Merge master into staging-next

2024-04-10 18:01:22 +00:00 · 2024-04-10 18:01:22 +00:00 · 925fbfdac4
parent b59871bfea 388f9799d7
commit 925fbfdac4
114 changed files with 1091 additions and 6282 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@ -55,7 +55,7 @@
 /pkgs/pkgs-lib/formats/hocon                     @h7x4

 # pkgs/by-name
-/pkgs/test/nixpkgs-check-by-name @infinisil
+/pkgs/test/check-by-name @infinisil
 /pkgs/by-name/README.md @infinisil
 /pkgs/top-level/by-name-overlay.nix @infinisil
 /.github/workflows/check-by-name.yml @infinisil
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -15348,6 +15348,12 @@
    githubId = 1368952;
    name = "Pedro Lara Campos";
  };
+  peefy = {
+    email = "xpf6677@gmail.com";
+    github = "Peefy";
+    githubId = 22744597;
+    name = "Peefy";
+  };
  peelz = {
    email = "peelz.dev+nixpkgs@gmail.com";
    github = "notpeelz";
--- a/nixos/doc/manual/installation/installing.chapter.md
+++ b/nixos/doc/manual/installation/installing.chapter.md
@ -376,7 +376,7 @@ Use the following commands:

    ```ShellSession
    # mkdir -p /mnt/boot
-    # mount /dev/disk/by-label/boot /mnt/boot
+    # mount -o umask=077 /dev/disk/by-label/boot /mnt/boot
    ```

 3.  If your machine has a limited amount of memory, you may want to
@ -572,7 +572,7 @@ With a partitioned disk.
 # mkfs.fat -F 32 -n boot /dev/sda3        # (for UEFI systems only)
 # mount /dev/disk/by-label/nixos /mnt
 # mkdir -p /mnt/boot                      # (for UEFI systems only)
-# mount /dev/disk/by-label/boot /mnt/boot # (for UEFI systems only)
+# mount -o umask=077 /dev/disk/by-label/boot /mnt/boot # (for UEFI systems only)
 # nixos-generate-config --root /mnt
 # nano /mnt/etc/nixos/configuration.nix
 # nixos-install
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -176,6 +176,10 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 - `programs.nix-ld.libraries` no longer sets `baseLibraries` via the option's default but in config and now merges any additional libraries with the default ones.
  This means that `lib.mkForce` must be used to clear the list of default libraries.

+- `cudaPackages.autoAddOpenGLRunpathHook` and `cudaPackages.autoAddDriverRunpath` have been deprecated for `pkgs.autoAddDriverRunpath`. Functionality has not changed, but the setuphook has been renamed and moved to the top-level package scope.
+
+- `cudaPackages.autoFixElfFiles` has been deprecated for `pkgs.autoFixElfFiles`. Functionality has not changed, but the setuphook has been renamed and moved to the top-level package scope.
+
 - `pdns` was updated to version [v4.9.x](https://doc.powerdns.com/authoritative/changelog/4.9.html), which introduces breaking changes. Check out the [Upgrade Notes](https://doc.powerdns.com/authoritative/upgrading.html#to-4-9-0) for details.

 - `unrar` was updated to v7. See [changelog](https://www.rarlab.com/unrar7notes.htm) for more information.
@ -318,7 +322,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - `xxd` has been moved from `vim` default output to its own output to reduce closure size. The canonical way to reference it across all platforms is `unixtools.xxd`.

- `programs.fzf.keybindings` and `programs.fzf.fuzzyCompletion` got replaced by `programs.fzf.enabled` as shell-completion is included in the fzf-binary now there is no easy option to load completion and keybindings separately. Please consult fzf-documentation on how to configure/disable certain keybindings.
+- `programs.fzf.keybindings` and `programs.fzf.fuzzyCompletion` got replaced by `programs.fzf.enable` as shell-completion is included in the fzf-binary now there is no easy option to load completion and keybindings separately. Please consult fzf-documentation on how to configure/disable certain keybindings.

 - The `stalwart-mail` package has been updated to v0.5.3, which includes [breaking changes](https://github.com/stalwartlabs/mail-server/blob/v0.5.3/UPGRADING.md).

--- a/nixos/lib/testing/meta.nix
+++ b/nixos/lib/testing/meta.nix
@ -36,7 +36,7 @@ in
          };
          platforms = lib.mkOption {
            type = types.listOf types.raw;
-            default = lib.platforms.linux;
+            default = lib.platforms.linux ++ lib.platforms.darwin;
            description = ''
              Sets the [`meta.platforms`](https://nixos.org/manual/nixpkgs/stable/#var-meta-platforms) attribute on the [{option}`test`](#test-opt-test) derivation.
            '';
--- a/nixos/modules/installer/tools/nixos-generate-config.pl
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@ -453,6 +453,17 @@ EOF
        }
    }

+    # Preserve umask (fmask, dmask) settings for vfat filesystems.
+    # (The default is to mount these world-readable, but that's a security risk
+    # for the EFI System Partition.)
+    if ($fsType eq "vfat") {
+        for (@superOptions) {
+            if ($_ =~ /fmask|dmask/) {
+                push @extraOptions, $_;
+            }
+        }
+    }
+
    # is this a stratis fs?
    my $stableDevPath = findStableDevPath $device;
    my $stratisPool;
--- a/nixos/modules/programs/fzf.nix
+++ b/nixos/modules/programs/fzf.nix
@ -9,11 +9,11 @@ in
 {
  imports = [
    (lib.mkRemovedOptionModule [ "programs" "fzf" "keybindings" ] ''
-      Use "programs.fzf.enabled" instead, due to fzf upstream-change it's not possible to load shell-completion and keybindings separately.
+      Use "programs.fzf.enable" instead, due to fzf upstream-change it's not possible to load shell-completion and keybindings separately.
      If you want to change/disable certain keybindings please check the fzf-documentation.
    '')
    (lib.mkRemovedOptionModule [ "programs" "fzf" "fuzzyCompletion" ] ''
-      Use "programs.fzf.enabled" instead, due to fzf upstream-change it's not possible to load shell-completion and keybindings separately.
+      Use "programs.fzf.enable" instead, due to fzf upstream-change it's not possible to load shell-completion and keybindings separately.
      If you want to change/disable certain keybindings please check the fzf-documentation.
    '')
  ];
--- a/nixos/modules/services/misc/nix-optimise.nix
+++ b/nixos/modules/services/misc/nix-optimise.nix
@ -42,9 +42,11 @@ in
        startAt = lib.optionals cfg.automatic cfg.dates;
      };

-      timers.nix-optimise.timerConfig = {
-        Persistent = true;
-        RandomizedDelaySec = 1800;
+      timers.nix-optimise = lib.mkIf cfg.automatic {
+        timerConfig = {
+          Persistent = true;
+          RandomizedDelaySec = 1800;
+        };
      };
    };
  };
--- a/pkgs/applications/audio/kid3/default.nix
+++ b/pkgs/applications/audio/kid3/default.nix
@ -1,5 +1,4 @@
-{
-  chromaprint
+{ chromaprint
 , cmake
 , docbook_xml_dtd_45
 , docbook_xsl
@ -7,25 +6,43 @@
 , ffmpeg
 , flac
 , id3lib
+, kdePackages
 , lib
 , libogg
 , libvorbis
 , libxslt
 , mp4v2
-, phonon
 , pkg-config
 , python3
 , qtbase
+, qtdeclarative
 , qtmultimedia
-, qtquickcontrols
 , qttools
 , readline
 , stdenv
 , taglib
 , wrapQtAppsHook
 , zlib
+, withCLI ? true
+, withKDE ? true
+, withQt ? false
 }:

+let
+  inherit (lib) optionals;
+
+  apps = lib.concatStringsSep ";" (
+    optionals withCLI [ "CLI" ]
+    ++ optionals withKDE [ "KDE" ]
+    ++ optionals withQt [ "Qt" ]
+  );
+
+  mainProgram =
+    if withQt then "kid3-qt"
+    else if withKDE then "kid3"
+    else "kid3-cli";
+
+in
 stdenv.mkDerivation (finalAttrs: {
  pname = "kid3";
  version = "3.9.5";
@ -41,6 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
    docbook_xsl
    pkg-config
    python3
+    qttools
    wrapQtAppsHook
  ];

@ -53,25 +71,32 @@ stdenv.mkDerivation (finalAttrs: {
    libvorbis
    libxslt
    mp4v2
-    phonon
    qtbase
+    qtdeclarative
    qtmultimedia
-    qtquickcontrols
-    qttools
    readline
    taglib
    zlib
-  ];
+  ] ++ lib.optionals withKDE (with kdePackages; [
+    kconfig
+    kconfigwidgets
+    kcoreaddons
+    kio
+    kxmlgui
+    phonon
+  ]);

-  cmakeFlags = [ "-DWITH_APPS=Qt;CLI" ];
-  NIX_LDFLAGS = "-lm -lpthread";
+  cmakeFlags = [ (lib.cmakeFeature "WITH_APPS" apps) ];

-  preConfigure = ''
-    export DOCBOOKDIR="${docbook_xsl}/xml/xsl/docbook/"
-  '';
+  env = {
+    DOCBOOKDIR = "${docbook_xsl}/xml/xsl/docbook/";
+    LANG = "C.UTF-8";
+    NIX_LDFLAGS = "-lm -lpthread";
+  };

  meta = {
    description = "A simple and powerful audio tag editor";
+    inherit mainProgram;
    homepage = "https://kid3.kde.org/";
    license = lib.licenses.lgpl2Plus;
    longDescription = ''
@ -103,7 +128,7 @@ stdenv.mkDerivation (finalAttrs: {
      - Edit synchronized lyrics and event timing codes, import and export
        LRC files.
    '';
-    maintainers = [ lib.maintainers.AndersonTorres ];
+    maintainers = with lib.maintainers; [ AndersonTorres ];
    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/applications/blockchains/bitcoin-abc/default.nix
+++ b/pkgs/applications/blockchains/bitcoin-abc/default.nix
@ -25,13 +25,13 @@

 mkDerivation rec {
  pname = "bitcoin" + lib.optionalString (!withGui) "d" + "-abc";
-  version = "0.29.0";
+  version = "0.29.1";

  src = fetchFromGitHub {
    owner = "bitcoin-ABC";
    repo = "bitcoin-abc";
    rev = "v${version}";
-    hash = "sha256-9BJfzGXX9b7JRWFU9Flda8CWDqkgE2/IZcPopCyfBck=";
+    hash = "sha256-QEuOMl1sbVdB2nRwBO/2adqj/NIQGbwrBqML39fymM0=";
  };

  nativeBuildInputs = [ pkg-config cmake ];
--- a/pkgs/applications/editors/quartus-prime/default.nix
+++ b/pkgs/applications/editors/quartus-prime/default.nix
@ -1,7 +1,8 @@
 { lib, buildFHSEnv, callPackage, makeDesktopItem, writeScript, runtimeShell
-, runCommand, quartus-prime-lite
+, runCommand, unstick, quartus-prime-lite
+, withQuesta ? true
 , supportedDevices ? [ "Arria II" "Cyclone V" "Cyclone IV" "Cyclone 10 LP" "MAX II/V" "MAX 10 FPGA" ]
-, unwrapped ? callPackage ./quartus.nix { inherit supportedDevices; }
+, unwrapped ? callPackage ./quartus.nix { inherit unstick supportedDevices withQuesta; }
 }:

 let
@ -18,11 +19,12 @@ in buildFHSEnv rec {
  name = "quartus-prime-lite"; # wrapped

  targetPkgs = pkgs: with pkgs; [
-    (runCommand "ld-lsb-compat" {} ''
+    (runCommand "ld-lsb-compat" {} (''
      mkdir -p "$out/lib"
      ln -sr "${glibc}/lib/ld-linux-x86-64.so.2" "$out/lib/ld-lsb-x86-64.so.3"
+    '' + lib.optionalString withQuesta ''
      ln -sr "${pkgsi686Linux.glibc}/lib/ld-linux.so.2" "$out/lib/ld-lsb.so.3"
-    '')
+    ''))
    # quartus requirements
    glib
    xorg.libICE
@ -37,11 +39,14 @@ in buildFHSEnv rec {
    # qsys requirements
    xorg.libXtst
    xorg.libXi
+    dejavu_fonts
+    gnumake
  ];

-  # Also support 32-bit executables.
-  multiArch = true;
+  # Also support 32-bit executables used by simulator.
+  multiArch = withQuesta;

+  # these libs are installed as 64 bit, plus as 32 bit when multiArch is true
  multiPkgs = pkgs: with pkgs; let
    # This seems ugly - can we override `libpng = libpng12` for all `pkgs`?
    freetype = pkgs.freetype.override { libpng = libpng12; };
--- a/pkgs/applications/editors/quartus-prime/quartus.nix
+++ b/pkgs/applications/editors/quartus-prime/quartus.nix
@ -1,4 +1,5 @@
 { stdenv, lib, unstick, fetchurl
+, withQuesta ? true
 , supportedDevices ? [ "Arria II" "Cyclone V" "Cyclone IV" "Cyclone 10 LP" "MAX II/V" "MAX 10 FPGA" ]
 }:

@ -41,26 +42,25 @@ let
    url = "https://downloads.intel.com/akdlm/software/acdsinst/${lib.versions.majorMinor version}std/${lib.elemAt (lib.splitVersion version) 4}/ib_installers/${name}";
  };

+  installers = map download ([{
+    name = "QuartusLiteSetup-${version}-linux.run";
+    sha256 = "1mg4db56rg407kdsvpzys96z59bls8djyddfzxi6bdikcklxz98h";
+  }] ++ lib.optional withQuesta {
+    name = "QuestaSetup-${version}-linux.run";
+    sha256 = "0f9lyphk4vf4ijif3kb4iqf18jl357z9h8g16kwnzaqwfngh2ixk";
+  });
+  components = map (id: download {
+    name = "${id}-${version}.qdz";
+    sha256 = lib.getAttr id componentHashes;
+  }) (lib.attrValues supportedDeviceIds);
+
 in stdenv.mkDerivation rec {
  inherit version;
  pname = "quartus-prime-lite-unwrapped";

-  src = map download ([{
-    name = "QuartusLiteSetup-${version}-linux.run";
-    sha256 = "1mg4db56rg407kdsvpzys96z59bls8djyddfzxi6bdikcklxz98h";
-  } {
-    name = "QuestaSetup-${version}-linux.run";
-    sha256 = "0f9lyphk4vf4ijif3kb4iqf18jl357z9h8g16kwnzaqwfngh2ixk";
-  }] ++ (map (id: {
-    name = "${id}-${version}.qdz";
-    sha256 = lib.getAttr id componentHashes;
-  }) (lib.attrValues supportedDeviceIds)));
-
  nativeBuildInputs = [ unstick ];

  buildCommand = let
-    installers = lib.sublist 0 2 src;
-    components = lib.sublist 2 ((lib.length src) - 2) src;
    copyInstaller = installer: ''
        # `$(cat $NIX_CC/nix-support/dynamic-linker) $src[0]` often segfaults, so cp + patchelf
        cp ${installer} $TEMP/${installer.name}
@ -68,22 +68,32 @@ in stdenv.mkDerivation rec {
        patchelf --interpreter $(cat $NIX_CC/nix-support/dynamic-linker) $TEMP/${installer.name}
      '';
    copyComponent = component: "cp ${component} $TEMP/${component.name}";
-    # leaves enabled: quartus, questa_fse, devinfo
+    # leaves enabled: quartus, devinfo
    disabledComponents = [
      "quartus_help"
      "quartus_update"
-      # not questa_fse
      "questa_fe"
-    ] ++ (lib.attrValues unsupportedDeviceIds);
+    ] ++ (lib.optional (!withQuesta) "questa_fse")
+      ++ (lib.attrValues unsupportedDeviceIds);
  in ''
+      echo "setting up installer..."
      ${lib.concatMapStringsSep "\n" copyInstaller installers}
      ${lib.concatMapStringsSep "\n" copyComponent components}

+      echo "executing installer..."
+      # "Could not load seccomp program: Invalid argument" might occur if unstick
+      # itself is compiled for x86_64 instead of the non-x86 host. In that case,
+      # override the input.
      unstick $TEMP/${(builtins.head installers).name} \
        --disable-components ${lib.concatStringsSep "," disabledComponents} \
        --mode unattended --installdir $out --accept_eula 1

+      echo "cleaning up..."
      rm -r $out/uninstall $out/logs
+
+      # replace /proc pentium check with a true statement. this allows usage under emulation.
+      substituteInPlace $out/quartus/adm/qenv.sh \
+        --replace-fail 'grep sse /proc/cpuinfo > /dev/null 2>&1' ':'
    '';

  meta = with lib; {
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -4271,6 +4271,18 @@ final: prev:
    meta.homepage = "https://github.com/morhetz/gruvbox/";
  };

+  gruvbox-baby = buildVimPlugin {
+    pname = "gruvbox-baby";
+    version = "2024-01-25";
+    src = fetchFromGitHub {
+      owner = "luisiacc";
+      repo = "gruvbox-baby";
+      rev = "bd52e62d8134647090108189e69c8b3cd18bdbbf";
+      sha256 = "17wnc3zpxki0fy8fbkinj0jvf6hnkz139x6yrg7hmj97aa8rh4sj";
+    };
+    meta.homepage = "https://github.com/luisiacc/gruvbox-baby/";
+  };
+
  gruvbox-flat-nvim = buildVimPlugin {
    pname = "gruvbox-flat.nvim";
    version = "2023-05-27";
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -356,6 +356,7 @@ https://github.com/liuchengxu/graphviz.vim/,,
 https://github.com/blazkowolf/gruber-darker.nvim/,,
 https://github.com/gruvbox-community/gruvbox/,,gruvbox-community
 https://github.com/morhetz/gruvbox/,,
+https://github.com/luisiacc/gruvbox-baby/,HEAD,
 https://github.com/eddyekofo94/gruvbox-flat.nvim/,,
 https://github.com/sainnhe/gruvbox-material/,,
 https://github.com/ellisonleao/gruvbox.nvim/,,
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@ -15,11 +15,11 @@ let
  archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "1jy1lsbha951z2bcnfrkgin7nms3clpa97rx7c7pdm23mnyg9073";
-    x86_64-darwin = "0425cnzw1dz2k6a9p63w7vf25icf02m04ri82dp0k1kvhjfr8l37";
-    aarch64-linux = "123p1glr9rc1z2lfl8g5zw7rcipg1njybscqn9qyzkpqymcsqfdy";
-    aarch64-darwin = "1bl5wvbfr5k1vy6ah2i9548cn1l3nx3ng4c544zvclskmr8kf84s";
-    armv7l-linux = "0nyv3yjqcrg4r2m2d63qz34g07pp8n0ndmai9pqwcf7a1m0v0sj4";
+    x86_64-linux = "1a9k4w6ggmrd17i038gi40d3hp24z5vs8nidxr5kvl74fi61js6y";
+    x86_64-darwin = "1q9lwx96zcz517pvr97mjqhv86p41ff3cw5jisxbsg6f76aw8y1y";
+    aarch64-linux = "1fdg9xz1fq9k8fc9x0an2kb8hn2vvbsnc48nv6lbx1j5aaa3k42g";
+    aarch64-darwin = "0kqqn24cimbqb8s7rz64niyknpp36w5ycdw8xfms20zfm5ybm82k";
+    armv7l-linux = "14rkr7k0axlaiplf0hdcmyqfgffng25s0j2i903if3i3sqv7316i";
  }.${system} or throwSystem;

  sourceRoot = lib.optionalString (!stdenv.isDarwin) ".";
@ -29,7 +29,7 @@ in

    # Please backport all compatible updates to the stable release.
    # This is important for the extension ecosystem.
-    version = "1.87.2.24072";
+    version = "1.88.0.24096";
    pname = "vscodium";

    executableName = "codium";
--- a/pkgs/applications/emulators/retroarch/hashes.json
+++ b/pkgs/applications/emulators/retroarch/hashes.json
@ -287,31 +287,31 @@
        "src": {
            "owner": "libretro",
            "repo": "fbneo",
-            "rev": "537b5b8dcc358370f2349109004233fbeab46cfe",
-            "hash": "sha256-zBOF1RV2dx5zraREZm/W//8DwrRMDc/j8sx+CwTyKz0="
+            "rev": "cb370363935458e723e0594fb03380c04e7f455b",
+            "hash": "sha256-u0kBdqfUu7QmZBbuLaDJRnsDUJLZiURF6BSkwOX8zpU="
        },
-        "version": "unstable-2024-04-02"
+        "version": "unstable-2024-04-08"
    },
    "fceumm": {
        "fetcher": "fetchFromGitHub",
        "src": {
            "owner": "libretro",
            "repo": "libretro-fceumm",
-            "rev": "40969671ce9e4b1a49165d836476cd71bb960131",
-            "hash": "sha256-wdAigh3qUzB3wmh6q/dwCHHhuyqyAmqV+NSvrzjODVM="
+            "rev": "aebea8783652bc75b21b9d2dcb28cedf1fa78e8a",
+            "hash": "sha256-4ux8pI2d8djkwY0M+h5tlXrLGIDHnMFiFqAWKrZAsxA="
        },
-        "version": "unstable-2024-03-02"
+        "version": "unstable-2024-04-06"
    },
    "flycast": {
        "fetcher": "fetchFromGitHub",
        "src": {
            "owner": "flyinghead",
            "repo": "flycast",
-            "rev": "a0c81d2f2a393bd34caf6f15c1231ba4e2175405",
-            "hash": "sha256-hajTfovkSH7l6AayQyiHI7E4I/82pBhQnDSxo0BcYu0=",
+            "rev": "9d6eab74e1eb182d627f63e1db79752852e9d230",
+            "hash": "sha256-Zi98lszi42XV6u0RhOnt6TVqAfdSaZRcpJIJDwI+ThU=",
            "fetchSubmodules": true
        },
-        "version": "unstable-2024-04-03"
+        "version": "unstable-2024-04-05"
    },
    "fmsx": {
        "fetcher": "fetchFromGitHub",
@ -358,10 +358,10 @@
        "src": {
            "owner": "libretro",
            "repo": "Genesis-Plus-GX",
-            "rev": "667158b034ce860e345b13e1ed927fea9d155b96",
-            "hash": "sha256-uerlejdqJO+vPDs1K7dAxImfJzWrEWlVhF/uTaQoo6E="
+            "rev": "b063aa81b90682ca89ae6fd1e958bc589b4ce34d",
+            "hash": "sha256-Tz6if6NfbwvZVDb5Ggr/tXuLNymOjcMkghKwZq6tl6I="
        },
-        "version": "unstable-2024-03-15"
+        "version": "unstable-2024-04-05"
    },
    "gpsp": {
        "fetcher": "fetchFromGitHub",
@ -408,10 +408,10 @@
        "src": {
            "owner": "libretro",
            "repo": "mame",
-            "rev": "ac9d0347f5d331eb49017cd599a5e63a668b4f22",
-            "hash": "sha256-YlnW5v8Slz/w/AHwWzJ7ZszFic/W0wth2nOZVOD7yxs="
+            "rev": "3aa1ff0d6c087ac35530572d09bc42a2591ff78f",
+            "hash": "sha256-pSBaheo3R5Oxn3nAG8AqodaRtYDIcmT4QVIzLjefa3c="
        },
-        "version": "unstable-2024-04-01"
+        "version": "unstable-2024-04-05"
    },
    "mame2000": {
        "fetcher": "fetchFromGitHub",
@ -438,10 +438,10 @@
        "src": {
            "owner": "libretro",
            "repo": "mame2003-plus-libretro",
-            "rev": "f03f865af9d496965ab15b9a213691319daad9d2",
-            "hash": "sha256-yHVkEJYSXHeUGNFJ/zbAwNi+I4gka8Id7z+LnDkCCSM="
+            "rev": "bf250331362db8fa08a5b3ef60decffba90bf564",
+            "hash": "sha256-7KxQtmmjJuDzoYzpQi/z6eYtThop3Qc1wY0JpUyv26A="
        },
-        "version": "unstable-2024-04-03"
+        "version": "unstable-2024-04-09"
    },
    "mame2010": {
        "fetcher": "fetchFromGitHub",
@ -559,10 +559,10 @@
        "src": {
            "owner": "libretro",
            "repo": "nestopia",
-            "rev": "efe3a052c75ad47d6e98eeffd1f3d2d4893279c2",
-            "hash": "sha256-sSXU+rUBJcE2gQRTqnZV8NSuBz/zWNxlZHQqoAUoigU="
+            "rev": "b99ede358b2219602443e7f414eabf81e17da244",
+            "hash": "sha256-iciidNkOhie3qJO8D4yB081ywfQtGGMrKBWFmBpps9g="
        },
-        "version": "unstable-2024-03-29"
+        "version": "unstable-2024-04-07"
    },
    "np2kai": {
        "fetcher": "fetchFromGitHub",
@ -630,10 +630,10 @@
        "src": {
            "owner": "libretro",
            "repo": "pcsx_rearmed",
-            "rev": "2fb8465594a7ffb7ccbac39fdedf7c70085d7f63",
-            "hash": "sha256-RQU2EDcBRa6aH40JrEJ3eppjflk5++AWlOH+iGJyjFY="
+            "rev": "4cc48a6b324ff1d025768bb5436279831e4bf319",
+            "hash": "sha256-bW/soI5/HgV71L7SdouAeR5ex54veJCTdCXCMwfxHIk="
        },
-        "version": "unstable-2024-03-29"
+        "version": "unstable-2024-04-06"
    },
    "picodrive": {
        "fetcher": "fetchFromGitHub",
@ -651,22 +651,22 @@
        "src": {
            "owner": "jpd002",
            "repo": "Play-",
-            "rev": "8445595b734301f22c6fdd57536867fea3786b58",
-            "hash": "sha256-3e9+PkSGZbjZ2LVY0cWRIK+TbdJ4hn8FxBjWqhsQB4o=",
+            "rev": "8f9fab334eb4ae6faf9cfd88f802cad68674792b",
+            "hash": "sha256-KzRj7Xjfqoi/m+eEHk6Lfk/6FHk4YtrGkY++sjUvT/Y=",
            "fetchSubmodules": true
        },
-        "version": "unstable-2024-04-02"
+        "version": "unstable-2024-04-09"
    },
    "ppsspp": {
        "fetcher": "fetchFromGitHub",
        "src": {
            "owner": "hrydgard",
            "repo": "ppsspp",
-            "rev": "5bead8d999717ed13f7808d3e6b88a237806899e",
-            "hash": "sha256-bGNlzpC3xPX5xyFyMfXbeR4q3Q9bGN/oRwFTLcgzfJM=",
+            "rev": "1bcb15576252ac4b253c39f7c34ea372a3637d96",
+            "hash": "sha256-bc0gJi2C+ZBlF7qczSQ+L4bZD5zt7NNIESEwdpqOhTY=",
            "fetchSubmodules": true
        },
-        "version": "unstable-2024-04-04"
+        "version": "unstable-2024-04-09"
    },
    "prboom": {
        "fetcher": "fetchFromGitHub",
--- a/pkgs/applications/misc/ausweisapp/default.nix
+++ b/pkgs/applications/misc/ausweisapp/default.nix
@ -15,13 +15,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "ausweisapp";
-  version = "2.1.0";
+  version = "2.1.1";

  src = fetchFromGitHub {
    owner = "Governikus";
    repo = "AusweisApp2";
    rev = finalAttrs.version;
-    hash = "sha256-wgVu5Yr65Gu1z5SEWy5l4B6UiI5bIobBfZLhL7s+SRE=";
+    hash = "sha256-YRRm8/yDwQIUjzqYzlqij8h2ri39Q7L8jVh5fgrZbGs=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/googleearth-pro/default.nix
+++ b/pkgs/applications/misc/googleearth-pro/default.nix
@ -120,6 +120,6 @@ mkDerivation rec {
    license = licenses.unfree;
    maintainers = with maintainers; [ friedelino shamilton ];
    platforms = platforms.linux;
-    knownVulnerabilities = [ "Includes vulnerable bundled libraries." ];
+    knownVulnerabilities = [ "Includes vulnerable versions of bundled libraries: openssl, ffmpeg, gdal, and proj." ];
  };
 }
--- a/pkgs/applications/misc/minder/default.nix
+++ b/pkgs/applications/misc/minder/default.nix
@ -25,13 +25,13 @@

 stdenv.mkDerivation rec {
  pname = "minder";
-  version = "1.16.3";
+  version = "1.16.4";

  src = fetchFromGitHub {
    owner = "phase1geo";
    repo = pname;
    rev = version;
-    sha256 = "sha256-YDsWWC4exh+9V87WyjdMdCH1arjBct3oEXbvaFyAaMY=";
+    sha256 = "sha256-1r2PbBYw4mmiScKbX9BGqe4i+emSvismJfPm3opLlOg=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/pgmodeler/default.nix
+++ b/pkgs/applications/misc/pgmodeler/default.nix
@ -7,6 +7,8 @@
 , qtwayland
 , qtsvg
 , postgresql
+, cups
+, libxml2
 }:

 stdenv.mkDerivation rec {
@ -21,16 +23,34 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ pkg-config qmake wrapQtAppsHook ];
-  qmakeFlags = [ "pgmodeler.pro" "CONFIG+=release" ];
+  qmakeFlags = [ "pgmodeler.pro" "CONFIG+=release" ] ++ lib.optionals stdenv.isDarwin [
+    "PGSQL_INC=${postgresql}/include"
+    "PGSQL_LIB=${postgresql.lib}/lib/libpq.dylib"
+    "XML_INC=${libxml2.dev}/include/libxml2"
+    "XML_LIB=${libxml2.out}/lib/libxml2.dylib"
+    "PREFIX=${placeholder "out"}/Applications/pgModeler.app/Contents"
+  ];

  # todo: libpq would suffice here. Unfortunately this won't work, if one uses only postgresql.lib here.
-  buildInputs = [ postgresql qtsvg qtwayland ];
+  buildInputs = [ postgresql qtsvg ]
+    ++ lib.optionals stdenv.isLinux [ qtwayland ]
+    ++ lib.optionals stdenv.isDarwin [ cups libxml2 ];
+
+  postInstall = lib.optionalString stdenv.isDarwin ''
+    mkdir -p $out/bin
+    for item in pgmodeler pgmodeler-{cli,se,ch}
+    do
+      ln -s $out/Applications/pgModeler.app/Contents/MacOS/$item $out/bin
+    done
+  '';
+
+  dontWrapQtApps = stdenv.isDarwin;

  meta = with lib; {
    description = "A database modeling tool for PostgreSQL";
    homepage = "https://pgmodeler.io/";
    license = licenses.gpl3;
    maintainers = [ maintainers.esclear ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/misc/tandoor-recipes/common.nix
+++ b/pkgs/applications/misc/tandoor-recipes/common.nix
@ -1,15 +1,15 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "1.5.12";
+  version = "1.5.16";

  src = fetchFromGitHub {
    owner = "TandoorRecipes";
    repo = "recipes";
    rev = version;
-    hash = "sha256-5UslXRoiq9cipGCOiqpf+rv7OPTsW4qpVTjakNeg4ug=";
+    hash = "sha256-A5cPO3uybTmAV8zWY90S9vtU/tLgbh1Iqhi+ty0RLhM=";
  };

-  yarnHash = "sha256-CresovsRh+dLHGnv49fCi/i66QXOS3SnzfFNvkVUfd8=";
+  yarnHash = "sha256-OAgVaXWTVlKqIgDgKNT1MWN3dYzTqrAGgNAnXLDHE+I=";

  meta = with lib; {
    homepage = "https://tandoor.dev/";
--- a/pkgs/applications/misc/tandoor-recipes/default.nix
+++ b/pkgs/applications/misc/tandoor-recipes/default.nix
@ -32,15 +32,15 @@ python.pkgs.pythonPackages.buildPythonPackage rec {
  format = "other";

  patches = [
-    # Allow setting MEDIA_ROOT through environment variable
-    # https://github.com/TandoorRecipes/recipes/pull/2931
-    (fetchpatch {
-      url = "https://github.com/TandoorRecipes/recipes/commit/abf981792057481f1d5b7473eb1090b3901ef8fa.patch";
-      hash = "sha256-3AFf0K/BpVwPQ2NGLUsefj6HvW7ej3szd3WaxFoqMiQ=";
-    })
+    ./pytest-xdist.patch # adapt pytest.ini the use $NIX_BUILD_CORES
  ];

+  postPatch = ''
+    substituteInPlace pytest.ini --subst-var NIX_BUILD_CORES
+  '';
+
  propagatedBuildInputs = with python.pkgs; [
+    aiohttp
    beautifulsoup4
    bleach
    bleach-allowlist
@ -50,7 +50,6 @@ python.pkgs.pythonPackages.buildPythonPackage rec {
    django-allauth
    django-annoying
    django-auth-ldap
-    django-autocomplete-light
    django-cleanup
    django-cors-headers
    django-crispy-forms
@ -132,15 +131,21 @@ python.pkgs.pythonPackages.buildPythonPackage rec {
  '';

  nativeCheckInputs = with python.pkgs; [
+    mock
    pytestCheckHook
+    pytest-asyncio
+    pytest-cov
    pytest-django
    pytest-factoryboy
+    pytest-html
+    pytest-xdist
  ];

  # flaky
  disabledTests = [
    "test_search_count"
    "test_url_import_regex_replace"
+    "test_delete"
  ];

  passthru = {
--- a/pkgs/applications/misc/tandoor-recipes/pytest-xdist.patch
+++ b/pkgs/applications/misc/tandoor-recipes/pytest-xdist.patch
@ -0,0 +1,12 @@
+diff --git a/pytest.ini b/pytest.ini
+index a3d26ec4..8bdf12fb 100644
+--- a/pytest.ini
+++ b/pytest.ini
+@@ -3,5 +3,5 @@ DJANGO_SETTINGS_MODULE = recipes.test_settings
+ testpaths = cookbook/tests
+ python_files = tests.py test_*.py *_tests.py
+ # uncomment to run coverage reports
+-addopts = -n auto --cov=. --cov-report=html:docs/reports/coverage --cov-report=xml:docs/reports/coverage/coverage.xml --junitxml=docs/reports/tests/pytest.xml --html=docs/reports/tests/tests.html
+addopts = -n @NIX_BUILD_CORES@ --cov=. --cov-report=html:docs/reports/coverage --cov-report=xml:docs/reports/coverage/coverage.xml --junitxml=docs/reports/tests/pytest.xml --html=docs/reports/tests/tests.html
+ # addopts = -n auto --junitxml=docs/reports/tests/pytest.xml --html=docs/reports/tests/tests.html
+\ No newline at end of file
--- a/pkgs/applications/networking/avalanchego/default.nix
+++ b/pkgs/applications/networking/avalanchego/default.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "avalanchego";
-  version = "1.11.3";
+  version = "1.11.4";

  src = fetchFromGitHub {
    owner = "ava-labs";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-VeszkBExveXmajnVLHDp9Fc9xngnUKBbVY55L260rds=";
+    hash = "sha256-0YS+q1gy7YmTx/DwxaElBG1tzosXReXqPu6RpR3hTjw=";
  };

-  vendorHash = "sha256-8K8loSdeISkA06LBkZgro+mEbQEZY1sdzplq7IKZ4kI=";
+  vendorHash = "sha256-et1PVLJQ/vBsg5438s6d9MA2oV40zahp9YKQOE0RX58=";
  # go mod vendor has a bug, see: https://github.com/golang/go/issues/57529
  proxyVendor = true;

--- a/pkgs/applications/networking/cluster/arkade/default.nix
+++ b/pkgs/applications/networking/cluster/arkade/default.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "arkade";
-  version = "0.11.6";
+  version = "0.11.9";

  src = fetchFromGitHub {
    owner = "alexellis";
    repo = "arkade";
    rev = version;
-    hash = "sha256-PCyPdUgvW2wCo1MZ/5jbPLfermbYKZKDbAFsc2goqlY=";
+    hash = "sha256-TJja4FL440ZG5VsCfJsKUYeM2YPlMSl2+ejjlgyP5IY=";
  };

  CGO_ENABLED = 0;
--- a/pkgs/applications/networking/cluster/kubespy/default.nix
+++ b/pkgs/applications/networking/cluster/kubespy/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kubespy";
-  version = "0.6.2";
+  version = "0.6.3";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "pulumi";
    repo = "kubespy";
-    sha256 = "sha256-eSQl8K+a9YcKXE80bl25+alHoBG8T+LCYOd4Bd9QSdY=";
+    sha256 = "sha256-l/vOIFvCQHq+gOr38SpVZ8ShZdI1bP4G5PY4hKhkCU0=";
  };

-  vendorHash = "sha256-brs4QIo4QoLHU95llBHN51zYcgQgN7kbMJDMy2OYOsk=";
+  vendorHash = "sha256-4q+eFMrcZsEdk1W7aorIrfS3oVAuD4V0KQ7oJ/5d8nk=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/networking/cluster/tftui/default.nix
+++ b/pkgs/applications/networking/cluster/tftui/default.nix
@ -7,14 +7,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "tftui";
-  version = "0.12.6";
+  version = "0.13.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "idoavrah";
    repo = "terraform-tui";
    rev = "refs/tags/v${version}";
-    hash = "sha256-vK1qKf8+RxwHUpuEQ97PcwGvObNVpd88kAb3DFRoRG0=";
+    hash = "sha256-2Kya0MRa1kc3B5nqs2MNprtnjOGyMLQh2OSErdT5W8M=";
  };

  pythonRelaxDeps = [
--- a/pkgs/applications/networking/deck/default.nix
+++ b/pkgs/applications/networking/deck/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "deck";
-  version = "1.36.1";
+  version = "1.36.2";

  src = fetchFromGitHub {
    owner = "Kong";
    repo = "deck";
    rev = "v${version}";
-    hash = "sha256-9wPwqiQBVVGCRVarAAWk9QjkbJBgCAKY16MjqT8ZBI4=";
+    hash = "sha256-8iRWV+zm/qiSJUgx8OnCf0sZqycXnAv4dUtbTIzIT5k=";
  };

  nativeBuildInputs = [ installShellFiles ];
@ -21,7 +21,7 @@ buildGoModule rec {
  ];

  proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-WNyDHFdqUREATvJW+akhLB1HQIXMZshn48FEw/OkfV0=";
+  vendorHash = "sha256-c5kq5vql3KSv8gkm4Wrp1llUhUOWZuuhkzNXDYrgUhw=";

  postInstall = ''
    installShellCompletion --cmd deck \
--- a/pkgs/applications/networking/instant-messengers/element/pin.nix
+++ b/pkgs/applications/networking/instant-messengers/element/pin.nix
@ -1,9 +1,9 @@
 {
-  "version" = "1.11.63";
+  "version" = "1.11.64";
  "hashes" = {
-    "desktopSrcHash" = "sha256-wQSFnF3HzERW4iS5leHP2LZKrJkTPW+LUgmj5b0/KZk=";
-    "desktopYarnHash" = "003d44psrw09dldvp9lfhsnipmcy1fwbicsvmd48mg7n3vnrg0zw";
-    "webSrcHash" = "sha256-FjYDwXa+7Lx/K0AERn64mPbjp0QFIoVoYMPx/mG4Zrs=";
-    "webYarnHash" = "0n7z9y3141rx0c5476zw3ccfck0f4b2jwsaxmq2ff7spwyw81zd2";
+    "desktopSrcHash" = "sha256-U6vVuc7claPZI4idZmTXpm1GHm+VrmoaJNVgJU0GHMU=";
+    "desktopYarnHash" = "079jg178cq2m91fhzrdab8x33wrm5a97ga19g0268q118vbnv98l";
+    "webSrcHash" = "sha256-jphxYlSxHjck6XA3JXofC6AbVb+aVOjsbxLUqo1hRhY=";
+    "webYarnHash" = "0q91llgx8cy6zxinfqbnrcfkmclqx7czlp08f1ls43x0w2vd8447";
  };
 }
--- a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
@ -63,14 +63,14 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "telegram-desktop";
-  version = "4.16.4";
+  version = "4.16.6";

  src = fetchFromGitHub {
    owner = "telegramdesktop";
    repo = "tdesktop";
    rev = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-WBLDsUUEbyn6/NqdbfaUKhoH0T/c9k6lKCy23WPRuqk=";
+    hash = "sha256-1NRA8guTbDEraW1uXSo7q54d1e8/QnXwxkfb6k3e6b0=";
  };

  patches = [
--- a/pkgs/applications/networking/trayscale/default.nix
+++ b/pkgs/applications/networking/trayscale/default.nix
@ -11,13 +11,13 @@

 buildGoModule rec {
  pname = "trayscale";
-  version = "0.11.1";
+  version = "0.11.2";

  src = fetchFromGitHub {
    owner = "DeedleFake";
    repo = "trayscale";
    rev = "v${version}";
-    hash = "sha256-SepVgSxM4+csX7S0LPl6HmGDcgS991sgWJrOAA2YjIc=";
+    hash = "sha256-Og/ilxWNB5TNqnViZ5TeE0P+RxG1JOP2q9jo91SBNZQ=";
  };

  vendorHash = "sha256-eIakjEYfVp2wfXu0oqBmd5hJZTp0xgYKNNbtpRBnT2w=";
--- a/pkgs/applications/radio/quisk/default.nix
+++ b/pkgs/applications/radio/quisk/default.nix
@ -8,11 +8,11 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "quisk";
-  version = "4.2.30";
+  version = "4.2.31";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-1CpIb8Hj9hpsOkxhY3HNKaYYbWa5cZY5//WAzeuvY/o=";
+    sha256 = "sha256-WzB/KAkjJ6zPPfOe35kbT3HbbCNQjm44GL0hInk3TH8=";
  };

  buildInputs = [
--- a/pkgs/applications/science/logic/klee/default.nix
+++ b/pkgs/applications/science/logic/klee/default.nix
@ -6,7 +6,6 @@
 , clang
 , llvm
 , python3
-, zlib
 , z3
 , stp
 , cryptominisat
@ -45,13 +44,13 @@ let
  };
 in stdenv.mkDerivation rec {
  pname = "klee";
-  version = "3.0";
+  version = "3.1";

  src = fetchFromGitHub {
    owner = "klee";
    repo = "klee";
    rev = "v${version}";
-    hash = "sha256-y5lWmtIcLAthQ0oHYQNd+ir75YaxHZR9Jgiz+ZUFQjY=";
+    hash = "sha256-5js1N8qVF0lCkahSU3ojT7+p/a9IaUpPWhIyFHEzqto=";
  };

  nativeBuildInputs = [ cmake ];
@ -98,6 +97,9 @@ in stdenv.mkDerivation rec {
    patchShebangs .
  '';

+  # https://github.com/klee/klee/issues/1690
+  hardeningDisable = [ "fortify" ];
+
  doCheck = true;

  passthru = {
--- a/pkgs/applications/science/logic/klee/klee-uclibc.nix
+++ b/pkgs/applications/science/logic/klee/klee-uclibc.nix
@ -26,12 +26,12 @@ let
  });
 in stdenv.mkDerivation rec {
  pname = "klee-uclibc";
-  version = "1.3";
+  version = "1.4";
  src = fetchFromGitHub {
    owner = "klee";
    repo = "klee-uclibc";
    rev = "klee_uclibc_v${version}";
-    sha256 = "sha256-xQ8GWa0Gmd3lbwKodJhrsZeuR4j7NT4zIUh+kNhVY/w=";
+    sha256 = "sha256-sogQK5Ed0k5tf4rrYwCKT4YRKyEovgT25p0BhGvJ1ok=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/terminal-emulators/st/default.nix
+++ b/pkgs/applications/terminal-emulators/st/default.nix
@ -18,11 +18,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "st";
-  version = "0.9.1";
+  version = "0.9.2";

  src = fetchurl {
    url = "https://dl.suckless.org/st/st-${finalAttrs.version}.tar.gz";
-    hash = "sha256-FvQ7lDOt6dcNYIXDH5/Znyg16q3jEiECDyIUMDXfwNI=";
+    hash = "sha256-ayFdT0crIdYjLzDyIRF6d34kvP7miVXd77dCZGf5SUs=";
  };

  outputs = [ "out" "terminfo" ];
--- a/pkgs/applications/version-management/ghq/default.nix
+++ b/pkgs/applications/version-management/ghq/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "ghq";
-  version = "1.6.0";
+  version = "1.6.1";

  src = fetchFromGitHub {
    owner = "x-motemen";
    repo = "ghq";
    rev = "v${version}";
-    sha256 = "sha256-gSMSn7YuhV/m5po+nu9Z/bxSRKg7/fXbF1stm7JQqZI=";
+    sha256 = "sha256-fp/pqLpuEqvLoB3ioDd1Kx+i1NUI+bUDJzdaT7dQGSg=";
  };

  vendorHash = "sha256-M9B19rSEMnmT4wfOVnSAK06UPR/xrs0252lX3B9ebF8=";
--- a/pkgs/applications/virtualization/ecs-agent/default.nix
+++ b/pkgs/applications/virtualization/ecs-agent/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "amazon-ecs-agent";
-  version = "1.82.1";
+  version = "1.82.2";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "aws";
    repo = pname;
-    hash = "sha256-WXxuFJnqWUm+XgFNdtf0WBBGa7fP8Qv7hRd4xfGeVeg=";
+    hash = "sha256-2a8QBdL28iHVTE+Xo1I+89pFBeWndPqT072SHB498SQ=";
  };

  vendorHash = null;
--- a/pkgs/by-name/ba/bashly/Gemfile.lock
+++ b/pkgs/by-name/ba/bashly/Gemfile.lock
@ -1,7 +1,7 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    bashly (1.1.1)
+    bashly (1.1.10)
      colsole (>= 0.8.1, < 2)
      completely (~> 0.6.1)
      filewatcher (~> 2.0)
@ -11,7 +11,7 @@ GEM
      psych (>= 3.3.2, < 7)
      tty-markdown (~> 0.7)
    colsole (1.0.0)
-    completely (0.6.1)
+    completely (0.6.2)
      colsole (>= 0.8.1, < 2)
      mister_bin (~> 0.7)
    docopt_ng (0.7.1)
@ -27,11 +27,11 @@ GEM
    module_methods (0.1.0)
    pastel (0.8.0)
      tty-color (~> 0.5)
-    psych (5.1.1.1)
+    psych (5.1.2)
      stringio
    rexml (3.2.6)
-    rouge (4.1.3)
-    stringio (3.0.8)
+    rouge (4.2.1)
+    stringio (3.1.0)
    strings (0.2.1)
      strings-ansi (~> 0.2)
      unicode-display_width (>= 1.5, < 3.0)
@ -45,7 +45,7 @@ GEM
      strings (~> 0.2.0)
      tty-color (~> 0.5)
      tty-screen (~> 0.8)
-    tty-screen (0.8.1)
+    tty-screen (0.8.2)
    unicode-display_width (2.5.0)
    unicode_utils (1.4.0)

--- a/pkgs/by-name/ba/bashly/gemset.nix
+++ b/pkgs/by-name/ba/bashly/gemset.nix
@ -5,10 +5,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1rhzbpv8j5qcm5a84m4vzrryb0j8z90q6djbpid4ay2fr492kvkq";
+      sha256 = "1kdqpnkwgmb6kbrq9fyazj0jh0dh8srh86xjk92xrvgfps1kh5sy";
      type = "gem";
    };
-    version = "1.1.1";
+    version = "1.1.10";
  };
  colsole = {
    groups = ["default"];
@ -26,10 +26,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "01nk1cigb09z6rjy41qrhqf58cgpqm43xwjdkz33mfmwrnz04cw1";
+      sha256 = "12vf279w44d520vw28drxyi05wi1hyrg262ifjlhk9chjrnzcc7k";
      type = "gem";
    };
-    version = "0.6.1";
+    version = "0.6.2";
  };
  docopt_ng = {
    groups = ["default"];
@ -121,10 +121,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0wjzrkssjfjpynij5dpycyflhqbjvi1gc2j73xgq3b196s1d3c24";
+      sha256 = "0s5383m6004q76xm3lb732bp4sjzb6mxb6rbgn129gy2izsj4wrk";
      type = "gem";
    };
-    version = "5.1.1.1";
+    version = "5.1.2";
  };
  rexml = {
    groups = ["default"];
@ -141,20 +141,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "19drl3x8fw65v3mpy7fk3cf3dfrywz5alv98n2rm4pp04vdn71lw";
+      sha256 = "1zd1pdldi6h8x27dqim7cy8m69xr01aw5c8k1zhkz497n4np6wgk";
      type = "gem";
    };
-    version = "4.1.3";
+    version = "4.2.1";
  };
  stringio = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0ix96dxbjqlpymdigb4diwrifr0bq7qhsrng95fkkp18av326nqk";
+      sha256 = "063psvsn1aq6digpznxfranhcpmi0sdv2jhra5g0459sw0x2dxn1";
      type = "gem";
    };
-    version = "3.0.8";
+    version = "3.1.0";
  };
  strings = {
    dependencies = ["strings-ansi" "unicode-display_width" "unicode_utils"];
@ -203,10 +203,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "18jr6s1cg8yb26wzkqa6874q0z93rq0y5aw092kdqazk71y6a235";
+      sha256 = "0l4vh6g333jxm9lakilkva2gn17j6gb052626r1pdbmy2lhnb460";
      type = "gem";
    };
-    version = "0.8.1";
+    version = "0.8.2";
  };
  unicode-display_width = {
    groups = ["default"];
--- a/pkgs/by-name/br/brainstem/package.nix
+++ b/pkgs/by-name/br/brainstem/package.nix
@ -0,0 +1,90 @@
+{ stdenv
+, lib
+, autoPatchelfHook
+, fetchzip
+, curl
+, systemd
+, zlib
+, writeText
+, withUpdater ? true
+, ...
+}:
+
+let
+  version = "2.10.5";
+  # Upstream has a udev.sh script asking for mode and group, but with uaccess we
+  # don't need any of that and can make it entirely static.
+  # For any rule adding the uaccess tag to be effective, the name of the file it
+  # is defined in has to lexically precede 73-seat-late.rules.
+  udevRule = writeText "60-brainstem.rules" ''
+    # Acroname Brainstem control devices
+    SUBSYSTEM=="usb", ATTRS{idVendor}=="24ff", TAG+="uaccess"
+
+    # Acroname recovery devices (pb82, pb242, pb167)
+    SUBSYSTEM=="tty", ATTRS{idVendor}=="0424", ATTRS{idProduct}=="274e", TAG+="uaccess"
+    SUBSYSTEM=="tty", ATTRS{idVendor}=="10c4", ATTRS{idProduct}=="ea60", TAG+="uaccess"
+    KERNEL=="hidraw*", ATTRS{idVendor}=="1fc9", ATTRS{idProduct}=="0130", TAG+="uaccess"
+  '';
+
+  src = fetchzip {
+    url = "https://acroname.com/sites/default/files/software/brainstem_sdk/${version}/brainstem_sdk_${version}_Ubuntu_LTS_22.04_x86_64.tgz";
+    hash = "sha256-S6u9goxTMCI12sffP/WKUF7bv0pLeNmNog7Hle+vpR4=";
+    # There's no "brainstem" parent directory in the archive.
+    stripRoot = false;
+  };
+in
+
+stdenv.mkDerivation {
+  pname = "brainstem";
+  inherit version src;
+
+  nativeBuildInputs = [ autoPatchelfHook ];
+  buildInputs = [
+    # libudev
+    (lib.getLib systemd)
+    # libstdc++.so libgcc_s.so
+    stdenv.cc.cc.lib
+  ] ++ lib.optionals withUpdater [
+    # libcurl.so.4
+    curl
+    # libz.so.1
+    zlib
+  ];
+
+  # Unpack the CLI tools, documentation, library and C headers.
+  # There's also a python .whl, containing more libraries, which might be used
+  # to support more architectures, too, but let's only do that if we need it.
+  installPhase = ''
+    mkdir -p $out/bin
+    install -m744 cli/AcronameHubCLI $out/bin
+    install -m744 cli/Updater $out/bin/AcronameHubUpdater
+
+    mkdir -p $out/lib/udev/rules.d
+    cp ${udevRule} $out/lib/udev/rules.d/60-brainstem.rules
+
+    mkdir -p $doc
+    cp docs/* $doc/
+    cp {license,version}.txt $doc/
+
+    mkdir -p $lib/lib
+    cp api/lib/libBrainStem2.* $lib/lib
+
+    mkdir -p $dev/include
+    cp -R api/lib/BrainStem2 $dev/include/
+  '';
+
+  outputs = [ "out" "lib" "dev" "doc" ];
+
+  meta = with lib; {
+    description = "BrainStem Software Development Kit";
+    longDescription = ''
+      The BrainStem SDK provides a library to access and control Acroname smart
+      USB switches, as well as a CLI interface, and a firmware updater.
+    '';
+    homepage = "https://acroname.com/software/brainstem-development-kit";
+    platforms = [ "x86_64-linux" ];
+    license = licenses.unfree;
+    maintainers = with maintainers; [ flokli ];
+    mainProgram = "AcronameHubCLI";
+  };
+}
--- a/pkgs/by-name/fl/flarectl/package.nix
+++ b/pkgs/by-name/fl/flarectl/package.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "flarectl";
-  version = "0.92.0";
+  version = "0.93.0";

  src = fetchFromGitHub {
    owner = "cloudflare";
    repo = "cloudflare-go";
    rev = "v${version}";
-    hash = "sha256-nmDW8ALhyp5McnX86JN51kJSo0bUvwTsHnQkfKSxJMM=";
+    hash = "sha256-XN/GRay5fJ2EjGHguG9i4ENCRBPZQcwQJg/2ka0HyaE=";
  };

-  vendorHash = "sha256-F1fwzzBg60E7B9iPV0gziGB3WE1tcZ/6nMpnEyTjV1g=";
+  vendorHash = "sha256-/81Onrs+qyKEt79DtfX4EDDVxhzB0uqaHa3X+GbupWQ=";

  subPackages = [ "cmd/flarectl" ];

--- a/pkgs/development/tools/continuous-integration/forgejo-actions-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/forgejo-actions-runner/default.nix
@ -2,22 +2,22 @@
 , buildGoModule
 , fetchFromGitea
 , testers
-, forgejo-actions-runner
+, forgejo-runner
 }:

 buildGoModule rec {
-  pname = "forgejo-actions-runner";
-  version = "3.3.0";
+  pname = "forgejo-runner";
+  version = "3.4.1";

  src = fetchFromGitea {
    domain = "code.forgejo.org";
    owner = "forgejo";
    repo = "runner";
    rev = "v${version}";
-    hash = "sha256-ZpsHytsIp+ZW4DI7X9MmI7nZRnXVHvx905YdZGS6WMY=";
+    hash = "sha256-c8heIHt+EJ6LnZT4/6TTWd7v85VRHjH72bdje12un4M=";
  };

-  vendorHash = "sha256-5GnGXpMy1D7KpVAVroX07Vw5QKYYtwdIhQsk23WCLgc=";
+  vendorHash = "sha256-FCCQZdAYRtJR3DGQIEvUzv+1kqvxVTGkwJwZSohq28s=";

  ldflags = [
    "-s"
@ -28,16 +28,16 @@ buildGoModule rec {
  doCheck = false; # Test try to lookup code.forgejo.org.

  passthru.tests.version = testers.testVersion {
-    package = forgejo-actions-runner;
+    package = forgejo-runner;
    version = src.rev;
  };

  meta = with lib; {
    description = "A runner for Forgejo based on act";
    homepage = "https://code.forgejo.org/forgejo/runner";
-    changelog = "https://gitea.com/gitea/act_runner/releases/tag/${src.rev}";
+    changelog = "https://code.forgejo.org/forgejo/runner/src/tag/${src.rev}/RELEASE-NOTES.md";
    license = licenses.mit;
-    maintainers = with maintainers; [ kranzes ];
+    maintainers = with maintainers; [ kranzes emilylange ];
    mainProgram = "act_runner";
  };
 }
--- a/pkgs/servers/gemini/gmid/default.nix
+++ b/pkgs/servers/gemini/gmid/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "gmid";
-  version = "1.8.6";
+  version = "2.0.2";

  src = fetchFromGitHub {
    owner = "omar-polo";
    repo = pname;
    rev = version;
-    hash = "sha256-ds5k5VHwc7/sq4PUe/WvxAx7gJkU4phKZk0KunPLNE0=";
+    hash = "sha256-5K6+CVX0/m6SBcTvwy4GD0x9R/yQjd+2tTJiA4OagcI=";
  };

  nativeBuildInputs = [ bison ];
--- a/pkgs/by-name/he/hermitcli/package.nix
+++ b/pkgs/by-name/he/hermitcli/package.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "hermit";
-  version = "0.39.0";
+  version = "0.39.1";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "cashapp";
    repo = "hermit";
-    hash = "sha256-BXh9HWCFeAs/S5z1ru+31mndsvt1DVh1Q7SeGzB4Rzk=";
+    hash = "sha256-ukg/KQTLG2F7mDNgoUr8GEKnkFHEJtVpwDs+DiLXvlM=";
  };

  vendorHash = "sha256-1QMZvxy6cCJVoIP8mG7s4V0nBAGhrHoPbiKKyYDDL2g=";
--- a/pkgs/by-name/kc/kcl-cli/package.nix
+++ b/pkgs/by-name/kc/kcl-cli/package.nix
@ -0,0 +1,27 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "kcl-cli";
+  version = "0.8.5";
+  src = fetchFromGitHub {
+    owner = "kcl-lang";
+    repo = "cli";
+    rev = "v${version}";
+    hash = "sha256-ZjEMgQukhBGY3LWqsGmLj3lKfLtNNaQugQs0cSLMb80=";
+  };
+  vendorHash = "sha256-jmqKMB85HxAlwH7FVjHrLCZQYuAJrguRfzIz1yMypjw=";
+  ldflags = [
+    "-X=kcl-lang.io/cli/pkg/version.version=${version}"
+  ];
+  subPackages = [ "cmd/kcl" ];
+  meta = with lib; {
+    description = "A command line interface for KCL programming language";
+    homepage = "https://github.com/kcl-lang/cli";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ peefy ];
+    mainProgram = "kcl";
+  };
+}
--- a/pkgs/by-name/mi/mini-calc/package.nix
+++ b/pkgs/by-name/mi/mini-calc/package.nix
@ -0,0 +1,30 @@
+{ lib, rustPlatform, fetchpatch, fetchFromGitHub }:
+rustPlatform.buildRustPackage rec {
+  pname = "mini-calc";
+  version = "2.12.2";
+
+  src = fetchFromGitHub {
+    owner = "coco33920";
+    repo = "calc";
+    rev = version;
+    hash = "sha256-MKMZVRjqwNQUNkuduvgVvsp53E48JPI68Lq/6ooLcFc=";
+  };
+
+  cargoHash = "sha256-A9t7i9mw4dzCWUAObZ81BSorCrzx6wEjYXiRWIBzM9M=";
+  cargoPatches = [
+    (fetchpatch {
+      url = "https://github.com/coco33920/calc/commit/0bd12cbf3e13e447725e22cc70df72e559d21c94.patch";
+      sha256 = "sha256-1QN18LQFh8orh9DvgLBGAHimW/b/8HxbwtVD9s7mQaI=";
+    })
+  ];
+
+  meta = {
+    description = "A fully-featured minimalistic configurable calculator written in Rust";
+    changelog = "https://github.com/coco33920/calc/blob/${version}/CHANGELOG.md";
+    homepage = "https://calc.nwa2coco.fr";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ sigmanificient ];
+    mainProgram = "mini-calc";
+    platforms = lib.platforms.unix;
+  };
+}
--- a/pkgs/by-name/ni/nilaway/package.nix
+++ b/pkgs/by-name/ni/nilaway/package.nix
@ -5,16 +5,18 @@

 buildGoModule rec {
  pname = "nilaway";
-  version = "unstable-2023-11-17";
+  version = "0-unstable-2024-04-04";

  src = fetchFromGitHub {
    owner = "uber-go";
    repo = "nilaway";
-    rev = "a267567c6ffff900df0c3394d031ee70079ec8df";
-    hash = "sha256-Ro1nSTEZcE9u4Ol6CSLBTiPrh72Ly9UcrXyvffzPfow=";
+    rev = "755a685ab68b85d9b36833b38972a559f217d396";
+    hash = "sha256-sDDBITrGD79pcbsrcrs6D8njBp4kuK1NkuBPwzIkaUE=";
  };

-  vendorHash = "sha256-kbVjkWW5D8jp5QFYGiyRuGFArRsQukJIR8xwaUUIUBs=";
+  vendorHash = "sha256-1j7NwfqrinEQL6XBO0PvwzxFytujoCtynMEXL2oTLkM=";
+
+  excludedPackages = [ "tools" ];

  ldflags = [ "-s" "-w" ];

--- a/pkgs/by-name/pa/pablodraw/deps.nix
+++ b/pkgs/by-name/pa/pablodraw/deps.nix
@ -0,0 +1,28 @@
+# This file was automatically generated by passthru.fetch-deps.
+# Please dont edit it manually, your changes might get overwritten!
+
+{ fetchNuGet }: [
+  (fetchNuGet { pname = "AtkSharp"; version = "3.24.24.38"; sha256 = "12dv3j8nzhjb5c0093djajdnv8n7m0q7vq2d5ry2v4xk9wqzxpr7"; })
+  (fetchNuGet { pname = "CairoSharp"; version = "3.24.24.38"; sha256 = "0n3y5w088k81apxik9amfvjdwcic4k2ixxvnrk9cw6d2wh1d5r8d"; })
+  (fetchNuGet { pname = "dotnet-outdated-tool"; version = "4.1.0"; sha256 = "1i3i2hnf4qszlp3yzwggnvz4qpp3lgrzf19ygsmbvqzw1g7w150c"; })
+  (fetchNuGet { pname = "Eto.Forms"; version = "2.7.4"; sha256 = "0q50fw646h25an5j8c4p1gck8ja20vy344w1gb7rdp167d573mb3"; })
+  (fetchNuGet { pname = "Eto.Platform.Gtk"; version = "2.7.4"; sha256 = "0zy35zw1s4al305y4b496f5nf9vmmm7i0jf8j0dlq6df8bfjifcn"; })
+  (fetchNuGet { pname = "GdkSharp"; version = "3.24.24.38"; sha256 = "0c5gzg106bnnc4wwwhch6lja68623a9hk8r2sjcv35hl5dh21616"; })
+  (fetchNuGet { pname = "GioSharp"; version = "3.24.24.38"; sha256 = "1b3irarxjbbpf24fw2avdglcslb5653gn6m829yhlcm5ay37pds4"; })
+  (fetchNuGet { pname = "GLibSharp"; version = "3.24.24.38"; sha256 = "1a0ixdq1gdb46gkb2nnlydsi10bjrbd3risfyaphsy8fbsyzrzvm"; })
+  (fetchNuGet { pname = "GtkSharp"; version = "3.24.24.38"; sha256 = "0cn8aggci6n088y5giiaxmyzv01rcz37r8pm738q2bsb57zppz2j"; })
+  (fetchNuGet { pname = "Lidgren.Network"; version = "1.0.2"; sha256 = "0ka0vwyy060wd1dn1551m56fv957mmc7dxlj71g7n6qmsi1mdhif"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; sha256 = "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm"; })
+  (fetchNuGet { pname = "Mono.Nat"; version = "3.0.3"; sha256 = "1b3alh1wz28y62cflwl1jppigv499cndm8sds32xsmvwpdwiq4yl"; })
+  (fetchNuGet { pname = "NETStandard.Library"; version = "2.0.3"; sha256 = "1fn9fxppfcg4jgypp2pmrpr6awl3qz1xmnri0cygpkwvyx27df1y"; })
+  (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.2"; sha256 = "1p9splg1min274dpz7xdfgzrwkyfd3xlkygwpr1xgjvvyjvs6b0i"; })
+  (fetchNuGet { pname = "PangoSharp"; version = "3.24.24.38"; sha256 = "0cma8j4cy4j3fw0nvsxlqi0azjkvfjsw0wb6k6b2k21rdpy5rbbn"; })
+  (fetchNuGet { pname = "SharpCompress"; version = "0.32.2"; sha256 = "1p198bl08ia89rf4n6yjpacj3yrz6s574snsfl40l8vlqcdrc1pm"; })
+  (fetchNuGet { pname = "System.Buffers"; version = "4.5.1"; sha256 = "04kb1mdrlcixj9zh1xdi5as0k0qi8byr5mi3p3jcxx72qz93s2y3"; })
+  (fetchNuGet { pname = "System.ComponentModel.Annotations"; version = "5.0.0"; sha256 = "021h7x98lblq9avm1bgpa4i31c2kgsa7zn4sqhxf39g087ar756j"; })
+  (fetchNuGet { pname = "System.Memory"; version = "4.5.4"; sha256 = "14gbbs22mcxwggn0fcfs1b062521azb9fbb7c113x0mq6dzq9h6y"; })
+  (fetchNuGet { pname = "System.Numerics.Vectors"; version = "4.4.0"; sha256 = "0rdvma399070b0i46c4qq1h2yvjj3k013sqzkilz4bz5cwmx1rba"; })
+  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "4.5.3"; sha256 = "1afi6s2r1mh1kygbjmfba6l4f87pi5sg13p4a48idqafli94qxln"; })
+  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "6.0.0"; sha256 = "0qm741kh4rh57wky16sq4m0v05fxmkjjr87krycf5vp9f0zbahbc"; })
+  (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "6.0.0"; sha256 = "0gm2kiz2ndm9xyzxgi0jhazgwslcs427waxgfa30m7yqll1kcrww"; })
+]
--- a/pkgs/by-name/pa/pablodraw/package.nix
+++ b/pkgs/by-name/pa/pablodraw/package.nix
@ -0,0 +1,69 @@
+{ lib
+, buildDotnetModule
+, fetchFromGitHub
+, dotnetCorePackages
+, wrapGAppsHook
+, copyDesktopItems
+, gtk3
+, libnotify
+, makeDesktopItem
+, stdenv
+}:
+
+buildDotnetModule rec {
+  pname = "pablodraw";
+  version = "3.3.13-beta";
+
+  src = fetchFromGitHub {
+    owner = "cwensley";
+    repo = "pablodraw";
+    rev = version;
+    hash = "sha256-PsCFiNcWYh6Bsf5Ihi3IoYyv66xUT1cRBKkx+K5gB/M=";
+  };
+
+  postPatch = ''
+    substituteInPlace ${projectFile} \
+      --replace-warn '<EnableCompressionInSingleFile>True</EnableCompressionInSingleFile>' ""
+  '';
+
+  projectFile = "Source/PabloDraw/PabloDraw.csproj";
+
+  executables = [ "PabloDraw" ];
+
+  dotnet-sdk = dotnetCorePackages.sdk_7_0;
+  dotnet-runtime = dotnetCorePackages.runtime_7_0;
+
+  nugetDeps = ./deps.nix;
+
+  nativeBuildInputs = [ wrapGAppsHook copyDesktopItems ];
+
+  runtimeDeps = [ gtk3 libnotify ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "PabloDraw";
+      exec = "PabloDraw";
+      comment = "An Ansi/Ascii text and RIPscrip vector graphic art editor/viewer";
+      type = "Application";
+      icon = "pablodraw";
+      desktopName = "PabloDraw";
+      terminal = false;
+      categories = [ "Graphics" ];
+    })
+  ];
+
+  postInstall = ''
+    install -Dm644 Assets/PabloDraw-512.png $out/share/icons/hicolor/512x512/apps/pablodraw.png
+    install -Dm644 Assets/PabloDraw-64.png $out/share/icons/hicolor/64x64/apps/pablodraw.png
+  '';
+
+  meta = with lib; {
+    description = "An Ansi/Ascii text and RIPscrip vector graphic art editor/viewer with multi-user capabilities";
+    homepage = "https://picoe.ca/products/pablodraw";
+    license = licenses.mit;
+    mainProgram = "PabloDraw";
+    maintainers = with maintainers; [ aleksana kip93 ];
+    platforms = platforms.all;
+    broken = stdenv.isDarwin; # Eto.Platform.Mac64 not found in nugetSource
+  };
+}
--- a/pkgs/by-name/pi/pixel-code/package.nix
+++ b/pkgs/by-name/pi/pixel-code/package.nix
@ -0,0 +1,27 @@
+{ lib, stdenvNoCC, fetchzip }:
+
+stdenvNoCC.mkDerivation rec {
+  name = "pixel-code";
+  version = "2.1";
+
+  src = fetchzip {
+    url = "https://github.com/qwerasd205/PixelCode/releases/download/v${version}/otf.zip";
+    hash = "sha256-qu55qXcDL6YIyiFavysI9O2foccvu2Hyw7/JyIMXYv4=";
+    stripRoot=false;
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/opentype $src/otf/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/qwerasd205/PixelCode";
+    description = "A pixel font designed to actually be good for programming";
+    license = licenses.ofl;
+    maintainers = with maintainers; [ mattpolzin ];
+  };
+}
--- a/pkgs/by-name/pk/pkcs11-provider/package.nix
+++ b/pkgs/by-name/pk/pkcs11-provider/package.nix
@ -0,0 +1,47 @@
+{ lib, stdenv, fetchFromGitHub
+, openssl, nss, p11-kit
+, opensc, gnutls, expect
+, autoreconfHook, autoconf-archive, pkg-config
+}:
+
+stdenv.mkDerivation rec {
+  pname = "pkcs11-provider";
+  version = "0.3";
+
+  src = fetchFromGitHub {
+    owner = "latchset";
+    repo = "pkcs11-provider";
+    rev = "v${version}";
+    hash = "sha256-jEQYsINRZ7bi2UqOXUUmGpm+1h+1qBNe18KvfAw2JzU=";
+  };
+
+  buildInputs = [ openssl nss p11-kit ];
+  nativeBuildInputs = [ autoreconfHook pkg-config autoconf-archive ];
+
+  # don't add SoftHSM to here: https://github.com/openssl/openssl/issues/22508
+  nativeCheckInputs = [ p11-kit.bin opensc nss.tools gnutls openssl.bin expect ];
+
+  postPatch = ''
+    patchShebangs --build .
+
+    # Makefile redirects to logfiles; make sure we can catch them.
+    for name in softokn softhsm; do
+      ln -s /dev/stderr tests/setup-$name.log
+    done
+  '';
+
+  enableParallelBuilding = true;
+
+  # Frequently fails due to a race condition.
+  enableParallelInstalling = false;
+
+  doCheck = true;
+
+  meta = with lib; {
+    homepage = "https://github.com/latchset/pkcs11-provider";
+    description = "An OpenSSL 3.x provider to access hardware or software tokens using the PKCS#11 Cryptographic Token Interface";
+    maintainers = with maintainers; [ numinit ];
+    license = licenses.asl20;
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/by-name/sc/scrutiny-collector/package.nix
+++ b/pkgs/by-name/sc/scrutiny-collector/package.nix
@ -7,7 +7,7 @@
 , nix-update-script
 }:
 let
-  version = "0.8.0";
+  version = "0.8.1";
 in
 buildGoModule rec {
  inherit version;
@ -17,7 +17,7 @@ buildGoModule rec {
    owner = "AnalogJ";
    repo = "scrutiny";
    rev = "refs/tags/v${version}";
-    hash = "sha256-ysjE2nn1WwhEiFIvJ5cRCJQf9mECTgiGUyenwf3mKTA=";
+    hash = "sha256-WoU5rdsIEhZQ+kPoXcestrGXC76rFPvhxa0msXjFsNg=";
  };

  subPackages = "collector/cmd/collector-metrics";
--- a/pkgs/by-name/sp/spicetify-cli/package.nix
+++ b/pkgs/by-name/sp/spicetify-cli/package.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "spicetify-cli";
-  version = "2.36.2";
+  version = "2.36.4";

  src = fetchFromGitHub {
    owner = "spicetify";
    repo = "spicetify-cli";
    rev = "v${version}";
-    hash = "sha256-M+jx7FGq73eTFdBuCC/HxZq03bRIwlx1Nuz9fYQ0xfI=";
+    hash = "sha256-KvVFu0nCp6J5C8XHgd1U3CKmLPuVnWjlx5nocQGO1es=";
  };

-  vendorHash = "sha256-axE1SY+UW5oddyhOiktq+vNfhw2/SFX4ut4Hivg6TYQ=";
+  vendorHash = "sha256-UPrLXzAdvCOmLm1tekzKyulQ4+2BSyPUF1k66GwKS88=";

  ldflags = [
    "-s -w"
--- a/pkgs/by-name/st/steampipe/package.nix
+++ b/pkgs/by-name/st/steampipe/package.nix
@ -11,16 +11,16 @@

 buildGoModule rec {
  pname = "steampipe";
-  version = "0.22.1";
+  version = "0.22.2";

  src = fetchFromGitHub {
    owner = "turbot";
    repo = "steampipe";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Oz1T9koeXnmHc5oru1apUtmhhvKi/gAtg/Hb7HKkkP0=";
+    hash = "sha256-wHTuXSjHILlTgWSoaYKjEjQMWEih1EOJX8SIHdfVpU8=";
  };

-  vendorHash = "sha256-U0BeGCRLjL56ZmVKcKqrrPTCXpShJzJq5/wnXDKax6g=";
+  vendorHash = "sha256-sN4EbcxZ+XKL0MRqfKwBmv1+WtPj0uKw2HpSGcHI8AE=";
  proxyVendor = true;

  postPatch = ''
--- a/pkgs/by-name/ui/uiua/package.nix
+++ b/pkgs/by-name/ui/uiua/package.nix
@ -14,16 +14,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "uiua";
-  version = "0.10.1";
+  version = "0.10.2";

  src = fetchFromGitHub {
    owner = "uiua-lang";
    repo = "uiua";
    rev = version;
-    hash = "sha256-gHEv8o1reKh7FfPQ2vettGy1Mvl6iVAoh6YL06iVFHs=";
+    hash = "sha256-vfWSMsduaJOh3ueJsjXW4MzYKZYI959lmah8glwex4A=";
  };

-  cargoHash = "sha256-bUwwHdhZD7ga+u1VNBfR5nEEnHrCXV6kcQgdOL10hGM=";
+  cargoHash = "sha256-LkW3/C67CuUpfGX3KQw3BjnmZpL1Vv+i7kqlXdhpP2I=";

  nativeBuildInputs = lib.optionals stdenv.isDarwin [
    rustPlatform.bindgenHook
--- a/pkgs/by-name/ya/yamlscript/package.nix
+++ b/pkgs/by-name/ya/yamlscript/package.nix
@ -2,11 +2,11 @@

 buildGraalvmNativeImage rec {
  pname = "yamlscript";
-  version = "0.1.46";
+  version = "0.1.52";

  src = fetchurl {
    url = "https://github.com/yaml/yamlscript/releases/download/${version}/yamlscript.cli-${version}-standalone.jar";
-    hash = "sha256-eHmHliWud2ONK3lHYpLlJ1+KhvH5vuD+x5kC54ZMfWk=";
+    hash = "sha256-VBb+mZXTzcP0oVjm3TWM38J3fSacQZwQ4WVVDgldHV4=";
  };

  executable = "ys";
--- a/pkgs/by-name/yu/yutto/package.nix
+++ b/pkgs/by-name/yu/yutto/package.nix
@ -5,9 +5,9 @@
 , nix-update-script
 }:

-python3Packages.buildPythonApplication {
+python3Packages.buildPythonApplication rec {
  pname = "yutto";
-  version = "2.0.0b36-unstable-2024-03-04";
+  version = "2.0.0-beta.37";
  format = "pyproject";

  disabled = python3Packages.pythonOlder "3.9";
@ -15,8 +15,8 @@ python3Packages.buildPythonApplication {
  src = fetchFromGitHub {
    owner = "yutto-dev";
    repo = "yutto";
-    rev = "f2d34f9e2a2d45ed8ed6ae4c2bf91af248da27f0";
-    hash = "sha256-/zTQt+/sCjnQPt8YyKvRXpWVpN/yi2LrhpFH4FPbeOc=";
+    rev = "v${version}";
+    hash = "sha256-daRuFYfR3FjvhVsQM1FXI19iOH+bukh6WxfH5O+CFk4=";
  };

  nativeBuildInputs = with python3Packages; [
@ -38,7 +38,9 @@ python3Packages.buildPythonApplication {

  pythonImportsCheck = [ "yutto" ];

-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version" "unstable" ];
+  };

  meta = with lib; {
    description = "A Bilibili downloader";
--- a/pkgs/data/misc/sing-geoip/default.nix
+++ b/pkgs/data/misc/sing-geoip/default.nix
@ -8,26 +8,32 @@
 let
  generator = buildGoModule rec {
    pname = "sing-geoip";
-    version = "20230512";
+    version = "20240312";

    src = fetchFromGitHub {
      owner = "SagerNet";
      repo = pname;
      rev = "refs/tags/${version}";
-      hash = "sha256-Zm+5N/37hoHpH/TLNJrHeaBXI8G1jEpM1jz6Um8edNE=";
+      hash = "sha256-nIrbiECK25GyuPEFqMvPdZUShC2JC1NI60Y10SsoWyY=";
    };

-    vendorHash = "sha256-ejXAdsJwXhqet+Ca+pDLWwu0gex79VcIxW6rmhRnbTQ=";
+    vendorHash = "sha256-WH0eMg06qCiVcy4H+vBtYrmLMA2KJRCPGXiEnatW+LU=";
+
+    postPatch = ''
+      sed -i -e '/func main()/,/^}/d' main.go
+      cat ${./main.go} >> main.go
+    '';

    meta = with lib; {
      description = "GeoIP data for sing-box";
      homepage = "https://github.com/SagerNet/sing-geoip";
      license = licenses.gpl3Plus;
      maintainers = with maintainers; [ linsui ];
+      mainProgram = "sing-geoip";
    };
  };
 in
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation {
  inherit (generator) pname;
  inherit (dbip-country-lite) version;

@ -38,8 +44,7 @@ stdenvNoCC.mkDerivation rec {
  buildPhase = ''
    runHook preBuild

-    ${pname} ${dbip-country-lite.mmdb} geoip.db
-    ${pname} ${dbip-country-lite.mmdb} geoip-cn.db cn
+    sing-geoip ${dbip-country-lite.mmdb}

    runHook postBuild
  '';
@ -49,6 +54,7 @@ stdenvNoCC.mkDerivation rec {

    install -Dm644 geoip.db $out/share/sing-box/geoip.db
    install -Dm644 geoip-cn.db $out/share/sing-box/geoip-cn.db
+    install -Dm644 rule-set/* -t $out/share/sing-box/rule-set

    runHook postInstall
  '';
--- a/pkgs/data/misc/sing-geoip/main.go
+++ b/pkgs/data/misc/sing-geoip/main.go
@ -0,0 +1,68 @@
+func main() {
+	var err error
+
+  input := os.Args[1]
+  ruleSetOutput := "rule-set"
+
+  binary, err := os.ReadFile(input)
+	if err != nil {
+		panic(err)
+	}
+  metadata, countryMap, err := parse(binary)
+	if err != nil {
+		panic(err)
+	}
+	allCodes := make([]string, 0, len(countryMap))
+	for code := range countryMap {
+		allCodes = append(allCodes, code)
+	}
+
+	writer, err := newWriter(metadata, allCodes)
+	if err != nil {
+		panic(err)
+	}
+	err = write(writer, countryMap, "geoip.db", nil)
+	if err != nil {
+		panic(err)
+	}
+
+	writer, err = newWriter(metadata, []string{"cn"})
+	if err != nil {
+		panic(err)
+	}
+	err = write(writer, countryMap, "geoip-cn.db", []string{"cn"})
+	if err != nil {
+		panic(err)
+	}
+
+	err = os.MkdirAll(ruleSetOutput, 0o755)
+	if err != nil {
+		panic(err)
+	}
+	for countryCode, ipNets := range countryMap {
+		var headlessRule option.DefaultHeadlessRule
+		headlessRule.IPCIDR = make([]string, 0, len(ipNets))
+		for _, cidr := range ipNets {
+			headlessRule.IPCIDR = append(headlessRule.IPCIDR, cidr.String())
+		}
+		var plainRuleSet option.PlainRuleSet
+		plainRuleSet.Rules = []option.HeadlessRule{
+			{
+				Type:           C.RuleTypeDefault,
+				DefaultOptions: headlessRule,
+			},
+		}
+		srsPath, _ := filepath.Abs(filepath.Join(ruleSetOutput, "geoip-"+countryCode+".srs"))
+		os.Stderr.WriteString("write " + srsPath + "\n")
+		outputRuleSet, err := os.Create(srsPath)
+		if err != nil {
+			panic(err)
+		}
+		err = srs.Write(outputRuleSet, plainRuleSet)
+		if err != nil {
+			outputRuleSet.Close()
+			panic(err)
+		}
+		outputRuleSet.Close()
+	}
+}
--- a/pkgs/data/themes/catppuccin/default.nix
+++ b/pkgs/data/themes/catppuccin/default.nix
@ -1,5 +1,5 @@
 let
-  validThemes = [ "bat" "bottom" "btop" "grub" "hyprland" "k9s" "kvantum" "lazygit" "plymouth" "qt5ct" "refind" "rofi" "starship" "thunderbird" "waybar" ];
+  validThemes = [ "bat" "bottom" "btop" "grub" "hyprland" "k9s" "kvantum" "lazygit" "lxqt" "plymouth" "qt5ct" "refind" "rofi" "starship" "thunderbird" "waybar" ];
 in
 { fetchFromGitHub
 , lib
@ -80,6 +80,14 @@ let
      hash = "sha256-gM0HplHhcpvtpmIVdlX/p59h0v+ihKEidS1imqPYlBg=";
    };

+    lxqt = fetchFromGitHub {
+      name = "lxqt";
+      owner = "catppuccin";
+      repo = "lxqt";
+      rev = "38cf86b3e499e0c0928a102c9c030e5dc6b79255";
+      hash = "sha256-3TuUkOwk6BSc7BnLnTowGAkSlNTOtGTRlEcjJ6MNJ5g=";
+    };
+
    plymouth = fetchFromGitHub {
      name = "plymouth";
      owner = "catppuccin";
@ -194,6 +202,10 @@ stdenvNoCC.mkDerivation {
    cp "${sources.lazygit}/themes/${variant}/${accent}.yml" "$out/lazygit/themes/"
    cp "${sources.lazygit}/themes-mergable/${variant}/${accent}.yml" "$out/lazygit/themes-mergable/"

+  '' + lib.optionalString (lib.elem "lxqt" themeList) ''
+    mkdir -p $out/share/lxqt/themes/catppuccin-${variant}
+    cp -r ${sources.lxqt}/src/catppuccin-${variant}/* $out/share/lxqt/themes/catppuccin-${variant}/
+
  '' + lib.optionalString (lib.elem "plymouth" themeList) ''
    mkdir -p $out/share/plymouth/themes/catppuccin-${variant}
    cp ${sources.plymouth}/themes/catppuccin-${variant}/* $out/share/plymouth/themes/catppuccin-${variant}
--- a/pkgs/desktops/xfce/core/xfce4-dev-tools/setup-hook.sh
+++ b/pkgs/desktops/xfce/core/xfce4-dev-tools/setup-hook.sh
@ -9,4 +9,6 @@ xdtAutogenPhase() {
    NOCONFIGURE=1 xdt-autogen
 }

-preConfigurePhases+=(xdtAutogenPhase)
+if [ -z "${dontUseXdtAutogenPhase-}" ]; then
+    preConfigurePhases+=(xdtAutogenPhase)
+fi
--- a/pkgs/development/cuda-modules/aliases.nix
+++ b/pkgs/development/cuda-modules/aliases.nix
@ -1,4 +1,18 @@
 # Packges which have been deprecated or removed from cudaPackages
-final: prev: {
+final: prev:
+let
+  mkRenamed =
+    oldName: newName: newPkg:
+    final.lib.warn "cudaPackages.${oldName} is deprecated, use ${newName} instead" newPkg;
+in
+{

+  # Deprecated: an alias kept for compatibility. Consider removing after 24.05
+  autoFixElfFiles = mkRenamed "autoFixElfFiles" "pkgs.autoFixElfFiles" final.pkgs.autoFixElfFiles; # Added 2024-03-30
+  autoAddDriverRunpath =
+    mkRenamed "autoAddDriverRunpath" "pkgs.autoAddDriverRunpath"
+      final.pkgs.autoAddDriverRunpath; # Added 2024-03-30
+  autoAddOpenGLRunpathHook =
+    mkRenamed "autoAddOpenGLRunpathHook" "pkgs.autoAddDriverRunpath"
+      final.pkgs.autoAddDriverRunpath; # Added 2024-03-30
 }
--- a/pkgs/development/cuda-modules/setup-hooks/extension.nix
+++ b/pkgs/development/cuda-modules/setup-hooks/extension.nix
@ -1,11 +1,4 @@
 final: _: {
-  # TODO:
-  # - Move to cuda-modules/aliases.nix once
-  #   https://github.com/NixOS/nixpkgs/issues/141803 is ready.
-  # - Consider removing after 24.11.
-  inherit (final.pkgs) autoAddDriverRunpath autoFixElfFiles;
-  autoAddOpenGLRunpathHook = final.autoAddDriverRunpath;
-
  # Internal hook, used by cudatoolkit and cuda redist packages
  # to accommodate automatic CUDAToolkit_ROOT construction
  markForCudatoolkitRootHook = final.callPackage (
--- a/pkgs/development/interpreters/expr/default.nix
+++ b/pkgs/development/interpreters/expr/default.nix
@ -5,18 +5,18 @@

 buildGoModule rec {
  pname = "expr";
-  version = "1.16.3";
+  version = "1.16.4";

  src = fetchFromGitHub {
    owner = "antonmedv";
    repo = "expr";
    rev = "v${version}";
-    hash = "sha256-XTI4TPViNQUPrIPZRWcaxFpkqMUOdGN162f+deFNRR0=";
+    hash = "sha256-evPzHLetmCqGnFNydbjUcVIBdcOWrhqaeBIwWB2G6hk=";
  };

  sourceRoot = "${src.name}/repl";

-  vendorHash = "sha256-ZIF0uCGrzs1nn06ouF/eJY1adOw8diAjMIhygZhrXuM=";
+  vendorHash = "sha256-GEFLIvshlnCk8pYIf9ZoNV5NBC1R52x12aIOdsAqwFI=";

  ldflags = [ "-s" "-w" ];

--- a/pkgs/development/interpreters/picolisp/default.nix
+++ b/pkgs/development/interpreters/picolisp/default.nix
@ -1,66 +1,49 @@
-{ lib, stdenv, fetchurl, jdk, w3m, openssl, makeWrapper }:
+{
+  clang,
+  fetchurl,
+  lib,
+  libffi,
+  llvm,
+  makeWrapper,
+  openssl,
+  pkg-config,
+  readline,
+  stdenv
+}:

-stdenv.mkDerivation rec {
-  pname = "picoLisp";
-  version = "20.6";
+stdenv.mkDerivation {
+  pname = "PicoLisp";
+  version = "24.3.30";
  src = fetchurl {
-    url = "https://www.software-lab.de/${pname}-${version}.tgz";
-    sha256 = "0l51x98bn1hh6kv40sdgp0x09pzg5i8yxbcjvm9n5bxsd6bbk5w2";
+    url = "https://www.software-lab.de/picoLisp-24.3.tgz";
+    sha256 = "sha256-FB43DAjHBFgxdysoLzBXLxii52a2CCh1skZP/RTzfdc=";
  };
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [openssl] ++ lib.optional stdenv.is64bit jdk;
-  patchPhase = ''
-    sed -i "s/which java/command -v java/g" mkAsm

-    ${lib.optionalString stdenv.isAarch32 ''
-      sed -i s/-m32//g Makefile
-      cat >>Makefile <<EOF
-      ext.o: ext.c
-        \$(CC) \$(CFLAGS) -fPIC -D_OS='"\$(OS)"' \$*.c
-      ht.o: ht.c
-        \$(CC) \$(CFLAGS) -fPIC -D_OS='"\$(OS)"' \$*.c
-      EOF
-    ''}
-  '';
-  sourceRoot = ''picoLisp/src${lib.optionalString stdenv.is64bit "64"}'';
-  postBuild = ''
-    cd ../src; make gate
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ clang libffi llvm openssl pkg-config readline ];
+  sourceRoot = ''pil21'';
+  buildPhase = ''
+    cd src
+    make
  '';
+
  installPhase = ''
    cd ..
-
-    mkdir -p "$out/share/picolisp" "$out/lib" "$out/bin"
-    cp -r . "$out/share/picolisp/build-dir"
-    ln -s "$out/share/picolisp/build-dir" "$out/lib/picolisp"
+    mkdir -p "$out/lib" "$out/bin" "$out/man"
+    cp -r . "$out/lib/picolisp/"
    ln -s "$out/lib/picolisp/bin/picolisp" "$out/bin/picolisp"
-    ln -s "$out/lib/picolisp/bin/httpGate" "$out/bin/httpGate"
-
-
-    makeWrapper $out/bin/picolisp $out/bin/pil \
-      --prefix PATH : ${w3m}/bin \
-      --add-flags "$out/lib/picolisp/lib.l" \
-      --add-flags "@lib/misc.l" \
-      --add-flags "@lib/btree.l" \
-      --add-flags "@lib/db.l" \
-      --add-flags "@lib/pilog.l"
-
-    mkdir -p "$out/share/emacs"
-    ln -s "$out/lib/picolisp/lib/el" "$out/share/emacs/site-lisp"
+    ln -s "$out/lib/picolisp/bin/pil" "$out/bin/pil"
+    ln -s "$out/lib/picolisp/man/man1/pil.1" "$out/man/pil.1"
+    ln -s "$out/lib/picolisp/man/man1/picolisp.1" "$out/man/picolisp.1"
+    substituteInPlace $out/bin/pil --replace /usr $out
  '';

  meta = with lib; {
-    # darwin: build times out
-    broken = (stdenv.isLinux && stdenv.isAarch64) || stdenv.isDarwin;
-    description = "A simple Lisp with an integrated database";
+    description = "A pragmatic programming language.";
    homepage = "https://picolisp.com/";
    license = licenses.mit;
-    maintainers = with maintainers; [ raskin ];
+    maintainers = with maintainers; [ nat-418 ];
    platforms = platforms.all;
  };
-
-  passthru = {
-    updateInfo = {
-      downloadPage = "https://www.software-lab.de/down.html";
-    };
-  };
 }
+
--- a/pkgs/development/libraries/entt/default.nix
+++ b/pkgs/development/libraries/entt/default.nix
@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, cmake }:
 stdenv.mkDerivation rec {
  pname = "entt";
-  version = "3.13.1";
+  version = "3.13.2";

  src = fetchFromGitHub {
    owner = "skypjack";
    repo = "entt";
    rev = "v${version}";
-    hash = "sha256-TZuKgpLJCy3uct39SFSVi4b4lyldcfJ3AQNrz3OT3Ow=";
+    hash = "sha256-botX9T9KEXbctI1hUOt983y2rtWDeXyTonGYpJ6eGr8=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/virglrenderer/default.nix
+++ b/pkgs/development/libraries/virglrenderer/default.nix
@ -1,5 +1,7 @@
 { lib, stdenv, fetchurl, meson, ninja, pkg-config, python3
-, libGLU, libepoxy, libX11, libdrm, mesa, gitUpdater
+, libGLU, libepoxy, libX11, libdrm, mesa
+, vaapiSupport ? true, libva
+, gitUpdater
 }:

 stdenv.mkDerivation rec {
@ -13,10 +15,15 @@ stdenv.mkDerivation rec {

  separateDebugInfo = true;

-  buildInputs = [ libGLU libepoxy libX11 libdrm mesa ];
+  buildInputs = [ libGLU libepoxy libX11 libdrm mesa ]
+    ++ lib.optionals vaapiSupport [ libva ];

  nativeBuildInputs = [ meson ninja pkg-config python3 ];

+  mesonFlags= [
+    (lib.mesonBool "video" vaapiSupport)
+  ];
+
  passthru = {
    updateScript = gitUpdater {
      url = "https://gitlab.freedesktop.org/virgl/virglrenderer.git";
--- a/pkgs/development/libraries/xgboost/default.nix
+++ b/pkgs/development/libraries/xgboost/default.nix
@ -115,21 +115,15 @@ stdenv.mkDerivation rec {
    let libname = "libxgboost${stdenv.hostPlatform.extensions.sharedLibrary}";
    in ''
      runHook preInstall
-      mkdir -p $out
-      cp -r ../include $out
-      cp -r ../dmlc-core/include/dmlc $out/include
-      cp -r ../rabit/include/rabit $out/include
-    '' + lib.optionalString (!rLibrary) ''
-      install -Dm755 ../lib/${libname} $out/lib/${libname}
-      install -Dm755 ../xgboost $out/bin/xgboost
    ''
    # the R library option builds a completely different binary xgboost.so instead of
    # libxgboost.so, which isn't full featured for python and CLI
    + lib.optionalString rLibrary ''
-      mkdir $out/library
+      mkdir -p $out/library
      export R_LIBS_SITE="$out/library:$R_LIBS_SITE''${R_LIBS_SITE:+:}"
-      make install -l $out/library
    '' + ''
+      cmake --install .
+      cp -r ../rabit/include/rabit $out/include
      runHook postInstall
    '';

--- a/pkgs/development/misc/juce/default.nix
+++ b/pkgs/development/misc/juce/default.nix
@ -20,13 +20,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "juce";
-  version = "7.0.10";
+  version = "7.0.11";

  src = fetchFromGitHub {
    owner = "juce-framework";
    repo = "juce";
    rev = finalAttrs.version;
-    hash = "sha256-CAHhHPTUvIyDOh2CdvNmw26HfoWWtbqRRiR+3Ky4GYA=";
+    hash = "sha256-XFC+MYxUE3NatM2oYykiPJtiQLy33JD64VZFfZS2Tas=";
  };

  patches = [
--- a/pkgs/development/python-modules/aiolifx-themes/default.nix
+++ b/pkgs/development/python-modules/aiolifx-themes/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "aiolifx-themes";
-  version = "0.4.16";
+  version = "0.4.17";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "Djelibeybi";
    repo = "aiolifx-themes";
    rev = "refs/tags/v${version}";
-    hash = "sha256-rtZRl1doTBg8CdX0p9fLzo6m2dx8YKCQOOZyvIPSr9A=";
+    hash = "sha256-nKzvdDzwizF1Db8qFQuOH7gLnYHmdCYdQZPN+gNg8mU=";
  };

  prePatch = ''
--- a/pkgs/development/python-modules/anywidget/default.nix
+++ b/pkgs/development/python-modules/anywidget/default.nix
@ -14,14 +14,14 @@

 buildPythonPackage rec {
  pname = "anywidget";
-  version = "0.9.4";
-  format = "pyproject";
+  version = "0.9.6";
+  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-97nCw1PohHKW2DtY6RARk1/RlMsc1s5wajuhbY3pQxo=";
+    hash = "sha256-nhDPAXwcsxwrTBG1kEBj77bDXMb3j/Xckk3FENjCS5E=";
  };

  # We do not need the jupyterlab build dependency, because we do not need to
@ -32,12 +32,12 @@ buildPythonPackage rec {
      --replace '"jupyterlab==3.*"' ""
  '';

-  nativeBuildInputs = [
+  build-system = [
    hatch-jupyter-builder
    hatchling
  ];

-  propagatedBuildInputs = [
+  dependencies = [
    ipywidgets
    psygnal
    typing-extensions
--- a/pkgs/development/python-modules/ipykernel/default.nix
+++ b/pkgs/development/python-modules/ipykernel/default.nix
@ -22,14 +22,14 @@

 buildPythonPackage rec {
  pname = "ipykernel";
-  version = "6.29.3";
+  version = "6.29.4";
  pyproject = true;

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-4UwlDR+eo5iUkCJcwaVCeBsJWhihlEf88rXq99CsW9I=";
+    hash = "sha256-PUQHAGD5R1rCCSt2ASP63xBdLiSTwkhItmkafE9Cr1w=";
  };

  # debugpy is optional, see https://github.com/ipython/ipykernel/pull/767
--- a/pkgs/development/python-modules/ipyparallel/default.nix
+++ b/pkgs/development/python-modules/ipyparallel/default.nix
@ -18,14 +18,14 @@

 buildPythonPackage rec {
  pname = "ipyparallel";
-  version = "8.7.0";
+  version = "8.8.0";
  pyproject = true;

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-QDwJca5Wwrajn/6PNfMcf9FwzhJ5JGKUWc3X96C058M=";
+    hash = "sha256-JATVn4ajqqO9J79rV993e/9cE2PBxuYEA3WdFu1C3Hs=";
  };

  # We do not need the jupyterlab build dependency, because we do not need to
--- a/pkgs/development/python-modules/ipyvuetify/default.nix
+++ b/pkgs/development/python-modules/ipyvuetify/default.nix
@ -11,13 +11,13 @@

 buildPythonPackage rec {
  pname = "ipyvuetify";
-  version = "1.9.3";
+  version = "1.9.4";
  pyproject = true;

  # GitHub version tries to run npm (Node JS)
  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-v2EM/liQ6C8o7x+UtbYM153L7Un9596tXKrNoDboQM0=";
+    hash = "sha256-wpwfN68wpj2+lLb4w0erAZYa7OrbVhNfGMv0635oiVs=";
  };

  # drop pynpm which tries to install node_modules
--- a/pkgs/development/python-modules/jupyterlab-server/default.nix
+++ b/pkgs/development/python-modules/jupyterlab-server/default.nix
@ -21,7 +21,7 @@

 buildPythonPackage rec {
  pname = "jupyterlab-server";
-  version = "2.25.4";
+  version = "2.26.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -29,7 +29,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "jupyterlab_server";
    inherit version;
-    hash = "sha256-IJgZjh6C4NuYJED5tRNhddc76izUKmSAqm/VAssjxPk=";
+    hash = "sha256-mzupHPKDf38ST8o21j88qArOK+1ImKY91H5lmMGrAG8=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/jupyterlab/default.nix
+++ b/pkgs/development/python-modules/jupyterlab/default.nix
@ -20,14 +20,14 @@

 buildPythonPackage rec {
  pname = "jupyterlab";
-  version = "4.1.5";
+  version = "4.1.6";
  pyproject = true;

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-ya11KQyxC/r/NiS/P7uFIxm0zOTEVmE/jruqmNA1JNs=";
+    hash = "sha256-eTXza6JuthUYOk9cK7yleRtRCM4qALVQX4z9EA1TZI4=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/marimo/default.nix
+++ b/pkgs/development/python-modules/marimo/default.nix
@ -19,14 +19,14 @@

 buildPythonPackage rec {
  pname = "marimo";
-  version = "0.3.9";
+  version = "0.3.12";
  pyproject = true;

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-tkBCfOMevhYcDvRNps00zvGx45S/aVF/KHDxNTCBq98=";
+    hash = "sha256-4OwTY4OFkTQcQqHntjcfwPTx4w+2GPEUBy/XgW/nATU=";
  };

  build-system = [
--- a/pkgs/development/python-modules/nbformat/default.nix
+++ b/pkgs/development/python-modules/nbformat/default.nix
@ -15,27 +15,31 @@

 buildPythonPackage rec {
  pname = "nbformat";
-  version = "5.10.3";
-  format = "pyproject";
+  version = "5.10.4";
+  pyproject = true;
  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-YO1ekQ73xiZLh9ZE8naxtJ4kARkw3u9UYFGI3eshFoU=";
+    hash = "sha256-MiFosU+Tel0RNimI7KwqSVLT2OOiy+sjGVhGMSJtWzo=";
  };

-  nativeBuildInputs = [
+  build-system = [
    hatchling
    hatch-nodejs-version
  ];

-  propagatedBuildInputs = [
+  dependencies = [
    fastjsonschema
    jsonschema
    jupyter-core
    traitlets
  ];

+  pythonImportsCheck = [
+    "nbformat"
+  ];
+
  nativeCheckInputs = [
    pep440
    pytestCheckHook
--- a/pkgs/development/python-modules/oci/default.nix
+++ b/pkgs/development/python-modules/oci/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "oci";
-  version = "2.125.1";
+  version = "2.125.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "oracle";
    repo = "oci-python-sdk";
    rev = "refs/tags/v${version}";
-    hash = "sha256-74Y/Rr3jmq4yO78FOrDja+wQIoXom6MBpXCiv/4zA0c=";
+    hash = "sha256-tpWaH/uiUm0wmJrSyxiy9H8I/c44KmGjWEecBk6Yq40=";
  };

  pythonRelaxDeps = [
--- a/pkgs/development/python-modules/osc/default.nix
+++ b/pkgs/development/python-modules/osc/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "osc";
-  version = "1.3.1";
+  version = "1.6.1";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "openSUSE";
    repo = "osc";
    rev = version;
-    sha256 = "sha256-pywSXGM3IX3cTr1uJIP7pNGIYE/skMIoJeoaMU75zwc=";
+    hash = "sha256-U76nAE7NdLIdrKzRC0sP8hy6G6A8Tr4Qe2PGZI2xvyk=";
  };

  buildInputs = [ bashInteractive ]; # needed for bash-completion helper
@ -45,7 +45,7 @@ buildPythonPackage rec {
    homepage = "https://github.com/openSUSE/osc";
    description = "opensuse-commander with svn like handling";
    mainProgram = "osc";
-    maintainers = [ maintainers.peti ];
+    maintainers = with maintainers; [ peti saschagrunert ];
    license = licenses.gpl2;
  };

--- a/pkgs/development/python-modules/pytest-jupyter/default.nix
+++ b/pkgs/development/python-modules/pytest-jupyter/default.nix
@ -22,14 +22,14 @@

 let self = buildPythonPackage rec {
  pname = "pytest-jupyter";
-  version = "0.9.1";
+  version = "0.10.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "jupyter-server";
    repo = "pytest-jupyter";
    rev = "refs/tags/v${version}";
-    hash = "sha256-+NtLyTpMpJ+asbiQZNLFs1qLr00UlEOlbxortQ1B4so=";
+    hash = "sha256-RTpXBbVCRj0oyZ1TXXDv3M7sAI4kA6f3ouzTr0rXjwY=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/survey/default.nix
+++ b/pkgs/development/python-modules/survey/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "survey";
-  version = "5.2.4";
+  version = "5.3.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-Hr7sYn6V2iw4r3P8mXhYVyUD8JpU2zGq4nG6hHM7gxU=";
+    hash = "sha256-jMTtsrEdt3NPy8NfeNPX4YNwjH2gaQfO89Iag/MBS+A=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/r-modules/default.nix
+++ b/pkgs/development/r-modules/default.nix
@ -654,7 +654,7 @@ let
    rtk = [ pkgs.zlib.dev ];
    scPipe = with pkgs; [ bzip2.dev xz.dev zlib.dev ];
    seqTools = [ pkgs.zlib.dev ];
-    seqbias = [ pkgs.zlib.dev ];
+    seqbias = with pkgs; [ zlib.dev bzip2.dev xz.dev ];
    sparkwarc = [ pkgs.zlib.dev ];
    RoBMA = [ pkgs.jags ];
    pexm = [ pkgs.jags ];
--- a/pkgs/development/tools/bearer/default.nix
+++ b/pkgs/development/tools/bearer/default.nix
@ -1,26 +1,25 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
-, testers
-, bearer
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  testers,
+  bearer,
 }:

 buildGoModule rec {
  pname = "bearer";
-  version = "1.43.1";
+  version = "1.43.2";

  src = fetchFromGitHub {
    owner = "bearer";
    repo = "bearer";
    rev = "refs/tags/v${version}";
-    hash = "sha256-T5JiGoiVs6crbWiOPbjLpcHRdIovHAVUDAaa4e3ZDPc=";
+    hash = "sha256-F7BToROR8mcINmIVz7J6xRSyLDKQyUyp7o1yQVVHdp0=";
  };

  vendorHash = "sha256-g0AnL6r3dUfCIAytTknAD5aCPBsohDUMNfMAYKBebi4=";

-  subPackages = [
-    "cmd/bearer"
-  ];
+  subPackages = [ "cmd/bearer" ];

  ldflags = [
    "-s"
--- a/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
+++ b/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "cirrus-cli";
-  version = "0.114.2";
+  version = "0.115.3";

  src = fetchFromGitHub {
    owner = "cirruslabs";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-msWvi2aUrGLfTCkBuKt9LQA3Dui74Pw3l1YHT0RPinw=";
+    sha256 = "sha256-kO2RgT5Y3fvayiYSFZsiHNwmOpIrNvNuD3BzbvhNRvg=";
  };

-  vendorHash = "sha256-f/OIgQBneXdEL2cfTvNK2kLMb8Ag9hqhhD0bXwaY/hM=";
+  vendorHash = "sha256-tkKxg08uL1vlOyD/tpRLzjHpOVWOmYZxcq8B+Q7/3Zo=";

  ldflags = [
    "-X github.com/cirruslabs/cirrus-cli/internal/version.Version=v${version}"
--- a/pkgs/development/tools/goa/default.nix
+++ b/pkgs/development/tools/goa/default.nix
@ -5,15 +5,15 @@

 buildGoModule rec {
  pname = "goa";
-  version = "3.15.2";
+  version = "3.16.0";

  src = fetchFromGitHub {
    owner = "goadesign";
    repo = "goa";
    rev = "v${version}";
-    hash = "sha256-jzhvElHOBzekW3cyXf7wJG+8E1GObWVtPbBw18/dpCk=";
+    hash = "sha256-UumeyuFElb+MPd9GYaT8U1GtDi21tChGKKqXBqQ/ZOk=";
  };
-  vendorHash = "sha256-Z31hTOMmxFM0zmHoZRJaIz7ka2adV0crdhou6EudDWw=";
+  vendorHash = "sha256-A7FsCfZQKFFrk0KXvgyJjfGjyHQ3Ruoq/+RxC+zSa04=";

  subPackages = [ "cmd/goa" ];

--- a/pkgs/development/tools/misc/terraform-ls/default.nix
+++ b/pkgs/development/tools/misc/terraform-ls/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "terraform-ls";
-  version = "0.32.8";
+  version = "0.33.0";

  src = fetchFromGitHub {
    owner = "hashicorp";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-ZXtzQEi5aLiYa4KjH3DkFPFi6EEEjxof6Y+8cRJkSCM=";
+    hash = "sha256-UrymfiuaQ6k2MSwq/ZhtdsaSzc3uRzIsdq/Wepeo5+I=";
  };

-  vendorHash = "sha256-DGomEJ0IGs8uOrn50N+R3tRZJvw7iyHlPVpH3CVvjsU=";
+  vendorHash = "sha256-yWRfYzctunXRHN9j3K7KUUAsJhs2bUzgPb+u6SjuAlk=";

  ldflags = [ "-s" "-w" ];

--- a/pkgs/development/tools/rust/cargo-lambda/Cargo.lock
+++ b/pkgs/development/tools/rust/cargo-lambda/Cargo.lock
--- a/pkgs/development/tools/rust/cargo-lambda/default.nix
+++ b/pkgs/development/tools/rust/cargo-lambda/default.nix
@ -15,21 +15,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-lambda";
-  version = "1.0.1";
+  version = "1.2.1";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-KSJn8DRvm/ZLikCT8Tp9lb/ej0KSlZqRROs1yLNDa6c=";
+    hash = "sha256-E9jUlEiHyf5UR/UZxJj9LTfyAxGR/WsvRQdFdIVvLG8=";
  };

-  cargoLock = {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "cargo-test-macro-0.1.0" = "sha256-s3PM5SHGwZRr1cKt3LTL9fSAhzZ6CaZmDMVUgnOr6R0=";
-    };
-  };
+  cargoHash = "sha256-IXMkgpyYwll8NwTXRffbsSP5uFHGJe1n2RQ1Mbu+E70=";

  nativeCheckInputs = [cacert];

@ -52,6 +47,8 @@ rustPlatform.buildRustPackage rec {
    "--skip=test_download_example"
    "--skip=test_init_subcommand"
    "--skip=test_init_subcommand_without_override"
+    "--skip=test_build_example"
+    "--skip=test_deploy_workspace"
  ];

  # remove date from version output to make reproducible
--- a/pkgs/development/tools/semantic-release/default.nix
+++ b/pkgs/development/tools/semantic-release/default.nix
@ -8,16 +8,16 @@

 buildNpmPackage rec {
  pname = "semantic-release";
-  version = "23.0.7";
+  version = "23.0.8";

  src = fetchFromGitHub {
    owner = "semantic-release";
    repo = "semantic-release";
    rev = "v${version}";
-    hash = "sha256-4NhTVp/E9yM7rtOQa03PMhQ/TfOL23XQiixXct9uies=";
+    hash = "sha256-9dnBrwvV0by2EFIpXd++I8JEzdotWSFcK7wbY/1Rpx0=";
  };

-  npmDepsHash = "sha256-2Ne+jgCo7H0dgLSsStuMWqd1aplQClf3GbDYZhIy014=";
+  npmDepsHash = "sha256-GwrrjL8egqoE2ATK5wOWuMF/xzCLYAe9wzZ0ff5H82E=";

  dontNpmBuild = true;

--- a/pkgs/development/tools/subxt/default.nix
+++ b/pkgs/development/tools/subxt/default.nix
@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "subxt";
-  version = "0.35.1";
+  version = "0.35.2";

  src = fetchFromGitHub {
    owner = "paritytech";
    repo = "subxt";
    rev = "v${version}";
-    hash = "sha256-hv31E0e2ANArrK5VNHwKiEfDvaJojTjBA65oskziLUI=";
+    hash = "sha256-nMdpMvNoynioCzD7wXbF1W3mwCfOClAZyjbF/3eworw=";
  };

-  cargoHash = "sha256-V7oAvD8M+1CGnXYzj4qeb+skkVROdXr0S5l5mZyLnfA=";
+  cargoHash = "sha256-sXiMgooOSGDl0L0i5VncCYuoSzjRSogRGqteE+b6jkc=";

  # Only build the command line client
  cargoBuildFlags = [ "--bin" "subxt" ];
--- a/pkgs/development/tools/trunk/default.nix
+++ b/pkgs/development/tools/trunk/default.nix
@ -55,7 +55,7 @@ rustPlatform.buildRustPackage rec {
    homepage = "https://github.com/trunk-rs/trunk";
    description = "Build, bundle & ship your Rust WASM application to the web";
    mainProgram = "trunk";
-    maintainers = with maintainers; [ freezeboy ];
+    maintainers = with maintainers; [ freezeboy ctron ];
    license = with licenses; [ asl20 ];
  };
 }
--- a/pkgs/development/tools/yarn-berry/default.nix
+++ b/pkgs/development/tools/yarn-berry/default.nix
@ -1,13 +1,13 @@
-{ fetchFromGitHub, lib, nodejs, stdenv, yarn }:
+{ fetchFromGitHub, lib, nodejs, stdenv, testers, yarn }:

-stdenv.mkDerivation rec {
-  name = "yarn-berry";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "yarn-berry";
  version = "4.1.1";

  src = fetchFromGitHub {
    owner = "yarnpkg";
    repo = "berry";
-    rev = "@yarnpkg/cli/${version}";
+    rev = "@yarnpkg/cli/${finalAttrs.version}";
    hash = "sha256-75bERA1uZeywMjYznFDyk4+AtVDLo7eIajVtWdAD/RA=";
  };

@ -35,6 +35,12 @@ stdenv.mkDerivation rec {

  passthru.updateScript = ./update.sh;

+  passthru.tests = {
+    version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+    };
+  };
+
  meta = with lib; {
    homepage = "https://yarnpkg.com/";
    description = "Fast, reliable, and secure dependency management.";
@ -43,4 +49,4 @@ stdenv.mkDerivation rec {
    platforms = platforms.unix;
    mainProgram = "yarn";
  };
-}
+})
--- a/pkgs/misc/fastly/default.nix
+++ b/pkgs/misc/fastly/default.nix
@ -10,13 +10,13 @@

 buildGoModule rec {
  pname = "fastly";
-  version = "10.8.9";
+  version = "10.8.10";

  src = fetchFromGitHub {
    owner = "fastly";
    repo = "cli";
    rev = "refs/tags/v${version}";
-    hash = "sha256-s3tsLCON8F1N7pK7xp8Fwmo8KNctmUnA7I1MxhQeDtA=";
+    hash = "sha256-AUseetBbr4phJJZe0qh9vXeNX7IwFGhgm+uGCbVWx5s=";
    # The git commit is part of the `fastly version` original output;
    # leave that output the same in nixpkgs. Use the `.git` directory
    # to retrieve the commit SHA, and remove the directory afterwards,
@ -33,7 +33,7 @@ buildGoModule rec {
    "cmd/fastly"
  ];

-  vendorHash = "sha256-irBqINffT7aMOn4NyuYmSuo+E4Rw7ifAIMV0QpKm0So=";
+  vendorHash = "sha256-L9U2MN7b2AU3fQSBKhF2Q6p7eN95bQGV0u9c0C6/yx0=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/os-specific/darwin/raycast/default.nix
+++ b/pkgs/os-specific/darwin/raycast/default.nix
@ -10,12 +10,12 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "raycast";
-  version = "1.70.3";
+  version = "1.71.1";

  src = fetchurl {
    name = "Raycast.dmg";
    url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=universal";
-    hash = "sha256-BSeWkopuBszBAITiaAPIwUvP7I7sZTl1laQXWIN4qRE=";
+    hash = "sha256-TJBBguUMgH0QM8h6GMHrQmfmREB1O8k4tp3YMywYeXY=";
  };

  dontPatch = true;
--- a/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
+++ b/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
@ -1,7 +1,7 @@
 # This file is autogenerated! Run ./update.sh to regenerate.
 {
-  version = "20240312";
-  revision = "20240312";
-  sourceHash = "sha256-fDrnI7H87vG4OpcmjMcRTio01oHI0Z2KUfe3NNeY3JY=";
-  outputHash = "sha256-GYmRaW6wsOR+pqeQDyGYUDh6HfEs+sEi5vQoBHEeX9I=";
+  version = "20240410";
+  revision = "20240410";
+  sourceHash = "sha256-Qo4f5kdHlBYKlzdFOtoKoCPHXxgDeCawSE3tnRwfC4U=";
+  outputHash = "sha256-pOYDdb0A1sESiT0kfA4DbWxKJ3+pog54+S3KcQB3BsA=";
 }
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@ -615,8 +615,8 @@ let
      F2FS_FS_COMPRESSION = whenAtLeast "5.6" yes;
      UDF_FS              = module;

-      NFSD_V2_ACL            = whenOlder "6.1" yes;
-      NFSD_V3                = whenOlder "5.18" yes;
+      NFSD_V2_ACL            = whenOlder "5.15" yes;
+      NFSD_V3                = whenOlder "5.15" yes;
      NFSD_V3_ACL            = yes;
      NFSD_V4                = yes;
      NFSD_V4_SECURITY_LABEL = yes;
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@ -1,15 +1,15 @@
 {
    "testing": {
-        "version": "6.9-rc2",
-        "hash": "sha256:14yjrkd63qsd2hip53x146fsd42d261pxdh85fprcvsrg656c6gp"
+        "version": "6.9-rc3",
+        "hash": "sha256:0xavyh3xg23il3bm2x6fjji3s26z05cyv1lry6h5yd7jjj3qm7cc"
    },
    "6.1": {
-        "version": "6.1.84",
-        "hash": "sha256:0ykhl4i6yhryzgjkdbdz4pd3b1ghv84h6mpn7bdx0ra7w7mx55xg"
+        "version": "6.1.85",
+        "hash": "sha256:0x32p1c04q5d0yd4qncrmc064m3g1x7cvfia5cd04q3wb769pzik"
    },
    "5.15": {
-        "version": "5.15.153",
-        "hash": "sha256:1g44gjcwcdq5552vwinljqwiy90bxax72jjvdasp71x88khv3pfp"
+        "version": "5.15.154",
+        "hash": "sha256:16067mhf173kgs4mvlzix9qscwq5wy8817dyfyjx5g7jkykmxy0p"
    },
    "5.10": {
        "version": "5.10.214",
@ -24,11 +24,11 @@
        "hash": "sha256:10dww3cyazcf3wjzh8igpa0frb8gvl6amnksh42zfkji4mskh2r6"
    },
    "6.6": {
-        "version": "6.6.25",
-        "hash": "sha256:0i0zvqlj02rm6wpbidji0rn9559vrpfc1b8gbfjk70lhhyz11llr"
+        "version": "6.6.26",
+        "hash": "sha256:1nan0h95dkqpb55jr5mxfi8yks09fd518im3vblbi4zvyi4v8m5g"
    },
    "6.8": {
-        "version": "6.8.4",
-        "hash": "sha256:0qwywy89an1w0yvs5957kqyv74mwgxady521w2lmyq00zjaw9pnm"
+        "version": "6.8.5",
+        "hash": "sha256:12gsxxiwkildj8i94fkm2v69zb6z6s7hnnlvpsyv8j1pszjj728k"
    }
 }
--- a/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
@ -6,7 +6,7 @@
 , ... } @ args:

 let
-  version = "6.6.23-rt28"; # updated by ./update-rt.sh
+  version = "6.6.25-rt29"; # updated by ./update-rt.sh
  branch = lib.versions.majorMinor version;
  kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@ -18,14 +18,14 @@ in buildLinux (args // {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-    sha256 = "1fd824ia3ngy65c5qaaln7m66ca4p80bwlnvvk76pw4yrccx23r0";
+    sha256 = "0i0zvqlj02rm6wpbidji0rn9559vrpfc1b8gbfjk70lhhyz11llr";
  };

  kernelPatches = let rt-patch = {
    name = "rt";
    patch = fetchurl {
      url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "0l9509qnv333fwjlxkr46rb23dhxs43bzj6iisk1r2lq69jhmyx4";
+      sha256 = "15mb4zycv86yp1cbs5svgs3pnmh8jihjhf4jxc4h4ywlzglkb1za";
    };
  }; in [ rt-patch ] ++ kernelPatches;

--- a/pkgs/os-specific/linux/kernel/update-mainline.py
+++ b/pkgs/os-specific/linux/kernel/update-mainline.py
@ -130,6 +130,13 @@ def main():
            continue

        if old_version is None:
+            if kernel.eol:
+                print(
+                    f"{kernel.branch} is EOL, not adding...",
+                    file=sys.stderr
+                )
+                continue
+
            message = f"linux_{nixpkgs_branch}: init at {kernel.version}"
        else:
            message = f"linux_{nixpkgs_branch}: {old_version} -> {kernel.version}"
--- a/Show More
+++ b/Show More