Merge master into haskell-updates

2024-04-03 00:12:53 +00:00 · 2024-04-03 00:12:53 +00:00 · 422c2f77f7
parent af997fc9f8 ce93557538
commit 422c2f77f7
234 changed files with 11542 additions and 2517 deletions
--- a/.git-blame-ignore-revs
+++ b/.git-blame-ignore-revs
@ -102,3 +102,6 @@ fb0e5be84331188a69b3edd31679ca6576edb75a

 # systemd: break too long lines of Nix code
 67643f8ec84bef1482204709073e417c9f07eb87
+
+# {pkgs/development/cuda-modules,pkgs/test/cuda,pkgs/top-level/cuda-packages.nix}: reformat all CUDA files with nixfmt-rfc-style 2023-03-01
+802a1b4d3338f24cbc4efd704616654456d75a94
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@ -95,6 +95,14 @@
        - pkgs/top-level/haskell-packages.nix
        - pkgs/top-level/release-haskell.nix

+"6.topic: julia":
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - doc/languages-frameworks/julia.section.md
+        - pkgs/development/compilers/julia/**/*
+        - pkgs/development/julia-modules/**/*
+
 "6.topic: jupyter":
  - any:
    - changed-files:
--- a/.github/workflows/check-nix-format.yml
+++ b/.github/workflows/check-nix-format.yml
@ -0,0 +1,50 @@
+# This file was copied mostly from check-maintainers-sorted.yaml.
+# NOTE: Formatting with the RFC-style nixfmt command is not yet stable. See
+# https://github.com/NixOS/rfcs/pull/166.
+# Because of this, this action is not yet enabled for all files -- only for
+# those who have opted in.
+name: Check that Nix files are formatted
+
+on:
+  pull_request_target:
+permissions:
+  contents: read
+
+jobs:
+  nixos:
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'NixOS'
+    steps:
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+        with:
+          # pull_request_target checks out the base branch by default
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
+        with:
+          # explicitly enable sandbox
+          extra_nix_config: sandbox = true
+      - name: Install nixfmt
+        run: nix-env -f default.nix -iAP nixfmt-rfc-style
+      - name: Check that Nix files are formatted according to the RFC style
+        # Each environment variable beginning with NIX_FMT_PATHS_ is a list of
+        # paths to check with nixfmt.
+        env:
+          # Format paths related to the Nixpkgs CUDA ecosystem.
+          NIX_FMT_PATHS_CUDA: |
+            pkgs/development/cuda-modules
+            pkgs/test/cuda
+            pkgs/top-level/cuda-packages.nix
+        # Iterate over all environment variables beginning with NIX_FMT_PATHS_.
+        run: |
+          for env_var in "${!NIX_FMT_PATHS_@}"; do
+            readarray -t paths <<< "${!env_var}"
+            if [[ "${paths[*]}" == "" ]]; then
+              echo "Error: $env_var is empty."
+              exit 1
+            fi
+            echo "Checking paths: ${paths[@]}"
+            if ! nixfmt --check "${paths[@]}"; then
+              echo "Error: nixfmt failed."
+              exit 1
+            fi
+          done
--- a/lib/default.nix
+++ b/lib/default.nix
@ -97,7 +97,7 @@ let
    inherit (self.strings) concatStrings concatMapStrings concatImapStrings
      intersperse concatStringsSep concatMapStringsSep
      concatImapStringsSep concatLines makeSearchPath makeSearchPathOutput
-      makeLibraryPath makeBinPath optionalString
+      makeLibraryPath makeIncludePath makeBinPath optionalString
      hasInfix hasPrefix hasSuffix stringToCharacters stringAsChars escape
      escapeShellArg escapeShellArgs
      isStorePath isStringLike
--- a/lib/strings.nix
+++ b/lib/strings.nix
@ -206,6 +206,18 @@ rec {
  */
  makeLibraryPath = makeSearchPathOutput "lib" "lib";

+  /* Construct an include search path (such as C_INCLUDE_PATH) containing the
+     header files for a set of packages or paths.
+
+     Example:
+       makeIncludePath [ "/usr" "/usr/local" ]
+       => "/usr/include:/usr/local/include"
+       pkgs = import <nixpkgs> { }
+       makeIncludePath [ pkgs.openssl pkgs.zlib ]
+       => "/nix/store/9rz8gxhzf8sw4kf2j2f1grr49w8zx5vj-openssl-1.0.1r-dev/include:/nix/store/wwh7mhwh269sfjkm6k5665b5kgp7jrk2-zlib-1.2.8-dev/include"
+  */
+  makeIncludePath = makeSearchPathOutput "dev" "include";
+
  /* Construct a binary search path (such as $PATH) containing the
     binaries for a set of packages.

--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@ -64,6 +64,7 @@ let
    lists
    listToAttrs
    makeExtensible
+    makeIncludePath
    makeOverridable
    mapAttrs
    matchAttrs
@ -296,6 +297,35 @@ runTests {
    expected = "a\nb\nc\n";
  };

+  testMakeIncludePathWithPkgs = {
+    expr = (makeIncludePath [
+      # makeIncludePath preferably selects the "dev" output
+      { dev.outPath = "/dev"; out.outPath = "/out"; outPath = "/default"; }
+      # "out" is used if "dev" is not found
+      { out.outPath = "/out"; outPath = "/default"; }
+      # And it returns the derivation directly if there's no "out" either
+      { outPath = "/default"; }
+      # Same if the output is specified explicitly, even if there's a "dev"
+      { dev.outPath = "/dev"; outPath = "/default"; outputSpecified = true; }
+    ]);
+    expected = "/dev/include:/out/include:/default/include:/default/include";
+  };
+
+  testMakeIncludePathWithEmptyList = {
+    expr = (makeIncludePath [ ]);
+    expected = "";
+  };
+
+  testMakeIncludePathWithOneString = {
+    expr = (makeIncludePath [ "/usr" ]);
+    expected = "/usr/include";
+  };
+
+  testMakeIncludePathWithManyString = {
+    expr = (makeIncludePath [ "/usr" "/usr/local" ]);
+    expected = "/usr/include:/usr/local/include";
+  };
+
  testReplicateString = {
    expr = strings.replicate 5 "hello";
    expected = "hellohellohellohellohello";
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -256,6 +256,12 @@
    githubId = 381298;
    name = "9R";
  };
+  A1ca7raz = {
+    email = "aya@wtm.moe";
+    github = "A1ca7raz";
+    githubId = 7345998;
+    name = "A1ca7raz";
+  };
  a1russell = {
    email = "adamlr6+pub@gmail.com";
    github = "a1russell";
@ -3693,6 +3699,13 @@
    githubId = 46303707;
    name = "Christian Lütke-Stetzkamp";
  };
+  clot27 = {
+    name = "Clot";
+    email = "adityayadav11082@protonmail.com";
+    github = "clot27";
+    githubId = 69784758;
+    matrix = "@clot27:matrix.org";
+  };
  clr-cera = {
    email = "clrcera05@gmail.com";
    github = "clr-cera";
@ -5850,6 +5863,13 @@
    githubId = 418227;
    name = "Jean-Philippe Braun";
  };
+  eopb = {
+    email = "ethanboxx@gmail.com";
+    github = "eopb";
+    githubId = 8074468;
+    matrix = "@efun:matrix.org";
+    name = "Ethan Brierley";
+  };
  eownerdead = {
    name = "EOWNERDEAD";
    email = "eownerdead@disroot.org";
@ -16404,6 +16424,12 @@
    githubId = 25647735;
    name = "Victor Freire";
  };
+  ravenz46 = {
+    email = "goldraven0406@gmail.com";
+    github = "RAVENz46";
+    githubId = 86608952;
+    name = "RAVENz46";
+  };
  rawkode = {
    email = "david.andrew.mckay@gmail.com";
    github = "rawkode";
@ -18838,6 +18864,15 @@
    githubId = 89950;
    name = "Stéphan Kochen";
  };
+  stephen-huan = {
+    name = "Stephen Huan";
+    email = "stephen.huan@cgdct.moe";
+    github = "stephen-huan";
+    githubId = 20411956;
+    keys = [{
+      fingerprint = "EA6E 2794 8C7D BF5D 0DF0  85A1 0FBC 2E3B A99D D60E";
+    }];
+  };
  stephenmw = {
    email = "stephen@q5comm.com";
    github = "stephenmw";
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@ -8,6 +8,7 @@ busted,,,,,,
 cassowary,,,,,,marsam alerque
 cldr,,,,,,alerque
 compat53,,,,,,vcunat
+commons.nvim,,,,,,mrcjkb
 cosmo,,,,,,marsam
 coxpcall,,,,1.17.0-1,,
 cqueues,,,,,,vcunat
@ -18,6 +19,8 @@ fennel,,,,,,misterio77
 fidget.nvim,,,,,,mrcjkb
 fifo,,,,,,
 fluent,,,,,,alerque
+funnyfiles.nvim,,,,,,mrcjkb
+fzf-lua,,,,,,mrcjkb
 fzy,,,,,,mrcjkb
 gitsigns.nvim,https://github.com/lewis6991/gitsigns.nvim.git,,,,5.1,
 haskell-tools.nvim,,,,,,
@ -85,6 +88,7 @@ luaunbound,,,,,,
 luaunit,,,,,,lockejan
 luautf8,,,,,,pstn
 luazip,,,,,,
+lua-utils.nvim,,,,,,mrcjkb
 lua-yajl,,,,,,pstn
 lua-iconv,,,,7.0.0,,
 luuid,,,,20120509-2,,
@ -98,6 +102,7 @@ middleclass,,,,,,
 mimetypes,,,,,,
 mpack,,,,,,
 moonscript,https://github.com/leafo/moonscript.git,dev-1,,,,arobyn
+neotest,,,,,,mrcjkb
 nlua,,,,,,teto
 nui.nvim,,,,,,mrcjkb
 nvim-cmp,https://github.com/hrsh7th/nvim-cmp,,,,,
@ -107,6 +112,10 @@ plenary.nvim,https://github.com/nvim-lua/plenary.nvim.git,,,,5.1,
 rapidjson,https://github.com/xpol/lua-rapidjson.git,,,,,
 rocks.nvim,,,,,5.1,teto mrcjkb
 rest.nvim,,,,,5.1,teto
+rocks.nvim,,,,,,mrcjkb
+rocks-git.nvim,,,,,,mrcjkb
+rocks-config.nvim,,,,,,mrcjkb
+rocks-dev.nvim,,,,,,mrcjkb
 rustaceanvim,,,,,,mrcjkb
 say,https://github.com/Olivine-Labs/say.git,,,,,
 serpent,,,,,,lockejan
--- a/nixos/doc/manual/default.nix
+++ b/nixos/doc/manual/default.nix
@ -9,12 +9,20 @@
 , prefix ? ../../..
 }:

-with pkgs;
-
 let
-  inherit (lib) hasPrefix removePrefix;
+  inherit (pkgs) buildPackages runCommand docbook_xsl_ns;

-  lib = pkgs.lib;
+  inherit (pkgs.lib)
+    hasPrefix
+    removePrefix
+    flip
+    foldr
+    types
+    mkOption
+    escapeShellArg
+    concatMapStringsSep
+    sourceFilesBySuffices
+    ;

  common = import ./common.nix;

@ -27,7 +35,7 @@ let
  # E.g. if some `options` came from modules in ${pkgs.customModules}/nix,
  # you'd need to include `extraSources = [ pkgs.customModules ]`
  prefixesToStrip = map (p: "${toString p}/") ([ prefix ] ++ extraSources);
-  stripAnyPrefixes = lib.flip (lib.foldr lib.removePrefix) prefixesToStrip;
+  stripAnyPrefixes = flip (foldr removePrefix) prefixesToStrip;

  optionsDoc = buildPackages.nixosOptionsDoc {
    inherit options revision baseOptionsJSON warningsAreErrors;
@ -42,8 +50,8 @@ let
  testOptionsDoc = let
      eval = nixos-lib.evalTest {
        # Avoid evaluating a NixOS config prototype.
-        config.node.type = lib.types.deferredModule;
-        options._module.args = lib.mkOption { internal = true; };
+        config.node.type = types.deferredModule;
+        options._module.args = mkOption { internal = true; };
      };
    in buildPackages.nixosOptionsDoc {
      inherit (eval) options;
@ -76,7 +84,7 @@ let
    substituteInPlace ./configuration/configuration.md \
      --replace \
          '@MODULE_CHAPTERS@' \
-          ${lib.escapeShellArg (lib.concatMapStringsSep "\n" (p: "${p.value}") config.meta.doc)}
+          ${escapeShellArg (concatMapStringsSep "\n" (p: "${p.value}") config.meta.doc)}
    substituteInPlace ./nixos-options.md \
      --replace \
        '@NIXOS_OPTIONS_JSON@' \
@ -95,7 +103,7 @@ in rec {
  # Generate the NixOS manual.
  manualHTML = runCommand "nixos-manual-html"
    { nativeBuildInputs = [ buildPackages.nixos-render-docs ];
-      inputs = lib.sourceFilesBySuffices ./. [ ".md" ];
+      inputs = sourceFilesBySuffices ./. [ ".md" ];
      meta.description = "The NixOS manual in HTML format";
      allowedReferences = ["out"];
    }
@ -114,8 +122,8 @@ in rec {

      nixos-render-docs -j $NIX_BUILD_CORES manual html \
        --manpage-urls ${manpageUrls} \
-        --revision ${lib.escapeShellArg revision} \
-        --generator "nixos-render-docs ${lib.version}" \
+        --revision ${escapeShellArg revision} \
+        --generator "nixos-render-docs ${pkgs.lib.version}" \
        --stylesheet style.css \
        --stylesheet highlightjs/mono-blue.css \
        --script ./highlightjs/highlight.pack.js \
@ -147,7 +155,7 @@ in rec {
              xml:id="book-nixos-manual">
          <info>
            <title>NixOS Manual</title>
-            <subtitle>Version ${lib.version}</subtitle>
+            <subtitle>Version ${pkgs.lib.version}</subtitle>
          </info>
          <chapter>
            <title>Temporarily unavailable</title>
@ -199,7 +207,7 @@ in rec {
      # Generate manpages.
      mkdir -p $out/share/man/man5
      nixos-render-docs -j $NIX_BUILD_CORES options manpage \
-        --revision ${lib.escapeShellArg revision} \
+        --revision ${escapeShellArg revision} \
        ${optionsJSON}/${common.outputPath}/options.json \
        $out/share/man/man5/configuration.nix.5
    '';
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -72,6 +72,8 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

+- [ownCloud Infinite Scale Stack](https://owncloud.com/infinite-scale-4-0/), a modern and scalable rewrite of ownCloud.
+
 - [Handheld Daemon](https://github.com/hhd-dev/hhd), support for gaming handhelds like the Legion Go, ROG Ally, and GPD Win. Available as [services.handheld-daemon](#opt-services.handheld-daemon.enable).

 - [Guix](https://guix.gnu.org), a functional package manager inspired by Nix. Available as [services.guix](#opt-services.guix.enable).
--- a/nixos/modules/misc/documentation.nix
+++ b/nixos/modules/misc/documentation.nix
@ -1,8 +1,32 @@
 { config, options, lib, pkgs, utils, modules, baseModules, extraModules, modulesPath, specialArgs, ... }:

-with lib;
-
 let
+  inherit (lib)
+    cleanSourceFilter
+    concatMapStringsSep
+    evalModules
+    filter
+    functionArgs
+    hasSuffix
+    isAttrs
+    isDerivation
+    isFunction
+    isPath
+    literalExpression
+    mapAttrs
+    mkIf
+    mkMerge
+    mkOption
+    mkRemovedOptionModule
+    mkRenamedOptionModule
+    optional
+    optionalAttrs
+    optionals
+    partition
+    removePrefix
+    types
+    warn
+    ;

  cfg = config.documentation;
  allOpts = options;
@ -13,7 +37,7 @@ let
      instance = f (mapAttrs (n: _: abort "evaluating ${n} for `meta` failed") (functionArgs f));
    in
      cfg.nixos.options.splitBuild
-        && builtins.isPath m
+        && isPath m
        && isFunction f
        && instance ? options
        && instance.meta.buildDocsInSandbox or true;
@ -51,12 +75,12 @@ let
          (name: value:
            let
              wholeName = "${namePrefix}.${name}";
-              guard = lib.warn "Attempt to evaluate package ${wholeName} in option documentation; this is not supported and will eventually be an error. Use `mkPackageOption{,MD}` or `literalExpression` instead.";
+              guard = warn "Attempt to evaluate package ${wholeName} in option documentation; this is not supported and will eventually be an error. Use `mkPackageOption{,MD}` or `literalExpression` instead.";
            in if isAttrs value then
              scrubDerivations wholeName value
              // optionalAttrs (isDerivation value) {
                outPath = guard "\${${wholeName}}";
-                drvPath = guard drvPath;
+                drvPath = guard value.drvPath;
              }
            else value
          )
@ -176,7 +200,7 @@ in
      enable = mkOption {
        type = types.bool;
        default = true;
-        description = lib.mdDoc ''
+        description = ''
          Whether to install documentation of packages from
          {option}`environment.systemPackages` into the generated system path.

@ -188,7 +212,7 @@ in
      man.enable = mkOption {
        type = types.bool;
        default = true;
-        description = lib.mdDoc ''
+        description = ''
          Whether to install manual pages.
          This also includes `man` outputs.
        '';
@ -197,7 +221,7 @@ in
      man.generateCaches = mkOption {
        type = types.bool;
        default = false;
-        description = mdDoc ''
+        description = ''
          Whether to generate the manual page index caches.
          This allows searching for a page or
          keyword using utilities like {manpage}`apropos(1)`
@ -209,7 +233,7 @@ in
      info.enable = mkOption {
        type = types.bool;
        default = true;
-        description = lib.mdDoc ''
+        description = ''
          Whether to install info pages and the {command}`info` command.
          This also includes "info" outputs.
        '';
@ -218,7 +242,7 @@ in
      doc.enable = mkOption {
        type = types.bool;
        default = true;
-        description = lib.mdDoc ''
+        description = ''
          Whether to install documentation distributed in packages' `/share/doc`.
          Usually plain text and/or HTML.
          This also includes "doc" outputs.
@ -228,7 +252,7 @@ in
      dev.enable = mkOption {
        type = types.bool;
        default = false;
-        description = mdDoc ''
+        description = ''
          Whether to install documentation targeted at developers.
          * This includes man pages targeted at developers if {option}`documentation.man.enable` is
            set (this also includes "devman" outputs).
@ -242,7 +266,7 @@ in
      nixos.enable = mkOption {
        type = types.bool;
        default = true;
-        description = lib.mdDoc ''
+        description = ''
          Whether to install NixOS's own documentation.

          - This includes man pages like
@ -256,7 +280,7 @@ in
      nixos.extraModules = mkOption {
        type = types.listOf types.raw;
        default = [];
-        description = lib.mdDoc ''
+        description = ''
          Modules for which to show options even when not imported.
        '';
      };
@ -264,7 +288,7 @@ in
      nixos.options.splitBuild = mkOption {
        type = types.bool;
        default = true;
-        description = lib.mdDoc ''
+        description = ''
          Whether to split the option docs build into a cacheable and an uncacheable part.
          Splitting the build can substantially decrease the amount of time needed to build
          the manual, but some user modules may be incompatible with this splitting.
@ -274,7 +298,7 @@ in
      nixos.options.warningsAreErrors = mkOption {
        type = types.bool;
        default = true;
-        description = lib.mdDoc ''
+        description = ''
          Treat warning emitted during the option documentation build (eg for missing option
          descriptions) as errors.
        '';
@ -283,7 +307,7 @@ in
      nixos.includeAllModules = mkOption {
        type = types.bool;
        default = false;
-        description = lib.mdDoc ''
+        description = ''
          Whether the generated NixOS's documentation should include documentation for all
          the options from all the NixOS modules included in the current
          `configuration.nix`. Disabling this will make the manual
@ -294,7 +318,7 @@ in
      nixos.extraModuleSources = mkOption {
        type = types.listOf (types.either types.path types.str);
        default = [ ];
-        description = lib.mdDoc ''
+        description = ''
          Which extra NixOS module paths the generated NixOS's documentation should strip
          from options.
        '';
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1362,6 +1362,7 @@
  ./services/web-apps/nexus.nix
  ./services/web-apps/nifi.nix
  ./services/web-apps/node-red.nix
+  ./services/web-apps/ocis.nix
  ./services/web-apps/onlyoffice.nix
  ./services/web-apps/openvscode-server.nix
  ./services/web-apps/mobilizon.nix
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@ -901,6 +901,16 @@ in {
        '';
      };

+      sidekiq.concurrency = mkOption {
+        type = with types; nullOr int;
+        default = null;
+        description = lib.mdDoc ''
+          How many processor threads to use for processing sidekiq background job queues. When null, the GitLab default is used.
+
+          See <https://docs.gitlab.com/ee/administration/sidekiq/extra_sidekiq_processes.html#manage-thread-counts-explicitly> for details.
+        '';
+      };
+
      sidekiq.memoryKiller.enable = mkOption {
        type = types.bool;
        default = true;
@ -1454,12 +1464,17 @@ in {
        TimeoutSec = "infinity";
        Restart = "always";
        WorkingDirectory = "${cfg.packages.gitlab}/share/gitlab";
-        ExecStart = utils.escapeSystemdExecArgs [
-          "${cfg.packages.gitlab}/share/gitlab/bin/sidekiq-cluster"
-          "-e" "production"
-          "-r" "."
-          "*" # all queue groups
-        ];
+        ExecStart = utils.escapeSystemdExecArgs (
+          [
+            "${cfg.packages.gitlab}/share/gitlab/bin/sidekiq-cluster"
+            "*" # all queue groups
+          ] ++ lib.optionals (cfg.sidekiq.concurrency != null) [
+            "--concurrency" (toString cfg.sidekiq.concurrency)
+          ] ++ [
+            "--environment" "production"
+            "--require" "."
+          ]
+        );
      };
    };

--- a/nixos/modules/services/misc/redmine.nix
+++ b/nixos/modules/services/misc/redmine.nix
@ -276,8 +276,8 @@ in
      { assertion = pgsqlLocal -> cfg.database.user == cfg.database.name;
        message = "services.redmine.database.user and services.redmine.database.name must be the same when using a local postgresql database";
      }
-      { assertion = cfg.database.createLocally -> cfg.database.type != "sqlite3" && cfg.database.socket != null;
-        message = "services.redmine.database.socket must be set if services.redmine.database.createLocally is set to true";
+      { assertion = (cfg.database.createLocally && cfg.database.type != "sqlite3") -> cfg.database.socket != null;
+        message = "services.redmine.database.socket must be set if services.redmine.database.createLocally is set to true and no sqlite database is used";
      }
      { assertion = cfg.database.createLocally -> cfg.database.host == "localhost";
        message = "services.redmine.database.host must be set to localhost if services.redmine.database.createLocally is set to true";
--- a/nixos/modules/services/monitoring/prometheus/exporters.md
+++ b/nixos/modules/services/monitoring/prometheus/exporters.md
@ -72,6 +72,7 @@ example:
      - `extraFlags`
      - `openFirewall`
      - `firewallFilter`
+      - `firewallRules`
      - `user`
      - `group`
  - As there is already a package available, the module can now be added. This
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@ -169,6 +169,17 @@ let
        is true. It is used as `ip46tables -I nixos-fw firewallFilter -j nixos-fw-accept`.
      '';
    };
+    firewallRules = mkOption {
+      type = types.nullOr types.lines;
+      default = null;
+      example = literalExpression ''
+        iifname "eth0" tcp dport ${toString port} counter accept
+      '';
+      description = lib.mdDoc ''
+        Specify rules for nftables to add to the input chain
+        when {option}`services.prometheus.exporters.${name}.openFirewall` is true.
+      '';
+    };
    user = mkOption {
      type = types.str;
      default = "${name}-exporter";
@ -194,6 +205,7 @@ let
        } // extraOpts);
      } ({ config, ... }: mkIf config.openFirewall {
        firewallFilter = mkDefault "-p tcp -m tcp --dport ${toString config.port}";
+        firewallRules = mkDefault ''tcp dport ${toString config.port} accept comment "${name}-exporter"'';
      })];
      internal = true;
      default = {};
@ -212,6 +224,7 @@ let
  mkExporterConf = { name, conf, serviceOpts }:
    let
      enableDynamicUser = serviceOpts.serviceConfig.DynamicUser or true;
+      nftables = config.networking.nftables.enable;
    in
    mkIf conf.enable {
      warnings = conf.warnings or [];
@ -223,10 +236,11 @@ let
      users.groups = (mkIf (conf.group == "${name}-exporter" && !enableDynamicUser) {
        "${name}-exporter" = {};
      });
-      networking.firewall.extraCommands = mkIf conf.openFirewall (concatStrings [
+      networking.firewall.extraCommands = mkIf (conf.openFirewall && !nftables) (concatStrings [
        "ip46tables -A nixos-fw ${conf.firewallFilter} "
        "-m comment --comment ${name}-exporter -j nixos-fw-accept"
      ]);
+      networking.firewall.extraInputRules = mkIf (conf.openFirewall && nftables) conf.firewallRules;
      systemd.services."prometheus-${name}-exporter" = mkMerge ([{
        wantedBy = [ "multi-user.target" ];
        after = [ "network.target" ];
--- a/nixos/modules/services/networking/cjdns.nix
+++ b/nixos/modules/services/networking/cjdns.nix
@ -246,12 +246,8 @@ in
            shopt -s lastpipe
            ${pkg}/bin/makekeys | { read private ipv6 public; }

-            umask 0077
-            echo "CJDNS_PRIVATE_KEY=$private" >> /etc/cjdns.keys
-            echo -e "CJDNS_IPV6=$ipv6\nCJDNS_PUBLIC_KEY=$public" > /etc/cjdns.public
-
-            chmod 600 /etc/cjdns.keys
-            chmod 444 /etc/cjdns.public
+            install -m 600 <(echo "CJDNS_PRIVATE_KEY=$private") /etc/cjdns.keys
+            install -m 444 <(echo -e "CJDNS_IPV6=$ipv6\nCJDNS_PUBLIC_KEY=$public") /etc/cjdns.public
        fi

        if [ -z "$CJDNS_ADMIN_PASSWORD" ]; then
--- a/nixos/modules/services/web-apps/mastodon.nix
+++ b/nixos/modules/services/web-apps/mastodon.nix
@ -742,11 +742,16 @@ in {
        umask 077
        export PGPASSWORD="$(cat '${cfg.database.passwordFile}')"
      '' + ''
-        if [ `psql -c \
-                "select count(*) from pg_class c \
-                join pg_namespace s on s.oid = c.relnamespace \
-                where s.nspname not in ('pg_catalog', 'pg_toast', 'information_schema') \
-                and s.nspname not like 'pg_temp%';" | sed -n 3p` -eq 0 ]; then
+        result="$(psql -t --csv -c \
+            "select count(*) from pg_class c \
+            join pg_namespace s on s.oid = c.relnamespace \
+            where s.nspname not in ('pg_catalog', 'pg_toast', 'information_schema') \
+            and s.nspname not like 'pg_temp%';")" || error_code=$?
+        if [ "''${error_code:-0}" -ne 0 ]; then
+          echo "Failure checking if database is seeded. psql gave exit code $error_code"
+          exit "$error_code"
+        fi
+        if [ "$result" -eq 0 ]; then
          echo "Seeding database"
          SAFETY_ASSURED=1 rails db:schema:load
          rails db:seed
--- a/nixos/modules/services/web-apps/ocis.md
+++ b/nixos/modules/services/web-apps/ocis.md
@ -0,0 +1,113 @@
+# ownCloud Infinite Scale {#module-services-ocis}
+
+[ownCloud Infinite Scale](https://owncloud.dev/ocis/) (oCIS) is an open-source,
+modern file-sync and sharing platform. It is a ground-up rewrite of the well-known PHP based ownCloud server.
+
+The server setup can be automated using
+[services.ocis](#opt-services.ocis.enable). The desktop client is packaged at
+`pkgs.owncloud-client`.
+
+## Basic usage {#module-services-ocis-basic-usage}
+
+oCIS is a golang application and does not require an HTTP server (such as nginx)
+in front of it, though you may optionally use one if you will.
+
+oCIS is configured using a combination of yaml and environment variables. It is
+recommended to familiarize yourself with upstream's available configuration
+options and deployment instructions:
+
+* [Getting Started](https://owncloud.dev/ocis/getting-started/)
+* [Configuration](https://owncloud.dev/ocis/config/)
+* [Basic Setup](https://owncloud.dev/ocis/deployment/basic-remote-setup/)
+
+A very basic configuration may look like this:
+```
+{ pkgs, ... }:
+{
+  services.ocis = {
+    enable = true;
+    configDir = "/etc/ocis/config";
+  };
+}
+```
+
+This will start the oCIS server and make it available at `https://localhost:9200`
+
+However to make this configuration work you will need generate a configuration.
+You can do this with:
+
+```console
+$ nix-shell -p ocis-bin
+$ mkdir scratch/
+$ cd scratch/
+$ ocis init --config-path . --admin-password "changeme"
+```
+
+You may need to pass `--insecure true` or provide the `OCIS_INSECURE = true;` to
+[`services.ocis.environment`][mod-envFile], if TLS certificates are generated
+and managed externally (e.g. if you are using oCIS behind reverse proxy).
+
+If you want to manage the config file in your nix configuration, then it is
+encouraged to use a secrets manager like sops-nix or agenix.
+
+Be careful not to write files containing secrets to the globally readable nix
+store.
+
+Please note that current NixOS module for oCIS is configured to run in `fullstack`
+mode, which starts all the services for owncloud on single instance. This will
+start multiple ocis services and listen on multiple other ports.
+
+Current known services and their ports are as below:
+
+| Service            | Group   |  Port |
+|--------------------|---------|-------|
+| gateway            | api     |  9142 |
+| sharing            | api     |  9150 |
+| app-registry       | api     |  9242 |
+| ocdav              | web     | 45023 |
+| auth-machine       | api     |  9166 |
+| storage-system     | api     |  9215 |
+| webdav             | web     |  9115 |
+| webfinger          | web     | 46871 |
+| storage-system     | web     |  9216 |
+| web                | web     |  9100 |
+| eventhistory       | api     | 33177 |
+| ocs                | web     |  9110 |
+| storage-publiclink | api     |  9178 |
+| settings           | web     |  9190 |
+| ocm                | api     |  9282 |
+| settings           | api     |  9191 |
+| ocm                | web     |  9280 |
+| app-provider       | api     |  9164 |
+| storage-users      | api     |  9157 |
+| auth-service       | api     |  9199 |
+| thumbnails         | web     |  9186 |
+| thumbnails         | api     |  9185 |
+| storage-shares     | api     |  9154 |
+| sse                | sse     | 46833 |
+| userlog            | userlog | 45363 |
+| search             | api     |  9220 |
+| proxy              | web     |  9200 |
+| idp                | web     |  9130 |
+| frontend           | web     |  9140 |
+| groups             | api     |  9160 |
+| graph              | graph   |  9120 |
+| users              | api     |  9144 |
+| auth-basic         | api     |  9146 |
+
+## Configuration via environment variables
+
+You can also eschew the config file entirely and pass everything to oCIS via
+environment variables. For this make use of
+[`services.ocis.environment`][mod-env] for non-sensitive
+values, and
+[`services.ocis.environmentFile`][mod-envFile] for
+sensitive values.
+
+Configuration in (`services.ocis.environment`)[mod-env] overrides those from
+[`services.ocis.environmentFile`][mod-envFile] and will have highest
+precedence
+
+
+[mod-env]: #opt-services.ocis.environment
+[mod-envFile]: #opt-services.ocis.environmentFile
--- a/nixos/modules/services/web-apps/ocis.nix
+++ b/nixos/modules/services/web-apps/ocis.nix
@ -0,0 +1,201 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib) types;
+  cfg = config.services.ocis;
+  defaultUser = "ocis";
+  defaultGroup = defaultUser;
+in
+{
+  options = {
+    services.ocis = {
+      enable = lib.mkEnableOption "ownCloud Infinite Scale";
+
+      package = lib.mkPackageOption pkgs "ocis-bin" { };
+
+      configDir = lib.mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        example = "/var/lib/ocis/config";
+        description = lib.mdDoc ''
+          Path to directory containing oCIS config file.
+
+          Example config can be generated by `ocis init --config-path fileName --admin-password "adminPass"`.
+          Add `--insecure true` if SSL certificates are generated and managed externally (e.g. using oCIS behind reverse proxy).
+
+          Note: This directory must contain at least a `ocis.yaml`. Ensure
+          [user](#opt-services.ocis.user) has read/write access to it. In some
+          circumstances you may need to add additional oCIS configuration files (e.g.,
+          `proxy.yaml`) to this directory.
+        '';
+      };
+
+      environmentFile = lib.mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        example = "/run/keys/ocis.env";
+        description = lib.mdDoc ''
+          An environment file as defined in {manpage}`systemd.exec(5)`.
+
+          Configuration provided in this file will override those from [configDir](#opt-services.ocis.configDir)/ocis.yaml.
+        '';
+      };
+
+      user = lib.mkOption {
+        type = types.str;
+        default = defaultUser;
+        example = "yourUser";
+        description = lib.mdDoc ''
+          The user to run oCIS as.
+          By default, a user named `${defaultUser}` will be created whose home
+          directory is [stateDir](#opt-services.ocis.stateDir).
+        '';
+      };
+
+      group = lib.mkOption {
+        type = types.str;
+        default = defaultGroup;
+        example = "yourGroup";
+        description = lib.mdDoc ''
+          The group to run oCIS under.
+          By default, a group named `${defaultGroup}` will be created.
+        '';
+      };
+
+      address = lib.mkOption {
+        type = types.str;
+        default = "127.0.0.1";
+        description = "Web interface address.";
+      };
+
+      port = lib.mkOption {
+        type = types.port;
+        default = 9200;
+        description = "Web interface port.";
+      };
+
+      url = lib.mkOption {
+        type = types.str;
+        default = "https://localhost:9200";
+        example = "https://some-hostname-or-ip:9200";
+        description = "Web interface address.";
+      };
+
+      stateDir = lib.mkOption {
+        default = "/var/lib/ocis";
+        type = types.str;
+        description = "ownCloud data directory.";
+      };
+
+      environment = lib.mkOption {
+        type = types.attrsOf types.str;
+        default = { };
+        description = lib.mdDoc ''
+          Extra config options.
+
+          See [the documentation](https://doc.owncloud.com/ocis/next/deployment/services/services.html) for available options.
+          See [notes for environment variables](https://doc.owncloud.com/ocis/next/deployment/services/env-var-note.html) for more information.
+
+          Note that all the attributes here will be copied to /nix/store/ and will be world readable. Options like *_PASSWORD or *_SECRET should be part of     [environmentFile](#opt-services.ocis.environmentFile) instead, and are only provided here for illustrative purpose.
+
+          Configuration here will override those from [environmentFile](#opt-services.ocis.environmentFile) and will have highest precedence, at the cost of security. Do NOT put security sensitive stuff here.
+        '';
+        example = {
+          OCIS_INSECURE = "false";
+          OCIS_LOG_LEVEL = "error";
+          OCIS_JWT_SECRET = "super_secret";
+          OCIS_TRANSFER_SECRET = "foo";
+          OCIS_MACHINE_AUTH_API_KEY = "foo";
+          OCIS_SYSTEM_USER_ID = "123";
+          OCIS_MOUNT_ID = "123";
+          OCIS_STORAGE_USERS_MOUNT_ID = "123";
+          GATEWAY_STORAGE_USERS_MOUNT_ID = "123";
+          CS3_ALLOW_INSECURE = "true";
+          OCIS_INSECURE_BACKENDS = "true";
+          TLS_INSECURE = "true";
+          TLS_SKIP_VERIFY_CLIENT_CERT = "true";
+          WEBDAV_ALLOW_INSECURE = "true";
+          IDP_TLS = "false";
+          GRAPH_APPLICATION_ID = "1234";
+          IDM_IDPSVC_PASSWORD = "password";
+          IDM_REVASVC_PASSWORD = "password";
+          IDM_SVC_PASSWORD = "password";
+          IDP_ISS = "https://localhost:9200";
+          OCIS_LDAP_BIND_PASSWORD = "password";
+          OCIS_SERVICE_ACCOUNT_ID = "foo";
+          OCIS_SERVICE_ACCOUNT_SECRET = "foo";
+          OCIS_SYSTEM_USER_API_KEY = "foo";
+          STORAGE_USERS_MOUNT_ID = "123";
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.users.${defaultUser} = lib.mkIf (cfg.user == defaultUser) {
+      group = cfg.group;
+      home = cfg.stateDir;
+      isSystemUser = true;
+      createHome = true;
+      description = "ownCloud Infinite Scale daemon user";
+    };
+
+    users.groups = lib.mkIf (cfg.group == defaultGroup) { ${defaultGroup} = { }; };
+
+    systemd = {
+      services.ocis = {
+        description = "ownCloud Infinite Scale Stack";
+        wantedBy = [ "multi-user.target" ];
+        environment = {
+          PROXY_HTTP_ADDR = "${cfg.address}:${toString cfg.port}";
+          OCIS_URL = cfg.url;
+          OCIS_CONFIG_DIR = if (cfg.configDir == null) then "${cfg.stateDir}/config" else cfg.configDir;
+          OCIS_BASE_DATA_PATH = cfg.stateDir;
+        } // cfg.environment;
+        serviceConfig = {
+          Type = "simple";
+          ExecStart = "${lib.getExe cfg.package} server";
+          WorkingDirectory = cfg.stateDir;
+          User = cfg.user;
+          Group = cfg.group;
+          Restart = "always";
+          EnvironmentFile = lib.optional (cfg.environmentFile != null) cfg.environmentFile;
+          ReadWritePaths = [ cfg.stateDir ];
+          ReadOnlyPaths = [ cfg.configDir ];
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateTmp = true;
+          PrivateDevices = true;
+          ProtectSystem = "strict";
+          ProtectHome = true;
+          ProtectControlGroups = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectKernelLogs = true;
+          RestrictAddressFamilies = [
+            "AF_UNIX"
+            "AF_INET"
+            "AF_INET6"
+            "AF_NETLINK"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          LockPersonality = true;
+          SystemCallArchitectures = "native";
+        };
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [
+    bhankas
+    danth
+    ramblurr
+  ];
+}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -648,6 +648,7 @@ in {
  nvmetcfg = handleTest ./nvmetcfg.nix {};
  nzbget = handleTest ./nzbget.nix {};
  nzbhydra2 = handleTest ./nzbhydra2.nix {};
+  ocis = handleTest ./ocis.nix {};
  oh-my-zsh = handleTest ./oh-my-zsh.nix {};
  ollama = handleTest ./ollama.nix {};
  ombi = handleTest ./ombi.nix {};
--- a/nixos/tests/gitlab.nix
+++ b/nixos/tests/gitlab.nix
@ -89,6 +89,10 @@ in {
          dbFile = pkgs.writeText "dbsecret" "we2quaeZ";
          jwsFile = pkgs.runCommand "oidcKeyBase" {} "${pkgs.openssl}/bin/openssl genrsa 2048 > $out";
        };
+
+        # reduce memory usage
+        sidekiq.concurrency = 1;
+        puma.workers = 2;
      };
    };
  };
--- a/nixos/tests/ocis.nix
+++ b/nixos/tests/ocis.nix
@ -0,0 +1,217 @@
+import ./make-test-python.nix (
+  { lib, pkgs, ... }:
+
+  let
+    # this is a demo user created by IDM_CREATE_DEMO_USERS=true
+    demoUser = "einstein";
+    demoPassword = "relativity";
+
+    adminUser = "admin";
+    adminPassword = "hunter2";
+    testRunner =
+      pkgs.writers.writePython3Bin "test-runner"
+        {
+          libraries = [ pkgs.python3Packages.selenium ];
+          flakeIgnore = [ "E501" ];
+        }
+        ''
+          import sys
+          from selenium.webdriver.common.by import By
+          from selenium.webdriver import Firefox
+          from selenium.webdriver.firefox.options import Options
+          from selenium.webdriver.support.ui import WebDriverWait
+          from selenium.webdriver.support import expected_conditions as EC
+
+          options = Options()
+          options.add_argument('--headless')
+          driver = Firefox(options=options)
+
+          user = sys.argv[1]
+          password = sys.argv[2]
+          driver.implicitly_wait(20)
+          driver.get('https://localhost:9200/login')
+          wait = WebDriverWait(driver, 10)
+          wait.until(EC.title_contains("Sign in"))
+          driver.find_element(By.XPATH, '//*[@id="oc-login-username"]').send_keys(user)
+          driver.find_element(By.XPATH, '//*[@id="oc-login-password"]').send_keys(password)
+          driver.find_element(By.XPATH, '//*[@id="root"]//button').click()
+          wait.until(EC.title_contains("Personal"))
+        '';
+
+    # This was generated with `ocis init --config-path testconfig/ --admin-password "hunter2" --insecure true`.
+    testConfig = ''
+      token_manager:
+        jwt_secret: kaKYgfso*d9GA-yTM.&BTOUEuMz%Ai0H
+      machine_auth_api_key: sGWRG1JZ&qe&pe@N1HKK4#qH*B&@xLnO
+      system_user_api_key: h+m4aHPUtOtUJFKrc5B2=04C=7fDZaT-
+      transfer_secret: 4-R6AfUjQn0P&+h2+$skf0lJqmre$j=x
+      system_user_id: db180e0a-b38a-4edf-a4cd-a3d358248537
+      admin_user_id: ea623f50-742d-4fd0-95bb-c61767b070d4
+      graph:
+        application:
+          id: 11971eab-d560-4b95-a2d4-50726676bbd0
+        events:
+          tls_insecure: true
+        spaces:
+          insecure: true
+        identity:
+          ldap:
+            bind_password: ^F&Vn7@mYGYGuxr$#qm^gGy@FVq=.w=y
+        service_account:
+          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
+      idp:
+        ldap:
+          bind_password: bv53IjS28x.nxth*%aRbE70%4TGNXbLU
+      idm:
+        service_user_passwords:
+          admin_password: hunter2
+          idm_password: ^F&Vn7@mYGYGuxr$#qm^gGy@FVq=.w=y
+          reva_password: z-%@fWipLliR8lD#fl.0teC#9QbhJ^eb
+          idp_password: bv53IjS28x.nxth*%aRbE70%4TGNXbLU
+      proxy:
+        oidc:
+          insecure: true
+        insecure_backends: true
+        service_account:
+          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
+      frontend:
+        app_handler:
+          insecure: true
+        archiver:
+          insecure: true
+        service_account:
+          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
+      auth_basic:
+        auth_providers:
+          ldap:
+            bind_password: z-%@fWipLliR8lD#fl.0teC#9QbhJ^eb
+      auth_bearer:
+        auth_providers:
+          oidc:
+            insecure: true
+      users:
+        drivers:
+          ldap:
+            bind_password: z-%@fWipLliR8lD#fl.0teC#9QbhJ^eb
+      groups:
+        drivers:
+          ldap:
+            bind_password: z-%@fWipLliR8lD#fl.0teC#9QbhJ^eb
+      ocdav:
+        insecure: true
+      ocm:
+        service_account:
+          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
+      thumbnails:
+        thumbnail:
+          transfer_secret: 2%11!zAu*AYE&=d*8dfoZs8jK&5ZMm*%
+          webdav_allow_insecure: true
+          cs3_allow_insecure: true
+      search:
+        events:
+          tls_insecure: true
+        service_account:
+          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
+      audit:
+        events:
+          tls_insecure: true
+      settings:
+        service_account_ids:
+        - df39a290-3f3e-4e39-b67b-8b810ca2abac
+      sharing:
+        events:
+          tls_insecure: true
+      storage_users:
+        events:
+          tls_insecure: true
+        mount_id: ef72cb8b-809c-4592-bfd2-1df603295205
+        service_account:
+          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
+      notifications:
+        notifications:
+          events:
+            tls_insecure: true
+        service_account:
+          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
+      nats:
+        nats:
+          tls_skip_verify_client_cert: true
+      gateway:
+        storage_registry:
+          storage_users_mount_id: ef72cb8b-809c-4592-bfd2-1df603295205
+      userlog:
+        service_account:
+          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
+      auth_service:
+        service_account:
+          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
+      clientlog:
+        service_account:
+          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE'';
+  in
+
+  {
+    name = "ocis";
+
+    meta.maintainers = with lib.maintainers; [
+      bhankas
+      ramblurr
+    ];
+
+    nodes.machine =
+      { config, ... }:
+      {
+        virtualisation.memorySize = 2048;
+        environment.systemPackages = [
+          pkgs.firefox-unwrapped
+          pkgs.geckodriver
+          testRunner
+        ];
+
+        # if you do this in production, dont put secrets in this file because it will be written to the world readable nix store
+        environment.etc."ocis/ocis.env".text = ''
+          ADMIN_PASSWORD=${adminPassword}
+          IDM_CREATE_DEMO_USERS=true
+        '';
+
+        # if you do this in production, dont put secrets in this file because it will be written to the world readable nix store
+        environment.etc."ocis/config/ocis.yaml".text = testConfig;
+
+        services.ocis = {
+          enable = true;
+          configDir = "/etc/ocis/config";
+          environment = {
+            OCIS_INSECURE = "true";
+          };
+          environmentFile = "/etc/ocis/ocis.env";
+        };
+      };
+
+    testScript = ''
+      start_all()
+      machine.wait_for_unit("ocis.service")
+      machine.wait_for_open_port(9200)
+      # wait for ocis to fully come up
+      machine.sleep(5)
+
+      with subtest("ocis bin works"):
+          machine.succeed("${lib.getExe pkgs.ocis-bin} version")
+
+      with subtest("use the web interface to log in with a demo user"):
+          machine.succeed("PYTHONUNBUFFERED=1 systemd-cat -t test-runner test-runner ${demoUser} ${demoPassword}")
+
+      with subtest("use the web interface to log in with the provisioned admin user"):
+          machine.succeed("PYTHONUNBUFFERED=1 systemd-cat -t test-runner test-runner ${adminUser} ${adminPassword}")
+    '';
+  }
+)
--- a/nixos/tests/redmine.nix
+++ b/nixos/tests/redmine.nix
@ -39,6 +39,7 @@ let
    meta.maintainers = [ maintainers.aanderse ];
  };
 in {
+  sqlite3 = redmineTest { name = "sqlite3"; type = "sqlite3"; };
  mysql = redmineTest { name = "mysql"; type = "mysql2"; };
  pgsql = redmineTest { name = "pgsql"; type = "postgresql"; };
 }
--- a/pkgs/applications/audio/musescore/default.nix
+++ b/pkgs/applications/audio/musescore/default.nix
@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchFromGitHub
-, fetchpatch
 , cmake
 , wrapQtAppsHook
 , pkg-config
@ -129,7 +128,7 @@ in stdenv'.mkDerivation (finalAttrs: {
    mkdir -p "$out/Applications"
    mv "$out/mscore.app" "$out/Applications/mscore.app"
    mkdir -p $out/bin
-    ln -s $out/Applications/mscore.app/Contents/MacOS/mscore $out/bin/mscore.
+    ln -s $out/Applications/mscore.app/Contents/MacOS/mscore $out/bin/mscore
  '';

  # Don't run bundled upstreams tests, as they require a running X window system.
@ -143,5 +142,6 @@ in stdenv'.mkDerivation (finalAttrs: {
    license = licenses.gpl3Only;
    maintainers = with maintainers; [ vandenoever doronbehar ];
    mainProgram = "mscore";
+    platforms = platforms.unix;
  };
 })
--- a/pkgs/applications/editors/nano/default.nix
+++ b/pkgs/applications/editors/nano/default.nix
@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, fetchFromGitHub, ncurses, texinfo, writeScript
-, common-updater-scripts, git, nix, nixfmt, coreutils, gnused, callPackage
+, common-updater-scripts, git, nix, nixfmt-classic, coreutils, gnused, callPackage
 , file ? null, gettext ? null, enableNls ? true, enableTiny ? false }:

 assert enableNls -> (gettext != null);
@ -48,7 +48,7 @@ in stdenv.mkDerivation rec {
        lib.makeBinPath [
          common-updater-scripts
          git
-          nixfmt
+          nixfmt-classic
          nix
          coreutils
          gnused
--- a/pkgs/applications/editors/vim/plugins/deprecated.json
+++ b/pkgs/applications/editors/vim/plugins/deprecated.json
@ -48,7 +48,7 @@
        "new": "sqlite-lua"
    },
    "vim-fsharp": {
-        "date": "2024-03-16",
+        "date": "2024-04-02",
        "new": "zarchive-vim-fsharp"
    },
    "vim-jade": {
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -1017,7 +1017,7 @@
        inherit (old) version src;
        sourceRoot = "${old.src.name}/spectre_oxi";

-        cargoHash = "sha256-VDnrJ2EJ8LDykqxYKD1VR8BkDqzzifazJzL/0UsmSCk=";
+        cargoHash = "sha256-tWJyVBYYQWr3ofYnbvfQZdzPQ9o//7XEbdjN5b2frPo=";


        preCheck = ''
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -690,8 +690,8 @@ let
        mktplcRef = {
          name = "vscode-intelephense-client";
          publisher = "bmewburn";
-          version = "1.10.2";
-          sha256 = "sha256-he/aPcsxfqYWI/RJ51d5V0reaTPTATci34xPm93qxGs=";
+          version = "1.10.4";
+          sha256 = "sha256-bD7AL4x0yL5S+MzQXMBrSZs1pVclfvsTfUbImP1oQok=";
        };
        meta = {
          description = "PHP code intelligence for Visual Studio Code";
--- a/pkgs/applications/file-managers/lf/default.nix
+++ b/pkgs/applications/file-managers/lf/default.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "lf";
-  version = "31";
+  version = "32";

  src = fetchFromGitHub {
    owner = "gokcehan";
    repo = "lf";
    rev = "r${version}";
-    hash = "sha256-Tuk/4R/gGtSY+4M/+OhQCbhXftZGoxZ0SeLIwYjTLA4=";
+    hash = "sha256-rFK1M15NcshVY2vtXcMWZhB9Rd/DRC8JyKE5u4wjh2I=";
  };

-  vendorHash = "sha256-PVvHrXfMN6ZSWqd5GJ08VaeKaHrFsz6FKdDoe0tk2BE=";
+  vendorHash = "sha256-r1Kq6CYGNbxTTue3sb3CKMsWZJDzX2dKX7QHQ73nZ8g=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/misc/1password-gui/default.nix
+++ b/pkgs/applications/misc/1password-gui/default.nix
@ -9,43 +9,43 @@
 let

  pname = "1password";
-  version = if channel == "stable" then "8.10.27" else "8.10.28-21.BETA";
+  version = if channel == "stable" then "8.10.28" else "8.10.30-11.BETA";

  sources = {
    stable = {
      x86_64-linux = {
        url = "https://downloads.1password.com/linux/tar/stable/x86_64/1password-${version}.x64.tar.gz";
-        hash = "sha256-xQQXPDC8mvQyC+z3y0n5KpRpLjrBeslwXPf28wfKVSM=";
+        hash = "sha256-1EfP8z+vH0yRklkcxCOPYExu13iFcs6jOdvWBzl64BA=";
      };
      aarch64-linux = {
        url = "https://downloads.1password.com/linux/tar/stable/aarch64/1password-${version}.arm64.tar.gz";
-        hash = "sha256-c26G/Zp+1Y6ZzGYeybFBJOB2gDx3k+4/Uu7sMlXHYjM=";
+        hash = "sha256-E4MfpHVIn5Vu/TcDgwkoHdSnKthaAMFJZArnmSH5cxA=";
      };
      x86_64-darwin = {
        url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        hash = "sha256-9LrSJ9PLRXFbA7xkBbqFIZVtAuy7UrDBh7e6rlLqrM0=";
+        hash = "sha256-+cXirJyDnxfE5FN8HEIrEyyoGvVrJ+0ykBHON9oHAek=";
      };
      aarch64-darwin = {
        url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        hash = "sha256-4oqpsRZ10y2uh2gp4QyHfUdKER8v8n8mjNFVwKRYkpo=";
+        hash = "sha256-zKAgAKYIgy5gZbe2IpskV8DG8AKtamYqq8cF/mTpRss=";
      };
    };
    beta = {
      x86_64-linux = {
        url = "https://downloads.1password.com/linux/tar/beta/x86_64/1password-${version}.x64.tar.gz";
-        hash = "sha256-Pz9tpGsKLmf37r0fnBxcE7qGjN3RZSF/iwQUnqev0Jk=";
+        hash = "sha256-6zyDZRsk9FZXJuGqqt1kCATcL99PjYP/wQzqE/4e4kg=";
      };
      aarch64-linux = {
        url = "https://downloads.1password.com/linux/tar/beta/aarch64/1password-${version}.arm64.tar.gz";
-        hash = "sha256-ezzdwUUcSBqJUKlG1By5HXbgrTFDpaGIJipU+V1FUBc=";
+        hash = "sha256-JwHk6Byqd5LxVWBT/blRVnYhgSeYfaVY3Ax4GkLcFxM=";
      };
      x86_64-darwin = {
        url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        hash = "sha256-zFO8ypDqPGcJY/2eKke/ljQ4S3syI7jyZSexbYzBA+c=";
+        hash = "sha256-h7vJguOEQBEvX9Z9MjdLj0hPnn8hJpeWRoduVowznLg=";
      };
      aarch64-darwin = {
        url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        hash = "sha256-LAhGmXqfcgjiDbE0RLhzpi15rluM8/fZ3GZ52yHdMKg=";
+        hash = "sha256-g6lorMdQ56B6gd4YN4WQSkztwHqIgO7QshM1zocpqTE=";
      };
    };
  };
--- a/pkgs/applications/misc/cherrytree/default.nix
+++ b/pkgs/applications/misc/cherrytree/default.nix
@ -20,13 +20,13 @@

 stdenv.mkDerivation rec {
  pname = "cherrytree";
-  version = "1.0.4";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "giuspen";
    repo = "cherrytree";
    rev = "refs/tags/v${version}";
-    hash = "sha256-SMx3a0pzhNahRzmenZwPQPCBgqoBGo9n3RcNcimNGBE=";
+    hash = "sha256-YoHaWc/olJrbV1A4hqDgYOLVlpHBrgI0x2TFr9oeqh4=";
  };

  nativeBuildInputs = [
@ -66,5 +66,6 @@ stdenv.mkDerivation rec {
    changelog = "https://raw.githubusercontent.com/giuspen/cherrytree/${version}/changelog.txt";
    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ ];
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/misc/nwg-panel/default.nix
+++ b/pkgs/applications/misc/nwg-panel/default.nix
@ -16,13 +16,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "nwg-panel";
-  version = "0.9.26";
+  version = "0.9.27";

  src = fetchFromGitHub {
    owner = "nwg-piotr";
    repo = "nwg-panel";
    rev = "refs/tags/v${version}";
-    hash = "sha256-FGSMXiVygkA3thHtWaA6s5Kz96PYZgMzQQwIjOr6a0c=";
+    hash = "sha256-GCaqFqoZ7lfyE3VD3Dgz8jVt9TtUq3XVzVeI6g3SO5E=";
  };

  # No tests
--- a/pkgs/applications/misc/prusa-slicer/meshboolean-const.patch
+++ b/pkgs/applications/misc/prusa-slicer/meshboolean-const.patch
@ -0,0 +1,19 @@
+diff --git a/src/libslic3r/MeshBoolean.cpp b/src/libslic3r/MeshBoolean.cpp
+index 31fdc35..32acbf8 100644
+--- a/src/libslic3r/MeshBoolean.cpp
+++ b/src/libslic3r/MeshBoolean.cpp
+@@ -147,12 +147,12 @@ template<class _Mesh> TriangleMesh cgal_to_triangle_mesh(const _Mesh &cgalmesh)
+     const auto &vertices = cgalmesh.vertices();
+     int vsize = int(vertices.size());
+ 
+-    for (auto &vi : vertices) {
+    for (const auto &vi : vertices) {
+         auto &v = cgalmesh.point(vi); // Don't ask...
+         its.vertices.emplace_back(to_vec3f(v));
+     }
+ 
+-    for (auto &face : faces) {
+    for (const auto &face : faces) {
+         auto vtc = cgalmesh.vertices_around_face(cgalmesh.halfedge(face));
+ 
+         int i = 0;
--- a/pkgs/applications/misc/prusa-slicer/super-slicer.nix
+++ b/pkgs/applications/misc/prusa-slicer/super-slicer.nix
@ -16,6 +16,7 @@ let
      ];
      sha256 = "sha256-v0q2MhySayij7+qBTE5q01IOq/DyUcWnjpbzB/AV34c=";
    })
+    ./meshboolean-const.patch
  ];

  versions = {
--- a/pkgs/applications/misc/revanced-cli/default.nix
+++ b/pkgs/applications/misc/revanced-cli/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "revanced-cli";
-  version = "4.5.0";
+  version = "4.6.0";

  src = fetchurl {
    url = "https://github.com/revanced/revanced-cli/releases/download/v${version}/revanced-cli-${version}-all.jar";
-    hash = "sha256-I25SmWUVJenFou1fKCd53PojoGt9FAQ7hDpEWweAICQ=";
+    hash = "sha256-QQH7aEkfBULqAvJ0FsKFxrraFjg1m1JJnuDtyvLJXEk=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/networking/browsers/chromium/update.py
+++ b/pkgs/applications/networking/browsers/chromium/update.py
@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i python -p python3 nix nixfmt nix-prefetch-git
+#! nix-shell -i python -p python3 nix nixfmt-classic nix-prefetch-git

 """This script automatically updates chromium, google-chrome, chromedriver, and ungoogled-chromium
 via upstream-info.nix."""
--- a/pkgs/applications/networking/browsers/floorp/default.nix
+++ b/pkgs/applications/networking/browsers/floorp/default.nix
@ -7,7 +7,7 @@

 ((buildMozillaMach rec {
  pname = "floorp";
-  packageVersion = "11.10.5";
+  packageVersion = "11.11.2";
  applicationName = "Floorp";
  binaryName = "floorp";
  branding = "browser/branding/official";
@ -15,14 +15,14 @@
  allowAddonSideload = true;

  # Must match the contents of `browser/config/version.txt` in the source tree
-  version = "115.8.0";
+  version = "115.10.0";

  src = fetchFromGitHub {
    owner = "Floorp-Projects";
    repo = "Floorp";
    fetchSubmodules = true;
    rev = "v${packageVersion}";
-    hash = "sha256-uKgN74xn0v86E/YfqbJNnMIR3gS+3dhdgLJ5VUerurQ=";
+    hash = "sha256-a9f4+t2w8aOOLNaKkr+FuY0ENa/Nkukg9pvJTiUMfWk=";
  };

  extraConfigureFlags = [
@ -31,6 +31,8 @@
    "--with-unsigned-addon-scopes=app,system"
  ];

+  updateScript = ./update.sh;
+
  meta = {
    description = "A fork of Firefox, focused on keeping the Open, Private and Sustainable Web alive, built in Japan";
    homepage = "https://floorp.app/";
--- a/pkgs/applications/networking/browsers/floorp/update.sh
+++ b/pkgs/applications/networking/browsers/floorp/update.sh
@ -0,0 +1,38 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl nix-prefetch-github jq gnused
+
+set -e
+
+owner=Floorp-Projects
+repo=Floorp
+dirname="$(dirname "$0")"
+
+updateVersion() {
+    sed -i "s/packageVersion = \"[0-9.]*\";/packageVersion = \"$1\";/g" "$dirname/default.nix"
+}
+
+updateBaseVersion() {
+    local base
+    base=$(curl -s "https://raw.githubusercontent.com/$owner/$repo/v$1/browser/config/version.txt")
+    sed -i "s/version = \"[0-9.]*\";/version = \"$base\";/g" "$dirname/default.nix"
+}
+
+updateHash() {
+    local hash
+    hash=$(nix-prefetch-github --fetch-submodules --rev "v$1" $owner $repo | jq .hash)
+    sed -i "s|hash = \"[a-zA-Z0-9\/+-=]*\";|hash = \"$hash\";|g" "$dirname/default.nix"
+}
+
+currentVersion=$(cd "$dirname" && nix eval --raw -f ../../../../.. floorp.version)
+
+latestTag=$(curl -s https://api.github.com/repos/Floorp-Projects/Floorp/releases/latest | jq -r ".tag_name")
+latestVersion="$(expr "$latestTag" : 'v\(.*\)')"
+
+if [[ "$currentVersion" == "$latestVersion" ]]; then
+    echo "Floorp is up-to-date: ${currentVersion}"
+    exit 0
+fi
+
+updateVersion "$latestVersion"
+updateBaseVersion "$latestVersion"
+updateHash "$latestVersion"
--- a/pkgs/applications/networking/browsers/microsoft-edge/browser.nix
+++ b/pkgs/applications/networking/browsers/microsoft-edge/browser.nix
@ -22,6 +22,7 @@
 , expat
 , libdrm
 , libxkbcommon
+, pipewire
 , gtk3
 , pango
 , cairo
@ -81,7 +82,7 @@ stdenv.mkDerivation rec {
        xorg.libxcb cups.lib dbus.lib expat libdrm
        xorg.libXcomposite xorg.libXdamage xorg.libXext
        xorg.libXfixes xorg.libXrandr libxkbcommon
-        gtk3 pango cairo gdk-pixbuf mesa
+        pipewire gtk3 pango cairo gdk-pixbuf mesa
        alsa-lib at-spi2-core xorg.libxshmfence systemd wayland
      ];
      naclHelper = lib.makeLibraryPath [
--- a/pkgs/applications/networking/circumflex/default.nix
+++ b/pkgs/applications/networking/circumflex/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "circumflex";
-  version = "3.5";
+  version = "3.6";

  src = fetchFromGitHub {
    owner = "bensadeh";
    repo = "circumflex";
    rev = version;
-    hash = "sha256-w5QdFvF+kIxt27rg/uXjd+G0Dls7oYhmFew+O2NoaVg=";
+    hash = "sha256-FzJUmF2X4Iyf83cIEa8b8EFCcWUyYEZBVyvXuhiaaWM=";
  };

-  vendorHash = "sha256-F9mzGP5b9dcmnT6TvjjbRq/isk1o8vM/5yxWUaZrnaw=";
+  vendorHash = "sha256-x/NgcodS/hirXJHxBHeUP9MgOBHq1yQWHprMrlpqsas=";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/applications/networking/cluster/fn-cli/default.nix
+++ b/pkgs/applications/networking/cluster/fn-cli/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "fn";
-  version = "0.6.30";
+  version = "0.6.31";

  src = fetchFromGitHub {
    owner = "fnproject";
    repo = "cli";
    rev = version;
-    hash = "sha256-1j0Hd/SYoBhelCIFUFxkByczWSYFXjTE9TVH9E3Km+Y=";
+    hash = "sha256-tL5mygomRdxHdWUAp6umMOhyKq/ZFcjn+5wZcqD2mVA=";
  };

  vendorHash = null;
--- a/pkgs/applications/networking/cluster/k3s/1_26/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_26/versions.nix
@ -1,8 +1,8 @@
 {
-  k3sVersion = "1.26.14+k3s1";
-  k3sCommit = "c7e6922aa84369b3c0d28bb800e67bb162895a1c";
-  k3sRepoSha256 = "1spvyyzk711g4ik1pv21xaasy7va5l5gcvbfkamfv4ijn0wz4mjx";
-  k3sVendorHash = "sha256-ursq2Vq1J9MdkwDl3kKioxizhR46yo2urNc3VpwVH2A=";
+  k3sVersion = "1.26.15+k3s1";
+  k3sCommit = "132972364806998c35d250153e2af245f9ecf18d";
+  k3sRepoSha256 = "13iwmjxyf71l2g66kxdivnj21bf9lmr5p4qlp8kmysm23w2badj9";
+  k3sVendorHash = "sha256-xoscRchOK4p3d1DAnxbJq7oIvxIn1twePmOBDdfXzw8=";
  chartVersions = import ./chart-versions.nix;
  k3sRootVersion = "0.12.2";
  k3sRootSha256 = "1gjynvr350qni5mskgm7pcc7alss4gms4jmkiv453vs8mmma9c9k";
--- a/pkgs/applications/networking/cluster/k3s/1_28/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_28/versions.nix
@ -1,8 +1,8 @@
 {
-  k3sVersion = "1.28.7+k3s1";
-  k3sCommit = "051b14b248655896fdfd7ba6c93db6182cde7431";
-  k3sRepoSha256 = "1136h9xwg1p26lh3m63a4c55qsahla0d0xvlr09qqbhqiyv7fn0b";
-  k3sVendorHash = "sha256-FzalTtDleFIN12lvn0k7+nWchr6y/Ztcxs0bs2E4UO0=";
+  k3sVersion = "1.28.8+k3s1";
+  k3sCommit = "653dd61aaa2d0ef8bd83ac4dbc6d150dde792efc";
+  k3sRepoSha256 = "0pf8xw1m56m2s8i99vxj4i2l7fz7388kiynwzfrck43jb7v7kbbw";
+  k3sVendorHash = "sha256-wglwRW2RO9QJI6CRLgkVg5Upt6R0M3gX76zy0kT02ec=";
  chartVersions = import ./chart-versions.nix;
  k3sRootVersion = "0.12.2";
  k3sRootSha256 = "1gjynvr350qni5mskgm7pcc7alss4gms4jmkiv453vs8mmma9c9k";
--- a/pkgs/applications/networking/cluster/k3s/1_29/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_29/versions.nix
@ -1,8 +1,8 @@
 {
-  k3sVersion = "1.29.2+k3s1";
-  k3sCommit = "86f102134ed6b1669badd3bfb6420f73e8f015d0";
-  k3sRepoSha256 = "0gd35ficik92x4svcg4mlw1v6vms7sfw1asmdahh16li4j27wdz5";
-  k3sVendorHash = "sha256-KG795CA3l+iCdJlYMNTQLmv3YqmtM2juacbsmH7B//M=";
+  k3sVersion = "1.29.3+k3s1";
+  k3sCommit = "8aecc26b0f167d5e9e4e9fbcfd5a471488bf5957";
+  k3sRepoSha256 = "12285mhwi6cifsw3gjxxmd1g2i5f7vkdgzdc6a78rkvnx7z1j3p3";
+  k3sVendorHash = "sha256-pID2h/rvvKyfHWoglYPbbliAby+9R2zoh7Ajd36qjVQ=";
  chartVersions = import ./chart-versions.nix;
  k3sRootVersion = "0.12.2";
  k3sRootSha256 = "1gjynvr350qni5mskgm7pcc7alss4gms4jmkiv453vs8mmma9c9k";
--- a/pkgs/applications/networking/cluster/k3s/README.md
+++ b/pkgs/applications/networking/cluster/k3s/README.md
@ -71,3 +71,44 @@ In order to resolve this issue, we propose backporting not just new patch releas

 In the above example, where NixOS 23.05 included k3s 1.26, and 23.11 included k3s 1.28, that means we would backport 1.27 to the NixOS 23.05 release, and backport all patches for 1.26 and 1.27.
 This would allow someone to upgrade between those NixOS releases in a supported configuration.
+
+
+## K3s upkeep for nixpkgs maintainers
+
+* A `nixos-stable` release triggers the need of re-setting K3s versions in `nixos-unstable` branch to a single K3s version. After every `nixos-stable` release, K3s maintainers should remove all K3s versions in `nixos-unstable` branch but the latest. While `nixos-stable` keeps the multiple K3s versions necessary for a smooth upgrade to `nixos-unstable`.
+
+* Whenever adding a new major/minor K3s version to nixpkgs:
+  - update `k3s` alias to the latest version.
+  - add a NixOS release note scheduling the removal of all K3s packages but the latest
+  - include migration information from both Kubernetes and K3s projects
+
+* For version patch upgrades, use the K3s update script.
+
+  To execute the update script, from nixpkgs git repository, run:
+
+  > ./pkgs/applications/networking/cluster/k3s/update-script.sh "29"
+
+  "29" being the target minor version to be updated.
+
+  On failure, the update script should be fixed. On failing to fix, open an issue reporting the update script breakage.
+
+  RyanTM bot can automatically do patch upgrades. Update logs are available at: https://r.ryantm.com/log/k3s_1_29/
+
+* When reviewing upgrades, check:
+
+  - At top-level, every K3s version should have the Go compiler pinned according to `go.mod` file.
+
+    Notice the update script does not automatically pin the Go version.
+
+  - K3s passthru.tests (Currently: single-node, multi-node, etcd) works for all architectures (linux-x86_64, aarch64-linux).
+
+    For GitHub CI, [OfBorg](https://github.com/NixOS/ofborg) can be used to test all platforms.
+
+    To test locally, at nixpkgs repository, run:
+    > nix build .#k3s_1_29.passthru.tests.{etcd,single-node,multi-node}
+
+    Replace "29" according to the version that you are testing.
+
+  - Read the nix build logs to check for anything unusual. (Obvious but underrated.)
+
+* Thank you for reading the documentation and your continued contribution.
--- a/pkgs/applications/networking/cluster/kubefirst/default.nix
+++ b/pkgs/applications/networking/cluster/kubefirst/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "kubefirst";
-  version = "2.4.2";
+  version = "2.4.3";

  src = fetchFromGitHub {
    owner = "kubefirst";
    repo = "kubefirst";
    rev = "refs/tags/v${version}";
-    hash = "sha256-fw2DmgAiCsEw5lkeZOiU5ptAFb13BDTx09Js6IO28Ww=";
+    hash = "sha256-wxIXXCB7+s3RfDjSxwlp0BBTZMb/9GFZ7cYm7L471U8=";
  };

  vendorHash = "sha256-ZcZl4knlyKAwTsiyZvlkN5e2ox30B5aNzutI/2UEE9U=";
--- a/pkgs/applications/networking/instant-messengers/abaddon/default.nix
+++ b/pkgs/applications/networking/instant-messengers/abaddon/default.nix
@ -20,13 +20,13 @@

 stdenv.mkDerivation rec {
  pname = "abaddon";
-  version = "0.1.14";
+  version = "0.2.0";

  src = fetchFromGitHub {
    owner = "uowuo";
    repo = "abaddon";
    rev = "v${version}";
-    hash = "sha256-Amp6PkQWd4PnwUL29fzGETLuQXVEaARr+jIRlfrxTKc=";
+    hash = "sha256-Gl4BI+bkYuc5RtClfTth+WQ4EVYCWn0xnFOaQpS7yq0=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/networking/instant-messengers/beeper/default.nix
+++ b/pkgs/applications/networking/instant-messengers/beeper/default.nix
@ -11,11 +11,11 @@
 }:
 let
  pname = "beeper";
-  version = "3.101.24";
+  version = "3.102.10";
  name = "${pname}-${version}";
  src = fetchurl {
-    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.101.24-build-240322frr3t3orv-x86_64.AppImage";
-    hash = "sha256-yfkWvPYQhI8cfXfmmyi2LoSro1jxJRWy9phycv5TUL8=";
+    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.102.10-build-2403272qaonqz6e-x86_64.AppImage";
+    hash = "sha256-rI9gUfFX5nffSawTKPII/gXE+FkzGDE18/ByGiJu8CU=";
  };
  appimage = appimageTools.wrapType2 {
    inherit version pname src;
--- a/pkgs/applications/networking/sync/backintime/common.nix
+++ b/pkgs/applications/networking/sync/backintime/common.nix
@ -7,13 +7,13 @@ let
  apps = lib.makeBinPath [ openssh python' cron rsync sshfs-fuse encfs ];
 in stdenv.mkDerivation rec {
  pname = "backintime-common";
-  version = "1.3.3";
+  version = "1.4.3";

  src = fetchFromGitHub {
    owner = "bit-team";
    repo = "backintime";
    rev = "v${version}";
-    sha256 = "sha256-cKmzq155/dCl5wZA2SE3XjfCocHxTh4Wa2IdfzSfQHg=";
+    sha256 = "sha256-2q2Q4rnxXwVnfH1YEBwY35B2ctG9+qpOIAHqPOjjArg=";
  };

  nativeBuildInputs = [ makeWrapper gettext ];
@ -21,6 +21,8 @@ in stdenv.mkDerivation rec {

  installFlags = [ "DEST=$(out)" ];

+  configureFlags = [ "--python=${lib.getExe python'}" ];
+
  preConfigure = ''
    cd common
    substituteInPlace configure \
@ -41,7 +43,7 @@ in stdenv.mkDerivation rec {
    homepage = "https://github.com/bit-team/backintime";
    description = "Simple backup tool for Linux";
    license = lib.licenses.gpl2;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ stephen-huan ];
    platforms = lib.platforms.all;
    longDescription = ''
      Back In Time is a simple backup tool (on top of rsync) for Linux
--- a/pkgs/applications/networking/sync/backintime/qt.nix
+++ b/pkgs/applications/networking/sync/backintime/qt.nix
@ -11,11 +11,11 @@ mkDerivation {

  buildInputs = [ python' backintime-common ];

+  configureFlags = [ "--python=${lib.getExe python'}" ];
+
  preConfigure = ''
    cd qt
-    substituteInPlace configure \
-      --replace '"/../etc' '"/etc'
-    substituteInPlace qttools.py \
+    substituteInPlace qttools_path.py \
      --replace "__file__, os.pardir, os.pardir" '"${backintime-common}/${python'.sitePackages}/backintime"'
  '';

@ -37,7 +37,6 @@ mkDerivation {
      --replace "/usr/bin/ionice" "${lib.getBin util-linux}/bin/ionice"

    substituteInPlace "$out/share/dbus-1/system-services/net.launchpad.backintime.serviceHelper.service" \
-      --replace "/usr/bin/python3" "${lib.getBin python'}/bin/python3" \
      --replace "/usr/share/backintime" "$out/share/backintime"

    substituteInPlace "$out/bin/backintime-qt_polkit" \
--- a/pkgs/applications/science/math/sage/sage-src.nix
+++ b/pkgs/applications/science/math/sage/sage-src.nix
@ -53,6 +53,13 @@ stdenv.mkDerivation rec {
    # algorithm soon, disable this test for now.
    # https://github.com/sagemath/sage/issues/34575
    ./patches/disable-slow-glpk-test.patch
+
+    # https://github.com/sagemath/sage/pull/37489, landed in 10.4.beta1
+    (fetchpatch {
+      name = "quaternionalgebra-random-failure.patch";
+      url = "https://github.com/sagemath/sage/commit/1c3f991b9d3c5778e409e5414c6cfcd456113f19.diff";
+      hash = "sha256-uCXchYx26DdxTjR1k2748KCEHPnekKS2fAM7SpyhNvM=";
+    })
  ];

  # Patches needed because of package updates. We could just pin the versions of
--- a/pkgs/applications/terminal-emulators/xterm/default.nix
+++ b/pkgs/applications/terminal-emulators/xterm/default.nix
@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, fetchpatch, xorg, ncurses, freetype, fontconfig
 , pkg-config, makeWrapper, nixosTests, gitUpdater
-, nixfmt, nix, gnused, coreutils, enableDecLocator ? true }:
+, nix, gnused, coreutils, enableDecLocator ? true }:

 stdenv.mkDerivation rec {
  pname = "xterm";
--- a/pkgs/applications/video/media-downloader/default.nix
+++ b/pkgs/applications/video/media-downloader/default.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "media-downloader";
-  version = "4.4.0";
+  version = "4.5.0";

  src = fetchFromGitHub {
    owner = "mhogomchungu";
    repo = "media-downloader";
    rev = finalAttrs.version;
-    hash = "sha256-/W0SkKe9rcwf8HBIEcdJCPdZEnx9eh+twBu9wa6Sq30=";
+    hash = "sha256-n+eQjjjdZhvXFSw5D/UQhyBMSZstfI/JixiEVhmQwXs=";
  };

  nativeBuildInputs = [
--- a/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-fixup-hook.sh
+++ b/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-fixup-hook.sh
@ -30,7 +30,8 @@ wrapDotnetProgram() {
 dotnetFixupHook() {
    echo "Executing dotnetFixupPhase"

-    if [ "${executables-}" ]; then
+    # check if executables is declared (including empty values, in which case we generate no executables)
+    if declare -p executables &>/dev/null; then
        for executable in ${executables[@]}; do
            path="${installPath-$out/lib/$pname}/$executable"

--- a/pkgs/build-support/setup-hooks/audit-blas.sh
+++ b/pkgs/build-support/setup-hooks/audit-blas.sh
@ -1,37 +0,0 @@
-# Ensure that we are always linking against “libblas.so.3” and
-# “liblapack.so.3”.
-
-auditBlas() {
-    local dir="$prefix"
-    [ -e "$dir" ] || return 0
-
-    local i
-    while IFS= read -r -d $'\0' i; do
-        if ! isELF "$i"; then continue; fi
-
-        if $OBJDUMP -p "$i" | grep 'NEEDED' | awk '{ print $2; }' | grep -q '\(libmkl_rt.so\|libopenblas.so.0\)'; then
-            echo "$i refers to a specific implementation of BLAS or LAPACK."
-            echo "This prevents users from switching BLAS/LAPACK implementations."
-            echo "Add \`blas' or \`lapack' to buildInputs instead of \`mkl' or \`openblas'."
-            exit 1
-        fi
-
-        (IFS=:
-         for dir in "$(patchelf --print-rpath "$i")"; do
-             if [ -f "$dir/libblas.so.3" ] || [ -f "$dir/libblas.so" ]; then
-                 if [ "$dir" != "@blas@/lib" ]; then
-                     echo "$dir is not allowed to contain a library named libblas.so.3"
-                     exit 1
-                 fi
-             fi
-             if [ -f "$dir/liblapack.so.3" ] || [ -f "$dir/liblapack.so" ]; then
-                 if [ "$dir" != "@lapack@/lib" ]; then
-                     echo "$dir is not allowed to contain a library named liblapack.so.3"
-                     exit 1
-                 fi
-             fi
-         done)
-    done < <(find "$dir" -type f -print0)
-}
-
-fixupOutputHooks+=(auditBlas)
--- a/pkgs/by-name/_6/_64gram/package.nix
+++ b/pkgs/by-name/_6/_64gram/package.nix
@ -0,0 +1,31 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, telegram-desktop
+}:
+
+telegram-desktop.overrideAttrs (old: rec {
+
+  pname = "64Gram";
+  version = "1.1.15";
+
+  src = fetchFromGitHub {
+    owner = "TDesktop-x64";
+    repo = "tdesktop";
+    rev = "v${version}";
+
+    fetchSubmodules = true;
+    hash = "sha256-3HLRv8RTyyfnjMF7w+euSOj6SbxlxOuczap5Nlizsvg=";
+  };
+
+  meta = with lib; {
+    description = "An unofficial Telegram Desktop providing Windows 64bit build and extra features";
+    license = licenses.gpl3Only;
+    platforms = platforms.all;
+    homepage = "https://github.com/TDesktop-x64/tdesktop";
+    changelog = "https://github.com/TDesktop-x64/tdesktop/releases/tag/v${version}";
+    maintainers = with maintainers; [ clot27 ];
+    mainProgram = "telegram-desktop";
+    broken = stdenv.isDarwin;
+  };
+})
--- a/pkgs/by-name/as/ast-grep/package.nix
+++ b/pkgs/by-name/as/ast-grep/package.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "ast-grep";
-  version = "0.20.0";
+  version = "0.20.2";

  src = fetchFromGitHub {
    owner = "ast-grep";
    repo = "ast-grep";
    rev = version;
-    hash = "sha256-vOHBrz/a42jRyQs7oJLkg3/ra3SMR9FKuiwJ9RrFizw=";
+    hash = "sha256-hq5C6VMnkJ/Y75y7i5ipTUE7s5HsLnmomyFZJlQp/5Y=";
  };

-  cargoHash = "sha256-T30V9FYNmh2Rg5ZFc9elcf4ZbTR1vwieirawEs3a4sI=";
+  cargoHash = "sha256-klQa8LB473tB3slDfA7p3SSzXBnzhCRZWeIeHskm71c=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/ba/bat/package.nix
+++ b/pkgs/by-name/ba/bat/package.nix
@ -52,6 +52,8 @@ rustPlatform.buildRustPackage rec {
    "--skip=pager_more"
    "--skip=pager_most"
    "--skip=pager_overwrite"
+    # Fails if the filesystem performs UTF-8 validation (such as ZFS with utf8only=on)
+    "--skip=file_with_invalid_utf8_filename"
  ];

  doInstallCheck = true;
--- a/pkgs/by-name/ca/cargo-information/Cargo.lock
+++ b/pkgs/by-name/ca/cargo-information/Cargo.lock
--- a/pkgs/by-name/ca/cargo-information/package.nix
+++ b/pkgs/by-name/ca/cargo-information/package.nix
@ -0,0 +1,62 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, makeWrapper
+, pkg-config
+, openssl
+, rustc
+, stdenv
+, darwin
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cargo-information";
+  version = "0.4.2";
+
+  src = fetchFromGitHub {
+    owner = "hi-rustin";
+    repo = "cargo-information";
+    rev = "v${version}";
+    hash = "sha256-k481iHQ1tVi9fF5/xYR99/1/oRv1nS3WH7W55aPSyfc=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "cargo-test-macro-0.1.0" = "sha256-4u3Ium+WYBdyocuehDulRgUOR74JC6AUI2+A5xlnUGw=";
+    };
+  };
+
+  checkFlags = [
+    # Require network access
+    "--skip=cargo_information::specify_version_within_ws_and_match_with_lockfile::case"
+    "--skip=cargo_information::within_ws::case"
+    "--skip=cargo_information::within_ws_with_alternative_registry::case"
+    "--skip=cargo_information::within_ws_without_lockfile::case"
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    makeWrapper
+  ];
+
+  buildInputs = [
+    openssl
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.Security
+  ];
+
+  postFixup = ''
+    wrapProgram $out/bin/cargo-info \
+      --prefix PATH : ${lib.makeBinPath [ rustc ]}
+  '';
+
+  meta = with lib; {
+    description = "A cargo subcommand to show information about crates";
+    mainProgram = "cargo-info";
+    homepage = "https://github.com/hi-rustin/cargo-information";
+    changelog = "https://github.com/hi-rustin/cargo-information/blob/v${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ eopb ];
+  };
+}
--- a/pkgs/by-name/co/coppwr/Cargo.lock
+++ b/pkgs/by-name/co/coppwr/Cargo.lock
--- a/pkgs/by-name/co/coppwr/package.nix
+++ b/pkgs/by-name/co/coppwr/package.nix
@ -0,0 +1,77 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, libxkbcommon
+, pipewire
+, stdenv
+, libGL
+, wayland
+, xorg
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "coppwr";
+  version = "1.5.1";
+
+  src = fetchFromGitHub {
+    owner = "dimtpap";
+    repo = "coppwr";
+    rev = version;
+    hash = "sha256-azho/SVGEdHXt/t6VSA0NVVfhxK9bxy4Ud68faFh5zo=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "egui_node_graph-0.4.0" = "sha256-VJvALtPP/vPZQ4KLWu8diFar9vuVkbeD65Em6rod8ww=";
+      "libspa-0.7.2" = "sha256-0TGhxHL1mkktE263ln3jnPZRkXS6+C3aPUBg86J25oM=";
+    };
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+  ];
+
+  buildInputs = [
+    libxkbcommon
+    pipewire
+    libGL
+    wayland
+    xorg.libXcursor
+    xorg.libXi
+    xorg.libXrandr
+    xorg.libX11
+  ];
+
+  preBuild = ''
+    mkdir -p $out/share/{applications,icons/hicolor/scalable/apps,metainfo}
+
+    install -m 444 \
+        -D $src/assets/io.github.dimtpap.coppwr.desktop \
+        -t $out/share/applications
+    install -m 444 \
+        -D $src/assets/io.github.dimtpap.coppwr.metainfo.xml \
+        -t $out/share/metainfo
+    cp $src/assets/icon/scalable.svg $out/share/icons/hicolor/scalable/apps/io.github.dimtpap.coppwr.svg
+    for size in 32 48 64 128 256 512; do
+      mkdir -p $out/share/icons/hicolor/"$size"x"$size"/apps
+      cp $src/assets/icon/"$size".png $out/share/icons/hicolor/"$size"x"$size"/apps/io.github.dimtpap.coppwr.png
+    done
+  '';
+
+  postFixup = ''
+    patchelf $out/bin/${pname} \
+      --add-rpath ${lib.makeLibraryPath [ libGL libxkbcommon wayland ]}
+  '';
+
+  meta = with lib; {
+    description = "Low level control GUI for the PipeWire multimedia server";
+    homepage = "https://github.com/dimtpap/coppwr";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ ravenz46 ];
+    platforms = platforms.linux;
+    mainProgram = "coppwr";
+  };
+}
--- a/pkgs/by-name/cr/crawley/package.nix
+++ b/pkgs/by-name/cr/crawley/package.nix
@ -6,18 +6,18 @@

 buildGoModule rec {
  pname = "crawley";
-  version = "1.7.3";
+  version = "1.7.4";

  src = fetchFromGitHub {
    owner = "s0rg";
    repo = "crawley";
    rev = "v${version}";
-    hash = "sha256-sLeQl0/FY0NBfyhIyjcFqvI5JA1GSAfe7s2XrOjLZEY=";
+    hash = "sha256-WV9r+Oz6wMZtSl7YbeuHRaVLCtLGlJXHk/WVLIA85Mc=";
  };

  nativeBuildInputs = [ installShellFiles ];

-  vendorHash = "sha256-fOy4jYF01MoWFS/SecXhlO2+BTYzR5eRm55rp+YNUuU=";
+  vendorHash = "sha256-2XF/oqqArvppuppA8kdr3WnUAvaJs39ohHzHBR+Xz/4=";

  ldflags = [ "-w" "-s" ];

--- a/pkgs/by-name/da/daytona-bin/package.nix
+++ b/pkgs/by-name/da/daytona-bin/package.nix
@ -0,0 +1,55 @@
+{ stdenvNoCC
+, lib
+, fetchurl
+, makeWrapper
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "daytona-bin";
+  version = "0.9.0";
+
+  src =
+    let
+      urls = {
+        "x86_64-linux" = {
+          url = "https://download.daytona.io/daytona/v${finalAttrs.version}/daytona-linux-amd64";
+          hash = "sha256-vJVGFmaGP9oCCzdvhuAPsoTaxzGvdDKDupMYuepRUCA=";
+        };
+        "x86_64-darwin" = {
+          url = "https://download.daytona.io/daytona/v${finalAttrs.version}/daytona-darwin-amd64";
+          hash = "sha256-R63AQVt5DudzJub+TYcJiHkBGVeOhjvgJZgnqvJb8t0=";
+        };
+        "aarch64-linux" = {
+          url = "https://download.daytona.io/daytona/v${finalAttrs.version}/daytona-linux-arm64";
+          hash = "sha256-98OEhJ1gakPTVO73M9WW0QuSDgR42gNjoioEkkNbf6w=";
+        };
+        "aarch64-darwin" = {
+          url = "https://download.daytona.io/daytona/v${finalAttrs.version}/daytona-darwin-arm64";
+          hash = "sha256-YmLyioFueEfi/2Q+JwINDhkwo617/KUZrimz9CibdA8=";
+        };
+      };
+    in
+    fetchurl urls."${stdenvNoCC.hostPlatform.system}";
+
+  dontUnpack = true;
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 $src $out/bin/daytona
+    runHook postInstall
+  '';
+
+  meta = {
+    changelog = "https://github.com/daytonaio/daytona/releases/tag/v${finalAttrs.version}";
+    description = "The Open Source Dev Environment Manager";
+    homepage = "https://github.com/daytonaio/daytona";
+    license = lib.licenses.asl20;
+    mainProgram = "daytona";
+    maintainers = with lib.maintainers; [ ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
--- a/pkgs/by-name/fa/fantomas/package.nix
+++ b/pkgs/by-name/fa/fantomas/package.nix
@ -2,9 +2,9 @@

 buildDotnetGlobalTool {
  pname = "fantomas";
-  version = "6.3.0";
+  version = "6.3.1";

-  nugetSha256 = "sha256-PWiyzkiDL8LBE/fwClS0d6PrE0D5pKYYZiMDZmyk9Y0=";
+  nugetSha256 = "sha256-mPuY2OwVK6dLtI+L8SIK5i7545VQ0ChhUPdQwBlvcE4=";

  meta = with lib; {
    description = "F# source code formatter";
--- a/pkgs/by-name/gh/gh-f/package.nix
+++ b/pkgs/by-name/gh/gh-f/package.nix
@ -0,0 +1,41 @@
+{ lib
+, fetchFromGitHub
+, stdenvNoCC
+, makeWrapper
+, fzf
+, coreutils
+, bat
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "gh-f";
+  version = "1.1.5";
+
+  src = fetchFromGitHub {
+    owner = "gennaro-tedesco";
+    repo = "gh-f";
+    rev = "v${version}";
+    hash = "sha256-ITl8T8Oe21m047ygFlxWVjzUYPG4rlcTjfSpsropYJw=";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  installPhase = ''
+    install -D -m755 "gh-f" "$out/bin/gh-f"
+  '';
+
+  postFixup = ''
+    wrapProgram "$out/bin/gh-f" --prefix PATH : "${lib.makeBinPath [fzf bat coreutils]}"
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/gennaro-tedesco/gh-f";
+    description = "GitHub CLI ultimate FZF extension";
+    maintainers = with maintainers; [ loicreynier ];
+    license = licenses.unlicense;
+    mainProgram = "gh-f";
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/by-name/in/inflow/package.nix
+++ b/pkgs/by-name/in/inflow/package.nix
@ -0,0 +1,76 @@
+{ lib, stdenv, fetchFromGitHub, runCommand, inflow, diffutils }:
+
+stdenv.mkDerivation rec {
+  pname = "inflow";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "stephen-huan";
+    repo = "inflow";
+    rev = "v${version}";
+    sha256 = "sha256-xKUqkrPwITai8g6U1NiNieAip/AzISgFfFtvR30hLNk=";
+  };
+
+  buildPhase = ''
+    runHook preBuild
+
+    $CXX -Wall -Wpedantic -Wextra -O3 -o inflow inflow.cpp
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 inflow -t $out/bin
+
+    runHook postInstall
+  '';
+
+  passthru.tests = {
+    reflowWithLineLength = runCommand "${pname}-test"
+      {
+        nativeBuildInputs = [ inflow ];
+        buildInputs = [ diffutils ];
+      } ''
+      cat <<EOF > input.txt
+      xxxxx xxx xxx xxxx xxxxxxxxx xx x xxxxxxxxx x xxxx xxxx xxxxxxx xxxxxxxx xxx
+      xxxxxxxxx xxxxxxxx xx xx xxxxx xxxxx xxxx xx x xxxx xx xxxxxxxx xxxxxxxx xxxx
+      xxx xxxx xxxx xxx xxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxx xxx xxxxx xx xxxx x xxxx
+      xxxxxxxx xxxx xxxx xx xxxxx xxxx xxxxx xxxx xxxxxxxxx xxx xxxxxxxxxxx xxxxxx
+      xxx xxxxxxxxx xxxx xxxx xx x xx xxxx xxx xxxx xx xxx xxx xxxxxxxxxxx xxxx xxxxx
+      x xxxxx xxxxxxx xxxxxxx xx xx xxxxxx xx xxxxx
+      EOF
+
+      inflow 72 < input.txt > actual.txt
+
+      cat <<EOF > expected.txt
+      xxxxx xxx xxx xxxx xxxxxxxxx xx x xxxxxxxxx x xxxx xxxx xxxxxxx
+      xxxxxxxx xxx xxxxxxxxx xxxxxxxx xx xx xxxxx xxxxx xxxx xx x xxxx
+      xx xxxxxxxx xxxxxxxx xxxx xxx xxxx xxxx xxx xxxxxxxxxxxxxxxxxxx
+      xxxxxxxxxxxxx xxx xxxxx xx xxxx x xxxx xxxxxxxx xxxx xxxx xx xxxxx
+      xxxx xxxxx xxxx xxxxxxxxx xxx xxxxxxxxxxx xxxxxx xxx xxxxxxxxx
+      xxxx xxxx xx x xx xxxx xxx xxxx xx xxx xxx xxxxxxxxxxx xxxx xxxxx
+      x xxxxx xxxxxxx xxxxxxx xx xx xxxxxx xx xxxxx
+      EOF
+
+      if ! cmp --silent expected.txt actual.txt
+      then
+        echo "Error: actual.txt and expected.txt are different"
+        diff actual.txt expected.txt
+        exit 1
+      fi
+
+      touch $out
+    '';
+  };
+
+  meta = with lib; {
+    description = "Variance-optimal paragraph formatter";
+    homepage = "https://github.com/stephen-huan/inflow";
+    license = licenses.unlicense;
+    mainProgram = "inflow";
+    maintainers = with maintainers; [ fbrs ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/by-name/ja/jan/package.nix
+++ b/pkgs/by-name/ja/jan/package.nix
@ -5,10 +5,10 @@

 let
  pname = "jan";
-  version = "0.4.9";
+  version = "0.4.10";
  src = fetchurl {
    url = "https://github.com/janhq/jan/releases/download/v${version}/jan-linux-x86_64-${version}.AppImage";
-    hash = "sha256-6XnDrr+AkZH69zXf0OKdi8R6LoRWWMZNqWilZhLGynk=";
+    hash = "sha256-IOqwz3pJ4veuxQwfkMs0Zf8dNQcQ0HwnR3SPBVvQXtU=";
  };

  appimageContents = appimageTools.extractType2 { inherit pname version src; };
--- a/pkgs/applications/misc/jetbrains-toolbox/default.nix
+++ b/pkgs/applications/misc/jetbrains-toolbox/default.nix
--- a/pkgs/by-name/jn/jnv/package.nix
+++ b/pkgs/by-name/jn/jnv/package.nix
@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "jnv";
-  version = "0.1.3";
+  version = "0.2.1";

  src = fetchFromGitHub {
    owner = "ynqa";
    repo = "jnv";
    rev = "v${version}";
-    hash = "sha256-szPMbcR6fg9mgJ0oE07aYTJZHJKbguK3IFKhuV0D/rI=";
+    hash = "sha256-CdpEo8hnO61I2Aocfd3nka81FTDPRguwxxcemzH+zcc=";
  };

-  cargoHash = "sha256-vEyWawtWT/8GntlEUyrtBRXPcjgMg9oYemGzHSg50Hg=";
+  cargoHash = "sha256-KF15Y2VrFJ7p5ut5cR80agaJ7bM9U9Ikcz1Ux8Ah138=";

  nativeBuildInputs = [
    autoconf
--- a/pkgs/by-name/ks/kshutdown/package.nix
+++ b/pkgs/by-name/ks/kshutdown/package.nix
@ -0,0 +1,32 @@
+{ stdenv
+, lib
+, fetchurl
+, extra-cmake-modules
+, unzip
+, libsForQt5
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "kshutdown";
+  version = "5.91-beta";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/project/kshutdown/KShutdown/${finalAttrs.version}/kshutdown-source-${finalAttrs.version}.zip";
+    hash = "sha256-gWXpVBhoZ57kaQV1C+xCBYc2gZjzJfFViD/SI9D+BRc=";
+    name = "kshutdown-source-${finalAttrs.version}.zip";
+  };
+
+  nativeBuildInputs = [ extra-cmake-modules unzip libsForQt5.wrapQtAppsHook ];
+
+  buildInputs = with libsForQt5; [ qtbase kxmlgui knotifyconfig kidletime ];
+
+  meta = with lib; {
+    homepage = "https://kshutdown.sourceforge.io/";
+    description = "A graphical shutdown utility for Linux and Windows";
+    mainProgram = "kshutdown";
+    license = with licenses; [ gpl3 ];
+    maintainers = with maintainers ; [ eymeric ];
+    platforms = platforms.linux;
+  };
+})
+
--- a/pkgs/by-name/le/lexical/package.nix
+++ b/pkgs/by-name/le/lexical/package.nix
@ -0,0 +1,48 @@
+{
+  lib,
+  beamPackages,
+  fetchFromGitHub,
+  writeScript,
+  elixir,
+}:
+
+beamPackages.mixRelease rec {
+  pname = "lexical";
+  version = "0.5.2";
+
+  src = fetchFromGitHub {
+    owner = "lexical-lsp";
+    repo = "lexical";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-HWqwJ7PAz80bm6YeDG84hLWPE11n06K98GOyeDQWZWU=";
+  };
+
+  mixFodDeps = beamPackages.fetchMixDeps {
+    inherit pname version src;
+
+    hash = "sha256-G0mT+rvXZWLJIMfrhxq3TXt26wDImayu44wGEYJ+3CE=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mix do compile --no-deps-check, package --path "$out"
+
+    runHook postInstall
+  '';
+
+  postInstall = ''
+    substituteInPlace "$out/bin/start_lexical.sh" --replace 'elixir_command=' 'elixir_command="${elixir}/bin/"'
+    mv "$out/bin" "$out/libexec"
+    makeWrapper "$out/libexec/start_lexical.sh" "$out/bin/lexical" --set RELEASE_COOKIE lexical
+  '';
+
+  meta = with lib; {
+    description = "Lexical is a next-generation elixir language server";
+    homepage = "https://github.com/lexical-lsp/lexical";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ GaetanLepage ];
+    mainProgram = "lexical";
+    platforms = beamPackages.erlang.meta.platforms;
+  };
+}
--- a/pkgs/by-name/ma/maa-cli/package.nix
+++ b/pkgs/by-name/ma/maa-cli/package.nix
@ -64,7 +64,7 @@ rustPlatform.buildRustPackage rec {
  meta = with lib; {
    description = "A simple CLI for MAA by Rust";
    homepage = "https://github.com/MaaAssistantArknights/maa-cli";
-    license = licenses.agpl3Plus;
+    license = licenses.agpl3Only;
    platforms = platforms.linux;
    maintainers = with maintainers; [ Cryolitia ];
    mainProgram = "maa";
--- a/pkgs/by-name/me/meg/package.nix
+++ b/pkgs/by-name/me/meg/package.nix
@ -0,0 +1,25 @@
+{ lib
+, fetchFromGitHub
+, buildGoModule
+}:
+buildGoModule rec {
+  pname = "meg";
+  version = "0.3.0";
+
+  vendorHash = "sha256-kQsGRmK7Qqz36whd6RI7Gecj40MM0o/fgRv7a+4yGZI=";
+
+  src = fetchFromGitHub {
+    owner = "tomnomnom";
+    repo = "meg";
+    rev = "v${version}";
+    hash = "sha256-uhfPNpvuuC9kBYUBCGE6X46TeZ5QxIcnDQ4HRrn2mT4=";
+  };
+
+  meta = with lib; {
+    homepage = "https://github.com/tomnomnom/meg";
+    description = "Fetch many paths for many hosts without flooding hosts";
+    mainProgram = "meg";
+    maintainers = with maintainers; [ averagebit ];
+    license = licenses.mit;
+  };
+}
--- a/pkgs/by-name/ni/nim_lk/lock.json
+++ b/pkgs/by-name/ni/nim_lk/lock.json
@ -1,12 +1,33 @@
 {
  "depends": [
+    {
+      "method": "fetchzip",
+      "packages": [
+        "atlas"
+      ],
+      "path": "/nix/store/v015scfifr10ialyimn7xxm0rdg4dha2-source",
+      "rev": "60681b93af4c8914afbd8eae9fc9820ba4d198a0",
+      "sha256": "1kc47w20ipbdh31s1gcblcikzlvlagmmha1qw3by70fc7mgazrxf",
+      "srcDir": "src",
+      "url": "https://github.com/nim-lang/atlas/archive/60681b93af4c8914afbd8eae9fc9820ba4d198a0.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "bigints"
+      ],
+      "path": "/nix/store/jvrm392g8adfsgf36prgwkbyd7vh5jsw-source",
+      "rev": "86ea14d31eea9275e1408ca34e6bfe9c99989a96",
+      "sha256": "15pcpmnk1bnw3k8769rjzcpg00nahyrypwbxs88jnwr4aczp99j4",
+      "srcDir": "src",
+      "url": "https://github.com/ehmry/nim-bigints/archive/86ea14d31eea9275e1408ca34e6bfe9c99989a96.tar.gz"
+    },
    {
      "method": "fetchzip",
      "packages": [
        "npeg"
      ],
      "path": "/nix/store/ffkxmjmigfs7zhhiiqm0iw2c34smyciy-source",
-      "ref": "1.2.1",
      "rev": "26d62fdc40feb84c6533956dc11d5ee9ea9b6c09",
      "sha256": "0xpzifjkfp49w76qmaylan8q181bs45anmp46l4bwr3lkrr7bpwh",
      "srcDir": "src",
@ -17,12 +38,11 @@
      "packages": [
        "preserves"
      ],
-      "path": "/nix/store/nrcpzf9hx70kry3gwhrdzcs3qicjncjh-source",
-      "ref": "20231021",
-      "rev": "edece399be70818208bf2263c30cb2bcf435bbff",
-      "sha256": "0xmw35wmw3a4lja9q4qvlvpxv3xk0hnkjg4fwfw6f3inh6zfiqki",
+      "path": "/nix/store/6nnn5di5vip1vladlb7z56rbw18d1y7j-source",
+      "rev": "2825bceecf33a15b9b7942db5331a32cbc39b281",
+      "sha256": "145vf46fy3wc52j6vs509fm9bi5lx7c53gskbkpcfbkv82l86dgk",
      "srcDir": "src",
-      "url": "https://git.syndicate-lang.org/ehmry/preserves-nim/archive/edece399be70818208bf2263c30cb2bcf435bbff.tar.gz"
+      "url": "https://git.syndicate-lang.org/ehmry/preserves-nim/archive/2825bceecf33a15b9b7942db5331a32cbc39b281.tar.gz"
    }
  ]
 }
--- a/pkgs/by-name/ni/nim_lk/package.nix
+++ b/pkgs/by-name/ni/nim_lk/package.nix
@ -8,25 +8,28 @@
 , makeWrapper
 }:

-buildNimPackage (finalAttrs: {
+let nim' = nim.passthru.nim;
+in buildNimPackage (finalAttrs: {
  pname = "nim_lk";
-  version = "20231031";
+  version = "20240210";

  src = fetchFromSourcehut {
    owner = "~ehmry";
    repo = "nim_lk";
    rev = finalAttrs.version;
-    hash = "sha256-dXm3dfXAxgucek19f1KdRShOsJyELPTB32qgGSKId6A=";
+    hash = "sha256-LLOf8HNee0Mol+e7/dvu9hQUCmpaVBNggTxaAl/wV6Y=";
  };

+  lockFile = ./lock.json;
+
  buildInputs = [ openssl ];
  nativeBuildInputs = [ makeWrapper ];

-  lockFile = ./lock.json;
+  nimFlags = [ "--path:${nim'}/nim" ];

  postFixup = ''
    wrapProgram $out/bin/nim_lk \
-      --suffix PATH : ${lib.makeBinPath [ nim nix-prefetch nix-prefetch-git ]}
+      --suffix PATH : ${lib.makeBinPath [ nim' nix-prefetch nix-prefetch-git ]}
  '';

  meta = finalAttrs.src.meta // {
--- a/pkgs/by-name/oc/ocis-bin/package.nix
+++ b/pkgs/by-name/oc/ocis-bin/package.nix
@ -0,0 +1,56 @@
+{
+  fetchurl,
+  lib,
+  stdenv,
+  autoPatchelfHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ocis-bin";
+  version = "5.0.0";
+  system =
+    if stdenv.isLinux && stdenv.isx86_64 then
+      "linux-amd64"
+    else if stdenv.isLinux && stdenv.isAarch64 then
+      "linux-arm64"
+    else
+      "";
+
+  src = fetchurl {
+    url = "https://github.com/owncloud/ocis/releases/download/v${finalAttrs.version}/ocis-${finalAttrs.version}-${finalAttrs.system}";
+
+    hash =
+      if stdenv.isLinux && stdenv.isAarch64 then
+        "sha256-xRgDNwmRovXbyGQ5sTUw5srsXMBDYyBFMpB9MoXoo+w="
+      else if stdenv.isLinux && stdenv.isx86_64 then
+        "sha256-0lgDIHldW67OwinfYPATXkWUZVnR3PoXC4XLM1KkKmY="
+      else
+        builtins.throw "Unsupported platform, please contact Nixpkgs maintainers for ocis package";
+  };
+  dontUnpack = true;
+
+  nativeBuildInputs = [ autoPatchelfHook ];
+
+  installPhase = ''
+    runHook preInstall
+    install -D $src $out/bin/ocis
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "ownCloud Infinite Scale Stack ";
+    homepage = "https://owncloud.dev/ocis/";
+    changelog = "https://github.com/owncloud/ocis/releases/tag/v${version}";
+    # oCIS is licensed under non-free EULA which can be found here :
+    # https://github.com/owncloud/ocis/releases/download/v5.0.0/End-User-License-Agreement-for-ownCloud-Infinite-Scale.pdf
+    license = licenses.unfree;
+    maintainers = with maintainers; [
+      ramblurr
+      bhankas
+      danth
+      ramblurr
+    ];
+    sourceProvenance = [ sourceTypes.binaryNativeCode ];
+    mainProgram = "ocis";
+  };
+})
--- a/pkgs/by-name/of/offat/package.nix
+++ b/pkgs/by-name/of/offat/package.nix
@ -0,0 +1,60 @@
+{ lib
+, fetchFromGitHub
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "offat";
+  version = "0.16.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "OWASP";
+    repo = "OFFAT";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-ald+hanICvY0jTgL7GtIMiArLWazykaJAJSfzPKE4/I=";
+  };
+
+  sourceRoot = "${src.name}/src";
+
+  build-system = with python3.pkgs; [
+    poetry-core
+  ];
+
+  dependencies = with python3.pkgs; [
+    aiohttp
+    aiolimiter
+    fastapi
+    openapi-spec-validator
+    requests
+    rich
+    setuptools
+    tenacity
+  ];
+
+  passthru.optional-dependencies = {
+    api = with python3.pkgs; [
+      fastapi
+      uvicorn
+      redis
+      rq
+      python-dotenv
+    ];
+  };
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "offat"
+  ];
+
+  meta = with lib; {
+    description = "Tool to test APIs for prevalent vulnerabilities";
+    homepage = "https://github.com/OWASP/OFFAT/";
+    changelog = "https://github.com/OWASP/OFFAT/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+    mainProgram = "offat";
+  };
+}
--- a/pkgs/by-name/pi/pingme/package.nix
+++ b/pkgs/by-name/pi/pingme/package.nix
@ -0,0 +1,37 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "pingme";
+  version = "0.2.6";
+
+  src = fetchFromGitHub {
+    owner = "kha7iq";
+    repo = "pingme";
+    rev = "v${version}";
+    hash = "sha256-i+EZ3HfuxHSuZDe0+nfZVvoNZN5XcdQFwfgOg4OLBOs=";
+  };
+
+  vendorHash = "sha256-fEJII8qSDIbMNhRfuYUsRA1AmOXR27iHpBPNCDFI4xQ=";
+
+  # bump go version
+  preBuild = ''
+    substituteInPlace go.mod \
+      --replace-fail 'go 1.16' 'go 1.21'
+    go mod tidy
+  '';
+  proxyVendor = true;
+
+  ldflags = [ "-s" "-w" "-X=main.Version=${version}" ];
+
+  meta = {
+    changelog = "https://github.com/kha7iq/pingme/releases/tag/${src.rev}";
+    description = "Send messages or alerts to multiple messaging platforms & email";
+    homepage = "https://pingme.lmno.pk";
+    license = lib.licenses.mit;
+    mainProgram = "pingme";
+    maintainers = with lib.maintainers; [ emilytrau ];
+  };
+}
--- a/pkgs/by-name/py/pyprland/package.nix
+++ b/pkgs/by-name/py/pyprland/package.nix
@ -2,7 +2,7 @@

 python3Packages.buildPythonApplication rec {
  pname = "pyprland";
-  version = "2.0.9";
+  version = "2.1.1";
  format = "pyproject";

  disabled = python3Packages.pythonOlder "3.10";
@ -11,7 +11,7 @@ python3Packages.buildPythonApplication rec {
    owner = "hyprland-community";
    repo = "pyprland";
    rev = "refs/tags/${version}";
-    hash = "sha256-dfE4KQguLp9DEWOuCtNDw8TA3sK9vEqU4VqAVlVaUvw=";
+    hash = "sha256-S1kNA70kxLK4ZdhJDXp1RhKsGVTS0k9wLxAtndv/iCo=";
  };

  nativeBuildInputs = with python3Packages; [ poetry-core ];
--- a/pkgs/by-name/si/simdutf/package.nix
+++ b/pkgs/by-name/si/simdutf/package.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "simdutf";
-  version = "5.0.0";
+  version = "5.2.0";

  src = fetchFromGitHub {
    owner = "simdutf";
    repo = "simdutf";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-ZCpLSMmgZSLAlVKzXFsaENnZwQAeKbNfKkj241PM26c=";
+    hash = "sha256-4yo962iiwSPW1JeQq5mLse5DJUub7AWqMDA+AdpsRBo=";
  };

  # Fix build on darwin
--- a/pkgs/by-name/sn/sn-pro/package.nix
+++ b/pkgs/by-name/sn/sn-pro/package.nix
@ -0,0 +1,30 @@
+{ lib, stdenvNoCC, fetchFromGitHub }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "sn-pro";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "supernotes";
+    repo = "sn-pro";
+    rev = version;
+    hash = "sha256-G/DIHWs91HYVbrV/jZ4aFsCCjqORo8YeqcHGN0LZ8p4=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 -t $out/share/fonts/otf exports/SNPro/*.otf
+    install -Dm644 -t $out/share/fonts/woff2 exports/SNPro/*.woff2
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "SN Pro Font Family";
+    homepage = "https://github.com/supernotes/sn-pro";
+    license = licenses.ofl;
+    maintainers = with maintainers; [ colemickens ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/by-name/wa/wayland-pipewire-idle-inhibit/package.nix
+++ b/pkgs/by-name/wa/wayland-pipewire-idle-inhibit/package.nix
@ -8,16 +8,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "wayland-pipewire-idle-inhibit";
-  version = "0.5.0";
+  version = "0.5.1";

  src = fetchFromGitHub {
    owner = "rafaelrc7";
    repo = "wayland-pipewire-idle-inhibit";
    rev = "v${version}";
-    sha256 = "sha256-pHTIzcmvB66Jwbkl8LtoYVP8+mRiUwT3D29onLdx+gM=";
+    sha256 = "sha256-2akYbnQnJ0wb51S3bwrm3/EiZydxbwkfuSfsiTvtNz8=";
  };

-  cargoHash = "sha256-7RNYA0OqKV2p3pOTsehEQSvVHH/hoJA733S0u7x06Fc=";
+  cargoHash = "sha256-C4cispJN2OQRBQiW+H36B8ETNn1oukgdELRVk7V7BQU=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/wi/wiremock/package.nix
+++ b/pkgs/by-name/wi/wiremock/package.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "wiremock";
-  version = "3.4.2";
+  version = "3.5.2";

  src = fetchurl {
    url = "mirror://maven/org/wiremock/wiremock-standalone/${version}/wiremock-standalone-${version}.jar";
-    hash = "sha256-Btf7oQRmfQnHdl5DawF2xOczDrR/5Po/9NytgqTLkVQ=";
+    hash = "sha256-27DIcfP5R1Qiwl2fhvUQjFsE8pTHTv5MuFqHGa+whVY=";
  };

  dontUnpack = true;
--- a/pkgs/data/misc/dbip-country-lite/default.nix
+++ b/pkgs/data/misc/dbip-country-lite/default.nix
@ -5,11 +5,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "dbip-country-lite";
-  version = "2024-03";
+  version = "2024-04";

  src = fetchurl {
    url = "https://download.db-ip.com/free/dbip-country-lite-${finalAttrs.version}.mmdb.gz";
-    hash = "sha256-pWlNmM7CCiIS1GRRX5GRWNOF5tOwPPTytgc7V2+l3LE=";
+    hash = "sha256-tpiggDnhYPeLJ21mctXjbNSS2Gw4RI8gnpc1stDVmMc=";
  };

  dontUnpack = true;
--- a/pkgs/data/misc/v2ray-domain-list-community/default.nix
+++ b/pkgs/data/misc/v2ray-domain-list-community/default.nix
@ -3,12 +3,12 @@
 let
  generator = pkgsBuildBuild.buildGoModule rec {
    pname = "v2ray-domain-list-community";
-    version = "20240324094850";
+    version = "20240402003241";
    src = fetchFromGitHub {
      owner = "v2fly";
      repo = "domain-list-community";
      rev = version;
-      hash = "sha256-Fdb0Bk0dk0SkBmUdeBjMH8/++fDvw1GtiKCYXdVAfCc=";
+      hash = "sha256-tIQqTvrQUGjLeZL1aQiqaViZSAysUfX+QlTkhH7N3Iw=";
    };
    vendorHash = "sha256-azvMUi8eLNoNofRa2X4SKTTiMd6aOyO6H/rOiKjkpIY=";
    meta = with lib; {
--- a/pkgs/data/themes/kwin-decorations/sierra-breeze-enhanced/default.nix
+++ b/pkgs/data/themes/kwin-decorations/sierra-breeze-enhanced/default.nix
@ -5,17 +5,24 @@
 , wrapQtAppsHook
 , kwin
 , lib
+, useQt5 ? false
 }:
+let
+  latestVersion = "2.0.1";
+  latestSha256 = "sha256-4KvOhQSYmHV/5TxyeK4f1uUmHK5uR5xXC2MfPTM96SM=";

+  qt5Version = "1.3.3";
+  qt5Sha256 = "sha256-zTUTsSzy4p0Y7RPOidCtxTjjyvPRyWSQCxA5sUzXcLc=";
+in
 stdenv.mkDerivation rec {
  pname = "sierra-breeze-enhanced";
-  version = "1.3.3";
+  version = if useQt5 then qt5Version else latestVersion;

  src = fetchFromGitHub {
    owner = "kupiqu";
    repo = "SierraBreezeEnhanced";
    rev = "V${version}";
-    sha256 = "sha256-zTUTsSzy4p0Y7RPOidCtxTjjyvPRyWSQCxA5sUzXcLc=";
+    sha256 = if useQt5 then qt5Sha256 else latestSha256;
  };

  nativeBuildInputs = [ cmake extra-cmake-modules wrapQtAppsHook ];
@ -32,6 +39,6 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/kupiqu/SierraBreezeEnhanced";
    changelog = "https://github.com/kupiqu/SierraBreezeEnhanced/releases/tag/V${version}";
    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ A1ca7raz ];
  };
 }
--- a/pkgs/development/compilers/osl/default.nix
+++ b/pkgs/development/compilers/osl/default.nix
@ -24,13 +24,13 @@ let

 in stdenv.mkDerivation rec {
  pname = "openshadinglanguage";
-  version = "1.13.7.0";
+  version = "1.13.8.0";

  src = fetchFromGitHub {
    owner = "AcademySoftwareFoundation";
    repo = "OpenShadingLanguage";
    rev = "v${version}";
-    hash = "sha256-M8B5lnLEnWu0PQx4BKidFHXm4+Xs26EaD2caOA+bZ1k=";
+    hash = "sha256-AixN3cj6r/PUGvAhVN4wGfpuLiBt5LglgJp68hFfJMo=";
  };

  cmakeFlags = [
--- a/pkgs/development/compilers/scala/2.x.nix
+++ b/pkgs/development/compilers/scala/2.x.nix
@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, makeWrapper, jre, gnugrep, coreutils, writeScript
-, common-updater-scripts, git, gnused, nix, nixfmt, majorVersion }:
+, common-updater-scripts, git, gnused, nix, nixfmt-classic, majorVersion }:

 let
  repo = "git@github.com:scala/scala.git";
@ -83,7 +83,7 @@ stdenv.mkDerivation rec {
          git
          gnused
          nix
-          nixfmt
+          nixfmt-classic
        ]
      }
      versionSelect='v${lib.versions.major version}.${lib.versions.minor version}.*'
--- a/pkgs/development/coq-modules/Vpl/default.nix
+++ b/pkgs/development/coq-modules/Vpl/default.nix
@ -11,7 +11,10 @@ mkCoqDerivation {

  sourceRoot = "source/coq";

-  meta = coq.ocamlPackages.vpl-core.meta // {
+  meta = {
    description = "Coq interface to VPL abstract domain of convex polyhedra";
+    homepage = "https://amarechal.gitlab.io/home/projects/vpl/";
+    license = lib.licenses.lgpl3Only;
+    maintainers = [ lib.maintainers.vbgl ];
  };
 }
--- a/pkgs/development/coq-modules/gappalib/default.nix
+++ b/pkgs/development/coq-modules/gappalib/default.nix
@ -6,7 +6,8 @@ mkCoqDerivation {
  owner = "gappa";
  domain = "gitlab.inria.fr";
  inherit version;
-  defaultVersion = if lib.versions.range "8.8" "8.18" coq.coq-version then "1.5.4" else null;
+  defaultVersion = if lib.versions.range "8.8" "8.19" coq.coq-version then "1.5.5" else null;
+  release."1.5.5".sha256 = "sha256-qxi2Kg3N3o6+ncq7aPNEg98dBmQC5WCa86zROPJSDdo=";
  release."1.5.4".sha256 = "sha256-9PlkXqCu4rbFD7qnMF1GSpPCVmwJ3r593RfAvkJbbdA=";
  release."1.5.3".sha256 = "sha256-SuMopX5sm4jh2uBuE7zr6vhWhHYZYnab+epjqYJqg+s=";
  release."1.5.2".sha256 = "sha256-A021Bhqz5r2CZBayfjIiWrCIfUlejcQAfbTmOaf6QTM=";
--- a/pkgs/development/coq-modules/interval/default.nix
+++ b/pkgs/development/coq-modules/interval/default.nix
@ -7,6 +7,7 @@ mkCoqDerivation rec {
  domain = "gitlab.inria.fr";
  inherit version;
  defaultVersion = with lib.versions; lib.switch coq.coq-version [
+    { case = range "8.12" "8.19"; out = "4.10.0"; }
    { case = range "8.12" "8.18"; out = "4.9.0"; }
    { case = range "8.12" "8.17"; out = "4.8.0"; }
    { case = range "8.12" "8.16"; out = "4.6.0"; }
@ -15,6 +16,7 @@ mkCoqDerivation rec {
    { case = range "8.7" "8.11"; out = "3.4.2"; }
    { case = range "8.5" "8.6";  out = "3.3.0"; }
  ] null;
+  release."4.10.0".sha256 = "sha256-MZJVoKGLXjDabdv9BuUSK1L9z1cubzC9cqVuWevKIXQ=";
  release."4.9.0".sha256 = "sha256-+5NppyQahcc1idGu/U3B+EIWuZz2L3/oY7dIJR6pitE=";
  release."4.8.1".sha256 = "sha256-gknZ3bA90YY2AvwfFsP5iMhohwkQ8G96mH+4st2RPDc=";
  release."4.8.0".sha256 = "sha256-YPQ1tuUgGixAVdQUJ9a3lZUNVgm2pKK3RKvl3m+/8rY=";
--- a/pkgs/development/coq-modules/vcfloat/default.nix
+++ b/pkgs/development/coq-modules/vcfloat/default.nix
@ -1,6 +1,6 @@
 { lib, mkCoqDerivation, coq, interval, compcert, flocq, bignums, version ? null }:

-let self = with lib; mkCoqDerivation {
+let self = mkCoqDerivation {
  pname = "vcfloat";
  owner = "VeriNum";
  inherit version;
@ -8,9 +8,11 @@ let self = with lib; mkCoqDerivation {
  postPatch = ''
    coq_makefile -o Makefile -f _CoqProject *.v
  '';
-  defaultVersion = with versions; switch coq.coq-version [
-    { case = range "8.16" "8.17"; out = "2.1.1"; }
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
+    { case = isEq "8.19"; out = "2.2"; }
+    { case = range "8.16" "8.18"; out = "2.1.1"; }
  ] null;
+  release."2.2".sha256 = "sha256-PyMm84ZYh+dOnl8Kk2wlYsQ+S/d1Hsp6uv2twTedEPg=";
  release."2.1.1".sha256 = "sha256-bd/XSQhyFUAnSm2bhZEZBWB6l4/Ptlm9JrWu6w9BOpw=";
  releaseRev = v: "v${v}";

@ -18,8 +20,8 @@ let self = with lib; mkCoqDerivation {

  meta = {
    description = "A tool for Coq proofs about floating-point round-off error";
-    maintainers = with maintainers; [ quinn-dougherty ];
-    license = licenses.lgpl3Plus;
+    maintainers = with lib.maintainers; [ quinn-dougherty ];
+    license = lib.licenses.lgpl3Plus;
  };
 };
 in self
--- a/pkgs/development/cuda-modules/backend-stdenv.nix
+++ b/pkgs/development/cuda-modules/backend-stdenv.nix
@ -21,6 +21,6 @@ let
  assertCondition = true;
 in

-  /* TODO: Consider testing whether we in fact use the newer libstdc++ */
+# TODO: Consider testing whether we in fact use the newer libstdc++

 lib.extendDerivation assertCondition passthruExtra cudaStdenv
--- a/pkgs/development/cuda-modules/cuda-library-samples/extension.nix
+++ b/pkgs/development/cuda-modules/cuda-library-samples/extension.nix
@ -1,4 +1,4 @@
-{hostPlatform, lib}:
+{ hostPlatform, lib }:
 let
  # Samples are built around the CUDA Toolkit, which is not available for
  # aarch64. Check for both CUDA version and platform.
@ -8,7 +8,7 @@ let
  extension =
    final: _:
    lib.attrsets.optionalAttrs platformIsSupported {
-      cuda-library-samples = final.callPackage ./generic.nix {};
+      cuda-library-samples = final.callPackage ./generic.nix { };
    };
 in
 extension
--- a/pkgs/development/cuda-modules/cuda-library-samples/generic.nix
+++ b/pkgs/development/cuda-modules/cuda-library-samples/generic.nix
@ -22,7 +22,7 @@ let
      cmake
      addOpenGLRunpath
    ];
-    buildInputs = [cudatoolkit];
+    buildInputs = [ cudatoolkit ];
    postFixup = ''
      for exe in $out/bin/*; do
        addOpenGLRunpath $exe
@ -36,7 +36,7 @@ let
        cuSPARSE, cuSOLVER, cuFFT, cuRAND, NPP and nvJPEG.
      '';
      license = lib.licenses.bsd3;
-      maintainers = with lib.maintainers; [obsidian-systems-maintenance] ++ lib.teams.cuda.members;
+      maintainers = with lib.maintainers; [ obsidian-systems-maintenance ] ++ lib.teams.cuda.members;
    };
  };
 in
@ -69,9 +69,9 @@ in

      src = "${src}/cuTENSOR";

-      buildInputs = [cutensor];
+      buildInputs = [ cutensor ];

-      cmakeFlags = ["-DCUTENSOR_EXAMPLE_BINARY_INSTALL_DIR=${builtins.placeholder "out"}/bin"];
+      cmakeFlags = [ "-DCUTENSOR_EXAMPLE_BINARY_INSTALL_DIR=${builtins.placeholder "out"}/bin" ];

      # CUTENSOR_ROOT is double escaped
      postPatch = ''
--- a/pkgs/development/cuda-modules/cuda-samples/generic.nix
+++ b/pkgs/development/cuda-modules/cuda-samples/generic.nix
@ -15,65 +15,63 @@
 let
  inherit (lib) lists strings;
 in
-backendStdenv.mkDerivation (
-  finalAttrs: {
-    strictDeps = true;
+backendStdenv.mkDerivation (finalAttrs: {
+  strictDeps = true;

-    pname = "cuda-samples";
-    version = cudaVersion;
+  pname = "cuda-samples";
+  version = cudaVersion;

-    src = fetchFromGitHub {
-      owner = "NVIDIA";
-      repo = finalAttrs.pname;
-      rev = "v${finalAttrs.version}";
-      inherit hash;
-    };
+  src = fetchFromGitHub {
+    owner = "NVIDIA";
+    repo = finalAttrs.pname;
+    rev = "v${finalAttrs.version}";
+    inherit hash;
+  };

-    nativeBuildInputs =
-      [
-        autoAddDriverRunpath
-        pkg-config
-      ]
-      # CMake has to run as a native, build-time dependency for libNVVM samples.
-      # However, it's not the primary build tool -- that's still make.
-      # As such, we disable CMake's build system.
-      ++ lists.optionals (strings.versionAtLeast finalAttrs.version "12.2") [cmake];
+  nativeBuildInputs =
+    [
+      autoAddDriverRunpath
+      pkg-config
+    ]
+    # CMake has to run as a native, build-time dependency for libNVVM samples.
+    # However, it's not the primary build tool -- that's still make.
+    # As such, we disable CMake's build system.
+    ++ lists.optionals (strings.versionAtLeast finalAttrs.version "12.2") [ cmake ];

-    dontUseCmakeConfigure = true;
+  dontUseCmakeConfigure = true;

-    buildInputs = [
-      cudatoolkit
-      freeimage
-      glfw3
-    ];
+  buildInputs = [
+    cudatoolkit
+    freeimage
+    glfw3
+  ];

-    # See https://github.com/NVIDIA/cuda-samples/issues/75.
-    patches = lib.optionals (finalAttrs.version == "11.3") [
-      (fetchpatch {
-        url = "https://github.com/NVIDIA/cuda-samples/commit/5c3ec60faeb7a3c4ad9372c99114d7bb922fda8d.patch";
-        hash = "sha256-0XxdmNK9MPpHwv8+qECJTvXGlFxc+fIbta4ynYprfpU=";
-      })
-    ];
+  # See https://github.com/NVIDIA/cuda-samples/issues/75.
+  patches = lib.optionals (finalAttrs.version == "11.3") [
+    (fetchpatch {
+      url = "https://github.com/NVIDIA/cuda-samples/commit/5c3ec60faeb7a3c4ad9372c99114d7bb922fda8d.patch";
+      hash = "sha256-0XxdmNK9MPpHwv8+qECJTvXGlFxc+fIbta4ynYprfpU=";
+    })
+  ];

-    enableParallelBuilding = true;
+  enableParallelBuilding = true;

-    preConfigure = ''
-      export CUDA_PATH=${cudatoolkit}
-    '';
+  preConfigure = ''
+    export CUDA_PATH=${cudatoolkit}
+  '';

-    installPhase = ''
-      runHook preInstall
+  installPhase = ''
+    runHook preInstall

-      install -Dm755 -t $out/bin bin/${backendStdenv.hostPlatform.parsed.cpu.name}/${backendStdenv.hostPlatform.parsed.kernel.name}/release/*
+    install -Dm755 -t $out/bin bin/${backendStdenv.hostPlatform.parsed.cpu.name}/${backendStdenv.hostPlatform.parsed.kernel.name}/release/*

-      runHook postInstall
-    '';
+    runHook postInstall
+  '';

-    meta = {
-      description = "Samples for CUDA Developers which demonstrates features in CUDA Toolkit";
-      # CUDA itself is proprietary, but these sample apps are not.
-      license = lib.licenses.bsd3;
-      maintainers = with lib.maintainers; [obsidian-systems-maintenance] ++ lib.teams.cuda.members;
-    };
-  }
-)
+  meta = {
+    description = "Samples for CUDA Developers which demonstrates features in CUDA Toolkit";
+    # CUDA itself is proprietary, but these sample apps are not.
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ obsidian-systems-maintenance ] ++ lib.teams.cuda.members;
+  };
+})
--- a/Show More
+++ b/Show More