Merge master into haskell-updates

2024-05-14 00:13:38 +00:00 · 2024-05-14 00:13:38 +00:00 · 105028cf9e
commit 105028cf9e
parent 1c387916b7 f778a3d907
332 changed files with 7265 additions and 8835 deletions
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@ -20,7 +20,7 @@ jobs:
    if: github.repository_owner == 'NixOS' && github.event.pull_request.merged == true && (github.event_name != 'labeled' || startsWith('backport', github.event.label.name))
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
        with:
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Create backport PRs
--- a/.github/workflows/basic-eval.yml
+++ b/.github/workflows/basic-eval.yml
@ -18,7 +18,7 @@ jobs:
    runs-on: ubuntu-latest
    # we don't limit this action to only NixOS repo since the checks are cheap and useful developer feedback
    steps:
-    - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+    - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
    - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
    - uses: cachix/cachix-action@18cf96c7c98e048e10a83abd92116114cd8504be # v14
      with:
--- a/.github/workflows/check-by-name.yml
+++ b/.github/workflows/check-by-name.yml
@ -91,7 +91,7 @@ jobs:
            exit 1
          fi
          echo "mergedSha=$mergedSha" >> "$GITHUB_ENV"
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
        with:
          # pull_request_target checks out the base branch by default
          ref: ${{ env.mergedSha }}
--- a/.github/workflows/check-cherry-picks.yml
+++ b/.github/workflows/check-cherry-picks.yml
@ -12,7 +12,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository_owner == 'NixOS'
    steps:
-    - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+    - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
      with:
        fetch-depth: 0
        filter: blob:none
--- a/.github/workflows/check-maintainers-sorted.yaml
+++ b/.github/workflows/check-maintainers-sorted.yaml
@ -12,7 +12,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository_owner == 'NixOS'
    steps:
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
        with:
          # pull_request_target checks out the base branch by default
          ref: refs/pull/${{ github.event.pull_request.number }}/merge
--- a/.github/workflows/check-nix-format.yml
+++ b/.github/workflows/check-nix-format.yml
@ -15,7 +15,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository_owner == 'NixOS'
    steps:
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
        with:
          # pull_request_target checks out the base branch by default
          ref: refs/pull/${{ github.event.pull_request.number }}/merge
--- a/.github/workflows/editorconfig.yml
+++ b/.github/workflows/editorconfig.yml
@ -24,7 +24,7 @@ jobs:
    - name: print list of changed files
      run: |
        cat "$HOME/changed_files"
-    - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+    - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
      with:
        # pull_request_target checks out the base branch by default
        ref: refs/pull/${{ github.event.pull_request.number }}/merge
--- a/.github/workflows/manual-nixos.yml
+++ b/.github/workflows/manual-nixos.yml
@ -14,7 +14,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository_owner == 'NixOS'
    steps:
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
        with:
          # pull_request_target checks out the base branch by default
          ref: refs/pull/${{ github.event.pull_request.number }}/merge
--- a/.github/workflows/manual-nixpkgs.yml
+++ b/.github/workflows/manual-nixpkgs.yml
@ -16,7 +16,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository_owner == 'NixOS'
    steps:
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
        with:
          # pull_request_target checks out the base branch by default
          ref: refs/pull/${{ github.event.pull_request.number }}/merge
--- a/.github/workflows/nix-parse.yml
+++ b/.github/workflows/nix-parse.yml
@ -24,7 +24,7 @@ jobs:
        if [[ -s "$HOME/changed_files" ]]; then
          echo "CHANGED_FILES=$HOME/changed_files" > "$GITHUB_ENV"
        fi
-    - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+    - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
      with:
        # pull_request_target checks out the base branch by default
        ref: refs/pull/${{ github.event.pull_request.number }}/merge
--- a/.github/workflows/periodic-merge-24h.yml
+++ b/.github/workflows/periodic-merge-24h.yml
@ -41,7 +41,7 @@ jobs:
            into: staging-23.11
    name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
    steps:
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5

      - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
        uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0
--- a/.github/workflows/periodic-merge-6h.yml
+++ b/.github/workflows/periodic-merge-6h.yml
@ -39,7 +39,7 @@ jobs:
            into: staging
    name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
    steps:
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5

      - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
        uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0
--- a/.github/workflows/update-terraform-providers.yml
+++ b/.github/workflows/update-terraform-providers.yml
@ -16,7 +16,7 @@ jobs:
    if: github.repository_owner == 'NixOS' && github.ref == 'refs/heads/master' # ensure workflow_dispatch only runs on master
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
        with:
          nix_path: nixpkgs=channel:nixpkgs-unstable
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@ -321,7 +321,7 @@ All the review template samples provided in this section are generic and meant a

 To get more information about how to review specific parts of Nixpkgs, refer to the documents linked to in the [overview section][overview].

-If a pull request contains documentation changes that might require feedback from the documentation team, ping [@NixOS/documentation-reviewers](https://github.com/orgs/nixos/teams/documentation-reviewers) on the pull request.
+If a pull request contains documentation changes that might require feedback from the documentation team, ping [@NixOS/documentation-team](https://github.com/orgs/nixos/teams/documentation-team) on the pull request.

 If you consider having enough knowledge and experience in a topic and would like to be a long-term reviewer for related submissions, please contact the current reviewers for that topic. They will give you information about the reviewing process. The main reviewers for a topic can be hard to find as there is no list, but checking past pull requests to see who reviewed or git-blaming the code to see who committed to that topic can give some hints.

--- a/doc/README.md
+++ b/doc/README.md
@ -345,4 +345,4 @@ Typographic replacements are enabled. Check the [list of possible replacement pa

 ## Getting help

-If you need documentation-specific help or reviews, ping [@NixOS/documentation-reviewers](https://github.com/orgs/nixos/teams/documentation-reviewers) on your pull request.
+If you need documentation-specific help or reviews, ping [@NixOS/documentation-team](https://github.com/orgs/nixos/teams/documentation-team) on your pull request.
--- a/doc/stdenv/meta.chapter.md
+++ b/doc/stdenv/meta.chapter.md
@ -101,7 +101,7 @@ For example, a package which requires dynamic linking and cannot be linked stati
 ```nix
 {
  meta.platforms = lib.platforms.all;
-  meta.badPlatforms = [ lib.systems.inspect.patterns.isStatic ];
+  meta.badPlatforms = [ lib.systems.inspect.platformPatterns.isStatic ];
 }
 ```

--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -11300,6 +11300,14 @@
    githubId = 887072;
    name = "Alexander Lebedev";
  };
+  lebensterben = {
+    name = "Lucius Hu";
+    github = "lebensterben";
+    githubId = 1222865;
+    keys = [{
+      fingerprint = "80C6 77F2 ED0B E732 3835 A8D3 7E47 4E82 E29B 5A7A";
+    }];
+  };
  lecoqjacob = {
    name = "Jacob LeCoq";
    email = "lecoqjacob@gmail.com";
@ -22587,6 +22595,12 @@
      fingerprint = "065A 0A98 FE61 E1C1 41B0  AFE7 64FA BC62 F457 2875";
    }];
  };
+  zelkourban = {
+    name = "zelkourban";
+    email = "zelo.urban@gmail.com";
+    github = "zelkourban";
+    githubId = 33812622;
+  };
  zendo = {
    name = "zendo";
    email = "linzway@qq.com";
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@ -263,6 +263,9 @@ with lib.maintainers; {

  docs = {
    members = [ ];
+    githubTeams = [
+      "documentation-team"
+    ];
    scope = "Maintain nixpkgs/NixOS documentation and tools for building it.";
    shortName = "Docs";
    enableFeatureFreezePing = true;
--- a/nixos/doc/manual/installation/installing-from-other-distro.section.md
+++ b/nixos/doc/manual/installation/installing-from-other-distro.section.md
@ -42,9 +42,11 @@ The first steps to all these are the same:
    will be safer to use the `nixos-*` channels instead:

    ```ShellSession
-    $ nix-channel --add https://nixos.org/channels/nixos-version nixpkgs
+    $ nix-channel --add https://nixos.org/channels/nixos-<version> nixpkgs
    ```

+    Where `<version>` corresponds to the latest version available on [channels.nixos.org](https://channels.nixos.org/).
+
    You may want to throw in a `nix-channel --update` for good measure.

 1.  Install the NixOS installation tools:
--- a/nixos/doc/manual/installation/installing-virtualbox-guest.section.md
+++ b/nixos/doc/manual/installation/installing-virtualbox-guest.section.md
@ -3,8 +3,8 @@
 Installing NixOS into a VirtualBox guest is convenient for users who
 want to try NixOS without installing it on bare metal. If you want to
 use a pre-made VirtualBox appliance, it is available at [the downloads
-page](https://nixos.org/nixos/download.html). If you want to set up a
-VirtualBox guest manually, follow these instructions:
+page](https://nixos.org/download/#nixos-virtualbox). If you want to set
+up a VirtualBox guest manually, follow these instructions:

 1.  Add a New Machine in VirtualBox with OS Type "Linux / Other Linux"

--- a/nixos/doc/manual/installation/upgrading.chapter.md
+++ b/nixos/doc/manual/installation/upgrading.chapter.md
@ -33,8 +33,8 @@ To see what channels are available, go to <https://channels.nixos.org>.
 contains the channel's latest version and includes ISO images and
 VirtualBox appliances.) Please note that during the release process,
 channels that are not yet released will be present here as well. See the
-Getting NixOS page <https://nixos.org/nixos/download.html> to find the
-newest supported stable release.
+Getting NixOS page <https://nixos.org/download/> to find the newest
+supported stable release.

 When you first install NixOS, you're automatically subscribed to the
 NixOS channel that corresponds to your installation source. For
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -209,8 +209,12 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - [isolate](https://github.com/ioi/isolate), a sandbox for securely executing untrusted programs. Available as [security.isolate](#opt-security.isolate.enable).

+- [ydotool](https://github.com/ReimuNotMoe/ydotool), a generic command-line automation tool now has a module. Available as [programs.ydotool](#opt-programs.ydotool.enable).
+
 - [private-gpt](https://github.com/zylon-ai/private-gpt), a service to interact with your documents using the power of LLMs, 100% privately, no data leaks. Available as [services.private-gpt](#opt-services.private-gpt.enable).

+- [keto](https://www.ory.sh/keto/), a permission & access control server, the first open source implementation of ["Zanzibar: Google's Consistent, Global Authorization System"](https://research.google/pubs/zanzibar-googles-consistent-global-authorization-system/).
+
 ## Backward Incompatibilities {#sec-release-24.05-incompatibilities}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -308,6 +308,7 @@
  ./programs/xwayland.nix
  ./programs/yabar.nix
  ./programs/yazi.nix
+  ./programs/ydotool.nix
  ./programs/yubikey-touch-detector.nix
  ./programs/zmap.nix
  ./programs/zsh/oh-my-zsh.nix
@ -699,6 +700,7 @@
  ./services/misc/cpuminer-cryptonight.nix
  ./services/misc/db-rest.nix
  ./services/misc/devmon.nix
+  ./services/misc/devpi-server.nix
  ./services/misc/dictd.nix
  ./services/misc/disnix.nix
  ./services/misc/docker-registry.nix
--- a/nixos/modules/programs/ydotool.nix
+++ b/nixos/modules/programs/ydotool.nix
@ -0,0 +1,83 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.programs.ydotool;
+in
+{
+  meta = {
+    maintainers = with lib.maintainers; [ quantenzitrone ];
+  };
+
+  options.programs.ydotool = {
+    enable = lib.mkEnableOption ''
+      ydotoold system service and install ydotool.
+      Add yourself to the 'ydotool' group to be able to use it.
+    '';
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.groups.ydotool = { };
+
+    systemd.services.ydotoold = {
+      description = "ydotoold - backend for ydotool";
+      wantedBy = [ "multi-user.target" ];
+      partOf = [ "multi-user.target" ];
+      serviceConfig = {
+        Group = "ydotool";
+        RuntimeDirectory = "ydotoold";
+        RuntimeDirectoryMode = "0750";
+        ExecStart = "${lib.getExe' pkgs.ydotool "ydotoold"} --socket-path=/run/ydotoold/socket --socket-perm=0660";
+
+        # hardening
+
+        ## allow access to uinput
+        DeviceAllow = [ "/dev/uinput" ];
+        DevicePolicy = "closed";
+
+        ## allow creation of unix sockets
+        RestrictAddressFamilies = [ "AF_UNIX" ];
+
+        CapabilityBoundingSet = "";
+        IPAddressDeny = "any";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateNetwork = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        ProtectUser = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        UMask = "0077";
+
+        # -> systemd-analyze security score 0.7 SAFE 😀
+      };
+    };
+
+    environment.variables = {
+      YDOTOOL_SOCKET = "/run/ydotoold/socket";
+    };
+    environment.systemPackages = with pkgs; [ ydotool ];
+  };
+}
--- a/nixos/modules/programs/zsh/zsh-syntax-highlighting.nix
+++ b/nixos/modules/programs/zsh/zsh-syntax-highlighting.nix
@ -87,7 +87,7 @@ in
    ];

    programs.zsh.interactiveShellInit =
-      lib.lib.mkAfter (lib.concatStringsSep "\n" ([
+      lib.mkAfter (lib.concatStringsSep "\n" ([
        "source ${pkgs.zsh-syntax-highlighting}/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh"
      ] ++ lib.optional (builtins.length(cfg.highlighters) > 0)
        "ZSH_HIGHLIGHT_HIGHLIGHTERS=(${builtins.concatStringsSep " " cfg.highlighters})"
--- a/nixos/modules/services/backup/borgbackup.nix
+++ b/nixos/modules/services/backup/borgbackup.nix
@ -33,13 +33,24 @@ let
    }
    trap on_exit EXIT

+    borgWrapper () {
+      local result
+      borg "$@" && result=$? || result=$?
+      if [[ -z "${toString cfg.failOnWarnings}" ]] && [[ "$result" == 1 ]]; then
+        echo "ignoring warning return value 1"
+        return 0
+      else
+        return "$result"
+      fi
+    }
+
    archiveName="${optionalString (cfg.archiveBaseName != null) (cfg.archiveBaseName + "-")}$(date ${cfg.dateFormat})"
    archiveSuffix="${optionalString cfg.appendFailedSuffix ".failed"}"
    ${cfg.preHook}
  '' + optionalString cfg.doInit ''
    # Run borg init if the repo doesn't exist yet
-    if ! borg list $extraArgs > /dev/null; then
-      borg init $extraArgs \
+    if ! borgWrapper list $extraArgs > /dev/null; then
+      borgWrapper init $extraArgs \
        --encryption ${cfg.encryption.mode} \
        $extraInitArgs
      ${cfg.postInit}
@ -48,7 +59,7 @@ let
    (
      set -o pipefail
      ${optionalString (cfg.dumpCommand != null) ''${escapeShellArg cfg.dumpCommand} | \''}
-      borg create $extraArgs \
+      borgWrapper create $extraArgs \
        --compression ${cfg.compression} \
        --exclude-from ${mkExcludeFile cfg} \
        --patterns-from ${mkPatternsFile cfg} \
@ -57,16 +68,16 @@ let
        ${if cfg.paths == null then "-" else escapeShellArgs cfg.paths}
    )
  '' + optionalString cfg.appendFailedSuffix ''
-    borg rename $extraArgs \
+    borgWrapper rename $extraArgs \
      "::$archiveName$archiveSuffix" "$archiveName"
  '' + ''
    ${cfg.postCreate}
  '' + optionalString (cfg.prune.keep != { }) ''
-    borg prune $extraArgs \
+    borgWrapper prune $extraArgs \
      ${mkKeepArgs cfg} \
      ${optionalString (cfg.prune.prefix != null) "--glob-archives ${escapeShellArg "${cfg.prune.prefix}*"}"} \
      $extraPruneArgs
-    borg compact $extraArgs $extraCompactArgs
+    borgWrapper compact $extraArgs $extraCompactArgs
    ${cfg.postPrune}
  '');

@ -488,6 +499,15 @@ in {
            default = true;
          };

+          failOnWarnings = mkOption {
+            type = types.bool;
+            description = ''
+              Fail the whole backup job if any borg command returns a warning
+              (exit code 1), for example because a file changed during backup.
+            '';
+            default = true;
+          };
+
          doInit = mkOption {
            type = types.bool;
            description = ''
--- a/nixos/modules/services/display-managers/greetd.nix
+++ b/nixos/modules/services/display-managers/greetd.nix
@ -27,6 +27,17 @@ in
      '';
    };

+    greeterManagesPlymouth = mkOption {
+      type = types.bool;
+      internal = true;
+      default = false;
+      description = ''
+        Don't configure the greetd service to wait for Plymouth to exit.
+
+        Enable this if the greeter you're using can manage Plymouth itself to provide a smoother handoff.
+      '';
+    };
+
    vt = mkOption {
      type = types.int;
      default = 1;
@ -72,8 +83,9 @@ in
        ];
        After = [
          "systemd-user-sessions.service"
-          "plymouth-quit-wait.service"
          "getty@${tty}.service"
+        ] ++ lib.optionals (!cfg.greeterManagesPlymouth) [
+          "plymouth-quit-wait.service"
        ];
        Conflicts = [
          "getty@${tty}.service"
--- a/nixos/modules/services/hardware/thermald.nix
+++ b/nixos/modules/services/hardware/thermald.nix
@ -50,8 +50,8 @@ in
            ${optionalString cfg.debug "--loglevel=debug"} \
            ${optionalString cfg.ignoreCpuidCheck "--ignore-cpuid-check"} \
            ${optionalString (cfg.configFile != null) "--config-file ${cfg.configFile}"} \
-            --dbus-enable \
-            --adaptive
+            ${optionalString (cfg.configFile == null) "--adaptive"} \
+            --dbus-enable
        '';
      };
    };
--- a/nixos/modules/services/misc/devpi-server.nix
+++ b/nixos/modules/services/misc/devpi-server.nix
@ -0,0 +1,128 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+with lib;
+let
+  cfg = config.services.devpi-server;
+
+  secretsFileName = "devpi-secret-file";
+
+  stateDirName = "devpi";
+
+  runtimeDir = "/run/${stateDirName}";
+  serverDir = "/var/lib/${stateDirName}";
+in
+{
+  options.services.devpi-server = {
+    enable = mkEnableOption "Devpi Server";
+
+    package = mkPackageOption pkgs "devpi-server" { };
+
+    primaryUrl = mkOption {
+      type = types.str;
+      description = "Url for the primary node. Required option for replica nodes.";
+    };
+
+    replica = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Run node as a replica.
+        Requires the secretFile option and the primaryUrl to be enabled.
+      '';
+    };
+
+    secretFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        Path to a shared secret file used for synchronization,
+        Required for all nodes in a replica/primary setup.
+      '';
+    };
+
+    host = mkOption {
+      type = types.str;
+      default = "localhost";
+      description = ''
+        domain/ip address to listen on
+      '';
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 3141;
+      description = "The port on which Devpi Server will listen.";
+    };
+
+    openFirewall = mkEnableOption "opening the default ports in the firewall for Devpi Server";
+  };
+
+  config = mkIf cfg.enable {
+
+    systemd.services.devpi-server = {
+      enable = true;
+      description = "devpi PyPI-compatible server";
+      documentation = [ "https://devpi.net/docs/devpi/devpi/stable/+d/index.html" ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" ];
+      # Since at least devpi-server 6.10.0, devpi requires the secrets file to
+      # have 0600 permissions.
+      preStart =
+        ''
+          cp ${cfg.secretFile} ${runtimeDir}/${secretsFileName}
+          chmod 0600 ${runtimeDir}/*${secretsFileName}
+
+          if [ -f ${serverDir}/.nodeinfo ]; then
+            # already initialized the package index, exit gracefully
+            exit 0
+          fi
+          ${cfg.package}/bin/devpi-init --serverdir ${serverDir} ''
+        + strings.optionalString cfg.replica "--role=replica --master-url=${cfg.primaryUrl}";
+
+      serviceConfig = {
+        Restart = "always";
+        ExecStart =
+          let
+            args =
+              [
+                "--request-timeout=5"
+                "--serverdir=${serverDir}"
+                "--host=${cfg.host}"
+                "--port=${builtins.toString cfg.port}"
+              ]
+              ++ lib.optionals (! isNull cfg.secretFile) [
+                "--secretfile=${runtimeDir}/${secretsFileName}"
+              ]
+              ++ (
+                if cfg.replica then
+                  [
+                    "--role=replica"
+                    "--master-url=${cfg.primaryUrl}"
+                  ]
+                else
+                  [ "--role=master" ]
+              );
+          in
+          "${cfg.package}/bin/devpi-server ${concatStringsSep " " args}";
+        DynamicUser = true;
+        StateDirectory = stateDirName;
+        RuntimeDirectory = stateDirName;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        ProtectHome = true;
+        ProtectSystem = "strict";
+      };
+    };
+
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.port ];
+    };
+
+    meta.maintainers = [ cafkafk ];
+  };
+}
--- a/nixos/modules/services/security/oauth2-proxy-nginx.nix
+++ b/nixos/modules/services/security/oauth2-proxy-nginx.nix
@ -64,11 +64,11 @@ in
    };
  };

-  config.services.oauth2-proxy = lib.mkIf (cfg.virtualHosts != [] && (lib.hasPrefix "127.0.0.1:" cfg.proxy)) {
+  config.services.oauth2-proxy = lib.mkIf (cfg.virtualHosts != {} && (lib.hasPrefix "127.0.0.1:" cfg.proxy)) {
    enable = true;
  };

-  config.services.nginx = lib.mkIf (cfg.virtualHosts != [] && config.services.oauth2-proxy.enable) (lib.mkMerge ([
+  config.services.nginx = lib.mkIf (cfg.virtualHosts != {} && config.services.oauth2-proxy.enable) (lib.mkMerge ([
    {
      virtualHosts.${cfg.domain}.locations."/oauth2/" = {
        proxyPass = cfg.proxy;
@ -78,7 +78,7 @@ in
        '';
      };
    }
-  ] ++ lib.optional (cfg.virtualHosts != []) {
+  ] ++ lib.optional (cfg.virtualHosts != {}) {
    recommendedProxySettings = true; # needed because duplicate headers
  } ++ (lib.mapAttrsToList (vhost: conf: {
    virtualHosts.${vhost} = {
--- a/nixos/modules/services/web-apps/miniflux.nix
+++ b/nixos/modules/services/web-apps/miniflux.nix
@ -1,7 +1,7 @@
 { config, lib, pkgs, ... }:

-with lib;
 let
+  inherit (lib) mkEnableOption mkPackageOption mkOption types literalExpression mkIf mkDefault;
  cfg = config.services.miniflux;

  defaultAddress = "localhost:8080";
@ -20,8 +20,8 @@ in

      package = mkPackageOption pkgs "miniflux" { };

-      createDatabaseLocally = lib.mkOption {
-        type = lib.types.bool;
+      createDatabaseLocally = mkOption {
+        type = types.bool;
        default = true;
        description = ''
          Whether a PostgreSQL database should be automatically created and
@ -66,6 +66,7 @@ in
      DATABASE_URL = lib.mkIf cfg.createDatabaseLocally "user=miniflux host=/run/postgresql dbname=miniflux";
      RUN_MIGRATIONS = 1;
      CREATE_ADMIN = 1;
+      WATCHDOG = 1;
    };

    services.postgresql = lib.mkIf cfg.createDatabaseLocally {
@ -96,12 +97,18 @@ in
        ++ lib.optionals cfg.createDatabaseLocally [ "postgresql.service" "miniflux-dbsetup.service" ];

      serviceConfig = {
-        ExecStart = "${cfg.package}/bin/miniflux";
+        Type = "notify";
+        ExecStart = lib.getExe cfg.package;
        User = "miniflux";
        DynamicUser = true;
        RuntimeDirectory = "miniflux";
        RuntimeDirectoryMode = "0750";
        EnvironmentFile = cfg.adminCredentialsFile;
+        WatchdogSec = 60;
+        WatchdogSignal = "SIGKILL";
+        Restart = "always";
+        RestartSec = 5;
+
        # Hardening
        CapabilityBoundingSet = [ "" ];
        DeviceAllow = [ "" ];
--- a/nixos/modules/services/web-servers/caddy/default.nix
+++ b/nixos/modules/services/web-servers/caddy/default.nix
@ -365,7 +365,7 @@ in
        # If the empty string is assigned to this option, the list of commands to start is reset, prior assignments of this option will have no effect.
        ExecStart = [ "" ''${cfg.package}/bin/caddy run ${runOptions} ${optionalString cfg.resume "--resume"}'' ];
        # Validating the configuration before applying it ensures we’ll get a proper error that will be reported when switching to the configuration
-        ExecReload = [ "" ''${cfg.package}/bin/caddy reload ${runOptions} --force'' ];
+        ExecReload = [ "" ] ++ lib.optional cfg.enableReload "${lib.getExe cfg.package} reload ${runOptions} --force";
        User = cfg.user;
        Group = cfg.group;
        ReadWritePaths = [ cfg.dataDir ];
--- a/nixos/modules/services/web-servers/garage.nix
+++ b/nixos/modules/services/web-servers/garage.nix
@ -52,13 +52,6 @@ in
            type = types.path;
            description = "The main data storage, put this on your large storage (e.g. high capacity HDD)";
          };
-
-          replication_mode = mkOption {
-            default = "none";
-            type = types.enum ([ "none" "1" "2" "3" "2-dangerous" "3-dangerous" "3-degraded" 1 2 3 ]);
-            apply = v: toString v;
-            description = "Garage replication mode, defaults to none, see: <https://garagehq.deuxfleurs.fr/documentation/reference-manual/configuration/#replication-mode> for reference.";
-          };
        };
      };
      description = "Garage configuration, see <https://garagehq.deuxfleurs.fr/documentation/reference-manual/configuration/> for reference.";
@ -71,6 +64,24 @@ in
  };

  config = mkIf cfg.enable {
+
+    assertions = [
+      # We removed our module-level default for replication_mode. If a user upgraded
+      # to garage 1.0.0 while relying on the module-level default, they would be left
+      # with a config which evaluates and builds, but then garage refuses to start
+      # because either replication_factor or replication_mode is required.
+      # This assertion can be removed in NixOS 24.11, when all users have been warned once.
+      {
+        assertion = (cfg.settings ? replication_factor || cfg.settings ? replication_mode) || lib.versionOlder cfg.package "1.0.0";
+        message = ''
+          Garage 1.0.0 requires an explicit replication factor to be set.
+          Please set replication_factor to 1 explicitly to preserve the previous behavior.
+          https://git.deuxfleurs.fr/Deuxfleurs/garage/src/tag/v1.0.0/doc/book/reference-manual/configuration.md#replication_factor
+
+        '';
+      }
+    ];
+
    environment.etc."garage.toml" = {
      source = configFile;
    };
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@ -728,9 +728,6 @@ in
            rm -f /tmp/.X0-lock
          '';

-        # TODO: move declaring the systemd service to its own mkIf
-        script = mkIf (config.systemd.services.display-manager.enable == true) "${config.services.displayManager.execCmd}";
-
        # Stop restarting if the display manager stops (crashes) 2 times
        # in one minute. Starting X typically takes 3-4s.
        startLimitIntervalSec = 30;
--- a/nixos/modules/system/activation/switchable-system.nix
+++ b/nixos/modules/system/activation/switchable-system.nix
@ -4,52 +4,93 @@ let

  perlWrapped = pkgs.perl.withPackages (p: with p; [ ConfigIniFiles FileSlurp ]);

+  description = extra: ''
+    Whether to include the capability to switch configurations.
+
+    Disabling this makes the system unable to be reconfigured via `nixos-rebuild`.
+
+    ${extra}
+  '';
+
 in

 {

-  options = {
-    system.switch.enable = lib.mkOption {
+  options.system.switch = {
+    enable = lib.mkOption {
      type = lib.types.bool;
      default = true;
-      description = ''
-        Whether to include the capability to switch configurations.
-
-        Disabling this makes the system unable to be reconfigured via `nixos-rebuild`.
-
+      description = description ''
        This is good for image based appliances where updates are handled
        outside the image. Reducing features makes the image lighter and
        slightly more secure.
      '';
    };
+
+    enableNg = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = description ''
+        Whether to use `switch-to-configuration-ng`, an experimental
+        re-implementation of `switch-to-configuration` with the goal of
+        replacing the original.
+      '';
+    };
  };

-  config = lib.mkIf config.system.switch.enable {
-    system.activatableSystemBuilderCommands = ''
-      mkdir $out/bin
-      substitute ${./switch-to-configuration.pl} $out/bin/switch-to-configuration \
-        --subst-var out \
-        --subst-var-by toplevel ''${!toplevelVar} \
-        --subst-var-by coreutils "${pkgs.coreutils}" \
-        --subst-var-by distroId ${lib.escapeShellArg config.system.nixos.distroId} \
-        --subst-var-by installBootLoader ${lib.escapeShellArg config.system.build.installBootLoader} \
-        --subst-var-by localeArchive "${config.i18n.glibcLocales}/lib/locale/locale-archive" \
-        --subst-var-by perl "${perlWrapped}" \
-        --subst-var-by shell "${pkgs.bash}/bin/sh" \
-        --subst-var-by su "${pkgs.shadow.su}/bin/su" \
-        --subst-var-by systemd "${config.systemd.package}" \
-        --subst-var-by utillinux "${pkgs.util-linux}" \
-        ;
+  config = lib.mkMerge [
+    {
+      assertions = [{
+        assertion = with config.system.switch; enable -> !enableNg;
+        message = "Only one of system.switch.enable and system.switch.enableNg may be enabled at a time";
+      }];
+    }
+    (lib.mkIf config.system.switch.enable {
+      system.activatableSystemBuilderCommands = ''
+        mkdir $out/bin
+        substitute ${./switch-to-configuration.pl} $out/bin/switch-to-configuration \
+          --subst-var out \
+          --subst-var-by toplevel ''${!toplevelVar} \
+          --subst-var-by coreutils "${pkgs.coreutils}" \
+          --subst-var-by distroId ${lib.escapeShellArg config.system.nixos.distroId} \
+          --subst-var-by installBootLoader ${lib.escapeShellArg config.system.build.installBootLoader} \
+          --subst-var-by localeArchive "${config.i18n.glibcLocales}/lib/locale/locale-archive" \
+          --subst-var-by perl "${perlWrapped}" \
+          --subst-var-by shell "${pkgs.bash}/bin/sh" \
+          --subst-var-by su "${pkgs.shadow.su}/bin/su" \
+          --subst-var-by systemd "${config.systemd.package}" \
+          --subst-var-by utillinux "${pkgs.util-linux}" \
+          ;

-      chmod +x $out/bin/switch-to-configuration
-      ${lib.optionalString (pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform) ''
-        if ! output=$(${perlWrapped}/bin/perl -c $out/bin/switch-to-configuration 2>&1); then
-          echo "switch-to-configuration syntax is not valid:"
-          echo "$output"
-          exit 1
-        fi
-      ''}
-    '';
-  };
+        chmod +x $out/bin/switch-to-configuration
+        ${lib.optionalString (pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform) ''
+          if ! output=$(${perlWrapped}/bin/perl -c $out/bin/switch-to-configuration 2>&1); then
+            echo "switch-to-configuration syntax is not valid:"
+            echo "$output"
+            exit 1
+          fi
+        ''}
+      '';
+    })
+    (lib.mkIf config.system.switch.enableNg {
+      # Use a subshell so we can source makeWrapper's setup hook without
+      # affecting the rest of activatableSystemBuilderCommands.
+      system.activatableSystemBuilderCommands = ''
+        (
+          source ${pkgs.buildPackages.makeWrapper}/nix-support/setup-hook
+
+          mkdir $out/bin
+          ln -sf ${lib.getExe pkgs.switch-to-configuration-ng} $out/bin/switch-to-configuration
+          wrapProgram $out/bin/switch-to-configuration \
+            --set OUT $out \
+            --set TOPLEVEL ''${!toplevelVar} \
+            --set DISTRO_ID ${lib.escapeShellArg config.system.nixos.distroId} \
+            --set INSTALL_BOOTLOADER ${lib.escapeShellArg config.system.build.installBootLoader} \
+            --set LOCALE_ARCHIVE ${config.i18n.glibcLocales}/lib/locale/locale-archive \
+            --set SYSTEMD ${config.systemd.package}
+        )
+      '';
+    })
+  ];

 }
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -243,6 +243,7 @@ in {
  deepin = handleTest ./deepin.nix {};
  deluge = handleTest ./deluge.nix {};
  dendrite = handleTest ./matrix/dendrite.nix {};
+  devpi-server = handleTest ./devpi-server.nix {};
  dex-oidc = handleTest ./dex-oidc.nix {};
  dhparams = handleTest ./dhparams.nix {};
  disable-installer-tools = handleTest ./disable-installer-tools.nix {};
@ -872,7 +873,8 @@ in {
  swap-random-encryption = handleTest ./swap-random-encryption.nix {};
  sway = handleTest ./sway.nix {};
  swayfx = handleTest ./swayfx.nix {};
-  switchTest = handleTest ./switch-test.nix {};
+  switchTest = handleTest ./switch-test.nix { ng = false; };
+  switchTestNg = handleTest ./switch-test.nix { ng = true; };
  sympa = handleTest ./sympa.nix {};
  syncthing = handleTest ./syncthing.nix {};
  syncthing-no-settings = handleTest ./syncthing-no-settings.nix {};
@ -1038,6 +1040,7 @@ in {
  xterm = handleTest ./xterm.nix {};
  xxh = handleTest ./xxh.nix {};
  yabar = handleTest ./yabar.nix {};
+  ydotool = handleTest ./ydotool.nix {};
  yggdrasil = handleTest ./yggdrasil.nix {};
  zammad = handleTest ./zammad.nix {};
  zeronet-conservancy = handleTest ./zeronet-conservancy.nix {};
--- a/nixos/tests/devpi-server.nix
+++ b/nixos/tests/devpi-server.nix
@ -0,0 +1,35 @@
+import ./make-test-python.nix ({pkgs, ...}: let
+  server-port = 3141;
+in {
+  name = "devpi-server";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [cafkafk];
+  };
+
+  nodes = {
+    devpi = {...}: {
+      services.devpi-server = {
+        enable = true;
+        host = "0.0.0.0";
+        port = server-port;
+        openFirewall = true;
+        secretFile = pkgs.writeText "devpi-secret" "v263P+V3YGDYUyfYL/RBURw+tCPMDw94R/iCuBNJrDhaYrZYjpA6XPFVDDH8ViN20j77y2PHoMM/U0opNkVQ2g==";
+      };
+    };
+
+    client1 = {...}: {
+      environment.systemPackages = with pkgs; [
+        devpi-client
+        jq
+      ];
+    };
+  };
+
+  testScript = ''
+    start_all()
+    devpi.wait_for_unit("devpi-server.service")
+    devpi.wait_for_open_port(${builtins.toString server-port})
+
+    client1.succeed("devpi getjson http://devpi:${builtins.toString server-port}")
+  '';
+})
--- a/nixos/tests/fcitx5/default.nix
+++ b/nixos/tests/fcitx5/default.nix
@ -89,10 +89,13 @@ rec {
            machine.succeed("xauth merge ${xauth}")
            machine.sleep(5)

+            machine.wait_until_succeeds("pgrep fcitx5")
            machine.succeed("su - ${user.name} -c 'kill $(pgrep fcitx5)'")
            machine.sleep(1)

            machine.succeed("su - ${user.name} -c 'alacritty >&2 &'")
+            machine.wait_for_window("alice@machine")
+
            machine.succeed("su - ${user.name} -c 'fcitx5 >&2 &'")
            machine.sleep(10)

--- a/nixos/tests/pgvecto-rs.nix
+++ b/nixos/tests/pgvecto-rs.nix
@ -66,7 +66,7 @@ let
    '';

  };
-  applicablePostgresqlVersions = filterAttrs (_: value: versionAtLeast value.version "12") postgresql-versions;
+  applicablePostgresqlVersions = filterAttrs (_: value: versionAtLeast value.version "14") postgresql-versions;
 in
 mapAttrs'
  (name: package: {
--- a/nixos/tests/switch-test.nix
+++ b/nixos/tests/switch-test.nix
@ -1,6 +1,6 @@
 # Test configuration switching.

-import ./make-test-python.nix ({ lib, pkgs, ...} : let
+import ./make-test-python.nix ({ lib, pkgs, ng, ...} : let

  # Simple service that can either be socket-activated or that will
  # listen on port 1234 if not socket-activated.
@ -48,6 +48,11 @@ in {

  nodes = {
    machine = { pkgs, lib, ... }: {
+      system.switch = {
+        enable = !ng;
+        enableNg = ng;
+      };
+
      environment.systemPackages = [ pkgs.socat ]; # for the socket activation stuff
      users.mutableUsers = false;

--- a/nixos/tests/systemd-initrd-modprobe.nix
+++ b/nixos/tests/systemd-initrd-modprobe.nix
@ -4,21 +4,21 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
  nodes.machine = { pkgs, ... }: {
    testing.initrdBackdoor = true;
    boot.initrd.systemd.enable = true;
-    boot.initrd.kernelModules = [ "loop" ]; # Load module in initrd.
+    boot.initrd.kernelModules = [ "tcp_hybla" ]; # Load module in initrd.
    boot.extraModprobeConfig = ''
-      options loop max_loop=42
+      options tcp_hybla rtt0=42
    '';
  };

  testScript = ''
    machine.wait_for_unit("initrd.target")
-    max_loop = machine.succeed("cat /sys/module/loop/parameters/max_loop")
-    assert int(max_loop) == 42, "Parameter should be respected for initrd kernel modules"
+    rtt = machine.succeed("cat /sys/module/tcp_hybla/parameters/rtt0")
+    assert int(rtt) == 42, "Parameter should be respected for initrd kernel modules"

    # Make sure it sticks in stage 2
    machine.switch_root()
    machine.wait_for_unit("multi-user.target")
-    max_loop = machine.succeed("cat /sys/module/loop/parameters/max_loop")
-    assert int(max_loop) == 42, "Parameter should be respected for initrd kernel modules"
+    rtt = machine.succeed("cat /sys/module/tcp_hybla/parameters/rtt0")
+    assert int(rtt) == 42, "Parameter should be respected for initrd kernel modules"
  '';
 })
--- a/nixos/tests/ydotool.nix
+++ b/nixos/tests/ydotool.nix
@ -0,0 +1,115 @@
+import ./make-test-python.nix (
+  { pkgs, lib, ... }:
+  let
+    textInput = "This works.";
+    inputBoxText = "Enter input";
+    inputBox = pkgs.writeShellScript "zenity-input" ''
+      ${lib.getExe pkgs.gnome.zenity} --entry --text '${inputBoxText}:' > /tmp/output &
+    '';
+  in
+  {
+    name = "ydotool";
+
+    meta = {
+      maintainers = with lib.maintainers; [
+        OPNA2608
+        quantenzitrone
+      ];
+    };
+
+    nodes = {
+      headless =
+        { config, ... }:
+        {
+          imports = [ ./common/user-account.nix ];
+
+          users.users.alice.extraGroups = [ "ydotool" ];
+
+          programs.ydotool.enable = true;
+
+          services.getty.autologinUser = "alice";
+        };
+
+      x11 =
+        { config, ... }:
+        {
+          imports = [
+            ./common/user-account.nix
+            ./common/auto.nix
+            ./common/x11.nix
+          ];
+
+          users.users.alice.extraGroups = [ "ydotool" ];
+
+          programs.ydotool.enable = true;
+
+          test-support.displayManager.auto = {
+            enable = true;
+            user = "alice";
+          };
+
+          services.xserver.windowManager.dwm.enable = true;
+          services.displayManager.defaultSession = lib.mkForce "none+dwm";
+        };
+
+      wayland =
+        { config, ... }:
+        {
+          imports = [ ./common/user-account.nix ];
+
+          services.cage = {
+            enable = true;
+            user = "alice";
+          };
+
+          programs.ydotool.enable = true;
+
+          services.cage.program = inputBox;
+        };
+    };
+
+    enableOCR = true;
+
+    testScript =
+      { nodes, ... }:
+      ''
+        def as_user(cmd: str):
+          """
+          Return a shell command for running a shell command as a specific user.
+          """
+          return f"sudo -u alice -i {cmd}"
+
+        start_all()
+
+        # Headless
+        headless.wait_for_unit("multi-user.target")
+        headless.wait_for_text("alice")
+        headless.succeed(as_user("ydotool type 'echo ${textInput} > /tmp/output'")) # text input
+        headless.succeed(as_user("ydotool key 28:1 28:0")) # text input
+        headless.screenshot("headless_input")
+        headless.wait_for_file("/tmp/output")
+        headless.wait_until_succeeds("grep '${textInput}' /tmp/output") # text input
+
+        # X11
+        x11.wait_for_x()
+        x11.execute(as_user("${inputBox}"))
+        x11.wait_for_text("${inputBoxText}")
+        x11.succeed(as_user("ydotool type '${textInput}'")) # text input
+        x11.screenshot("x11_input")
+        x11.succeed(as_user("ydotool mousemove -a 400 110")) # mouse input
+        x11.succeed(as_user("ydotool click 0xC0")) # mouse input
+        x11.wait_for_file("/tmp/output")
+        x11.wait_until_succeeds("grep '${textInput}' /tmp/output") # text input
+
+        # Wayland
+        wayland.wait_for_unit("graphical.target")
+        wayland.wait_for_text("${inputBoxText}")
+        wayland.succeed("ydotool type '${textInput}'") # text input
+        wayland.screenshot("wayland_input")
+        wayland.succeed("ydotool mousemove -a 100 100") # mouse input
+        wayland.succeed("ydotool click 0xC0") # mouse input
+        wayland.wait_for_file("/tmp/output")
+        wayland.wait_until_succeeds("grep '${textInput}' /tmp/output") # text input
+      '';
+  }
+)
--- a/pkgs/applications/audio/go-musicfox/default.nix
+++ b/pkgs/applications/audio/go-musicfox/default.nix
@ -9,18 +9,18 @@

 buildGoModule rec {
  pname = "go-musicfox";
-  version = "4.3.3";
+  version = "4.4.0";

  src = fetchFromGitHub {
    owner = "go-musicfox";
    repo = "go-musicfox";
    rev = "v${version}";
-    hash = "sha256-J6R3T92cHFUkKwc+GKm612tVjglP2Tc/kDUmzUMhvio=";
+    hash = "sha256-11N3dykuEDKAryieNVaPfb3G7E/a4A7Znx9rBvFTHC4=";
  };

  deleteVendor = true;

-  vendorHash = "sha256-KSIdBEEvYaYcDIDmzfRO857I8FSN4Ajw6phAPQLYEqg=";
+  vendorHash = "sha256-ey78zeCSEuRgteG5ZRb4uO88E6lwEgqSxKfjJg3NGT4=";

  subPackages = [ "cmd/musicfox.go" ];

--- a/pkgs/applications/audio/squeezelite/default.nix
+++ b/pkgs/applications/audio/squeezelite/default.nix
@ -45,13 +45,13 @@ stdenv.mkDerivation {
  pname = binName;
  # versions are specified in `squeezelite.h`
  # see https://github.com/ralph-irving/squeezelite/issues/29
-  version = "2.0.0.1486";
+  version = "2.0.0.1488";

  src = fetchFromGitHub {
    owner = "ralph-irving";
    repo = "squeezelite";
-    rev = "fd4a82e7d0e53124d9618320f3c115d90654509d";
-    hash = "sha256-nR2Px7VYjAktUsueEyBAV2392+/dX6JYIy7YSMh05c0=";
+    rev = "0e85ddfd79337cdc30b7d29922b1d790600bb6b4";
+    hash = "sha256-FGqo/c74JN000w/iRnvYUejqnYGDzHNZu9pEmR7yR3s=";
  };

  buildInputs = [ flac libmad libvorbis mpg123 ]
--- a/pkgs/applications/blockchains/bitcoin-knots/default.nix
+++ b/pkgs/applications/blockchains/bitcoin-knots/default.nix
@ -25,11 +25,11 @@

 stdenv.mkDerivation rec {
  pname = if withGui then "bitcoin-knots" else "bitcoind-knots";
-  version = "25.1.knots20231115";
+  version = "26.1.knots20240325";

  src = fetchurl {
-    url = "https://bitcoinknots.org/files/25.x/${version}/bitcoin-${version}.tar.gz";
-    sha256 = "b6251beee95cf6701c6ebc443b47fb0e99884880f2661397f964a8828add4002";
+    url = "https://bitcoinknots.org/files/26.x/${version}/bitcoin-${version}.tar.gz";
+    hash = "sha256-PqpePDna2gpCzF2K43N4h6cV5Y9w/e5ZcUvaNEaFaIk=";
  };

  nativeBuildInputs =
@ -40,7 +40,8 @@ stdenv.mkDerivation rec {
    ++ lib.optionals withGui [ wrapQtAppsHook ];

  buildInputs = [ boost libevent miniupnpc zeromq zlib ]
-    ++ lib.optionals withWallet [ db48 sqlite ]
+    ++ lib.optionals withWallet [ sqlite ]
+    ++ lib.optionals (withWallet && !stdenv.isDarwin) [ db48 ]
    ++ lib.optionals withGui [ qrencode qtbase qttools ];

  configureFlags = [
--- a/pkgs/applications/editors/kakoune/default.nix
+++ b/pkgs/applications/editors/kakoune/default.nix
@ -1,30 +1,18 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch }:
+{ lib, stdenv, fetchFromGitHub }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "kakoune-unwrapped";
-  version = "2023.08.05";
+  version = "2024.05.09";
  src = fetchFromGitHub {
    repo = "kakoune";
    owner = "mawww";
-    rev = "v${version}";
-    sha256 = "sha256-RR3kw39vEjsg+6cIY6cK2i3ecGHlr1yzuBKaDtGlOGo=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-Dfp33zk9ZUMrCZRfPNfoSX6rgQKItvOQx+CuRNQgtTA=";
  };
-  patches = [
-    # Use explicit target types for gather calls to bypass clang regression
-    #
-    # Since clang-16 there has been a regression in the P0522R0 support.
-    # (Bug report at https://github.com/llvm/llvm-project/issue/63281)
-    #
-    # Closes mawww/kakoune#4892
-    (fetchpatch {
-      url = "https://github.com/mawww/kakoune/commit/7577fa1b668ea81eb9b7b9af690a4161187129dd.patch";
-      hash = "sha256-M0jKaEDhkpvX+n7k8Jf2lWaRNy8bqZ1kRHR4eG4npss=";
-    })
-  ];
  makeFlags = [ "debug=no" "PREFIX=${placeholder "out"}" ];

-  preConfigure = ''
-    export version="v${version}"
+  postPatch = ''
+    echo "v${finalAttrs.version}" >.version
  '';

  enableParallelBuilding = true;
@ -51,4 +39,4 @@ stdenv.mkDerivation rec {
    maintainers = with maintainers; [ vrthra ];
    platforms = platforms.unix;
  };
-}
+})
--- a/pkgs/applications/editors/vim/plugins/deprecated.json
+++ b/pkgs/applications/editors/vim/plugins/deprecated.json
@ -7,6 +7,14 @@
        "date": "2021-12-21",
        "new": "cmp-tmux"
    },
+    "fern-vim": {
+        "date": "2024-05-12",
+        "new": "vim-fern"
+    },
+    "gina-vim": {
+        "date": "2024-05-12",
+        "new": "vim-gina"
+    },
    "gist-vim": {
        "date": "2020-03-27",
        "new": "vim-gist"
@ -47,8 +55,12 @@
        "date": "2021-09-03",
        "new": "sqlite-lua"
    },
+    "suda-vim": {
+        "date": "2024-05-12",
+        "new": "vim-suda"
+    },
    "vim-fsharp": {
-        "date": "2024-05-06",
+        "date": "2024-05-12",
        "new": "zarchive-vim-fsharp"
    },
    "vim-jade": {
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@ -27,12 +27,12 @@
  };
  angular = buildGrammar {
    language = "angular";
-    version = "0.0.0+rev=f12fc56";
+    version = "0.0.0+rev=10f21f3";
    src = fetchFromGitHub {
      owner = "dlvandenberg";
      repo = "tree-sitter-angular";
-      rev = "f12fc56469d778285fb35b5bdb943edcfe77c48a";
-      hash = "sha256-BR9siCgn3jPwlC1+HgJEo3N8I36nr0KGaOO2zWLv9T4=";
+      rev = "10f21f3f1b10584e62ecc113ab3cda1196d0ceb8";
+      hash = "sha256-hBvDFLIN4n0dbpH8FKe0sY8t4Jwa0GtrLt2GG04Qgn8=";
    };
    meta.homepage = "https://github.com/dlvandenberg/tree-sitter-angular";
  };
@ -50,12 +50,12 @@
  };
  arduino = buildGrammar {
    language = "arduino";
-    version = "0.0.0+rev=8518c3f";
+    version = "0.0.0+rev=babb6d4";
    src = fetchFromGitHub {
      owner = "ObserverOfTime";
      repo = "tree-sitter-arduino";
-      rev = "8518c3fa6b8562af545a496d55c9abd78f53e732";
-      hash = "sha256-slPZSjN9SJQj4d5NDpxL1DbnnYia1Aroh7/bQJA2P0Q=";
+      rev = "babb6d4da69b359bbb80adbf1fe39c0da9175210";
+      hash = "sha256-nA/4SRlXfm8hMZw/GOQFAxzoPNAzVP0cCnHLc1ZawXU=";
    };
    meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-arduino";
  };
@ -105,12 +105,12 @@
  };
  bash = buildGrammar {
    language = "bash";
-    version = "0.0.0+rev=f8fb327";
+    version = "0.0.0+rev=2fbd860";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-bash";
-      rev = "f8fb3274f72a30896075585b32b0c54cad65c086";
-      hash = "sha256-sj1qYb42k0hXXcNCKg1hINYD11wDcVpnoPhZNtlYT6k=";
+      rev = "2fbd860f802802ca76a6661ce025b3a3bca2d3ed";
+      hash = "sha256-rCuQbnQAOnQWKYreNH80nlL+0A1qbWbjMvtczcoWPrY=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-bash";
  };
@ -182,23 +182,23 @@
  };
  c = buildGrammar {
    language = "c";
-    version = "0.0.0+rev=1aafaff";
+    version = "0.0.0+rev=82fb86a";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-c";
-      rev = "1aafaff4d26dac5a36dd3495be33e1c20161d761";
-      hash = "sha256-eix/BqsZzrJc+h1sHiG/IDtdyZvIsEdox71sPMNXs58=";
+      rev = "82fb86aa544843bd17a9f0f3dc16edf645a34349";
+      hash = "sha256-wiCgRSrJodNq7WVQTIDsQ6K/ZrgnSFdGG9kDegu6zGs=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-c";
  };
  c_sharp = buildGrammar {
    language = "c_sharp";
-    version = "0.0.0+rev=e1384e2";
+    version = "0.0.0+rev=82fa8f0";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-c-sharp";
-      rev = "e1384e2f132936019b43aaaae154cd780fb497ce";
-      hash = "sha256-TxmJCKs7wqkceczHtOCVSzhlIZmpY86MuQo05Yy4J98=";
+      rev = "82fa8f05f41a33e9bc830f85d74a9548f0291738";
+      hash = "sha256-5GkU3/yVMCnNvNssad3vEIN8PlbLeQsRBlwgH2KUrBo=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-c-sharp";
  };
@ -259,12 +259,12 @@
  };
  comment = buildGrammar {
    language = "comment";
-    version = "0.0.0+rev=aefcc28";
+    version = "0.0.0+rev=5d8b29f";
    src = fetchFromGitHub {
      owner = "stsewd";
      repo = "tree-sitter-comment";
-      rev = "aefcc2813392eb6ffe509aa0fc8b4e9b57413ee1";
-      hash = "sha256-ihkBqdYVulTlysb9J8yg4c5XVktJw8jIwzhqybBw8Ug=";
+      rev = "5d8b29f6ef3bf64d59430dcfe76b31cc44b5abfd";
+      hash = "sha256-19jxH6YK3Rn0fOGSiWen5/eNKPKUSXVsIYB/QAPEA1I=";
    };
    meta.homepage = "https://github.com/stsewd/tree-sitter-comment";
  };
@ -325,12 +325,12 @@
  };
  css = buildGrammar {
    language = "css";
-    version = "0.0.0+rev=2e868a7";
+    version = "0.0.0+rev=f6be52c";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-css";
-      rev = "2e868a75a518531656b493cba36ef60d8c61cc89";
-      hash = "sha256-KGhTAYeuEkEDbKyKAI359RXpcdFjVHxWNLPAjZ4l+68=";
+      rev = "f6be52c3d1cdb1c5e4dd7d8bce0a57497f55d6af";
+      hash = "sha256-V1KrNM5C03RcRYcRIPxxfyWlnQkbyAevTHuZINn3Bdc=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-css";
  };
@ -348,12 +348,12 @@
  };
  cuda = buildGrammar {
    language = "cuda";
-    version = "0.0.0+rev=c794560";
+    version = "0.0.0+rev=e7878a9";
    src = fetchFromGitHub {
      owner = "theHamsta";
      repo = "tree-sitter-cuda";
-      rev = "c794560823013fc4cc29944d862b7158d9585408";
-      hash = "sha256-YiLsKDLiiH8JUFdnaqYrEk7xy4IIAFUFVSjwhXEoD8U=";
+      rev = "e7878a9cf4157e9d6c8013ff5605c9f26d62894d";
+      hash = "sha256-1UCYWY6DvanLdFeS0ALHG3eJT/Rk/muZTkFm3YwF5II=";
    };
    meta.homepage = "https://github.com/theHamsta/tree-sitter-cuda";
  };
@ -447,12 +447,12 @@
  };
  dockerfile = buildGrammar {
    language = "dockerfile";
-    version = "0.0.0+rev=439c3e7";
+    version = "0.0.0+rev=087daa2";
    src = fetchFromGitHub {
      owner = "camdencheek";
      repo = "tree-sitter-dockerfile";
-      rev = "439c3e7b8a9bfdbf1f7d7c2beaae4173dc484cbf";
-      hash = "sha256-sW3fCCAXNak4JszEPgspZFfOHtUlqnW3eRxzHNfzInk=";
+      rev = "087daa20438a6cc01fa5e6fe6906d77c869d19fe";
+      hash = "sha256-uDRDq6MYYV8nh6FDsQN3tdyZywEg8A224bfWrgFGvFs=";
    };
    meta.homepage = "https://github.com/camdencheek/tree-sitter-dockerfile";
  };
@ -480,12 +480,12 @@
  };
  dtd = buildGrammar {
    language = "dtd";
-    version = "0.0.0+rev=5910ee2";
+    version = "0.0.0+rev=648183d";
    src = fetchFromGitHub {
      owner = "tree-sitter-grammars";
      repo = "tree-sitter-xml";
-      rev = "5910ee285378e07ff1e63a9f5d21898f62310aed";
-      hash = "sha256-X/DhTD/cNWoBxWvBBwPmGqAUtJjWkvo0PnbFK/lrTUg=";
+      rev = "648183d86f6f8ffb240ea11b4c6873f6f45d8b67";
+      hash = "sha256-O40z5VYmFeE8pkJ85Vu5DWV31YslIrwD80+4qnpoRNY=";
    };
    location = "dtd";
    meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-xml";
@ -581,12 +581,12 @@
  };
  embedded_template = buildGrammar {
    language = "embedded_template";
-    version = "0.0.0+rev=6d791b8";
+    version = "0.0.0+rev=38d5004";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-embedded-template";
-      rev = "6d791b897ecda59baa0689a85a9906348a2a6414";
-      hash = "sha256-I4L3mxkAnmKs+BiNRDAs58QFD2r8jN1B2yv0dZdgkzQ=";
+      rev = "38d5004a797298dc42c85e7706c5ceac46a3f29f";
+      hash = "sha256-IPPCexaq42Em5A+kmrj5e/SFrXoKdWCTYAL/TWvbDJ0=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-embedded-template";
  };
@ -812,12 +812,12 @@
  };
  gleam = buildGrammar {
    language = "gleam";
-    version = "0.0.0+rev=a0b11a1";
+    version = "0.0.0+rev=8432ffe";
    src = fetchFromGitHub {
      owner = "gleam-lang";
      repo = "tree-sitter-gleam";
-      rev = "a0b11a15935b95848176c747a8b5776752d90d7c";
-      hash = "sha256-h7IDqQpqPFC5WwR2fPxCKLvvdYCFqm5CPf6EJ36qsxQ=";
+      rev = "8432ffe32ccd360534837256747beb5b1c82fca1";
+      hash = "sha256-PO01z8vyzDT4ZGPxgZl9PPsp/gktT2TaCwutMy87i8E=";
    };
    meta.homepage = "https://github.com/gleam-lang/tree-sitter-gleam";
  };
@ -834,12 +834,12 @@
  };
  glsl = buildGrammar {
    language = "glsl";
-    version = "0.0.0+rev=9f61177";
+    version = "0.0.0+rev=8c9fb41";
    src = fetchFromGitHub {
      owner = "theHamsta";
      repo = "tree-sitter-glsl";
-      rev = "9f611774fb5b95993e31e03f137b4a689c63f827";
-      hash = "sha256-WLKfP4gE2bOU5ksDmbcTdf6Gud8BoFOv3wX6UyNgkvM=";
+      rev = "8c9fb41836dc202bbbcf0e2369f256055786dedb";
+      hash = "sha256-aUM0gisdoV3A9lWSjn21wXIBI8ZrKI/5IffAaf917e4=";
    };
    meta.homepage = "https://github.com/theHamsta/tree-sitter-glsl";
  };
@ -867,12 +867,12 @@
  };
  go = buildGrammar {
    language = "go";
-    version = "0.0.0+rev=eb68645";
+    version = "0.0.0+rev=7ee8d92";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-go";
-      rev = "eb68645662a3f7bf7fdd4bcb9531585f54c8570e";
-      hash = "sha256-RZx8M3QGX/+kfjbEB0+f2jeDZhGF+XGXwtb5oltxHrI=";
+      rev = "7ee8d928db5202f6831a78f8112fd693bf69f98b";
+      hash = "sha256-ARfpfMSXy+DpvUMJvUgjgReoyvGbrVwYutZD91JA4qc=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-go";
  };
@ -999,12 +999,12 @@
  };
  haskell = buildGrammar {
    language = "haskell";
-    version = "0.0.0+rev=af32d88";
+    version = "0.0.0+rev=a50070d";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-haskell";
-      rev = "af32d884088ce7b74541b5e51820baa7e305caae";
-      hash = "sha256-w4F1PtVjg7FWPRQQMSV8nU7GwCISiCgaIre+S63N+T0=";
+      rev = "a50070d5bb5bd5c1281740a6102ecf1f4b0c4f19";
+      hash = "sha256-huO0Ly9JYQbT64o/AjdZrE9vghQ5vT+/iQl50o4TJ0I=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-haskell";
  };
@ -1066,12 +1066,12 @@
  };
  hlsl = buildGrammar {
    language = "hlsl";
-    version = "0.0.0+rev=de5d490";
+    version = "0.0.0+rev=feea0ff";
    src = fetchFromGitHub {
      owner = "theHamsta";
      repo = "tree-sitter-hlsl";
-      rev = "de5d490e52aa7be2a877df7022f93dff05f03eb9";
-      hash = "sha256-5eHyyk6m8VNjenjM1xDBhZcROwzSm/O+9GtgyiXNHFc=";
+      rev = "feea0ff6eccda8be958c133985dca8977db3d887";
+      hash = "sha256-VIrNt9pjNtwVbQKZGPota5blxbPGGEhdiRYtPNU/XtA=";
    };
    meta.homepage = "https://github.com/theHamsta/tree-sitter-hlsl";
  };
@ -1165,12 +1165,12 @@
  };
  idl = buildGrammar {
    language = "idl";
-    version = "0.0.0+rev=d9a260e";
+    version = "0.0.0+rev=e885d7f";
    src = fetchFromGitHub {
      owner = "cathaysia";
      repo = "tree-sitter-idl";
-      rev = "d9a260eda455deaa36d2edf398963b0736ed0845";
-      hash = "sha256-4NQmZ8H5mmKQDaPlKkAgDKfARjM+m6G9Wb7PcQk+NS0=";
+      rev = "e885d7fd66c2549b7a28172400d645d27656f5cb";
+      hash = "sha256-japZBj8H+NTTw/Ne7prSjhZD6idcLjPCKEB3OjSSoxc=";
    };
    meta.homepage = "https://github.com/cathaysia/tree-sitter-idl";
  };
@ -1231,12 +1231,12 @@
  };
  javascript = buildGrammar {
    language = "javascript";
-    version = "0.0.0+rev=c002746";
+    version = "0.0.0+rev=e88537c";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-javascript";
-      rev = "c0027460e8f9629afeeb27f7949ecf961c82d707";
-      hash = "sha256-/h8h+Rxabs+uBs/c9K1nc/K7viygBhuH3DJbqeQSCpI=";
+      rev = "e88537c2703546f3f0887dd3f16898e1749cdba5";
+      hash = "sha256-/poR9qMfjWKJW6aw0s6VjNh7fkf/HvUJNZIeZ1YEwVM=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-javascript";
  };
@ -1253,23 +1253,23 @@
  };
  jsdoc = buildGrammar {
    language = "jsdoc";
-    version = "0.0.0+rev=6a6cf9e";
+    version = "0.0.0+rev=49fde20";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-jsdoc";
-      rev = "6a6cf9e7341af32d8e2b2e24a37fbfebefc3dc55";
-      hash = "sha256-fKscFhgZ/BQnYnE5EwurFZgiE//O0WagRIHVtDyes/Y=";
+      rev = "49fde205b59a1d9792efc21ee0b6d50bbd35ff14";
+      hash = "sha256-Mfau8071UiotdSS+/W9kQWhKF7BCRI8WtRxss/U0GQw=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-jsdoc";
  };
  json = buildGrammar {
    language = "json";
-    version = "0.0.0+rev=80e623c";
+    version = "0.0.0+rev=94f5c52";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-json";
-      rev = "80e623c2165887f9829357acfa9c0a0bab34a3cd";
-      hash = "sha256-waejAbS7MjrE7w03MPqvBRpEpqTcKc6RgKCVSYaDV1Y=";
+      rev = "94f5c527b2965465956c2000ed6134dd24daf2a7";
+      hash = "sha256-16/ZRjRolUC/iN7ASrNnXNSkfohBlSqyyYAz4nka6pM=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-json";
  };
@ -1352,12 +1352,12 @@
  };
  kotlin = buildGrammar {
    language = "kotlin";
-    version = "0.0.0+rev=eca05ed";
+    version = "0.0.0+rev=c9cb850";
    src = fetchFromGitHub {
      owner = "fwcd";
      repo = "tree-sitter-kotlin";
-      rev = "eca05edbab1918d7d36a0d30d086ba7b6b1e8803";
-      hash = "sha256-cmtUGmytAgiqBi31CNxEX+vE3YXmH1hphsIHvGRd7SY=";
+      rev = "c9cb8504b81684375e7beb8907517dbd6947a1be";
+      hash = "sha256-fuEKCtCzaWOp0gKrsPMOW9oGOXnM2Qb652Nhn1lc1eA=";
    };
    meta.homepage = "https://github.com/fwcd/tree-sitter-kotlin";
  };
@ -1385,12 +1385,12 @@
  };
  lalrpop = buildGrammar {
    language = "lalrpop";
-    version = "0.0.0+rev=123d8b4";
+    version = "0.0.0+rev=854a40e";
    src = fetchFromGitHub {
      owner = "traxys";
      repo = "tree-sitter-lalrpop";
-      rev = "123d8b472e949b59f348c32e245107a34a3d8945";
-      hash = "sha256-+06eppRj7TynVYOMs30/7kUM69RqdmryIoBuiZJ7DvY=";
+      rev = "854a40e99f7c70258e522bdb8ab584ede6196e2e";
+      hash = "sha256-rVWmYF26DbPHoNRBv9FKEeacSbgw93PHy/wrQDGzlWk=";
    };
    meta.homepage = "https://github.com/traxys/tree-sitter-lalrpop";
  };
@ -1608,12 +1608,12 @@
  };
  mlir = buildGrammar {
    language = "mlir";
-    version = "0.0.0+rev=ed52870";
+    version = "0.0.0+rev=a708e9b";
    src = fetchFromGitHub {
      owner = "artagnon";
      repo = "tree-sitter-mlir";
-      rev = "ed528701a1ee52d4735c3439da262c898e506fc3";
-      hash = "sha256-VDwKpSRRlZDjrJH7NqKUZm596M/glWhAimkmH0POue4=";
+      rev = "a708e9b3f3d7f2fc85ac3fd1d4317c51b101eab0";
+      hash = "sha256-ITimvcYGqPUrqg3Z9EyfhEznzME2TKBOJpr0Fbc3OoE=";
    };
    generate = true;
    meta.homepage = "https://github.com/artagnon/tree-sitter-mlir";
@ -1777,12 +1777,12 @@
  };
  odin = buildGrammar {
    language = "odin";
-    version = "0.0.0+rev=b5f668e";
+    version = "0.0.0+rev=f25b8c5";
    src = fetchFromGitHub {
      owner = "amaanq";
      repo = "tree-sitter-odin";
-      rev = "b5f668ef8918aab13812ce73acd89fe191fb8c5e";
-      hash = "sha256-D/+ls8a5efAy3sBaH1eGEifEwBRmz+6bYIMGNji949Q=";
+      rev = "f25b8c5201c1480dc0c8c4155a059a79a5a40719";
+      hash = "sha256-720CY0OKlq1P+9g0VHQ6l0lTBjGy/tYiolL8e2ahd8o=";
    };
    meta.homepage = "https://github.com/amaanq/tree-sitter-odin";
  };
@ -1832,47 +1832,47 @@
  };
  perl = buildGrammar {
    language = "perl";
-    version = "0.0.0+rev=96a17c4";
+    version = "0.0.0+rev=d4ebabd";
    src = fetchFromGitHub {
      owner = "tree-sitter-perl";
      repo = "tree-sitter-perl";
-      rev = "96a17c4c2dd345dc61f330d040684538d634bbc2";
-      hash = "sha256-I/76AfSPU5WOwch8inBWojIraJGVffnGvOpQepq6qYU=";
+      rev = "d4ebabd45bcb053fcc7f6688b5c8ed80c7ae7a32";
+      hash = "sha256-0WnI0L6Tuy3FD4XxCZR1HcQyo5uv0VXhK8eqopCAS+A=";
    };
    meta.homepage = "https://github.com/tree-sitter-perl/tree-sitter-perl";
  };
  php = buildGrammar {
    language = "php";
-    version = "0.0.0+rev=58054be";
+    version = "0.0.0+rev=d5aea05";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-php";
-      rev = "58054be104db0809ea6f119514a4d904f95e5b5c";
-      hash = "sha256-oMn+0p+b01gSgGm5nrXO5FX9Je6y8bBNwP72x2e0hZU=";
+      rev = "d5aea05a70c5d021fa746516391f156d35658875";
+      hash = "sha256-Wk8JBHqAPIHDGQ6+cw/ATFdeFGZZZ3XgkPCuAOFUROs=";
    };
    location = "php";
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-php";
  };
  php_only = buildGrammar {
    language = "php_only";
-    version = "0.0.0+rev=58054be";
+    version = "0.0.0+rev=d5aea05";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-php";
-      rev = "58054be104db0809ea6f119514a4d904f95e5b5c";
-      hash = "sha256-oMn+0p+b01gSgGm5nrXO5FX9Je6y8bBNwP72x2e0hZU=";
+      rev = "d5aea05a70c5d021fa746516391f156d35658875";
+      hash = "sha256-Wk8JBHqAPIHDGQ6+cw/ATFdeFGZZZ3XgkPCuAOFUROs=";
    };
    location = "php_only";
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-php";
  };
  phpdoc = buildGrammar {
    language = "phpdoc";
-    version = "0.0.0+rev=f285e33";
+    version = "0.0.0+rev=1d0e255";
    src = fetchFromGitHub {
      owner = "claytonrcarter";
      repo = "tree-sitter-phpdoc";
-      rev = "f285e338d328a03920a9bfd8dda78585c7ddcca3";
-      hash = "sha256-kvAZ1+tbw6bAtLhPeNGi1rmnyNhBSL/nynQADX+4tMw=";
+      rev = "1d0e255b37477d0ca46f1c9e9268c8fa76c0b3fc";
+      hash = "sha256-EWj/Av8+Ri7KiC9LzH73ytufjkp3MxBPwfm6mF3IGD8=";
    };
    meta.homepage = "https://github.com/claytonrcarter/tree-sitter-phpdoc";
  };
@ -2066,12 +2066,12 @@
  };
  ql = buildGrammar {
    language = "ql";
-    version = "0.0.0+rev=fa5c382";
+    version = "0.0.0+rev=42becd6";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-ql";
-      rev = "fa5c3821dd2161f5c8528a8cbdb258daa6dc4de6";
-      hash = "sha256-5Fc9u7sTWG/RRcg/B5uiF8wjsbHCNt+fcOtCPgf4gyo=";
+      rev = "42becd6f8f7bae82c818fa3abb1b6ff34b552310";
+      hash = "sha256-OFqBI9u5Ik6AoG88v7qTVnol5H9O/n1vaZhoxQ7Sj70=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-ql";
  };
@ -2088,23 +2088,23 @@
  };
  qmljs = buildGrammar {
    language = "qmljs";
-    version = "0.0.0+rev=239f262";
+    version = "0.0.0+rev=2c57cac";
    src = fetchFromGitHub {
      owner = "yuja";
      repo = "tree-sitter-qmljs";
-      rev = "239f2627b4c7859fd9adc53609cb40fa0a5431ce";
-      hash = "sha256-xlQ/C8rrjOMUZpciOJ+gjmS4zlRJYnhWtkoBKxssXCA=";
+      rev = "2c57cac27e207425f8df15327884434cb12365a3";
+      hash = "sha256-LFOujMN9HMtDqjq2ZOP0oxydQHFS0wvL6ORBqruGXeM=";
    };
    meta.homepage = "https://github.com/yuja/tree-sitter-qmljs";
  };
  query = buildGrammar {
    language = "query";
-    version = "0.0.0+rev=608c011";
+    version = "0.0.0+rev=d25e8d1";
    src = fetchFromGitHub {
      owner = "nvim-treesitter";
      repo = "tree-sitter-query";
-      rev = "608c01187fb9f525a1e4cf585bb63d73dea280b7";
-      hash = "sha256-kOlWlABRCv0eZcTNOkRhJxA4t0IUUvk1pi1s8UiWons=";
+      rev = "d25e8d183f319497b8b22a2a1585975b020da722";
+      hash = "sha256-c4ttg5UXtRlUdtljQwczoBSR/oX+rnj5gUqR8EIYMKQ=";
    };
    meta.homepage = "https://github.com/nvim-treesitter/tree-sitter-query";
  };
@ -2176,12 +2176,12 @@
  };
  regex = buildGrammar {
    language = "regex";
-    version = "0.0.0+rev=ba22e4e";
+    version = "0.0.0+rev=47007f1";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-regex";
-      rev = "ba22e4e0cb42b2ef066948d0ea030ac509cef733";
-      hash = "sha256-mb8y3lsbN5zEpVCeBQxGXSRqC3FKsvNg1Rb1XTSh3Qo=";
+      rev = "47007f195752d8e57bda80b0b6cdb2d173a9f7d7";
+      hash = "sha256-X1CEk4nLxXY1a3PHG+4uSDKAXmsJIhd0nVYieTaHOkk=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-regex";
  };
@ -2242,12 +2242,12 @@
  };
  ron = buildGrammar {
    language = "ron";
-    version = "0.0.0+rev=f0ddc95";
+    version = "0.0.0+rev=7893855";
    src = fetchFromGitHub {
      owner = "amaanq";
      repo = "tree-sitter-ron";
-      rev = "f0ddc95a4b7bb21a7308642255a80f5496e69c5b";
-      hash = "sha256-Wi81LYFfQXjZzj2OuxB64sNDEim/eZKViMeQ0h/w88k=";
+      rev = "78938553b93075e638035f624973083451b29055";
+      hash = "sha256-Sp0g6AWKHNjyUmL5k3RIU+5KtfICfg3o/DH77XRRyI0=";
    };
    meta.homepage = "https://github.com/amaanq/tree-sitter-ron";
  };
@ -2264,23 +2264,23 @@
  };
  ruby = buildGrammar {
    language = "ruby";
-    version = "0.0.0+rev=9d86f37";
+    version = "0.0.0+rev=788a63c";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-ruby";
-      rev = "9d86f3761bb30e8dcc81e754b81d3ce91848477e";
-      hash = "sha256-Ibfu+5NWCkw7jriy1tiMLplpXNZfZf8WP30lDU1//GM=";
+      rev = "788a63ca1b7619288980aaafd37d890ee2469421";
+      hash = "sha256-FvLSj0lTNNabneXrDH7/HQq4mcTLvBwhkPW/Pf48JWc=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-ruby";
  };
  rust = buildGrammar {
    language = "rust";
-    version = "0.0.0+rev=0435214";
+    version = "0.0.0+rev=9c84af0";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-rust";
-      rev = "04352146022062c101b8ddd853adf17eadd8cf56";
-      hash = "sha256-4CTh6fKSV8TuMHLAfEKWsAeCqeCM2uo6hVmF5KWhyPY=";
+      rev = "9c84af007b0f144954adb26b3f336495cbb320a7";
+      hash = "sha256-mwnikq3s7Ien68DYT3p9oVGy7xjBgtiJMHAwMj5HXHI=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-rust";
  };
@ -2353,12 +2353,12 @@
  };
  smali = buildGrammar {
    language = "smali";
-    version = "0.0.0+rev=3f65178";
+    version = "0.0.0+rev=fdfa6a1";
    src = fetchFromGitHub {
      owner = "tree-sitter-grammars";
      repo = "tree-sitter-smali";
-      rev = "3f6517855898ef23023e5d64a8b175d4ee8d646e";
-      hash = "sha256-K1cRK4D0BE9FNq1tpa0L3Crc+8woXIwhRPg86+73snk=";
+      rev = "fdfa6a1febc43c7467aa7e937b87b607956f2346";
+      hash = "sha256-S0U6Xuntz16DrpYwSqMQu8Cu7UuD/JufHUxIHv826yw=";
    };
    meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-smali";
  };
@ -2386,12 +2386,12 @@
  };
  solidity = buildGrammar {
    language = "solidity";
-    version = "0.0.0+rev=fa5c61c";
+    version = "0.0.0+rev=b5a23ea";
    src = fetchFromGitHub {
      owner = "JoranHonig";
      repo = "tree-sitter-solidity";
-      rev = "fa5c61c7c5a2d9e8e99439e2cec90225f4acb86b";
-      hash = "sha256-evB+BQPPANC0JV7i74KYbGyFxE3N5OSOOF+ujA93y2E=";
+      rev = "b5a23ead0f69d38b5c9a630f52f5c129132c16ed";
+      hash = "sha256-xOW5C/Bcx2xg/6MPYulQkolWGwyQ+htRKvTnkFnqzOE=";
    };
    meta.homepage = "https://github.com/JoranHonig/tree-sitter-solidity";
  };
@ -2421,12 +2421,12 @@
  };
  sourcepawn = buildGrammar {
    language = "sourcepawn";
-    version = "0.0.0+rev=3ca89fd";
+    version = "0.0.0+rev=6a67772";
    src = fetchFromGitHub {
      owner = "nilshelmig";
      repo = "tree-sitter-sourcepawn";
-      rev = "3ca89fdf998340a7973e276b39516d8902950f86";
-      hash = "sha256-AF7PiM0Tt6wqGdNsfMGSkgWXgZRDZGdKc7DQpUHuGUA=";
+      rev = "6a67772eed866cd6d247cc478a28c6a9272fc0ef";
+      hash = "sha256-sroMixo0FvPpC01F/hx5VV3h9ugdLhVbGeVnIlabyk0=";
    };
    meta.homepage = "https://github.com/nilshelmig/tree-sitter-sourcepawn";
  };
@ -2454,12 +2454,12 @@
  };
  squirrel = buildGrammar {
    language = "squirrel";
-    version = "0.0.0+rev=f93fd28";
+    version = "0.0.0+rev=0a50d31";
    src = fetchFromGitHub {
      owner = "amaanq";
      repo = "tree-sitter-squirrel";
-      rev = "f93fd2864dd05cc39b0490145fd86a1a93bfa3a3";
-      hash = "sha256-06cmaCyBkdwSmIHSEE0xr9V4M6pp+ApIZNopbnW3pok=";
+      rev = "0a50d31098e83c668d34d1160a0f6c7d23b571cc";
+      hash = "sha256-cLMAeDfZiHInA9+Td8FedRVSNv1vFE/bpCftRqV72d0=";
    };
    meta.homepage = "https://github.com/amaanq/tree-sitter-squirrel";
  };
@ -2542,12 +2542,12 @@
  };
  swift = buildGrammar {
    language = "swift";
-    version = "0.0.0+rev=5f5d7a2";
+    version = "0.0.0+rev=c9c669b";
    src = fetchFromGitHub {
      owner = "alex-pinkus";
      repo = "tree-sitter-swift";
-      rev = "5f5d7a2a04f2d367a010ed908cc956e7b05fde4f";
-      hash = "sha256-8BTyk99cc4kWpx1tvfMLyrKeZUQRRN0oMGw4Vz54Gtc=";
+      rev = "c9c669b4513479e07a0ff44cf14f72351959ac21";
+      hash = "sha256-OyT7jkGTuNG7eQrQvZRI49ipu+MMXTOz/1O7r42MaOk=";
    };
    generate = true;
    meta.homepage = "https://github.com/alex-pinkus/tree-sitter-swift";
@ -2587,23 +2587,23 @@
  };
  tablegen = buildGrammar {
    language = "tablegen";
-    version = "0.0.0+rev=6b7eb09";
+    version = "0.0.0+rev=b117088";
    src = fetchFromGitHub {
      owner = "amaanq";
      repo = "tree-sitter-tablegen";
-      rev = "6b7eb096621443627cc5e29c8c34ff1fde482cf3";
-      hash = "sha256-kdOqHAyKAI4IgI2/GbEx13DWLB8JklURd3ndaicxUno=";
+      rev = "b1170880c61355aaf38fc06f4af7d3c55abdabc4";
+      hash = "sha256-uJCn2RdTnOf/guBUhfodgQ8pMshNh+xUJZunoLwNgrM=";
    };
    meta.homepage = "https://github.com/amaanq/tree-sitter-tablegen";
  };
  tact = buildGrammar {
    language = "tact";
-    version = "0.0.0+rev=f65460e";
+    version = "0.0.0+rev=034df21";
    src = fetchFromGitHub {
      owner = "tact-lang";
      repo = "tree-sitter-tact";
-      rev = "f65460eb0746037bc15913e2737afcf87745b66b";
-      hash = "sha256-qoyiJzM1GMvHMpI3unnW9SysHMEw28mb64Xt1pO/hTI=";
+      rev = "034df2162ed7b654efd999942e266be713c7cde0";
+      hash = "sha256-2+MVrDPuhrM0HE9uRG5LpmyXYy73Pv3MY20UXwBXalM=";
    };
    meta.homepage = "https://github.com/tact-lang/tree-sitter-tact";
  };
@ -2632,12 +2632,12 @@
  };
  templ = buildGrammar {
    language = "templ";
-    version = "0.0.0+rev=c06e7bf";
+    version = "0.0.0+rev=d631f60";
    src = fetchFromGitHub {
      owner = "vrischmann";
      repo = "tree-sitter-templ";
-      rev = "c06e7bf0edfa211f6a7665a3c7fa25c1198850b2";
-      hash = "sha256-E2Dkq4o9RDzPHnIq9TgjXAtJS5u6l/zV6KAcq+NSD6Y=";
+      rev = "d631f60287c0904770bc41aa865e249594b52422";
+      hash = "sha256-rANNbNlybga+IGNfclMGX0On48sQ3WTWvw3bnhxKsZk=";
    };
    meta.homepage = "https://github.com/vrischmann/tree-sitter-templ";
  };
@ -2688,12 +2688,12 @@
  };
  tlaplus = buildGrammar {
    language = "tlaplus";
-    version = "0.0.0+rev=763f9a4";
+    version = "0.0.0+rev=08d9156";
    src = fetchFromGitHub {
      owner = "tlaplus-community";
      repo = "tree-sitter-tlaplus";
-      rev = "763f9a4edcb1747595842164614aa143eec084dd";
-      hash = "sha256-xkJbiDsheVhcSoMRLLvF4GPOBPRsGxWClyF8khTd0CI=";
+      rev = "08d915655d360bb0b7592d38a533dcc17dcb8dfb";
+      hash = "sha256-zE48mJUoCiyF4YDQyZtxMIqUq+99BWT4XGxeTzcWLYY=";
    };
    meta.homepage = "https://github.com/tlaplus-community/tree-sitter-tlaplus";
  };
@ -2744,12 +2744,12 @@
  };
  tsx = buildGrammar {
    language = "tsx";
-    version = "0.0.0+rev=b00b8eb";
+    version = "0.0.0+rev=7b4275d";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-typescript";
-      rev = "b00b8eb44f0b9f02556da0b1a4e2f71faed7e61b";
-      hash = "sha256-uGuwE1eTVEkuosMfTeY2akHB+bJ5npWEwUv+23nhY9M=";
+      rev = "7b4275d077ae196fc0ce42ab3ad091574e3ec519";
+      hash = "sha256-oRvAU+g2wOZrUexWAsDTY+g9iSXVs5FvGlGIAdcfIfA=";
    };
    location = "tsx";
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-typescript";
@ -2778,12 +2778,12 @@
  };
  typescript = buildGrammar {
    language = "typescript";
-    version = "0.0.0+rev=b00b8eb";
+    version = "0.0.0+rev=7b4275d";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-typescript";
-      rev = "b00b8eb44f0b9f02556da0b1a4e2f71faed7e61b";
-      hash = "sha256-uGuwE1eTVEkuosMfTeY2akHB+bJ5npWEwUv+23nhY9M=";
+      rev = "7b4275d077ae196fc0ce42ab3ad091574e3ec519";
+      hash = "sha256-oRvAU+g2wOZrUexWAsDTY+g9iSXVs5FvGlGIAdcfIfA=";
    };
    location = "typescript";
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-typescript";
@ -2801,12 +2801,12 @@
  };
  typst = buildGrammar {
    language = "typst";
-    version = "0.0.0+rev=4610172";
+    version = "0.0.0+rev=3924cb9";
    src = fetchFromGitHub {
      owner = "uben0";
      repo = "tree-sitter-typst";
-      rev = "4610172f312e8ce5184e6882be5ad1a1cd800fbe";
-      hash = "sha256-vIDVnm89mcbEDV8u6x2HO6CgkNaGEVMRRlrT3dLIFcQ=";
+      rev = "3924cb9ed9e0e62ce7df9c4fe0faa4c234795999";
+      hash = "sha256-W8mNIASM85btE3XychvagVJofIb+CkNT4XeIhdQt8FU=";
    };
    meta.homepage = "https://github.com/uben0/tree-sitter-typst";
  };
@ -2857,12 +2857,12 @@
  };
  uxntal = buildGrammar {
    language = "uxntal";
-    version = "0.0.0+rev=4c5ecd6";
+    version = "0.0.0+rev=ad9b638";
    src = fetchFromGitHub {
      owner = "amaanq";
      repo = "tree-sitter-uxntal";
-      rev = "4c5ecd6326ebd61f6f9a22a370cbd100e0d601da";
-      hash = "sha256-vgeTsRJ3mlR02jXuucmXpszVOmusZwuV0xj/7sSs+WQ=";
+      rev = "ad9b638b914095320de85d59c49ab271603af048";
+      hash = "sha256-hR0EaYv1++MJ0pdBl3ZtyEljitnp5hgFWQa9F6b1KE4=";
    };
    meta.homepage = "https://github.com/amaanq/tree-sitter-uxntal";
  };
@ -3012,24 +3012,24 @@
  };
  xml = buildGrammar {
    language = "xml";
-    version = "0.0.0+rev=5910ee2";
+    version = "0.0.0+rev=648183d";
    src = fetchFromGitHub {
      owner = "tree-sitter-grammars";
      repo = "tree-sitter-xml";
-      rev = "5910ee285378e07ff1e63a9f5d21898f62310aed";
-      hash = "sha256-X/DhTD/cNWoBxWvBBwPmGqAUtJjWkvo0PnbFK/lrTUg=";
+      rev = "648183d86f6f8ffb240ea11b4c6873f6f45d8b67";
+      hash = "sha256-O40z5VYmFeE8pkJ85Vu5DWV31YslIrwD80+4qnpoRNY=";
    };
    location = "xml";
    meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-xml";
  };
  yaml = buildGrammar {
    language = "yaml";
-    version = "0.0.0+rev=08ab1fb";
+    version = "0.0.0+rev=7b03fee";
    src = fetchFromGitHub {
      owner = "tree-sitter-grammars";
      repo = "tree-sitter-yaml";
-      rev = "08ab1fbc18beac06b2938495a2c6ab17b5a6abc5";
-      hash = "sha256-Xwx6UEfdOP3lakMvQB5CQjtrhSfkJ19eaT1YyUhRpss=";
+      rev = "7b03feefd36b5f155465ca736c6304aca983b267";
+      hash = "sha256-hjZQv8kMpjJ29Rl6CEBwb090rFNWP1HPkSECbmTr0zQ=";
    };
    meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-yaml";
  };
@ -3046,12 +3046,12 @@
  };
  yuck = buildGrammar {
    language = "yuck";
-    version = "0.0.0+rev=a513732";
+    version = "0.0.0+rev=e877f6a";
    src = fetchFromGitHub {
      owner = "Philipp-M";
      repo = "tree-sitter-yuck";
-      rev = "a513732feb813426b51d1ead8397a9c285c411be";
-      hash = "sha256-XfenP9bXkskCfiq2sE8qLog0NmSecP50Ur+8HDtU4pQ=";
+      rev = "e877f6ade4b77d5ef8787075141053631ba12318";
+      hash = "sha256-l8c1/7q8S78jGyl+VAVVgs8wq58PrrjycyJfWXsCgAI=";
    };
    meta.homepage = "https://github.com/Philipp-M/tree-sitter-yuck";
  };
--- a/pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix
@ -21,8 +21,8 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
  mktplcRef = {
    name = "python";
    publisher = "ms-python";
-    version = "2023.1.10091012";
-    hash = "sha256-JosFv6ngJmw1XRILwTZMVxlGIdWFLFQjj4olfnVwAIM=";
+    version = "2024.5.11021008";
+    hash = "sha256-UnI0leRKqCtFLBdGS/UvLuCcxQhibyY0ChmzQ9uytoY=";
  };

  buildInputs = [ icu ];
@ -37,11 +37,11 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
  postPatch =
    ''
      # remove bundled python deps and use libs from nixpkgs
-      rm -r pythonFiles/lib
-      mkdir -p pythonFiles/lib/python/
-      ln -s ${python3.pkgs.debugpy}/lib/*/site-packages/debugpy pythonFiles/lib/python/
+      rm -r python_files/lib
+      mkdir -p python_files/lib/python/
+      ln -s ${python3.pkgs.debugpy}/lib/*/site-packages/debugpy python_files/lib/python/
      buildPythonPath "$propagatedBuildInputs"
-      for i in pythonFiles/*.py; do
+      for i in python_files/*.py; do
        patchPythonScript "$i"
      done
    ''
--- a/pkgs/applications/graphics/cq-editor/default.nix
+++ b/pkgs/applications/graphics/cq-editor/default.nix
@ -1,63 +0,0 @@
-{ lib
-, mkDerivationWith
-, python3Packages
-, fetchFromGitHub
-, wrapQtAppsHook
-}:
-
-mkDerivationWith python3Packages.buildPythonApplication rec {
-  pname = "cq-editor";
-  version = "0.1.1";
-
-  src = fetchFromGitHub {
-    owner = "CadQuery";
-    repo = "CQ-editor";
-    rev = version;
-    sha256 = "1970izjaa60r5cg9i35rzz9lk5c5d8q1vw1rh2skvfbf63z1hnzv";
-  };
-
-  patches = [
-    ./spyder4.patch
-  ];
-
-  propagatedBuildInputs = with python3Packages; [
-    cadquery
-    logbook
-    pyqt5
-    pyparsing
-    pyqtgraph
-    spyder
-    path
-    qtconsole
-    requests
-  ];
-
-  nativeBuildInputs = [ wrapQtAppsHook ];
-  preFixup = ''
-    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
-  '';
-
-  nativeCheckInputs = with python3Packages; [
-    pytest
-    pytest-xvfb
-    pytest-mock
-    pytest-cov
-    pytest-repeat
-    pytest-qt
-  ];
-
-  checkPhase = ''
-    pytest --no-xvfb
-  '';
-
-  # requires X server
-  doCheck = false;
-
-  meta = with lib; {
-    description = "CadQuery GUI editor based on PyQT";
-    homepage = "https://github.com/CadQuery/CQ-editor";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ costrouc marcus7070 ];
-  };
-
-}
--- a/pkgs/applications/graphics/symbolic-preview/default.nix
+++ b/pkgs/applications/graphics/symbolic-preview/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "symbolic-preview";
-  version = "0.0.3";
+  version = "0.0.9";

  src = fetchurl {
-    url = "https://gitlab.gnome.org/World/design/symbolic-preview/uploads/df71a2eee9ea0c90b3d146e7286fec42/symbolic-preview-${version}.tar.xz";
-    sha256 = "08g2sbdb1x5z26mi68nmciq6xwv0chvxw6anj1qdfh7npsg0dm4c";
+    url = "https://gitlab.gnome.org/World/design/symbolic-preview/uploads/e2fed158fc0d267f2051302bcf14848b/symbolic-preview-${version}.tar.xz";
+    hash = "sha256-kx+70LCQzzWAw2Xd3fKGq941540IM3Y1+r4Em4MNWbw=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/audio/sox/default.nix
+++ b/pkgs/applications/misc/audio/sox/default.nix
@ -31,7 +31,7 @@
 , enableAMR ? false
 , amrnb
 , amrwb
-, enableLibpulseaudio ? stdenv.isLinux
+, enableLibpulseaudio ? stdenv.isLinux && lib.meta.availableOn stdenv.hostPlatform libpulseaudio
 , libpulseaudio
 }:

--- a/pkgs/applications/misc/blender/darwin.patch
+++ b/pkgs/applications/misc/blender/darwin.patch
@ -1,27 +1,25 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
--- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -1894,7 +1894,7 @@ if(WITH_COMPILER_SHORT_FILE_MACRO)
-   ADD_CHECK_CXX_COMPILER_FLAG(CXX_PREFIX_MAP_FLAGS CXX_MACRO_PREFIX_MAP -fmacro-prefix-map=foo=bar)
+--- a/CMakeLists.txt	2024-03-01 08:08:05
+++ b/CMakeLists.txt	2024-04-24 15:45:30
+@@ -2134,7 +2134,7 @@
+   )
   if(C_MACRO_PREFIX_MAP AND CXX_MACRO_PREFIX_MAP)
     if(APPLE)
 -      if(XCODE AND ${XCODE_VERSION} VERSION_LESS 12.0)
 +      if(FALSE)
       # Developers may have say LLVM Clang-10.0.1 toolchain (which supports the flag)
       # with Xcode-11 (the Clang of which doesn't support the flag).
-         message(WARNING
-diff --git a/build_files/cmake/platform/platform_apple.cmake b/build_files/cmake/platform/platform_apple.cmake
--- a/build_files/cmake/platform/platform_apple.cmake
-+++ b/build_files/cmake/platform/platform_apple.cmake
-@@ -60,7 +60,6 @@ else()
-   message(STATUS "Using pre-compiled LIBDIR: ${LIBDIR}")
+         message(
+--- a/build_files/cmake/platform/platform_apple.cmake	2024-02-22 15:31:36
+++ b/build_files/cmake/platform/platform_apple.cmake	2024-04-24 16:06:13
+@@ -55,7 +55,6 @@
+   endif()
 endif()
- if(NOT EXISTS "${LIBDIR}/")
+ if(NOT EXISTS "${LIBDIR}/.git")
 -  message(FATAL_ERROR "Mac OSX requires pre-compiled libs at: '${LIBDIR}'")
 endif()
- 
- # Prefer lib directory paths
-@@ -98,10 +97,6 @@ if(WITH_CODEC_SNDFILE)
+ if(FIRST_RUN)
+   message(STATUS "Using pre-compiled LIBDIR: ${LIBDIR}")
+@@ -115,10 +114,6 @@
   find_library(_sndfile_VORBIS_LIBRARY NAMES vorbis HINTS ${LIBDIR}/ffmpeg/lib)
   find_library(_sndfile_VORBISENC_LIBRARY NAMES vorbisenc HINTS ${LIBDIR}/ffmpeg/lib)
   list(APPEND LIBSNDFILE_LIBRARIES
@ -32,44 +30,26 @@ diff --git a/build_files/cmake/platform/platform_apple.cmake b/build_files/cmake
   )
 
   print_found_status("SndFile libraries" "${LIBSNDFILE_LIBRARIES}")
-@@ -118,7 +113,7 @@ if(WITH_PYTHON)
-     # Normally cached but not since we include them with blender.
-     set(PYTHON_INCLUDE_DIR "${LIBDIR}/python/include/python${PYTHON_VERSION}")
-     set(PYTHON_EXECUTABLE "${LIBDIR}/python/bin/python${PYTHON_VERSION}")
-    set(PYTHON_LIBRARY ${LIBDIR}/python/lib/libpython${PYTHON_VERSION}.a)
-+    set(PYTHON_LIBRARY ${LIBDIR}/python/lib/libpython${PYTHON_VERSION}.dylib)
-     set(PYTHON_LIBPATH "${LIBDIR}/python/lib/python${PYTHON_VERSION}")
-   else()
-     # Module must be compiled against Python framework.
-@@ -147,7 +142,7 @@ endif()
- 
- # FreeType compiled with Brotli compression for woff2.
- find_package(Freetype REQUIRED)
-list(APPEND FREETYPE_LIBRARIES
-+message(TRACE APPEND FREETYPE_LIBRARIES
-   ${LIBDIR}/brotli/lib/libbrotlicommon-static.a
-   ${LIBDIR}/brotli/lib/libbrotlidec-static.a)
- 
-@@ -159,9 +154,7 @@ if(WITH_CODEC_FFMPEG)
+@@ -162,9 +157,7 @@
   set(FFMPEG_ROOT_DIR ${LIBDIR}/ffmpeg)
   set(FFMPEG_FIND_COMPONENTS
     avcodec avdevice avformat avutil
 -    mp3lame ogg opus swresample swscale
 -    theora theoradec theoraenc vorbis vorbisenc
-    vorbisfile vpx x264 xvidcore)
-+    swresample swscale)
+-    vorbisfile vpx x264)
+   swresample swscale)
   if(EXISTS ${LIBDIR}/ffmpeg/lib/libaom.a)
     list(APPEND FFMPEG_FIND_COMPONENTS aom)
   endif()
-@@ -273,7 +266,6 @@ if(WITH_BOOST)
- endif()
+@@ -275,7 +268,6 @@
+ add_bundled_libraries(boost/lib)
 
 if(WITH_INTERNATIONAL OR WITH_CODEC_FFMPEG)
 -  string(APPEND PLATFORM_LINKFLAGS " -liconv") # boost_locale and ffmpeg needs it !
 endif()
 
 if(WITH_PUGIXML)
-@@ -402,7 +394,7 @@ endif()
+@@ -350,7 +342,7 @@
 
 # CMake FindOpenMP doesn't know about AppleClang before 3.12, so provide custom flags.
 if(WITH_OPENMP)
@ -78,3 +58,12 @@ diff --git a/build_files/cmake/platform/platform_apple.cmake b/build_files/cmake
     # Use OpenMP from our precompiled libraries.
     message(STATUS "Using ${LIBDIR}/openmp for OpenMP")
     set(OPENMP_CUSTOM ON)
+@@ -427,7 +419,7 @@
+   " -Wl,-unexported_symbols_list,'${PLATFORM_SYMBOLS_MAP}'"
+ )
+ 
+-if(${XCODE_VERSION} VERSION_GREATER_EQUAL 15.0)
+if(FALSE)
+   if("${CMAKE_OSX_ARCHITECTURES}" STREQUAL "x86_64")
+     # Silence "no platform load command found in <static library>, assuming: macOS".
+     string(APPEND PLATFORM_LINKFLAGS " -Wl,-ld_classic")
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@ -8,12 +8,14 @@
  addOpenGLRunpath,
  alembic,
  boost,
+  brotli,
  callPackage,
  cmake,
  colladaSupport ? true,
  config,
  cudaPackages,
  cudaSupport ? config.cudaSupport,
+  darwin,
  dbus,
  embree,
  fetchurl,
@ -51,6 +53,7 @@
  libxkbcommon,
  llvmPackages,
  makeWrapper,
+  materialx,
  mesa,
  ocl-icd,
  openal,
@ -71,6 +74,7 @@
  rocmPackages, # comes with a significantly larger closure size
  runCommand,
  spaceNavSupport ? stdenv.isLinux,
+  sse2neon,
  stdenv,
  tbb,
  wayland,
@ -114,15 +118,14 @@ stdenv.mkDerivation (finalAttrs: {
        ''
          : > build_files/cmake/platform/platform_apple_xcode.cmake
          substituteInPlace source/creator/CMakeLists.txt \
-            --replace '${"$"}{LIBDIR}/python' \
-                      '${python3}'
-          substituteInPlace build_files/cmake/platform/platform_apple.cmake \
-            --replace '${"$"}{LIBDIR}/python' \
+            --replace-fail '${"$"}{LIBDIR}/python' \
                      '${python3}' \
-            --replace '${"$"}{LIBDIR}/opencollada' \
-                      '${opencollada}' \
-            --replace '${"$"}{PYTHON_LIBPATH}/site-packages/numpy' \
-                      '${python3Packages.numpy}/${python3.sitePackages}/numpy'
+            --replace-fail '${"$"}{LIBDIR}/materialx/' '${materialx}/'
+          substituteInPlace build_files/cmake/platform/platform_apple.cmake \
+            --replace-fail '${"$"}{LIBDIR}/brotli/lib/libbrotlicommon-static.a' \
+                      '${lib.getLib brotli}/lib/libbrotlicommon.dylib' \
+            --replace-fail '${"$"}{LIBDIR}/brotli/lib/libbrotlidec-static.a' \
+                      '${lib.getLib brotli}/lib/libbrotlidec.dylib'
        ''
      else
        ''
@ -150,6 +153,7 @@ stdenv.mkDerivation (finalAttrs: {
      "-DWITH_FFTW3=ON"
      "-DWITH_IMAGE_OPENJPEG=ON"
      "-DWITH_INSTALL_PORTABLE=OFF"
+      "-DMaterialX_DIR=${materialx}/lib/cmake/MaterialX"
      "-DWITH_MOD_OCEANSIM=ON"
      "-DWITH_OPENCOLLADA=${if colladaSupport then "ON" else "OFF"}"
      "-DWITH_OPENCOLORIO=ON"
@ -164,7 +168,7 @@ stdenv.mkDerivation (finalAttrs: {

      # Blender supplies its own FindAlembic.cmake (incompatible with the Alembic-supplied config file)
      "-DALEMBIC_INCLUDE_DIR=${lib.getDev alembic}/include"
-      "-DALEMBIC_LIBRARY=${lib.getLib alembic}/lib/libAlembic.so"
+      "-DALEMBIC_LIBRARY=${lib.getLib alembic}/lib/libAlembic${stdenv.hostPlatform.extensions.sharedLibrary}"
    ]
    ++ lib.optionals waylandSupport [
      "-DWITH_GHOST_WAYLAND=ON"
@ -172,11 +176,12 @@ stdenv.mkDerivation (finalAttrs: {
      "-DWITH_GHOST_WAYLAND_DYNLOAD=OFF"
      "-DWITH_GHOST_WAYLAND_LIBDECOR=ON"
    ]
-    ++ lib.optionals stdenv.hostPlatform.isAarch64 [ "-DWITH_CYCLES_EMBREE=OFF" ]
+    ++ lib.optionals (stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isLinux) [ "-DWITH_CYCLES_EMBREE=OFF" ]
    ++ lib.optionals stdenv.isDarwin [
      "-DLIBDIR=/does-not-exist"
-      "-DWITH_CYCLES_OSL=OFF" # requires LLVM
-      "-DWITH_OPENVDB=OFF" # OpenVDB currently doesn't build on darwin
+      "-DWITH_CYCLES_OSL=OFF" # causes segfault on aarch64-darwin
+      "-DSSE2NEON_INCLUDE_DIR=${sse2neon}/lib"
+      "-DWITH_USD=OFF" # currently fails on darwin
    ]
    ++ lib.optional stdenv.cc.isClang "-DPYTHON_LINKFLAGS=" # Clang doesn't support "-export-dynamic"
    ++ lib.optional jackaudioSupport "-DWITH_JACK=ON"
@ -219,21 +224,22 @@ stdenv.mkDerivation (finalAttrs: {
      libsndfile
      libtiff
      libwebp
+      materialx
      opencolorio
      openexr
      openimageio
      openjpeg
      openpgl
      (opensubdiv.override { inherit cudaSupport; })
+      openvdb
      potrace
      pugixml
-      pyPkgsOpenusd
      python3
      tbb
      zlib
      zstd
    ]
-    ++ lib.optionals (!stdenv.isAarch64) [
+    ++ lib.optionals (!stdenv.isAarch64 && stdenv.isLinux) [
      embree
      (openimagedenoise.override { inherit cudaSupport; })
    ]
@ -248,8 +254,8 @@ stdenv.mkDerivation (finalAttrs: {
          libXrender
          libXxf86vm
          openal
-          openvdb # OpenVDB currently doesn't build on darwin
          openxr-loader
+          pyPkgsOpenusd
        ]
      else
        [
@ -259,7 +265,11 @@ stdenv.mkDerivation (finalAttrs: {
          OpenAL
          OpenGL
          SDL
+          brotli
+          embree
          llvmPackages.openmp
+          (openimagedenoise.override { inherit cudaSupport; })
+          sse2neon
        ]
    )
    ++ lib.optionals cudaSupport [ cudaPackages.cuda_cudart ]
@ -280,11 +290,12 @@ stdenv.mkDerivation (finalAttrs: {
      ps = python3Packages;
    in
    [
+      materialx
      ps.numpy
      ps.requests
      ps.zstandard
-      pyPkgsOpenusd
-    ];
+    ]
+    ++ lib.optionals (!stdenv.isDarwin) [ pyPkgsOpenusd ];

  blenderExecutable =
    placeholder "out"
@ -295,8 +306,10 @@ stdenv.mkDerivation (finalAttrs: {
      mkdir $out/Applications
      mv $out/Blender.app $out/Applications
    ''
-    + ''
+    + lib.optionalString stdenv.isLinux ''
      mv $out/share/blender/${lib.versions.majorMinor finalAttrs.version}/python{,-ext}
+    ''
+    + ''
      buildPythonPath "$pythonPath"
      wrapProgram $blenderExecutable \
        --prefix PATH : $program_PATH \
@ -311,6 +324,9 @@ stdenv.mkDerivation (finalAttrs: {
      isELF "$program" || continue
      addOpenGLRunpath "$program"
    done
+  ''
+  + lib.optionalString stdenv.isDarwin ''
+    makeWrapper $out/Applications/Blender.app/Contents/MacOS/Blender $out/bin/blender
  '';

  passthru = {
@ -327,15 +343,13 @@ stdenv.mkDerivation (finalAttrs: {
    tests = {
      render = runCommand "${finalAttrs.pname}-test" { } ''
        set -euo pipefail
-
        export LIBGL_DRIVERS_PATH=${mesa.drivers}/lib/dri
        export __EGL_VENDOR_LIBRARY_FILENAMES=${mesa.drivers}/share/glvnd/egl_vendor.d/50_mesa.json
-
        cat <<'PYTHON' > scene-config.py
        import bpy
        bpy.context.scene.eevee.taa_render_samples = 32
        bpy.context.scene.cycles.samples = 32
-        if ${if stdenv.isAarch64 then "True" else "False"}:
+        if ${if (stdenv.isAarch64 && stdenv.isLinux) then "True" else "False"}:
            bpy.context.scene.cycles.use_denoising = False
        bpy.context.scene.render.resolution_x = 100
        bpy.context.scene.render.resolution_y = 100
@ -347,7 +361,7 @@ stdenv.mkDerivation (finalAttrs: {
        for engine in BLENDER_EEVEE CYCLES; do
          echo "Rendering with $engine..."
          # Beware that argument order matters
-          ${finalAttrs.finalPackage}/bin/blender \
+          ${lib.getExe finalAttrs.finalPackage} \
            --background \
            -noaudio \
            --factory-startup \
@ -372,8 +386,10 @@ stdenv.mkDerivation (finalAttrs: {
      "aarch64-linux"
      "x86_64-darwin"
      "x86_64-linux"
+      "aarch64-darwin"
    ];
-    broken = stdenv.isDarwin;
+    # the current apple sdk is too old (currently 11_0) and fails to build "metal" on x86_64-darwin
+    broken = stdenv.hostPlatform.system == "x86_64-darwin";
    maintainers = with lib.maintainers; [
      goibhniu
      veprbl
--- a/pkgs/applications/misc/electrum/ltc-aiorpcX-version-bump.patch
+++ b/pkgs/applications/misc/electrum/ltc-aiorpcX-version-bump.patch
@ -0,0 +1,44 @@
+diff --git a/contrib/deterministic-build/requirements.txt b/contrib/deterministic-build/requirements.txt
+index 7441e3389..2a4718f96 100644
+--- a/contrib/deterministic-build/requirements.txt
+++ b/contrib/deterministic-build/requirements.txt
+@@ -74,9 +74,8 @@ aiohttp==3.8.1 \
+ aiohttp-socks==0.7.1 \
+     --hash=sha256:2215cac4891ef3fa14b7d600ed343ed0f0a670c23b10e4142aa862b3db20341a \
+     --hash=sha256:94bcff5ef73611c6c6231c2ffc1be4af1599abec90dbd2fdbbd63233ec2fb0ff
+-aiorpcX==0.22.1 \
+-    --hash=sha256:6026f7bed3432e206589c94dcf599be8cd85b5736b118c7275845c1bd922a553 \
+-    --hash=sha256:e74f9fbed3fd21598e71fe05066618fc2c06feec504fe29490ddda05fdbdde62
+aiorpcX==0.23.1 \
+    --hash=sha256:5b23002f1a4d5d3085e31555a07519c5ef8d4c40071eb499556ffda8114860a2
+ aiosignal==1.2.0 \
+     --hash=sha256:26e62109036cd181df6e6ad646f91f0dcfd05fe16d0cb924138ff2ab75d64e3a \
+     --hash=sha256:78ed67db6c7b7ced4f98e495e572106d5c432a93e1ddd1bf475e1dc05f5b7df2
+diff --git a/contrib/requirements/requirements.txt b/contrib/requirements/requirements.txt
+index 04b0a77f3..2330ea921 100644
+--- a/contrib/requirements/requirements.txt
+++ b/contrib/requirements/requirements.txt
+@@ -1,7 +1,7 @@
+ qrcode
+ protobuf>=3.12
+ qdarkstyle>=2.7
+-aiorpcx>=0.22.0,<0.23
+aiorpcx>=0.22.0,<0.24
+ aiohttp>=3.3.0,<4.0.0
+ aiohttp_socks>=0.3
+ certifi
+diff --git a/run_electrum b/run_electrum
+index a1b30f29e..cb22f8724 100755
+--- a/run_electrum
+++ b/run_electrum
+@@ -67,8 +67,8 @@ def check_imports():
+         import aiorpcx
+     except ImportError as e:
+         sys.exit(f"Error: {str(e)}. Try 'sudo python3 -m pip install <module-name>'")
+-    if not ((0, 22, 0) <= aiorpcx._version < (0, 23)):
+-        raise RuntimeError(f'aiorpcX version {aiorpcx._version} does not match required: 0.22.0<=ver<0.23')
+    if not ((0, 22, 0) <= aiorpcx._version < (0, 24)):
+        raise RuntimeError(f'aiorpcX version {aiorpcx._version} does not match required: 0.22.0<=ver<0.24')
+     # the following imports are for pyinstaller
+     from google.protobuf import descriptor
+     from google.protobuf import message
--- a/pkgs/applications/misc/electrum/ltc.nix
+++ b/pkgs/applications/misc/electrum/ltc.nix
@ -82,6 +82,26 @@ python3.pkgs.buildPythonApplication {
    qdarkstyle
  ];

+  patches = [
+    # electrum-ltc attempts to pin to aiorpcX < 0.23, but nixpkgs
+    # has moved to newer versions.
+    #
+    # electrum-ltc hasn't been updated in some time, so we replicate
+    # the patch from electrum (BTC) and alter it to be usable with
+    # electrum-ltc.
+    #
+    # Similar to the BTC patch, we need to overwrite the symlink
+    # at electrum_ltc/electrum-ltc with the patched run_electrum
+    # in postPatch.
+    ./ltc-aiorpcX-version-bump.patch
+  ];
+
+  postPatch = ''
+    # copy the patched `/run_electrum` over `/electrum/electrum`
+    # so the aiorpcx compatibility patch is used
+    cp run_electrum electrum_ltc/electrum-ltc
+  '';
+
  preBuild = ''
    sed -i 's,usr_share = .*,usr_share = "'$out'/share",g' setup.py
    substituteInPlace ./electrum_ltc/ecc_fast.py \
--- a/pkgs/applications/misc/gxkb/default.nix
+++ b/pkgs/applications/misc/gxkb/default.nix
@ -1,16 +1,16 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, gtk3, libwnck, libxklavier
+{ lib, stdenv, fetchFromGitHub, fetchurl, git, autoreconfHook, pkg-config, gtk3, libwnck, libxklavier
 , appindicatorSupport ? true, libayatana-appindicator
 }:

 stdenv.mkDerivation rec {
  pname = "gxkb";
-  version = "0.9.3";
+  version = "0.9.5";

  src = fetchFromGitHub {
    owner = "zen-tools";
    repo = "gxkb";
    rev = "v${version}";
-    sha256 = "sha256-9r1eZl7PgIt2ZpK+QQHaa460imIHT3Lh5mpzcFglyWc=";
+    sha256 = "sha256-oBIBIkj4p6HlF0PRQtI/K5dhLs7pbPxN7Cgr/YZaI1s=";
  };

  nativeBuildInputs = [ pkg-config autoreconfHook ];
@ -19,6 +19,18 @@ stdenv.mkDerivation rec {
  configureFlags = lib.optional appindicatorSupport "--enable-appindicator=yes";
  outputs = [ "out" "man" ];

+  # This patch restore data which was wiped by upstream without any technical reasons
+  # https://github.com/omgbebebe/gxkb/commit/727ec8b595a91dbb540e6087750f43b85d0dfbc0
+  # NOTE: the `patch` hook cannot be used here due to lack of support for git binary patches
+  p1 = fetchurl {
+       url = "https://github.com/omgbebebe/gxkb/commit/727ec8b595a91dbb540e6087750f43b85d0dfbc0.patch";
+       hash = "sha256-x7x3MHHrOnPivvlzOFqgFAA5BDB2LOXMlalPYbwM/1Q=";
+  };
+
+  postPatch = ''
+    ${git}/bin/git apply ${p1}
+  '';
+
  meta = with lib; {
    description = "X11 keyboard indicator and switcher";
    homepage = "https://zen-tools.github.io/gxkb/";
--- a/pkgs/applications/misc/kratos/default.nix
+++ b/pkgs/applications/misc/kratos/default.nix
@ -1,8 +1,15 @@
-{ fetchFromGitHub, buildGoModule, lib, stdenv }:
-
-buildGoModule rec {
+{
+  fetchFromGitHub,
+  buildGoModule,
+  lib,
+  stdenv
+}:
+let
  pname = "kratos";
  version = "1.1.0";
+in
+buildGoModule {
+  inherit pname version;

  src = fetchFromGitHub {
    owner = "ory";
@ -17,6 +24,11 @@ buildGoModule rec {

  tags = [ "sqlite" ];

+  # Pass versioning information via ldflags
+  ldflags = [
+    "-X github.com/ory/kratos/driver/config.Version=${version}"
+  ];
+
  doCheck = false;

  preBuild = ''
@ -30,14 +42,14 @@ buildGoModule rec {
    patchShebangs "''${files[@]}"

    # patchShebangs doesn't work for this Makefile, do it manually
-    substituteInPlace Makefile --replace '/bin/bash' '${stdenv.shell}'
+    substituteInPlace Makefile --replace-fail '/usr/bin/env bash' '${stdenv.shell}'
  '';

-  meta = with lib; {
-    maintainers = with maintainers; [ mrmebelman ];
-    homepage = "https://www.ory.sh/kratos/";
-    license = licenses.asl20;
-    description = "An API-first Identity and User Management system that is built according to cloud architecture best practices";
+  meta = {
    mainProgram = "kratos";
+    description = "An API-first Identity and User Management system that is built according to cloud architecture best practices";
+    homepage = "https://www.ory.sh/kratos/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ mrmebelman ];
  };
 }
--- a/pkgs/applications/misc/onagre/Cargo.lock
+++ b/pkgs/applications/misc/onagre/Cargo.lock
--- a/pkgs/applications/misc/onagre/default.nix
+++ b/pkgs/applications/misc/onagre/default.nix
@ -1,41 +0,0 @@
-{ lib
-, fetchFromGitHub
-, rustPlatform
-, cmake
-, pkgconf
-, freetype
-, expat
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "onagre";
-  version = "1.0.0-alpha.0";
-
-  src = fetchFromGitHub {
-    owner = "oknozor";
-    repo = pname;
-    rev = version;
-    hash = "sha256-hP+slfCWgsTgR2ZUjAmqx9f7+DBu3MpSLvaiZhqNK1Q=";
-  };
-
-  cargoLock = {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "pop-launcher-1.2.1" = "sha256-LeKaJIvooD2aUlY113P0mzxOcj63sGkrA0SIccNqCLY=";
-    };
-  };
-
-  cargoSha256 = "sha256-IOhAGrAiT2mnScNP7k7XK9CETUr6BjGdQVdEUvTYQT4=";
-
-  nativeBuildInputs = [ cmake pkgconf ];
-  buildInputs = [ freetype expat ];
-
-  meta = with lib; {
-    description = "A general purpose application launcher for X and wayland inspired by rofi/wofi and alfred";
-    homepage = "https://github.com/oknozor/onagre";
-    license = licenses.mit;
-    maintainers = [ maintainers.jfvillablanca ];
-    platforms = platforms.linux;
-    mainProgram = "onagre";
-  };
-}
--- a/pkgs/applications/misc/tui-journal/default.nix
+++ b/pkgs/applications/misc/tui-journal/default.nix
@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "tui-journal";
-  version = "0.8.3";
+  version = "0.8.4";

  src = fetchFromGitHub {
    owner = "AmmarAbouZor";
    repo = "tui-journal";
    rev = "v${version}";
-    hash = "sha256-G8p1eaHebUH2lFNyC2njUzZacE6rayApCb7PBFcpKLk=";
+    hash = "sha256-SgpIR7gLfmX6mCtuqRonqzX07Eblp9Mq80y71b05FZY=";
  };

-  cargoHash = "sha256-iM5PsgCUxBbjeWGEIohZwMiCIdXqj/bhFoL0GtVKKq4=";
+  cargoHash = "sha256-SetNhIengAiLRMHoYBRxHR1LgzYywRC7L6hmRF9COik=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@ -5,6 +5,7 @@
 , libva, pipewire, wayland
 , gcc, nspr, nss, runCommand
 , lib, libkrb5
+, widevine-cdm
 , electron-source # for warnObsoleteVersionConditional

 # package customization
@ -74,78 +75,6 @@ let
    ungoogled-chromium = pkgsBuildBuild.callPackage ./ungoogled.nix {};
  };

-  pkgSuffix = if channel == "dev" then "unstable" else
-    (if channel == "ungoogled-chromium" then "stable" else channel);
-  pkgName = "google-chrome-${pkgSuffix}";
-  chromeSrc =
-    let
-      # Use the latest stable Chrome version if necessary:
-      version = if chromium.upstream-info.hash_deb_amd64 != null
-        then chromium.upstream-info.version
-        else (import ./upstream-info.nix).stable.version;
-      hash = if chromium.upstream-info.hash_deb_amd64 != null
-        then chromium.upstream-info.hash_deb_amd64
-        else (import ./upstream-info.nix).stable.hash_deb_amd64;
-    in fetchurl {
-      urls = map (repo: "${repo}/${pkgName}/${pkgName}_${version}-1_amd64.deb") [
-        "https://dl.google.com/linux/chrome/deb/pool/main/g"
-        "http://95.31.35.30/chrome/pool/main/g"
-        "http://mirror.pcbeta.com/google/chrome/deb/pool/main/g"
-        "http://repo.fdzh.org/chrome/deb/pool/main/g"
-      ];
-      inherit hash;
-  };
-
-  mkrpath = p: "${lib.makeSearchPathOutput "lib" "lib64" p}:${lib.makeLibraryPath p}";
-  widevineCdm = stdenv.mkDerivation {
-    name = "chrome-widevine-cdm";
-
-    src = chromeSrc;
-
-    unpackCmd = let
-      widevineCdmPath =
-        if (channel == "stable" || channel == "ungoogled-chromium") then
-          "./opt/google/chrome/WidevineCdm"
-        else if channel == "beta" then
-          "./opt/google/chrome-beta/WidevineCdm"
-        else if channel == "dev" then
-          "./opt/google/chrome-unstable/WidevineCdm"
-        else
-          throw "Unknown chromium channel.";
-    in ''
-      # Extract just WidevineCdm from upstream's .deb file
-      ar p "$src" data.tar.xz | tar xJ "${widevineCdmPath}"
-
-      # Move things around so that we don't have to reference a particular
-      # chrome-* directory later.
-      mv "${widevineCdmPath}" ./
-
-      # unpackCmd wants a single output directory; let it take WidevineCdm/
-      rm -rf opt
-    '';
-
-    doCheck = true;
-    checkPhase = ''
-      ! find -iname '*.so' -exec ldd {} + | grep 'not found'
-    '';
-
-    PATCH_RPATH = mkrpath [ gcc.cc glib nspr nss ];
-
-    patchPhase = ''
-      patchelf --set-rpath "$PATCH_RPATH" _platform_specific/linux_x64/libwidevinecdm.so
-    '';
-
-    installPhase = ''
-      mkdir -p $out/WidevineCdm
-      cp -a * $out/WidevineCdm/
-    '';
-
-    meta = {
-      platforms = [ "x86_64-linux" ];
-      license = lib.licenses.unfree;
-    };
-  };
-
  suffix = lib.optionalString (channel != "stable" && channel != "ungoogled-chromium") ("-" + channel);

  sandboxExecutableName = chromium.browser.passthru.sandboxExecutableName;
@ -159,7 +88,7 @@ let
        mkdir -p $out
        cp -a ${browser}/* $out/
        chmod u+w $out/libexec/chromium
-        cp -a ${widevineCdm}/WidevineCdm $out/libexec/chromium/
+        cp -a ${widevine-cdm}/share/google/chrome/WidevineCdm $out/libexec/chromium/
      ''
    else browser;

@ -244,7 +173,7 @@ in stdenv.mkDerivation {
  passthru = {
    inherit (chromium) upstream-info browser;
    mkDerivation = chromium.mkChromiumDerivation;
-    inherit chromeSrc sandboxExecutableName;
+    inherit sandboxExecutableName;
  };
 }
 # the following is a complicated and long-winded variant of
--- a/pkgs/applications/networking/browsers/chromium/update.py
+++ b/pkgs/applications/networking/browsers/chromium/update.py
@ -20,7 +20,6 @@ from os.path import abspath, dirname
 from urllib.request import urlopen

 RELEASES_URL = 'https://versionhistory.googleapis.com/v1/chrome/platforms/linux/channels/all/versions/all/releases'
-DEB_URL = 'https://dl.google.com/linux/chrome/deb/pool/main/g'

 PIN_PATH = dirname(abspath(__file__)) + '/upstream-info.nix'
 UNGOOGLED_FLAGS_PATH = dirname(abspath(__file__)) + '/ungoogled-flags.toml'
@ -259,10 +258,6 @@ with urlopen(RELEASES_URL) as resp:
                    version
                )
                src_hash_cache[version] = channel["hash"]
-
-            channel['hash_deb_amd64'] = nix_prefetch_url(
-                f'{DEB_URL}/google-chrome-{google_chrome_suffix}/' +
-                f'google-chrome-{google_chrome_suffix}_{version}-1_amd64.deb')
        except subprocess.CalledProcessError:
            # This release isn't actually available yet.  Continue to
            # the next one.
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@ -16,7 +16,6 @@
      };
    };
    hash = "sha256-nSI+tkJxOedMtYgtiqW37v0ZjgxxU5o/0sH9bPAchBg=";
-    hash_deb_amd64 = "sha256-RvQdpDmWRcsASh1b8M0Zg+AvZprE5qhi14shfo0WlfE=";
    version = "124.0.6367.201";
  };
  ungoogled-chromium = {
@ -33,7 +32,6 @@
      };
    };
    hash = "sha256-nSI+tkJxOedMtYgtiqW37v0ZjgxxU5o/0sH9bPAchBg=";
-    hash_deb_amd64 = "sha256-RvQdpDmWRcsASh1b8M0Zg+AvZprE5qhi14shfo0WlfE=";
    version = "124.0.6367.201";
  };
 }
--- a/pkgs/applications/networking/cluster/glooctl/default.nix
+++ b/pkgs/applications/networking/cluster/glooctl/default.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "glooctl";
-  version = "1.16.10";
+  version = "1.16.11";

  src = fetchFromGitHub {
    owner = "solo-io";
    repo = "gloo";
    rev = "v${version}";
-    hash = "sha256-GC0/HGPO/sbkyf2bLY0A+pQrPYqMv6BP0zNUHENpQjg=";
+    hash = "sha256-3GTSIZRELj8Pdm02SUKSCk6/Q7Hkuggvq+XjJAH9qU0=";
  };

  vendorHash = "sha256-UyzqKpF2WBj25Bm4MtkF6yjl87A61vGsteBNCjJV178=";
--- a/pkgs/applications/networking/cluster/krane/Gemfile.lock
+++ b/pkgs/applications/networking/cluster/krane/Gemfile.lock
@ -14,7 +14,7 @@ GEM
    addressable (2.8.6)
      public_suffix (>= 2.0.2, < 6.0)
    base64 (0.2.0)
-    bigdecimal (3.1.7)
+    bigdecimal (3.1.8)
    colorize (0.8.1)
    concurrent-ruby (1.2.3)
    connection_pool (2.4.1)
@ -48,13 +48,13 @@ GEM
    http-cookie (1.0.5)
      domain_name (~> 0.5)
    http-form_data (2.3.0)
-    i18n (1.14.4)
+    i18n (1.14.5)
      concurrent-ruby (~> 1.0)
    jsonpath (1.1.5)
      multi_json
    jwt (2.8.1)
      base64
-    krane (3.5.2)
+    krane (3.5.3)
      activesupport (>= 5.0)
      colorize (~> 0.8)
      concurrent-ruby (~> 1.1)
@ -75,7 +75,7 @@ GEM
      rake (~> 13.0)
    mime-types (3.5.2)
      mime-types-data (~> 3.2015)
-    mime-types-data (3.2024.0305)
+    mime-types-data (3.2024.0507)
    minitest (5.22.3)
    multi_json (1.15.0)
    mutex_m (0.2.0)
@ -109,4 +109,4 @@ DEPENDENCIES
  krane

 BUNDLED WITH
-   2.5.7
+   2.5.9
--- a/pkgs/applications/networking/cluster/krane/gemset.nix
+++ b/pkgs/applications/networking/cluster/krane/gemset.nix
@ -36,10 +36,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0cq1c29zbkcxgdihqisirhcw76xc768z2zpd5vbccpq0l1lv76g7";
+      sha256 = "1gi7zqgmqwi5lizggs1jhc3zlwaqayy9rx2ah80sxy24bbnng558";
      type = "gem";
    };
-    version = "3.1.7";
+    version = "3.1.8";
  };
  colorize = {
    groups = ["default"];
@ -214,10 +214,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0lbm33fpb3w06wd2231sg58dwlwgjsvym93m548ajvl6s3mfvpn7";
+      sha256 = "1ffix518y7976qih9k1lgnc17i3v6yrlh0a3mckpxdb4wc2vrp16";
      type = "gem";
    };
-    version = "1.14.4";
+    version = "1.14.5";
  };
  jsonpath = {
    dependencies = ["multi_json"];
@ -247,10 +247,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1s2xc5igk3yg3jpl3abakvrsf4xl6hljhgyddjsrp2g05sksa9x6";
+      sha256 = "11jj5fpfsb1sfwgc356xv1vxl8yq65wbbshmawpagk555y0pzbpb";
      type = "gem";
    };
-    version = "3.5.2";
+    version = "3.5.3";
  };
  kubeclient = {
    dependencies = ["http" "jsonpath" "recursive-open-struct" "rest-client"];
@ -290,10 +290,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "00x7w5xqsj9m33v3vkmy23wipkkysafksib53ypzn27p5g81w455";
+      sha256 = "0kybw1a6f7d1ipyawnpi5cwiy05rkz9qwglgfvhmd1z0l2gcigmm";
      type = "gem";
    };
-    version = "3.2024.0305";
+    version = "3.2024.0507";
  };
  minitest = {
    groups = ["default"];
--- a/pkgs/applications/networking/cluster/kubevpn/default.nix
+++ b/pkgs/applications/networking/cluster/kubevpn/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "kubevpn";
-  version = "2.2.7";
+  version = "2.2.8";

  src = fetchFromGitHub {
    owner  = "KubeNetworks";
    repo   = "kubevpn";
    rev    = "v${version}";
-    hash = "sha256-6HZc4PxgTLROn1nQLreC/GP43/MXiqtiSAGsMfXC5vw=";
+    hash = "sha256-/5x1ovvO4Pfnux3GpfeOUy9PIrHPmZzYvOCH09EjxKE=";
  };

  vendorHash = null;
--- a/pkgs/applications/networking/cluster/nova/default.nix
+++ b/pkgs/applications/networking/cluster/nova/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "nova";
-  version = "3.8.0";
+  version = "3.9.0";

  src = fetchFromGitHub {
    owner = "FairwindsOps";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-3bSxMb/JFIy3b6N/94cXfGlUbPIm046O9m2KPan8YIs=";
+    hash = "sha256-9ccWH0bh67LCwzKmyaE32j+qeKfNauclSMjpRwdblH8=";
  };

-  vendorHash = "sha256-c30B8Wjvwp4NnB1P8h4/raGiGAX/cbTZ/KQqh/qeNhA=";
+  vendorHash = "sha256-Vt2yUYm2i1NHzW7GxDRqBpaFS4dLfODNEMPO+CTwrLY=";

  ldflags = [ "-X main.version=${version}" "-s" "-w" ];

--- a/pkgs/applications/networking/instant-messengers/cinny/default.nix
+++ b/pkgs/applications/networking/instant-messengers/cinny/default.nix
@ -29,6 +29,11 @@ buildNpmPackage rec {

  npmDepsHash = "sha256-4R+To2LhcnEM9x1noo6MhCckyBKgPWiAi7zgDqAmaN0=";

+  # Fix error: no member named 'aligned_alloc' in the global namespace
+  env.NIX_CFLAGS_COMPILE = lib.optionalString (
+    stdenv.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinSdkVersion "11.0"
+  ) "-D_LIBCPP_HAS_NO_LIBRARY_ALIGNED_ALLOCATION=1";
+
  nativeBuildInputs = [
    jq
    python3
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@ -1,6 +1,13 @@
-{ hostPlatform, callPackage }: {
-  signal-desktop = if hostPlatform.system == "aarch64-linux"
-    then callPackage ./signal-desktop-aarch64.nix { }
-    else callPackage ./signal-desktop.nix { };
-  signal-desktop-beta = callPackage ./signal-desktop-beta.nix{ };
+{ hostPlatform, callPackage }:
+{
+  signal-desktop =
+    if hostPlatform.system == "aarch64-linux" then
+      callPackage ./signal-desktop-aarch64.nix { }
+    else
+      callPackage ./signal-desktop.nix { };
+  signal-desktop-beta = (callPackage ./signal-desktop-beta.nix { }).overrideAttrs (old: {
+    meta = old.meta // {
+      platforms = [ "x86_64-linux" ];
+    };
+  });
 }
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "signalbackup-tools";
-  version = "20240506";
+  version = "20240509-1";

  src = fetchFromGitHub {
    owner = "bepaald";
    repo = pname;
    rev = version;
-    hash = "sha256-rPM5Qz1n9bTOF//sqpT+LvEjBSCT2BjyQBIxjV6CkGU=";
+    hash = "sha256-GUh/OTeJNBg3TDij/8jIEXfw9ox1wvq6tRq61JbMiZg=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/instant-messengers/twitch-tui/default.nix
+++ b/pkgs/applications/networking/instant-messengers/twitch-tui/default.nix
@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "twitch-tui";
-  version = "2.6.7";
+  version = "2.6.8";

  src = fetchFromGitHub {
    owner = "Xithrius";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-sokOdM4Z2U/B23XEGONNHr2g9iuNz+Hm+on+7xMYD0E=";
+    hash = "sha256-tak9CPqDVGTfQAjNLhPPvYgP4lUV5g1vPziWbRtqOA0=";
  };

-  cargoHash = "sha256-ngivv/2NDmY8c6eInzfdS4GjZQHWU3iJEFI3S+tf34M=";
+  cargoHash = "sha256-SNSFUhm2zFew/oYCoRQXTGEhwmvgM8GX5afPRoltmV0=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/applications/networking/pyload-ng/default.nix
+++ b/pkgs/applications/networking/pyload-ng/default.nix
@ -1,13 +1,15 @@
 { lib, fetchPypi, nixosTests, python3 }:

 python3.pkgs.buildPythonApplication rec {
-  version = "0.5.0b3.dev80";
+  version = "0.5.0b3.dev85";
  pname = "pyload-ng";
  pyproject = true;

  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-1vIkEctoj6udowYxFwY42f/zL9Elw2Nl6ZaL2x30k/M=";
+    inherit version;
+    # The uploaded tarball uses an underscore in recent releases
+    pname = "pyload_ng";
+    hash = "sha256-KLpfh53JKqe0kZLcQ1C4fXFFYeO5pPhia9fRxWsbIHY=";
  };

  patches = [
--- a/pkgs/applications/networking/syncplay/default.nix
+++ b/pkgs/applications/networking/syncplay/default.nix
@ -2,7 +2,6 @@
 , stdenv
 , fetchFromGitHub
 , buildPythonApplication
-, fetchpatch
 , pem
 , pyside6
 , twisted
@ -14,7 +13,7 @@

 buildPythonApplication rec {
  pname = "syncplay";
-  version = "1.7.0";
+  version = "1.7.2";

  format = "other";

@ -22,15 +21,10 @@ buildPythonApplication rec {
    owner = "Syncplay";
    repo = "syncplay";
    rev = "v${version}";
-    sha256 = "sha256-Te81yOv3D6M6aMfC5XrM6/I6BlMdlY1yRk1RRJa9Mxg=";
+    sha256 = "sha256-PERPE6141LXmb8fmW17Vu54Unpf9vEK+ahm6q1byRTU=";
  };

  patches = [
-    (fetchpatch {
-      name = "fix-typeerror.patch";
-      url = "https://github.com/Syncplay/syncplay/commit/b62b038cdf58c54205987dfc52ebf228505ad03b.patch";
-      hash = "sha256-pSP33Qn1I+nJBW8T1E1tSJKRh5OnZMRsbU+jr5z4u7c=";
-    })
    ./trusted_certificates.patch
  ];

@ -52,6 +46,6 @@ buildPythonApplication rec {
    description = "Free software that synchronises media players";
    license = licenses.asl20;
    platforms = platforms.linux ++ platforms.darwin;
-    maintainers = with maintainers; [ Enzime ];
+    maintainers = with maintainers; [ assistant Enzime ];
  };
 }
--- a/pkgs/applications/office/gnucash/0005-disable-test-lots.patch
+++ b/pkgs/applications/office/gnucash/0005-disable-test-lots.patch
@ -0,0 +1,11 @@
+--- a/libgnucash/engine/test/CMakeLists.txt	2024-02-23 09:05:19.000000000 +0900
+++ b/libgnucash/engine/test/CMakeLists.txt	2024-05-08 22:08:04.572060359 +0900
+@@ -57,7 +57,6 @@
+ 
+ add_engine_test(test-account-object test-account-object.cpp)
+ add_engine_test(test-group-vs-book test-group-vs-book.cpp)
+-add_engine_test(test-lots test-lots.cpp)
+ add_engine_test(test-querynew test-querynew.c)
+ add_engine_test(test-query test-query.cpp)
+ add_engine_test(test-split-vs-account test-split-vs-account.cpp)
+
--- a/pkgs/applications/office/gnucash/default.nix
+++ b/pkgs/applications/office/gnucash/default.nix
@ -76,6 +76,9 @@ stdenv.mkDerivation rec {
    ./0003-remove-valgrind.patch
    # this patch makes gnucash exec the Finance::Quote wrapper directly
    ./0004-exec-fq-wrapper.patch
+    # this patch disables a flaky test
+    # see https://bugs.gnucash.org/show_bug.cgi?id=799289
+    ./0005-disable-test-lots.patch
    # Fix importing QIF by backporting a fix. remove on next release
    # https://bugs.gnucash.org/show_bug.cgi?id=799262
    (fetchpatch {
--- a/pkgs/applications/office/planify/default.nix
+++ b/pkgs/applications/office/planify/default.nix
@ -10,6 +10,7 @@
 , evolution-data-server
 , glib
 , glib-networking
+, gst_all_1
 , gtk4
 , gtksourceview5
 , gxml
@ -49,6 +50,9 @@ stdenv.mkDerivation rec {
    evolution-data-server
    glib
    glib-networking
+    # Needed for GtkMediaStream creation with success.ogg, see #311295.
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
    gtk4
    gtksourceview5
    gxml
--- a/pkgs/applications/office/wpsoffice/default.nix
+++ b/pkgs/applications/office/wpsoffice/default.nix
@ -49,6 +49,7 @@ stdenv.mkDerivation rec {

      nativeBuildInputs = [ curl coreutils ];

+      impureEnvVars = lib.fetchers.proxyImpureEnvVars;
      SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
    } ''
    timestamp10=$(date '+%s')
--- a/pkgs/applications/radio/chirp/default.nix
+++ b/pkgs/applications/radio/chirp/default.nix
@ -10,13 +10,13 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "chirp";
-  version = "0.4.0-unstable-2024-05-03";
+  version = "0.4.0-unstable-2024-05-10";

  src = fetchFromGitHub {
    owner = "kk7ds";
    repo = "chirp";
-    rev = "e95140ff433b805ca16df04cba501b7332a9ec95";
-    hash = "sha256-UU3Ve6Yb7UK2nOLTfJasrlMX4iu1cpLBLScvhRhTUJ0=";
+    rev = "d5dc5c8e053dbcf87c8b0ccf03109c0870c22bfb";
+    hash = "sha256-Tqq1dTjtzHTgaHUAio5B8V4Bo+P8EPa3s/kG181TrCc=";
  };
  buildInputs = [
    glib
--- a/pkgs/applications/radio/cloudlog/default.nix
+++ b/pkgs/applications/radio/cloudlog/default.nix
@ -8,13 +8,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "cloudlog";
-  version = "2.6.10";
+  version = "2.6.11";

  src = fetchFromGitHub {
    owner = "magicbug";
    repo = "Cloudlog";
    rev = version;
-    hash = "sha256-VPiv/Df4dasiYUBA6UHrxBczmGAqzhQkPrknzSYJxAE=";
+    hash = "sha256-9JGhMCypoKOh1Gy1DdK7nrma+L4sJsYN/iuNhBPmHPA=";
  };

  postPatch = ''
--- a/pkgs/applications/science/math/eigenmath/default.nix
+++ b/pkgs/applications/science/math/eigenmath/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "eigenmath";
-  version = "0-unstable-2024-05-03";
+  version = "0-unstable-2024-05-12";

  src = fetchFromGitHub {
    owner = "georgeweigt";
    repo = pname;
-    rev = "69ebfbaa7f328ddc9d97b7c404369818a5febe4a";
-    hash = "sha256-lHxVyUXIY9+YIStA6202Bhy/b0xaxJbW/VPI7FbNJk0=";
+    rev = "978b3bd582a90c8e82079f2e4e4a3a5038cbbe08";
+    hash = "sha256-DoGX8nUcWcioTq8ymB+HLsCnt9V6HTKSX4Zs2CQz78Q=";
  };

  checkPhase = let emulator = stdenv.hostPlatform.emulator buildPackages; in ''
--- a/pkgs/applications/version-management/git-cola/default.nix
+++ b/pkgs/applications/version-management/git-cola/default.nix
@ -10,14 +10,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "git-cola";
-  version = "4.7.0";
+  version = "4.7.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "git-cola";
    repo = "git-cola";
    rev = "v${version}";
-    hash = "sha256-BiSs3vWJacCtGthHi/nFJm4Hqt0uO6XXZi/Zqvjb928=";
+    hash = "sha256-93aayGGMgkSghTpx8M5Cfbxf2szAwrSzuoWK6GCTqZ8=";
  };

  buildInputs = lib.optionals stdenv.isLinux [
--- a/pkgs/applications/video/davinci-resolve/default.nix
+++ b/pkgs/applications/video/davinci-resolve/default.nix
@ -25,6 +25,9 @@
 , jq

 , studioVariant ? false
+
+, common-updater-scripts
+, writeShellApplication
 }:

 let
@ -251,7 +254,28 @@ buildFHSEnv {
    ''
  }";

-  passthru = { inherit davinci; };
+  passthru = {
+    inherit davinci;
+    updateScript = lib.getExe (writeShellApplication {
+      name = "update-davinci-resolve";
+      runtimeInputs = [ curl jq common-updater-scripts ];
+      text = ''
+        set -o errexit
+        drv=pkgs/applications/video/davinci-resolve/default.nix
+        currentVersion=${lib.escapeShellArg davinci.version}
+        downloadsJSON="$(curl --fail --silent https://www.blackmagicdesign.com/api/support/us/downloads.json)"
+
+        latestLinuxVersion="$(echo "$downloadsJSON" | jq '[.downloads[] | select(.urls.Linux) | .urls.Linux[] | select(.downloadTitle | test("DaVinci Resolve")) | .downloadTitle]' | grep -oP 'DaVinci Resolve \K\d+\.\d+\.\d+' | sort | tail -n 1)"
+        update-source-version davinci-resolve "$latestLinuxVersion" --source-key=davinci.src
+
+        # Since the standard and studio both use the same version we need to reset it before updating studio
+        sed -i -e "s/""$latestLinuxVersion""/""$currentVersion""/" "$drv"
+
+        latestStudioLinuxVersion="$(echo "$downloadsJSON" | jq '[.downloads[] | select(.urls.Linux) | .urls.Linux[] | select(.downloadTitle | test("DaVinci Resolve")) | .downloadTitle]' | grep -oP 'DaVinci Resolve Studio \K\d+\.\d+\.\d+' | sort | tail -n 1)"
+        update-source-version davinci-resolve-studio "$latestStudioLinuxVersion" --source-key=davinci.src
+      '';
+    });
+  };

  meta = with lib; {
    description = "Professional video editing, color, effects and audio post-processing";
--- a/pkgs/applications/video/kodi/addons/visualization-projectm/default.nix
+++ b/pkgs/applications/video/kodi/addons/visualization-projectm/default.nix
@ -3,13 +3,13 @@
 buildKodiBinaryAddon rec {
  pname = "visualization-projectm";
  namespace = "visualization.projectm";
-  version = "20.2.0";
+  version = "21.0.1";

  src = fetchFromGitHub {
    owner = "xbmc";
    repo = namespace;
    rev = "${version}-${rel}";
-    hash = "sha256-Kcl1ep+RJlofFmxkrGT3T+XXdwiCofq1hggwU0PAd0E=";
+    hash = "sha256-wjSQmOtQb4KjY3iH3Xh7AdQwE6ked+cpW6/gdNYS+NA=";
  };

  extraBuildInputs = [ pkg-config libGL projectm ];
--- a/pkgs/applications/video/mkvtoolnix/default.nix
+++ b/pkgs/applications/video/mkvtoolnix/default.nix
@ -8,6 +8,7 @@
 , cmark
 , docbook_xsl
 , expat
+, fetchpatch2
 , file
 , flac
 , fmt
@ -94,6 +95,11 @@ stdenv.mkDerivation rec {
  ++ optionals stdenv.isLinux [ qtwayland ]
  ++ optionals stdenv.isDarwin [ libiconv ];

+  patches = [ (fetchpatch2 {
+    url = "https://gitlab.com/mbunkus/mkvtoolnix/-/commit/7e1bea9527616ab6ab38425e7290579f05dd9bb1.patch";
+    hash = "sha256-9UZrfwrzfKwF8XDzqYnuaDgZws7l1YAb5O1O1+nxo0g=";
+  }) ];
+
  # autoupdate is not needed but it silences a ton of pointless warnings
  postPatch = ''
    patchShebangs . > /dev/null
--- a/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
@ -23,13 +23,13 @@

 stdenv.mkDerivation rec {
  pname = "advanced-scene-switcher";
-  version = "1.25.5";
+  version = "1.26.0";

  src = fetchFromGitHub {
    owner = "WarmUpTill";
    repo = "SceneSwitcher";
    rev = version;
-    hash = "sha256-ROR+R1Zak8XkhFk1+Pyi0lB+JZI4SVtKGin4vem7NEE=";
+    hash = "sha256-ba+QQWekDp/9V+kNcNowXXJrfU4DCttz0tSoC7Ko1bE=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@ -19,11 +19,10 @@
 , symlinkJoin
 , substituteAll
 , extraPackages ? [ ]
-, runc
 , crun
-, gvisor
-, youki
+, runc
 , conmon
+, extraRuntimes ? lib.optionals stdenv.isLinux [ runc ]  # e.g.: runc, gvisor, youki
 , slirp4netns
 , fuse-overlayfs
 , util-linux
@ -59,28 +58,30 @@ let
      netavark
      slirp4netns
      passt
-    ];
+      conmon
+      crun
+    ] ++ extraRuntimes;
  };
 in
 buildGoModule rec {
  pname = "podman";
-  version = "5.0.2";
+  version = "5.0.3";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "podman";
    rev = "v${version}";
-    hash = "sha256-8Swqwyzu/WI9mG21bLF81Kk4kS2Ltg0GV9G3EcG/FnU=";
+    hash = "sha256-PA7mKHPzPDFdwKXAHvHnDvHF+mTmm59jkoeUeiCP6vE=";
  };

  patches = [
-    # we intentionally don't build and install the helper so we shouldn't display messages to users about it
-    ./rm-podman-mac-helper-msg.patch
-  ] ++ lib.optionals stdenv.isLinux [
    (substituteAll {
      src = ./hardcode-paths.patch;
-      inherit crun runc gvisor youki conmon;
+      bin_path = helpersBin;
    })
+
+    # we intentionally don't build and install the helper so we shouldn't display messages to users about it
+    ./rm-podman-mac-helper-msg.patch
  ];

  vendorHash = null;
--- a/pkgs/applications/virtualization/podman/hardcode-paths.patch
+++ b/pkgs/applications/virtualization/podman/hardcode-paths.patch
@ -1,8 +1,8 @@
 diff --git a/vendor/github.com/containers/common/pkg/config/default.go b/vendor/github.com/containers/common/pkg/config/default.go
-index 19c4bb6bf..2743de4b2 100644
+index 3a6d804ad..5628e2bf6 100644
 --- a/vendor/github.com/containers/common/pkg/config/default.go
 +++ b/vendor/github.com/containers/common/pkg/config/default.go
-@@ -364,75 +364,34 @@ func defaultEngineConfig() (*EngineConfig, error) {
+@@ -366,75 +366,34 @@ func defaultEngineConfig() (*EngineConfig, error) {
 	c.Retry = 3
 	c.OCIRuntimes = map[string][]string{
 		"crun": {
@ -13,7 +13,7 @@ index 19c4bb6bf..2743de4b2 100644
 -			"/sbin/crun",
 -			"/bin/crun",
 -			"/run/current-system/sw/bin/crun",
-+			"@crun@/bin/crun",
+			"@bin_path@/bin/crun",
 		},
 		"crun-vm": {
 -			"/usr/bin/crun-vm",
@ -22,7 +22,7 @@ index 19c4bb6bf..2743de4b2 100644
 -			"/sbin/crun-vm",
 -			"/bin/crun-vm",
 -			"/run/current-system/sw/bin/crun-vm",
-+			// TODO: "@crun-vm@/bin/crun-vm",
+			"@bin_path@/bin/crun-vm",
 		},
 		"crun-wasm": {
 -			"/usr/bin/crun-wasm",
@ -32,7 +32,7 @@ index 19c4bb6bf..2743de4b2 100644
 -			"/sbin/crun-wasm",
 -			"/bin/crun-wasm",
 -			"/run/current-system/sw/bin/crun-wasm",
-+			// TODO: "@crun-wasm@/bin/crun-wasm",
+			"@bin_path@/bin/crun-wasm",
 		},
 		"runc": {
 -			"/usr/bin/runc",
@ -43,11 +43,11 @@ index 19c4bb6bf..2743de4b2 100644
 -			"/bin/runc",
 -			"/usr/lib/cri-o-runc/sbin/runc",
 -			"/run/current-system/sw/bin/runc",
-+			"@runc@/bin/runc",
+			"@bin_path@/bin/runc",
 		},
 		"runj": {
 -			"/usr/local/bin/runj",
-+			// TODO: "@runj@/bin/runj",
+			"@bin_path@/bin/runj",
 		},
 		"kata": {
 -			"/usr/bin/kata-runtime",
@ -58,7 +58,7 @@ index 19c4bb6bf..2743de4b2 100644
 -			"/bin/kata-runtime",
 -			"/usr/bin/kata-qemu",
 -			"/usr/bin/kata-fc",
-+			// TODO: "@kata@/bin/kata",
+			"@bin_path@/bin/kata-runtime",
 		},
 		"runsc": {
 -			"/usr/bin/runsc",
@ -68,27 +68,27 @@ index 19c4bb6bf..2743de4b2 100644
 -			"/bin/runsc",
 -			"/sbin/runsc",
 -			"/run/current-system/sw/bin/runsc",
-+			"@gvisor@/bin/runsc",
+			"@bin_path@/bin/runsc",
 		},
 		"youki": {
 -			"/usr/local/bin/youki",
 -			"/usr/bin/youki",
 -			"/bin/youki",
 -			"/run/current-system/sw/bin/youki",
-+			"@youki@/bin/youki",
+			"@bin_path@/bin/youki",
 		},
 		"krun": {
 -			"/usr/bin/krun",
 -			"/usr/local/bin/krun",
-+			// TODO: "@krun@/bin/krun",
+			"@bin_path@/bin/krun",
 		},
 		"ocijail": {
 -			"/usr/local/bin/ocijail",
-+			// TODO: "@ocijail@/bin/ocijail",
+			"@bin_path@/bin/ocijail",
 		},
 	}
 	c.PlatformToOCIRuntime = map[string]string{
-@@ -443,16 +402,9 @@ func defaultEngineConfig() (*EngineConfig, error) {
+@@ -445,26 +404,12 @@ func defaultEngineConfig() (*EngineConfig, error) {
 	// Needs to be called after populating c.OCIRuntimes.
 	c.OCIRuntime = c.findRuntime()
 
@ -103,7 +103,18 @@ index 19c4bb6bf..2743de4b2 100644
 -		"/usr/local/bin/conmon",
 -		"/usr/local/sbin/conmon",
 -		"/run/current-system/sw/bin/conmon",
-+		"@conmon@/bin/conmon",
+		"@bin_path@/bin/conmon",
 	})
 	c.ConmonRsPath.Set([]string{
- 		"/usr/libexec/podman/conmonrs",
+-		"/usr/libexec/podman/conmonrs",
+-		"/usr/local/libexec/podman/conmonrs",
+-		"/usr/local/lib/podman/conmonrs",
+-		"/usr/bin/conmonrs",
+-		"/usr/sbin/conmonrs",
+-		"/usr/local/bin/conmonrs",
+-		"/usr/local/sbin/conmonrs",
+-		"/run/current-system/sw/bin/conmonrs",
+		"@bin_path@/bin/conmonrs",
+ 	})
+ 	c.PullPolicy = DefaultPullPolicy
+ 	c.RuntimeSupportsJSON.Set([]string{
--- a/pkgs/applications/window-managers/hyprwm/hyprland/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland/default.nix
@ -81,6 +81,7 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  nativeBuildInputs = [
+    hwdata
    jq
    makeWrapper
    meson
@ -114,7 +115,6 @@ stdenv.mkDerivation (finalAttrs: {
    pciutils
    tomlplusplus
    # for subproject wlroots-hyprland
-    hwdata
    seatd
    libliftoff
    libdisplay-info
--- a/pkgs/build-support/php/builders/v1/build-composer-project.nix
+++ b/pkgs/build-support/php/builders/v1/build-composer-project.nix
@ -1,5 +1,6 @@
 {
  callPackage,
+  nix-update-script,
  stdenvNoCC,
  lib,
  php,
@ -89,6 +90,13 @@ let
          composerStrictValidation = previousAttrs.composerStrictValidation or true;
        });

+      # Projects providing a lockfile from upstream can be automatically updated.
+      passthru = previousAttrs.passthru or { } // {
+        updateScript =
+          previousAttrs.passthru.updateScript
+            or (if finalAttrs.composerRepository.composerLock == null then nix-update-script { } else null);
+      };
+
      env = {
        COMPOSER_CACHE_DIR = "/dev/null";
        COMPOSER_DISABLE_NETWORK = "1";
--- a/pkgs/by-name/ad/adafruit-nrfutil/package.nix
+++ b/pkgs/by-name/ad/adafruit-nrfutil/package.nix
@ -19,11 +19,17 @@ python3Packages.buildPythonApplication rec {
  patches = [
    # Pull a patch which fixes the tests, but is not yet released in a new version:
    # https://github.com/adafruit/Adafruit_nRF52_nrfutil/pull/38
+    # https://github.com/adafruit/Adafruit_nRF52_nrfutil/pull/42
    (fetchpatch {
      name = "fix-tests.patch";
      url = "https://github.com/adafruit/Adafruit_nRF52_nrfutil/commit/e5fbcc8ee5958041db38c04139ba686bf7d1b845.patch";
      sha256 = "sha256-0tbJldGtYcDdUzA3wZRv0lenXVn6dqV016U9nMpQ6/w=";
    })
+    (fetchpatch {
+      name = "fix-test-test_get_vk_pem.patch";
+      url = "https://github.com/adafruit/Adafruit_nRF52_nrfutil/commit/f42cee3c2d7c8d0911f27ba24d6a140083cb85cf.patch";
+      sha256 = "sha256-7WoRqPKc8O5EYK7Fj1WrMJREwhueiVpkEizIfVnEPBU=";
+    })
  ];

  nativeBuildInputs = with python3Packages; [
--- a/pkgs/by-name/ad/adwsteamgtk/package.nix
+++ b/pkgs/by-name/ad/adwsteamgtk/package.nix
@ -12,7 +12,7 @@

 python3Packages.buildPythonApplication rec {
  pname = "adwsteamgtk";
-  version = "0.6.10";
+  version = "0.6.11";
  # built with meson, not a python format
  format = "other";

@ -20,7 +20,7 @@ python3Packages.buildPythonApplication rec {
    owner = "Foldex";
    repo = "AdwSteamGtk";
    rev = "refs/tags/v${version}";
-    hash = "sha256-sh4FLXG78i20Bt8pCCbhO6Sx815stjAZRLCD+X5Zk40=";
+    hash = "sha256-f7+2gTpG5Ntgq+U2AkQihzSTrO+oMsLWxgxe4dVyz8A=";
  };

  buildInputs = [
--- a/pkgs/by-name/al/alacarte/package.nix
+++ b/pkgs/by-name/al/alacarte/package.nix
@ -0,0 +1,70 @@
+{
+  lib,
+  fetchFromGitLab,
+  python3,
+  autoconf,
+  automake,
+  gettext,
+  pkg-config,
+  libxslt,
+  gobject-introspection,
+  wrapGAppsHook3,
+  gnome-menus,
+  glib,
+  gtk3,
+  docbook_xsl,
+  nix-update-script,
+}:
+python3.pkgs.buildPythonApplication rec {
+  pname = "alacarte";
+  version = "3.52.0";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "GNOME";
+    repo = "alacarte";
+    rev = version;
+    hash = "sha256-SkolSk6RireH3aKkRTUCib/nflqD02PR9uVtXePRHQY=";
+  };
+
+  format = "other";
+
+  nativeBuildInputs = [
+    autoconf
+    automake
+    gettext
+    pkg-config
+    python3
+    libxslt
+    gobject-introspection
+    wrapGAppsHook3
+  ];
+
+  buildInputs = [
+    gnome-menus
+    glib
+    gtk3
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [ pygobject3 ];
+
+  configureScript = "./autogen.sh";
+
+  # Builder couldn't fetch the docbook.xsl from the internet directly,
+  # so we substitute it with the docbook.xsl in already in nixpkgs
+  preConfigure = ''
+    substituteInPlace man/Makefile.am \
+      --replace-fail "http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl" "${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl"
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    homepage = "https://gitlab.gnome.org/GNOME/alacarte";
+    description = "A menu editor for GNOME using the freedesktop.org menu specification";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    mainProgram = "alacarte";
+    maintainers = with lib.maintainers; [ pluiedev ];
+  };
+}
--- a/pkgs/by-name/au/audio-sharing/package.nix
+++ b/pkgs/by-name/au/audio-sharing/package.nix
@ -21,20 +21,20 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "audio-sharing";
-  version = "0.2.2";
+  version = "0.2.4";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "World";
    repo = "AudioSharing";
    rev = finalAttrs.version;
-    hash = "sha256-ejNktgN9tfi4TzWDQJnESGcBkpvLVH34sukTFCBfo3U=";
+    hash = "sha256-yUMiy5DaCPfCmBIGCXpqtvSSmQl5wo6vsLdW7Tt/Wfo=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit (finalAttrs) src;
    name = "${finalAttrs.pname}-${finalAttrs.version}";
-    hash = "sha256-c19DxHF4HFN0qTqC2CNzwko79uVeLeyrrXAvuyxeiOQ=";
+    hash = "sha256-FfjSttXf6WF2w59CP6L/+BIuuXp2yKPTku7FMvdIHg0=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/be/bevelbar/package.nix
+++ b/pkgs/by-name/be/bevelbar/package.nix
@ -1,24 +1,24 @@
-{ lib,
+{
+  lib,
  stdenv,
  fetchurl,
  pkg-config,
  libX11,
  libXft,
  libXrandr,
+  gitUpdater,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "bevelbar";
-  version = "22.06";
+  version = "23.08";

  src = fetchurl {
    url = "https://www.uninformativ.de/git/bevelbar/archives/bevelbar-v${finalAttrs.version}.tar.gz";
-    hash = "sha256-8ceFwQFHhJ1qEXJtzoDXU0XRgudaAfsoWq7LYgGEqsM=";
+    hash = "sha256-4wMSPi9tu+z1AW2uvPefxkeT/5DYo2oJybhNnpe82QU=";
  };

-  nativeBuildInputs = [
-    pkg-config
-  ];
+  nativeBuildInputs = [ pkg-config ];

  buildInputs = [
    libX11
@ -28,11 +28,19 @@ stdenv.mkDerivation (finalAttrs: {

  makeFlags = [ "prefix=$(out)" ];

-  meta = with lib; {
+  passthru.updateScript = gitUpdater {
+    url = "https://www.uninformativ.de/git/bevelbar.git/";
+    rev-prefix = "v";
+  };
+
+  meta = {
    homepage = "https://www.uninformativ.de/git/bevelbar/file/README.html";
    description = "X11 status bar with beveled borders";
-    license = licenses.mit;
-    maintainers = with maintainers; [ AndersonTorres neeasade ];
-    platforms = platforms.linux;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      AndersonTorres
+      neeasade
+    ];
+    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/by-name/bu/buckle/package.nix
+++ b/pkgs/by-name/bu/buckle/package.nix
@ -1,4 +1,10 @@
-{ lib, fetchFromGitHub, rustPlatform }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  rustPlatform,
+  darwin,
+}:

 rustPlatform.buildRustPackage rec {
  pname = "buckle";
@ -12,6 +18,11 @@ rustPlatform.buildRustPackage rec {
    sha256 = "sha256-eWhcDzw+6I5N0dse5avwhcQ/y6YZ6b3QKyBwWBrA/xo=";
  };

+  buildInputs = lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.Security
+    darwin.apple_sdk.frameworks.SystemConfiguration
+  ];
+
  checkFlags = [
    # Both tests access the network.
    "--skip=test_buck2_latest"
--- a/pkgs/by-name/ca/cargo-raze/package.nix
+++ b/pkgs/by-name/ca/cargo-raze/package.nix
@ -0,0 +1,55 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  rustPlatform,
+  pkg-config,
+  curl,
+  libgit2,
+  openssl,
+  darwin,
+}:
+let
+  version = "0.16.1";
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = "cargo-raze";
+    rev = "v${version}";
+    hash = "sha256-dn1MrF+FYBG+vD5AfXCwmzskmKK/TXArnMWW2BAfFFQ=";
+  };
+in
+rustPlatform.buildRustPackage {
+  pname = "cargo-raze";
+  inherit src version;
+
+  sourceRoot = "${src.name}/impl";
+
+  # Make it build on Rust >1.76. Since upstream is unmaintained,
+  # there's no counting on them to fix this any time soon...
+  # See #310673 and #310125 for similar fixes
+  cargoPatches = [ ./rustc-serialize-fix.patch ];
+
+  cargoHash = "sha256-V8FkkWcXrYcDmhbdJztpbd4gBVbtbPY0NHS4pb/z8HM=";
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [
+    libgit2
+    openssl
+    curl
+  ] ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;
+
+  preCheck = lib.optionalString stdenv.isDarwin ''
+    # Darwin issue: Os { code: 24, kind: Uncategorized, message: "Too many open files" }
+    # https://github.com/google/cargo-raze/issues/544
+    ulimit -n 1024
+  '';
+
+  __darwinAllowLocalNetworking = true;
+
+  meta = {
+    description = "Generate Bazel BUILD files from Cargo dependencies";
+    homepage = "https://github.com/google/cargo-raze";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ elasticdog ];
+  };
+}
--- a/pkgs/by-name/ca/cargo-raze/rustc-serialize-fix.patch
+++ b/pkgs/by-name/ca/cargo-raze/rustc-serialize-fix.patch
@ -0,0 +1,29 @@
+diff --git a/impl/Cargo.lock b/impl/Cargo.lock
+index 0c963206..7db3432f 100644
+--- a/Cargo.lock
+++ b/Cargo.lock
+@@ -1957,9 +1957,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "rustc-serialize"
+-version = "0.3.24"
+version = "0.3.25"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "dcf128d1287d2ea9d80910b5f1120d0b8eede3fbf1abe91c40d39ea7d51e6fda"
+checksum = "fe834bc780604f4674073badbad26d7219cadfb4a2275802db12cbae17498401"
+ 
+ [[package]]
+ name = "ryu"
+diff --git a/impl/Cargo.toml b/impl/Cargo.toml
+index 9dd6dd99..a559febf 100644
+--- a/Cargo.toml
+++ b/Cargo.toml
+@@ -38,7 +38,7 @@ itertools = "0.10.0"
+ log = "0.4.13"
+ pathdiff = "0.2.0"
+ regex = "1.5.5"
+-rustc-serialize = "0.3.24"
+rustc-serialize = "0.3.25"
+ semver = { version = "1", features = ["serde"] }
+ serde = "1.0.120"
+ serde_derive = "1.0.120"
--- a/Show More
+++ b/Show More