Merge master into haskell-updates

2024-01-01 00:14:29 +00:00 · 2024-01-01 00:14:29 +00:00 · 9504795b14
commit 9504795b14
parent 50d354db00 a9236d91a1
193 changed files with 6804 additions and 1109 deletions
--- a/doc/build-helpers/images/binarycache.section.md
+++ b/doc/build-helpers/images/binarycache.section.md
@ -1,49 +1,58 @@
 # pkgs.mkBinaryCache {#sec-pkgs-binary-cache}

-`pkgs.mkBinaryCache` is a function for creating Nix flat-file binary caches. Such a cache exists as a directory on disk, and can be used as a Nix substituter by passing `--substituter file:///path/to/cache` to Nix commands.
+`pkgs.mkBinaryCache` is a function for creating Nix flat-file binary caches.
+Such a cache exists as a directory on disk, and can be used as a Nix substituter by passing `--substituter file:///path/to/cache` to Nix commands.

-Nix packages are most commonly shared between machines using [HTTP, SSH, or S3](https://nixos.org/manual/nix/stable/package-management/sharing-packages.html), but a flat-file binary cache can still be useful in some situations. For example, you can copy it directly to another machine, or make it available on a network file system. It can also be a convenient way to make some Nix packages available inside a container via bind-mounting.
+Nix packages are most commonly shared between machines using [HTTP, SSH, or S3](https://nixos.org/manual/nix/stable/package-management/sharing-packages.html), but a flat-file binary cache can still be useful in some situations.
+For example, you can copy it directly to another machine, or make it available on a network file system.
+It can also be a convenient way to make some Nix packages available inside a container via bind-mounting.

-Note that this function is meant for advanced use-cases. The more idiomatic way to work with flat-file binary caches is via the [nix-copy-closure](https://nixos.org/manual/nix/stable/command-ref/nix-copy-closure.html) command. You may also want to consider [dockerTools](#sec-pkgs-dockerTools) for your containerization needs.
+`mkBinaryCache` expects an argument with the `rootPaths` attribute.
+`rootPaths` must be a list of derivations.
+The transitive closure of these derivations' outputs will be copied into the cache.

-## Example {#sec-pkgs-binary-cache-example}
+::: {.note}
+This function is meant for advanced use cases.
+The more idiomatic way to work with flat-file binary caches is via the [nix-copy-closure](https://nixos.org/manual/nix/stable/command-ref/nix-copy-closure.html) command.
+You may also want to consider [dockerTools](#sec-pkgs-dockerTools) for your containerization needs.
+:::
+
+[]{#sec-pkgs-binary-cache-example}
+:::{.example #ex-mkbinarycache-copying-package-closure}
+
+# Copying a package and its closure to another machine with `mkBinaryCache`

 The following derivation will construct a flat-file binary cache containing the closure of `hello`.

 ```nix
+{ mkBinaryCache, hello }:
 mkBinaryCache {
  rootPaths = [hello];
 }
 ```

- `rootPaths` specifies a list of root derivations. The transitive closure of these derivations' outputs will be copied into the cache.
-
-Here's an example of building and using the cache.
-
-Build the cache on one machine, `host1`:
+Build the cache on a machine.
+Note that the command still builds the exact nix package above, but adds some boilerplate to build it directly from an expression.

 ```shellSession
-nix-build -E 'with import <nixpkgs> {}; mkBinaryCache { rootPaths = [hello]; }'
+$ nix-build -E 'let pkgs = import <nixpkgs> {}; in pkgs.callPackage ({ mkBinaryCache, hello }: mkBinaryCache { rootPaths = [hello]; }) {}'
+/nix/store/azf7xay5xxdnia4h9fyjiv59wsjdxl0g-binary-cache
 ```

+Copy the resulting directory to another machine, which we'll call `host2`:
+
 ```shellSession
-/nix/store/cc0562q828rnjqjyfj23d5q162gb424g-binary-cache
+$ scp result host2:/tmp/hello-cache
 ```

-Copy the resulting directory to the other machine, `host2`:
+At this point, the cache can be used as a substituter when building derivations on `host2`:

 ```shellSession
-scp result host2:/tmp/hello-cache
-```
-
-Substitute the derivation using the flat-file binary cache on the other machine, `host2`:
-```shellSession
-nix-build -A hello '<nixpkgs>' \
+$ nix-build -A hello '<nixpkgs>' \
  --option require-sigs false \
  --option trusted-substituters file:///tmp/hello-cache \
  --option substituters file:///tmp/hello-cache
+/nix/store/zhl06z4lrfrkw5rp0hnjjfrgsclzvxpm-hello-2.12.1
 ```

-```shellSession
-/nix/store/gl5a41azbpsadfkfmbilh9yk40dh5dl0-hello-2.12.1
-```
+:::
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -2063,6 +2063,12 @@
    githubId = 80325;
    name = "Benjamin Andresen";
  };
+  barab-i = {
+    email = "barab_i@outlook.com";
+    github = "barab-i";
+    githubId = 92919899;
+    name = "Barab I";
+  };
  baracoder = {
    email = "baracoder@googlemail.com";
    github = "baracoder";
@ -3968,6 +3974,12 @@
    githubId = 217899;
    name = "Cyryl Płotnicki";
  };
+  d3vil0p3r = {
+    name = "Antonio Voza";
+    email = "vozaanthony@gmail.com";
+    github = "D3vil0p3r";
+    githubId = 83867734;
+  };
  dadada = {
    name = "dadada";
    email = "dadada@dadada.li";
@ -8242,6 +8254,12 @@
    github = "Janik-Haag";
    githubId = 80165193;
  };
+  jankaifer = {
+    name = "Jan Kaifer";
+    email = "jan@kaifer.cz";
+    github = "jankaifer";
+    githubId = 12820484;
+  };
  jansol = {
    email = "jan.solanti@paivola.fi";
    github = "jansol";
@ -10956,6 +10974,12 @@
    githubId = 2486026;
    name = "Luca Fulchir";
  };
+  luleyleo = {
+    email = "git@leopoldluley.de";
+    github = "luleyleo";
+    githubId = 10746692;
+    name = "Leopold Luley";
+  };
  lumi = {
    email = "lumi@pew.im";
    github = "lumi-me-not";
@ -13246,6 +13270,13 @@
    githubId = 6391776;
    name = "Nikita Voloboev";
  };
+  niklaskorz = {
+    name = "Niklas Korz";
+    email = "niklas@niklaskorz.de";
+    matrix = "@niklaskorz:korz.dev";
+    github = "niklaskorz";
+    githubId = 590517;
+  };
  NikolaMandic = {
    email = "nikola@mandic.email";
    github = "NikolaMandic";
@ -13551,6 +13582,12 @@
    githubId = 1839979;
    name = "Niklas Thörne";
  };
+  nudelsalat = {
+    email = "nudelsalat@clouz.de";
+    name = "Fabian Dreßler";
+    github = "Noodlesalat";
+    githubId = 12748782;
+  };
  nukaduka = {
    email = "ksgokte@gmail.com";
    github = "NukaDuka";
@ -13842,10 +13879,10 @@
    name = "Sandro Stikić";
  };
  OPNA2608 = {
-    email = "christoph.neidahl@gmail.com";
+    email = "opna2608@protonmail.com";
    github = "OPNA2608";
    githubId = 23431373;
-    name = "Christoph Neidahl";
+    name = "Cosima Neidahl";
  };
  orbekk = {
    email = "kjetil.orbekk@gmail.com";
@ -16965,6 +17002,11 @@
    githubId = 50401154;
    name = "Simone Ruffini";
  };
+  simonhammes = {
+    github = "simonhammes";
+    githubId = 10352679;
+    name = "Simon Hammes";
+  };
  simonkampe = {
    email = "simon.kampe+nix@gmail.com";
    github = "simonkampe";
@ -17286,6 +17328,13 @@
    githubId = 151924;
    name = "John Anderson";
  };
+  soopyc = {
+    name = "Cassie Cheung";
+    email = "me@soopy.moe";
+    github = "soopyc";
+    githubId = 13762043;
+    matrix = "@sophie:nue.soopy.moe";
+  };
  sophrosyne = {
    email = "joshuaortiz@tutanota.com";
    github = "sophrosyne97";
@ -20186,7 +20235,7 @@
  };
  yana = {
    email = "yana@riseup.net";
-    github = "yanalunaterra";
+    github = "yanateras";
    githubId = 1643293;
    name = "Yana Timoshenko";
  };
@ -20715,6 +20764,12 @@
    githubId = 8100652;
    name = "David Mell";
  };
+  zshipko = {
+    email = "zachshipko@gmail.com";
+    github = "zshipko";
+    githubId = 332534;
+    name = "Zach Shipko";
+  };
  ztzg = {
    email = "dd@crosstwine.com";
    github = "ztzg";
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -33,6 +33,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 - [Anki Sync Server](https://docs.ankiweb.net/sync-server.html), the official sync server built into recent versions of Anki. Available as [services.anki-sync-server](#opt-services.anki-sync-server.enable).
 The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been marked deprecated and will be dropped after 24.05 due to lack of maintenance of the anki-sync-server softwares.

+- [ping_exporter](https://github.com/czerwonk/ping_exporter), a Prometheus exporter for ICMP echo requests. Available as [services.prometheus.exporters.ping](#opt-services.prometheus.exporters.ping.enable).
+
 - [Clevis](https://github.com/latchset/clevis), a pluggable framework for automated decryption, used to unlock encrypted devices in initrd. Available as [boot.initrd.clevis.enable](#opt-boot.initrd.clevis.enable).

 - [TuxClocker](https://github.com/Lurkki14/tuxclocker), a hardware control and monitoring program. Available as [programs.tuxclocker](#opt-programs.tuxclocker.enable).
@ -128,6 +130,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
  `globalRedirect` can now have redirect codes other than 301 through
  `redirectCode`.

+- The source of the `mockgen` package has changed to the [go.uber.org/mock](https://github.com/uber-go/mock) fork because [the original repository is no longer maintained](https://github.com/golang/mock#gomock).
+
 - [](#opt-boot.kernel.sysctl._net.core.wmem_max_) changed from a string to an integer because of the addition of a custom merge option (taking the highest value defined to avoid conflicts between 2 services trying to set that value), just as [](#opt-boot.kernel.sysctl._net.core.rmem_max_) since 22.11.

 - `services.zfs.zed.enableMail` now uses the global `sendmail` wrapper defined by an email module
--- a/nixos/modules/misc/documentation.nix
+++ b/nixos/modules/misc/documentation.nix
@ -77,7 +77,11 @@ let
          libPath = filter (pkgs.path + "/lib");
          pkgsLibPath = filter (pkgs.path + "/pkgs/pkgs-lib");
          nixosPath = filter (pkgs.path + "/nixos");
-          modules = map (p: ''"${removePrefix "${modulesPath}/" (toString p)}"'') docModules.lazy;
+          modules =
+            "[ "
+            + concatMapStringsSep " " (p: ''"${removePrefix "${modulesPath}/" (toString p)}"'') docModules.lazy
+            + " ]";
+          passAsFile = [ "modules" ];
        } ''
          export NIX_STORE_DIR=$TMPDIR/store
          export NIX_STATE_DIR=$TMPDIR/state
@ -87,7 +91,7 @@ let
            --argstr libPath "$libPath" \
            --argstr pkgsLibPath "$pkgsLibPath" \
            --argstr nixosPath "$nixosPath" \
-            --arg modules "[ $modules ]" \
+            --arg modules "import $modulesPath" \
            --argstr stateVersion "${options.system.stateVersion.default}" \
            --argstr release "${config.system.nixos.release}" \
            $nixosPath/lib/eval-cacheable-options.nix > $out \
--- a/nixos/modules/services/hardware/thermald.nix
+++ b/nixos/modules/services/hardware/thermald.nix
@ -19,6 +19,12 @@ in
        '';
      };

+     ignoreCpuidCheck = mkOption {
+        type = types.bool;
+        default = false;
+        description = lib.mdDoc "Whether to ignore the cpuid check to allow running on unsupported platforms";
+      };
+
      configFile = mkOption {
        type = types.nullOr types.path;
        default = null;
@ -42,6 +48,7 @@ in
          ${cfg.package}/sbin/thermald \
            --no-daemon \
            ${optionalString cfg.debug "--loglevel=debug"} \
+            ${optionalString cfg.ignoreCpuidCheck "--ignore-cpuid-check"} \
            ${optionalString (cfg.configFile != null) "--config-file ${cfg.configFile}"} \
            --dbus-enable \
            --adaptive
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@ -747,7 +747,7 @@ in

            ${concatStringsSep "\n" (mapAttrsToList (to: from: ''
              ln -sf ${from} /var/lib/postfix/conf/${to}
-              ${pkgs.postfix}/bin/postalias /var/lib/postfix/conf/${to}
+              ${pkgs.postfix}/bin/postalias -o -p /var/lib/postfix/conf/${to}
            '') cfg.aliasFiles)}
            ${concatStringsSep "\n" (mapAttrsToList (to: from: ''
              ln -sf ${from} /var/lib/postfix/conf/${to}
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@ -64,6 +64,7 @@ let
    "pgbouncer"
    "php-fpm"
    "pihole"
+    "ping"
    "postfix"
    "postgres"
    "process"
--- a/nixos/modules/services/monitoring/prometheus/exporters/ping.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/ping.nix
@ -0,0 +1,48 @@
+{ config, lib, pkgs, options }:
+
+with lib;
+
+let
+  cfg = config.services.prometheus.exporters.ping;
+
+  settingsFormat = pkgs.formats.yaml {};
+  configFile = settingsFormat.generate "config.yml" cfg.settings;
+in
+{
+  port = 9427;
+  extraOpts = {
+    telemetryPath = mkOption {
+      type = types.str;
+      default = "/metrics";
+      description = ''
+        Path under which to expose metrics.
+      '';
+    };
+
+    settings = mkOption {
+      type = settingsFormat.type;
+      default = {};
+
+      description = lib.mdDoc ''
+        Configuration for ping_exporter, see
+        <https://github.com/czerwonk/ping_exporter>
+        for supported values.
+      '';
+    };
+  };
+
+  serviceOpts = {
+    serviceConfig = {
+      # ping-exporter needs `CAP_NET_RAW` to run as non root https://github.com/czerwonk/ping_exporter#running-as-non-root-user
+      CapabilityBoundingSet = [ "CAP_NET_RAW" ];
+      AmbientCapabilities = [ "CAP_NET_RAW" ];
+      ExecStart = ''
+        ${pkgs.prometheus-ping-exporter}/bin/ping_exporter \
+          --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
+          --web.telemetry-path ${cfg.telemetryPath} \
+          --config.path="${configFile}" \
+          ${concatStringsSep " \\\n  " cfg.extraFlags}
+      '';
+    };
+  };
+}
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@ -352,10 +352,11 @@ let

        # The acme-challenge location doesn't need to be added if we are not using any automated
        # certificate provisioning and can also be omitted when we use a certificate obtained via a DNS-01 challenge
-        acmeLocation = optionalString (vhost.enableACME || (vhost.useACMEHost != null && config.security.acme.certs.${vhost.useACMEHost}.dnsProvider == null)) ''
+        acmeLocation = optionalString (vhost.enableACME || (vhost.useACMEHost != null && config.security.acme.certs.${vhost.useACMEHost}.dnsProvider == null))
          # Rule for legitimate ACME Challenge requests (like /.well-known/acme-challenge/xxxxxxxxx)
          # We use ^~ here, so that we don't check any regexes (which could
          # otherwise easily override this intended match accidentally).
+        ''
          location ^~ /.well-known/acme-challenge/ {
            ${optionalString (vhost.acmeFallbackHost != null) "try_files $uri @acme-fallback;"}
            ${optionalString (vhost.acmeRoot != null) "root ${vhost.acmeRoot};"}
@ -375,10 +376,11 @@ let
            ${concatMapStringsSep "\n" listenString redirectListen}

            server_name ${vhost.serverName} ${concatStringsSep " " vhost.serverAliases};
-            ${acmeLocation}
+
            location / {
              return ${toString vhost.redirectCode} https://$host$request_uri;
            }
+            ${acmeLocation}
          }
        ''}

@ -392,13 +394,6 @@ let
            http3 ${if vhost.http3 then "on" else "off"};
            http3_hq ${if vhost.http3_hq then "on" else "off"};
          ''}
-          ${acmeLocation}
-          ${optionalString (vhost.root != null) "root ${vhost.root};"}
-          ${optionalString (vhost.globalRedirect != null) ''
-            location / {
-              return ${toString vhost.redirectCode} http${optionalString hasSSL "s"}://${vhost.globalRedirect}$request_uri;
-            }
-          ''}
          ${optionalString hasSSL ''
            ssl_certificate ${vhost.sslCertificate};
            ssl_certificate_key ${vhost.sslCertificateKey};
@ -421,6 +416,14 @@ let

          ${mkBasicAuth vhostName vhost}

+          ${optionalString (vhost.root != null) "root ${vhost.root};"}
+
+          ${optionalString (vhost.globalRedirect != null) ''
+            location / {
+              return ${toString vhost.redirectCode} http${optionalString hasSSL "s"}://${vhost.globalRedirect}$request_uri;
+            }
+          ''}
+          ${acmeLocation}
          ${mkLocations vhost.locations}

          ${vhost.extraConfig}
--- a/nixos/modules/system/boot/loader/grub/grub.nix
+++ b/nixos/modules/system/boot/loader/grub/grub.nix
@ -36,7 +36,7 @@ let
    # Package set of targeted architecture
    if cfg.forcei686 then pkgs.pkgsi686Linux else pkgs;

-  realGrub = if cfg.zfsSupport then grubPkgs.grub2.override { zfsSupport = true; }
+  realGrub = if cfg.zfsSupport then grubPkgs.grub2.override { zfsSupport = true; zfs = cfg.zfsPackage; }
    else grubPkgs.grub2;

  grub =
@ -614,6 +614,16 @@ in
        '';
      };

+      zfsPackage = mkOption {
+        type = types.package;
+        internal = true;
+        default = pkgs.zfs;
+        defaultText = literalExpression "pkgs.zfs";
+        description = lib.mdDoc ''
+          Which ZFS package to use if `config.boot.loader.grub.zfsSupport` is true.
+        '';
+      };
+
      efiSupport = mkOption {
        default = false;
        type = types.bool;
--- a/nixos/modules/tasks/filesystems/zfs.nix
+++ b/nixos/modules/tasks/filesystems/zfs.nix
@ -667,6 +667,7 @@ in
      # TODO FIXME See https://github.com/NixOS/nixpkgs/pull/99386#issuecomment-798813567. To not break people's bootloader and as probably not everybody would read release notes that thoroughly add inSystem.
      boot.loader.grub = mkIf (inInitrd || inSystem) {
        zfsSupport = true;
+        zfsPackage = cfgZfs.package;
      };

      services.zfs.zed.settings = {
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -257,6 +257,7 @@ in {
  dolibarr = handleTest ./dolibarr.nix {};
  domination = handleTest ./domination.nix {};
  dovecot = handleTest ./dovecot.nix {};
+  drawterm = discoverTests (import ./drawterm.nix);
  drbd = handleTest ./drbd.nix {};
  dublin-traceroute = handleTest ./dublin-traceroute.nix {};
  earlyoom = handleTestOn ["x86_64-linux"] ./earlyoom.nix {};
@ -786,6 +787,7 @@ in {
  spark = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./spark {};
  sqlite3-to-mysql = handleTest ./sqlite3-to-mysql.nix {};
  sslh = handleTest ./sslh.nix {};
+  ssh-agent-auth = handleTest ./ssh-agent-auth.nix {};
  ssh-audit = handleTest ./ssh-audit.nix {};
  sssd = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./sssd.nix {};
  sssd-ldap = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./sssd-ldap.nix {};
--- a/nixos/tests/drawterm.nix
+++ b/nixos/tests/drawterm.nix
@ -0,0 +1,58 @@
+{ system, pkgs }:
+let
+  tests = {
+    xorg = {
+      node = { pkgs, ... }: {
+        imports = [ ./common/user-account.nix ./common/x11.nix ];
+        services.xserver.enable = true;
+        services.xserver.displayManager.sessionCommands = ''
+          ${pkgs.drawterm}/bin/drawterm -g 1024x768 &
+        '';
+        test-support.displayManager.auto.user = "alice";
+      };
+      systems = [ "x86_64-linux" "aarch64-linux" ];
+    };
+    wayland = {
+      node = { pkgs, ... }: {
+        imports = [ ./common/wayland-cage.nix ];
+        services.cage.program = "${pkgs.drawterm-wayland}/bin/drawterm";
+      };
+      systems = [ "x86_64-linux" ];
+    };
+  };
+
+  mkTest = name: machine:
+    import ./make-test-python.nix ({ pkgs, ... }: {
+      inherit name;
+
+      nodes = { "${name}" = machine; };
+
+      meta = with pkgs.lib.maintainers; {
+        maintainers = [ moody ];
+      };
+
+      enableOCR = true;
+
+      testScript = ''
+        @polling_condition
+        def drawterm_running():
+            machine.succeed("pgrep drawterm")
+
+        start_all()
+
+        machine.wait_for_unit("graphical.target")
+        drawterm_running.wait() # type: ignore[union-attr]
+        machine.wait_for_text("cpu")
+        machine.send_chars("cpu\n")
+        machine.wait_for_text("auth")
+        machine.send_chars("cpu\n")
+        machine.wait_for_text("ending")
+        machine.screenshot("out.png")
+      '';
+
+    });
+  mkTestOn = systems: name: machine:
+    if pkgs.lib.elem system systems then mkTest name machine
+    else { ... }: { };
+in
+builtins.mapAttrs (k: v: mkTestOn v.systems k v.node { inherit system; }) tests
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@ -1053,6 +1053,50 @@ let
      '';
    };

+    ping = {
+      exporterConfig = {
+        enable = true;
+
+        settings = {
+          targets = [ {
+            "localhost" = {
+              alias = "local machine";
+              env = "prod";
+              type = "domain";
+            };
+          } {
+            "127.0.0.1" = {
+              alias = "local machine";
+              type = "v4";
+            };
+          } {
+            "::1" = {
+              alias = "local machine";
+              type = "v6";
+            };
+          } {
+            "google.com" = {};
+          } ];
+          dns = {};
+          ping = {
+            interval = "2s";
+            timeout = "3s";
+            history-size = 42;
+            payload-size = 56;
+          };
+          log = {
+            level = "warn";
+          };
+        };
+      };
+
+      exporterTest = ''
+        wait_for_unit("prometheus-ping-exporter.service")
+        wait_for_open_port(9427)
+        succeed("curl -sSf http://localhost:9427/metrics | grep 'ping_up{.*} 1'")
+      '';
+    };
+
    postfix = {
      exporterConfig = {
        enable = true;
--- a/nixos/tests/ssh-agent-auth.nix
+++ b/nixos/tests/ssh-agent-auth.nix
@ -0,0 +1,51 @@
+import ./make-test-python.nix ({ lib, pkgs, ... }:
+  let
+    inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
+  in {
+    name = "ssh-agent-auth";
+    meta.maintainers = with lib.maintainers; [ nicoo ];
+
+    nodes = let nodeConfig = n: { ... }: {
+      users.users = {
+        admin = {
+          isNormalUser = true;
+          extraGroups = [ "wheel" ];
+          openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
+        };
+        foo.isNormalUser = true;
+      };
+
+      security.pam.enableSSHAgentAuth = true;
+      security.${lib.replaceStrings [ "_" ] [ "-" ] n} = {
+        enable = true;
+        wheelNeedsPassword = true;  # We are checking `pam_ssh_agent_auth(8)` works for a sudoer
+      };
+
+      # Necessary for pam_ssh_agent_auth  >_>'
+      services.openssh.enable = true;
+    };
+    in lib.genAttrs [ "sudo" "sudo_rs" ] nodeConfig;
+
+    testScript = let
+      privateKeyPath = "/home/admin/.ssh/id_ecdsa";
+      userScript = pkgs.writeShellScript "test-script" ''
+        set -e
+        ssh-add -q ${privateKeyPath}
+
+        # faketty needed to ensure `sudo` doesn't write to the controlling PTY,
+        #  which would break the test-driver's line-oriented protocol.
+        ${lib.getExe pkgs.faketty} sudo -u foo -- id -un
+      '';
+    in ''
+      for vm in (sudo, sudo_rs):
+        sudo_impl = vm.name.replace("_", "-")
+        with subtest(f"wheel user can auth with ssh-agent for {sudo_impl}"):
+            vm.copy_from_host("${snakeOilPrivateKey}", "${privateKeyPath}")
+            vm.succeed("chmod -R 0700 /home/admin")
+            vm.succeed("chown -R admin:users /home/admin")
+
+            # Run `userScript` in an environment with an SSH-agent available
+            assert vm.succeed("sudo -u admin -- ssh-agent ${userScript} 2>&1").strip() == "foo"
+    '';
+  }
+)
--- a/pkgs/applications/audio/ncpamixer/default.nix
+++ b/pkgs/applications/audio/ncpamixer/default.nix
@ -1,17 +1,31 @@
-{ lib, stdenv, fetchFromGitHub, cmake, ncurses, libpulseaudio, pkg-config }:
+{ lib, stdenv, fetchFromGitHub, fetchurl, cmake, ncurses, libpulseaudio, pandoc, pkg-config }:

 stdenv.mkDerivation rec {
  pname = "ncpamixer";
-  version = "1.3.3.5";
+  version = "1.3.7";

  src = fetchFromGitHub {
    owner = "fulhax";
    repo = "ncpamixer";
    rev = version;
-    sha256 = "sha256-iwwfuMZn8HwnTIEBgTuvnJNlRlPt4G+j/piXO8S7mPc=";
+    sha256 = "sha256-GJ2zSIxSnL53nFZ2aeGlVI7i4APt+aALVEhNP5RkpMc=";
  };

-  nativeBuildInputs = [ cmake pkg-config ];
+  patches = [
+    ./remove_dynamic_download.patch
+  ];
+
+  postPatch = let
+    PandocMan = fetchurl {
+      url = "https://github.com/rnpgp/cmake-modules/raw/387084811ee01a69911fe86bcc644b7ed8ad6304/PandocMan.cmake";
+      hash = "sha256-KI55Yc2IuQtmbptqkk6Hzr75gIE/uQdUbQsm/fDpaWg=";
+    };
+  in ''
+    substituteInPlace src/CMakeLists.txt \
+      --replace "include(PandocMan)" "include(${PandocMan})"
+  '';
+
+  nativeBuildInputs = [ cmake pandoc pkg-config ];

  buildInputs = [ ncurses libpulseaudio ];

--- a/pkgs/applications/audio/ncpamixer/remove_dynamic_download.patch
+++ b/pkgs/applications/audio/ncpamixer/remove_dynamic_download.patch
@ -0,0 +1,16 @@
+diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
+index 8aac546..ec809e8 100644
+--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
+@@ -14,11 +14,9 @@ if(USE_WIDE)
+     set(CURSES_NEED_WIDE TRUE)
+ endif()
+ 
+-include(FetchContent)
+ include(GNUInstallDirs)
+ 
+ if (BUILD_MANPAGES)
+-    include("${CMAKE_CURRENT_SOURCE_DIR}/cmake.deps/FetchPandocMan.cmake")
+     include(PandocMan)
+     add_pandoc_man("${CMAKE_CURRENT_SOURCE_DIR}/man/ncpamixer.1.md")
+ endif()
--- a/pkgs/applications/editors/neovim/default.nix
+++ b/pkgs/applications/editors/neovim/default.nix
@ -69,13 +69,13 @@ let
 in
  stdenv.mkDerivation rec {
    pname = "neovim-unwrapped";
-    version = "0.9.4";
+    version = "0.9.5";

    src = fetchFromGitHub {
      owner = "neovim";
      repo = "neovim";
      rev = "v${version}";
-      hash = "sha256-Lyo98cAs7Zhx23N4s4f3zpWFKYJMmXleWpt3wiVDQZo=";
+      hash = "sha256-CcaBqA0yFCffNPmXOJTo8c9v1jrEBiqAl8CG5Dj5YxE=";
    };

    patches = [
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -16335,5 +16335,29 @@ final: prev:
    meta.homepage = "https://github.com/jhradilek/vim-snippets/";
  };

+  palette-nvim = buildVimPlugin {
+    pname = "palette-nvim";
+    version = "2023-10-02";
+    src = fetchFromGitHub {
+      owner = "roobert";
+      repo = "palette.nvim";
+      rev = "a808c190a4f74f73782302152ebf323660d8db5f";
+      sha256 = "sha256-gCyDl+2fDa5CPpibxQnp+pJSkyRl0r03Sh3+IXIoQIQ=";
+    };
+    meta.homepage = "https://github.com/roobert/palette.nvim/";
+  };
+
+  obsidian-nvim = buildVimPlugin {
+    pname = "obsidian-nvim";
+    version = "2023-12-30";
+    src = fetchFromGitHub {
+      owner = "epwalsh";
+      repo = "obsidian.nvim";
+      rev = "88bf9150d9639a2cae3319e76abd7ab6b30d27f0";
+      sha256 = "sha256-irPk9iprbI4ijNUjMxXjw+DljudZ8aB3f/FJxXhFSoA=";
+    };
+    meta.homepage = "https://github.com/epwalsh/obsidian.nvim/";
+  };
+

 }
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -929,6 +929,10 @@
    dependencies = with self; [ promise-async ];
  };

+  obsidian-nvim = super.obsidian-nvim.overrideAttrs {
+    dependencies = with self; [ plenary-nvim ];
+  };
+
  octo-nvim = super.octo-nvim.overrideAttrs {
    dependencies = with self; [ telescope-nvim plenary-nvim ];
  };
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -661,6 +661,7 @@ https://github.com/roxma/nvim-yarp/,,
 https://github.com/haringsrob/nvim_context_vt/,,
 https://github.com/neovim/nvimdev.nvim/,,
 https://github.com/nvchad/nvterm/,HEAD,
+https://github.com/epwalsh/obsidian.nvim/,HEAD,
 https://github.com/glepnir/oceanic-material/,,
 https://github.com/mhartington/oceanic-next/,,
 https://github.com/pwntester/octo.nvim/,,
@ -685,6 +686,7 @@ https://github.com/nyoom-engineering/oxocarbon.nvim/,HEAD,
 https://github.com/vuki656/package-info.nvim/,,
 https://github.com/wbthomason/packer.nvim/,,
 https://github.com/drewtempelmeyer/palenight.vim/,,
+https://github.com/roobert/palette.nvim/,HEAD,
 https://github.com/NLKNguyen/papercolor-theme/,,
 https://github.com/tmsvg/pear-tree/,,
 https://github.com/steelsojka/pears.nvim/,,
--- a/pkgs/applications/emulators/cemu/default.nix
+++ b/pkgs/applications/emulators/cemu/default.nix
@ -33,13 +33,13 @@

 stdenv.mkDerivation rec {
  pname = "cemu";
-  version = "2.0-59";
+  version = "2.0-61";

  src = fetchFromGitHub {
    owner = "cemu-project";
    repo = "Cemu";
    rev = "v${version}";
-    hash = "sha256-dw77UkhyJ+XJLYWT6adUuTd+spqNr3/ZOMLaAVWgzmc=";
+    hash = "sha256-oKVVBie3Q3VtsHbh0wJfdlx1YnF424hib8mFRYnbgXY=";
  };

  patches = [
--- a/pkgs/applications/emulators/hercules/default.nix
+++ b/pkgs/applications/emulators/hercules/default.nix
@ -1,27 +0,0 @@
-{ lib
-, stdenv
-, fetchurl
-}:
-
-stdenv.mkDerivation rec {
-  pname = "hercules";
-  version = "3.13";
-
-  src = fetchurl {
-    url = "http://downloads.hercules-390.eu/${pname}-${version}.tar.gz";
-    sha256 = "0zg6rwz8ib4alibf8lygi8qn69xx8n92kbi8b3jhi1ymb32mf349";
-  };
-
-  meta = with lib; {
-    homepage = "http://www.hercules-390.eu";
-    description = "IBM mainframe emulator";
-    longDescription = ''
-      Hercules is an open source software implementation of the mainframe
-      System/370 and ESA/390 architectures, in addition to the latest 64-bit
-      z/Architecture. Hercules runs under Linux, Windows, Solaris, FreeBSD, and
-      Mac OS X.
-    '';
-    license = licenses.qpl;
-    maintainers = [ maintainers.anna328p ];
-  };
-}
--- a/pkgs/applications/emulators/yuzu/compat-list.nix
+++ b/pkgs/applications/emulators/yuzu/compat-list.nix
@ -0,0 +1,18 @@
+{ stdenv, fetchFromGitHub, unstableGitUpdater }:
+stdenv.mkDerivation {
+  pname = "yuzu-compatibility-list";
+  version = "unstable-2023-12-28";
+
+  src = fetchFromGitHub {
+    owner = "flathub";
+    repo = "org.yuzu_emu.yuzu";
+    rev = "0b9bf10851d6ad54441dc4f687d5755ed2c6f7a8";
+    hash = "sha256-oWEeAhyxFO1TFH3d+/ivRf1KnNUU8y5c/7NtOzlpKXg=";
+  };
+
+  buildCommand = ''
+    cp $src/compatibility_list.json $out
+  '';
+
+  passthru.updateScript = unstableGitUpdater {};
+}
--- a/pkgs/applications/emulators/yuzu/default.nix
+++ b/pkgs/applications/emulators/yuzu/default.nix
@ -1,68 +1,22 @@
-{ branch ? "mainline"
-, qt6Packages
-, fetchFromGitHub
-, fetchgit
-, fetchurl
-, fetchzip
-, runCommand
-, gnutar
-}:
+{ qt6Packages, makeScopeWithSplicing', generateSplicesForMkScope, vulkan-headers, fetchFromGitHub }:

-let
-  sources = import ./sources.nix;
+makeScopeWithSplicing' {
+  otherSplices = generateSplicesForMkScope "yuzuPackages";
+  f = self: qt6Packages // {
+    compat-list = self.callPackage ./compat-list.nix {};
+    nx_tzdb = self.callPackage ./nx_tzdb.nix {};

-  compat-list = fetchurl {
-    name = "yuzu-compat-list";
-    url = "https://raw.githubusercontent.com/flathub/org.yuzu_emu.yuzu/${sources.compatList.rev}/compatibility_list.json";
-    hash = sources.compatList.hash;
+    mainline = self.callPackage ./mainline.nix {};
+    early-access = self.callPackage ./early-access {};
+
+    vulkan-headers = vulkan-headers.overrideAttrs(old: rec {
+      version = "1.3.274";
+      src = fetchFromGitHub {
+        owner = "KhronosGroup";
+        repo = "Vulkan-Headers";
+        rev = "v${version}";
+        hash = "sha256-SsS5VlEnhjOSu8MlIVC0d2r2EAf8QsNJPEAXNtbDOJ4=";
+      };
+    });
  };
-
-  mainlineSrc = fetchFromGitHub {
-    owner = "yuzu-emu";
-    repo = "yuzu-mainline";
-    rev = "mainline-0-${sources.mainline.version}";
-    hash = sources.mainline.hash;
-    fetchSubmodules = true;
-  };
-
-  # The mirror repo for early access builds is missing submodule info,
-  # but the Windows distributions include a source tarball, which in turn
-  # includes the full git metadata. So, grab that and rehydrate it.
-  # This has the unfortunate side effect of requiring two FODs, one
-  # for the Windows download and one for the full repo with submodules.
-  eaZip = fetchzip {
-    name = "yuzu-ea-windows-dist";
-    url = "https://github.com/pineappleEA/pineapple-src/releases/download/EA-${sources.ea.version}/Windows-Yuzu-EA-${sources.ea.version}.zip";
-    hash = sources.ea.distHash;
-  };
-
-  eaGitSrc = runCommand "yuzu-ea-dist-unpacked" {
-    src = eaZip;
-    nativeBuildInputs = [ gnutar ];
-  }
-  ''
-    mkdir $out
-    tar xf $src/*.tar.xz --directory=$out --strip-components=1
-  '';
-
-  eaSrcRehydrated = fetchgit {
-    url = eaGitSrc;
-    fetchSubmodules = true;
-    hash = sources.ea.fullHash;
-  };
-
-in {
-  mainline = qt6Packages.callPackage ./generic.nix {
-    branch = "mainline";
-    version = sources.mainline.version;
-    src = mainlineSrc;
-    inherit compat-list;
-  };
-
-  early-access = qt6Packages.callPackage ./generic.nix {
-    branch = "early-access";
-    version = sources.ea.version;
-    src = eaSrcRehydrated;
-    inherit compat-list;
-  };
-}.${branch}
+}
--- a/pkgs/applications/emulators/yuzu/early-access/default.nix
+++ b/pkgs/applications/emulators/yuzu/early-access/default.nix
@ -0,0 +1,36 @@
+{ mainline, fetchzip, fetchgit, runCommand, gnutar }:
+# The mirror repo for early access builds is missing submodule info,
+# but the Windows distributions include a source tarball, which in turn
+# includes the full git metadata. So, grab that and rehydrate it.
+# This has the unfortunate side effect of requiring two FODs, one
+# for the Windows download and one for the full repo with submodules.
+let
+  sources = import ./sources.nix;
+
+  zip = fetchzip {
+    name = "yuzu-ea-windows-dist";
+    url = "https://github.com/pineappleEA/pineapple-src/releases/download/EA-${sources.version}/Windows-Yuzu-EA-${sources.version}.zip";
+    hash = sources.distHash;
+  };
+
+  gitSrc = runCommand "yuzu-ea-dist-unpacked" {
+    src = zip;
+    nativeBuildInputs = [ gnutar ];
+  }
+  ''
+    mkdir $out
+    tar xf $src/*.tar.xz --directory=$out --strip-components=1
+  '';
+
+  rehydratedSrc = fetchgit {
+    url = gitSrc;
+    fetchSubmodules = true;
+    hash = sources.fullHash;
+  };
+in mainline.overrideAttrs(old: {
+  pname = "yuzu-early-access";
+  version = sources.version;
+  src = rehydratedSrc;
+  passthru.updateScript = ./update.sh;
+  meta = old.meta // { description = old.meta.description + " - early access branch"; };
+})
--- a/pkgs/applications/emulators/yuzu/early-access/sources.nix
+++ b/pkgs/applications/emulators/yuzu/early-access/sources.nix
@ -0,0 +1,7 @@
+# Generated by ./update.sh - do not update manually!
+# Last updated: 2023-12-29
+{
+  version = "4037";
+  distHash = "sha256:0pw56hj13fm9j5nja1lhj839d88w00kcr30kygasr36w9c7yv2n7";
+  fullHash = "sha256:0f42fp8z333b3k4pn8j0cp3480llvlygl5p6qfgywhq3g5hcpzpb";
+}
--- a/pkgs/applications/emulators/yuzu/early-access/update.sh
+++ b/pkgs/applications/emulators/yuzu/early-access/update.sh
@ -0,0 +1,48 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i bash -p nix nix-prefetch-git gnutar curl jq unzip
+
+set -euo pipefail
+
+cd "$(dirname "$(readlink -f "$0")")"
+
+log() {
+    tput bold
+    echo "#" "$@"
+    tput sgr0
+}
+
+oldVersion="$(nix --experimental-features nix-command eval -f sources.nix --raw version)"
+newVersion="$(curl "https://api.github.com/repos/pineappleEA/pineapple-src/releases?per_page=1" | jq -r '.[0].tag_name' | cut -d"-" -f2)"
+
+if [ "$oldVersion" == "$newVersion" ]; then
+    log "Already up to date"
+    exit 0
+fi
+
+fetched="$(nix-prefetch-url --unpack --print-path "https://github.com/pineappleEA/pineapple-src/releases/download/EA-${newVersion}/Windows-Yuzu-EA-${newVersion}.zip")"
+
+eaDistHash="$(echo "${fetched}" | head -n1)"
+eaDist="$(echo "${fetched}" | tail -n1)"
+
+eaDistUnpacked="$(mktemp -d)"
+trap 'rm -rf "$eaDistUnpacked"' EXIT
+
+log "Unpacking dist..."
+tar xf "$eaDist"/*.tar.xz --directory="$eaDistUnpacked" --strip-components=1
+
+log "Rehydrating..."
+eaFullHash="$(nix-prefetch-git --fetch-submodules "$eaDistUnpacked" | jq -r '.sha256')"
+
+cat >sources.nix <<EOF
+# Generated by ./update.sh - do not update manually!
+# Last updated: $(date +%F)
+{
+  version = "$newVersion";
+  distHash = "sha256:$eaDistHash";
+  fullHash = "sha256:$eaFullHash";
+}
+EOF
+
+if [ "${COMMIT:-0}" == "1" ]; then
+    git commit -m "yuzu-ea: ${oldVersion} -> ${newVersion}" ./sources.nix
+fi
--- a/pkgs/applications/emulators/yuzu/mainline.nix
+++ b/pkgs/applications/emulators/yuzu/mainline.nix
@ -1,21 +1,18 @@
-{ version
-, src
-, branch
-, compat-list
-
-, lib
+{ lib
 , stdenv
+, fetchFromGitHub
+, nix-update-script
 , wrapQtAppsHook
 , alsa-lib
 , boost
 , catch2_3
 , cmake
+, compat-list
 , cpp-jwt
 , cubeb
 , discord-rpc
 , doxygen
 , enet
-, fetchurl
 , ffmpeg
 , fmt
 , glslang
@ -29,6 +26,7 @@
 , libzip
 , lz4
 , nlohmann_json
+, nx_tzdb
 , perl
 , pkg-config
 , python3
@ -47,17 +45,17 @@
 , zlib
 , zstd
 }:
+stdenv.mkDerivation(finalAttrs: {
+  pname = "yuzu";
+  version = "1665";

-let
-  tzinfoVersion = "221202";
-  tzinfo = fetchurl {
-    url = "https://github.com/lat9nq/tzdb_to_nx/releases/download/${tzinfoVersion}/${tzinfoVersion}.zip";
-    hash = "sha256-mRzW+iIwrU1zsxHmf+0RArU8BShAoEMvCz+McXFFK3c=";
+  src = fetchFromGitHub {
+    owner = "yuzu-emu";
+    repo = "yuzu-mainline";
+    rev = "mainline-0-${finalAttrs.version}";
+    hash = "sha256-xzSup1oz83GPpOGh9aJJ5YjoFX/cBI8RV6SvDYNH/zA=";
+    fetchSubmodules = true;
  };
-in stdenv.mkDerivation {
-  pname = "yuzu-${branch}";
-
-  inherit version src;

  nativeBuildInputs = [
    cmake
@ -69,6 +67,10 @@ in stdenv.mkDerivation {
  ];

  buildInputs = [
+    # vulkan-headers must come first, so the older propagated versions
+    # don't get picked up by accident
+    vulkan-headers
+
    alsa-lib
    boost
    catch2_3
@ -101,7 +103,6 @@ in stdenv.mkDerivation {
    sndio
    speexdsp
    udev
-    vulkan-headers
    # intentionally omitted: xbyak - prefer vendored version for compatibility
    zlib
    zstd
@ -120,6 +121,8 @@ in stdenv.mkDerivation {
    "-DENABLE_QT_TRANSLATION=ON"

    # use system libraries
+    # NB: "external" here means "from the externals/ directory in the source",
+    # so "off" means "use system"
    "-DYUZU_USE_EXTERNAL_SDL2=OFF"
    "-DYUZU_USE_EXTERNAL_VULKAN_HEADERS=OFF"

@ -145,13 +148,13 @@ in stdenv.mkDerivation {
  preConfigure = ''
    # see https://github.com/NixOS/nixpkgs/issues/114044, setting this through cmakeFlags does not work.
    cmakeFlagsArray+=(
-      "-DTITLE_BAR_FORMAT_IDLE=yuzu | ${branch} ${version} (nixpkgs) {}"
-      "-DTITLE_BAR_FORMAT_RUNNING=yuzu | ${branch} ${version} (nixpkgs) | {}"
+      "-DTITLE_BAR_FORMAT_IDLE=${finalAttrs.pname} | ${finalAttrs.version} (nixpkgs) {}"
+      "-DTITLE_BAR_FORMAT_RUNNING=${finalAttrs.pname} | ${finalAttrs.version} (nixpkgs) | {}"
    )

    # provide pre-downloaded tz data
    mkdir -p build/externals/nx_tzdb
-    ln -sf ${tzinfo} build/externals/nx_tzdb/${tzinfoVersion}.zip
+    ln -sf ${nx_tzdb} build/externals/nx_tzdb/${nx_tzdb.version}.zip
  '';

  # This must be done after cmake finishes as it overwrites the file
@ -159,12 +162,14 @@ in stdenv.mkDerivation {
    ln -sf ${compat-list} ./dist/compatibility_list/compatibility_list.json
  '';

-  passthru.updateScript = ./update.sh;
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version-regex" "mainline-0-(.*)" ];
+  };

  meta = with lib; {
    homepage = "https://yuzu-emu.org";
    changelog = "https://yuzu-emu.org/entry";
-    description = "The ${branch} branch of an experimental Nintendo Switch emulator written in C++";
+    description = "An experimental Nintendo Switch emulator written in C++";
    longDescription = ''
      An experimental Nintendo Switch emulator written in C++.
      Using the mainline branch is recommended for general usage.
@ -185,4 +190,4 @@ in stdenv.mkDerivation {
      k900
    ];
  };
-}
+})
--- a/pkgs/applications/emulators/yuzu/nx_tzdb.nix
+++ b/pkgs/applications/emulators/yuzu/nx_tzdb.nix
@ -0,0 +1,20 @@
+{ stdenv, fetchurl, gitUpdater }:
+stdenv.mkDerivation rec {
+  pname = "nx_tzdb";
+  version = "221202";
+
+  src = fetchurl {
+    url = "https://github.com/lat9nq/tzdb_to_nx/releases/download/${version}/${version}.zip";
+    hash = "sha256-mRzW+iIwrU1zsxHmf+0RArU8BShAoEMvCz+McXFFK3c=";
+  };
+
+  dontUnpack = true;
+
+  buildCommand = ''
+    cp $src $out
+  '';
+
+  passthru.updateScript = gitUpdater {
+    url = "https://github.com/lat9nq/tzdb_to_nx.git";
+  };
+}
--- a/pkgs/applications/emulators/yuzu/sources.nix
+++ b/pkgs/applications/emulators/yuzu/sources.nix
@ -1,19 +0,0 @@
-# Generated by ./update.sh - do not update manually!
-# Last updated: 2023-12-14
-{
-  compatList = {
-    rev = "fc974b6e78105774dae5f68e712a6beb51b9db1e";
-    hash = "sha256:1hdsza3wf9a0yvj6h55gsl7xqvhafvbz1i8paz9kg7l49b0gnlh1";
-  };
-
-  mainline = {
-    version = "1651";
-    hash = "sha256:00cxyh3d18k17g982yqcbaq4b6bgs4kji0yz6i15h066aj15dimy";
-  };
-
-  ea = {
-    version = "4019";
-    distHash = "sha256:1qd953bl216yxmaa6y0iil6pn2pn53k87qwagbmcd4l5h4aaqi7h";
-    fullHash = "sha256:0na96hqfdd40q6drrlgak4qdsxs3wfizxhb8kf8qrbai3qfpx00v";
-  };
-}
--- a/pkgs/applications/emulators/yuzu/update.sh
+++ b/pkgs/applications/emulators/yuzu/update.sh
@ -1,66 +0,0 @@
-#! /usr/bin/env nix-shell
-#! nix-shell -i bash -p nix nix-prefetch-git gnutar curl jq unzip
-
-set -euo pipefail
-
-cd "$(dirname "$(readlink -f "$0")")"
-
-log() {
-    tput bold
-    echo "#" "$@"
-    tput sgr0
-}
-
-alias curl='curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"}'
-
-log "Updating compatibility list..."
-compatListRev="$(curl "https://api.github.com/repos/flathub/org.yuzu_emu.yuzu/commits/master" | jq -r '.sha')"
-
-log "Downloading rev: ${compatListRev}"
-compatListHash="$(nix-prefetch-url "https://raw.githubusercontent.com/flathub/org.yuzu_emu.yuzu/${compatListRev}/compatibility_list.json")"
-
-log "Updating mainline..."
-mainlineVersion="$(curl "https://api.github.com/repos/yuzu-emu/yuzu-mainline/releases?per_page=1" | jq -r '.[0].name' | cut -d" " -f2)"
-
-log "Downloading version: ${mainlineVersion}"
-mainlineHash="$(nix-prefetch-git --fetch-submodules --rev "mainline-0-${mainlineVersion}" "https://github.com/yuzu-emu/yuzu-mainline" | jq -r '.sha256')"
-
-log "Updating early access..."
-eaVersion="$(curl "https://api.github.com/repos/pineappleEA/pineapple-src/releases?per_page=1" | jq -r '.[0].tag_name' | cut -d"-" -f2)"
-
-log "Downloading dist version: ${eaVersion}"
-fetched="$(nix-prefetch-url --unpack --print-path "https://github.com/pineappleEA/pineapple-src/releases/download/EA-${eaVersion}/Windows-Yuzu-EA-${eaVersion}.zip")"
-
-eaDistHash="$(echo "${fetched}" | head -n1)"
-eaDist="$(echo "${fetched}" | tail -n1)"
-
-eaDistUnpacked="$(mktemp -d)"
-trap 'rm -rf "$eaDistUnpacked"' EXIT
-
-log "Unpacking dist..."
-tar xf "$eaDist"/*.tar.xz --directory="$eaDistUnpacked" --strip-components=1
-
-log "Rehydrating..."
-eaFullHash="$(nix-prefetch-git --fetch-submodules "$eaDistUnpacked" | jq -r '.sha256')"
-
-cat >sources.nix <<EOF
-# Generated by ./update.sh - do not update manually!
-# Last updated: $(date +%F)
-{
-  compatList = {
-    rev = "$compatListRev";
-    hash = "sha256:$compatListHash";
-  };
-
-  mainline = {
-    version = "$mainlineVersion";
-    hash = "sha256:$mainlineHash";
-  };
-
-  ea = {
-    version = "$eaVersion";
-    distHash = "sha256:$eaDistHash";
-    fullHash = "sha256:$eaFullHash";
-  };
-}
-EOF
--- a/pkgs/applications/graphics/inkscape/extensions.nix
+++ b/pkgs/applications/graphics/inkscape/extensions.nix
@ -44,6 +44,7 @@
    mkdir -p $out/share/inkscape/extensions
    cp ${inkcut}/share/inkscape/extensions/* $out/share/inkscape/extensions
  '');
+  silhouette = callPackage ./extensions/silhouette { };
  textext = callPackage ./extensions/textext {
    pdflatex = texlive.combined.scheme-basic;
    lualatex = texlive.combined.scheme-basic;
--- a/pkgs/applications/graphics/inkscape/extensions/silhouette/default.nix
+++ b/pkgs/applications/graphics/inkscape/extensions/silhouette/default.nix
@ -0,0 +1,91 @@
+{ fetchFromGitHub
+, lib
+, gettext
+, pkgs
+, python3
+, umockdev
+, writeScript
+}:
+
+let
+  # We need these simple wrapper shell scripts because Inkscape extensions with
+  # interpreter="shell" always get invoked with the `sh` command [0], regardless of
+  # the shebang at the top of the script.
+  # [0]: https://gitlab.com/inkscape/inkscape/-/blob/d61d917afb94721c92a650b2c4b116b0a4826f41/src/extension/implementation/script.cpp#L93
+  launch-sendto_silhouette = writeScript "sendto_silhouette.sh" ''
+    cd $(dirname $0)
+    ./sendto_silhouette.py "$@"
+  '';
+  launch-silhouette_multi = writeScript "silhouette_multi.sh" ''
+    cd $(dirname $0)
+    ./silhouette_multi.py "$@"
+  '';
+in
+python3.pkgs.buildPythonApplication rec {
+  pname = "inkscape-silhouette";
+  version = "1.28";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "fablabnbg";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-uNVhdkZFadL7QNlCsXq51TbhzRKH9KYDPDNCFhw3cQs=";
+  };
+
+  patches = [
+    ./interpreter.patch
+    ./use-prefix-for-udev.patch
+  ];
+
+  propagatedBuildInputs = [
+    python3.pkgs.pyusb
+    python3.pkgs.lxml
+    python3.pkgs.inkex
+    python3.pkgs.matplotlib
+    python3.pkgs.wxPython_4_2
+    python3.pkgs.xmltodict
+  ];
+
+  nativeBuildInputs = [
+    gettext # msgfmt
+  ];
+
+  nativeCheckInputs = [
+    python3.pkgs.pytestCheckHook
+    umockdev
+  ];
+
+  pytestFlagsArray = [
+    "test"
+  ];
+
+  doCheck = true;
+
+  installPhase = ''
+    runHook preInstall
+    make install PREFIX=$out
+    runHook postInstall
+  '';
+
+  postInstall = ''
+    # Unmark read_dump.py as executable so wrapPythonProgramsIn won't turn it
+    # into a shell script (thereby making it impossible to import as a Python
+    # module).
+    chmod -x $out/share/inkscape/extensions/silhouette/read_dump.py
+    cp ${launch-sendto_silhouette} $out/share/inkscape/extensions/sendto_silhouette.sh
+    cp ${launch-silhouette_multi} $out/share/inkscape/extensions/silhouette_multi.sh
+  '';
+
+  postFixup = ''
+    wrapPythonProgramsIn "$out/share/inkscape/extensions/" "$out $pythonPath"
+  '';
+
+  meta = with lib; {
+    description = "An extension to drive Silhouette vinyl cutters (e.g. Cameo, Portrait, Curio series) from within Inkscape.";
+    homepage = "https://github.com/fablabnbg/inkscape-silhouette";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ jfly ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/applications/graphics/inkscape/extensions/silhouette/interpreter.patch
+++ b/pkgs/applications/graphics/inkscape/extensions/silhouette/interpreter.patch
@ -0,0 +1,24 @@
+diff --git a/sendto_silhouette.inx b/sendto_silhouette.inx
+index 55a3278..d780730 100644
+--- a/sendto_silhouette.inx
+++ b/sendto_silhouette.inx
+@@ -188,6 +188,6 @@ Always use the least amount of blade possible.
+   </effect>
+ 
+   <script>
+-      <command location="inx" interpreter="python">sendto_silhouette.py</command>
+      <command location="inx" interpreter="shell">sendto_silhouette.sh</command>
+   </script>
+ </inkscape-extension>
+diff --git a/silhouette_multi.inx b/silhouette_multi.inx
+index f6fd2ed..2d9dba6 100644
+--- a/silhouette_multi.inx
+++ b/silhouette_multi.inx
+@@ -31,6 +31,6 @@
+   </effect>
+   
+   <script>
+-      <command location="inx" interpreter="python">silhouette_multi.py</command>
+      <command location="inx" interpreter="shell">silhouette_multi.sh</command>
+   </script>
+ </inkscape-extension>
--- a/pkgs/applications/graphics/inkscape/extensions/silhouette/use-prefix-for-udev.patch
+++ b/pkgs/applications/graphics/inkscape/extensions/silhouette/use-prefix-for-udev.patch
@ -0,0 +1,13 @@
+diff --git a/Makefile b/Makefile
+index 5aff25d..43c3fb0 100644
+--- a/Makefile
+++ b/Makefile
+@@ -22,7 +22,7 @@ VERS=$$(python3 ./sendto_silhouette.py --version)
+ 
+ DEST=$(DESTDIR)$(PREFIX)/share/inkscape/extensions
+ LOCALE=$(DESTDIR)$(PREFIX)/share/locale
+-UDEV=$(DESTDIR)/lib/udev
+UDEV=$(DESTDIR)$(PREFIX)/lib/udev
+ INKSCAPE_TEMPLATES=$(DESTDIR)$(PREFIX)/share/inkscape/templates
+ 
+ # User-specifc inkscape extensions folder for local install
--- a/pkgs/applications/graphics/inkscape/extensions/textext/default.nix
+++ b/pkgs/applications/graphics/inkscape/extensions/textext/default.nix
@ -20,13 +20,13 @@ let
 in
 python3.pkgs.buildPythonApplication rec {
  pname = "textext";
-  version = "1.8.1";
+  version = "1.10.1";

  src = fetchFromGitHub {
    owner = "textext";
    repo = "textext";
    rev = version;
-    sha256 = "sha256-Qzd39X0X3DdwZ3pIIGvEbNjl6dxjDf3idzjwCkp3WRg=";
+    sha256 = "sha256-FbUfZfVOYEyQVL1YMyNwb/sIUxJ+VhevatjuJI/ocIw=";
  };

  patches = [
--- a/pkgs/applications/misc/clipcat/default.nix
+++ b/pkgs/applications/misc/clipcat/default.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "clipcat";
-  version = "0.15.0";
+  version = "0.16.0";

  src = fetchFromGitHub {
    owner = "xrelkd";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-NuljH6cqgdtTJDkNv4w44s1UM4/R1gmpVyWpCzCJ3DU=";
+    hash = "sha256-9BilasXc/3FFPcKAgPvc0hIHP7NbOqRD8ZwIMRc/Y3M=";
  };

-  cargoHash = "sha256-5+qa9/QGZyZBaO2kbvpP7Ybs1EXIO1MlPFm0PDTNqCQ=";
+  cargoHash = "sha256-zkeKhi0DiYqA5+KiU77ZJXRyhLUKVDmHvF7TG1URzo4=";

  nativeBuildInputs = [
    protobuf
--- a/pkgs/applications/misc/clipqr/default.nix
+++ b/pkgs/applications/misc/clipqr/default.nix
@ -17,13 +17,13 @@

 buildGoModule rec {
  pname = "clipqr";
-  version = "1.1.0";
+  version = "1.2.0";

  src = fetchFromGitLab {
    owner = "imatt-foss";
    repo = "clipqr";
    rev = "v${version}";
-    hash = "sha256-OQ45GV+bViIejGC03lAuvw/y8v1itA+6pFC4H/qL744=";
+    hash = "sha256-gfKCuTZY9VsiXMlw6XX6YylMO4xGoLQU/5QvnDV7GbE=";
  };

  vendorHash = null;
--- a/pkgs/applications/misc/elf-dissector/default.nix
+++ b/pkgs/applications/misc/elf-dissector/default.nix
@ -1,24 +1,26 @@
 { lib
 , stdenv
-, fetchgit
+, fetchFromGitLab
 , cmake
+, elfutils
 , extra-cmake-modules
-, wrapQtAppsHook
 , kitemmodels
 , libiberty
-, libelf
 , libdwarf
 , libopcodes
+, wrapQtAppsHook
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
  pname = "elf-dissector";
-  version = "unstable-2023-06-06";
+  version = "unstable-2023-12-24";

-  src = fetchgit {
-    url = "https://invent.kde.org/sdk/elf-dissector.git";
-    rev = "de2e80438176b4b513150805238f3333f660718c";
-    hash = "sha256-2yHPVPu6cncXhFCJvrSodcRFVAxj4vn+e99WhtiZniM=";
+  src = fetchFromGitLab {
+    domain = "invent.kde.org";
+    owner = "sdk";
+    repo = "elf-dissector";
+    rev = "613538bd1d87ce72d5115646551a49cf7ff2ee34";
+    hash = "sha256-fQFGFw8nZHMs8J1W2CcHAJCdcvaY2l2/CySyBSsKpyE=";
  };

  patches = [
@ -27,12 +29,12 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ cmake extra-cmake-modules wrapQtAppsHook ];

-  buildInputs = [ kitemmodels libiberty libelf libdwarf libopcodes ];
+  buildInputs = [ kitemmodels libiberty elfutils libopcodes libdwarf ];

  meta = with lib; {
    homepage = "https://invent.kde.org/sdk/elf-dissector";
    description = "Tools for inspecting, analyzing and optimizing ELF files";
    license = licenses.gpl2;
-    maintainers = with maintainers; [ ehmry ];
+    maintainers = with maintainers; [ ehmry philiptaron ];
  };
 }
--- a/pkgs/applications/misc/elf-dissector/fix_build_for_src_lib_disassembler_disassembler.diff
+++ b/pkgs/applications/misc/elf-dissector/fix_build_for_src_lib_disassembler_disassembler.diff
@ -1,12 +1,16 @@
 diff --git a/src/lib/disassmbler/disassembler.cpp b/src/lib/disassmbler/disassembler.cpp
-index 3277544..e77ffc4 100644
+index 8ff058e..dbd4bbe 100644
 --- a/src/lib/disassmbler/disassembler.cpp
 +++ b/src/lib/disassmbler/disassembler.cpp
-@@ -127,7 +127,7 @@ QString Disassembler::disassembleBinutils(const unsigned char* data, uint64_t si
+@@ -144,11 +144,7 @@ QString Disassembler::disassembleBinutils(const unsigned char* data, uint64_t si
     QString result;
     disassembler_ftype disassemble_fn;
     disassemble_info info;
+-#if BINUTILS_VERSION >= BINUTILS_VERSION_CHECK(2, 39)
+-    INIT_DISASSEMBLE_INFO(info, &result, qstring_printf, fprintf_styled);
+-#else
 -    INIT_DISASSEMBLE_INFO(info, &result, qstring_printf);
+-#endif
 +    INIT_DISASSEMBLE_INFO(info, &result, qstring_printf, qstring_printf);
 
     info.application_data = this;
--- a/pkgs/applications/misc/jiten/cookie-fix.patch
+++ b/pkgs/applications/misc/jiten/cookie-fix.patch
@ -0,0 +1,39 @@
+diff --git a/jiten/app.py b/jiten/app.py
+index 6d54020..f30a1d8 100644
+--- a/jiten/app.py
+++ b/jiten/app.py
+@@ -149,13 +149,22 @@ True
+ >>> d.index("JLPT N3") < d.index("歯", d.index("JLPT N5")) < d.index("JLPT N2")
+ True
+ 
+->>> sorted( (c.name, c.value) for c in client.cookie_jar )
+>>> def cookies():
+...   import importlib.metadata
+...   v = tuple(map(int, importlib.metadata.version("werkzeug").split(".")))
+...   if v < (2, 3):
+...     return sorted( (c.name, c.value) for c in client.cookie_jar )
+...   else:
+...     cookies = [ client.get_cookie(k) for k in PREFS ]
+...     return sorted( (c.key, c.value) for c in cookies if c is not None )
+
+>>> cookies()
+ []
+ >>> p = dict(dark = "yes", lang = "eng ger oops".split())
+ >>> r = client.post("/_save_prefs", data = p, follow_redirects = True)
+ >>> r.status
+ '200 OK'
+->>> sorted( (c.name, c.value) for c in client.cookie_jar )
+>>> cookies()
+ [('dark', 'yes'), ('lang', '"eng ger"'), ('large', 'no'), ('max', '50'), ('nogrid', 'no'), ('nor2h', 'no'), ('roma', 'no')]
+ 
+ """                                                             # }}}1
+@@ -168,8 +177,7 @@ import kanjidraw
+ import click, flask, jinja2, werkzeug
+ 
+ os.environ["FLASK_SKIP_DOTENV"] = "yes"                       #  FIXME
+-from flask import Flask, abort, escape, make_response, redirect, \
+-                  request, render_template, url_for
+from flask import Flask, abort, make_response, redirect, request, render_template, url_for
+ 
+ from .version import __version__, py_version
+ from .kana import kana2romaji
--- a/pkgs/applications/misc/jiten/default.nix
+++ b/pkgs/applications/misc/jiten/default.nix
@ -27,6 +27,12 @@ python3.pkgs.buildPythonApplication rec {
    sha256 = "16sz8i0sw7ggy6kijcx4qyl2zr6xj789x4iav0yyllx12dfgp5b1";
  };

+  patches = [
+    # Potentially can be dropped after the next release
+    # https://github.com/NixOS/nixpkgs/issues/271600
+    ./cookie-fix.patch
+  ];
+
  nativeBuildInputs = [ makeWrapper ];
  buildInputs = [ pcre sqlite ];
  propagatedBuildInputs = with python3.pkgs; [ click flask kanjidraw ];
--- a/pkgs/applications/misc/keymapp/default.nix
+++ b/pkgs/applications/misc/keymapp/default.nix
@ -0,0 +1,68 @@
+{ stdenv
+, lib
+, fetchurl
+, autoPatchelfHook
+, wrapGAppsHook
+, libusb1
+, webkitgtk
+, gtk3
+, writeShellScript
+, makeDesktopItem
+, copyDesktopItems
+}:
+let
+  desktopItem = makeDesktopItem {
+    name = "keymapp";
+    icon = "keymapp";
+    desktopName = "Keymapp";
+    categories = [ "Settings" "HardwareSettings" ];
+    type = "Application";
+    exec = "keymapp";
+  };
+in
+stdenv.mkDerivation rec {
+  pname = "keymapp";
+  version = "1.0.7";
+
+  src = fetchurl {
+    url = "https://oryx.nyc3.cdn.digitaloceanspaces.com/keymapp/keymapp-${version}.tar.gz";
+    hash = "sha256-BmCLF/4wjBDxToMW0OYqI6PZwqmctgBs7nBygmJ+YOU=";
+  };
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    autoPatchelfHook
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    libusb1
+    webkitgtk
+    gtk3
+  ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    runHook preInstall
+
+    install -m755 -D keymapp "$out/bin/${pname}"
+    install -Dm644 icon.png "$out/share/pixmaps/${pname}.png"
+
+    runHook postInstall
+  '';
+
+  preFixup = ''
+    gappsWrapperArgs+=(--set-default '__NV_PRIME_RENDER_OFFLOAD' 1)
+  '';
+
+  desktopItems = [ desktopItem ];
+
+  meta = with lib; {
+    homepage = "https://www.zsa.io/flash/";
+    description = "Application for ZSA keyboards";
+    maintainers = with lib.maintainers; [ jankaifer shawn8901 ];
+    platforms = platforms.linux;
+    license = lib.licenses.unfree;
+  };
+}
--- a/pkgs/applications/misc/writefreely/default.nix
+++ b/pkgs/applications/misc/writefreely/default.nix
@ -1,25 +1,19 @@
-{ lib, buildGoModule, fetchFromGitHub, go-bindata }:
+{ lib, buildGoModule, fetchFromGitHub }:

 buildGoModule rec {
  pname = "writefreely";
-  version = "0.13.2";
+  version = "0.14.0";

  src = fetchFromGitHub {
-    owner = "writeas";
+    owner = "writefreely";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-GnuqYgiwXdKM+os5RzuUYe9ADOhZaxou5dD7GCEE1Ns=";
+    sha256 = "sha256-vOoTAr33FMQaHIwpwIX0g/KJWQvDn3oVJg14kEY6FIQ=";
  };

-  vendorHash = "sha256-IBer+8FP+IWWJPnaugr8zzQA9mSVFzP0Nofgl/PhtzQ=";
+  vendorHash = "sha256-xTo/zbz9pSjvNntr5dnytiJ7oRAdtEuyiu4mJZgwHTc=";

-  nativeBuildInputs = [ go-bindata ];
-
-  preBuild = ''
-    make assets
-  '';
-
-  ldflags = [ "-s" "-w" "-X github.com/writeas/writefreely.softwareVer=${version}" ];
+  ldflags = [ "-s" "-w" "-X github.com/writefreely/writefreely.softwareVer=${version}" ];

  tags = [ "sqlite" ];

@ -27,8 +21,8 @@ buildGoModule rec {

  meta = with lib; {
    description = "Build a digital writing community";
-    homepage = "https://github.com/writeas/writefreely";
+    homepage = "https://github.com/writefreely/writefreely";
    license = licenses.agpl3Only;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ soopyc ];
  };
 }
--- a/pkgs/applications/networking/browsers/misc/widevine-cdm.nix
+++ b/pkgs/applications/networking/browsers/misc/widevine-cdm.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "widevine-cdm";
-  version = "4.10.2557.0";
+  version = "4.10.2710.0";

  src = fetchzip {
    url = "https://dl.google.com/widevine-cdm/${version}-linux-x64.zip";
-    hash = "sha256-XxTjuPjWy06SmHC6GaIVIp3zD76isCVATWwwdZljntE=";
+    hash = "sha256-lGTrSzUk5FluH1o4E/9atLIabEpco3C3gZw+y6H6LJo=";
    stripRoot = false;
  };

--- a/pkgs/applications/networking/cluster/k9s/default.nix
+++ b/pkgs/applications/networking/cluster/k9s/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "k9s";
-  version = "0.30.4";
+  version = "0.30.6";

  src = fetchFromGitHub {
    owner = "derailed";
    repo = "k9s";
    rev = "v${version}";
-    hash = "sha256-P06hKqVu/aUttjwdFVCvzC80WWbQn94bXk3LVl/97yw=";
+    hash = "sha256-ro2gm3EYput9l0CCfSPeRB/mTtEXlGIcZ00H0pCtQi8=";
  };

  ldflags = [
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "terragrunt";
-  version = "0.54.10";
+  version = "0.54.12";

  src = fetchFromGitHub {
    owner = "gruntwork-io";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-0cciBPMK2ceRSyV0zt5o/SgHDUzbtMj/BmLzqsMf/7g=";
+    hash = "sha256-fKZd4WlU011LCrh6jLyEecm5jEbX/CF5Vk0PMQbznx0=";
  };

-  vendorHash = "sha256-nz/mIMLgYF2HjN0jalCqUni143VKjFUMBc/0GaEG20U=";
+  vendorHash = "sha256-ey2PHpNK4GBE6FlXTYlbYhtG1re3OflbYnQmti9fS9k=";

  doCheck = false;

--- a/pkgs/applications/networking/instant-messengers/beeper/default.nix
+++ b/pkgs/applications/networking/instant-messengers/beeper/default.nix
@ -11,11 +11,11 @@
 }:
 let
  pname = "beeper";
-  version = "3.90.11";
+  version = "3.90.22";
  name = "${pname}-${version}";
  src = fetchurl {
-    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.90.11-build-2312112f0wxx20y.AppImage";
-    hash = "sha256-ZYv0PUvZiw8pcszCVCd7mHE/+VHb+I25OPu5R7vI1j4=";
+    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.90.22-build-2312219r0azbdcp.AppImage";
+    hash = "sha256-gLceLWdY/0yAveV3IdoLbqForFKqyU3a9QQOVEJ9TIg=";
  };
  appimage = appimageTools.wrapType2 {
    inherit version pname src;
--- a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
@ -120,7 +120,7 @@ stdenv.mkDerivation (finalAttrs: builtins.removeAttrs pinData [ "hashes" ] // {
    genericName = "Matrix Client";
    comment = finalAttrs.meta.description;
    categories = [ "Network" "InstantMessaging" "Chat" ];
-    startupWMClass = "element";
+    startupWMClass = "Element";
    mimeTypes = [ "x-scheme-handler/element" ];
  };

--- a/pkgs/applications/networking/instant-messengers/teams/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams/default.nix
@ -26,37 +26,33 @@ let
  };

  appName = "Teams.app";
-
-  darwin = stdenv.mkDerivation {
-    inherit pname meta;
-    version = versions.darwin;
-
-    src = fetchurl {
-      url = "https://statics.teams.cdn.office.net/production-osx/${versions.darwin}/Teams_osx.pkg";
-      hash = hashes.darwin;
-    };
-
-    nativeBuildInputs = [ xar cpio makeWrapper ];
-
-    unpackPhase = ''
-      xar -xf $src
-      zcat < Teams_osx_app.pkg/Payload | cpio -i
-    '';
-
-    sourceRoot = "Microsoft\ Teams.app";
-    dontPatch = true;
-    dontConfigure = true;
-    dontBuild = true;
-
-    installPhase = ''
-      runHook preInstall
-      mkdir -p $out/{Applications/${appName},bin}
-      cp -R . $out/Applications/${appName}
-      makeWrapper $out/Applications/${appName}/Contents/MacOS/Teams $out/bin/teams
-      runHook postInstall
-    '';
-  };
 in
-if stdenv.isDarwin
-then darwin
-else throw "Teams app for Linux has been removed as it is unmaintained by upstream. (2023-09-29)"
+stdenv.mkDerivation {
+  inherit pname meta;
+  version = versions.darwin;
+
+  src = fetchurl {
+    url = "https://statics.teams.cdn.office.net/production-osx/${versions.darwin}/Teams_osx.pkg";
+    hash = hashes.darwin;
+  };
+
+  nativeBuildInputs = [ xar cpio makeWrapper ];
+
+  unpackPhase = ''
+    xar -xf $src
+    zcat < Teams_osx_app.pkg/Payload | cpio -i
+  '';
+
+  sourceRoot = "Microsoft\ Teams.app";
+  dontPatch = true;
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/{Applications/${appName},bin}
+    cp -R . $out/Applications/${appName}
+    makeWrapper $out/Applications/${appName}/Contents/MacOS/Teams $out/bin/teams
+    runHook postInstall
+  '';
+}
--- a/pkgs/applications/networking/mailreaders/imapfilter.nix
+++ b/pkgs/applications/networking/mailreaders/imapfilter.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "imapfilter";
-  version = "2.8.1";
+  version = "2.8.2";

  src = fetchFromGitHub {
    owner = "lefcha";
    repo = "imapfilter";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-nHKZ3skRbDhKWocaw5mbaRnZC37FxFIVd08iFgrEA0s=";
+    sha256 = "sha256-pYnv9slw4bRPfCnhd/tlJC9JEx+3h40nyZ3qUll7p6c=";
  };
  makeFlags = [
    "SSLCAFILE=/etc/ssl/certs/ca-bundle.crt"
--- a/pkgs/applications/networking/mailreaders/meli/default.nix
+++ b/pkgs/applications/networking/mailreaders/meli/default.nix
@ -22,15 +22,18 @@

 rustPlatform.buildRustPackage rec {
  pname = "meli";
-  version = "0.8.2";
+  version = "0.8.4";

  src = fetchgit {
-    url = "https://git.meli.delivery/meli/meli.git";
+    url = "https://git.meli-email.org/meli/meli.git";
    rev = "v${version}";
-    hash = "sha256-iEHTFofga/HV/1jSAqTsqV55zC22tqI7UW7m4PZgz0M=";
+    hash = "sha256-wmIlYgXB17/i9Q+6C7pbcEjVlEuvhmqrSH+cDmaBKLs=";
  };

-  cargoHash = "sha256-ijlivyBezLECBSaWBYVy9tVcSO8U+yGDQyU4dIATR6k=";
+  cargoHash = "sha256-gYS/dxNMz/HkCmRXH5AdHPXJ2giqpAHc4eVXJGOpMDM=";
+
+  # Needed to get openssl-sys to use pkg-config
+  OPENSSL_NO_VENDOR=1;

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/applications/office/fava/default.nix
+++ b/pkgs/applications/office/fava/default.nix
@ -2,12 +2,12 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "fava";
-  version = "1.26.3";
+  version = "1.26.4";
  format = "pyproject";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-HjMcNZ+VV5PdTIW3q6Ja/gFIZl6xXDxk0pUCyIX4dPM=";
+    hash = "sha256-kQXojI57NYZgu3qXjtOL/a48YnXhuA6FEazhJ7jntqk=";
  };

  nativeBuildInputs = with python3.pkgs; [ setuptools-scm ];
--- a/pkgs/applications/office/paperless-ngx/default.nix
+++ b/pkgs/applications/office/paperless-ngx/default.nix
@ -21,13 +21,13 @@
 }:

 let
-  version = "2.1.2";
+  version = "2.2.1";

  src = fetchFromGitHub {
    owner = "paperless-ngx";
    repo = "paperless-ngx";
    rev = "refs/tags/v${version}";
-    hash = "sha256-jD0dRgU/9gtNZUuTV+zkjqWb8gBnvD/AOTPucdaVKwE=";
+    hash = "sha256-ds/hQ0+poUTO2bnXiHvNUanVFJcxxyuW3a9Yxcq5cAg=";
  };

  python = python3;
@ -52,7 +52,7 @@ let
      cd src-ui
    '';

-    npmDepsHash = "sha256-K7wTYGGwEhPoXdRD+4swhSlMH0iem6YkF0tjnVHh7K8=";
+    npmDepsHash = "sha256-o/inxHiOeMhQvZVcy6CM3Jy8B2sSp+8WJBknp3KVbZM=";

    nativeBuildInputs = [
      pkg-config
--- a/pkgs/applications/office/portfolio/default.nix
+++ b/pkgs/applications/office/portfolio/default.nix
@ -27,11 +27,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "PortfolioPerformance";
-  version = "0.66.2";
+  version = "0.67.0";

  src = fetchurl {
    url = "https://github.com/buchen/portfolio/releases/download/${version}/PortfolioPerformance-${version}-linux.gtk.x86_64.tar.gz";
-    hash = "sha256-jUakjgprf561OVwBW25+/+q+r2CZ6H1iDM3n6w54IfI=";
+    hash = "sha256-bm38t8wgLEYZVDsMnOv3Wj6TgKu2s36wo8q0Sj7pPNI=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/logic/z3/default.nix
+++ b/pkgs/applications/science/logic/z3/default.nix
@ -89,8 +89,8 @@ let common = { version, sha256, patches ? [ ], tag ? "z3" }:
 in
 {
  z3_4_12 = common {
-    version = "4.12.2";
-    sha256 = "sha256-DTgpKEG/LtCGZDnicYvbxG//JMLv25VHn/NaF307JYA=";
+    version = "4.12.4";
+    sha256 = "sha256-cxl7D47dRn+uMVOHbF0avj5+ZFWjaJ7lXj/8l6r9q2I=";
  };
  z3_4_11 = common {
    version = "4.11.2";
--- a/pkgs/applications/science/math/eigenmath/default.nix
+++ b/pkgs/applications/science/math/eigenmath/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "eigenmath";
-  version = "unstable-2023-12-12";
+  version = "unstable-2023-12-31";

  src = fetchFromGitHub {
    owner = "georgeweigt";
    repo = pname;
-    rev = "bec2c9bd0750ec7970f6c701e619565c9d348e84";
-    hash = "sha256-+VohU8mkFjZ0zhjmri0KY1kTzPLn2q5Au4nEBdXcR+8=";
+    rev = "cc92936e226b0a4c77cdc5d00b7a02c472746f6f";
+    hash = "sha256-wY06pZzqcgYdBS7ecB3ZnvmK74ve651n6aHHAN5DWdw=";
  };

  checkPhase = let emulator = stdenv.hostPlatform.emulator buildPackages; in ''
--- a/pkgs/applications/terminal-emulators/roxterm/default.nix
+++ b/pkgs/applications/terminal-emulators/roxterm/default.nix
@ -1,39 +0,0 @@
-{ at-spi2-core, cmake, dbus, dbus-glib, docbook_xsl, libepoxy, fetchFromGitHub
-, glib, gtk3, harfbuzz, libXdmcp, libXtst, libpthreadstubs
-, libselinux, libsepol, libtasn1, libxkbcommon, libxslt, p11-kit, pcre2
-, pkg-config, lib, stdenv, util-linuxMinimal, vte, wrapGAppsHook, xmlto, nixosTests
-}:
-
-stdenv.mkDerivation rec {
-  pname = "roxterm";
-  version = "3.14.2";
-
-  src = fetchFromGitHub {
-    owner = "realh";
-    repo = "roxterm";
-    rev = version;
-    sha256 = "sha256-LBxVZ5Az0vGalbQd437of5a3aoZH51v6OKTfndHkkiM=";
-  };
-
-  nativeBuildInputs = [ cmake pkg-config wrapGAppsHook libxslt ];
-
-  buildInputs =
-    [ gtk3 dbus dbus-glib vte pcre2 harfbuzz libpthreadstubs libXdmcp
-      util-linuxMinimal glib docbook_xsl xmlto libselinux
-      libsepol libxkbcommon libepoxy at-spi2-core libXtst libtasn1 p11-kit
-    ];
-
-  passthru.tests.test = nixosTests.terminal-emulators.roxterm;
-
-  meta = with lib; {
-    homepage = "https://github.com/realh/roxterm";
-    license = licenses.gpl3;
-    description = "Tabbed, VTE-based terminal emulator";
-    longDescription = ''
-      Tabbed, VTE-based terminal emulator. Similar to gnome-terminal without
-      the dependencies on Gnome.
-    '';
-    maintainers = with maintainers; [ ];
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/applications/video/mpv/scripts/buildLua.nix
+++ b/pkgs/applications/video/mpv/scripts/buildLua.nix
@ -36,6 +36,9 @@ lib.makeOverridable (args: stdenvNoCC.mkDerivation (extendedBy
    dontBuild = true;
    preferLocalBuild = true;

+    # Prevent `patch` from emitting `.orig` files (that end up in the output)
+    patchFlags = [ "--no-backup-if-mismatch" "-p1" ];
+
    outputHashMode = "recursive";
    installPhase = ''
      runHook preInstall
@ -51,7 +54,7 @@ lib.makeOverridable (args: stdenvNoCC.mkDerivation (extendedBy
          exit 1
        }
        mkdir -p "${scriptsDir}"
-        cp -a "${scriptPath}" "${scriptsDir}/${lib.removeSuffix ".lua" scriptName}"
+        cp -a "${scriptPath}" "${scriptsDir}/${scriptName}"
      else
        install -m644 -Dt "${scriptsDir}" \
          ${escapedList ([ scriptPath ] ++ extraScripts)}
--- a/pkgs/applications/video/mpv/scripts/mpv-playlistmanager.nix
+++ b/pkgs/applications/video/mpv/scripts/mpv-playlistmanager.nix
@ -2,13 +2,13 @@

 buildLua rec {
  pname = "mpv-playlistmanager";
-  version = "unstable-2023-08-09";
+  version = "unstable-2023-11-28";

  src = fetchFromGitHub {
    owner = "jonniek";
    repo = "mpv-playlistmanager";
-    rev = "e479cbc7e83a07c5444f335cfda13793681bcbd8";
-    sha256 = "sha256-Nh4g8uSkHWPjwl5wyqWtM+DW9fkEbmCcOsZa4eAF6Cs=";
+    rev = "579490c7ae1becc129736b7632deec4f3fb90b99";
+    hash = "sha256-swOtoB8UV/HPTpQRGXswAfUYsyC2Nj/QRIkGP8X1jk0=";
  };

  postPatch = ''
--- a/pkgs/applications/video/mpv/scripts/sponsorblock.nix
+++ b/pkgs/applications/video/mpv/scripts/sponsorblock.nix
@ -1,7 +1,7 @@
-{ lib, stdenvNoCC, fetchFromGitHub, fetchpatch, python3, nix-update-script }:
+{ lib, buildLua, fetchFromGitHub, fetchpatch, python3, nix-update-script }:

 # Usage: `pkgs.mpv.override { scripts = [ pkgs.mpvScripts.sponsorblock ]; }`
-stdenvNoCC.mkDerivation {
+buildLua {
  pname = "mpv_sponsorblock";
  version = "unstable-2023-01-30";

@ -12,8 +12,6 @@ stdenvNoCC.mkDerivation {
    sha256 = "sha256-iUXaTWWFEdxhxClu2NYbQcThlvYty3A2dEYGooeAVAQ=";
  };

-  dontBuild = true;
-
  patches = [
    # Use XDG_DATA_HOME and XDG_CACHE_HOME if defined for UID and DB
    # Necessary to avoid sponsorblock to write in the nix store at runtime.
@ -34,23 +32,16 @@ stdenvNoCC.mkDerivation {
      --replace 'mp.find_config_file("scripts")' "\"$out/share/mpv/scripts\""
  '';

-  installPhase = ''
-    mkdir -p $out/share/mpv/scripts
-    cp -r sponsorblock.lua sponsorblock_shared $out/share/mpv/scripts/
-  '';
+  postInstall = "cp -a sponsorblock_shared $out/share/mpv/scripts/";

-  passthru = {
-    scriptName = "sponsorblock.lua";
-    updateScript = nix-update-script {
-      extraArgs = [ "--version=branch" ];
-    };
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
  };

  meta = with lib; {
    description = "Script for mpv to skip sponsored segments of YouTube videos";
    homepage = "https://github.com/po5/mpv_sponsorblock";
    license = licenses.gpl3;
-    platforms = platforms.all;
    maintainers = with maintainers; [ pacien ];
  };
 }
--- a/pkgs/applications/virtualization/OVMF/default.nix
+++ b/pkgs/applications/virtualization/OVMF/default.nix
@ -31,6 +31,7 @@ let
    i686 = "FV/OVMF";
    x86_64 = "FV/OVMF";
    aarch64 = "FV/AAVMF";
+    riscv64 = "FV/RISCV_VIRT";
  };

 in
--- a/pkgs/by-name/ar/armitage/package.nix
+++ b/pkgs/by-name/ar/armitage/package.nix
@ -0,0 +1,145 @@
+{ lib
+, stdenv
+, fetchurl
+, fetchFromGitHub
+, jdk11
+, gradle_6
+, perl
+, metasploit
+, makeWrapper
+, makeDesktopItem
+, copyDesktopItems
+, writeDarwinBundle
+}:
+
+let
+  pname = "armitage";
+  version = "unstable-2022-12-05";
+
+  src = fetchFromGitHub {
+    owner = "r00t0v3rr1d3";
+    repo = "armitage";
+    rev = "991244e9a0c0fc9302e48c4e708347c315f78b13";
+    hash = "sha256-0ik20wzE0cf6cC/HY6RwMHqkvqPFpZmOUyZyb5H3SHg=";
+  };
+
+  patches = [
+    (fetchurl {
+      name = "Remove-mentions-of-old-metasploit-versions.patch";
+      url = "https://gitlab.com/kalilinux/packages/armitage/-/raw/042beb7494a10227761ecb3ddabf4019bbb78681/debian/patches/Remove-mentions-of-old-metasploit-versions.patch";
+      hash = "sha256-VUey/e8kcBWqAxYTfIXoyTAoDR/UKZKqBJAKmdabArY=";
+    })
+    (fetchurl {
+      name = "Update-postgresql-version-to-support-scram-sha-256.patch";
+      url = "https://gitlab.com/kalilinux/packages/armitage/-/raw/042beb7494a10227761ecb3ddabf4019bbb78681/debian/patches/Update-postgresql-version-to-support-scram-sha-256.patch";
+      hash = "sha256-ZPvcRoUCrq32g0Mw8+EhNl8DlI+jMYUlFyPW1VScgzc=";
+    })
+    (fetchurl {
+      name = "fix-launch-script.patch";
+      url = "https://gitlab.com/kalilinux/packages/armitage/-/raw/042beb7494a10227761ecb3ddabf4019bbb78681/debian/patches/fix-launch-script.patch";
+      hash = "sha256-I6T7iwShQLn+ZHuKa117VOlItXjY4/51RDbjvNJEW/4=";
+    })
+    (fetchurl {
+      name = "fix-meterpreter.patch";
+      url = "https://gitlab.com/kalilinux/packages/armitage/-/raw/042beb7494a10227761ecb3ddabf4019bbb78681/debian/patches/fix-meterpreter.patch";
+      hash = "sha256-p4fs5xFdC2apW0U8x8u9S4p5gq3Eiv+0E4CGccQZYKY=";
+    })
+  ];
+
+  deps = stdenv.mkDerivation {
+    pname = "${pname}-deps";
+    inherit version src patches;
+    nativeBuildInputs = [ gradle_6 perl ];
+    buildPhase = ''
+      export GRADLE_USER_HOME=$(mktemp -d)
+      gradle --no-daemon assemble
+    '';
+    # perl code mavenizes pathes (com.squareup.okio/okio/1.13.0/a9283170b7305c8d92d25aff02a6ab7e45d06cbe/okio-1.13.0.jar -> com/squareup/okio/okio/1.13.0/okio-1.13.0.jar)
+    installPhase = ''
+      find $GRADLE_USER_HOME -type f -regex '.*\.\(jar\|pom\)' \
+        | perl -pe 's#(.*/([^/]+)/([^/]+)/([^/]+)/[0-9a-f]{30,40}/([^/\s]+))$# ($x = $2) =~ tr|\.|/|; "install -Dm444 $1 \$out/$x/$3/$4/$5" #e' \
+        | sh
+      rm -rf $out/tmp
+    '';
+    outputHashAlgo = "sha256";
+    outputHashMode = "recursive";
+    outputHash = "sha256-6o3HlBfmpjpmMeiRydOme6fJc8caq8EBRVf3nJq9vqo=";
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
+  inherit pname version src patches;
+
+  __darwinAllowLocalNetworking = true;
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "armitage";
+      desktopName = "Armitage";
+      exec = "armitage";
+      icon = "armitage";
+      comment = finalAttrs.meta.description;
+      categories = [ "Network" "Security" ];
+      startupNotify = false;
+    })
+  ];
+
+  nativeBuildInputs = [
+    jdk11
+    gradle_6
+    makeWrapper
+    copyDesktopItems
+  ] ++ lib.optionals stdenv.isDarwin [
+    writeDarwinBundle
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    export GRADLE_USER_HOME=$(mktemp -d)
+    substituteInPlace armitage/build.gradle \
+      --replace 'mavenCentral()' 'mavenLocal(); maven { url uri("${deps}") }'
+    substituteInPlace cortana/build.gradle \
+      --replace 'mavenCentral()' 'mavenLocal(); maven { url uri("${deps}") }'
+    gradle --offline --no-daemon assemble
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    JAR="$out/share/armitage/armitage.jar"
+    install -Dm444 build/armitage.jar $JAR
+
+    install -Dm755 dist/unix/armitage $out/bin/armitage
+    substituteInPlace $out/bin/armitage \
+      --replace "armitage.jar" "$JAR"
+    wrapProgram $out/bin/armitage \
+      --prefix PATH : "${lib.makeBinPath [ jdk11 metasploit ]}"
+
+    install -Dm755 dist/unix/teamserver $out/bin/teamserver
+    substituteInPlace $out/bin/teamserver \
+      --replace "armitage.jar" "$JAR"
+    wrapProgram $out/bin/teamserver \
+      --prefix PATH : "${lib.makeBinPath [ jdk11 metasploit ]}"
+
+    install -Dm444 dist/unix/armitage-logo.png $out/share/pixmaps/armitage.png
+    ${lib.optionalString stdenv.isDarwin ''
+      mkdir -p "$out/Applications/Armitage.app/Contents/MacOS"
+      mkdir -p "$out/Applications/Armitage.app/Contents/Resources"
+      cp dist/mac/Armitage.app/Contents/Resources/macIcon.icns $out/Applications/Armitage.app/Contents/Resources
+      write-darwin-bundle $out Armitage armitage macIcon
+    ''}
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Graphical cyber attack management tool for Metasploit";
+    homepage = "https://github.com/r00t0v3rr1d3/armitage";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ emilytrau ];
+    platforms = platforms.unix;
+    mainProgram = "armitage";
+  };
+})
--- a/pkgs/by-name/do/door-knocker/package.nix
+++ b/pkgs/by-name/do/door-knocker/package.nix
@ -0,0 +1,50 @@
+{ stdenv
+, lib
+, fetchFromGitea
+, blueprint-compiler
+, desktop-file-utils
+, glib
+, gtk4
+, libadwaita
+, meson
+, ninja
+, pkg-config
+, wrapGAppsHook4
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "door-knocker";
+  version = "0.4.2";
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "tytan652";
+    repo = "door-knocker";
+    rev = finalAttrs.version;
+    hash = "sha256-9kCEPo+rlR344uPGhuWxGq6dAPgyCFEQ1XPGkLfp/bA=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    desktop-file-utils
+    blueprint-compiler
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    glib
+    gtk4
+    libadwaita
+  ];
+
+  meta = with lib; {
+    description = "Tool to check the availability of portals";
+    homepage = "https://codeberg.org/tytan652/door-knocker";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ symphorien ];
+    platforms = platforms.linux;
+    mainProgram = "door-knocker";
+  };
+})
--- a/pkgs/by-name/dr/drone-scp/package.nix
+++ b/pkgs/by-name/dr/drone-scp/package.nix
@ -4,16 +4,16 @@
 }:
 buildGoModule rec {
  pname = "drone-scp";
-  version = "1.6.12";
+  version = "1.6.13";

  src = fetchFromGitHub {
    owner = "appleboy";
    repo = "drone-scp";
    rev = "v${version}";
-    hash = "sha256-pdVSb+hOW38LMP6fwAxVy/8SyfwKcMe4SgemPZ1PlSg=";
+    hash = "sha256-xto5QPrrPzGFy9GYUfK8lFUcXxi9gGHHs/84FdSjbYc=";
  };

-  vendorHash = "sha256-HQeWj5MmVfR6PkL2FEnaptMH+4nSh7T2wfOaZyUZvbM=";
+  vendorHash = "sha256-rVS2ZKeJou/ZfLvNMd6jMRYMYuDXiqGyZSSDX9y3FQo=";

  # Needs a specific user...
  doCheck = false;
--- a/pkgs/by-name/ff/ff2mpv-go/package.nix
+++ b/pkgs/by-name/ff/ff2mpv-go/package.nix
@ -1,6 +1,7 @@
 { lib
 , buildGoModule
 , fetchgit
+, makeWrapper
 , mpv
 }:
 buildGoModule rec {
@ -13,17 +14,21 @@ buildGoModule rec {
    hash = "sha256-e/AuOA3isFTyBf97Zwtr16yo49UdYzvktV5PKB/eH/s=";
  };

-  vendorHash = null;
+  nativeBuildInputs = [
+    makeWrapper
+  ];

-  postPatch = ''
-    substituteInPlace ff2mpv.go --replace '"mpv"' '"${lib.getExe mpv}"'
-  '';
+  vendorHash = null;

  postInstall = ''
    mkdir -p "$out/lib/mozilla/native-messaging-hosts"
    $out/bin/ff2mpv-go --manifest > "$out/lib/mozilla/native-messaging-hosts/ff2mpv.json"
  '';

+  postFixup = ''
+    wrapProgram $out/bin/ff2mpv-go --suffix PATH ":" ${lib.makeBinPath [ mpv ]}
+  '';
+
  meta = with lib; {
    description = "Native messaging host for ff2mpv written in Go";
    homepage = "https://git.clsr.net/util/ff2mpv-go/";
--- a/pkgs/by-name/gr/gruvbox-plus-icons/package.nix
+++ b/pkgs/by-name/gr/gruvbox-plus-icons/package.nix
@ -3,7 +3,7 @@
 , stdenvNoCC
 , fetchFromGitHub
 , gtk3
-, breeze-icons
+, plasma5Packages
 , gnome-icon-theme
 , hicolor-icon-theme
 }:
@ -21,7 +21,7 @@ stdenvNoCC.mkDerivation {

  nativeBuildInputs = [ gtk3 ];

-  propagatedBuildInputs = [ breeze-icons gnome-icon-theme hicolor-icon-theme ];
+  propagatedBuildInputs = [ plasma5Packages.breeze-icons gnome-icon-theme hicolor-icon-theme ];

  installPhase = ''
    runHook preInstall
--- a/pkgs/by-name/he/hercules/package.nix
+++ b/pkgs/by-name/he/hercules/package.nix
@ -0,0 +1,153 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, runCommand
+, libtool
+, cmake
+, zlib
+, bzip2
+, enableRexx ? stdenv.isLinux, regina
+}:
+let
+  herculesCpu =
+    if stdenv.hostPlatform.isx86 then "x86"
+    else stdenv.hostPlatform.qemuArch;
+  herculesBits = if stdenv.hostPlatform.is32bit then "32" else "64";
+
+  herculesLibDir =
+    if stdenv.hostPlatform.isx86 then "lib"
+    else "lib/${herculesCpu}";
+
+  mkExtPkg = depName: attrFn: (stdenv.mkDerivation {
+    pname = "hercules-${depName}";
+
+    postPatch = ''
+      patchShebangs build
+      sed -i build \
+        -e "s%_tool=.*$%_tool=${cmake}/bin/cmake%" \
+        -e "s/CPUS=.*$/CPUS=$NIX_BUILD_CORES/"
+    '';
+
+    dontUseCmakeConfigure = true;
+
+    buildPhase = ''
+      mkdir ../build $out
+      # In source builds are not allowed.
+      cd ../build
+      ../source/build \
+        --pkgname ${depName} \
+        --cpu ${herculesCpu} \
+        --arch ${herculesBits} \
+        --install "$out"
+    '';
+
+    nativeBuildInputs = [ cmake ];
+
+    enableParallelBuilding = true;
+
+    meta = with lib; {
+      description = "Hercules ${depName} library";
+      license = lib.licenses.free; # Mixture of Public Domain, ICU (MIT compatible) and others
+      maintainers = with maintainers; [ anna328p vifino ];
+    };
+  }).overrideAttrs (default: attrFn default);
+
+
+  crypto = mkExtPkg "crypto" (default: {
+    version = "1.0.0";
+    src = fetchFromGitHub {
+      owner = "SDL-Hercules-390";
+      repo = "crypto";
+      rev = "a5096e5dd79f46b568806240c0824cd8cb2fcda2";
+      hash = "sha256-VWjM8WxPMynyW49Z8U/r6SsF7u7Xbk7Dd0gR35lIw28=";
+    };
+  });
+
+  decNumber = mkExtPkg "decNumber" (default: {
+    version = "3.68.0";
+    src = fetchFromGitHub {
+      owner = "SDL-Hercules-390";
+      repo = "decNumber";
+      rev = "3aa2f4531b5fcbd0478ecbaf72ccc47079c67280";
+      hash = "sha256-PfPhnYUSIw1sYiGRM3iHRTbHHbQ+sK7oO12pH/yt+MQ=";
+    };
+  });
+
+  softFloat = mkExtPkg "SoftFloat" (default: {
+    version = "3.5.0";
+    src = fetchFromGitHub {
+      owner = "SDL-Hercules-390";
+      repo = "SoftFloat";
+      rev = "4b0c326008e174610969c92e69178939ed80653d";
+      hash = "sha256-DEIT5Xk6IqUXCIGD2Wj0h9xPOR0Mid2Das7aKMQMDaM=";
+    };
+  });
+
+  telnet = mkExtPkg "telnet" (default: {
+    version = "1.0.0";
+    src = fetchFromGitHub {
+      owner = "SDL-Hercules-390";
+      repo = "telnet";
+      rev = "729f0b688c1426018112c1e509f207fb5f266efa";
+      hash = "sha256-ED0Cl+VcK6yl59ShgJBZKy25oAFC8eji36pNLwMxTM0=";
+    };
+  });
+
+  extpkgs = runCommand "hercules-extpkgs" {} ''
+    OUTINC="$out/include"
+    OUTLIB="$out/${herculesLibDir}"
+    mkdir -p "$OUTINC" "$OUTLIB"
+    for dep in "${crypto}" "${decNumber}" "${softFloat}" "${telnet}"; do
+      ln -s $dep/include/* "$OUTINC"
+      ln -s $dep/${herculesLibDir}/* "$OUTLIB"
+    done
+  '';
+in
+stdenv.mkDerivation rec {
+  pname = "hercules";
+  version = "4.6";
+
+  src = fetchFromGitHub {
+    owner = "SDL-Hercules-390";
+    repo = "hyperion";
+    rev = "Release_${version}";
+    hash = "sha256-ZhMTun6tmTsmIiFPTRFudwRXzWydrih61RsLyv0p24U=";
+  };
+
+  postPatch = ''
+    patchShebangs _dynamic_version
+  '';
+
+  nativeBuildInputs = [ libtool ];
+  buildInputs = [
+    (lib.getOutput "lib" libtool)
+    zlib
+    bzip2
+    extpkgs
+  ] ++ lib.optionals enableRexx [
+    regina
+  ];
+
+  configureFlags = [
+    "--enable-extpkgs=${extpkgs}"
+    "--without-included-ltdl"
+    "--enable-ipv6"
+    "--enable-cckd-bzip2"
+    "--enable-het-bzip2"
+  ] ++ lib.optionals enableRexx [
+    "--enable-regina-rexx"
+  ];
+
+  meta = with lib; {
+    homepage = "https://sdl-hercules-390.github.io/html/";
+    description = "IBM mainframe emulator";
+    longDescription = ''
+      Hercules is an open source software implementation of the mainframe
+      System/370 and ESA/390 architectures, in addition to the latest 64-bit
+      z/Architecture. Hercules runs under Linux, Windows, Solaris, FreeBSD, and
+      Mac OS X.
+    '';
+    license = licenses.qpl;
+    maintainers = with maintainers; [ anna328p vifino ];
+  };
+}
--- a/pkgs/by-name/jj/jj/package.nix
+++ b/pkgs/by-name/jj/jj/package.nix
@ -0,0 +1,73 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, nix-update-script
+, testers
+, writeText
+, runCommand
+, jj
+}:
+buildGoModule rec {
+  pname = "jj";
+  version = "1.9.2";
+
+  src = fetchFromGitHub {
+    owner = "tidwall";
+    repo = "jj";
+    rev = "v${version}";
+    hash = "sha256-Yijap5ZghTBe1ahkQgjjxuo++SriJWXgRqrNXIVQ0os=";
+  };
+
+  vendorHash = "sha256-39rA3jMGYhsh1nrGzI1vfHZzZDy4O6ooYWB8af654mM=";
+
+  subPackages = [ "cmd/jj" ];
+
+  CGO_ENABLED = "0";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${version}"
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests = with testers; {
+      version = testVersion { package = jj; };
+      examples = testEqualContents {
+        assertion = "examples from projects README.md work";
+        actual = runCommand "actual" { nativeBuildInputs = [ jj ]; } ''
+          {
+            echo '{"name":{"first":"Tom","last":"Smith"}}' | jj name.last
+            echo '{"name":{"first":"Tom","last":"Smith"}}' | jj name
+            echo '{"name":{"first":"Tom","last":"Smith"}}' | jj -v Andy name.first
+            echo '{"friends":["Tom","Jane","Carol"]}' | jj -v Andy friends.-1
+            echo '{"age":46,"name":{"first":"Tom","last":"Smith"}}' | jj -D age
+          } > $out
+        '';
+        expected = writeText "expected" ''
+          Smith
+          {"first":"Tom","last":"Smith"}
+          {"name":{"first":"Andy","last":"Smith"}}
+          {"friends":["Tom","Jane","Carol","Andy"]}
+          {"name":{"first":"Tom","last":"Smith"}}
+        '';
+      };
+    };
+  };
+
+  meta = with lib; {
+    description = "JSON Stream Editor (command line utility)";
+    longDescription = ''
+      JJ is a command line utility that provides a fast and simple way to retrieve
+      or update values from JSON documents. It's powered by GJSON and SJSON under the hood.
+      It's fast because it avoids parsing irrelevant sections of json, skipping over values
+      that do not apply, and aborts as soon as the target value has been found or updated.
+    '';
+    homepage = "https://github.com/tidwall/jj";
+    changelog = "https://github.com/tidwall/jj/releases/tag/v${version}";
+    license = licenses.mit;
+    mainProgram = "jj";
+    maintainers = with maintainers; [ katexochen ];
+  };
+}
--- a/pkgs/by-name/li/libsignal-ffi/Cargo.lock
+++ b/pkgs/by-name/li/libsignal-ffi/Cargo.lock
--- a/pkgs/by-name/li/libsignal-ffi/package.nix
+++ b/pkgs/by-name/li/libsignal-ffi/package.nix
@ -0,0 +1,46 @@
+{ lib, stdenv, fetchFromGitHub, rustPlatform, runCommand, xcodebuild, protobuf, boringssl }:
+let
+  # boring-sys expects the static libraries in build/ instead of lib/
+  boringssl-wrapper = runCommand "boringssl-wrapper" { } ''
+    mkdir $out
+    cd $out
+    ln -s ${boringssl.out}/lib build
+    ln -s ${boringssl.dev}/include include
+  '';
+in
+rustPlatform.buildRustPackage rec {
+  pname = "libsignal-ffi";
+  # must match the version used in mautrix-signal
+  # see https://github.com/mautrix/signal/issues/401
+  version = "0.36.1";
+
+  src = fetchFromGitHub {
+    owner = "signalapp";
+    repo = "libsignal";
+    rev = "v${version}";
+    hash = "sha256-UD4E2kI1ZNtFhwBGphTzF37NHqbSZjQGHbliOWAMYOE=";
+  };
+
+  nativeBuildInputs = [ protobuf ] ++ lib.optionals stdenv.isDarwin [ xcodebuild ];
+  buildInputs = [ rustPlatform.bindgenHook ];
+
+  env.BORING_BSSL_PATH = "${boringssl-wrapper}";
+
+  # The Cargo.lock contains git dependencies
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "boring-3.1.0" = "sha256-R6hh4K57mgV10nuVcMZETvxlQsMsmGapgCQ7pjuognk=";
+      "curve25519-dalek-4.1.1" = "sha256-p9Vx0lAaYILypsI4/RVsHZLOqZKaa4Wvf7DanLA38pc=";
+    };
+  };
+
+  cargoBuildFlags = [ "-p" "libsignal-ffi" ];
+
+  meta = with lib; {
+    description = "A C ABI library which exposes Signal protocol logic";
+    homepage = "https://github.com/signalapp/libsignal";
+    license = licenses.agpl3Plus;
+    maintainers = with maintainers; [ niklaskorz ];
+  };
+}
--- a/pkgs/by-name/li/livekit/package.nix
+++ b/pkgs/by-name/li/livekit/package.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "livekit";
-  version = "1.5.1";
+  version = "1.5.2";

  src = fetchFromGitHub {
    owner = "livekit";
    repo = "livekit";
    rev = "v${version}";
-    hash = "sha256-3KRES/2mGO6b1ZZEGx29Yu5wgEG4NOJ7/J0xPvQiNWk=";
+    hash = "sha256-Z1N6iYXd3HswRJql3YZMot5fdkdFFbJuxyGDgLsbtQI=";
  };

-  vendorHash = "sha256-5wByIkMs3321u4/2vPpsZ/L5zlcgrZo0b+NjeMR1RWE=";
+  vendorHash = "sha256-O0rlezMdhoRHdK37BGKW3CHLpYfkFC1d83o5u54LQ8k=";

  subPackages = [ "cmd/server" ];

--- a/pkgs/by-name/lz/lzsa/package.nix
+++ b/pkgs/by-name/lz/lzsa/package.nix
@ -0,0 +1,34 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "lzsa";
+  version = "1.4.1";
+
+  src = fetchFromGitHub {
+    owner = "emmanuel-marty";
+    repo = "lzsa";
+    rev = finalAttrs.version;
+    hash = "sha256-XaPtMW9INv/wzMXvlyXgE3VfFJCY/5R/HFGhV3ZKvGs=";
+  };
+
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 lzsa -t $out/bin/
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "https://github.com/emmanuel-marty/lzsa";
+    description = "Byte-aligned, efficient lossless packer that is optimized for fast decompression on 8-bit micros";
+    license = with lib.licenses; [ cc0 ];
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/by-name/ma/maltego/package.nix
+++ b/pkgs/by-name/ma/maltego/package.nix
@ -0,0 +1,81 @@
+{ lib
+, stdenv
+, fetchzip
+, jre
+, giflib
+, gawk
+, makeBinaryWrapper
+, icoutils
+, copyDesktopItems
+, makeDesktopItem
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "maltego";
+  version = "4.6.0";
+
+  src = fetchzip {
+    url = "https://downloads.maltego.com/maltego-v4/linux/Maltego.v${finalAttrs.version}.linux.zip";
+    hash = "sha256-q+1RYToZtBxAIDSiUWf3i/3GBBDwh6NWteHiK4VM1HY=";
+  };
+
+  postPatch = ''
+      substituteInPlace bin/maltego \
+            --replace /usr/bin/awk ${lib.getExe gawk}
+  '';
+
+    desktopItems = [
+    (makeDesktopItem {
+      name = finalAttrs.pname;
+      desktopName = "Maltego";
+      exec = finalAttrs.meta.mainProgram;
+      icon = finalAttrs.pname;
+      comment = "An open source intelligence and forensics application";
+      categories = [ "Network" "Security" ];
+      startupNotify = false;
+    })
+  ];
+
+  nativeBuildInputs = [
+    icoutils
+    makeBinaryWrapper
+    copyDesktopItems
+  ];
+
+  buildInputs = [ jre giflib ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{bin,share}
+    chmod +x bin/maltego
+
+    icotool -x bin/maltego.ico
+
+    for size in 16 32 48 256
+    do
+      mkdir -p $out/share/icons/hicolor/$size\x$size/apps
+      cp maltego_*_$size\x$size\x32.png $out/share/icons/hicolor/$size\x$size/apps/maltego.png
+    done
+
+    rm -r *.png
+
+    cp -aR . "$out/share/maltego/"
+
+    makeWrapper $out/share/maltego/bin/maltego $out/bin/${finalAttrs.meta.mainProgram} \
+      --set JAVA_HOME ${jre} \
+      --prefix PATH : ${lib.makeBinPath [ jre ]}
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.maltego.com";
+    description = "An open source intelligence and forensics application, enabling to easily gather information about DNS, domains, IP addresses, websites, persons, and so on";
+    mainProgram = "maltego";
+    maintainers = with maintainers; [ emilytrau d3vil0p3r ];
+    platforms = with platforms; linux ++ darwin;
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
+    license = licenses.unfree;
+  };
+})
--- a/pkgs/by-name/mc/mcfly-fzf/package.nix
+++ b/pkgs/by-name/mc/mcfly-fzf/package.nix
@ -0,0 +1,29 @@
+{ lib, rustPlatform, fetchFromGitHub }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "mcfly-fzf";
+  version = "0.1.2";
+
+  src = fetchFromGitHub {
+    owner = "bnprks";
+    repo = "mcfly-fzf";
+    rev = version;
+    hash = "sha256-3QxiG9MR0BCKRjA8ue/Yb/AZ5SwiSdjn6qaOxSAK0SI=";
+  };
+
+  postPatch = ''
+    substituteInPlace shell/mcfly-fzf.bash --replace '$(command -v mcfly-fzf)' '${placeholder "out"}/bin/mcfly-fzf'
+    substituteInPlace shell/mcfly-fzf.zsh --replace '$(command -v mcfly-fzf)' '${placeholder "out"}/bin/mcfly-fzf'
+    substituteInPlace shell/mcfly-fzf.fish --replace '(command -v mcfly-fzf)' '${placeholder "out"}/bin/mcfly-fzf'
+  '';
+
+  cargoHash = "sha256-pR5Fni/8iJuaDyWKrOnSanO50hvFXh73Qlgmd4a3Ucs=";
+
+  meta = with lib; {
+    homepage = "https://github.com/bnprks/mcfly-fzf";
+    description = "Integrate Mcfly with fzf to combine a solid command history database with a widely-loved fuzzy search UI";
+    license = licenses.mit;
+    maintainers = [ maintainers.simonhammes ];
+    mainProgram = "mcfly-fzf";
+  };
+}
--- a/pkgs/applications/audio/ocenaudio/default.nix
+++ b/pkgs/applications/audio/ocenaudio/default.nix
@ -7,25 +7,28 @@
 , libjack2
 , alsa-lib
 , bzip2
-, libpulseaudio }:
+, libpulseaudio
+, xz
+}:

 stdenv.mkDerivation rec {
  pname = "ocenaudio";
-  version = "3.13.2";
+  version = "3.13.3";

  src = fetchurl {
    url = "https://www.ocenaudio.com/downloads/index.php/ocenaudio_debian9_64.deb?version=${version}";
-    sha256 = "sha256-ITlnOrreZHTH8NDjx/hQzEV3toAwaM2bWFLqMf3btNE=";
+    hash = "sha256-B0+NyFZ9c0ljzYMJm3741TpoxFS0Zo6hxzhadYFofSA=";
  };

  nativeBuildInputs = [
+    alsa-lib
    autoPatchelfHook
-    qt5.qtbase
-    qt5.wrapQtAppsHook
+    bzip2
    libjack2
    libpulseaudio
-    bzip2
-    alsa-lib
+    qt5.qtbase
+    qt5.wrapQtAppsHook
+    xz
  ];

  buildInputs = [ dpkg ];
--- a/pkgs/by-name/pd/pdk/Gemfile
+++ b/pkgs/by-name/pd/pdk/Gemfile
@ -1,2 +1,2 @@
 source 'https://rubygems.org'
-gem 'pdk', '3.0.0'
+gem 'pdk', '3.0.1'
--- a/pkgs/by-name/pd/pdk/Gemfile.lock
+++ b/pkgs/by-name/pd/pdk/Gemfile.lock
@ -1,7 +1,7 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    addressable (2.8.5)
+    addressable (2.8.6)
      public_suffix (>= 2.0.2, < 6.0)
    childprocess (4.1.0)
    concurrent-ruby (1.1.10)
@ -22,7 +22,7 @@ GEM
    pastel (0.8.0)
      tty-color (~> 0.5)
    pathspec (1.1.3)
-    pdk (3.0.0)
+    pdk (3.0.1)
      bundler (>= 2.1.0, < 3.0.0)
      childprocess (~> 4.1.0)
      concurrent-ruby (= 1.1.10)
@ -51,7 +51,7 @@ GEM
      tty-cursor (~> 0.7)
      tty-screen (~> 0.8)
      wisper (~> 2.0)
-    tty-screen (0.8.1)
+    tty-screen (0.8.2)
    tty-spinner (0.9.3)
      tty-cursor (~> 0.7)
    tty-which (0.5.0)
@ -61,7 +61,7 @@ PLATFORMS
  x86_64-linux

 DEPENDENCIES
-  pdk (= 3.0.0)
+  pdk (= 3.0.1)

 BUNDLED WITH
-   2.4.20
+   2.4.22
--- a/pkgs/by-name/pd/pdk/gemset.nix
+++ b/pkgs/by-name/pd/pdk/gemset.nix
@ -5,10 +5,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "05r1fwy487klqkya7vzia8hnklcxy4vr92m9dmni3prfwk6zpw33";
+      sha256 = "0irbdwkkjwzajq1ip6ba46q49sxnrl2cw7ddkdhsfhb6aprnm3vr";
      type = "gem";
    };
-    version = "2.8.5";
+    version = "2.8.6";
  };
  childprocess = {
    groups = ["default"];
@ -169,10 +169,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0wbr20gkv0ggc3b0hah29xs4rlldrm5kk55838vizzgk6d0pddmi";
+      sha256 = "1imb1bqda7xxq38r2fvq9qphr4d1shy7c2v1agw50a736g4346x2";
      type = "gem";
    };
-    version = "3.0.0";
+    version = "3.0.1";
  };
  public_suffix = {
    groups = ["default"];
@ -241,10 +241,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "18jr6s1cg8yb26wzkqa6874q0z93rq0y5aw092kdqazk71y6a235";
+      sha256 = "0l4vh6g333jxm9lakilkva2gn17j6gb052626r1pdbmy2lhnb460";
      type = "gem";
    };
-    version = "0.8.1";
+    version = "0.8.2";
  };
  tty-spinner = {
    dependencies = ["tty-cursor"];
--- a/pkgs/by-name/qs/qspeakers/package.nix
+++ b/pkgs/by-name/qs/qspeakers/package.nix
@ -0,0 +1,35 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, libsForQt5
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "qspeakers";
+  version = "1.6.9";
+
+  src = fetchFromGitHub {
+    owner = "be1";
+    repo = "qspeakers";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-V4rcDUJU27ijzsc6zhsEiQ/7SdvHmGR2402iIazrMfE=";
+  };
+
+  nativeBuildInputs = [
+    libsForQt5.qmake
+    libsForQt5.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    libsForQt5.qtcharts
+    libsForQt5.qttools
+  ];
+
+  meta = {
+    description = "A loudspeaker enclosure designer";
+    homepage = "https://github.com/be1/qspeakers";
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "qspeakers";
+    maintainers = with lib.maintainers; [ tomasajt ];
+  };
+})
--- a/pkgs/by-name/re/renode-unstable/package.nix
+++ b/pkgs/by-name/re/renode-unstable/package.nix
@ -0,0 +1,16 @@
+{ renode
+, fetchurl
+, buildUnstable ? true
+}:
+
+(renode.override {
+  inherit buildUnstable;
+}).overrideAttrs (finalAttrs: _: {
+  pname = "renode-unstable";
+  version = "1.14.0+20231229gita76dac0ae";
+
+  src = fetchurl {
+    url = "https://builds.renode.io/renode-${finalAttrs.version}.linux-portable.tar.gz";
+    hash = "sha256-fvwNN3sT8VZ7XJPrfpAbjSiuAB274QhuPeekwz0AU3c=";
+  };
+})
--- a/pkgs/by-name/re/renode/package.nix
+++ b/pkgs/by-name/re/renode/package.nix
@ -0,0 +1,103 @@
+{ stdenv
+, lib
+, fetchurl
+, autoPatchelfHook
+, makeWrapper
+, writeScript
+, glibcLocales
+, python3Packages
+, gtk-sharp-2_0
+, gtk2-x11
+, screen
+, buildUnstable ? false
+}:
+
+let
+  pythonLibs = with python3Packages; makePythonPath [
+    construct
+    psutil
+    pyyaml
+    requests
+    robotframework
+  ];
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "renode";
+  version = "1.14.0";
+
+  src = fetchurl {
+    url = "https://builds.renode.io/renode-${finalAttrs.version}.linux-portable.tar.gz";
+    hash = "sha256-1wfVHtCYc99ACz8m2XEg1R0nIDh9xP4ffV/vxeeEHxE=";
+  };
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    makeWrapper
+  ];
+
+  propagatedBuildInputs = [
+    gtk2-x11
+    gtk-sharp-2_0
+    screen
+  ];
+
+  strictDeps = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{bin,libexec/renode}
+
+    mv * $out/libexec/renode
+    mv .renode-root $out/libexec/renode
+    chmod +x $out/libexec/renode/*.so
+
+    makeWrapper "$out/libexec/renode/renode" "$out/bin/renode" \
+      --prefix PATH : "$out/libexec/renode" \
+      --suffix LD_LIBRARY_PATH : "${gtk2-x11}/lib" \
+      --set LOCALE_ARCHIVE "${glibcLocales}/lib/locale/locale-archive"
+
+    makeWrapper "$out/libexec/renode/renode-test" "$out/bin/renode-test" \
+      --prefix PATH : "$out/libexec/renode" \
+      --prefix PYTHONPATH : "${pythonLibs}" \
+      --suffix LD_LIBRARY_PATH : "${gtk2-x11}/lib" \
+      --set LOCALE_ARCHIVE "${glibcLocales}/lib/locale/locale-archive"
+
+    substituteInPlace "$out/libexec/renode/renode-test" \
+      --replace '$PYTHON_RUNNER' '${python3Packages.python}/bin/python3'
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript =
+    let
+      versionRegex =
+        if buildUnstable
+        then "[0-9\.\+]+[^\+]*."
+        else "[0-9\.]+[^\+]*.";
+    in
+    writeScript "${finalAttrs.pname}-updater" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts curl gnugrep gnused pup
+
+      latestVersion=$(
+        curl -sS https://builds.renode.io \
+          | pup 'a text{}' \
+          | egrep 'renode-${versionRegex}\.linux-portable\.tar\.gz' \
+          | head -n1 \
+          | sed -e 's,renode-\(.*\)\.linux-portable\.tar\.gz,\1,g'
+      )
+
+      update-source-version ${finalAttrs.pname} "$latestVersion" \
+        --file=pkgs/by-name/re/${finalAttrs.pname}/package.nix \
+        --system=x86_64-linux
+    '';
+
+  meta = {
+    description = "Virtual development framework for complex embedded systems";
+    homepage = "https://renode.org";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ otavio ];
+    platforms = [ "x86_64-linux" ];
+  };
+})
--- a/pkgs/by-name/ro/roxterm/package.nix
+++ b/pkgs/by-name/ro/roxterm/package.nix
@ -0,0 +1,98 @@
+{
+  at-spi2-core
+, cmake
+, dbus
+, dbus-glib
+, docbook_xsl
+, fetchFromGitHub
+, glib
+, gtk3
+, harfbuzz
+, lib
+, libXdmcp
+, libXtst
+, libepoxy
+, libpthreadstubs
+, libselinux
+, libsepol
+, libtasn1
+, libxkbcommon
+, libxslt
+, nixosTests
+, p11-kit
+, pcre2
+, pkg-config
+, stdenv
+, util-linuxMinimal
+, vte
+, wrapGAppsHook
+, xmlto
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "roxterm";
+  version = "3.14.3";
+
+  src = fetchFromGitHub {
+    owner = "realh";
+    repo = "roxterm";
+    rev = finalAttrs.version;
+    hash = "sha256-NSOGq3rN+9X4WA8Q0gMbZ9spO/dbZkzeo4zEno/Kgcs=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    libxslt
+    pkg-config
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    at-spi2-core
+    dbus
+    dbus-glib
+    docbook_xsl
+    glib
+    gtk3
+    harfbuzz
+    libXdmcp
+    libXtst
+    libepoxy
+    libpthreadstubs
+    libselinux
+    libsepol
+    libtasn1
+    libxkbcommon
+    p11-kit
+    pcre2
+    util-linuxMinimal
+    vte
+    xmlto
+  ];
+
+  passthru.tests.test = nixosTests.terminal-emulators.roxterm;
+
+  meta = {
+    homepage = "https://github.com/realh/roxterm";
+    description = " A highly configurable terminal emulator";
+    longDescription = ''
+      ROXTerm is a terminal emulator intended to provide similar features to
+      gnome-terminal, based on the same VTE library. It was originally designed
+      to have a smaller footprint and quicker start-up time by not using the
+      Gnome libraries and by using a separate applet to provide the
+      configuration GUI, but thanks to all the features it's acquired over the
+      years ROXTerm can probably now be accused of bloat. However, it is more
+      configurable than gnome-terminal and aimed more at "power" users who make
+      heavy use of terminals.
+
+      It still supports the ROX desktop application layout it was named after,
+      but can also be installed in a more conventional manner for use in other
+      desktop environments.
+    '';
+    changelog = "https://github.com/realh/roxterm/blob/${finalAttrs.src.rev}/debian/changelog";
+    license = with lib.licenses; [ gpl2Plus gpl3Plus lgpl3Plus ];
+    mainProgram = "roxterm";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/sw/swayosd/package.nix
+++ b/pkgs/by-name/sw/swayosd/package.nix
@ -18,19 +18,19 @@

 stdenv.mkDerivation rec {
  pname = "swayosd";
-  version = "unstable-2023-07-18";
+  version = "unstable-2023-09-26";

  src = fetchFromGitHub {
    owner = "ErikReider";
    repo = "SwayOSD";
-    rev = "b14c83889c7860c174276d05dec6554169a681d9";
-    hash = "sha256-MJuTwEI599Y7q+0u0DMxRYaXsZfpksc2csgnK9Ghp/E=";
+    rev = "1c7d2f5b3ee262f25bdd3c899eadf17efb656d26";
+    hash = "sha256-Y22O6Ktya/WIhidnoyxnZu5YvXWNmSS6vecDU8zDD34=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-pExpzQwuHREhgkj+eZ8drBVsh/B3WiQBBh906O6ymFw=";
+    hash = "sha256-tqbMlygX+n14oR1t+0ngjiSG2mHUk/NbiWHk4yEAb2o=";
  };

  nativeBuildInputs = [
@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
    description = "A GTK based on screen display for keyboard shortcuts";
    homepage = "https://github.com/ErikReider/SwayOSD";
    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ aleksana ];
+    maintainers = with maintainers; [ aleksana barab-i ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/by-name/sw/swayosd/swayosd_systemd_paths.patch
+++ b/pkgs/by-name/sw/swayosd/swayosd_systemd_paths.patch
@ -2,13 +2,6 @@ diff --git a/data/meson.build b/data/meson.build
 index fc687a5..68decdf 100644
 --- a/data/meson.build
 +++ b/data/meson.build
-@@ -1,5 +1,6 @@
- datadir = get_option('datadir')
- sysconfdir = get_option('sysconfdir')
-+libdir = get_option('libdir')
- 
- # LICENSE
- install_data(
@@ -41,11 +42,7 @@ configure_file(
 
 # Systemd service unit
--- a/pkgs/by-name/tr/trealla/package.nix
+++ b/pkgs/by-name/tr/trealla/package.nix
@ -17,13 +17,13 @@
 assert lib.elem lineEditingLibrary [ "isocline" "readline" ];
 stdenv.mkDerivation (finalAttrs: {
  pname = "trealla";
-  version = "2.31.6";
+  version = "2.32.13";

  src = fetchFromGitHub {
    owner = "trealla-prolog";
    repo = "trealla";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-gptWmATDwcSOUE5YYLEi6r/gVIVk0+nCeynxhD1ra/c=";
+    hash = "sha256-Meyy6muzJt/Lg76sa+nwZXCOhfeMTwO4VYTXO/o20XI=";
  };

  postPatch = ''
--- a/pkgs/by-name/ux/uxn/package.nix
+++ b/pkgs/by-name/ux/uxn/package.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "uxn";
-  version = "unstable-2023-12-05";
+  version = "unstable-2023-12-25";

  src = fetchFromSourcehut {
    owner = "~rabbits";
    repo = "uxn";
-    rev = "14bf95ba390f9cb84c23ed084b69787efe253e06";
-    hash = "sha256-oQAt9jDO0FZm6+6bBt/nDimkbiKsvuhsxnFcsNWvop8=";
+    rev = "3f252c0ee378933856b9b01be1b3c7da58cacad5";
+    hash = "sha256-DcKZ0LMm9Q1rC+//9jEygitVG+UuXeDXcgSZDOueExc=";
  };

  outputs = [ "out" "projects" ];
--- a/pkgs/by-name/vc/vcpkg-tool/package.nix
+++ b/pkgs/by-name/vc/vcpkg-tool/package.nix
@ -18,13 +18,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "vcpkg-tool";
-  version = "2023-10-18";
+  version = "2023-12-12";

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = "vcpkg-tool";
    rev = finalAttrs.version;
-    hash = "sha256-Hm+GSKov9A6tmN10BHOTVy8aWkLOJNBMOQJNm4HnWuI=";
+    hash = "sha256-Ol31TDY3cLEzXQk8YpK2Lf3CEnM5RkJqdcm/OQGUetE=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/vi/vinegar/package.nix
+++ b/pkgs/by-name/vi/vinegar/package.nix
@ -1,19 +1,21 @@
-{
-  lib,
-  buildGoModule,
-  fetchFromGitHub,
-  makeBinaryWrapper,
-  pkg-config,
-  libGL,
-  libxkbcommon,
-  xorg,
-  wineWowPackages,
-  fetchpatch,
-}: let
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, makeBinaryWrapper
+, pkg-config
+, libGL
+, libxkbcommon
+, xorg
+, wayland
+, vulkan-headers
+, wineWowPackages
+, fetchpatch
+}:
+let
  # wine-staging doesn't support overrideAttrs for now
  wine = wineWowPackages.stagingFull.overrideDerivation (oldAttrs: {
    patches =
-      (oldAttrs.patches or [])
+      (oldAttrs.patches or [ ])
      ++ [
        # upstream issue: https://bugs.winehq.org/show_bug.cgi?id=55604
        # Here are the currently applied patches for Roblox to run under WINE:
@ -25,46 +27,46 @@
      ];
  });
 in
-  buildGoModule rec {
-    pname = "vinegar";
-    version = "1.5.9";
+buildGoModule rec {
+  pname = "vinegar";
+  version = "1.6.0";

-    src = fetchFromGitHub {
-      owner = "vinegarhq";
-      repo = "vinegar";
-      rev = "v${version}";
-      hash = "sha256-cLzQnNmQYyAIdTGygk/CNU/mxGgcgoFTg5G/0DNwpz4=";
-    };
+  src = fetchFromGitHub {
+    owner = "vinegarhq";
+    repo = "vinegar";
+    rev = "v${version}";
+    hash = "sha256-TebRAqMPrXSSKg05iX3Y/S0uACePOR/QNnNcOOMw+Xk=";
+  };

-    vendorHash = "sha256-DZI4APnrldnwOmLZ9ucFBGQDxzPXTIi44eLu74WrSBI=";
+  vendorHash = "sha256-Ex6PRd3rD2jbLXlY36koNvZF3P+gAZTE9hExIfOw9CE=";

-    nativeBuildInputs = [pkg-config makeBinaryWrapper];
-    buildInputs = [libGL libxkbcommon xorg.libX11 xorg.libXcursor xorg.libXfixes wine];
+  nativeBuildInputs = [ pkg-config makeBinaryWrapper ];
+  buildInputs = [ libGL libxkbcommon xorg.libX11 xorg.libXcursor xorg.libXfixes wayland vulkan-headers wine ];

-    buildPhase = ''
-      runHook preBuild
-      make PREFIX=$out
-      runHook postBuild
-    '';
+  buildPhase = ''
+    runHook preBuild
+    make PREFIX=$out
+    runHook postBuild
+  '';

-    installPhase = ''
-      runHook preInstall
-      make PREFIX=$out install
-      runHook postInstall
-    '';
+  installPhase = ''
+    runHook preInstall
+    make PREFIX=$out install
+    runHook postInstall
+  '';

-    postInstall = ''
-      wrapProgram $out/bin/vinegar \
-        --prefix PATH : ${lib.makeBinPath [wine]}
-    '';
+  postInstall = ''
+    wrapProgram $out/bin/vinegar \
+      --prefix PATH : ${lib.makeBinPath [wine]}
+  '';

-    meta = with lib; {
-      description = "An open-source, minimal, configurable, fast bootstrapper for running Roblox on Linux";
-      homepage = "https://github.com/vinegarhq/vinegar";
-      changelog = "https://github.com/vinegarhq/vinegar/releases/tag/v${version}";
-      mainProgram = "vinegar";
-      license = licenses.gpl3Only;
-      platforms = ["x86_64-linux" "i686-linux"];
-      maintainers = with maintainers; [nyanbinary];
-    };
-  }
+  meta = with lib; {
+    description = "An open-source, minimal, configurable, fast bootstrapper for running Roblox on Linux";
+    homepage = "https://github.com/vinegarhq/vinegar";
+    changelog = "https://github.com/vinegarhq/vinegar/releases/tag/v${version}";
+    mainProgram = "vinegar";
+    license = licenses.gpl3Only;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ nyanbinary ];
+  };
+}
--- a/pkgs/applications/emulators/commanderx16/emulator.nix
+++ b/pkgs/applications/emulators/commanderx16/emulator.nix
@ -2,18 +2,19 @@
 , stdenv
 , fetchFromGitHub
 , SDL2
+, callPackage
 , zlib
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "x16-emulator";
-  version = "44";
+  version = "46";

  src = fetchFromGitHub {
    owner = "X16Community";
    repo = "x16-emulator";
    rev = "r${finalAttrs.version}";
-    hash = "sha256-NDtfbhqGldxtvWQf/t6UnMRjI2DR7JYKbm2KFAMZhHY=";
+    hash = "sha256-cYr6s69eua1hCFqNkcomZDK9akxBqMTIaGqOl/YX2kc=";
  };

  postPatch = ''
@ -41,6 +42,11 @@ stdenv.mkDerivation (finalAttrs: {
    # upstream project recommends emulator and rom to be synchronized; passing
    # through the version is useful to ensure this
    inherit (finalAttrs) version;
+    emulator = finalAttrs.finalPackage;
+    rom = callPackage ./rom.nix { };
+    run = (callPackage ./run.nix { }){
+      inherit (finalAttrs.finalPackage) emulator rom;
+    };
  };

  meta = {
--- a/pkgs/applications/emulators/commanderx16/rom.nix
+++ b/pkgs/applications/emulators/commanderx16/rom.nix
@ -2,22 +2,24 @@
 , stdenv
 , fetchFromGitHub
 , cc65
+, lzsa
 , python3
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "x16-rom";
-  version = "44";
+  version = "46";

  src = fetchFromGitHub {
    owner = "X16Community";
    repo = "x16-rom";
    rev = "r${finalAttrs.version}";
-    hash = "sha256-x/U+8e869mkWZKmCiW2fZKGB9un2cFXNclemwxbAjLQ=";
+    hash = "sha256-PcLHIT84NbH+ejq8SY/UN+TYtRFWtqQBHwHqToFUol8=";
  };

  nativeBuildInputs = [
    cc65
+    lzsa
    python3
  ];

--- a/pkgs/applications/emulators/commanderx16/run.nix
+++ b/pkgs/applications/emulators/commanderx16/run.nix
@ -35,3 +35,4 @@ symlinkJoin {
 # 1. Parse the command line in order to allow the user to set an optional
 # rom-file
 # 2. generate runScript based on symlinkJoin (maybe a postBuild?)
+# 3. a NixOS module to abstract the runner
--- a/pkgs/data/themes/colloid-kde/default.nix
+++ b/pkgs/data/themes/colloid-kde/default.nix
@ -18,13 +18,7 @@ stdenvNoCC.mkDerivation rec {
    hash = "sha256-AYH9fW20/p+mq6lxR1lcCV1BQ/kgcsjHncpMvYWXnWA=";
  };

-  # Propagate sddm theme dependencies to user env otherwise sddm does
-  # not find them. Putting them in buildInputs is not enough.
-  propagatedUserEnvPkgs = [
-    kdeclarative.bin
-    plasma-framework
-    plasma-workspace
-  ];
+  outputs = [ "out" "sddm" ];

  postPatch = ''
    patchShebangs install.sh
@ -34,12 +28,12 @@ stdenvNoCC.mkDerivation rec {
      --replace '$HOME/.config' $out/share

    substituteInPlace sddm/install.sh \
-      --replace /usr $out \
+      --replace /usr $sddm \
      --replace '$(cd $(dirname $0) && pwd)' . \
      --replace '"$UID" -eq "$ROOT_UID"' true

    substituteInPlace sddm/Colloid/Main.qml \
-      --replace /usr $out
+      --replace /usr $sddm
  '';

  installPhase = ''
@ -50,13 +44,23 @@ stdenvNoCC.mkDerivation rec {
    name= HOME="$TMPDIR" \
    ./install.sh --dest $out/share/themes

-    mkdir -p $out/share/sddm/themes
+    mkdir -p $sddm/share/sddm/themes
    cd sddm
    source install.sh

    runHook postInstall
  '';

+  postFixup = ''
+    # Propagate sddm theme dependencies to user env otherwise sddm
+    # does not find them. Putting them in buildInputs is not enough.
+
+    mkdir -p $sddm/nix-support
+
+    printWords ${kdeclarative.bin} ${plasma-framework} ${plasma-workspace} \
+      >> $sddm/nix-support/propagated-user-env-packages
+  '';
+
  passthru.updateScript = gitUpdater { };

  meta = with lib; {
--- a/pkgs/desktops/enlightenment/efl/default.nix
+++ b/pkgs/desktops/enlightenment/efl/default.nix
@ -58,11 +58,11 @@

 stdenv.mkDerivation rec {
  pname = "efl";
-  version = "1.26.3";
+  version = "1.27.0";

  src = fetchurl {
    url = "http://download.enlightenment.org/rel/libs/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-2fg6oP2TNPRN7rTklS3A5RRGg6+seG/uvOYDCVFhfRU=";
+    sha256 = "sha256-PfuZ+8wmjAvHl+L4PoxQPvneZihPQLOBu1l6CBhcAPQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/enlightenment/enlightenment/default.nix
+++ b/pkgs/desktops/enlightenment/enlightenment/default.nix
@ -22,11 +22,11 @@

 stdenv.mkDerivation rec {
  pname = "enlightenment";
-  version = "0.25.4";
+  version = "0.26.0";

  src = fetchurl {
    url = "https://download.enlightenment.org/rel/apps/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-VttdIGuCG5qIMdJucT5BCscLIlWm9D/N98Ae794jt6I=";
+    sha256 = "sha256-EbbvBnG+X+rWiL9VTDCiocaDSTrRDF/jEV/7RlVCToQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/lomiri/services/hfd-service/default.nix
+++ b/pkgs/desktops/lomiri/services/hfd-service/default.nix
@ -31,10 +31,11 @@ stdenv.mkDerivation (finalAttrs: {

    # Queries pkg-config via pkg_get_variable, can't override prefix
    substituteInPlace init/CMakeLists.txt \
-      --replace "\''${SYSTEMD_SYSTEM_DIR}" "$out/lib/systemd/system"
+      --replace 'pkg_get_variable(SYSTEMD_SYSTEM_DIR systemd systemdsystemunitdir)' 'set(SYSTEMD_SYSTEM_DIR ''${CMAKE_INSTALL_PREFIX}/lib/systemd/system)'
    substituteInPlace CMakeLists.txt \
-      --replace 'pkg_get_variable(AS_INTERFACES_DIR accountsservice interfacesdir)' 'set(AS_INTERFACES_DIR "''${CMAKE_INSTALL_DATADIR}/accountsservice/interfaces")' \
-      --replace 'DESTINATION ''${DBUS_INTERFACES_DIR}' 'DESTINATION ${placeholder "out"}/''${DBUS_INTERFACES_DIR}'
+      --replace 'pkg_get_variable(AS_INTERFACES_DIR accountsservice interfacesdir)' 'set(AS_INTERFACES_DIR "''${CMAKE_INSTALL_FULL_DATADIR}/accountsservice/interfaces")' \
+      --replace '../../dbus-1/interfaces' "\''${CMAKE_INSTALL_PREFIX}/\''${DBUS_INTERFACES_DIR}" \
+      --replace 'DESTINATION ''${DBUS_INTERFACES_DIR}' 'DESTINATION ''${CMAKE_INSTALL_PREFIX}/''${DBUS_INTERFACES_DIR}'
    substituteInPlace src/CMakeLists.txt \
      --replace "\''${DBUS_INTERFACES_DIR}/org.freedesktop.Accounts.xml" '${accountsservice}/share/dbus-1/interfaces/org.freedesktop.Accounts.xml'
  '';
--- a/pkgs/desktops/xfce/core/thunar/default.nix
+++ b/pkgs/desktops/xfce/core/thunar/default.nix
@ -21,9 +21,9 @@
 let unwrapped = mkXfceDerivation {
  category = "xfce";
  pname = "thunar";
-  version = "4.18.9";
+  version = "4.18.10";

-  sha256 = "sha256-FiJAxELdt/1g5ThTBshTSFK54f9Ncqhn/C+rWQ+zrig=";
+  sha256 = "sha256-jne+jETPmM6VksdwJAxruji/GKH42iftWm74Ok9qX44=";

  nativeBuildInputs = [
    docbook_xsl
--- a/pkgs/development/compilers/dotnet/default.nix
+++ b/pkgs/development/compilers/dotnet/default.nix
@ -5,7 +5,7 @@ dotnetCombined = with dotnetCorePackages; combinePackages [ sdk_6_0 aspnetcore_7
 Hashes and urls are retrieved from:
 https://dotnet.microsoft.com/download/dotnet
 */
-{ callPackage }:
+{ lib, config, callPackage }:
 let
  buildDotnet = attrs: callPackage (import ./build-dotnet.nix attrs) {};
  buildAttrs = {
@ -35,7 +35,7 @@ in
  inherit systemToDotnetRid;

  combinePackages = attrs: callPackage (import ./combine-packages.nix attrs) {};
-
+} // lib.optionalAttrs config.allowAliases {
  # EOL
  sdk_2_1 = throw "Dotnet SDK 2.1 is EOL, please use 6.0 (LTS) or 7.0 (Current)";
  sdk_2_2 = throw "Dotnet SDK 2.2 is EOL, please use 6.0 (LTS) or 7.0 (Current)";
--- a/pkgs/development/hare-third-party/hare-ev/default.nix
+++ b/pkgs/development/hare-third-party/hare-ev/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation {
  pname = "hare-ev";
-  version = "unstable-2023-10-31";
+  version = "unstable-2023-12-04";

  src = fetchFromSourcehut {
    owner = "~sircmpwn";
    repo = "hare-ev";
-    rev = "9bdbd02401334b7d762131a46e64ca2cd24846dc";
-    hash = "sha256-VY8nsy5kLDMScA2ig3Rgbkf6VQlCTnGWjzGvsI9OcaQ=";
+    rev = "e3c3f7613c602672ac41a3e47c106a5bd27a2378";
+    hash = "sha256-TQsR2lXJfkPu53WpJy/K+Jruyfw8mCkEIE9DbFQoS+s=";
  };

  nativeCheckInputs = [
--- a/Show More
+++ b/Show More