Merge master into haskell-updates

2024-04-11 00:13:08 +00:00 · 2024-04-11 00:13:08 +00:00 · db9e43b395
parent 4b6f3f8e74 34d3520673
commit db9e43b395
284 changed files with 7923 additions and 5497 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@ -55,7 +55,7 @@
 /pkgs/pkgs-lib/formats/hocon                     @h7x4

 # pkgs/by-name
-/pkgs/test/nixpkgs-check-by-name @infinisil
+/pkgs/test/check-by-name @infinisil
 /pkgs/by-name/README.md @infinisil
 /pkgs/top-level/by-name-overlay.nix @infinisil
 /.github/workflows/check-by-name.yml @infinisil
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1342,12 +1342,6 @@
    githubId = 81317317;
    name = "Anna Aurora";
  };
-  a-n-n-a-l-e-e = {
-    github = "a-n-n-a-l-e-e";
-    githubId = 150648636;
-    matrix = "@a-n-n-a-l-e-e:matrix.org";
-    name = "annalee";
-  };
  anoa = {
    matrix = "@andrewm:amorgan.xyz";
    email = "andrew@amorgan.xyz";
@ -15354,6 +15348,12 @@
    githubId = 1368952;
    name = "Pedro Lara Campos";
  };
+  peefy = {
+    email = "xpf6677@gmail.com";
+    github = "Peefy";
+    githubId = 22744597;
+    name = "Peefy";
+  };
  peelz = {
    email = "peelz.dev+nixpkgs@gmail.com";
    github = "notpeelz";
--- a/maintainers/scripts/check-cherry-picks.sh
+++ b/maintainers/scripts/check-cherry-picks.sh
@ -12,6 +12,9 @@ PICKABLE_BRANCHES=${PICKABLE_BRANCHES:-master staging release-??.?? staging-??.?
 problem=0

 while read new_commit_sha ; do
+  if [ -z "$new_commit_sha" ] ; then
+    continue  # skip empty lines
+  fi
  if [ "$GITHUB_ACTIONS" = 'true' ] ; then
    echo "::group::Commit $new_commit_sha"
  else
@ -57,6 +60,8 @@ while read new_commit_sha ; do

          $range_diff_common --color

+          echo "Note this should not necessarily be treated as a hard fail, but a reviewer's attention should" \
+            "be drawn to it and github actions have no way of doing that but to raise a 'failure'"
          problem=1
        else
          echo "  ✔ $original_commit_sha highly similar to $new_commit_sha"
--- a/nixos/doc/manual/installation/installing.chapter.md
+++ b/nixos/doc/manual/installation/installing.chapter.md
@ -376,7 +376,7 @@ Use the following commands:

    ```ShellSession
    # mkdir -p /mnt/boot
-    # mount /dev/disk/by-label/boot /mnt/boot
+    # mount -o umask=077 /dev/disk/by-label/boot /mnt/boot
    ```

 3.  If your machine has a limited amount of memory, you may want to
@ -572,7 +572,7 @@ With a partitioned disk.
 # mkfs.fat -F 32 -n boot /dev/sda3        # (for UEFI systems only)
 # mount /dev/disk/by-label/nixos /mnt
 # mkdir -p /mnt/boot                      # (for UEFI systems only)
-# mount /dev/disk/by-label/boot /mnt/boot # (for UEFI systems only)
+# mount -o umask=077 /dev/disk/by-label/boot /mnt/boot # (for UEFI systems only)
 # nixos-generate-config --root /mnt
 # nano /mnt/etc/nixos/configuration.nix
 # nixos-install
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -163,6 +163,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - [Uni-Sync](https://github.com/EightB1ts/uni-sync), a synchronization tool for Lian Li Uni Controllers. Available as [hardware.uni-sync](#opt-hardware.uni-sync.enable)

+- [prometheus-nats-exporter](https://github.com/nats-io/prometheus-nats-exporter), a Prometheus exporter for NATS. Available as [services.prometheus.exporters.nats](#opt-services.prometheus.exporters.nats.enable).
+
 ## Backward Incompatibilities {#sec-release-24.05-incompatibilities}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@ -176,6 +178,10 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 - `programs.nix-ld.libraries` no longer sets `baseLibraries` via the option's default but in config and now merges any additional libraries with the default ones.
  This means that `lib.mkForce` must be used to clear the list of default libraries.

+- `cudaPackages.autoAddOpenGLRunpathHook` and `cudaPackages.autoAddDriverRunpath` have been deprecated for `pkgs.autoAddDriverRunpath`. Functionality has not changed, but the setuphook has been renamed and moved to the top-level package scope.
+
+- `cudaPackages.autoFixElfFiles` has been deprecated for `pkgs.autoFixElfFiles`. Functionality has not changed, but the setuphook has been renamed and moved to the top-level package scope.
+
 - `pdns` was updated to version [v4.9.x](https://doc.powerdns.com/authoritative/changelog/4.9.html), which introduces breaking changes. Check out the [Upgrade Notes](https://doc.powerdns.com/authoritative/upgrading.html#to-4-9-0) for details.

 - `unrar` was updated to v7. See [changelog](https://www.rarlab.com/unrar7notes.htm) for more information.
@ -318,7 +324,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - `xxd` has been moved from `vim` default output to its own output to reduce closure size. The canonical way to reference it across all platforms is `unixtools.xxd`.

- `programs.fzf.keybindings` and `programs.fzf.fuzzyCompletion` got replaced by `programs.fzf.enabled` as shell-completion is included in the fzf-binary now there is no easy option to load completion and keybindings separately. Please consult fzf-documentation on how to configure/disable certain keybindings.
+- `programs.fzf.keybindings` and `programs.fzf.fuzzyCompletion` got replaced by `programs.fzf.enable` as shell-completion is included in the fzf-binary now there is no easy option to load completion and keybindings separately. Please consult fzf-documentation on how to configure/disable certain keybindings.

 - The `stalwart-mail` package has been updated to v0.5.3, which includes [breaking changes](https://github.com/stalwartlabs/mail-server/blob/v0.5.3/UPGRADING.md).

--- a/nixos/modules/installer/tools/nixos-generate-config.pl
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@ -453,6 +453,17 @@ EOF
        }
    }

+    # Preserve umask (fmask, dmask) settings for vfat filesystems.
+    # (The default is to mount these world-readable, but that's a security risk
+    # for the EFI System Partition.)
+    if ($fsType eq "vfat") {
+        for (@superOptions) {
+            if ($_ =~ /fmask|dmask/) {
+                push @extraOptions, $_;
+            }
+        }
+    }
+
    # is this a stratis fs?
    my $stableDevPath = findStableDevPath $device;
    my $stratisPool;
--- a/nixos/modules/programs/fzf.nix
+++ b/nixos/modules/programs/fzf.nix
@ -9,11 +9,11 @@ in
 {
  imports = [
    (lib.mkRemovedOptionModule [ "programs" "fzf" "keybindings" ] ''
-      Use "programs.fzf.enabled" instead, due to fzf upstream-change it's not possible to load shell-completion and keybindings separately.
+      Use "programs.fzf.enable" instead, due to fzf upstream-change it's not possible to load shell-completion and keybindings separately.
      If you want to change/disable certain keybindings please check the fzf-documentation.
    '')
    (lib.mkRemovedOptionModule [ "programs" "fzf" "fuzzyCompletion" ] ''
-      Use "programs.fzf.enabled" instead, due to fzf upstream-change it's not possible to load shell-completion and keybindings separately.
+      Use "programs.fzf.enable" instead, due to fzf upstream-change it's not possible to load shell-completion and keybindings separately.
      If you want to change/disable certain keybindings please check the fzf-documentation.
    '')
  ];
--- a/nixos/modules/services/backup/restic-rest-server.nix
+++ b/nixos/modules/services/backup/restic-rest-server.nix
@ -12,7 +12,7 @@ in
    enable = mkEnableOption (lib.mdDoc "Restic REST Server");

    listenAddress = mkOption {
-      default = ":8000";
+      default = "8000";
      example = "127.0.0.1:8080";
      type = types.str;
      description = lib.mdDoc "Listen on a specific IP address and port.";
@ -61,14 +61,19 @@ in
  };

  config = mkIf cfg.enable {
+    assertions = [{
+      assertion = lib.substring 0 1 cfg.listenAddress != ":";
+      message = "The restic-rest-server now uses systemd socket activation, which expects only the Port number: services.restic.server.listenAddress = \"${lib.substring 1 6 cfg.listenAddress}\";";
+    }];
+
    systemd.services.restic-rest-server = {
      description = "Restic REST Server";
-      after = [ "network.target" ];
+      after = [ "network.target" "restic-rest-server.socket" ];
+      requires = [ "restic-rest-server.socket" ];
      wantedBy = [ "multi-user.target" ];
      serviceConfig = {
        ExecStart = ''
          ${cfg.package}/bin/rest-server \
-          --listen ${cfg.listenAddress} \
          --path ${cfg.dataDir} \
          ${optionalString cfg.appendOnly "--append-only"} \
          ${optionalString cfg.privateRepos "--private-repos"} \
@ -80,16 +85,40 @@ in
        Group = "restic";

        # Security hardening
-        ReadWritePaths = [ cfg.dataDir ];
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateNetwork = true;
        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectProc = "invisible";
        ProtectSystem = "strict";
        ProtectKernelTunables = true;
        ProtectKernelModules = true;
        ProtectControlGroups = true;
        PrivateDevices = true;
+        ReadWritePaths = [ cfg.dataDir ];
+        RemoveIPC = true;
+        RestrictAddressFamilies = "none";
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = "@system-service";
+        UMask = 027;
      };
    };

+    systemd.sockets.restic-rest-server = {
+      listenStreams = [ cfg.listenAddress ];
+      wantedBy = [ "sockets.target" ];
+    };
+
    systemd.tmpfiles.rules = mkIf cfg.privateRepos [
        "f ${cfg.dataDir}/.htpasswd 0700 restic restic -"
    ];
--- a/nixos/modules/services/backup/znapzend.nix
+++ b/nixos/modules/services/backup/znapzend.nix
@ -465,5 +465,5 @@ in
    };
  };

-  meta.maintainers = with maintainers; [ infinisil SlothOfAnarchy ];
+  meta.maintainers = with maintainers; [ SlothOfAnarchy ];
 }
--- a/nixos/modules/services/display-managers/sddm.nix
+++ b/nixos/modules/services/display-managers/sddm.nix
@ -66,7 +66,7 @@ let
      HideShells = "/run/current-system/sw/bin/nologin";
    };

-    X11 = {
+    X11 = optionalAttrs xcfg.enable {
      MinimumVT = if xcfg.tty != null then xcfg.tty else 7;
      ServerPath = toString xserverWrapper;
      XephyrPath = "${pkgs.xorg.xorgserver.out}/bin/Xephyr";
--- a/nixos/modules/services/misc/nix-optimise.nix
+++ b/nixos/modules/services/misc/nix-optimise.nix
@ -42,9 +42,11 @@ in
        startAt = lib.optionals cfg.automatic cfg.dates;
      };

-      timers.nix-optimise.timerConfig = {
-        Persistent = true;
-        RandomizedDelaySec = 1800;
+      timers.nix-optimise = lib.mkIf cfg.automatic {
+        timerConfig = {
+          Persistent = true;
+          RandomizedDelaySec = 1800;
+        };
      };
    };
  };
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@ -55,6 +55,7 @@ let
    "modemmanager"
    "mongodb"
    "mysqld"
+    "nats"
    "nextcloud"
    "nginx"
    "nginxlog"
--- a/nixos/modules/services/monitoring/prometheus/exporters/nats.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/nats.nix
@ -0,0 +1,34 @@
+{ config, lib, pkgs, options, ... }:
+
+with lib;
+
+let
+
+  cfg = config.services.prometheus.exporters.nats;
+
+in
+{
+  port = 7777;
+
+  extraOpts = {
+    url = mkOption {
+      type = types.str;
+      default = "http://127.0.0.1:8222";
+      description = ''
+        NATS monitor endpoint to query.
+      '';
+    };
+  };
+
+  serviceOpts = {
+    serviceConfig = {
+      ExecStart = ''
+        ${pkgs.prometheus-nats-exporter}/bin/prometheus-nats-exporter \
+          -addr ${cfg.listenAddress} \
+          -port ${toString cfg.port} \
+          ${concatStringsSep " \\\n  " cfg.extraFlags} \
+          ${cfg.url}
+      '';
+    };
+  };
+}
--- a/nixos/modules/services/networking/radicale.nix
+++ b/nixos/modules/services/networking/radicale.nix
@ -200,5 +200,5 @@ in {
    };
  };

-  meta.maintainers = with lib.maintainers; [ infinisil dotlambda ];
+  meta.maintainers = with lib.maintainers; [ dotlambda ];
 }
--- a/nixos/modules/virtualisation/digital-ocean-config.nix
+++ b/nixos/modules/virtualisation/digital-ocean-config.nix
@ -31,7 +31,7 @@ with lib;
      hostName = config.networking.hostName;
      doMetadataFile = "/run/do-metadata/v1.json";
    in mkMerge [{
-      fileSystems."/" = {
+      fileSystems."/" = lib.mkDefault {
        device = "/dev/disk/by-label/nixos";
        autoResize = true;
        fsType = "ext4";
@ -41,11 +41,7 @@ with lib;
        kernelParams = [ "console=ttyS0" "panic=1" "boot.panic_on_fail" ];
        initrd.kernelModules = [ "virtio_scsi" ];
        kernelModules = [ "virtio_pci" "virtio_net" ];
-        loader = {
-          grub.device = "/dev/vda";
-          timeout = 0;
-          grub.configurationLimit = 0;
-        };
+        loader.grub.devices = lib.mkDefault ["/dev/vda"];
      };
      services.openssh = {
        enable = mkDefault true;
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -777,6 +777,7 @@ in {
  redis = handleTest ./redis.nix {};
  redmine = handleTest ./redmine.nix {};
  restartByActivationScript = handleTest ./restart-by-activation-script.nix {};
+  restic-rest-server = handleTest ./restic-rest-server.nix {};
  restic = handleTest ./restic.nix {};
  retroarch = handleTest ./retroarch.nix {};
  rkvm = handleTest ./rkvm {};
--- a/nixos/tests/restic-rest-server.nix
+++ b/nixos/tests/restic-rest-server.nix
@ -0,0 +1,122 @@
+import ./make-test-python.nix (
+  { pkgs, ... }:
+
+  let
+    remoteRepository = "rest:http://restic_rest_server:8001/";
+
+    backupPrepareCommand = ''
+      touch /root/backupPrepareCommand
+      test ! -e /root/backupCleanupCommand
+    '';
+
+    backupCleanupCommand = ''
+      rm /root/backupPrepareCommand
+      touch /root/backupCleanupCommand
+    '';
+
+    testDir = pkgs.stdenvNoCC.mkDerivation {
+      name = "test-files-to-backup";
+      unpackPhase = "true";
+      installPhase = ''
+        mkdir $out
+        echo some_file > $out/some_file
+        echo some_other_file > $out/some_other_file
+        mkdir $out/a_dir
+        echo a_file > $out/a_dir/a_file
+      '';
+    };
+
+    passwordFile = "${pkgs.writeText "password" "correcthorsebatterystaple"}";
+    paths = [ "/opt" ];
+    exclude = [ "/opt/excluded_file_*" ];
+    pruneOpts = [
+      "--keep-daily 2"
+      "--keep-weekly 1"
+      "--keep-monthly 1"
+      "--keep-yearly 99"
+    ];
+  in
+  {
+    name = "restic-rest-server";
+
+    nodes = {
+      restic_rest_server = {
+        services.restic.server = {
+          enable = true;
+          extraFlags = [ "--no-auth" ];
+          listenAddress = "8001";
+        };
+        networking.firewall.allowedTCPPorts = [ 8001 ];
+      };
+      server = {
+        services.restic.backups = {
+          remotebackup = {
+            inherit passwordFile paths exclude pruneOpts backupPrepareCommand backupCleanupCommand;
+            repository = remoteRepository;
+            initialize = true;
+            timerConfig = null; # has no effect here, just checking that it doesn't break the service
+          };
+          remoteprune = {
+            inherit passwordFile;
+            repository = remoteRepository;
+            pruneOpts = [ "--keep-last 1" ];
+          };
+        };
+      };
+    };
+
+    testScript = ''
+      restic_rest_server.start()
+      server.start()
+      restic_rest_server.wait_for_unit("restic-rest-server.socket")
+      restic_rest_server.wait_for_open_port(8001)
+      server.wait_for_unit("dbus.socket")
+      server.fail(
+          "restic-remotebackup snapshots",
+      )
+      server.succeed(
+          # set up
+          "cp -rT ${testDir} /opt",
+          "touch /opt/excluded_file_1 /opt/excluded_file_2",
+
+          # test that remotebackup runs custom commands and produces a snapshot
+          "timedatectl set-time '2016-12-13 13:45'",
+          "systemctl start restic-backups-remotebackup.service",
+          "rm /root/backupCleanupCommand",
+          'restic-remotebackup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',
+
+          # test that restoring that snapshot produces the same directory
+          "mkdir /tmp/restore-1",
+          "restic-remotebackup restore latest -t /tmp/restore-1",
+          "diff -ru ${testDir} /tmp/restore-1/opt",
+
+          # test that we can create four snapshots in remotebackup and rclonebackup
+          "timedatectl set-time '2017-12-13 13:45'",
+          "systemctl start restic-backups-remotebackup.service",
+          "rm /root/backupCleanupCommand",
+
+          "timedatectl set-time '2018-12-13 13:45'",
+          "systemctl start restic-backups-remotebackup.service",
+          "rm /root/backupCleanupCommand",
+
+          "timedatectl set-time '2018-12-14 13:45'",
+          "systemctl start restic-backups-remotebackup.service",
+          "rm /root/backupCleanupCommand",
+
+          "timedatectl set-time '2018-12-15 13:45'",
+          "systemctl start restic-backups-remotebackup.service",
+          "rm /root/backupCleanupCommand",
+
+          "timedatectl set-time '2018-12-16 13:45'",
+          "systemctl start restic-backups-remotebackup.service",
+          "rm /root/backupCleanupCommand",
+
+          'restic-remotebackup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 4"',
+
+          # test that remoteprune brings us back to 1 snapshot in remotebackup
+          "systemctl start restic-backups-remoteprune.service",
+          'restic-remotebackup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',
+      )
+    '';
+  }
+)
--- a/pkgs/applications/audio/kid3/default.nix
+++ b/pkgs/applications/audio/kid3/default.nix
@ -1,5 +1,4 @@
-{
-  chromaprint
+{ chromaprint
 , cmake
 , docbook_xml_dtd_45
 , docbook_xsl
@ -7,25 +6,43 @@
 , ffmpeg
 , flac
 , id3lib
+, kdePackages
 , lib
 , libogg
 , libvorbis
 , libxslt
 , mp4v2
-, phonon
 , pkg-config
 , python3
 , qtbase
+, qtdeclarative
 , qtmultimedia
-, qtquickcontrols
 , qttools
 , readline
 , stdenv
 , taglib
 , wrapQtAppsHook
 , zlib
+, withCLI ? true
+, withKDE ? true
+, withQt ? false
 }:

+let
+  inherit (lib) optionals;
+
+  apps = lib.concatStringsSep ";" (
+    optionals withCLI [ "CLI" ]
+    ++ optionals withKDE [ "KDE" ]
+    ++ optionals withQt [ "Qt" ]
+  );
+
+  mainProgram =
+    if withQt then "kid3-qt"
+    else if withKDE then "kid3"
+    else "kid3-cli";
+
+in
 stdenv.mkDerivation (finalAttrs: {
  pname = "kid3";
  version = "3.9.5";
@ -41,6 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
    docbook_xsl
    pkg-config
    python3
+    qttools
    wrapQtAppsHook
  ];

@ -53,25 +71,32 @@ stdenv.mkDerivation (finalAttrs: {
    libvorbis
    libxslt
    mp4v2
-    phonon
    qtbase
+    qtdeclarative
    qtmultimedia
-    qtquickcontrols
-    qttools
    readline
    taglib
    zlib
-  ];
+  ] ++ lib.optionals withKDE (with kdePackages; [
+    kconfig
+    kconfigwidgets
+    kcoreaddons
+    kio
+    kxmlgui
+    phonon
+  ]);

-  cmakeFlags = [ "-DWITH_APPS=Qt;CLI" ];
-  NIX_LDFLAGS = "-lm -lpthread";
+  cmakeFlags = [ (lib.cmakeFeature "WITH_APPS" apps) ];

-  preConfigure = ''
-    export DOCBOOKDIR="${docbook_xsl}/xml/xsl/docbook/"
-  '';
+  env = {
+    DOCBOOKDIR = "${docbook_xsl}/xml/xsl/docbook/";
+    LANG = "C.UTF-8";
+    NIX_LDFLAGS = "-lm -lpthread";
+  };

  meta = {
    description = "A simple and powerful audio tag editor";
+    inherit mainProgram;
    homepage = "https://kid3.kde.org/";
    license = lib.licenses.lgpl2Plus;
    longDescription = ''
@ -103,7 +128,7 @@ stdenv.mkDerivation (finalAttrs: {
      - Edit synchronized lyrics and event timing codes, import and export
        LRC files.
    '';
-    maintainers = [ lib.maintainers.AndersonTorres ];
+    maintainers = with lib.maintainers; [ AndersonTorres ];
    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/applications/audio/synaesthesia/default.nix
+++ b/pkgs/applications/audio/synaesthesia/default.nix
@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
    description = "Program for representing sounds visually";
    license = lib.licenses.gpl2Only;
    platforms = lib.platforms.linux;
-    maintainers = [ lib.maintainers.infinisil ];
+    maintainers = [ ];
    mainProgram = "synaesthesia";
  };
 }
--- a/pkgs/applications/blockchains/bitcoin-abc/default.nix
+++ b/pkgs/applications/blockchains/bitcoin-abc/default.nix
@ -25,13 +25,13 @@

 mkDerivation rec {
  pname = "bitcoin" + lib.optionalString (!withGui) "d" + "-abc";
-  version = "0.29.0";
+  version = "0.29.1";

  src = fetchFromGitHub {
    owner = "bitcoin-ABC";
    repo = "bitcoin-abc";
    rev = "v${version}";
-    hash = "sha256-9BJfzGXX9b7JRWFU9Flda8CWDqkgE2/IZcPopCyfBck=";
+    hash = "sha256-QEuOMl1sbVdB2nRwBO/2adqj/NIQGbwrBqML39fymM0=";
  };

  nativeBuildInputs = [ pkg-config cmake ];
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@ -10,16 +10,16 @@ let
    inherit tiling_wm;
  };
  stableVersion = {
-    version = "2023.2.1.24"; # "Android Studio Iguana | 2023.2.1 Patch 1"
-    sha256Hash = "sha256-ACZCdXKEnJy7DJTW+XGOoIvDRdzP47NytUEAqV//mbU=";
+    version = "2023.2.1.25"; # "Android Studio Iguana | 2023.2.1 Patch 2"
+    sha256Hash = "sha256-zWPq1GfckqCP9rNpXAHVfoApdvxkrN3NMc1qJCf/obw=";
  };
  betaVersion = {
-    version = "2023.3.1.15"; # "Android Studio Jellyfish | 2023.3.1.1 Beta 2"
-    sha256Hash = "sha256-ImXHda8Xbayuk+OMZVtAFsGNnaqm2PvI3lko2gUpIeU=";
+    version = "2023.3.1.17"; # "Android Studio Jellyfish | 2023.3.1.1 RC 2"
+    sha256Hash = "sha256-zROBKzQiP4V2P67HgOIkHgn8q/M0zy5MkZozVSiQsWU=";
  };
  latestVersion = {
-    version = "2024.1.1.1"; # "Android Studio Koala | 2024.1.1 Canary 3"
-    sha256Hash = "sha256-QNAudFlM+1QAZg+EYgiIknllai4N1wj55ZnkUWho7ps=";
+    version = "2024.1.1.2"; # "Android Studio Koala | 2024.1.1 Canary 4"
+    sha256Hash = "sha256-d/bzgKimps0Tw7GQD9sc2LLDNaVpWlqNTKkuyxKrCWo=";
  };
 in {
  # Attributes are named by their corresponding release channels
--- a/pkgs/applications/editors/quartus-prime/default.nix
+++ b/pkgs/applications/editors/quartus-prime/default.nix
@ -1,7 +1,8 @@
 { lib, buildFHSEnv, callPackage, makeDesktopItem, writeScript, runtimeShell
-, runCommand, quartus-prime-lite
+, runCommand, unstick, quartus-prime-lite
+, withQuesta ? true
 , supportedDevices ? [ "Arria II" "Cyclone V" "Cyclone IV" "Cyclone 10 LP" "MAX II/V" "MAX 10 FPGA" ]
-, unwrapped ? callPackage ./quartus.nix { inherit supportedDevices; }
+, unwrapped ? callPackage ./quartus.nix { inherit unstick supportedDevices withQuesta; }
 }:

 let
@ -18,11 +19,12 @@ in buildFHSEnv rec {
  name = "quartus-prime-lite"; # wrapped

  targetPkgs = pkgs: with pkgs; [
-    (runCommand "ld-lsb-compat" {} ''
+    (runCommand "ld-lsb-compat" {} (''
      mkdir -p "$out/lib"
      ln -sr "${glibc}/lib/ld-linux-x86-64.so.2" "$out/lib/ld-lsb-x86-64.so.3"
+    '' + lib.optionalString withQuesta ''
      ln -sr "${pkgsi686Linux.glibc}/lib/ld-linux.so.2" "$out/lib/ld-lsb.so.3"
-    '')
+    ''))
    # quartus requirements
    glib
    xorg.libICE
@ -37,11 +39,14 @@ in buildFHSEnv rec {
    # qsys requirements
    xorg.libXtst
    xorg.libXi
+    dejavu_fonts
+    gnumake
  ];

-  # Also support 32-bit executables.
-  multiArch = true;
+  # Also support 32-bit executables used by simulator.
+  multiArch = withQuesta;

+  # these libs are installed as 64 bit, plus as 32 bit when multiArch is true
  multiPkgs = pkgs: with pkgs; let
    # This seems ugly - can we override `libpng = libpng12` for all `pkgs`?
    freetype = pkgs.freetype.override { libpng = libpng12; };
--- a/pkgs/applications/editors/quartus-prime/quartus.nix
+++ b/pkgs/applications/editors/quartus-prime/quartus.nix
@ -1,4 +1,5 @@
 { stdenv, lib, unstick, fetchurl
+, withQuesta ? true
 , supportedDevices ? [ "Arria II" "Cyclone V" "Cyclone IV" "Cyclone 10 LP" "MAX II/V" "MAX 10 FPGA" ]
 }:

@ -41,26 +42,25 @@ let
    url = "https://downloads.intel.com/akdlm/software/acdsinst/${lib.versions.majorMinor version}std/${lib.elemAt (lib.splitVersion version) 4}/ib_installers/${name}";
  };

+  installers = map download ([{
+    name = "QuartusLiteSetup-${version}-linux.run";
+    sha256 = "1mg4db56rg407kdsvpzys96z59bls8djyddfzxi6bdikcklxz98h";
+  }] ++ lib.optional withQuesta {
+    name = "QuestaSetup-${version}-linux.run";
+    sha256 = "0f9lyphk4vf4ijif3kb4iqf18jl357z9h8g16kwnzaqwfngh2ixk";
+  });
+  components = map (id: download {
+    name = "${id}-${version}.qdz";
+    sha256 = lib.getAttr id componentHashes;
+  }) (lib.attrValues supportedDeviceIds);
+
 in stdenv.mkDerivation rec {
  inherit version;
  pname = "quartus-prime-lite-unwrapped";

-  src = map download ([{
-    name = "QuartusLiteSetup-${version}-linux.run";
-    sha256 = "1mg4db56rg407kdsvpzys96z59bls8djyddfzxi6bdikcklxz98h";
-  } {
-    name = "QuestaSetup-${version}-linux.run";
-    sha256 = "0f9lyphk4vf4ijif3kb4iqf18jl357z9h8g16kwnzaqwfngh2ixk";
-  }] ++ (map (id: {
-    name = "${id}-${version}.qdz";
-    sha256 = lib.getAttr id componentHashes;
-  }) (lib.attrValues supportedDeviceIds)));
-
  nativeBuildInputs = [ unstick ];

  buildCommand = let
-    installers = lib.sublist 0 2 src;
-    components = lib.sublist 2 ((lib.length src) - 2) src;
    copyInstaller = installer: ''
        # `$(cat $NIX_CC/nix-support/dynamic-linker) $src[0]` often segfaults, so cp + patchelf
        cp ${installer} $TEMP/${installer.name}
@ -68,22 +68,32 @@ in stdenv.mkDerivation rec {
        patchelf --interpreter $(cat $NIX_CC/nix-support/dynamic-linker) $TEMP/${installer.name}
      '';
    copyComponent = component: "cp ${component} $TEMP/${component.name}";
-    # leaves enabled: quartus, questa_fse, devinfo
+    # leaves enabled: quartus, devinfo
    disabledComponents = [
      "quartus_help"
      "quartus_update"
-      # not questa_fse
      "questa_fe"
-    ] ++ (lib.attrValues unsupportedDeviceIds);
+    ] ++ (lib.optional (!withQuesta) "questa_fse")
+      ++ (lib.attrValues unsupportedDeviceIds);
  in ''
+      echo "setting up installer..."
      ${lib.concatMapStringsSep "\n" copyInstaller installers}
      ${lib.concatMapStringsSep "\n" copyComponent components}

+      echo "executing installer..."
+      # "Could not load seccomp program: Invalid argument" might occur if unstick
+      # itself is compiled for x86_64 instead of the non-x86 host. In that case,
+      # override the input.
      unstick $TEMP/${(builtins.head installers).name} \
        --disable-components ${lib.concatStringsSep "," disabledComponents} \
        --mode unattended --installdir $out --accept_eula 1

+      echo "cleaning up..."
      rm -r $out/uninstall $out/logs
+
+      # replace /proc pentium check with a true statement. this allows usage under emulation.
+      substituteInPlace $out/quartus/adm/qenv.sh \
+        --replace-fail 'grep sse /proc/cpuinfo > /dev/null 2>&1' ':'
    '';

  meta = with lib; {
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -4271,6 +4271,18 @@ final: prev:
    meta.homepage = "https://github.com/morhetz/gruvbox/";
  };

+  gruvbox-baby = buildVimPlugin {
+    pname = "gruvbox-baby";
+    version = "2024-01-25";
+    src = fetchFromGitHub {
+      owner = "luisiacc";
+      repo = "gruvbox-baby";
+      rev = "bd52e62d8134647090108189e69c8b3cd18bdbbf";
+      sha256 = "17wnc3zpxki0fy8fbkinj0jvf6hnkz139x6yrg7hmj97aa8rh4sj";
+    };
+    meta.homepage = "https://github.com/luisiacc/gruvbox-baby/";
+  };
+
  gruvbox-flat-nvim = buildVimPlugin {
    pname = "gruvbox-flat.nvim";
    version = "2023-05-27";
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -356,6 +356,7 @@ https://github.com/liuchengxu/graphviz.vim/,,
 https://github.com/blazkowolf/gruber-darker.nvim/,,
 https://github.com/gruvbox-community/gruvbox/,,gruvbox-community
 https://github.com/morhetz/gruvbox/,,
+https://github.com/luisiacc/gruvbox-baby/,HEAD,
 https://github.com/eddyekofo94/gruvbox-flat.nvim/,,
 https://github.com/sainnhe/gruvbox-material/,,
 https://github.com/ellisonleao/gruvbox.nvim/,,
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@ -15,11 +15,11 @@ let
  archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "1jy1lsbha951z2bcnfrkgin7nms3clpa97rx7c7pdm23mnyg9073";
-    x86_64-darwin = "0425cnzw1dz2k6a9p63w7vf25icf02m04ri82dp0k1kvhjfr8l37";
-    aarch64-linux = "123p1glr9rc1z2lfl8g5zw7rcipg1njybscqn9qyzkpqymcsqfdy";
-    aarch64-darwin = "1bl5wvbfr5k1vy6ah2i9548cn1l3nx3ng4c544zvclskmr8kf84s";
-    armv7l-linux = "0nyv3yjqcrg4r2m2d63qz34g07pp8n0ndmai9pqwcf7a1m0v0sj4";
+    x86_64-linux = "1a9k4w6ggmrd17i038gi40d3hp24z5vs8nidxr5kvl74fi61js6y";
+    x86_64-darwin = "1q9lwx96zcz517pvr97mjqhv86p41ff3cw5jisxbsg6f76aw8y1y";
+    aarch64-linux = "1fdg9xz1fq9k8fc9x0an2kb8hn2vvbsnc48nv6lbx1j5aaa3k42g";
+    aarch64-darwin = "0kqqn24cimbqb8s7rz64niyknpp36w5ycdw8xfms20zfm5ybm82k";
+    armv7l-linux = "14rkr7k0axlaiplf0hdcmyqfgffng25s0j2i903if3i3sqv7316i";
  }.${system} or throwSystem;

  sourceRoot = lib.optionalString (!stdenv.isDarwin) ".";
@ -29,7 +29,7 @@ in

    # Please backport all compatible updates to the stable release.
    # This is important for the extension ecosystem.
-    version = "1.87.2.24072";
+    version = "1.88.0.24096";
    pname = "vscodium";

    executableName = "codium";
--- a/pkgs/applications/emulators/retroarch/hashes.json
+++ b/pkgs/applications/emulators/retroarch/hashes.json
@ -287,31 +287,31 @@
        "src": {
            "owner": "libretro",
            "repo": "fbneo",
-            "rev": "537b5b8dcc358370f2349109004233fbeab46cfe",
-            "hash": "sha256-zBOF1RV2dx5zraREZm/W//8DwrRMDc/j8sx+CwTyKz0="
+            "rev": "cb370363935458e723e0594fb03380c04e7f455b",
+            "hash": "sha256-u0kBdqfUu7QmZBbuLaDJRnsDUJLZiURF6BSkwOX8zpU="
        },
-        "version": "unstable-2024-04-02"
+        "version": "unstable-2024-04-08"
    },
    "fceumm": {
        "fetcher": "fetchFromGitHub",
        "src": {
            "owner": "libretro",
            "repo": "libretro-fceumm",
-            "rev": "40969671ce9e4b1a49165d836476cd71bb960131",
-            "hash": "sha256-wdAigh3qUzB3wmh6q/dwCHHhuyqyAmqV+NSvrzjODVM="
+            "rev": "aebea8783652bc75b21b9d2dcb28cedf1fa78e8a",
+            "hash": "sha256-4ux8pI2d8djkwY0M+h5tlXrLGIDHnMFiFqAWKrZAsxA="
        },
-        "version": "unstable-2024-03-02"
+        "version": "unstable-2024-04-06"
    },
    "flycast": {
        "fetcher": "fetchFromGitHub",
        "src": {
            "owner": "flyinghead",
            "repo": "flycast",
-            "rev": "a0c81d2f2a393bd34caf6f15c1231ba4e2175405",
-            "hash": "sha256-hajTfovkSH7l6AayQyiHI7E4I/82pBhQnDSxo0BcYu0=",
+            "rev": "9d6eab74e1eb182d627f63e1db79752852e9d230",
+            "hash": "sha256-Zi98lszi42XV6u0RhOnt6TVqAfdSaZRcpJIJDwI+ThU=",
            "fetchSubmodules": true
        },
-        "version": "unstable-2024-04-03"
+        "version": "unstable-2024-04-05"
    },
    "fmsx": {
        "fetcher": "fetchFromGitHub",
@ -358,10 +358,10 @@
        "src": {
            "owner": "libretro",
            "repo": "Genesis-Plus-GX",
-            "rev": "667158b034ce860e345b13e1ed927fea9d155b96",
-            "hash": "sha256-uerlejdqJO+vPDs1K7dAxImfJzWrEWlVhF/uTaQoo6E="
+            "rev": "b063aa81b90682ca89ae6fd1e958bc589b4ce34d",
+            "hash": "sha256-Tz6if6NfbwvZVDb5Ggr/tXuLNymOjcMkghKwZq6tl6I="
        },
-        "version": "unstable-2024-03-15"
+        "version": "unstable-2024-04-05"
    },
    "gpsp": {
        "fetcher": "fetchFromGitHub",
@ -408,10 +408,10 @@
        "src": {
            "owner": "libretro",
            "repo": "mame",
-            "rev": "ac9d0347f5d331eb49017cd599a5e63a668b4f22",
-            "hash": "sha256-YlnW5v8Slz/w/AHwWzJ7ZszFic/W0wth2nOZVOD7yxs="
+            "rev": "3aa1ff0d6c087ac35530572d09bc42a2591ff78f",
+            "hash": "sha256-pSBaheo3R5Oxn3nAG8AqodaRtYDIcmT4QVIzLjefa3c="
        },
-        "version": "unstable-2024-04-01"
+        "version": "unstable-2024-04-05"
    },
    "mame2000": {
        "fetcher": "fetchFromGitHub",
@ -438,10 +438,10 @@
        "src": {
            "owner": "libretro",
            "repo": "mame2003-plus-libretro",
-            "rev": "f03f865af9d496965ab15b9a213691319daad9d2",
-            "hash": "sha256-yHVkEJYSXHeUGNFJ/zbAwNi+I4gka8Id7z+LnDkCCSM="
+            "rev": "bf250331362db8fa08a5b3ef60decffba90bf564",
+            "hash": "sha256-7KxQtmmjJuDzoYzpQi/z6eYtThop3Qc1wY0JpUyv26A="
        },
-        "version": "unstable-2024-04-03"
+        "version": "unstable-2024-04-09"
    },
    "mame2010": {
        "fetcher": "fetchFromGitHub",
@ -559,10 +559,10 @@
        "src": {
            "owner": "libretro",
            "repo": "nestopia",
-            "rev": "efe3a052c75ad47d6e98eeffd1f3d2d4893279c2",
-            "hash": "sha256-sSXU+rUBJcE2gQRTqnZV8NSuBz/zWNxlZHQqoAUoigU="
+            "rev": "b99ede358b2219602443e7f414eabf81e17da244",
+            "hash": "sha256-iciidNkOhie3qJO8D4yB081ywfQtGGMrKBWFmBpps9g="
        },
-        "version": "unstable-2024-03-29"
+        "version": "unstable-2024-04-07"
    },
    "np2kai": {
        "fetcher": "fetchFromGitHub",
@ -630,10 +630,10 @@
        "src": {
            "owner": "libretro",
            "repo": "pcsx_rearmed",
-            "rev": "2fb8465594a7ffb7ccbac39fdedf7c70085d7f63",
-            "hash": "sha256-RQU2EDcBRa6aH40JrEJ3eppjflk5++AWlOH+iGJyjFY="
+            "rev": "4cc48a6b324ff1d025768bb5436279831e4bf319",
+            "hash": "sha256-bW/soI5/HgV71L7SdouAeR5ex54veJCTdCXCMwfxHIk="
        },
-        "version": "unstable-2024-03-29"
+        "version": "unstable-2024-04-06"
    },
    "picodrive": {
        "fetcher": "fetchFromGitHub",
@ -651,22 +651,22 @@
        "src": {
            "owner": "jpd002",
            "repo": "Play-",
-            "rev": "8445595b734301f22c6fdd57536867fea3786b58",
-            "hash": "sha256-3e9+PkSGZbjZ2LVY0cWRIK+TbdJ4hn8FxBjWqhsQB4o=",
+            "rev": "8f9fab334eb4ae6faf9cfd88f802cad68674792b",
+            "hash": "sha256-KzRj7Xjfqoi/m+eEHk6Lfk/6FHk4YtrGkY++sjUvT/Y=",
            "fetchSubmodules": true
        },
-        "version": "unstable-2024-04-02"
+        "version": "unstable-2024-04-09"
    },
    "ppsspp": {
        "fetcher": "fetchFromGitHub",
        "src": {
            "owner": "hrydgard",
            "repo": "ppsspp",
-            "rev": "5bead8d999717ed13f7808d3e6b88a237806899e",
-            "hash": "sha256-bGNlzpC3xPX5xyFyMfXbeR4q3Q9bGN/oRwFTLcgzfJM=",
+            "rev": "1bcb15576252ac4b253c39f7c34ea372a3637d96",
+            "hash": "sha256-bc0gJi2C+ZBlF7qczSQ+L4bZD5zt7NNIESEwdpqOhTY=",
            "fetchSubmodules": true
        },
-        "version": "unstable-2024-04-04"
+        "version": "unstable-2024-04-09"
    },
    "prboom": {
        "fetcher": "fetchFromGitHub",
--- a/pkgs/applications/graphics/potreeconverter/default.nix
+++ b/pkgs/applications/graphics/potreeconverter/default.nix
@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
    cmake
  ];

-  patchPhase = ''
+  postPatch = ''
    runHook prePatch

    substituteInPlace ./CMakeLists.txt \
@ -37,12 +37,12 @@ stdenv.mkDerivation rec {
    # prevent inheriting permissions from /nix/store when copying
    substituteInPlace Converter/src/main.cpp --replace \
      'fs::copy(templateDir, pagedir, fs::copy_options::overwrite_existing | fs::copy_options::recursive)' 'string cmd = "cp --no-preserve=mode -r " + templateDir + " " + pagedir; system(cmd.c_str());'
-
-    runHook postPatch
  '';

+  # The upstream build system does not provide an install target.
  installPhase = ''
    runHook preInstall
+
    mkdir -p $out/{bin,lib}
    mv liblaszip.so $out/lib
    mv PotreeConverter $out/bin
@ -56,10 +56,8 @@ stdenv.mkDerivation rec {
    runHook postInstall
  '';

-  fixupPhase = ''
-    runHook preFixup
+  postFixup = ''
    ln -s $src/resources $out/bin/resources
-    runHook postFixup
  '';

  meta = with lib; {
--- a/pkgs/applications/misc/ausweisapp/default.nix
+++ b/pkgs/applications/misc/ausweisapp/default.nix
@ -15,13 +15,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "ausweisapp";
-  version = "2.1.0";
+  version = "2.1.1";

  src = fetchFromGitHub {
    owner = "Governikus";
    repo = "AusweisApp2";
    rev = finalAttrs.version;
-    hash = "sha256-wgVu5Yr65Gu1z5SEWy5l4B6UiI5bIobBfZLhL7s+SRE=";
+    hash = "sha256-YRRm8/yDwQIUjzqYzlqij8h2ri39Q7L8jVh5fgrZbGs=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/bashSnippets/default.nix
+++ b/pkgs/applications/misc/bashSnippets/default.nix
@ -45,7 +45,7 @@ stdenv.mkDerivation {
    description = "A collection of small bash scripts for heavy terminal users";
    homepage = "https://github.com/alexanderepstein/Bash-Snippets";
    license = licenses.mit;
-    maintainers = with maintainers; [ infinisil ];
+    maintainers = [ ];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/misc/buku/default.nix
+++ b/pkgs/applications/misc/buku/default.nix
@ -82,6 +82,6 @@ with python3.pkgs; buildPythonApplication rec {
    homepage = "https://github.com/jarun/Buku";
    license = licenses.gpl3;
    platforms = platforms.unix;
-    maintainers = with maintainers; [ matthiasbeyer infinisil ];
+    maintainers = with maintainers; [ matthiasbeyer ];
  };
 }
--- a/pkgs/applications/misc/googleearth-pro/default.nix
+++ b/pkgs/applications/misc/googleearth-pro/default.nix
@ -120,6 +120,6 @@ mkDerivation rec {
    license = licenses.unfree;
    maintainers = with maintainers; [ friedelino shamilton ];
    platforms = platforms.linux;
-    knownVulnerabilities = [ "Includes vulnerable bundled libraries." ];
+    knownVulnerabilities = [ "Includes vulnerable versions of bundled libraries: openssl, ffmpeg, gdal, and proj." ];
  };
 }
--- a/pkgs/applications/misc/minder/default.nix
+++ b/pkgs/applications/misc/minder/default.nix
@ -25,13 +25,13 @@

 stdenv.mkDerivation rec {
  pname = "minder";
-  version = "1.16.3";
+  version = "1.16.4";

  src = fetchFromGitHub {
    owner = "phase1geo";
    repo = pname;
    rev = version;
-    sha256 = "sha256-YDsWWC4exh+9V87WyjdMdCH1arjBct3oEXbvaFyAaMY=";
+    sha256 = "sha256-1r2PbBYw4mmiScKbX9BGqe4i+emSvismJfPm3opLlOg=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/mkgmap/splitter/default.nix
+++ b/pkgs/applications/misc/mkgmap/splitter/default.nix
@ -15,12 +15,12 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "splitter";
-  version = "653";
+  version = "654";

  src = fetchsvn {
    url = "https://svn.mkgmap.org.uk/mkgmap/splitter/trunk";
    rev = version;
-    sha256 = "sha256-iw414ecnOfeG3FdlIaoVOPv9BXZ95uUHuPzCQGH4G+A=";
+    sha256 = "sha256-y/pl8kIQ6fiF541ho72LMgJFWJdkUBqPToQGCGmmcfg=";
  };

  patches = [
--- a/pkgs/applications/misc/pgmodeler/default.nix
+++ b/pkgs/applications/misc/pgmodeler/default.nix
@ -7,6 +7,8 @@
 , qtwayland
 , qtsvg
 , postgresql
+, cups
+, libxml2
 }:

 stdenv.mkDerivation rec {
@ -21,16 +23,34 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ pkg-config qmake wrapQtAppsHook ];
-  qmakeFlags = [ "pgmodeler.pro" "CONFIG+=release" ];
+  qmakeFlags = [ "pgmodeler.pro" "CONFIG+=release" ] ++ lib.optionals stdenv.isDarwin [
+    "PGSQL_INC=${postgresql}/include"
+    "PGSQL_LIB=${postgresql.lib}/lib/libpq.dylib"
+    "XML_INC=${libxml2.dev}/include/libxml2"
+    "XML_LIB=${libxml2.out}/lib/libxml2.dylib"
+    "PREFIX=${placeholder "out"}/Applications/pgModeler.app/Contents"
+  ];

  # todo: libpq would suffice here. Unfortunately this won't work, if one uses only postgresql.lib here.
-  buildInputs = [ postgresql qtsvg qtwayland ];
+  buildInputs = [ postgresql qtsvg ]
+    ++ lib.optionals stdenv.isLinux [ qtwayland ]
+    ++ lib.optionals stdenv.isDarwin [ cups libxml2 ];
+
+  postInstall = lib.optionalString stdenv.isDarwin ''
+    mkdir -p $out/bin
+    for item in pgmodeler pgmodeler-{cli,se,ch}
+    do
+      ln -s $out/Applications/pgModeler.app/Contents/MacOS/$item $out/bin
+    done
+  '';
+
+  dontWrapQtApps = stdenv.isDarwin;

  meta = with lib; {
    description = "A database modeling tool for PostgreSQL";
    homepage = "https://pgmodeler.io/";
    license = licenses.gpl3;
    maintainers = [ maintainers.esclear ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/misc/syncthingtray/default.nix
+++ b/pkgs/applications/misc/syncthingtray/default.nix
@ -34,14 +34,14 @@ https://github.com/NixOS/nixpkgs/issues/199596#issuecomment-1310136382 */
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "1.5.1";
+  version = "1.5.2";
  pname = "syncthingtray";

  src = fetchFromGitHub {
    owner = "Martchus";
    repo = "syncthingtray";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-6Q3nf6WjFgpBK7VR+ykmtIM68vwsmrYqmJPXsPpWjs4=";
+    hash = "sha256-OjrkmpH9sVrO3M25PKj6jhmI2DmbP+/r4mOZ4BqE/1Y=";
  };

  buildInputs = [
--- a/pkgs/applications/misc/tandoor-recipes/common.nix
+++ b/pkgs/applications/misc/tandoor-recipes/common.nix
@ -1,15 +1,15 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "1.5.12";
+  version = "1.5.16";

  src = fetchFromGitHub {
    owner = "TandoorRecipes";
    repo = "recipes";
    rev = version;
-    hash = "sha256-5UslXRoiq9cipGCOiqpf+rv7OPTsW4qpVTjakNeg4ug=";
+    hash = "sha256-A5cPO3uybTmAV8zWY90S9vtU/tLgbh1Iqhi+ty0RLhM=";
  };

-  yarnHash = "sha256-CresovsRh+dLHGnv49fCi/i66QXOS3SnzfFNvkVUfd8=";
+  yarnHash = "sha256-OAgVaXWTVlKqIgDgKNT1MWN3dYzTqrAGgNAnXLDHE+I=";

  meta = with lib; {
    homepage = "https://tandoor.dev/";
--- a/pkgs/applications/misc/tandoor-recipes/default.nix
+++ b/pkgs/applications/misc/tandoor-recipes/default.nix
@ -32,15 +32,15 @@ python.pkgs.pythonPackages.buildPythonPackage rec {
  format = "other";

  patches = [
-    # Allow setting MEDIA_ROOT through environment variable
-    # https://github.com/TandoorRecipes/recipes/pull/2931
-    (fetchpatch {
-      url = "https://github.com/TandoorRecipes/recipes/commit/abf981792057481f1d5b7473eb1090b3901ef8fa.patch";
-      hash = "sha256-3AFf0K/BpVwPQ2NGLUsefj6HvW7ej3szd3WaxFoqMiQ=";
-    })
+    ./pytest-xdist.patch # adapt pytest.ini the use $NIX_BUILD_CORES
  ];

+  postPatch = ''
+    substituteInPlace pytest.ini --subst-var NIX_BUILD_CORES
+  '';
+
  propagatedBuildInputs = with python.pkgs; [
+    aiohttp
    beautifulsoup4
    bleach
    bleach-allowlist
@ -50,7 +50,6 @@ python.pkgs.pythonPackages.buildPythonPackage rec {
    django-allauth
    django-annoying
    django-auth-ldap
-    django-autocomplete-light
    django-cleanup
    django-cors-headers
    django-crispy-forms
@ -132,15 +131,21 @@ python.pkgs.pythonPackages.buildPythonPackage rec {
  '';

  nativeCheckInputs = with python.pkgs; [
+    mock
    pytestCheckHook
+    pytest-asyncio
+    pytest-cov
    pytest-django
    pytest-factoryboy
+    pytest-html
+    pytest-xdist
  ];

  # flaky
  disabledTests = [
    "test_search_count"
    "test_url_import_regex_replace"
+    "test_delete"
  ];

  passthru = {
--- a/pkgs/applications/misc/tandoor-recipes/pytest-xdist.patch
+++ b/pkgs/applications/misc/tandoor-recipes/pytest-xdist.patch
@ -0,0 +1,12 @@
+diff --git a/pytest.ini b/pytest.ini
+index a3d26ec4..8bdf12fb 100644
+--- a/pytest.ini
+++ b/pytest.ini
+@@ -3,5 +3,5 @@ DJANGO_SETTINGS_MODULE = recipes.test_settings
+ testpaths = cookbook/tests
+ python_files = tests.py test_*.py *_tests.py
+ # uncomment to run coverage reports
+-addopts = -n auto --cov=. --cov-report=html:docs/reports/coverage --cov-report=xml:docs/reports/coverage/coverage.xml --junitxml=docs/reports/tests/pytest.xml --html=docs/reports/tests/tests.html
+addopts = -n @NIX_BUILD_CORES@ --cov=. --cov-report=html:docs/reports/coverage --cov-report=xml:docs/reports/coverage/coverage.xml --junitxml=docs/reports/tests/pytest.xml --html=docs/reports/tests/tests.html
+ # addopts = -n auto --junitxml=docs/reports/tests/pytest.xml --html=docs/reports/tests/tests.html
+\ No newline at end of file
--- a/pkgs/applications/misc/tasknc/default.nix
+++ b/pkgs/applications/misc/tasknc/default.nix
@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/lharding/tasknc";
    description = "A ncurses wrapper around taskwarrior";
    mainProgram = "tasknc";
-    maintainers = with maintainers; [ matthiasbeyer infinisil ];
+    maintainers = with maintainers; [ matthiasbeyer ];
    platforms = platforms.linux; # Cannot test others
    license = licenses.mit;
  };
--- a/pkgs/applications/misc/tmatrix/default.nix
+++ b/pkgs/applications/misc/tmatrix/default.nix
@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/M4444/TMatrix";
    license = licenses.gpl2;
    platforms = platforms.all;
-    maintainers = with maintainers; [ infinisil Br1ght0ne ];
+    maintainers = with maintainers; [ Br1ght0ne ];
    mainProgram = "tmatrix";
  };
 }
--- a/pkgs/applications/misc/translate-shell/default.nix
+++ b/pkgs/applications/misc/translate-shell/default.nix
@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
    homepage = "https://www.soimort.org/translate-shell";
    description = "Command-line translator using Google Translate, Bing Translator, Yandex.Translate, and Apertium";
    license = licenses.unlicense;
-    maintainers = with maintainers; [ ebzzry infinisil ];
+    maintainers = with maintainers; [ ebzzry ];
    mainProgram = "trans";
    platforms = platforms.unix;
  };
--- a/pkgs/applications/networking/avalanchego/default.nix
+++ b/pkgs/applications/networking/avalanchego/default.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "avalanchego";
-  version = "1.11.3";
+  version = "1.11.4";

  src = fetchFromGitHub {
    owner = "ava-labs";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-VeszkBExveXmajnVLHDp9Fc9xngnUKBbVY55L260rds=";
+    hash = "sha256-0YS+q1gy7YmTx/DwxaElBG1tzosXReXqPu6RpR3hTjw=";
  };

-  vendorHash = "sha256-8K8loSdeISkA06LBkZgro+mEbQEZY1sdzplq7IKZ4kI=";
+  vendorHash = "sha256-et1PVLJQ/vBsg5438s6d9MA2oV40zahp9YKQOE0RX58=";
  # go mod vendor has a bug, see: https://github.com/golang/go/issues/57529
  proxyVendor = true;

--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -1,214 +1,21 @@
-{ lib, stdenv, fetchurl, wrapGAppsHook, makeWrapper
-, alsa-lib
-, at-spi2-atk
-, at-spi2-core
-, atk
-, cairo
-, cups
-, dbus
-, dpkg
-, expat
-, fontconfig
-, freetype
-, gdk-pixbuf
-, glib
-, gnome
-, gsettings-desktop-schemas
-, gtk3
-, gtk4
-, libX11
-, libXScrnSaver
-, libXcomposite
-, libXcursor
-, libXdamage
-, libXext
-, libXfixes
-, libXi
-, libXrandr
-, libXrender
-, libXtst
-, libdrm
-, libkrb5
-, libuuid
-, libxkbcommon
-, libxshmfence
-, mesa
-, nspr
-, nss
-, pango
-, pipewire
-, snappy
-, udev
-, wayland
-, xdg-utils
-, coreutils
-, xorg
-, zlib
+# Expression generated by update.sh; do not edit it by hand!
+{ stdenv, callPackage }:

-# command line arguments which are always set e.g "--disable-gpu"
-, commandLineArgs ? ""
-
-# Necessary for USB audio devices.
-, pulseSupport ? stdenv.isLinux
-, libpulseaudio
-
-# For GPU acceleration support on Wayland (without the lib it doesn't seem to work)
-, libGL
-
-# For video acceleration via VA-API (--enable-features=VaapiVideoDecoder,VaapiVideoEncoder)
-, libvaSupport ? stdenv.isLinux
-, libva
-, enableVideoAcceleration ? libvaSupport
-
-# For Vulkan support (--enable-features=Vulkan); disabled by default as it seems to break VA-API
-, vulkanSupport ? false
-, addOpenGLRunpath
-, enableVulkan ? vulkanSupport
-}:
-
-let
-  inherit (lib) optional optionals makeLibraryPath makeSearchPathOutput makeBinPath
-    optionalString strings escapeShellArg;
-
-  deps = [
-    alsa-lib at-spi2-atk at-spi2-core atk cairo cups dbus expat
-    fontconfig freetype gdk-pixbuf glib gtk3 gtk4 libdrm libX11 libGL
-    libxkbcommon libXScrnSaver libXcomposite libXcursor libXdamage
-    libXext libXfixes libXi libXrandr libXrender libxshmfence
-    libXtst libuuid mesa nspr nss pango pipewire udev wayland
-    xorg.libxcb zlib snappy libkrb5
-  ]
-    ++ optional pulseSupport libpulseaudio
-    ++ optional libvaSupport libva;
-
-  rpath = makeLibraryPath deps + ":" + makeSearchPathOutput "lib" "lib64" deps;
-  binpath = makeBinPath deps;
-
-  enableFeatures = optionals enableVideoAcceleration [ "VaapiVideoDecoder" "VaapiVideoEncoder" ]
-    ++ optional enableVulkan "Vulkan";
-
-  disableFeatures = [ "OutdatedBuildDetector" ] # disable automatic updates
-    # The feature disable is needed for VAAPI to work correctly: https://github.com/brave/brave-browser/issues/20935
-    ++ optionals enableVideoAcceleration  [ "UseChromeOSDirectVideoDecoder" ];
-in
-
-stdenv.mkDerivation rec {
-  pname = "brave";
-  version = "1.64.113";
-
-  src = fetchurl {
-    url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    hash = "sha256-T0uVq1yxDXNi6x9ot5bs3NRaOQ+RwBThvULS6EZ+Bdg=";
-  };
-
-  dontConfigure = true;
-  dontBuild = true;
-  dontPatchELF = true;
-  doInstallCheck = true;
-
-  nativeBuildInputs = [
-    dpkg
-    (wrapGAppsHook.override { inherit makeWrapper; })
-  ];
-
-  buildInputs = [
-    # needed for GSETTINGS_SCHEMAS_PATH
-    glib gsettings-desktop-schemas gtk3 gtk4
-
-    # needed for XDG_ICON_DIRS
-    gnome.adwaita-icon-theme
-  ];
-
-  unpackPhase = "dpkg-deb --fsys-tarfile $src | tar -x --no-same-permissions --no-same-owner";
-
-  installPhase = ''
-      runHook preInstall
-
-      mkdir -p $out $out/bin
-
-      cp -R usr/share $out
-      cp -R opt/ $out/opt
-
-      export BINARYWRAPPER=$out/opt/brave.com/brave/brave-browser
-
-      # Fix path to bash in $BINARYWRAPPER
-      substituteInPlace $BINARYWRAPPER \
-          --replace /bin/bash ${stdenv.shell}
-
-      ln -sf $BINARYWRAPPER $out/bin/brave
-
-      for exe in $out/opt/brave.com/brave/{brave,chrome_crashpad_handler}; do
-          patchelf \
-              --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-              --set-rpath "${rpath}" $exe
-      done
-
-      # Fix paths
-      substituteInPlace $out/share/applications/brave-browser.desktop \
-          --replace /usr/bin/brave-browser-stable $out/bin/brave
-      substituteInPlace $out/share/gnome-control-center/default-apps/brave-browser.xml \
-          --replace /opt/brave.com $out/opt/brave.com
-      substituteInPlace $out/share/menu/brave-browser.menu \
-          --replace /opt/brave.com $out/opt/brave.com
-      substituteInPlace $out/opt/brave.com/brave/default-app-block \
-          --replace /opt/brave.com $out/opt/brave.com
-
-      # Correct icons location
-      icon_sizes=("16" "24" "32" "48" "64" "128" "256")
-
-      for icon in ''${icon_sizes[*]}
-      do
-          mkdir -p $out/share/icons/hicolor/$icon\x$icon/apps
-          ln -s $out/opt/brave.com/brave/product_logo_$icon.png $out/share/icons/hicolor/$icon\x$icon/apps/brave-browser.png
-      done
-
-      # Replace xdg-settings and xdg-mime
-      ln -sf ${xdg-utils}/bin/xdg-settings $out/opt/brave.com/brave/xdg-settings
-      ln -sf ${xdg-utils}/bin/xdg-mime $out/opt/brave.com/brave/xdg-mime
-
-      runHook postInstall
-  '';
-
-  preFixup = ''
-    # Add command line args to wrapGApp.
-    gappsWrapperArgs+=(
-      --prefix LD_LIBRARY_PATH : ${rpath}
-      --prefix PATH : ${binpath}
-      --suffix PATH : ${lib.makeBinPath [ xdg-utils coreutils ]}
-      ${optionalString (enableFeatures != []) ''
-      --add-flags "--enable-features=${strings.concatStringsSep "," enableFeatures}\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+,WaylandWindowDecorations}}"
-      ''}
-      ${optionalString (disableFeatures != []) ''
-      --add-flags "--disable-features=${strings.concatStringsSep "," disableFeatures}"
-      ''}
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto}}"
-      ${optionalString vulkanSupport ''
-      --prefix XDG_DATA_DIRS  : "${addOpenGLRunpath.driverLink}/share"
-      ''}
-      --add-flags ${escapeShellArg commandLineArgs}
-    )
-  '';
-
-  installCheckPhase = ''
-    # Bypass upstream wrapper which suppresses errors
-    $out/opt/brave.com/brave/brave --version
-  '';
-
-  passthru.updateScript = ./update.sh;
-
-  meta = with lib; {
-    homepage = "https://brave.com/";
-    description = "Privacy-oriented browser for Desktop and Laptop computers";
-    changelog = "https://github.com/brave/brave-browser/blob/master/CHANGELOG_DESKTOP.md#" + replaceStrings [ "." ] [ "" ] version;
-    longDescription = ''
-      Brave browser blocks the ads and trackers that slow you down,
-      chew up your bandwidth, and invade your privacy. Brave lets you
-      contribute to your favorite creators automatically.
-    '';
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.mpl20;
-    maintainers = with maintainers; [ uskudnik rht jefflabonte nasirhm buckley310 ];
-    platforms = [ "x86_64-linux" ];
-    mainProgram = "brave";
-  };
-}
+if stdenv.isAarch64 then
+  callPackage ./make-brave.nix { } {
+    pname = "brave";
+    version = "1.64.116";
+    url = "https://github.com/brave/brave-browser/releases/download/v1.64.116/brave-browser_1.64.116_arm64.deb";
+    hash = "sha256-XC3GnutiTYdCOJPegj8MRYC5dRrBoKBg4k50ZFrlj4E=";
+    platform = "aarch64-linux";
+  }
+else if stdenv.isx86_64 then
+  callPackage ./make-brave.nix { } {
+    pname = "brave";
+    version = "1.64.116";
+    url = "https://github.com/brave/brave-browser/releases/download/v1.64.116/brave-browser_1.64.116_amd64.deb";
+    hash = "sha256-mnvFPfZu44TZGdUb+AxaJbecQrXkIzJkYvB4GO55uv0=";
+    platform = "x86_64-linux";
+  }
+else
+  throw "Unsupported platform."
--- a/pkgs/applications/networking/browsers/brave/make-brave.nix
+++ b/pkgs/applications/networking/browsers/brave/make-brave.nix
@ -0,0 +1,218 @@
+{ lib, stdenv, fetchurl, wrapGAppsHook, makeWrapper
+, alsa-lib
+, at-spi2-atk
+, at-spi2-core
+, atk
+, cairo
+, cups
+, dbus
+, dpkg
+, expat
+, fontconfig
+, freetype
+, gdk-pixbuf
+, glib
+, gnome
+, gsettings-desktop-schemas
+, gtk3
+, gtk4
+, libX11
+, libXScrnSaver
+, libXcomposite
+, libXcursor
+, libXdamage
+, libXext
+, libXfixes
+, libXi
+, libXrandr
+, libXrender
+, libXtst
+, libdrm
+, libkrb5
+, libuuid
+, libxkbcommon
+, libxshmfence
+, mesa
+, nspr
+, nss
+, pango
+, pipewire
+, snappy
+, udev
+, wayland
+, xdg-utils
+, coreutils
+, xorg
+, zlib
+
+# command line arguments which are always set e.g "--disable-gpu"
+, commandLineArgs ? ""
+
+# Necessary for USB audio devices.
+, pulseSupport ? stdenv.isLinux
+, libpulseaudio
+
+# For GPU acceleration support on Wayland (without the lib it doesn't seem to work)
+, libGL
+
+# For video acceleration via VA-API (--enable-features=VaapiVideoDecoder,VaapiVideoEncoder)
+, libvaSupport ? stdenv.isLinux
+, libva
+, enableVideoAcceleration ? libvaSupport
+
+# For Vulkan support (--enable-features=Vulkan); disabled by default as it seems to break VA-API
+, vulkanSupport ? false
+, addOpenGLRunpath
+, enableVulkan ? vulkanSupport
+}:
+
+{ pname
+, version
+, hash
+, url
+, platform
+}:
+
+let
+  inherit (lib) optional optionals makeLibraryPath makeSearchPathOutput makeBinPath
+    optionalString strings escapeShellArg;
+
+  deps = [
+    alsa-lib at-spi2-atk at-spi2-core atk cairo cups dbus expat
+    fontconfig freetype gdk-pixbuf glib gtk3 gtk4 libdrm libX11 libGL
+    libxkbcommon libXScrnSaver libXcomposite libXcursor libXdamage
+    libXext libXfixes libXi libXrandr libXrender libxshmfence
+    libXtst libuuid mesa nspr nss pango pipewire udev wayland
+    xorg.libxcb zlib snappy libkrb5
+  ]
+    ++ optional pulseSupport libpulseaudio
+    ++ optional libvaSupport libva;
+
+  rpath = makeLibraryPath deps + ":" + makeSearchPathOutput "lib" "lib64" deps;
+  binpath = makeBinPath deps;
+
+  enableFeatures = optionals enableVideoAcceleration [ "VaapiVideoDecoder" "VaapiVideoEncoder" ]
+    ++ optional enableVulkan "Vulkan";
+
+  disableFeatures = [ "OutdatedBuildDetector" ] # disable automatic updates
+    # The feature disable is needed for VAAPI to work correctly: https://github.com/brave/brave-browser/issues/20935
+    ++ optionals enableVideoAcceleration  [ "UseChromeOSDirectVideoDecoder" ];
+in
+stdenv.mkDerivation {
+  inherit pname version;
+
+  src = fetchurl {
+    inherit url hash;
+  };
+
+  dontConfigure = true;
+  dontBuild = true;
+  dontPatchELF = true;
+  doInstallCheck = true;
+
+  nativeBuildInputs = [
+    dpkg
+    (wrapGAppsHook.override { inherit makeWrapper; })
+  ];
+
+  buildInputs = [
+    # needed for GSETTINGS_SCHEMAS_PATH
+    glib gsettings-desktop-schemas gtk3 gtk4
+
+    # needed for XDG_ICON_DIRS
+    gnome.adwaita-icon-theme
+  ];
+
+  unpackPhase = "dpkg-deb --fsys-tarfile $src | tar -x --no-same-permissions --no-same-owner";
+
+  installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out $out/bin
+
+      cp -R usr/share $out
+      cp -R opt/ $out/opt
+
+      export BINARYWRAPPER=$out/opt/brave.com/brave/brave-browser
+
+      # Fix path to bash in $BINARYWRAPPER
+      substituteInPlace $BINARYWRAPPER \
+          --replace /bin/bash ${stdenv.shell}
+
+      ln -sf $BINARYWRAPPER $out/bin/brave
+
+      for exe in $out/opt/brave.com/brave/{brave,chrome_crashpad_handler}; do
+          patchelf \
+              --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+              --set-rpath "${rpath}" $exe
+      done
+
+      # Fix paths
+      substituteInPlace $out/share/applications/brave-browser.desktop \
+          --replace /usr/bin/brave-browser-stable $out/bin/brave
+      substituteInPlace $out/share/gnome-control-center/default-apps/brave-browser.xml \
+          --replace /opt/brave.com $out/opt/brave.com
+      substituteInPlace $out/share/menu/brave-browser.menu \
+          --replace /opt/brave.com $out/opt/brave.com
+      substituteInPlace $out/opt/brave.com/brave/default-app-block \
+          --replace /opt/brave.com $out/opt/brave.com
+
+      # Correct icons location
+      icon_sizes=("16" "24" "32" "48" "64" "128" "256")
+
+      for icon in ''${icon_sizes[*]}
+      do
+          mkdir -p $out/share/icons/hicolor/$icon\x$icon/apps
+          ln -s $out/opt/brave.com/brave/product_logo_$icon.png $out/share/icons/hicolor/$icon\x$icon/apps/brave-browser.png
+      done
+
+      # Replace xdg-settings and xdg-mime
+      ln -sf ${xdg-utils}/bin/xdg-settings $out/opt/brave.com/brave/xdg-settings
+      ln -sf ${xdg-utils}/bin/xdg-mime $out/opt/brave.com/brave/xdg-mime
+
+      runHook postInstall
+  '';
+
+  preFixup = ''
+    # Add command line args to wrapGApp.
+    gappsWrapperArgs+=(
+      --prefix LD_LIBRARY_PATH : ${rpath}
+      --prefix PATH : ${binpath}
+      --suffix PATH : ${lib.makeBinPath [ xdg-utils coreutils ]}
+      ${optionalString (enableFeatures != []) ''
+      --add-flags "--enable-features=${strings.concatStringsSep "," enableFeatures}\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+,WaylandWindowDecorations}}"
+      ''}
+      ${optionalString (disableFeatures != []) ''
+      --add-flags "--disable-features=${strings.concatStringsSep "," disableFeatures}"
+      ''}
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto}}"
+      ${optionalString vulkanSupport ''
+      --prefix XDG_DATA_DIRS  : "${addOpenGLRunpath.driverLink}/share"
+      ''}
+      --add-flags ${escapeShellArg commandLineArgs}
+    )
+  '';
+
+  installCheckPhase = ''
+    # Bypass upstream wrapper which suppresses errors
+    $out/opt/brave.com/brave/brave --version
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    homepage = "https://brave.com/";
+    description = "Privacy-oriented browser for Desktop and Laptop computers";
+    changelog = "https://github.com/brave/brave-browser/blob/master/CHANGELOG_DESKTOP.md#" + lib.replaceStrings [ "." ] [ "" ] version;
+    longDescription = ''
+      Brave browser blocks the ads and trackers that slow you down,
+      chew up your bandwidth, and invade your privacy. Brave lets you
+      contribute to your favorite creators automatically.
+    '';
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [ uskudnik rht jefflabonte nasirhm buckley310 ];
+    platforms = [ "aarch64-linux" "x86_64-linux" ];
+    mainProgram = "brave";
+  };
+}
--- a/pkgs/applications/networking/browsers/brave/update.sh
+++ b/pkgs/applications/networking/browsers/brave/update.sh
@ -1,5 +1,42 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl gnused common-updater-scripts
+#!nix-shell -i bash -p curl gnused nix

-version="$(curl -sL https://brave-browser-apt-release.s3.brave.com/dists/stable/main/binary-amd64/Packages | sed -r -n 's/^Version: (.*)/\1/p' | head -n1)"
-update-source-version brave "$version"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
+
+latestVersionAarch64="$(curl -sL https://brave-browser-apt-release.s3.brave.com/dists/stable/main/binary-arm64/Packages \
+    | sed -r -n 's/^Version: (.*)/\1/p' | head -n1)"
+hashAarch64="$(nix hash to-sri --type sha256 \
+    $(curl -sL https://brave-browser-apt-release.s3.brave.com/dists/stable/main/binary-arm64/Packages \
+    | sed -r -n 's/^SHA256: (.*)/\1/p' | head -n1)
+)"
+
+latestVersionAmd64="$(curl -sL https://brave-browser-apt-release.s3.brave.com/dists/stable/main/binary-amd64/Packages \
+    | sed -r -n 's/^Version: (.*)/\1/p' | head -n1)"
+hashAmd64="$(nix hash to-sri --type sha256 \
+    $(curl -sL https://brave-browser-apt-release.s3.brave.com/dists/stable/main/binary-amd64/Packages \
+    | sed -r -n 's/^SHA256: (.*)/\1/p' | head -n1)
+)"
+
+cat > $SCRIPT_DIR/default.nix << EOF
+# Expression generated by update.sh; do not edit it by hand!
+{ stdenv, callPackage }:
+
+if stdenv.isAarch64 then
+  callPackage ./make-brave.nix { } {
+    pname = "brave";
+    version = "${latestVersionAarch64}";
+    url = "https://github.com/brave/brave-browser/releases/download/v${latestVersionAarch64}/brave-browser_${latestVersionAarch64}_arm64.deb";
+    hash = "${hashAarch64}";
+    platform = "aarch64-linux";
+  }
+else if stdenv.isx86_64 then
+  callPackage ./make-brave.nix { } {
+    pname = "brave";
+    version = "${latestVersionAmd64}";
+    url = "https://github.com/brave/brave-browser/releases/download/v${latestVersionAmd64}/brave-browser_${latestVersionAmd64}_amd64.deb";
+    hash = "${hashAmd64}";
+    platform = "x86_64-linux";
+  }
+else
+  throw "Unsupported platform."
+EOF
--- a/pkgs/applications/networking/cluster/arkade/default.nix
+++ b/pkgs/applications/networking/cluster/arkade/default.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "arkade";
-  version = "0.11.6";
+  version = "0.11.9";

  src = fetchFromGitHub {
    owner = "alexellis";
    repo = "arkade";
    rev = version;
-    hash = "sha256-PCyPdUgvW2wCo1MZ/5jbPLfermbYKZKDbAFsc2goqlY=";
+    hash = "sha256-TJja4FL440ZG5VsCfJsKUYeM2YPlMSl2+ejjlgyP5IY=";
  };

  CGO_ENABLED = 0;
--- a/pkgs/applications/networking/cluster/kubespy/default.nix
+++ b/pkgs/applications/networking/cluster/kubespy/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kubespy";
-  version = "0.6.2";
+  version = "0.6.3";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "pulumi";
    repo = "kubespy";
-    sha256 = "sha256-eSQl8K+a9YcKXE80bl25+alHoBG8T+LCYOd4Bd9QSdY=";
+    sha256 = "sha256-l/vOIFvCQHq+gOr38SpVZ8ShZdI1bP4G5PY4hKhkCU0=";
  };

-  vendorHash = "sha256-brs4QIo4QoLHU95llBHN51zYcgQgN7kbMJDMy2OYOsk=";
+  vendorHash = "sha256-4q+eFMrcZsEdk1W7aorIrfS3oVAuD4V0KQ7oJ/5d8nk=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/networking/cluster/tftui/default.nix
+++ b/pkgs/applications/networking/cluster/tftui/default.nix
@ -7,14 +7,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "tftui";
-  version = "0.12.6";
+  version = "0.13.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "idoavrah";
    repo = "terraform-tui";
    rev = "refs/tags/v${version}";
-    hash = "sha256-vK1qKf8+RxwHUpuEQ97PcwGvObNVpd88kAb3DFRoRG0=";
+    hash = "sha256-2Kya0MRa1kc3B5nqs2MNprtnjOGyMLQh2OSErdT5W8M=";
  };

  pythonRelaxDeps = [
--- a/pkgs/applications/networking/deck/default.nix
+++ b/pkgs/applications/networking/deck/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "deck";
-  version = "1.36.1";
+  version = "1.36.2";

  src = fetchFromGitHub {
    owner = "Kong";
    repo = "deck";
    rev = "v${version}";
-    hash = "sha256-9wPwqiQBVVGCRVarAAWk9QjkbJBgCAKY16MjqT8ZBI4=";
+    hash = "sha256-8iRWV+zm/qiSJUgx8OnCf0sZqycXnAv4dUtbTIzIT5k=";
  };

  nativeBuildInputs = [ installShellFiles ];
@ -21,7 +21,7 @@ buildGoModule rec {
  ];

  proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-WNyDHFdqUREATvJW+akhLB1HQIXMZshn48FEw/OkfV0=";
+  vendorHash = "sha256-c5kq5vql3KSv8gkm4Wrp1llUhUOWZuuhkzNXDYrgUhw=";

  postInstall = ''
    installShellCompletion --cmd deck \
--- a/pkgs/applications/networking/instant-messengers/element/pin.nix
+++ b/pkgs/applications/networking/instant-messengers/element/pin.nix
@ -1,9 +1,9 @@
 {
-  "version" = "1.11.63";
+  "version" = "1.11.64";
  "hashes" = {
-    "desktopSrcHash" = "sha256-wQSFnF3HzERW4iS5leHP2LZKrJkTPW+LUgmj5b0/KZk=";
-    "desktopYarnHash" = "003d44psrw09dldvp9lfhsnipmcy1fwbicsvmd48mg7n3vnrg0zw";
-    "webSrcHash" = "sha256-FjYDwXa+7Lx/K0AERn64mPbjp0QFIoVoYMPx/mG4Zrs=";
-    "webYarnHash" = "0n7z9y3141rx0c5476zw3ccfck0f4b2jwsaxmq2ff7spwyw81zd2";
+    "desktopSrcHash" = "sha256-U6vVuc7claPZI4idZmTXpm1GHm+VrmoaJNVgJU0GHMU=";
+    "desktopYarnHash" = "079jg178cq2m91fhzrdab8x33wrm5a97ga19g0268q118vbnv98l";
+    "webSrcHash" = "sha256-jphxYlSxHjck6XA3JXofC6AbVb+aVOjsbxLUqo1hRhY=";
+    "webYarnHash" = "0q91llgx8cy6zxinfqbnrcfkmclqx7czlp08f1ls43x0w2vd8447";
  };
 }
--- a/pkgs/applications/networking/instant-messengers/gurk-rs/Cargo.lock
+++ b/pkgs/applications/networking/instant-messengers/gurk-rs/Cargo.lock
--- a/pkgs/applications/networking/instant-messengers/gurk-rs/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gurk-rs/default.nix
@ -9,13 +9,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "gurk-rs";
-  version = "0.4.2";
+  version = "0.4.3";

  src = fetchFromGitHub {
    owner = "boxdot";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-UTjTXUc0W+vlO77ilveAy0HWF5KSKbDnrg5ewTyuTdA=";
+    hash = "sha256-MPYqWgwh5PKH3GsCDx6aa4ryorWZ96YK8KOYZ5PILkk=";
  };

  postPatch = ''
@ -25,10 +25,10 @@ rustPlatform.buildRustPackage rec {
  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "libsignal-protocol-0.1.0" = "sha256-FCrJO7porlY5FrwZ2c67UPd4tgN7cH2/3DTwfPjihwM=";
-      "libsignal-service-0.1.0" = "sha256-OWLtaxldKgYPP/aJuWezNkNN0990l3RtDWK38R1fL90=";
-      "curve25519-dalek-4.0.0" = "sha256-KUXvYXeVvJEQ/+dydKzXWCZmA2bFa2IosDzaBL6/Si0=";
-      "presage-0.6.0-dev" = "sha256-65YhxMAAFsnOprBWiB0uH/R9iITt+EYn+kMVjAwTgOQ=";
+      "libsignal-protocol-0.1.0" = "sha256-p4YzrtJaQhuMBTtquvS1m9llszfyTeDfl7+IXzRUFSE=";
+      "libsignal-service-0.1.0" = "sha256-p0umCPtBg9s4G6RHcwK/tU+RtQE2fFLRHOYt2GmBCtQ=";
+      "curve25519-dalek-4.1.1" = "sha256-p9Vx0lAaYILypsI4/RVsHZLOqZKaa4Wvf7DanLA38pc=";
+      "presage-0.6.1" = "sha256-MsVSUI4ht+ftO2UC1IIeCtomkzg4ug95kKsc41PDVNg=";
      "qr2term-0.3.1" = "sha256-U8YLouVZTtDwsvzZiO6YB4Pe75RXGkZXOxHCQcCOyT8=";
    };
  };
--- a/pkgs/applications/networking/instant-messengers/ripcord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/ripcord/default.nix
@ -63,7 +63,7 @@ mkDerivation rec {
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
    # See: https://cancel.fm/ripcord/shareware-redistribution/
    license = licenses.unfreeRedistributable;
-    maintainers = with maintainers; [ infinisil ];
+    maintainers = [ ];
    platforms = [ "x86_64-linux" ];
  };
 }
--- a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
@ -63,14 +63,14 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "telegram-desktop";
-  version = "4.16.4";
+  version = "4.16.6";

  src = fetchFromGitHub {
    owner = "telegramdesktop";
    repo = "tdesktop";
    rev = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-WBLDsUUEbyn6/NqdbfaUKhoH0T/c9k6lKCy23WPRuqk=";
+    hash = "sha256-1NRA8guTbDEraW1uXSo7q54d1e8/QnXwxkfb6k3e6b0=";
  };

  patches = [
--- a/pkgs/applications/networking/mumble/default.nix
+++ b/pkgs/applications/networking/mumble/default.nix
@ -51,7 +51,7 @@ let
      mainProgram = "mumble-server";
      homepage = "https://mumble.info";
      license = licenses.bsd3;
-      maintainers = with maintainers; [ infinisil felixsinger lilacious ];
+      maintainers = with maintainers; [ felixsinger lilacious ];
      platforms = platforms.linux;
    };
  });
--- a/pkgs/applications/networking/trayscale/default.nix
+++ b/pkgs/applications/networking/trayscale/default.nix
@ -11,13 +11,13 @@

 buildGoModule rec {
  pname = "trayscale";
-  version = "0.11.1";
+  version = "0.11.2";

  src = fetchFromGitHub {
    owner = "DeedleFake";
    repo = "trayscale";
    rev = "v${version}";
-    hash = "sha256-SepVgSxM4+csX7S0LPl6HmGDcgS991sgWJrOAA2YjIc=";
+    hash = "sha256-Og/ilxWNB5TNqnViZ5TeE0P+RxG1JOP2q9jo91SBNZQ=";
  };

  vendorHash = "sha256-eIakjEYfVp2wfXu0oqBmd5hJZTp0xgYKNNbtpRBnT2w=";
--- a/pkgs/applications/networking/znc/modules.nix
+++ b/pkgs/applications/networking/znc/modules.nix
@ -37,7 +37,7 @@ in
      description = "Request backlog for IRC channels.";
      homepage = "https://github.com/fruitiex/znc-backlog/";
      license = licenses.asl20;
-      maintainers = with maintainers; [ infinisil ];
+      maintainers = [ ];
    };
  };

--- a/pkgs/applications/radio/quisk/default.nix
+++ b/pkgs/applications/radio/quisk/default.nix
@ -8,11 +8,11 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "quisk";
-  version = "4.2.30";
+  version = "4.2.31";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-1CpIb8Hj9hpsOkxhY3HNKaYYbWa5cZY5//WAzeuvY/o=";
+    sha256 = "sha256-WzB/KAkjJ6zPPfOe35kbT3HbbCNQjm44GL0hInk3TH8=";
  };

  buildInputs = [
--- a/pkgs/applications/science/logic/klee/default.nix
+++ b/pkgs/applications/science/logic/klee/default.nix
@ -6,7 +6,6 @@
 , clang
 , llvm
 , python3
-, zlib
 , z3
 , stp
 , cryptominisat
@ -45,13 +44,13 @@ let
  };
 in stdenv.mkDerivation rec {
  pname = "klee";
-  version = "3.0";
+  version = "3.1";

  src = fetchFromGitHub {
    owner = "klee";
    repo = "klee";
    rev = "v${version}";
-    hash = "sha256-y5lWmtIcLAthQ0oHYQNd+ir75YaxHZR9Jgiz+ZUFQjY=";
+    hash = "sha256-5js1N8qVF0lCkahSU3ojT7+p/a9IaUpPWhIyFHEzqto=";
  };

  nativeBuildInputs = [ cmake ];
@ -98,6 +97,9 @@ in stdenv.mkDerivation rec {
    patchShebangs .
  '';

+  # https://github.com/klee/klee/issues/1690
+  hardeningDisable = [ "fortify" ];
+
  doCheck = true;

  passthru = {
--- a/pkgs/applications/science/logic/klee/klee-uclibc.nix
+++ b/pkgs/applications/science/logic/klee/klee-uclibc.nix
@ -26,12 +26,12 @@ let
  });
 in stdenv.mkDerivation rec {
  pname = "klee-uclibc";
-  version = "1.3";
+  version = "1.4";
  src = fetchFromGitHub {
    owner = "klee";
    repo = "klee-uclibc";
    rev = "klee_uclibc_v${version}";
-    sha256 = "sha256-xQ8GWa0Gmd3lbwKodJhrsZeuR4j7NT4zIUh+kNhVY/w=";
+    sha256 = "sha256-sogQK5Ed0k5tf4rrYwCKT4YRKyEovgT25p0BhGvJ1ok=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/math/almonds/default.nix
+++ b/pkgs/applications/science/math/almonds/default.nix
@ -22,6 +22,6 @@ with python3.pkgs; buildPythonApplication rec {
    mainProgram = "almonds";
    homepage = "https://github.com/Tenchi2xh/Almonds";
    license = licenses.mit;
-    maintainers = with maintainers; [ infinisil ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/applications/science/misc/snakemake/default.nix
+++ b/pkgs/applications/science/misc/snakemake/default.nix
@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "snakemake";
-  version = "8.10.4";
+  version = "8.10.6";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "snakemake";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-SZf//Z1rLHyvW/f0U6kEBzV1NjDEDG1OcFl9/JR+i/g=";
+    hash = "sha256-THp8sqAFZVA5V2k0ruv9qwmPNjSVi2uVx8tla0Y3awE=";
    # https://github.com/python-versioneer/python-versioneer/issues/217
    postFetch = ''
      sed -i "$out"/snakemake/_version.py -e 's#git_refnames = ".*"#git_refnames = " (tag: v${version})"#'
--- a/pkgs/applications/terminal-emulators/st/default.nix
+++ b/pkgs/applications/terminal-emulators/st/default.nix
@ -18,11 +18,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "st";
-  version = "0.9.1";
+  version = "0.9.2";

  src = fetchurl {
    url = "https://dl.suckless.org/st/st-${finalAttrs.version}.tar.gz";
-    hash = "sha256-FvQ7lDOt6dcNYIXDH5/Znyg16q3jEiECDyIUMDXfwNI=";
+    hash = "sha256-ayFdT0crIdYjLzDyIRF6d34kvP7miVXd77dCZGf5SUs=";
  };

  outputs = [ "out" "terminfo" ];
--- a/pkgs/applications/version-management/ghq/default.nix
+++ b/pkgs/applications/version-management/ghq/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "ghq";
-  version = "1.6.0";
+  version = "1.6.1";

  src = fetchFromGitHub {
    owner = "x-motemen";
    repo = "ghq";
    rev = "v${version}";
-    sha256 = "sha256-gSMSn7YuhV/m5po+nu9Z/bxSRKg7/fXbF1stm7JQqZI=";
+    sha256 = "sha256-fp/pqLpuEqvLoB3ioDd1Kx+i1NUI+bUDJzdaT7dQGSg=";
  };

  vendorHash = "sha256-M9B19rSEMnmT4wfOVnSAK06UPR/xrs0252lX3B9ebF8=";
--- a/pkgs/applications/version-management/git-credential-oauth/default.nix
+++ b/pkgs/applications/version-management/git-credential-oauth/default.nix
@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:

 buildGoModule rec {
  pname = "git-credential-oauth";
@ -11,6 +11,8 @@ buildGoModule rec {
    hash = "sha256-bqyoAAqli0L6Kf+W1sTh2vmmfaIj2OdpQyvQZnYOWWA=";
  };

+  nativeBuildInputs = [ installShellFiles ];
+
  ldflags = [
    "-s"
    "-w"
@ -19,6 +21,10 @@ buildGoModule rec {

  vendorHash = "sha256-cCqbEv4kBnF6FWvfaXCOxadPVXR/AxXS3nXHf6WmsSs=";

+  postInstall = ''
+    installManPage $src/git-credential-oauth.1
+  '';
+
  meta = {
    description = "Git credential helper that securely authenticates to GitHub, GitLab and BitBucket using OAuth";
    homepage = "https://github.com/hickford/git-credential-oauth";
--- a/pkgs/applications/version-management/sourcehut/builds.nix
+++ b/pkgs/applications/version-management/sourcehut/builds.nix
@ -16,28 +16,28 @@
 , setuptools
 }:
 let
-  version = "0.89.13";
+  version = "0.89.15";
  gqlgen = import ./fix-gqlgen-trimpath.nix { inherit unzip; gqlgenVersion = "0.17.39"; };

  src = fetchFromSourcehut {
    owner = "~sircmpwn";
    repo = "builds.sr.ht";
    rev = version;
-    hash = "sha256-JpRVRzuHB6cgk/qW1j4zF8/K1xwz3J4nZhijmz5kVWU=";
+    hash = "sha256-rmNaBnTPDDQO/ImkGkMwW8fyjQyBUBchTEnbtAK24pw=";
  };

  buildsrht-api = buildGoModule ({
    inherit src version;
    pname = "buildsrht-api";
    modRoot = "api";
-    vendorHash = "sha256-kTqoUfFEoNdDDzVNJ7XIbH7tbsl5MdBL+/UDHFv7D+A=";
+    vendorHash = "sha256-dwpuB+aYqzhGSdGVq/F9FTdHWMBkGMtVuZ7I3hB3b+Q=";
  } // gqlgen);

  buildsrht-worker = buildGoModule ({
    inherit src version;
    pname = "buildsrht-worker";
    modRoot = "worker";
-    vendorHash = "sha256-kTqoUfFEoNdDDzVNJ7XIbH7tbsl5MdBL+/UDHFv7D+A=";
+    vendorHash = "sha256-dwpuB+aYqzhGSdGVq/F9FTdHWMBkGMtVuZ7I3hB3b+Q=";
  } // gqlgen);
 in
 buildPythonPackage rec {
--- a/pkgs/applications/version-management/sourcehut/core.nix
+++ b/pkgs/applications/version-management/sourcehut/core.nix
@ -28,7 +28,7 @@

 buildPythonPackage rec {
  pname = "srht";
-  version = "0.71.5";
+  version = "0.71.8";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -37,7 +37,7 @@ buildPythonPackage rec {
    owner = "~sircmpwn";
    repo = "core.sr.ht";
    rev = version;
-    hash = "sha256-YIoKOiTi/9X4bSiG+GvnwzvKYhbfywrv/dTjxaJOOTQ=";
+    hash = "sha256-rDpm2HJOWScvIxOmHcat6y4CWdBE9T2gE/jZskYAFB0=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/version-management/sourcehut/fix-gqlgen-trimpath.nix
+++ b/pkgs/applications/version-management/sourcehut/fix-gqlgen-trimpath.nix
@ -1,13 +1,13 @@
 { unzip
-, gqlgenVersion ? "0.17.42"
+, gqlgenVersion
 }:
 {
  overrideModAttrs = (_: {
    # No need to workaround -trimpath: it's not used in goModules,
    # but do download `go generate`'s dependencies nonetheless.
    preBuild = ''
-      go generate ./loaders
-      go generate ./graph
+      if [ -d ./loaders ]; then go generate ./loaders; fi
+      if [ -d ./graph ]; then go generate ./graph; fi
    '';
  });

@ -25,8 +25,8 @@
  # If it fails, the gqlgenVersion may have to be updated.
  preBuild = ''
    unzip ''${GOPROXY#"file://"}/github.com/99designs/gqlgen/@v/v${gqlgenVersion}.zip
-    go generate ./loaders
-    go generate ./graph
+    if [ -d ./loaders ]; then go generate ./loaders; fi
+    if [ -d ./graph ]; then go generate ./graph; fi
    rm -rf github.com
  '';
 }
--- a/pkgs/applications/version-management/sourcehut/git.nix
+++ b/pkgs/applications/version-management/sourcehut/git.nix
@ -13,28 +13,28 @@
 , setuptools
 }:
 let
-  version = "0.85.7";
-  gqlgen = import ./fix-gqlgen-trimpath.nix { inherit unzip; };
+  version = "0.85.9";
+  gqlgen = import ./fix-gqlgen-trimpath.nix { inherit unzip; gqlgenVersion = "0.17.42"; };

  src = fetchFromSourcehut {
    owner = "~sircmpwn";
    repo = "git.sr.ht";
    rev = version;
-    hash = "sha256-jkESrrVE+0O2g64zzPOpqhl8DpvmosQvuF0s6Xd+lbM=";
+    hash = "sha256-tmbBw6x3nqN9nRIR3xOXQ+L5EACXLQYLXQYK3lsOsAI=";
  };

  gitApi = buildGoModule ({
    inherit src version;
    pname = "gitsrht-api";
    modRoot = "api";
-    vendorHash = "sha256-yWVpldqwpEZmeI18tvdIgof8GgSFEP70c8T5XDkryn0=";
+    vendorHash = "sha256-4KwnUi6ILUagMDXzuBG9CRT2N8uyjvRM74TwJqIzicc=";
  } // gqlgen);

  gitDispatch = buildGoModule ({
    inherit src version;
    pname = "gitsrht-dispatch";
    modRoot = "gitsrht-dispatch";
-    vendorHash = "sha256-yWVpldqwpEZmeI18tvdIgof8GgSFEP70c8T5XDkryn0=";
+    vendorHash = "sha256-4KwnUi6ILUagMDXzuBG9CRT2N8uyjvRM74TwJqIzicc=";

    postPatch = ''
      substituteInPlace gitsrht-dispatch/main.go \
@ -46,7 +46,7 @@ let
    inherit src version;
    pname = "gitsrht-keys";
    modRoot = "gitsrht-keys";
-    vendorHash = "sha256-yWVpldqwpEZmeI18tvdIgof8GgSFEP70c8T5XDkryn0=";
+    vendorHash = "sha256-4KwnUi6ILUagMDXzuBG9CRT2N8uyjvRM74TwJqIzicc=";

    postPatch = ''
      substituteInPlace gitsrht-keys/main.go \
@ -58,7 +58,7 @@ let
    inherit src version;
    pname = "gitsrht-shell";
    modRoot = "gitsrht-shell";
-    vendorHash = "sha256-yWVpldqwpEZmeI18tvdIgof8GgSFEP70c8T5XDkryn0=";
+    vendorHash = "sha256-4KwnUi6ILUagMDXzuBG9CRT2N8uyjvRM74TwJqIzicc=";

    postPatch = ''
      substituteInPlace gitsrht-shell/main.go \
@ -70,7 +70,7 @@ let
    inherit src version;
    pname = "gitsrht-update-hook";
    modRoot = "gitsrht-update-hook";
-    vendorHash = "sha256-yWVpldqwpEZmeI18tvdIgof8GgSFEP70c8T5XDkryn0=";
+    vendorHash = "sha256-4KwnUi6ILUagMDXzuBG9CRT2N8uyjvRM74TwJqIzicc=";

    postPatch = ''
      substituteInPlace gitsrht-update-hook/main.go \
--- a/pkgs/applications/version-management/sourcehut/hg.nix
+++ b/pkgs/applications/version-management/sourcehut/hg.nix
@ -14,8 +14,8 @@
 }:

 let
-  version = "0.32.4";
-  gqlgen = import ./fix-gqlgen-trimpath.nix { inherit unzip; gqlgenVersion = "0.17.20"; };
+  version = "0.33.0";
+  gqlgen = import ./fix-gqlgen-trimpath.nix { inherit unzip; gqlgenVersion = "0.17.45"; };

  pyproject = true;

@ -25,7 +25,7 @@ let
    owner = "~sircmpwn";
    repo = "hg.sr.ht";
    rev = version;
-    hash = "sha256-mYkA44c9wy/Iy1h1lXkVpc9gN7rQXFm4T3YBlQ1Dj60=";
+    hash = "sha256-+BYeE+8dXY/MLLYyBBLD+eKqmrPiKyyCGIZLkCPzNYM=";
    vc = "hg";
  };

@ -33,7 +33,7 @@ let
    inherit src version;
    pname = "hgsrht-api";
    modRoot = "api";
-    vendorHash = "sha256-vuOYpnF3WjA6kOe9MVSuVMhJBQqCmIex+QUBJrP+VDs=";
+    vendorHash = "sha256-K+KMhcvkG/qeQTnlHS4xhLCcvBQNNp2DcScJPm8Dbic=";
  } // gqlgen);

  hgsrht-keys = buildGoModule {
--- a/pkgs/applications/version-management/sourcehut/hub.nix
+++ b/pkgs/applications/version-management/sourcehut/hub.nix
@ -12,21 +12,21 @@
 }:

 let
-  version = "0.17.5";
-  gqlgen = import ./fix-gqlgen-trimpath.nix { inherit unzip; gqlgenVersion = "0.17.41"; };
+  version = "0.17.7";
+  gqlgen = import ./fix-gqlgen-trimpath.nix { inherit unzip; gqlgenVersion = "0.17.43"; };

  src = fetchFromSourcehut {
    owner = "~sircmpwn";
    repo = "hub.sr.ht";
    rev = version;
-    hash = "sha256-GbBxK3XE+Y6Jiap0Nxa8vk4Kv6IbcdSi4NN59AeKwjA=";
+    hash = "sha256-IyY7Niy/vZSAXjYZMlxY6uuQ8nH/4yT4+MaRjHtl6G4=";
  };

  hubsrht-api = buildGoModule ({
    inherit src version;
    pname = "hubsrht-api";
    modRoot = "api";
-    vendorHash = "sha256-wmuM0SxQbohTDaU8zmkw1TQTmqhOy1yAl1jRWk6TKL8=";
+    vendorHash = "sha256-GVN11nEJqIHh8MtKvIXe4zcUwJph9eTSkJ2R+ufD+ic=";
  } // gqlgen);
 in
 buildPythonPackage rec {
--- a/pkgs/applications/version-management/sourcehut/lists.nix
+++ b/pkgs/applications/version-management/sourcehut/lists.nix
@ -15,21 +15,21 @@
 }:

 let
-  version = "0.57.14";
-  gqlgen = import ./fix-gqlgen-trimpath.nix { inherit unzip; gqlgenVersion = "0.17.36"; };
+  version = "0.57.18";
+  gqlgen = import ./fix-gqlgen-trimpath.nix { inherit unzip; gqlgenVersion = "0.17.45"; };

  src = fetchFromSourcehut {
    owner = "~sircmpwn";
    repo = "lists.sr.ht";
    rev = version;
-    hash = "sha256-rzOxlat7Lbgt0Wl6vvnAC+fS3MynFVKFvVdIdxgA5e0=";
+    hash = "sha256-l+QPocnwHTjrU+M0wnm4tBrbz8KmSb6DovC+skuAnLc=";
  };

  listssrht-api = buildGoModule ({
    inherit src version;
    pname = "listssrht-api";
    modRoot = "api";
-    vendorHash = "sha256-OWgrPvXVlvJPcoABP0ZxKzoYFhU44j/I44sBBRbd6KY=";
+    vendorHash = "sha256-UeVs/+uZNtv296bzXIBio2wcg3Uzu3fBM4APzF9O0hY=";
  } // gqlgen);
 in
 buildPythonPackage rec {
--- a/pkgs/applications/version-management/sourcehut/man.nix
+++ b/pkgs/applications/version-management/sourcehut/man.nix
@ -12,21 +12,21 @@
 }:

 let
-  version = "0.16.3";
-  gqlgen = import ./fix-gqlgen-trimpath.nix { inherit unzip; gqlgenVersion = "0.17.36"; };
+  version = "0.16.5";
+  gqlgen = import ./fix-gqlgen-trimpath.nix { inherit unzip; gqlgenVersion = "0.17.43"; };

  src = fetchFromSourcehut {
    owner = "~sircmpwn";
    repo = "man.sr.ht";
    rev = version;
-    hash = "sha256-o1A3LmwH6WgpFqjKyL3UTru9q7TgKdOdbKZfJHR6fCA=";
+    hash = "sha256-JFMtif2kIE/fs5PNcQtkJikAFNszgZTU7BG/8fTncTI=";
  };

  mansrht-api = buildGoModule ({
    inherit src version;
    pname = "mansrht-api";
    modRoot = "api";
-    vendorHash = "sha256-6AzKWytdyuofCFaDEdeO24mv1mtpnQEJydrjVWGY2eU=";
+    vendorHash = "sha256-GVN11nEJqIHh8MtKvIXe4zcUwJph9eTSkJ2R+ufD+ic=";
  } // gqlgen);
 in
 buildPythonPackage rec {
--- a/pkgs/applications/version-management/sourcehut/meta.nix
+++ b/pkgs/applications/version-management/sourcehut/meta.nix
@ -18,21 +18,21 @@
 , setuptools
 }:
 let
-  version = "0.68.5";
-  gqlgen = import ./fix-gqlgen-trimpath.nix { inherit unzip; gqlgenVersion = "0.17.36"; };
+  version = "0.69.8";
+  gqlgen = import ./fix-gqlgen-trimpath.nix { inherit unzip; gqlgenVersion = "0.17.43"; };

  src = fetchFromSourcehut {
    owner = "~sircmpwn";
    repo = "meta.sr.ht";
    rev = version;
-    hash = "sha256-mwUqBzi7nMTZL7uwv7hBjGkO8U3krXXpvfUCaYHgHBU=";
+    hash = "sha256-K7p6cytkPYgUuYr7BVfU/+sVbSr2YEmreIDnTatUMyk=";
  };

  metasrht-api = buildGoModule ({
    inherit src version;
    pname = "metasrht-api";
    modRoot = "api";
-    vendorHash = "sha256-4T1xnHDjxsIyddA51exNwwz6ZWeuT7N8LBsCJ7c8sRI=";
+    vendorHash = "sha256-vIkUK1pigVU8vZL5xpHLeinOga5eXXHTuDkHxwUz6uM=";
  } // gqlgen);
 in
 buildPythonPackage rec {
--- a/pkgs/applications/version-management/sourcehut/pages.nix
+++ b/pkgs/applications/version-management/sourcehut/pages.nix
@ -6,21 +6,25 @@

 buildGoModule (rec {
  pname = "pagessrht";
-  version = "0.15.4";
+  version = "0.15.7";

  src = fetchFromSourcehut {
    owner = "~sircmpwn";
    repo = "pages.sr.ht";
    rev = version;
-    hash = "sha256-3kdQVIL7xaIPu2elxj1k+4/y75bd+OKP5+VPSniF7w8=";
+    hash = "sha256-Lobuf12ybSO7Y4ztOLMFW0dmPFaBSEPCy4Nmh89tylI=";
  };

  postPatch = ''
    substituteInPlace Makefile \
      --replace "all: server" ""
+
+    # fix build failure due to unused import
+    substituteInPlace server.go \
+      --replace-warn '	"fmt"' ""
  '';

-  vendorHash = "sha256-DP+6rxjiXzs0RbSuMD20XwO/+v7QXCNgXj2LxZ96lWE=";
+  vendorHash = "sha256-9hpOkP6AYSZe7MW1mrwFEKq7TvVt6OcF6eHWY4jARuU=";

  postInstall = ''
    mkdir -p $out/share/sql/
@ -36,4 +40,4 @@ buildGoModule (rec {
  };
  # There is no ./loaders but this does not cause troubles
  # to go generate
-} // import ./fix-gqlgen-trimpath.nix { inherit unzip; })
+} // import ./fix-gqlgen-trimpath.nix { inherit unzip; gqlgenVersion = "0.17.42"; })
--- a/pkgs/applications/version-management/sourcehut/paste.nix
+++ b/pkgs/applications/version-management/sourcehut/paste.nix
@ -12,21 +12,21 @@
 }:

 let
-  version = "0.15.2";
-  gqlgen = import ./fix-gqlgen-trimpath.nix { inherit unzip; gqlgenVersion = "0.17.20"; };
+  version = "0.15.4";
+  gqlgen = import ./fix-gqlgen-trimpath.nix { inherit unzip; gqlgenVersion = "0.17.45"; };

  src = fetchFromSourcehut {
    owner = "~sircmpwn";
    repo = "paste.sr.ht";
    rev = version;
-    hash = "sha256-ZZzcd14Jbo1MfET7B56X/fl9xWXpCJ8TuKrGVgJwZfQ=";
+    hash = "sha256-M38hAMRdMzcqxJv7j7foOIYEImr/ZYz/lbYOF9R9g2M=";
  };

  pastesrht-api = buildGoModule ({
    inherit src version;
    pname = "pastesrht-api";
    modRoot = "api";
-    vendorHash = "sha256-jiE73PUPSHxtWp7XBdH4mJw95pXmZjCl4tk2wQUf2M4=";
+    vendorHash = "sha256-vt5nSPcx+Y/SaWcqjV38DTL3ZtzmdjbkJYMv5Fhhnq4=";
  } // gqlgen);
 in
 buildPythonPackage rec {
--- a/pkgs/applications/version-management/sourcehut/scm.nix
+++ b/pkgs/applications/version-management/sourcehut/scm.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "scmsrht";
-  version = "0.22.23";
+  version = "0.22.24";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "~sircmpwn";
    repo = "scm.sr.ht";
    rev = version;
-    hash = "sha256-058dOEYJDY3jtxH1VkV1CFq5CZTkauSnTWg57DCnNtw=";
+    hash = "sha256-9IgMmYzInfrten7z8bznlSFJlUjHf3k3z76lkP6tP50=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/version-management/sourcehut/todo.nix
+++ b/pkgs/applications/version-management/sourcehut/todo.nix
@ -13,21 +13,21 @@
 }:

 let
-  version = "0.75.6";
-  gqlgen = import ./fix-gqlgen-trimpath.nix { inherit unzip; gqlgenVersion = "0.17.36"; };
+  version = "0.75.10";
+  gqlgen = import ./fix-gqlgen-trimpath.nix { inherit unzip; gqlgenVersion = "0.17.45"; };

  src = fetchFromSourcehut {
    owner = "~sircmpwn";
    repo = "todo.sr.ht";
    rev = version;
-    hash = "sha256-BPJ1M9dX+xNIw++VZ0Si/rjnfI9BY95TE2o+u7JRVAU=";
+    hash = "sha256-3dVZdupsygM7/6T1Mn7yRc776aa9pKgwF0hgZX6uVQ0=";
  };

  todosrht-api = buildGoModule ({
    inherit src version;
    pname = "todosrht-api";
    modRoot = "api";
-    vendorHash = "sha256-vTKIJFE8AFR2eZFwG9ba6FWPW02og3ZVcrsqUnOkJIQ=";
+    vendorHash = "sha256-fImOQLnQLHTrg5ikuYRZ+u+78exAiYA19DGQoUjQBOM=";
  } // gqlgen);
 in
 buildPythonPackage rec {
--- a/pkgs/applications/version-management/sourcehut/update.sh
+++ b/pkgs/applications/version-management/sourcehut/update.sh
@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i bash -p git mercurial common-updater-scripts
+#! nix-shell -i bash -p gnused git mercurial common-updater-scripts
 set -eux -o pipefail

 cd "$(dirname "${BASH_SOURCE[0]}")" || exit 1
@ -34,21 +34,29 @@ get_latest_version() {
  rm -rf "$tmp"
  if [ "$1" = "hgsrht" ]; then
    hg clone "$src" "$tmp" >/dev/null
-    printf "%s" "$(cd "$tmp" && hg log --limit 1 --template '{latesttag}')"
+    printf "%s %s\n" \
+        "$(cd "$tmp" && hg log --limit 1 --template '{latesttag}')" \
+        "$(cd "$tmp" && sed -ne 's/^\s*github\.com\/99designs\/gqlgen v\(.*\)$/\1/p' go.mod)"
  else
    git clone "$src" "$tmp" >/dev/null
-    printf "%s" "$(cd "$tmp" && git describe "$(git rev-list --tags --max-count=1)")"
+    printf "%s %s\n" \
+        "$(cd "$tmp" && git describe "$(git rev-list --tags --max-count=1)")" \
+        "$(cd "$tmp" && sed -ne 's/^\s*github\.com\/99designs\/gqlgen v\(.*\)$/\1/p' go.mod)"
  fi
 }

 update_version() {
  default_nix="$(default "$1")"
  oldVersion="$(version "$1")"
-  version="$(get_latest_version "$1")"
+  read -r version gqlgen_ver < <(get_latest_version "$1")
  local p="$(attr_path "$1")"

  (cd "$root" && update-source-version "$p" "$version")

+  # update `gqlgenVersion` if necessary
+  old_gqlgen_ver="$(sed -ne 's/^.*gqlgenVersion = "\(.*\)".*$/\1/p' "$default_nix")"
+  sed -ri "s|gqlgenVersion = \"$old_gqlgen_ver\";|gqlgenVersion = \"$gqlgen_ver\";|w /dev/stdout" "$default_nix"
+
  # Update vendorHash of Go modules
  retry=true
  while "$retry"; do
@ -63,7 +71,7 @@ update_version() {
    done
  done

-  if [ "$oldVersion" != "$version" ]; then
+  if [ "$oldVersion" != "$version" ] || [ "$old_gqlgen_ver" != "$gqlgen_ver" ]; then
    git add "$default_nix"
    git commit -m "sourcehut.$1: $oldVersion -> $version"
  fi
--- a/pkgs/applications/video/mpv/scripts/sponsorblock-minimal.nix
+++ b/pkgs/applications/video/mpv/scripts/sponsorblock-minimal.nix
@ -1,9 +1,4 @@
-{ lib
-, buildLua
-, fetchFromGitea
-, unstableGitUpdater
-, curl
-}:
+{ lib, buildLua, fetchFromGitea, unstableGitUpdater, curl, coreutils }:

 buildLua {
  pname = "mpv_sponsorblock_minimal";
@ -17,15 +12,17 @@ buildLua {
    rev = "ca2844b8cf7674bfccd282d389a50427742251d3";
    hash = "sha256-28HWZ6nOhKiE+5Ya1N3Vscd8aeH9OKS0t72e/xPfFQQ=";
  };
-  passthru.updateScript = unstableGitUpdater {};
+  passthru.updateScript = unstableGitUpdater { };

  preInstall = ''
    substituteInPlace sponsorblock_minimal.lua \
-      --replace "curl" "${lib.getExe curl}"
+      --replace-fail "curl" "${lib.getExe curl}" \
+      --replace-fail "sha256sum" "${lib.getExe' coreutils "sha256sum"}"
  '';

  meta = with lib; {
-    description = "A minimal script to skip sponsored segments of YouTube videos";
+    description =
+      "A minimal script to skip sponsored segments of YouTube videos";
    homepage = "https://codeberg.org/jouni/mpv_sponsorblock_minimal";
    license = licenses.gpl3Only;
    platforms = platforms.all;
--- a/pkgs/applications/virtualization/driver/win-pvdrivers/default.nix
+++ b/pkgs/applications/virtualization/driver/win-pvdrivers/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenvNoCC, fetchurl }:

 let
  # Upstream versioned download links are broken
@ -40,7 +40,7 @@ let
  ];

 in
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
  pname = "win-pvdrivers";
  version = "unstable-2023-08-17";

--- a/pkgs/applications/virtualization/ecs-agent/default.nix
+++ b/pkgs/applications/virtualization/ecs-agent/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "amazon-ecs-agent";
-  version = "1.82.1";
+  version = "1.82.2";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "aws";
    repo = pname;
-    hash = "sha256-WXxuFJnqWUm+XgFNdtf0WBBGa7fP8Qv7hRd4xfGeVeg=";
+    hash = "sha256-2a8QBdL28iHVTE+Xo1I+89pFBeWndPqT072SHB498SQ=";
  };

  vendorHash = null;
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@ -72,8 +72,8 @@ rec {

    for o in $(cat /proc/cmdline); do
      case $o in
-        mountDisk=1)
-          mountDisk=1
+        mountDisk=*)
+          mountDisk=''${mountDisk#mountDisk=}
          ;;
        command=*)
          set -- $(IFS==; echo $o)
@ -103,6 +103,8 @@ rec {

    if test -z "$mountDisk"; then
      mount -t tmpfs none /fs
+    elif [[ -e "$mountDisk" ]]; then
+      mount "$mountDisk" /fs
    else
      mount /dev/${hd} /fs
    fi
@ -388,7 +390,7 @@ rec {
     filesystem containing a non-NixOS Linux distribution. */

  runInLinuxImage = drv: runInLinuxVM (lib.overrideDerivation drv (attrs: {
-    mountDisk = true;
+    mountDisk = attrs.mountDisk or true;

    /* Mount `image' as the root FS, but use a temporary copy-on-write
       image since we don't want to (and can't) write to `image'. */
@ -576,9 +578,9 @@ rec {

  fillDiskWithDebs =
    { size ? 4096, debs, name, fullName, postInstall ? null, createRootFS ? defaultCreateRootFS
-    , QEMU_OPTS ? "", memSize ? 512 }:
+    , QEMU_OPTS ? "", memSize ? 512, ... }@args:

-    runInLinuxVM (stdenv.mkDerivation {
+    runInLinuxVM (stdenv.mkDerivation ({
      inherit name postInstall QEMU_OPTS memSize;

      debs = (lib.intersperse "|" debs);
@ -647,7 +649,6 @@ rec {

        echo "running post-install script..."
        eval "$postInstall"
-        ln -sf dash /mnt/bin/sh

        rm /mnt/.debug

@ -658,7 +659,7 @@ rec {
      '';

      passthru = { inherit fullName; };
-    });
+    } // args));


  /* Generate a Nix expression containing fetchurl calls for the
@ -727,9 +728,6 @@ rec {
        esac
      done

-      # Work around this bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=452279
-      sed -i ./Packages -e s/x86_64-linux-gnu/x86-64-linux-gnu/g
-
      perl -w ${deb/deb-closure.pl} \
        ./Packages ${urlPrefix} ${toString packages} > $out
    '';
@ -744,7 +742,7 @@ rec {
    , packagesList ? "", packagesLists ? [packagesList]
    , packages, extraPackages ? [], postInstall ? ""
    , extraDebs ? [], createRootFS ? defaultCreateRootFS
-    , QEMU_OPTS ? "", memSize ? 512 }:
+    , QEMU_OPTS ? "", memSize ? 512, ... }@args:

    let
      expr = debClosureGenerator {
@ -752,10 +750,10 @@ rec {
        packages = packages ++ extraPackages;
      };
    in
-      (fillDiskWithDebs {
+      (fillDiskWithDebs ({
        inherit name fullName size postInstall createRootFS QEMU_OPTS memSize;
        debs = import expr {inherit fetchurl;} ++ extraDebs;
-      }) // {inherit expr;};
+      } // args)) // {inherit expr;};


  /* The set of supported RPM-based distributions. */
--- a/pkgs/development/tools/rust/cargo-lambda/Cargo.lock
+++ b/pkgs/development/tools/rust/cargo-lambda/Cargo.lock
--- a/pkgs/by-name/an/anchor/package.nix
+++ b/pkgs/by-name/an/anchor/package.nix
@ -0,0 +1,48 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, stdenv
+, darwin
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "anchor";
+  version = "0.29.0";
+
+  src = fetchFromGitHub {
+    owner = "coral-xyz";
+    repo = "anchor";
+    rev = "v${version}";
+    hash = "sha256-hOpdCVO3fXMqnAihjXXD9SjqK4AMhQQhZmISqJnDVCI=";
+    fetchSubmodules = true;
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "serum_dex-0.4.0" = "sha256-Nzhh3OcAFE2LcbUgrA4zE2TnUMfV0dD4iH6fTi48GcI=";
+    };
+  };
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.Security
+    darwin.apple_sdk.frameworks.SystemConfiguration
+  ];
+
+  checkFlags = [
+    # the following test cases try to access network, skip them
+    "--skip=tests::test_check_and_get_full_commit_when_full_commit"
+    "--skip=tests::test_check_and_get_full_commit_when_partial_commit"
+    "--skip=tests::test_get_anchor_version_from_commit"
+  ];
+
+
+  meta = with lib; {
+    description = "Solana Sealevel Framework";
+    homepage = "https://github.com/coral-xyz/anchor";
+    changelog = "https://github.com/coral-xyz/anchor/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ xrelkd ];
+    mainProgram = "anchor";
+  };
+}
--- a/pkgs/by-name/ba/bashly/Gemfile.lock
+++ b/pkgs/by-name/ba/bashly/Gemfile.lock
@ -1,7 +1,7 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    bashly (1.1.1)
+    bashly (1.1.10)
      colsole (>= 0.8.1, < 2)
      completely (~> 0.6.1)
      filewatcher (~> 2.0)
@ -11,7 +11,7 @@ GEM
      psych (>= 3.3.2, < 7)
      tty-markdown (~> 0.7)
    colsole (1.0.0)
-    completely (0.6.1)
+    completely (0.6.2)
      colsole (>= 0.8.1, < 2)
      mister_bin (~> 0.7)
    docopt_ng (0.7.1)
@ -27,11 +27,11 @@ GEM
    module_methods (0.1.0)
    pastel (0.8.0)
      tty-color (~> 0.5)
-    psych (5.1.1.1)
+    psych (5.1.2)
      stringio
    rexml (3.2.6)
-    rouge (4.1.3)
-    stringio (3.0.8)
+    rouge (4.2.1)
+    stringio (3.1.0)
    strings (0.2.1)
      strings-ansi (~> 0.2)
      unicode-display_width (>= 1.5, < 3.0)
@ -45,7 +45,7 @@ GEM
      strings (~> 0.2.0)
      tty-color (~> 0.5)
      tty-screen (~> 0.8)
-    tty-screen (0.8.1)
+    tty-screen (0.8.2)
    unicode-display_width (2.5.0)
    unicode_utils (1.4.0)

--- a/pkgs/by-name/ba/bashly/gemset.nix
+++ b/pkgs/by-name/ba/bashly/gemset.nix
@ -5,10 +5,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1rhzbpv8j5qcm5a84m4vzrryb0j8z90q6djbpid4ay2fr492kvkq";
+      sha256 = "1kdqpnkwgmb6kbrq9fyazj0jh0dh8srh86xjk92xrvgfps1kh5sy";
      type = "gem";
    };
-    version = "1.1.1";
+    version = "1.1.10";
  };
  colsole = {
    groups = ["default"];
@ -26,10 +26,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "01nk1cigb09z6rjy41qrhqf58cgpqm43xwjdkz33mfmwrnz04cw1";
+      sha256 = "12vf279w44d520vw28drxyi05wi1hyrg262ifjlhk9chjrnzcc7k";
      type = "gem";
    };
-    version = "0.6.1";
+    version = "0.6.2";
  };
  docopt_ng = {
    groups = ["default"];
@ -121,10 +121,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0wjzrkssjfjpynij5dpycyflhqbjvi1gc2j73xgq3b196s1d3c24";
+      sha256 = "0s5383m6004q76xm3lb732bp4sjzb6mxb6rbgn129gy2izsj4wrk";
      type = "gem";
    };
-    version = "5.1.1.1";
+    version = "5.1.2";
  };
  rexml = {
    groups = ["default"];
@ -141,20 +141,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "19drl3x8fw65v3mpy7fk3cf3dfrywz5alv98n2rm4pp04vdn71lw";
+      sha256 = "1zd1pdldi6h8x27dqim7cy8m69xr01aw5c8k1zhkz497n4np6wgk";
      type = "gem";
    };
-    version = "4.1.3";
+    version = "4.2.1";
  };
  stringio = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0ix96dxbjqlpymdigb4diwrifr0bq7qhsrng95fkkp18av326nqk";
+      sha256 = "063psvsn1aq6digpznxfranhcpmi0sdv2jhra5g0459sw0x2dxn1";
      type = "gem";
    };
-    version = "3.0.8";
+    version = "3.1.0";
  };
  strings = {
    dependencies = ["strings-ansi" "unicode-display_width" "unicode_utils"];
@ -203,10 +203,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "18jr6s1cg8yb26wzkqa6874q0z93rq0y5aw092kdqazk71y6a235";
+      sha256 = "0l4vh6g333jxm9lakilkva2gn17j6gb052626r1pdbmy2lhnb460";
      type = "gem";
    };
-    version = "0.8.1";
+    version = "0.8.2";
  };
  unicode-display_width = {
    groups = ["default"];
--- a/pkgs/by-name/bp/bpftop/package.nix
+++ b/pkgs/by-name/bp/bpftop/package.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "bpftop";
-  version = "0.4.0";
+  version = "0.4.1";

  src = fetchFromGitHub {
    owner = "Netflix";
    repo = "bpftop";
    rev = "v${version}";
-    hash = "sha256-N5sszFVU1nMS6QQENa9JcgFKSSWs07bWn6usvV/QmX4=";
+    hash = "sha256-OLPebPzb2FKiV1Gc8HTK3sXU2UDMyhFA/XLix/lWxgU=";
  };

-  cargoHash = "sha256-yVNql4fSU1HhLKy8HYUbNnMnxgr/gPuqKol5O0ZDQlY=";
+  cargoHash = "sha256-UYCbNECsos71cwwE5avtaijPaPGhLEU7J9i84wPkObI=";

  buildInputs = [
    elfutils
--- a/pkgs/by-name/br/brainstem/package.nix
+++ b/pkgs/by-name/br/brainstem/package.nix
@ -0,0 +1,90 @@
+{ stdenv
+, lib
+, autoPatchelfHook
+, fetchzip
+, curl
+, systemd
+, zlib
+, writeText
+, withUpdater ? true
+, ...
+}:
+
+let
+  version = "2.10.5";
+  # Upstream has a udev.sh script asking for mode and group, but with uaccess we
+  # don't need any of that and can make it entirely static.
+  # For any rule adding the uaccess tag to be effective, the name of the file it
+  # is defined in has to lexically precede 73-seat-late.rules.
+  udevRule = writeText "60-brainstem.rules" ''
+    # Acroname Brainstem control devices
+    SUBSYSTEM=="usb", ATTRS{idVendor}=="24ff", TAG+="uaccess"
+
+    # Acroname recovery devices (pb82, pb242, pb167)
+    SUBSYSTEM=="tty", ATTRS{idVendor}=="0424", ATTRS{idProduct}=="274e", TAG+="uaccess"
+    SUBSYSTEM=="tty", ATTRS{idVendor}=="10c4", ATTRS{idProduct}=="ea60", TAG+="uaccess"
+    KERNEL=="hidraw*", ATTRS{idVendor}=="1fc9", ATTRS{idProduct}=="0130", TAG+="uaccess"
+  '';
+
+  src = fetchzip {
+    url = "https://acroname.com/sites/default/files/software/brainstem_sdk/${version}/brainstem_sdk_${version}_Ubuntu_LTS_22.04_x86_64.tgz";
+    hash = "sha256-S6u9goxTMCI12sffP/WKUF7bv0pLeNmNog7Hle+vpR4=";
+    # There's no "brainstem" parent directory in the archive.
+    stripRoot = false;
+  };
+in
+
+stdenv.mkDerivation {
+  pname = "brainstem";
+  inherit version src;
+
+  nativeBuildInputs = [ autoPatchelfHook ];
+  buildInputs = [
+    # libudev
+    (lib.getLib systemd)
+    # libstdc++.so libgcc_s.so
+    stdenv.cc.cc.lib
+  ] ++ lib.optionals withUpdater [
+    # libcurl.so.4
+    curl
+    # libz.so.1
+    zlib
+  ];
+
+  # Unpack the CLI tools, documentation, library and C headers.
+  # There's also a python .whl, containing more libraries, which might be used
+  # to support more architectures, too, but let's only do that if we need it.
+  installPhase = ''
+    mkdir -p $out/bin
+    install -m744 cli/AcronameHubCLI $out/bin
+    install -m744 cli/Updater $out/bin/AcronameHubUpdater
+
+    mkdir -p $out/lib/udev/rules.d
+    cp ${udevRule} $out/lib/udev/rules.d/60-brainstem.rules
+
+    mkdir -p $doc
+    cp docs/* $doc/
+    cp {license,version}.txt $doc/
+
+    mkdir -p $lib/lib
+    cp api/lib/libBrainStem2.* $lib/lib
+
+    mkdir -p $dev/include
+    cp -R api/lib/BrainStem2 $dev/include/
+  '';
+
+  outputs = [ "out" "lib" "dev" "doc" ];
+
+  meta = with lib; {
+    description = "BrainStem Software Development Kit";
+    longDescription = ''
+      The BrainStem SDK provides a library to access and control Acroname smart
+      USB switches, as well as a CLI interface, and a firmware updater.
+    '';
+    homepage = "https://acroname.com/software/brainstem-development-kit";
+    platforms = [ "x86_64-linux" ];
+    license = licenses.unfree;
+    maintainers = with maintainers; [ flokli ];
+    mainProgram = "AcronameHubCLI";
+  };
+}
--- a/pkgs/by-name/ch/changelog-d/package.nix
+++ b/pkgs/by-name/ch/changelog-d/package.nix
@ -13,6 +13,7 @@ let
  haskellModifications =
    lib.flip lib.pipe [
      addCompletions
+      haskell.lib.doJailbreak
      haskell.lib.justStaticExecutables
    ];

--- a/pkgs/by-name/co/colstr/package.nix
+++ b/pkgs/by-name/co/colstr/package.nix
@ -0,0 +1,45 @@
+{ lib
+, stdenv
+, fetchFromGitea
+, nix-update-script
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "colstr";
+  version = "1.0.0";
+
+  src = fetchFromGitea {
+    domain = "git.sleeping.town";
+    owner = "wonder";
+    repo = "colstr";
+    rev = finalAttrs.version;
+    hash = "sha256-0V2S/yYu5L7qxkT4Zf18x9+cHoPMztFmgSywpxF8QqA=";
+  };
+
+  buildPhase = ''
+    runHook preBuild
+
+    eval ${stdenv.cc.targetPrefix}c++ main.cpp
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 a.out $out/bin/colstr
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = with lib; {
+    description = "Deterministically output each input argument in a color assigned to it";
+    homepage = "https://git.sleeping.town/wonder/colstr";
+    license = with licenses; [ cc0 ];
+    maintainers = with maintainers; [ annaaurora ];
+    mainProgram = "colstr";
+    platforms = platforms.all;
+  };
+})
--- a/pkgs/by-name/de/dep-scan/package.nix
+++ b/pkgs/by-name/de/dep-scan/package.nix
@ -1,31 +1,27 @@
-{ lib
-, python3
-, fetchFromGitHub
+{
+  lib,
+  fetchFromGitHub,
+  python3,
 }:

 python3.pkgs.buildPythonApplication rec {
  pname = "dep-scan";
-  version = "5.2.14";
+  version = "5.3.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "owasp-dep-scan";
    repo = "dep-scan";
    rev = "refs/tags/v${version}";
-    hash = "sha256-G8i/tGEDgjPnIP04nrbx4HseiaU6N1GJGSg78yhaqII=";
+    hash = "sha256-2WV4f9vHdfnzoQWvwK/+lT9IS0v0sGBqnwDFHWG48G4=";
  };

  postPatch = ''
    substituteInPlace pytest.ini \
      --replace-fail " --cov-append --cov-report term --cov depscan" ""
-    # Already fixed by upstream
-    substituteInPlace pyproject.toml \
-      --replace-fail "==5.6.4" ">=5.6.4"
  '';

-  build-system = with python3.pkgs; [
-    setuptools
-  ];
+  build-system = with python3.pkgs; [ setuptools ];

  dependencies = with python3.pkgs; [
    appthreat-vulnerability-db
@ -47,9 +43,7 @@ python3.pkgs.buildPythonApplication rec {
    pytestCheckHook
  ];

-  pythonImportsCheck = [
-    "depscan"
-  ];
+  pythonImportsCheck = [ "depscan" ];

  preCheck = ''
    export HOME=$(mktemp -d)
--- a/pkgs/by-name/et/etlegacy-unwrapped/package.nix
+++ b/pkgs/by-name/et/etlegacy-unwrapped/package.nix
@ -92,11 +92,6 @@ stdenv.mkDerivation {
    "-DINSTALL_DEFAULT_BINDIR=${placeholder "out"}/bin"
  ];

-  postInstall = ''
-    makeWrapper $out/bin/etl.* $out/bin/etl
-    makeWrapper $out/bin/etlded.* $out/bin/etlded
-  '';
-
  hardeningDisable = [ "fortify" ];

  meta = {
--- a/pkgs/by-name/et/etlegacy/package.nix
+++ b/pkgs/by-name/et/etlegacy/package.nix
@ -18,10 +18,12 @@ symlinkJoin {
  ];

  postBuild = ''
-    makeWrapper $out/bin/etl.* $out/bin/etl \
+    wrapProgram $out/bin/etl.* \
      --add-flags "+set fs_basepath ${placeholder "out"}/lib/etlegacy"
-    makeWrapper $out/bin/etlded.* $out/bin/etlded \
+    wrapProgram $out/bin/etlded.* \
      --add-flags "+set fs_basepath ${placeholder "out"}/lib/etlegacy"
+    makeWrapper $out/bin/etl.* $out/bin/etl
+    makeWrapper $out/bin/etlded.* $out/bin/etlded
  '';

  meta = {
--- a/pkgs/by-name/fl/flarectl/package.nix
+++ b/pkgs/by-name/fl/flarectl/package.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "flarectl";
-  version = "0.92.0";
+  version = "0.93.0";

  src = fetchFromGitHub {
    owner = "cloudflare";
    repo = "cloudflare-go";
    rev = "v${version}";
-    hash = "sha256-nmDW8ALhyp5McnX86JN51kJSo0bUvwTsHnQkfKSxJMM=";
+    hash = "sha256-XN/GRay5fJ2EjGHguG9i4ENCRBPZQcwQJg/2ka0HyaE=";
  };

-  vendorHash = "sha256-F1fwzzBg60E7B9iPV0gziGB3WE1tcZ/6nMpnEyTjV1g=";
+  vendorHash = "sha256-/81Onrs+qyKEt79DtfX4EDDVxhzB0uqaHa3X+GbupWQ=";

  subPackages = [ "cmd/flarectl" ];

--- a/pkgs/development/tools/continuous-integration/forgejo-actions-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/forgejo-actions-runner/default.nix
@ -2,22 +2,22 @@
 , buildGoModule
 , fetchFromGitea
 , testers
-, forgejo-actions-runner
+, forgejo-runner
 }:

 buildGoModule rec {
-  pname = "forgejo-actions-runner";
-  version = "3.3.0";
+  pname = "forgejo-runner";
+  version = "3.4.1";

  src = fetchFromGitea {
    domain = "code.forgejo.org";
    owner = "forgejo";
    repo = "runner";
    rev = "v${version}";
-    hash = "sha256-ZpsHytsIp+ZW4DI7X9MmI7nZRnXVHvx905YdZGS6WMY=";
+    hash = "sha256-c8heIHt+EJ6LnZT4/6TTWd7v85VRHjH72bdje12un4M=";
  };

-  vendorHash = "sha256-5GnGXpMy1D7KpVAVroX07Vw5QKYYtwdIhQsk23WCLgc=";
+  vendorHash = "sha256-FCCQZdAYRtJR3DGQIEvUzv+1kqvxVTGkwJwZSohq28s=";

  ldflags = [
    "-s"
@ -28,16 +28,16 @@ buildGoModule rec {
  doCheck = false; # Test try to lookup code.forgejo.org.

  passthru.tests.version = testers.testVersion {
-    package = forgejo-actions-runner;
+    package = forgejo-runner;
    version = src.rev;
  };

  meta = with lib; {
    description = "A runner for Forgejo based on act";
    homepage = "https://code.forgejo.org/forgejo/runner";
-    changelog = "https://gitea.com/gitea/act_runner/releases/tag/${src.rev}";
+    changelog = "https://code.forgejo.org/forgejo/runner/src/tag/${src.rev}/RELEASE-NOTES.md";
    license = licenses.mit;
-    maintainers = with maintainers; [ kranzes ];
+    maintainers = with maintainers; [ kranzes emilylange ];
    mainProgram = "act_runner";
  };
 }
--- a/pkgs/servers/gemini/gmid/default.nix
+++ b/pkgs/servers/gemini/gmid/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "gmid";
-  version = "1.8.6";
+  version = "2.0.2";

  src = fetchFromGitHub {
    owner = "omar-polo";
    repo = pname;
    rev = version;
-    hash = "sha256-ds5k5VHwc7/sq4PUe/WvxAx7gJkU4phKZk0KunPLNE0=";
+    hash = "sha256-5K6+CVX0/m6SBcTvwy4GD0x9R/yQjd+2tTJiA4OagcI=";
  };

  nativeBuildInputs = [ bison ];
--- a/pkgs/by-name/go/go-critic/package.nix
+++ b/pkgs/by-name/go/go-critic/package.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "go-critic";
-  version = "0.11.2";
+  version = "0.11.3";

  src = fetchFromGitHub {
    owner = "go-critic";
    repo = "go-critic";
    rev = "v${version}";
-    hash = "sha256-xej9ROsJYrjvlitxnAjUKPsp0kb8INvFnkdNfYiycz8=";
+    hash = "sha256-GEwUz6iH9y+d2UoKY68VHOKomn4EUkzoUgNHTqluW8I=";
  };

-  vendorHash = "sha256-pYdnZjCGx+skF/kqA1QO3NuVqOfsMJNVhFBpwtdZhIA=";
+  vendorHash = "sha256-rfqX76SQnLQFwheHlS3GZD+jeaVd38qfSnQCH7OH6+I=";

  subPackages = [
    "cmd/gocritic"
--- a/pkgs/by-name/gu/guix/package.nix
+++ b/pkgs/by-name/gu/guix/package.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , autoreconfHook
 , disarchive
 , git
@ -43,6 +44,19 @@ stdenv.mkDerivation rec {
    hash = "sha256-Q8dpy/Yy7wVEmsH6SMG6FSwzSUxqvH5HE3u6eyFJ+KQ=";
  };

+  patches = [
+    (fetchpatch {
+      name = "CVE-2024-27297_1.patch";
+      url = "https://git.savannah.gnu.org/cgit/guix.git/patch/?id=8f4ffb3fae133bb21d7991e97c2f19a7108b1143";
+      hash = "sha256-xKo1h2uckC2pYHt+memekagfL6dWcF8gOnTOOW/wJUU=";
+    })
+    (fetchpatch {
+      name = "CVE-2024-27297_2.patch";
+      url = "https://git.savannah.gnu.org/cgit/guix.git/patch/?id=ff1251de0bc327ec478fc66a562430fbf35aef42";
+      hash = "sha256-f4KWDVrvO/oI+4SCUHU5GandkGtHrlaM1BWygM/Qlao=";
+    })
+  ];
+
  postPatch = ''
    sed nix/local.mk -i -E \
      -e "s|^sysvinitservicedir = .*$|sysvinitservicedir = $out/etc/init.d|" \
--- a/Show More
+++ b/Show More