Merge master into staging-next

2024-04-23 12:01:30 +00:00 · 2024-04-23 12:01:30 +00:00 · 0c36ffa13e
parent 6cbdbb6230 52053cb756
commit 0c36ffa13e
77 changed files with 1645 additions and 1120 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -4448,6 +4448,12 @@
    github = "DarkOnion0";
    githubId = 68606322;
  };
+  daru-san = {
+    name = "Daru";
+    email = "zadarumaka@proton.me";
+    github = "Daru-san";
+    githubId = 135046711;
+  };
  das-g = {
    email = "nixpkgs@raphael.dasgupta.ch";
    github = "das-g";
--- a/nixos/lib/systemd-lib.nix
+++ b/nixos/lib/systemd-lib.nix
@ -1,4 +1,4 @@
-{ config, lib, pkgs }:
+{ config, lib, pkgs, utils }:

 let
  inherit (lib)
@ -396,8 +396,41 @@ in rec {
    };
  };

-  serviceConfig = { config, ... }: {
-    config.environment.PATH = mkIf (config.path != []) "${makeBinPath config.path}:${makeSearchPathOutput "bin" "sbin" config.path}";
+  serviceConfig = { name, config, ... }: {
+    config = {
+      name = "${name}.service";
+      environment.PATH = mkIf (config.path != []) "${makeBinPath config.path}:${makeSearchPathOutput "bin" "sbin" config.path}";
+    };
+  };
+
+  pathConfig = { name, config, ... }: {
+    config = {
+      name = "${name}.path";
+    };
+  };
+
+  socketConfig = { name, config, ... }: {
+    config = {
+      name = "${name}.socket";
+    };
+  };
+
+  sliceConfig = { name, config, ... }: {
+    config = {
+      name = "${name}.slice";
+    };
+  };
+
+  targetConfig = { name, config, ... }: {
+    config = {
+      name = "${name}.target";
+    };
+  };
+
+  timerConfig = { name, config, ... }: {
+    config = {
+      name = "${name}.timer";
+    };
  };

  stage2ServiceConfig = {
@ -416,6 +449,7 @@ in rec {

  mountConfig = { config, ... }: {
    config = {
+      name = "${utils.escapeSystemdPath config.where}.mount";
      mountConfig =
        { What = config.what;
          Where = config.where;
@ -429,6 +463,7 @@ in rec {

  automountConfig = { config, ... }: {
    config = {
+      name = "${utils.escapeSystemdPath config.where}.automount";
      automountConfig =
        { Where = config.where;
        };
@ -444,8 +479,8 @@ in rec {
      WantedBy=${concatStringsSep " " def.wantedBy}
    '';

-  targetToUnit = name: def:
-    { inherit (def) aliases wantedBy requiredBy upheldBy enable overrideStrategy;
+  targetToUnit = def:
+    { inherit (def) name aliases wantedBy requiredBy upheldBy enable overrideStrategy;
      text =
        ''
          [Unit]
@ -453,8 +488,8 @@ in rec {
        '';
    };

-  serviceToUnit = name: def:
-    { inherit (def) aliases wantedBy requiredBy upheldBy enable overrideStrategy;
+  serviceToUnit = def:
+    { inherit (def) name aliases wantedBy requiredBy upheldBy enable overrideStrategy;
      text = commonUnitText def (''
        [Service]
      '' + (let env = cfg.globalEnvironment // def.environment;
@ -463,7 +498,7 @@ in rec {
            "Environment=${toJSON "${n}=${env.${n}}"}\n";
          # systemd max line length is now 1MiB
          # https://github.com/systemd/systemd/commit/e6dde451a51dc5aaa7f4d98d39b8fe735f73d2af
-          in if stringLength s >= 1048576 then throw "The value of the environment variable ‘${n}’ in systemd service ‘${name}.service’ is too long." else s) (attrNames env))
+          in if stringLength s >= 1048576 then throw "The value of the environment variable ‘${n}’ in systemd service ‘${def.name}.service’ is too long." else s) (attrNames env))
      + (if def ? reloadIfChanged && def.reloadIfChanged then ''
        X-ReloadIfChanged=true
      '' else if (def ? restartIfChanged && !def.restartIfChanged) then ''
@ -474,8 +509,8 @@ in rec {
      '' + attrsToSection def.serviceConfig);
    };

-  socketToUnit = name: def:
-    { inherit (def) aliases wantedBy requiredBy upheldBy enable overrideStrategy;
+  socketToUnit = def:
+    { inherit (def) name aliases wantedBy requiredBy upheldBy enable overrideStrategy;
      text = commonUnitText def ''
        [Socket]
        ${attrsToSection def.socketConfig}
@ -484,40 +519,40 @@ in rec {
      '';
    };

-  timerToUnit = name: def:
-    { inherit (def) aliases wantedBy requiredBy upheldBy enable overrideStrategy;
+  timerToUnit = def:
+    { inherit (def) name aliases wantedBy requiredBy upheldBy enable overrideStrategy;
      text = commonUnitText def ''
        [Timer]
        ${attrsToSection def.timerConfig}
      '';
    };

-  pathToUnit = name: def:
-    { inherit (def) aliases wantedBy requiredBy upheldBy enable overrideStrategy;
+  pathToUnit = def:
+    { inherit (def) name aliases wantedBy requiredBy upheldBy enable overrideStrategy;
      text = commonUnitText def ''
        [Path]
        ${attrsToSection def.pathConfig}
      '';
    };

-  mountToUnit = name: def:
-    { inherit (def) aliases wantedBy requiredBy upheldBy enable overrideStrategy;
+  mountToUnit = def:
+    { inherit (def) name aliases wantedBy requiredBy upheldBy enable overrideStrategy;
      text = commonUnitText def ''
        [Mount]
        ${attrsToSection def.mountConfig}
      '';
    };

-  automountToUnit = name: def:
-    { inherit (def) aliases wantedBy requiredBy upheldBy enable overrideStrategy;
+  automountToUnit = def:
+    { inherit (def) name aliases wantedBy requiredBy upheldBy enable overrideStrategy;
      text = commonUnitText def ''
        [Automount]
        ${attrsToSection def.automountConfig}
      '';
    };

-  sliceToUnit = name: def:
-    { inherit (def) aliases wantedBy requiredBy upheldBy enable overrideStrategy;
+  sliceToUnit = def:
+    { inherit (def) name aliases wantedBy requiredBy upheldBy enable overrideStrategy;
      text = commonUnitText def ''
        [Slice]
        ${attrsToSection def.sliceConfig}
--- a/nixos/lib/systemd-types.nix
+++ b/nixos/lib/systemd-types.nix
@ -5,8 +5,13 @@ let
    automountConfig
    makeUnit
    mountConfig
+    pathConfig
+    sliceConfig
+    socketConfig
    stage1ServiceConfig
    stage2ServiceConfig
+    targetConfig
+    timerConfig
    unitConfig
    ;

@ -48,29 +53,32 @@ let
    ;
 in

-rec {
+{
  units = attrsOf (submodule ({ name, config, ... }: {
    options = concreteUnitOptions;
-    config = { unit = mkDefault (makeUnit name config); };
+    config = {
+      name = mkDefault name;
+      unit = mkDefault (makeUnit name config);
+    };
  }));

  services = attrsOf (submodule [ stage2ServiceOptions unitConfig stage2ServiceConfig ]);
  initrdServices = attrsOf (submodule [ stage1ServiceOptions unitConfig stage1ServiceConfig ]);

-  targets = attrsOf (submodule [ stage2CommonUnitOptions unitConfig ]);
-  initrdTargets = attrsOf (submodule [ stage1CommonUnitOptions unitConfig ]);
+  targets = attrsOf (submodule [ stage2CommonUnitOptions unitConfig targetConfig ]);
+  initrdTargets = attrsOf (submodule [ stage1CommonUnitOptions unitConfig targetConfig ]);

-  sockets = attrsOf (submodule [ stage2SocketOptions unitConfig ]);
-  initrdSockets = attrsOf (submodule [ stage1SocketOptions unitConfig ]);
+  sockets = attrsOf (submodule [ stage2SocketOptions unitConfig socketConfig]);
+  initrdSockets = attrsOf (submodule [ stage1SocketOptions unitConfig socketConfig ]);

-  timers = attrsOf (submodule [ stage2TimerOptions unitConfig ]);
-  initrdTimers = attrsOf (submodule [ stage1TimerOptions unitConfig ]);
+  timers = attrsOf (submodule [ stage2TimerOptions unitConfig timerConfig ]);
+  initrdTimers = attrsOf (submodule [ stage1TimerOptions unitConfig timerConfig ]);

-  paths = attrsOf (submodule [ stage2PathOptions unitConfig ]);
-  initrdPaths = attrsOf (submodule [ stage1PathOptions unitConfig ]);
+  paths = attrsOf (submodule [ stage2PathOptions unitConfig pathConfig ]);
+  initrdPaths = attrsOf (submodule [ stage1PathOptions unitConfig pathConfig ]);

-  slices = attrsOf (submodule [ stage2SliceOptions unitConfig ]);
-  initrdSlices = attrsOf (submodule [ stage1SliceOptions unitConfig ]);
+  slices = attrsOf (submodule [ stage2SliceOptions unitConfig sliceConfig ]);
+  initrdSlices = attrsOf (submodule [ stage1SliceOptions unitConfig sliceConfig ]);

  mounts = listOf (submodule [ stage2MountOptions unitConfig mountConfig ]);
  initrdMounts = listOf (submodule [ stage1MountOptions unitConfig mountConfig ]);
--- a/nixos/lib/systemd-unit-options.nix
+++ b/nixos/lib/systemd-unit-options.nix
@ -65,6 +65,14 @@ in rec {
      '';
    };

+    name = lib.mkOption {
+      type = lib.types.str;
+      description = ''
+        The name of this systemd unit, including its extension.
+        This can be used to refer to this unit from other systemd units.
+      '';
+    };
+
    overrideStrategy = mkOption {
      default = "asDropinIfExists";
      type = types.enum [ "asDropinIfExists" "asDropin" ];
--- a/nixos/lib/utils.nix
+++ b/nixos/lib/utils.nix
@ -35,7 +35,8 @@ let
  inherit (lib.strings) toJSON normalizePath escapeC;
 in

-rec {
+let
+utils = rec {

  # Copy configuration files to avoid having the entire sources in the system closure
  copyFile = filePath: pkgs.runCommand (builtins.unsafeDiscardStringContext (baseNameOf filePath)) {} ''
@ -262,11 +263,12 @@ rec {
      filter (x: !(elem (getName x) namesToRemove)) packages;

  systemdUtils = {
-    lib = import ./systemd-lib.nix { inherit lib config pkgs; };
+    lib = import ./systemd-lib.nix { inherit lib config pkgs utils; };
    unitOptions = import ./systemd-unit-options.nix { inherit lib systemdUtils; };
    types = import ./systemd-types.nix { inherit lib systemdUtils pkgs; };
    network = {
      units = import ./systemd-network-units.nix { inherit lib systemdUtils; };
    };
  };
-}
+};
+in utils
--- a/nixos/modules/services/web-apps/coder.nix
+++ b/nixos/modules/services/web-apps/coder.nix
@ -169,7 +169,7 @@ in {
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];

-      environment = config.environment.extra // {
+      environment = cfg.environment.extra // {
        CODER_ACCESS_URL = cfg.accessUrl;
        CODER_WILDCARD_ACCESS_URL = cfg.wildcardAccessUrl;
        CODER_PG_CONNECTION_URL = "user=${cfg.database.username} ${optionalString (cfg.database.password != null) "password=${cfg.database.password}"} database=${cfg.database.database} host=${cfg.database.host} ${optionalString (cfg.database.sslmode != null) "sslmode=${cfg.database.sslmode}"}";
--- a/nixos/modules/services/web-apps/mediawiki.nix
+++ b/nixos/modules/services/web-apps/mediawiki.nix
@ -246,7 +246,9 @@ in

      passwordFile = mkOption {
        type = types.path;
-        description = "A file containing the initial password for the admin user.";
+        description = ''
+          A file containing the initial password for the administrator account "admin".
+        '';
        example = "/run/keys/mediawiki-password";
      };

--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@ -595,18 +595,17 @@ in
    };

    systemd.units =
-         mapAttrs' (n: v: nameValuePair "${n}.path"    (pathToUnit    n v)) cfg.paths
-      // mapAttrs' (n: v: nameValuePair "${n}.service" (serviceToUnit n v)) cfg.services
-      // mapAttrs' (n: v: nameValuePair "${n}.slice"   (sliceToUnit   n v)) cfg.slices
-      // mapAttrs' (n: v: nameValuePair "${n}.socket"  (socketToUnit  n v)) cfg.sockets
-      // mapAttrs' (n: v: nameValuePair "${n}.target"  (targetToUnit  n v)) cfg.targets
-      // mapAttrs' (n: v: nameValuePair "${n}.timer"   (timerToUnit   n v)) cfg.timers
-      // listToAttrs (map
-                   (v: let n = escapeSystemdPath v.where;
-                       in nameValuePair "${n}.mount" (mountToUnit n v)) cfg.mounts)
-      // listToAttrs (map
-                   (v: let n = escapeSystemdPath v.where;
-                       in nameValuePair "${n}.automount" (automountToUnit n v)) cfg.automounts);
+      let
+        withName = cfgToUnit: cfg: lib.nameValuePair cfg.name (cfgToUnit cfg);
+      in
+         mapAttrs' (_: withName pathToUnit) cfg.paths
+      // mapAttrs' (_: withName serviceToUnit) cfg.services
+      // mapAttrs' (_: withName sliceToUnit) cfg.slices
+      // mapAttrs' (_: withName socketToUnit) cfg.sockets
+      // mapAttrs' (_: withName targetToUnit) cfg.targets
+      // mapAttrs' (_: withName timerToUnit) cfg.timers
+      // listToAttrs (map (withName mountToUnit) cfg.mounts)
+      // listToAttrs (map (withName automountToUnit) cfg.automounts);

      # Environment of PID 1
      systemd.managerEnvironment = {
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@ -490,18 +490,18 @@ in {

      targets.initrd.aliases = ["default.target"];
      units =
-           mapAttrs' (n: v: nameValuePair "${n}.path"    (pathToUnit    n v)) cfg.paths
-        // mapAttrs' (n: v: nameValuePair "${n}.service" (serviceToUnit n v)) cfg.services
-        // mapAttrs' (n: v: nameValuePair "${n}.slice"   (sliceToUnit   n v)) cfg.slices
-        // mapAttrs' (n: v: nameValuePair "${n}.socket"  (socketToUnit  n v)) cfg.sockets
-        // mapAttrs' (n: v: nameValuePair "${n}.target"  (targetToUnit  n v)) cfg.targets
-        // mapAttrs' (n: v: nameValuePair "${n}.timer"   (timerToUnit   n v)) cfg.timers
+           mapAttrs' (n: v: nameValuePair "${n}.path"    (pathToUnit    v)) cfg.paths
+        // mapAttrs' (n: v: nameValuePair "${n}.service" (serviceToUnit v)) cfg.services
+        // mapAttrs' (n: v: nameValuePair "${n}.slice"   (sliceToUnit   v)) cfg.slices
+        // mapAttrs' (n: v: nameValuePair "${n}.socket"  (socketToUnit  v)) cfg.sockets
+        // mapAttrs' (n: v: nameValuePair "${n}.target"  (targetToUnit  v)) cfg.targets
+        // mapAttrs' (n: v: nameValuePair "${n}.timer"   (timerToUnit   v)) cfg.timers
        // listToAttrs (map
                     (v: let n = escapeSystemdPath v.where;
-                         in nameValuePair "${n}.mount" (mountToUnit n v)) cfg.mounts)
+                         in nameValuePair "${n}.mount" (mountToUnit v)) cfg.mounts)
        // listToAttrs (map
                     (v: let n = escapeSystemdPath v.where;
-                         in nameValuePair "${n}.automount" (automountToUnit n v)) cfg.automounts);
+                         in nameValuePair "${n}.automount" (automountToUnit v)) cfg.automounts);

      # make sure all the /dev nodes are set up
      services.systemd-tmpfiles-setup-dev.wantedBy = ["sysinit.target"];
--- a/nixos/modules/system/boot/systemd/user.nix
+++ b/nixos/modules/system/boot/systemd/user.nix
@ -175,12 +175,12 @@ in {
    };

    systemd.user.units =
-         mapAttrs' (n: v: nameValuePair "${n}.path"    (pathToUnit    n v)) cfg.paths
-      // mapAttrs' (n: v: nameValuePair "${n}.service" (serviceToUnit n v)) cfg.services
-      // mapAttrs' (n: v: nameValuePair "${n}.slice"   (sliceToUnit   n v)) cfg.slices
-      // mapAttrs' (n: v: nameValuePair "${n}.socket"  (socketToUnit  n v)) cfg.sockets
-      // mapAttrs' (n: v: nameValuePair "${n}.target"  (targetToUnit  n v)) cfg.targets
-      // mapAttrs' (n: v: nameValuePair "${n}.timer"   (timerToUnit   n v)) cfg.timers;
+         mapAttrs' (n: v: nameValuePair "${n}.path"    (pathToUnit    v)) cfg.paths
+      // mapAttrs' (n: v: nameValuePair "${n}.service" (serviceToUnit v)) cfg.services
+      // mapAttrs' (n: v: nameValuePair "${n}.slice"   (sliceToUnit   v)) cfg.slices
+      // mapAttrs' (n: v: nameValuePair "${n}.socket"  (socketToUnit  v)) cfg.sockets
+      // mapAttrs' (n: v: nameValuePair "${n}.target"  (targetToUnit  v)) cfg.targets
+      // mapAttrs' (n: v: nameValuePair "${n}.timer"   (timerToUnit   v)) cfg.timers;

    # Generate timer units for all services that have a ‘startAt’ value.
    systemd.user.timers =
--- a/nixos/tests/systemd.nix
+++ b/nixos/tests/systemd.nix
@ -1,7 +1,7 @@
 import ./make-test-python.nix ({ pkgs, ... }: {
  name = "systemd";

-  nodes.machine = { lib, ... }: {
+  nodes.machine = { config, lib, ... }: {
    imports = [ common/user-account.nix common/x11.nix ];

    virtualisation.emptyDiskImages = [ 512 512 ];
@ -38,9 +38,18 @@ import ./make-test-python.nix ({ pkgs, ... }: {
      script = "true";
    };

+    systemd.services.testDependency1 = {
+      description = "Test Dependency 1";
+      wantedBy = [ config.systemd.services."testservice1".name ];
+      serviceConfig.Type = "oneshot";
+      script = ''
+        true
+      '';
+    };
+
    systemd.services.testservice1 = {
      description = "Test Service 1";
-      wantedBy = [ "multi-user.target" ];
+      wantedBy = [ config.systemd.targets.multi-user.name ];
      serviceConfig.Type = "oneshot";
      script = ''
        if [ "$XXX_SYSTEM" = foo ]; then
--- a/pkgs/applications/audio/audacious/plugins.nix
+++ b/pkgs/applications/audio/audacious/plugins.nix
@ -41,6 +41,7 @@
 , qtmultimedia
 , qtx11extras
 , soxr
+, vgmstream
 , wavpack
 }:

@ -109,6 +110,10 @@ stdenv.mkDerivation rec {

  dontWrapQtApps = true;

+  postInstall = ''
+    ln -s ${vgmstream.override { buildAudaciousPlugin = true; }}/lib/audacious/Input/* $out/lib/audacious/Input
+  '';
+
  meta = audacious.meta // {
    description = "Plugins for Audacious music player";
  };
--- a/pkgs/applications/audio/pt2-clone/default.nix
+++ b/pkgs/applications/audio/pt2-clone/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "pt2-clone";
-  version = "1.67";
+  version = "1.68";

  src = fetchFromGitHub {
    owner = "8bitbubsy";
    repo = "pt2-clone";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-fTUTXwS6A72zhKkANlSljQVvPeN5rOTyuyb8vLxYfdk=";
+    sha256 = "sha256-xlXwOxmJ5cL1ouTOnFwTvx959IDQIvJ0ZRk+G9p0HbA=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/audio/vgmstream/default.nix
+++ b/pkgs/applications/audio/vgmstream/default.nix
@ -1,6 +1,7 @@
-{ stdenv, lib, fetchFromGitHub, cmake, pkg-config
-, mpg123, ffmpeg, libvorbis, libao, jansson, speex
+{ stdenv, lib, fetchFromGitHub, cmake, pkg-config, gtk3
+, audacious, mpg123, ffmpeg, libvorbis, libao, jansson, speex
 , nix-update-script
+, buildAudaciousPlugin ? false  # only build cli by default, pkgs.audacious-plugins sets this to enable plugin support
 }:

 stdenv.mkDerivation rec {
@ -19,16 +20,29 @@ stdenv.mkDerivation rec {
    extraArgs = [ "--version-regex" "r(.*)" ];
  };

-  nativeBuildInputs = [ cmake pkg-config ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ] ++ lib.optional buildAudaciousPlugin gtk3;

-  buildInputs = [ mpg123 ffmpeg libvorbis libao jansson speex ];
+  buildInputs = [
+    mpg123
+    ffmpeg
+    libvorbis
+    libao
+    jansson
+    speex
+  ] ++ lib.optional buildAudaciousPlugin (audacious.override { audacious-plugins = null; });
+
+  preConfigure = ''
+    substituteInPlace cmake/dependencies/audacious.cmake \
+      --replace "pkg_get_variable(AUDACIOUS_PLUGIN_DIR audacious plugin_dir)" "set(AUDACIOUS_PLUGIN_DIR \"$out/lib/audacious\")"
+  '';

  cmakeFlags = [
-    # There's no nice way to build the audacious plugin without a circular dependency
-    "-DBUILD_AUDACIOUS=OFF"
    # It always tries to download it, no option to use the system one
    "-DUSE_CELT=OFF"
-  ];
+  ] ++ lib.optional (! buildAudaciousPlugin) "-DBUILD_AUDACIOUS=OFF";

  meta = with lib; {
    description = "A library for playback of various streamed audio formats used in video games";
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -8184,6 +8184,18 @@ final: prev:
    meta.homepage = "https://github.com/ishan9299/nvim-solarized-lua/";
  };

+  nvim-sops = buildVimPlugin {
+    pname = "nvim-sops";
+    version = "2023-07-31";
+    src = fetchFromGitHub {
+      owner = "lucidph3nx";
+      repo = "nvim-sops";
+      rev = "cb2209562d00ef8c6c88bdec836d9edb8fbb96ef";
+      sha256 = "0fvxnx5ji3d4kgsxl2ssqs7s567ibk4h38mz70m3nhs3sxk696lj";
+    };
+    meta.homepage = "https://github.com/lucidph3nx/nvim-sops/";
+  };
+
  nvim-spectre = buildVimPlugin {
    pname = "nvim-spectre";
    version = "2024-04-17";
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -688,6 +688,7 @@ https://github.com/dstein64/nvim-scrollview/,,
 https://github.com/s1n7ax/nvim-search-and-replace/,HEAD,
 https://github.com/dcampos/nvim-snippy/,HEAD,
 https://github.com/ishan9299/nvim-solarized-lua/,,
+https://github.com/lucidph3nx/nvim-sops/,HEAD,
 https://github.com/nvim-pack/nvim-spectre/,,
 https://github.com/chrisgrieser/nvim-spider/,HEAD,
 https://github.com/kylechui/nvim-surround/,main,
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -1793,8 +1793,8 @@ let
        mktplcRef = {
          publisher = "github";
          name = "copilot";
-          version = "1.172.758";
-          hash = "sha256-sK3IiA4mQ6Hse+UpZ81Zb5iBSREzTrs7ypsfGbJiXm4=";
+          version = "1.180.827";
+          hash = "sha256-HA1na9FoExIiAay+tEjxWKqpG2+wq4Oww77Gl2Bhciw=";
        };

        meta = {
@ -1810,8 +1810,8 @@ let
        mktplcRef = {
          publisher = "github";
          name = "copilot-chat";
-          version = "0.13.2024022301"; # compatible with vscode >= 1.87
-          hash = "sha256-WdojLEdrg6iqTH/cNPEWb6VEfk+gIHh2M5GHrAURjy8=";
+          version = "0.14.2024032901";  # compatible with vscode 1.88.1
+          hash = "sha256-+6N7IGO5j0wP5Zg8CwapHeKGWiZzc43VM4jCtqJDJIQ=";
        };
        meta = {
          description = "GitHub Copilot Chat is a companion extension to GitHub Copilot that houses experimental chat features";
--- a/pkgs/applications/editors/vscode/extensions/nvarner.typst-lsp/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/nvarner.typst-lsp/default.nix
@ -12,8 +12,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
    publisher = "nvarner";
    # Please update the corresponding binary (typst-lsp) when updating
    # this extension.
-    version = "0.12.1";
-    hash = "sha256-JcfFaR1wU5XwapH8vnfVy7Cb7DfUWVeoLfBV3wEtCpE=";
+    version = "0.13.0";
+    hash = "sha256-xiFUJymZOTEqlGvCHvLiI0pVg7NLgIXhZ7x8yx+a5mY=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/emulators/wine/sources.nix
+++ b/pkgs/applications/emulators/wine/sources.nix
@ -69,9 +69,9 @@ in rec {

  unstable = fetchurl rec {
    # NOTE: Don't forget to change the hash for staging as well.
-    version = "9.6";
+    version = "9.7";
    url = "https://dl.winehq.org/wine/source/9.x/wine-${version}.tar.xz";
-    hash = "sha256-Dglg7YK2AX6ILtozOLrRJwoRd7bPBfA6wfqxVavoIEg=";
+    hash = "sha256-2fPDM2VuiL1M71Mx80sci2nJZKUnWe73RdjdrlGhU1M=";
    inherit (stable) patches;

    ## see http://wiki.winehq.org/Gecko
@ -88,9 +88,9 @@ in rec {

    ## see http://wiki.winehq.org/Mono
    mono = fetchurl rec {
-      version = "9.0.0";
+      version = "9.1.0";
      url = "https://dl.winehq.org/wine/wine-mono/${version}/wine-mono-${version}-x86.msi";
-      hash = "sha256-efbEMQBnVWbBEvQZm56nuUTTOBZLNL2R+hGwsKQU4cQ=";
+      hash = "sha256-igoeaDe0lN9Jkn5ddZscaQjom4ovjjrQJeHCiBiCR24=";
    };

    updateScript = writeShellScript "update-wine-unstable" ''
@ -117,7 +117,7 @@ in rec {
  staging = fetchFromGitLab rec {
    # https://gitlab.winehq.org/wine/wine-staging
    inherit (unstable) version;
-    hash = "sha256-6AKN/KpmsTw9qxErhTTzqWuglgFdOAhtaoBlVRcs71Q=";
+    hash = "sha256-KU6i1P81Fr+4aZH/SJ+YibaIfX88SZMPdPcGS2mT2CE=";
    domain = "gitlab.winehq.org";
    owner = "wine";
    repo = "wine-staging";
--- a/pkgs/applications/misc/waybar/default.nix
+++ b/pkgs/applications/misc/waybar/default.nix
@ -74,27 +74,16 @@ let
    rev = "0.10.1";
    hash = "sha256-iIYKvpOWafPJB5XhDOSIW9Mb4I3A4pcgIIPQdQYEqUw=";
  };
-
-  wireplumber_0_4 = wireplumber.overrideAttrs (attrs: rec {
-    version = "0.4.17";
-    src = fetchFromGitLab {
-      domain = "gitlab.freedesktop.org";
-      owner = "pipewire";
-      repo = "wireplumber";
-      rev = version;
-      hash = "sha256-vhpQT67+849WV1SFthQdUeFnYe/okudTQJoL3y+wXwI=";
-    };
-  });
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "waybar";
-  version = "0.10.0";
+  version = "0.10.1";

  src = fetchFromGitHub {
    owner = "Alexays";
    repo = "Waybar";
    rev = finalAttrs.version;
-    hash = "sha256-p1VRrKT2kTDy48gDXPMHlLbfcokAOFeTZXGzTeO1SAE=";
+    hash = "sha256-xDeY0Bnwr+jCS0IpseWNgryQ3yV7RJ1VNNbOkT/xl5c=";
  };

  postUnpack = lib.optional cavaSupport ''
@ -151,7 +140,7 @@ stdenv.mkDerivation (finalAttrs: {
  ++ lib.optional traySupport libdbusmenu-gtk3
  ++ lib.optional udevSupport udev
  ++ lib.optional upowerSupport upower
-  ++ lib.optional wireplumberSupport wireplumber_0_4
+  ++ lib.optional wireplumberSupport wireplumber
  ++ lib.optional (cavaSupport || pipewireSupport) pipewire
  ++ lib.optional (!stdenv.isLinux) libinotify-kqueue;

--- a/pkgs/applications/virtualization/cri-o/default.nix
+++ b/pkgs/applications/virtualization/cri-o/default.nix
@ -15,13 +15,13 @@

 buildGoModule rec {
  pname = "cri-o";
-  version = "1.29.2";
+  version = "1.29.3";

  src = fetchFromGitHub {
    owner = "cri-o";
    repo = "cri-o";
    rev = "v${version}";
-    hash = "sha256-il28u2+Jv2gh6XqRV4y6u0FDZ4flmcp+bOj9aibL+ro=";
+    hash = "sha256-JJuqYC4GAZqXyyAjVoPipnGjRGbVx1rfH4UrtIOP7cc=";
  };
  vendorHash = null;

--- a/pkgs/by-name/ad/adbtuifm/package.nix
+++ b/pkgs/by-name/ad/adbtuifm/package.nix
@ -0,0 +1,25 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  lib,
+}:
+buildGoModule rec {
+  pname = "adbtuifm";
+  version = "0.5.8";
+  src = fetchFromGitHub {
+    owner = "darkhz";
+    repo = "adbtuifm";
+    rev = "v${version}";
+    hash = "sha256-TK93O9XwMrsrQT3EG0969HYMtYkK0a4PzG9FSTqHxAY=";
+  };
+  vendorHash = "sha256-voVoowjM90OGWXF4REEevO8XEzT7azRYiDay4bnGBks=";
+  meta = with lib; {
+    description = "A TUI-based file manager for the Android Debug Bridge";
+    homepage = "https://github.com/darkhz/adbtuifm";
+    changelog = "https:/github.com/darkhz/adbtuifm/releases/tag/v${version}";
+    license = with licenses; [mit];
+    maintainers = with maintainers; [daru-san];
+    mainProgram = "adbtuifm";
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/by-name/at/atac/package.nix
+++ b/pkgs/by-name/at/atac/package.nix
@ -30,6 +30,7 @@ rustPlatform.buildRustPackage rec {
    ]
    ++ lib.optionals stdenv.isDarwin [
      darwin.apple_sdk.frameworks.Security
+      darwin.apple_sdk.frameworks.SystemConfiguration
    ];

  env = {
--- a/pkgs/by-name/au/audiobookshelf/source.json
+++ b/pkgs/by-name/au/audiobookshelf/source.json
@ -1,9 +1,9 @@
 {
  "owner": "advplyr",
  "repo": "audiobookshelf",
-  "rev": "166454ef43e3cdb42c644cdccdacddd3a880cd89",
-  "hash": "sha256-QrGzlSGK7WDlRemS13CmHdg563HFv9QhOpCF+XRxXsg=",
-  "version": "2.8.1",
-  "depsHash": "sha256-CzlwpgSgsQZGuRWTA/IkCyaryCSurH74WR5Rhm5faEk=",
-  "clientDepsHash": "sha256-s7/Rlj3DrYjUkxAN82bTpWe+D4HdVOc1mrqKgqcJuI4="
+  "rev": "8b27c726d51cd9706cd564ef72377b89db3194b3",
+  "hash": "sha256-9WqMcehlGhSMI08u6/LSNOrLhCCl8coEHAUUM5KLnx8=",
+  "version": "2.9.0",
+  "depsHash": "sha256-ll96aPw6lO7B1c5s7uIpn3poPu/JRa/weins5SNMQw4=",
+  "clientDepsHash": "sha256-uqHfU38BLqigGzKJC/i/bftLJbCmHaOcj04d1bu4K1I="
 }
--- a/pkgs/by-name/au/autopsy/package.nix
+++ b/pkgs/by-name/au/autopsy/package.nix
@ -0,0 +1,49 @@
+{ stdenv, lib, makeWrapper, fetchzip, testdisk, imagemagick, jdk, findutils, sleuthkit, ... }:
+let
+  jdkWithJfx = jdk.override (lib.optionalAttrs stdenv.isLinux {
+    enableJavaFX = true;
+  });
+in
+stdenv.mkDerivation rec {
+  pname = "autopsy";
+  version = "4.21.0";
+
+  src = fetchzip {
+    url = "https://github.com/sleuthkit/autopsy/releases/download/autopsy-${version}/autopsy-${version}.zip";
+    sha256 = "32iOQA3+ykltCYW/MpqCVxyhh3mm6eYzY+t0smAsWRw=";
+  };
+
+  nativeBuildInputs = [ makeWrapper findutils ];
+  buildInputs = [ testdisk imagemagick jdkWithJfx ];
+
+  installPhase = ''
+    runHook preInstall
+
+    cp -r . $out
+
+    # Run the provided setup script to make files executable and copy sleuthkit
+    TSK_JAVA_LIB_PATH="${sleuthkit}/share/java" bash $out/unix_setup.sh -j '${jdkWithJfx}' -n autopsy
+
+    substituteInPlace $out/bin/autopsy \
+      --replace-warn 'APPNAME=`basename "$PRG"`' 'APPNAME=autopsy'
+    wrapProgram $out/bin/autopsy \
+      --run 'export SOLR_LOGS_DIR="$HOME/.autopsy/dev/var/log"' \
+      --run 'export SOLR_PID_DIR="$HOME/.autopsy/dev"' \
+      --prefix PATH : "${lib.makeBinPath [ testdisk imagemagick jdkWithJfx ]}"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Graphical interface to The Sleuth Kit and other open source digital forensics tools";
+    homepage = "https://www.sleuthkit.org/autopsy";
+    changelog = "https://github.com/sleuthkit/autopsy/releases/tag/autopsy-${version}";
+    # Autopsy brings a lot of vendored dependencies
+    license = with lib.licenses; [ asl20 ipl10 lgpl3Only lgpl21Only zlib wtfpl bsd3 cc-by-30 mit gpl2Only ];
+    maintainers = with lib.maintainers; [ zebreus ];
+    mainProgram = "autopsy";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    # Autopsy theoretically also supports darwin
+    platforms = lib.platforms.x86_64;
+  };
+}
--- a/pkgs/by-name/bn/bngblaster/package.nix
+++ b/pkgs/by-name/bn/bngblaster/package.nix
@ -1,29 +1,28 @@
-{ stdenv
-, lib
-, fetchFromGitHub
-, cmake
-, cmocka
-, libdict
-, ncurses
-, jansson
-, openssl
-, libpcap
+{
+  lib,
+  stdenv,
+  cmake,
+  cmocka,
+  fetchFromGitHub,
+  jansson,
+  libdict,
+  libpcap,
+  ncurses,
+  openssl,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "bngblaster";
-  version = "0.8.44";
+  version = "0.8.47";

  src = fetchFromGitHub {
    owner = "rtbrick";
    repo = "bngblaster";
    rev = finalAttrs.version;
-    hash = "sha256-kKzrXw6HQ2917RBArj2BxixXXH0mIvC4IeEU2JY4F9s=";
+    hash = "sha256-ad2vVBXN5hUCaFnq4WYc7UTKvyLg4HY+l+PGlc5ylmw=";
  };

-  nativeBuildInputs = [
-    cmake
-  ];
+  nativeBuildInputs = [ cmake ];

  buildInputs = [
    libdict
@ -31,9 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
    jansson
    openssl
    cmocka
-  ] ++ lib.optionals finalAttrs.doCheck [
-    libpcap
-  ];
+  ] ++ lib.optionals finalAttrs.doCheck [ libpcap ];

  cmakeFlags = [
    "-DBNGBLASTER_TESTS=${if finalAttrs.doCheck then "ON" else "OFF"}"
@ -43,9 +40,9 @@ stdenv.mkDerivation (finalAttrs: {
  doCheck = true;

  meta = with lib; {
+    description = "Network tester for access and routing protocols";
    homepage = "https://github.com/rtbrick/bngblaster/";
    changelog = "https://github.com/rtbrick/bngblaster/releases/tag/${finalAttrs.version}";
-    description = "network tester for access and routing protocols";
    license = licenses.bsd3;
    maintainers = teams.wdz.members;
    badPlatforms = platforms.darwin;
--- a/pkgs/by-name/br/bruno/package.nix
+++ b/pkgs/by-name/br/bruno/package.nix
@ -27,20 +27,20 @@ let
 in
 buildNpmPackage' rec {
  pname = "bruno";
-  version = "1.13.1";
+  version = "1.14.0";

  src = fetchFromGitHub {
    owner = "usebruno";
    repo = "bruno";
    rev = "v${version}";
-    hash = "sha256-fVbwHmJ/5OtMM0lkOIo6zPXkAa8mIK+WRHCTXJ1XEIw=";
+    hash = "sha256-kUvDtqv3Tdnntr4Ny5pM406KA5++AHsCoAiPg4x4Rsw=";

    postFetch = ''
      ${lib.getExe npm-lockfile-fix} $out/package-lock.json
    '';
  };

-  npmDepsHash = "sha256-D90y6NaiR9zpgtjfm9QgLxBVbHa09OMSi+fvgwqSjgY=";
+  npmDepsHash = "sha256-VvUpAdF4ouy695om3qpsyrmiMf69OFgfpQyeZArQEDs=";
  npmFlags = [ "--legacy-peer-deps" ];

  nativeBuildInputs = [
--- a/pkgs/by-name/gl/glasskube/package.nix
+++ b/pkgs/by-name/gl/glasskube/package.nix
@ -7,12 +7,12 @@
 }:

 let
-  version = "0.1.0";
+  version = "0.2.0";
  gitSrc = fetchFromGitHub {
    owner = "glasskube";
    repo = "glasskube";
    rev = "refs/tags/v${version}";
-    hash = "sha256-iJjO4V2sK3e/SpDZ5Lfw7gILgZrI4CGg0wLLVKthGUE=";
+    hash = "sha256-r14gYgrenUk3OFUEab4QlwmwUeEwqocJJ3Vje9wRdBA=";
  };
  web-bundle = buildNpmPackage rec {
    inherit version;
@ -20,7 +20,7 @@ let

    src = gitSrc;

-    npmDepsHash = "sha256-nv2ng8gUOi9K46bDuWt/Y3S6AJovUWaqM+8uGiu/QSs=";
+    npmDepsHash = "sha256-WKwEAVMG6r/ZFmxgLR+zJCW8F2DOHxpWDYqhX/vcdrs=";

    dontNpmInstall = true;

@ -40,7 +40,7 @@ in buildGoModule rec {

  src = gitSrc;

-  vendorHash = "sha256-iFWcTzZP0DKJ9hrmfUWR4U/VX2zsR+3uojI+GRI2R3I=";
+  vendorHash = "sha256-sj9TEAWhExwaaKlMJ10U7m3/xbUNl0dVZwrCb2TTu4o=";

  CGO_ENABLED = 0;

--- a/pkgs/by-name/go/godot_4-export-templates/package.nix
+++ b/pkgs/by-name/go/godot_4-export-templates/package.nix
@ -0,0 +1,13 @@
+# Export templates is necessary for setting up Godot engine, it's used when exporting projects.
+# Godot applications/games packages needs to reference export templates.
+# Export templates version should be kept in sync with Godot version.
+# https://docs.godotengine.org/en/stable/tutorials/export/exporting_projects.html#export-templates
+
+{ fetchzip, godot_4, ... }:
+
+fetchzip {
+  pname = "export_templates";
+  extension = "zip";
+  url = "https://github.com/godotengine/godot/releases/download/${godot_4.version}/Godot_v${godot_4.version}_export_templates.tpz";
+  hash = "sha256-eomGLH9lbZhl7VtHTWjJ5mxVt0Yg8LfnAnpqoCksPgs=";
+}
--- a/pkgs/by-name/hu/hugo/package.nix
+++ b/pkgs/by-name/hu/hugo/package.nix
@ -10,13 +10,13 @@

 buildGoModule rec {
  pname = "hugo";
-  version = "0.125.0";
+  version = "0.125.3";

  src = fetchFromGitHub {
    owner = "gohugoio";
    repo = "hugo";
    rev = "refs/tags/v${version}";
-    hash = "sha256-aPBS/8m57Dn8Uvem58KzaCZJ1Hn8doL1BsDdF7w5nJc=";
+    hash = "sha256-PZTV/VM0KS/vM4lLrJ/XPvNi33lM+L0gITQHGpjdN+4=";
  };

  vendorHash = "sha256-jGCHlAE5mSDKpZVWgjCEN51sL+3GR/C5ROI9065OhRU=";
--- a/pkgs/by-name/om/omnictl/package.nix
+++ b/pkgs/by-name/om/omnictl/package.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "omnictl";
-  version = "0.32.2";
+  version = "0.33.2";

  src = fetchFromGitHub {
    owner = "siderolabs";
    repo = "omni";
    rev = "v${version}";
-    hash = "sha256-db/bYwMPrOZvD/YPtFaRK80yaYdsE70YPh0xQe0uVi4=";
+    hash = "sha256-sszIUHEXtnla1fxlUbHXjQzaJoafse1YOSVikd7LMHk=";
  };

-  vendorHash = "sha256-uwzVUdA51eT9fi2Wr0ilNPMpXx430UIYYWXQa1hpzRM=";
+  vendorHash = "sha256-fU2bmVL42tEoWvrCAg2iSV7bErZhwor6tnjGRrtwMA4=";

  ldflags = [ "-s" "-w" ];

--- a/pkgs/by-name/py/pyprland/package.nix
+++ b/pkgs/by-name/py/pyprland/package.nix
@ -2,7 +2,7 @@

 python3Packages.buildPythonApplication rec {
  pname = "pyprland";
-  version = "2.2.5";
+  version = "2.2.10";
  format = "pyproject";

  disabled = python3Packages.pythonOlder "3.10";
@ -11,7 +11,7 @@ python3Packages.buildPythonApplication rec {
    owner = "hyprland-community";
    repo = "pyprland";
    rev = "refs/tags/${version}";
-    hash = "sha256-ech+KqB0SyFYDWNP+luv+K2aDjJHZDWp72V6wkGBJJw=";
+    hash = "sha256-SOrkOLSjXq8PlZ894EKjfN+Dfnwa8dRgh5eOJVeD2Mk=";
  };

  nativeBuildInputs = with python3Packages; [ poetry-core ];
--- a/pkgs/by-name/rk/rkbin/package.nix
+++ b/pkgs/by-name/rk/rkbin/package.nix
@ -31,6 +31,6 @@ stdenv.mkDerivation {
    homepage = "https://github.com/rockchip-linux/rkbin";
    license = licenses.unfreeRedistributable;
    maintainers = with maintainers; [ thefossguy ];
-    platforms = [ "aarch64-linux" ];
+    platforms = lib.platforms.all;
  };
 }
--- a/pkgs/by-name/rk/rkboot/package.nix
+++ b/pkgs/by-name/rk/rkboot/package.nix
@ -0,0 +1,43 @@
+{ stdenv
+, lib
+, rkbin
+, box64
+}:
+
+stdenv.mkDerivation {
+  name = "rkboot";
+
+  src = rkbin.src;
+
+  postPatch = ''
+    substituteInPlace RKBOOT/*.ini --replace 'PATH=' 'PATH=rkboot/'
+  '';
+
+  buildPhase = ''
+    mkdir rkboot
+    for i in $(ls ./RKBOOT/*.ini)
+    do
+      # The proprietary, statically linked binaries to perform boot_merge are
+      # x86_64 only. Though we use box64 to emulate if building on aarch64-linux
+      ${lib.optionalString stdenv.isAarch64 "${lib.getExe box64}"} ./tools/boot_merger "$i" || true
+    done
+  '';
+
+  installPhase = ''
+    mkdir -p $out
+    if [ -z "$(ls -A rkboot)" ]; then
+      echo "Error: The 'rkboot' directory is empty."
+      exit 1
+    else
+      mv rkboot $out/bin
+    fi
+  '';
+
+  meta = with lib; {
+    description = "Rockchip proprietary SPL bootloader blobs";
+    homepage = "https://github.com/rockchip-linux/rkbin";
+    license = licenses.unfreeRedistributable;
+    maintainers = with maintainers; [ matthewcroughan ];
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
+  };
+}
--- a/pkgs/by-name/st/stats/package.nix
+++ b/pkgs/by-name/st/stats/package.nix
@ -6,11 +6,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "stats";
-  version = "2.10.7";
+  version = "2.10.10";

  src = fetchurl {
    url = "https://github.com/exelban/stats/releases/download/v${finalAttrs.version}/Stats.dmg";
-    hash = "sha256-B44KFrKy76IZB7QeivE4a/e8JARp4VwJs0mTffa622w=";
+    hash = "sha256-CdTY5Qv/xF9ItNgHQFqec5nKObnImx/+MuFShTfdrAo=";
  };
  sourceRoot = ".";

--- a/pkgs/development/compilers/ocaml/ber-metaocaml.nix
+++ b/pkgs/development/compilers/ocaml/ber-metaocaml.nix
@ -9,9 +9,9 @@ let
   x11deps = [ libX11 xorgproto ];
   inherit (lib) optionals;

-   baseOcamlBranch  = "4.11";
+   baseOcamlBranch  = "4.14";
   baseOcamlVersion = "${baseOcamlBranch}.1";
-   metaocamlPatch   = "111";
+   metaocamlPatch   = "114";
 in

 stdenv.mkDerivation rec {
@ -20,12 +20,12 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://caml.inria.fr/pub/distrib/ocaml-${baseOcamlBranch}/ocaml-${baseOcamlVersion}.tar.gz";
-    sha256 = "sha256-3Yi2OFvZLgrZInMuKMxoyHd4QXcOoAPCC9FS9dtEFc4=";
+    sha256 = "sha256-GDl53JwJyw9YCiMraFMaCbAlqmKLjY1ydEnxRv1vX+4=";
  };

  metaocaml = fetchurl {
    url = "http://okmij.org/ftp/ML/ber-metaocaml-${metaocamlPatch}.tar.gz";
-    sha256 = "sha256-hDb0w0ZCm0hCz8jktZKmr/7gPSfBoKPT/cc7sPjt0yE=";
+    sha256 = "sha256-vvq3xI4jSAsrXcDk97TPbFDYgO9NcQeN/yBcUbcb/y0=";
  };

  x11env = buildEnv { name = "x11env"; paths = x11deps; };
@ -38,17 +38,6 @@ stdenv.mkDerivation rec {
  dontStrip = true;
  buildInputs = [ ncurses ] ++ optionals useX11 x11deps;

-  patches = [
-    # glibc 2.34 changed SIGSTKSZ from a #define'd integer to an
-    # expression involving a function call.  This broke all code that
-    # used SIGSTKSZ as the size of a statically-allocated array.  This
-    # patch is also applied by the ocaml/4.07.nix expression.
-    (fetchpatch {
-      url = "https://github.com/ocaml/ocaml/commit/dd28ac0cf4365bd0ea1bcc374cbc5e95a6f39bea.patch";
-      sha256 = "sha256-OmyovAu+8sgg3n5YD29Cytx3u/9PO2ofMsmrwiKUxks=";
-    })
-  ];
-
  postConfigure = ''
    tar -xvzf $metaocaml
    cd ${pname}-${version}
--- a/pkgs/development/python-modules/aioeagle/default.nix
+++ b/pkgs/development/python-modules/aioeagle/default.nix
@ -1,26 +1,30 @@
-{ lib
-, aiohttp
-, buildPythonPackage
-, fetchFromGitHub
-, pythonOlder
-, xmltodict
+{
+  lib,
+  aiohttp,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pythonOlder,
+  setuptools,
+  xmltodict,
 }:

 buildPythonPackage rec {
  pname = "aioeagle";
  version = "1.1.0";
-  format = "setuptools";
+  pyproject = true;

  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "home-assistant-libs";
-    repo = pname;
-    rev = version;
-    sha256 = "117nb50cxwrixif2r6fxmr9v0jxkcamm816v48hbhyc660w6xvk4";
+    repo = "aioeagle";
+    rev = "refs/tags/${version}";
+    hash = "sha256-ZO5uODCGebggItsEVKtis0uwU67dmSxc7DHzzkBZ9oQ=";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    aiohttp
    xmltodict
  ];
--- a/pkgs/development/python-modules/aiounifi/default.nix
+++ b/pkgs/development/python-modules/aiounifi/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "aiounifi";
-  version = "75";
+  version = "76";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "Kane610";
    repo = "aiounifi";
    rev = "refs/tags/v${version}";
-    hash = "sha256-IPm3/i+JJpjVfRFq+Yq1mfajHL/mOARk5koyy/t37NQ=";
+    hash = "sha256-N9N7sMHBiEhYUFok4bTSJZyp5pkJzj9pMxahY6FTx+I=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/awswrangler/default.nix
+++ b/pkgs/development/python-modules/awswrangler/default.nix
@ -1,32 +1,33 @@
-{ backoff
-, sparqlwrapper
-, boto3
-, buildPythonPackage
-, fetchFromGitHub
-, gremlinpython
-, jsonpath-ng
-, lib
-, moto
-, openpyxl
-, opensearch-py
-, pandas
-, pg8000
-, poetry-core
-, progressbar2
-, pyarrow
-, pymysql
-, pyodbc
-, pyparsing
-, pytestCheckHook
-, pythonOlder
-, pythonRelaxDepsHook
-, redshift-connector
-, requests-aws4auth
+{
+  backoff,
+  sparqlwrapper,
+  boto3,
+  buildPythonPackage,
+  fetchFromGitHub,
+  gremlinpython,
+  jsonpath-ng,
+  lib,
+  moto,
+  openpyxl,
+  opensearch-py,
+  pandas,
+  pg8000,
+  poetry-core,
+  progressbar2,
+  pyarrow,
+  pymysql,
+  pyodbc,
+  pyparsing,
+  pytestCheckHook,
+  pythonOlder,
+  pythonRelaxDepsHook,
+  redshift-connector,
+  requests-aws4auth,
 }:

 buildPythonPackage rec {
  pname = "awswrangler";
-  version = "3.7.2";
+  version = "3.7.3";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -35,16 +36,17 @@ buildPythonPackage rec {
    owner = "aws";
    repo = "aws-sdk-pandas";
    rev = "refs/tags/${version}";
-    hash = "sha256-1eb2oTiRNxA2XTpkScA5WJutN5P6FX96jC4Ra9VdonI=";
+    hash = "sha256-gm6ieteW+NcY+AOLcMZLUPcSi2Z/Mo27rzd1i9imp5I=";
  };

+  pythonRelaxDeps = [ "packaging" ];
+
  build-system = [
    poetry-core
-    pythonRelaxDepsHook
  ];

-  pythonRelaxDeps = [
-    "packaging"
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
  ];

  dependencies = [
@ -62,12 +64,21 @@ buildPythonPackage rec {
    requests-aws4auth
  ];

+  passthru.optional-dependencies = {
+    sqlserver = [ pyodbc ];
+    sparql = [ sparqlwrapper ];
+  };
+
  nativeCheckInputs = [
    moto
    pyparsing
    pytestCheckHook
  ];

+  pythonImportsCheck = [
+    "awswrangler"
+  ];
+
  pytestFlagsArray = [
    # Subset of tests that run in upstream CI (many others require credentials)
    # https://github.com/aws/aws-sdk-pandas/blob/20fec775515e9e256e8cee5aee12966516608840/.github/workflows/minimal-tests.yml#L36-L43
@ -77,15 +88,6 @@ buildPythonPackage rec {
    "tests/unit/test_moto.py"
  ];

-  passthru.optional-dependencies = {
-    sqlserver = [
-      pyodbc
-    ];
-    sparql = [
-      sparqlwrapper
-    ];
-  };
-
  meta = with lib; {
    description = "Pandas on AWS";
    homepage = "https://github.com/aws/aws-sdk-pandas";
--- a/pkgs/development/python-modules/azure-cosmos/default.nix
+++ b/pkgs/development/python-modules/azure-cosmos/default.nix
@ -1,30 +1,43 @@
-{ buildPythonPackage
-, lib
-, fetchPypi
-, six
-, requests
+{
+  lib,
+  azure-core,
+  buildPythonPackage,
+  fetchPypi,
+  pythonOlder,
+  setuptools,
+  typing-extensions,
 }:

 buildPythonPackage rec {
-  version = "4.6.0";
-  format = "setuptools";
  pname = "azure-cosmos";
+  version = "4.6.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-2uxqwgHGRzsJK2Ku5x44G+62w6jcNhJJgytwSMTwYeI=";
+    hash = "sha256-2uxqwgHGRzsJK2Ku5x44G+62w6jcNhJJgytwSMTwYeI=";
  };

-  propagatedBuildInputs = [ six requests ];
+  build-system = [ setuptools ];
+
+  dependencies = [
+    azure-core
+    typing-extensions
+  ];

  pythonNamespaces = [ "azure" ];

-  # requires an active Azure Cosmos service
+  # Requires an active Azure Cosmos service
  doCheck = false;

+  pythonImportsCheck = [ "azure.cosmos" ];
+
  meta = with lib; {
    description = "Azure Cosmos DB API";
-    homepage = "https://github.com/Azure/azure-sdk-for-python";
+    homepage = "https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/cosmos/azure-cosmos";
+    changelog = "https://github.com/Azure/azure-sdk-for-python/blob/azure-cosmos_${version}/sdk/cosmos/azure-cosmos/CHANGELOG.md";
    license = licenses.mit;
    maintainers = with maintainers; [ jonringer ];
  };
--- a/pkgs/development/python-modules/backports-shutil-which/default.nix
+++ b/pkgs/development/python-modules/backports-shutil-which/default.nix
@ -1,11 +1,12 @@
 { lib, fetchPypi, buildPythonPackage, pytest }:

 buildPythonPackage rec {
-  pname = "backports.shutil_which";
+  pname = "backports-shutil-which";
  version = "3.5.2";

  src = fetchPypi {
-    inherit pname version;
+    pname = "backports.shutil_which";
+    inherit version;
    sha256 = "fe39f567cbe4fad89e8ac4dbeb23f87ef80f7fe8e829669d0221ecdb0437c133";
  };

--- a/pkgs/development/python-modules/crc/default.nix
+++ b/pkgs/development/python-modules/crc/default.nix
@ -1,14 +1,15 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, poetry-core
-, pytestCheckHook
-, pythonOlder
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  pytestCheckHook,
+  pythonOlder,
 }:

 buildPythonPackage rec {
  pname = "crc";
-  version = "6.1.2";
+  version = "7.0.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -17,31 +18,23 @@ buildPythonPackage rec {
    owner = "Nicoretti";
    repo = "crc";
    rev = "refs/tags/${version}";
-    hash = "sha256-d946yBMrOIgMXGOr2ej5bvn59D5iAGMese24qdv8l/Y=";
+    hash = "sha256-y30tnGG+G9dWBO8MUFYm2IGHiGIPbv4kB2VwhV0/C74=";
  };

-  nativeBuildInputs = [
-    poetry-core
-  ];
+  build-system = [ poetry-core ];

-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];

-  pythonImportsCheck = [
-    "crc"
-  ];
+  pythonImportsCheck = [ "crc" ];

-  disabledTestPaths = [
-    "test/bench"
-  ];
+  disabledTestPaths = [ "test/bench" ];

  meta = with lib; {
-    changelog = "https://github.com/Nicoretti/crc/releases/tag/${version}";
    description = "Python module for calculating and verifying predefined & custom CRC's";
-    mainProgram = "crc";
    homepage = "https://nicoretti.github.io/crc/";
+    changelog = "https://github.com/Nicoretti/crc/releases/tag/${version}";
    license = licenses.bsd2;
    maintainers = with maintainers; [ jleightcap ];
+    mainProgram = "crc";
  };
 }
--- a/pkgs/development/python-modules/git-versioner/default.nix
+++ b/pkgs/development/python-modules/git-versioner/default.nix
@ -0,0 +1,34 @@
+{ lib
+, buildPythonPackage
+, setuptools-scm
+, fetchFromGitLab
+}:
+
+buildPythonPackage rec {
+  pname = "git-versioner";
+  version = "7.1";
+  pyproject = true;
+
+  src = fetchFromGitLab {
+    owner = "alelec";
+    repo = "__version__";
+    rev = "v${version}";
+    hash = "sha256-bnpuFJSd4nBXJA75V61kiB+nU5pUzdEAIScfKx7aaGU=";
+  };
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  pythonImportsCheck = [
+    "__version__"
+  ];
+
+  meta = with lib; {
+    description = "Manage current / next version for project";
+    homepage = "https://gitlab.com/alelec/__version__";
+    license = licenses.mit;
+    maintainers = with maintainers; [ slotThe ];
+  };
+
+}
--- a/pkgs/development/python-modules/llama-index-agent-openai/default.nix
+++ b/pkgs/development/python-modules/llama-index-agent-openai/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "llama-index-agent-openai";
-  version = "0.2.2";
+  version = "0.2.3";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -19,7 +19,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "llama_index_agent_openai";
    inherit version;
-    hash = "sha256-EgY92TLHQBV5b5c5hsxS14P1H9o45OrXKlbQ/RlZJe4=";
+    hash = "sha256-yJnZCzIDZlao74bQ8DeNQWjgDrLXWhCQHqtYulsmVqQ=";
  };

  pythonRelaxDeps = [ "llama-index-llms-openai" ];
--- a/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix
+++ b/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "llama-index-vector-stores-qdrant";
-  version = "0.2.1";
+  version = "0.2.5";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -19,7 +19,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "llama_index_vector_stores_qdrant";
    inherit version;
-    hash = "sha256-begHJBxdu+19LIoNgAd3Gnei2TQqpEU3gd6cVrv0zGw=";
+    hash = "sha256-5lkQ0AZ15qx5v0PaaYYNElNUfjxY1i2rOKTSPVq5H9Y=";
  };

  build-system = [ poetry-core ];
--- a/pkgs/development/python-modules/mesa/default.nix
+++ b/pkgs/development/python-modules/mesa/default.nix
@ -19,7 +19,7 @@ buildPythonPackage rec {
  disabled = isPy27;

  src = fetchPypi {
-    pname = "Mesa";
+    pname = "mesa";
    inherit version;
    hash = "sha256-5og3ACS2r36BEGWfqtw6WG6yJwNF5p3M9K25sSmHosM=";
  };
@ -47,5 +47,6 @@ buildPythonPackage rec {
    description = "An agent-based modeling (or ABM) framework in Python";
    license = licenses.asl20;
    maintainers = [ maintainers.dpaetzel ];
+    broken = true; # missing dependencies
  };
 }
--- a/pkgs/development/python-modules/notus-scanner/default.nix
+++ b/pkgs/development/python-modules/notus-scanner/default.nix
@ -1,29 +1,30 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, paho-mqtt
-, poetry-core
-, psutil
-, pytestCheckHook
-, python-gnupg
-, pythonOlder
-, pythonRelaxDepsHook
-, sentry-sdk
-, tomli
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  paho-mqtt,
+  poetry-core,
+  psutil,
+  pytestCheckHook,
+  python-gnupg,
+  pythonOlder,
+  pythonRelaxDepsHook,
+  sentry-sdk,
+  tomli,
 }:

 buildPythonPackage rec {
  pname = "notus-scanner";
-  version = "22.6.2";
-  format = "pyproject";
+  version = "22.6.3";
+  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "greenbone";
-    repo = pname;
+    repo = "notus-scanner";
    rev = "refs/tags/v${version}";
-    hash = "sha256-V70cFSfQ9SuLhCSUa8DuYA7qaabwiK9IbIkYcQMgVUk=";
+    hash = "sha256-LYYof/s0OvXMbEH7jyFIymUVrWYUd/6lychIzfPlylc=";
  };

  pythonRelaxDeps = [
@ -31,27 +32,20 @@ buildPythonPackage rec {
    "python-gnupg"
  ];

-  nativeBuildInputs = [
-    poetry-core
-    pythonRelaxDepsHook
-  ];
+  build-system = [ poetry-core ];
+
+  nativeBuildInputs = [ pythonRelaxDepsHook ];

  propagatedBuildInputs = [
    paho-mqtt
    psutil
    python-gnupg
    sentry-sdk
-  ] ++ lib.optionals (pythonOlder "3.11") [
-    tomli
-  ];
+  ] ++ lib.optionals (pythonOlder "3.11") [ tomli ];

-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];

-  pythonImportsCheck = [
-    "notus.scanner"
-  ];
+  pythonImportsCheck = [ "notus.scanner" ];

  meta = with lib; {
    description = "Helper to create results from local security checks";
--- a/pkgs/development/python-modules/onetimepass/default.nix
+++ b/pkgs/development/python-modules/onetimepass/default.nix
@ -1,23 +1,35 @@
-{ lib, buildPythonPackage, fetchFromGitHub, six, timecop }:
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pythonOlder,
+  setuptools,
+  six,
+  timecop,
+  unittestCheckHook,
+}:

 buildPythonPackage rec {
  pname = "onetimepass";
  version = "1.0.1";
-  format = "setuptools";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "tadeck";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "0wmv62l3r8r4428gdzyj80lhgadfqvj220khz1wnm9alyzg60wkh";
+    repo = "onetimepass";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-cHJg3vdUpWp5+HACIeTGrqkHKUDS//aQICSjPKgwu3I=";
  };

-  propagatedBuildInputs = [
-    six
-  ];
+  build-system = [ setuptools ];
+
+  dependencies = [ six ];

  nativeCheckInputs = [
    timecop
+    unittestCheckHook
  ];

  pythonImportsCheck = [ "onetimepass" ];
@ -25,6 +37,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "One-time password library for HMAC-based (HOTP) and time-based (TOTP) passwords";
    homepage = "https://github.com/tadeck/onetimepass";
+    changelog = "https://github.com/tadeck/onetimepass/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ zakame ];
  };
--- a/pkgs/development/python-modules/openai-whisper/default.nix
+++ b/pkgs/development/python-modules/openai-whisper/default.nix
@ -14,14 +14,13 @@
 , numba
 , numpy
 , openai-triton
-, scipy
 , tiktoken
 , torch
 , tqdm
-, transformers

 # tests
 , pytestCheckHook
+, scipy
 }:

 buildPythonPackage rec {
@ -45,6 +44,7 @@ buildPythonPackage rec {

  nativeBuildInputs = [
    setuptools
+    scipy
  ];

  propagatedBuildInputs = [
@ -52,11 +52,9 @@ buildPythonPackage rec {
    numba
    numpy
    openai-triton
-    scipy
    tiktoken
    torch
    tqdm
-    transformers
  ];

  preCheck = ''
--- a/pkgs/development/python-modules/pick/default.nix
+++ b/pkgs/development/python-modules/pick/default.nix
@ -1,36 +1,31 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, poetry-core
-, pytestCheckHook
-, pythonOlder
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  pytestCheckHook,
+  pythonOlder,
 }:

 buildPythonPackage rec {
  pname = "pick";
-  version = "2.2.0";
-  format = "pyproject";
+  version = "2.3.0";
+  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "wong2";
-    repo = pname;
+    repo = "pick";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Py+D03bXnVsIwvYwjl0IMeH33ZPJW5TuJ3tU79MMsCw=";
+    hash = "sha256-1CDwnPvu64zHu+MML0KssPxI5CH7ng8lYZXQzmeSOCw=";
  };

-  nativeBuildInputs = [
-    poetry-core
-  ];
+  build-system = [ poetry-core ];

-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];

-  pythonImportsCheck = [
-    "pick"
-  ];
+  pythonImportsCheck = [ "pick" ];

  meta = with lib; {
    description = "Module to create curses-based interactive selection list in the terminal";
--- a/pkgs/development/python-modules/pip-system-certs/default.nix
+++ b/pkgs/development/python-modules/pip-system-certs/default.nix
@ -0,0 +1,43 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools-scm
+, wheel
+, git-versioner
+, wrapt
+}:
+
+buildPythonPackage rec {
+  pname = "pip-system-certs";
+  version = "4.0";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit version;
+    pname = "pip_system_certs";
+    hash = "sha256-245qMTiNl5XskTmVffGon6UnT7ZhZEVv0JGl0+lMNQw=";
+  };
+
+  nativeBuildInputs = [
+    setuptools-scm
+    wheel
+    git-versioner
+  ];
+
+  propagatedBuildInputs = [
+    wrapt
+  ];
+
+  pythonImportsCheck = [
+    "pip_system_certs.wrapt_requests"
+    "pip_system_certs.bootstrap"
+  ];
+
+  meta = with lib; {
+    description = "Live patches pip and requests to use system certs by default";
+    homepage = "https://gitlab.com/alelec/pip-system-certs";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ slotThe ];
+  };
+
+}
--- a/pkgs/development/python-modules/pip-tools/default.nix
+++ b/pkgs/development/python-modules/pip-tools/default.nix
@ -68,6 +68,9 @@ buildPythonPackage rec {
    "test_compile_recursive_extras"
    "test_combine_different_extras_of_the_same_package"
    "test_diff_should_not_uninstall"
+    "test_cli_compile_all_extras_with_multiple_packages"
+    # Deprecations
+    "test_error_in_pyproject_toml"
  ];

  pythonImportsCheck = [
--- a/pkgs/development/python-modules/pip-tools/fix-setup-py-bad-syntax-detection.patch
+++ b/pkgs/development/python-modules/pip-tools/fix-setup-py-bad-syntax-detection.patch
@ -1,21 +1,22 @@
-diff --color -ru a/piptools/scripts/compile.py b/piptools/scripts/compile.py
--- a/piptools/scripts/compile.py	2022-06-30 11:24:26.000000000 +0200
-+++ b/piptools/scripts/compile.py	2022-08-01 13:40:58.392515765 +0200
-@@ -6,7 +6,7 @@
- from typing import IO, Any, BinaryIO, List, Optional, Tuple, Union, cast
- 
+diff --git a/piptools/scripts/compile.py b/piptools/scripts/compile.py
+index 195faa7..3e69437 100755
+--- a/piptools/scripts/compile.py
+++ b/piptools/scripts/compile.py
+@@ -9,7 +9,7 @@ from pathlib import Path
+ from typing import IO, Any, BinaryIO, cast
+
 import click
 -from build import BuildBackendException
 +from build import BuildException
- from build.util import project_wheel_metadata
 from click.utils import LazyFile, safecall
- from pip._internal.commands import create_command
-@@ -421,7 +421,7 @@
-                 metadata = project_wheel_metadata(
-                     os.path.dirname(os.path.abspath(src_file))
+ from pip._internal.req import InstallRequirement
+ from pip._internal.req.constructors import install_req_from_line
+@@ -369,6 +369,6 @@ def cli(
+                     isolated=build_isolation,
+                     quiet=log.verbosity <= 0,
                 )
 -            except BuildBackendException as e:
-+            except (BuildException,StopIteration) as e:
+            except (BuildException, StopIteration) as e:
                 log.error(str(e))
                 log.error(f"Failed to parse {os.path.abspath(src_file)}")
                 sys.exit(2)
--- a/pkgs/development/python-modules/plantuml-markdown/default.nix
+++ b/pkgs/development/python-modules/plantuml-markdown/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "plantuml-markdown";
-  version = "3.9.4";
+  version = "3.9.5";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "mikitex70";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-DSR4/PEs1uzGHgtw5p3HMlquOIYHPWbTHrw6QGx7t4o=";
+    hash = "sha256-bfbji517y0/PXMfLg2gGWlogg7IPhXvQ5vekLzc4/ow=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pydrawise/default.nix
+++ b/pkgs/development/python-modules/pydrawise/default.nix
@ -1,24 +1,25 @@
-{ lib
-, aiohttp
-, aioresponses
-, apischema
-, buildPythonPackage
-, fetchFromGitHub
-, freezegun
-, gql
-, graphql-core
-, pytest-asyncio
-, pytestCheckHook
-, pythonOlder
-, requests
-, setuptools
-, setuptools-scm
+{
+  lib,
+  aiohttp,
+  aioresponses,
+  apischema,
+  buildPythonPackage,
+  fetchFromGitHub,
+  freezegun,
+  gql,
+  graphql-core,
+  pytest-asyncio,
+  pytestCheckHook,
+  pythonOlder,
+  requests,
+  setuptools,
+  setuptools-scm,
 }:

 buildPythonPackage rec {
  pname = "pydrawise";
-  version = "2024.3.0";
-  format = "pyproject";
+  version = "2024.4.0";
+  pyproject = true;

  disabled = pythonOlder "3.10";

@ -26,15 +27,15 @@ buildPythonPackage rec {
    owner = "dknowles2";
    repo = "pydrawise";
    rev = "refs/tags/${version}";
-    hash = "sha256-sL0/LZ7ggUg2OGkIauNLHR7i3l3k4NGvyY2ea1O1m3E=";
+    hash = "sha256-krePSrMMrMgKDHQSjzH7hSNnRmwyRe0qTDXc0r0+CPU=";
  };

-  nativeBuildInputs = [
+  build-system = [
    setuptools
    setuptools-scm
  ];

-  propagatedBuildInputs = [
+  dependencies = [
    aiohttp
    apischema
    gql
@ -49,9 +50,7 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

-  pythonImportsCheck = [
-    "pydrawise"
-  ];
+  pythonImportsCheck = [ "pydrawise" ];

  meta = with lib; {
    description = "Library for interacting with Hydrawise sprinkler controllers through the GraphQL API";
--- a/pkgs/development/python-modules/testcontainers/default.nix
+++ b/pkgs/development/python-modules/testcontainers/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "testcontainers";
-  version = "4.3.3";
+  version = "4.4.0";
  disabled = pythonOlder "3.9";

  pyproject = true;
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "testcontainers";
    repo = "testcontainers-python";
    rev = "refs/tags/testcontainers-v${version}";
-    hash = "sha256-qb7mOtL+YJI24DOBgrqxc817k4fD2kTOtUNF2X0qEIc=";
+    hash = "sha256-1iwbfArEjYxpEpMlmJ8rzVLXA8OSNT7ozkpTVTIL91U=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/timecop/default.nix
+++ b/pkgs/development/python-modules/timecop/default.nix
@ -1,20 +1,35 @@
-{ lib, buildPythonPackage, fetchPypi }:
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  pythonOlder,
+  setuptools,
+  unittestCheckHook,
+}:

 buildPythonPackage rec {
  pname = "timecop";
  version = "0.5.0dev";
-  format = "setuptools";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0zbi58sw2yp1qchzfhyi7bsrwxajiypphg65fir98kvj03g011wd";
+    hash = "sha256-jYcA3gByT5RydMU8eK+PUnWe9TrRQ/chw+F6wTUqcX0=";
  };

+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [ unittestCheckHook ];
+
  # test_epoch fails, see https://github.com/bluekelp/pytimecop/issues/4
  preCheck = ''
    sed -i 's/test_epoch/_test_epoch/' timecop/tests/test_freeze.py
  '';

+  pythonImportsCheck = [ "timecop" ];
+
  meta = with lib; {
    description = "A port of the most excellent TimeCop Ruby Gem for Python";
    homepage = "https://github.com/bluekelp/pytimecop";
--- a/pkgs/development/python-modules/zha/default.nix
+++ b/pkgs/development/python-modules/zha/default.nix
@ -26,7 +26,7 @@

 buildPythonPackage rec {
  pname = "zha";
-  version = "0.0.5";
+  version = "0.0.8";
  pyproject = true;

  disabled = pythonOlder "3.12";
@ -35,7 +35,7 @@ buildPythonPackage rec {
    owner = "zigpy";
    repo = "zha";
    rev = "refs/tags/${version}";
-    hash = "sha256-47dlWMzY1vPmHIDCy8a0xzk2G+OPq6vEK5OpP1c8vw4=";
+    hash = "sha256-xOaqwgL8NqB3pHNa6U/wextntI5aMivHLaIhSRqvgRU=";
  };

  postPatch = ''
@ -49,8 +49,6 @@ buildPythonPackage rec {
    "zha-quirks"
  ];

-
-
  nativeBuildInputs = [
    pythonRelaxDepsHook
  ];
@ -94,6 +92,7 @@ buildPythonPackage rec {
    "test_check_available_unsuccessful"
    "test_device_counter_sensors"
    "test_device_tracker"
+    "test_device_unavailable_skips_entity_polling"
    "test_elec_measurement_sensor_polling"
    "test_electrical_measurement_init"
    "test_group_member_assume_state"
--- a/pkgs/development/tools/godot/4/default.nix
+++ b/pkgs/development/tools/godot/4/default.nix
@ -22,6 +22,7 @@
 , speechd
 , fontconfig
 , udev
+, withDebug ? false
 , withPlatform ? "linuxbsd"
 , withTarget ? "editor"
 , withPrecision ? "single"
@ -43,14 +44,14 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "godot4";
-  version = "4.2.1-stable";
-  commitHash = "b09f793f564a6c95dc76acc654b390e68441bd01";
+  version = "4.2.2-stable";
+  commitHash = "15073afe3856abd2aa1622492fe50026c7d63dc1";

  src = fetchFromGitHub {
    owner = "godotengine";
    repo = "godot";
    rev = commitHash;
-    hash = "sha256-Q6Og1H4H2ygOryMPyjm6kzUB6Su6T9mJIp0alNAxvjQ=";
+    hash = "sha256-anJgPEeHIW2qIALMfPduBVgbYYyz1PWCmPsZZxS9oHI=";
  };

  nativeBuildInputs = [
@ -115,6 +116,7 @@ stdenv.mkDerivation rec {
    platform = withPlatform;
    target = withTarget;
    precision = withPrecision; # Floating-point precision level
+    debug_symbols = withDebug;

    # Options from 'platform/linuxbsd/detect.py'
    pulseaudio = withPulseaudio; # Use PulseAudio
@ -125,6 +127,8 @@ stdenv.mkDerivation rec {
    touch = withTouch; # Enable touch events
  };

+  dontStrip = withDebug;
+
  outputs = [ "out" "man" ];

  installPhase = ''
@ -142,12 +146,12 @@ stdenv.mkDerivation rec {
    cp icon.png "$out/share/icons/godot.png"
  '';

-  meta = with lib; {
+  meta = {
    homepage = "https://godotengine.org";
    description = "Free and Open Source 2D and 3D game engine";
-    license = licenses.mit;
+    license = lib.licenses.mit;
    platforms = [ "i686-linux" "x86_64-linux" "aarch64-linux" ];
-    maintainers = with maintainers; [ shiryel ];
+    maintainers = with lib.maintainers; [ shiryel superherointj ];
    mainProgram = "godot4";
  };
 }
--- a/pkgs/games/anki/Cargo.lock
+++ b/pkgs/games/anki/Cargo.lock
--- a/pkgs/games/anki/default.nix
+++ b/pkgs/games/anki/default.nix
@ -28,21 +28,20 @@

 let
  pname = "anki";
-  version = "23.12.1";
-  rev = "1a1d4d5419c6b57ef3baf99c9d2d9cf85d36ae0a";
+  version = "24.04";
+  rev = "429bc9e14cefb597646a0e1beac6ef140f226b6f";

  src = fetchFromGitHub {
    owner = "ankitects";
    repo = "anki";
    rev = version;
-    hash = "sha256-K38bhfU1076PxdKJFvnFb2w6Q9Q2MUmL+j8be3RZQYk=";
+    hash = "sha256-H/Y6ZEJ7meprk4SWIPkoABs6AV1CzbK2l22jEnMSvyk=";
    fetchSubmodules = true;
  };

  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "fsrs-0.1.0" = "sha256-KJgT01OmMbqgYFE5Fu8nblZl9rL5QVVMa2DNFsw6cdk=";
      "linkcheck-0.4.1" = "sha256-S93J1cDzMlzDjcvz/WABmv8CEC6x78E+f7nzhsN7NkE=";
      "percent-encoding-iri-2.2.0" = "sha256-kCBeS1PNExyJd4jWfDfctxq6iTdAq69jtxFQgCCQ8kQ=";
    };
@ -51,7 +50,7 @@ let

  yarnOfflineCache = fetchYarnDeps {
    yarnLock = "${src}/yarn.lock";
-    hash = "sha256-tOl+gLBE6SNPQvVWT/N7RKFaaP9SnpCBJf5dq2wCPuM=";
+    hash = "sha256-7yBN6si1Q+xvyosP7YnOw9ZfGcLZdy5ukXXFvvI20Js=";
  };

  anki-build-python = python3.withPackages (ps: with ps; [
@ -155,22 +154,25 @@ python3.pkgs.buildPythonApplication {

  propagatedBuildInputs = with python3.pkgs; [
    # This rather long list came from running:
-    #    grep --no-filename -oE "^[^ =]*" python/{requirements.base.txt,requirements.bundle.txt,requirements.qt6_4.txt} | \
+    #    grep --no-filename -oE "^[^ =]*" python/{requirements.base.txt,requirements.bundle.txt,requirements.qt6_lin.txt} | \
    #      sort | uniq | grep -v "^#$"
    # in their repo at the git tag for this version
    # There's probably a more elegant way, but the above extracted all the
    # names, without version numbers, of their python dependencies. The hope is
    # that nixpkgs versions are "close enough"
    # I then removed the ones the check phase failed on (pythonCatchConflictsPhase)
+    attrs
    beautifulsoup4
+    blinker
+    build
    certifi
    charset-normalizer
    click
    colorama
    decorator
-    distro
    flask
    flask-cors
+    google-api-python-client
    idna
    importlib-metadata
    itsdangerous
@ -179,21 +181,27 @@ python3.pkgs.buildPythonApplication {
    markdown
    markupsafe
    orjson
-    pep517
-    pyparsing
+    packaging
+    pip
+    pip-system-certs
+    pip-tools
+    protobuf
+    pyproject-hooks
    pyqt6
    pyqt6-sip
    pyqt6-webengine
    pyrsistent
    pysocks
-    python3.pkgs.protobuf
    requests
    send2trash
-    six
+    setuptools
    soupsieve
+    tomli
    urllib3
    waitress
    werkzeug
+    wheel
+    wrapt
    zipp
  ] ++ lib.optionals stdenv.isDarwin [
    AVKit
--- a/pkgs/games/anki/patches/remove-the-gl-library-workaround.patch
+++ b/pkgs/games/anki/patches/remove-the-gl-library-workaround.patch
@ -1,13 +1,13 @@
 diff --git a/qt/aqt/__init__.py b/qt/aqt/__init__.py
-index 6f28d2dd0..fcd6a5ee4 100644
+index b6d24080b..5e5faac7b 100644
 --- a/qt/aqt/__init__.py
 +++ b/qt/aqt/__init__.py
-@@ -402,12 +402,6 @@ def setupGL(pm: aqt.profiles.ProfileManager) -> None:
+@@ -413,11 +413,5 @@ def setupGL(pm: aqt.profiles.ProfileManager) -> None:
     # RHI errors are emitted multiple times so make sure we only handle them once
     driver_failed = False

 -    # work around pyqt loading wrong GL library
-    if is_lin:
+-    if is_lin and not sys.platform.startswith("freebsd"):
 -        import ctypes
 -
 -        ctypes.CDLL("libGL.so.1", ctypes.RTLD_GLOBAL)
@ -15,5 +15,3 @@ index 6f28d2dd0..fcd6a5ee4 100644
     # catch opengl errors
     def msgHandler(category: Any, ctx: Any, msg: Any) -> None:
         if category == QtMsgType.QtDebugMsg:
--
-2.42.0
--- a/pkgs/servers/grocy/0001-Define-configs-with-env-vars.patch
+++ b/pkgs/servers/grocy/0001-Define-configs-with-env-vars.patch
@ -11,7 +11,7 @@ Subject: [PATCH 1/2] Define configs with env vars
 4 files changed, 6 insertions(+), 6 deletions(-)

 diff --git a/app.php b/app.php
-index bc5b1b39..26f7687e 100644
+index bc5b1b3..26f7687 100644
 --- a/app.php
 +++ b/app.php
@@ -12,7 +12,7 @@ use Slim\Views\Blade;
@ -41,11 +41,24 @@ index bc5b1b39..26f7687e 100644
 
 ob_clean(); // No response output before here
 $app->run();
+diff --git a/controllers/BaseApiController.php b/controllers/BaseApiController.php
+index 5941e348..e5b02af4 100644
+--- a/controllers/BaseApiController.php
+++ b/controllers/BaseApiController.php
+@@ -162,7 +162,7 @@ class BaseApiController extends BaseController
+ 		if (self::$htmlPurifierInstance == null)
+ 		{
+ 			$htmlPurifierConfig = \HTMLPurifier_Config::createDefault();
+-			$htmlPurifierConfig->set('Cache.SerializerPath', GROCY_DATAPATH . '/viewcache');
+			$htmlPurifierConfig->set('Cache.SerializerPath', getenv('GROCY_CACHE_DIR'));
+ 			$htmlPurifierConfig->set('HTML.Allowed', 'div,b,strong,i,em,u,a[href|title|target],iframe[src|width|height|frameborder],ul,ol,li,p[style],br,span[style],img[style|width|height|alt|src],table[border|width|style],tbody,tr,td,th,blockquote,*[style|class|id],h1,h2,h3,h4,h5,h6');
+ 			$htmlPurifierConfig->set('Attr.EnableID', true);
+ 			$htmlPurifierConfig->set('HTML.SafeIframe', true);
 diff --git a/services/DatabaseService.php b/services/DatabaseService.php
-index 4a05bda1..ce41ed17 100644
+index ba79a73..12a851a 100644
 --- a/services/DatabaseService.php
 +++ b/services/DatabaseService.php
-@@ -125,6 +125,6 @@ class DatabaseService
+@@ -137,6 +137,6 @@ class DatabaseService
 			return GROCY_DATAPATH . '/grocy_' . $dbSuffix . '.db';
 		}
 
@ -54,7 +67,7 @@ index 4a05bda1..ce41ed17 100644
 	}
 }
 diff --git a/services/FilesService.php b/services/FilesService.php
-index 7d070350..a6dd4b08 100644
+index 7d07035..a6dd4b0 100644
 --- a/services/FilesService.php
 +++ b/services/FilesService.php
@@ -10,7 +10,7 @@ class FilesService extends BaseService
@ -67,18 +80,18 @@ index 7d070350..a6dd4b08 100644
 		{
 			mkdir($this->StoragePath);
 diff --git a/services/StockService.php b/services/StockService.php
-index 7265e82b..13af591a 100644
+index 9f034a5..fd3c0b7 100644
 --- a/services/StockService.php
 +++ b/services/StockService.php
-@@ -1761,7 +1761,7 @@ class StockService extends BaseService
+@@ -1707,7 +1707,7 @@ class StockService extends BaseService
 			throw new \Exception('No barcode lookup plugin defined');
 		}
 
 -		$path = GROCY_DATAPATH . "/plugins/$pluginName.php";
 +		$path = getenv('GROCY_PLUGIN_DIR') . "/$pluginName.php";
- 
 		if (file_exists($path))
 		{
+ 			require_once $path;
 -- 
-2.41.0
+2.42.0

--- a/pkgs/servers/grocy/0002-Remove-check-for-config-file-as-it-s-stored-in-etc-g.patch
+++ b/pkgs/servers/grocy/0002-Remove-check-for-config-file-as-it-s-stored-in-etc-g.patch
@ -8,10 +8,10 @@ Subject: [PATCH 2/2] Remove check for config-file as it's stored in /etc/grocy
 1 file changed, 1 deletion(-)

 diff --git a/helpers/PrerequisiteChecker.php b/helpers/PrerequisiteChecker.php
-index da431b4b..6b878627 100644
+index 8e12a5c..37b433d 100644
 --- a/helpers/PrerequisiteChecker.php
 +++ b/helpers/PrerequisiteChecker.php
-@@ -17,7 +17,6 @@ class PrerequisiteChecker
+@@ -18,7 +18,6 @@ class PrerequisiteChecker
 	public function checkRequirements()
 	{
 		self::checkForPhpVersion();
@ -20,5 +20,4 @@ index da431b4b..6b878627 100644
 		self::checkForComposer();
 		self::checkForPhpExtensions();
 -- 
-2.41.0
-
+2.42.0
--- a/pkgs/servers/grocy/default.nix
+++ b/pkgs/servers/grocy/default.nix
@ -1,40 +1,71 @@
-{ lib, stdenv, fetchurl, unzip, nixosTests }:
+{ lib
+, fetchFromGitHub
+, fetchYarnDeps
+, php
+, yarn
+, fixup-yarn-lock
+, nixosTests
+}:

-stdenv.mkDerivation rec {
+php.buildComposerProject (finalAttrs: {
  pname = "grocy";
-  version = "4.0.3";
+  version = "4.2.0";

-  src = fetchurl {
-    url = "https://github.com/grocy/grocy/releases/download/v${version}/grocy_${version}.zip";
-    hash = "sha256-KBTsi634SolgA01eRthMuWx7DIF7rhvJSPxiHyuKSR8=";
+  src = fetchFromGitHub {
+    owner = "grocy";
+    repo = "grocy";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-aX3DMy9Jv8rNp1/VIvUtNXYXGBrCgBMs5GsDf4XXSj0=";
  };

-  nativeBuildInputs = [ unzip ];
-  unpackPhase = ''
-    unzip ${src} -d .
-  '';
+  vendorHash = "sha256-KaYvA0Rd4pd1s/L8QbVUgkE+SjH+jv4+6RvIaGOpews=";
+
+  offlineCache = fetchYarnDeps {
+    yarnLock = finalAttrs.src + "/yarn.lock";
+    hash = "sha256-UvWY8+qSRvzJbm7z3CmLyeUHxemzNUB7dHYP95ZVtcI=";
+  };
+
+  nativeBuildInputs = [
+    yarn
+    fixup-yarn-lock
+  ];
+
+  # Upstream composer.json file is missing the name, description and license fields
+  composerStrictValidation = false;

  # NOTE: if patches are created from a git checkout, those should be modified
-  # with `unixdos` to make sure those apply here.
+  # with `unix2dos` to make sure those apply here.
  patches = [
    ./0001-Define-configs-with-env-vars.patch
    ./0002-Remove-check-for-config-file-as-it-s-stored-in-etc-g.patch
  ];
-  patchFlags = [ "--binary" "-p1" ];

-  dontBuild = true;
+  configurePhase = ''
+    runHook preConfigure

-  passthru.tests = { inherit (nixosTests) grocy; };
+    export HOME=$(mktemp -d)
+    yarn config --offline set yarn-offline-mirror $offlineCache
+    fixup-yarn-lock yarn.lock
+    yarn install --offline --frozen-lockfile --no-progress --non-interactive
+
+    runHook postConfigure
+  '';

  installPhase = ''
-    mkdir -p $out/
-    cp -R . $out/
+    runHook preInstall
+
+    mv $out/share/php/grocy/* $out
+    rm -r $out/share
+
+    runHook postInstall
  '';

+  passthru.tests = { inherit (nixosTests) grocy; };
+
  meta = with lib; {
    license = licenses.mit;
    maintainers = with maintainers; [ n0emis ];
    description = "ERP beyond your fridge - grocy is a web-based self-hosted groceries & household management solution for your home";
    homepage = "https://grocy.info/";
  };
-}
+})
--- a/pkgs/servers/invidious/versions.json
+++ b/pkgs/servers/invidious/versions.json
@ -1,8 +1,8 @@
 {
  "invidious": {
-    "rev": "08390acd0c17875fddb84cabba54197a5b5740e4",
-    "hash": "sha256-75C/ImX/PYikVdSO4rZM/aYyEgx6pU90BHNeRFfcsDM=",
-    "version": "0.20.1-unstable-2024-03-31"
+    "rev": "b673695aa2704b880562399ac78659ad23b7940d",
+    "hash": "sha256-2vYCQNAf+o1Z2HFMk4sIlKNBFAsiLZe0Iw34oThC2Vs=",
+    "version": "0.20.1-unstable-2024-04-10"
  },
  "videojs": {
    "hash": "sha256-jED3zsDkPN8i6GhBBJwnsHujbuwlHdsVpVqa1/pzSH4="
--- a/pkgs/servers/matrix-synapse/matrix-hookshot/package.json
+++ b/pkgs/servers/matrix-synapse/matrix-hookshot/package.json
@ -1,6 +1,6 @@
 {
  "name": "matrix-hookshot",
-  "version": "5.2.1",
+  "version": "5.3.0",
  "description": "A bridge between Matrix and multiple project management services, such as GitHub, GitLab and JIRA.",
  "main": "lib/app.js",
  "repository": "https://github.com/matrix-org/matrix-hookshot",
@ -55,6 +55,7 @@
    "cors": "^2.8.5",
    "express": "^4.18.2",
    "figma-js": "^1.14.0",
+    "helmet": "^7.1.0",
    "http-status-codes": "^2.2.0",
    "ioredis": "^5.2.3",
    "jira-client": "^8.2.2",
@ -114,6 +115,6 @@
    "ts-jest": "^29.1.1",
    "ts-node": "^10.9.1",
    "typescript": "^5.3.3",
-    "vite": "^5.0.12"
+    "vite": "^5.0.13"
  }
 }
--- a/pkgs/servers/matrix-synapse/matrix-hookshot/pin.json
+++ b/pkgs/servers/matrix-synapse/matrix-hookshot/pin.json
@ -1,6 +1,6 @@
 {
-  "version": "5.2.1",
-  "srcHash": "sha256-yh8erXI1r9BqdJvEdk2WuBojXUK7VQf9bc4GQ2a2vIo=",
-  "yarnHash": "0nps2wbpkaivi9wb9zcqsrg77w9mm7inls9jqsx7xmyn4ashbs1p",
-  "cargoHash": "sha256-3euxhE9Y3N9bxo5S+l2mhYF575EoC/A5pH/mD+Ey86g="
+  "version": "5.3.0",
+  "srcHash": "sha256-saniKtauX+9lZxPZOtGLlk4//ht0njgWfnOIJsdQlOQ=",
+  "yarnHash": "1a52j61mb5hq62wd681zqpw7fkjhabqicdyvmam4jdd2qz2vh0w1",
+  "cargoHash": "sha256-ffjAsYOML+mDBToaVVuxjLUUEpGmBzWB0nN4jzOO098="
 }
--- a/pkgs/servers/monitoring/telegraf/default.nix
+++ b/pkgs/servers/monitoring/telegraf/default.nix
@ -8,7 +8,7 @@

 buildGoModule rec {
  pname = "telegraf";
-  version = "1.30.1";
+  version = "1.30.2";

  subPackages = [ "cmd/telegraf" ];

@ -16,10 +16,10 @@ buildGoModule rec {
    owner = "influxdata";
    repo = "telegraf";
    rev = "v${version}";
-    hash = "sha256-cBEPNPeezh4X817Iq8Bo41/KX58I9HL2GA0lAU7+ISE=";
+    hash = "sha256-y9FfCCOUl0IWwcol1aDG+1m7270wWc3akhZzaK/KItY=";
  };

-  vendorHash = "sha256-jTw5YLGgHs3uvihI6KPZg+cNrnNixUznJsH0CtIVe6I=";
+  vendorHash = "sha256-7X2k/fpr9zQNXfyd+18VpRTcmYvPBvQzPNolNfmIZG8=";
  proxyVendor = true;

  ldflags = [
--- a/pkgs/tools/admin/awslimitchecker/default.nix
+++ b/pkgs/tools/admin/awslimitchecker/default.nix
@ -1,17 +1,29 @@
-{ lib, python3Packages, fetchFromGitHub }:
+{
+  lib,
+  fetchFromGitHub,
+  python3,
+}:

-python3Packages.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
  pname = "awslimitchecker";
  version = "12.0.0";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "jantman";
    repo = "awslimitchecker";
-    rev = version;
-    sha256 = "1p6n4kziyl6sfq7vgga9v88ddwh3sgnfb1m1cx6q25n0wyl7phgv";
+    rev = "refs/tags/${version}";
+    hash = "sha256-+8F7qOfAFoFNZ6GG5ezTA/LWENpJvbcPdtpQH/8k1tw=";
  };

-  propagatedBuildInputs = with python3Packages; [
+  patches = [
+    # Fix the version lookup to use only the hardcoded version in the source package
+    ./version.patch
+  ];
+
+  build-system = with python3.pkgs; [ setuptools ];
+
+  dependencies = with python3.pkgs; [
    boto3
    botocore
    pytz
@ -19,27 +31,15 @@ python3Packages.buildPythonApplication rec {
    versionfinder
  ];

-  nativeCheckInputs = with python3Packages; [
+  nativeCheckInputs = with python3.pkgs; [
    freezegun
    onetimepass
-    pytestCheckHook
    pyotp
+    mock
+    (pytestCheckHook.override { pytest = pytest_7; })
    testfixtures
  ];

-  patches = [
-    # Fix the version lookup to use only the hardcoded version in the source package
-    ./version.patch
-  ];
-
-  pytestFlagsArray = [
-    "awslimitchecker/tests"
-
-    # Upstream did not adapt to pytest 8 yet.
-    "-W"
-    "ignore::pytest.PytestRemovedIn8Warning"
-  ];
-
  disabledTestPaths = [
    # AWS tests that use the network
    "awslimitchecker/tests/services"
@ -53,11 +53,11 @@ python3Packages.buildPythonApplication rec {
  pythonImportsCheck = [ "awslimitchecker.checker" ];

  meta = with lib; {
+    description = "A script and python package to check your AWS service limits and usage via boto3";
    homepage = "http://awslimitchecker.readthedocs.org";
    changelog = "https://github.com/jantman/awslimitchecker/blob/${version}/CHANGES.rst";
-    description = "A script and python package to check your AWS service limits and usage via boto3";
-    mainProgram = "awslimitchecker";
    license = licenses.agpl3Plus;
    maintainers = with maintainers; [ zakame ];
+    mainProgram = "awslimitchecker";
  };
 }
--- a/pkgs/tools/admin/qovery-cli/default.nix
+++ b/pkgs/tools/admin/qovery-cli/default.nix
@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "qovery-cli";
-  version = "0.87.0";
+  version = "0.89.0";

  src = fetchFromGitHub {
    owner = "Qovery";
    repo = "qovery-cli";
    rev = "refs/tags/v${version}";
-    hash = "sha256-JUyhVq3xMPV9s4OCfkKgCnSMjztYDPJgS4A+jJOZofE=";
+    hash = "sha256-3guMKAxDxv/R60pKP0y+XTTaxHZSTfnXtNO2RC74/xE=";
  };

-  vendorHash = "sha256-Lwg3PFmSipaaYtu88c1qI/Ws50TQOqEu4mSuxcpx3zI=";
+  vendorHash = "sha256-/wm/KCO/oYJkjh0AuUi9rUyrqen/otC4KVVXhROz9Ro=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/tools/admin/trivy/default.nix
+++ b/pkgs/tools/admin/trivy/default.nix
@ -1,28 +1,29 @@
-{ lib
-, stdenv
-, buildPackages
-, buildGoModule
-, fetchFromGitHub
-, installShellFiles
-, testers
-, trivy
+{
+  lib,
+  stdenv,
+  buildPackages,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+  testers,
+  trivy,
 }:

 buildGoModule rec {
  pname = "trivy";
-  version = "0.50.1";
+  version = "0.50.2";

  src = fetchFromGitHub {
    owner = "aquasecurity";
-    repo = pname;
+    repo = "trivy";
    rev = "refs/tags/v${version}";
-    hash = "sha256-TcSWgEdk0hjckY5ZGm2/jg9C4yiTTtgQjZEihXBi+fA=";
+    hash = "sha256-0FV67+m09PCkPZfnkepkvBA4mFYIkJSMT5v0tDwalW8=";
  };

  # Hash mismatch on across Linux and Darwin
  proxyVendor = true;

-  vendorHash = "sha256-FkyGqZSEKWCI7tRmTBI+dmiqZPPPMUlqbCxs59N1syY=";
+  vendorHash = "sha256-aki+kwjZxPPD/K3k8wJMc2HNB6DzFf92mcOOQFwsbXU=";

  subPackages = [ "cmd/trivy" ];

@ -39,7 +40,11 @@ buildGoModule rec {

  postInstall =
    let
-      trivy = if stdenv.buildPlatform.canExecute stdenv.hostPlatform then placeholder "out" else buildPackages.trivy;
+      trivy =
+        if stdenv.buildPlatform.canExecute stdenv.hostPlatform then
+          placeholder "out"
+        else
+          buildPackages.trivy;
    in
    ''
      installShellCompletion --cmd trivy \
@ -69,6 +74,9 @@ buildGoModule rec {
    '';
    mainProgram = "trivy";
    license = licenses.asl20;
-    maintainers = with maintainers; [ fab jk ];
+    maintainers = with maintainers; [
+      fab
+      jk
+    ];
  };
 }
--- a/pkgs/tools/package-management/nix-eval-jobs/default.nix
+++ b/pkgs/tools/package-management/nix-eval-jobs/default.nix
@ -11,12 +11,12 @@
 }:
 stdenv.mkDerivation rec {
  pname = "nix-eval-jobs";
-  version = "2.19.4";
+  version = "2.21.0";
  src = fetchFromGitHub {
    owner = "nix-community";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-97ZqhTMqnAr1rzEy96faceWzFyWexnYbH1aTfc1y0JE=";
+    hash = "sha256-StJq7Zy+/iVBUAKFzhHWlsirFucZ3gNtzXhAYXAsNnw=";
  };
  buildInputs = [
    boost
--- a/pkgs/tools/security/cnquery/default.nix
+++ b/pkgs/tools/security/cnquery/default.nix
@ -6,18 +6,18 @@

 buildGoModule rec {
  pname = "cnquery";
-  version = "10.12.2";
+  version = "11.0.2";

  src = fetchFromGitHub {
    owner = "mondoohq";
    repo = "cnquery";
    rev = "refs/tags/v${version}";
-    hash = "sha256-TqbE94JmewkYxulF8ePKxQLb2NvQ6FNpfqqedtYM4aY=";
+    hash = "sha256-hWZXt9hUK0IXnmqKvKdowR42NVu+guMPW3krzgI1KqU=";
  };

  subPackages = [ "apps/cnquery" ];

-  vendorHash = "sha256-dS62XJFdL3Js2i6JwksvU8hEme6+6NojfjdzUZnY1wI=";
+  vendorHash = "sha256-Q1Wz3zHow4UeqgZVP9s9xHuLwrG2LE/tsDUdgs6xMNo=";

  ldflags = [
    "-w"
--- a/pkgs/tools/security/grype/default.nix
+++ b/pkgs/tools/security/grype/default.nix
@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "grype";
-  version = "0.76.0";
+  version = "0.77.0";

  src = fetchFromGitHub {
    owner = "anchore";
    repo = "grype";
    rev = "refs/tags/v${version}";
-    hash = "sha256-FdxtJVLeH7UQBYjoOuimCoswvIkz/2sBJ4Kn5NGBDWY=";
+    hash = "sha256-EnAMAmoP8rbkOkdPPxkN14lOPVYPqVpmaekfXBboeyI=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -12546,6 +12546,8 @@ with pkgs;

  recoll = libsForQt5.callPackage ../applications/search/recoll { };

+  recoll-nox = recoll.override { withGui = false; };
+
  redoc-cli = callPackage ../development/tools/redoc-cli { };

  reflex = callPackage ../development/tools/reflex { };
@ -39910,7 +39912,7 @@ with pkgs;
  dnadd = callPackage ../tools/nix/dnadd { };

  nix-eval-jobs = callPackage ../tools/package-management/nix-eval-jobs {
-    nix = nixVersions.nix_2_19;
+    nix = nixVersions.nix_2_21;
  };

  nix-doc = callPackage ../tools/package-management/nix-doc { };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -4790,6 +4790,8 @@ self: super: with self; {

  gitpython = callPackage ../development/python-modules/gitpython { };

+  git-versioner = callPackage ../development/python-modules/git-versioner { };
+
  glad =  callPackage ../development/python-modules/glad { };

  glad2 =  callPackage ../development/python-modules/glad2 { };
@ -9776,6 +9778,8 @@ self: super: with self; {

  pip-requirements-parser = callPackage ../development/python-modules/pip-requirements-parser { };

+  pip-system-certs = callPackage ../development/python-modules/pip-system-certs { };
+
  pipx = callPackage ../development/python-modules/pipx { };

  pivy = callPackage ../development/python-modules/pivy {