Merge master into haskell-updates

2024-01-13 00:13:05 +00:00 · 2024-01-13 00:13:05 +00:00 · 13076e430b
commit 13076e430b
parent 245035ea35 a4e8dd38d1
134 changed files with 30427 additions and 1640 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -11437,6 +11437,12 @@
    githubId = 458783;
    name = "Martin Gammelsæter";
  };
+  martinjlowm = {
+    email = "martin@martinjlowm.dk";
+    github = "martinjlowm";
+    githubId = 110860;
+    name = "Martin Jesper Low Madsen";
+  };
  martinramm = {
    email = "martin-ramm@gmx.de";
    github = "MartinRamm";
@ -15806,6 +15812,12 @@
    githubId = 7221768;
    name = "Andika Demas Riyandi";
  };
+  rjpcasalino = {
+    email = "ryan@rjpc.net";
+    github = "rjpcasalino";
+    githubId = 12821230;
+    name = "Ryan J.P. Casalino";
+  };
  rkitover = {
    email = "rkitover@gmail.com";
    github = "rkitover";
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -68,6 +68,18 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 - `mkosi` was updated to v19. Parts of the user interface have changed. Consult the
  [release notes](https://github.com/systemd/mkosi/releases/tag/v19) for a list of changes.

+- `services.nginx` will no longer advertise HTTP/3 availability automatically. This must now be manually added, preferably to each location block.
+  Example:
+
+  ```nix
+    locations."/".extraConfig = ''
+      add_header Alt-Svc 'h3=":$server_port"; ma=86400';
+    '';
+    locations."^~ /assets/".extraConfig = ''
+      add_header Alt-Svc 'h3=":$server_port"; ma=86400';
+    '';
+
+  ```
 - The `kanata` package has been updated to v1.5.0, which includes [breaking changes](https://github.com/jtroo/kanata/releases/tag/v1.5.0).

 - The latest available version of Nextcloud is v28 (available as `pkgs.nextcloud28`). The installation logic is as follows:
--- a/nixos/lib/make-single-disk-zfs-image.nix
+++ b/nixos/lib/make-single-disk-zfs-image.nix
@ -21,6 +21,9 @@
 , # size of the FAT partition, in megabytes.
  bootSize ? 1024

+  , # memory allocated for virtualized build instance
+  memSize ? 1024
+
 , # The size of the root partition, in megabytes.
  rootSize ? 2048

@ -230,7 +233,7 @@ let
  ).runInLinuxVM (
    pkgs.runCommand name
      {
-        memSize = 1024;
+        inherit memSize;
        QEMU_OPTS = "-drive file=$rootDiskImage,if=virtio,cache=unsafe,werror=report";
        preVM = ''
          PATH=$PATH:${pkgs.qemu_kvm}/bin
--- a/nixos/maintainers/scripts/openstack/openstack-image-zfs.nix
+++ b/nixos/maintainers/scripts/openstack/openstack-image-zfs.nix
@ -20,6 +20,12 @@ in
      default = "nixos-openstack-image-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}";
    };

+    ramMB = mkOption {
+      type = types.int;
+      default = 1024;
+      description = lib.mdDoc "RAM allocation for build VM";
+    };
+
    sizeMB = mkOption {
      type = types.int;
      default = 8192;
@ -64,7 +70,7 @@ in
      includeChannel = copyChannel;

      bootSize = 1000;
-
+      memSize = cfg.ramMB;
      rootSize = cfg.sizeMB;
      rootPoolProperties = {
        ashift = 12;
--- a/nixos/modules/services/admin/pgadmin.nix
+++ b/nixos/modules/services/admin/pgadmin.nix
@ -44,12 +44,19 @@ in

    initialPasswordFile = mkOption {
      description = lib.mdDoc ''
-        Initial password file for the pgAdmin account.
+        Initial password file for the pgAdmin account. Minimum length by default is 6.
+        Please see `services.pgadmin.minimumPasswordLength`.
        NOTE: Should be string not a store path, to prevent the password from being world readable
      '';
      type = types.path;
    };

+    minimumPasswordLength = mkOption {
+      description = lib.mdDoc "Minimum length of the password";
+      type = types.int;
+      default = 6;
+    };
+
    emailServer = {
      enable = mkOption {
        description = lib.mdDoc ''
@ -116,6 +123,7 @@ in

    services.pgadmin.settings = {
      DEFAULT_SERVER_PORT = cfg.port;
+      PASSWORD_LENGTH_MIN = cfg.minimumPasswordLength;
      SERVER_MODE = true;
      UPGRADE_CHECK_ENABLED = false;
    } // (optionalAttrs cfg.openFirewall {
@ -141,6 +149,14 @@ in

      preStart = ''
        # NOTE: this is idempotent (aka running it twice has no effect)
+        # Check here for password length to prevent pgadmin from starting
+        # and presenting a hard to find error message
+        # see https://github.com/NixOS/nixpkgs/issues/270624
+        PW_LENGTH=$(wc -m < ${escapeShellArg cfg.initialPasswordFile})
+        if [ $PW_LENGTH -lt ${toString cfg.minimumPasswordLength} ]; then
+            echo "Password must be at least ${toString cfg.minimumPasswordLength} characters long"
+            exit 1
+        fi
        (
          # Email address:
          echo ${escapeShellArg cfg.initialEmail}
--- a/nixos/modules/services/mail/dovecot.nix
+++ b/nixos/modules/services/mail/dovecot.nix
@ -1,8 +1,11 @@
 { options, config, lib, pkgs, ... }:

-with lib;
-
 let
+  inherit (lib) any attrValues concatMapStringsSep concatStrings
+    concatStringsSep flatten imap1 isList literalExpression mapAttrsToList
+    mkEnableOption mkIf mkOption mkRemovedOptionModule optional optionalAttrs
+    optionalString singleton types;
+
  cfg = config.services.dovecot2;
  dovecotPkg = pkgs.dovecot;

@ -113,6 +116,36 @@ let
      ''
    )

+    ''
+      plugin {
+        sieve_plugins = ${concatStringsSep " " cfg.sieve.plugins}
+        sieve_extensions = ${concatStringsSep " " (map (el: "+${el}") cfg.sieve.extensions)}
+        sieve_global_extensions = ${concatStringsSep " " (map (el: "+${el}") cfg.sieve.globalExtensions)}
+    ''
+    (optionalString (cfg.imapsieve.mailbox != []) ''
+      ${
+        concatStringsSep "\n" (flatten (imap1 (
+            idx: el:
+              singleton "imapsieve_mailbox${toString idx}_name = ${el.name}"
+              ++ optional (el.from != null) "imapsieve_mailbox${toString idx}_from = ${el.from}"
+              ++ optional (el.causes != null) "imapsieve_mailbox${toString idx}_causes = ${el.causes}"
+              ++ optional (el.before != null) "imapsieve_mailbox${toString idx}_before = file:${stateDir}/imapsieve/before/${baseNameOf el.before}"
+              ++ optional (el.after != null) "imapsieve_mailbox${toString idx}_after = file:${stateDir}/imapsieve/after/${baseNameOf el.after}"
+          )
+          cfg.imapsieve.mailbox))
+      }
+    '')
+    (optionalString (cfg.sieve.pipeBins != []) ''
+        sieve_pipe_bin_dir = ${pkgs.linkFarm "sieve-pipe-bins" (map (el: {
+          name = builtins.unsafeDiscardStringContext (baseNameOf el);
+          path = el;
+        })
+        cfg.sieve.pipeBins)}
+    '')
+    ''
+      }
+    ''
+
    cfg.extraConfig
  ];

@ -343,6 +376,104 @@ in
      description = lib.mdDoc "Quota limit for the user in bytes. Supports suffixes b, k, M, G, T and %.";
    };

+    imapsieve.mailbox = mkOption {
+      default = [];
+      description = "Configure Sieve filtering rules on IMAP actions";
+      type = types.listOf (types.submodule ({ config, ... }: {
+        options = {
+          name = mkOption {
+            description = ''
+              This setting configures the name of a mailbox for which administrator scripts are configured.
+
+              The settings defined hereafter with matching sequence numbers apply to the mailbox named by this setting.
+
+              This setting supports wildcards with a syntax compatible with the IMAP LIST command, meaning that this setting can apply to multiple or even all ("*") mailboxes.
+            '';
+            example = "Junk";
+            type = types.str;
+          };
+
+          from = mkOption {
+            default = null;
+            description = ''
+              Only execute the administrator Sieve scripts for the mailbox configured with services.dovecot2.imapsieve.mailbox.<name>.name when the message originates from the indicated mailbox.
+
+              This setting supports wildcards with a syntax compatible with the IMAP LIST command, meaning that this setting can apply to multiple or even all ("*") mailboxes.
+            '';
+            example = "*";
+            type = types.nullOr types.str;
+          };
+
+          causes = mkOption {
+            default = null;
+            description = ''
+              Only execute the administrator Sieve scripts for the mailbox configured with services.dovecot2.imapsieve.mailbox.<name>.name when one of the listed IMAPSIEVE causes apply.
+
+              This has no effect on the user script, which is always executed no matter the cause.
+            '';
+            example = "COPY";
+            type = types.nullOr (types.enum [ "APPEND" "COPY" "FLAG" ]);
+          };
+
+          before = mkOption {
+            default = null;
+            description = ''
+              When an IMAP event of interest occurs, this sieve script is executed before any user script respectively.
+
+              This setting each specify the location of a single sieve script. The semantics of this setting is similar to sieve_before: the specified scripts form a sequence together with the user script in which the next script is only executed when an (implicit) keep action is executed.
+            '';
+            example = literalExpression "./report-spam.sieve";
+            type = types.nullOr types.path;
+          };
+
+          after = mkOption {
+            default = null;
+            description = ''
+              When an IMAP event of interest occurs, this sieve script is executed after any user script respectively.
+
+              This setting each specify the location of a single sieve script. The semantics of this setting is similar to sieve_after: the specified scripts form a sequence together with the user script in which the next script is only executed when an (implicit) keep action is executed.
+            '';
+            example = literalExpression "./report-spam.sieve";
+            type = types.nullOr types.path;
+          };
+        };
+      }));
+    };
+
+    sieve = {
+      plugins = mkOption {
+        default = [];
+        example = [ "sieve_extprograms" ];
+        description = "Sieve plugins to load";
+        type = types.listOf types.str;
+      };
+
+      extensions = mkOption {
+        default = [];
+        description = "Sieve extensions for use in user scripts";
+        example = [ "notify" "imapflags" "vnd.dovecot.filter" ];
+        type = types.listOf types.str;
+      };
+
+      globalExtensions = mkOption {
+        default = [];
+        example = [ "vnd.dovecot.environment" ];
+        description = "Sieve extensions for use in global scripts";
+        type = types.listOf types.str;
+      };
+
+      pipeBins = mkOption {
+        default = [];
+        example = literalExpression ''
+          map lib.getExe [
+            (pkgs.writeShellScriptBin "learn-ham.sh" "exec ''${pkgs.rspamd}/bin/rspamc learn_ham")
+            (pkgs.writeShellScriptBin "learn-spam.sh" "exec ''${pkgs.rspamd}/bin/rspamc learn_spam")
+          ]
+        '';
+        description = "Programs available for use by the vnd.dovecot.pipe extension";
+        type = types.listOf types.path;
+      };
+    };
  };


@ -353,14 +484,23 @@ in
      enable = true;
      params.dovecot2 = {};
    };
-    services.dovecot2.protocols =
-      optional cfg.enableImap "imap"
-      ++ optional cfg.enablePop3 "pop3"
-      ++ optional cfg.enableLmtp "lmtp";

-    services.dovecot2.mailPlugins = mkIf cfg.enableQuota {
-      globally.enable = [ "quota" ];
-      perProtocol.imap.enable = [ "imap_quota" ];
+    services.dovecot2 = {
+      protocols =
+        optional cfg.enableImap "imap"
+        ++ optional cfg.enablePop3 "pop3"
+        ++ optional cfg.enableLmtp "lmtp";
+
+      mailPlugins = mkIf cfg.enableQuota {
+        globally.enable = [ "quota" ];
+        perProtocol.imap.enable = [ "imap_quota" ];
+      };
+
+      sieve.plugins =
+        optional (cfg.imapsieve.mailbox != []) "sieve_imapsieve"
+        ++ optional (cfg.sieve.pipeBins != []) "sieve_extprograms";
+
+      sieve.globalExtensions = optional (cfg.sieve.pipeBins != []) "vnd.dovecot.pipe";
    };

    users.users = {
@ -415,7 +555,7 @@ in
      # (should be 0) so that the compiled sieve script is newer than
      # the source file and Dovecot won't try to compile it.
      preStart = ''
-        rm -rf ${stateDir}/sieve
+        rm -rf ${stateDir}/sieve ${stateDir}/imapsieve
      '' + optionalString (cfg.sieveScripts != {}) ''
        mkdir -p ${stateDir}/sieve
        ${concatStringsSep "\n" (
@ -432,6 +572,29 @@ in
        ) cfg.sieveScripts
      )}
        chown -R '${cfg.mailUser}:${cfg.mailGroup}' '${stateDir}/sieve'
+      ''
+      + optionalString (cfg.imapsieve.mailbox != []) ''
+        mkdir -p ${stateDir}/imapsieve/{before,after}
+
+        ${
+          concatMapStringsSep "\n"
+            (el:
+              optionalString (el.before != null) ''
+                cp -p ${el.before} ${stateDir}/imapsieve/before/${baseNameOf el.before}
+                ${pkgs.dovecot_pigeonhole}/bin/sievec '${stateDir}/imapsieve/before/${baseNameOf el.before}'
+              ''
+              + optionalString (el.after != null) ''
+                cp -p ${el.after} ${stateDir}/imapsieve/after/${baseNameOf el.after}
+                ${pkgs.dovecot_pigeonhole}/bin/sievec '${stateDir}/imapsieve/after/${baseNameOf el.after}'
+              ''
+            )
+            cfg.imapsieve.mailbox
+        }
+
+        ${
+          optionalString (cfg.mailUser != null && cfg.mailGroup != null)
+            "chown -R '${cfg.mailUser}:${cfg.mailGroup}' '${stateDir}/imapsieve'"
+        }
      '';
    };

@ -459,4 +622,5 @@ in

  };

+  meta.maintainers = [ lib.maintainers.dblsaiko ];
 }
--- a/nixos/modules/services/misc/ntfy-sh.nix
+++ b/nixos/modules/services/misc/ntfy-sh.nix
@ -79,12 +79,6 @@ in
        cache-file = mkDefault "/var/lib/ntfy-sh/cache-file.db";
      };

-      systemd.tmpfiles.rules = [
-        "f ${cfg.settings.auth-file} 0600 ${cfg.user} ${cfg.group} - -"
-        "d ${cfg.settings.attachment-cache-dir} 0700 ${cfg.user} ${cfg.group} - -"
-        "f ${cfg.settings.cache-file} 0600 ${cfg.user} ${cfg.group} - -"
-      ];
-
      systemd.services.ntfy-sh = {
        description = "Push notifications server";

--- a/nixos/modules/services/networking/miniupnpd.nix
+++ b/nixos/modules/services/networking/miniupnpd.nix
@ -13,8 +13,17 @@ let
      listening_ip=${range}
    '') cfg.internalIPs}

+    ${lib.optionalString (firewall == "nftables") ''
+      upnp_table_name=miniupnpd
+      upnp_nat_table_name=miniupnpd
+    ''}
+
    ${cfg.appendConfig}
  '';
+  firewall = if config.networking.nftables.enable then "nftables" else "iptables";
+  miniupnpd = pkgs.miniupnpd.override { inherit firewall; };
+  firewallScripts = lib.optionals (firewall == "iptables")
+    ([ "iptables"] ++ lib.optional (config.networking.enableIPv6) "ip6tables");
 in
 {
  options = {
@ -57,20 +66,50 @@ in
  };

  config = mkIf cfg.enable {
-    networking.firewall.extraCommands = ''
-      ${pkgs.bash}/bin/bash -x ${pkgs.miniupnpd}/etc/miniupnpd/iptables_init.sh -i ${cfg.externalInterface}
-    '';
+    networking.firewall.extraCommands = lib.mkIf (firewallScripts != []) (builtins.concatStringsSep "\n" (map (fw: ''
+      EXTIF=${cfg.externalInterface} ${pkgs.bash}/bin/bash -x ${miniupnpd}/etc/miniupnpd/${fw}_init.sh
+    '') firewallScripts));

-    networking.firewall.extraStopCommands = ''
-      ${pkgs.bash}/bin/bash -x ${pkgs.miniupnpd}/etc/miniupnpd/iptables_removeall.sh -i ${cfg.externalInterface}
-    '';
+    networking.firewall.extraStopCommands = lib.mkIf (firewallScripts != []) (builtins.concatStringsSep "\n" (map (fw: ''
+      EXTIF=${cfg.externalInterface} ${pkgs.bash}/bin/bash -x ${miniupnpd}/etc/miniupnpd/${fw}_removeall.sh
+    '') firewallScripts));
+
+    networking.nftables = lib.mkIf (firewall == "nftables") {
+      # see nft_init in ${miniupnpd-nftables}/etc/miniupnpd
+      tables.miniupnpd = {
+        family = "inet";
+        # The following is omitted because it's expected that the firewall is to be responsible for it.
+        #
+        # chain forward {
+        #   type filter hook forward priority filter; policy drop;
+        #   jump miniupnpd
+        # }
+        #
+        # Otherwise, it quickly gets ugly with (potentially) two forward chains with "policy drop".
+        # This means the chain "miniupnpd" never actually gets triggered and is simply there to satisfy
+        # miniupnpd. If you're doing it yourself (without networking.firewall), the easiest way to get
+        # it to work is adding a rule "ct status dnat accept" - this is what networking.firewall does.
+        # If you don't want to simply accept forwarding for all "ct status dnat" packets, override
+        # upnp_table_name with whatever your table is, create a chain "miniupnpd" in your table and
+        # jump into it from your forward chain.
+        content = ''
+          chain miniupnpd {}
+          chain prerouting_miniupnpd {
+            type nat hook prerouting priority dstnat; policy accept;
+          }
+          chain postrouting_miniupnpd {
+            type nat hook postrouting priority srcnat; policy accept;
+          }
+        '';
+      };
+    };

    systemd.services.miniupnpd = {
      description = "MiniUPnP daemon";
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
      serviceConfig = {
-        ExecStart = "${pkgs.miniupnpd}/bin/miniupnpd -f ${configFile}";
+        ExecStart = "${miniupnpd}/bin/miniupnpd -f ${configFile}";
        PIDFile = "/run/miniupnpd.pid";
        Type = "forking";
      };
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@ -334,8 +334,8 @@ let
          + optionalString vhost.default "default_server "
          + optionalString vhost.reuseport "reuseport "
          + optionalString (extraParameters != []) (concatStringsSep " "
-            (let inCompatibleParameters = [ "ssl" "proxy_protocol" "http2" ];
-                isCompatibleParameter = param: !(any (p: p == param) inCompatibleParameters);
+            (let inCompatibleParameters = [ "accept_filter" "backlog" "deferred" "fastopen" "http2" "proxy_protocol" "so_keepalive" "ssl" ];
+                isCompatibleParameter = param: !(any (p: lib.hasPrefix p param) inCompatibleParameters);
            in filter isCompatibleParameter extraParameters))
          + ";"))
          + "
@ -408,12 +408,6 @@ let
            ssl_conf_command Options KTLS;
          ''}

-          ${optionalString (hasSSL && vhost.quic && vhost.http3)
-            # Advertise that HTTP/3 is available
-          ''
-            add_header Alt-Svc 'h3=":$server_port"; ma=86400';
-          ''}
-
          ${mkBasicAuth vhostName vhost}

          ${optionalString (vhost.root != null) "root ${vhost.root};"}
--- a/nixos/modules/services/web-servers/nginx/vhost-options.nix
+++ b/nixos/modules/services/web-servers/nginx/vhost-options.nix
@ -235,9 +235,9 @@ with lib;
        which can be achieved by setting `services.nginx.package = pkgs.nginxQuic;`
        and activate the QUIC transport protocol
        `services.nginx.virtualHosts.<name>.quic = true;`.
-        Note that HTTP/3 support is experimental and
-        *not* yet recommended for production.
+        Note that HTTP/3 support is experimental and *not* yet recommended for production.
        Read more at https://quic.nginx.org/
+        HTTP/3 availability must be manually advertised, preferably in each location block.
      '';
    };

@ -250,8 +250,7 @@ with lib;
        which can be achieved by setting `services.nginx.package = pkgs.nginxQuic;`
        and activate the QUIC transport protocol
        `services.nginx.virtualHosts.<name>.quic = true;`.
-        Note that special application protocol support is experimental and
-        *not* yet recommended for production.
+        Note that special application protocol support is experimental and *not* yet recommended for production.
        Read more at https://quic.nginx.org/
      '';
    };
--- a/nixos/modules/tasks/filesystems/zfs.nix
+++ b/nixos/modules/tasks/filesystems/zfs.nix
@ -71,7 +71,7 @@ let
    done
    poolReady() {
      pool="$1"
-      state="$("${zpoolCmd}" import 2>/dev/null | "${awkCmd}" "/pool: $pool/ { found = 1 }; /state:/ { if (found == 1) { print \$2; exit } }; END { if (found == 0) { print \"MISSING\" } }")"
+      state="$("${zpoolCmd}" import -d "${cfgZfs.devNodes}" 2>/dev/null | "${awkCmd}" "/pool: $pool/ { found = 1 }; /state:/ { if (found == 1) { print \$2; exit } }; END { if (found == 0) { print \"MISSING\" } }")"
      if [[ "$state" = "ONLINE" ]]; then
        return 0
      else
--- a/nixos/modules/virtualisation/libvirtd.nix
+++ b/nixos/modules/virtualisation/libvirtd.nix
@ -116,6 +116,15 @@ let
          QEMU's swtpm options.
        '';
      };
+
+      vhostUserPackages = mkOption {
+        type = types.listOf types.package;
+        default = [ ];
+        example = lib.literalExpression "[ pkgs.virtiofsd ]";
+        description = lib.mdDoc ''
+          Packages containing out-of-tree vhost-user drivers.
+        '';
+      };
    };
  };

@ -502,6 +511,14 @@ in
    # https://libvirt.org/daemons.html#monolithic-systemd-integration
    systemd.sockets.libvirtd.wantedBy = [ "sockets.target" ];

+    systemd.tmpfiles.rules = let
+      vhostUserCollection = pkgs.buildEnv {
+        name = "vhost-user";
+        paths = cfg.qemu.vhostUserPackages;
+        pathsToLink = [ "/share/qemu/vhost-user" ];
+      };
+    in [ "L+ /var/lib/qemu/vhost-user - - - - ${vhostUserCollection}/share/qemu/vhost-user" ];
+
    security.polkit = {
      enable = true;
      extraConfig = ''
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -617,6 +617,7 @@ in {
  nscd = handleTest ./nscd.nix {};
  nsd = handleTest ./nsd.nix {};
  ntfy-sh = handleTest ./ntfy-sh.nix {};
+  ntfy-sh-migration = handleTest ./ntfy-sh-migration.nix {};
  nzbget = handleTest ./nzbget.nix {};
  nzbhydra2 = handleTest ./nzbhydra2.nix {};
  oh-my-zsh = handleTest ./oh-my-zsh.nix {};
@ -910,7 +911,8 @@ in {
  unbound = handleTest ./unbound.nix {};
  unifi = handleTest ./unifi.nix {};
  unit-php = handleTest ./web-servers/unit-php.nix {};
-  upnp = handleTest ./upnp.nix {};
+  upnp.iptables = handleTest ./upnp.nix { useNftables = false; };
+  upnp.nftables = handleTest ./upnp.nix { useNftables = true; };
  uptermd = handleTest ./uptermd.nix {};
  uptime-kuma = handleTest ./uptime-kuma.nix {};
  usbguard = handleTest ./usbguard.nix {};
--- a/nixos/tests/ntfy-sh-migration.nix
+++ b/nixos/tests/ntfy-sh-migration.nix
@ -0,0 +1,77 @@
+# the ntfy-sh module was switching to DynamicUser=true. this test assures that
+# the migration does not break existing setups.
+#
+# this test works doing a migration and asserting ntfy-sh runs properly. first,
+# ntfy-sh is configured to use a static user and group. then ntfy-sh is
+# started and tested. after that, ntfy-sh is shut down and a systemd drop
+# in configuration file is used to upate the service configuration to use
+# DynamicUser=true. then the ntfy-sh is started again and tested.
+
+import ./make-test-python.nix {
+  name = "ntfy-sh";
+
+  nodes.machine = {
+    lib,
+    pkgs,
+    ...
+  }: {
+    environment.etc."ntfy-sh-dynamic-user.conf".text = ''
+      [Service]
+      Group=new-ntfy-sh
+      User=new-ntfy-sh
+      DynamicUser=true
+    '';
+
+    services.ntfy-sh.enable = true;
+    services.ntfy-sh.settings.base-url = "http://localhost:2586";
+
+    systemd.services.ntfy-sh.serviceConfig = {
+      DynamicUser = lib.mkForce false;
+      ExecStartPre = [
+        "${pkgs.coreutils}/bin/id"
+        "${pkgs.coreutils}/bin/ls -lahd /var/lib/ntfy-sh/"
+        "${pkgs.coreutils}/bin/ls -lah /var/lib/ntfy-sh/"
+      ];
+      Group = lib.mkForce "old-ntfy-sh";
+      User = lib.mkForce "old-ntfy-sh";
+    };
+
+    users.users.old-ntfy-sh = {
+      isSystemUser = true;
+      group = "old-ntfy-sh";
+    };
+
+    users.groups.old-ntfy-sh = {};
+  };
+
+  testScript = ''
+    import json
+
+    msg = "Test notification"
+
+    def test_ntfysh():
+      machine.wait_for_unit("ntfy-sh.service")
+      machine.wait_for_open_port(2586)
+
+      machine.succeed(f"curl -d '{msg}' localhost:2586/test")
+
+      text = machine.succeed("curl -s localhost:2586/test/json?poll=1")
+      for line in text.splitlines():
+        notif = json.loads(line)
+        assert msg == notif["message"], "Wrong message"
+
+      machine.succeed("ntfy user list")
+
+    machine.wait_for_unit("multi-user.target")
+
+    test_ntfysh()
+
+    machine.succeed("systemctl stop ntfy-sh.service")
+    machine.succeed("mkdir -p /run/systemd/system/ntfy-sh.service.d")
+    machine.succeed("cp /etc/ntfy-sh-dynamic-user.conf /run/systemd/system/ntfy-sh.service.d/dynamic-user.conf")
+    machine.succeed("systemctl daemon-reload")
+    machine.succeed("systemctl start ntfy-sh.service")
+
+    test_ntfysh()
+  '';
+}
--- a/nixos/tests/pgadmin4.nix
+++ b/nixos/tests/pgadmin4.nix
@ -4,31 +4,49 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
  name = "pgadmin4";
  meta.maintainers = with lib.maintainers; [ mkg20001 gador ];

-  nodes.machine = { pkgs, ... }: {
+  nodes = {
+    machine = { pkgs, ... }: {

-    imports = [ ./common/user-account.nix ];
+      imports = [ ./common/user-account.nix ];

-    environment.systemPackages = with pkgs; [
-      wget
-      curl
-      pgadmin4-desktopmode
-    ];
+      environment.systemPackages = with pkgs; [
+        wget
+        curl
+        pgadmin4-desktopmode
+      ];

-    services.postgresql = {
-      enable = true;
-      authentication = ''
-        host    all             all             localhost               trust
-      '';
+      services.postgresql = {
+        enable = true;
+        authentication = ''
+          host    all             all             localhost               trust
+        '';
+      };
+
+      services.pgadmin = {
+        port = 5051;
+        enable = true;
+        initialEmail = "bruh@localhost.de";
+        initialPasswordFile = pkgs.writeText "pw" "bruh2012!";
+      };
    };
+    machine2 = { pkgs, ... }: {

-    services.pgadmin = {
-      port = 5051;
-      enable = true;
-      initialEmail = "bruh@localhost.de";
-      initialPasswordFile = pkgs.writeText "pw" "bruh2012!";
+      imports = [ ./common/user-account.nix ];
+
+      services.postgresql = {
+        enable = true;
+      };
+
+      services.pgadmin = {
+        enable = true;
+        initialEmail = "bruh@localhost.de";
+        initialPasswordFile = pkgs.writeText "pw" "bruh2012!";
+        minimumPasswordLength = 12;
+      };
    };
  };

+
  testScript = ''
    with subtest("Check pgadmin module"):
      machine.wait_for_unit("postgresql")
@ -49,5 +67,9 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
      machine.wait_until_succeeds("curl -sS localhost:5050")
      machine.wait_until_succeeds("curl -sS localhost:5050/browser/ | grep \"<title>pgAdmin 4</title>\" > /dev/null")
      machine.succeed("wget -nv --level=1 --spider --recursive localhost:5050/browser")
+
+    with subtest("Check pgadmin minimum password length"):
+      machine2.wait_for_unit("postgresql")
+      machine2.wait_for_console_text("Password must be at least 12 characters long")
  '';
 })
--- a/nixos/tests/upnp.nix
+++ b/nixos/tests/upnp.nix
@ -5,7 +5,7 @@
 # this succeeds an external client will try to connect to the port
 # mapping.

-import ./make-test-python.nix ({ pkgs, ... }:
+import ./make-test-python.nix ({ pkgs, useNftables, ... }:

 let
  internalRouterAddress = "192.168.3.1";
@ -27,6 +27,7 @@ in
          networking.nat.enable = true;
          networking.nat.internalInterfaces = [ "eth2" ];
          networking.nat.externalInterface = "eth1";
+          networking.nftables.enable = useNftables;
          networking.firewall.enable = true;
          networking.firewall.trustedInterfaces = [ "eth2" ];
          networking.interfaces.eth1.ipv4.addresses = [
@ -82,7 +83,7 @@ in
      # Wait for network and miniupnpd.
      router.wait_for_unit("network-online.target")
      # $router.wait_for_unit("nat")
-      router.wait_for_unit("firewall.service")
+      router.wait_for_unit("${if useNftables then "nftables" else "firewall"}.service")
      router.wait_for_unit("miniupnpd")

      client1.wait_for_unit("network-online.target")
--- a/pkgs/applications/audio/sidplayfp/default.nix
+++ b/pkgs/applications/audio/sidplayfp/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "sidplayfp";
-  version = "2.6.0";
+  version = "2.6.2";

  src = fetchFromGitHub {
    owner = "libsidplayfp";
    repo = "sidplayfp";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-4SiIfJ/5l/Vf/trt6+XNJbnPvUypZ2yPBCagTcBXrvk=";
+    hash = "sha256-bAd4fq5tlBYfYuIG/02MCbEwjjVBZFJbZJNT13voInw=";
  };

  strictDeps = true;
--- a/pkgs/applications/editors/xmlcopyeditor/default.nix
+++ b/pkgs/applications/editors/xmlcopyeditor/default.nix
@ -25,6 +25,13 @@ stdenv.mkDerivation rec {

  patches = [ ./xmlcopyeditor.patch ];

+  # error: cannot initialize a variable of type 'xmlErrorPtr' (aka '_xmlError *')
+  #        with an rvalue of type 'const xmlError *' (aka 'const _xmlError *')
+  postPatch = ''
+    substituteInPlace src/wraplibxml.cpp \
+      --replace "xmlErrorPtr err" "const xmlError *err"
+  '';
+
  nativeBuildInputs = [
    intltool
    pkg-config
--- a/pkgs/applications/graphics/identity/Cargo.lock
+++ b/pkgs/applications/graphics/identity/Cargo.lock
--- a/pkgs/applications/graphics/identity/default.nix
+++ b/pkgs/applications/graphics/identity/default.nix
@ -1,54 +1,60 @@
-{ appstream-glib
-, blueprint-compiler
-, desktop-file-utils
+{ lib
+, stdenv
 , fetchFromGitLab
-, gst_all_1
-, gtk4
-, lib
-, libadwaita
+, rustPlatform
+, nix-update-script
+
+, appstream
+, blueprint-compiler
 , cargo
+, desktop-file-utils
 , meson
 , ninja
-, nix-update-script
 , pkg-config
-, rustPlatform
 , rustc
-, stdenv
 , wrapGAppsHook4
+
+, dav1d
+, gst_all_1
+, gtk4
+, libadwaita
+, libwebp
 }:

 stdenv.mkDerivation rec {
  pname = "identity";
-  version = "0.5.0";
+  version = "0.6.0";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "YaLTeR";
    repo = "identity";
    rev = "v${version}";
-    sha256 = "sha256-ZBK2Vc2wnohABnWXRtmRdAAOnkTIHt4RriZitu8BW1A=";
+    hash = "sha256-AiOaTjYOc7Eo+9kl1H91TKAkCKNUJNWobmBENZlHBhQ=";
  };

-  cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src;
-    name = "${pname}-${version}";
-    hash = "sha256-5NUnrBHj3INhh9zbdwPink47cP6uJiRyzzdj+yiSVD8=";
+  cargoDeps = rustPlatform.importCargoLock {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "gst-plugin-gtk4-0.12.0-alpha.1" = "sha256-JSw9yZ4oy7m6c9pqOT+fnYEbTlneLTtWQf3/Jbek/ps=";
+    };
  };

  nativeBuildInputs = [
-    appstream-glib
+    appstream
    blueprint-compiler
+    cargo
    desktop-file-utils
    meson
    ninja
    pkg-config
-    wrapGAppsHook4
-    rustPlatform.cargoSetupHook
-    cargo
    rustc
+    rustPlatform.cargoSetupHook
+    wrapGAppsHook4
  ];

  buildInputs = [
+    dav1d
    gst_all_1.gst-libav
    gst_all_1.gst-plugins-bad
    gst_all_1.gst-plugins-base
@ -56,15 +62,16 @@ stdenv.mkDerivation rec {
    gst_all_1.gstreamer
    gtk4
    libadwaita
+    libwebp
  ];

  passthru.updateScript = nix-update-script { };

-  meta = {
+  meta = with lib; {
    description = "A program for comparing multiple versions of an image or video";
    homepage = "https://gitlab.gnome.org/YaLTeR/identity";
-    maintainers = [ lib.maintainers.paveloom ];
-    license = lib.licenses.gpl3Plus;
-    platforms = lib.platforms.linux;
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ paveloom ];
  };
 }
--- a/pkgs/applications/misc/cartridges/default.nix
+++ b/pkgs/applications/misc/cartridges/default.nix
@ -6,29 +6,32 @@
 , libadwaita
 , meson
 , ninja
-, python3
+, python3Packages
 , stdenv
 , wrapGAppsHook4
+, nix-update-script
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "cartridges";
-  version = "2.3";
+  version = "2.7.2";

  src = fetchFromGitHub {
    owner = "kra-mo";
    repo = "cartridges";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-d0c0043kssPvGxs6FygDkTKZoYtFge2cH4MIhz2vVYk=";
+    hash = "sha256-+18TWtxKT87CZ8vTtYac9aQ0wIbhJEXbXFZrSj5BmjI=";
  };

+  pythonPath = with python3Packages; [
+    pillow
+    pygobject3
+    pyyaml
+    requests
+  ];
+
  buildInputs = [
    libadwaita
-    (python3.withPackages (p: with p; [
-      pillow
-      pygobject3
-      pyyaml
-      requests
-    ]))
+    (python3Packages.python.withPackages (_: finalAttrs.pythonPath))
  ];

  nativeBuildInputs = [
@ -37,9 +40,21 @@ stdenv.mkDerivation (finalAttrs: {
    gobject-introspection
    meson
    ninja
+    python3Packages.wrapPython
    wrapGAppsHook4
  ];

+  dontWrapGApps = true;
+
+  postFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+    wrapPythonPrograms "$out/bin" "$out" "$pythonPath"
+  '';
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
  meta = with lib; {
    description = "A GTK4 + Libadwaita game launcher";
    longDescription = ''
--- a/pkgs/applications/misc/girara/default.nix
+++ b/pkgs/applications/misc/girara/default.nix
@ -59,7 +59,7 @@ stdenv.mkDerivation rec {

  mesonFlags = [
    "-Ddocs=disabled" # docs do not seem to be installed
-    (lib.mesonEnable "tests" (stdenv.buildPlatform.canExecute stdenv.hostPlatform))
+    (lib.mesonEnable "tests" ((stdenv.buildPlatform.canExecute stdenv.hostPlatform) && (!stdenv.isDarwin)))
  ];

  checkPhase = ''
--- a/pkgs/applications/misc/gnome-extension-manager/default.nix
+++ b/pkgs/applications/misc/gnome-extension-manager/default.nix
@ -7,6 +7,7 @@
 , ninja
 , gettext
 , gtk4
+, appstream
 , appstream-glib
 , desktop-file-utils
 , gobject-introspection
@ -16,32 +17,30 @@
 , libsoup_3
 , glib
 , libbacktrace
-, python3
 , text-engine
 }:

 stdenv.mkDerivation rec {
  pname = "gnome-extension-manager";
-  version = "0.4.2";
+  version = "0.4.3";

  src = fetchFromGitHub {
    owner = "mjakeman";
    repo = "extension-manager";
    rev = "v${version}";
-    hash = "sha256-AQdYZsOaTk+EX1bi/kDI2GcVfu7ZKIyrFpNf/fRcJmo=";
+    hash = "sha256-e+s8iIUvW9Rw0Wq4aIn3IzBLGTQC6o0TmNXd5gz892Y=";
  };

  nativeBuildInputs = [
+    appstream
    appstream-glib
    desktop-file-utils
    gettext
    glib
    gobject-introspection
-    libadwaita
    meson
    ninja
    pkg-config
-    python3
    wrapGAppsHook4
  ];

@ -49,16 +48,23 @@ stdenv.mkDerivation rec {
    blueprint-compiler
    gtk4
    json-glib
+    libadwaita
    libsoup_3
    libbacktrace
    text-engine
  ];

+  mesonFlags = [
+    (lib.mesonOption "package" "Nix")
+    (lib.mesonOption "distributor" "nixpkgs")
+  ];
+
  meta = with lib; {
    description = "Desktop app for managing GNOME shell extensions";
    homepage = "https://github.com/mjakeman/extension-manager";
    license = licenses.gpl3Plus;
    platforms = platforms.linux;
+    mainProgram = "extension-manager";
    maintainers = with maintainers; [ foo-dogsquared ];
  };
 }
--- a/pkgs/applications/misc/skytemple/default.nix
+++ b/pkgs/applications/misc/skytemple/default.nix
@ -10,14 +10,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "skytemple";
-  version = "1.6.0";
+  version = "1.6.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "SkyTemple";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-AQ8Wxks7TTHP2h9Tc1LYG4neQ2uWebFIFoCOd3A6KB8=";
+    hash = "sha256-norcfoxZG9crgQz7p1+Gfne5il1AWfxdZa4JE/LfXU8=";
  };

  buildInputs = [
--- a/pkgs/applications/misc/toot/default.nix
+++ b/pkgs/applications/misc/toot/default.nix
@ -2,19 +2,22 @@

 python3Packages.buildPythonApplication rec {
  pname = "toot";
-  version = "0.38.2";
+  version = "0.41.1";

  src = fetchFromGitHub {
    owner  = "ihabunek";
    repo   = "toot";
    rev = "refs/tags/${version}";
-    sha256 = "sha256-0L/5i+m0rh1VjsZ0N2cshi+Nw951ASjMf5y6JxV53ko=";
+    sha256 = "sha256-FwxA8YJzNKEK5WjdDi8PIufHh+SRVMRiFVIQs1iZ0UY=";
  };

  nativeCheckInputs = with python3Packages; [ pytest ];

  propagatedBuildInputs = with python3Packages;
-    [ requests beautifulsoup4 future wcwidth urwid psycopg2 tomlkit ];
+  [
+    requests beautifulsoup4 future wcwidth
+    urwid urwidgets psycopg2 tomlkit click
+  ];

  checkPhase = ''
    py.test
--- a/pkgs/applications/misc/waylock/default.nix
+++ b/pkgs/applications/misc/waylock/default.nix
@ -12,14 +12,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "waylock";
-  version = "0.6.3";
+  version = "0.6.4";

  src = fetchFromGitHub {
    owner = "ifreund";
    repo = "waylock";
    rev = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-Q1FlahawsnJ77gP6QVs9AR058rhMU92iueRPudPf+sE=";
+    hash = "sha256-RSAUSlsBB9IphvdSiFqJIvyhhJoAKKb+KyGhdoTa3vs=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/cluster/k3s/1_27/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_27/versions.nix
@ -1,14 +1,14 @@
 {
-  k3sVersion = "1.27.8+k3s2";
-  k3sCommit = "02fcbd1f57f0bc0ca1dc68f98cfa0e7d3b008225";
-  k3sRepoSha256 = "02g741b43s2ss1mdjnrs7fx4bhv9k55k4n350h9qp5jgqg8ldbdi";
-  k3sVendorHash = "sha256-mCPr+Y8wiWyW5T/iYH7Y4tz+nrqGyD2IQnIFd0EgdjI=";
+  k3sVersion = "1.27.9+k3s1";
+  k3sCommit = "2c249a39358bd36438ab53aedef5487d950fd558";
+  k3sRepoSha256 = "16zcp1ih34zpz6115ivbcs49n5yikgj8mpiv177jvvb2vakmkgv6";
+  k3sVendorHash = "sha256-zvoBN1mErSXovv/xVzjntHyZjVyCfPzsOdlcTSIwKus=";
  chartVersions = import ./chart-versions.nix;
  k3sRootVersion = "0.12.2";
  k3sRootSha256 = "1gjynvr350qni5mskgm7pcc7alss4gms4jmkiv453vs8mmma9c9k";
  k3sCNIVersion = "1.3.0-k3s1";
  k3sCNISha256 = "0zma9g4wvdnhs9igs03xlx15bk2nq56j73zns9xgqmfiixd9c9av";
-  containerdVersion = "1.7.7-k3s1.27";
-  containerdSha256 = "1v1hzjcd8ym3nf7bb88z4n8q1g7gawrkp0j82ah80ars40mifhan";
+  containerdVersion = "1.7.11-k3s2.27";
+  containerdSha256 = "0xjxc5dgh3drk2glvcabd885damjffp9r4cs0cm1zgnrrbhlipra";
  criCtlVersion = "1.26.0-rc.0-k3s1";
 }
--- a/pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix
+++ b/pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix
@ -5,7 +5,7 @@

 buildGoPackage rec {
  pname = "ssm-session-manager-plugin";
-  version = "1.2.536.0";
+  version = "1.2.553.0";

  goPackagePath = "github.com/aws/session-manager-plugin";

@ -13,7 +13,7 @@ buildGoPackage rec {
    owner = "aws";
    repo = "session-manager-plugin";
    rev = version;
-    hash = "sha256-uMkb7AKgReq2uOdE5Y8P1JCyCIOF67x6nZ+S3o/P//s=";
+    hash = "sha256-jyCHhD3KyHob7z200tEkAUR9ALJVsGsRQ7Wx4B6jBnQ=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
+++ b/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "tektoncd-cli";
-  version = "0.33.0";
+  version = "0.34.0";

  src = fetchFromGitHub {
    owner = "tektoncd";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "sha256-PjtZrN0AmD2Ll0Jgvw/7ZNb5/TqYdsngrdLjLfprPa0=";
+    sha256 = "sha256-bX1PmLQDpNMh1JMYvnAQhLFYiEoa5UnQSc/i+Y6DigI=";
  };

  vendorHash = null;
--- a/pkgs/applications/networking/cluster/zarf/default.nix
+++ b/pkgs/applications/networking/cluster/zarf/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "zarf";
-  version = "0.32.0";
+  version = "0.32.1";

  src = fetchFromGitHub {
    owner = "defenseunicorns";
    repo = "zarf";
    rev = "v${version}";
-    hash = "sha256-ijEzPY5J/qqMxhGkbiY5r4JnFNSiT+Sl5NZ7qV1qQwo=";
+    hash = "sha256-A5GfXdm13u82yW8mTYDX+H6idCBSeYML3C56t1TD2ec=";
  };

-  vendorHash = "sha256-UDfeARPIade3Gal7NETXexvYYKQmx4gr69PmUjtdSJQ=";
+  vendorHash = "sha256-7UBqO1O6o/eM04/bZpcGgttLhSoemcBBly3IZbATAz0=";
  proxyVendor = true;

  preBuild = ''
--- a/pkgs/applications/networking/mailreaders/neomutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/neomutt/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, gettext, makeWrapper, tcl, which
+{ lib, stdenv, fetchFromGitHub, gettext, makeWrapper, tcl, which
 , ncurses, perl , cyrus_sasl, gss, gpgme, libkrb5, libidn2, libxml2, notmuch, openssl
 , lua, lmdb, libxslt, docbook_xsl, docbook_xml_dtd_42, w3m, mailcap, sqlite, zlib, lndir
 , pkg-config, zstd, enableZstd ? true, enableMixmaster ? false, enableLua ? false
@ -6,27 +6,16 @@
 }:

 stdenv.mkDerivation rec {
-  version = "20231103";
+  version = "20231221";
  pname = "neomutt";

  src = fetchFromGitHub {
    owner  = "neomutt";
    repo   = "neomutt";
    rev    = version;
-    sha256 = "sha256-9/XYgQjOdIwDpoJz5kNmiRBdoSod9l7Yl0u4e20KDPw=";
+    sha256 = "sha256-IXly2N/DD2+XBXVIXJw1sE/0eJwbUaONDNRMi7n1T44=";
  };

-  patches = [
-    # https://github.com/neomutt/neomutt/issues/3773#issuecomment-1493295144
-    ./fix-open-very-large-mailbox.patch
-    # https://github.com/neomutt/neomutt/issues/4128
-    (fetchpatch {
-      name = "fix-attr-color-copy.patch";
-      url = "https://github.com/neomutt/neomutt/commit/24f8644c28e602206a63fae53c4eb3d32426ce0c.patch";
-      hash = "sha256-8qcW9hb6yxEZICRYgl6ZhPQDrI6nZN9NH+40GhTgR0o=";
-    })
-  ];
-
  buildInputs = [
    cyrus_sasl gss gpgme libkrb5 libidn2 ncurses
    notmuch openssl perl lmdb
--- a/pkgs/applications/networking/mailreaders/neomutt/fix-open-very-large-mailbox.patch
+++ b/pkgs/applications/networking/mailreaders/neomutt/fix-open-very-large-mailbox.patch
@ -1,51 +0,0 @@
-diff --git a/mutt_mailbox.c b/mutt_mailbox.c
-index 5581a8187..22f0ca21a 100644
--- a/mutt_mailbox.c
-+++ b/mutt_mailbox.c
-@@ -160,6 +160,9 @@ int mutt_mailbox_check(struct Mailbox *m_cur, CheckStatsFlags flags)
-   st_ctx.st_dev = 0;
-   st_ctx.st_ino = 0;
-
-+  if (kInMboxOpen)
-+    return 0;
-+
- #ifdef USE_IMAP
-   if (flags & MUTT_MAILBOX_CHECK_FORCE)
-     mutt_update_num_postponed();
-diff --git a/mx.c b/mx.c
-index 4bf5af141..a4e9f83f5 100644
--- a/mx.c
-+++ b/mx.c
-@@ -295,6 +295,8 @@ bool mx_mbox_ac_link(struct Mailbox *m)
-   return true;
- }
-
-+int kInMboxOpen = 0;
-+
- /**
-  * mx_mbox_open - Open a mailbox and parse it
-  * @param m     Mailbox to open
-@@ -386,8 +388,10 @@ bool mx_mbox_open(struct Mailbox *m, OpenMailboxFlags flags)
-   m->msg_tagged = 0;
-   m->vcount = 0;
-
-+  kInMboxOpen = 1;
-   enum MxOpenReturns rc = m->mx_ops->mbox_open(m);
-   m->opened++;
-+  kInMboxOpen = 0;
-
-   if ((rc == MX_OPEN_OK) || (rc == MX_OPEN_ABORT))
-   {
-diff --git a/mx.h b/mx.h
-index 741431570..43e40bf32 100644
--- a/mx.h
-+++ b/mx.h
-@@ -38,6 +38,8 @@ extern const struct MxOps *mx_ops[];
-
- extern struct EnumDef MboxTypeDef;
-
-+extern int kInMboxOpen;
-+
- typedef uint8_t MsgOpenFlags;      ///< Flags for mx_msg_open_new(), e.g. #MUTT_ADD_FROM
- #define MUTT_MSG_NO_FLAGS       0  ///< No flags are set
- #define MUTT_ADD_FROM     (1 << 0) ///< add a From_ line
--- a/pkgs/applications/networking/xpipe/default.nix
+++ b/pkgs/applications/networking/xpipe/default.nix
@ -27,21 +27,20 @@ let
  inherit (stdenvNoCC.hostPlatform) system;
  throwSystem = throw "Unsupported system: ${system}";

+  # Keep this setup to easily add more arch support in the future
  arch = {
    x86_64-linux = "x86_64";
-    aarch64-linux = "arm64";
  }.${system} or throwSystem;

  hash = {
-    x86_64-linux = "sha256-/cumOKaWPdAruMLZP2GMUdocIhsbo59dc4Q3ngc/JOc=";
-    aarch64-linux = "sha256-xMV+9etnuFwRGIHdaXNViKd4FMOuVtugGDS1xyMwEnM=";
+    x86_64-linux = "sha256-8iQR6cWqDzjTRL6psiugQOdYqaEOgZnjcLN+90apWuY=";
  }.${system} or throwSystem;

  displayname = "XPipe";

 in stdenvNoCC.mkDerivation rec {
  pname = "xpipe";
-  version = "1.7.3";
+  version = "1.7.13";

  src = fetchzip {
    url = "https://github.com/xpipe-io/xpipe/releases/download/${version}/xpipe-portable-linux-${arch}.tar.gz";
@ -103,16 +102,16 @@ in stdenvNoCC.mkDerivation rec {
    mkdir -p "$out/etc/bash_completion.d"
    ln -s "$out/opt/$pkg/cli/xpipe_completion" "$out/etc/bash_completion.d/$pkg"

-    substituteInPlace $out/share/applications/${displayname}.desktop --replace "Exec=" "Exec=$out"
-    substituteInPlace $out/share/applications/${displayname}.desktop --replace "Icon=" "Icon=$out"
+    substituteInPlace "$out/share/applications/${displayname}.desktop" --replace "Exec=" "Exec=$out"
+    substituteInPlace "$out/share/applications/${displayname}.desktop" --replace "Icon=" "Icon=$out"

-    mv "$out/opt/xpipe/app/bin/xpiped" "$out/opt/xpipe/app/bin/xpiped_raw"
-    mv "$out/opt/xpipe/app/lib/app/xpiped.cfg" "$out/opt/xpipe/app/lib/app/xpiped_raw.cfg"
-    mv "$out/opt/xpipe/app/scripts/xpiped_debug.sh" "$out/opt/xpipe/app/scripts/xpiped_debug_raw.sh"
+    mv "$out/opt/$pkg/app/bin/xpiped" "$out/opt/$pkg/app/bin/xpiped_raw"
+    mv "$out/opt/$pkg/app/lib/app/xpiped.cfg" "$out/opt/$pkg/app/lib/app/xpiped_raw.cfg"
+    mv "$out/opt/$pkg/app/scripts/xpiped_debug.sh" "$out/opt/$pkg/app/scripts/xpiped_debug_raw.sh"

-    makeShellWrapper "$out/opt/xpipe/app/bin/xpiped_raw" "$out/opt/xpipe/app/bin/xpiped" \
+    makeShellWrapper "$out/opt/$pkg/app/bin/xpiped_raw" "$out/opt/$pkg/app/bin/xpiped" \
      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ fontconfig gtk3 udev ]}"
-    makeShellWrapper "$out/opt/xpipe/app/scripts/xpiped_debug_raw.sh" "$out/opt/xpipe/app/scripts/xpiped_debug.sh" \
+    makeShellWrapper "$out/opt/$pkg/app/scripts/xpiped_debug_raw.sh" "$out/opt/$pkg/app/scripts/xpiped_debug.sh" \
      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ fontconfig gtk3 udev ]}"

    runHook postInstall
@ -126,7 +125,7 @@ in stdenvNoCC.mkDerivation rec {
    changelog = "https://github.com/xpipe-io/${pname}/releases/tag/${version}";
    license = [ licenses.asl20 licenses.unfree ];
    maintainers = with maintainers; [ crschnick ];
-    platforms = [ "x86_64-linux" "aarch64-linux" ];
+    platforms = [ "x86_64-linux" ];
    mainProgram = pname;
  };
 }
--- a/pkgs/applications/radio/quisk/default.nix
+++ b/pkgs/applications/radio/quisk/default.nix
@ -8,11 +8,11 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "quisk";
-  version = "4.2.27";
+  version = "4.2.28";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-7pI9K7VOksQREbDFa02w48tcvanehBQ+5d/XYUD/gSo=";
+    sha256 = "sha256-Hb5XLcAOdf9KxoAWnNpQzkp7dxp3mbfClbdoz4/BRso=";
  };

  buildInputs = [
--- a/pkgs/applications/science/logic/cadical/default.nix
+++ b/pkgs/applications/science/logic/cadical/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "cadical";
-  version = "1.9.3";
+  version = "1.9.4";

  src = fetchFromGitHub {
    owner = "arminbiere";
    repo = "cadical";
    rev = "rel-${version}";
-    sha256 = "sha256-kjvbWFcoEe7Df2HDKKc2txrxpS8/StwiCLbS2RqnkyE=";
+    sha256 = "sha256-cSuvvd7ci8jXzFowS7+V3bor7bXCxaKcGdDU91nIo+k=";
  };

  outputs = [ "out" "dev" "lib" ];
--- a/pkgs/applications/science/math/primecount/default.nix
+++ b/pkgs/applications/science/math/primecount/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "primecount";
-  version = "7.9";
+  version = "7.10";

  src = fetchFromGitHub {
    owner = "kimwalisch";
    repo = "primecount";
    rev = "v${version}";
-    hash = "sha256-0sn6WnrI6Umrsz3lvFIzFi8/fEAqh1qhWxtNPPq5SyA=";
+    hash = "sha256-z7sHGR6zZSTV1PbL0WPGHf52CYQ572KC1yznCuIEJbQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/misc/rink/default.nix
+++ b/pkgs/applications/science/misc/rink/default.nix
@ -2,17 +2,17 @@
 , libiconv, Security }:

 rustPlatform.buildRustPackage rec {
-  version = "0.6.3";
+  version = "0.7.0";
  pname = "rink";

  src = fetchFromGitHub {
    owner = "tiffany352";
    repo = "rink-rs";
    rev = "v${version}";
-    sha256 = "sha256-AhC3c6CpV0tlD6d/hFWt7hGj2UsXsOCeujkRSDlpvCM=";
+    sha256 = "sha256-5UrSJ/y6GxDUNaljal57JJY17NuI+2yLwVTwp+xBNxs=";
  };

-  cargoSha256 = "sha256-Xo5iYwL4Db+GWMl5UXbPmj0Y0PJYR4Q0aUGnYCd+NB8=";
+  cargoHash = "sha256-G30NcP1ej01ygHzaxZ2OdgfksvXe/SCsmZFwamxlDvA=";

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ ncurses ]
--- a/pkgs/applications/version-management/github-desktop/default.nix
+++ b/pkgs/applications/version-management/github-desktop/default.nix
@ -21,11 +21,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "github-desktop";
-  version = "3.2.5";
+  version = "3.3.6";
+  rcversion = "3";
+  arch = "amd64";

  src = fetchurl {
-    url = "https://github.com/shiftkey/desktop/releases/download/release-${finalAttrs.version}-linux1/GitHubDesktop-linux-${finalAttrs.version}-linux1.deb";
-    hash = "sha256-p+qr9/aEQcfkKArC3oTyIijHkaNzLum3xXeSnNexgbU=";
+    url = "https://github.com/shiftkey/desktop/releases/download/release-${finalAttrs.version}-linux${finalAttrs.rcversion}/GitHubDesktop-linux-${finalAttrs.arch}-${finalAttrs.version}-linux${finalAttrs.rcversion}.deb";
+    hash = "sha256-900JhfHN78CuAXptPX2ToTvT9E+g+xRXqmlm34J9l6k=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/version-management/scriv/default.nix
+++ b/pkgs/applications/version-management/scriv/default.nix
@ -9,11 +9,11 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "scriv";
-  version = "1.5.0";
+  version = "1.5.1";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-+OTWFDnHCF2bxQU8f7DfULYG1cA9tOZCsNRPdKobns8=";
+    hash = "sha256-MK6f+NFE+ODPOUxOHTeVQvGzgjdnZClVtU7EDcALMrY=";
  };

  propagatedBuildInputs = with python3.pkgs; [
--- a/pkgs/applications/video/open-in-mpv/default.nix
+++ b/pkgs/applications/video/open-in-mpv/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "open-in-mpv";
-  version = "2.1.0";
+  version = "2.1.0-unstable-2023-05-13";

  src = fetchFromGitHub {
    owner = "Baldomo";
    repo = "open-in-mpv";
-    rev = "v${version}";
-    hash = "sha256-3Fsa3AwiHsb8VcKa4a/RKyYu+CD5nEX0nIXENhBZCWk=";
+    rev = "07fc639b2882a9a68e539f0fc34b61e247c355fa";
+    hash = "sha256-XkoXvSh5uu96isXc1at36mxSCPylHgMLN97qSpj2cyc=";
  };

  vendorHash = "sha256-G6GZO2+CfEAYcf7zBcqDa808A0eJjM8dq7+4VGZ+P4c=";
--- a/pkgs/applications/virtualization/crosvm/default.nix
+++ b/pkgs/applications/virtualization/crosvm/default.nix
@ -5,12 +5,12 @@

 rustPlatform.buildRustPackage rec {
  pname = "crosvm";
-  version = "119.0";
+  version = "120.0";

  src = fetchgit {
    url = "https://chromium.googlesource.com/chromiumos/platform/crosvm";
-    rev = "b9977397be2ffc8154bf55983eb21495016d48b5";
-    sha256 = "oaCWiyYWQQGERaUPSekUHsO8vaHzIA5ZdSebm/qRR7I=";
+    rev = "0a9d1cb8be29e49c355ea8b18cd58506dbbaf6e5";
+    sha256 = "BbCcsxJU25VgWVday4rGPXaJSuAWebNGo3MiYPIBBto=";
    fetchSubmodules = true;
  };

@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {

  separateDebugInfo = true;

-  cargoHash = "sha256-U/sF/0OWxA41iZsOTao8eeb98lluqOwcPwwA4emcSFc=";
+  cargoHash = "sha256-YXfKZeRL3gfWztf36lVNbCCwUqW+0w3q7X7v0arCrvk=";

  nativeBuildInputs = [
    pkg-config protobuf python3 rustPlatform.bindgenHook wayland-scanner
--- a/pkgs/applications/virtualization/docker/buildx.nix
+++ b/pkgs/applications/virtualization/docker/buildx.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "docker-buildx";
-  version = "0.12.0";
+  version = "0.12.1";

  src = fetchFromGitHub {
    owner = "docker";
    repo = "buildx";
    rev = "v${version}";
-    hash = "sha256-O2oXswExH6OQLDZcgCGF62oZ7v6svZuOziw0SZgOVHI=";
+    hash = "sha256-QC2mlJWjOtqYAB+YrL+s2FsJ79LuLFZGOgSVGL6WmX8=";
  };

  doCheck = false;
--- a/pkgs/build-support/dotnet/build-dotnet-module/default.nix
+++ b/pkgs/build-support/dotnet/build-dotnet-module/default.nix
@ -37,7 +37,7 @@

  # The path to publish the project to. When unset, the directory "$out/lib/$pname" is used.
 , installPath ? null
-  # The binaries that should get installed to `$out/bin`, relative to `$out/lib/$pname/`. These get wrapped accordingly.
+  # The binaries that should get installed to `$out/bin`, relative to `$installPath/`. These get wrapped accordingly.
  # Unfortunately, dotnet has no method for doing this automatically.
  # If unset, all executables in the projects root will get installed. This may cause bloat!
 , executables ? null
--- a/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-fixup-hook.sh
+++ b/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-fixup-hook.sh
@ -32,7 +32,7 @@ dotnetFixupHook() {

    if [ "${executables-}" ]; then
        for executable in ${executables[@]}; do
-            path="$out/lib/$pname/$executable"
+            path="${installPath-$out/lib/$pname}/$executable"

            if test -x "$path"; then
                wrapDotnetProgram "$path" "$out/bin/$(basename "$executable")"
@ -45,7 +45,7 @@ dotnetFixupHook() {
    else
        while IFS= read -d '' executable; do
            wrapDotnetProgram "$executable" "$out/bin/$(basename "$executable")" \;
-        done < <(find "$out/lib/$pname" ! -name "*.dll" -executable -type f -print0)
+        done < <(find "${installPath-$out/lib/$pname}" ! -name "*.dll" -executable -type f -print0)
    fi

    echo "Finished dotnetFixupPhase"
--- a/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-install-hook.sh
+++ b/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-install-hook.sh
@ -30,7 +30,7 @@ dotnetInstallHook() {
        env dotnet publish ${project-} \
            -p:ContinuousIntegrationBuild=true \
            -p:Deterministic=true \
-            --output "$out/lib/${pname}" \
+            --output "${installPath-$out/lib/$pname}" \
            --configuration "@buildType@" \
            --no-build \
            ${runtimeIdFlags[@]} \
--- a/pkgs/build-support/fetchgithub/default.nix
+++ b/pkgs/build-support/fetchgithub/default.nix
@ -19,7 +19,7 @@ let
  baseUrl = "https://${githubBase}/${owner}/${repo}";
  newMeta = meta // {
    homepage = meta.homepage or baseUrl;
-
+  } // lib.optionalAttrs (position != null) {
    # to indicate where derivation originates, similar to make-derivation.nix's mkDerivation
    position = "${position.file}:${toString position.line}";
  };
--- a/pkgs/by-name/as/ast-grep/package.nix
+++ b/pkgs/by-name/as/ast-grep/package.nix
@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "ast-grep";
-  version = "0.16.1";
+  version = "0.17.0";

  src = fetchFromGitHub {
    owner = "ast-grep";
    repo = "ast-grep";
    rev = version;
-    hash = "sha256-QjwtffTFxmsj+3UaLphBldK0SVJBaeOQrfUNbIwNpAo=";
+    hash = "sha256-/lWvFYSE4gFbVPlJMROGcb86mVviGdh1tFAY74qTTX4=";
  };

-  cargoHash = "sha256-TieiPD2bniFqeTf8FgP8ujQDVWbSiBqsAFkNZkzoFd0=";
+  cargoHash = "sha256-r1vfh2JtBjWFgXrijlFxPyRr8LRAIogiA2TZHI5MJRM=";

  # Work around https://github.com/NixOS/nixpkgs/issues/166205.
  env = lib.optionalAttrs stdenv.cc.isClang {
--- a/pkgs/by-name/co/cosmic-applibrary/Cargo.lock
+++ b/pkgs/by-name/co/cosmic-applibrary/Cargo.lock
--- a/pkgs/by-name/co/cosmic-applibrary/package.nix
+++ b/pkgs/by-name/co/cosmic-applibrary/package.nix
@ -0,0 +1,70 @@
+{ lib
+, fetchFromGitHub
+, stdenv
+, rustPlatform
+, just
+, pkg-config
+, makeBinaryWrapper
+, libxkbcommon
+, wayland
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cosmic-applibrary";
+  version = "unstable-2024-01-03";
+
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = pname;
+    rev = "889cb6078c05cdf3eb94f19f64db552fa2be32dc";
+    hash = "sha256-qLAFSHA7YdOWr7ZmLCkQ+aGWb2schANfgdD2BxsrvaE=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "accesskit-0.11.0" = "sha256-xVhe6adUb8VmwIKKjHxwCwOo5Y1p3Or3ylcJJdLDrrE=";
+      "atomicwrites-0.4.2" = "sha256-QZSuGPrJXh+svMeFWqAXoqZQxLq/WfIiamqvjJNVhxA=";
+      "cosmic-config-0.1.0" = "sha256-WM08/jnB2kAf77FE+0xpBJcVGOHOCcUorifQ/5LXav0=";
+      "cosmic-client-toolkit-0.1.0" = "sha256-AEgvF7i/OWPdEMi8WUaAg99igBwE/AexhAXHxyeJMdc=";
+      "glyphon-0.3.0" = "sha256-JGkNIfj1HjOF8kGxqJPNq/JO+NhZD6XrZ4KmkXEP6Xc=";
+      "smithay-client-toolkit-0.18.0" = "sha256-2WbDKlSGiyVmi7blNBr2Aih9FfF2dq/bny57hoA4BrE=";
+      "softbuffer-0.3.3" = "sha256-eKYFVr6C1+X6ulidHIu9SP591rJxStxwL9uMiqnXx4k=";
+      "taffy-0.3.11" = "sha256-SCx9GEIJjWdoNVyq+RZAGn0N71qraKZxf9ZWhvyzLaI=";
+      "cosmic-settings-daemon-0.1.0" = "sha256-z/dvRyc3Zc1fAQh2HKk6NI6QSDpNqarqslwszjU+0nc=";
+      "cosmic-text-0.10.0" = "sha256-C2FHJBESbiyL2BhLb6T+wI9EX+xCyp02Kk6cI46EfDs=";
+    };
+  };
+
+  nativeBuildInputs = [ just pkg-config makeBinaryWrapper ];
+  buildInputs = [ libxkbcommon wayland ];
+
+  dontUseJustBuild = true;
+
+  justFlags = [
+    "--set"
+    "prefix"
+    (placeholder "out")
+    "--set"
+    "bin-src"
+    "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-app-library"
+  ];
+
+  postPatch = ''
+    substituteInPlace justfile --replace '#!/usr/bin/env' "#!$(command -v env)"
+  '';
+
+  postInstall = ''
+    wrapProgram $out/bin/cosmic-app-library \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [wayland]}"
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/pop-os/cosmic-applibrary";
+    description = "Application Template for the COSMIC Desktop Environment";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ nyanbinary ];
+    platforms = platforms.linux;
+    mainProgram = "cosmic-app-library";
+  };
+}
--- a/pkgs/by-name/co/cosmic-bg/Cargo.lock
+++ b/pkgs/by-name/co/cosmic-bg/Cargo.lock
--- a/pkgs/by-name/co/cosmic-bg/package.nix
+++ b/pkgs/by-name/co/cosmic-bg/package.nix
@ -0,0 +1,62 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, just
+, pkg-config
+, makeBinaryWrapper
+, libxkbcommon
+, wayland
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cosmic-bg";
+  version = "unstable-2023-10-10";
+
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = pname;
+    rev = "6a6fe4e387e46c2e159df56a9768220a6269ccf4";
+    hash = "sha256-fdRFndhwISmbTqmXfekFqh+Wrtdjg3vSZut4IAQUBbA=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "cosmic-config-0.1.0" = "sha256-vM5iIr71zg8OWShuoyQI+pV9C5dPXnvkfEVYAg0XAH4=";
+      "smithay-client-toolkit-0.17.0" = "sha256-XXfXRXeEm2LCLTfyd74PYuLmTtLu50pcXKld/6H4juA=";
+    };
+  };
+
+  postPatch = ''
+    substituteInPlace justfile --replace '#!/usr/bin/env' "#!$(command -v env)"
+  '';
+
+  nativeBuildInputs = [ just pkg-config makeBinaryWrapper ];
+  buildInputs = [ libxkbcommon wayland ];
+
+  dontUseJustBuild = true;
+
+  justFlags = [
+    "--set"
+    "prefix"
+    (placeholder "out")
+    "--set"
+    "bin-src"
+    "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-bg"
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/cosmic-bg \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [wayland]}"
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/pop-os/cosmic-bg";
+    description = "Applies Background for the COSMIC Desktop Environment";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ nyanbinary ];
+    platforms = platforms.linux;
+    mainProgram = "cosmic-bg";
+  };
+}
--- a/pkgs/by-name/co/cosmic-design-demo/Cargo.lock
+++ b/pkgs/by-name/co/cosmic-design-demo/Cargo.lock
--- a/pkgs/by-name/co/cosmic-design-demo/package.nix
+++ b/pkgs/by-name/co/cosmic-design-demo/package.nix
@ -0,0 +1,76 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, cmake
+, just
+, pkg-config
+, expat
+, libxkbcommon
+, fontconfig
+, freetype
+, wayland
+, makeBinaryWrapper
+, cosmic-icons
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cosmic-design-demo";
+  version = "unstable-2024-01-08";
+
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = pname;
+    rev = "d58cfad46f2982982494fce27fb00ad834dc8992";
+    hash = "sha256-nWkiaegSjxgyGlpjXE9vzGjiDORaRCSoZJMDv0jtvaA=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "accesskit-0.11.0" = "sha256-xVhe6adUb8VmwIKKjHxwCwOo5Y1p3Or3ylcJJdLDrrE=";
+      "atomicwrites-0.4.2" = "sha256-QZSuGPrJXh+svMeFWqAXoqZQxLq/WfIiamqvjJNVhxA=";
+      "cosmic-client-toolkit-0.1.0" = "sha256-AEgvF7i/OWPdEMi8WUaAg99igBwE/AexhAXHxyeJMdc=";
+      "cosmic-config-0.1.0" = "sha256-fOaAG5p4RVULMZZA1EPXUw2t8R0Xw9B66ZIFow3376Q=";
+      "cosmic-text-0.10.0" = "sha256-lurasfMuFEi1o4aNJfqRe3YpsXpxdaZiUMVquC1DyX0=";
+      "cosmic-time-0.4.0" = "sha256-kPahIznCtjIa38ty8IzGTbZ25tEZ26hLOL1ybPaTeAk=";
+      "glyphon-0.3.0" = "sha256-JGkNIfj1HjOF8kGxqJPNq/JO+NhZD6XrZ4KmkXEP6Xc=";
+      "smithay-client-toolkit-0.16.1" = "sha256-z7EZThbh7YmKzAACv181zaEZmWxTrMkFRzP0nfsHK6c=";
+      "smithay-client-toolkit-0.18.0" = "sha256-2WbDKlSGiyVmi7blNBr2Aih9FfF2dq/bny57hoA4BrE=";
+      "softbuffer-0.3.3" = "sha256-eKYFVr6C1+X6ulidHIu9SP591rJxStxwL9uMiqnXx4k=";
+      "sctk-adwaita-0.5.4" = "sha256-yK0F2w/0nxyKrSiHZbx7+aPNY2vlFs7s8nu/COp2KqQ=";
+      "taffy-0.3.11" = "sha256-SCx9GEIJjWdoNVyq+RZAGn0N71qraKZxf9ZWhvyzLaI=";
+      "winit-0.28.6" = "sha256-FhW6d2XnXCGJUMoT9EMQew9/OPXiehy/JraeCiVd76M=";
+    };
+  };
+
+  nativeBuildInputs = [ cmake just pkg-config makeBinaryWrapper ];
+  buildInputs = [ libxkbcommon expat fontconfig freetype wayland ];
+
+  dontUseJustBuild = true;
+
+  justFlags = [
+    "--unstable"
+    "--set"
+    "prefix"
+    (placeholder "out")
+    "--set"
+    "bin-src"
+    "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-design-demo"
+  ];
+
+  postInstall = ''
+    wrapProgram "$out/bin/cosmic-design-demo" \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [wayland]}" \
+      --suffix XDG_DATA_DIRS : "${cosmic-icons}/share"
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/pop-os/cosmic-design-demo";
+    description = "Design Demo for the COSMIC Desktop Environment";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ nyanbinary ];
+    platforms = platforms.linux;
+    mainProgram = "cosmic-design-demo";
+  };
+}
--- a/pkgs/by-name/co/cosmic-files/Cargo.lock
+++ b/pkgs/by-name/co/cosmic-files/Cargo.lock
--- a/pkgs/by-name/co/cosmic-files/package.nix
+++ b/pkgs/by-name/co/cosmic-files/package.nix
@ -0,0 +1,74 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, makeBinaryWrapper
+, cosmic-icons
+, just
+, pkg-config
+, libxkbcommon
+, wayland
+, xorg
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cosmic-files";
+  version = "unstable-2024-01-12";
+
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = pname;
+    rev = "467414217903d96f71f5566d8359831000dfede1";
+    hash = "sha256-cfIlTHm1lnASjwHnrlLFJd01jT8D1P5XGLXYaJiF8pA=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "accesskit-0.11.0" = "sha256-xVhe6adUb8VmwIKKjHxwCwOo5Y1p3Or3ylcJJdLDrrE=";
+      "atomicwrites-0.4.2" = "sha256-QZSuGPrJXh+svMeFWqAXoqZQxLq/WfIiamqvjJNVhxA=";
+      "cosmic-config-0.1.0" = "sha256-+kcul4iOillcWPK+aD3Z2rMfmVb+i2p5ckKRhc1gdDw=";
+      "cosmic-text-0.10.0" = "sha256-PHz5jUecK889E88Y20XUe2adTUO8ElnoV7IIcaohMUw=";
+      "glyphon-0.3.0" = "sha256-JGkNIfj1HjOF8kGxqJPNq/JO+NhZD6XrZ4KmkXEP6Xc=";
+      "sctk-adwaita-0.5.4" = "sha256-yK0F2w/0nxyKrSiHZbx7+aPNY2vlFs7s8nu/COp2KqQ=";
+      "softbuffer-0.3.3" = "sha256-eKYFVr6C1+X6ulidHIu9SP591rJxStxwL9uMiqnXx4k=";
+      "smithay-client-toolkit-0.16.1" = "sha256-z7EZThbh7YmKzAACv181zaEZmWxTrMkFRzP0nfsHK6c=";
+      "systemicons-0.7.0" = "sha256-zzAI+6mnpQOh+3mX7/sJ+w4a7uX27RduQ99PNxLNF78=";
+      "taffy-0.3.11" = "sha256-SCx9GEIJjWdoNVyq+RZAGn0N71qraKZxf9ZWhvyzLaI=";
+      "winit-0.28.6" = "sha256-FhW6d2XnXCGJUMoT9EMQew9/OPXiehy/JraeCiVd76M=";
+    };
+  };
+
+  postPatch = ''
+    substituteInPlace justfile --replace '#!/usr/bin/env' "#!$(command -v env)"
+  '';
+
+  nativeBuildInputs = [ just pkg-config makeBinaryWrapper ];
+  buildInputs = [ wayland ];
+
+  dontUseJustBuild = true;
+
+  justFlags = [
+    "--set"
+    "prefix"
+    (placeholder "out")
+    "--set"
+    "bin-src"
+    "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-files"
+  ];
+
+  # LD_LIBRARY_PATH can be removed once tiny-xlib is bumped above 0.2.2
+  postInstall = ''
+    wrapProgram "$out/bin/${pname}" \
+      --suffix XDG_DATA_DIRS : "${cosmic-icons}/share" \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ xorg.libX11 xorg.libXcursor xorg.libXrandr xorg.libXi wayland libxkbcommon ]}
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/pop-os/cosmic-files";
+    description = "File Manager for the COSMIC Desktop Environment";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ ahoneybun nyanbinary ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/by-name/co/cosmic-notifications/Cargo.lock
+++ b/pkgs/by-name/co/cosmic-notifications/Cargo.lock
--- a/pkgs/by-name/co/cosmic-notifications/package.nix
+++ b/pkgs/by-name/co/cosmic-notifications/package.nix
@ -0,0 +1,73 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, just
+, which
+, pkg-config
+, makeBinaryWrapper
+, libxkbcommon
+, wayland
+, appstream-glib
+, desktop-file-utils
+, intltool
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cosmic-notifications";
+  version = "unstable-2024-01-05";
+
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = pname;
+    rev = "3b07cf550a54b757a5f136e4d8fde74d09afe3fd";
+    hash = "sha256-+S8bPorarSJQwIQfTmo4qK+B1kKAlQvllUuZ2UBL0eY=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "accesskit-0.11.0" = "sha256-xVhe6adUb8VmwIKKjHxwCwOo5Y1p3Or3ylcJJdLDrrE=";
+      "atomicwrites-0.4.2" = "sha256-QZSuGPrJXh+svMeFWqAXoqZQxLq/WfIiamqvjJNVhxA=";
+      "cosmic-client-toolkit-0.1.0" = "sha256-AEgvF7i/OWPdEMi8WUaAg99igBwE/AexhAXHxyeJMdc=";
+      "cosmic-config-0.1.0" = "sha256-DmuUvFjhoqI5lneiWFFYF3WM3mACx5ZfZqeKpsyL7Ss=";
+      "cosmic-text-0.10.0" = "sha256-kIBhh6CakQaWGfBWu5qaV8LAbJENX7GW+BStJK/P4iA=";
+      "cosmic-settings-daemon-0.1.0" = "sha256-z/dvRyc3Zc1fAQh2HKk6NI6QSDpNqarqslwszjU+0nc=";
+      "glyphon-0.3.0" = "sha256-JGkNIfj1HjOF8kGxqJPNq/JO+NhZD6XrZ4KmkXEP6Xc=";
+      "smithay-client-toolkit-0.18.0" = "sha256-2WbDKlSGiyVmi7blNBr2Aih9FfF2dq/bny57hoA4BrE=";
+      "softbuffer-0.3.3" = "sha256-eKYFVr6C1+X6ulidHIu9SP591rJxStxwL9uMiqnXx4k=";
+      "taffy-0.3.11" = "sha256-SCx9GEIJjWdoNVyq+RZAGn0N71qraKZxf9ZWhvyzLaI=";
+    };
+  };
+
+  postPatch = ''
+    substituteInPlace justfile --replace '#!/usr/bin/env' "#!$(command -v env)"
+  '';
+
+  nativeBuildInputs = [ just which pkg-config makeBinaryWrapper ];
+  buildInputs = [ libxkbcommon wayland appstream-glib desktop-file-utils intltool ];
+
+  dontUseJustBuild = true;
+
+  justFlags = [
+    "--set"
+    "prefix"
+    (placeholder "out")
+    "--set"
+    "bin-src"
+    "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-notifications"
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/cosmic-notifications \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [wayland]}"
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/pop-os/cosmic-notifications";
+    description = "Notifications for the COSMIC Desktop Environment";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ nyanbinary ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/by-name/co/cosmic-randr/package.nix
+++ b/pkgs/by-name/co/cosmic-randr/package.nix
@ -0,0 +1,49 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, just
+, pkg-config
+, wayland
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cosmic-randr";
+  version = "unstable-2023-12-22";
+
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = pname;
+    rev = "8a082103a0365b02fbed2c17c02373eceb7ad4d3";
+    hash = "sha256-LsZpey9OhNq9FTtHXvZXtHyhXttJ+tr5qBS6eSL27dE=";
+  };
+
+  cargoHash = "sha256-XpN9X8CZUGOe6mQhWWQy766gyoiTPObKsv9J8xiDvdA=";
+
+  postPatch = ''
+    substituteInPlace justfile --replace '#!/usr/bin/env' "#!$(command -v env)"
+  '';
+
+  nativeBuildInputs = [ just pkg-config ];
+  buildInputs = [ wayland ];
+
+  dontUseJustBuild = true;
+
+  justFlags = [
+    "--set"
+    "prefix"
+    (placeholder "out")
+    "--set"
+    "bin-src"
+    "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-randr"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/pop-os/cosmic-randr";
+    description = "Library and utility for displaying and configuring Wayland outputs";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ nyanbinary ];
+    platforms = platforms.linux;
+    mainProgram = "cosmic-randr";
+  };
+}
--- a/pkgs/by-name/co/cosmic-screenshot/package.nix
+++ b/pkgs/by-name/co/cosmic-screenshot/package.nix
@ -0,0 +1,43 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, just
+, pkg-config
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cosmic-screenshot";
+  version = "unstable-2023-11-08";
+
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = pname;
+    rev = "b413a7128ddcdfb3c63e84bdade5c5b90b163a9a";
+    hash = "sha256-SDxBBhmnqNDX95Rb7QiI46sAxrfodB5tSq8AbXAU480=";
+  };
+
+  cargoHash = "sha256-ZRsAhIWPm38Ys9jM/3yVJLW818lUGLCcSfFZb+UTbnU=";
+
+  nativeBuildInputs = [ just pkg-config ];
+
+  dontUseJustBuild = true;
+
+  justFlags = [
+    "--set"
+    "prefix"
+    (placeholder "out")
+    "--set"
+    "bin-src"
+    "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-screenshot"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/pop-os/cosmic-screenshot";
+    description = "Screenshot tool for the COSMIC Desktop Environment";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ nyanbinary ];
+    platforms = platforms.linux;
+    mainProgram = "cosmic-screenshot";
+  };
+}
--- a/pkgs/by-name/co/cosmic-settings-daemon/package.nix
+++ b/pkgs/by-name/co/cosmic-settings-daemon/package.nix
@ -0,0 +1,31 @@
+{ lib
+, fetchFromGitHub
+, rustPlatform
+, pkg-config
+, udev
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cosmic-settings-daemon";
+  version = "unstable-2023-12-29";
+
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = pname;
+    rev = "f7183b68c6ca3f68054b5dd6457b1d5798a75a48";
+    hash = "sha256-Wck0NY6CUjD16gxi74stayiahs4UiqS7iQCkbOXCgKE=";
+  };
+
+  cargoHash = "sha256-vCs20RdGhsI1+f78KEau7ohtoGTrGP9QH91wooQlgOE=";
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ udev ];
+
+  meta = with lib; {
+    homepage = "https://github.com/pop-os/cosmic-settings-daemon";
+    description = "Settings Daemon for the COSMIC Desktop Environment";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ nyanbinary ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/window-managers/cosmic/settings/Cargo.lock
+++ b/pkgs/applications/window-managers/cosmic/settings/Cargo.lock
--- a/pkgs/applications/window-managers/cosmic/settings/default.nix
+++ b/pkgs/applications/window-managers/cosmic/settings/default.nix
@ -1,10 +1,9 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, rust
 , rustPlatform
 , cmake
-, makeWrapper
+, makeBinaryWrapper
 , cosmic-icons
 , just
 , pkg-config
@ -15,35 +14,34 @@
 , wayland
 , expat
 , udev
-, which
-, lld
-, util-linuxMinimal
 }:

 rustPlatform.buildRustPackage rec {
  pname = "cosmic-settings";
-  version = "unstable-2023-10-26";
+  version = "unstable-2024-01-09";

  src = fetchFromGitHub {
    owner = "pop-os";
    repo = pname;
-    rev = "d15ebbd340dee7adf184831311b5da73faaa80f5";
-    hash = "sha256-OlQ2jjT/ygO+hpl5Cc3h8Yp/SVo+pmI/EH7pqvY9GXI=";
+    rev = "f2148eed9a56ef1b5ba73db73e15486e188e01b7";
+    hash = "sha256-JUiUC/RNR1cqJouUEneHZotkN2M18vJhv+ATvGFrQxU=";
  };

  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "accesskit-0.11.0" = "sha256-/6KUCH1CwMHd5YEMOpAdVeAxpjl9JvrzDA4Xnbd1D9k=";
+      "accesskit-0.11.0" = "sha256-xVhe6adUb8VmwIKKjHxwCwOo5Y1p3Or3ylcJJdLDrrE=";
+      "atomicwrites-0.4.2" = "sha256-QZSuGPrJXh+svMeFWqAXoqZQxLq/WfIiamqvjJNVhxA=";
      "cosmic-bg-config-0.1.0" = "sha256-fdRFndhwISmbTqmXfekFqh+Wrtdjg3vSZut4IAQUBbA=";
-      "cosmic-comp-config-0.1.0" = "sha256-q0LP8TODETobYg0S6XDsP0Lw/RJIB8YB4jiUkRHpsio=";
-      "cosmic-config-0.1.0" = "sha256-+mnvf/IM9cqoZv5zHW8uBAqeY2pG3IOiOWIESVExnqg=";
-      "cosmic-panel-config-0.1.0" = "sha256-U5FYZ5hjJ5s6lYfWrgyuy8zLjiXGQV+OKwf6nzHZT6w=";
-      "smithay-client-toolkit-0.17.0" = "sha256-vDY4cqz5CZD12twElUWVCsf4N6VO9O+Udl8Dc4arWK4=";
-      "softbuffer-0.2.0" = "sha256-VD2GmxC58z7Qfu/L+sfENE+T8L40mvUKKSfgLmCTmjY=";
-      "taffy-0.3.11" = "sha256-gPHJhYmDb3Pj7eM8eFv1kPoODk0BGiw+yMj9ROXIjAU=";
-      "winit-0.28.6" = "sha256-8IQ6HyvD09v8+KWO5jbAkouRTTX/Des4Pn/sjGrtdok=";
-      "xdg-shell-wrapper-config-0.1.0" = "sha256-pvaI/joul7jWTdIrPq3PbBcQGMLZLd2rTu1aIwXiZN8=";
+      "cosmic-comp-config-0.1.0" = "sha256-xN5VbxRO50BPU0VP1rSOkq3TS2WTiCGavJS8o05Jw50=";
+      "cosmic-config-0.1.0" = "sha256-/oAG5xu0Lnsw/CIGXrvoC3pKkj5aS0qubWIPozQDSsY=";
+      "cosmic-client-toolkit-0.1.0" = "sha256-AEgvF7i/OWPdEMi8WUaAg99igBwE/AexhAXHxyeJMdc=";
+      "cosmic-panel-config-0.1.0" = "sha256-SDqNLuj219FMqlO2devw/DD04RJfSBJLDLH/4ObRCl8=";
+      "glyphon-0.3.0" = "sha256-Uw1zbHVAjB3pUfUd8GnFUnske3Gxs+RktrbaFJfK430=";
+      "smithay-client-toolkit-0.18.0" = "sha256-9NwNrEC+csTVtmXrNQFvOgohTGUO2VCvqOME7SnDCOg=";
+      "softbuffer-0.3.3" = "sha256-eKYFVr6C1+X6ulidHIu9SP591rJxStxwL9uMiqnXx4k=";
+      "taffy-0.3.11" = "sha256-SCx9GEIJjWdoNVyq+RZAGn0N71qraKZxf9ZWhvyzLaI=";
+      "xdg-shell-wrapper-config-0.1.0" = "sha256-3Dc2fU8xBVUmAs0Q1zEdcdG7vlxpBO+UIlyM/kzGcC4=";
    };
  };

@ -51,7 +49,7 @@ rustPlatform.buildRustPackage rec {
    substituteInPlace justfile --replace '#!/usr/bin/env' "#!$(command -v env)"
  '';

-  nativeBuildInputs = [ cmake just pkg-config which lld util-linuxMinimal makeWrapper ];
+  nativeBuildInputs = [ cmake just pkg-config makeBinaryWrapper ];
  buildInputs = [ libxkbcommon libinput fontconfig freetype wayland expat udev ];

  dontUseJustBuild = true;
@ -76,5 +74,6 @@ rustPlatform.buildRustPackage rec {
    license = licenses.gpl3Only;
    maintainers = with maintainers; [ nyanbinary ];
    platforms = platforms.linux;
+    mainProgram = "cosmic-settings";
  };
 }
--- a/pkgs/by-name/dy/dynamodb-local/package.nix
+++ b/pkgs/by-name/dy/dynamodb-local/package.nix
@ -34,7 +34,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    homepage = "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DynamoDBLocal.html";
    license = licenses.unfree;
    mainProgram = "dynamodb-local";
-    maintainers = with maintainers; [ shyim ];
+    maintainers = with maintainers; [ shyim martinjlowm ];
    platforms = platforms.all;
    sourceProvenance = with lib.sourceTypes; [
      binaryBytecode
--- a/pkgs/by-name/hu/hugo/package.nix
+++ b/pkgs/by-name/hu/hugo/package.nix
@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "hugo";
-  version = "0.121.1";
+  version = "0.121.2";

  src = fetchFromGitHub {
    owner = "gohugoio";
    repo = "hugo";
    rev = "refs/tags/v${version}";
-    hash = "sha256-XNOp0k2t5Tv4HKKz3ZqL/sAdiYedOACaZ/1T7t7/Q1A=";
+    hash = "sha256-YwwvxkS+oqTMZzwq6iiB/0vLHIyeReQi76B7fCgqtcY=";
  };

-  vendorHash = "sha256-J/me67pC+YWjGIQP6q1c+vsSXFxXoLZV7AyDv3+606k=";
+  vendorHash = "sha256-4j61PFULBXhtERDhbHW7gwEuP+KBUEdva2fjuaAVY0o=";

  doCheck = false;

--- a/pkgs/applications/video/iina/default.nix
+++ b/pkgs/applications/video/iina/default.nix
@ -7,11 +7,11 @@

 stdenv.mkDerivation rec {
  pname = "iina";
-  version = "1.3.3";
+  version = "1.3.4";

  src = fetchurl {
    url = "https://github.com/iina/iina/releases/download/v${version}/IINA.v${version}.dmg";
-    hash = "sha256-Sz9sS+07t32+KcEr9tXQlZKEr7Ace1mjX9caOicIiZE=";
+    hash = "sha256-feUPWtSi/Vsnv1mjGyBgB0wFMxx6r6UzrUratlAo14w=";
  };

  nativeBuildInputs = [ undmg ];
@ -32,6 +32,7 @@ stdenv.mkDerivation rec {
    platforms = platforms.darwin;
    license = licenses.gpl3;
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    mainProgram = "iina";
    maintainers = with maintainers; [ arkivm stepbrobd ];
  };
 }
--- a/pkgs/by-name/ni/nix-web/package.nix
+++ b/pkgs/by-name/ni/nix-web/package.nix
@ -1,9 +1,12 @@
 { lib
+, stdenv
 , rustPlatform
 , fetchFromGitea
 , pkg-config
 , openssl
-, nix
+, nixVersions
+, nixPackage ? nixVersions.nix_2_17
+, darwin
 }:

 let
@ -11,19 +14,20 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "nix-web";
-  version = "0.1.0";
+  version = "0.2.0";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "gorgon";
    repo = "gorgon";
    rev = "nix-web-v${version}";
-    hash = "sha256-+IDvoMRuMt1nS69yFhPPVs+s6Dj0dgXVdjjd9f3+spk=";
+    hash = "sha256-M/0nlD2jUtvdWJ647QHrp8JcUUVYxiLJlGjnZ+cfpYU=";
  };
-  cargoHash = "sha256-uVBfIw++MRxgVAC+KzGVuMZra8oktUfHcZQk90FF1a8=";
+  cargoHash = "sha256-6kcpP/CFiy571B98Y96/cdcClH50gdyPLZ28Npva7B4=";

  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ openssl ];
+  buildInputs = lib.optional (!stdenv.isDarwin) openssl
+    ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;

  postPatch = ''
    substituteInPlace nix-web/nix-web.service \
@ -36,12 +40,13 @@ rustPlatform.buildRustPackage rec {
  cargoBuildFlags = cargoFlags;
  cargoTestFlags = cargoFlags;

-  NIX_WEB_BUILD_NIX_CLI_PATH = "${nix}/bin/nix";
+  NIX_WEB_BUILD_NIX_CLI_PATH = "${nixPackage}/bin/nix";

  meta = with lib; {
    description = "Web interface for the Nix store";
    homepage = "https://codeberg.org/gorgon/gorgon/src/branch/main/nix-web";
    license = licenses.eupl12;
+    platforms = platforms.unix;
    maintainers = with maintainers; [ embr ];
    mainProgram = "nix-web";
  };
--- a/pkgs/by-name/sp/spicetify-cli/package.nix
+++ b/pkgs/by-name/sp/spicetify-cli/package.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "spicetify-cli";
-  version = "2.29.1";
+  version = "2.30.0";

  src = fetchFromGitHub {
    owner = "spicetify";
    repo = "spicetify-cli";
    rev = "v${version}";
-    hash = "sha256-fgecZn0/CWQFH4Tnm5kqOOvWlE1jzGvG6LxVN7KryPg=";
+    hash = "sha256-kQcAn5/NzzH+i24Ss6GaQEycazraE03R4tqMhxKROcY=";
  };

-  vendorHash = "sha256-alNUJ+ejwZPvefCTHt0/NWSAIt4MFzbPmkMinMrpe2M=";
+  vendorHash = "sha256-T7aUjzb69ZAnpLCpHv5C6ZyUktfC8Zt94rIju8QplWI=";

  ldflags = [
    "-s -w"
--- a/pkgs/by-name/ta/tailwindcss-language-server/package.nix
+++ b/pkgs/by-name/ta/tailwindcss-language-server/package.nix
@ -9,7 +9,7 @@
 }:

 let
-  version = "0.0.14";
+  version = "0.0.16";
 in
 buildNpmPackage {
  pname = "tailwindcss-language-server";
@ -19,11 +19,11 @@ buildNpmPackage {
    owner = "tailwindlabs";
    repo = "tailwindcss-intellisense";
    rev = "@tailwindcss/language-server@v${version}";
-    hash = "sha256-EE1Gd0cmcJmyleoXVNtMJ8IKYpQIzRf2F42HOORHbwo=";
+    hash = "sha256-azzWrT8Ac+bdEfmNo+9WfQgHwA3+q9yGZMLfYXAQHtU=";
  };

  makeCacheWritable = true;
-  npmDepsHash = "sha256-gQgGIo/cS0P1B5lSmNpd8WOgucf3RbRk1YOvMXNbxb0=";
+  npmDepsHash = "sha256-z2fLtGnYgI8ocWTBrqpdElgjNghoE42LFJRWyVt/U7M=";
  npmWorkspace = "packages/tailwindcss-language-server";

  buildInputs = [ libsecret ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ Security AppKit ]);
--- a/pkgs/data/fonts/cozette/default.nix
+++ b/pkgs/data/fonts/cozette/default.nix
@ -2,11 +2,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "cozette";
-  version = "1.23.1";
+  version = "1.23.2";

  src = fetchzip {
    url = "https://github.com/slavfox/Cozette/releases/download/v.${version}/CozetteFonts-v-${builtins.replaceStrings ["."] ["-"] version}.zip";
-    hash = "sha256-LbC5siSxDZnOEkfxeqOSyoaDuTEMG2xCpZaOZrHLTJo=";
+    hash = "sha256-v1UWrVx1PnNPiFtMMy4kOkIe//iHxx0LOA4nHo95Zws=";
  };

  installPhase = ''
--- a/pkgs/development/libraries/gdal/default.nix
+++ b/pkgs/development/libraries/gdal/default.nix
@ -76,13 +76,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gdal";
-  version = "3.8.2";
+  version = "3.8.3";

  src = fetchFromGitHub {
    owner = "OSGeo";
    repo = "gdal";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-R21zRjEvJO+97yXJDvzDJryQ7ps9uEN62DZ0GCxdoFk=";
+    hash = "sha256-GYBGGZ2bobVYElO0WJrsQzLMdNR5AfQwgdjBtPeGH1g=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@ -280,7 +280,7 @@ stdenv.mkDerivation (finalAttrs: {
      "gobject-2.0"
      "gthread-2.0"
    ];
-    platforms   = platforms.unix;
+    platforms   = platforms.unix ++ platforms.windows;

    longDescription = ''
      GLib provides the core application building blocks for libraries
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@ -115,7 +115,7 @@ stdenv.mkDerivation (finalAttrs: {
    changelog = "https://github.com/harfbuzz/harfbuzz/raw/${version}/NEWS";
    maintainers = [ maintainers.eelco ];
    license = licenses.mit;
-    platforms = platforms.unix;
+    platforms = platforms.unix ++ platforms.windows;
    pkgConfigModules = [
      "harfbuzz"
      "harfbuzz-gobject"
--- a/pkgs/development/libraries/libjcat/default.nix
+++ b/pkgs/development/libraries/libjcat/default.nix
@ -19,7 +19,7 @@

 stdenv.mkDerivation rec {
  pname = "libjcat";
-  version = "0.1.14";
+  version = "0.2.0";

  outputs = [ "bin" "out" "dev" "devdoc" "man" "installedTests" ];

@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
    owner = "hughsie";
    repo = "libjcat";
    rev = version;
-    sha256 = "sha256-XN7/ZtWCCO7lSspXM4vNowoWN1U0NGQPUTM9KjTEHjY=";
+    sha256 = "sha256-nLn2s9hX9f6I1Avxzs24ZPQHglJqKSUTpBpwskVyJKw=";
  };

  patches = [
--- a/pkgs/development/libraries/proj/default.nix
+++ b/pkgs/development/libraries/proj/default.nix
@ -15,14 +15,14 @@
 , cacert
 }:

-stdenv.mkDerivation (finalAttrs: rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "proj";
  version = "9.3.1";

  src = fetchFromGitHub {
    owner = "OSGeo";
    repo = "PROJ";
-    rev = version;
+    rev = finalAttrs.version;
    hash = "sha256-M8Zgy5xnmZu7mzxXXGqaIfe7o7iMf/1sOJVOBsTvtdQ=";
  };

@ -68,7 +68,7 @@ stdenv.mkDerivation (finalAttrs: rec {
  };

  meta = with lib; {
-    changelog = "https://github.com/OSGeo/PROJ/blob/${src.rev}/NEWS";
+    changelog = "https://github.com/OSGeo/PROJ/blob/${finalAttrs.src.rev}/NEWS";
    description = "Cartographic Projections Library";
    homepage = "https://proj.org/";
    license = licenses.mit;
--- a/pkgs/development/libraries/rure/Cargo.lock
+++ b/pkgs/development/libraries/rure/Cargo.lock
@ -13,9 +13,9 @@ dependencies = [

 [[package]]
 name = "libc"
-version = "0.2.151"
+version = "0.2.152"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "302d7ab3130588088d277783b1e2d2e10c9e9e4a16dd9050e6ec93fb3e7048f4"
+checksum = "13e3bf6590cbc649f4d1a3eefc9d5d6eb746f5200ffb04e5e142700b8faa56e7"

 [[package]]
 name = "memchr"
--- a/pkgs/development/libraries/science/chemistry/dftd4/default.nix
+++ b/pkgs/development/libraries/science/chemistry/dftd4/default.nix
@ -27,11 +27,18 @@ stdenv.mkDerivation rec {

  buildInputs = [ blas lapack mctc-lib mstore multicharge ];

-  postInstall = ''
-    substituteInPlace $out/lib/pkgconfig/${pname}.pc \
-      --replace "''${prefix}/" ""
+  outputs = [ "out" "dev" ];
+
+  # Fix the Pkg-Config files for doubled store paths
+  postPatch = ''
+    substituteInPlace config/template.pc \
+      --replace "\''${prefix}/" ""
  '';

+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=${if stdenv.hostPlatform.isStatic then "OFF" else "ON"}"
+  ];
+
  doCheck = true;
  preCheck = ''
    export OMP_NUM_THREADS=2
--- a/pkgs/development/libraries/science/chemistry/mctc-lib/default.nix
+++ b/pkgs/development/libraries/science/chemistry/mctc-lib/default.nix
@ -22,11 +22,18 @@ stdenv.mkDerivation rec {

  buildInputs = [ json-fortran ];

-  postInstall = ''
-    substituteInPlace $out/lib/pkgconfig/${pname}.pc \
-      --replace "''${prefix}/" ""
+  outputs = [ "out" "dev" ];
+
+  # Fix the Pkg-Config files for doubled store paths
+  postPatch = ''
+    substituteInPlace config/template.pc \
+      --replace "\''${prefix}/" ""
  '';

+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=${if stdenv.hostPlatform.isStatic then "OFF" else "ON"}"
+  ];
+
  doCheck = true;

  meta = with lib; {
--- a/pkgs/development/libraries/science/chemistry/mstore/default.nix
+++ b/pkgs/development/libraries/science/chemistry/mstore/default.nix
@ -21,11 +21,18 @@ stdenv.mkDerivation rec {

  buildInputs = [ mctc-lib ];

-  postInstall = ''
-    substituteInPlace $out/lib/pkgconfig/${pname}.pc \
-      --replace "''${prefix}/" ""
+  outputs = [ "out" "dev" ];
+
+  # Fix the Pkg-Config files for doubled store paths
+  postPatch = ''
+    substituteInPlace config/template.pc \
+      --replace "\''${prefix}/" ""
  '';

+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=${if stdenv.hostPlatform.isStatic then "OFF" else "ON"}"
+  ];
+
  meta = with lib; {
    description = "Molecular structure store for testing";
    license = licenses.asl20;
--- a/pkgs/development/libraries/science/chemistry/multicharge/default.nix
+++ b/pkgs/development/libraries/science/chemistry/multicharge/default.nix
@ -26,11 +26,18 @@ stdenv.mkDerivation rec {

  buildInputs = [ blas lapack mctc-lib mstore ];

-  postInstall = ''
-    substituteInPlace $out/lib/pkgconfig/${pname}.pc \
-      --replace "''${prefix}/" ""
+  outputs = [ "out" "dev" ];
+
+  # Fix the Pkg-Config files for doubled store paths
+  postPatch = ''
+    substituteInPlace config/template.pc \
+      --replace "\''${prefix}/" ""
  '';

+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=${if stdenv.hostPlatform.isStatic then "OFF" else "ON"}"
+  ];
+
  doCheck = true;
  preCheck = ''
    export OMP_NUM_THREADS=2
--- a/pkgs/development/libraries/science/chemistry/simple-dftd3/default.nix
+++ b/pkgs/development/libraries/science/chemistry/simple-dftd3/default.nix
@ -26,10 +26,16 @@ stdenv.mkDerivation rec {

  buildInputs = [ mctc-lib mstore toml-f blas ];

-  postInstall = ''
-    substituteInPlace $out/lib/pkgconfig/s-dftd3.pc \
-      --replace "''${prefix}/" ""
+  outputs = [ "out" "dev" ];
+
+  # Fix the Pkg-Config files for doubled store paths
+  postPatch = ''
+    substituteInPlace config/template.pc \
+      --replace "\''${prefix}/" ""
  '';
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=${if stdenv.hostPlatform.isStatic then "OFF" else "ON"}"
+  ];

  doCheck = true;
  preCheck = ''
--- a/pkgs/development/libraries/science/chemistry/tblite/default.nix
+++ b/pkgs/development/libraries/science/chemistry/tblite/default.nix
@ -35,6 +35,12 @@ stdenv.mkDerivation rec {
    })
  ];

+  # Fix the Pkg-Config files for doubled store paths
+  postPatch = ''
+    substituteInPlace config/template.pc \
+      --replace "\''${prefix}/" ""
+  '';
+
  nativeBuildInputs = [ cmake gfortran ];

  buildInputs = [
@ -48,16 +54,17 @@ stdenv.mkDerivation rec {
    simple-dftd3
  ];

+  outputs = [ "out" "dev" ];
+
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=${if stdenv.hostPlatform.isStatic then "OFF" else "ON"}"
+  ];
+
  doCheck = true;
  preCheck = ''
    export OMP_NUM_THREADS=2
  '';

-  postInstall = ''
-    substituteInPlace $out/lib/pkgconfig/${pname}.pc \
-      --replace "''${prefix}" ""
-  '';
-
  meta = with lib; {
    description = "Light-weight tight-binding framework";
    license = with licenses; [ gpl3Plus lgpl3Plus ];
--- a/pkgs/development/libraries/silgraphite/graphite2.nix
+++ b/pkgs/development/libraries/silgraphite/graphite2.nix
@ -52,6 +52,6 @@ stdenv.mkDerivation rec {
    license = licenses.lgpl21;
    maintainers = [ maintainers.raskin ];
    mainProgram = "gr2fonttest";
-    platforms = platforms.unix;
+    platforms = platforms.unix ++ platforms.windows;
  };
 }
--- a/pkgs/development/libraries/toml-f/default.nix
+++ b/pkgs/development/libraries/toml-f/default.nix
@ -21,11 +21,18 @@ stdenv.mkDerivation rec {

  buildInputs = [ test-drive ];

-  postInstall = ''
-    substituteInPlace $out/lib/pkgconfig/${pname}.pc \
-      --replace "''${prefix}/" ""
+  outputs = [ "out" "dev" ];
+
+  # Fix the Pkg-Config files for doubled store paths
+  postPatch = ''
+    substituteInPlace config/template.pc \
+      --replace "\''${prefix}/" ""
  '';

+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=${if stdenv.hostPlatform.isStatic then "OFF" else "ON"}"
+  ];
+
  doCheck = true;

  meta = with lib; {
--- a/pkgs/development/python-modules/adafruit-platformdetect/default.nix
+++ b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
@ -7,7 +7,7 @@

 buildPythonPackage rec {
  pname = "adafruit-platformdetect";
-  version = "3.57.0";
+  version = "3.58.0";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -15,7 +15,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "Adafruit-PlatformDetect";
    inherit version;
-    hash = "sha256-tw95VnxsK57KBMw0fzzgJnFe8O8Ef0rQ9qBMIeYrkHQ=";
+    hash = "sha256-9pucdj4rXCLitoNqu1ddETY9XUmIlIfC0hIoKJ54Ks8=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/dnf-plugins-core/default.nix
+++ b/pkgs/development/python-modules/dnf-plugins-core/default.nix
@ -22,7 +22,7 @@ in

 buildPythonPackage rec {
  pname = "dnf-plugins-core";
-  version = "4.4.3";
+  version = "4.4.4";
  format = "other";

  outputs = [ "out" "man" ];
@ -31,7 +31,7 @@ buildPythonPackage rec {
    owner = "rpm-software-management";
    repo = "dnf-plugins-core";
    rev = version;
-    hash = "sha256-YEw8REvK2X7mBg9HDI6V2p8QtZ3TJh4Dzn8Uuhfbrgo=";
+    hash = "sha256-SGgUozOAU6h87SguXh+13CxV4GnVhdN3SpwKfDPh2GY=";
  };

  patches = [
--- a/pkgs/development/python-modules/marshmallow-sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/marshmallow-sqlalchemy/default.nix
@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "marshmallow-sqlalchemy";
-  version = "0.29.0";
+  version = "0.30.0";
  format = "setuptools";

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-NSOndDkO8MHA98cIp1GYCcU5bPYIcg8U9Vw290/1u+w=";
+    hash = "sha256-Ka0KT9G0oeUtywf5Zz0oSmsHlRQZFswhadTuml0Ac0c=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/mautrix/default.nix
+++ b/pkgs/development/python-modules/mautrix/default.nix
@ -16,20 +16,21 @@
 , pytest-asyncio
 , aiosqlite
 , asyncpg
+, ruamel-yaml
 }:

 buildPythonPackage rec {
  pname = "mautrix";
-  version = "0.20.3";
+  version = "0.20.4";
  format = "setuptools";

-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.10";

  src = fetchFromGitHub {
    owner = "mautrix";
    repo = "python";
    rev = "refs/tags/v${version}";
-    hash = "sha256-7ZSPxKRLAgwC1ECxa1eOTH60cMJXs1iv2PE2Vq9f0co=";
+    hash = "sha256-A9d/r4Caeo4tO82/MMXgU5xKvXRDnK0iQUm8AFhDPLM=";
  };

  propagatedBuildInputs = [
@ -51,12 +52,10 @@ buildPythonPackage rec {

  nativeCheckInputs = [
    pytestCheckHook
-  ];
-
-  checkInputs = [
    pytest-asyncio
    aiosqlite
    asyncpg
+    ruamel-yaml
  ] ++ passthru.optional-dependencies.encryption;

  pythonImportsCheck = [
--- a/pkgs/development/python-modules/mwparserfromhell/default.nix
+++ b/pkgs/development/python-modules/mwparserfromhell/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "mwparserfromhell";
-  version = "0.6.5";
+  version = "0.6.6";
  format = "setuptools";

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-K60L/2FFdjmeRHDWQAuinFLVlWgqS43mQq+7W+v0o0Y=";
+    hash = "sha256-ca/sHpeEulduldbzSEVYLTxzOjpSuncN2KnDpA5bZJ8=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/paddlepaddle/default.nix
+++ b/pkgs/development/python-modules/paddlepaddle/default.nix
@ -28,8 +28,10 @@ let
  version = "2.5.0";
  format = "wheel";
  pyShortVersion = "cp${builtins.replaceStrings ["."] [""] python.pythonVersion}";
+  cpuOrGpu = if cudaSupport then "gpu" else "cpu";
  allHashAndPlatform = import ./binary-hashes.nix;
-  hash = allHashAndPlatform."${stdenv.system}"."${if cudaSupport then "gpu" else "cpu"}"."${pyShortVersion}";
+  hash = allHashAndPlatform."${stdenv.system}"."${cpuOrGpu}"."${pyShortVersion}"
+    or (throw "${pname} has no binary-hashes.nix entry for '${stdenv.system}.${cpuOrGpu}.${pyShortVersion}' attribute");
  platform = allHashAndPlatform."${stdenv.system}".platform;
  src = fetchPypi ({
    inherit version format hash platform;
--- a/pkgs/development/python-modules/pglast/default.nix
+++ b/pkgs/development/python-modules/pglast/default.nix
@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "pglast";
-  version = "5.7";
+  version = "5.8";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-5JYygEthxFvjjbKpzw2CJNAvtrnCqdnR0sbJHhNRYFw=";
+    hash = "sha256-+3ysQuGrAH5xCBKaP0T/PLfbmLuxiKHPB+76D32GG9E=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pyopencl/default.nix
+++ b/pkgs/development/python-modules/pyopencl/default.nix
@ -2,6 +2,7 @@
 , stdenv
 , fetchPypi
 , buildPythonPackage
+, fetchpatch
 , appdirs
 , cffi
 , decorator
@ -34,6 +35,14 @@ in buildPythonPackage rec {
    hash = "sha256-IgF078qQDp1d5a7yqht3pvJVBQHekrA1qRATrq5NTF4=";
  };

+  patches = [
+    (fetchpatch {
+      name = "fix-conditions-for-CL_UNORM_INT24-availability.patch";
+      url = "https://github.com/inducer/pyopencl/pull/706.patch";
+      hash = "sha256-31aiqYlhbEw3F2k/x3W2rbOX0A90cHwIlfXMivFucMA=";
+    })
+  ];
+
  nativeBuildInputs = [
    oldest-supported-numpy
    setuptools
--- a/pkgs/development/python-modules/textual-dev/default.nix
+++ b/pkgs/development/python-modules/textual-dev/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "textual-dev";
-  version = "1.3.0";
+  version = "1.4.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "Textualize";
    repo = "textual-dev";
    rev = "refs/tags/v${version}";
-    hash = "sha256-66LcU9xXNWzoYV7ykbbKGO3/0URDu/GN2dmtxu1joqw=";
+    hash = "sha256-l8InIStQD7rAHYr2/eA1+Z0goNZoO4t78eODYmwSOrA=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/virt-firmware/default.nix
+++ b/pkgs/development/python-modules/virt-firmware/default.nix
@ -30,6 +30,7 @@ buildPythonPackage rec {
  pytestFlagsArray = ["tests/tests.py"];

  propagatedBuildInputs = [
+    setuptools
    cryptography
    pefile
  ];
--- a/pkgs/development/tools/azcopy/default.nix
+++ b/pkgs/development/tools/azcopy/default.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "azure-storage-azcopy";
-  version = "10.22.1";
+  version = "10.22.2";

  src = fetchFromGitHub {
    owner = "Azure";
    repo = "azure-storage-azcopy";
    rev = "refs/tags/v${version}";
-    hash = "sha256-WS8h4WRiCTthZOT3NQE8h7BihpaHFfCe39XoGvnDZ1k=";
+    hash = "sha256-mC6iAsUmnJeVIJPkoI/pNN6mujALW9qvQ4M7Wk9eLnQ=";
  };

  subPackages = [ "." ];
--- a/pkgs/development/tools/gqlgenc/default.nix
+++ b/pkgs/development/tools/gqlgenc/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "gqlgenc";
-  version = "0.16.1";
+  version = "0.16.2";

  src = fetchFromGitHub {
    owner = "yamashou";
    repo = "gqlgenc";
    rev = "v${version}";
-    sha256 = "sha256-jr4bQU+3YKS4KEGrgmiMMrefDkAxSTrBEUuGuM6OMTc=";
+    sha256 = "sha256-XNmCSkgJJ2notrv0Din4jlU9EoHJcznjEUiXQgQ5a7I=";
  };

  excludedPackages = [ "example" ];
--- a/pkgs/development/tools/refurb/default.nix
+++ b/pkgs/development/tools/refurb/default.nix
@ -5,14 +5,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "refurb";
-  version = "1.13.0";
+  version = "1.27.0";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "dosisod";
    repo = "refurb";
    rev = "refs/tags/v${version}";
-    hash = "sha256-e/gKBgbtjO2XYnAIdHDoVJWyP6cyvsuIFLrV/eqjces=";
+    hash = "sha256-v9zeip7dyEGbn4FVXkd713ybVyf9tvvflCeiS4H7lO0=";
  };

  postPatch = ''
--- a/pkgs/development/tools/rust/cargo-mutants/default.nix
+++ b/pkgs/development/tools/rust/cargo-mutants/default.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-mutants";
-  version = "23.12.2";
+  version = "24.1.0";

  src = fetchFromGitHub {
    owner = "sourcefrog";
    repo = "cargo-mutants";
    rev = "v${version}";
-    hash = "sha256-TFVk8uq+wBfCmwU5klqapxp6IeJNnvoH6pDKC8NJuao=";
+    hash = "sha256-hWM8QtzWUrhWHTAv4Fgq9F3ZIZS2HVP4R8J/HIh8T+0=";
  };

-  cargoHash = "sha256-cN7mgyKzuYZT+g8j04Ncqb4s2mwyTsNib5RssrEa2F8=";
+  cargoHash = "sha256-dKhxyhLWeaP9/qYZLMDFGF2DmKhzPXOT5qXHP3D3MjY=";

  buildInputs = lib.optionals stdenv.isDarwin [
    darwin.apple_sdk.frameworks.SystemConfiguration
--- a/pkgs/games/iortcw/sp.nix
+++ b/pkgs/games/iortcw/sp.nix
@ -47,6 +47,6 @@ stdenv.mkDerivation rec {
    homepage = src.meta.homepage;
    license = licenses.gpl3;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ rjpcasalino ];
  };
 }
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@ -297,6 +297,7 @@ let
      # At the time of writing (25-06-2023): this is only used in a "correct" way by ath drivers for initiating DFS radiation
      # for "certified devices"
      EXPERT                      = option yes; # this is needed for offering the certification option
+      RFKILL_INPUT                = option yes; # counteract an undesired effect of setting EXPERT
      CFG80211_CERTIFICATION_ONUS = option yes;
      # DFS: "Dynamic Frequency Selection" is a spectrum-sharing mechanism that allows
      # you to use certain interesting frequency when your local regulatory domain mandates it.
--- a/pkgs/os-specific/linux/libtraceevent/default.nix
+++ b/pkgs/os-specific/linux/libtraceevent/default.nix
@ -2,12 +2,12 @@

 stdenv.mkDerivation rec {
  pname = "libtraceevent";
-  version = "1.8.1";
+  version = "1.8.2";

  src = fetchgit {
    url = "https://git.kernel.org/pub/scm/libs/libtrace/libtraceevent.git";
    rev = "libtraceevent-${version}";
-    hash = "sha256-zib2IrgtaDGDEO/2Kp9ytHuceW/7slRPDUClYgqemOE=";
+    hash = "sha256-2oa3pR8DOPaeHcoqcLX00ihx1lpXablnsf0IZR2sOm8=";
  };

  postPatch = ''
--- a/Show More
+++ b/Show More