Merge master into haskell-updates

2024-03-21 00:13:28 +00:00 · 2024-03-21 00:13:28 +00:00 · 2015f3cc71
commit 2015f3cc71
parent 7c668395e4 71a5d2c832
249 changed files with 23109 additions and 11773 deletions
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@ -2014,6 +2014,10 @@ example of such a situation is when `py.test` is used.

 * Tests that attempt to access `$HOME` can be fixed by using the following
  work-around before running tests (e.g. `preCheck`): `export HOME=$(mktemp -d)`
+* Compiling with Cython causes tests to fail with a `ModuleNotLoadedError`.
+  This can be fixed with two changes in the derivation: 1) replacing `pytest` with
+  `pytestCheckHook` and 2) adding a `preCheck` containing `cd $out` to run
+  tests within the built output.

 ## Contributing {#contributing}

--- a/lib/attrsets.nix
+++ b/lib/attrsets.nix
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@ -599,6 +599,11 @@ in mkLicense lset) ({
    url = "https://fedoraproject.org/wiki/Licensing/GPL_Classpath_Exception";
  };

+  giftware = {
+    spdxId = "Giftware";
+    fullName = "Giftware License";
+  };
+
  hpnd = {
    spdxId = "HPND";
    fullName = "Historic Permission Notice and Disclaimer";
@ -609,6 +614,11 @@ in mkLicense lset) ({
    spdxId = "HPND-sell-variant";
  };

+  hpndUc = {
+    spdxId = "HPND-UC";
+    fullName = "Historical Permission Notice and Disclaimer - University of California variant";
+  };
+
  # Intel's license, seems free
  iasl = {
    spdxId = "Intel-ACPI";
@ -894,6 +904,11 @@ in mkLicense lset) ({
    url = "https://raw.githubusercontent.com/netdata/netdata/master/web/gui/v2/LICENSE.md";
  };

+  nistSoftware = {
+    spdxId = "NIST-Software";
+    fullName = "NIST Software License";
+  };
+
  nlpl = {
    spdxId = "NLPL";
    fullName = "No Limit Public License";
--- a/lib/trivial.nix
+++ b/lib/trivial.nix
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -761,6 +761,11 @@
    githubId = 786394;
    name = "Alexander Krupenkin ";
  };
+  akshayka = {
+    github = "akshayka";
+    githubId = 1994308;
+    name = "Akshay Agrawal";
+  };
  akshgpt7 = {
    email = "akshgpt7@gmail.com";
    github = "akshgpt7";
@ -2936,6 +2941,12 @@
    githubId = 37375448;
    name = "Buildit";
  };
+  bwc9876 = {
+    email = "bwc9876@gmail.com";
+    github = "Bwc9876";
+    githubId = 25644444;
+    name = "Ben C";
+  };
  bwlang = {
    email = "brad@langhorst.com";
    github = "bwlang";
@ -3428,7 +3439,7 @@
    name = "Philipp Dargel";
  };
  chito = {
-    email = "iamchito@protonmail.com";
+    email = "chitochi@proton.me";
    github = "chitochi";
    githubId = 153365419;
    matrix = "@chito:nichijou.dev";
@ -5005,6 +5016,12 @@
    githubId = 283316;
    name = "Dane Lipscombe";
  };
+  dmadisetti = {
+    email = "nix@madisetti.me";
+    github = "dmadisetti";
+    githubId = 2689338;
+    name = "Dylan Madisetti";
+  };
  dmalikov = {
    email = "malikov.d.y@gmail.com";
    github = "dmalikov";
@ -8654,6 +8671,12 @@
    githubId = 2179419;
    name = "Arseniy Seroka";
  };
+  jakedevs = {
+    email = "work@jakedevs.net";
+    github = "jakedevs";
+    githubId = 153585330;
+    name = "Jacob Levi";
+  };
  jakehamilton = {
    name = "Jake Hamilton";
    email = "jake.hamilton@hey.com";
@ -9950,6 +9973,15 @@
    githubId = 1621930;
    name = "Kamil Chmielewski";
  };
+  kamillaova = {
+    name = "Kamilla Ova";
+    email = "me@kamillaova.dev";
+    github = "Kamillaova";
+    githubId = 54859825;
+    keys = [{
+      fingerprint = "B2D0 AA53 8DBE 60B0 0811  3FC0 2D52 5F67 791E 5834";
+    }];
+  };
  kampfschlaefer = {
    email = "arnold@arnoldarts.de";
    github = "kampfschlaefer";
@ -15046,6 +15078,12 @@
    github = "pennae";
    githubId = 82953136;
  };
+  perchun = {
+    name = "Perchun Pak";
+    email = "nixpkgs@perchun.it";
+    github = "PerchunPak";
+    githubId = 68118654;
+  };
  peret = {
    name = "Peter Retzlaff";
    github = "peret";
@ -16722,6 +16760,15 @@
    githubId = 1312525;
    name = "Rongcui Dong";
  };
+  rookeur = {
+    email = "adrien.langou@hotmail.com";
+    github = "Rookeur";
+    githubId = 57438432;
+    name = "Adrien Langou";
+    keys = [{
+      fingerprint = "3B8F FC41 0094 2CB4 5A2A  7DF2 5A44 DA8F 9071 91B0";
+    }];
+  };
  roosemberth = {
    email = "roosembert.palacios+nixpkgs@posteo.ch";
    matrix = "@roosemberth:orbstheorem.ch";
@ -18362,6 +18409,11 @@
    githubId = 950799;
    name = "Tomasz Czyż";
  };
+  spoonbaker = {
+    github = "Spoonbaker";
+    githubId = 47164123;
+    name = "Spoonbaker";
+  };
  sprock = {
    email = "rmason@mun.ca";
    github = "sprock";
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@ -95,6 +95,7 @@ magick,,,,,5.1,donovanglover
 markdown,,,,,,
 mediator_lua,,,,,,
 middleclass,,,,,,
+mimetypes,,,,,,
 mpack,,,,,,
 moonscript,https://github.com/leafo/moonscript.git,dev-1,,,,arobyn
 nlua,,,,,,teto
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -154,6 +154,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - `idris2` was updated to v0.7.0. This version introduces breaking changes. Check out the [changelog](https://github.com/idris-lang/Idris2/blob/v0.7.0/CHANGELOG.md#v070) for details.

+- `nvtop` family of packages was reorganized into nested attrset. `nvtop` has been renamed to `nvtopPackages.full`, and all `nvtop-{amd,nvidia,intel,msm}` packages are now named as `nvtopPackages.{amd,nvidia,intel,msm}`
+
 - `neo4j` has been updated to 5, you may want to read the [release notes for Neo4j 5](https://neo4j.com/release-notes/database/neo4j-5/)

 - `services.neo4j.allowUpgrade` was removed and no longer has any effect. Neo4j 5 supports automatic rolling upgrades.
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1034,6 +1034,7 @@
  ./services/networking/multipath.nix
  ./services/networking/murmur.nix
  ./services/networking/mxisd.nix
+  ./services/networking/mycelium.nix
  ./services/networking/namecoind.nix
  ./services/networking/nar-serve.nix
  ./services/networking/nat.nix
--- a/nixos/modules/programs/starship.nix
+++ b/nixos/modules/programs/starship.nix
@ -12,7 +12,7 @@ let
      nativeBuildInputs = [ pkgs.yq ];
    } ''
    tomlq -s -t 'reduce .[] as $item ({}; . * $item)' \
-      ${lib.concatStringsSep " " (map (f: "${pkgs.starship}/share/starship/presets/${f}.toml") cfg.presets)} \
+      ${lib.concatStringsSep " " (map (f: "${cfg.package}/share/starship/presets/${f}.toml") cfg.presets)} \
      ${userSettingsFile} \
      > $out
  '';
@ -26,23 +26,20 @@ let
 in
 {
  options.programs.starship = {
-    enable = lib.mkEnableOption (lib.mdDoc "the Starship shell prompt");
+    enable = lib.mkEnableOption "the Starship shell prompt";

-    interactiveOnly = lib.mkOption {
-      default = true;
-      example = false;
-      type = lib.types.bool;
-      description = lib.mdDoc ''
-        Whether to enable starship only when the shell is interactive.
-        Some plugins require this to be set to false to function correctly.
-      '';
-    };
+    package = lib.mkPackageOption pkgs "starship" { };
+
+    interactiveOnly = lib.mkEnableOption ''
+      starship only when the shell is interactive.
+      Some plugins require this to be set to false to function correctly
+    '' // { default = true; };

    presets = lib.mkOption {
      default = [ ];
      example = [ "nerd-font-symbols" ];
      type = with lib.types; listOf str;
-      description = lib.mdDoc ''
+      description = ''
        Presets files to be merged with settings in order.
      '';
    };
@ -50,7 +47,7 @@ in
    settings = lib.mkOption {
      inherit (settingsFormat) type;
      default = { };
-      description = lib.mdDoc ''
+      description = ''
        Configuration included in `starship.toml`.

        See https://starship.rs/config/#prompt for documentation.
@ -68,7 +65,7 @@ in
        if [[ ! -f "$HOME/.config/starship.toml" ]]; then
          export STARSHIP_CONFIG=${settingsFile}
        fi
-        eval "$(${pkgs.starship}/bin/starship init bash)"
+        eval "$(${cfg.package}/bin/starship init bash)"
      fi
    '';

@ -81,7 +78,7 @@ in
        if not test -f "$HOME/.config/starship.toml";
          set -x STARSHIP_CONFIG ${settingsFile}
        end
-        eval (${pkgs.starship}/bin/starship init fish)
+        eval (${cfg.package}/bin/starship init fish)
      end
    '';

@ -94,7 +91,7 @@ in
        if [[ ! -f "$HOME/.config/starship.toml" ]]; then
          export STARSHIP_CONFIG=${settingsFile}
        fi
-        eval "$(${pkgs.starship}/bin/starship init zsh)"
+        eval "$(${cfg.package}/bin/starship init zsh)"
      fi
    '';
  };
--- a/nixos/modules/services/desktop-managers/plasma6.nix
+++ b/nixos/modules/services/desktop-managers/plasma6.nix
@ -252,6 +252,7 @@ in {
    services.xserver.displayManager.sddm = {
      package = kdePackages.sddm;
      theme = mkDefault "breeze";
+      wayland.compositor = "kwin";
      extraPackages = with kdePackages; [
        breeze-icons
        kirigami
--- a/nixos/modules/services/misc/etebase-server.nix
+++ b/nixos/modules/services/misc/etebase-server.nix
@ -177,6 +177,7 @@ in

    systemd.tmpfiles.rules = [
      "d '${cfg.dataDir}' - ${cfg.user} ${config.users.users.${cfg.user}.group} - -"
+    ] ++ lib.optionals (cfg.unixSocket != null) [
      "d '${builtins.dirOf cfg.unixSocket}' - ${cfg.user} ${config.users.users.${cfg.user}.group} - -"
    ];

--- a/nixos/modules/services/networking/dnscache.nix
+++ b/nixos/modules/services/networking/dnscache.nix
@ -86,7 +86,11 @@ in {

  config = mkIf config.services.dnscache.enable {
    environment.systemPackages = [ pkgs.djbdns ];
-    users.users.dnscache.isSystemUser = true;
+    users.users.dnscache = {
+        isSystemUser = true;
+        group = "dnscache";
+    };
+    users.groups.dnscache = {};

    systemd.services.dnscache = {
      description = "djbdns dnscache server";
--- a/nixos/modules/services/networking/mycelium.nix
+++ b/nixos/modules/services/networking/mycelium.nix
@ -0,0 +1,126 @@
+{ config, pkgs, lib, ... }:
+
+let
+  cfg = config.services.mycelium;
+in
+{
+  options.services.mycelium = {
+    enable = lib.mkEnableOption "mycelium network";
+    peers = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      description = ''
+        List of peers to connect to in the format quic://1.2.3.4:9651.
+        If addHostedPublicNodes is set to true, the hosted public nodes will be added to this list.
+      '';
+      default = [];
+    };
+    keyFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = ''
+        optional path to a keyFile, if unset the default location (/var/lib/mycelium/key) will be used
+        If this key does not exist, it will be generated
+      '';
+    };
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Open the firewall for mycelium";
+    };
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.mycelium;
+      defaultText = lib.literalExpression ''"''${pkgs.mycelium}"'';
+      description = "The mycelium package to use";
+    };
+    addHostedPublicNodes = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = ''
+        add the hosted peers from https://github.com/threefoldtech/mycelium#hosted-public-nodes
+      '';
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall [ 9651 ];
+    networking.firewall.allowedUDPPorts = lib.optionals cfg.openFirewall [ 9650 9651 ];
+
+    systemd.services.mycelium = {
+      description = "Mycelium network";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      restartTriggers = [
+        cfg.keyFile
+      ];
+
+      unitConfig.Documentation = "https://github.com/threefoldtech/mycelium";
+
+      serviceConfig = {
+        User = "mycelium";
+        DynamicUser = true;
+        StateDirectory = "mycelium";
+        ProtectHome = true;
+        ProtectSystem = true;
+        LoadCredential = lib.mkIf (cfg.keyFile != null) "keyfile:${cfg.keyFile}";
+        SyslogIdentifier = "mycelium";
+        AmbientCapabilities = [ "CAP_NET_ADMIN" ];
+        MemoryDenyWriteExecute = true;
+        ProtectControlGroups = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "@system-service" "~@privileged @keyring" ];
+        ExecStart = lib.concatStringsSep " " ([
+          (lib.getExe cfg.package)
+          (if (cfg.keyFile != null) then
+            "--key-file \${CREDENTIALS_DIRECTORY}/keyfile" else
+            "--key-file %S/mycelium/key.bin"
+          )
+          "--tun-name" "mycelium"
+        ] ++
+          (lib.optional (cfg.addHostedPublicNodes || cfg.peers != []) "--peers")
+        ++ cfg.peers ++ (lib.optionals cfg.addHostedPublicNodes [
+          "tcp://188.40.132.242:9651" # DE 01
+          "tcp://[2a01:4f8:221:1e0b::2]:9651"
+          "quic://188.40.132.242:9651"
+          "quic://[2a01:4f8:221:1e0b::2]:9651"
+
+          "tcp://136.243.47.186:9651" # DE 02
+          "tcp://[2a01:4f8:212:fa6::2]:9651"
+          "quic://136.243.47.186:9651"
+          "quic://[2a01:4f8:212:fa6::2]:9651"
+
+          "tcp://185.69.166.7:9651" # BE 03
+          "tcp://[2a02:1802:5e:0:8478:51ff:fee2:3331]:9651"
+          "quic://185.69.166.7:9651"
+          "quic://[2a02:1802:5e:0:8478:51ff:fee2:3331]:9651"
+
+          "tcp://185.69.166.8:9651" # BE 04
+          "tcp://[2a02:1802:5e:0:8c9e:7dff:fec9:f0d2]:9651"
+          "quic://185.69.166.8:9651"
+          "quic://[2a02:1802:5e:0:8c9e:7dff:fec9:f0d2]:9651"
+
+          "tcp://65.21.231.58:9651" # FI 05
+          "tcp://[2a01:4f9:6a:1dc5::2]:9651"
+          "quic://65.21.231.58:9651"
+          "quic://[2a01:4f9:6a:1dc5::2]:9651"
+
+          "tcp://65.109.18.113:9651" # FI 06
+          "tcp://[2a01:4f9:5a:1042::2]:9651"
+          "quic://65.109.18.113:9651"
+          "quic://[2a01:4f9:5a:1042::2]:9651"
+        ]));
+        Restart = "always";
+        RestartSec = 5;
+        TimeoutStopSec = 5;
+      };
+    };
+  };
+  meta = {
+    maintainers = with lib.maintainers; [ flokli lassulus ];
+  };
+}
+
--- a/nixos/modules/services/x11/display-managers/sddm.nix
+++ b/nixos/modules/services/x11/display-managers/sddm.nix
@ -1,19 +1,24 @@
 { config, lib, pkgs, ... }:

-with lib;
 let
  xcfg = config.services.xserver;
  dmcfg = xcfg.displayManager;
  cfg = dmcfg.sddm;
  xEnv = config.systemd.services.display-manager.environment;

-  sddm = cfg.package.override(old: {
+  sddm = cfg.package.override (old: {
    withWayland = cfg.wayland.enable;
-    extraPackages = old.extraPackages or [] ++ cfg.extraPackages;
+    extraPackages = old.extraPackages or [ ] ++ cfg.extraPackages;
  });

  iniFmt = pkgs.formats.ini { };

+  inherit (lib)
+    concatMapStrings concatStringsSep getExe
+    attrNames getAttr optionalAttrs optionalString
+    mkRemovedOptionModule mkRenamedOptionModule mkIf mkEnableOption mkOption mkPackageOption types
+    ;
+
  xserverWrapper = pkgs.writeShellScript "xserver-wrapper" ''
    ${concatMapStrings (n: "export ${n}=\"${getAttr n xEnv}\"\n") (attrNames xEnv)}
    exec systemd-cat -t xserver-wrapper ${dmcfg.xserverBin} ${toString dmcfg.xserverArgs} "$@"
@ -38,12 +43,21 @@ let
      DefaultSession = optionalString (dmcfg.defaultSession != null) "${dmcfg.defaultSession}.desktop";

      DisplayServer = if cfg.wayland.enable then "wayland" else "x11";
+    } // optionalAttrs (cfg.wayland.compositor == "kwin") {
+      GreeterEnvironment = concatStringsSep " " [
+        "LANG=C.UTF-8"
+        "QT_WAYLAND_SHELL_INTEGRATION=layer-shell"
+      ];
+      InputMethod = ""; # needed if we are using --inputmethod with kwin
    };

    Theme = {
      Current = cfg.theme;
      ThemeDir = "/run/current-system/sw/share/sddm/themes";
      FacesDir = "/run/current-system/sw/share/sddm/faces";
+    } // optionalAttrs (cfg.theme == "breeze") {
+      CursorTheme = "breeze_cursors";
+      CursorSize = 24;
    };

    Users = {
@ -69,7 +83,7 @@ let
      SessionDir = "${dmcfg.sessionData.desktops}/share/wayland-sessions";
      CompositorCommand = lib.optionalString cfg.wayland.enable cfg.wayland.compositorCommand;
    };
-  } // lib.optionalAttrs dmcfg.autoLogin.enable {
+  } // optionalAttrs dmcfg.autoLogin.enable {
    Autologin = {
      User = dmcfg.autoLogin.user;
      Session = autoLoginSessionName;
@ -83,6 +97,34 @@ let
  autoLoginSessionName =
    "${dmcfg.sessionData.autologinSession}.desktop";

+  compositorCmds = {
+    kwin = concatStringsSep " " [
+      "${lib.getBin pkgs.kdePackages.kwin}/bin/kwin_wayland"
+      "--no-global-shortcuts"
+      "--no-kactivities"
+      "--no-lockscreen"
+      "--locale1"
+    ];
+    # This is basically the upstream default, but with Weston referenced by full path
+    # and the configuration generated from NixOS options.
+    weston =
+      let
+        westonIni = (pkgs.formats.ini { }).generate "weston.ini" {
+          libinput = {
+            enable-tap = xcfg.libinput.mouse.tapping;
+            left-handed = xcfg.libinput.mouse.leftHanded;
+          };
+          keyboard = {
+            keymap_model = xcfg.xkb.model;
+            keymap_layout = xcfg.xkb.layout;
+            keymap_variant = xcfg.xkb.variant;
+            keymap_options = xcfg.xkb.options;
+          };
+        };
+      in
+      "${getExe pkgs.weston} --shell=kiosk -c ${westonIni}";
+  };
+
 in
 {
  imports = [
@ -111,7 +153,7 @@ in
        '';
      };

-      package = mkPackageOption pkgs [ "plasma5Packages" "sddm" ] {};
+      package = mkPackageOption pkgs [ "plasma5Packages" "sddm" ] { };

      enableHidpi = mkOption {
        type = types.bool;
@ -145,7 +187,7 @@ in

      extraPackages = mkOption {
        type = types.listOf types.package;
-        default = [];
+        default = [ ];
        defaultText = "[]";
        description = lib.mdDoc ''
          Extra Qt plugins / QML libraries to add to the environment.
@ -206,24 +248,16 @@ in
      wayland = {
        enable = mkEnableOption "experimental Wayland support";

+        compositor = mkOption {
+          description = lib.mdDoc "The compositor to use: ${lib.concatStringsSep ", " (builtins.attrNames compositorCmds)}";
+          type = types.enum (builtins.attrNames compositorCmds);
+          default = "weston";
+        };
+
        compositorCommand = mkOption {
          type = types.str;
          internal = true;
-
-          # This is basically the upstream default, but with Weston referenced by full path
-          # and the configuration generated from NixOS options.
-          default = let westonIni = (pkgs.formats.ini {}).generate "weston.ini" {
-              libinput = {
-                enable-tap = xcfg.libinput.mouse.tapping;
-                left-handed = xcfg.libinput.mouse.leftHanded;
-              };
-              keyboard = {
-                keymap_model = xcfg.xkb.model;
-                keymap_layout = xcfg.xkb.layout;
-                keymap_variant = xcfg.xkb.variant;
-                keymap_options = xcfg.xkb.options;
-              };
-            }; in "${pkgs.weston}/bin/weston --shell=kiosk -c ${westonIni}";
+          default = compositorCmds.${cfg.wayland.compositor};
          description = lib.mdDoc "Command used to start the selected compositor";
        };
      };
@ -247,8 +281,6 @@ in
      }
    ];

-    services.xserver.displayManager.job.execCmd = "exec /run/current-system/sw/bin/sddm";
-
    security.pam.services = {
      sddm.text = ''
        auth      substack      login
@ -293,30 +325,41 @@ in
      uid = config.ids.uids.sddm;
    };

-    environment.etc."sddm.conf".source = cfgFile;
-    environment.pathsToLink = [
-      "/share/sddm"
-    ];
+    environment = {
+      etc."sddm.conf".source = cfgFile;
+      pathsToLink = [
+        "/share/sddm"
+      ];
+      systemPackages = [ sddm ];
+    };

    users.groups.sddm.gid = config.ids.gids.sddm;

-    environment.systemPackages = [ sddm ];
-    services.dbus.packages = [ sddm ];
-    systemd.tmpfiles.packages = [ sddm ];
+    services = {
+      dbus.packages = [ sddm ];
+      xserver = {
+        displayManager.job.execCmd = "exec /run/current-system/sw/bin/sddm";
+        # To enable user switching, allow sddm to allocate TTYs/displays dynamically.
+        tty = null;
+        display = null;
+      };
+    };

-    # We're not using the upstream unit, so copy these: https://github.com/sddm/sddm/blob/develop/services/sddm.service.in
-    systemd.services.display-manager.after = [
-      "systemd-user-sessions.service"
-      "getty@tty7.service"
-      "plymouth-quit.service"
-      "systemd-logind.service"
-    ];
-    systemd.services.display-manager.conflicts = [
-      "getty@tty7.service"
-    ];
+    systemd = {
+      tmpfiles.packages = [ sddm ];

-    # To enable user switching, allow sddm to allocate TTYs/displays dynamically.
-    services.xserver.tty = null;
-    services.xserver.display = null;
+      # We're not using the upstream unit, so copy these: https://github.com/sddm/sddm/blob/develop/services/sddm.service.in
+      services.display-manager = {
+        after = [
+          "systemd-user-sessions.service"
+          "getty@tty7.service"
+          "plymouth-quit.service"
+          "systemd-logind.service"
+        ];
+        conflicts = [
+          "getty@tty7.service"
+        ];
+      };
+    };
  };
 }
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@ -749,7 +749,7 @@ in
    boot.kernel.sysctl."fs.inotify.max_user_instances" = mkDefault 524288;
    boot.kernel.sysctl."fs.inotify.max_user_watches" = mkDefault 524288;

-    programs.gnupg.agent.pinentryPackage = lib.mkDefault pkgs.pinentry-gnome3;
+    programs.gnupg.agent.pinentryPackage = lib.mkOverride 1100 pkgs.pinentry-gnome3;

    systemd.defaultUnit = mkIf cfg.autorun "graphical.target";

--- a/nixos/modules/system/boot/uki.nix
+++ b/nixos/modules/system/boot/uki.nix
@ -7,8 +7,6 @@ let
  inherit (pkgs.stdenv.hostPlatform) efiArch;

  format = pkgs.formats.ini { };
-  ukifyConfig = format.generate "ukify.conf" cfg.settings;
-
 in

 {
@ -48,6 +46,15 @@ in
          contains and how it is built.
        '';
      };
+
+      configFile = lib.mkOption {
+        type = lib.types.path;
+        description = lib.mdDoc ''
+          The configuration file passed to {manpage}`ukify(1)` to create the UKI.
+
+          By default this configuration file is created from {option}`boot.uki.settings`.
+        '';
+      };
    };

    system.boot.loader.ukiFile = lib.mkOption {
@ -80,6 +87,8 @@ in
      };
    };

+    boot.uki.configFile = lib.mkOptionDefault (format.generate "ukify.conf" cfg.settings);
+
    system.boot.loader.ukiFile =
      let
        name = config.boot.uki.name;
@ -92,7 +101,7 @@ in
    system.build.uki = pkgs.runCommand config.system.boot.loader.ukiFile { } ''
      mkdir -p $out
      ${pkgs.buildPackages.systemdUkify}/lib/systemd/ukify build \
-        --config=${ukifyConfig} \
+        --config=${cfg.configFile} \
        --output="$out/${config.system.boot.loader.ukiFile}"
    '';

--- a/nixos/modules/virtualisation/nixos-containers.nix
+++ b/nixos/modules/virtualisation/nixos-containers.nix
@ -509,6 +509,12 @@ in
                                for details).
                              '';
                            }
+                            {
+                              assertion = !lib.strings.hasInfix "_" name;
+                              message = ''
+                                Names containing underscores are not allowed in nixos-containers. Please rename the container '${name}'
+                              '';
+                            }
                          ];
                        };
                      };
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -561,6 +561,7 @@ in {
  munin = handleTest ./munin.nix {};
  mutableUsers = handleTest ./mutable-users.nix {};
  mxisd = handleTest ./mxisd.nix {};
+  mycelium = handleTest ./mycelium {};
  mympd = handleTest ./mympd.nix {};
  mysql = handleTest ./mysql/mysql.nix {};
  mysql-autobackup = handleTest ./mysql/mysql-autobackup.nix {};
--- a/nixos/tests/drawterm.nix
+++ b/nixos/tests/drawterm.nix
@ -38,11 +38,24 @@ let
        def drawterm_running():
            machine.succeed("pgrep drawterm")

+        # cage is a bit wonky here.
+        # it seems to lag behind drawing
+        # and somehow needs a single input character
+        # in order to get the first prompt to show up.
+        # This is not present in any other compositor
+        # as far as I know, and after spending a couple
+        # hours with the upstream source trying to deduce
+        # how to perhaps fix it, I figured just polling is OK.
+        @polling_condition
+        def cpu_shown_up():
+            machine.send_chars(".")
+            machine.wait_for_text("cpu", 1)
+
        start_all()

        machine.wait_for_unit("graphical.target")
        drawterm_running.wait() # type: ignore[union-attr]
-        machine.wait_for_text("cpu")
+        cpu_shown_up.wait() # type: ignore[union-attr]
        machine.send_chars("cpu\n")
        machine.wait_for_text("auth")
        machine.send_chars("cpu\n")
--- a/nixos/tests/mycelium/default.nix
+++ b/nixos/tests/mycelium/default.nix
@ -0,0 +1,57 @@
+import ../make-test-python.nix ({ lib, ... }: let
+  peer1-ip = "531:c350:28c1:dfde:ea6d:77d1:a60b:7209";
+  peer2-ip = "49f:3942:3a55:d100:4c78:c558:c4f:695b";
+in
+  {
+    name = "mycelium";
+    meta.maintainers = with lib.maintainers; [ lassulus ];
+
+    nodes = {
+
+      peer1 = { config, pkgs, ... }: {
+        virtualisation.vlans = [ 1 ];
+        networking.interfaces.eth1.ipv4.addresses = [{
+          address = "192.168.1.11";
+          prefixLength = 24;
+        }];
+
+        services.mycelium = {
+          enable = true;
+          addHostedPublicNodes = false;
+          openFirewall = true;
+          keyFile = ./peer1.key;
+          peers = [
+            "quic://192.168.1.12:9651"
+            "tcp://192.168.1.12:9651"
+          ];
+        };
+      };
+
+      peer2 = { config, pkgs, ... }: {
+        virtualisation.vlans = [ 1 ];
+        networking.interfaces.eth1.ipv4.addresses = [{
+          address = "192.168.1.12";
+          prefixLength = 24;
+        }];
+
+        services.mycelium = {
+          enable = true;
+          addHostedPublicNodes = false;
+          openFirewall = true;
+          keyFile = ./peer2.key;
+        };
+      };
+    };
+
+    testScript = ''
+      start_all()
+
+      peer1.wait_for_unit("network-online.target")
+      peer2.wait_for_unit("network-online.target")
+      peer1.wait_for_unit("mycelium.service")
+      peer2.wait_for_unit("mycelium.service")
+
+      peer1.succeed("ping -c5 ${peer2-ip}")
+      peer2.succeed("ping -c5 ${peer1-ip}")
+    '';
+  })
--- a/nixos/tests/mycelium/peer1.key
+++ b/nixos/tests/mycelium/peer1.key
@ -0,0 +1 @@
+sì	B0ã”ŸŽdûR<C3BB>æÈôÌH¶5œu?à»í…^
--- a/nixos/tests/mycelium/peer2.key
+++ b/nixos/tests/mycelium/peer2.key
@ -0,0 +1 @@
+ΟX<>1®yGΟΥ…<CEA5>SAM»<4D>eΘΐ«Ύ‡<0C>έ7]
--- a/pkgs/applications/audio/monkeys-audio/default.nix
+++ b/pkgs/applications/audio/monkeys-audio/default.nix
@ -5,13 +5,13 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "10.52";
+  version = "10.60";
  pname = "monkeys-audio";

  src = fetchzip {
    url = "https://monkeysaudio.com/files/MAC_${
      builtins.concatStringsSep "" (lib.strings.splitString "." finalAttrs.version)}_SDK.zip";
-    hash = "sha256-n+bQzvuCTt7dnqkPO592KKZeShmMlbp/KAXK0F2dlTg=";
+    hash = "sha256-llOo9G65UDDCzaSahq5qssw6SmOJ5C9qS2bdXB/pKF0=";
    stripRoot = false;
  };
  nativeBuildInputs = [
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@ -10,16 +10,16 @@ let
    inherit tiling_wm;
  };
  stableVersion = {
-    version = "2023.2.1.23"; # "Android Studio Iguana | 2023.2.1"
-    sha256Hash = "sha256-G2aPgMqBHNw1DetlaBQ9o3/VfX6QEh9VQqMZ5S/VoHM=";
+    version = "2023.2.1.24"; # "Android Studio Iguana | 2023.2.1 Patch 1"
+    sha256Hash = "sha256-ACZCdXKEnJy7DJTW+XGOoIvDRdzP47NytUEAqV//mbU=";
  };
  betaVersion = {
    version = "2023.2.1.23"; # "Android Studio Iguana | 2023.2.1"
    sha256Hash = "sha256-G2aPgMqBHNw1DetlaBQ9o3/VfX6QEh9VQqMZ5S/VoHM=";
  };
  latestVersion = {
-    version = "2023.3.1.12"; # "Android Studio Jellyfish | 2023.3.1 Canary 12"
-    sha256Hash = "sha256-yg84WBLHfb6q+OlHuh5SJ5P4Fuc8yqO9eZ8iecOhZj4=";
+    version = "2023.3.2.1"; # "Android Studio Jellyfish | 2023.3.2 Canary 1"
+    sha256Hash = "sha256-99EWGh3+3HV8yO29ANg1pwoo/1ktI2aCwKrdIqlcgVs=";
  };
 in {
  # Attributes are named by their corresponding release channels
--- a/pkgs/applications/editors/bluefish/default.nix
+++ b/pkgs/applications/editors/bluefish/default.nix
@ -13,11 +13,11 @@

 stdenv.mkDerivation rec {
  pname = "bluefish";
-  version = "2.2.14";
+  version = "2.2.15";

  src = fetchurl {
    url = "mirror://sourceforge/bluefish/bluefish-${version}.tar.bz2";
-    sha256 = "sha256-IszfnOTlyWIQY+bPfXOr+wc2q3pyvOCG0Gxc9e4SXt4=";
+    sha256 = "sha256-YUPlHGtVedWW86moXg8NhYDJ9Y+ChXWxGYgODKHZQbw=";
  };

  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
--- a/pkgs/applications/editors/rstudio/default.nix
+++ b/pkgs/applications/editors/rstudio/default.nix
@ -7,7 +7,7 @@
 , makeDesktopItem
 , copyDesktopItems
 , cmake
-, boost
+, boost183
 , zlib
 , openssl
 , R
@ -40,18 +40,19 @@

 let
  pname = "RStudio";
-  version =
-  "${RSTUDIO_VERSION_MAJOR}.${RSTUDIO_VERSION_MINOR}.${RSTUDIO_VERSION_PATCH}${RSTUDIO_VERSION_SUFFIX}";
-  RSTUDIO_VERSION_MAJOR  = "2023";
-  RSTUDIO_VERSION_MINOR  = "09";
-  RSTUDIO_VERSION_PATCH  = "0";
-  RSTUDIO_VERSION_SUFFIX = "+463";
+  version = "2023.12.1+402";
+  RSTUDIO_VERSION_MAJOR = lib.versions.major version;
+  RSTUDIO_VERSION_MINOR = lib.versions.minor version;
+  RSTUDIO_VERSION_PATCH = lib.versions.patch version;
+  RSTUDIO_VERSION_SUFFIX = "+" + toString (
+    lib.tail (lib.splitString "+" version)
+  );

  src = fetchFromGitHub {
    owner = "rstudio";
    repo = "rstudio";
-    rev = "v${version}";
-    hash = "sha256-FwNuU2rbE3GEhuwphvZISUMhvSZJ6FjjaZ1oQ9F8NWc=";
+    rev = version;
+    hash = "sha256-ecMzkpHazg8jEBz9wh8hqRX2UdziOC8b6F+3xxdugy0=";
  };

  mathJaxSrc = fetchurl {
@ -62,8 +63,8 @@ let
  rsconnectSrc = fetchFromGitHub {
    owner = "rstudio";
    repo = "rsconnect";
-    rev = "5175a927a41acfd9a21d9fdecb705ea3292109f2";
-    hash = "sha256-c1fFcN6KAfxXv8bv4WnIqQKg1wcNP2AywhEmIbyzaBA=";
+    rev = "v1.2.0";
+    hash = "sha256-ghRz4Frd+I9ShRNNOE/kdk9KjRCj0Z1mPnThueriiUY=";
  };

  # Ideally, rev should match the rstudio release name.
@ -93,7 +94,7 @@ in
    ];

    buildInputs = [
-      boost
+      boost183
      zlib
      openssl
      R
@ -133,6 +134,7 @@ in
      ./fix-resources-path.patch
      ./pandoc-nix-path.patch
      ./use-system-quarto.patch
+      ./ignore-etc-os-release.patch
    ];

    postPatch = ''
--- a/pkgs/applications/editors/rstudio/ignore-etc-os-release.patch
+++ b/pkgs/applications/editors/rstudio/ignore-etc-os-release.patch
@ -0,0 +1,77 @@
+diff --git a/CMakeGlobals.txt b/CMakeGlobals.txt
+index 5f96ffb..3f15687 100644
+--- a/CMakeGlobals.txt
+++ b/CMakeGlobals.txt
+@@ -29,11 +29,6 @@ endif()
+ get_filename_component(ROOT_SRC_DIR ${CMAKE_CURRENT_LIST_FILE} PATH)
+ set(CMAKE_MODULE_PATH "${ROOT_SRC_DIR}/cmake/modules/")
+ 
+-# read /etc/os-release
+-if(LINUX)
+-   include(OsRelease)
+-endif()
+-
+ # version info
+ if ("$ENV{RSTUDIO_VERSION_MAJOR}" STREQUAL "")
+   string(TIMESTAMP CPACK_PACKAGE_VERSION_MAJOR "%Y")
+diff --git a/cmake/modules/OsRelease.cmake b/cmake/modules/OsRelease.cmake
+deleted file mode 100644
+index 81a9e1f..0000000
+--- a/cmake/modules/OsRelease.cmake
+++ /dev/null
+@@ -1,24 +0,0 @@
+-#
+-# OsRelease.cmake
+-#
+-# Copyright (C) 2022 by Posit Software, PBC
+-#
+-# This program is licensed to you under the terms of version 3 of the
+-# GNU Affero General Public License. This program is distributed WITHOUT
+-# ANY EXPRESS OR IMPLIED WARRANTY, INCLUDING THOSE OF NON-INFRINGEMENT,
+-# MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Please refer to the
+-# AGPL (http://www.gnu.org/licenses/agpl-3.0.txt) for more details.
+-#
+-#
+-
+-# reads and parses /etc/os-release into CMake variables
+-file(STRINGS "/etc/os-release" OS_RELEASE)
+-foreach(LINE ${OS_RELEASE})
+-	string(FIND "${LINE}" "=" INDEX)
+-	string(SUBSTRING "${LINE}" 0 "${INDEX}" KEY)
+-	math(EXPR INDEX "${INDEX} + 1")
+-	string(SUBSTRING "${LINE}" "${INDEX}" -1 VALUE)
+-	separate_arguments(VALUE UNIX_COMMAND "${VALUE}")
+-	set("OS_RELEASE_${KEY}" "${VALUE}" CACHE INTERNAL "/etc/os-release: ${KEY}")
+-endforeach()
+-
+diff --git a/package/linux/CMakeLists.txt b/package/linux/CMakeLists.txt
+index 5d5c35e..a94f8fc 100644
+--- a/package/linux/CMakeLists.txt
+++ b/package/linux/CMakeLists.txt
+@@ -16,7 +16,7 @@
+ # configure cpack install location
+ set(CPACK_SET_DESTDIR "ON")
+ set(CPACK_INSTALL_PREFIX "${CMAKE_INSTALL_PREFIX}")
+-message(STATUS "Packaging RStudio for ${OS_RELEASE_PRETTY_NAME}")
+message(STATUS "Packaging RStudio for Nix")
+ 
+ # detect architecture (packaging platform specific)
+ find_program(DPKG_EXECUTABLE dpkg)
+@@ -42,17 +42,6 @@ if(EXISTS "/etc/redhat-release")
+    endif()
+ endif()
+ 
+-# set libssl dependency
+-if(OS_RELEASE_ID STREQUAL "ubuntu")
+-  if(OS_RELEASE_VERSION_ID VERSION_GREATER_EQUAL "22.04")
+-    set(RSTUDIO_DEBIAN_DEPENDS_SSL "libssl-dev")
+-  else()
+-    set(RSTUDIO_DEBIAN_DEPENDS_SSL "libssl1.0.0 | libssl1.0.2 | libssl1.1")
+-  endif()
+-else()
+-  set(RSTUDIO_DEBIAN_DEPENDS_SSL "libssl-dev")
+-endif()
+-
+ # configuration specific
+ if(RSTUDIO_SERVER)
+ 
--- a/pkgs/applications/editors/rstudio/use-system-node.patch
+++ b/pkgs/applications/editors/rstudio/use-system-node.patch
@ -6,7 +6,7 @@ index d18362b..98cdd4c 100644
 external-pandoc-path=${RSTUDIO_DEPENDENCIES_PANDOC_DIR}
 external-quarto-path=${RSTUDIO_DEPENDENCIES_QUARTO_DIR}
 external-libclang-path=${RSTUDIO_DEPENDENCIES_DIR}/common/libclang
-external-node-path=${RSTUDIO_DEPENDENCIES_DIR}/common/node/16.14.0/bin/node
+-external-node-path=${RSTUDIO_DEPENDENCIES_DIR}/common/node/18.18.2/bin/node
 +external-node-path=@node@/bin/node
 
 # enable copilot
@ -32,7 +32,7 @@ index 033d605..f1ee63d 100644
 +++ b/src/gwt/build.xml
@@ -87,29 +87,7 @@
    <!-- ensure version matches RSTUDIO_NODE_VERSION -->
-    <property name="node.version" value="16.14.0"/>
+    <property name="node.version" value="18.18.2"/>
    <property name="node.dir" value="../../dependencies/common/node/${node.version}"/>
 -   <!-- use yarn from system but will prefer yarn from dependencies if available -->
 -   <condition property="yarn.bin" value="yarn">
@ -58,15 +58,18 @@ index 033d605..f1ee63d 100644
 -      value="c:\rstudio-tools\dependencies\common\node\${node.version}\node_modules\yarn\bin\yarn.cmd"
 -      file="c:\rstudio-tools\dependencies\common\node\${node.version}\node_modules\yarn\bin\yarn.cmd"/>
 +   <property name="node.bin" value="@node@/bin/node"/>
- 
+
    <property name="panmirror.dir" value="./lib/quarto/apps/panmirror"/>
    <property name="panmirror.build.dir" value="./www/js/panmirror"/>
-@@ -126,21 +104,11 @@
-       file="c:\rstudio-tools\src\gwt\lib\quarto\apps\panmirror"/>
- 
-    <target name="panmirror" description="Compile panmirror library">
+@@ -133,28 +111,11 @@
+             <isset property="panmirror.minify" />
+          </not>
+       </condition>
+-
 -      <echo message="yarn location: ${yarn.bin}"/>
 -      <echo message="panmirror location: ${panmirror.dir}"/>
+-      <echo message="panmirror minify: ${panmirror.minify}"/>
+-
       <mkdir dir="${panmirror.build.dir}"/>
 -      <exec executable="${yarn.bin}" dir="${panmirror.dir}" resolveexecutable="true" failonerror="true">
 -         <arg value="install"/>
@ -75,14 +78,19 @@ index 033d605..f1ee63d 100644
 -      </exec>
 -      <exec executable="${yarn.bin}" dir="${panmirror.dir}" resolveexecutable="true" failonerror="true">
 -         <arg value="build"/>
+-         <arg value="--minify"/>
+-         <arg value="${panmirror.minify}"/>
+-         <arg value="--sourcemap"/>
+-         <arg value="true"/>
 -         <env key="PANMIRROR_OUTDIR" value="dist-rstudio"/>
-+      <exec executable="${node.bin}" dir="${panmirror.dir}" spawn="${panmirror.spawn}">
-+         <arg value="fuse"/>
-+         <arg value="${panmirror.target}"/>
+     <exec executable="${node.bin}" dir="${panmirror.dir}" spawn="${panmirror.spawn}">
+          <arg value="fuse"/>
+          <arg value="${panmirror.target}"/>
       </exec>
 -      <copy todir="${panmirror.build.dir}">
 -         <fileset dir="${panmirror.dir}/dist-rstudio"/>
 -      </copy>
    </target>
- 
+
    <target name="javac" description="Compile java source">
+    
--- a/pkgs/applications/emulators/punes/default.nix
+++ b/pkgs/applications/emulators/punes/default.nix
@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchFromGitHub
-, fetchpatch
 , gitUpdater
 , cmake
 , pkg-config
@ -17,26 +16,17 @@
 , wrapQtAppsHook
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "punes";
-  version = "0.110";
+  version = "0.111";

  src = fetchFromGitHub {
    owner = "punesemu";
    repo = "puNES";
-    rev = "v${version}";
-    sha256 = "sha256-+hL168r40aYUjyLbWFXWk9G2srrrG1TH1gLYMliHftU=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-TIXjYkInWV3yVnvXrdHcmeWYeps5TcvkG2Xjg4roIds=";
  };

-  patches = [
-    # Fixes compilation on aarch64
-    # Remove when version > 0.110
-    (fetchpatch {
-      url = "https://github.com/punesemu/puNES/commit/90dd5bc90412bbd199c2716f67a24aa88b24d80f.patch";
-      hash = "sha256-/KNpTds4qjwyaTUebWWPlVXfuxVh6M4zOInxUfYztJg=";
-    })
-  ];
-
  nativeBuildInputs = [
    cmake
    pkg-config
@ -73,8 +63,9 @@ stdenv.mkDerivation rec {
    description = "Qt-based Nintendo Entertainment System emulator and NSF/NSFe Music Player";
    mainProgram = "punes";
    homepage = "https://github.com/punesemu/puNES";
+    changelog = "https://github.com/punesemu/puNES/blob/v${finalAttrs.version}/ChangeLog";
    license = licenses.gpl2Plus;
    maintainers = with maintainers; [ OPNA2608 ];
    platforms = with platforms; linux ++ freebsd ++ openbsd ++ windows;
  };
-}
+})
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@ -6,6 +6,7 @@
 , copyDesktopItems
 , prefetch-yarn-deps
 , makeWrapper
+, autoSignDarwinBinariesHook
 , nodejs
 , yarn
 , electron
@ -23,6 +24,11 @@ stdenv.mkDerivation rec {
    hash = "sha256-+TCnVXcmAEpa7MiL0dyeoh2aUfIIO8eze9pEaHgKnME=";
  };

+  # `@electron/fuses` tries to run `codesign` and fails. Disable and use autoSignDarwinBinariesHook instead
+  postPatch = ''
+    sed -i -e 's/resetAdHocDarwinSignature:.*/resetAdHocDarwinSignature: false,/' build/fuses.js
+  '';
+
  offlineCache = fetchYarnDeps {
    yarnLock = src + "/yarn.lock";
    hash = "sha256-QS0bkDDQq3sn79TQ+pTZsmbmXgMccyLmlPLTsko7eGg=";
@ -35,6 +41,8 @@ stdenv.mkDerivation rec {
    yarn
  ] ++ lib.optionals (!stdenv.isDarwin) [
    copyDesktopItems
+  ] ++ lib.optionals stdenv.isDarwin [
+    autoSignDarwinBinariesHook
  ];

  ELECTRON_SKIP_BINARY_DOWNLOAD = true;
--- a/pkgs/applications/graphics/structorizer/default.nix
+++ b/pkgs/applications/graphics/structorizer/default.nix
@ -10,7 +10,7 @@

 stdenv.mkDerivation rec {
  pname = "structorizer";
-  version = "3.32-17";
+  version = "3.32-18";

  desktopItems = [
    (makeDesktopItem {
@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
    owner = "fesch";
    repo = "Structorizer.Desktop";
    rev = version;
-    hash = "sha256-yJPF4N402wzc4kNWgcu7quhQ9QaERMfqHdQrf1IGwrQ=";
+    hash = "sha256-CA87j11TFUd0nmuPc1qyqdITkTPE/jauf31cO2iBQVg=";
  };

  patches = [ ./makeStructorizer.patch ./makeBigJar.patch ];
--- a/pkgs/applications/misc/1password/default.nix
+++ b/pkgs/applications/misc/1password/default.nix
@ -12,12 +12,12 @@ let
    if extension == "zip" then fetchzip args else fetchurl args;

  pname = "1password-cli";
-  version = "2.25.1";
+  version = "2.26.0";
  sources = rec {
-    aarch64-linux = fetch "linux_arm64" "sha256-3LUfqTaLpJal/tjtRzTztm8H4wl1g4VSHWiFRukAqvE=" "zip";
-    i686-linux = fetch "linux_386" "sha256-QJu4SHfM4zzHP14MKaSydAeFCvAPa4wsMh+JvWGR7J4=" "zip";
-    x86_64-linux = fetch "linux_amd64" "sha256-erZCpCH5Q4VqGO045qKP5KAp07xKgMKrVrY54btT5BM=" "zip";
-    aarch64-darwin = fetch "apple_universal" "sha256-kOAbr5MrDylgEQGMYUDklKCNNkZalVfJBcUwSZSMFH0=" "pkg";
+    aarch64-linux = fetch "linux_arm64" "sha256-zWmWeAPtgSR8/3l40K4DPdMm0Pan+J1uNjUaEx+geO4=" "zip";
+    i686-linux = fetch "linux_386" "sha256-OOjAMfRTSW+RuD0PPosvxMIPJcPQQok5Wn209sa0tuU=" "zip";
+    x86_64-linux = fetch "linux_amd64" "sha256-RwdEeqBFNj5dgBsmC2fiDwUGFWhuqeEL7g60ogFEq1Y=" "zip";
+    aarch64-darwin = fetch "apple_universal" "sha256-pwXHax0DBx1UpVmwYytpSikt5xdKZJXrdqvjWyWdUBM=" "pkg";
    x86_64-darwin = aarch64-darwin;
  };
  platforms = builtins.attrNames sources;
--- a/pkgs/applications/misc/electrum/grs.nix
+++ b/pkgs/applications/misc/electrum/grs.nix
@ -10,7 +10,7 @@
 }:

 let
-  version = "4.4.4";
+  version = "4.5.4";

  libsecp256k1_name =
    if stdenv.isLinux then "libsecp256k1.so.{v}"
@ -32,11 +32,11 @@ python3.pkgs.buildPythonApplication {
    owner = "Groestlcoin";
    repo = "electrum-grs";
    rev = "refs/tags/v${version}";
-    sha256 = "0fl01qdvb1z6l6kwipj1lj0qmjk3mzw25wv7yh5j1hh1f5lng0s8";
+    sha256 = "1k078jg3bw4n3kcxy917m30x1skxm679w8hcw8mlxb94ikrjc66h";
  };

  nativeBuildInputs = lib.optionals enableQt [ wrapQtAppsHook ];
-  buildInputs = lib.optional stdenv.isLinux qtwayland;
+  buildInputs = lib.optional (stdenv.isLinux && enableQt) qtwayland;

  propagatedBuildInputs = with python3.pkgs; [
    aiohttp
@ -56,17 +56,25 @@ python3.pkgs.buildPythonApplication {
    requests
    tlslite-ng
    certifi
+    jsonpatch
    # plugins
    btchip-python
    ledger-bitcoin
    ckcc-protocol
    keepkey
    trezor
+    bitbox02
+    cbor
+    pyserial
  ] ++ lib.optionals enableQt [
    pyqt5
    qdarkstyle
  ];

+  checkInputs = with python3.pkgs; lib.optionals enableQt [
+    pyqt6
+  ];
+
  postPatch = ''
    # make compatible with protobuf4 by easing dependencies ...
    substituteInPlace ./contrib/requirements/requirements.txt \
@ -104,7 +112,6 @@ python3.pkgs.buildPythonApplication {

  meta = with lib; {
    description = "Lightweight Groestlcoin wallet";
-    mainProgram = "electrum-grs";
    longDescription = ''
      An easy-to-use Groestlcoin client featuring wallets generated from
      mnemonic seeds (in addition to other, more advanced, wallet options)
@ -116,5 +123,6 @@ python3.pkgs.buildPythonApplication {
    license = licenses.mit;
    platforms = platforms.all;
    maintainers = with maintainers; [ gruve-p ];
+    mainProgram = "electrum-grs";
  };
 }
--- a/pkgs/applications/misc/kuro/default.nix
+++ b/pkgs/applications/misc/kuro/default.nix
@ -5,18 +5,21 @@
 , makeDesktopItem
 , copyDesktopItems
 , mkYarnPackage
-, electron
+, electron_29
 }:

+let
+  electron = electron_29;
+in
 mkYarnPackage rec {
  pname = "kuro";
  version = "9.0.0";

  src = fetchFromGitHub {
    owner = "davidsmorais";
-    repo = pname;
+    repo = "kuro";
    rev = "v${version}";
-    sha256 = "sha256-9Z/r5T5ZI5aBghHmwiJcft/x/wTRzDlbIupujN2RFfU=";
+    hash = "sha256-9Z/r5T5ZI5aBghHmwiJcft/x/wTRzDlbIupujN2RFfU=";
  };

  packageJSON = ./package.json;
@ -26,7 +29,7 @@ mkYarnPackage rec {
    hash = "sha256-GTiNv7u1QK/wjQgpka7REuoLn2wjZG59kYJQaZZPycI=";
  };

-  ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";

  nativeBuildInputs = [
    makeWrapper
@ -68,21 +71,23 @@ mkYarnPackage rec {

  desktopItems = [
    (makeDesktopItem {
-      name = pname;
-      exec = pname;
-      icon = pname;
+      name = "kuro";
+      exec = "kuro";
+      icon = "kuro";
      desktopName = "Kuro";
      genericName = "Microsoft To-Do Client";
      comment = meta.description;
      categories = [ "Office" ];
-      startupWMClass = pname;
+      startupWMClass = "kuro";
    })
  ];

  meta = with lib; {
+    changelog = "https://github.com/davidsmorais/kuro/releases/tag/${src.rev}";
    description = "An unofficial, featureful, open source, community-driven, free Microsoft To-Do app";
    homepage = "https://github.com/davidsmorais/kuro";
    license = licenses.mit;
+    mainProgram = "kuro";
    maintainers = with maintainers; [ ChaosAttractor ];
    inherit (electron.meta) platforms;
  };
--- a/pkgs/applications/misc/obinskit/default.nix
+++ b/pkgs/applications/misc/obinskit/default.nix
@ -1,65 +0,0 @@
-{ stdenv
-, lib
-, fetchurl
-, libxkbcommon
-, systemd
-, xorg
-, electron_13
-, makeWrapper
-, makeDesktopItem
-}:
-let
-  desktopItem = makeDesktopItem rec {
-    name = "Obinskit";
-    exec = "obinskit";
-    icon = "obinskit";
-    desktopName = "Obinskit";
-    genericName = "Obinskit keyboard configurator";
-    categories = [ "Utility" ];
-  };
-  electron = electron_13;
-in
-stdenv.mkDerivation rec {
-  pname = "obinskit";
-  version = "1.2.11";
-
-  src = fetchurl {
-    url = "https://s3.hexcore.xyz/occ/linux/tar/ObinsKit_${version}_x64.tar.gz";
-    curlOptsList = [ "--header" "Referer: https://www.hexcore.xyz/" ];
-    hash = "sha256-KhCu1TZsJmcXRSWSTaYOMjt+IA4qqavBwaYzXnkgls0=";
-  };
-
-  unpackPhase = "tar -xzf $src";
-
-  sourceRoot = "ObinsKit_${version}_x64";
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  dontConfigure = true;
-  dontBuild = true;
-
-  installPhase = ''
-    mkdir -p $out/opt/obinskit
-
-    cp -r resources $out/opt/obinskit/
-    cp -r locales $out/opt/obinskit/
-
-    mkdir -p $out/share/{applications,pixmaps}
-    install resources/icons/tray-darwin@2x.png $out/share/pixmaps/obinskit.png
-    ln -s ${desktopItem}/share/applications/* $out/share/applications
-  '';
-
-  postFixup = ''
-    makeWrapper ${electron}/bin/electron $out/bin/${pname} \
-      --add-flags $out/opt/obinskit/resources/app.asar \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc.lib libxkbcommon (lib.getLib systemd) xorg.libXt xorg.libXtst ]}"
-  '';
-
-  meta = with lib; {
-    description = "Graphical configurator for Anne Pro and Anne Pro II keyboards";
-    homepage = "https://www.hexcore.xyz/obinskit";
-    license = licenses.unfree;
-    maintainers = with maintainers; [ shou ];
-    platforms = [ "x86_64-linux" ];
-  };
-}
--- a/pkgs/applications/misc/passky-desktop/default.nix
+++ b/pkgs/applications/misc/passky-desktop/default.nix
@ -1,12 +1,15 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, electron_22
+, electron_29
 , makeWrapper
 , makeDesktopItem
 , copyDesktopItems
 }:

+let
+  electron = electron_29;
+in
 stdenv.mkDerivation rec {
  pname = "passky-desktop";
  version = "8.1.1";
@ -18,7 +21,10 @@ stdenv.mkDerivation rec {
    sha256 = "1ma8s1bngjdzclcc4m5pcmavk38sidaskmz7dgfnv84y35si18dr";
  };

-  nativeBuildInputs = [ makeWrapper copyDesktopItems ];
+  nativeBuildInputs = [
+    makeWrapper
+    copyDesktopItems
+  ];

  installPhase = ''
    runHook preInstall
@ -35,7 +41,7 @@ stdenv.mkDerivation rec {
    done

    mkdir "$out/share/applications"
-    makeWrapper ${electron_22}/bin/electron "$out/bin/passky" \
+    makeWrapper ${electron}/bin/electron "$out/bin/passky" \
      --add-flags "$out/share/passky/electron/" \
      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"

@ -45,12 +51,13 @@ stdenv.mkDerivation rec {
  desktopItems = [
    (
      makeDesktopItem {
-        name = "Passky";
+        name = "passky";
        type = "Application";
-        desktopName = "passky";
+        desktopName = "Passky";
        comment = "Simple, modern, open source and secure password manager.";
        icon = "passky";
        exec = "passky %U";
+        terminal = false;
        categories = [ "Utility" ];
        startupWMClass = "Passky";
      }
--- a/pkgs/applications/misc/sl1-to-photon/default.nix
+++ b/pkgs/applications/misc/sl1-to-photon/default.nix
@ -8,34 +8,34 @@
 , shiboken2
 }:
 let
-  version = "0.1.3";
+  version = "0.1.3+";
 in
 buildPythonApplication rec {
  pname = "sl1-to-photon";
  inherit version;

  src = fetchFromGitHub {
-    owner = "fookatchu";
+    owner = "cab404";
    repo = "SL1toPhoton";
-    rev = "v${version}";
-    sha256 = "1hmb74rcky3nax4lxn7pw6lcd5a66fdbwrm11c84zb31xb51bakw";
+    rev = "7edc6ea99818622f5d49ac7af80ddd4916b8c19f";
+    sha256 = "ssFfjlBMi3FHosDBUA2gs71VUIBkEdPVcV3STNxmOIM=";
  };

-  propagatedBuildInputs = [ pyphotonfile pillow numpy pyside2 shiboken2 ];
+  pythonPath = [ pyphotonfile pillow numpy pyside2 shiboken2 ];

-  format = "other";
+  format = "setuptools";
+  dontUseSetuptoolsCheck = true;

  installPhase = ''
    install -D -m 0755 SL1_to_Photon.py $out/bin/${pname}
-    sed -i '1i#!/usr/bin/env python' $out/bin/${pname}
  '';

  meta = with lib; {
    maintainers = [ maintainers.cab404 ];
    license = licenses.gpl3Plus;
    description = "Tool for converting Slic3r PE's SL1 files to Photon files for the Anycubic Photon 3D-Printer";
+    homepage = "https://github.com/cab404/SL1toPhoton";
    mainProgram = "sl1-to-photon";
-    homepage = "https://github.com/fookatchu/SL1toPhoton";
  };

 }
--- a/pkgs/applications/misc/sweethome3d/default.nix
+++ b/pkgs/applications/misc/sweethome3d/default.nix
@ -53,6 +53,9 @@ let
    nativeBuildInputs = [ makeWrapper unzip autoPatchelfHook ];
    buildInputs = [ ant jdk p7zip gtk3 gsettings-desktop-schemas libXxf86vm ];

+    # upstream targets Java 7 by default
+    env.ANT_ARGS = "-DappletClassSource=8 -DappletClassTarget=8 -DclassSource=8 -DclassTarget=8";
+
    buildPhase = ''
      runHook preBuild

--- a/pkgs/applications/misc/sweethome3d/editors.nix
+++ b/pkgs/applications/misc/sweethome3d/editors.nix
@ -44,6 +44,9 @@ let
    nativeBuildInputs = [ makeWrapper unzip ];
    buildInputs = [ ant jdk gtk3 gsettings-desktop-schemas ];

+    # upstream targets Java 7 by default
+    env.ANT_ARGS = "-DappletClassSource=8 -DappletClassTarget=8 -DclassSource=8 -DclassTarget=8";
+
    postPatch = ''
      sed -i -e 's,../SweetHome3D,${applicationSrc},g' build.xml
      sed -i -e 's,lib/macosx/java3d-1.6/jogl-all.jar,lib/java3d-1.6/jogl-all.jar,g' build.xml
--- a/pkgs/applications/misc/waycorner/default.nix
+++ b/pkgs/applications/misc/waycorner/default.nix
@ -8,14 +8,14 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "waycorner";
-  version = "0.2.1";
+  version = "0.2.2";
  src = fetchFromGitHub {
    owner = "AndreasBackx";
    repo = "waycorner";
    rev = version;
-    hash = "sha256-xvmvtn6dMqt8kUwvn5d5Nl1V84kz1eWa9BSIN/ONkSQ=";
+    hash = "sha256-b0wGqtCvWzCV9mj2eZ0SXzxM02fbyQ+OfKcbZ2MhLOE=";
  };
-  cargoHash = "sha256-Dl+GhJywWhaC4QMS70klazPsFipGVRW+6jrXH2XsEAI=";
+  cargoHash = "sha256-Xl2nBBcfWjULKG2L+qX4ruw7gux6+qfFg/dTAarqgAU=";
  buildInputs = [
    wayland
  ];
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@ -1,23 +1,23 @@
 {
  stable = {
    chromedriver = {
-      hash_darwin = "sha256-QdL9KamluVX6kIIY6F7zxKL5l7clhsE7QWGWw4YRUtM=";
+      hash_darwin = "sha256-yRLbe3xl0L/PfRcVB4LA6JeDvLpgUhtKZiAfyB2v/ZE=";
      hash_darwin_aarch64 =
-        "sha256-GKqk6GMitz0uud65iPCUMdOtIEhmWyHPbtrO+V2f8XU=";
-      hash_linux = "sha256-QKr2BjydiP5D3T5becwQHeFmK0LMrIFhbssDELqSEQM=";
-      version = "122.0.6261.128";
+        "sha256-TMreCFF9Lo+9gy7kzZWd9Mjep0CYa3Cxn4kr9BNTdkE=";
+      hash_linux = "sha256-rM2usA0zDZ1aXvkbvm+l0xalViEJIxu8ZYZvoTkNiis=";
+      version = "123.0.6312.58";
    };
    deps = {
      gn = {
-        hash = "sha256-UhdDsq9JyP0efGpAaJ/nLp723BbjM6pkFPcAnQbgMKY=";
-        rev = "f99e015ac35f689cfdbf46e4eb174e5d2da78d8e";
+        hash = "sha256-JvilCnnb4laqwq69fay+IdAujYC1EHD7uWpkF/C8tBw=";
+        rev = "d4f94f9a6c25497b2ce0356bb99a8d202c8c1d32";
        url = "https://gn.googlesource.com/gn";
-        version = "2024-01-22";
+        version = "2024-02-19";
      };
    };
-    hash = "sha256-BzLSwDQrmKavh4s2uOSfP935NnB5+Hw7oD7YDbSWp2g=";
-    hash_deb_amd64 = "sha256-SxdYfWhV3ZpiGWmagOM6JUfjAmU9pzFGDQDinXrweas=";
-    version = "122.0.6261.128";
+    hash = "sha256-GrCYCUjxV16tinqrIqW4DQD51dKIgKNu2fLLz9Yqq7k=";
+    hash_deb_amd64 = "sha256-z+UC7wUsWAX7kPIgk8S9ujW2n6HlUp0m3zHTvsAiTps=";
+    version = "123.0.6312.58";
  };
  ungoogled-chromium = {
    deps = {
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@ -18,6 +18,7 @@
 , sndio
 , libjack2
 , speechd
+, removeReferencesTo
 }:

 ## configurability of the wrapper itself
@ -238,7 +239,7 @@ let
              };
            }));

-      nativeBuildInputs = [ makeWrapper lndir jq ];
+      nativeBuildInputs = [ makeWrapper lndir jq removeReferencesTo ];
      buildInputs = [ browser.gtk3 ];


@ -413,7 +414,9 @@ let
      passthru = { unwrapped = browser; };

      disallowedRequisites = [ stdenv.cc ];
-
+      postInstall = ''
+        find "$out" -type f -exec remove-references-to -t ${stdenv.cc} '{}' +
+      '';
      meta = browser.meta // {
        inherit (browser.meta) description;
        mainProgram = launcherName;
--- a/pkgs/applications/networking/browsers/mullvad-browser/default.nix
+++ b/pkgs/applications/networking/browsers/mullvad-browser/default.nix
@ -90,7 +90,7 @@ let
      ++ lib.optionals mediaSupport [ ffmpeg ]
  );

-  version = "13.0.10";
+  version = "13.0.12";

  sources = {
    x86_64-linux = fetchurl {
@ -102,7 +102,7 @@ let
        "https://tor.eff.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
        "https://tor.calyxinstitute.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
      ];
-      hash = "sha256-+8b3K3XLSPlndR12KNUH0lsPquhTupxQrLBuSEGac7Y=";
+      hash = "sha256-qqz3tdic2muBQI6JXc0/uxBeenWFYHN43K7qJee9q78=";
    };
  };

--- a/pkgs/applications/networking/browsers/tor-browser/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser/default.nix
@ -101,7 +101,7 @@ lib.warnIf (useHardenedMalloc != null)
      ++ lib.optionals mediaSupport [ ffmpeg ]
  );

-  version = "13.0.11";
+  version = "13.0.12";

  sources = {
    x86_64-linux = fetchurl {
@ -111,7 +111,7 @@ lib.warnIf (useHardenedMalloc != null)
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
        "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
      ];
-      hash = "sha256-a8BAesBp85oaHJrkQYcYufH9cy7OrFrfnljZZrFPlGE=";
+      hash = "sha256-2AzcDYngLr+J+s12tAMdB9SjDzOWPnQY9WL7/3+N0FA=";
    };

    i686-linux = fetchurl {
@ -121,7 +121,7 @@ lib.warnIf (useHardenedMalloc != null)
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
        "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
      ];
-      hash = "sha256-cyZnLcJmXNjBJhBLwBoW09K6dsT6Og+h0ufc4/6zxac=";
+      hash = "sha256-ect++2xZe00Hlikz6eMNMiiHnVoETSvjD0Cf1oBgj9E=";
    };
  };

--- a/pkgs/applications/networking/cluster/argocd/default.nix
+++ b/pkgs/applications/networking/cluster/argocd/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "argocd";
-  version = "2.10.3";
+  version = "2.10.4";

  src = fetchFromGitHub {
    owner = "argoproj";
    repo = "argo-cd";
    rev = "v${version}";
-    hash = "sha256-DaM3vNmZTz4zJTsmtgWwKPhHeUdqe2ZdlXYTppdhiJs=";
+    hash = "sha256-D7vkVvYLImC9dtqPU3Gxe5sQO92qxnx4533ykBm7u7c=";
  };

  proxyVendor = true; # darwin/linux hash mismatch
--- a/pkgs/applications/networking/cluster/tftui/default.nix
+++ b/pkgs/applications/networking/cluster/tftui/default.nix
@ -1,27 +1,33 @@
 { lib
-, buildPythonApplication
-, fetchPypi
+, fetchFromGitHub
 , makeWrapper
-, poetry-core
-, posthog
-, pyperclip
-, requests
-, rich
-, textual
+, python3
 , enableUsageTracking ? false
 }:

-buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
  pname = "tftui";
-  version = "0.12.4";
+  version = "0.12.6";
  pyproject = true;

-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-E4Y0qA7SooMlHh+oSFUl1hfblpirr/Jdb1C2fqU43t0=";
+  src = fetchFromGitHub {
+    owner = "idoavrah";
+    repo = "terraform-tui";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-vK1qKf8+RxwHUpuEQ97PcwGvObNVpd88kAb3DFRoRG0=";
  };

-  propagatedBuildInputs = [
+  pythonRelaxDeps = [
+    "textual"
+  ];
+
+  nativeBuildInputs = with python3.pkgs; [
+    makeWrapper
+    poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
    posthog
    pyperclip
    requests
@ -29,11 +35,6 @@ buildPythonApplication rec {
    textual
  ];

-  nativeBuildInputs = [
-    makeWrapper
-    poetry-core
-  ];
-
  pythonImportsCheck = [
    "tftui"
  ];
@ -46,7 +47,7 @@ buildPythonApplication rec {
  meta = with lib; {
    description = "Textual UI to view and interact with Terraform state";
    homepage = "https://github.com/idoavrah/terraform-tui";
-    changelog = "https://github.com/idoavrah/terraform-tui/releases";
+    changelog = "https://github.com/idoavrah/terraform-tui/releases/tag/v${version}";
    license = licenses.asl20;
    maintainers = with maintainers; teams.bitnomial.members;
    mainProgram = "tftui";
--- a/pkgs/applications/networking/cluster/werf/default.nix
+++ b/pkgs/applications/networking/cluster/werf/default.nix
@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "werf";
-  version = "1.2.296";
+  version = "1.2.297";

  src = fetchFromGitHub {
    owner = "werf";
    repo = "werf";
    rev = "v${version}";
-    hash = "sha256-D0bWva6Y0x9uMdKMONsiGC3SV2ktGPzfMq9BELqgk3E=";
+    hash = "sha256-AFuEpMSsfwjqoiLCiSyXecIe/UA72BEHs+kUaUtZU2U=";
  };

-  vendorHash = "sha256-6q13vMxu0iQgaXS+Z6V0jjSIhxMscw6sLANzK07gAlI=";
+  vendorHash = "sha256-mOHrNXaLnTt0WRVJI8GD48pxLvbSa6oWoxa4YFaIA6Y=";

  proxyVendor = true;

--- a/pkgs/applications/networking/instant-messengers/chatty/default.nix
+++ b/pkgs/applications/networking/instant-messengers/chatty/default.nix
@ -15,6 +15,7 @@
 , gnome-desktop
 , gspell
 , gtk4
+, gst_all_1
 , json-glib
 , libgcrypt
 , libadwaita
@ -29,7 +30,7 @@

 stdenv.mkDerivation rec {
  pname = "chatty";
-  version = "0.8.1";
+  version = "0.8.2";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
@ -37,7 +38,7 @@ stdenv.mkDerivation rec {
    repo = "Chatty";
    rev = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-5IkQnXAKl0duy/B6+z7PXYv5zxakxJCgQhWBw5wioWg=";
+    hash = "sha256-7SdoN9JjGwELOdISJwS1Afcydp/rE2uq/tHO/UrFKNU=";
  };

  nativeBuildInputs = [
@ -58,6 +59,7 @@ stdenv.mkDerivation rec {
    gnome-desktop
    gspell
    gtk4
+    gst_all_1.gstreamer
    json-glib
    libgcrypt
    libadwaita
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "signalbackup-tools";
-  version = "20240318";
+  version = "20240319";

  src = fetchFromGitHub {
    owner = "bepaald";
    repo = pname;
    rev = version;
-    hash = "sha256-KK+KQowI0KKwgZE91xivfmhnHyDMRozfpLsrOLuE+FE=";
+    hash = "sha256-aDf7HId0A4GBiG3AJZLAtVEq54RywV/gx4Sa3c/KLg0=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/protonmail-bridge/default.nix
+++ b/pkgs/applications/networking/protonmail-bridge/default.nix
@ -37,17 +37,14 @@ buildGoModule rec {

  postInstall = ''
    mv $out/bin/Desktop-Bridge $out/bin/protonmail-bridge # The cli is named like that in other distro packages
-    install -Dm444 dist/proton-bridge.desktop -t $out/share/applications
-    install -Dm444 dist/bridge.svg $out/share/icons/hicolor/scalable/apps/protonmail-bridge.svg
  '';

-  meta = with lib; {
-    homepage = "https://github.com/ProtonMail/proton-bridge";
+  meta = {
    changelog = "https://github.com/ProtonMail/proton-bridge/blob/${src.rev}/Changelog.md";
-    downloadPage = "https://github.com/ProtonMail/proton-bridge/releases";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ mrfreezeex ];
    description = "Use your ProtonMail account with your local e-mail client";
+    downloadPage = "https://github.com/ProtonMail/proton-bridge/releases";
+    homepage = "https://github.com/ProtonMail/proton-bridge";
+    license = lib.licenses.gpl3Plus;
    longDescription = ''
      An application that runs on your computer in the background and seamlessly encrypts
      and decrypts your mail as it enters and leaves your computer.
@ -55,5 +52,6 @@ buildGoModule rec {
      To work, use secret-service freedesktop.org API (e.g. Gnome keyring) or pass.
    '';
    mainProgram = "protonmail-bridge";
+    maintainers = with lib.maintainers; [ mrfreezeex daniel-fahey ];
  };
 }
--- a/pkgs/applications/networking/rymdport/default.nix
+++ b/pkgs/applications/networking/rymdport/default.nix
@ -11,16 +11,16 @@

 buildGoModule rec {
  pname = "rymdport";
-  version = "3.5.2";
+  version = "3.5.3";

  src = fetchFromGitHub {
    owner = "Jacalz";
    repo = "rymdport";
    rev = "v${version}";
-    hash = "sha256-LTCr1OFh+1QQhXFNl9SoLPqEY0ERlLlWfSxRKjyyqPk=";
+    hash = "sha256-lCtFm360UeypzYpivlYXxuqZ0BzGzGkkq31dmgjwv4M=";
  };

-  vendorHash = "sha256-twXeLNWy/5wTaFb645mCeI5PzByEGj5aCWl6vO+qRLQ=";
+  vendorHash = "sha256-PXRy12JWYQQMMzh7jrEhquileY2oYFvqt8KZvrfp2o0=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/applications/office/qownnotes/default.nix
+++ b/pkgs/applications/office/qownnotes/default.nix
@ -19,14 +19,14 @@
 let
  pname = "qownnotes";
  appname = "QOwnNotes";
-  version = "24.3.3";
+  version = "24.3.4";
 in
 stdenv.mkDerivation {
  inherit pname version;

  src = fetchurl {
    url = "https://github.com/pbek/QOwnNotes/releases/download/v${version}/qownnotes-${version}.tar.xz";
-    hash = "sha256-1PnGccbEKkFZGE7mxMD8onMkFd/f9qyvERSu+VL3yUE=";
+    hash = "sha256-PQoZKb0kf/tMQBJ5OpL9XqXv7fAftGTVsg3tZYe3j5c=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/biology/astral/default.nix
+++ b/pkgs/applications/science/biology/astral/default.nix
@ -2,49 +2,67 @@
 , stdenvNoCC
 , fetchFromGitHub
 , jdk8
-, makeWrapper
 , jre8
+, strip-nondeterminism
+, makeWrapper
 , zip
 }:
+
 let
  jdk = jdk8;
  jre = jre8;
 in
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "astral";
  version = "5.7.1";

  src = fetchFromGitHub {
    owner = "smirarab";
    repo = "ASTRAL";
-    rev = "v${version}";
-    sha256 = "043w2z6gbrisqirdid022f4b8jps1pp5syi344krv2bis1gjq5sn";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-VhcsX9BxiZ0nISN6Xe4N+kq0iBMCtNhyxDrm9cwXfBA=";
  };

-  nativeBuildInputs = [ jdk makeWrapper jre zip ];
+  patches = [
+    # we can't use stripJavaArchivesHook here, because the build process puts a .jar file into a zip file
+    # this patch calls strip-nondeterminism manually
+    ./make-deterministic.patch
+  ];
+
+  nativeBuildInputs = [
+    jdk
+    zip
+    strip-nondeterminism
+    makeWrapper
+  ];

  buildPhase = ''
+    runHook preBuild
    patchShebangs ./make.sh
    ./make.sh
+    runHook postBuild
  '';

  doCheck = true;

  checkPhase = ''
    runHook preCheck
-    java -jar astral.${version}.jar -i main/test_data/song_primates.424.gene.tre
+    java -jar astral.${finalAttrs.version}.jar -i main/test_data/song_primates.424.gene.tre
    runHook postCheck
  '';

  installPhase = ''
-    mkdir -p $out/share/lib
-    mkdir -p $out/bin
-    mv astral.${version}.jar $out/share/
-    mv lib/*.jar $out/share/lib
-    mv Astral.${version}.zip $out/share/
-    cp -a  main/test_data $out/share/
+    runHook preInstall
+
+    install -Dm644 astral.${finalAttrs.version}.jar -t $out/share
+    install -Dm644 lib/*.jar -t $out/share/lib
+    install -Dm644 Astral.${finalAttrs.version}.zip -t $out/share
+    cp -a main/test_data $out/share
+
    makeWrapper ${jre}/bin/java $out/bin/astral \
-        --add-flags "-jar $out/share/astral.${version}.jar"
+        --add-flags "-jar $out/share/astral.${finalAttrs.version}.jar"
+
+    runHook postInstall
  '';

  meta = with lib; {
@ -53,9 +71,9 @@ stdenvNoCC.mkDerivation rec {
    mainProgram = "astral";
    sourceProvenance = with sourceTypes; [
      fromSource
-      binaryBytecode  # source bundles dependencies as jars
+      binaryBytecode # source bundles dependencies as jars
    ];
    license = licenses.asl20;
-    maintainers = with maintainers; [ bzizou ];
+    maintainers = with maintainers; [ bzizou tomasajt ];
  };
-}
+})
--- a/pkgs/applications/science/biology/astral/make-deterministic.patch
+++ b/pkgs/applications/science/biology/astral/make-deterministic.patch
@ -0,0 +1,21 @@
+diff --git a/make.sh b/make.sh
+index 3ff6529..937b1a2 100644
+--- a/make.sh
+++ b/make.sh
+@@ -17,6 +17,8 @@ jar cvfm ../astral.$version.jar ../manifest.text phylonet/util/BitSet.* phylonet
+ 
+ cd ..
+ 
+strip-nondeterminism --type jar astral.$version.jar
+
+ chmod +x astral.$version.jar
+ sed -e "s/__astral.jar__/astral.$version.jar/g" -e "s/__astral.zip__/Astral.$version.zip/g" README.template.md > README.md
+ sed -e "s/__astral.jar__/astral.$version.jar/g" -e "s/__astral.zip__/Astral.$version.zip/g" astral-tutorial-template.md > astral-tutorial.md
+@@ -32,6 +34,7 @@ ln -s ../astral-tutorial.pdf .
+ cd ..
+ rm -f Astral.$version.zip
+ zip -r Astral.$version.zip Astral 
+strip-nondeterminism --type zip Astral.$version.zip
+ 
+ set +x
+ echo "
--- a/pkgs/applications/science/biology/conglomerate/default.nix
+++ b/pkgs/applications/science/biology/conglomerate/default.nix
@ -32,6 +32,6 @@ stdenv.mkDerivation rec {
    description = "More command-line utilities for working with MINC files";
    maintainers = with maintainers; [ bcdarwin ];
    platforms = platforms.unix;
-    license   = licenses.free;
+    license   = licenses.hpndUc;
  };
 }
--- a/pkgs/applications/science/math/nauty/default.nix
+++ b/pkgs/applications/science/math/nauty/default.nix
@ -4,11 +4,11 @@
 }:
 stdenv.mkDerivation rec {
  pname = "nauty";
-  version = "2.7r4";
+  version = "2.8.8";

  src = fetchurl {
-    url = "https://pallini.di.uniroma1.it/nauty${builtins.replaceStrings ["."] [""] version}.tar.gz";
-    sha256 = "sha256-uBDIWm/imfO0yfJKr5KcrH+VRsLzXCDh3Qrbx0CISKY=";
+    url = "https://pallini.di.uniroma1.it/nauty${builtins.replaceStrings ["."] ["_"] version}.tar.gz";
+    sha256 = "sha256-FZ0hVoEKa7JAQQzWHrZBrdhQiNnxXIiM2qN7hoH5Kc4=";
  };

  outputs = [ "out" "dev" ];
@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
    # I'm not sure if the filename will remain the same for future changelog or
    # if it will track changes to minor releases. Lets see. Better than nothing
    # in any case.
-    changelog = "https://pallini.di.uniroma1.it/changes24-27.txt";
+    changelog = "https://pallini.di.uniroma1.it/changes24-28.txt";
    homepage = "https://pallini.di.uniroma1.it/";
  };
 }
--- a/pkgs/applications/science/math/sage/default.nix
+++ b/pkgs/applications/science/math/sage/default.nix
@ -15,7 +15,7 @@ let
    pkgs = pkgs.python3.pkgs.overrideScope (self: super: {
      # `sagelib`, i.e. all of sage except some wrappers and runtime dependencies
      sagelib = self.callPackage ./sagelib.nix {
-        inherit flint arb;
+        inherit flint3;
        inherit sage-src env-locations singular;
        inherit (maxima) lisp-compiler;
        linbox = pkgs.linbox.override { withSage = true; };
@ -73,7 +73,7 @@ let
    sagelib = python3.pkgs.sagelib;
    sage-docbuild = python3.pkgs.sage-docbuild;
    inherit env-locations;
-    inherit python3 singular palp flint pythonEnv maxima;
+    inherit python3 singular palp flint3 pythonEnv maxima;
    pkg-config = pkgs.pkg-config; # not to confuse with pythonPackages.pkg-config
  };

@ -125,9 +125,7 @@ let
    ignoreCollisions = true;
  } // { extraLibs = pythonRuntimeDeps; }; # make the libs accessible

-  arb = pkgs.arb.override { inherit flint; };
-
-  singular = pkgs.singular.override { inherit flint; };
+  singular = pkgs.singular.override { inherit flint3; };

  maxima = pkgs.maxima-ecl.override {
    lisp-compiler = pkgs.ecl.override {
@ -149,7 +147,7 @@ let
  # openblas instead of openblasCompat. Apparently other packages somehow use flints
  # blas when it is available. Alternative would be to override flint to use
  # openblasCompat.
-  flint = pkgs.flint.override { withBlas = false; };
+  flint3 = pkgs.flint3.override { withBlas = false; };

  # Multiple palp dimensions need to be available and sage expects them all to be
  # in the same folder.
--- a/pkgs/applications/science/math/sage/env-locations.nix
+++ b/pkgs/applications/science/math/sage/env-locations.nix
@ -3,7 +3,6 @@
 , pari
 , singular
 , maxima
-, conway_polynomials
 , graphs
 , elliptic_curves
 , polytopes_db
@ -27,16 +26,13 @@ writeTextFile rec {
    export GPDOCDIR="${pari}/share/pari/doc"
    export SINGULARPATH='${singular}/share/singular'
    export SINGULAR_SO='${singular}/lib/libSingular.so'
-    export GAP_SO='${gap}/lib/libgap.so'
    export SINGULAR_EXECUTABLE='${singular}/bin/Singular'
    export MAXIMA_FAS='${maxima}/lib/maxima/${maxima.version}/binary-ecl/maxima.fas'
    export MAXIMA_PREFIX="${maxima}"
-    export CONWAY_POLYNOMIALS_DATA_DIR='${conway_polynomials}/share/conway_polynomials'
    export GRAPHS_DATA_DIR='${graphs}/share/graphs'
    export ELLCURVE_DATA_DIR='${elliptic_curves}/share/ellcurves'
    export POLYTOPE_DATA_DIR='${polytopes_db}/share/reflexive_polytopes'
-    export GAP_LIB_DIR='${gap}/lib/gap'
-    export GAP_SHARE_DIR='${gap}/share/gap'
+    export GAP_ROOT_PATHS='${gap}/lib/gap;${gap}/share/gap'
    export ECLDIR='${maxima.lisp-compiler}/lib/${maxima.lisp-compiler.pname}-${maxima.lisp-compiler.version}/'
    export COMBINATORIAL_DESIGN_DATA_DIR="${combinatorial_designs}/share/combinatorial_designs"
    export CREMONA_MINI_DATA_DIR="${elliptic_curves}/share/cremona"
--- a/pkgs/applications/science/math/sage/python-modules/sage-docbuild.nix
+++ b/pkgs/applications/science/math/sage/python-modules/sage-docbuild.nix
@ -4,6 +4,7 @@
 , jupyter-sphinx
 , sphinx
 , sphinx-copybutton
+, sphinx-inline-tabs
 }:

 buildPythonPackage rec {
@ -15,6 +16,7 @@ buildPythonPackage rec {
    jupyter-sphinx
    sphinx
    sphinx-copybutton
+    sphinx-inline-tabs
  ];

  preBuild = ''
--- a/pkgs/applications/science/math/sage/sage-env.nix
+++ b/pkgs/applications/science/math/sage/sage-env.nix
@ -42,7 +42,7 @@
 , flintqs
 , blas
 , lapack
-, flint
+, flint3
 , gmp
 , mpfr
 , zlib
@ -155,7 +155,7 @@ writeTextFile rec {
    # cython needs to find these libraries, otherwise will fail with `ld: cannot find -lflint` or similar
    export LDFLAGS='${
      lib.concatStringsSep " " (map (pkg: "-L${pkg}/lib") [
-        flint
+        flint3
        gap
        glpk
        gmp
@ -174,7 +174,7 @@ writeTextFile rec {
        singular
        gmp.dev
        glpk
-        flint
+        flint3
        gap
        mpfr.dev
      ])
--- a/pkgs/applications/science/math/sage/sage-src.nix
+++ b/pkgs/applications/science/math/sage/sage-src.nix
@ -10,14 +10,14 @@
 # all get the same sources with the same patches applied.

 stdenv.mkDerivation rec {
-  version = "10.2";
+  version = "10.3";
  pname = "sage-src";

  src = fetchFromGitHub {
    owner = "sagemath";
    repo = "sage";
    rev = version;
-    sha256 = "sha256-VXnPdJhtw5Y/anecrVpevJDCyBVfnjksyuuZslNipm4=";
+    hash = "sha256-OHtMv8t0RrP6R8XIREU+C1vpazeQLWa75wx9Mv6BN1U=";
  };

  # contains essential files (e.g., setup.cfg) generated by the bootstrap script.
@ -25,8 +25,8 @@ stdenv.mkDerivation rec {
  configure-src = fetchurl {
    # the hash below is the tagged commit's _parent_. it can also be found by looking for
    # the "configure" asset at https://github.com/sagemath/sage/releases/tag/${version}
-    url = "mirror://sageupstream/configure/configure-b2813506039143e6f0abe859ab67a343abf72c2e.tar.gz";
-    sha256 = "sha256-a1v0XyoKI+zO6Sjm8DzEwItRHbIgRDbpj4UfwVH+/hw=";
+    url = "mirror://sageupstream/configure/configure-ab1a517b64b02bf15bbcb8d7c2d4d643bd5eff9b.tar.gz";
+    hash = "sha256-pe9AxTM+gFSR4/eVfUzay+4bwjoubbYeDPc+avKjlaw=";
  };

  # Patches needed because of particularities of nix or the way this is packaged.
@ -62,11 +62,11 @@ stdenv.mkDerivation rec {
  # should come from or be proposed to upstream. This list will probably never
  # be empty since dependencies update all the time.
  packageUpgradePatches = [
-    # https://github.com/sagemath/sage/pull/37123, to land in 10.3.beta7
+    # https://github.com/sagemath/sage/pull/37492
    (fetchpatch {
-      name = "scipy-1.12-upgrade.patch";
-      url = "https://github.com/sagemath/sage/commit/54eec464e9fdf18b411d9148aecb918178e95909.diff";
-      sha256 = "sha256-9wyNrcSfF6mYFTIV4ev2OdD7igb0AeyZZYWSc/+JrIU=";
+      name = "singular-4.3.2p14-upgrade.patch";
+      url = "https://github.com/sagemath/sage/commit/a0c56816b051e97da44ac0a4e4d4f6915cf7fa0f.diff";
+      sha256 = "sha256-WGMmPeBoj2LUC+2qxWuaJL89QUuGt6axGvxWkpM9LYg=";
    })
  ];

--- a/pkgs/applications/science/math/sage/sagelib.nix
+++ b/pkgs/applications/science/math/sage/sagelib.nix
@ -10,7 +10,6 @@
 , iml
 , libpng
 , readline
-, arb
 , blas
 , boost
 , brial
@ -18,7 +17,7 @@
 , eclib
 , ecm
 , fflas-ffpack
-, flint
+, flint3
 , gap
 , giac
 , givaro
@ -45,6 +44,7 @@
 , singular
 , sqlite
 , symmetrica
+, conway-polynomials
 , cvxopt
 , cypari2
 , cysignals
@ -92,6 +92,7 @@ buildPythonPackage rec {
  version = src.version;
  pname = "sagelib";
  src = sage-src;
+  pyproject = true;

  nativeBuildInputs = [
    iml
@ -112,7 +113,6 @@ buildPythonPackage rec {

  propagatedBuildInputs = [
    # native dependencies (TODO: determine which ones need to be propagated)
-    arb
    blas
    boost
    brial
@ -120,7 +120,7 @@ buildPythonPackage rec {
    eclib
    ecm
    fflas-ffpack
-    flint
+    flint3
    gap
    giac
    givaro
@ -149,6 +149,7 @@ buildPythonPackage rec {
    symmetrica

    # from src/sage/setup.cfg and requirements.txt
+    conway-polynomials
    cvxopt
    cypari2
    cysignals
@ -202,11 +203,7 @@ buildPythonPackage rec {
    mkdir -p "$SAGE_SHARE/sage/ext/notebook-ipython"
    mkdir -p "var/lib/sage/installed"

-    # version lower bounds are useful, but upper bounds are a hassle because
-    # Sage tests already catch any relevant API breakage.
-    # according to the discussion at https://trac.sagemath.org/ticket/33520,
-    # upper bounds will be less noisy starting from Sage 9.6.
-    sed -i 's/, <[^, ]*//' build/pkgs/*/install-requires.txt
+    sed -i "/sage-conf/d" src/{setup.cfg,pyproject.toml,requirements.txt}

    cd build/pkgs/sagelib/src
  '';
--- a/pkgs/applications/science/math/singular/default.nix
+++ b/pkgs/applications/science/math/singular/default.nix
@ -5,7 +5,7 @@
 , sharutils
 , file
 , getconf
-, flint
+, flint3
 , ntl
 , cddlib
 , gfan
@ -18,13 +18,13 @@
 # want it to match the upstream format because sage depends on it.
 , texinfo4
 , texliveSmall
-, enableDocs ? !stdenv.isDarwin
+, enableDocs ? true
 , enableGfanlib ? true
 }:

 stdenv.mkDerivation rec {
  pname = "singular";
-  version = "4.3.2p2";
+  version = "4.3.2p16";

  # since the tarball does not contain tests, we fetch from GitHub.
  src = fetchFromGitHub {
@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
    # if a release is tagged (which sometimes does not happen), it will
    # be in the format below.
    rev = "Release-${lib.replaceStrings ["."] ["-"] version}";
-    sha256 = "sha256-dtZmN8xUCZ9eSgmtBxqfJeWsM4W5Baq7xWXuNAxNLjA=";
+    sha256 = "sha256-5JZgI5lnfX4JlBSEAL7Wv6uao/57GBaMqwgslJt9Bjk=";

    # the repository's .gitattributes file contains the lines "/Tst/
    # export-ignore" and "/doc/ export-ignore" so some directories are
@ -68,7 +68,7 @@ stdenv.mkDerivation rec {
    ncurses
    readline
    ntl
-    flint
+    flint3
    lrcalc
    gfan
  ] ++ lib.optionals enableGfanlib [
--- a/pkgs/applications/version-management/commitizen/default.nix
+++ b/pkgs/applications/version-management/commitizen/default.nix
@ -11,7 +11,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "commitizen";
-  version = "3.18.4";
+  version = "3.20.0";
  format = "pyproject";

  disabled = python3.pythonOlder "3.8";
@ -20,7 +20,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "commitizen-tools";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-ODBlNwrvkYnZ+CvKyc5Bic6DK/z8d6/KR3+iarFxduE=";
+    hash = "sha256-lruEkXgbND2Q49J9mnDSqDA4kWiUBIg1mI+s1a+V3ds=";
  };

  pythonRelaxDeps = [
--- a/pkgs/applications/video/kodi/addons/inputstream-adaptive/default.nix
+++ b/pkgs/applications/video/kodi/addons/inputstream-adaptive/default.nix
@ -10,13 +10,13 @@ in
 buildKodiBinaryAddon rec {
  pname = "inputstream-adaptive";
  namespace = "inputstream.adaptive";
-  version = "20.3.16";
+  version = "20.3.18";

  src = fetchFromGitHub {
    owner = "xbmc";
    repo = "inputstream.adaptive";
    rev = "${version}-${rel}";
-    sha256 = "sha256-1OY+3pvpVW8rkj7HL84IECyHpAmWsUQ9mTzuGesH+jI=";
+    sha256 = "sha256-cjlUKrus4Dv48dCk6AlOgY2iZYTwT39tj2u7aq1P104=";
  };

  extraCMakeFlags = [
--- a/pkgs/applications/video/kodi/addons/jellycon/default.nix
+++ b/pkgs/applications/video/kodi/addons/jellycon/default.nix
@ -0,0 +1,55 @@
+{ lib, addonDir, buildKodiAddon, fetchFromGitHub, kodi, requests, dateutil, six, kodi-six, signals, websocket }:
+let
+  python = kodi.pythonPackages.python.withPackages (p: with p; [ pyyaml ]);
+in
+buildKodiAddon rec {
+  pname = "jellycon";
+  namespace = "plugin.video.jellycon";
+  version = "0.8.0";
+
+  src = fetchFromGitHub {
+    owner = "jellyfin";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-60my7Y60KV5WWALQiamnmAJZJi82cV21rIGYPiV7T+A=";
+  };
+
+  nativeBuildInputs = [
+    python
+  ];
+
+  prePatch = ''
+    # ZIP does not support timestamps before 1980 - https://bugs.python.org/issue34097
+    substituteInPlace build.py \
+      --replace "with zipfile.ZipFile(f'{target}/{archive_name}', 'w') as z:" "with zipfile.ZipFile(f'{target}/{archive_name}', 'w', strict_timestamps=False) as z:"
+  '';
+
+  buildPhase = ''
+    ${python}/bin/python3 build.py --version=py3
+  '';
+
+  postInstall = ''
+    mv /build/source/addon.xml $out${addonDir}/${namespace}/
+  '';
+
+  propagatedBuildInputs = [
+    requests
+    dateutil
+    six
+    kodi-six
+    signals
+    websocket
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/jellyfin/jellycon";
+    description = "A lightweight Kodi add-on for Jellyfin";
+    longDescription = ''
+      JellyCon is a lightweight Kodi add-on that lets you browse and play media
+      files directly from your Jellyfin server within the Kodi interface. It can
+      easily switch between multiple user accounts at will.
+    '';
+    license = licenses.gpl2Only;
+    maintainers = teams.kodi.members;
+  };
+}
--- a/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
@ -23,13 +23,13 @@

 stdenv.mkDerivation rec {
  pname = "advanced-scene-switcher";
-  version = "1.24.2";
+  version = "1.25.3";

  src = fetchFromGitHub {
    owner = "WarmUpTill";
    repo = "SceneSwitcher";
    rev = version;
-    hash = "sha256-J5Qcs2eoKMeO1O/MCsR5wfmfbtndRaZmHrbleEZqqOo=";
+    hash = "sha256-cVMeFAliP0srvnhJQkOhZB2hrald8RHFhBXwdGIu2uo=";
  };

  nativeBuildInputs = [
@ -61,11 +61,7 @@ stdenv.mkDerivation rec {
    chmod -R +w $sourceRoot/deps/libremidi
  '';

-  postInstall = ''
-    mkdir $out/lib $out/share
-    mv $out/obs-plugins/64bit $out/lib/obs-plugins
-    mv $out/data $out/share/obs
-  '';
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=stringop-overflow";

  meta = with lib; {
    description = "An automated scene switcher for OBS Studio";
--- a/pkgs/applications/video/vdr/markad/default.nix
+++ b/pkgs/applications/video/vdr/markad/default.nix
@ -19,12 +19,12 @@
 }:
 stdenv.mkDerivation rec {
  pname = "vdr-markad";
-  version = "3.4.12";
+  version = "3.4.13";

  src = fetchFromGitHub {
    repo = "vdr-plugin-markad";
    owner = "kfb77";
-    sha256 = "sha256-yc/zWMGzsfZl3n+Qt5Se2duo3jwntCWaYq1yACsrPzM=";
+    sha256 = "sha256-pDnziIWX6deBXuVIN7w6F6TdYDCcEO6MSaUIMB63uAg=";
    rev = "V${version}";
  };

--- a/pkgs/applications/virtualization/rvvm/default.nix
+++ b/pkgs/applications/virtualization/rvvm/default.nix
@ -1,21 +1,45 @@
-{ lib, stdenv, fetchFromGitHub, SDL_compat, libX11, libXext }:
+{ lib
+, stdenv
+, fetchFromGitHub
+
+, SDL2
+
+, libX11
+, libXext
+
+, guiBackend ? "sdl"
+
+, enableSDL ? guiBackend == "sdl"
+, enableX11 ? guiBackend == "x11"
+}:
+
+assert lib.assertMsg (builtins.elem guiBackend ["sdl" "x11" "none"]) "Unsupported GUI backend";
+assert lib.assertMsg (!(enableSDL && enableX11)) "RVVM can have only one GUI backend at a time";
+assert lib.assertMsg (stdenv.isDarwin -> !enableX11) "macOS supports only SDL GUI backend";

 stdenv.mkDerivation rec {
  pname = "rvvm";
-  version = "0.5";
+  version = "0.6";

  src = fetchFromGitHub {
    owner = "LekKit";
    repo = "RVVM";
    rev = "v${version}";
-    sha256 = "sha256-1wAKijRYB0FGBe4cSHUynkO4ePVG4QvVIgSoWzNbqtE=";
+    sha256 = "sha256-5nSlKyWDAx0EeKFzzwP5+99XuJz9BHXEF1WNkRMLa9U=";
  };

-  buildInputs = if stdenv.isDarwin then [ SDL_compat ] else [ libX11 libXext ];
+  buildInputs = []
+    ++ lib.optionals enableSDL [ SDL2 ]
+    ++ lib.optionals enableX11 [ libX11 libXext ];
+
+  enableParallelBuilding = true;

  buildFlags = [ "all" "lib" ];

  makeFlags = [ "PREFIX=$(out)" ]
+    ++ lib.optional enableSDL "USE_SDL=2" # Use SDL2 instead of SDL1
+    ++ lib.optional (!enableSDL && !enableX11) "USE_FB=0"
+
    # work around https://github.com/NixOS/nixpkgs/issues/19098
    ++ lib.optional (stdenv.cc.isClang && stdenv.isDarwin) "CFLAGS=-fno-lto";

@ -24,7 +48,7 @@ stdenv.mkDerivation rec {
    description = "The RISC-V Virtual Machine";
    license = with licenses; [ gpl3 /* or */ mpl20 ];
    platforms = platforms.linux ++ platforms.darwin;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ kamillaova ];
    mainProgram = "rvvm";
  };
 }
--- a/pkgs/by-name/al/alephone-apotheosis-x/package.nix
+++ b/pkgs/by-name/al/alephone-apotheosis-x/package.nix
@ -1,4 +1,4 @@
-{ alephone, requireFile }:
+{ lib, alephone, requireFile }:

 alephone.makeWrapper rec {
  pname = "apotheosis-x";
@ -16,5 +16,6 @@ alephone.makeWrapper rec {
  meta = {
    description = "Total conversion for Marathon Infinity running on the Aleph One engine";
    homepage = "https://simplici7y.com/items/apotheosis-x-5";
+    license = lib.licenses.unfree;
  };
 }
--- a/pkgs/by-name/al/alt-tab-macos/package.nix
+++ b/pkgs/by-name/al/alt-tab-macos/package.nix
@ -6,11 +6,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "alt-tab-macos";
-  version = "6.61.0";
+  version = "6.66.0";

  src = fetchurl {
    url = "https://github.com/lwouis/alt-tab-macos/releases/download/v${finalAttrs.version}/AltTab-${finalAttrs.version}.zip";
-    hash = "sha256-crmeYVeSmu5avNSd3dCbEeGnuqonh1HC5NnEOz8OB2U=";
+    hash = "sha256-mQ4tS9htL+X4lXqSe3L+mnwgVnHb3Zxyz6dgzmYHY9w=";
  };

  sourceRoot = ".";
--- a/pkgs/by-name/as/asciiquarium-transparent/package.nix
+++ b/pkgs/by-name/as/asciiquarium-transparent/package.nix
@ -3,32 +3,35 @@
  stdenv,
  fetchFromGitHub,
  makeWrapper,
-  perlPackages,
+  perl,
 }:
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
  pname = "asciiquarium-transparent";
-  version = "unstable-2023-02-19";
+  version = "1.3";
+
  src = fetchFromGitHub {
    owner = "nothub";
    repo = "asciiquarium";
-    rev = "653cd99a611080c776d18fc7991ae5dd924c72ce";
-    hash = "sha256-72LRFydbObFDXJllmlRjr5O8qjDqtlp3JunE3kwb5aU=";
+    rev = "${finalAttrs.version}";
+    hash = "sha256-zQyVIfwmhF3WsCeIZLwjDufvKzAfjLxaK2s7WTedqCg=";
  };
-  nativeBuildInputs = [makeWrapper];
-  buildInputs = [perlPackages.perl];
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl ];
  installPhase = ''
    runHook preInstall
-    mkdir -p $out/bin
-    cp asciiquarium $out/bin/asciiquarium
-    wrapProgram $out/bin/asciiquarium --set PERL5LIB ${perlPackages.makeFullPerlPath [perlPackages.TermAnimation]}
+    install -Dm555 asciiquarium -t $out/bin
+    wrapProgram $out/bin/asciiquarium \
+      --set PERL5LIB ${with perl.pkgs; makeFullPerlPath [ TermAnimation ]}
    runHook postInstall
  '';
-  meta = with lib; {
+
+  meta = {
    description = "An aquarium/sea animation in ASCII art (with option of transparent background)";
-    mainProgram = "asciiquarium";
    homepage = "https://github.com/nothub/asciiquarium";
-    license = with licenses; [gpl2Only];
-    platforms = platforms.unix;
-    maintainers = with maintainers; [quantenzitrone];
+    license = lib.licenses.gpl2Only;
+    mainProgram = "asciiquarium";
+    maintainers = with lib.maintainers; [ quantenzitrone ];
+    platforms = perl.meta.platforms;
  };
-}
+})
--- a/pkgs/by-name/ca/cargo-pgo/package.nix
+++ b/pkgs/by-name/ca/cargo-pgo/package.nix
@ -0,0 +1,29 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cargo-pgo";
+  version = "0.2.6";
+
+  src = fetchFromGitHub {
+    owner = "kobzol";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-u3kWYPLJYarwwudRpeBdJglP9kNbLRTYgEvZT2pBBoY=";
+  };
+
+  cargoHash = "sha256-Peicupa2vFDzPCH0OQYk7plkWIn82o45oGutOyMlI2s=";
+
+  # Integration tests do not run in Nix build environment due to needing to
+  # create and build Cargo workspaces.
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Cargo subcommand for optimizing Rust binaries/libraries with PGO and BOLT";
+    homepage = "https://github.com/kobzol/cargo-pgo";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ dannixon ];
+  };
+}
--- a/pkgs/by-name/ce/cert-viewer/package.nix
+++ b/pkgs/by-name/ce/cert-viewer/package.nix
@ -0,0 +1,26 @@
+{ buildGoModule
+, fetchFromGitHub
+, lib
+}:
+
+buildGoModule rec {
+  pname = "cert-viewer";
+  version = "0.9.0";
+
+  src = fetchFromGitHub {
+    owner = "mgit-at";
+    repo = "cert-viewer";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-q4FLKH0ZA/79zLo7dt+CSOjfKyygTiQKSuungQTtue0=";
+  };
+
+  vendorHash = "sha256-55zDUAe5s+03/OnDcK1DqmMUpFO2sBaVjEk6vbrHgzY=";
+
+  meta = {
+    description = "Admin tool to view and inspect multiple x509 Certificates";
+    homepage = "https://github.com/mgit-at/cert-viewer";
+    license = lib.licenses.apsl20;
+    maintainers = [ lib.maintainers.mkg20001 ];
+    mainProgram = "cert-viewer";
+  };
+}
--- a/pkgs/by-name/co/cosmic-edit/Cargo.lock
+++ b/pkgs/by-name/co/cosmic-edit/Cargo.lock
--- a/pkgs/by-name/co/cosmic-edit/package.nix
+++ b/pkgs/by-name/co/cosmic-edit/package.nix
@ -6,8 +6,6 @@
  cmake,
  makeBinaryWrapper,
  cosmic-icons,
-  glib,
-  gtk3,
  just,
  pkg-config,
  libglvnd,
@ -23,33 +21,38 @@

 rustPlatform.buildRustPackage rec {
  pname = "cosmic-edit";
-  version = "0-unstable-2024-01-19";
+  version = "unstable-2024-02-28";

  src = fetchFromGitHub {
    owner = "pop-os";
    repo = pname;
-    rev = "b97eb0603bf6c7e168fc6e17aa779af1f105b9ee";
-    hash = "sha256-oprqM3QTewC/L/KOQ4uT81dPLqjP+Kp+wxgkY8l1Nc8=";
+    rev = "536a66eff9c032afd76b60be6a9067a14ed38ab1";
+    hash = "sha256-UsZBxeamw8VuHtHrVtTwHhPPG+SMBrGY5taw+da/Ll0=";
  };

  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "accesskit-0.11.0" = "sha256-xVhe6adUb8VmwIKKjHxwCwOo5Y1p3Or3ylcJJdLDrrE=";
+      "accesskit-0.12.2" = "sha256-ksaYMGT/oug7isQY8/1WD97XDUsX2ShBdabUzxWffYw=";
      "atomicwrites-0.4.2" = "sha256-QZSuGPrJXh+svMeFWqAXoqZQxLq/WfIiamqvjJNVhxA=";
-      "cosmic-config-0.1.0" = "sha256-PR6u2DT+HneMSFszfg0sZK7oLwsOX4YtpUP88KWHy68=";
-      "cosmic-syntax-theme-0.1.0" = "sha256-9Vf2s5Ry2hco80EbXOuVLwvOWygRiuaRD4tTImWooSg=";
-      "cosmic-text-0.10.0" = "sha256-WxT0LPXu17jb0XpuCu2PjlGTV1a0K1HMhl6WpciKMkM=";
-      "glyphon-0.4.1" = "sha256-mwJXi63LTBIVFrFcywr/NeOJKfMjQaQkNl3CSdEgrZc=";
-      "sctk-adwaita-0.5.4" = "sha256-yK0F2w/0nxyKrSiHZbx7+aPNY2vlFs7s8nu/COp2KqQ=";
-      "softbuffer-0.3.3" = "sha256-eKYFVr6C1+X6ulidHIu9SP591rJxStxwL9uMiqnXx4k=";
-      "smithay-client-toolkit-0.16.1" = "sha256-z7EZThbh7YmKzAACv181zaEZmWxTrMkFRzP0nfsHK6c=";
+      "cosmic-config-0.1.0" = "sha256-Zyi95zcBAohM1WBropLzJczSIfNNNBK2odB4AmW4h5I=";
+      "cosmic-files-0.1.0" = "sha256-64An0MPgnFgyVlWmtBGBs+IV2z+4vmEY2uRPetZM4/M=";
+      "cosmic-syntax-theme-0.1.0" = "sha256-BNb9wrryD5FJImboD3TTdPRIfiBqPpItqwGdT1ZiNng=";
+      "cosmic-text-0.11.2" = "sha256-Y9i5stMYpx+iqn4y5DJm1O1+3UIGp0/fSsnNq3Zloug=";
+      "d3d12-0.19.0" = "sha256-usrxQXWLGJDjmIdw1LBXtBvX+CchZDvE8fHC0LjvhD4=";
+      "glyphon-0.5.0" = "sha256-j1HrbEpUBqazWqNfJhpyjWuxYAxkvbXzRKeSouUoPWg=";
+      "softbuffer-0.4.1" = "sha256-a0bUFz6O8CWRweNt/OxTvflnPYwO5nm6vsyc/WcXyNg=";
      "systemicons-0.7.0" = "sha256-zzAI+6mnpQOh+3mX7/sJ+w4a7uX27RduQ99PNxLNF78=";
      "taffy-0.3.11" = "sha256-SCx9GEIJjWdoNVyq+RZAGn0N71qraKZxf9ZWhvyzLaI=";
-      "winit-0.28.6" = "sha256-FhW6d2XnXCGJUMoT9EMQew9/OPXiehy/JraeCiVd76M=";
+      "winit-0.29.10" = "sha256-ScTII2AzK3SC8MVeASZ9jhVWsEaGrSQ2BnApTxgfxK4=";
    };
  };

+  # COSMIC applications now uses vergen for the About page
+  # Update the COMMIT_DATE to match when the commit was made
+  env.VERGEN_GIT_COMMIT_DATE = "2024-02-28";
+  env.VERGEN_GIT_SHA = src.rev;
+
  postPatch = ''
    substituteInPlace justfile --replace '#!/usr/bin/env' "#!$(command -v env)"
  '';
@ -57,13 +60,12 @@ rustPlatform.buildRustPackage rec {
  nativeBuildInputs = [ just pkg-config makeBinaryWrapper ];
  buildInputs = [
    libxkbcommon
-    glib
-    gtk3
    xorg.libX11
    libinput
    libglvnd
    fontconfig
    freetype
+    mesa
    wayland
    vulkan-loader
  ];
@ -94,7 +96,7 @@ rustPlatform.buildRustPackage rec {
    wrapProgram "$out/bin/${pname}" \
      --suffix XDG_DATA_DIRS : "${cosmic-icons}/share" \
      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [
-        xorg.libX11 xorg.libXcursor xorg.libXi xorg.libXrandr vulkan-loader mesa.drivers
+        xorg.libX11 xorg.libXcursor xorg.libXi xorg.libXrandr vulkan-loader libxkbcommon mesa.drivers wayland
      ]}
  '';

--- a/pkgs/by-name/co/cosmic-settings/Cargo.lock
+++ b/pkgs/by-name/co/cosmic-settings/Cargo.lock
--- a/pkgs/by-name/co/cosmic-settings/package.nix
+++ b/pkgs/by-name/co/cosmic-settings/package.nix
@ -5,6 +5,7 @@
 , cmake
 , makeBinaryWrapper
 , cosmic-icons
+, cosmic-randr
 , just
 , pkg-config
 , libxkbcommon
@ -14,34 +15,38 @@
 , wayland
 , expat
 , udev
+, util-linux
 }:

 rustPlatform.buildRustPackage rec {
  pname = "cosmic-settings";
-  version = "unstable-2024-01-09";
+  version = "0-unstable-2024-02-15";

  src = fetchFromGitHub {
    owner = "pop-os";
    repo = pname;
-    rev = "f2148eed9a56ef1b5ba73db73e15486e188e01b7";
-    hash = "sha256-JUiUC/RNR1cqJouUEneHZotkN2M18vJhv+ATvGFrQxU=";
+    rev = "82ee8a693cb2e1f727aa600f62a24d5de5d685d6";
+    hash = "sha256-OGei48Eu0kBXlWwGQaRZULAOnKyrDjCXV8OuWdOmv8E=";
  };

  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "accesskit-0.11.0" = "sha256-xVhe6adUb8VmwIKKjHxwCwOo5Y1p3Or3ylcJJdLDrrE=";
+      "accesskit-0.12.2" = "sha256-ksaYMGT/oug7isQY8/1WD97XDUsX2ShBdabUzxWffYw=";
      "atomicwrites-0.4.2" = "sha256-QZSuGPrJXh+svMeFWqAXoqZQxLq/WfIiamqvjJNVhxA=";
-      "cosmic-bg-config-0.1.0" = "sha256-fdRFndhwISmbTqmXfekFqh+Wrtdjg3vSZut4IAQUBbA=";
-      "cosmic-comp-config-0.1.0" = "sha256-xN5VbxRO50BPU0VP1rSOkq3TS2WTiCGavJS8o05Jw50=";
-      "cosmic-config-0.1.0" = "sha256-/oAG5xu0Lnsw/CIGXrvoC3pKkj5aS0qubWIPozQDSsY=";
-      "cosmic-client-toolkit-0.1.0" = "sha256-AEgvF7i/OWPdEMi8WUaAg99igBwE/AexhAXHxyeJMdc=";
-      "cosmic-panel-config-0.1.0" = "sha256-SDqNLuj219FMqlO2devw/DD04RJfSBJLDLH/4ObRCl8=";
-      "glyphon-0.3.0" = "sha256-Uw1zbHVAjB3pUfUd8GnFUnske3Gxs+RktrbaFJfK430=";
-      "smithay-client-toolkit-0.18.0" = "sha256-9NwNrEC+csTVtmXrNQFvOgohTGUO2VCvqOME7SnDCOg=";
-      "softbuffer-0.3.3" = "sha256-eKYFVr6C1+X6ulidHIu9SP591rJxStxwL9uMiqnXx4k=";
+      "cosmic-bg-config-0.1.0" = "sha256-2P2NcgDmytvBCMbG8isfZrX+JirMwAz8qjW3BhfhebI=";
+      "cosmic-comp-config-0.1.0" = "sha256-btXMVpgf6CKSXuUeNydreibgrRvBwiljYucaoch6RKs=";
+      "cosmic-config-0.1.0" = "sha256-QDcU9kVRHJmr8yuHq5C0RahQz0xBMkmDboW9Y2Tsk5s=";
+      "cosmic-client-toolkit-0.1.0" = "sha256-vj7Wm1uJ5ULvGNEwKznNhujCZQiuntsWMyKQbIVaO/Q=";
+      "cosmic-panel-config-0.1.0" = "sha256-gPQ5BsLvhnopnnGeKbUizmgk0yhEEgSD0etX9YEWc5E=";
+      "cosmic-randr-shell-0.1.0" = "sha256-t1PM/uIM+lbBwgFsKnRiqPZnlb4dxZnN72MfnW0HU/0=";
+      "cosmic-text-0.11.2" = "sha256-EG0jERREWR4MBWKgFmE/t6SpTTQRXK76PPa7+/TAKOA=";
+      "d3d12-0.19.0" = "sha256-usrxQXWLGJDjmIdw1LBXtBvX+CchZDvE8fHC0LjvhD4=";
+      "glyphon-0.5.0" = "sha256-j1HrbEpUBqazWqNfJhpyjWuxYAxkvbXzRKeSouUoPWg=";
+      "smithay-client-toolkit-0.18.0" = "sha256-2WbDKlSGiyVmi7blNBr2Aih9FfF2dq/bny57hoA4BrE=";
+      "softbuffer-0.4.1" = "sha256-a0bUFz6O8CWRweNt/OxTvflnPYwO5nm6vsyc/WcXyNg=";
      "taffy-0.3.11" = "sha256-SCx9GEIJjWdoNVyq+RZAGn0N71qraKZxf9ZWhvyzLaI=";
-      "xdg-shell-wrapper-config-0.1.0" = "sha256-3Dc2fU8xBVUmAs0Q1zEdcdG7vlxpBO+UIlyM/kzGcC4=";
+      "xdg-shell-wrapper-config-0.1.0" = "sha256-PfuybCDLeRcVCkVxFK2T9BnL2uJz7C4EEPDZ9cWlPqk=";
    };
  };

@ -50,7 +55,7 @@ rustPlatform.buildRustPackage rec {
  '';

  nativeBuildInputs = [ cmake just pkg-config makeBinaryWrapper ];
-  buildInputs = [ libxkbcommon libinput fontconfig freetype wayland expat udev ];
+  buildInputs = [ libxkbcommon libinput fontconfig freetype wayland expat udev util-linux ];

  dontUseJustBuild = true;

@ -65,7 +70,8 @@ rustPlatform.buildRustPackage rec {

  postInstall = ''
    wrapProgram "$out/bin/cosmic-settings" \
-      --suffix XDG_DATA_DIRS : "${cosmic-icons}/share"
+      --prefix PATH : ${lib.makeBinPath [ cosmic-randr ]} \
+      --suffix XDG_DATA_DIRS : "$out/share:${cosmic-icons}/share"
  '';

  meta = with lib; {
--- a/pkgs/by-name/co/cosmic-store/Cargo.lock
+++ b/pkgs/by-name/co/cosmic-store/Cargo.lock
--- a/pkgs/by-name/co/cosmic-store/package.nix
+++ b/pkgs/by-name/co/cosmic-store/package.nix
@ -0,0 +1,99 @@
+{ lib, stdenv, fetchFromGitHub, rustPlatform, appstream, makeBinaryWrapper
+, cosmic-icons, glib, just, pkg-config, libglvnd, libxkbcommon, libinput
+, fontconfig, flatpak, freetype, openssl, mesa, wayland, xorg, vulkan-loader
+, vulkan-validation-layers, }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cosmic-store";
+  version = "unstable-2024-03-13";
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = pname;
+    rev = "df014ea82ae0465470f5d237bfe71d2c085d29a0";
+    hash = "sha256-1Sp6/qVONK+O5FLEcsu45eEBNaVbJLptt+ByXOZYwpo=";
+    fetchSubmodules = true;
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "accesskit-0.12.2" = "sha256-ksaYMGT/oug7isQY8/1WD97XDUsX2ShBdabUzxWffYw=";
+      "appstream-0.2.2" = "sha256-Qb/zzZJ2sM97nGVtp8amecTlwuaDrx1cacDcZOwhUm8=";
+      "atomicwrites-0.4.2" = "sha256-QZSuGPrJXh+svMeFWqAXoqZQxLq/WfIiamqvjJNVhxA=";
+      "cosmic-config-0.1.0" = "sha256-J6c2pRCpyfCFMmzwJ4RdEghSaFDshDtZL6DteAiaq1o=";
+      "cosmic-text-0.11.2" = "sha256-6mvGyMCFC/tSIiDgDX+zuDUi15S9dXI6Dc6pj36hIJM=";
+      "d3d12-0.19.0" = "sha256-usrxQXWLGJDjmIdw1LBXtBvX+CchZDvE8fHC0LjvhD4=";
+      "glyphon-0.5.0" = "sha256-j1HrbEpUBqazWqNfJhpyjWuxYAxkvbXzRKeSouUoPWg=";
+      "softbuffer-0.4.1" = "sha256-a0bUFz6O8CWRweNt/OxTvflnPYwO5nm6vsyc/WcXyNg=";
+      "taffy-0.3.11" = "sha256-SCx9GEIJjWdoNVyq+RZAGn0N71qraKZxf9ZWhvyzLaI=";
+      "winit-0.29.10" = "sha256-ScTII2AzK3SC8MVeASZ9jhVWsEaGrSQ2BnApTxgfxK4=";
+    };
+  };
+
+  postPatch = ''
+    substituteInPlace justfile --replace '#!/usr/bin/env' "#!$(command -v env)"
+  '';
+
+  nativeBuildInputs = [ just pkg-config makeBinaryWrapper ];
+  buildInputs = [
+    appstream
+    glib
+    libxkbcommon
+    libinput
+    libglvnd
+    fontconfig
+    flatpak
+    freetype
+    openssl
+    xorg.libX11
+    wayland
+    vulkan-loader
+    vulkan-validation-layers
+  ];
+
+  dontUseJustBuild = true;
+
+  justFlags = [
+    "--set"
+    "prefix"
+    (placeholder "out")
+    "--set"
+    "bin-src"
+    "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-store"
+  ];
+
+  # Force linking to libEGL, which is always dlopen()ed, and to
+  # libwayland-client, which is always dlopen()ed except by the
+  # obscure winit backend.
+  RUSTFLAGS = map (a: "-C link-arg=${a}") [
+    "-Wl,--push-state,--no-as-needed"
+    "-lEGL"
+    "-lwayland-client"
+    "-Wl,--pop-state"
+  ];
+
+  # LD_LIBRARY_PATH can be removed once tiny-xlib is bumped above 0.2.2
+  postInstall = ''
+    wrapProgram "$out/bin/${pname}" \
+      --suffix XDG_DATA_DIRS : "${cosmic-icons}/share" \
+      --prefix LD_LIBRARY_PATH : ${
+        lib.makeLibraryPath [
+          xorg.libX11
+          xorg.libXcursor
+          xorg.libXi
+          xorg.libXrandr
+          libxkbcommon
+          vulkan-loader
+          mesa.drivers
+        ]
+      }
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/pop-os/cosmic-store";
+    description = "App Store for the COSMIC Desktop Environment";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ ahoneybun nyanbinary ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/by-name/co/cosmic-term/Cargo.lock
+++ b/pkgs/by-name/co/cosmic-term/Cargo.lock
--- a/pkgs/by-name/co/cosmic-term/package.nix
+++ b/pkgs/by-name/co/cosmic-term/package.nix
@ -19,31 +19,37 @@

 rustPlatform.buildRustPackage rec {
  pname = "cosmic-term";
-  version = "0-unstable-2024-01-19";
+  version = "unstable-2024-02-28";
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = pname;
-    rev = "6d519018a070e25db0cd099a2752a7add4d6b138";
-    hash = "sha256-gfvBLrhq6Bz6cQdgiLH5o8vyptOT+q3xwUYoDG6eGTY=";
+    rev = "36477e06dc6d05bd01dc08b3f20e0a6e388d6c7e";
+    hash = "sha256-VkRVfV4sC+5+/8g1FOlBjJCeR/KGb5gP0SWy5bmFo+Y=";
  };

  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "accesskit-0.11.0" = "sha256-xVhe6adUb8VmwIKKjHxwCwOo5Y1p3Or3ylcJJdLDrrE=";
+      "accesskit-0.12.2" = "sha256-ksaYMGT/oug7isQY8/1WD97XDUsX2ShBdabUzxWffYw=";
      "atomicwrites-0.4.2" = "sha256-QZSuGPrJXh+svMeFWqAXoqZQxLq/WfIiamqvjJNVhxA=";
-      "cosmic-config-0.1.0" = "sha256-uo4So9I/jD3LPfigyKwESUdZiK1wqm7rg9wYwyv4uKc=";
-      "cosmic-text-0.10.0" = "sha256-S0GkKUiUsSkL1CZHXhtpQy7Mf5+6fqNuu33RRtxG3mE=";
-      "glyphon-0.4.1" = "sha256-mwJXi63LTBIVFrFcywr/NeOJKfMjQaQkNl3CSdEgrZc=";
+      "cosmic-config-0.1.0" = "sha256-Zyi95zcBAohM1WBropLzJczSIfNNNBK2odB4AmW4h5I=";
+      "cosmic-files-0.1.0" = "sha256-64An0MPgnFgyVlWmtBGBs+IV2z+4vmEY2uRPetZM4/M=";
+      "cosmic-text-0.11.2" = "sha256-Y9i5stMYpx+iqn4y5DJm1O1+3UIGp0/fSsnNq3Zloug=";
+      "d3d12-0.19.0" = "sha256-usrxQXWLGJDjmIdw1LBXtBvX+CchZDvE8fHC0LjvhD4=";
+      "glyphon-0.5.0" = "sha256-j1HrbEpUBqazWqNfJhpyjWuxYAxkvbXzRKeSouUoPWg=";
      "libc-0.2.151" = "sha256-VcNTcLOnVXMlX86yeY0VDfIfKOZyyx/DO1Hbe30BsaI=";
-      "sctk-adwaita-0.5.4" = "sha256-yK0F2w/0nxyKrSiHZbx7+aPNY2vlFs7s8nu/COp2KqQ=";
-      "smithay-client-toolkit-0.16.1" = "sha256-z7EZThbh7YmKzAACv181zaEZmWxTrMkFRzP0nfsHK6c=";
-      "softbuffer-0.3.3" = "sha256-eKYFVr6C1+X6ulidHIu9SP591rJxStxwL9uMiqnXx4k=";
+      "softbuffer-0.4.1" = "sha256-a0bUFz6O8CWRweNt/OxTvflnPYwO5nm6vsyc/WcXyNg=";
+      "systemicons-0.7.0" = "sha256-zzAI+6mnpQOh+3mX7/sJ+w4a7uX27RduQ99PNxLNF78=";
      "taffy-0.3.11" = "sha256-SCx9GEIJjWdoNVyq+RZAGn0N71qraKZxf9ZWhvyzLaI=";
-      "winit-0.28.6" = "sha256-FhW6d2XnXCGJUMoT9EMQew9/OPXiehy/JraeCiVd76M=";
+      "winit-0.29.10" = "sha256-ScTII2AzK3SC8MVeASZ9jhVWsEaGrSQ2BnApTxgfxK4=";
    };
  };

+  # COSMIC applications now uses vergen for the About page
+  # Update the COMMIT_DATE to match when the commit was made
+  env.VERGEN_GIT_COMMIT_DATE = "2024-02-28";
+  env.VERGEN_GIT_SHA = src.rev;
+
  postPatch = ''
    substituteInPlace justfile --replace '#!/usr/bin/env' "#!$(command -v env)"
  '';
--- a/pkgs/applications/graphics/displaycal/default.nix
+++ b/pkgs/applications/graphics/displaycal/default.nix
@ -10,13 +10,13 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "displaycal";
-  version = "3.9.11";
+  version = "3.9.12";
  format = "setuptools";

  src = fetchPypi {
    pname = "DisplayCAL";
    inherit version;
-    hash = "sha256-zAZW2eMjwRYevlz8KEzTxzGO8vx5AydfY3vGTapNo1c=";
+    hash = "sha256-0NZ+fr3ilnyWE6+Xa8xqpccNe7WVvvQfQEYvdQ8rf/Q=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ei/eigenlayer/package.nix
+++ b/pkgs/by-name/ei/eigenlayer/package.nix
@ -6,16 +6,16 @@
 }:
 buildGoModule rec {
  pname = "eigenlayer";
-  version = "0.6.2";
+  version = "0.6.3";

  src = fetchFromGitHub {
    owner = "Layr-Labs";
    repo = "eigenlayer-cli";
    rev = "v${version}";
-    hash = "sha256-cr3ltNmJj8GoQLADivekLU2hV7xWk4KR2Gej0rcaVTA=";
+    hash = "sha256-v2d6+jxEYXgJjZOFRc+teQWq161v4FLO+KjYq96XwTs=";
  };

-  vendorHash = "sha256-VcXjYiJ9nwSCQJvQd7UYduZKJISRfoEXjziiX6Z3w6Q=";
+  vendorHash = "sha256-pJYs9jD3EmmXlkPO6gkuB2FYsgX9Yn6S6QYb2dQ1fY4=";

  ldflags = ["-s" "-w"];
  subPackages = ["cmd/eigenlayer"];
--- a/pkgs/by-name/gh/gh-copilot/package.nix
+++ b/pkgs/by-name/gh/gh-copilot/package.nix
@ -0,0 +1,59 @@
+{ stdenv
+, lib
+, fetchurl
+}:
+let
+  inherit (stdenv.hostPlatform) system;
+  throwSystem = throw "Unsupported system: ${system}";
+
+  systemToPlatform = {
+    "x86_64-linux" = {
+      name = "linux-amd64";
+      hash = "sha256-FKzvERcVYkyy1aNYHZIftC2WvSHRxFqSG/g7gpTTvoo=";
+    };
+    "aarch64-linux" = {
+      name = "linux-arm64";
+      hash = "sha256-4vX9On0upgfjM/IL/UzQj5ioeVnSsd2rUgIz6w4szZM=";
+    };
+    "x86_64-darwin" = {
+      name = "darwin-amd64";
+      hash = "sha256-W4ElKXsMo47dVRNJEnLzH2rpvkua56lj/NkJd3R8CCE=";
+    };
+    "aarch64-darwin" = {
+      name = "darwin-arm64";
+      hash = "sha256-F2OA66h/ptkjLZ2oQgkbZlDo31YDZzhk5Pre36TkHvI=";
+    };
+  };
+  platform = systemToPlatform.${system} or throwSystem;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gh-copilot";
+  version = "0.5.4-beta";
+
+  src = fetchurl {
+    name = "gh-copilot";
+    url = "https://github.com/github/gh-copilot/releases/download/v${finalAttrs.version}/${platform.name}";
+    hash = platform.hash;
+  };
+
+  dontUnpack = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -m755 -D $src $out/bin/gh-copilot
+
+    runHook postInstall
+  '';
+
+  meta = {
+    changelog = "https://github.com/github/gh-copilot/releases/tag/v${finalAttrs.version}";
+    description = "Ask for assistance right in your terminal.";
+    homepage = "https://github.com/github/gh-copilot";
+    license = lib.licenses.unfree;
+    mainProgram = "gh-copilot";
+    maintainers = with lib.maintainers; [ perchun ];
+    platforms = lib.attrNames systemToPlatform;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
--- a/pkgs/tools/networking/godns/default.nix
+++ b/pkgs/tools/networking/godns/default.nix
@ -1,25 +1,50 @@
 { lib
 , buildGoModule
 , fetchFromGitHub
+, nodejs
+, npmHooks
+, fetchNpmDeps
 , nix-update-script
 }:

 buildGoModule rec {
  pname = "godns";
-  version = "3.0.7";
+  version = "3.1.5";

  src = fetchFromGitHub {
    owner = "TimothyYe";
    repo = "godns";
    rev = "refs/tags/v${version}";
-    hash = "sha256-7zgvrEVt8xg54NijcqnXoZcXetzOu9h3Ucw7w03YagU=";
+    hash = "sha256-kdClyeU0hR0ymVLn9xe/kYVJE/9P/hAz/5UwRAQ2KCU=";
  };

-  vendorHash = "sha256-veDrGB6gjUa8G/UyKzEgH2ItGGEPlXDePahq2XP2nAo=";
+  vendorHash = "sha256-kSREFNIGH0MXiyKMp1LmrLkhKBhovvNRz46LTXT2XME=";
+  npmDeps = fetchNpmDeps {
+    src = "${src}/web";
+    hash = "sha256-2yeqLly0guU/kpX+yH/QOoDGzyJTxkTaCt8EleJhybU=";
+  };
+
+  npmRoot = "web";
+  nativeBuildInputs = [
+    nodejs
+    npmHooks.npmConfigHook
+  ];
+
+  overrideModAttrs = oldAttrs: {
+    # Do not add `npmConfigHook` to `goModules`
+    nativeBuildInputs = lib.remove npmHooks.npmConfigHook oldAttrs.nativeBuildInputs;
+    # Do not run `preBuild` when building `goModules`
+    preBuild = null;
+  };

  # Some tests require internet access, broken in sandbox
  doCheck = false;

+  preBuild = ''
+    npm --prefix="$npmRoot" run build
+    go generate ./...
+  '';
+
  ldflags = [
    "-s"
    "-w"
--- a/pkgs/by-name/ho/home-manager/package.nix
+++ b/pkgs/by-name/ho/home-manager/package.nix
@ -16,14 +16,14 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "home-manager";
-  version = "unstable-2024-03-15";
+  version = "unstable-2024-03-19";

  src = fetchFromGitHub {
    name = "home-manager-source";
    owner = "nix-community";
    repo = "home-manager";
-    rev = "206f457fffdb9a73596a4cb2211a471bd305243d";
-    hash = "sha256-SUXGZNrXX05YA9G6EmgupxhOr3swI1gcxLUeDMUhrEY=";
+    rev = "022464438a85450abb23d93b91aa82e0addd71fb";
+    hash = "sha256-2bNMraoRB4pdw/HtxgYTFeMhEekBZeQ53/a8xkqpbZc=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ja/jan/package.nix
+++ b/pkgs/by-name/ja/jan/package.nix
@ -5,10 +5,10 @@

 let
  pname = "jan";
-  version = "0.4.8";
+  version = "0.4.9";
  src = fetchurl {
    url = "https://github.com/janhq/jan/releases/download/v${version}/jan-linux-x86_64-${version}.AppImage";
-    hash = "sha256-8Vi2KK+5Wk/K+RJZ0/cbRUb8L25WEiLdo5ay8+ichdw=";
+    hash = "sha256-6XnDrr+AkZH69zXf0OKdi8R6LoRWWMZNqWilZhLGynk=";
  };

  appimageContents = appimageTools.extractType2 { inherit pname version src; };
--- a/pkgs/by-name/lu/lunacy/package.nix
+++ b/pkgs/by-name/lu/lunacy/package.nix
@ -18,11 +18,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "lunacy";
-  version = "9.4.2.5022";
+  version = "9.5.0";

  src = fetchurl {
    url = "https://lcdn.icons8.com/setup/Lunacy_${finalAttrs.version}.deb";
-    hash = "sha256-69CO1SPdO+JhAH/G/DihyHDueQOLaaJCf32MjBc77j4=";
+    hash = "sha256-dG2xLoqRQJsaR7v00iN46GP4jB8WVrxayn2CSQLCUlQ=";
  };

  unpackCmd = ''
--- a/pkgs/by-name/ma/maloader/package.nix
+++ b/pkgs/by-name/ma/maloader/package.nix
@ -0,0 +1,63 @@
+{
+  lib,
+  llvmPackages,
+  fetchFromGitHub,
+  opencflite,
+  libuuid,
+  zlib,
+}:
+
+let
+  stdenv = llvmPackages.libcxxStdenv;
+in
+stdenv.mkDerivation {
+  pname = "maloader";
+  version = "0-unstable-2018-05-02";
+
+  src = fetchFromGitHub {
+    owner = "shinh";
+    repo = "maloader";
+    rev = "464a90fdfd06a54c9da5d1a3725ed6229c0d3d60";
+    hash = "sha256-0N3+tr8XUsn3WhJNsPVknumBrfMgDawTEXVRkIs/IV8=";
+  };
+
+  postPatch = ''
+    substituteInPlace ld-mac.cc \
+      --replace-fail 'loadLibMac(mypath)' 'loadLibMac("${placeholder "out"}/lib/")' \
+      --replace-fail 'libCoreFoundation.so' '${opencflite}/lib/libCoreFoundation.so'
+    substituteInPlace libmac/stack_protector-obsd.c \
+      --replace-fail 'sys/sysctl.h' 'linux/sysctl.h'
+  '';
+
+  buildInputs = [
+    libuuid
+    zlib
+  ];
+
+  buildFlags = [
+    "USE_LIBCXX=1"
+    "release"
+  ];
+
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-command-line-argument";
+
+  installPhase = ''
+    runHook preInstall
+
+    install -vD libmac.so "$out/lib/libmac.so"
+
+    for bin in extract macho2elf ld-mac; do
+      install -vD "$bin" "$out/bin/$bin"
+    done
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Mach-O loader for Linux";
+    homepage = "https://github.com/shinh/maloader";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ wegank ];
+    inherit (opencflite.meta) platforms;
+  };
+}
--- a/pkgs/by-name/me/mercure/package.nix
+++ b/pkgs/by-name/me/mercure/package.nix
@ -8,18 +8,18 @@

 buildGoModule rec {
  pname = "mercure";
-  version = "0.15.9";
+  version = "0.15.10";

  src = fetchFromGitHub {
    owner = "dunglas";
    repo = "mercure";
    rev = "v${version}";
-    hash = "sha256-4Y+yZSZrBDLPbQXaOCSKk/EY20Ka8CS4ivUg1TEaqXo=";
+    hash = "sha256-ot4Gb2Zg4VaF/ip9cLJYP69WGmKw/+WQSf20o1aQtpM=";
  };

  sourceRoot = "${src.name}/caddy";

-  vendorHash = "sha256-N0RmvhBlTiWmBb4TzLmaThD9jVkKgcIO9vPWxJAvLRQ=";
+  vendorHash = "sha256-K+9LQ9wI0ltZI7N2mshiDsjEMc2FzenqSGP00fEWuMQ=";

  subPackages = [ "mercure" ];
  excludedPackages = [ "../cmd/mercure" ];
--- a/pkgs/by-name/oc/octorpki/package.nix
+++ b/pkgs/by-name/oc/octorpki/package.nix
@ -1,51 +0,0 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
-, fetchpatch
-}:
-
-buildGoModule rec {
-  pname = "octorpki";
-  version = "1.5.10";
-
-  src = fetchFromGitHub {
-    owner = "cloudflare";
-    repo = "cfrpki";
-    rev = "v${version}";
-    hash = "sha256-eqIAauwFh1Zbv3Jkk8plz1OR3ZW8fs0ugNwwTnSHSFM=";
-  };
-
-  patches = [
-    # https://github.com/cloudflare/cfrpki/pull/150
-    (fetchpatch {
-      url = "https://github.com/cloudflare/cfrpki/commit/fd0c4e95b880c463430c91ce1f86205b9309399b.patch";
-      hash = "sha256-cJ0mWkjtGvgTIH5eEum8h2Gy2PqR+nPto+mj5m/I/d4=";
-    })
-  ];
-
-  ldflags = [
-    "-X main.version=v${version}"
-    "-X main.talpath=${placeholder "out"}/share/tals"
-  ];
-
-  subPackages = [
-    "cmd/octorpki"
-  ];
-
-  postInstall = ''
-    mkdir -p $out/share
-    cp -R cmd/octorpki/tals $out/share/tals
-  '';
-
-  vendorHash = null;
-
-  meta = with lib; {
-    homepage = "https://github.com/cloudflare/cfrpki#octorpki";
-    changelog = "https://github.com/cloudflare/cfrpki/releases/tag/v${version}";
-    description = "A software used to download RPKI (RFC 6480) certificates and validate them";
-    mainProgram = "octorpki";
-    license = licenses.bsd3;
-    platforms = platforms.all;
-    maintainers = teams.wdz.members;
-  };
-}
--- a/pkgs/by-name/ol/olvid/package.nix
+++ b/pkgs/by-name/ol/olvid/package.nix
@ -0,0 +1,108 @@
+{ stdenv
+, lib
+, fetchurl
+, zlib
+, libXext
+, libX11
+, libXrender
+, libXtst
+, libXi
+, freetype
+, alsa-lib
+, jdk21
+, openjfx21
+, autoPatchelfHook
+, makeBinaryWrapper
+, wrapGAppsHook
+}:
+
+let
+  repo = "olvid";
+
+  javafxModules = [ "swing" "controls" "media" "fxml" "graphics" "base" ];
+
+  classpath =
+    lib.concatMap (mod: [
+      "${openjfx21}/modules_src/javafx.${mod}/module-info.java"
+      "${openjfx21}/modules/javafx.${mod}"
+      "${openjfx21}/modules_libs/javafx.${mod}"
+    ]) javafxModules ++
+    [ "$out/share/${repo}/*" ];
+
+  jvmArgs = [
+    "-cp" (lib.concatStringsSep ":" classpath)
+    "-Djpackage.app-version=$version"
+    "-Dolvid.sqlcipher=true"
+    "-Dolvid.dev=false"
+    "-Dolvid.packaged=true"
+    "-Dolvid.multiuser=false"
+    "-Dolvid.debug=false"
+    "-Dolvid.version=$version"
+    "-Djava.net.useSystemProxies=true"
+    "-Djava.library.path=$out/lib/"
+    "-Xss8M"
+    "-XX:+ShowCodeDetailsInExceptionMessages"
+    "--add-opens=java.desktop/java.awt=ALL-UNNAMED"
+    "--add-opens=java.desktop/java.awt.geom=ALL-UNNAMED"
+    "--add-opens=java.desktop/sun.awt.geom=ALL-UNNAMED"
+    "--add-opens=java.base/java.util=ALL-UNNAMED"
+    "--add-opens=java.desktop/javax.swing=ALL-UNNAMED"
+    "--add-opens=java.desktop/sun.awt.shell=ALL-UNNAMED"
+  ];
+in
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "olvid";
+  version = "1.5.0";
+
+  dontUnpack = true;
+  dontWrapGApps = true;
+
+  src = fetchurl {
+    url = "https://static.olvid.io/linux/${repo}-${finalAttrs.version}.tar.gz";
+    hash = "sha256-iiMc9mM+uUVeS1i1gzXMZaMwSChdz7vNrL9uqJlR8NU=";
+  };
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    makeBinaryWrapper
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    zlib
+    libXext
+    libX11
+    libXrender
+    libXtst
+    libXi
+    freetype
+    alsa-lib
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -dm755 "$out/share/${repo}"
+    tar -xf "$src" -C "$out/share/${repo}" --wildcards --strip-components 3 olvid/lib/app/'*.jar'
+
+    install -dm755 "$out/lib"
+    tar -xf "$src" -C "$out/lib" --strip-components 4 olvid/lib/runtime/lib/
+
+    install -dm755 "$out/bin"
+    makeBinaryWrapper ${jdk21}/bin/java $out/bin/${repo} \
+      "''${gappsWrapperArgs[@]}" \
+      --add-flags "${lib.concatStringsSep " " jvmArgs} io.olvid.windows.messenger.start_up.Launcher"
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "The secure french messenger";
+    homepage = "https://www.olvid.io";
+    license = licenses.agpl3;
+    mainProgram = "olvid";
+    maintainers = with maintainers; [ rookeur ];
+    platforms = platforms.linux;
+  };
+})
--- a/pkgs/by-name/op/opencflite/package.nix
+++ b/pkgs/by-name/op/opencflite/package.nix
@ -0,0 +1,43 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  pkg-config,
+  icu,
+  libkqueue,
+  libuuid,
+  tzdata,
+  zlib,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "opencflite";
+  version = "635.21.8";
+
+  src = fetchFromGitHub {
+    owner = "gerickson";
+    repo = "opencflite";
+    rev = "opencflite-${version}";
+    hash = "sha256-ijyj4SFYQ0wZAFM2ehNnR9+yu5yDTSVW3VBycBT9l+A=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    icu
+    libkqueue
+    libuuid
+    tzdata
+    zlib
+  ];
+
+  enableParallelBuilding = true;
+
+  meta = {
+    description = "Cross platform port of the macOS CoreFoundation";
+    homepage = "https://github.com/gerickson/opencflite";
+    license = lib.licenses.apsl20;
+    maintainers = with lib.maintainers; [ wegank ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/applications/misc/owmods-cli/default.nix
+++ b/pkgs/applications/misc/owmods-cli/default.nix
@ -6,34 +6,40 @@
 , pkg-config
 , installShellFiles
 , zstd
+, libsoup_3
+, makeWrapper
+, mono
+, wrapWithMono ? true
 , openssl
-, Security
+, darwin
 }:

 rustPlatform.buildRustPackage rec {
  pname = "owmods-cli";
-  version = "0.12.2";
+  version = "0.13.0";

  src = fetchFromGitHub {
    owner = "ow-mods";
    repo = "ow-mod-man";
    rev = "cli_v${version}";
-    hash = "sha256-AfqpLL3cGZLKW5/BE6SaBe4S8GzYM2GKUZU8mFH5uX4=";
+    hash = "sha256-JCPuKGO0pbhQaNmZUcZ95EZbXubrjZnw0qJmKCGuAoQ=";
  };

-  cargoHash = "sha256-PhdfpiUgeOB13ROgzPBYM+sBLGMP+RtV9j9ebo8PpJU=";
+  cargoHash = "sha256-dTEEpjonvFYFv16e0eS71B4OMiYueYSfcs8gmSYeHPc=";

  nativeBuildInputs = [
    pkg-config
    installShellFiles
-  ];
+  ] ++ lib.optional wrapWithMono makeWrapper;

  buildInputs = [
    zstd
+    libsoup_3
  ] ++ lib.optionals stdenv.isLinux [
    openssl
  ] ++ lib.optionals stdenv.isDarwin [
-    Security
+    darwin.apple_sdk.frameworks.Security
+    darwin.apple_sdk.frameworks.SystemConfiguration
  ];

  env = {
@ -44,9 +50,11 @@ rustPlatform.buildRustPackage rec {

  postInstall = ''
    cargo xtask dist_cli
-    installManPage man/man*/*
+    installManPage dist/cli/man/*
    installShellCompletion --cmd owmods \
-      dist/cli/completions/owmods.{bash,fish,zsh}
+    dist/cli/completions/owmods.{bash,fish,zsh}
+    '' + lib.optionalString wrapWithMono ''
+    wrapProgram $out/bin/${meta.mainProgram} --prefix PATH : '${mono}/bin'
  '';

  passthru.updateScript = nix-update-script {};
@ -58,6 +66,6 @@ rustPlatform.buildRustPackage rec {
    changelog = "https://github.com/ow-mods/ow-mod-man/releases/tag/cli_v${version}";
    mainProgram = "owmods";
    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ locochoco ];
+    maintainers = with maintainers; [ bwc9876 spoonbaker locochoco ];
  };
 }
--- a/pkgs/by-name/pr/protonmail-bridge-gui/package.nix
+++ b/pkgs/by-name/pr/protonmail-bridge-gui/package.nix
@ -0,0 +1,113 @@
+{ lib
+, stdenv
+, pkg-config
+, libsecret
+, cmake
+, ninja
+, qt6
+, grpc
+, protobuf
+, zlib
+, gtest
+, sentry-native
+, protonmail-bridge
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "protonmail-bridge-gui";
+
+  inherit (protonmail-bridge) version src;
+
+  patches = [
+    # Use `gtest` from Nixpkgs to allow an offline build
+    ./use-nix-googletest.patch
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+    ninja
+    qt6.qtbase
+    qt6.qtdeclarative
+    qt6.qtwayland
+    qt6.qtsvg
+    qt6.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    libsecret
+    grpc
+    protobuf
+    zlib
+    gtest
+    sentry-native
+  ];
+
+  sourceRoot = "${finalAttrs.src.name}/internal/frontend/bridge-gui";
+
+  postPatch = ''
+    # Bypass `vcpkg` by deleting lines that `include` BridgeSetup.cmake
+    find . -type f -name "CMakeLists.txt" -exec sed -i "/BridgeSetup\\.cmake/d" {} \;
+
+    # Use the available ICU version
+    sed -i "s/libicu\(i18n\|uc\|data\)\.so\.56/libicu\1.so/g" bridge-gui/DeployLinux.cmake
+
+    # Create a Desktop Entry that uses a `protonmail-bridge-gui` binary without upstream's launcher
+    sed "s/^\(Icon\|Exec\)=.*$/\1=protonmail-bridge-gui/" ../../../dist/proton-bridge.desktop > proton-bridge-gui.desktop
+
+    # Also update `StartupWMClass` to match the GUI binary's `wmclass` (Wayland app id)
+    sed -i "s/^\(StartupWMClass=\)Proton Mail Bridge$/\1ch.proton.bridge-gui/" proton-bridge-gui.desktop
+
+    # Don't build `bridge-gui-tester`
+    sed -i "/add_subdirectory(bridge-gui-tester)/d" CMakeLists.txt
+  '';
+
+  preConfigure = ''
+    cmakeFlagsArray+=(
+      "-DCMAKE_BUILD_TYPE=Release"
+      "-DBRIDGE_APP_FULL_NAME=Proton Mail Bridge"
+      "-DBRIDGE_VENDOR=Proton AG"
+      "-DBRIDGE_REVISION=${finalAttrs.src.rev}"
+      "-DBRIDGE_TAG=${finalAttrs.version}"
+      "-DBRIDGE_BUILD_ENV=Nix"
+      "-DBRIDGE_APP_VERSION=${finalAttrs.version}"
+    )
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    # Install the GUI binary
+    install -Dm755 bridge-gui/bridge-gui $out/lib/bridge-gui
+
+    # Symlink the backend binary from the protonmail-bridge (CLI) package
+    ln -s ${protonmail-bridge}/bin/protonmail-bridge $out/lib/bridge
+
+    # Symlink the GUI binary
+    mkdir -p $out/bin
+    ln -s $out/lib/bridge-gui $out/bin/protonmail-bridge-gui
+
+    # Install desktop assets
+    install -Dm644 ../proton-bridge-gui.desktop -t $out/share/applications
+    install -Dm644 ../../../../dist/bridge.svg $out/share/icons/hicolor/scalable/apps/protonmail-bridge-gui.svg
+
+    runHook postInstall
+  '';
+
+  meta = {
+    changelog = "https://github.com/ProtonMail/proton-bridge/blob/${finalAttrs.src.rev}/Changelog.md";
+    description = "Qt-based GUI to use your ProtonMail account with your local e-mail client";
+    downloadPage = "https://github.com/ProtonMail/proton-bridge/releases";
+    homepage = "https://github.com/ProtonMail/proton-bridge";
+    license = lib.licenses.gpl3Plus;
+    longDescription = ''
+      Provides a GUI application that runs in the background and seamlessly encrypts
+      and decrypts your mail as it enters and leaves your computer.
+
+      To work, use secret-service freedesktop.org API (e.g. Gnome keyring) or pass.
+    '';
+    mainProgram = "protonmail-bridge-gui";
+    maintainers = with lib.maintainers; [ daniel-fahey ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/pr/protonmail-bridge-gui/use-nix-googletest.patch
+++ b/pkgs/by-name/pr/protonmail-bridge-gui/use-nix-googletest.patch
@ -0,0 +1,23 @@
+diff --git a/bridgepp/CMakeLists.txt b/bridgepp/CMakeLists.txt
+index f4a0a553..02d631dc 100644
+--- a/bridgepp/CMakeLists.txt
+++ b/bridgepp/CMakeLists.txt
+@@ -172,16 +172,8 @@ if (CMAKE_VERSION VERSION_GREATER_EQUAL "3.24.0")
+     cmake_policy(SET CMP0135 NEW) # avoid warning DOWNLOAD_EXTRACT_TIMESTAMP
+ endif ()
+ 
+-include(FetchContent)
+-FetchContent_Declare(
+-    googletest
+-    URL https://github.com/google/googletest/archive/b796f7d44681514f58a683a3a71ff17c94edb0c1.zip
+-)
+-
+-# For Windows: Prevent overriding the parent project's compiler/linker settings
+-set(gtest_force_shared_crt ON CACHE BOOL "" FORCE)
+-
+-FetchContent_MakeAvailable(googletest)
+# Use find_package to use the gtest package provided by Nix
+find_package(GTest REQUIRED)
+ 
+ enable_testing()
+ 
--- a/pkgs/by-name/re/renode-dts2repl/package.nix
+++ b/pkgs/by-name/re/renode-dts2repl/package.nix
@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication {
  pname = "renode-dts2repl";
-  version = "unstable-2024-03-12";
+  version = "unstable-2024-03-19";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "antmicro";
    repo = "dts2repl";
-    rev = "eff98d616e3541e54ca783c84f598c9e348a76a8";
-    hash = "sha256-qNHj5WOSca04ceGeRNa60M6cH9/rRHLEF1YX75yYDO8=";
+    rev = "dc4160a3a4c23aee846625ac9115fe2cbb91fe42";
+    hash = "sha256-cy4XLKKiWqEvWWDHmj2bhp38pbtSxp+P92r7NxueAaE=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/re/renode/package.nix
+++ b/pkgs/by-name/re/renode/package.nix
@ -23,11 +23,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "renode";
-  version = "1.14.0";
+  version = "1.15.0";

  src = fetchurl {
-    url = "https://builds.renode.io/renode-${finalAttrs.version}.linux-portable.tar.gz";
-    hash = "sha256-1wfVHtCYc99ACz8m2XEg1R0nIDh9xP4ffV/vxeeEHxE=";
+    url = "https://github.com/renode/renode/releases/download/v${finalAttrs.version}/renode-${finalAttrs.version}.linux-portable.tar.gz";
+    hash = "sha256-w3HKYctW1LmiAse/27Y1Gmz9hDprQ1CK7+TXIexCrkg=";
  };

  nativeBuildInputs = [
@ -95,7 +95,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Virtual development framework for complex embedded systems";
-    homepage = "https://renode.org";
+    homepage = "https://renode.io";
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [ otavio ];
    platforms = [ "x86_64-linux" ];
--- a/pkgs/by-name/rs/rs-tftpd/package.nix
+++ b/pkgs/by-name/rs/rs-tftpd/package.nix
@ -0,0 +1,26 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "rs-tftpd";
+  version = "0.2.12";
+
+  src = fetchFromGitHub {
+    owner = "altugbakan";
+    repo = "rs-tftpd";
+    rev = version;
+    hash = "sha256-H67lXwX+4guHpdq0yTHe6tl1NxC41saNrM9g+yH5otk=";
+  };
+
+  cargoHash = "sha256-B5kduRuX9Lcdd31yj4PsDo8fyy0nabtmsiAXvc8RlYo=";
+
+  meta = with lib; {
+    description = "TFTP Server Daemon implemented in Rust";
+    homepage = "https://github.com/altugbakan/rs-tftpd";
+    license = licenses.mit;
+    maintainers = with maintainers; [ matthewcroughan ];
+    mainProgram = "tftpd";
+  };
+}
--- a/Show More
+++ b/Show More
				`@ -0,0 +1 @@`
				`sì B0ã”ŸŽdûR<C3BB>æÈôÌH¶5œu?à»í…^`
				`@ -0,0 +1 @@`
				`ΟX<>1®yGΟΥ…<CEA5>SAM»<4D>eΘΐ«Ύ‡<0C>έ7]`