Merge master into staging-next

2024-05-06 00:02:18 +00:00 · 2024-05-06 00:02:18 +00:00 · ce0d85be7c
commit ce0d85be7c
parent 3dbf904108 48705e5f4d
70 changed files with 8809 additions and 321 deletions
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -133,7 +133,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - [mautrix-meta](https://github.com/mautrix/meta), a Matrix <-> Facebook and Matrix <-> Instagram hybrid puppeting/relaybot bridge. Available as services.mautrix-meta

- [Jottacloud Command-line Tool](https://docs.jottacloud.com/en/articles/1436834-jottacloud-command-line-tool), a CLI for the [Jottacloud](https://jottacloud.com/) cloud storage provider. Available as [user.services.jotta-cli](#opt-user.services.jotta-cli.enable).
+- [Jottacloud Command-line Tool](https://docs.jottacloud.com/en/articles/1436834-jottacloud-command-line-tool), a CLI for the [Jottacloud](https://jottacloud.com/) cloud storage provider. Available as [services.jotta-cli](#opt-services.jotta-cli.enable).

 - [transfer-sh](https://github.com/dutchcoders/transfer.sh), a tool that supports easy and fast file sharing from the command-line. Available as [services.transfer-sh](#opt-services.transfer-sh.enable).

--- a/nixos/modules/services/desktop-managers/plasma6.nix
+++ b/nixos/modules/services/desktop-managers/plasma6.nix
@ -286,6 +286,15 @@ in {
      kde-smartcard = lib.mkIf config.security.pam.p11.enable { p11Auth = true; };
    };

+    security.wrappers = {
+      kwin_wayland = {
+        owner = "root";
+        group = "root";
+        capabilities = "cap_sys_nice+ep";
+        source = "${lib.getBin pkgs.kdePackages.kwin}/bin/kwin_wayland";
+      };
+    };
+
    programs.dconf.enable = true;

    programs.firefox.nativeMessagingHosts.packages = [kdePackages.plasma-browser-integration];
--- a/nixos/modules/services/networking/jotta-cli.md
+++ b/nixos/modules/services/networking/jotta-cli.md
@ -6,7 +6,7 @@ The [Jottacloud Command-line Tool](https://docs.jottacloud.com/en/articles/14368

 ```nix
 {
-  user.services.jotta-cli.enable = true;
+  services.jotta-cli.enable = true;
 }
 ```

@ -15,7 +15,7 @@ This adds `jotta-cli` to `environment.systemPackages` and starts a user service
 ## Example Configuration {#module-services-jotta-cli-example-configuration}

 ```nix
-user.services.jotta-cli = {
+services.jotta-cli = {
  enable = true;
  options = [ "slow" ];
  package = pkgs.jotta-cli;
--- a/nixos/modules/services/networking/jotta-cli.nix
+++ b/nixos/modules/services/networking/jotta-cli.nix
@ -2,10 +2,10 @@

 with lib;

-let cfg = config.user.services.jotta-cli;
+let cfg = config.services.jotta-cli;
 in {
  options = {
-    user.services.jotta-cli = {
+    services.jotta-cli = {

      enable = mkEnableOption "Jottacloud Command-line Tool";

--- a/nixos/modules/services/networking/sunshine.nix
+++ b/nixos/modules/services/networking/sunshine.nix
@ -1,6 +1,6 @@
 { config, lib, pkgs, utils, ... }:
 let
-  inherit (lib) mkEnableOption mkPackageOption mkOption mkIf mkDefault types optionals getExe;
+  inherit (lib) mkEnableOption mkPackageOption mkOption literalExpression mkIf mkDefault types optionals getExe;
  inherit (utils) escapeSystemdExecArgs;
  cfg = config.services.sunshine;

@ -46,7 +46,7 @@ in

        See https://docs.lizardbyte.dev/projects/sunshine/en/latest/about/advanced_usage.html#configuration for syntax.
      '';
-      example = ''
+      example = literalExpression ''
        {
          sunshine_name = "nixos";
        }
@ -67,7 +67,7 @@ in
      description = ''
        Configuration for applications to be exposed to Moonlight. If this is set, no configuration is possible from the web UI, and must be by the `settings` option.
      '';
-      example = ''
+      example = literalExpression ''
        {
          env = {
            PATH = "$(PATH):$(HOME)/.local/bin";
--- a/nixos/modules/services/system/dbus.nix
+++ b/nixos/modules/services/system/dbus.nix
@ -147,6 +147,10 @@ in
      };

      systemd.services.dbus = {
+        aliases = [
+          # hack aiding to prevent dbus from restarting when switching from dbus-broker back to dbus
+          "dbus-broker.service"
+        ];
        # Don't restart dbus-daemon. Bad things tend to happen if we do.
        reloadIfChanged = true;
        restartTriggers = [
@ -158,6 +162,10 @@ in
      };

      systemd.user.services.dbus = {
+        aliases = [
+          # hack aiding to prevent dbus from restarting when switching from dbus-broker back to dbus
+          "dbus-broker.service"
+        ];
        # Don't restart dbus-daemon. Bad things tend to happen if we do.
        reloadIfChanged = true;
        restartTriggers = [
@ -184,6 +192,8 @@ in
      # https://github.com/NixOS/nixpkgs/issues/108643
      systemd.services.dbus-broker = {
        aliases = [
+          # allow other services to just depend on dbus,
+          # but also a hack aiding to prevent dbus from restarting when switching from dbus-broker back to dbus
          "dbus.service"
        ];
        unitConfig = {
@ -203,6 +213,8 @@ in

      systemd.user.services.dbus-broker = {
        aliases = [
+          # allow other services to just depend on dbus,
+          # but also a hack aiding to prevent dbus from restarting when switching from dbus-broker back to dbus
          "dbus.service"
        ];
        # Don't restart dbus. Bad things tend to happen if we do.
--- a/nixos/modules/system/activation/switch-to-configuration.pl
+++ b/nixos/modules/system/activation/switch-to-configuration.pl
@ -472,6 +472,9 @@ sub handle_modified_unit { ## no critic(Subroutines::ProhibitManyArgs, Subroutin
            $units_to_reload->{$unit} = 1;
            record_unit($reload_list_file, $unit);
        }
+        elsif ($unit eq "dbus.service" || $unit eq "dbus-broker.service") {
+            # dbus service should only ever be reloaded, not started/stoped/restarted as that would break the system.
+        }
        elsif (!parse_systemd_bool(\%new_unit_info, "Service", "X-RestartIfChanged", 1) || parse_systemd_bool(\%new_unit_info, "Unit", "RefuseManualStop", 0) || parse_systemd_bool(\%new_unit_info, "Unit", "X-OnlyManualStart", 0)) {
            $units_to_skip->{$unit} = 1;
        } else {
--- a/nixos/tests/jotta-cli.nix
+++ b/nixos/tests/jotta-cli.nix
@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
  meta.maintainers = with pkgs.lib.maintainers; [ evenbrenden ];

  nodes.machine = { pkgs, ... }: {
-    user.services.jotta-cli.enable = true;
+    services.jotta-cli.enable = true;
    imports = [ ./common/user-account.nix ];
  };

--- a/pkgs/applications/audio/soundsource/default.nix
+++ b/pkgs/applications/audio/soundsource/default.nix
@ -5,11 +5,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "soundsource";
-  version = "5.6.0";
+  version = "5.6.3";

  src = fetchurl {
-    url = "https://web.archive.org/web/20230707140658/https://rogueamoeba.com/soundsource/download/SoundSource.zip";
-    sha256 = "1avm1jr75mjbps0fad3glshrwl42vnhc0f9sak038ny85f3apyi0";
+    url = "https://web.archive.org/web/20240505002011/https://rogueamoeba.com/soundsource/download/SoundSource.zip";
+    sha256 = "sha256-uXQw4MEV4hkrd7tjNCxtuXpbfmdW8bilI5ZmXwn9BLM=";
  };
  dontUnpack = true;

--- a/pkgs/applications/emulators/craftos-pc/default.nix
+++ b/pkgs/applications/emulators/craftos-pc/default.nix
@ -3,6 +3,7 @@
 , fetchFromGitHub
 , callPackage
 , patchelf
+, unzip
 , poco
 , openssl
 , SDL2
@ -40,7 +41,9 @@ stdenv.mkDerivation rec {
    hash = "sha256-ozebHgUgwdqYtWAyL+EdwpjEvZC+PkWcLYCPWz2FjSw=";
  };

-  buildInputs = [ patchelf poco openssl SDL2 SDL2_mixer ncurses libpng pngpp libwebp ];
+  nativeBuildInputs = [ patchelf unzip ];
+  buildInputs = [ poco openssl SDL2 SDL2_mixer ncurses libpng pngpp libwebp ];
+  strictDeps = true;

  preBuild = ''
    cp -R ${craftos2-lua}/* ./craftos2-lua/
@ -63,6 +66,17 @@ stdenv.mkDerivation rec {
    patchelf --replace-needed craftos2-lua/src/liblua.so liblua.so $out/bin/craftos
    cp -R api $out/include/CraftOS-PC
    cp -R ${craftos2-rom}/* $out/share/craftos
+
+    mkdir -p resources/linux-icons
+    unzip resources/linux-icons.zip -d resources/linux-icons
+    for dim in 16 24 32 48 64 96 128 256 1024; do
+      dir="$out/share/icons/hicolor/$dimx$dim/apps"
+      mkdir -p "$dir"
+      cp "resources/linux-icons/$dim.png" "$dir/craftos.png"
+    done
+
+    mkdir -p $out/share/applications
+    cp resources/linux-icons/CraftOS-PC.desktop $out/share/applications/CraftOS-PC.desktop
  '';

  passthru.tests = {
--- a/pkgs/applications/misc/font-manager/default.nix
+++ b/pkgs/applications/misc/font-manager/default.nix
@ -16,6 +16,7 @@
 , gtk3
 , gnome
 , desktop-file-utils
+, fetchpatch2
 , wrapGAppsHook3
 , gobject-introspection
 # withWebkit enables the "webkit" feature, also known as Google Fonts
@ -33,6 +34,16 @@ stdenv.mkDerivation rec {
    hash = "sha256-M13Q9d2cKhc0tudkvw0zgqPAFTlmXwK+LltXeuDPWxo=";
  };

+  patches = [
+    # see https://github.com/FontManager/font-manager/issues/355
+    # should be removed on next release
+    (fetchpatch2 {
+      name = "fix-build-with-newer-vala.patch";
+      url = "https://github.com/FontManager/font-manager/commit/600f498946c3904064b4e4fdf96e5841f6a827e4.patch";
+      hash = "sha256-DC9+pvG88t+PPdGQ2oemeEYK9PaD0C2yWBYYCh4Wn9g=";
+    })
+  ];
+
  nativeBuildInputs = [
    pkg-config
    meson
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/generic.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/generic.nix
@ -57,7 +57,8 @@
 let
  inherit (stdenv) targetPlatform;
  ARCH = if targetPlatform.isAarch64 then "arm64" else "x64";
-in stdenv.mkDerivation rec {
+in
+stdenv.mkDerivation rec {
  inherit pname version;

  # Please backport all updates to the stable channel.
@ -155,10 +156,9 @@ in stdenv.mkDerivation rec {
      --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
    )

-    # Fix the desktop link and fix showing application icon in tray
+    # Fix the desktop link
    substituteInPlace $out/share/applications/${pname}.desktop \
-      --replace "/opt/${dir}/${pname}" $out/bin/${pname} \
-      ${if pname == "signal-desktop" then "--replace \"bin/signal-desktop\" \"bin/signal-desktop --use-tray-icon\"" else ""}
+      --replace "/opt/${dir}/${pname}" $out/bin/${pname}

    # Note: The following path contains bundled libraries:
    # $out/lib/${dir}/resources/app.asar.unpacked/node_modules/
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
@ -2,7 +2,7 @@
 callPackage ./generic.nix { } rec {
  pname = "signal-desktop";
  dir = "Signal";
-  version = "7.6.0";
+  version = "7.7.0";
  url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-  hash = "sha256-sGOWsFZTO9VQDkCqhsOkW5aY+sh0fLH7kPPe/bAzGvg=";
+  hash = "sha256-UESpbYZ4oRhhQF8GYrbKnNkqmefCfTE1jfCCK7ctIKk=";
 }
--- a/pkgs/applications/version-management/commitizen/default.nix
+++ b/pkgs/applications/version-management/commitizen/default.nix
@ -11,7 +11,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "commitizen";
-  version = "3.24.0";
+  version = "3.25.0";
  format = "pyproject";

  disabled = python3.pythonOlder "3.8";
@ -20,7 +20,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "commitizen-tools";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-kGrXy2V5yFv7MQUKjmE89tRnG+3b73GPVHqGZ3XO0nY=";
+    hash = "sha256-9vaQO0KBL4RgWS8mNSZlnpm1qH+l5TjCa5JndQ1Q36Q=";
  };

  pythonRelaxDeps = [
--- a/pkgs/applications/version-management/git-cliff/default.nix
+++ b/pkgs/applications/version-management/git-cliff/default.nix
@ -32,5 +32,6 @@ rustPlatform.buildRustPackage rec {
    changelog = "https://github.com/orhun/git-cliff/blob/v${version}/CHANGELOG.md";
    license = licenses.gpl3Only;
    maintainers = with maintainers; [ siraben ];
+    mainProgram = "git-cliff";
  };
 }
--- a/pkgs/applications/video/mpv/scripts/default.nix
+++ b/pkgs/applications/video/mpv/scripts/default.nix
@ -99,6 +99,7 @@ let
      convert = callPackage ./convert.nix { };
      cutter = callPackage ./cutter.nix { };
      dynamic-crop = callPackage ./dynamic-crop.nix { };
+      evafast = callPackage ./evafast.nix { };
      inhibit-gnome = callPackage ./inhibit-gnome.nix { };
      memo = callPackage ./memo.nix { };
      manga-reader = callPackage ./manga-reader.nix { };
--- a/pkgs/applications/video/mpv/scripts/evafast.nix
+++ b/pkgs/applications/video/mpv/scripts/evafast.nix
@ -0,0 +1,27 @@
+{
+  fetchFromGitHub,
+  buildLua,
+  lib,
+  unstableGitUpdater,
+}:
+
+buildLua {
+  pname = "evafast";
+  version = "0-unstable-2024-02-09";
+
+  src = fetchFromGitHub {
+    owner = "po5";
+    repo = "evafast";
+    rev = "92af3e2e1c756ce83f9d0129c780caeef1131a0b";
+    hash = "sha256-BGWD2XwVu8zOSiDJ+9oWi8aPN2Wkw0Y0gF58X4f+tdI=";
+  };
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = with lib; {
+    description = "Seeking and hybrid fastforwarding like VHS";
+    homepage = "https://github.com/po5/evafast";
+    license = licenses.unfree; # no license; see https://github.com/po5/evafast/issues/15
+    maintainers = with lib.maintainers; [ purrpurrn ];
+  };
+}
--- a/pkgs/by-name/do/docfd/package.nix
+++ b/pkgs/by-name/do/docfd/package.nix
@ -1,15 +1,16 @@
-{ lib
-, ocamlPackages
-, stdenv
-, overrideSDK
-, fetchFromGitHub
-, python3
-, dune_3
-, makeWrapper
-, pandoc
-, poppler_utils
-, testers
-, docfd
+{
+  lib,
+  ocamlPackages,
+  stdenv,
+  overrideSDK,
+  fetchFromGitHub,
+  python3,
+  dune_3,
+  makeWrapper,
+  pandoc,
+  poppler_utils,
+  testers,
+  docfd,
 }:

 let
@ -20,7 +21,7 @@ let
 in
 buildDunePackage' rec {
  pname = "docfd";
-  version = "4.0.0";
+  version = "5.1.0";

  minimalOCamlVersion = "5.1";

@ -28,10 +29,15 @@ buildDunePackage' rec {
    owner = "darrenldl";
    repo = "docfd";
    rev = version;
-    hash = "sha256-fgwUXRZ6k5i3XLxXpjbrl0TJZMT+NkGXf7KNwRgi+q8=";
+    hash = "sha256-54gsX5C8AJAOkqnBxHLI76k6cEqWqEydxbZjJZl7FjE=";
  };

-  nativeBuildInputs = [ python3 dune_3 makeWrapper ];
+  nativeBuildInputs = [
+    python3
+    dune_3
+    makeWrapper
+  ];
+
  buildInputs = with ocamlPackages; [
    cmdliner
    containers-data
@ -43,18 +49,24 @@ buildDunePackage' rec {
    notty
    ocolor
    oseq
+    ppx_deriving
+    ppxlib
+    re
    spelll
    timedesc
    yojson
  ];

  postInstall = ''
-    wrapProgram $out/bin/docfd --prefix PATH : "${lib.makeBinPath [ pandoc poppler_utils ]}"
+    wrapProgram $out/bin/docfd --prefix PATH : "${
+      lib.makeBinPath [
+        pandoc
+        poppler_utils
+      ]
+    }"
  '';

-  passthru.tests.version = testers.testVersion {
-    package = docfd;
-  };
+  passthru.tests.version = testers.testVersion { package = docfd; };

  meta = with lib; {
    description = "TUI multiline fuzzy document finder";
--- a/pkgs/by-name/gi/gickup/package.nix
+++ b/pkgs/by-name/gi/gickup/package.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "gickup";
-  version = "0.10.29";
+  version = "0.10.30";

  src = fetchFromGitHub {
    owner = "cooperspencer";
    repo = "gickup";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Y03SdmO/GJx1gans58IW/Q9N7spRswvjyNbzYLdkD80=";
+    hash = "sha256-knnc4FAzGk1hV/Pzoc+klm4dt1cFrn4BYZx1lY7iLp8=";
  };

  vendorHash = "sha256-XxDsEmi945CduurQRsH7rjFAEu/SMX3rSd63Dwq2r8A=";
--- a/pkgs/by-name/gr/grafana-kiosk/package.nix
+++ b/pkgs/by-name/gr/grafana-kiosk/package.nix
@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, chromium, makeWrapper }:

 buildGoModule rec {
  pname = "grafana-kiosk";
@ -13,6 +13,11 @@ buildGoModule rec {

  vendorHash = "sha256-sXaxyPNuHDUOkYcWYm94YvJmr1mGe4HdzttWrNSK2Pw=";

+  nativeBuildInputs = [ makeWrapper ];
+  postFixup = ''
+    wrapProgram $out/bin/grafana-kiosk --prefix PATH : ${lib.makeBinPath [ chromium ]}
+  '';
+
  meta = with lib; {
    description = "Kiosk Utility for Grafana";
    homepage = "https://github.com/grafana/grafana-kiosk";
--- a/pkgs/by-name/ko/kotlin-interactive-shell/package.nix
+++ b/pkgs/by-name/ko/kotlin-interactive-shell/package.nix
@ -0,0 +1,45 @@
+{ lib, maven, fetchFromGitHub, makeWrapper, jre }:
+
+maven.buildMavenPackage rec {
+  pname = "kotlin-interactive-shell";
+  version = "0.5.2";
+
+  src = fetchFromGitHub {
+    owner = "Kotlin";
+    repo = "kotlin-interactive-shell";
+    rev = "v${version}";
+    hash = "sha256-3DTyo7rPswpEVzFkcprT6FD+ITGJ+qCXFKXEGoCK+oE=";
+  };
+
+  mvnHash = "sha256-m1o0m0foqJhEzWjC9behBeld5HT08WClcZN2xc3fZrI=";
+  mvnParameters = "-DskipTests compile";
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{bin,lib}
+    cp lib/ki-shell.jar $out/lib/ki-shell.jar
+    makeWrapper ${lib.getExe jre} $out/bin/ki \
+      --add-flags "-jar $out/lib/ki-shell.jar"
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Kotlin Language Interactive Shell";
+    longDescription = ''
+      The shell is an extensible implementation of Kotlin REPL with a rich set of features including:
+      - Syntax highlight
+      - Type inference command
+      - Downloading dependencies in runtime using Maven coordinates
+      - List declared symbols
+    '';
+    homepage = "https://github.com/Kotlin/kotlin-interactive-shell";
+    license = licenses.asl20;
+    maintainers = [ maintainers.starsep ];
+    platforms = jre.meta.platforms;
+    mainProgram = "ki";
+  };
+}
--- a/pkgs/by-name/la/labelle/package.nix
+++ b/pkgs/by-name/la/labelle/package.nix
@ -8,14 +8,14 @@
 }:
 python3Packages.buildPythonApplication rec {
  pname = "labelle";
-  version = "1.2.0";
+  version = "1.2.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "labelle-org";
    repo = "labelle";
-    rev = "v${version}";
-    hash = "sha256-fLlYqJs/V5t8IdfVkfBsjtjM1rRdCyTYF87G+h1VU5Y=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-Im1mZ9kJB+0uPAmEXpUWoOYBooejes05vTGLDqPCAN4=";
  };

  postPatch = ''
--- a/pkgs/by-name/pr/pretalx/package.nix
+++ b/pkgs/by-name/pr/pretalx/package.nix
@ -85,10 +85,16 @@ python.pkgs.buildPythonApplication rec {
  ]);

  pythonRelaxDeps = [
+    "celery"
+    "css-inline"
    "cssutils"
    "django-csp"
    "django-filter"
+    "django-hierarkey"
+    "markdown"
+    "pillow"
    "python-dateutil"
+    "reportlab"
  ];

  propagatedBuildInputs = with python.pkgs; [
--- a/pkgs/by-name/pr/pretix/package.nix
+++ b/pkgs/by-name/pr/pretix/package.nix
@ -29,13 +29,13 @@ let
  };

  pname = "pretix";
-  version = "2024.3.0";
+  version = "2024.4.0";

  src = fetchFromGitHub {
    owner = "pretix";
    repo = "pretix";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Wz1vZcqgwyS0xJgTtRxqfaJpJ1fAMhIyxvTvBT/ABSo=";
+    hash = "sha256-+F5EOMMkO1ngGeFscDipwbldsY0AhOUKbjqgNpuph4g=";
  };

  npmDeps = buildNpmPackage {
@ -43,7 +43,7 @@ let
    inherit version src;

    sourceRoot = "${src.name}/src/pretix/static/npm_dir";
-    npmDepsHash = "sha256-2fHlEEmYzpF3SyvF7+FbwCt+zQVGF0/kslDFnJ+DQGE=";
+    npmDepsHash = "sha256-0Q/BCRHlnyQJlCF3PgIP9q3Qyr/ff+GP0lPIwPsIMSU=";

    dontBuild = true;

@ -81,16 +81,15 @@ python.pkgs.buildPythonApplication rec {
      --replace-fail psycopg2-binary psycopg2 \
      --replace-fail vat_moss_forked==2020.3.20.0.11.0 vat-moss \
      --replace-fail "bleach==5.0.*" bleach \
+      --replace-fail "django-hierarkey==1.1.*" django-hierarkey \
+      --replace-fail "djangorestframework==3.15.*" djangorestframework \
      --replace-fail "dnspython==2.6.*" dnspython \
-      --replace-fail "django-countries==7.5.*" django-countries \
-      --replace-fail "django-filter==24.1" django-filter \
      --replace-fail "importlib_metadata==7.*" importlib_metadata \
      --replace-fail "markdown==3.6" markdown \
      --replace-fail "protobuf==5.26.*" protobuf \
      --replace-fail "pycryptodome==3.20.*" pycryptodome \
      --replace-fail "pypdf==3.9.*" pypdf \
      --replace-fail "python-dateutil==2.9.*" python-dateutil \
-      --replace-fail "sentry-sdk==1.42.*" sentry-sdk \
      --replace-fail "stripe==7.9.*" stripe
  '';

@ -175,6 +174,7 @@ python.pkgs.buildPythonApplication rec {
    text-unidecode
    tlds
    tqdm
+    ua-parser
    vat-moss
    vobject
    webauthn
--- a/pkgs/by-name/si/siyuan/package-lock.json
+++ b/pkgs/by-name/si/siyuan/package-lock.json
--- a/pkgs/by-name/si/siyuan/package.nix
+++ b/pkgs/by-name/si/siyuan/package.nix
@ -0,0 +1,100 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+  buildNpmPackage,
+  substituteAll,
+  pandoc,
+  electron,
+}:
+
+buildNpmPackage rec {
+  pname = "siyuan";
+  version = "3.0.11";
+
+  src = fetchFromGitHub {
+    owner = "siyuan-note";
+    repo = "siyuan";
+    rev = "v${version}";
+    hash = "sha256-s82g5os944us85V2TBnm+HNd37vVzNjaOJYrbBrgLSI=";
+  };
+
+  kernel = buildGoModule {
+    name = "${pname}-${version}-kernel";
+    inherit src;
+    sourceRoot = "${src.name}/kernel";
+    vendorHash = "sha256-onZBrw0fDsjqXgQF06C40ArxNmsbFDIwD57fJ0jB0ls=";
+
+    patches = [
+      (substituteAll {
+        src = ./set-pandoc-path.patch;
+        pandoc_path = lib.getExe pandoc;
+      })
+    ];
+
+    # this patch makes it so that file permissions are not kept when copying files using the gulu package
+    # this fixes a problem where it was copying files from the store and keeping their permissions
+    # hopefully this doesn't break other functionality
+    modPostBuild = ''
+      chmod +w vendor/github.com/88250/gulu
+      substituteInPlace vendor/github.com/88250/gulu/file.go \
+          --replace-fail "os.Chmod(dest, sourceinfo.Mode())" "os.Chmod(dest, 0644)"
+    '';
+  };
+
+  sourceRoot = "${src.name}/app";
+
+  postPatch = ''
+    ln -s ${./package-lock.json} package-lock.json
+    # for some reason the default page is broken, use the redirection link automatically
+    substituteInPlace electron/main.js \
+        --replace-fail ' "/stage/build/app/index.html?v=" + new Date().getTime()' '"/stage/build/desktop"'
+  '';
+
+  npmDepsHash = "sha256-Yv/iOCyry3CNeKPxS206Y5y5mvzPU873PJdi0UQkVLs=";
+
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+
+  npmBuildScript = "build:desktop";
+
+  postBuild = ''
+    substituteInPlace electron-builder-linux.yml \
+        --replace-fail '- target: "AppImage"' "" \
+        --replace-fail '- target: "tar.gz"' '- target: "dir"'
+
+    # add extra fields to resolve the electron provided by nixpkgs
+    sed -e 1i'electronDist: ${electron}/libexec/electron' \
+        -e 1i'electronVersion: ${electron.version}' \
+        -i electron-builder-linux.yml
+
+    npm run dist-linux
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/siyuan
+    cp -r build/*-unpacked/{locales,resources{,.pak}} $out/share/siyuan
+
+    mkdir $out/share/siyuan/resources/kernel
+    ln -s ${kernel}/bin/kernel $out/share/siyuan/resources/kernel/SiYuan-Kernel
+
+    makeWrapper ${lib.getExe electron} $out/bin/siyuan \
+        --chdir $out/share/siyuan/resources \
+        --add-flags $out/share/siyuan/resources/app \
+        --set ELECTRON_FORCE_IS_PACKAGED 1 \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+        --inherit-argv0
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A privacy-first personal knowledge management system that supports complete offline usage, as well as end-to-end encrypted data sync";
+    homepage = "https://b3log.org/siyuan/";
+    license = lib.licenses.agpl3Plus;
+    mainProgram = "siyuan";
+    maintainers = with lib.maintainers; [ tomasajt ];
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/by-name/si/siyuan/set-pandoc-path.patch
+++ b/pkgs/by-name/si/siyuan/set-pandoc-path.patch
@ -0,0 +1,13 @@
+diff --git a/util/pandoc.go b/util/pandoc.go
+index 5dbc58d..5f32644 100644
+--- a/util/pandoc.go
+++ b/util/pandoc.go
+@@ -97,6 +97,8 @@ var (
+ )
+ 
+ func InitPandoc() {
+    PandocBinPath = "@pandoc_path@"
+    return
+ 	if ContainerStd != Container {
+ 		return
+ 	}
--- a/pkgs/by-name/ve/vencord/package-lock.json
+++ b/pkgs/by-name/ve/vencord/package-lock.json
@ -1,12 +1,12 @@
 {
    "name": "vencord",
-    "version": "1.7.9",
+    "version": "1.8.0",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
        "": {
            "name": "vencord",
-            "version": "1.7.9",
+            "version": "1.8.0",
            "license": "GPL-3.0-or-later",
            "dependencies": {
                "@sapphi-red/web-noise-suppressor": "0.3.3",
@ -68,21 +68,21 @@
            }
        },
        "node_modules/@babel/helper-validator-identifier": {
-            "version": "7.22.20",
-            "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.22.20.tgz",
-            "integrity": "sha512-Y4OZ+ytlatR8AI+8KZfKuL5urKp7qey08ha31L8b3BwewJAoJamTzyvxPR/5D+KkdJCGPq/+8TukHBlY10FX9A==",
+            "version": "7.24.5",
+            "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.24.5.tgz",
+            "integrity": "sha512-3q93SSKX2TWCG30M2G2kwaKeTYgEUp5Snjuj8qm729SObL6nbtUldAi37qbxkD5gg3xnBio+f9nqpSepGZMvxA==",
            "dev": true,
            "engines": {
                "node": ">=6.9.0"
            }
        },
        "node_modules/@babel/highlight": {
-            "version": "7.24.2",
-            "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.24.2.tgz",
-            "integrity": "sha512-Yac1ao4flkTxTteCDZLEvdxg2fZfz1v8M4QpaGypq/WPDqg3ijHYbDfs+LG5hvzSoqaSZ9/Z9lKSP3CjZjv+pA==",
+            "version": "7.24.5",
+            "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.24.5.tgz",
+            "integrity": "sha512-8lLmua6AVh/8SLJRRVD6V8p73Hir9w5mJrhE+IPpILG31KKlI9iz5zmBYKcWPS59qSfgP9RaSBQSHHE81WKuEw==",
            "dev": true,
            "dependencies": {
-                "@babel/helper-validator-identifier": "^7.22.20",
+                "@babel/helper-validator-identifier": "^7.24.5",
                "chalk": "^2.4.2",
                "js-tokens": "^4.0.0",
                "picocolors": "^1.0.0"
@ -163,9 +163,9 @@
            }
        },
        "node_modules/@csstools/css-parser-algorithms": {
-            "version": "2.6.1",
-            "resolved": "https://registry.npmjs.org/@csstools/css-parser-algorithms/-/css-parser-algorithms-2.6.1.tgz",
-            "integrity": "sha512-ubEkAaTfVZa+WwGhs5jbo5Xfqpeaybr/RvWzvFxRs4jfq16wH8l8Ty/QEEpINxll4xhuGfdMbipRyz5QZh9+FA==",
+            "version": "2.6.3",
+            "resolved": "https://registry.npmjs.org/@csstools/css-parser-algorithms/-/css-parser-algorithms-2.6.3.tgz",
+            "integrity": "sha512-xI/tL2zxzEbESvnSxwFgwvy5HS00oCXxL4MLs6HUiDcYfwowsoQaABKxUElp1ARITrINzBnsECOc1q0eg2GOrA==",
            "dev": true,
            "funding": [
                {
@ -181,13 +181,13 @@
                "node": "^14 || ^16 || >=18"
            },
            "peerDependencies": {
-                "@csstools/css-tokenizer": "^2.2.4"
+                "@csstools/css-tokenizer": "^2.3.1"
            }
        },
        "node_modules/@csstools/css-tokenizer": {
-            "version": "2.2.4",
-            "resolved": "https://registry.npmjs.org/@csstools/css-tokenizer/-/css-tokenizer-2.2.4.tgz",
-            "integrity": "sha512-PuWRAewQLbDhGeTvFuq2oClaSCKPIBmHyIobCV39JHRYN0byDcUWJl5baPeNUcqrjtdMNqFooE0FGl31I3JOqw==",
+            "version": "2.3.1",
+            "resolved": "https://registry.npmjs.org/@csstools/css-tokenizer/-/css-tokenizer-2.3.1.tgz",
+            "integrity": "sha512-iMNHTyxLbBlWIfGtabT157LH9DUx9X8+Y3oymFEuMj8HNc+rpE3dPFGFgHjpKfjeFDjLjYIAIhXPGvS2lKxL9g==",
            "dev": true,
            "funding": [
                {
@ -204,9 +204,9 @@
            }
        },
        "node_modules/@csstools/media-query-list-parser": {
-            "version": "2.1.9",
-            "resolved": "https://registry.npmjs.org/@csstools/media-query-list-parser/-/media-query-list-parser-2.1.9.tgz",
-            "integrity": "sha512-qqGuFfbn4rUmyOB0u8CVISIp5FfJ5GAR3mBrZ9/TKndHakdnm6pY0L/fbLcpPnrzwCyyTEZl1nUcXAYHEWneTA==",
+            "version": "2.1.11",
+            "resolved": "https://registry.npmjs.org/@csstools/media-query-list-parser/-/media-query-list-parser-2.1.11.tgz",
+            "integrity": "sha512-uox5MVhvNHqitPP+SynrB1o8oPxPMt2JLgp5ghJOWf54WGQ5OKu47efne49r1SWqs3wRP8xSWjnO9MBKxhB1dA==",
            "dev": true,
            "funding": [
                {
@ -222,8 +222,8 @@
                "node": "^14 || ^16 || >=18"
            },
            "peerDependencies": {
-                "@csstools/css-parser-algorithms": "^2.6.1",
-                "@csstools/css-tokenizer": "^2.2.4"
+                "@csstools/css-parser-algorithms": "^2.6.3",
+                "@csstools/css-tokenizer": "^2.3.1"
            }
        },
        "node_modules/@csstools/selector-specificity": {
@ -803,9 +803,9 @@
            "dev": true
        },
        "node_modules/@types/lodash": {
-            "version": "4.17.0",
-            "resolved": "https://registry.npmjs.org/@types/lodash/-/lodash-4.17.0.tgz",
-            "integrity": "sha512-t7dhREVv6dbNj0q17X12j7yDG4bD/DHYX7o5/DbDxobP0HnGPgpRz2Ej77aL7TZT3DSw13fqUTj8J4mMnqa7WA==",
+            "version": "4.17.1",
+            "resolved": "https://registry.npmjs.org/@types/lodash/-/lodash-4.17.1.tgz",
+            "integrity": "sha512-X+2qazGS3jxLAIz5JDXDzglAF3KpijdhFxlf/V1+hEsOUc+HnWi81L/uv/EvGuV90WY+7mPGFCUDGfQC3Gj95Q==",
            "dev": true
        },
        "node_modules/@types/minimist": {
@ -4967,15 +4967,15 @@
            }
        },
        "node_modules/table/node_modules/ajv": {
-            "version": "8.12.0",
-            "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.12.0.tgz",
-            "integrity": "sha512-sRu1kpcO9yLtYxBKvqfTeh9KzZEwO3STyX1HT+4CaDzC6HpTGYhIhPIzj9XuKU7KYDwnaeh5hcOwjy1QuJzBPA==",
+            "version": "8.13.0",
+            "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.13.0.tgz",
+            "integrity": "sha512-PRA911Blj99jR5RMeTunVbNXMF6Lp4vZXnk5GQjcnUWUTsrXtekg/pnmFFI2u/I36Y/2bITGS30GZCXei6uNkA==",
            "dev": true,
            "dependencies": {
-                "fast-deep-equal": "^3.1.1",
+                "fast-deep-equal": "^3.1.3",
                "json-schema-traverse": "^1.0.0",
                "require-from-string": "^2.0.2",
-                "uri-js": "^4.2.2"
+                "uri-js": "^4.4.1"
            },
            "funding": {
                "type": "github",
--- a/pkgs/by-name/ve/vencord/package.nix
+++ b/pkgs/by-name/ve/vencord/package.nix
@ -5,8 +5,8 @@
 , buildWebExtension ? false
 }:
 let
-  version = "1.7.9";
-  gitHash = "d294128";
+  version = "1.8.0";
+  gitHash = "51729c8";
 in
 buildNpmPackage rec {
  pname = "vencord";
@ -16,7 +16,7 @@ buildNpmPackage rec {
    owner = "Vendicated";
    repo = "Vencord";
    rev = "v${version}";
-    hash = "sha256-iXcWz/ZqhCQnqS37LVTXYW+1eeos0AUA0O5URb2FELU=";
+    hash = "sha256-IE0QV16O3zg8YIu0T8iLYW75ARjlZn0S5P6PLc9S/Rc=";
  };

  ESBUILD_BINARY_PATH = lib.getExe (esbuild.overrideAttrs (final: _: {
@ -34,7 +34,7 @@ buildNpmPackage rec {
  npmRebuildFlags = [ "|| true" ];

  makeCacheWritable = true;
-  npmDepsHash = "sha256-G3adLiSrEyAShTsNEaYLEPYACHoXTISiNp/9jru0mUc=";
+  npmDepsHash = "sha256-0Ujs3jnq/jJPd5kI28QOXKsesc6W2rEndDHBvxotAO4=";
  npmFlags = [ "--legacy-peer-deps" ];
  npmBuildScript = if buildWebExtension then "buildWeb" else "build";
  npmBuildFlags = [ "--" "--standalone" "--disable-updater" ];
--- a/pkgs/data/fonts/iosevka/default.nix
+++ b/pkgs/data/fonts/iosevka/default.nix
@ -55,16 +55,16 @@ assert (extraParameters != null) -> set != null;

 buildNpmPackage rec {
  pname = "Iosevka${toString set}";
-  version = "29.2.1";
+  version = "30.0.0";

  src = fetchFromGitHub {
    owner = "be5invis";
    repo = "iosevka";
    rev = "v${version}";
-    hash = "sha256-WWumGi6+jaQUGi1eArS9l3G8sOQL4ZetixVB5RWDPQ4=";
+    hash = "sha256-V+oRmrqeIdYDaHmX7zCt7+So9tHOsJbqF0cBhCoctSU=";
  };

-  npmDepsHash = "sha256-Gm3R8lWmYbLOfyGW+f8CYXlodp11vMCMAhagILxLKFA=";
+  npmDepsHash = "sha256-vRk7yUL+st/1kwNItLhypF22A8YuOG7e3vfoZwB0+oo=";

  nativeBuildInputs = [
    remarshal
--- a/pkgs/data/themes/catppuccin-gtk/default.nix
+++ b/pkgs/data/themes/catppuccin-gtk/default.nix
@ -29,13 +29,13 @@ lib.checkListOfEnum "${pname}: tweaks" validTweaks tweaks

 stdenvNoCC.mkDerivation rec {
  inherit pname;
-  version = "0.7.3";
+  version = "0.7.4";

  src = fetchFromGitHub {
    owner = "catppuccin";
    repo = "gtk";
    rev = "v${version}";
-    hash = "sha256-pGL8vaE63ss2ZT2FoNDfDkeuCxjcbl02RmwwfHC/Vxg=";
+    hash = "sha256-RFhahwiBTsjeRW71JkAveOHO70O6SbTZhUEvq8oMQ4Y=";
  };

  nativeBuildInputs = [ gtk3 sassc ];
--- a/pkgs/development/compilers/llvm/common/lldb.nix
+++ b/pkgs/development/compilers/llvm/common/lldb.nix
@ -50,9 +50,7 @@ stdenv.mkDerivation (rec {
  src = src';
  inherit patches;

-  # LLDB expects to find the path to `bin` relative to `lib` on Darwin. It can’t be patched with the location of
-  # the `lib` output because that would create a cycle between it and the `out` output.
-  outputs = [ "out" "dev" ] ++ lib.optionals (!stdenv.isDarwin) [ "lib" ];
+  outputs = [ "out" "lib" "dev" ];

  sourceRoot = lib.optional (lib.versionAtLeast release_version "13") "${src.name}/${pname}";

--- a/pkgs/development/libraries/libdigidocpp/default.nix
+++ b/pkgs/development/libraries/libdigidocpp/default.nix
@ -2,12 +2,12 @@
 , xercesc, xml-security-c, pkg-config, xsd, zlib, xalanc, xxd }:

 stdenv.mkDerivation rec {
-  version = "3.16.0";
+  version = "3.17.1";
  pname = "libdigidocpp";

  src = fetchurl {
     url = "https://github.com/open-eid/libdigidocpp/releases/download/v${version}/libdigidocpp-${version}.tar.gz";
-     hash = "sha256-XgObeVQJ2X7hNIelGK55RTtkKvU6D+RkLMc24/PZCzY=";
+     hash = "sha256-3qDsIAOiWMZDj2zLE+Os7BoeCPeC4JQ6p8jSBd7PdV0=";
  };

  nativeBuildInputs = [ cmake pkg-config xxd ];
--- a/pkgs/development/libraries/qtkeychain/default.nix
+++ b/pkgs/development/libraries/qtkeychain/default.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "qtkeychain";
-  version = "0.14.2";
+  version = "0.14.3";

  src = fetchFromGitHub {
    owner = "frankosterfeld";
    repo = "qtkeychain";
    rev = version;
-    sha256 = "sha256-aRBhg4RwK2jUQWW/OmzNSMUScaFUPdbWbApD37CXPoI=";
+    sha256 = "sha256-+1WX3ARH+jWeDiaJnX+ZlRMj+l3qvgBwcGKjB9QEJNI=";
  };

  dontWrapQtApps = true;
--- a/pkgs/development/python-modules/css-inline/Cargo.lock
+++ b/pkgs/development/python-modules/css-inline/Cargo.lock
@ -52,9 +52,9 @@ dependencies = [

 [[package]]
 name = "autocfg"
-version = "1.2.0"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1fdabc7756949593fe60f30ec81974b613357de856987752631dea1e3394c80"
+checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"

 [[package]]
 name = "backtrace"
@ -73,15 +73,9 @@ dependencies = [

 [[package]]
 name = "base64"
-version = "0.22.0"
+version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9475866fec1451be56a3c2400fd081ff546538961565ccb5b7142cbd22bc7a51"
-
-[[package]]
-name = "bitflags"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"

 [[package]]
 name = "bitflags"
@ -131,9 +125,9 @@ dependencies = [

 [[package]]
 name = "cc"
-version = "1.0.94"
+version = "1.0.96"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17f6e324229dc011159fcc089755d1e2e216a90d43a7dea6853ca740b84f35e7"
+checksum = "065a29261d53ba54260972629f9ca6bffa69bac13cd1fed61420f7fa68b9f8bd"

 [[package]]
 name = "cfg-if"
@ -186,7 +180,7 @@ checksum = "248e3bacc7dc6baa3b21e405ee045c3047101a49145e7e9eca583ab4c2ca5345"

 [[package]]
 name = "css-inline"
-version = "0.14.0"
+version = "0.14.1"
 dependencies = [
 "cssparser",
 "html5ever",
@ -201,7 +195,7 @@ dependencies = [

 [[package]]
 name = "css-inline-python"
-version = "0.14.0"
+version = "0.14.1"
 dependencies = [
 "built",
 "css-inline",
@ -375,9 +369,9 @@ checksum = "4271d37baee1b8c7e4b708028c57d816cf9d2434acb33a549475f78c181f6253"

 [[package]]
 name = "hashbrown"
-version = "0.14.3"
+version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "290f1a1d9242c78d09ce40a5e87e7554ee637af1351968159f4952f028f75604"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
 dependencies = [
 "ahash",
 "allocator-api2",
@ -577,15 +571,15 @@ dependencies = [

 [[package]]
 name = "libc"
-version = "0.2.153"
+version = "0.2.154"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd"
+checksum = "ae743338b92ff9146ce83992f766a31066a91a8c84a45e0e9f21e7cf6de6d346"

 [[package]]
 name = "lock_api"
-version = "0.4.11"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c168f8615b12bc01f9c17e2eb0cc07dcae1940121185446edc3744920e8ef45"
+checksum = "07af8b9cdd281b7915f413fa73f29ebd5d55d0d3f0155584dade1ff18cea1b17"
 dependencies = [
 "autocfg",
 "scopeguard",
@ -614,9 +608,9 @@ checksum = "c41e0c4fef86961ac6d6f8a82609f55f31b05e4fce149ac5710e439df7619ba4"

 [[package]]
 name = "markup5ever"
-version = "0.12.0"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7940b09815a02810a42b9e1bc41c069880a87de68e9b1dcbe754a3ba3b47c20"
+checksum = "16ce3abbeba692c8b8441d036ef91aea6df8da2c6b6e21c7e14d3c18e526be45"
 dependencies = [
 "log",
 "phf 0.11.2",
@ -675,9 +669,9 @@ checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"

 [[package]]
 name = "num-traits"
-version = "0.2.18"
+version = "0.2.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da0df0e5185db44f69b44f26786fe401b6c293d1907744beaa7fa62b2e5a517a"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
 dependencies = [
 "autocfg",
 ]
@ -709,9 +703,9 @@ checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"

 [[package]]
 name = "parking_lot"
-version = "0.12.1"
+version = "0.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3742b2c103b9f06bc9fff0a37ff4912935851bee6d36f3c02bcc755bcfec228f"
+checksum = "7e4af0ca4f6caed20e900d564c242b8e5d4903fdacf31d3daf527b66fe6f42fb"
 dependencies = [
 "lock_api",
 "parking_lot_core",
@ -719,15 +713,15 @@ dependencies = [

 [[package]]
 name = "parking_lot_core"
-version = "0.9.9"
+version = "0.9.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c42a9226546d68acdd9c0a280d17ce19bfe27a46bf68784e4066115788d008e"
+checksum = "1e401f977ab385c9e4e3ab30627d6f26d00e2c73eef317493c4ec6d468726cf8"
 dependencies = [
 "cfg-if",
 "libc",
 "redox_syscall",
 "smallvec",
- "windows-targets 0.48.5",
+ "windows-targets 0.52.5",
 ]

 [[package]]
@ -915,9 +909,9 @@ dependencies = [

 [[package]]
 name = "pyo3-built"
-version = "0.4.7"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be6d574e0f8cab2cdd1eeeb640cbf845c974519fa9e9b62fa9c08ecece0ca5de"
+checksum = "35ee655adc94166665a1d714b439e27857dd199b947076891d6a17d32d396cde"

 [[package]]
 name = "pyo3-ffi"
@ -1015,18 +1009,18 @@ dependencies = [

 [[package]]
 name = "redox_syscall"
-version = "0.4.1"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa"
+checksum = "469052894dcb553421e483e4209ee581a45100d31b4018de03e5a7ad86374a7e"
 dependencies = [
- "bitflags 1.3.2",
+ "bitflags",
 ]

 [[package]]
 name = "reqwest"
-version = "0.12.3"
+version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e6cc1e89e689536eb5aeede61520e874df5a4707df811cd5da4aa5fbb2aae19"
+checksum = "566cafdd92868e0939d3fb961bd0dc25fcfaaed179291093b3d43e6b3150ea10"
 dependencies = [
 "base64",
 "bytes",
@ -1093,9 +1087,9 @@ checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"

 [[package]]
 name = "rustls"
-version = "0.22.3"
+version = "0.22.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99008d7ad0bbbea527ec27bddbc0e432c5b87d8175178cee68d2eec9c4a1813c"
+checksum = "bf4ef73721ac7bcd79b2b315da7779d8fc09718c6b3d2d1b2d94850eb8c18432"
 dependencies = [
 "log",
 "ring",
@ -1117,15 +1111,15 @@ dependencies = [

 [[package]]
 name = "rustls-pki-types"
-version = "1.4.1"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ecd36cc4259e3e4514335c4a138c6b43171a8d61d8f5c9348f9fc7529416f247"
+checksum = "beb461507cee2c2ff151784c52762cf4d9ff6a61f3e80968600ed24fa837fa54"

 [[package]]
 name = "rustls-webpki"
-version = "0.102.2"
+version = "0.102.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "faaa0a62740bedb9b2ef5afa303da42764c012f743917351dc9a237ea1663610"
+checksum = "f3bce581c0dd41bce533ce695a1437fa16a7ab5ac3ccfa99fe1a620a7885eabf"
 dependencies = [
 "ring",
 "rustls-pki-types",
@ -1150,7 +1144,7 @@ version = "0.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4eb30575f3638fc8f6815f448d50cb1a2e255b0897985c8c59f4d37b72a07b06"
 dependencies = [
- "bitflags 2.5.0",
+ "bitflags",
 "cssparser",
 "derive_more",
 "fxhash",
@ -1174,18 +1168,18 @@ dependencies = [

 [[package]]
 name = "serde"
-version = "1.0.198"
+version = "1.0.200"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9846a40c979031340571da2545a4e5b7c4163bdae79b301d5f86d03979451fcc"
+checksum = "ddc6f9cc94d67c0e21aaf7eda3a010fd3af78ebf6e096aa6e2e13c79749cce4f"
 dependencies = [
 "serde_derive",
 ]

 [[package]]
 name = "serde_derive"
-version = "1.0.198"
+version = "1.0.200"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e88edab869b01783ba905e7d0153f9fc1a6505a96e4ad3018011eedb838566d9"
+checksum = "856f046b9400cee3c8c94ed572ecdb752444c24528c035cd35882aad6f492bcb"
 dependencies = [
 "proc-macro2",
 "quote",
@ -1256,9 +1250,9 @@ checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"

 [[package]]
 name = "socket2"
-version = "0.5.6"
+version = "0.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05ffd9c0a93b7543e062e759284fcf5f5e3b098501104bfbdde4d404db792871"
+checksum = "ce305eb0b4296696835b71df73eb912e0f1ffd2556a501fcede6e0c50349191c"
 dependencies = [
 "libc",
 "windows-sys 0.52.0",
@ -1808,18 +1802,18 @@ dependencies = [

 [[package]]
 name = "zerocopy"
-version = "0.7.32"
+version = "0.7.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74d4d3961e53fa4c9a25a8637fc2bfaf2595b3d3ae34875568a5cf64787716be"
+checksum = "087eca3c1eaf8c47b94d02790dd086cd594b912d2043d4de4bfdd466b3befb7c"
 dependencies = [
 "zerocopy-derive",
 ]

 [[package]]
 name = "zerocopy-derive"
-version = "0.7.32"
+version = "0.7.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ce1b18ccd8e73a9321186f97e46f9f04b778851177567b1975109d26a08d2a6"
+checksum = "6f4b6c273f496d8fd4eaf18853e6b448760225dc030ff2c485a786859aea6393"
 dependencies = [
 "proc-macro2",
 "quote",
--- a/pkgs/development/python-modules/css-inline/default.nix
+++ b/pkgs/development/python-modules/css-inline/default.nix
@ -18,14 +18,14 @@

 buildPythonPackage rec {
  pname = "css-inline";
-  version = "0.14.0";
+  version = "0.14.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Stranger6667";
    repo = "css-inline";
    rev = "python-v${version}";
-    hash = "sha256-CdR90GGPWOerXWfVeHrFLAelL+MJ9bfoB4TjKBdRSL0=";
+    hash = "sha256-+hX05y+ii2/wAbcc3SPK3ns4slUKFGqHURb3Z08yhVw=";
  };

  postPatch = ''
@ -42,7 +42,7 @@ buildPythonPackage rec {
      ln -s ${./Cargo.lock} Cargo.lock
    '';
    name = "${pname}-${version}";
-    hash = "sha256-/GO7OcUl0iFgEhr8ZWZQOTNqHn7bt38PpFs0HktmAhE=";
+    hash = "sha256-ogzj8JxiFX2VWEeEnKACycd2Bud9VUpLuF4h35eUls0=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/django-extensions/default.nix
+++ b/pkgs/development/python-modules/django-extensions/default.nix
@ -1,13 +1,21 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonAtLeast
+
+# build-system
+, setuptools
+
+# dependencies
 , django
+
+# tests
 , factory-boy
 , mock
 , pip
 , pygments
-, pytest-django
 , pytestCheckHook
+, pytest-django
 , shortuuid
 , vobject
 , werkzeug
@ -16,7 +24,11 @@
 buildPythonPackage rec {
  pname = "django-extensions";
  version = "3.2.3";
-  format = "setuptools";
+  pyproject = true;
+
+  # https://github.com/django-extensions/django-extensions/issues/1831
+  # Requires asyncore, which was dropped in 3.12
+  disabled = pythonAtLeast "3.12";

  src = fetchFromGitHub {
    owner = pname;
@ -30,7 +42,11 @@ buildPythonPackage rec {
      --replace "--cov=django_extensions --cov-report html --cov-report term" ""
  '';

-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
    django
  ];

--- a/pkgs/development/python-modules/django-hierarkey/default.nix
+++ b/pkgs/development/python-modules/django-hierarkey/default.nix
@ -2,6 +2,9 @@
 , buildPythonPackage
 , fetchFromGitHub

+# build-system
+, setuptools
+
 # propagates
 , python-dateutil

@ -13,18 +16,21 @@

 buildPythonPackage rec {
  pname = "django-hierarkey";
-  version = "1.1.0";
-  format = "setuptools";
+  version = "1.2.0";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "raphaelm";
    repo = "django-hierarkey";
-    # https://github.com/raphaelm/django-hierarkey/commit/c81ace02ca404a8756e2931bb6faf55b6365e140
-    rev = "c81ace02ca404a8756e2931bb6faf55b6365e140";
-    hash = "sha256-sCARyTjuuAUptlOsFmApnsQpcksP+uYnq0lukXDMcuk=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-1LSH9GwoNF3NrDVNUIHDAVsktyKIprDgB5XlIHeM3fM=";
  };

-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
    python-dateutil
  ];

--- a/pkgs/development/python-modules/django-mysql/default.nix
+++ b/pkgs/development/python-modules/django-mysql/default.nix
@ -7,7 +7,6 @@

 # dependencies
 , django
-, mysqlclient

 # tests
 , pytest-django
@ -16,23 +15,22 @@

 buildPythonPackage rec {
  pname = "django-mysql";
-  version = "4.12.0";
+  version = "4.13.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "adamchainz";
    repo = "django-mysql";
    rev = "refs/tags/${version}";
-    hash = "sha256-AieI6zUPFXQsrvoms5bu/Bb3J+DvfLA4rCCsjhYBEZQ=";
+    hash = "sha256-hIvkLLv9R23u+JC6t/zwbMvmgLMstYp0ytuSqNiohJg=";
  };

-  nativeBuildInputs = [
+  build-system = [
    setuptools
  ];

-  buildInputs = [
+  dependencies = [
    django
-    mysqlclient
  ];

  doCheck = false; # requires mysql/mariadb server
@ -44,6 +42,10 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

+  pythonImportsCheck = [
+    "django_mysql"
+  ];
+
  meta = with lib; {
    changelog = "https://github.com/adamchainz/django-mysql/blob/${version}/docs/changelog.rst";
    description = "Extensions to Django for use with MySQL/MariaD";
--- a/pkgs/development/python-modules/django-otp/default.nix
+++ b/pkgs/development/python-modules/django-otp/default.nix
@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "django-otp";
-  version = "1.3.0post1";
+  version = "1.5.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "django-otp";
    repo = "django-otp";
    rev = "v${version}";
-    hash = "sha256-Q8YTCYERyoAXenSiDabxuxaWiD6ZeJKKKgaR/Rg3y20=";
+    hash = "sha256-c0Yr41S1LFBzcDIK2etOP3rYcCPaThDs+XGiw4WP/ks=";
  };

  build-system = [
--- a/pkgs/development/python-modules/django-statici18n/default.nix
+++ b/pkgs/development/python-modules/django-statici18n/default.nix
@ -16,15 +16,14 @@

 buildPythonPackage rec {
  pname = "django-statici18n";
-  version = "2.4.0";
+  version = "2.5.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "zyegfryed";
    repo = "django-statici18n";
-    # https://github.com/zyegfryed/django-statici18n/issues/59
-    rev = "9b83a8f0f2e625dd5f56d53cfe4e07aca9479ab6";
-    hash = "sha256-KrIlWmN7um9ad2avfANOza579bjYkxTo9F0UFpvLu3A=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-n6HqHcXvz2ihwN+gJr5P+/Yt4RpuOu2yAjo9fiNZB54=";
  };

  build-system = [
--- a/pkgs/development/python-modules/python-creole/default.nix
+++ b/pkgs/development/python-modules/python-creole/default.nix
@ -86,6 +86,15 @@ buildPythonPackage rec {
    "creole/tests/test_rest2html.py"
  ];

+  pytestFlagsArray = [
+    # fixture mismatch after docutils update
+    "--deselect=creole/rest_tools/clean_writer.py::creole.rest_tools.clean_writer.rest2html"
+    "--deselect=creole/tests/test_cross_compare_all.py::CrossCompareTests::test_link"
+    "--deselect=creole/tests/test_cross_compare_all.py::CrossCompareTests::test_link_with_at_sign"
+    "--deselect=creole/tests/test_cross_compare_all.py::CrossCompareTests::test_link_with_unknown_protocol"
+    "--deselect=creole/tests/test_cross_compare_all.py::CrossCompareTests::test_link_without_title"
+  ];
+
  meta = with lib; {
    description = "Creole markup tools written in Python";
    homepage = "https://github.com/jedie/python-creole";
--- a/pkgs/development/python-modules/webauthn/default.nix
+++ b/pkgs/development/python-modules/webauthn/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "webauthn";
-  version = "2.0.0";
+  version = "2.1.0";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "duo-labs";
    repo = "py_webauthn";
    rev = "refs/tags/v${version}";
-    hash = "sha256-StqoSrzErV13/OUpSWbI+6N5tSFPEpvnmQcDiZMaXPI=";
+    hash = "sha256-AfQ3lt0WvoThU5kCE7MzhAXwbqmNaCrUqOMWI937hO4=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/ydiff/default.nix
+++ b/pkgs/development/python-modules/ydiff/default.nix
@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, docutils, pygments
+{ lib, buildPythonPackage, fetchPypi, pygments
 , gitMinimal, mercurial, subversion, patchutils, less
 }:

@ -26,11 +26,11 @@ buildPythonPackage rec {
    patchShebangs tests/*.sh
  '';

-  nativeCheckInputs = [ docutils pygments ];
+  nativeCheckInputs = [ pygments ];

  checkPhase = ''
    runHook preCheck
-    make doc-check reg # We don't want the linter or coverage check.
+    make reg # We don't want the linter or coverage check.
    runHook postCheck
  '';

--- a/pkgs/development/tools/golangci-lint/default.nix
+++ b/pkgs/development/tools/golangci-lint/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "golangci-lint";
-  version = "1.57.2";
+  version = "1.58.0";

  src = fetchFromGitHub {
    owner = "golangci";
    repo = "golangci-lint";
    rev = "v${version}";
-    hash = "sha256-d3U56fRIyntj/uKTOHuKFvOZqh+6VtzYrbKDjcKzhbI=";
+    hash = "sha256-qG/H6/FePQFJdiSnf1zh5Pos9KjuicRJ3HzDM0QXPSE=";
  };

-  vendorHash = "sha256-3gS/F1jcjegtkLfmPcBzYqDA4KmwABkKpPAhTxqguYw=";
+  vendorHash = "sha256-bT8MUeLk7LgLlqk3aBqsVU139ZH4y1ZFsQ67Lxj4OBg=";

  subPackages = [ "cmd/golangci-lint" ];

--- a/pkgs/development/tools/heroku/default.nix
+++ b/pkgs/development/tools/heroku/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation {
  pname = "heroku";
-  version = "8.11.4";
+  version = "8.11.5";

  src = fetchzip {
-    url = "https://cli-assets.heroku.com/versions/8.11.4/501330b/heroku-v8.11.4-501330b-linux-x64.tar.xz";
-    hash = "sha256-Q8kXXsk2VGNLv4LyUqnN3Rapozac/jgkyhSnkBOcDmo=";
+    url = "https://cli-assets.heroku.com/versions/8.11.5/df5cd30/heroku-v8.11.5-df5cd30-linux-x64.tar.xz";
+    hash = "sha256-in6VuJmoItXGL85XqN1oItGPkUmDb4n+LzxE5q4ycYc=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/development/tools/misc/blackfire/default.nix
+++ b/pkgs/development/tools/misc/blackfire/default.nix
@ -10,7 +10,7 @@

 stdenv.mkDerivation rec {
  pname = "blackfire";
-  version = "2.26.4";
+  version = "2.27.0";

  src = passthru.sources.${stdenv.hostPlatform.system} or (throw "Unsupported platform for blackfire: ${stdenv.hostPlatform.system}");

@ -57,23 +57,23 @@ stdenv.mkDerivation rec {
    sources = {
      "x86_64-linux" = fetchurl {
        url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_amd64.deb";
-        sha256 = "czFzZ+Z2CYw0ETzsmimAMNKrpiIVufyguOYuZJu2L8s=";
+        sha256 = "4SFexvlmw6+ZI+cQAe9xIoeR43c8BG97v8A8oIB9fP4=";
      };
      "i686-linux" = fetchurl {
        url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_i386.deb";
-        sha256 = "I/7ZESjJjlRSvV41ldEtdymp7fwe0tCCFeS/oouOUi8=";
+        sha256 = "N34qScxL9JhqyUika2QIioW+dixxRMv9Y1Q0DaxIA80=";
      };
      "aarch64-linux" = fetchurl {
        url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_arm64.deb";
-        sha256 = "lJn9iRAPkLCpv+Vbk72a58DaNgNOTfyFiycyHosBiq4=";
+        sha256 = "rZ+n9mJAL7CZR91+PxHt7oNZAfZnQKAqDSaU8z4ahS4=";
      };
      "aarch64-darwin" = fetchurl {
        url = "https://packages.blackfire.io/blackfire/${version}/blackfire-darwin_arm64.pkg.tar.gz";
-        sha256 = "puvM/QB8nJgJaw1eDMJTb9aDrIdrqO3WVdDYWeayTAs=";
+        sha256 = "fHrgX6YFojEj+eD933WgR4DgIZmJupmHmdO3gHzQxSc=";
      };
      "x86_64-darwin" = fetchurl {
        url = "https://packages.blackfire.io/blackfire/${version}/blackfire-darwin_amd64.pkg.tar.gz";
-        sha256 = "srv99KyjxzEJNRA4hjoobSqzSab+Ox7g80tTun3G9KY=";
+        sha256 = "oxG/p946JettJZqEkmPWpfvLkLUg1FYA77hNdJ+jGfE=";
      };
    };

--- a/pkgs/development/tools/ruff/default.nix
+++ b/pkgs/development/tools/ruff/default.nix
@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "ruff";
-  version = "0.4.2";
+  version = "0.4.3";

  src = fetchFromGitHub {
    owner = "astral-sh";
    repo = "ruff";
    rev = "refs/tags/v${version}";
-    hash = "sha256-AnAJi0srzwxU/22Uy+OjaSBdAEjCXH99J7VDvI03HDU=";
+    hash = "sha256-kduKKaCeqwSnCOPPNlNI6413OAvYkEGM2o4wOMqLZmc=";
  };

-  cargoHash = "sha256-qMh2OvNYO4/0Gv/scE5/OWQMzLaetZY5DJFSeoLnISU=";
+  cargoHash = "sha256-XffMH5uCC8mKFs739BgTQItsJRYLeLm+1G9N0bTExdw=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/development/web/deno/default.nix
+++ b/pkgs/development/web/deno/default.nix
@ -13,16 +13,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "deno";
-  version = "1.42.4";
+  version = "1.43.1";

  src = fetchFromGitHub {
    owner = "denoland";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-O9R+i7hTKhRJ0UgjnylMOgQyDGqBeOUy7h3g/e1pTHM=";
+    hash = "sha256-Y/1c0b7CmT5jzgkRGzEnTNmUiLn5oDf5jTvzU2SU0RA=";
  };

-  cargoHash = "sha256-FsbmuOc+u8ZSu3lgS3oGTiwfWovQewuSPfL3HYKtwJk=";
+  cargoHash = "sha256-Hoe22bToJ+2nZeq9iy2XXwbXDEbfRjW1g3rhcT3Og04=";

  postPatch = ''
    # upstream uses lld on aarch64-darwin for faster builds
--- a/pkgs/development/web/deno/librusty_v8.nix
+++ b/pkgs/development/web/deno/librusty_v8.nix
@ -10,11 +10,11 @@ let
  };
 in
 fetch_librusty_v8 {
-  version = "0.90.1";
+  version = "0.91.0";
  shas = {
-    x86_64-linux = "sha256-lEGvxBY91cg4GOTUCoLnKeZOcKOl+sdASe/q+s3epkM=";
-    aarch64-linux = "sha256-Z9cR1cIBlAFcPghFIMHzW0JP8g5yioK2Vgk1/tGEO0s=";
-    x86_64-darwin = "sha256-F/r36lmeQeraotkjK7F7XapXmmMZRRCoD4b5wR0gpCY=";
-    aarch64-darwin = "sha256-pE2wGU8YYU4pQlc8oQRYsEx2b0MTkGAwVrn6xW22vrk=";
+    x86_64-linux = "sha256-xLQnHOUuZq24/LhXJ1PgspI/Mpip3XSLMVQE/nh4chE=";
+    aarch64-linux = "sha256-zt05idUKlyPuVk8+N219dTfhtlcObO+cBb41Z6TTwfs=";
+    x86_64-darwin = "sha256-AFEUZO3aKNy4rEk9Mi611cuduE5p5lkE23RzLOTPP4Q=";
+    aarch64-darwin = "sha256-fldGauOMYSwWWP/kF0Ifp5s20h6akbb5sI8iw1hj/6s=";
  };
 }
--- a/pkgs/kde/plasma/kwin/0001-Lower-CAP_SYS_NICE-from-the-ambient-set.patch
+++ b/pkgs/kde/plasma/kwin/0001-Lower-CAP_SYS_NICE-from-the-ambient-set.patch
@ -0,0 +1,40 @@
+From 232e480ab1303f37d37d295b57fdcbb6b6648bca Mon Sep 17 00:00:00 2001
+From: Alois Wohlschlager <alois1@gmx-topmail.de>
+Date: Sun, 7 Aug 2022 16:12:31 +0200
+Subject: [PATCH] Lower CAP_SYS_NICE from the ambient set
+
+The capabilities wrapper raises CAP_SYS_NICE into the ambient set so it
+is inherited by the wrapped program. However, we don't want it to leak
+into the entire desktop environment.
+
+Lower the capability again at startup so that the kernel will clear it
+on exec.
+---
+ src/main_wayland.cpp | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/main_wayland.cpp b/src/main_wayland.cpp
+index 1720e14e7..f2bb446b0 100644
+--- a/src/main_wayland.cpp
+++ b/src/main_wayland.cpp
+@@ -39,7 +39,9 @@
+ #include <QWindow>
+ #include <qplatformdefs.h>
+ 
+#include <linux/capability.h>
+ #include <sched.h>
+#include <sys/prctl.h>
+ #include <sys/resource.h>
+ 
+ #include <iomanip>
+@@ -285,6 +287,7 @@ static QString automaticBackendSelection()
+ 
+ int main(int argc, char *argv[])
+ {
+    prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_LOWER, CAP_SYS_NICE, 0, 0);
+     KWin::Application::setupMalloc();
+     KWin::Application::setupLocalizedString();
+     KWin::gainRealTime();
+-- 
+2.37.1
+
--- a/pkgs/kde/plasma/kwin/default.nix
+++ b/pkgs/kde/plasma/kwin/default.nix
@ -26,6 +26,7 @@ mkKdeDerivation {
    # The rest are NixOS-specific hacks
    ./0003-plugins-qpa-allow-using-nixos-wrapper.patch
    ./0001-NixOS-Unwrap-executable-name-for-.desktop-search.patch
+    ./0001-Lower-CAP_SYS_NICE-from-the-ambient-set.patch
  ];

  postPatch = ''
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/android-tv-card/default.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/android-tv-card/default.nix
@ -0,0 +1,39 @@
+{ lib
+, buildNpmPackage
+, fetchFromGitHub
+}:
+
+buildNpmPackage rec {
+  pname = "android-tv-card";
+  version = "3.6.1";
+
+  src = fetchFromGitHub {
+    owner = "Nerwyn";
+    repo = "android-tv-card";
+    rev = version;
+    hash = "sha256-bVfaB5s4b0bu8RiPGoyuPzhe2otCPugldmoVQuYX3P8=";
+  };
+
+  patches = [ ./dont-call-git.patch ];
+
+  npmDepsHash = "sha256-yLIf+VXrNF81pq8dbPa+JplNZqhrRnXHEdEk6wJN98A=";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir $out
+    cp dist/android-tv-card.min.js $out
+
+    runHook postInstall
+  '';
+
+  passthru.entrypoint = "android-tv-card.min.js";
+
+  meta = with lib; {
+    description = "Universal Customizable TV Remote Card, with HA actions, super configurable touchpad, slider, haptics, and keyboard";
+    homepage = "https://github.com/Nerwyn/android-tv-card";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ k900 ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/android-tv-card/dont-call-git.patch
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/android-tv-card/dont-call-git.patch
@ -0,0 +1,17 @@
+diff --git a/webpack.config.js b/webpack.config.js
+index 469ffe1..3233c4b 100644
+--- a/webpack.config.js
+++ b/webpack.config.js
+@@ -1,11 +1,7 @@
+ const path = require('path');
+ const { execSync } = require('child_process');
+ 
+-let env =
+-	execSync('git branch --show-current').toString().trim() == 'main'
+-		? 'production'
+-		: 'development';
+-env = 'production';
+let env = 'production';
+ 
+ module.exports = {
+ 	mode: env,
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/button-card/default.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/button-card/default.nix
@ -0,0 +1,52 @@
+{ lib
+, mkYarnPackage
+, fetchYarnDeps
+, fetchFromGitHub
+}:
+
+mkYarnPackage rec {
+  pname = "button-card";
+  version = "4.1.2";
+
+  src = fetchFromGitHub {
+    owner = "custom-cards";
+    repo = "button-card";
+    rev = "v${version}";
+    hash = "sha256-Ntg1sNgAehcL2fT0rP0YHzV5q6rB5p1TyFXtbZyB3Vo=";
+  };
+
+  packageJSON = ./package.json;
+
+  offlineCache = fetchYarnDeps {
+    yarnLock = src + "/yarn.lock";
+    hash = "sha256-OFnsRR9zA9D22xBdh4XfLueGVA2ERXmGEp54x0OFDFY=";
+  };
+
+  buildPhase = ''
+    runHook preBuild
+
+    yarn build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir $out
+    cp ./deps/button-card/dist/button-card.js $out
+
+    runHook postInstall
+  '';
+
+  doDist = false;
+
+  meta = with lib; {
+    description = "Lovelace button-card for home assistant";
+    homepage = "https://github.com/custom-cards/button-card";
+    changelog = "https://github.com/custom-cards/button-card/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ k900 ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/button-card/package.json
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/button-card/package.json
@ -0,0 +1,78 @@
+{
+  "name": "button-card",
+  "version": "4.1.2",
+  "description": "Button card for lovelace",
+  "main": "dist/button-card.js",
+  "scripts": {
+    "build": "npm run lint && npm run rollup",
+    "rollup": "rollup -c",
+    "babel": "babel dist/button-card.js --out-file dist/button-card.js",
+    "lint": "eslint src/*.ts",
+    "watch": "rollup -c --watch",
+    "postversion": "npm run build",
+    "audit-fix": "npx yarn-audit-fix"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/custom-cards/button-card.git"
+  },
+  "keywords": [
+    "lovelace"
+  ],
+  "author": "kuuji",
+  "contributors": [
+    "Ian Richardson (https://github.com/iantrich)",
+    "Jérôme Wiedemann (https://github.com/RomRider)"
+  ],
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/custom-cards/button-card/issues"
+  },
+  "homepage": "https://github.com/custom-cards/button-card#readme",
+  "devDependencies": {
+    "@babel/core": "^7.12.3",
+    "@babel/plugin-proposal-class-properties": "^7.12.1",
+    "@babel/plugin-proposal-decorators": "^7.12.1",
+    "@rollup/plugin-babel": "^5.2.1",
+    "@rollup/plugin-commonjs": "^16.0.0",
+    "@rollup/plugin-json": "^4.0.2",
+    "@rollup/plugin-node-resolve": "^10.0.0",
+    "@semantic-release/changelog": "^5.0.1",
+    "@semantic-release/commit-analyzer": "^8.0.1",
+    "@semantic-release/exec": "^5.0.0",
+    "@semantic-release/git": "^9.0.0",
+    "@semantic-release/npm": "^7.0.10",
+    "@semantic-release/release-notes-generator": "^9.0.1",
+    "@typescript-eslint/eslint-plugin": "^6.1.0",
+    "@typescript-eslint/parser": "^6.1.0",
+    "conventional-changelog-conventionalcommits": "^4.5.0",
+    "eslint": "7.12.1",
+    "eslint-config-airbnb-base": "^14.1.0",
+    "eslint-config-prettier": "^6.15.0",
+    "eslint-plugin-import": "^2.22.1",
+    "eslint-plugin-prettier": "^3.1.2",
+    "npm": "^6.14.3",
+    "prettier": "^2.1.2",
+    "prettier-eslint": "^11.0.0",
+    "rollup": "^2.33.1",
+    "rollup-plugin-cleanup": "^3.2.1",
+    "rollup-plugin-serve": "^1.1.0",
+    "rollup-plugin-terser": "^7.0.2",
+    "rollup-plugin-typescript2": "^0.29.0",
+    "semantic-release": "^17.3.8",
+    "ts-lit-plugin": "^1.1.10",
+    "typescript": "^4.0.5",
+    "typescript-styled-plugin": "^0.15.0",
+    "yarn-audit-fix": "^9.3.10"
+  },
+  "dependencies": {
+    "@ctrl/tinycolor": "^3.1.6",
+    "@material/mwc-ripple": "^0.19.1",
+    "fast-copy": "^2.1.0",
+    "home-assistant-js-websocket": "^8.2.0",
+    "lit": "^2.7.6",
+    "lit-element": "^3.3.2",
+    "lit-html": "^2.7.5",
+    "memoize-one": "^6.0.0"
+  }
+}
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/card-mod/default.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/card-mod/default.nix
@ -0,0 +1,37 @@
+{ lib
+, buildNpmPackage
+, fetchFromGitHub
+}:
+
+buildNpmPackage rec {
+  pname = "lovelace-card-mod";
+  version = "3.4.3";
+
+  src = fetchFromGitHub {
+    owner = "thomasloven";
+    repo = "lovelace-card-mod";
+    rev = "v${version}";
+    hash = "sha256-LFKOTu0SBeHpf8Hjvsgc/xOUux9d4lBCshdD9u7eO5o=";
+  };
+
+  npmDepsHash = "sha256-JJexFmVbDHi2JCiCpcDupzVf0xfwy+vqWILq/dLVcBo=";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir $out
+    cp card-mod.js $out
+
+    runHook postInstall
+  '';
+
+  passthru.entrypoint = "card-mod.js";
+
+  meta = with lib; {
+    description = "Add CSS styles to (almost) any lovelace card";
+    homepage = "https://github.com/thomasloven/lovelace-card-mod";
+    license = licenses.mit;
+    maintainers = with maintainers; [ k900 ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/decluttering-card/default.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/decluttering-card/default.nix
@ -0,0 +1,36 @@
+{ lib
+, buildNpmPackage
+, fetchFromGitHub
+}:
+
+buildNpmPackage rec {
+  pname = "decluttering-card";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "custom-cards";
+    repo = "decluttering-card";
+    rev = "v${version}";
+    hash = "sha256-8pf7G6RbLdpIdXYz801+wwAc3NcNs8l0x4fSGqlAmG0=";
+  };
+
+  npmDepsHash = "sha256-9tmEfKo8n2LR+r40hEqOfn7w6/P29XQ+KZSHL97wUuY=";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir $out
+    cp dist/decluttering-card.js $out
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Declutter your lovelace configuration with the help of this card";
+    homepage = "https://github.com/custom-cards/decluttering-card";
+    changelog = "https://github.com/custom-cards/decluttering-card/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ k900 ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/default.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/default.nix
@ -2,6 +2,16 @@
 }:

 {
+  android-tv-card = callPackage ./android-tv-card { };
+
+  button-card = callPackage ./button-card { };
+
+  card-mod = callPackage ./card-mod { };
+
+  decluttering-card = callPackage ./decluttering-card { };
+
+  lg-webos-remote-control = callPackage ./lg-webos-remote-control { };
+
  light-entity-card = callPackage ./light-entity-card { };

  mini-graph-card = callPackage ./mini-graph-card {};
@ -12,5 +22,7 @@

  mushroom = callPackage ./mushroom { };

+  valetudo-map-card = callPackage ./valetudo-map-card { };
+
  zigbee2mqtt-networkmap = callPackage ./zigbee2mqtt-networkmap { };
 }
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/lg-webos-remote-control/default.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/lg-webos-remote-control/default.nix
@ -0,0 +1,37 @@
+{ lib
+, buildNpmPackage
+, fetchFromGitHub
+}:
+
+buildNpmPackage rec {
+  pname = "lg-webos-remote-control";
+  version = "2.0.3";
+
+  src = fetchFromGitHub {
+    owner = "madmicio";
+    repo = "LG-WebOS-Remote-Control";
+    rev = version;
+    hash = "sha256-ICOAi8q8dWrBFCv18JYSWc6MIwqxfDXOcc6kCKLGehs=";
+  };
+
+  npmDepsHash = "sha256-kN+i0ic1JWs6kqnAliiO4yVMDXwfZaQsRGKeV9A0MxE=";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir $out
+    cp dist/lg-remote-control.js $out
+
+    runHook postInstall
+  '';
+
+  passthru.entrypoint = "lg-remote-control.js";
+
+  meta = with lib; {
+    description = "Remote Control for LG TV WebOS";
+    homepage = "https://github.com/madmicio/LG-WebOS-Remote-Control";
+    license = licenses.mit;
+    maintainers = with maintainers; [ k900 ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/valetudo-map-card/default.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/valetudo-map-card/default.nix
@ -0,0 +1,39 @@
+{ lib
+, buildNpmPackage
+, fetchFromGitHub
+}:
+
+buildNpmPackage rec {
+  pname = "lovelace-valetudo-map-card";
+  version = "2023.04.0";
+
+  src = fetchFromGitHub {
+    owner = "Hypfer";
+    repo = "lovelace-valetudo-map-card";
+    rev = "v${version}";
+    hash = "sha256-owOIbA1tRlnbWJ/p/wAUpeDnz/Wzu+GmUammJ6VFxHc=";
+  };
+
+  patches = [ ./remove-git-dependency.patch ];
+
+  npmDepsHash = "sha256-xHHbOt9HW+zJAhHEDy2V5eYyLv4e3OrUbnzqeJasSng=";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir $out
+    cp dist/valetudo-map-card.js $out
+
+    runHook postInstall
+  '';
+
+  passthru.entrypoint = "valetudo-map-card.js";
+
+  meta = with lib; {
+    description = "Display the map from a valetudo-enabled robot in a home assistant dashboard card";
+    homepage = "https://github.com/Hypfer/lovelace-valetudo-map-card";
+    license = licenses.mit;
+    maintainers = with maintainers; [ k900 ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/valetudo-map-card/remove-git-dependency.patch
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/valetudo-map-card/remove-git-dependency.patch
@ -0,0 +1,64 @@
+diff --git a/package-lock.json b/package-lock.json
+index cce05ba..36020f8 100644
+--- a/package-lock.json
+++ b/package-lock.json
+@@ -1,12 +1,12 @@
+ {
+   "name": "lovelace-valetudo-map-card",
+-  "version": "2022.08.0",
+  "version": "2023.04.0",
+   "lockfileVersion": 2,
+   "requires": true,
+   "packages": {
+     "": {
+       "name": "lovelace-valetudo-map-card",
+-      "version": "2022.08.0",
+      "version": "2023.04.0",
+       "license": "MIT",
+       "dependencies": {
+         "custom-card-helpers": "1.9.0"
+@@ -21,7 +21,6 @@
+         "eslint-plugin-jsdoc": "39.3.0",
+         "eslint-plugin-regexp": "1.7.0",
+         "eslint-plugin-sort-keys-fix": "1.1.2",
+-        "eslint-plugin-sort-requires": "git+https://npm@github.com/Hypfer/eslint-plugin-sort-requires.git#2.1.1",
+         "pako": "2.0.4",
+         "rollup": "2.58.0",
+         "rollup-plugin-babel": "4.4.0",
+@@ -1596,12 +1595,6 @@
+         "node": ">=6.0.0"
+       }
+     },
+-    "node_modules/eslint-plugin-sort-requires": {
+-      "version": "2.1.0",
+-      "resolved": "git+https://npm@github.com/Hypfer/eslint-plugin-sort-requires.git#3e216dd9e9589b87671a3e7bf4084a0bd96e920e",
+-      "dev": true,
+-      "license": "MIT"
+-    },
+     "node_modules/eslint-scope": {
+       "version": "7.1.1",
+       "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-7.1.1.tgz",
+@@ -4358,11 +4351,6 @@
+         }
+       }
+     },
+-    "eslint-plugin-sort-requires": {
+-      "version": "git+https://npm@github.com/Hypfer/eslint-plugin-sort-requires.git#3e216dd9e9589b87671a3e7bf4084a0bd96e920e",
+-      "dev": true,
+-      "from": "eslint-plugin-sort-requires@git+https://npm@github.com/Hypfer/eslint-plugin-sort-requires.git#2.1.1"
+-    },
+     "eslint-scope": {
+       "version": "7.1.1",
+       "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-7.1.1.tgz",
+diff --git a/package.json b/package.json
+index 85a9d35..d8c6865 100644
+--- a/package.json
+++ b/package.json
+@@ -23,7 +23,6 @@
+     "eslint-plugin-jsdoc": "39.3.0",
+     "eslint-plugin-regexp": "1.7.0",
+     "eslint-plugin-sort-keys-fix": "1.1.2",
+-    "eslint-plugin-sort-requires": "git+https://npm@github.com/Hypfer/eslint-plugin-sort-requires.git#2.1.1",
+     "@typescript-eslint/eslint-plugin": "5.25.0",
+     "@typescript-eslint/experimental-utils": "5.25.0",
+     "@typescript-eslint/parser": "5.25.0",
--- a/pkgs/servers/monitoring/prometheus/unbound-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/unbound-exporter.nix
@ -5,7 +5,7 @@
 }:

 let
-  version = "0.4.5";
+  version = "0.4.6";
 in
 buildGoModule {
  pname = "unbound_exporter";
--- a/pkgs/servers/sunshine/default.nix
+++ b/pkgs/servers/sunshine/default.nix
@ -52,26 +52,21 @@ let
 in
 stdenv'.mkDerivation rec {
  pname = "sunshine";
-  version = "0.23.0";
+  version = "0.23.1";

  src = fetchFromGitHub {
    owner = "LizardByte";
    repo = "Sunshine";
    rev = "v${version}";
-    sha256 = "sha256-K43LZ7zouTRUI4xhiHuRzu2tN7mUl1nTapuR34JR/Ac=";
+    sha256 = "sha256-D5ee5m2ZTKVqZDH07nzJuFEbZBQ4xW7m4nYnJQe0EaA=";
    fetchSubmodules = true;
  };

-  patches = [
-    # remove npm install as it needs internet access -- handled separately below
-    ./dont-build-webui.patch
-  ];
-
  # build webui
  ui = buildNpmPackage {
    inherit src version;
    pname = "sunshine-ui";
-    npmDepsHash = "sha256-I7IrCR7eQ97a8cPB8F8+T0zX8iJcwh+YtZ9QRtEVZtI=";
+    npmDepsHash = "sha256-9FuMtxTwrU9UIhZXQn/tmGN0IHZBdunV0cY/EElj4bA=";

    # use generated package-lock.json as upstream does not provide one
    postPatch = ''
@ -176,12 +171,23 @@ stdenv'.mkDerivation rec {
    cp -r ${ui}/build ../
  '';

+  buildFlags = [
+    "sunshine"
+  ];
+
  # allow Sunshine to find libvulkan
  postFixup = lib.optionalString cudaSupport ''
    wrapProgram $out/bin/sunshine \
      --set LD_LIBRARY_PATH ${lib.makeLibraryPath [ vulkan-loader ]}
  '';

+  # redefine installPhase to avoid attempt to build webui
+  installPhase = ''
+    runHook preInstall
+    cmake --install .
+    runHook postInstall
+  '';
+
  postInstall = ''
    install -Dm644 ../packaging/linux/${pname}.desktop $out/share/applications/${pname}.desktop
  '';
--- a/pkgs/servers/sunshine/dont-build-webui.patch
+++ b/pkgs/servers/sunshine/dont-build-webui.patch
@ -1,13 +0,0 @@
-diff --git a/cmake/targets/unix.cmake b/cmake/targets/unix.cmake
-index 2ce0378..10d8262 100644
--- a/cmake/targets/unix.cmake
-+++ b/cmake/targets/unix.cmake
-@@ -1,8 +1,3 @@
- # unix specific target definitions
- # put anything here that applies to both linux and macos
- 
-#WebUI build
-add_custom_target(web-ui ALL
-        WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}"
-        COMMENT "Installing NPM Dependencies and Building the Web UI"
-        COMMAND bash -c \"npm install && SUNSHINE_BUILD_HOMEBREW=${NPM_BUILD_HOMEBREW} SUNSHINE_SOURCE_ASSETS_DIR=${NPM_SOURCE_ASSETS_DIR} SUNSHINE_ASSETS_DIR=${NPM_ASSETS_DIR} npm run build\")  # cmake-lint: disable=C0301
--- a/pkgs/servers/sunshine/package-lock.json
+++ b/pkgs/servers/sunshine/package-lock.json
@ -11,8 +11,8 @@
        "bootstrap": "5.3.3",
        "vite": "4.5.2",
        "vite-plugin-ejs": "1.6.4",
-        "vue": "3.4.5",
-        "vue-i18n": "9.11.0"
+        "vue": "3.4.23",
+        "vue-i18n": "9.13.0"
      }
    },
    "node_modules/@babel/parser": {
@ -366,12 +366,12 @@
      }
    },
    "node_modules/@intlify/core-base": {
-      "version": "9.11.0",
-      "resolved": "https://registry.npmjs.org/@intlify/core-base/-/core-base-9.11.0.tgz",
-      "integrity": "sha512-cveOqAstjLZIiyatcP/HrzrQ87cZI8ScPQna3yvoM8zjcjcIRK1MRvmxUNlPdg0rTNJMZw7rixPVM58O5aHVPA==",
+      "version": "9.13.0",
+      "resolved": "https://registry.npmjs.org/@intlify/core-base/-/core-base-9.13.0.tgz",
+      "integrity": "sha512-Lx8+YTrFpom7AtdbbuJHzgmr612/bceHU92v8ZPU9HU9/rczf+TmCs95BxWPIR4K42xh4MVMLsNzLUWiXcNaLg==",
      "dependencies": {
-        "@intlify/message-compiler": "9.11.0",
-        "@intlify/shared": "9.11.0"
+        "@intlify/message-compiler": "9.13.0",
+        "@intlify/shared": "9.13.0"
      },
      "engines": {
        "node": ">= 16"
@ -381,11 +381,11 @@
      }
    },
    "node_modules/@intlify/message-compiler": {
-      "version": "9.11.0",
-      "resolved": "https://registry.npmjs.org/@intlify/message-compiler/-/message-compiler-9.11.0.tgz",
-      "integrity": "sha512-x31Gl7cscnoI4UUY1yaIy8e7vVMVW1VVlTXZz4SIHKqoSEUkfmgqK8NAx1e7RcoHEbICR7uyCbud0ZL1s4OGXQ==",
+      "version": "9.13.0",
+      "resolved": "https://registry.npmjs.org/@intlify/message-compiler/-/message-compiler-9.13.0.tgz",
+      "integrity": "sha512-zhESuudiDpFQhUOx/qrSMd7ZYHbmgCc0QzBc27cDUxaaAj3olbYJnsx3osiHPQyYnv/LuC+WTqoNOEBoHP6dqQ==",
      "dependencies": {
-        "@intlify/shared": "9.11.0",
+        "@intlify/shared": "9.13.0",
        "source-map-js": "^1.0.2"
      },
      "engines": {
@ -396,9 +396,9 @@
      }
    },
    "node_modules/@intlify/shared": {
-      "version": "9.11.0",
-      "resolved": "https://registry.npmjs.org/@intlify/shared/-/shared-9.11.0.tgz",
-      "integrity": "sha512-KHSNgi7sRjmSm7aD8QH8WFt9VfKaekJuJ473opbJlkGY3EDnDUU8ikIhG8PbasQbgNvbY3m3tWNGqk2omIdwMA==",
+      "version": "9.13.0",
+      "resolved": "https://registry.npmjs.org/@intlify/shared/-/shared-9.13.0.tgz",
+      "integrity": "sha512-fUwWcpDz9Wm4dSaz+6XmjoNXWBjZLJtT1Zf1cpLBELbCAOS8WBRscPtgOSfzm6JCqf5KgMI4g917f5TtEeez3A==",
      "engines": {
        "node": ">= 16"
      },
@ -433,49 +433,49 @@
      }
    },
    "node_modules/@vue/compiler-core": {
-      "version": "3.4.5",
-      "resolved": "https://registry.npmjs.org/@vue/compiler-core/-/compiler-core-3.4.5.tgz",
-      "integrity": "sha512-Daka7P1z2AgKjzuueWXhwzIsKu0NkLB6vGbNVEV2iJ8GJTrzraZo/Sk4GWCMRtd/qVi3zwnk+Owbd/xSZbwHtQ==",
+      "version": "3.4.23",
+      "resolved": "https://registry.npmjs.org/@vue/compiler-core/-/compiler-core-3.4.23.tgz",
+      "integrity": "sha512-HAFmuVEwNqNdmk+w4VCQ2pkLk1Vw4XYiiyxEp3z/xvl14aLTUBw2OfVH3vBcx+FtGsynQLkkhK410Nah1N2yyQ==",
      "dependencies": {
-        "@babel/parser": "^7.23.6",
-        "@vue/shared": "3.4.5",
+        "@babel/parser": "^7.24.1",
+        "@vue/shared": "3.4.23",
        "entities": "^4.5.0",
        "estree-walker": "^2.0.2",
-        "source-map-js": "^1.0.2"
+        "source-map-js": "^1.2.0"
      }
    },
    "node_modules/@vue/compiler-dom": {
-      "version": "3.4.5",
-      "resolved": "https://registry.npmjs.org/@vue/compiler-dom/-/compiler-dom-3.4.5.tgz",
-      "integrity": "sha512-J8YlxknJVd90SXFJ4HwGANSAXsx5I0lK30sO/zvYV7s5gXf7gZR7r/1BmZ2ju7RGH1lnc6bpBc6nL61yW+PsAQ==",
+      "version": "3.4.23",
+      "resolved": "https://registry.npmjs.org/@vue/compiler-dom/-/compiler-dom-3.4.23.tgz",
+      "integrity": "sha512-t0b9WSTnCRrzsBGrDd1LNR5HGzYTr7LX3z6nNBG+KGvZLqrT0mY6NsMzOqlVMBKKXKVuusbbB5aOOFgTY+senw==",
      "dependencies": {
-        "@vue/compiler-core": "3.4.5",
-        "@vue/shared": "3.4.5"
+        "@vue/compiler-core": "3.4.23",
+        "@vue/shared": "3.4.23"
      }
    },
    "node_modules/@vue/compiler-sfc": {
-      "version": "3.4.5",
-      "resolved": "https://registry.npmjs.org/@vue/compiler-sfc/-/compiler-sfc-3.4.5.tgz",
-      "integrity": "sha512-jauvkDuSSUbP0ebhfNqljhShA90YEfX/0wZ+w40oZF43IjGyWYjqYaJbvMJwGOd+9+vODW6eSvnk28f0SGV7OQ==",
+      "version": "3.4.23",
+      "resolved": "https://registry.npmjs.org/@vue/compiler-sfc/-/compiler-sfc-3.4.23.tgz",
+      "integrity": "sha512-fSDTKTfzaRX1kNAUiaj8JB4AokikzStWgHooMhaxyjZerw624L+IAP/fvI4ZwMpwIh8f08PVzEnu4rg8/Npssw==",
      "dependencies": {
-        "@babel/parser": "^7.23.6",
-        "@vue/compiler-core": "3.4.5",
-        "@vue/compiler-dom": "3.4.5",
-        "@vue/compiler-ssr": "3.4.5",
-        "@vue/shared": "3.4.5",
+        "@babel/parser": "^7.24.1",
+        "@vue/compiler-core": "3.4.23",
+        "@vue/compiler-dom": "3.4.23",
+        "@vue/compiler-ssr": "3.4.23",
+        "@vue/shared": "3.4.23",
        "estree-walker": "^2.0.2",
-        "magic-string": "^0.30.5",
-        "postcss": "^8.4.32",
-        "source-map-js": "^1.0.2"
+        "magic-string": "^0.30.8",
+        "postcss": "^8.4.38",
+        "source-map-js": "^1.2.0"
      }
    },
    "node_modules/@vue/compiler-ssr": {
-      "version": "3.4.5",
-      "resolved": "https://registry.npmjs.org/@vue/compiler-ssr/-/compiler-ssr-3.4.5.tgz",
-      "integrity": "sha512-DDdEcDzj2lWTMfUMMtEpLDhURai9LhM0zSZ219jCt7b2Vyl0/jy3keFgCPMitG0V1S1YG4Cmws3lWHWdxHQOpg==",
+      "version": "3.4.23",
+      "resolved": "https://registry.npmjs.org/@vue/compiler-ssr/-/compiler-ssr-3.4.23.tgz",
+      "integrity": "sha512-hb6Uj2cYs+tfqz71Wj6h3E5t6OKvb4MVcM2Nl5i/z1nv1gjEhw+zYaNOV+Xwn+SSN/VZM0DgANw5TuJfxfezPg==",
      "dependencies": {
-        "@vue/compiler-dom": "3.4.5",
-        "@vue/shared": "3.4.5"
+        "@vue/compiler-dom": "3.4.23",
+        "@vue/shared": "3.4.23"
      }
    },
    "node_modules/@vue/devtools-api": {
@ -484,48 +484,48 @@
      "integrity": "sha512-LgPscpE3Vs0x96PzSSB4IGVSZXZBZHpfxs+ZA1d+VEPwHdOXowy/Y2CsvCAIFrf+ssVU1pD1jidj505EpUnfbA=="
    },
    "node_modules/@vue/reactivity": {
-      "version": "3.4.5",
-      "resolved": "https://registry.npmjs.org/@vue/reactivity/-/reactivity-3.4.5.tgz",
-      "integrity": "sha512-BcWkKvjdvqJwb7BhhFkXPLDCecX4d4a6GATvCduJQDLv21PkPowAE5GKuIE5p6RC07/Lp9FMkkq4AYCTVF5KlQ==",
+      "version": "3.4.23",
+      "resolved": "https://registry.npmjs.org/@vue/reactivity/-/reactivity-3.4.23.tgz",
+      "integrity": "sha512-GlXR9PL+23fQ3IqnbSQ8OQKLodjqCyoCrmdLKZk3BP7jN6prWheAfU7a3mrltewTkoBm+N7qMEb372VHIkQRMQ==",
      "dependencies": {
-        "@vue/shared": "3.4.5"
+        "@vue/shared": "3.4.23"
      }
    },
    "node_modules/@vue/runtime-core": {
-      "version": "3.4.5",
-      "resolved": "https://registry.npmjs.org/@vue/runtime-core/-/runtime-core-3.4.5.tgz",
-      "integrity": "sha512-wh9ELIOQKeWT9SaUPdLrsxRkZv14jp+SJm9aiQGWio+/MWNM3Lib0wE6CoKEqQ9+SCYyGjDBhTOTtO47kCgbkg==",
+      "version": "3.4.23",
+      "resolved": "https://registry.npmjs.org/@vue/runtime-core/-/runtime-core-3.4.23.tgz",
+      "integrity": "sha512-FeQ9MZEXoFzFkFiw9MQQ/FWs3srvrP+SjDKSeRIiQHIhtkzoj0X4rWQlRNHbGuSwLra6pMyjAttwixNMjc/xLw==",
      "dependencies": {
-        "@vue/reactivity": "3.4.5",
-        "@vue/shared": "3.4.5"
+        "@vue/reactivity": "3.4.23",
+        "@vue/shared": "3.4.23"
      }
    },
    "node_modules/@vue/runtime-dom": {
-      "version": "3.4.5",
-      "resolved": "https://registry.npmjs.org/@vue/runtime-dom/-/runtime-dom-3.4.5.tgz",
-      "integrity": "sha512-n5ewvOjyG3IEpqGBahdPXODFSpVlSz3H4LF76Sx0XAqpIOqyJ5bIb2PrdYuH2ogBMAQPh+o5tnoH4nJpBr8U0Q==",
+      "version": "3.4.23",
+      "resolved": "https://registry.npmjs.org/@vue/runtime-dom/-/runtime-dom-3.4.23.tgz",
+      "integrity": "sha512-RXJFwwykZWBkMiTPSLEWU3kgVLNAfActBfWFlZd0y79FTUxexogd0PLG4HH2LfOktjRxV47Nulygh0JFXe5f9A==",
      "dependencies": {
-        "@vue/runtime-core": "3.4.5",
-        "@vue/shared": "3.4.5",
+        "@vue/runtime-core": "3.4.23",
+        "@vue/shared": "3.4.23",
        "csstype": "^3.1.3"
      }
    },
    "node_modules/@vue/server-renderer": {
-      "version": "3.4.5",
-      "resolved": "https://registry.npmjs.org/@vue/server-renderer/-/server-renderer-3.4.5.tgz",
-      "integrity": "sha512-jOFc/VE87yvifQpNju12VcqimH8pBLxdcT+t3xMeiED1K6DfH9SORyhFEoZlW5TG2Vwfn3Ul5KE+1aC99xnSBg==",
+      "version": "3.4.23",
+      "resolved": "https://registry.npmjs.org/@vue/server-renderer/-/server-renderer-3.4.23.tgz",
+      "integrity": "sha512-LDwGHtnIzvKFNS8dPJ1SSU5Gvm36p2ck8wCZc52fc3k/IfjKcwCyrWEf0Yag/2wTFUBXrqizfhK9c/mC367dXQ==",
      "dependencies": {
-        "@vue/compiler-ssr": "3.4.5",
-        "@vue/shared": "3.4.5"
+        "@vue/compiler-ssr": "3.4.23",
+        "@vue/shared": "3.4.23"
      },
      "peerDependencies": {
-        "vue": "3.4.5"
+        "vue": "3.4.23"
      }
    },
    "node_modules/@vue/shared": {
-      "version": "3.4.5",
-      "resolved": "https://registry.npmjs.org/@vue/shared/-/shared-3.4.5.tgz",
-      "integrity": "sha512-6XptuzlMvN4l4cDnDw36pdGEV+9njYkQ1ZE0Q6iZLwrKefKaOJyiFmcP3/KBDHbt72cJZGtllAc1GaHe6XGAyg=="
+      "version": "3.4.23",
+      "resolved": "https://registry.npmjs.org/@vue/shared/-/shared-3.4.23.tgz",
+      "integrity": "sha512-wBQ0gvf+SMwsCQOyusNw/GoXPV47WGd1xB5A1Pgzy0sQ3Bi5r5xm3n+92y3gCnB3MWqnRDdvfkRGxhKtbBRNgg=="
    },
    "node_modules/ansi-styles": {
      "version": "4.3.0",
@ -751,14 +751,11 @@
      }
    },
    "node_modules/magic-string": {
-      "version": "0.30.9",
-      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.9.tgz",
-      "integrity": "sha512-S1+hd+dIrC8EZqKyT9DstTH/0Z+f76kmmvZnkfQVmOpDEF9iVgdYif3Q/pIWHmCoo59bQVGW0kVL3e2nl+9+Sw==",
+      "version": "0.30.10",
+      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.10.tgz",
+      "integrity": "sha512-iIRwTIf0QKV3UAnYK4PU8uiEc4SRh5jX0mwpIwETPpHdhVM4f53RSwS/vXvN1JhGX+Cs7B8qIq3d6AH49O5fAQ==",
      "dependencies": {
        "@jridgewell/sourcemap-codec": "^1.4.15"
-      },
-      "engines": {
-        "node": ">=12"
      }
    },
    "node_modules/minimatch": {
@ -918,15 +915,15 @@
      }
    },
    "node_modules/vue": {
-      "version": "3.4.5",
-      "resolved": "https://registry.npmjs.org/vue/-/vue-3.4.5.tgz",
-      "integrity": "sha512-VH6nHFhLPjgu2oh5vEBXoNZxsGHuZNr3qf4PHClwJWw6IDqw6B3x+4J+ABdoZ0aJuT8Zi0zf3GpGlLQCrGWHrw==",
+      "version": "3.4.23",
+      "resolved": "https://registry.npmjs.org/vue/-/vue-3.4.23.tgz",
+      "integrity": "sha512-X1y6yyGJ28LMUBJ0k/qIeKHstGd+BlWQEOT40x3auJFTmpIhpbKLgN7EFsqalnJXq1Km5ybDEsp6BhuWKciUDg==",
      "dependencies": {
-        "@vue/compiler-dom": "3.4.5",
-        "@vue/compiler-sfc": "3.4.5",
-        "@vue/runtime-dom": "3.4.5",
-        "@vue/server-renderer": "3.4.5",
-        "@vue/shared": "3.4.5"
+        "@vue/compiler-dom": "3.4.23",
+        "@vue/compiler-sfc": "3.4.23",
+        "@vue/runtime-dom": "3.4.23",
+        "@vue/server-renderer": "3.4.23",
+        "@vue/shared": "3.4.23"
      },
      "peerDependencies": {
        "typescript": "*"
@ -938,12 +935,12 @@
      }
    },
    "node_modules/vue-i18n": {
-      "version": "9.11.0",
-      "resolved": "https://registry.npmjs.org/vue-i18n/-/vue-i18n-9.11.0.tgz",
-      "integrity": "sha512-vU4gY6lu8Pdfs9BgKGiDAJmFDf88cceR47KcSB0VW4xJzUrXR/7qwqM7A8dQ2nedhoIDxoOm5Ro4pFd2KvJqbA==",
+      "version": "9.13.0",
+      "resolved": "https://registry.npmjs.org/vue-i18n/-/vue-i18n-9.13.0.tgz",
+      "integrity": "sha512-NlZ+e8rhGSGNk/Vfh4IUvlPRjljPCRslbNYgQmYZY+sLXZgahw8fylQguZU3e8ntJDvitfe40f8p3udOiKMS0A==",
      "dependencies": {
-        "@intlify/core-base": "9.11.0",
-        "@intlify/shared": "9.11.0",
+        "@intlify/core-base": "9.13.0",
+        "@intlify/shared": "9.13.0",
        "@vue/devtools-api": "^6.5.0"
      },
      "engines": {
--- a/pkgs/tools/misc/fend/default.nix
+++ b/pkgs/tools/misc/fend/default.nix
@ -18,16 +18,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "fend";
-  version = "1.4.6";
+  version = "1.4.8";

  src = fetchFromGitHub {
    owner = "printfn";
    repo = "fend";
    rev = "v${version}";
-    hash = "sha256-xqWAL1xMUUL2AtxnZ4oXWmNoks0pL63uqKoNc0Vvw/4=";
+    hash = "sha256-i4h2QYgA1XX+qHOEH07PR3G/0SSA8a413vm9T39TuYQ=";
  };

-  cargoHash = "sha256-0ov/uzBEa8Wzw5T0mSMnnmJYucBLUe0Qlwel6pVRorc=";
+  cargoHash = "sha256-EhumvDwXNXB0Vp3qWkJs0y0gEwiy3Z9/3KZ92YDTlqk=";

  nativeBuildInputs = [ pandoc installShellFiles pkg-config copyDesktopItems ];
  buildInputs = [ pkg-config openssl ] ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
--- a/pkgs/tools/security/clamav/default.nix
+++ b/pkgs/tools/security/clamav/default.nix
@ -6,11 +6,11 @@

 stdenv.mkDerivation rec {
  pname = "clamav";
-  version = "1.3.0";
+  version = "1.3.1";

  src = fetchurl {
    url = "https://www.clamav.net/downloads/production/${pname}-${version}.tar.gz";
-    hash = "sha256-CoamSWMg2RV2A3szEBEZr2/Y1bkQYM0xajqcIp6WBKo=";
+    hash = "sha256-EqMDW/JvVfceMQalGl+o17dEVy35imOSCpz/h2p9zOQ=";
  };

  patches = [
--- a/pkgs/tools/security/semgrep/common.nix
+++ b/pkgs/tools/security/semgrep/common.nix
@ -1,9 +1,9 @@
 { lib }:

 rec {
-  version = "1.70.0";
+  version = "1.71.0";

-  srcHash = "sha256-+fpXHUqTltS+eHvX5qVSLqJkFZGXJ6fTmezDdkocXmY=";
+  srcHash = "sha256-KLDyKNo2oAQlcT9J2SbPSGJvUkxbT05IdEjl5YPBZqA=";

  # submodule dependencies
  # these are fetched so we:
@ -13,8 +13,8 @@ rec {
    "cli/src/semgrep/semgrep_interfaces" = {
      owner = "semgrep";
      repo = "semgrep-interfaces";
-      rev = "df63c8fe4695d742eb7c027cd5d12ccbb3395dab";
-      hash = "sha256-UHF0rGKYCiefU42bk5T3oBW2GYT4HGSmRQYprfneOlY=";
+      rev = "75abf193687b84ab341d8267d865ad68d81a89c9";
+      hash = "sha256-pS95f9oZLtzCEOQrjJP6aGm6lrltumG4ZjSTaUcRDpU=";
    };
  };

@ -25,19 +25,19 @@ rec {
  core = {
    x86_64-linux = {
      platform = "any";
-      hash = "sha256-DjIv5LTOZbjIr8BFqnIpH5h09KtxrggtA3xdCZ+OvZ8=";
+      hash = "sha256-0pEpxIYed0Z086l1apJXuEVW1Hly4HauzHD8bjxR1Zw=";
    };
    aarch64-linux = {
      platform = "musllinux_1_0_aarch64.manylinux2014_aarch64";
-      hash = "sha256-09zeVoSb61WeKHJZOLIHXHP+m6X5k7x38iU8jlpubBk=";
+      hash = "sha256-6VefgA4YFiY7fsy7sbQFXCjsJNM4+vlv6uLSrzBd2qI=";
    };
    x86_64-darwin = {
      platform = "macosx_10_14_x86_64";
-      hash = "sha256-nRpkJEeO8/cQmScg8vNuRLFfKcJZ7vG7pP37FqgcNlQ=";
+      hash = "sha256-wgCaS7Lw1FP42mOZmhO5v2Nz8PnDEkEP2gbxr7aGtDk=";
    };
    aarch64-darwin = {
      platform = "macosx_11_0_arm64";
-      hash = "sha256-SzqFYyWJFNyW5H5xEcxF1GsuLK9GoaqiAx94X754QpI=";
+      hash = "sha256-IZc2RZbAYpflkszl5lFutxikwtO6XGoyyeHJIhU/K+k=";
    };
  };

--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -7043,7 +7043,8 @@ with pkgs;

  ckb-next = libsForQt5.callPackage ../tools/misc/ckb-next { };

-  clamav = darwin.apple_sdk_11_0.callPackage ../tools/security/clamav {
+  clamav = callPackage ../tools/security/clamav {
+    stdenv = if stdenv.isDarwin then overrideSDK stdenv "11.0" else stdenv;
    inherit (darwin.apple_sdk_11_0.frameworks) Foundation;
  };