.14494.240.zip",
+        "241.14494.307": "https://plugins.jetbrains.com/files/6981/513562/ini-241.14494.240.zip"
      },
      "name": "ini"
    },
@ -89,8 +108,8 @@
        "phpstorm"
      ],
      "builds": {
-        "241.14494.237": "https://plugins.jetbrains.com/files/7219/514919/Symfony_Plugin-2023.1.267.zip",
-        "241.14494.240": "https://plugins.jetbrains.com/files/7219/514919/Symfony_Plugin-2023.1.267.zip"
+        "241.14494.237": "https://plugins.jetbrains.com/files/7219/518876/Symfony_Plugin-2023.1.268.zip",
+        "241.14494.240": "https://plugins.jetbrains.com/files/7219/518876/Symfony_Plugin-2023.1.268.zip"
      },
      "name": "symfony-support"
    },
@ -114,11 +133,11 @@
        "rust-rover"
      ],
      "builds": {
-        "233.14475.66": "https://plugins.jetbrains.com/files/7322/484110/python-ce-233.14475.9.zip",
        "233.15026.24": "https://plugins.jetbrains.com/files/7322/502153/python-ce-233.14808.12.zip",
        "241.14494.238": "https://plugins.jetbrains.com/files/7322/513587/python-ce-241.14494.240.zip",
        "241.14494.240": "https://plugins.jetbrains.com/files/7322/513587/python-ce-241.14494.240.zip",
-        "241.14494.251": "https://plugins.jetbrains.com/files/7322/513587/python-ce-241.14494.240.zip"
+        "241.14494.283": "https://plugins.jetbrains.com/files/7322/513587/python-ce-241.14494.240.zip",
+        "241.14494.307": "https://plugins.jetbrains.com/files/7322/513587/python-ce-241.14494.240.zip"
      },
      "name": "python-community-edition"
    },
@ -139,15 +158,15 @@
      ],
      "builds": {
        "233.13135.979": "https://plugins.jetbrains.com/files/8182/466854/intellij-rust-233.15445.zip",
-        "233.14475.31": "https://plugins.jetbrains.com/files/8182/466854/intellij-rust-233.15445.zip",
-        "233.14475.66": "https://plugins.jetbrains.com/files/8182/466854/intellij-rust-233.15445.zip",
        "241.14494.234": null,
        "241.14494.235": null,
        "241.14494.237": null,
        "241.14494.238": null,
        "241.14494.240": null,
        "241.14494.241": null,
-        "241.14494.251": null
+        "241.14494.283": null,
+        "241.14494.288": null,
+        "241.14494.307": null
      },
      "name": "-deprecated-rust"
    },
@ -168,15 +187,15 @@
      ],
      "builds": {
        "233.13135.979": null,
-        "233.14475.31": null,
-        "233.14475.66": null,
        "241.14494.234": null,
        "241.14494.235": null,
        "241.14494.237": null,
        "241.14494.238": null,
        "241.14494.240": null,
        "241.14494.241": null,
-        "241.14494.251": null
+        "241.14494.283": null,
+        "241.14494.288": null,
+        "241.14494.307": null
      },
      "name": "-deprecated-rust-beta"
    },
@ -214,17 +233,17 @@
        "webstorm"
      ],
      "builds": {
-        "233.13135.979": "https://plugins.jetbrains.com/files/8607/422943/NixIDEA-0.4.0.11.zip",
-        "233.14475.31": "https://plugins.jetbrains.com/files/8607/422943/NixIDEA-0.4.0.11.zip",
-        "233.14475.66": "https://plugins.jetbrains.com/files/8607/422943/NixIDEA-0.4.0.11.zip",
-        "233.15026.24": "https://plugins.jetbrains.com/files/8607/422943/NixIDEA-0.4.0.11.zip",
-        "241.14494.234": null,
-        "241.14494.235": null,
-        "241.14494.237": null,
-        "241.14494.238": null,
-        "241.14494.240": null,
-        "241.14494.241": null,
-        "241.14494.251": null
+        "233.13135.979": "https://plugins.jetbrains.com/files/8607/519418/NixIDEA-0.4.0.12.zip",
+        "233.15026.24": "https://plugins.jetbrains.com/files/8607/519418/NixIDEA-0.4.0.12.zip",
+        "241.14494.234": "https://plugins.jetbrains.com/files/8607/519418/NixIDEA-0.4.0.12.zip",
+        "241.14494.235": "https://plugins.jetbrains.com/files/8607/519418/NixIDEA-0.4.0.12.zip",
+        "241.14494.237": "https://plugins.jetbrains.com/files/8607/519418/NixIDEA-0.4.0.12.zip",
+        "241.14494.238": "https://plugins.jetbrains.com/files/8607/519418/NixIDEA-0.4.0.12.zip",
+        "241.14494.240": "https://plugins.jetbrains.com/files/8607/519418/NixIDEA-0.4.0.12.zip",
+        "241.14494.241": "https://plugins.jetbrains.com/files/8607/519418/NixIDEA-0.4.0.12.zip",
+        "241.14494.283": "https://plugins.jetbrains.com/files/8607/519418/NixIDEA-0.4.0.12.zip",
+        "241.14494.288": "https://plugins.jetbrains.com/files/8607/519418/NixIDEA-0.4.0.12.zip",
+        "241.14494.307": "https://plugins.jetbrains.com/files/8607/519418/NixIDEA-0.4.0.12.zip"
      },
      "name": "nixidea"
    },
@ -257,8 +276,6 @@
      ],
      "builds": {
        "233.13135.979": "https://plugins.jetbrains.com/files/10037/493012/CSVEditor-3.3.0-233.zip",
-        "233.14475.31": "https://plugins.jetbrains.com/files/10037/493012/CSVEditor-3.3.0-233.zip",
-        "233.14475.66": "https://plugins.jetbrains.com/files/10037/493012/CSVEditor-3.3.0-233.zip",
        "233.15026.24": "https://plugins.jetbrains.com/files/10037/493012/CSVEditor-3.3.0-233.zip",
        "241.14494.234": "https://plugins.jetbrains.com/files/10037/493010/CSVEditor-3.3.0-241.zip",
        "241.14494.235": "https://plugins.jetbrains.com/files/10037/493010/CSVEditor-3.3.0-241.zip",
@ -266,7 +283,9 @@
        "241.14494.238": "https://plugins.jetbrains.com/files/10037/493010/CSVEditor-3.3.0-241.zip",
        "241.14494.240": "https://plugins.jetbrains.com/files/10037/493010/CSVEditor-3.3.0-241.zip",
        "241.14494.241": "https://plugins.jetbrains.com/files/10037/493010/CSVEditor-3.3.0-241.zip",
-        "241.14494.251": "https://plugins.jetbrains.com/files/10037/493010/CSVEditor-3.3.0-241.zip"
+        "241.14494.283": "https://plugins.jetbrains.com/files/10037/493010/CSVEditor-3.3.0-241.zip",
+        "241.14494.288": "https://plugins.jetbrains.com/files/10037/493010/CSVEditor-3.3.0-241.zip",
+        "241.14494.307": "https://plugins.jetbrains.com/files/10037/493010/CSVEditor-3.3.0-241.zip"
      },
      "name": "csv-editor"
    },
@ -288,8 +307,6 @@
      ],
      "builds": {
        "233.13135.979": "https://plugins.jetbrains.com/files/12062/445740/keymap-vscode-233.11799.188.zip",
-        "233.14475.31": "https://plugins.jetbrains.com/files/12062/445740/keymap-vscode-233.11799.188.zip",
-        "233.14475.66": "https://plugins.jetbrains.com/files/12062/445740/keymap-vscode-233.11799.188.zip",
        "233.15026.24": "https://plugins.jetbrains.com/files/12062/445740/keymap-vscode-233.11799.188.zip",
        "241.14494.234": "https://plugins.jetbrains.com/files/12062/508223/keymap-vscode-241.14494.150.zip",
        "241.14494.235": "https://plugins.jetbrains.com/files/12062/508223/keymap-vscode-241.14494.150.zip",
@ -297,7 +314,9 @@
        "241.14494.238": "https://plugins.jetbrains.com/files/12062/508223/keymap-vscode-241.14494.150.zip",
        "241.14494.240": "https://plugins.jetbrains.com/files/12062/508223/keymap-vscode-241.14494.150.zip",
        "241.14494.241": "https://plugins.jetbrains.com/files/12062/508223/keymap-vscode-241.14494.150.zip",
-        "241.14494.251": "https://plugins.jetbrains.com/files/12062/508223/keymap-vscode-241.14494.150.zip"
+        "241.14494.283": "https://plugins.jetbrains.com/files/12062/508223/keymap-vscode-241.14494.150.zip",
+        "241.14494.288": "https://plugins.jetbrains.com/files/12062/508223/keymap-vscode-241.14494.150.zip",
+        "241.14494.307": "https://plugins.jetbrains.com/files/12062/508223/keymap-vscode-241.14494.150.zip"
      },
      "name": "vscode-keymap"
    },
@ -319,8 +338,6 @@
      ],
      "builds": {
        "233.13135.979": "https://plugins.jetbrains.com/files/12559/445772/keymap-eclipse-233.11799.165.zip",
-        "233.14475.31": "https://plugins.jetbrains.com/files/12559/445772/keymap-eclipse-233.11799.165.zip",
-        "233.14475.66": "https://plugins.jetbrains.com/files/12559/445772/keymap-eclipse-233.11799.165.zip",
        "233.15026.24": "https://plugins.jetbrains.com/files/12559/445772/keymap-eclipse-233.11799.165.zip",
        "241.14494.234": "https://plugins.jetbrains.com/files/12559/508216/keymap-eclipse-241.14494.150.zip",
        "241.14494.235": "https://plugins.jetbrains.com/files/12559/508216/keymap-eclipse-241.14494.150.zip",
@ -328,7 +345,9 @@
        "241.14494.238": "https://plugins.jetbrains.com/files/12559/508216/keymap-eclipse-241.14494.150.zip",
        "241.14494.240": "https://plugins.jetbrains.com/files/12559/508216/keymap-eclipse-241.14494.150.zip",
        "241.14494.241": "https://plugins.jetbrains.com/files/12559/508216/keymap-eclipse-241.14494.150.zip",
-        "241.14494.251": "https://plugins.jetbrains.com/files/12559/508216/keymap-eclipse-241.14494.150.zip"
+        "241.14494.283": "https://plugins.jetbrains.com/files/12559/508216/keymap-eclipse-241.14494.150.zip",
+        "241.14494.288": "https://plugins.jetbrains.com/files/12559/508216/keymap-eclipse-241.14494.150.zip",
+        "241.14494.307": "https://plugins.jetbrains.com/files/12559/508216/keymap-eclipse-241.14494.150.zip"
      },
      "name": "eclipse-keymap"
    },
@ -350,8 +369,6 @@
      ],
      "builds": {
        "233.13135.979": "https://plugins.jetbrains.com/files/13017/445774/keymap-visualStudio-233.11799.165.zip",
-        "233.14475.31": "https://plugins.jetbrains.com/files/13017/445774/keymap-visualStudio-233.11799.165.zip",
-        "233.14475.66": "https://plugins.jetbrains.com/files/13017/445774/keymap-visualStudio-233.11799.165.zip",
        "233.15026.24": "https://plugins.jetbrains.com/files/13017/445774/keymap-visualStudio-233.11799.165.zip",
        "241.14494.234": "https://plugins.jetbrains.com/files/13017/508253/keymap-visualStudio-241.14494.150.zip",
        "241.14494.235": "https://plugins.jetbrains.com/files/13017/508253/keymap-visualStudio-241.14494.150.zip",
@ -359,7 +376,9 @@
        "241.14494.238": "https://plugins.jetbrains.com/files/13017/508253/keymap-visualStudio-241.14494.150.zip",
        "241.14494.240": "https://plugins.jetbrains.com/files/13017/508253/keymap-visualStudio-241.14494.150.zip",
        "241.14494.241": "https://plugins.jetbrains.com/files/13017/508253/keymap-visualStudio-241.14494.150.zip",
-        "241.14494.251": "https://plugins.jetbrains.com/files/13017/508253/keymap-visualStudio-241.14494.150.zip"
+        "241.14494.283": "https://plugins.jetbrains.com/files/13017/508253/keymap-visualStudio-241.14494.150.zip",
+        "241.14494.288": "https://plugins.jetbrains.com/files/13017/508253/keymap-visualStudio-241.14494.150.zip",
+        "241.14494.307": "https://plugins.jetbrains.com/files/13017/508253/keymap-visualStudio-241.14494.150.zip"
      },
      "name": "visual-studio-keymap"
    },
@ -381,8 +400,6 @@
      ],
      "builds": {
        "233.13135.979": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
-        "233.14475.31": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
-        "233.14475.66": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
        "233.15026.24": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
        "241.14494.234": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
        "241.14494.235": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
@ -390,7 +407,9 @@
        "241.14494.238": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
        "241.14494.240": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
        "241.14494.241": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
-        "241.14494.251": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar"
+        "241.14494.283": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
+        "241.14494.288": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
+        "241.14494.307": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar"
      },
      "name": "darcula-pitch-black"
    },
@ -411,17 +430,17 @@
        "webstorm"
      ],
      "builds": {
-        "233.13135.979": "https://plugins.jetbrains.com/files/17718/512366/github-copilot-intellij-1.5.1.5285.zip",
-        "233.14475.31": "https://plugins.jetbrains.com/files/17718/512366/github-copilot-intellij-1.5.1.5285.zip",
-        "233.14475.66": "https://plugins.jetbrains.com/files/17718/512366/github-copilot-intellij-1.5.1.5285.zip",
-        "233.15026.24": "https://plugins.jetbrains.com/files/17718/512366/github-copilot-intellij-1.5.1.5285.zip",
-        "241.14494.234": "https://plugins.jetbrains.com/files/17718/512366/github-copilot-intellij-1.5.1.5285.zip",
-        "241.14494.235": "https://plugins.jetbrains.com/files/17718/512366/github-copilot-intellij-1.5.1.5285.zip",
-        "241.14494.237": "https://plugins.jetbrains.com/files/17718/512366/github-copilot-intellij-1.5.1.5285.zip",
-        "241.14494.238": "https://plugins.jetbrains.com/files/17718/512366/github-copilot-intellij-1.5.1.5285.zip",
-        "241.14494.240": "https://plugins.jetbrains.com/files/17718/512366/github-copilot-intellij-1.5.1.5285.zip",
-        "241.14494.241": "https://plugins.jetbrains.com/files/17718/512366/github-copilot-intellij-1.5.1.5285.zip",
-        "241.14494.251": "https://plugins.jetbrains.com/files/17718/512366/github-copilot-intellij-1.5.1.5285.zip"
+        "233.13135.979": "https://plugins.jetbrains.com/files/17718/517133/github-copilot-intellij-1.5.2.5345.zip",
+        "233.15026.24": "https://plugins.jetbrains.com/files/17718/517133/github-copilot-intellij-1.5.2.5345.zip",
+        "241.14494.234": "https://plugins.jetbrains.com/files/17718/517133/github-copilot-intellij-1.5.2.5345.zip",
+        "241.14494.235": "https://plugins.jetbrains.com/files/17718/517133/github-copilot-intellij-1.5.2.5345.zip",
+        "241.14494.237": "https://plugins.jetbrains.com/files/17718/517133/github-copilot-intellij-1.5.2.5345.zip",
+        "241.14494.238": "https://plugins.jetbrains.com/files/17718/517133/github-copilot-intellij-1.5.2.5345.zip",
+        "241.14494.240": "https://plugins.jetbrains.com/files/17718/517133/github-copilot-intellij-1.5.2.5345.zip",
+        "241.14494.241": "https://plugins.jetbrains.com/files/17718/517133/github-copilot-intellij-1.5.2.5345.zip",
+        "241.14494.283": "https://plugins.jetbrains.com/files/17718/517133/github-copilot-intellij-1.5.2.5345.zip",
+        "241.14494.288": "https://plugins.jetbrains.com/files/17718/517133/github-copilot-intellij-1.5.2.5345.zip",
+        "241.14494.307": "https://plugins.jetbrains.com/files/17718/517133/github-copilot-intellij-1.5.2.5345.zip"
      },
      "name": "github-copilot"
    },
@ -443,8 +462,6 @@
      ],
      "builds": {
        "233.13135.979": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
-        "233.14475.31": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
-        "233.14475.66": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
        "233.15026.24": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
        "241.14494.234": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
        "241.14494.235": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
@ -452,7 +469,9 @@
        "241.14494.238": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
        "241.14494.240": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
        "241.14494.241": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
-        "241.14494.251": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip"
+        "241.14494.283": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
+        "241.14494.288": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
+        "241.14494.307": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip"
      },
      "name": "netbeans-6-5-keymap"
    },
@ -463,9 +482,9 @@
        "rust-rover"
      ],
      "builds": {
-        "233.14475.31": "https://plugins.jetbrains.com/files/22407/515371/intellij-rust-233.25026.24.zip",
        "233.15026.24": "https://plugins.jetbrains.com/files/22407/515371/intellij-rust-233.25026.24.zip",
-        "241.14494.240": "https://plugins.jetbrains.com/files/22407/515370/intellij-rust-241.25026.24.zip"
+        "241.14494.240": "https://plugins.jetbrains.com/files/22407/515370/intellij-rust-241.25026.24.zip",
+        "241.14494.288": "https://plugins.jetbrains.com/files/22407/515370/intellij-rust-241.25026.24.zip"
      },
      "name": "rust"
    }
@ -481,21 +500,20 @@
    "https://plugins.jetbrains.com/files/13017/508253/keymap-visualStudio-241.14494.150.zip": "sha256-tNgt0vIkdCB/LcaSj58mT6cNlw4lytRo0cZSt7sIERU=",
    "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar": "sha256-eXInfAqY3yEZRXCAuv3KGldM1pNKEioNwPB0rIGgJFw=",
    "https://plugins.jetbrains.com/files/164/515255/IdeaVim-2.10.2-signed.zip": "sha256-FP6th8J3ymfTrwvJ3Ms7fsNPh3f9ab5ZVg5yPpKV/rY=",
-    "https://plugins.jetbrains.com/files/17718/512366/github-copilot-intellij-1.5.1.5285.zip": "sha256-lep8ZUOjbV0tsfO/yEWJiHWtwm639zxpc/7L9rCKSsU=",
+    "https://plugins.jetbrains.com/files/17718/517133/github-copilot-intellij-1.5.2.5345.zip": "sha256-BaBYXN8eulaJtJSKrz9bZ2Yn8029goSAUvjYU+BaiIU=",
    "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip": "sha256-KrzZTKZMQqoEMw+vDUv2jjs0EX0leaPBkU8H/ecq/oI=",
    "https://plugins.jetbrains.com/files/22407/515370/intellij-rust-241.25026.24.zip": "sha256-tBPoO2EkPaWFZ/Gu3UAkZPy4opssWJQEVlz9GZUkNtQ=",
    "https://plugins.jetbrains.com/files/22407/515371/intellij-rust-233.25026.24.zip": "sha256-j4b4To8jY4orP87GpphHPtLKeAPDNXcLNSUlIXDDy2Q=",
    "https://plugins.jetbrains.com/files/631/513581/python-241.14494.240.zip": "sha256-pQP1LF/6uImQpBOpxUGE8KmmFh26kiC4YaYLAHnEc3o=",
    "https://plugins.jetbrains.com/files/6981/509027/ini-233.15026.15.zip": "sha256-6sTD+OFO/yA7m5o0XqoJKLcQ4zAFro7Iy7WNPfA49xM=",
    "https://plugins.jetbrains.com/files/6981/513562/ini-241.14494.240.zip": "sha256-QC42nC7mEE3X1cmKj8jkwzpDJzX7ZoOPEd9y6i8IuvM=",
-    "https://plugins.jetbrains.com/files/7219/514919/Symfony_Plugin-2023.1.267.zip": "sha256-zhnoxJgJJDgSnLdaNRrqS767YuvAzm8sXzhz9e2G0+8=",
+    "https://plugins.jetbrains.com/files/7219/518876/Symfony_Plugin-2023.1.268.zip": "sha256-mYEuFdSaxw9Lc8yNgPB0ty6mfxjKaAa/jY6v4E2Qo0Q=",
    "https://plugins.jetbrains.com/files/7320/507957/PHP_Annotations-10.0.0.zip": "sha256-JIZ6Iq3sOcAm8fBXnjRrG9dqCZuD/WajyVmn1JjYMBA=",
-    "https://plugins.jetbrains.com/files/7322/484110/python-ce-233.14475.9.zip": "sha256-YMB/ewCKE1F/JXI8iau9pKkv9D5D9a8OiTVukkzTocA=",
    "https://plugins.jetbrains.com/files/7322/502153/python-ce-233.14808.12.zip": "sha256-PUBR9krJ26QrL2jTus0b+uhzkEkT+lGnBKy1f4i/U+w=",
    "https://plugins.jetbrains.com/files/7322/513587/python-ce-241.14494.240.zip": "sha256-6YC/aoiTRLAh87C2v3k24BLBH/tsdTWuDK/CBv8y1QI=",
    "https://plugins.jetbrains.com/files/8182/466854/intellij-rust-233.15445.zip": "sha256-+Lc/avYBLpyIV63DlbhAJtieHDv4HdggqdGFDw9iqN0=",
    "https://plugins.jetbrains.com/files/8554/508289/featuresTrainer-241.14494.150.zip": "sha256-D2gF9bLAEFd1+6vZskiM2Eyl5e8hmyh/VHrmW2NociE=",
-    "https://plugins.jetbrains.com/files/8607/422943/NixIDEA-0.4.0.11.zip": "sha256-Dwitpu5yLPWx+IUilpN5iqnN8FkKgaxUNjroBEx5lkM=",
+    "https://plugins.jetbrains.com/files/8607/519418/NixIDEA-0.4.0.12.zip": "sha256-D2HFG2tQy719+baHjUyizoq67tv6lDZrX3s6HDlBRA0=",
    "https://plugins.jetbrains.com/files/9568/513582/go-plugin-241.14494.240.zip": "sha256-66Gx4XFn5DEZ/wCkN7IFQKtp+P0R9PoEAXmwOB97Q3A="
  }
 }
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -428,8 +428,8 @@ let
        mktplcRef = {
          name = "vscode-neovim";
          publisher = "asvetliakov";
-          version = "1.7.1";
-          sha256 = "0ib4sjk7r370ckvaqb4yzgy7csy8pli9z2jhibhhwwcq2748ah4q";
+          version = "1.8.1";
+          sha256 = "0kqzry0cbvvy1pkbx5rhnk5ry7j91cbf11vz1s1jrqc7j0hq0yx8";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/asvetliakov.vscode-neovim/changelog";
@ -941,8 +941,8 @@ let
        mktplcRef = {
          name = "coder-remote";
          publisher = "coder";
-          version = "0.1.18";
-          sha256 = "soNGZuyvG5+haWRcwYmYB+0OcyDAm4UQ419UnEd8waA=";
+          version = "0.1.36";
+          hash = "sha256-N1X8wB2n6JYoFHCP5iHBXHnEaRa9S1zooQZsR5mUeh8=";
        };
        meta = {
          description = "An extension for Visual Studio Code to open any Coder workspace in VS Code with a single click.";
@ -2803,8 +2803,8 @@ let
        mktplcRef = {
          name = "typst-preview";
          publisher = "mgt19937";
-          version = "0.11.1";
-          hash = "sha256-OsCgkq0OSBu7RZYHlxgy7W7zDNDUgJFSeSET20CX8zA=";
+          version = "0.11.4";
+          hash = "sha256-GwlzFphZmP87pLys01+PWTv13imcdGjunCMH6atz9xs=";
        };

        buildInputs = [
--- a/pkgs/applications/editors/vscode/extensions/vscode-utils.nix
+++ b/pkgs/applications/editors/vscode/extensions/vscode-utils.nix
@ -32,6 +32,10 @@ let

    inherit configurePhase buildPhase dontPatchELF dontStrip;

+    # Some .vsix files contain other directories (e.g., `package`) that we don't use.
+    # If other directories are present but `sourceRoot` is unset, the unpacker phase fails.
+    sourceRoot = "extension";
+
    installPrefix = "share/vscode/extensions/${vscodeExtUniqueId}";

    nativeBuildInputs = [ unzip ] ++ nativeBuildInputs;
--- a/pkgs/applications/misc/camunda-modeler/default.nix
+++ b/pkgs/applications/misc/camunda-modeler/default.nix
@ -9,11 +9,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "camunda-modeler";
-  version = "5.21.0";
+  version = "5.22.0";

  src = fetchurl {
    url = "https://github.com/camunda/camunda-modeler/releases/download/v${version}/camunda-modeler-${version}-linux-x64.tar.gz";
-    hash = "sha256-brZRYvRrOHj/HUb+w5tPkxHnJzVyFBKshk2ZO7YMzsU=";
+    hash = "sha256-WLJMF+G7pP7OZh6xDrO/JpNV9iX/9XBmi5kRPp3TJBI=";
  };
  sourceRoot = "camunda-modeler-${version}-linux-x64";

--- a/pkgs/applications/misc/jrnl/default.nix
+++ b/pkgs/applications/misc/jrnl/default.nix
@ -1,27 +1,32 @@
-{ lib
-, fetchFromGitHub
-, python3
-, testers
-, jrnl
+{
+  lib,
+  fetchFromGitHub,
+  python3,
+  testers,
+  jrnl,
 }:

 python3.pkgs.buildPythonApplication rec {
  pname = "jrnl";
  version = "4.1";
-  format = "pyproject";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "jrnl-org";
-    repo = pname;
+    repo = "jrnl";
    rev = "refs/tags/v${version}";
    hash = "sha256-DtujXSDJWnOrHjVgJEJNKJMhSrNBHlR2hvHeHLSIF2o=";
  };

-  nativeBuildInputs = with python3.pkgs; [
-    poetry-core
-  ];
+  postPatch = ''
+    # Support pytest_bdd 7.1.2 and later, https://github.com/jrnl-org/jrnl/pull/1878
+    substituteInPlace tests/lib/when_steps.py \
+      --replace-fail "from pytest_bdd.steps import inject_fixture" "from pytest_bdd.compat import inject_fixture"
+  '';

-  propagatedBuildInputs = with python3.pkgs; [
+  build-system = with python3.pkgs; [ poetry-core ];
+
+  dependencies = with python3.pkgs; [
    asteval
    colorama
    cryptography
@ -43,14 +48,11 @@ python3.pkgs.buildPythonApplication rec {
    toml
  ];

-
  preCheck = ''
    export HOME=$(mktemp -d);
  '';

-  pythonImportsCheck = [
-    "jrnl"
-  ];
+  pythonImportsCheck = [ "jrnl" ];

  passthru.tests.version = testers.testVersion {
    package = jrnl;
@ -58,11 +60,14 @@ python3.pkgs.buildPythonApplication rec {
  };

  meta = with lib; {
-    changelog = "https://github.com/jrnl-org/jrnl/releases/tag/v${version}";
-    description = "Simple command line journal application that stores your journal in a plain text file";
+    description = "Command line journal application that stores your journal in a plain text file";
    homepage = "https://jrnl.sh/";
+    changelog = "https://github.com/jrnl-org/jrnl/releases/tag/v${version}";
    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ bryanasdev000 zalakain ];
+    maintainers = with maintainers; [
+      bryanasdev000
+      zalakain
+    ];
    mainProgram = "jrnl";
  };
 }
--- a/pkgs/applications/misc/pgmodeler/default.nix
+++ b/pkgs/applications/misc/pgmodeler/default.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "pgmodeler";
-  version = "1.1.1";
+  version = "1.1.2";

  src = fetchFromGitHub {
    owner = "pgmodeler";
    repo = "pgmodeler";
    rev = "v${version}";
-    sha256 = "sha256-9/D5C3l3N15q+xP9lLAcdT+1+dEMcowBeR+DjE67fYQ=";
+    sha256 = "sha256-urKAsuYmK8dsXhP+I7p27PXXYRapPtkI8FqARfLwnEw=";
  };

  nativeBuildInputs = [ pkg-config qmake wrapQtAppsHook ];
--- a/pkgs/applications/misc/prusa-slicer/default.nix
+++ b/pkgs/applications/misc/prusa-slicer/default.nix
@ -66,12 +66,12 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "prusa-slicer";
-  version = "2.7.3";
+  version = "2.7.4";

  src = fetchFromGitHub {
    owner = "prusa3d";
    repo = "PrusaSlicer";
-    hash = "sha256-pV9KQlZoCQZWi12VUKntKzFUuZgGpDoh1aNMoAHTbZI=";
+    hash = "sha256-g2I2l6i/8p8werDs4mDI/lGeDQsma4WSB9vT6OB2LGg=";
    rev = "version_${finalAttrs.version}";
  };

--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@ -1,11 +1,11 @@
 {
  stable = {
    chromedriver = {
-      hash_darwin = "sha256-sB6gH5k5zK1IIctBTXQpxlgmLEoIatcLDYO+WIFaYxA=";
+      hash_darwin = "sha256-PmLV++FK6aCvdhNNhb2ZAmRLumr+VRFvN+7IByieEZk=";
      hash_darwin_aarch64 =
-        "sha256-sikyGQG0Y14eNjT3f/Z50cPmm38T58X7zQIGopXOHOs=";
-      hash_linux = "sha256-2WZmRXyvxN3hXeOoPQXL6lU6Xki9iUmTdETRxOkIYD0=";
-      version = "123.0.6312.86";
+        "sha256-6Ys1EMSLmJNNaWdPeQiCT+bC0H7ABInVNzwXorGavn4=";
+      hash_linux = "sha256-iimq37dcEcY2suW73a6lhgHuNaoqtzbAZCHkQP9ro/Y=";
+      version = "123.0.6312.122";
    };
    deps = {
      gn = {
@ -15,9 +15,9 @@
        version = "2024-02-19";
      };
    };
-    hash = "sha256-C17TPDVFW3+cHO1tcEghjI6H59TVPm9hdCrF2s5NI68=";
-    hash_deb_amd64 = "sha256-zmnBi4UBx52fQKHHJuUaCMuDJl7ntQzhG6h/yH7YPNU=";
-    version = "123.0.6312.105";
+    hash = "sha256-7H7h621AHPyhFYbaVFO892TtS+SP3Qu7cYUVk3ICL14=";
+    hash_deb_amd64 = "sha256-tNkO1mPZg1xltBfoWeNhLekITtZV/WNgu//i2DJb17c=";
+    version = "123.0.6312.122";
  };
  ungoogled-chromium = {
    deps = {
@ -28,12 +28,12 @@
        version = "2024-02-19";
      };
      ungoogled-patches = {
-        hash = "sha256-81SoZBOAAV0cAVzz3yOzBstRW3vWjmkFoFNjYdPnme4=";
-        rev = "123.0.6312.105-1";
+        hash = "sha256-ojKIAkJB/gfg6scCxUYNAGx4lsquAaCySBDcUCFLqSU=";
+        rev = "d5773b0fb696ef107cc6df6a94cbe732c9e905f9";
      };
    };
-    hash = "sha256-C17TPDVFW3+cHO1tcEghjI6H59TVPm9hdCrF2s5NI68=";
-    hash_deb_amd64 = "sha256-zmnBi4UBx52fQKHHJuUaCMuDJl7ntQzhG6h/yH7YPNU=";
-    version = "123.0.6312.105";
+    hash = "sha256-7H7h621AHPyhFYbaVFO892TtS+SP3Qu7cYUVk3ICL14=";
+    hash_deb_amd64 = "sha256-tNkO1mPZg1xltBfoWeNhLekITtZV/WNgu//i2DJb17c=";
+    version = "123.0.6312.122";
  };
 }
--- a/pkgs/applications/networking/cluster/atmos/default.nix
+++ b/pkgs/applications/networking/cluster/atmos/default.nix
@ -38,6 +38,6 @@ buildGoModule rec {
    description = "Universal Tool for DevOps and Cloud Automation (works with terraform, helm, helmfile, etc)";
    mainProgram = "atmos";
    license = licenses.asl20;
-    maintainers = with maintainers; [ rb ];
+    maintainers = with maintainers; [ ] ++ teams.cloudposse.members;
  };
 }
--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@ -2,15 +2,15 @@

 buildGoModule rec {
  pname = "kubernetes-helm";
-  version = "3.14.3";
+  version = "3.14.4";

  src = fetchFromGitHub {
    owner = "helm";
    repo = "helm";
    rev = "v${version}";
-    sha256 = "sha256-GC9rkB35m+a/9pEvD7aNjE4z3qrv33NES842crrzD3I=";
+    sha256 = "sha256-Wt5ovKa2CHrD0VSxvReYAwoC4SsuZHAhi/P6Kn1H7So=";
  };
-  vendorHash = "sha256-f5tLyq9tP5tdE73Mlee9vAUSHqkUAtAJkwjZP/K6wPM=";
+  vendorHash = "sha256-b25LUyr4B4fF/WF4Q+zzrDo78kuSTEPBklKkA4o+DBo=";

  subPackages = [ "cmd/helm" ];
  ldflags = [
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@ -31,7 +31,7 @@ let
      postConfigure = ''
        # speakeasy hardcodes /bin/stty https://github.com/bgentry/speakeasy/issues/22
        substituteInPlace vendor/github.com/bgentry/speakeasy/speakeasy_unix.go \
-          --replace "/bin/stty" "${coreutils}/bin/stty"
+          --replace-fail "/bin/stty" "${coreutils}/bin/stty"
      '';

      nativeBuildInputs = [ installShellFiles ];
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "terragrunt";
-  version = "0.56.2";
+  version = "0.56.5";

  src = fetchFromGitHub {
    owner = "gruntwork-io";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-FbuXdng2pGd1Wi4GdFzQjk4quP5yz3APNXm6dcfGO7U=";
+    hash = "sha256-aKgcXLxFZBoomrKJFmUr/XfxHmNrkvK2IlfTR2dJNY0=";
  };

-  vendorHash = "sha256-ijAg0Y/dfNxDS/Jov7QYjlTZ4N4/jDMH/zCV0jdVXRc=";
+  vendorHash = "sha256-joEmkFtoVxqlVrgl2mtJN9Cyr3YdnT6tBjaSXj9z2WU=";

  doCheck = false;

--- a/pkgs/applications/networking/cluster/zarf/default.nix
+++ b/pkgs/applications/networking/cluster/zarf/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "zarf";
-  version = "0.32.6";
+  version = "0.33.0";

  src = fetchFromGitHub {
    owner = "defenseunicorns";
    repo = "zarf";
    rev = "v${version}";
-    hash = "sha256-YytP6JC3efREoVzKKYLz6e8YzuSZas89Sw43mQn+aBI=";
+    hash = "sha256-r/PRLOqzXANYWAq3hdLKWxw1WXJzgVjIenHky2+WXj4=";
  };

-  vendorHash = "sha256-nV+Beciv81brFWPVl4131Mtcj/oUwRhVTGK+M4Yedus=";
+  vendorHash = "sha256-6DGkDHBoUj5Zk0KI3HVb+trkzWzB4+8nOh1ijE9PrEk=";
  proxyVendor = true;

  preBuild = ''
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@ -2,14 +2,14 @@
 let
  versions =
    if stdenv.isLinux then {
-      stable = "0.0.47";
-      ptb = "0.0.76";
-      canary = "0.0.326";
-      development = "0.0.16";
+      stable = "0.0.49";
+      ptb = "0.0.78";
+      canary = "0.0.346";
+      development = "0.0.17";
    } else {
-      stable = "0.0.298";
-      ptb = "0.0.105";
-      canary = "0.0.451";
+      stable = "0.0.300";
+      ptb = "0.0.107";
+      canary = "0.0.468";
      development = "0.0.39";
    };
  version = versions.${branch};
@ -17,33 +17,33 @@ let
    x86_64-linux = {
      stable = fetchurl {
        url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-4cELs7K7DAfzbA0/BwAkKraTD7z58jzOf1J3Our3CwM=";
+        hash = "sha256-rVSYAkTZTlurnbUeYJFCgsPcsCqjJ1bJneQQiyhmvwQ=";
      };
      ptb = fetchurl {
        url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-Gj6OLzkHrEQ2CeEQpICaAh1m13DpM2cpNVsebBJ0MVc=";
+        hash = "sha256-Fp94BsR6Fzy4tV+c5ToP9GKg6GC/TryGvHWLupew4Z8=";
      };
      canary = fetchurl {
        url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-MxiFhd7tLvL1tBRc451qjCFZlmGM8IolckExp0sR3y8=";
+        hash = "sha256-/FBVo3ptZk2YQPoq+VpyxMlSWYlVb8ChpKW5YH/BM7U=";
      };
      development = fetchurl {
        url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-        hash = "sha256-6QImWsNmL2JveB2QJ1MyBxkVEQfdPvKEdenRPjURptI=";
+        hash = "sha256-AmbaMVi/or+9QLuQO5u5btgKeKdrfo7bzZgGLILwgqo=";
      };
    };
    x86_64-darwin = {
      stable = fetchurl {
        url = "https://dl.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-GlTebQ16sRgHdpB9+Jw7dn+KVZ6qIrAmWBSypTcoFmE=";
+        hash = "sha256-f9YIlzRESzzxtD9/us1DY5acu2HYo+UrwS7GWk9RwCk=";
      };
      ptb = fetchurl {
        url = "https://dl-ptb.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-X5bYO1D5eWTYh22v4R274OhjTsVv70XCyrMqeRlt0Bo=";
+        hash = "sha256-etxXrO9Ksacbdes3DT1Tm4kKD/t40jGUeSAegdexRqc=";
      };
      canary = fetchurl {
        url = "https://dl-canary.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-psVm0eXDHVBGNb/R0kHbvz/4ilyIg4xlOj/CwkwlvgM=";
+        hash = "sha256-UOoXDwAa5pFukqTCmUfM89QVK5jB13id8ek/gwWajMM=";
      };
      development = fetchurl {
        url = "https://dl-development.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
--- a/pkgs/applications/networking/instant-messengers/qq/default.nix
+++ b/pkgs/applications/networking/instant-messengers/qq/default.nix
@ -19,7 +19,8 @@
 , vips
 , at-spi2-core
 , autoPatchelfHook
-, makeWrapper
+, makeShellWrapper
+, wrapGAppsHook
 }:

 let
@ -43,7 +44,8 @@ stdenv.mkDerivation {

  nativeBuildInputs = [
    autoPatchelfHook
-    makeWrapper
+    makeShellWrapper
+    wrapGAppsHook
    dpkg
  ];

@ -62,6 +64,8 @@ stdenv.mkDerivation {
    xorg.libXdamage
  ];

+  dontWrapGApps = true;
+
  runtimeDependencies = map lib.getLib [
    systemd
  ];
@ -75,9 +79,11 @@ stdenv.mkDerivation {
    substituteInPlace $out/share/applications/qq.desktop \
      --replace "/opt/QQ/qq" "$out/bin/qq" \
      --replace "/usr/share" "$out/share"
-    makeWrapper $out/opt/QQ/qq $out/bin/qq \
+    makeShellWrapper $out/opt/QQ/qq $out/bin/qq \
+      --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH" \
      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libGL ]}" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      "''${gappsWrapperArgs[@]}"

    # Remove bundled libraries
    rm -r $out/opt/QQ/resources/app/sharp-lib
--- a/pkgs/applications/science/math/eigenmath/default.nix
+++ b/pkgs/applications/science/math/eigenmath/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "eigenmath";
-  version = "unstable-2024-03-20";
+  version = "unstable-2024-04-08";

  src = fetchFromGitHub {
    owner = "georgeweigt";
    repo = pname;
-    rev = "262a6525225be7bcef52c3072b1061db3c238055";
-    hash = "sha256-QH8mLlcCOuq77vLer8RsSnD9VeJu9kAVv2qWAH3ky6I=";
+    rev = "c0be6c47309aa40d44784a3a4c4c07bc4e8fb6fa";
+    hash = "sha256-UVCazX0P03+e1exnpXrGNc/1vHxLH04Xtvgsy00UAoI=";
  };

  checkPhase = let emulator = stdenv.hostPlatform.emulator buildPackages; in ''
--- a/pkgs/applications/science/misc/boinc/default.nix
+++ b/pkgs/applications/science/misc/boinc/default.nix
@ -27,14 +27,14 @@

 stdenv.mkDerivation rec {
  pname = "boinc";
-  version = "7.24.3";
+  version = "8.0.1";

  src = fetchFromGitHub {
    name = "${pname}-${version}-src";
    owner = "BOINC";
    repo = "boinc";
    rev = "client_release/${lib.versions.majorMinor version}/${version}";
-    hash = "sha256-0gyCO5t8t0SbOCBClVVu+C2VpBlxsnoRHBRYgI8nNO4=";
+    hash = "sha256-pjk9+VRWrFIoHolIEEWlRx89hifLNeFtIi34F1OBD38=";
  };

  nativeBuildInputs = [ libtool automake autoconf m4 pkg-config ];
--- a/pkgs/applications/version-management/cgit/common.nix
+++ b/pkgs/applications/version-management/cgit/common.nix
@ -12,6 +12,8 @@
 stdenv.mkDerivation {
  inherit pname version src gitSrc;

+  separateDebugInfo = true;
+
  nativeBuildInputs = [
    pkg-config asciidoc
  ] ++ (with python3Packages; [ python wrapPython ]);
--- a/pkgs/applications/version-management/git-cliff/default.nix
+++ b/pkgs/applications/version-management/git-cliff/default.nix
@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "git-cliff";
-  version = "2.2.0";
+  version = "2.2.1";

  src = fetchFromGitHub {
    owner = "orhun";
    repo = "git-cliff";
    rev = "v${version}";
-    hash = "sha256-pOmSVySn8QUpFLTXFXBVm1KTX9ny221t1xSxBRHkljQ=";
+    hash = "sha256-FRcreSnSO65m9h9+SUg4qdFELvpVX1+HkWH3dI2RR/M=";
  };

-  cargoHash = "sha256-y0XTvSV8JE6nmSJfJKLw2Gt/D/yX12kbx2+RHqVCVWI=";
+  cargoHash = "sha256-RlcZvyFi7fc8eJYB5X64axAnNp8Z1h0WOV4hM1SLoRk=";

  # attempts to run the program on .git in src which is not deterministic
  doCheck = false;
--- a/pkgs/applications/version-management/git-mit/default.nix
+++ b/pkgs/applications/version-management/git-mit/default.nix
@ -10,7 +10,7 @@
 }:

 let
-  version = "5.12.191";
+  version = "5.12.194";
 in
 rustPlatform.buildRustPackage {
  pname = "git-mit";
@ -20,10 +20,10 @@ rustPlatform.buildRustPackage {
    owner = "PurpleBooth";
    repo = "git-mit";
    rev = "v${version}";
-    hash = "sha256-aSEoAs0s7zyALf3s77eVlrjkCrn7ihW/4OW5hN8YL8k=";
+    hash = "sha256-9ITy2VPLIunSLSNx4EXbvxZ7V/Kr+DwmjzDVj/QVGHs=";
  };

-  cargoHash = "sha256-pm+XreLGxZJKRcrmU1ooMjN7MTRJqgKOy2J1OqdodxE=";
+  cargoHash = "sha256-6R+T0BSgT6IivugkXXsX5xJ2c3/J3FnLY3ZvcfYW53E=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/applications/version-management/git-repo/default.nix
+++ b/pkgs/applications/version-management/git-repo/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "git-repo";
-  version = "2.39";
+  version = "2.45";

  src = fetchFromGitHub {
    owner = "android";
    repo = "tools_repo";
    rev = "v${version}";
-    hash = "sha256-Qw0x/YiXMDrlTy6boembfqVRvEYiMWOALJtaMrr7/WI=";
+    hash = "sha256-f765TcOHL8wdPa9qSmGegofjCXx1tF/K5bRQnYQcYVc=";
  };

  # Fix 'NameError: name 'ssl' is not defined'
--- a/pkgs/applications/version-management/git-repo/import-ssl-module.patch
+++ b/pkgs/applications/version-management/git-repo/import-ssl-module.patch
@ -18,11 +18,13 @@ diff --git a/repo b/repo
 index 8b05def..f394b3e 100755
 --- a/repo
 +++ b/repo
-@@ -236,6 +236,7 @@ import optparse
+@@ -236,8 +236,9 @@ import optparse
 import re
 import shutil
 import stat
 +import ssl
+ import urllib.error
+ import urllib.request
 
 if sys.version_info[0] == 3:
   import urllib.request
--- a/pkgs/applications/video/qmplay2/default.nix
+++ b/pkgs/applications/video/qmplay2/default.nix
@ -26,14 +26,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "qmplay2";
-  version = "24.04.02";
+  version = "24.04.07";

  src = fetchFromGitHub {
    owner = "zaps166";
    repo = "QMPlay2";
    rev = finalAttrs.version;
    fetchSubmodules = true;
-    hash = "sha256-eJWXTcJU24QzPChFTKbvNcuL9UpIQD8rFzd5h591tjg=";
+    hash = "sha256-WIDGApvl+aaB3Vdv0sHY+FHWqzreWWd3/xOLV11YfxM=";
  };

  nativeBuildInputs = [
--- a/pkgs/build-support/rust/test/import-cargo-lock/basic-dynamic/default.nix
+++ b/pkgs/build-support/rust/test/import-cargo-lock/basic-dynamic/default.nix
@ -1,10 +1,19 @@
-{ rustPlatform }:
-
+{ lib, rustPlatform }:
+let
+  fs = lib.fileset;
+in
 rustPlatform.buildRustPackage {
  pname = "basic-dynamic";
  version = "0.1.0";

-  src = ./.;
+  src = fs.toSource {
+    root = ./.;
+    fileset = fs.unions [
+      ./Cargo.toml
+      ./Cargo.lock
+      ./src
+    ];
+  };

  cargoLock.lockFileContents = builtins.readFile ./Cargo.lock;

--- a/pkgs/build-support/rust/test/import-cargo-lock/basic/default.nix
+++ b/pkgs/build-support/rust/test/import-cargo-lock/basic/default.nix
@ -1,10 +1,19 @@
-{ rustPlatform }:
-
+{ lib, rustPlatform }:
+let
+  fs = lib.fileset;
+in
 rustPlatform.buildRustPackage {
  pname = "basic";
  version = "0.1.0";

-  src = ./.;
+  src = fs.toSource {
+    root = ./.;
+    fileset = fs.unions [
+      ./Cargo.toml
+      ./Cargo.lock
+      ./src
+    ];
+  };

  cargoLock = {
    lockFile = ./Cargo.lock;
--- a/pkgs/build-support/rust/test/import-cargo-lock/git-dependency-branch/default.nix
+++ b/pkgs/build-support/rust/test/import-cargo-lock/git-dependency-branch/default.nix
@ -1,10 +1,19 @@
-{ rustPlatform }:
-
+{ lib, rustPlatform }:
+let
+  fs = lib.fileset;
+in
 rustPlatform.buildRustPackage {
  pname = "git-dependency-branch";
  version = "0.1.0";

-  src = ./.;
+  src = fs.toSource {
+    root = ./.;
+    fileset = fs.unions [
+      ./Cargo.toml
+      ./Cargo.lock
+      ./src
+    ];
+  };

  cargoLock = {
    lockFile = ./Cargo.lock;
--- a/pkgs/build-support/rust/test/import-cargo-lock/git-dependency-rev-non-workspace-nested-crate/default.nix
+++ b/pkgs/build-support/rust/test/import-cargo-lock/git-dependency-rev-non-workspace-nested-crate/default.nix
@ -1,10 +1,19 @@
 { rustPlatform, pkg-config, openssl, lib, darwin, stdenv }:
-
+let
+  fs = lib.fileset;
+in
 rustPlatform.buildRustPackage {
  pname = "git-dependency-rev-non-workspace-nested-crate";
  version = "0.1.0";

-  src = ./.;
+  src = fs.toSource {
+    root = ./.;
+    fileset = fs.unions [
+      ./Cargo.toml
+      ./Cargo.lock
+      ./src
+    ];
+  };

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/build-support/rust/test/import-cargo-lock/git-dependency-rev/default.nix
+++ b/pkgs/build-support/rust/test/import-cargo-lock/git-dependency-rev/default.nix
@ -1,10 +1,19 @@
-{ rustPlatform }:
-
+{ lib, rustPlatform }:
+let
+  fs = lib.fileset;
+in
 rustPlatform.buildRustPackage {
  pname = "git-dependency-rev";
  version = "0.1.0";

-  src = ./.;
+  src = fs.toSource {
+    root = ./.;
+    fileset = fs.unions [
+      ./Cargo.toml
+      ./Cargo.lock
+      ./src
+    ];
+  };

  cargoLock = {
    lockFile = ./Cargo.lock;
--- a/pkgs/build-support/rust/test/import-cargo-lock/git-dependency-tag/default.nix
+++ b/pkgs/build-support/rust/test/import-cargo-lock/git-dependency-tag/default.nix
@ -1,10 +1,19 @@
-{ rustPlatform }:
-
+{ lib, rustPlatform }:
+let
+  fs = lib.fileset;
+in
 rustPlatform.buildRustPackage {
  pname = "git-dependency-tag";
  version = "0.1.0";

-  src = ./.;
+  src = fs.toSource {
+    root = ./.;
+    fileset = fs.unions [
+      ./Cargo.toml
+      ./Cargo.lock
+      ./src
+    ];
+  };

  cargoLock = {
    lockFile = ./Cargo.lock;
--- a/pkgs/build-support/rust/test/import-cargo-lock/git-dependency/default.nix
+++ b/pkgs/build-support/rust/test/import-cargo-lock/git-dependency/default.nix
@ -1,10 +1,19 @@
-{ rustPlatform }:
-
+{ lib, rustPlatform }:
+let
+  fs = lib.fileset;
+in
 rustPlatform.buildRustPackage {
  pname = "git-dependency";
  version = "0.1.0";

-  src = ./.;
+  src = fs.toSource {
+    root = ./.;
+    fileset = fs.unions [
+      ./Cargo.toml
+      ./Cargo.lock
+      ./src
+    ];
+  };

  cargoLock = {
    lockFile = ./Cargo.lock;
--- a/pkgs/build-support/rust/test/import-cargo-lock/v1/default.nix
+++ b/pkgs/build-support/rust/test/import-cargo-lock/v1/default.nix
@ -1,10 +1,19 @@
-{ rustPlatform }:
-
+{ lib, rustPlatform }:
+let
+  fs = lib.fileset;
+in
 rustPlatform.buildRustPackage {
  pname = "v1";
  version = "0.1.0";

-  src = ./.;
+  src = fs.toSource {
+    root = ./.;
+    fileset = fs.unions [
+      ./Cargo.toml
+      ./Cargo.lock
+      ./src
+    ];
+  };

  cargoLock = {
    lockFile = ./Cargo.lock;
--- a/pkgs/by-name/_0/_0xpropo/package.nix
+++ b/pkgs/by-name/_0/_0xpropo/package.nix
@ -0,0 +1,33 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchzip,
+}:
+stdenvNoCC.mkDerivation rec {
+  pname = "0xpropo";
+  version = "1.000";
+
+  src = let
+    underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
+  in
+    fetchzip {
+      url = "https://github.com/0xType/0xPropo/releases/download/${version}/0xPropo_${underscoreVersion}.zip";
+      hash = "sha256-yIhabwHjBipkcmsSRaokBXCbawQkUNOU8v+fbn2iiY4=";
+    };
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm644 -t $out/share/fonts/opentype/ *.otf
+    install -Dm644 -t $out/share/fonts/truetype/ *.ttf
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Proportional version of the 0xProto font";
+    homepage = "https://github.com/0xType/0xPropo";
+    changelog = "https://github.com/0xType/0xPropo/releases/tag/${version}";
+    license = licenses.ofl;
+    maintainers = with maintainers; [vinnymeller];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/by-name/_6/_64gram/package.nix
+++ b/pkgs/by-name/_6/_64gram/package.nix
@ -2,11 +2,12 @@
 , stdenv
 , fetchFromGitHub
 , telegram-desktop
+, nix-update-script
 }:

 telegram-desktop.overrideAttrs (old: rec {
  pname = "64gram";
-  version = "1.1.16";
+  version = "1.1.17";

  src = fetchFromGitHub {
    owner = "TDesktop-x64";
@ -14,9 +15,11 @@ telegram-desktop.overrideAttrs (old: rec {
    rev = "v${version}";

    fetchSubmodules = true;
-    hash = "sha256-2IuNJleHtlkELcTHDwRT4pcDcDXSqM5YlLPGYiGT2TE=";
+    hash = "sha256-QWHC1NAAKpH9zU7cplCW2rNYckY87bpU7MEZ1ytSi58=";
  };

+  passthru.updateScript = nix-update-script {};
+
  meta = with lib; {
    description = "An unofficial Telegram Desktop providing Windows 64bit build and extra features";
    license = licenses.gpl3Only;
--- a/pkgs/by-name/as/asahi-bless/package.nix
+++ b/pkgs/by-name/as/asahi-bless/package.nix
@ -0,0 +1,26 @@
+{ lib
+, fetchCrate
+, rustPlatform
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "asahi-bless";
+  version = "0.3.0";
+
+  src = fetchCrate {
+    inherit pname version;
+    hash = "sha256-pgl424SqeHODsjGwNRJtVHT6sKRlYxlXl3esEKK02jc=";
+  };
+
+  cargoHash = "sha256-ilblP8nqb/eY0+9Iua298M7NQKv+IwtdliGd9ZYAVaM=";
+  cargoDepsName = pname;
+
+  meta = with lib; {
+    description = "A tool to select active boot partition on ARM Macs";
+    homepage = "https://crates.io/crates/asahi-bless";
+    license = licenses.mit;
+    maintainers = with maintainers; [ lukaslihotzki ];
+    mainProgram = "asahi-bless";
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/by-name/as/asahi-btsync/package.nix
+++ b/pkgs/by-name/as/asahi-btsync/package.nix
@ -0,0 +1,26 @@
+{ lib
+, fetchCrate
+, rustPlatform
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "asahi-btsync";
+  version = "0.2.0";
+
+  src = fetchCrate {
+    inherit pname version;
+    hash = "sha256-jp05WcwY1cWh4mBQj+3jRCZoG32OhDvTB84hOAGemX8=";
+  };
+
+  cargoHash = "sha256-XsgWqdwb0DDsK6HkaoVGQB/mm1U1TVzJM5q/gt9GryA=";
+  cargoDepsName = pname;
+
+  meta = with lib; {
+    description = "A tool to sync Bluetooth pairing keys with macos on ARM Macs";
+    homepage = "https://crates.io/crates/asahi-btsync";
+    license = licenses.mit;
+    maintainers = with maintainers; [ lukaslihotzki ];
+    mainProgram = "asahi-btsync";
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/by-name/as/asahi-nvram/package.nix
+++ b/pkgs/by-name/as/asahi-nvram/package.nix
@ -0,0 +1,26 @@
+{ lib
+, fetchCrate
+, rustPlatform
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "asahi-nvram";
+  version = "0.2.1";
+
+  src = fetchCrate {
+    inherit pname version;
+    hash = "sha256-bFUFjHVTYj0eUmhijraOdeCvAt2UGX8+yyvooYN1Uo0=";
+  };
+
+  cargoHash = "sha256-WhySIQew8xxdwXLWkpvTYQZFiqCEPjEAjr7NVxfjDkU=";
+  cargoDepsName = pname;
+
+  meta = with lib; {
+    description = "A tool to read and write nvram variables on ARM Macs";
+    homepage = "https://crates.io/crates/asahi-nvram";
+    license = licenses.mit;
+    maintainers = with maintainers; [ lukaslihotzki ];
+    mainProgram = "asahi-nvram";
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/by-name/as/asahi-wifisync/package.nix
+++ b/pkgs/by-name/as/asahi-wifisync/package.nix
@ -0,0 +1,26 @@
+{ lib
+, fetchCrate
+, rustPlatform
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "asahi-wifisync";
+  version = "0.2.0";
+
+  src = fetchCrate {
+    inherit pname version;
+    hash = "sha256-wKd6rUUnegvl6cHODVQlllaOXuAGlmwx9gr73I/2l/c=";
+  };
+
+  cargoHash = "sha256-UF1T0uAFO/ydTWigYXOP9Ju1qgV1oBmJuXSq4faSzJM=";
+  cargoDepsName = pname;
+
+  meta = with lib; {
+    description = "A tool to sync Wifi passwords with macos on ARM Macs";
+    homepage = "https://crates.io/crates/asahi-wifisync";
+    license = licenses.mit;
+    maintainers = with maintainers; [ lukaslihotzki ];
+    mainProgram = "asahi-wifisync";
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/by-name/bi/bitbake-language-server/package.nix
+++ b/pkgs/by-name/bi/bitbake-language-server/package.nix
@ -1,19 +1,20 @@
 { lib
 , nix-update-script
 , python3
+, oelint-adv
 , fetchFromGitHub
 }:

 python3.pkgs.buildPythonApplication rec {
  pname = "bitbake-language-server";
-  version = "0.0.8";
+  version = "0.0.14";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "Freed-Wu";
    repo = pname;
    rev = version;
-    hash = "sha256-WJpa2LP95vrJG/OjiLSx8zEPO5ZOw66M5s3r2dufQJA=";
+    hash = "sha256-aGj9lW420A+iTQWSCdIITAJj3p89VUkPvdhQ/0M6uXo=";
  };

  nativeBuildInputs = with python3.pkgs; [
@ -22,18 +23,17 @@ python3.pkgs.buildPythonApplication rec {
  ];

  propagatedBuildInputs = with python3.pkgs; [
-    oelint-parser
    pygls
-  ];
+  ] ++ [ oelint-adv ];

  passthru.updateScript = nix-update-script { };

-  meta = with lib; {
+  meta = {
    description = "Language server for bitbake";
    mainProgram = "bitbake-language-server";
    homepage = "https://github.com/Freed-Wu/bitbake-language-server";
-    changelog = "https://github.com/Freed-Wu/bitbake-language-server/releases/tag/v${version}";
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ otavio ];
+    changelog = "https://github.com/Freed-Wu/bitbake-language-server/releases/tag/${version}";
+    license = lib.licenses.gpl3;
+    maintainers = [ lib.maintainers.otavio ];
  };
 }
--- a/pkgs/by-name/ch/chess-tui/package.nix
+++ b/pkgs/by-name/ch/chess-tui/package.nix
@ -0,0 +1,26 @@
+{ lib
+, fetchFromGitHub
+, rustPlatform
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "chess-tui";
+  version = "1.2.0";
+
+  src = fetchFromGitHub {
+    owner = "thomas-mauran";
+    repo = "chess-tui";
+    rev = "${version}";
+    hash = "sha256-If2xShHuqdCeasP12ZzwvGJSIKFmqJs0Hv1fBhJKoU4=";
+  };
+
+  cargoHash = "sha256-TT4lVAttlT3knufMslSVxInn9QM0QJ9jyklzwhRikWA=";
+
+  meta = with lib;{
+    description = "A chess TUI implementation in rust";
+    homepage = "https://github.com/thomas-mauran/chess-tui";
+    maintainers = with maintainers; [ ByteSudoer ];
+    license = licenses.mit;
+    mainProgram = "chess-tui";
+  };
+}
--- a/pkgs/by-name/de/deltatouch/package.nix
+++ b/pkgs/by-name/de/deltatouch/package.nix
@ -0,0 +1,91 @@
+{ lib
+, stdenv
+, fetchFromGitea
+, fetchpatch
+, cmake
+, intltool
+, libdeltachat
+, lomiri
+, qt5
+, quirc
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "deltatouch";
+  version = "1.4.0";
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "lk108";
+    repo = "deltatouch";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-tqcQmFmF8Z9smVMfaXOmXQ3Uw41bUcU4iUi8fxBlg8U=";
+    fetchSubmodules = true;
+  };
+
+
+  patches = [
+    (fetchpatch {
+      name = "0001-deltatouch-Fix-localisation.patch";
+      url = "https://codeberg.org/lk108/deltatouch/commit/dcfdd8a0fca5fff10d0383f77f4c0cbea302de00.patch";
+      hash = "sha256-RRjHG/xKtj757ZP2SY0GtWwh66kkTWoICV1vDkFAw3k=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    qt5.wrapQtAppsHook
+    intltool
+    cmake
+  ];
+
+  buildInputs = [
+    qt5.qtbase
+    qt5.qtwebengine
+    qt5.qtquickcontrols2
+    lomiri.lomiri-ui-toolkit
+    lomiri.lomiri-ui-extras
+    lomiri.lomiri-api
+    lomiri.lomiri-indicator-network # Lomiri.Connectivity module
+    lomiri.qqc2-suru-style
+  ];
+
+  postPatch = ''
+    # Fix all sorts of install locations
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'set(DATA_DIR /)' 'set(DATA_DIR ''${CMAKE_INSTALL_DATAROOTDIR})' \
+      --replace-fail 'RUNTIME DESTINATION ''${CMAKE_INSTALL_PREFIX}' 'RUNTIME DESTINATION ''${CMAKE_INSTALL_BINDIR}' \
+      --replace-fail 'assets/logo.svg DESTINATION assets' 'assets/logo.svg DESTINATION ''${CMAKE_INSTALL_DATAROOTDIR}/icons/hicolor/scalable/apps RENAME deltatouch.svg' \
+      --replace-fail "\''${DESKTOP_FILE_NAME} DESTINATION \''${DATA_DIR}" "\''${DESKTOP_FILE_NAME} DESTINATION \''${CMAKE_INSTALL_DATAROOTDIR}/applications"
+
+    substituteInPlace plugins/DeltaHandler/CMakeLists.txt plugins/DTWebEngineProfile/CMakeLists.txt \
+      --replace-fail 'set(QT_IMPORTS_DIR "/lib/''${ARCH_TRIPLET}")' 'set(QT_IMPORTS_DIR "${placeholder "out"}/${qt5.qtbase.qtQmlPrefix}")'
+
+    # Fix import of library dependencies
+    substituteInPlace plugins/DeltaHandler/CMakeLists.txt \
+      --replace-fail 'IMPORTED_LOCATION "''${CMAKE_CURRENT_BINARY_DIR}/libdeltachat.so"' 'IMPORTED_LOCATION "${lib.getLib libdeltachat}/lib/libdeltachat.so"' \
+      --replace-fail 'IMPORTED_LOCATION "''${CMAKE_CURRENT_BINARY_DIR}/libquirc.so.1.2"' 'IMPORTED_LOCATION "${lib.getLib quirc}/lib/libquirc.so"'
+
+    # Fix icon reference in desktop file
+    substituteInPlace deltatouch.desktop.in \
+      --replace-fail 'Icon=assets/logo.svg' 'Icon=deltatouch'
+  '';
+
+  postInstall = ''
+    # Remove clickable metadata & helpers from out
+    rm $out/{manifest.json,share/push*}
+  '';
+
+  meta = with lib; {
+    changelog = "https://codeberg.org/lk108/deltatouch/src/commit/${finalAttrs.src.rev}/CHANGELOG";
+    description = "Messaging app for Ubuntu Touch, powered by Delta Chat core";
+    longDescription = ''
+      DeltaTouch is a messenger for Ubuntu Touch based on Delta Chat core.
+      Delta Chat works over email.
+    '';
+    homepage = "https://codeberg.org/lk108/deltatouch";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ link2xt ];
+    mainProgram = "deltatouch";
+    platforms = platforms.linux;
+  };
+})
--- a/pkgs/by-name/ei/eigenlayer/package.nix
+++ b/pkgs/by-name/ei/eigenlayer/package.nix
@ -6,16 +6,16 @@
 }:
 buildGoModule rec {
  pname = "eigenlayer";
-  version = "0.6.3";
+  version = "0.7.0";

  src = fetchFromGitHub {
    owner = "Layr-Labs";
    repo = "eigenlayer-cli";
    rev = "v${version}";
-    hash = "sha256-v2d6+jxEYXgJjZOFRc+teQWq161v4FLO+KjYq96XwTs=";
+    hash = "sha256-4KN5AletaQ/Xpr/mCLgB/ceVbqMzWoi7bKoWRDePnuc=";
  };

-  vendorHash = "sha256-pJYs9jD3EmmXlkPO6gkuB2FYsgX9Yn6S6QYb2dQ1fY4=";
+  vendorHash = "sha256-6RF32eWU7HS9C3T7hDVHjWxX/3Ch/ixOGHml30Q9PaU=";

  ldflags = ["-s" "-w"];
  subPackages = ["cmd/eigenlayer"];
--- a/pkgs/by-name/el/elasticsearch-curator/package.nix
+++ b/pkgs/by-name/el/elasticsearch-curator/package.nix
@ -1,26 +1,25 @@
-{ lib
-, elasticsearch-curator
-, fetchFromGitHub
-, nix-update-script
-, python3
-, testers
+{
+  lib,
+  elasticsearch-curator,
+  fetchFromGitHub,
+  nix-update-script,
+  python3,
+  testers,
 }:

 python3.pkgs.buildPythonApplication rec {
  pname = "elasticsearch-curator";
-  version = "8.0.12";
+  version = "8.0.15";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "elastic";
    repo = "curator";
    rev = "refs/tags/v${version}";
-    hash = "sha256-CU/8l5607eKodcdpMKu0Wdlg+K6YnFX6uoDju12NDR0=";
+    hash = "sha256-pW928jT9oL76RJuJgH7nhCvgWPzXixzqBKVYsaJy9xw=";
  };

-  build-system = with python3.pkgs; [
-    hatchling
-  ];
+  build-system = with python3.pkgs; [ hatchling ];

  dependencies = with python3.pkgs; [
    certifi
--- a/pkgs/by-name/fi/files-cli/package.nix
+++ b/pkgs/by-name/fi/files-cli/package.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "files-cli";
-  version = "2.12.54";
+  version = "2.12.56";

  src = fetchFromGitHub {
    repo = "files-cli";
    owner = "files-com";
    rev = "v${version}";
-    hash = "sha256-NA71J7sfbUW1c/FxVrmkTw/hwbZqFbxqdPjeMoYA9nc=";
+    hash = "sha256-0cvGdYy84gfxDIPcz4GqUNwwADSDaSdTlpkD6eYh2CU=";
  };

-  vendorHash = "sha256-/Zd5U/a/9mw/9llSRvmjLT+L7gcE0OZjkiRAOYHoQCU=";
+  vendorHash = "sha256-igFqxTkSJpWHfquvRnBDLXcW8VNsJJK4fNIDob5oCuE=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/gi/gitu/package.nix
+++ b/pkgs/by-name/gi/gitu/package.nix
@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "gitu";
-  version = "0.13.1";
+  version = "0.15.0";

  src = fetchFromGitHub {
    owner = "altsem";
    repo = "gitu";
    rev = "v${version}";
-    hash = "sha256-1wfc3n3uSkox2wa5i+Qiv7PZ0d2dXXbwjWw8NMXJXj8=";
+    hash = "sha256-/yPP8GzeaVMauhcYLDAgXzOafUpOhJF2tyHOyD6KWS8=";
  };

-  cargoHash = "sha256-JwNyzA6D8mIzp/+egjD2C7T9mGbcCKKtwFRXBuXMQ+U=";
+  cargoHash = "sha256-eKRFPnH9MvSykrnPo4dc5DtEfb79s0hBtmYfERGQbWg=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/hy/hyprdim/Cargo.lock
+++ b/pkgs/by-name/hy/hyprdim/Cargo.lock
--- a/pkgs/by-name/hy/hyprdim/package.nix
+++ b/pkgs/by-name/hy/hyprdim/package.nix
@ -8,16 +8,21 @@

 rustPlatform.buildRustPackage rec {
  pname = "hyprdim";
-  version = "2.2.3";
+  version = "2.2.4";

  src = fetchFromGitHub {
    owner = "donovanglover";
    repo = "hyprdim";
    rev = version;
-    hash = "sha256-Eeh0D3DkC4ureDUE+BXTGcMFNmZ0hLSidlKlL4ZDgsQ=";
+    hash = "sha256-XRaBrn8gnXyMiCf3UQvdZGnZ//YMUivfVg0IoZF5F88=";
  };

-  cargoHash = "sha256-hgcGzRLB1L3yxJjw1ECDJPmbl1W+2OS4KDojclyVYrc=";
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "hyprland-0.3.13" = "sha256-gjShmFcECdX0/t7mL035l9e9OzZuJqX0Ueozv38l03g=";
+    };
+  };

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/i2/i2p/package.nix
+++ b/pkgs/by-name/i2/i2p/package.nix
@ -0,0 +1,122 @@
+{ lib
+, stdenv
+, fetchzip
+, jdk
+, ant
+, gettext
+, which
+, dbip-country-lite
+, java-service-wrapper
+, makeWrapper
+, gmp
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "i2p";
+  version = "2.4.0";
+
+  src = fetchzip {
+    urls = map (mirror: "${mirror}${finalAttrs.version}/i2psource_${finalAttrs.version}.tar.bz2") [
+      "https://github.com/i2p/i2p.i2p/releases/download/i2p-"
+      "https://download.i2p2.de/releases/"
+      "https://files.i2p-projekt.de/"
+      "https://download.i2p2.no/releases/"
+    ];
+    hash = "sha256-RESN1qA/SD9MajUSJyXssNZnph2XZge7xr2kTgOp5V4=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    makeWrapper
+    ant
+    gettext
+    jdk
+    which
+  ];
+
+  buildInputs = [ gmp ];
+
+  postConfigure = ''
+    rm -r installer/lib
+    mkdir -p installer/lib/wrapper/all/
+    # The java-service-wrapper is needed for build but not really used in runtime
+    ln -s ${java-service-wrapper}/lib/wrapper.jar installer/lib/wrapper/all/wrapper.jar
+    # Don't use the bundled geoip data
+    echo "with-geoip-database=true" >> override.properties
+  '';
+
+  buildPhase = ''
+    # When this variable exists we can build the .so files only.
+    export DEBIANVERSION=1
+    pushd core/c/jcpuid
+    ./build.sh
+    popd
+    pushd core/c/jbigi
+    ./build_jbigi.sh dynamic
+    popd
+    export JAVA_TOOL_OPTIONS="-Dfile.encoding=UTF8"
+    SOURCE_DATE_EPOCH=0 ant preppkg-unix
+  '';
+
+  installPhase = ''
+    mkdir -p $out/{bin,share,geoip}
+    mv pkg-temp/* $out
+    mv core/c/jbigi/*.so $out/lib
+    mv $out/man $out/share/
+    rm $out/{osid,postinstall.sh,INSTALL-headless.txt}
+
+    for jar in $out/lib/*.jar; do
+      if [ ! -z $CP ]; then
+        CP=$CP:$jar;
+      else
+        CP=$jar
+      fi
+    done
+
+    makeWrapper ${jdk}/bin/java $out/bin/i2prouter \
+      --add-flags "-cp $CP -Djava.library.path=$out/lib/ -Di2p.dir.base=$out -DloggerFilenameOverride=logs/log-router-@.txt" \
+      --add-flags "net.i2p.router.RouterLaunch"
+
+    ln -s ${dbip-country-lite.mmdb} $out/geoip/GeoLite2-Country.mmdb
+  '';
+
+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    # Check if jbigi is used
+    java -cp $out/lib/i2p.jar -Djava.library.path=$out/lib/ net.i2p.util.NativeBigInteger \
+      | tee /dev/stderr | grep -Fw "Found native library" || exit 1
+
+    runHook postInstallCheck
+  '';
+
+  meta = with lib; {
+    description = "Applications and router for I2P, anonymity over the Internet";
+    homepage = "https://geti2p.net";
+    sourceProvenance = with sourceTypes; [
+      fromSource
+      binaryBytecode # source bundles dependencies as jars
+    ];
+    license = with licenses; [
+      asl20
+      boost
+      bsd2
+      bsd3
+      cc-by-30
+      cc0
+      epl10
+      gpl2
+      gpl3
+      lgpl21Only
+      lgpl3Only
+      mit
+      publicDomain
+    ];
+    platforms = [ "x86_64-linux" "i686-linux" "aarch64-linux" ];
+    maintainers = with maintainers; [ linsui ];
+    mainProgram = "i2prouter-plain";
+  };
+})
--- a/pkgs/by-name/ju/justbuild/package.nix
+++ b/pkgs/by-name/ju/justbuild/package.nix
@ -11,7 +11,7 @@
  openssl,

  pkg-config,
-  protobuf_23,
+  protobuf_24,
  grpc,
  pandoc,
  python3,
@ -75,19 +75,21 @@ stdenv.mkDerivation rec {
    grpc
    libgit2
    openssl
-    # Using protobuf 23 because this is the same version upstream currently
-    # uses for bundled builds
+    # Using protobuf 24 because the current version of grpc is build using
+    # protobuf 24 and therefore the older protobuf version causes errors
+    # during build.
+    # Upstream currently uses protobuf 23 for bundled builds
    # For future updates: The currently used version can be found in the file
    # etc/repos.json: https://github.com/just-buildsystem/justbuild/blob/master/etc/repos.json
    # under the key .repositories.protobuf
-    protobuf_23
+    protobuf_24
    python3
  ];

  postPatch = ''
    sed -ie 's|\./bin/just-mr.py|${python3}/bin/python3 ./bin/just-mr.py|' bin/bootstrap.py
    sed -ie 's|#!/usr/bin/env python3|#!${python3}/bin/python3|' bin/parallel-bootstrap-traverser.py
-    jq '.repositories.protobuf.pkg_bootstrap.local_path = "${protobuf_23}"' etc/repos.json > etc/repos.json.patched
+    jq '.repositories.protobuf.pkg_bootstrap.local_path = "${protobuf_24}"' etc/repos.json > etc/repos.json.patched
    mv etc/repos.json.patched etc/repos.json
    jq '.repositories.com_github_grpc_grpc.pkg_bootstrap.local_path = "${grpc}"' etc/repos.json > etc/repos.json.patched
    mv etc/repos.json.patched etc/repos.json
@ -170,7 +172,7 @@ stdenv.mkDerivation rec {
  '';

  meta = with lib; {
-    broken = true; # last successful build 2024-01-26
+    broken = stdenv.isDarwin;
    description = "a generic build tool";
    homepage = "https://github.com/just-buildsystem/justbuild";
    license = licenses.asl20;
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@ -72,13 +72,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
  pname = "llama-cpp";
-  version = "2589";
+  version = "2636";

  src = fetchFromGitHub {
    owner = "ggerganov";
    repo = "llama.cpp";
    rev = "refs/tags/b${finalAttrs.version}";
-    hash = "sha256-VvTXNEl1pzzwSBT6JSOyvys3tHkjp1n6lVGngD97J74=";
+    hash = "sha256-FAU9Kv8cfFmx2gCx5oFgPmBQnwVuhkqlxIsB1yWDHUY=";
  };

  postPatch = ''
--- a/pkgs/by-name/lx/lxd-ui/package.nix
+++ b/pkgs/by-name/lx/lxd-ui/package.nix
@ -7,22 +7,23 @@
  prefetch-yarn-deps,
  yarn,
  nixosTests,
+  nix-update-script,
 }:

 stdenv.mkDerivation rec {
  pname = "lxd-ui";
-  version = "0.7";
+  version = "0.8";

  src = fetchFromGitHub {
    owner = "canonical";
    repo = "lxd-ui";
    rev = "refs/tags/${version}";
-    hash = "sha256-DJLkXZpParmEYHbTpl6KFC9l9y5DqzUTrC0pb2dJXI4=";
+    hash = "sha256-oD/GPm84oFXHcZ8vTUzNgQinrHwNuvpeVjsrp8ibIZY=";
  };

  offlineCache = fetchYarnDeps {
    yarnLock = "${src}/yarn.lock";
-    hash = "sha256-ckTWE/czzvxbGOF8fsJ3W1sal7+NaHquoSjZSPjkGj4=";
+    hash = "sha256-hRZ0vbksxnUv4XMrbhP2PI94UYYzwrydJHSx+uf+MbI=";
  };

  nativeBuildInputs = [
@ -60,10 +61,12 @@ stdenv.mkDerivation rec {
  '';

  passthru.tests.default = nixosTests.lxd.ui;
+  passthru.updateScript = nix-update-script { };

  meta = {
    description = "Web user interface for LXD";
    homepage = "https://github.com/canonical/lxd-ui";
+    changelog = "https://github.com/canonical/lxd-ui/releases/tag/${version}";
    license = lib.licenses.gpl3;
    maintainers = lib.teams.lxc.members;
    platforms = lib.platforms.linux;
--- a/pkgs/by-name/me/mermaid-cli/package.nix
+++ b/pkgs/by-name/me/mermaid-cli/package.nix
@ -11,18 +11,18 @@

 stdenv.mkDerivation rec {
  pname = "mermaid-cli";
-  version = "10.4.0";
+  version = "10.8.0";

  src = fetchFromGitHub {
    owner = "mermaid-js";
    repo = "mermaid-cli";
    rev = version;
-    hash = "sha256-mzBN/Hg/03+jYyoAHvjx33HC46ZA6dtHmiSnaExCRR0=";
+    hash = "sha256-nCLLv8QXx9N4WiUFw3WB+Rpfd4H4oCFa1ac01al+ovY=";
  };

  offlineCache = fetchYarnDeps {
    yarnLock = "${src}/yarn.lock";
-    hash = "sha256-RQsRGzkuPgGVuEpF5lzv26XKMPLX2NrsjVkGMMkCbO4=";
+    hash = "sha256-thZxaa7S3vlS1Ws+G5dklun+ISCV908p1Ov7qb8fP3c=";
  };

  nativeBuildInputs  = [
--- a/pkgs/by-name/mo/movim/package.nix
+++ b/pkgs/by-name/mo/movim/package.nix
@ -1,20 +1,51 @@
 { lib
+, fetchpatch
 , fetchFromGitHub
+, dash
 , php
 , phpCfg ? null
 , withPgsql ? true # “strongly recommended” according to docs
 , withMysql ? false
+, minifyStaticFiles ? false # default files are often not minified
+, parallel
+, esbuild
+, lightningcss
+, scour
+, nixosTests
 }:

+let
+  defaultMinifyOpts = {
+    script = {
+      enable = false;
+      target = "es2021";
+    };
+    style = {
+      enable = false;
+      browserslist = "defaults, Firefox ESR, last 20 Firefox major versions, last 20 Chrome major versions, last 3 Safari major versions, last 1 KaiOS version, and supports css-variables";
+    };
+    svg = {
+      enable = false;
+    };
+  };
+
+  minify = lib.recursiveUpdate defaultMinifyOpts
+    (if lib.isBool minifyStaticFiles && minifyStaticFiles then
+      { script.enable = true; style.enable = true; svg.enable = true; }
+    else if lib.isAttrs minifyStaticFiles then
+      lib.filterAttrsRecursive (_: v: v != null) minifyStaticFiles
+    else
+      { });
+in
 php.buildComposerProject (finalAttrs: {
  pname = "movim";
-  version = "0.23";
+  version = "0.23.0.20240328";

  src = fetchFromGitHub {
    owner = "movim";
    repo = "movim";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-9MBe2IRYxvUuCc5m7ajvIlBU7YVm4A3RABlOOIjpKoM=";
+    rev = "c3a43cd7e3a1a3a6efd595470e6a85b2ec578cba";
+    hash = "sha256-x0C4w3SRP3NMOhGSZOQALk6PNWUre4MvFW5cESr8Wvk=";
  };

  php = php.buildEnv ({
@ -28,16 +59,98 @@ php.buildComposerProject (finalAttrs: {
    extraConfig = phpCfg;
  });

+  nativeBuildInputs =
+    lib.optional (lib.any (x: x.enable) (lib.attrValues minify)) parallel
+    ++ lib.optional minify.script.enable esbuild
+    ++ lib.optional minify.style.enable lightningcss
+    ++ lib.optional minify.svg.enable scour;
+
  # no listed license
  # pinned commonmark
  composerStrictValidation = false;

-  vendorHash = "sha256-PBoJbVuF0Qy7nNlL4yx446ivlZpPYNIai78yC0wWkCM=";
+  vendorHash = "sha256-RFIi1I+gcagRgkDpgQeR1oGJeBGA7z9q3DCfW+ZDr2Y=";
+
+  postPatch = ''
+    # Our modules are already wrapped, removes missing *.so warnings;
+    # replacing `$configuration` with actually-used flags.
+    substituteInPlace src/Movim/Daemon/Session.php \
+      --replace-fail "exec php ' . \$configuration " "exec php -dopcache.enable=1 -dopcache.enable_cli=1 ' "
+
+    # Point to PHP + PHP INI in the Nix store
+    substituteInPlace src/Movim/{Console/DaemonCommand.php,Daemon/Session.php} \
+      --replace-fail "exec php " "exec ${lib.getExe finalAttrs.php} "
+    substituteInPlace src/Movim/Console/DaemonCommand.php \
+      --replace-fail "<info>php vendor/bin/phinx migrate</info>" \
+        "<info>${lib.getBin finalAttrs.php} vendor/bin/phinx migrate</info>" \
+      --replace-fail "<info>php daemon.php setAdmin {jid}</info>" \
+        "<info>${finalAttrs.meta.mainProgram} setAdmin {jid}</info>"
+
+    # BUGFIX: Imagick API Changes for 7.x+
+    # See additionally: https://github.com/movim/movim/pull/1122
+    substituteInPlace src/Movim/Image.php \
+      --replace-fail "Imagick::ALPHACHANNEL_REMOVE" "Imagick::ALPHACHANNEL_OFF" \
+      --replace-fail "Imagick::ALPHACHANNEL_ACTIVATE" "Imagick::ALPHACHANNEL_ON"
+  '';
+
+  preBuild = lib.optionalString minify.script.enable ''
+    find ./public -type f -iname "*.js" \
+      | parallel ${lib.escapeShellArgs [
+          "--will-cite"
+          "-j $NIX_BUILD_CORES"
+          ''
+            tmp="$(mktemp)"
+            esbuild {} --minify --target=${lib.escapeShellArg minify.script.target} --outfile=$tmp
+            [[ "$(stat -c %s $tmp)" -lt "$(stat -c %s {})" ]] && mv $tmp {}
+          ''
+        ]}
+  '' + lib.optionalString minify.style.enable ''
+    export BROWSERLIST=${lib.escapeShellArg minify.style.browserslist}
+    find ./public -type f -iname "*.css" \
+      | parallel ${lib.escapeShellArgs [
+          "--will-cite"
+          "-j $NIX_BUILD_CORES"
+          ''
+            tmp="$(mktemp)"
+            lightningcss {} --minify --browserslist --output-file=$tmp
+            [[ "$(stat -c %s $tmp)" -lt "$(stat -c %s {})" ]] && mv $tmp {}
+          ''
+        ]}
+  '' + lib.optionalString minify.svg.enable ''
+    find ./public -type f -iname "*.svg" -a -not -path "*/emojis/*" \
+      | parallel ${lib.escapeShellArgs [
+          "--will-cite"
+          "-j $NIX_BUILD_CORES"
+          ''
+            tmp="$(mktemp)"
+            scour -i {} -o $tmp --disable-style-to-xml --enable-comment-stripping --enable-viewboxing --indent=tab
+            [[ "$(stat -c %s $tmp)" -lt "$(stat -c %s {})" ]] && mv $tmp {}
+          ''
+        ]}
+  '';
+
+  postInstall = ''
+    mkdir -p $out/bin
+    echo "#!${lib.getExe dash}" > $out/bin/movim
+    echo "${lib.getExe finalAttrs.php} $out/share/php/${finalAttrs.pname}/daemon.php \"\$@\"" >> $out/bin/movim
+    chmod +x $out/bin/movim
+
+    mkdir -p $out/share/{bash-completion/completion,fish/vendor_completions.d,zsh/site-functions}
+    $out/bin/movim completion bash | sed "s/daemon.php/movim/g" > $out/share/bash-completion/completion/movim.bash
+    $out/bin/movim completion fish | sed "s/daemon.php/movim/g" > $out/share/fish/vendor_completions.d/movim.fish
+    $out/bin/movim completion zsh | sed "s/daemon.php/movim/g" > $out/share/zsh/site-functions/_movim
+    chmod +x $out/share/{bash-completion/completion/movim.bash,fish/vendor_completions.d/movim.fish,zsh/site-functions/_movim}
+  '';
+
+  passthru = {
+    tests = { inherit (nixosTests) movim; };
+  };

  meta = {
    description = "a federated blogging & chat platform that acts as a web front end for the XMPP protocol";
    homepage = "https://movim.eu";
    license = lib.licenses.agpl3Plus;
    maintainers = with lib.maintainers; [ toastal ];
+    mainProgram = "movim";
  };
 })
--- a/pkgs/by-name/na/namespace-cli/package.nix
+++ b/pkgs/by-name/na/namespace-cli/package.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "namespace-cli";
-  version = "0.0.354";
+  version = "0.0.355";

  src = fetchFromGitHub {
    owner = "namespacelabs";
    repo = "foundation";
    rev = "v${version}";
-    hash = "sha256-wO1ygoaqgCkvtVJ+ATxNGSiJpAZAqe2LXyPg8r4osQk=";
+    hash = "sha256-St/zZqfoate9TwYo7q9Za+T6q4kRw9vSzcBfMW7AXkw=";
  };

  vendorHash = "sha256-a/e+xPOD9BDSlKknmfcX2tTMyIUrzKxqtUpFXcFIDSE=";
--- a/pkgs/by-name/oe/oelint-adv/package.nix
+++ b/pkgs/by-name/oe/oelint-adv/package.nix
@ -6,17 +6,18 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "oelint-adv";
-  version = "4.4.5";
+  version = "5.1.2";
  format = "setuptools";

  src = fetchPypi {
    inherit version;
    pname = "oelint_adv";
-    hash = "sha256-NRTfWHtItwjZi3O26MzH8GtetCkj7egZa3OArs+Q2SY=";
+    hash = "sha256-7lrjytvcOnZZ8ezhWKng7OahqwsW95VkDt8B6NMriR0=";
  };

  propagatedBuildInputs = with python3.pkgs; [
    anytree
+    argcomplete
    colorama
    oelint-parser
    urllib3
--- a/pkgs/by-name/ry/ryzen-monitor-ng/package.nix
+++ b/pkgs/by-name/ry/ryzen-monitor-ng/package.nix
@ -0,0 +1,41 @@
+{ lib, stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation {
+  pname = "ryzen-monitor-ng";
+  version = "2.0.5-unstable-2023-11-05";
+
+  # Upstream has not updated ryzen_smu header version
+  # This fork corrects ryzen_smu header version and
+  # adds support for Matisse AMD CPUs.
+  src = fetchFromGitHub {
+    owner = "plasmin";
+    repo = "ryzen_monitor_ng";
+    rev = "8b7854791d78de731a45ce7d30dd17983228b7b1";
+    hash = "sha256-fcW2fEsCFliRnMFnboR0jchzVIlCYbr2AE6AS06cb6o=";
+  };
+
+  ## Remove binaries committed into upstream repo
+  preBuild = ''
+    rm src/ryzen_monitor
+  '';
+
+  makeTargets = [ "clean" "install" ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    mv ./src/ryzen_monitor $out/bin
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Access Ryzen SMU information exposed by the ryzen_smu driver";
+    homepage = "https://github.com/mann1x/ryzen_monitor_ng";
+    license = licenses.agpl3Only;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ phdyellow ];
+    mainProgram = "ryzen_monitor";
+  };
+}
--- a/pkgs/by-name/sc/scrutiny/package.nix
+++ b/pkgs/by-name/sc/scrutiny/package.nix
@ -7,13 +7,13 @@
 }:
 let
  pname = "scrutiny";
-  version = "0.8.0";
+  version = "0.8.1";

  src = fetchFromGitHub {
    owner = "AnalogJ";
    repo = "scrutiny";
    rev = "refs/tags/v${version}";
-    hash = "sha256-ysjE2nn1WwhEiFIvJ5cRCJQf9mECTgiGUyenwf3mKTA=";
+    hash = "sha256-WoU5rdsIEhZQ+kPoXcestrGXC76rFPvhxa0msXjFsNg=";
  };

  frontend = buildNpmPackage {
@ -64,6 +64,7 @@ buildGoModule rec {
  meta = {
    description = "Hard Drive S.M.A.R.T Monitoring, Historical Trends & Real World Failure Thresholds.";
    homepage = "https://github.com/AnalogJ/scrutiny";
+    changelog = "https://github.com/AnalogJ/scrutiny/releases/tag/v${version}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ jnsgruk ];
    mainProgram = "scrutiny";
--- a/pkgs/by-name/sh/shanggu-fonts/package.nix
+++ b/pkgs/by-name/sh/shanggu-fonts/package.nix
@ -0,0 +1,70 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  p7zip,
+}:
+let
+  version = "1.020";
+
+  source =
+    with lib.attrsets;
+    mapAttrs'
+      (
+        name: hash:
+        nameValuePair (lib.strings.toLower name) (fetchurl {
+          url = "https://github.com/GuiWonder/Shanggu/releases/download/${version}/Shanggu${name}TTCs.7z";
+          inherit hash;
+        })
+      )
+      {
+        Mono = "sha256-PcP4zJk8pptuX9tchr4qOorqAvj8YMRBcVrtCbp/1Zo=";
+        Round = "sha256-3wqMdnpdn4xpw7wO+QmIpl5/vZjQGgcfTMdtewK28B8=";
+        Sans = "sha256-isRqIVcH24knPqPI+a+9CpxEKd+PG642giUS9+VbC60=";
+        Serif = "sha256-k0I0NXStE1hcdOaOykuESy6sYqBHHaMaDxxr3tJUSYU=";
+      };
+in
+stdenvNoCC.mkDerivation {
+  pname = "shanggu-fonts";
+  inherit version;
+
+  outputs = [ "out" ] ++ builtins.attrNames source;
+
+  nativeBuildInputs = [ p7zip ];
+
+  unpackPhase = ''
+    runHook preUnpack
+  '' + lib.strings.concatLines (
+    lib.attrsets.mapAttrsToList (name: value: ''
+      7z x ${value} -o${name}
+    '') source
+  ) + ''
+    runHook postUnpack
+  '';
+
+  installPhase =
+    ''
+      runHook preInstall
+
+      mkdir -p $out/share/fonts/truetype
+    ''
+    + lib.strings.concatLines (
+      lib.lists.forEach (builtins.attrNames source) (
+        name: (''
+          install -Dm444 ${name}/*.ttc -t $'' + name + ''/share/fonts/truetype
+          ln -s $'' + name + ''/share/fonts/truetype/*.ttc $out/share/fonts/truetype
+          ''
+        )
+      )
+    ) + ''
+      runHook postInstall
+    '';
+
+  meta = with lib; {
+    homepage = "https://github.com/GuiWonder/Shanggu";
+    description = "Heritage glyph (old glyph) font based on Siyuan";
+    license = licenses.ofl;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ Cryolitia ];
+  };
+}
--- a/pkgs/applications/blockchains/solana/Cargo.lock
+++ b/pkgs/applications/blockchains/solana/Cargo.lock
--- a/pkgs/applications/blockchains/solana/default.nix
+++ b/pkgs/applications/blockchains/solana/default.nix
@ -7,10 +7,11 @@
 , protobuf
 , libcxx
 , rocksdb
+, installShellFiles
 , pkg-config
 , openssl
 , nix-update-script
-# Taken from https://github.com/solana-labs/solana/blob/master/scripts/cargo-install-all.sh#L84
+  # Taken from https://github.com/solana-labs/solana/blob/master/scripts/cargo-install-all.sh#L84
 , solanaPkgs ? [
    "solana"
    "solana-bench-tps"
@ -23,7 +24,7 @@
    "solana-net-shaper"
    "solana-validator"
    "solana-test-validator"
-] ++ [
+  ] ++ [
    # XXX: Ensure `solana-genesis` is built LAST!
    # See https://github.com/solana-labs/solana/issues/5826
    "solana-genesis"
@ -66,36 +67,42 @@ rustPlatform.buildRustPackage rec {
  # I'm not in the mood ((ΦωΦ))
  doCheck = false;

-  nativeBuildInputs = [ protobuf pkg-config ];
+  nativeBuildInputs = [ installShellFiles protobuf pkg-config ];
  buildInputs = [ openssl rustPlatform.bindgenHook ]
-                ++ lib.optionals stdenv.isLinux [ udev ]
-                ++ lib.optionals stdenv.isDarwin [
-                  libcxx
-                  IOKit
-                  Security
-                  AppKit
-                  System
-                  Libsystem ];
+    ++ lib.optionals stdenv.isLinux [ udev ]
+    ++ lib.optionals stdenv.isDarwin [
+    libcxx
+    IOKit
+    Security
+    AppKit
+    System
+    Libsystem
+  ];

  postInstall = ''
+    installShellCompletion --cmd solana \
+      --bash <($out/bin/solana completion --shell bash) \
+      --fish <($out/bin/solana completion --shell fish) \
+      --zsh  <($out/bin/solana completion --shell zsh)
+
    mkdir -p $out/bin/sdk/bpf
    cp -a ./sdk/bpf/* $out/bin/sdk/bpf/
  '';

  # Used by build.rs in the rocksdb-sys crate. If we don't set these, it would
  # try to build RocksDB from source.
-  ROCKSDB_LIB_DIR="${rocksdb}/lib";
+  ROCKSDB_LIB_DIR = "${rocksdb}/lib";

  # Require this on darwin otherwise the compiler starts rambling about missing
  # cmath functions
-  CPPFLAGS=lib.optionals stdenv.isDarwin "-isystem ${lib.getDev libcxx}/include/c++/v1";
-  LDFLAGS=lib.optionals stdenv.isDarwin "-L${lib.getLib libcxx}/lib";
+  CPPFLAGS = lib.optionals stdenv.isDarwin "-isystem ${lib.getDev libcxx}/include/c++/v1";
+  LDFLAGS = lib.optionals stdenv.isDarwin "-L${lib.getLib libcxx}/lib";

  # If set, always finds OpenSSL in the system, even if the vendored feature is enabled.
  OPENSSL_NO_VENDOR = 1;

  meta = with lib; {
-    description = "Web-Scale Blockchain for fast, secure, scalable, decentralized apps and marketplaces. ";
+    description = "Web-Scale Blockchain for fast, secure, scalable, decentralized apps and marketplaces";
    homepage = "https://solana.com";
    license = licenses.asl20;
    maintainers = with maintainers; [ netfox happysalada aikooo7 ];
--- a/pkgs/by-name/th/thcrap-steam-proton-wrapper/package.nix
+++ b/pkgs/by-name/th/thcrap-steam-proton-wrapper/package.nix
@ -0,0 +1,56 @@
+{
+  lib
+  , stdenv
+  , fetchFromGitHub
+  , makeWrapper
+  , bash
+  , subversion
+  , gnome
+}:
+stdenv.mkDerivation {
+  pname = "thcrap-proton";
+  version = "0-unstable-2024-04-03";
+
+  src = fetchFromGitHub {
+    owner = "tactikauan";
+    repo = "thcrap-steam-proton-wrapper";
+    rev = "2b636c3f5f1ce1b9b41f731aa9397aa68d2ce66b";
+    sha256 = "sha256-J2O8F75NMdsxSaNVr8zLf+vLEJE6CHqWQIIscuuJZ3o=";
+  };
+
+  buildInputs = [ subversion ];
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp thcrap_proton $out/bin/thcrap_proton
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    wrapProgram $out/bin/thcrap_proton \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          bash
+          subversion
+          gnome.zenity
+        ]
+      }
+  '';
+
+  meta = {
+    description = "A wrapper script for launching the official Touhou games on Steam with patches through Proton on GNU/Linux";
+    homepage = "https://github.com/tactikauan/thcrap-steam-proton-wrapper";
+    license = lib.licenses.unlicense;
+    maintainers = with lib.maintainers; [ ashuramaruzxc ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
+    mainProgram = "thcrap_proton";
+  };
+}
--- a/pkgs/by-name/to/tootik/package.nix
+++ b/pkgs/by-name/to/tootik/package.nix
@ -0,0 +1,35 @@
+{ lib, stdenv, buildGoModule, fetchFromGitHub, openssl }:
+
+buildGoModule rec {
+  pname = "tootik";
+  version = "0.9.6";
+
+  src = fetchFromGitHub {
+    owner = "dimkr";
+    repo = "tootik";
+    rev = version;
+    hash = "sha256-RcuioFb0+mvZupwgaCN6qbcOy7gHp9KjJxRwaPI55yo=";
+  };
+
+  vendorHash = "sha256-/52VjfoecXaML1cDRIEe1EQPYU8xeP9lu4lY3cMV3VE=";
+
+  nativeBuildInputs = [ openssl ];
+
+  preBuild = ''
+    go generate ./migrations
+  '';
+
+  ldflags = [ "-X github.com/dimkr/tootik/buildinfo.Version=${version}" ];
+
+  tags = [ "fts5" ];
+
+  doCheck = !(stdenv.isDarwin && stdenv.isAarch64);
+
+  meta = {
+    description = "A federated nanoblogging service with a Gemini frontend";
+    homepage = "https://github.com/dimkr/tootik";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ sikmir ];
+    mainProgram = "tootik";
+  };
+}
--- a/pkgs/by-name/ty/typst-preview/Cargo.lock
+++ b/pkgs/by-name/ty/typst-preview/Cargo.lock
@ -437,9 +437,9 @@ dependencies = [

 [[package]]
 name = "clap"
-version = "4.5.2"
+version = "4.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b230ab84b0ffdf890d5a10abdbc8b83ae1c4918275daea1ab8801f71536b2651"
+checksum = "949626d00e063efc93b6dca932419ceb5432f99769911c0b995f7e884c778813"
 dependencies = [
 "clap_builder",
 "clap_derive",
@ -468,11 +468,11 @@ dependencies = [

 [[package]]
 name = "clap_derive"
-version = "4.5.0"
+version = "4.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "307bc0538d5f0f83b8248db3087aa92fe504e4691294d0c96c0eabc33f47ba47"
+checksum = "90239a040c80f5e14809ca132ddc4176ab33d5e17e49691793296e3fcb34d72f"
 dependencies = [
- "heck",
+ "heck 0.5.0",
 "proc-macro2",
 "quote",
 "syn 2.0.52",
@ -1328,6 +1328,12 @@ version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"

+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
 [[package]]
 name = "hermit-abi"
 version = "0.3.9"
@ -2527,8 +2533,9 @@ dependencies = [

 [[package]]
 name = "reflexo"
-version = "0.4.2-rc8"
-source = "git+https://github.com/Myriad-Dreamin/typst.ts?rev=c8ff53382c2afa67582465c6e7e0fd78603e4341#c8ff53382c2afa67582465c6e7e0fd78603e4341"
+version = "0.5.0-rc2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "247ea8050cb5c88b41a68b3269f5a2eb7ebff55851a564d96b035643418346e6"
 dependencies = [
 "base64 0.22.0",
 "bitvec",
@ -3138,7 +3145,7 @@ version = "0.25.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "23dc1fa9ac9c169a78ba62f0b841814b7abae11bdd047b9c58f893439e309ea0"
 dependencies = [
- "heck",
+ "heck 0.4.1",
 "proc-macro2",
 "quote",
 "rustversion",
@ -3151,7 +3158,7 @@ version = "0.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7a3417fc93d76740d974a01654a09777cb500428cc874ca9f45edfe0c4d4cd18"
 dependencies = [
- "heck",
+ "heck 0.4.1",
 "proc-macro2",
 "quote",
 "rustversion",
@ -3596,8 +3603,9 @@ checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"

 [[package]]
 name = "typst"
-version = "0.10.0"
-source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=typst.ts-v0.11.0-2#48820fe69b8061bd949847afc343bf160d05c924"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82ce6533a33d2cc4b5eba6b009b862e75c8f9146a584f84ca154c94463e43993"
 dependencies = [
 "az",
 "bitflags 2.4.2",
@ -3643,7 +3651,7 @@ dependencies = [
 "ttf-parser",
 "two-face",
 "typed-arena",
- "typst-assets 0.10.0",
+ "typst-assets",
 "typst-macros",
 "typst-syntax",
 "typst-timing",
@ -3657,20 +3665,17 @@ dependencies = [

 [[package]]
 name = "typst-assets"
-version = "0.10.0"
-source = "git+https://github.com/typst/typst-assets?rev=4d1211a#4d1211ab5ba8a02992a7362000e6dd422d44dd68"
-
-[[package]]
-name = "typst-assets"
-version = "0.11.0-rc1"
-source = "git+https://github.com/typst/typst-assets?tag=v0.11.0-rc1#0ef66188759fc7035be57d9608ccb1ecfd3ef796"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f13f85360328da54847dd7fefaf272dfa5b6d1fdeb53f32938924c39bf5b2c6c"

 [[package]]
 name = "typst-macros"
-version = "0.10.0"
-source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=typst.ts-v0.11.0-2#48820fe69b8061bd949847afc343bf160d05c924"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "54e48fdd6dabf48a0e595960aaef6ae43dac7d243e8c1c6926a0787d5b8a9ba7"
 dependencies = [
- "heck",
+ "heck 0.4.1",
 "proc-macro2",
 "quote",
 "syn 2.0.52",
@ -3678,7 +3683,7 @@ dependencies = [

 [[package]]
 name = "typst-preview"
-version = "0.10.10"
+version = "0.11.4"
 dependencies = [
 "anyhow",
 "await-tree",
@ -3702,7 +3707,7 @@ dependencies = [
 "tokio",
 "tokio-tungstenite",
 "typst",
- "typst-assets 0.11.0-rc1",
+ "typst-assets",
 "typst-ts-compiler",
 "typst-ts-core",
 "typst-ts-svg-exporter",
@ -3711,8 +3716,9 @@ dependencies = [

 [[package]]
 name = "typst-syntax"
-version = "0.10.0"
-source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=typst.ts-v0.11.0-2#48820fe69b8061bd949847afc343bf160d05c924"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "367d86bf18f0363146bea1ea76fad19b54458695fdfad5e74ead3ede574b75fe"
 dependencies = [
 "comemo",
 "ecow",
@ -3727,8 +3733,9 @@ dependencies = [

 [[package]]
 name = "typst-timing"
-version = "0.10.0"
-source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=typst.ts-v0.11.0-2#48820fe69b8061bd949847afc343bf160d05c924"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b2629933cde6f299c43627b90c83bb006cb906c56cc5dec7324f0a5017d5fd8"
 dependencies = [
 "parking_lot",
 "serde",
@ -3738,8 +3745,9 @@ dependencies = [

 [[package]]
 name = "typst-ts-compiler"
-version = "0.4.2-rc8"
-source = "git+https://github.com/Myriad-Dreamin/typst.ts?rev=c8ff53382c2afa67582465c6e7e0fd78603e4341#c8ff53382c2afa67582465c6e7e0fd78603e4341"
+version = "0.5.0-rc2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c18cf7d96c0c558901b3f7e3f5200ecb7e3d7d3dcc5a1222e94bc875237ff352"
 dependencies = [
 "append-only-vec",
 "base64 0.22.0",
@ -3776,8 +3784,9 @@ dependencies = [

 [[package]]
 name = "typst-ts-core"
-version = "0.4.2-rc8"
-source = "git+https://github.com/Myriad-Dreamin/typst.ts?rev=c8ff53382c2afa67582465c6e7e0fd78603e4341#c8ff53382c2afa67582465c6e7e0fd78603e4341"
+version = "0.5.0-rc2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a69135c380eb60efa4aeabd986d27d82ecd1b4c843fd3393992b449409317847"
 dependencies = [
 "base64 0.22.0",
 "base64-serde",
@ -3813,14 +3822,16 @@ dependencies = [

 [[package]]
 name = "typst-ts-svg-exporter"
-version = "0.4.2-rc8"
-source = "git+https://github.com/Myriad-Dreamin/typst.ts?rev=c8ff53382c2afa67582465c6e7e0fd78603e4341#c8ff53382c2afa67582465c6e7e0fd78603e4341"
+version = "0.5.0-rc2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6063f63c8e3ba3d4d7f4cb1a8fd96b096e8e713f24783278fea98dac0746966"
 dependencies = [
 "base64 0.22.0",
 "comemo",
 "log",
 "once_cell",
 "rayon",
+ "reflexo",
 "siphasher 1.0.0",
 "tiny-skia",
 "typst",
--- a/pkgs/by-name/ty/typst-preview/dom.json
+++ b/pkgs/by-name/ty/typst-preview/dom.json
@ -13,12 +13,12 @@
    "unlink:local": "yarn unlink @myriaddreamin/typst.ts @myriaddreamin/typst-ts-renderer"
  },
  "peerDependencies": {
-    "@myriaddreamin/typst-ts-renderer": "0.4.2-rc9",
-    "@myriaddreamin/typst.ts": "0.4.2-rc9"
+    "@myriaddreamin/typst-ts-renderer": "0.4.2-rc10",
+    "@myriaddreamin/typst.ts": "0.4.2-rc10"
  },
  "devDependencies": {
-    "@myriaddreamin/typst-ts-renderer": "0.4.2-rc9",
-    "@myriaddreamin/typst.ts": "0.4.2-rc9",
+    "@myriaddreamin/typst-ts-renderer": "0.4.2-rc10",
+    "@myriaddreamin/typst.ts": "0.4.2-rc10",
    "typescript": "^5.0.2",
    "vite": "^4.3.9",
    "vite-plugin-singlefile": "^0.13.5",
--- a/pkgs/by-name/ty/typst-preview/frontend.json
+++ b/pkgs/by-name/ty/typst-preview/frontend.json
@ -13,8 +13,8 @@
    "unlink:local": "yarn unlink @myriaddreamin/typst.ts @myriaddreamin/typst-ts-renderer"
  },
  "dependencies": {
-    "@myriaddreamin/typst-ts-renderer": "0.4.2-rc9",
-    "@myriaddreamin/typst.ts": "0.4.2-rc9",
+    "@myriaddreamin/typst-ts-renderer": "0.4.2-rc10",
+    "@myriaddreamin/typst.ts": "0.4.2-rc10",
    "typst-dom": "file:../typst-dom",
    "rxjs": "^7.8.1"
  },
--- a/pkgs/by-name/ty/typst-preview/package.nix
+++ b/pkgs/by-name/ty/typst-preview/package.nix
@ -14,13 +14,13 @@
 let
  # Keep the vscode "mgt19937.typst-preview" extension in sync when updating
  # this package at pkgs/applications/editors/vscode/extensions/default.nix
-  version = "0.11.2";
+  version = "0.11.4";

  src = fetchFromGitHub {
    owner = "Enter-tainer";
    repo = "typst-preview";
    rev = "v${version}";
-    hash = "sha256-etFP1CuRSE6Sy19+dlF6FUQhuqJrJ53v7LZFrTyA+q0=";
+    hash = "sha256-5MbKp6j4+61Do8YH0xPIQPHEjU/kCKsMUUQDJDXzSMw=";
    fetchSubmodules = true;

    postFetch = ''
@ -41,7 +41,7 @@ let

    offlineCache = fetchYarnDeps {
      yarnLock = "${domSrc}/yarn.lock";
-      hash = "sha256-aDs+2n6sL4MTizRuYqkwfYrx/lK3ll9u4NoN0zPyWco=";
+      hash = "sha256-QIGwHG0n6vYfAPA/+CdvK1c+QxM3XyoQdS/T4+TdsKs=";
    };

    buildPhase = ''
@ -67,7 +67,7 @@ let

    offlineCache = fetchYarnDeps {
      yarnLock = "${frontendSrc}/yarn.lock";
-      hash = "sha256-gkjtDi7ZR3aKn1ZRJEkFc3IdhbmF1GyYoGiIniOsPBo=";
+      hash = "sha256-QFiyUky/0BdB5vS9KX5xBOvBCEtJ+zZG4f7ai5j6V4U=";
    };

    packageResolutions = { inherit typst-dom; };
@ -92,7 +92,7 @@ rustPlatform.buildRustPackage {
  pname = "typst-preview";
  inherit version src;

-  cargoHash = "sha256-f9oTeUMbXjkCHLsiMng9gME9QGRWgBi1WAwoeBCeT6I=";
+  cargoHash = "sha256-xj8Xvbz0NUy0BFoVS8ONiYZZQWIJu1FZxJkBEuABDOw=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/ug/ugm/package.nix
+++ b/pkgs/by-name/ug/ugm/package.nix
@ -0,0 +1,37 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, makeWrapper
+}:
+
+buildGoModule rec {
+  pname = "ugm";
+  version = "1.4.0";
+
+  src = fetchFromGitHub {
+    owner = "ariasmn";
+    repo = "ugm";
+    rev = "v${version}";
+    hash = "sha256-Co8JN0WEc1I08My9m7iyAshtEO4aszN8/sCvoGFJv2A=";
+  };
+
+  vendorHash = "sha256-34D9fQnmKnOyUqshduLmFiVgcVKi7mDKBs3X5ZQxsuw=";
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  # Fix unaligned table when running this program under a CJK environment
+  postFixup = ''
+    wrapProgram $out/bin/ugm \
+        --set RUNEWIDTH_EASTASIAN 0
+  '';
+
+  meta = with lib; {
+    description = "A terminal based UNIX user and group browser";
+    homepage = "https://github.com/ariasmn/ugm";
+    changelog = "https://github.com/ariasmn/ugm/releases/tag/${src.rev}";
+    license = licenses.mit;
+    mainProgram = "ugm";
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ oo-infty ];
+  };
+}
--- a/pkgs/by-name/uu/uuu/package.nix
+++ b/pkgs/by-name/uu/uuu/package.nix
@ -10,19 +10,20 @@
 , bzip2
 , libusb1
 , openssl
+, tinyxml-2
 , zlib
 , zstd
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "uuu";
-  version = "1.5.141";
+  version = "1.5.179";

  src = fetchFromGitHub {
    owner = "nxp-imx";
    repo = "mfgtools";
    rev = "uuu_${finalAttrs.version}";
-    hash = "sha256-N5L6k2oVXfnER7JRoX0JtzgEhb/vFMexu7hUKQhmcoE=";
+    hash = "sha256-W0jFwivjD19SQmXz2G7cIvWh1zkyN4AXh3bfqF302MA=";
  };

  passthru.updateScript = nix-update-script {
@ -39,6 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
    bzip2
    libusb1
    openssl
+    tinyxml-2
    zlib
    zstd
  ];
--- a/pkgs/by-name/ws/wslu/package.nix
+++ b/pkgs/by-name/ws/wslu/package.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "wslu";
-  version = "4.1.2";
+  version = "4.1.3";

  src = fetchFromGitHub {
    owner = "wslutilities";
    repo = "wslu";
    rev = "v${version}";
-    hash = "sha256-rmNGKayg8Y872yICilveMpDFBLkDZ6Ox8rqtWrK2om8=";
+    hash = "sha256-lyJk8nOADq+s7GkZXsd1T4ilrDzMRsoALOesG8NxYK8=";
  };

  nativeBuildInputs = [ copyDesktopItems ];
--- a/pkgs/by-name/xe/xevd/package.nix
+++ b/pkgs/by-name/xe/xevd/package.nix
@ -0,0 +1,63 @@
+{
+  lib,
+  fetchFromGitHub,
+  fetchpatch2,
+  stdenv,
+  gitUpdater,
+  cmake,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xevd";
+  version = "0.4.1";
+
+  src = fetchFromGitHub {
+    owner = "mpeg5";
+    repo = "xevd";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-+qC/BnP8o/kfl5ax+g1PohvXIJBL2gin/QZ9Gkvi0WU=";
+  };
+
+  patches = [
+    (fetchpatch2 {
+      name = "fix dangling pointer error";
+      url = "https://github.com/mpeg5/xevd/commit/13b86a74e26df979dd1cc3a1cb19bf1ac828e197.patch";
+      sha256 = "sha256-CeSfhN78ldooyZ9H4F2ex9wTBFXuNZdBcnLdk7GqDXI=";
+    })
+    (fetchpatch2 {
+      name = "fix invalid comparison of c_buf in write_y4m_header ";
+      url = "https://github.com/mpeg5/xevd/commit/e4ae0c567a6ec5e10c9f5ed44c61e4e3b6816c16.patch";
+      sha256 = "sha256-9bG6hyIV/AZ0mRbd3Fc/c137Xm1i6NJ1IfuGadG0vUU=";
+    })
+  ];
+
+  postPatch = ''
+    echo v$version > version.txt
+  '';
+
+  nativeBuildInputs = [ cmake ];
+
+  postInstall = ''
+    ln $dev/include/xevd/* $dev/include/
+  '';
+
+  env.NIX_CFLAGS_COMPILE = toString [ "-lm" ];
+
+  outputs = [
+    "out"
+    "lib"
+    "dev"
+  ];
+
+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
+
+  meta = {
+    homepage = "https://github.com/mpeg5/xevd";
+    description = "eXtra-fast Essential Video Decoder, MPEG-5 EVC";
+    license = lib.licenses.bsd3;
+    mainProgram = "xevd_app";
+    maintainers = with lib.maintainers; [ jopejoe1 ];
+    platforms = lib.platforms.all;
+    broken = !stdenv.hostPlatform.isx86;
+  };
+})
--- a/pkgs/by-name/xe/xeve/package.nix
+++ b/pkgs/by-name/xe/xeve/package.nix
@ -0,0 +1,49 @@
+{
+  lib,
+  fetchFromGitHub,
+  gitUpdater,
+  stdenv,
+  cmake,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xeve";
+  version = "0.4.3";
+
+  src = fetchFromGitHub {
+    owner = "mpeg5";
+    repo = "xeve";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-8YueEx2oIh24jV38bzpDlCVHNZB7HDOXeP5MANM8zBc=";
+  };
+
+  postPatch = ''
+    echo v$version > version.txt
+  '';
+
+  nativeBuildInputs = [ cmake ];
+
+  postInstall = ''
+    ln $dev/include/xeve/* $dev/include/
+  '';
+
+  env.NIX_CFLAGS_COMPILE = toString [ "-lm" ];
+
+  outputs = [
+    "out"
+    "lib"
+    "dev"
+  ];
+
+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
+
+  meta = {
+    homepage = "https://github.com/mpeg5/xeve";
+    description = "eXtra-fast Essential Video Encoder, MPEG-5 EVC";
+    license = lib.licenses.bsd3;
+    mainProgram = "xeve_app";
+    maintainers = with lib.maintainers; [ jopejoe1 ];
+    platforms = lib.platforms.all;
+    broken = !stdenv.hostPlatform.isx86;
+  };
+})
--- a/pkgs/data/themes/yaru/default.nix
+++ b/pkgs/data/themes/yaru/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "yaru";
-  version = "24.04.0";
+  version = "23.10.0";

  src = fetchFromGitHub {
    owner = "ubuntu";
    repo = "yaru";
    rev = version;
-    hash = "sha256-KvpA86YL6toVklRPu4hP3j3w+Q0h/n6mZRZgk3HvMfc=";
+    hash = "sha256-+Szk77QeoM4PwusxKflTh83h16qz6Es6UwDXpbydJUE=";
  };

  nativeBuildInputs = [ meson sassc pkg-config glib ninja python3 ];
--- a/pkgs/desktops/mate/mate-themes/default.nix
+++ b/pkgs/desktops/mate/mate-themes/default.nix
@ -15,11 +15,11 @@

 stdenv.mkDerivation rec {
  pname = "mate-themes";
-  version = "3.22.24";
+  version = "3.22.26";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/themes/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "PYs6KihTMd4kxM9djJ3YRtqhFpXyBnZdjxaT68rPbko=";
+    sha256 = "Ik6J02TrO3Pxz3VtBUlKmEIak8v1Q0miyF/GB+t1Xtc=";
  };

  nativeBuildInputs = [
--- a/Show More
+++ b/Show More