Merge master into staging-next

2024-04-16 18:00:57 +00:00 · 2024-04-16 18:00:57 +00:00 · feedc73bee
parent 736d06d6cf 4a04be9a3c
commit feedc73bee
77 changed files with 2083 additions and 1196 deletions
--- a/lib/default.nix
+++ b/lib/default.nix
@ -146,7 +146,7 @@ let
      scrubOptionValue literalExpression literalExample
      showOption showOptionWithDefLocs showFiles
      unknownModule mkOption mkPackageOption mkPackageOptionMD
-      literalMD;
+      mdDoc literalMD;
    inherit (self.types) isType setType defaultTypeMerge defaultFunctor
      isOptionType mkOptionType;
    inherit (self.asserts)
--- a/lib/options.nix
+++ b/lib/options.nix
@ -404,7 +404,7 @@ rec {
     Kept here to alert downstream users who may not be aware of the migration's
     completion that it should be removed from modules.
  */
-  mdDoc = lib.warn "lib.mdDoc was removed from nixpkgs. Option descriptions are now in Markdown by default, you can remove any remaining uses of it.";
+  mdDoc = lib.warn "lib.mdDoc will be removed from nixpkgs in 24.11. Option descriptions are now in Markdown by default; you can remove any remaining uses of lib.mdDoc.";

  /* For use in the `defaultText` and `example` option attributes. Causes the
     given MD text to be inserted verbatim in the documentation, for when
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -20270,6 +20270,11 @@
    githubId = 9853194;
    name = "Philipp Bartsch";
  };
+  toast = {
+    name = "Toast";
+    github = "toast003";
+    githubId = 39011842;
+  };
  toastal = {
    email = "toastal+nix@posteo.net";
    matrix = "@toastal:mozilla.org";
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -118,6 +118,8 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
  Matter Controller Server exposing websocket connections for use with other services, notably Home Assistant.
  Available as [services.matter-server](#opt-services.matter-server.enable)

+- [db-rest](https://github.com/derhuerst/db-rest), a wrapper around Deutsche Bahn's internal API for public transport data. Available as [services.db-rest](#opt-services.db-rest.enable).
+
 - [Anki Sync Server](https://docs.ankiweb.net/sync-server.html), the official sync server built into recent versions of Anki. Available as [services.anki-sync-server](#opt-services.anki-sync-server.enable).
 The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been marked deprecated and will be dropped after 24.05 due to lack of maintenance of the anki-sync-server softwares.

--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -690,6 +690,7 @@
  ./services/misc/clipmenu.nix
  ./services/misc/confd.nix
  ./services/misc/cpuminer-cryptonight.nix
+  ./services/misc/db-rest.nix
  ./services/misc/devmon.nix
  ./services/misc/dictd.nix
  ./services/misc/disnix.nix
--- a/nixos/modules/services/misc/db-rest.nix
+++ b/nixos/modules/services/misc/db-rest.nix
@ -0,0 +1,182 @@
+{ config, pkgs, lib, ... }:
+let
+  inherit (lib) mkOption types mkIf mkMerge mkDefault mkEnableOption mkPackageOption maintainers;
+  cfg = config.services.db-rest;
+in
+{
+  options = {
+    services.db-rest = {
+      enable = mkEnableOption "db-rest service";
+
+      user = mkOption {
+        type = types.str;
+        default = "db-rest";
+        description = "User account under which db-rest runs.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "db-rest";
+        description = "Group under which db-rest runs.";
+      };
+
+      host = mkOption {
+        type = types.str;
+        default = "127.0.0.1";
+        description = "The host address the db-rest server should listen on.";
+      };
+
+      port = mkOption {
+        type = types.port;
+        default = 3000;
+        description = "The port the db-rest server should listen on.";
+      };
+
+      redis = {
+        enable = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Enable caching with redis for db-rest.";
+        };
+
+        createLocally = mkOption {
+          type = types.bool;
+          default = true;
+          description = "Configure a local redis server for db-rest.";
+        };
+
+        host = mkOption {
+          type = with types; nullOr str;
+          default = null;
+          description = "Redis host.";
+        };
+
+        port = mkOption {
+          type = with types; nullOr port;
+          default = null;
+          description = "Redis port.";
+        };
+
+        user = mkOption {
+          type = with types; nullOr str;
+          default = null;
+          description = "Optional username used for authentication with redis.";
+        };
+
+        passwordFile = mkOption {
+          type = with types; nullOr path;
+          default = null;
+          example = "/run/keys/db-rest/pasword-redis-db";
+          description = "Path to a file containing the redis password.";
+        };
+
+        useSSL = mkOption {
+          type = types.bool;
+          default = true;
+          description = "Use SSL if using a redis network connection.";
+        };
+      };
+
+      package = mkPackageOption pkgs "db-rest" { };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = (cfg.redis.enable && !cfg.redis.createLocally) -> (cfg.redis.host != null && cfg.redis.port != null);
+        message = ''
+          {option}`services.db-rest.redis.createLocally` and redis network connection ({option}`services.db-rest.redis.host` or {option}`services.db-rest.redis.port`) enabled. Disable either of them.
+        '';
+      }
+      {
+        assertion = (cfg.redis.enable && !cfg.redis.createLocally) -> (cfg.redis.passwordFile != null);
+        message = ''
+          {option}`services.db-rest.redis.createLocally` is disabled, but {option}`services.db-rest.redis.passwordFile` is not set.
+        '';
+      }
+    ];
+
+    systemd.services.db-rest = mkMerge [
+      {
+        description = "db-rest service";
+        after = [ "network.target" ]
+          ++ lib.optional cfg.redis.createLocally "redis-db-rest.service";
+        requires = lib.optional cfg.redis.createLocally "redis-db-rest.service";
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          Type = "simple";
+          Restart = "always";
+          RestartSec = 5;
+          WorkingDirectory = cfg.package;
+          User = cfg.user;
+          Group = cfg.group;
+          RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+          MemoryDenyWriteExecute = false;
+          LoadCredential = lib.optional (cfg.redis.enable && cfg.redis.passwordFile != null) "REDIS_PASSWORD:${cfg.redis.passwordFile}";
+          ExecStart = mkDefault "${cfg.package}/bin/db-rest";
+
+          RemoveIPC = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          ProtectClock = true;
+          ProtectKernelLogs = true;
+          ProtectControlGroups = true;
+          ProtectKernelModules = true;
+          PrivateMounts = true;
+          SystemCallArchitectures = "native";
+          ProtectHostname = true;
+          LockPersonality = true;
+          ProtectKernelTunables = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          RestrictNamespaces = true;
+          ProtectSystem = "strict";
+          ProtectProc = "invisible";
+          ProcSubset = "pid";
+          ProtectHome = true;
+          PrivateUsers = true;
+          PrivateTmp = true;
+          CapabilityBoundingSet = "";
+        };
+        environment = {
+          NODE_ENV = "production";
+          NODE_EXTRA_CA_CERTS = "/etc/ssl/certs/ca-certificates.crt";
+          HOSTNAME = cfg.host;
+          PORT = toString cfg.port;
+        };
+      }
+      (mkIf cfg.redis.enable (if cfg.redis.createLocally then
+        { environment.REDIS_URL = config.services.redis.servers.db-rest.unixSocket; }
+      else
+        {
+          script =
+            let
+              username = lib.optionalString (cfg.redis.user != null) (cfg.redis.user);
+              host = cfg.redis.host;
+              port = toString cfg.redis.port;
+              protocol = if cfg.redis.useSSL then "rediss" else "redis";
+            in
+            ''
+              export REDIS_URL="${protocol}://${username}:$(${config.systemd.package}/bin/systemd-creds cat REDIS_PASSWORD)@${host}:${port}"
+              exec ${cfg.package}/bin/db-rest
+            '';
+        }))
+    ];
+
+    users.users = lib.mkMerge [
+      (lib.mkIf (cfg.user == "db-rest") {
+        db-rest = {
+          isSystemUser = true;
+          group = cfg.group;
+        };
+      })
+      (lib.mkIf cfg.redis.createLocally { ${cfg.user}.extraGroups = [ "redis-db-rest" ]; })
+    ];
+
+    users.groups = lib.mkIf (cfg.group == "db-rest") { db-rest = { }; };
+
+    services.redis.servers.db-rest.enable = cfg.redis.enable && cfg.redis.createLocally;
+  };
+  meta.maintainers = with maintainers; [ marie ];
+}
--- a/nixos/modules/services/web-apps/akkoma.nix
+++ b/nixos/modules/services/web-apps/akkoma.nix
@ -772,6 +772,11 @@ in {
                    default = if lib.versionOlder config.system.stateVersion "24.05"
                              then "${httpConf.scheme}://${httpConf.host}:${builtins.toString httpConf.port}/media/"
                              else null;
+                    defaultText = literalExpression ''
+                      if lib.versionOlder config.system.stateVersion "24.05"
+                      then "$\{httpConf.scheme}://$\{httpConf.host}:$\{builtins.toString httpConf.port}/media/"
+                      else null;
+                    '';
                    description = ''
                      Base path which uploads will be stored at.
                      Whilst this can just be set to a subdirectory of the main domain, it is now recommended to use a different subdomain.
@ -804,6 +809,7 @@ in {
                enabled = mkOption {
                    type = types.bool;
                    default = false;
+                    defaultText = literalExpression "false";
                    description = ''
                      Whether to enable proxying of remote media through the instance's proxy.
                    '';
@ -813,6 +819,11 @@ in {
                    default = if lib.versionOlder config.system.stateVersion "24.05"
                              then "${httpConf.scheme}://${httpConf.host}:${builtins.toString httpConf.port}/media/"
                              else null;
+                    defaultText = literalExpression ''
+                      if lib.versionOlder config.system.stateVersion "24.05"
+                      then "$\{httpConf.scheme}://$\{httpConf.host}:$\{builtins.toString httpConf.port}/media/"
+                      else null;
+                    '';
                    description = ''
                      Base path for the media proxy.
                      Whilst this can just be set to a subdirectory of the main domain, it is now recommended to use a different subdomain.
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -236,6 +236,7 @@ in {
  darling = handleTest ./darling.nix {};
  dae = handleTest ./dae.nix {};
  davis = handleTest ./davis.nix {};
+  db-rest = handleTest ./db-rest.nix {};
  dconf = handleTest ./dconf.nix {};
  deconz = handleTest ./deconz.nix {};
  deepin = handleTest ./deepin.nix {};
--- a/nixos/tests/db-rest.nix
+++ b/nixos/tests/db-rest.nix
@ -0,0 +1,107 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+{
+  name = "db-rest";
+  meta.maintainers = with pkgs.lib.maintainers; [ marie ];
+
+  nodes = {
+    database = {
+      networking = {
+        interfaces.eth1 = {
+          ipv4.addresses = [
+            { address = "192.168.2.10"; prefixLength = 24; }
+          ];
+        };
+        firewall.allowedTCPPorts = [ 31638 ];
+      };
+
+      services.redis.servers.db-rest = {
+        enable = true;
+        bind = "0.0.0.0";
+        requirePass = "choochoo";
+        port = 31638;
+      };
+    };
+
+    serverWithTcp = { pkgs, ... }: {
+      environment = {
+        etc = {
+          "db-rest/password-redis-db".text = ''
+            choochoo
+          '';
+        };
+      };
+
+      networking = {
+        interfaces.eth1 = {
+          ipv4.addresses = [
+            { address = "192.168.2.11"; prefixLength = 24; }
+          ];
+        };
+        firewall.allowedTCPPorts = [ 3000 ];
+      };
+
+      services.db-rest = {
+        enable = true;
+        host = "0.0.0.0";
+        redis = {
+          enable = true;
+          createLocally = false;
+          host = "192.168.2.10";
+          port = 31638;
+          passwordFile = "/etc/db-rest/password-redis-db";
+          useSSL = false;
+        };
+      };
+    };
+
+    serverWithUnixSocket = { pkgs, ... }: {
+      networking = {
+        interfaces.eth1 = {
+          ipv4.addresses = [
+            { address = "192.168.2.12"; prefixLength = 24; }
+          ];
+        };
+        firewall.allowedTCPPorts = [ 3000 ];
+      };
+
+      services.db-rest = {
+        enable = true;
+        host = "0.0.0.0";
+        redis = {
+          enable = true;
+          createLocally = true;
+        };
+      };
+    };
+
+    client = {
+      environment.systemPackages = [ pkgs.jq ];
+      networking = {
+        interfaces.eth1 = {
+          ipv4.addresses = [
+            { address = "192.168.2.13"; prefixLength = 24; }
+          ];
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    with subtest("db-rest redis with TCP socket"):
+      database.wait_for_unit("redis-db-rest.service")
+      database.wait_for_open_port(31638)
+
+      serverWithTcp.wait_for_unit("db-rest.service")
+      serverWithTcp.wait_for_open_port(3000)
+
+      client.succeed("curl --fail --get http://192.168.2.11:3000/stations --data-urlencode 'query=Köln Hbf' | jq -r '.\"8000207\".name' | grep 'Köln Hbf'")
+
+    with subtest("db-rest redis with Unix socket"):
+      serverWithUnixSocket.wait_for_unit("db-rest.service")
+      serverWithUnixSocket.wait_for_open_port(3000)
+
+      client.succeed("curl --fail --get http://192.168.2.12:3000/stations --data-urlencode 'query=Köln Hbf' | jq -r '.\"8000207\".name' | grep 'Köln Hbf'")
+  '';
+})
--- a/pkgs/applications/editors/vscode/extensions/README.md
+++ b/pkgs/applications/editors/vscode/extensions/README.md
@ -0,0 +1,37 @@
+# Visual Studio Code Extensions
+
+## Conventions for adding new extensions
+
+* Extensions are named in the **lowercase** version of the extension's unique identifier. Which is found on the marketplace extension page, and is the name under which the extension is installed by VSCode under `~/.vscode`.
+  Extension location should be: ${lib.strings.toLower mktplcRef.publisher}.${lib.string.toLower mktplcRef.name}
+
+* Move extension to a discrete directory whenever the extension needs extra parameters/packages (at top of the file) or other files (such as patches, update script, components). Global index file parameters/packages should be utilities shared by many extensions. Extension specific parameters/packages should not be in the global index page.
+
+* Currently `nixfmt-rfc-style` formatter is being used to format the VSCode extensions.
+
+* Respect `alphabetical order` whenever adding extensions. On disorder, please, kindly open a PR re-establishing the order.
+
+* Avoid [unnecessary](https://nix.dev/guides/best-practices.html#with-scopes) use of `with`, particularly `nested with`.
+
+* Use `hash` instead of `sha256`.
+
+* On `meta` field:
+  - add a `changelog`.
+  - `description` should mention it is a Visual Studio Code extension.
+  - `downloadPage` is the VSCode marketplace URL.
+  - `homepage` is the source-code URL.
+  - verify `license` in upstream.
+
+* On commit messages:
+  - Naming convention for:
+    - Adding a new extension:
+
+      > vscode-extensions.publisher.extension-name: init 1.2.3
+      >
+      > Release: https://github.com/owner/project/releases/tag/1.2.3
+    - Updating an extension:
+
+      > vscode-extensions.publisher.extension-name: 1.2.3 -> 2.3.4
+      >
+      > Release: https://github.com/owner/project/releases/tag/2.3.4
+  - Multiple extensions can be added in a single PR, but each extension requires it's own commit.
--- a/pkgs/applications/editors/vscode/extensions/asciidoctor.asciidoctor-vscode/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/asciidoctor.asciidoctor-vscode/default.nix
@ -0,0 +1,27 @@
+{
+  asciidoctor,
+  lib,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "asciidoctor-vscode";
+    publisher = "asciidoctor";
+    version = "2.8.9";
+    sha256 = "1xkxx5i3nhd0dzqhhdmx0li5jifsgfhv0p5h7xwsscz3gzgsdcyb";
+  };
+
+  postPatch = ''
+    substituteInPlace dist/src/text-parser.js \
+      --replace "get('asciidoctor_command', 'asciidoctor')" \
+                "get('asciidoctor_command', '${asciidoctor}/bin/asciidoctor')"
+    substituteInPlace dist/src/commands/exportAsPDF.js \
+      --replace "get('asciidoctorpdf_command', 'asciidoctor-pdf')" \
+                "get('asciidoctorpdf_command', '${asciidoctor}/bin/asciidoctor-pdf')"
+  '';
+
+  meta = {
+    license = lib.licenses.mit;
+  };
+}
--- a/pkgs/applications/editors/vscode/extensions/azdavis.millet/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/azdavis.millet/default.nix
@ -0,0 +1,30 @@
+{
+  lib,
+  jq,
+  moreutils,
+  millet,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "Millet";
+    publisher = "azdavis";
+    version = "0.13.5";
+    hash = "sha256-sWM7N+axgu1zOGWexR4JVupVmYhZrd4cZz3pmLxRj8Q=";
+  };
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
+  postInstall = ''
+    cd "$out/$installPrefix"
+    jq '.contributes.configuration.properties."millet.server.path".default = "${millet}/bin/millet-ls"' package.json | sponge package.json
+  '';
+  meta = {
+    description = "Standard ML support for VS Code";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=azdavis.millet";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.smasher164 ];
+  };
+}
--- a/pkgs/applications/editors/vscode/extensions/b4dm4n.vscode-nixpkgs-fmt/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/b4dm4n.vscode-nixpkgs-fmt/default.nix
@ -0,0 +1,27 @@
+{
+  vscode-utils,
+  jq,
+  lib,
+  moreutils,
+  nixpkgs-fmt,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "nixpkgs-fmt";
+    publisher = "B4dM4n";
+    version = "0.0.1";
+    hash = "sha256-vz2kU36B1xkLci2QwLpl/SBEhfSWltIDJ1r7SorHcr8=";
+  };
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
+  postInstall = ''
+    cd "$out/$installPrefix"
+    jq '.contributes.configuration.properties."nixpkgs-fmt.path".default = "${nixpkgs-fmt}/bin/nixpkgs-fmt"' package.json | sponge package.json
+  '';
+  meta = {
+    license = lib.licenses.mit;
+  };
+}
--- a/pkgs/applications/editors/vscode/extensions/betterthantomorrow.calva/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/betterthantomorrow.calva/default.nix
@ -0,0 +1,27 @@
+{
+  clojure-lsp,
+  jq,
+  lib,
+  moreutils,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "calva";
+    publisher = "betterthantomorrow";
+    version = "2.0.374";
+    hash = "sha256-VwdHOkduSSIrcOvrcVf7K8DSp3N1u9fvbaCVDCxp+bk=";
+  };
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
+  postInstall = ''
+    cd "$out/$installPrefix"
+    jq '.contributes.configuration[0].properties."calva.clojureLspPath".default = "${clojure-lsp}/bin/clojure-lsp"' package.json | sponge package.json
+  '';
+  meta = {
+    license = lib.licenses.mit;
+  };
+}
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -1,28 +1,17 @@
+# Before adding a new extension, read ./README.md
+
 { config
 , lib
 , fetchurl
 , callPackage
 , vscode-utils
-, asciidoctor
-, nodePackages
 , python3Packages
 , jdk
 , llvmPackages
 , llvmPackages_14
-, nixpkgs-fmt
 , protobuf
 , jq
-, shellcheck
 , moreutils
-, racket
-, clojure-lsp
-, alejandra
-, millet
-, craftos-pc
-, shfmt
-, tinymist
-, typst-lsp
-, typst-preview
 , autoPatchelfHook
 , zlib
 , stdenv
@ -31,15 +20,6 @@
 let
  inherit (vscode-utils) buildVscodeMarketplaceExtension;

-  #
-  # Unless there is a good reason not to, we attempt to use the lowercase
-  # version of the extension's unique identifier. The unique identifier can be
-  # found on the marketplace extension page, and is the name under which the
-  # extension is installed by VSCode under `~/.vscode`.
-  #
-  # This means an extension should be located at
-  # ${lib.strings.toLower mktplcRef.publisher}.${lib.string.toLower mktplcRef.name}
-  #
  baseExtensions = self: lib.mapAttrs (_n: lib.recurseIntoAttrs)
    {
      "13xforever".language-x86-64-assembly = buildVscodeMarketplaceExtension {
@ -368,27 +348,7 @@ let
        };
      };

-      asciidoctor.asciidoctor-vscode = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "asciidoctor-vscode";
-          publisher = "asciidoctor";
-          version = "2.8.9";
-          sha256 = "1xkxx5i3nhd0dzqhhdmx0li5jifsgfhv0p5h7xwsscz3gzgsdcyb";
-        };
-
-        postPatch = ''
-          substituteInPlace dist/src/text-parser.js \
-            --replace "get('asciidoctor_command', 'asciidoctor')" \
-                      "get('asciidoctor_command', '${asciidoctor}/bin/asciidoctor')"
-          substituteInPlace dist/src/commands/exportAsPDF.js \
-            --replace "get('asciidoctorpdf_command', 'asciidoctor-pdf')" \
-                      "get('asciidoctorpdf_command', '${asciidoctor}/bin/asciidoctor-pdf')"
-        '';
-
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
+      asciidoctor.asciidoctor-vscode = callPackage ./asciidoctor.asciidoctor-vscode { };

      asdine.cue = buildVscodeMarketplaceExtension {
        mktplcRef = {
@ -458,42 +418,9 @@ let
        };
      };

-      azdavis.millet = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "Millet";
-          publisher = "azdavis";
-          version = "0.13.5";
-          hash = "sha256-sWM7N+axgu1zOGWexR4JVupVmYhZrd4cZz3pmLxRj8Q=";
-        };
-        nativeBuildInputs = [ jq moreutils ];
-        postInstall = ''
-          cd "$out/$installPrefix"
-          jq '.contributes.configuration.properties."millet.server.path".default = "${millet}/bin/millet-ls"' package.json | sponge package.json
-        '';
-        meta = {
-          description = "Standard ML support for VS Code";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=azdavis.millet";
-          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.smasher164 ];
-        };
-      };
+      azdavis.millet = callPackage ./azdavis.millet { };

-      b4dm4n.vscode-nixpkgs-fmt = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "nixpkgs-fmt";
-          publisher = "B4dM4n";
-          version = "0.0.1";
-          hash = "sha256-vz2kU36B1xkLci2QwLpl/SBEhfSWltIDJ1r7SorHcr8=";
-        };
-        nativeBuildInputs = [ jq moreutils ];
-        postInstall = ''
-          cd "$out/$installPrefix"
-          jq '.contributes.configuration.properties."nixpkgs-fmt.path".default = "${nixpkgs-fmt}/bin/nixpkgs-fmt"' package.json | sponge package.json
-        '';
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
+      b4dm4n.vscode-nixpkgs-fmt = callPackage ./b4dm4n.vscode-nixpkgs-fmt { };

      baccata.scaladex-search = buildVscodeMarketplaceExtension {
        mktplcRef = {
@ -595,24 +522,9 @@ let
        };
      };

-      betterthantomorrow.calva = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "calva";
-          publisher = "betterthantomorrow";
-          version = "2.0.374";
-          hash = "sha256-VwdHOkduSSIrcOvrcVf7K8DSp3N1u9fvbaCVDCxp+bk=";
-        };
-        nativeBuildInputs = [ jq moreutils ];
-        postInstall = ''
-          cd "$out/$installPrefix"
-          jq '.contributes.configuration[0].properties."calva.clojureLspPath".default = "${clojure-lsp}/bin/clojure-lsp"' package.json | sponge package.json
-        '';
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
+      betterthantomorrow.calva = callPackage ./betterthantomorrow.calva { };

-       bierner.docs-view = buildVscodeMarketplaceExtension {
+      bierner.docs-view = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "docs-view";
          publisher = "bierner";
@ -1634,27 +1546,7 @@ let
        };
      };

-      eugleo.magic-racket = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "magic-racket";
-          publisher = "evzen-wybitul";
-          version = "0.6.4";
-          hash = "sha256-Hxa4VPm3QvJICzpDyfk94fGHu1hr+YN9szVBwDB8X4U=";
-        };
-        nativeBuildInputs = [ jq moreutils ];
-        postInstall = ''
-          cd "$out/$installPrefix"
-          jq '.contributes.configuration.properties."magicRacket.general.racketPath".default = "${racket}/bin/racket"' package.json | sponge package.json
-          jq '.contributes.configuration.properties."magicRacket.general.racoPath".default = "${racket}/bin/raco"' package.json | sponge package.json
-        '';
-        meta = {
-          changelog = "https://marketplace.visualstudio.com/items/evzen-wybitul.magic-racket/changelog";
-          description = "The best coding experience for Racket in VS Code";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=evzen-wybitul.magic-racket";
-          homepage = "https://github.com/Eugleo/magic-racket";
-          license = lib.licenses.agpl3Only;
-        };
-      };
+      eugleo.magic-racket = callPackage ./eugleo.magic-racket { };

      ExiaHuang.dictionary = buildVscodeMarketplaceExtension {
        mktplcRef = {
@ -1775,28 +1667,7 @@ let
        };
      };

-      foxundermoon.shell-format = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "shell-format";
-          publisher = "foxundermoon";
-          version = "7.2.5";
-          hash = "sha256-kfpRByJDcGY3W9+ELBzDOUMl06D/vyPlN//wPgQhByk=";
-        };
-
-        nativeBuildInputs = [ jq moreutils ];
-
-        postInstall = ''
-          cd "$out/$installPrefix"
-          jq '.contributes.configuration.properties."shellformat.path".default = "${shfmt}/bin/shfmt"' package.json | sponge package.json
-        '';
-
-        meta = {
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=foxundermoon.shell-format";
-          homepage = "https://github.com/foxundermoon/vs-shell-format";
-          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.dbirks ];
-        };
-      };
+      foxundermoon.shell-format = callPackage ./foxundermoon.shell-format { };

      freebroccolo.reasonml = buildVscodeMarketplaceExtension {
        meta = {
@ -2297,38 +2168,7 @@ let
        };
      };

-      jackmacwindows.craftos-pc = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "craftos-pc";
-          publisher = "jackmacwindows";
-          version = "1.2.2";
-          hash = "sha256-A+MNroXv0t9Mw/gr0Fyov3cXyF/GGzwRLKrIxQ2tKCE=";
-        };
-        nativeBuildInputs = [ jq moreutils ];
-        postInstall = ''
-          cd "$out/$installPrefix"
-
-          jq -e '
-            .contributes.configuration.properties."craftos-pc.executablePath.linux".default =
-              "${lib.meta.getExe craftos-pc}" |
-            .contributes.configuration.properties."craftos-pc.executablePath.mac".default =
-              "${lib.meta.getExe craftos-pc}" |
-            .contributes.configuration.properties."craftos-pc.executablePath.windows".default =
-              "${lib.meta.getExe craftos-pc}"
-          ' \
-          < package.json \
-          | sponge package.json
-        '';
-        meta = {
-          changelog = "https://marketplace.visualstudio.com/items/jackmacwindows.craftos-pc/changelog";
-          description = "A Visual Studio Code extension for opening a CraftOS-PC window";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=jackmacwindows.craftos-pc";
-          homepage = "https://www.craftos-pc.cc/docs/extension";
-          license = lib.licenses.mit;
-          maintainers = with lib.maintainers; [ tomodachi94 ];
-          platforms = craftos-pc.meta.platforms;
-        };
-      };
+      jackmacwindows.craftos-pc = callPackage ./jackmacwindows.craftos-pc { };

      james-yu.latex-workshop = buildVscodeMarketplaceExtension {
        mktplcRef = {
@ -2447,8 +2287,8 @@ let
        mktplcRef = {
          name = "nix-ide";
          publisher = "jnoortheen";
-          version = "0.2.2";
-          hash = "sha256-jwOM+6LnHyCkvhOTVSTUZvgx77jAg6hFCCpBqY8AxIg=";
+          version = "0.3.1";
+          hash = "sha256-05oMDHvFM/dTXB6T3rcDK3EiNG2T0tBN9Au9b+Bk7rI=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/jnoortheen.nix-ide/changelog";
@ -2546,33 +2386,7 @@ let
        };
      };

-      kamadorueda.alejandra = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "alejandra";
-          publisher = "kamadorueda";
-          version = "1.0.0";
-          hash = "sha256-COlEjKhm8tK5XfOjrpVUDQ7x3JaOLiYoZ4MdwTL8ktk=";
-        };
-        nativeBuildInputs = [ jq moreutils ];
-        postInstall = ''
-          cd "$out/$installPrefix"
-
-          jq -e '
-            .contributes.configuration.properties."alejandra.program".default =
-              "${alejandra}/bin/alejandra" |
-            .contributes.configurationDefaults."alejandra.program" =
-              "${alejandra}/bin/alejandra"
-          ' \
-          < package.json \
-          | sponge package.json
-        '';
-        meta = {
-          description = "The Uncompromising Nix Code Formatter";
-          homepage = "https://github.com/kamadorueda/alejandra";
-          license = lib.licenses.unlicense;
-          maintainers = [ lib.maintainers.kamadorueda ];
-        };
-      };
+      kamadorueda.alejandra = callPackage ./kamadorueda.alejandra { };

      kamikillerto.vscode-colorize = buildVscodeMarketplaceExtension {
        mktplcRef = {
@ -2797,35 +2611,7 @@ let
        };
      };

-      # Keep pkgs/by-name/ty/typst-preview/package.nix in sync with this
-      # extension
-      mgt19937.typst-preview = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "typst-preview";
-          publisher = "mgt19937";
-          version = "0.11.4";
-          hash = "sha256-GwlzFphZmP87pLys01+PWTv13imcdGjunCMH6atz9xs=";
-        };
-
-        buildInputs = [
-          typst-preview
-        ];
-
-        nativeBuildInputs = [ jq moreutils ];
-
-        postInstall = ''
-          cd "$out/$installPrefix"
-          jq '.contributes.configuration.properties."typst-preview.executable".default = "${lib.getExe typst-preview}"' package.json | sponge package.json
-        '';
-
-        meta = {
-          description = "Typst Preview is an extension for previewing your Typst files in vscode instantly";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=mgt19937.typst-preview";
-          homepage = "https://github.com/Enter-tainer/typst-preview-vscode";
-          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.drupol ];
-        };
-      };
+      mgt19937.typst-preview = callPackage ./mgt19937.typst-preview { };

      mhutchie.git-graph = buildVscodeMarketplaceExtension {
        mktplcRef = {
@ -2867,10 +2653,9 @@ let
        mktplcRef = {
          name = "direnv";
          publisher = "mkhl";
-          version = "0.16.0";
-          hash = "sha256-u2AFjvhm3zio1ygW9yD9ZwbywLrEssd0O7/0AtfCvMo=";
+          version = "0.17.0";
+          hash = "sha256-9sFcfTMeLBGw2ET1snqQ6Uk//D/vcD9AVsZfnUNrWNg=";
        };
-
        meta = {
          description = "direnv support for Visual Studio Code";
          license = lib.licenses.bsd0;
@ -2979,25 +2764,7 @@ let

      ms-python.python = callPackage ./ms-python.python { };

-      ms-python.vscode-pylance = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "vscode-pylance";
-          publisher = "MS-python";
-          version = "2023.8.50";
-          hash = "sha256-xJU/j5r/Idp/0VorEfciT4SFKRBpMCv9Z0LKO/++1Gk=";
-        };
-
-        buildInputs = [ nodePackages.pyright ];
-
-        meta = {
-          changelog = "https://marketplace.visualstudio.com/items/ms-python.vscode-pylance/changelog";
-          description = "A performant, feature-rich language server for Python in VS Code";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-python.vscode-pylance";
-          homepage = "https://github.com/microsoft/pylance-release";
-          license = lib.licenses.unfree;
-          maintainers = [ lib.maintainers.ericthemagician ];
-        };
-      };
+      ms-python.vscode-pylance = callPackage ./ms-python.vscode-pylance { };

      ms-toolsai.datawrangler = buildVscodeMarketplaceExtension {
        mktplcRef = {
@ -3269,36 +3036,7 @@ let
        };
      };

-      myriad-dreamin.tinymist = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "tinymist";
-          publisher = "myriad-dreamin";
-          # Please update the corresponding binary (tinymist) when updating
-          # this extension.
-          version = "0.11.3";
-          hash = "sha256-b5aD4gz4j+QAEPmYaNnaputbYTPoFxVFih76HmznUP8=";
-        };
-
-        nativeBuildInputs = [ jq moreutils ];
-
-        buildInputs = [
-          tinymist
-        ];
-
-        postInstall = ''
-          cd "$out/$installPrefix"
-          jq '.contributes.configuration.properties."tinymist.serverPath".default = "${lib.getExe tinymist}"' package.json | sponge package.json
-        '';
-
-        meta = {
-          changelog = "https://marketplace.visualstudio.com/items/myriad-dreamin.tinymist/changelog";
-          description = "A VSCode extension for providing an integration solution for Typst";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=myriad-dreamin.tinymist";
-          homepage = "https://github.com/myriad-dreamin/tinymist";
-          license = lib.licenses.asl20;
-          maintainers = [ lib.maintainers.drupol ];
-        };
-      };
+      myriad-dreamin.tinymist = callPackage ./myriad-dreamin.tinymist { };

      naumovs.color-highlight = buildVscodeMarketplaceExtension {
        mktplcRef = {
@ -3383,36 +3121,7 @@ let
        };
      };

-      nvarner.typst-lsp = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "typst-lsp";
-          publisher = "nvarner";
-          # Please update the corresponding binary (typst-lsp) when updating
-          # this extension.
-          version = "0.12.1";
-          hash = "sha256-JcfFaR1wU5XwapH8vnfVy7Cb7DfUWVeoLfBV3wEtCpE=";
-        };
-
-        nativeBuildInputs = [ jq moreutils ];
-
-        buildInputs = [
-          typst-lsp
-        ];
-
-        postInstall = ''
-          cd "$out/$installPrefix"
-          jq '.contributes.configuration.properties."typst-lsp.serverPath".default = "${lib.getExe typst-lsp}"' package.json | sponge package.json
-        '';
-
-        meta = {
-          changelog = "https://marketplace.visualstudio.com/items/nvarner.typst-lsp/changelog";
-          description = "A VSCode extension for providing a language server for Typst";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=nvarner.typst-lsp";
-          homepage = "https://github.com/nvarner/typst-lsp";
-          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.drupol ];
-        };
-      };
+      nvarner.typst-lsp = callPackage ./nvarner.typst-lsp { };

      ocamllabs.ocaml-platform = buildVscodeMarketplaceExtension {
        meta = {
@ -3901,6 +3610,23 @@ let
        };
      };

+      signageos.signageos-vscode-sops = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "signageos-vscode-sops";
+          publisher = "signageos";
+          version = "0.9.1";
+          hash = "sha256-b1Gp+tL5/e97xMuqkz4EvN0PxI7cJOObusEkcp+qKfM=";
+        };
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/signageos.signageos-vscode-sops/changelog";
+          description = "A Visual Studio Code extension for SOPS support";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=signageos.signageos-vscode-sops";
+          homepage = "https://github.com/signageos/vscode-sops";
+          license = lib.licenses.unfree;
+          maintainers = [ lib.maintainers.superherointj ];
+        };
+      };
+
      silofy.hackthebox = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "hackthebox";
@ -4324,26 +4050,7 @@ let
        };
      };

-      timonwong.shellcheck = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "shellcheck";
-          publisher = "timonwong";
-          version = "0.37.0";
-          sha256 = "1d0blynn6c2hz4y9fk7b5wsa3x168gxyycr5d05zqp0rx520m5wc";
-        };
-        nativeBuildInputs = [ jq moreutils ];
-        postInstall = ''
-          cd "$out/$installPrefix"
-          jq '.contributes.configuration.properties."shellcheck.executablePath".default = "${shellcheck}/bin/shellcheck"' package.json | sponge package.json
-        '';
-        meta = {
-          description = "Integrates ShellCheck into VS Code, a linter for Shell scripts";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=timonwong.shellcheck";
-          homepage = "https://github.com/vscode-shellcheck/vscode-shellcheck";
-          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.raroh73 ];
-        };
-      };
+      timonwong.shellcheck = callPackage ./timonwong.shellcheck { };

      tobiasalthoff.atom-material-theme = buildVscodeMarketplaceExtension {
        mktplcRef = {
@ -4495,12 +4202,12 @@ let
        mktplcRef = {
          name = "errorlens";
          publisher = "usernamehw";
-          version = "3.14.0";
-          sha256 = "0k70f5f4hcv3jl3a04736ml8amx8w7wb3mb8f6l5gngnvq9fj528";
+          version = "3.16.0";
+          hash = "sha256-Y3M/A5rYLkxQPRIZ0BUjhlkvixDae+wIRUsBn4tREFw=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/usernamehw.errorlens/changelog";
-          description = "Improve highlighting of errors, warnings and other language diagnostics.";
+          description = "A Visual Studio Code extension that improves highlighting of errors, warnings and other language diagnostics";
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=usernamehw.errorlens";
          homepage = "https://github.com/usernamehw/vscode-error-lens";
          license = lib.licenses.mit;
--- a/pkgs/applications/editors/vscode/extensions/eugleo.magic-racket/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/eugleo.magic-racket/default.nix
@ -0,0 +1,32 @@
+{
+  lib,
+  jq,
+  moreutils,
+  racket,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "magic-racket";
+    publisher = "evzen-wybitul";
+    version = "0.6.4";
+    hash = "sha256-Hxa4VPm3QvJICzpDyfk94fGHu1hr+YN9szVBwDB8X4U=";
+  };
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
+  postInstall = ''
+    cd "$out/$installPrefix"
+    jq '.contributes.configuration.properties."magicRacket.general.racketPath".default = "${racket}/bin/racket"' package.json | sponge package.json
+    jq '.contributes.configuration.properties."magicRacket.general.racoPath".default = "${racket}/bin/raco"' package.json | sponge package.json
+  '';
+  meta = {
+    changelog = "https://marketplace.visualstudio.com/items/evzen-wybitul.magic-racket/changelog";
+    description = "The best coding experience for Racket in VS Code";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=evzen-wybitul.magic-racket";
+    homepage = "https://github.com/Eugleo/magic-racket";
+    license = lib.licenses.agpl3Only;
+  };
+}
--- a/pkgs/applications/editors/vscode/extensions/foxundermoon.shell-format/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/foxundermoon.shell-format/default.nix
@ -0,0 +1,33 @@
+{
+  jq,
+  lib,
+  moreutils,
+  shfmt,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "shell-format";
+    publisher = "foxundermoon";
+    version = "7.2.5";
+    hash = "sha256-kfpRByJDcGY3W9+ELBzDOUMl06D/vyPlN//wPgQhByk=";
+  };
+
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
+
+  postInstall = ''
+    cd "$out/$installPrefix"
+    jq '.contributes.configuration.properties."shellformat.path".default = "${shfmt}/bin/shfmt"' package.json | sponge package.json
+  '';
+
+  meta = {
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=foxundermoon.shell-format";
+    homepage = "https://github.com/foxundermoon/vs-shell-format";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.dbirks ];
+  };
+}
--- a/pkgs/applications/editors/vscode/extensions/jackmacwindows.craftos-pc/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/jackmacwindows.craftos-pc/default.nix
@ -0,0 +1,43 @@
+{
+  vscode-utils,
+  craftos-pc,
+  jq,
+  lib,
+  moreutils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "craftos-pc";
+    publisher = "jackmacwindows";
+    version = "1.2.2";
+    hash = "sha256-A+MNroXv0t9Mw/gr0Fyov3cXyF/GGzwRLKrIxQ2tKCE=";
+  };
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
+  postInstall = ''
+    cd "$out/$installPrefix"
+
+    jq -e '
+      .contributes.configuration.properties."craftos-pc.executablePath.linux".default =
+        "${lib.meta.getExe craftos-pc}" |
+      .contributes.configuration.properties."craftos-pc.executablePath.mac".default =
+        "${lib.meta.getExe craftos-pc}" |
+      .contributes.configuration.properties."craftos-pc.executablePath.windows".default =
+        "${lib.meta.getExe craftos-pc}"
+    ' \
+    < package.json \
+    | sponge package.json
+  '';
+  meta = {
+    changelog = "https://marketplace.visualstudio.com/items/jackmacwindows.craftos-pc/changelog";
+    description = "A Visual Studio Code extension for opening a CraftOS-PC window";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=jackmacwindows.craftos-pc";
+    homepage = "https://www.craftos-pc.cc/docs/extension";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ tomodachi94 ];
+    platforms = craftos-pc.meta.platforms;
+  };
+}
--- a/pkgs/applications/editors/vscode/extensions/kamadorueda.alejandra/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/kamadorueda.alejandra/default.nix
@ -0,0 +1,38 @@
+{
+  alejandra,
+  jq,
+  lib,
+  moreutils,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "alejandra";
+    publisher = "kamadorueda";
+    version = "1.0.0";
+    hash = "sha256-COlEjKhm8tK5XfOjrpVUDQ7x3JaOLiYoZ4MdwTL8ktk=";
+  };
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
+  postInstall = ''
+    cd "$out/$installPrefix"
+
+    jq -e '
+      .contributes.configuration.properties."alejandra.program".default =
+        "${alejandra}/bin/alejandra" |
+      .contributes.configurationDefaults."alejandra.program" =
+        "${alejandra}/bin/alejandra"
+    ' \
+    < package.json \
+    | sponge package.json
+  '';
+  meta = {
+    description = "The Uncompromising Nix Code Formatter";
+    homepage = "https://github.com/kamadorueda/alejandra";
+    license = lib.licenses.unlicense;
+    maintainers = [ lib.maintainers.kamadorueda ];
+  };
+}
--- a/pkgs/applications/editors/vscode/extensions/mgt19937.typst-preview/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/mgt19937.typst-preview/default.nix
@ -0,0 +1,38 @@
+# Keep pkgs/by-name/ty/typst-preview/package.nix in sync with this extension
+
+{
+  vscode-utils,
+  lib,
+  jq,
+  moreutils,
+  typst-preview,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "typst-preview";
+    publisher = "mgt19937";
+    version = "0.11.4";
+    hash = "sha256-GwlzFphZmP87pLys01+PWTv13imcdGjunCMH6atz9xs=";
+  };
+
+  buildInputs = [ typst-preview ];
+
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
+
+  postInstall = ''
+    cd "$out/$installPrefix"
+    jq '.contributes.configuration.properties."typst-preview.executable".default = "${lib.getExe typst-preview}"' package.json | sponge package.json
+  '';
+
+  meta = {
+    description = "Typst Preview is an extension for previewing your Typst files in vscode instantly";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=mgt19937.typst-preview";
+    homepage = "https://github.com/Enter-tainer/typst-preview-vscode";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.drupol ];
+  };
+}
--- a/pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix
@ -0,0 +1,25 @@
+{
+  lib,
+  nodePackages,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "vscode-pylance";
+    publisher = "MS-python";
+    version = "2023.8.50";
+    hash = "sha256-xJU/j5r/Idp/0VorEfciT4SFKRBpMCv9Z0LKO/++1Gk=";
+  };
+
+  buildInputs = [ nodePackages.pyright ];
+
+  meta = {
+    changelog = "https://marketplace.visualstudio.com/items/ms-python.vscode-pylance/changelog";
+    description = "A performant, feature-rich language server for Python in VS Code";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-python.vscode-pylance";
+    homepage = "https://github.com/microsoft/pylance-release";
+    license = lib.licenses.unfree;
+    maintainers = [ lib.maintainers.ericthemagician ];
+  };
+}
--- a/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
@ -0,0 +1,39 @@
+{
+  jq,
+  lib,
+  moreutils,
+  tinymist,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "tinymist";
+    publisher = "myriad-dreamin";
+    # Please update the corresponding binary (tinymist) when updating
+    # this extension.
+    version = "0.11.4";
+    hash = "sha256-VR+vl6mctwq9oSIgnfutvPFwfGUdEco8fCOjzMvPtII=";
+  };
+
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
+
+  buildInputs = [ tinymist ];
+
+  postInstall = ''
+    cd "$out/$installPrefix"
+    jq '.contributes.configuration.properties."tinymist.serverPath".default = "${lib.getExe tinymist}"' package.json | sponge package.json
+  '';
+
+  meta = {
+    changelog = "https://marketplace.visualstudio.com/items/myriad-dreamin.tinymist/changelog";
+    description = "A VSCode extension for providing an integration solution for Typst";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=myriad-dreamin.tinymist";
+    homepage = "https://github.com/myriad-dreamin/tinymist";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.drupol ];
+  };
+}
--- a/pkgs/applications/editors/vscode/extensions/nvarner.typst-lsp/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/nvarner.typst-lsp/default.nix
@ -0,0 +1,39 @@
+{
+  jq,
+  lib,
+  moreutils,
+  typst-lsp,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "typst-lsp";
+    publisher = "nvarner";
+    # Please update the corresponding binary (typst-lsp) when updating
+    # this extension.
+    version = "0.12.1";
+    hash = "sha256-JcfFaR1wU5XwapH8vnfVy7Cb7DfUWVeoLfBV3wEtCpE=";
+  };
+
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
+
+  buildInputs = [ typst-lsp ];
+
+  postInstall = ''
+    cd "$out/$installPrefix"
+    jq '.contributes.configuration.properties."typst-lsp.serverPath".default = "${lib.getExe typst-lsp}"' package.json | sponge package.json
+  '';
+
+  meta = {
+    changelog = "https://marketplace.visualstudio.com/items/nvarner.typst-lsp/changelog";
+    description = "A VSCode extension for providing a language server for Typst";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=nvarner.typst-lsp";
+    homepage = "https://github.com/nvarner/typst-lsp";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.drupol ];
+  };
+}
--- a/pkgs/applications/editors/vscode/extensions/timonwong.shellcheck/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/timonwong.shellcheck/default.nix
@ -0,0 +1,31 @@
+{
+  jq,
+  lib,
+  moreutils,
+  shellcheck,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "shellcheck";
+    publisher = "timonwong";
+    version = "0.37.0";
+    sha256 = "1d0blynn6c2hz4y9fk7b5wsa3x168gxyycr5d05zqp0rx520m5wc";
+  };
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
+  postInstall = ''
+    cd "$out/$installPrefix"
+    jq '.contributes.configuration.properties."shellcheck.executablePath".default = "${shellcheck}/bin/shellcheck"' package.json | sponge package.json
+  '';
+  meta = {
+    description = "Integrates ShellCheck into VS Code, a linter for Shell scripts";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=timonwong.shellcheck";
+    homepage = "https://github.com/vscode-shellcheck/vscode-shellcheck";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.raroh73 ];
+  };
+}
--- a/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix
@ -27,8 +27,14 @@ let

    cargoHash = "sha256-e/Jki/4pCs0qzaBVR4iiUhdBFmWlTZYREQkuFSoWYFo=";

+    buildInputs = lib.optionals stdenv.isDarwin [ lldb ];
+
    nativeBuildInputs = [ makeWrapper ];

+    env = lib.optionalAttrs stdenv.isDarwin {
+      NIX_LDFLAGS = "-llldb -lc++abi";
+    };
+
    buildAndTestSubdir = "adapter";

    buildFeatures = [ "weak-linkage" ];
@ -89,6 +95,15 @@ let
    '';
  };

+  # debugservers on macOS require the 'com.apple.security.cs.debugger'
+  # entitlement which nixpkgs' lldb-server does not yet provide; see
+  # <https://github.com/NixOS/nixpkgs/pull/38624> for details
+  lldbServer =
+    if stdenv.isDarwin then
+      "/Applications/Xcode.app/Contents/SharedFrameworks/LLDB.framework/Versions/A/Resources/debugserver"
+    else
+      "${lldb.out}/bin/lldb-server";
+
 in stdenv.mkDerivation {
  pname = "vscode-extension-${publisher}-${pname}";
  inherit src version vscodeExtUniqueId vscodeExtPublisher vscodeExtName;
@ -107,6 +122,9 @@ in stdenv.mkDerivation {

  postConfigure = ''
    cp -r ${nodeDeps}/lib/node_modules .
+  '' + lib.optionalString stdenv.isDarwin ''
+    export HOME="$TMPDIR/home"
+    mkdir $HOME
  '';

  cmakeFlags = [
@ -129,7 +147,8 @@ in stdenv.mkDerivation {
    mv -t $ext vsix-extracted/extension/*
    cp -t $ext/ -r ${adapter}/share/*
    wrapProgram $ext/adapter/codelldb \
-      --set-default LLDB_DEBUGSERVER_PATH "${lldb.out}/bin/lldb-server"
+      --prefix LD_LIBRARY_PATH : "$ext/lldb/lib" \
+      --set-default LLDB_DEBUGSERVER_PATH "${lldbServer}"
    # Mark that all components are installed.
    touch $ext/platform.ok

--- a/pkgs/applications/misc/vhs/default.nix
+++ b/pkgs/applications/misc/vhs/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "vhs";
-  version = "0.7.1";
+  version = "0.7.2";

  src = fetchFromGitHub {
    owner = "charmbracelet";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-4VQcIynkENScxpeM09IXrpMszqojlMuyjtXX2lbS9dg=";
+    hash = "sha256-CWurSAxEXAquWXEOyBWBF6JN9Pesm5hBS3jVNv56dvE=";
  };

-  vendorHash = "sha256-/XW5Gq9Yz+M7Al1hy6pow34e3Cn3q8aA0ByRdhWXUIQ=";
+  vendorHash = "sha256-Kh5Sy7URmhsyBF35I0TaDdpSLD96MnkwIS+96+tSyO0=";

  nativeBuildInputs = [ installShellFiles makeWrapper ];

--- a/pkgs/applications/networking/browsers/palemoon/bin.nix
+++ b/pkgs/applications/networking/browsers/palemoon/bin.nix
@ -14,23 +14,15 @@
 , libpulseaudio
 , makeDesktopItem
 , wrapGAppsHook
+, writeScript
 , testers
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "palemoon-bin";
-  version = "33.0.0";
+  version = "33.0.2";

-  src = fetchzip {
-    urls = [
-      "https://rm-eu.palemoon.org/release/palemoon-${finalAttrs.version}.linux-x86_64-gtk${if withGTK3 then "3" else "2"}.tar.xz"
-      "https://rm-us.palemoon.org/release/palemoon-${finalAttrs.version}.linux-x86_64-gtk${if withGTK3 then "3" else "2"}.tar.xz"
-    ];
-    hash = if withGTK3 then
-      "sha256-qZX23dsKNg5AOIaBAAmTWT6VDEl3OGz3kb3idtvJElw="
-    else
-      "sha256-Lz1+5I8Rj0GrBUBTJoRsatpyzkqVHZuWbKARkuWFs5U=";
-  };
+  src = finalAttrs.passthru.sources."gtk${if withGTK3 then "3" else "2"}";

  preferLocalBuild = true;

@ -155,8 +147,49 @@ stdenv.mkDerivation (finalAttrs: {
    wrapGApp $out/lib/palemoon/palemoon
  '';

-  passthru.tests.version = testers.testVersion {
-    package = finalAttrs.finalPackage;
+  passthru = {
+    sources = let
+      urlRegionVariants = buildVariant: map
+        (region: "https://rm-${region}.palemoon.org/release/palemoon-${finalAttrs.version}.linux-x86_64-${buildVariant}.tar.xz")
+        [
+          "eu"
+          "us"
+        ];
+    in {
+      gtk3 = fetchzip {
+        urls = urlRegionVariants "gtk3";
+        hash = "sha256-Kahnwlj9PIWB24lvH6h9cZK459NW2Vo2g6ckuv0Ax48=";
+      };
+      gtk2 = fetchzip {
+        urls = urlRegionVariants "gtk2";
+        hash = "sha256-XOiLGmU8O96clUpnp/OkzXmWR1PJ2AdzbVFj6adbcvY=";
+      };
+    };
+
+    tests.version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+    };
+
+    updateScript = writeScript "update-palemoon-bin" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts curl libxml2
+
+      set -eu -o pipefail
+
+      # Only release note announcement == finalized release
+      version="$(
+        curl -s 'http://www.palemoon.org/releasenotes.shtml' |
+        xmllint --html --xpath 'html/body/table/tbody/tr/td/h3/text()' - 2>/dev/null | head -n1 |
+        sed 's/v\(\S*\).*/\1/'
+      )"
+
+      for variant in gtk3 gtk2; do
+        # The script will not perform an update when the version attribute is up to date from previous platform run
+        # We need to clear it before each run
+        update-source-version palemoon-bin 0 "${lib.fakeHash}" --source-key="sources.$variant"
+        update-source-version palemoon-bin "$version" --source-key="sources.$variant"
+      done
+    '';
  };

  meta = with lib; {
--- a/pkgs/applications/networking/cluster/cni/default.nix
+++ b/pkgs/applications/networking/cluster/cni/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "cni";
-  version = "1.1.2";
+  version = "1.2.0";

  src = fetchFromGitHub {
    owner = "containernetworking";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-g7fVeoqquxPa17AfTu6wnB6PQJDluJ21T3ETrcvWtWg=";
+    hash = "sha256-32rmfBjPtc9w+B8PIb8sFOIlzZ7PnS6XSZRNLreMVl4=";
  };

-  vendorHash = "sha256-nH/myA/KdTeFXvmBymXITyx5fdCGnWRn6hNRinXc3/s=";
+  vendorHash = "sha256-JWaQacekMQGT710U5UgiIpmEYgyUCh1uks5eSV5nhWc=";

  subPackages = [
    "./cnitool"
--- a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
@ -20,13 +20,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "teams-for-linux";
-  version = "1.4.22";
+  version = "1.4.27";

  src = fetchFromGitHub {
    owner = "IsmaelMartinez";
    repo = "teams-for-linux";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-eNd12p9QvuYpiy9FaGaMSfQ3qVYzmYyO2/v/rdV3nN8=";
+    hash = "sha256-nUHiveS1XI+vC2Tj1DK/DS4CrKTLMg1IYgTPWXuLrAc=";
  };

  offlineCache = fetchYarnDeps {
--- a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
@ -63,14 +63,14 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "telegram-desktop";
-  version = "4.16.6";
+  version = "4.16.7";

  src = fetchFromGitHub {
    owner = "telegramdesktop";
    repo = "tdesktop";
    rev = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-1NRA8guTbDEraW1uXSo7q54d1e8/QnXwxkfb6k3e6b0=";
+    hash = "sha256-+BXuFHXGOgpmAX7wsGLxZxfzvNsntFLtd+Obhb339Yc=";
  };

  patches = [
--- a/pkgs/applications/version-management/git-machete/default.nix
+++ b/pkgs/applications/version-management/git-machete/default.nix
@ -12,13 +12,13 @@

 buildPythonApplication rec {
  pname = "git-machete";
-  version = "3.24.2";
+  version = "3.25.0";

  src = fetchFromGitHub {
    owner = "virtuslab";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-nxfSdgGF/hDFf7KIJ+tqCvxEi1GOjTAbpcJylIqhd/M=";
+    hash = "sha256-tLEuSwM8X0+oQDB9fmj5OQsC7iA906EQZz3yvB6rXfk=";
  };

  nativeBuildInputs = [ installShellFiles ];
--- a/pkgs/applications/virtualization/nixpacks/default.nix
+++ b/pkgs/applications/virtualization/nixpacks/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "nixpacks";
-  version = "1.21.2";
+  version = "1.21.3";

  src = fetchFromGitHub {
    owner = "railwayapp";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-GY5fwmwr2FAJB9SjTaghlC4GD6ECnect21VInTXseRE=";
+    sha256 = "sha256-niEuOsSOjHDP4KEax/OqQfxWC3XmTRUKB8k0DQ3Ybq0=";
  };

-  cargoHash = "sha256-kXfNWAloMwpykv6zJS5g6ng8RGn+NBNgYJmUg/I7dBg=";
+  cargoHash = "sha256-LMVYrxYpkwM9rdGkKaeLFKB+B2HI+AEDwrdBCAFLpJQ=";

  # skip test due FHS dependency
  doCheck = false;
--- a/pkgs/applications/window-managers/river/default.nix
+++ b/pkgs/applications/window-managers/river/default.nix
@ -1,6 +1,6 @@
 { lib
 , stdenv
-, fetchFromGitHub
+, fetchFromGitea
 , libGL
 , libX11
 , libevdev
@ -12,7 +12,7 @@
 , udev
 , wayland
 , wayland-protocols
-, wlroots_0_16
+, wlroots_0_17
 , xwayland
 , zig_0_11
 , withManpages ? true
@ -21,16 +21,17 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "river";
-  version = "0.2.6";
+  version = "0.3.0";

  outputs = [ "out" ] ++ lib.optionals withManpages [ "man" ];

-  src = fetchFromGitHub {
-    owner = "riverwm";
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "river";
    repo = "river";
    rev = "refs/tags/v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-JPb8l5ANxYCqinWNoQK5PAyn4CaiSj0e9mAhZwd9HOw=";
+    hash = "sha256-6LZuWx0sC6bW0K7D0PR8hJlVW6i6NIzOOORdMu3Gk5U=";
  };

  nativeBuildInputs = [
@ -49,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
    pixman
    udev
    wayland-protocols
-    wlroots_0_16
+    wlroots_0_17
  ] ++ lib.optional xwaylandSupport libX11;

  dontConfigure = true;
@ -64,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
  passthru.providedSessions = [ "river" ];

  meta = {
-    homepage = "https://github.com/ifreund/river";
+    homepage = "https://codeberg.org/river/river";
    description = "A dynamic tiling wayland compositor";
    longDescription = ''
      River is a dynamic tiling Wayland compositor with flexible runtime
@ -79,7 +80,7 @@ stdenv.mkDerivation (finalAttrs: {
      - Scriptable configuration and control through a custom Wayland protocol
        and separate riverctl binary implementing it.
    '';
-    changelog = "https://github.com/ifreund/river/releases/tag/v${finalAttrs.version}";
+    changelog = "https://codeberg.org/river/river/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.gpl3Plus;
    maintainers = with lib.maintainers; [
      adamcstephens
--- a/pkgs/by-name/at/atuin/package.nix
+++ b/pkgs/by-name/at/atuin/package.nix
@ -10,20 +10,20 @@

 rustPlatform.buildRustPackage rec {
  pname = "atuin";
-  version = "18.1.0";
+  version = "18.2.0";

  src = fetchFromGitHub {
    owner = "atuinsh";
    repo = "atuin";
    rev = "v${version}";
-    hash = "sha256-ddj8vHFTRBzeueSvY9kS1ZIcAID8k3MXrQkUVt04rQg=";
+    hash = "sha256-TTQ2XLqng7TMLnRsLDb/50yyHYuMSPZJ4H+7CEFWQQ0=";
  };

  # TODO: unify this to one hash because updater do not support this
  cargoHash =
    if stdenv.isLinux
-    then "sha256-LKHBXm9ZThX96JjxJb8d7cRdhWL1t/3aG3Qq1TYBC74="
-    else "sha256-RSkC062XB5zy3lmI0OQhJfJ6FqFWXhpMPNIIqbrrlso=";
+    then "sha256-KMH19Op7uyb3Z/cjT6bdmO+JEp1o2n6rWRNYmn1+0hE="
+    else "sha256-mBOyo6bKipMfmsowQujeUpog12jXAiqx5CtkwCxquRU=";

  # atuin's default features include 'check-updates', which do not make sense
  # for distribution builds. List all other default features.
@ -60,6 +60,8 @@ rustPlatform.buildRustPackage rec {
    # PermissionDenied (Operation not permitted)
    "--skip=change_password"
    "--skip=multi_user_test"
+    # Tries to touch files
+    "--skip=build_aliases"
  ];

  meta = with lib; {
--- a/pkgs/by-name/br/bruno/package.nix
+++ b/pkgs/by-name/br/bruno/package.nix
@ -27,20 +27,20 @@ let
 in
 buildNpmPackage' rec {
  pname = "bruno";
-  version = "1.12.3";
+  version = "1.13.1";

  src = fetchFromGitHub {
    owner = "usebruno";
    repo = "bruno";
    rev = "v${version}";
-    hash = "sha256-ubvsTJ/MSEguVeJg91LvgARWte+p5MHdqhXIVqbyPhQ=";
+    hash = "sha256-fVbwHmJ/5OtMM0lkOIo6zPXkAa8mIK+WRHCTXJ1XEIw=";

    postFetch = ''
      ${lib.getExe npm-lockfile-fix} $out/package-lock.json
    '';
  };

-  npmDepsHash = "sha256-Zt5cVB1S86iPYKOUj7FwyR97lwmnFz6sZ+S3Ms/b9+o=";
+  npmDepsHash = "sha256-D90y6NaiR9zpgtjfm9QgLxBVbHa09OMSi+fvgwqSjgY=";
  npmFlags = [ "--legacy-peer-deps" ];

  nativeBuildInputs = [
@ -73,7 +73,7 @@ buildNpmPackage' rec {

  postPatch = ''
    substituteInPlace scripts/build-electron.sh \
-      --replace 'if [ "$1" == "snap" ]; then' 'exit 0; if [ "$1" == "snap" ]; then'
+      --replace-fail 'if [ "$1" == "snap" ]; then' 'exit 0; if [ "$1" == "snap" ]; then'
  '';

  ELECTRON_SKIP_BINARY_DOWNLOAD=1;
@ -94,8 +94,8 @@ buildNpmPackage' rec {
    find ./Electron.app -name 'Info.plist' | xargs -d '\n' chmod +rw

    substituteInPlace electron-builder-config.js \
-      --replace "identity: 'Anoop MD (W7LPPWA48L)'" 'identity: null' \
-      --replace "afterSign: 'notarize.js'," ""
+      --replace-fail "identity: 'Anoop MD (W7LPPWA48L)'" 'identity: null' \
+      --replace-fail "afterSign: 'notarize.js'," ""

    npm exec electron-builder -- \
      --dir \
@ -151,7 +151,7 @@ buildNpmPackage' rec {
    homepage = "https://www.usebruno.com";
    inherit (electron.meta) platforms;
    license = licenses.mit;
-    maintainers = with maintainers; [ water-sucks lucasew kashw2 mattpolzin ];
+    maintainers = with maintainers; [ gepbird kashw2 lucasew mattpolzin water-sucks ];
    mainProgram = "bruno";
  };
 }
--- a/pkgs/by-name/es/espflash/package.nix
+++ b/pkgs/by-name/es/espflash/package.nix
@ -6,6 +6,7 @@
 , installShellFiles
 , udev
 , stdenv
+, CoreServices
 , Security
 , nix-update-script
 , openssl
@ -14,13 +15,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "espflash";
-  version = "2.1.0";
+  version = "3.0.0";

  src = fetchFromGitHub {
    owner = "esp-rs";
    repo = "espflash";
    rev = "v${version}";
-    hash = "sha256-Nv2/33VYpCkPYyUhlVDYJR1BkbtEvEPtmgyZXfVn1ug=";
+    hash = "sha256-0CnYdz1KG/y4B+dOp9rYE097ctf4GNmyqv3/xywdA6A=";
  };

  nativeBuildInputs = [
@ -34,11 +35,12 @@ rustPlatform.buildRustPackage rec {
  buildInputs = [ openssl ] ++ lib.optionals stdenv.isLinux [
    udev
  ] ++ lib.optionals stdenv.isDarwin [
+    CoreServices
    Security
    SystemConfiguration
  ];

-  cargoHash = "sha256-Xj5FVTssC3e+mMhDHmKqV6lUQgaIv3aVc1yewbQSy9E=";
+  cargoHash = "sha256-CmhBl+d5odc0QL45aWCJcBZIVeJsdpxJweh7FT8cpyY=";

  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
    installShellCompletion --cmd espflash \
--- a/pkgs/by-name/ha/handheld-daemon/package.nix
+++ b/pkgs/by-name/ha/handheld-daemon/package.nix
@ -48,7 +48,7 @@ python3.pkgs.buildPythonApplication rec {
    description = "Linux support for handheld gaming devices like the Legion Go, ROG Ally, and GPD Win";
    platforms = platforms.linux;
    license = licenses.mit;
-    maintainers = with maintainers; [ appsforartists ];
+    maintainers = with maintainers; [ appsforartists toast ];
    mainProgram = "hhd";
  };
 }
--- a/pkgs/by-name/so/soupault/package.nix
+++ b/pkgs/by-name/so/soupault/package.nix
@ -1,7 +1,9 @@
 { lib
+, darwin
 , fetchzip
 , ocamlPackages
 , soupault
+, stdenv
 , testers
 }:

@ -23,6 +25,8 @@ ocamlPackages.buildDunePackage {
    hash = "sha256-vGTJUbAeYs/EYFykNSmCc4c9G66/Lz3BsUYnZQ8feFo=";
  };

+  nativeBuildInputs = lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [ darwin.sigtool ];
+
  buildInputs = with ocamlPackages; [
    base64
    camomile
--- a/pkgs/by-name/sp/spicetify-cli/package.nix
+++ b/pkgs/by-name/sp/spicetify-cli/package.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "spicetify-cli";
-  version = "2.36.4";
+  version = "2.36.5";

  src = fetchFromGitHub {
    owner = "spicetify";
    repo = "spicetify-cli";
    rev = "v${version}";
-    hash = "sha256-KvVFu0nCp6J5C8XHgd1U3CKmLPuVnWjlx5nocQGO1es=";
+    hash = "sha256-amalb1NNoA9KqeQtMtJZamLFNL3Wc/21ZVkr/Evhmik=";
  };

  vendorHash = "sha256-UPrLXzAdvCOmLm1tekzKyulQ4+2BSyPUF1k66GwKS88=";
--- a/pkgs/by-name/td/tdl/package.nix
+++ b/pkgs/by-name/td/tdl/package.nix
@ -4,16 +4,16 @@
 }:
 buildGoModule rec {
  pname = "tdl";
-  version = "0.16.1";
+  version = "0.16.2";

  src = fetchFromGitHub {
    owner = "iyear";
    repo = "tdl";
    rev = "v${version}";
-    hash = "sha256-xSnACm7LrsyhtQevDtP36bKeExSFd4Xsn7xLSLi7i+I=";
+    hash = "sha256-YbyTUmYXcltmvJVatS1TLkqZli7sba4ARi9bRkcd07M=";
  };

-  vendorHash = "sha256-VYxTSon2U9qj9sbMSlXrDFeOTOZXQVX2PyS+EDBG+YM=";
+  vendorHash = "sha256-WFhwmV4zlYDQA2Xow51m/AQ9GwUwr26rW3WMldduLl8=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/ti/tinymist/Cargo.lock
+++ b/pkgs/by-name/ti/tinymist/Cargo.lock
@ -3595,7 +3595,7 @@ dependencies = [

 [[package]]
 name = "tests"
-version = "0.11.3"
+version = "0.11.4"
 dependencies = [
 "insta",
 "lsp-server",
@ -3692,7 +3692,7 @@ dependencies = [

 [[package]]
 name = "tinymist"
-version = "0.11.3"
+version = "0.11.4"
 dependencies = [
 "anyhow",
 "async-trait",
@ -3743,7 +3743,7 @@ dependencies = [

 [[package]]
 name = "tinymist-query"
-version = "0.11.3"
+version = "0.11.4"
 dependencies = [
 "anyhow",
 "comemo 0.4.0",
@ -3779,7 +3779,7 @@ dependencies = [

 [[package]]
 name = "tinymist-render"
-version = "0.11.3"
+version = "0.11.4"
 dependencies = [
 "base64 0.22.0",
 "log",
@ -4370,9 +4370,9 @@ dependencies = [

 [[package]]
 name = "typstyle"
-version = "0.11.11"
+version = "0.11.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8556b6c8261a6d205674be583443714a9887911a392df630ea95c2900caf2710"
+checksum = "38f04e5495bff9deed2a9155dca07889ec0fe1c79f48eb2d9ea99fc272459499"
 dependencies = [
 "anyhow",
 "clap",
--- a/pkgs/by-name/ti/tinymist/package.nix
+++ b/pkgs/by-name/ti/tinymist/package.nix
@ -13,13 +13,13 @@ rustPlatform.buildRustPackage rec {
  pname = "tinymist";
  # Please update the corresponding vscode extension when updating
  # this derivation.
-  version = "0.11.3";
+  version = "0.11.4";

  src = fetchFromGitHub {
    owner = "Myriad-Dreamin";
    repo = "tinymist";
    rev = "v${version}";
-    hash = "sha256-0wVCOFWA6PX1UHe3rGWbCW4zSJHvGrW9OiFcH2wvayA=";
+    hash = "sha256-zMwyM4Y+nn/u/UXGlOxGB/JApgmYQW4qAek40uJO0Fc=";
  };

  cargoLock = {
--- a/pkgs/by-name/ze/zed-editor/Cargo.lock
+++ b/pkgs/by-name/ze/zed-editor/Cargo.lock
@ -12380,7 +12380,7 @@ dependencies = [

 [[package]]
 name = "zed"
-version = "0.130.6"
+version = "0.130.7"
 dependencies = [
 "activity_indicator",
 "anyhow",
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@ -27,13 +27,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "zed";
-  version = "0.130.6";
+  version = "0.130.7";

  src = fetchFromGitHub {
    owner = "zed-industries";
    repo = "zed";
    rev = "refs/tags/v${version}";
-    hash = "sha256-ENlvjqoxPInTVpt7qpV+02AbAOCnfCrowfDTyyr4Y7A=";
+    hash = "sha256-nGE4RjquH5tEz6vHR1f5F44TX4GtPwiPP3V3lWPpmxk=";
    fetchSubmodules = true;
  };

--- a/pkgs/data/misc/hackage/pin.json
+++ b/pkgs/data/misc/hackage/pin.json
@ -1,6 +1,6 @@
 {
-  "commit": "a3f1357d6561e38afbb7545f733063f9ad7465c4",
-  "url": "https://github.com/commercialhaskell/all-cabal-hashes/archive/a3f1357d6561e38afbb7545f733063f9ad7465c4.tar.gz",
-  "sha256": "0nvrqbaf483af1abxqcms8f60nbxyqghf5k1jb4m3xah0206kdwf",
-  "msg": "Update from Hackage at 2024-03-31T04:36:22Z"
+  "commit": "5bae847bf7e96ce10e824377f4cb7f02c51b7245",
+  "url": "https://github.com/commercialhaskell/all-cabal-hashes/archive/5bae847bf7e96ce10e824377f4cb7f02c51b7245.tar.gz",
+  "sha256": "1p45mapjca2d7r8ky27s0pn3sflp61iippcabsb85s49fi9sqlv2",
+  "msg": "Update from Hackage at 2024-04-09T20:48:09Z"
 }
--- a/pkgs/desktops/gnome/misc/gitg/default.nix
+++ b/pkgs/desktops/gnome/misc/gitg/default.nix
@ -1,12 +1,11 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch
 , vala
-, gettext
 , pkg-config
 , gtk3
 , glib
+, gpgme
 , json-glib
 , wrapGAppsHook
 , libpeas
@ -14,12 +13,13 @@
 , gobject-introspection
 , gtksourceview4
 , gsettings-desktop-schemas
-, adwaita-icon-theme
 , gnome
 , gspell
+, gvfs
 , shared-mime-info
 , libgee
 , libgit2-glib
+, libhandy
 , libsecret
 , libxml2
 , meson
@ -30,25 +30,15 @@

 stdenv.mkDerivation rec {
  pname = "gitg";
-  version = "41";
+  version = "44";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "f7Ybn7EPuqVI0j1wZbq9cq1j5iHeVYQMBlzm45hsRik=";
+    hash = "sha256-NCoxaE2rlnHNNBvT485mWtzuBGDCoIHdxJPNvAMTJTA=";
  };

-  patches = [
-    # Fix build with meson 0.61
-    # data/meson.build:8:5: ERROR: Function does not take positional arguments.
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gitg/-/commit/1978973b12848741b08695ec2020bac98584d636.patch";
-      sha256 = "sha256-RzaGPGGiKMgjy0waFqt48rV2yWBGZgC3kHehhVhxktk=";
-    })
-  ];
-
  nativeBuildInputs = [
    gobject-introspection
-    gettext
    meson
    ninja
    pkg-config
@ -58,28 +48,29 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
-    adwaita-icon-theme
    glib
+    gpgme
    gsettings-desktop-schemas
    gtk3
    gtksourceview4
    gspell
+    gvfs
    json-glib
    libdazzle
    libgee
    libgit2-glib
+    libhandy
    libpeas
    libsecret
    libxml2
  ];

-  doCheck = false; # FAIL: tests-gitg gtk_style_context_add_provider_for_screen: assertion 'GDK_IS_SCREEN (screen)' failed
+  doCheck = true;

  postPatch = ''
-    chmod +x meson_post_install.py
    patchShebangs meson_post_install.py

-    substituteInPlace tests/libgitg/test-commit.vala --replace "/bin/bash" "${bash}/bin/bash"
+    substituteInPlace tests/libgitg/test-commit.vala --replace-fail "/bin/bash" "${bash}/bin/bash"
  '';

  preFixup = ''
@ -95,11 +86,13 @@ stdenv.mkDerivation rec {
    };
  };

+  strictDeps = true;
+
  meta = with lib; {
    homepage = "https://wiki.gnome.org/Apps/Gitg";
    description = "GNOME GUI client to view git repositories";
    mainProgram = "gitg";
-    maintainers = with maintainers; [ domenkozar ];
+    maintainers = with maintainers; [ domenkozar Luflosi ];
    license = licenses.gpl2Plus;
    platforms = platforms.linux;
  };
--- a/pkgs/development/compilers/ghc/common-hadrian.nix
+++ b/pkgs/development/compilers/ghc/common-hadrian.nix
@ -5,7 +5,7 @@
    if rev != null
    then "https://gitlab.haskell.org/ghc/ghc.git"
    else "https://downloads.haskell.org/ghc/${version}/ghc-${version}-src.tar.xz"
-
+, postFetch ? null
 }:

 { lib
@ -146,6 +146,8 @@
    inherit url sha256;
  } // lib.optionalAttrs (rev != null) {
    inherit rev;
+  } // lib.optionalAttrs (postFetch != null) {
+    inherit postFetch;
  })

  # GHC's build system hadrian built from the GHC-to-build's source tree
--- a/pkgs/development/compilers/ghc/head.nix
+++ b/pkgs/development/compilers/ghc/head.nix
@ -1,5 +1,11 @@
 import ./common-hadrian.nix {
-  version = "9.11.20240323";
-  rev = "8f7cfc7ee00978fda14f31ce4a56ad4639c07138";
-  sha256 = "1id5gmn472zrzx372hy4wci5sby941jd8imspgaam6vrqxibdyln";
+  version = "9.11.20240410";
+  rev = "1b1a92bd25c3f7249cf922c5dbf4415d2de44a36";
+  sha256 = "sha256-2HdhxhVrKn8c/ZOGYoYThqXpod2OPiGXgH+mAV69Ip0=";
+  # The STM benchmark contains chanbench.hs and ChanBench.hs causing a hash
+  # mismatch on case insensitive filesystems. See also
+  # https://gitlab.haskell.org/ghc/packages/stm/-/issues/2
+  postFetch = ''
+    rm -rf "$out/libraries/stm/bench"
+  '';
 }
--- a/pkgs/development/compilers/gmqcc/default.nix
+++ b/pkgs/development/compilers/gmqcc/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "gmqcc";
-  version = "unstable-2021-07-09";
+  version = "0-unstable-2023-05-05";

  src = fetchFromGitHub {
    owner = "graphitemaster";
    repo = "gmqcc";
-    rev = "297eab9e5e2c9cc4f41201b68821593a5cf9a725";
-    sha256 = "1hl2qn7402ia03kjkblj4q4wfypxkil99sivsyk2vrnwwpdp4nzx";
+    rev = "2fe0af00e78d55edecd7ca7ee1808c4ea946b05f";
+    hash = "sha256-AyuwsUIt+P/D4ABuIXGJxpp0TMAbnDg+R2iNMy6WjRw=";
  };

  installPhase = ''
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@ -2611,15 +2611,6 @@ self: super: {
  # 2022-03-16: Bounds need to be loosened https://github.com/obsidiansystems/dependent-sum-aeson-orphans/issues/10
  dependent-sum-aeson-orphans = doJailbreak super.dependent-sum-aeson-orphans;

-  # 2022-03-16: package qualified import issue: https://github.com/ghcjs/ghcjs-dom/issues/101
-  ghcjs-dom = assert super.ghcjs-dom.version == "0.9.5.0"; overrideCabal (old: {
-    postPatch = ''
-      sed -i 's/import "jsaddle-dom" GHCJS.DOM.Document/import "ghcjs-dom-jsaddle" GHCJS.DOM.Document/' src/GHCJS/DOM/Document.hs
-    '' + (old.postPatch or "");
-    })
-    # 2023-07-15: Restrictive upper bounds on text
-    (doJailbreak super.ghcjs-dom);
-
  # Too strict bounds on chell: https://github.com/fpco/haskell-filesystem/issues/24
  system-fileio = doJailbreak super.system-fileio;

--- a/pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml
@ -167,6 +167,7 @@ broken-packages:
  - animascii # failure in job https://hydra.nixos.org/build/233211290 at 2023-09-02
  - Animas # failure in job https://hydra.nixos.org/build/233256636 at 2023-09-02
  - animate # failure in job https://hydra.nixos.org/build/233243661 at 2023-09-02
+  - anitomata-aseprite # failure in job https://hydra.nixos.org/build/255675501 at 2024-04-16
  - anki-tools # failure in job https://hydra.nixos.org/build/233205129 at 2023-09-02
  - annotated-fix # failure in job https://hydra.nixos.org/build/233241215 at 2023-09-02
  - anonymous-sums # failure in job https://hydra.nixos.org/build/233222773 at 2023-09-02
@ -736,6 +737,7 @@ broken-packages:
  - chalmers-lava2000 # failure in job https://hydra.nixos.org/build/233239592 at 2023-09-02
  - changelog-d # failure in job https://hydra.nixos.org/build/252716175 at 2024-03-16
  - changelog-d # failure in job https://hydra.nixos.org/build/253689337 at 2024-03-31
+  - changelog-d # failure in job https://hydra.nixos.org/build/255671571 at 2024-04-16
  - changelogged # failure in job https://hydra.nixos.org/build/233211675 at 2023-09-02
  - character-cases # failure in job https://hydra.nixos.org/build/233197636 at 2023-09-02
  - charter # failure in job https://hydra.nixos.org/build/233237264 at 2023-09-02
@ -786,6 +788,7 @@ broken-packages:
  - CLASE # failure in job https://hydra.nixos.org/build/233234459 at 2023-09-02
  - clash-prelude # failure in job https://hydra.nixos.org/build/233252128 at 2023-09-02
  - Clash-Royale-Hack-Cheats # failure in job https://hydra.nixos.org/build/233216034 at 2023-09-02
+  - ClasshSS # failure in job https://hydra.nixos.org/build/255688076 at 2024-04-16
  - ClassLaws # failure in job https://hydra.nixos.org/build/233243019 at 2023-09-02
  - classy-effects-base # failure in updateAutotoolsGnuConfigScriptsPhase in job https://hydra.nixos.org/build/237233636 at 2023-10-21
  - classy-influxdb-simple # failure in job https://hydra.nixos.org/build/233253418 at 2023-09-02
@ -1312,6 +1315,7 @@ broken-packages:
  - disco # failure in job https://hydra.nixos.org/build/233212298 at 2023-09-02
  - discordian-calendar # failure in job https://hydra.nixos.org/build/233218124 at 2023-09-02
  - discord-types # failure in job https://hydra.nixos.org/build/233251778 at 2023-09-02
+  - discount # failure in job https://hydra.nixos.org/build/256329404 at 2024-04-16
  - discrete # failure in job https://hydra.nixos.org/build/233206492 at 2023-09-02
  - DiscussionSupportSystem # failure in job https://hydra.nixos.org/build/233244662 at 2023-09-02
  - Dish # failure in job https://hydra.nixos.org/build/233233264 at 2023-09-02
@ -1594,6 +1598,7 @@ broken-packages:
  - exherbo-cabal # failure in job https://hydra.nixos.org/build/233206319 at 2023-09-02
  - exh # failure in job https://hydra.nixos.org/build/233253883 at 2023-09-02
  - exif # failure in job https://hydra.nixos.org/build/233229247 at 2023-09-02
+  - exiftool # failure in job https://hydra.nixos.org/build/255692636 at 2024-04-16
  - exigo-schema # failure in job https://hydra.nixos.org/build/233197808 at 2023-09-02
  - exinst-deepseq # failure in job https://hydra.nixos.org/build/233207947 at 2023-09-02
  - exinst-hashable # failure in job https://hydra.nixos.org/build/233210438 at 2023-09-02
@ -1983,6 +1988,7 @@ broken-packages:
  - ghci-ng # failure in job https://hydra.nixos.org/build/233229533 at 2023-09-02
  - ghcitui # failure in job https://hydra.nixos.org/build/252737339 at 2024-03-16
  - ghcjs-base-stub # timeout
+  - ghcjs-dom-javascript # failure in job https://hydra.nixos.org/build/255688382 at 2024-04-16
  - ghcjs-dom-jsffi # failure in job https://hydra.nixos.org/build/233215225 at 2023-09-02
  - ghcjs-fetch # timeout
  - ghcjs-promise # failure in job https://hydra.nixos.org/build/233243985 at 2023-09-02
@ -2008,6 +2014,7 @@ broken-packages:
  - gh-labeler # failure in job https://hydra.nixos.org/build/233233139 at 2023-09-02
  - giak # failure in job https://hydra.nixos.org/build/233242229 at 2023-09-02
  - gi-ayatana-appindicator3 # failure in job https://hydra.nixos.org/build/253681898 at 2024-03-31
+  - gibberish # failure in job https://hydra.nixos.org/build/255688714 at 2024-04-16
  - gi-clutter # failure in job https://hydra.nixos.org/build/233252753 at 2023-09-02
  - gi-coglpango # failure in job https://hydra.nixos.org/build/233194401 at 2023-09-02
  - Gifcurry # failure in job https://hydra.nixos.org/build/233200204 at 2023-09-02
@ -3258,6 +3265,7 @@ broken-packages:
  - kademlia # failure in job https://hydra.nixos.org/build/233250935 at 2023-09-02
  - kafka-client # failure in job https://hydra.nixos.org/build/233243580 at 2023-09-02
  - kafka-client-sync # failure in job https://hydra.nixos.org/build/233208699 at 2023-09-02
+  - kafka-interchange # failure in job https://hydra.nixos.org/build/255676938 at 2024-04-16
  - Kalman # failure in job https://hydra.nixos.org/build/233210601 at 2023-09-02
  - kalman # failure in job https://hydra.nixos.org/build/233226292 at 2023-09-02
  - kangaroo # failure in job https://hydra.nixos.org/build/233222234 at 2023-09-02
@ -3595,6 +3603,7 @@ broken-packages:
  - lsfrom # failure in job https://hydra.nixos.org/build/233211705 at 2023-09-02
  - lsh # failure in job https://hydra.nixos.org/build/233256686 at 2023-09-02
  - lsp-client # failure in job https://hydra.nixos.org/build/233219871 at 2023-09-02
+  - ltext # failure in job https://hydra.nixos.org/build/255686825 at 2024-04-16
  - lti13 # failure in job https://hydra.nixos.org/build/252715722 at 2024-03-16
  - ltiv1p1 # failure in job https://hydra.nixos.org/build/233200883 at 2023-09-02
  - ltk # failure in job https://hydra.nixos.org/build/233244152 at 2023-09-02
@ -4087,6 +4096,7 @@ broken-packages:
  - nixfromnpm # failure in job https://hydra.nixos.org/build/233239168 at 2023-09-02
  - nixpkgs-update # failure in job https://hydra.nixos.org/build/233196708 at 2023-09-02
  - nix-tools # failure in job https://hydra.nixos.org/build/233662959 at 2023-09-02
+  - nkeys # failure in job https://hydra.nixos.org/build/255693929 at 2024-04-16
  - nlp-scores # failure in job https://hydra.nixos.org/build/233232770 at 2023-09-02
  - NMap # failure in job https://hydra.nixos.org/build/233246148 at 2023-09-02
  - nme # failure in job https://hydra.nixos.org/build/233224069 at 2023-09-02
@ -4153,6 +4163,7 @@ broken-packages:
  - OGL # failure in job https://hydra.nixos.org/build/233255135 at 2023-09-02
  - ogma-language-c # failure in job https://hydra.nixos.org/build/233228824 at 2023-09-02
  - ogma-language-cocospec # failure in job https://hydra.nixos.org/build/233235359 at 2023-09-02
+  - ogma-language-jsonspec # failure in job https://hydra.nixos.org/build/255671054 at 2024-04-16
  - ogma-language-smv # failure in job https://hydra.nixos.org/build/233239832 at 2023-09-02
  - ogmarkup # failure in job https://hydra.nixos.org/build/233229980 at 2023-09-02
  - ohloh-hs # failure in job https://hydra.nixos.org/build/233228177 at 2023-09-02
@ -4183,6 +4194,7 @@ broken-packages:
  - onpartitions # failure in job https://hydra.nixos.org/build/233226163 at 2023-09-02
  - onu-course # failure in job https://hydra.nixos.org/build/233233153 at 2023-09-02
  - oops # failure in job https://hydra.nixos.org/build/252738443 at 2024-03-16
+  - op2 # failure in job https://hydra.nixos.org/build/255683846 at 2024-04-16
  - opaleye-classy # failure in job https://hydra.nixos.org/build/233214120 at 2023-09-02
  - opaleye-sqlite # failure in job https://hydra.nixos.org/build/233191474 at 2023-09-02
  - opaleye-trans # failure in job https://hydra.nixos.org/build/233210536 at 2023-09-02
@ -4429,6 +4441,7 @@ broken-packages:
  - persistent-equivalence # failure in job https://hydra.nixos.org/build/233208713 at 2023-09-02
  - persistent-generic # failure in job https://hydra.nixos.org/build/233220060 at 2023-09-02
  - persistent-mongoDB # failure in job https://hydra.nixos.org/build/233207971 at 2023-09-02
+  - persistent-mtl # failure in job https://hydra.nixos.org/build/255677987 at 2024-04-16
  - persistent-odbc # failure in job https://hydra.nixos.org/build/233191221 at 2023-09-02
  - persistent-postgresql-streaming # failure in job https://hydra.nixos.org/build/233194038 at 2023-09-02
  - persistent-ratelimit # failure in job https://hydra.nixos.org/build/233224537 at 2023-09-02
@ -4455,6 +4468,7 @@ broken-packages:
  - pgvector # failure in job https://hydra.nixos.org/build/233202205 at 2023-09-02
  - phasechange # failure in job https://hydra.nixos.org/build/233254293 at 2023-09-02
  - phaser # failure in job https://hydra.nixos.org/build/233250604 at 2023-09-02
+  - phkdf # failure in job https://hydra.nixos.org/build/255669790 at 2024-04-16
  - phoityne # failure in job https://hydra.nixos.org/build/233195238 at 2023-09-02
  - phoityne-vscode # failure in job https://hydra.nixos.org/build/233190938 at 2023-09-02
  - phone-metadata # failure in job https://hydra.nixos.org/build/233256096 at 2023-09-02
@ -4536,6 +4550,7 @@ broken-packages:
  - platinum-parsing # failure in job https://hydra.nixos.org/build/233225071 at 2023-09-02
  - PlayingCards # failure in job https://hydra.nixos.org/build/233239100 at 2023-09-02
  - playlists # failure in job https://hydra.nixos.org/build/233240151 at 2023-09-02
+  - plegg # failure in job https://hydra.nixos.org/build/255679256 at 2024-04-16
  - plex # failure in job https://hydra.nixos.org/build/241435308 at 2023-11-19
  - plist-buddy # failure in job https://hydra.nixos.org/build/233199181 at 2023-09-02
  - plist # failure in job https://hydra.nixos.org/build/233233906 at 2023-09-02
@ -4590,6 +4605,7 @@ broken-packages:
  - polysemy-several # failure in job https://hydra.nixos.org/build/233216921 at 2023-09-02
  - polysemy-socket # failure in job https://hydra.nixos.org/build/233195754 at 2023-09-02
  - polysemy-test # failure in job https://hydra.nixos.org/build/236686974 at 2023-10-04
+  - polysemy-zoo # failure in job https://hydra.nixos.org/build/255673786 at 2024-04-16
  - polyseq # failure in job https://hydra.nixos.org/build/233191210 at 2023-09-02
  - polytypeable # failure in job https://hydra.nixos.org/build/233211797 at 2023-09-02
  - polyvariadic # failure in job https://hydra.nixos.org/build/233250822 at 2023-09-02
@ -5092,6 +5108,7 @@ broken-packages:
  - rosso # failure in job https://hydra.nixos.org/build/233230103 at 2023-09-02
  - rotating-log # failure in job https://hydra.nixos.org/build/233206245 at 2023-09-02
  - rounding # failure in job https://hydra.nixos.org/build/233234537 at 2023-09-02
+  - RoundingFiasco # failure in job https://hydra.nixos.org/build/255680622 at 2024-04-16
  - roundtrip-aeson # failure in job https://hydra.nixos.org/build/233253408 at 2023-09-02
  - rowrecord # failure in job https://hydra.nixos.org/build/233208964 at 2023-09-02
  - R-pandoc # failure in job https://hydra.nixos.org/build/233192114 at 2023-09-02
@ -5126,6 +5143,7 @@ broken-packages:
  - safe-access # failure in job https://hydra.nixos.org/build/252736917 at 2024-03-16
  - safe-buffer-monad # failure in job https://hydra.nixos.org/build/233192108 at 2023-09-02
  - safe-coerce # failure in job https://hydra.nixos.org/build/233244289 at 2023-09-02
+  - safe-coloured-text-gen # failure in job https://hydra.nixos.org/build/255682500 at 2024-04-16
  - safe-coloured-text-layout # failure in job https://hydra.nixos.org/build/233247031 at 2023-09-02
  - safecopy-migrate # failure in job https://hydra.nixos.org/build/233224574 at 2023-09-02
  - safecopy-store # failure in job https://hydra.nixos.org/build/233227973 at 2023-09-02
@ -5223,6 +5241,7 @@ broken-packages:
  - selda-postgresql # failure in job https://hydra.nixos.org/build/245539286 at 2024-01-02
  - selectors # failure in job https://hydra.nixos.org/build/233227433 at 2023-09-02
  - selenium # failure in job https://hydra.nixos.org/build/233214276 at 2023-09-02
+  - sel # failure in job https://hydra.nixos.org/build/255671988 at 2024-04-16
  - selinux # failure in job https://hydra.nixos.org/build/233192853 at 2023-09-02
  - Semantique # failure in job https://hydra.nixos.org/build/233199841 at 2023-09-02
  - semdoc # failure in job https://hydra.nixos.org/build/233258790 at 2023-09-02
@ -5877,6 +5896,7 @@ broken-packages:
  - tcp-streams # failure in job https://hydra.nixos.org/build/252713034 at 2024-03-16
  - tcp-streams-openssl # failure in job https://hydra.nixos.org/build/233258076 at 2023-09-02
  - tdigest-Chart # failure in job https://hydra.nixos.org/build/233244784 at 2023-09-02
+  - tdlib-types # failure in job https://hydra.nixos.org/build/255678555 at 2024-04-16
  - tdoc # failure in job https://hydra.nixos.org/build/233250532 at 2023-09-02
  - tds # failure in job https://hydra.nixos.org/build/233201528 at 2023-09-02
  - teams # failure in job https://hydra.nixos.org/build/233228277 at 2023-09-02
@ -5973,6 +5993,7 @@ broken-packages:
  - tga # failure in job https://hydra.nixos.org/build/233198921 at 2023-09-02
  - thank-you-stars # failure in job https://hydra.nixos.org/build/233219923 at 2023-09-02
  - th-build # failure in job https://hydra.nixos.org/build/233224794 at 2023-09-02
+  - th-deepstrict # failure in job https://hydra.nixos.org/build/255670533 at 2024-04-16
  - th-dict-discovery # failure in job https://hydra.nixos.org/build/233204140 at 2023-09-02
  - theatre-dev # failure in updateAutotoolsGnuConfigScriptsPhase in job https://hydra.nixos.org/build/239251083 at 2023-11-10
  - THEff # failure in job https://hydra.nixos.org/build/233221239 at 2023-09-02
@ -6673,6 +6694,7 @@ broken-packages:
  - yarn2nix # failure in job https://hydra.nixos.org/build/233216079 at 2023-09-02
  - yarr # failure in job https://hydra.nixos.org/build/233209487 at 2023-09-02
  - yate # failure in job https://hydra.nixos.org/build/233231754 at 2023-09-02
+  - yaya # failure in job https://hydra.nixos.org/build/255668220 at 2024-04-16
  - yaya-test # failure in job https://hydra.nixos.org/build/233254306 at 2023-09-02
  - yaya-unsafe-test # failure in job https://hydra.nixos.org/build/233194827 at 2023-09-02
  - yeller # failure in job https://hydra.nixos.org/build/233240270 at 2023-09-02
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
@ -28,6 +28,9 @@ default-package-overrides:
  - gi-gdkx11 < 4
  # 2021-11-09: ghc-bignum is bundled starting with 9.0.1; only 1.0 builds with GHCs prior to 9.2.1
  - ghc-bignum == 1.0
+  # Needs to be pinned to match jsaddle from Stackage LTS (9.8.*)
+  - jsaddle-dom < 0.9.9.0
+  - jsaddle-webkit2gtk < 0.9.9.0

 extra-packages:
  - Cabal-syntax == 3.6.*               # Dummy package that ensures packages depending on Cabal-syntax can work for Cabal < 3.8
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/stackage.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/stackage.yaml
@ -1,4 +1,4 @@
-# Stackage LTS 22.14
+# Stackage LTS 22.16
 # This file is auto-generated by
 # maintainers/scripts/haskell/update-stackage.sh
 default-package-overrides:
@ -489,7 +489,7 @@ default-package-overrides:
  - bitvec ==1.1.5.0
  - bitwise-enum ==1.0.1.2
  - blake2 ==0.3.0.1
-  - Blammo ==1.1.2.1
+  - Blammo ==1.1.2.2
  - blank-canvas ==0.7.4
  - blanks ==0.5.0
  - blas-carray ==0.1.0.2
@ -684,7 +684,7 @@ default-package-overrides:
  - commonmark-extensions ==0.2.5.4
  - commonmark-pandoc ==0.2.2.1
  - commutative ==0.0.2
-  - commutative-semigroups ==0.1.0.2
+  - commutative-semigroups ==0.1.1.0
  - comonad ==5.0.8
  - compact ==0.2.0.0
  - compactmap ==0.1.4.3
@ -999,7 +999,7 @@ default-package-overrides:
  - enum-text ==0.5.3.0
  - envelope ==0.2.2.0
  - envparse ==0.5.0
-  - envy ==2.1.2.0
+  - envy ==2.1.3.0
  - epub-metadata ==5.2
  - eq ==4.3
  - equal-files ==0.0.5.4
@ -1085,7 +1085,7 @@ default-package-overrides:
  - FindBin ==0.0.5
  - fingertree ==0.1.5.0
  - finite-typelits ==0.1.6.0
-  - first-class-families ==0.8.0.1
+  - first-class-families ==0.8.1.0
  - fits-parse ==0.3.6
  - fitspec ==0.4.10
  - fixed ==0.3
@ -1325,7 +1325,7 @@ default-package-overrides:
  - happy ==1.20.1.1
  - happy-meta ==0.2.1.0
  - HasBigDecimal ==0.2.0.0
-  - hashable ==1.4.3.0
+  - hashable ==1.4.4.0
  - hashids ==1.1.1.0
  - hashing ==0.1.1.0
  - hashmap ==1.3.3
@ -1845,7 +1845,7 @@ default-package-overrides:
  - matchable ==0.1.2.1
  - mathexpr ==0.3.1.0
  - math-extras ==0.1.1.0
-  - math-functions ==0.3.4.3
+  - math-functions ==0.3.4.4
  - mathlist ==0.2.0.0
  - matplotlib ==0.7.7
  - matrices ==0.5.0
@ -1861,9 +1861,9 @@ default-package-overrides:
  - med-module ==0.1.3
  - megaparsec ==9.5.0
  - megaparsec-tests ==9.5.0
-  - mega-sdist ==0.4.3.0
+  - mega-sdist ==0.4.3.1
  - membership ==0.0.1
-  - memcache ==0.3.0.1
+  - memcache ==0.3.0.2
  - memfd ==1.0.1.3
  - memory ==0.18.0
  - MemoTrie ==0.6.11
@ -2089,7 +2089,7 @@ default-package-overrides:
  - Only ==0.1
  - oo-prototypes ==0.1.0.0
  - oops ==0.2.0.1
-  - opaleye ==0.10.2.1
+  - opaleye ==0.10.2.3
  - OpenAL ==1.7.0.5
  - openapi3 ==3.2.4
  - open-browser ==0.2.1.0
@ -2135,7 +2135,7 @@ default-package-overrides:
  - pandoc-cli ==3.1.11.1
  - pandoc-dhall-decoder ==0.1.0.1
  - pandoc-lua-engine ==0.2.1.2
-  - pandoc-lua-marshal ==0.2.5
+  - pandoc-lua-marshal ==0.2.6
  - pandoc-plot ==1.8.0
  - pandoc-server ==0.1.0.5
  - pandoc-throw ==0.1.0.0
@ -2258,7 +2258,7 @@ default-package-overrides:
  - posix-paths ==0.3.0.0
  - posix-pty ==0.2.2
  - possibly ==1.0.0.0
-  - postgres-options ==0.2.1.0
+  - postgres-options ==0.2.2.0
  - postgresql-binary ==0.13.1.3
  - postgresql-libpq ==0.10.0.0
  - postgresql-libpq-notify ==0.2.0.0
@ -2489,7 +2489,7 @@ default-package-overrides:
  - runmemo ==1.0.0.1
  - run-st ==0.1.3.3
  - rvar ==0.3.0.2
-  - rzk ==0.7.3
+  - rzk ==0.7.4
  - s3-signer ==0.5.0.0
  - safe ==0.3.21
  - safe-coloured-text ==0.2.0.2
@ -2892,7 +2892,7 @@ default-package-overrides:
  - text-builder-linear ==0.1.2
  - text-conversions ==0.3.1.1
  - text-format ==0.3.2.1
-  - text-icu ==0.8.0.4
+  - text-icu ==0.8.0.5
  - text-iso8601 ==0.1
  - text-latin1 ==0.3.1
  - text-ldap ==0.1.1.14
@ -2940,8 +2940,8 @@ default-package-overrides:
  - th-test-utils ==1.2.1
  - th-utilities ==0.2.5.0
  - thyme ==0.4
-  - tidal ==1.9.4
-  - tidal-link ==1.0.2
+  - tidal ==1.9.5
+  - tidal-link ==1.0.3
  - tile ==0.3.0.0
  - time-compat ==1.9.6.1
  - time-domain ==0.1.0.3
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml
@ -1012,7 +1012,7 @@ dont-distribute-packages:
 - cqrs-test
 - cqrs-testkit
 - crackNum
- - crackNum_3_10
+ - crackNum_3_12
 - craft
 - craftwerk-cairo
 - craftwerk-gtk
@ -1483,6 +1483,7 @@ dont-distribute-packages:
 - fxpak
 - g2
 - g2q
+ - g3p-hash
 - gact
 - galois-fft
 - galois-field
@ -2401,6 +2402,7 @@ dont-distribute-packages:
 - ixset-typed-conversions
 - iyql
 - j2hs
+ - jackpolynomials
 - java-bridge-extras
 - java-character
 - java-reflect
@ -3088,6 +3090,8 @@ dont-distribute-packages:
 - persistable-record
 - persistable-types-HDBC-pg
 - persistent-audit
+ - persistent-event-source
+ - persistent-eventsource
 - persistent-hssqlppp
 - persistent-map
 - persistent-mysql-haskell
@ -3341,6 +3345,7 @@ dont-distribute-packages:
 - razom-text-util
 - rbr
 - rc
+ - rdf4h-vocab-activitystreams
 - rdioh
 - react
 - react-flux-servant
@ -3925,6 +3930,7 @@ dont-distribute-packages:
 - tbox
 - tccli
 - tdd-util
+ - tdlib
 - techlab
 - telegram-bot
 - telegram-raw-api
@ -4284,6 +4290,7 @@ dont-distribute-packages:
 - wyvern
 - xcffib
 - xdcc
+ - xdg-basedir-compliant
 - xhb-atom-cache
 - xhb-ewmh
 - xml-catalog
@ -4325,6 +4332,10 @@ dont-distribute-packages:
 - yaml-streamly
 - yarr-image-io
 - yavie
+ - yaya-containers
+ - yaya-hedgehog
+ - yaya-quickcheck
+ - yaya-unsafe
 - ycextra
 - yeamer
 - yeshql
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
--- a/pkgs/development/interpreters/wazero/default.nix
+++ b/pkgs/development/interpreters/wazero/default.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "wazero";
-  version = "1.7.0";
+  version = "1.7.1";

  src = fetchFromGitHub {
    owner = "tetratelabs";
    repo = "wazero";
    rev = "v${version}";
-    hash = "sha256-TBGRO+5PHPna2dNSeNktxALEc6TvJzV+kEiynYqvhgY=";
+    hash = "sha256-xMI/6zhXxoD5rq+MZBiMzdmxlHS1gel1IChZe1iENyE=";
  };

  vendorHash = null;
--- a/pkgs/development/libraries/xed/default.nix
+++ b/pkgs/development/libraries/xed/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, python3Packages }:
+{ lib, stdenv, fetchFromGitHub, python3Packages, llvmPackages }:

 let
  # mbuild is a custom build system used only to build xed
@ -10,34 +10,37 @@ let
      owner = "intelxed";
      repo = "mbuild";
      rev = "v${version}";
-      sha256 = "sha256-eOAqmoPotdXGcBmrD9prXph4XOL6noJU6GYT/ud/VXk=";
+      sha256 = "sha256-nVHHiaPbf+b+RntjUGjLLGS53e6c+seXIBx7AcTtiWU=";
    };
  };

 in stdenv.mkDerivation rec {
  pname = "xed";
-  version = "2022.08.11";
+  version = "2024.02.22";

  src = fetchFromGitHub {
    owner = "intelxed";
    repo = "xed";
    rev = "v${version}";
-    sha256 = "sha256-Iil+dfjuWYPbzmSjgwKTKScSE/IsWuHEKQ5HsBJDqWM=";
+    sha256 = "sha256-LF4iJ1/Z3OifCiir/kU3ufZqtiRLeaJeAwuBqP2BCF4=";
  };

-  nativeBuildInputs = [ mbuild ];
+  nativeBuildInputs = [ mbuild ] ++ lib.optionals stdenv.isDarwin [ llvmPackages.bintools ];

  buildPhase = ''
    patchShebangs mfile.py

    # this will build, test and install
    ./mfile.py test --prefix $out
+    ./mfile.py examples
+    mkdir -p $out/bin
+    cp ./obj/wkit/examples/obj/xed $out/bin/
  '';

  dontInstall = true; # already installed during buildPhase

  meta = with lib; {
-    broken = (stdenv.isLinux && stdenv.isAarch64);
+    broken = stdenv.isAarch64;
    description = "Intel X86 Encoder Decoder (Intel XED)";
    homepage    = "https://intelxed.github.io/";
    license     = licenses.asl20;
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "botocore-stubs";
-  version = "1.34.69";
+  version = "1.34.84";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -17,7 +17,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "botocore_stubs";
    inherit version;
-    hash = "sha256-RjJI/R1ue2igxXvddY0Exr0MXCw7+oGv351k8JMLWbw=";
+    hash = "sha256-t+D++dPLD7Yw+GvBYB3GLjkvMer9WdtB4y0PIqUpwcc=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/ifconfig-parser/default.nix
+++ b/pkgs/development/python-modules/ifconfig-parser/default.nix
@ -1,24 +1,36 @@
-{ lib, buildPythonPackage, fetchFromGitHub }:
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  pythonOlder,
+}:

 buildPythonPackage rec {
  pname = "ifconfig-parser";
  version = "0.0.5";
-  format = "setuptools";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "KnightWhoSayNi";
-    repo = pname;
+    repo = "ifconfig-parser";
    rev = "4921ac9d6be6244b062d082c164f5a5e69522478";
-    sha256 = "07hbkbr1qspr7qgzldkaslzc6ripj5zlif12d4fk5j801yhvnxjd";
+    hash = "sha256-TXa7oQ8AyTIdaSK4SH+RN2bDPtVqNvofPvlqHPKaCx4=";
  };

+  build-system = [ setuptools ];
+
  checkPhase = ''
    export PYTHONPATH=$PYTHONPATH:$(pwd)/ifconfigparser:$(pwd)/ifconfigparser/tests
    python -m unittest -v test_ifconfig_parser.TestIfconfigParser
  '';

+  pythonImportsCheck = [ "ifconfigparser" ];
+
  meta = with lib; {
-    description = "Unsophisticated python package for parsing raw output of ifconfig.";
+    description = "Module for parsing raw output of ifconfig";
    homepage = "https://github.com/KnightWhoSayNi/ifconfig-parser";
    license = licenses.mit;
    maintainers = with maintainers; [ atemu ];
--- a/pkgs/development/python-modules/napalm/default.nix
+++ b/pkgs/development/python-modules/napalm/default.nix
@ -34,7 +34,7 @@

 buildPythonPackage rec {
  pname = "napalm";
-  version = "4.1.0";
+  version = "5.0.0";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -43,7 +43,7 @@ buildPythonPackage rec {
    owner = "napalm-automation";
    repo = "napalm";
    rev = "refs/tags/${version}";
-    hash = "sha256-JqjuYMJcP58UMn1pPYg7x8KpqCKQUs19Ng9HbI2iX38=";
+    hash = "sha256-Abw3h69qTFwOOFeAfivqAIWLozErJ1yZZfx7CbMy1AI=";
  };

  nativeBuildInputs = [
@ -52,7 +52,6 @@ buildPythonPackage rec {

  propagatedBuildInputs = [
    cffi
-    future
    jinja2
    junos-eznc
    lxml
--- a/pkgs/development/python-modules/openusd/default.nix
+++ b/pkgs/development/python-modules/openusd/default.nix
@ -48,13 +48,13 @@ in

 buildPythonPackage rec {
  pname = "openusd";
-  version = "23.11";
+  version = "24.03";

  src = fetchFromGitHub {
    owner = "PixarAnimationStudios";
    repo = "OpenUSD";
    rev = "refs/tags/v${version}";
-    hash = "sha256-5zQrfB14kXs75WbL3s4eyhxELglhLNxU2L2aVXiyVjg=";
+    hash = "sha256-EYf8GhXhsAx0Wxz9ibDZEV4E5scL3GPiu3Nje7N5C/I=";
  };

  stdenv = if python.stdenv.isDarwin then darwin.apple_sdk_11_0.stdenv else python.stdenv;
@ -147,9 +147,6 @@ buildPythonPackage rec {
    ''
    + lib.optionalString withDocs ''
      mv $out/docs $doc
-    ''
-    + ''
-      rm $out/share -r # only examples
    '';

  meta = {
--- a/pkgs/development/python-modules/pyemvue/default.nix
+++ b/pkgs/development/python-modules/pyemvue/default.nix
@ -14,12 +14,12 @@

 buildPythonPackage rec {
  pname = "pyemvue";
-  version = "0.18.4";
+  version = "0.18.5";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-PTRVabYbT7Xwjkm+Oz56YjNb5Xwcgxn+IvXeazKsHyY=";
+    hash = "sha256-cgQARaGM6Jb2kEcG7HqPStRPkhHldJ7UbxQpxN6JbZE=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/skaware-packages/s6-linux-init/default.nix
+++ b/pkgs/development/skaware-packages/s6-linux-init/default.nix
@ -1,4 +1,11 @@
-{ lib, skawarePackages, skalibs, execline, s6 }:
+{ lib
+, stdenv
+, skawarePackages
+, skalibs
+, execline
+, s6
+, targetPackages
+}:

 skawarePackages.buildPackage {
  pname = "s6-linux-init";
@ -25,6 +32,14 @@ skawarePackages.buildPackage {
    "--with-dynlib=${s6.out}/lib"
  ];

+  # See ../s6-rc/default.nix for an explanation
+  postConfigure = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) ''
+    substituteInPlace src/init/s6-linux-init-maker.c \
+        --replace-fail '<execline/config.h>' '"${targetPackages.execline.dev}/include/execline/config.h"' \
+        --replace-fail '<s6/config.h>' '"${targetPackages.s6.dev}/include/s6/config.h"' \
+        --replace-fail '<s6-linux-init/config.h>' '"${targetPackages.s6-linux-init.dev}/include/s6-linux-init/config.h"'
+  '';
+
  postInstall = ''
    # remove all s6 executables from build directory
    rm $(find -name "s6-*" -type f -mindepth 1 -maxdepth 1 -executable)
--- a/pkgs/development/skaware-packages/s6-rc/default.nix
+++ b/pkgs/development/skaware-packages/s6-rc/default.nix
@ -50,9 +50,9 @@ skawarePackages.buildPackage {
  # system we're cross-compiling for.
  postConfigure = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform) ''
    substituteInPlace src/s6-rc/s6-rc-compile.c \
-        --replace '<execline/config.h>' '"${targetPackages.execline.dev}/include/execline/config.h"' \
-        --replace '<s6/config.h>' '"${targetPackages.s6.dev}/include/s6/config.h"' \
-        --replace '<s6-rc/config.h>' '"${targetPackages.s6-rc.dev}/include/s6-rc/config.h"'
+        --replace-fail '<execline/config.h>' '"${targetPackages.execline.dev}/include/execline/config.h"' \
+        --replace-fail '<s6/config.h>' '"${targetPackages.s6.dev}/include/s6/config.h"' \
+        --replace-fail '<s6-rc/config.h>' '"${targetPackages.s6-rc.dev}/include/s6-rc/config.h"'
  '';

  postInstall = ''
--- a/pkgs/development/tools/goa/default.nix
+++ b/pkgs/development/tools/goa/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "goa";
-  version = "3.16.0";
+  version = "3.16.1";

  src = fetchFromGitHub {
    owner = "goadesign";
    repo = "goa";
    rev = "v${version}";
-    hash = "sha256-UumeyuFElb+MPd9GYaT8U1GtDi21tChGKKqXBqQ/ZOk=";
+    hash = "sha256-1j7qgMTb9uz261mI8adY9aM8BkCFQHCCjuc8RIDcqCg=";
  };
  vendorHash = "sha256-A7FsCfZQKFFrk0KXvgyJjfGjyHQ3Ruoq/+RxC+zSa04=";

--- a/pkgs/development/tools/language-servers/gopls/default.nix
+++ b/pkgs/development/tools/language-servers/gopls/default.nix
@ -2,17 +2,17 @@

 buildGoModule rec {
  pname = "gopls";
-  version = "0.15.2";
+  version = "0.15.3";

  src = fetchFromGitHub {
    owner = "golang";
    repo = "tools";
    rev = "gopls/v${version}";
-    hash = "sha256-GgJ92nj94jRX3GnrOozG43wl8K/+UPOCbmp7Wt5E96U=";
+    hash = "sha256-JUqw2qJFxiuZyXgrmirrOuwG9mtcW1e1+SS0CaZY8VA=";
  };

  modRoot = "gopls";
-  vendorHash = "sha256-q7vWiXJAX4u8B4RyFc7kg1BvMCPaTBFOVkWXeE78Emo=";
+  vendorHash = "sha256-j2jMkVvsZ6UjcziSKtxGfwr7eRiTlEPW7LQCaEIa3I0=";

  # https://github.com/golang/tools/blob/9ed98faa/gopls/main.go#L27-L30
  ldflags = [ "-X main.version=v${version}" ];
--- a/pkgs/development/tools/ytt/default.nix
+++ b/pkgs/development/tools/ytt/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "ytt";
-  version = "0.48.0";
+  version = "0.49.0";

  src = fetchFromGitHub {
    owner = "vmware-tanzu";
    repo = "carvel-ytt";
    rev = "v${version}";
-    sha256 = "sha256-jHSSccD9jQGR2bblp1J9LQNPiTI47hsjPBmtPVmIRtI=";
+    sha256 = "sha256-7eG9ATZTqA48KFdPW/XVYNdq+giYVx0v1GDtabiTpQI=";
  };

  vendorHash = null;
--- a/pkgs/kde/generated/sources/plasma.json
+++ b/pkgs/kde/generated/sources/plasma.json
@ -1,317 +1,317 @@
 {
  "bluedevil": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/bluedevil-6.0.3.tar.xz",
-    "hash": "sha256-0mO+VIJaQYnUVrAafOC9tCdaG1VeN4KxCop30r6TyyQ="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/bluedevil-6.0.4.tar.xz",
+    "hash": "sha256-jFYW3z/rI8C2Y77aOvCaYvZnPbD/6KyLOJiLNNUPfow="
  },
  "breeze": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/breeze-6.0.3.tar.xz",
-    "hash": "sha256-WXxGCXBArnmktHCGxcyhIb8rRHm80JkwJunM0mC0sfk="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/breeze-6.0.4.tar.xz",
+    "hash": "sha256-kRl5iJGROVwzMhngkJAgjGWPlDuZU+Qg/GKSQv1eXHY="
  },
  "breeze-grub": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/breeze-grub-6.0.3.tar.xz",
-    "hash": "sha256-e7i9FT8J0Cj1kHWU/A6AhSlLS1GHAKxCUlQrrKCasRU="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/breeze-grub-6.0.4.tar.xz",
+    "hash": "sha256-lZDLSj8GgCGMQkrhd0uANmOQ0Mxktq+G6+cuAqPd31A="
  },
  "breeze-gtk": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/breeze-gtk-6.0.3.tar.xz",
-    "hash": "sha256-t8Ew3GsnQ6rTkI1UsLryp7f+cX1SZfdgUEHrN9QQ6jY="
+    "version": "6.0.4.1",
+    "url": "mirror://kde/stable/plasma/6.0.4/breeze-gtk-6.0.4.1.tar.xz",
+    "hash": "sha256-QHjlwUDWoBq2WRgz+bNC2rTf8rUyHYXJTX1KLST6i2I="
  },
  "breeze-plymouth": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/breeze-plymouth-6.0.3.tar.xz",
-    "hash": "sha256-AffQVamnYbDKl9fUTbzXMokQPB0K/XUuI330BYBzz0A="
+    "version": "6.0.4.1",
+    "url": "mirror://kde/stable/plasma/6.0.4/breeze-plymouth-6.0.4.1.tar.xz",
+    "hash": "sha256-9zZpOOzu2kKPYyoq2trKBFhGzF7Nb+LBXZ+0JM9j/ks="
  },
  "discover": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/discover-6.0.3.tar.xz",
-    "hash": "sha256-spGWIR+PhL/eku1ZNmyzu8f9bONAsCJmrQusJsHcd54="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/discover-6.0.4.tar.xz",
+    "hash": "sha256-oFaw24l2LhfPR0P1oavkZWhQ2y1VJ7xzLPYYDcjVGqg="
  },
  "drkonqi": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/drkonqi-6.0.3.tar.xz",
-    "hash": "sha256-H6nnUiVRqaq5LYreP2u7f8+4Mpc6AREapESxiOQ04s4="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/drkonqi-6.0.4.tar.xz",
+    "hash": "sha256-4O567rzFGICNTifxmv6VnuzvLVSm0Mh23nSxk2XsNxA="
  },
  "flatpak-kcm": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/flatpak-kcm-6.0.3.tar.xz",
-    "hash": "sha256-k+tUaLHfzxqFNVm2biXWrkkNZbo5dSY/HlwHGLSuOmU="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/flatpak-kcm-6.0.4.tar.xz",
+    "hash": "sha256-OcWhy7sSusqAFLcscN8BZHyrtix9BMJvzqEfiRSJWE0="
  },
  "kactivitymanagerd": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/kactivitymanagerd-6.0.3.tar.xz",
-    "hash": "sha256-T5IxT8IRfcJv9nHDM04AdtXyt/7KQ09OE4v99XS2fOU="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/kactivitymanagerd-6.0.4.tar.xz",
+    "hash": "sha256-LM1qBGdzIq36oBETAXnU7903CEIreYxP4+Zk9JozrC8="
  },
  "kde-cli-tools": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/kde-cli-tools-6.0.3.tar.xz",
-    "hash": "sha256-UN5KvK8mWbqMG+hXvLfxoJVQ0nzEfyWg3uWSEQpVnEI="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/kde-cli-tools-6.0.4.tar.xz",
+    "hash": "sha256-OdbpPuLidNOkuHjUa3Yb58szjuJhMl8ybOKRoOyVrm0="
  },
  "kdecoration": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/kdecoration-6.0.3.tar.xz",
-    "hash": "sha256-PJH2WpseoIzyA+eexO3+pojEY9fSGMlSlsA3a99ZVvk="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/kdecoration-6.0.4.tar.xz",
+    "hash": "sha256-D+U/FjLz+oa8TT6EPvySFrKiVwIKflWrV59WueRb1X4="
  },
  "kde-gtk-config": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/kde-gtk-config-6.0.3.tar.xz",
-    "hash": "sha256-NtTPT+Ss3sXZF8j/P/FXSOb8s1bc06RIjJ4Ifnm1ZMI="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/kde-gtk-config-6.0.4.tar.xz",
+    "hash": "sha256-/VSRwrDoh9wgThZhrH82TywJZQhc5PUPoihX4O0oXb0="
  },
  "kdeplasma-addons": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/kdeplasma-addons-6.0.3.tar.xz",
-    "hash": "sha256-LeweAF4uh/PI04OgZ4sb+Y1IhQfT3pSn34zZPju5Z8E="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/kdeplasma-addons-6.0.4.tar.xz",
+    "hash": "sha256-bS1t9HdbppObQ7Q4196asfxhGiEqfu30cN5NVphrOxg="
  },
  "kgamma": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/kgamma-6.0.3.tar.xz",
-    "hash": "sha256-gW55sJkvoq5tT23Wsnf1CFYt+E4AYdnAYJVXU7hCJNM="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/kgamma-6.0.4.tar.xz",
+    "hash": "sha256-NEXh2trK2AatIPwAi3TagI85ctGLsry++0bmTnCOvqQ="
  },
  "kglobalacceld": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/kglobalacceld-6.0.3.tar.xz",
-    "hash": "sha256-EqE37lBS/b92xUxO/AfVUO3KWiWntDTVIsFBjj41ssw="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/kglobalacceld-6.0.4.tar.xz",
+    "hash": "sha256-kUe/JywvjU42U+S1GKF2o2EnYOReYHhbz4fo09ybhdI="
  },
  "kinfocenter": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/kinfocenter-6.0.3.tar.xz",
-    "hash": "sha256-7pwt2u4si/RTw46CwzJ9yDrTkAQt0QbBnd9LYlGorfs="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/kinfocenter-6.0.4.tar.xz",
+    "hash": "sha256-WvGrf9XFT5UiFTe9TukT36Bn3f86HLS11IbeU5pIJo4="
  },
  "kmenuedit": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/kmenuedit-6.0.3.tar.xz",
-    "hash": "sha256-fPjU4qqeJjOp0PCSAlxIwKcxoUz5IKa1KNj/57TWxyw="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/kmenuedit-6.0.4.tar.xz",
+    "hash": "sha256-LUXBUbrwQI+7nXbhWLqxuFxTmVrzGTNuQkS4e1/W5cg="
  },
  "kpipewire": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/kpipewire-6.0.3.tar.xz",
-    "hash": "sha256-Grp6BL81yIaQaK84eEUSG1205+YfGZDk3rhstoOgUn4="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/kpipewire-6.0.4.tar.xz",
+    "hash": "sha256-oXRC+09xnxVN4QFYudoHkamkt9otC2+CMD+zt6L0aDY="
  },
  "kscreen": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/kscreen-6.0.3.tar.xz",
-    "hash": "sha256-WRbghsImAEClTdoA/jL6doVA2rp4kV8tdrpd9515mp4="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/kscreen-6.0.4.tar.xz",
+    "hash": "sha256-aNA9i7KFvVk5bGQX70m/AFGHT43iVqi6rGryT43PgAA="
  },
  "kscreenlocker": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/kscreenlocker-6.0.3.tar.xz",
-    "hash": "sha256-Sv7bQ6k1JB/2mORJBbSvbhkBRAMmhoCTFjyjb4OY1mk="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/kscreenlocker-6.0.4.tar.xz",
+    "hash": "sha256-PBiobSYN8IHcLLzrqixchRqclXcZxeEtQwBPx8Mt69U="
  },
  "ksshaskpass": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/ksshaskpass-6.0.3.tar.xz",
-    "hash": "sha256-t+pKW7tQqwyY8ELQAag18P6E8suR5Pb5DxvgxmoYMgk="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/ksshaskpass-6.0.4.tar.xz",
+    "hash": "sha256-6tZPEioyTzF6WABxBZbP4yOfiPmK5HuEl83a8K77NEY="
  },
  "ksystemstats": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/ksystemstats-6.0.3.tar.xz",
-    "hash": "sha256-f+w6cF3Qb6/0+YzpS1BfypV+CdgmGSQC+WQ/gY3PREU="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/ksystemstats-6.0.4.tar.xz",
+    "hash": "sha256-pKGiCjLue0sD1Pm0o8AcRchb6tbcEyG2g20udxOzh/o="
  },
  "kwallet-pam": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/kwallet-pam-6.0.3.tar.xz",
-    "hash": "sha256-Is2LAK4XqSxHOvYZajaFX8PqzpIEtz87ziSJ2A806H8="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/kwallet-pam-6.0.4.tar.xz",
+    "hash": "sha256-gGqL0NocebcAHizPD1Iitk3xn/uWDy24mxHk9NWpqYE="
  },
  "kwayland": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/kwayland-6.0.3.tar.xz",
-    "hash": "sha256-+7EprPuoK7CqOph5C1Vivz/Khn70H0gjxvE8ZgUDZpg="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/kwayland-6.0.4.tar.xz",
+    "hash": "sha256-QkMuJkTEuZeFTp/0j6f65fbMURepbyPGC1sc8rgr53o="
  },
  "kwayland-integration": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/kwayland-integration-6.0.3.tar.xz",
-    "hash": "sha256-2dz0Ncoy1J8kG5EWyzWa2TrQ8KsgZ/bkG5VaeDTY4bo="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/kwayland-integration-6.0.4.tar.xz",
+    "hash": "sha256-4gPb0gYPoPk0MTb3Y6lV89oQpOpGUEW8ofMEh7CeFeo="
  },
  "kwin": {
-    "version": "6.0.3.1",
-    "url": "mirror://kde/stable/plasma/6.0.3/kwin-6.0.3.1.tar.xz",
-    "hash": "sha256-8VEIqZMga5YqPFg1uYigtJIsCpvJq4D69rNqM00yGzM="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/kwin-6.0.4.tar.xz",
+    "hash": "sha256-9VUvjFsXnicv7jOhkkloZXPqv/3dVUG8Mfj9cGm6qCs="
  },
  "kwrited": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/kwrited-6.0.3.tar.xz",
-    "hash": "sha256-Od+o/t6t8TmrxhCojFF8q2WNUsulAiOmi3B2C+Ene6s="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/kwrited-6.0.4.tar.xz",
+    "hash": "sha256-iYAp+/GVwXDZ5eFDYo1tIogZMA+SAZ6rPBOAQtMfFTo="
  },
  "layer-shell-qt": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/layer-shell-qt-6.0.3.tar.xz",
-    "hash": "sha256-NEPFeo+L4m76QLPy90jRMKxk1hP4lOeY1vpS4ptZtRc="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/layer-shell-qt-6.0.4.tar.xz",
+    "hash": "sha256-QyyIZjB84boUw8/aWseXb+XgnkWk+gs1zJbkZ+lLBiY="
  },
  "libkscreen": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/libkscreen-6.0.3.tar.xz",
-    "hash": "sha256-R4X8PipebbOmLMWPFoLddRNOyIydlmudj7IuhwqjNIM="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/libkscreen-6.0.4.tar.xz",
+    "hash": "sha256-QGko2isD8l5qt8jkQF6Ptn4SYHiRnYKG+kfzaJ+1q1c="
  },
  "libksysguard": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/libksysguard-6.0.3.tar.xz",
-    "hash": "sha256-UzYTh/OSk8chrw1LrEi7AIdX5kL9qbmvgZChyp2cK5I="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/libksysguard-6.0.4.tar.xz",
+    "hash": "sha256-VmrC8GAwEokrIpGqbUZjsG6mVMPbNm9lpZ4yUDv6jeo="
  },
  "libplasma": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/libplasma-6.0.3.tar.xz",
-    "hash": "sha256-HKAgAm3to4pGyzTNcdfEnDsYub7ybK8c73Zav0n99x0="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/libplasma-6.0.4.tar.xz",
+    "hash": "sha256-YcLBSEVsuXx8EEcRtWz/AQv+V4XD8QxbZayASjNG/XQ="
  },
  "milou": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/milou-6.0.3.tar.xz",
-    "hash": "sha256-Lvv54qZEFF0tpKEEDmovTlRwMur8YRkGWbtXH45806I="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/milou-6.0.4.tar.xz",
+    "hash": "sha256-HIw+BEnhDcfHfPkF6qbH4E3mA2u7hGKbIqE63EI84f8="
  },
  "ocean-sound-theme": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/ocean-sound-theme-6.0.3.tar.xz",
-    "hash": "sha256-Y7vfbsFcFOyAgHy8QoZQ5eLeHpxjm33erlx4mcIzxTY="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/ocean-sound-theme-6.0.4.tar.xz",
+    "hash": "sha256-OgmXNgFb92gk/qaGBEJNCsyvVoQGh8GGds9gAnOkCZk="
  },
  "oxygen": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/oxygen-6.0.3.tar.xz",
-    "hash": "sha256-c31dui2KYinXw9ZUtZAKo8Cio6jjbLXIfY7XpzgjPIQ="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/oxygen-6.0.4.tar.xz",
+    "hash": "sha256-kVDgCYmnLP81u0bFrJryXKvO5MwYKZyL5we+6ExeVG8="
  },
  "oxygen-sounds": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/oxygen-sounds-6.0.3.tar.xz",
-    "hash": "sha256-MOoAoJx1lfboRxqgKLRdP1GPWOOxmsFMiBexYkUoT6Y="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/oxygen-sounds-6.0.4.tar.xz",
+    "hash": "sha256-4p++hTBBMqrrnWVBni5w9DyN7wzkcHgZUJ11QBkcoxk="
  },
  "plasma5support": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/plasma5support-6.0.3.tar.xz",
-    "hash": "sha256-yIO7B+UT7cZv05OaVC88TgF8iCwYUShuVbt63ctcNJU="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/plasma5support-6.0.4.tar.xz",
+    "hash": "sha256-UTUfrsaTG0aWF4vUnZ5gvJ3iw/PRD/CrOFSuPZApdaE="
  },
  "plasma-activities": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/plasma-activities-6.0.3.tar.xz",
-    "hash": "sha256-xhWV6fR+769H47r0ANz9C6ASquSMaTQtj6DjoeElcP8="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/plasma-activities-6.0.4.tar.xz",
+    "hash": "sha256-yDjDpxkZa6Bu09cYs/TfhBTifIR+IG/KoxBZWb55320="
  },
  "plasma-activities-stats": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/plasma-activities-stats-6.0.3.tar.xz",
-    "hash": "sha256-XdmMwCemN/2279LeDdXmftu0+wRhGNH+ScPpX21EGj0="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/plasma-activities-stats-6.0.4.tar.xz",
+    "hash": "sha256-hs5jZ0/Vw1WtE6J1Umvqd0pKjGGfMjGg6thWVZGz7ws="
  },
  "plasma-browser-integration": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/plasma-browser-integration-6.0.3.tar.xz",
-    "hash": "sha256-hqcuOkgQf6oIKWdR9W1SBWRSXEA1bPSlrxJqJUjdxfE="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/plasma-browser-integration-6.0.4.tar.xz",
+    "hash": "sha256-LBA0/4Q56DMES8cAJc5C2elJ4OpJg+ofQc30LRigKxc="
  },
  "plasma-desktop": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/plasma-desktop-6.0.3.tar.xz",
-    "hash": "sha256-AZsQu40EqAadgqWRE8AhoeWiTTed6lvjCXAXquEb2dA="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/plasma-desktop-6.0.4.tar.xz",
+    "hash": "sha256-hiFSrpcefS5NwHzF+DDvEhMZ4W+OgpnUB0lOcwz9xb4="
  },
  "plasma-disks": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/plasma-disks-6.0.3.tar.xz",
-    "hash": "sha256-+m8c+QhNf+/a2+DJWFd6ynRHsTl+xNQUYa6uRK9qwyg="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/plasma-disks-6.0.4.tar.xz",
+    "hash": "sha256-/S9dIwPDFG7KLvB1FPLQIACjftiZofnRf/A2f4fNT8A="
  },
  "plasma-firewall": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/plasma-firewall-6.0.3.tar.xz",
-    "hash": "sha256-GKV9L6UF2CrM/zUWxOGiA7CTikgU8ERShoFcGe4rdZo="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/plasma-firewall-6.0.4.tar.xz",
+    "hash": "sha256-vS8X7kWlz3COMXKGPmcXfZRtqbEkrhD7Yl+NPvASQ64="
  },
  "plasma-integration": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/plasma-integration-6.0.3.tar.xz",
-    "hash": "sha256-W+t3hNEk2eoQjwCAQ6k8g3wHVz9byK/PkhbutGRK/Yo="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/plasma-integration-6.0.4.tar.xz",
+    "hash": "sha256-7vXCHuQ+76EDQSakXSs02pZ6+Bz5IanCpDFKT7JziRM="
  },
  "plasma-mobile": {
-    "version": "6.0.3.1",
-    "url": "mirror://kde/stable/plasma/6.0.3/plasma-mobile-6.0.3.1.tar.xz",
-    "hash": "sha256-pIkzv+U5s3JOxKP4JwW54SF4MwhgNA1nd4riCmU224M="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/plasma-mobile-6.0.4.tar.xz",
+    "hash": "sha256-XXFKfLWU5H6r7Z3ceqdfJGfQ0wLZG2a5SWarjMnEmvw="
  },
  "plasma-nano": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/plasma-nano-6.0.3.tar.xz",
-    "hash": "sha256-mBjOkE8YME0wsirNcTmAV33mzAvXXqDPtkvtJQ0ASyo="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/plasma-nano-6.0.4.tar.xz",
+    "hash": "sha256-WUy1C4CVPb7D135Rvmb765gy0D75543JLKR0e/sBb28="
  },
  "plasma-nm": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/plasma-nm-6.0.3.tar.xz",
-    "hash": "sha256-EFi4WULetceWMvXDLwn3gbcDgd4SOeHOh9/plyhW7T0="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/plasma-nm-6.0.4.tar.xz",
+    "hash": "sha256-ZFGdnQX8tPhce5xHCMxvUQ4o/cJyttDip6HvwDiIxt8="
  },
  "plasma-pa": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/plasma-pa-6.0.3.tar.xz",
-    "hash": "sha256-seGYoBVR6HJ1s/m3GLlN8+3zkdzPK6ceqa8HvFLd7ls="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/plasma-pa-6.0.4.tar.xz",
+    "hash": "sha256-MprRwyZ5hFm+qxReztQ+buliN42VKZwaZPWpKeq9pgE="
  },
  "plasma-sdk": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/plasma-sdk-6.0.3.tar.xz",
-    "hash": "sha256-SuTUlcd7ZQjvhTXTm3OosUwe4Sl8fbp0DpKLJg/b/Xk="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/plasma-sdk-6.0.4.tar.xz",
+    "hash": "sha256-a6LOS9QLdVTvMuw3VD+2JozDyx8WDZmfTPCWjf1Vseg="
  },
  "plasma-systemmonitor": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/plasma-systemmonitor-6.0.3.tar.xz",
-    "hash": "sha256-JcMI6Yx4ByoERWIVkythPo+56nHsUgwFANcearC8WEc="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/plasma-systemmonitor-6.0.4.tar.xz",
+    "hash": "sha256-rPWGChXXO3cn3cacJx/k3FbCcE2s86AuLHtUVon84kU="
  },
  "plasma-thunderbolt": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/plasma-thunderbolt-6.0.3.tar.xz",
-    "hash": "sha256-xQ/yiDnu6HYm638ZH/VsDJZhdt0Q0/Qqm84oDjMTTWI="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/plasma-thunderbolt-6.0.4.tar.xz",
+    "hash": "sha256-WpcTdp20D5T9igq10I5eqhkHaN8W3+hIs5GjSDHYZh4="
  },
  "plasma-vault": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/plasma-vault-6.0.3.tar.xz",
-    "hash": "sha256-UYQtcK+1ecGvixcb2975hpqY2obi4V3kfw0pTuGqifc="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/plasma-vault-6.0.4.tar.xz",
+    "hash": "sha256-t5e1kynAJQn1i9D6l4zERP3tZ2o302yeT1xcbx7JDL4="
  },
  "plasma-welcome": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/plasma-welcome-6.0.3.tar.xz",
-    "hash": "sha256-22EjXA90eHBwlbHsmc4TwnD+uBoYHUTrjUMJJRtj1Bw="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/plasma-welcome-6.0.4.tar.xz",
+    "hash": "sha256-a8qHSddcujU+RYQuYofRki3NGM7UuK04aFhXC76cGFI="
  },
  "plasma-workspace": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/plasma-workspace-6.0.3.tar.xz",
-    "hash": "sha256-5D6oADqHUyed9FgOvtF+6jUulpS1TbpFB0BgJaQfacM="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/plasma-workspace-6.0.4.tar.xz",
+    "hash": "sha256-fywocclm5m1d4tY7yxpVT+ALTaa96T9pcAvRsfYNxWc="
  },
  "plasma-workspace-wallpapers": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/plasma-workspace-wallpapers-6.0.3.tar.xz",
-    "hash": "sha256-Zuy9JdtjSutSvgX8PcxKcbHP/e4Sq2RRR65fLsQje9s="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/plasma-workspace-wallpapers-6.0.4.tar.xz",
+    "hash": "sha256-yLMIh5Nkdd5/DFzggG/gKt5VlM+Twc3pzbcvv7J2bxQ="
  },
  "plymouth-kcm": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/plymouth-kcm-6.0.3.tar.xz",
-    "hash": "sha256-IGN0fREb2G15T4PkY1glJCCy0TyDVpElZOqMf6GLRu4="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/plymouth-kcm-6.0.4.tar.xz",
+    "hash": "sha256-UC67u4joCIxgnBy14Hd6EQ6GSyVTvB1qM6PEjdMVaN4="
  },
  "polkit-kde-agent-1": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/polkit-kde-agent-1-6.0.3.tar.xz",
-    "hash": "sha256-PbxfR+7HCSzPH0KVo0n+aa6EzoAL6pCSWglrY43Qy/0="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/polkit-kde-agent-1-6.0.4.tar.xz",
+    "hash": "sha256-4Py7ihz6uL5psnE7IQWwI1E3OB8f221GXDl45rhiayQ="
  },
  "powerdevil": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/powerdevil-6.0.3.tar.xz",
-    "hash": "sha256-HJuQ4wyyIi4PXNKq8Kj4kIyefsEVGtQNzXz3VA6h7ZI="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/powerdevil-6.0.4.tar.xz",
+    "hash": "sha256-F3O2IYGQmDHSTJFBo/3Y6WoJzwi9Q1qdmoYFlGsPJVk="
  },
  "print-manager": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/print-manager-6.0.3.tar.xz",
-    "hash": "sha256-8qLpHnxDtqsdsLmal8QqSEUjDH9stznLMKSMKCRX5Iw="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/print-manager-6.0.4.tar.xz",
+    "hash": "sha256-QJJsrLZckMSd1HWPV7YGulcfSepm/0LAMcaf2+ciHAg="
  },
  "qqc2-breeze-style": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/qqc2-breeze-style-6.0.3.tar.xz",
-    "hash": "sha256-QBhE+H4b5I4V8WevZBqzEaIDdsSKmz7iHHbuJeij29k="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/qqc2-breeze-style-6.0.4.tar.xz",
+    "hash": "sha256-4dD5VqajzEqGHRs9Ie9JoeEYMGXINatTdo2fei/7kSw="
  },
  "sddm-kcm": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/sddm-kcm-6.0.3.tar.xz",
-    "hash": "sha256-+qdeD1r+HikPAMaW+/duSqcRiONRv4RFRwQ+BiYAmG4="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/sddm-kcm-6.0.4.tar.xz",
+    "hash": "sha256-J5Wg1HqNdYZgAnS53GVuXo0fjWN+UCzEjMi8KNM9PTk="
  },
  "systemsettings": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/systemsettings-6.0.3.tar.xz",
-    "hash": "sha256-HHTYkou9DL1Y8B/V7anbjNMl4X5jt0NsDxnTII9Rxaw="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/systemsettings-6.0.4.tar.xz",
+    "hash": "sha256-GMgBYjAIPY8uyY0zwBV3VgYMWhNuiZV2nb9+8ybEAu0="
  },
  "wacomtablet": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/wacomtablet-6.0.3.tar.xz",
-    "hash": "sha256-wMD7IxTGSq3rE/QUEhrnbMGNJ5YD1S/G2xJZ+7/DOwE="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/wacomtablet-6.0.4.tar.xz",
+    "hash": "sha256-hsxtxur7/UhEitBWggY1fVyoLb+cFHOz0VB8h3itlY4="
  },
  "xdg-desktop-portal-kde": {
-    "version": "6.0.3",
-    "url": "mirror://kde/stable/plasma/6.0.3/xdg-desktop-portal-kde-6.0.3.tar.xz",
-    "hash": "sha256-vWWbfhto3tKNgZmr+MX0n8butDLJtqiEPr9MBMwDWqk="
+    "version": "6.0.4",
+    "url": "mirror://kde/stable/plasma/6.0.4/xdg-desktop-portal-kde-6.0.4.tar.xz",
+    "hash": "sha256-keVaeU8A/bdTBe0F9yoc4xDiKLEViG9yRxRzycfIiWA="
  }
 }
--- a/pkgs/kde/plasma/drkonqi/default.nix
+++ b/pkgs/kde/plasma/drkonqi/default.nix
@ -5,7 +5,6 @@
  gdb,
  python3,
  substituteAll,
-  coreutils,
 }: let
  gdb' = gdb.override {
    hostCpuOnly = true;
@ -26,11 +25,6 @@ in
      })
    ];

-    postPatch = ''
-      substituteInPlace src/coredump/processor/drkonqi-coredump-pickup.service.cmake \
-        --replace /usr/bin/sleep ${coreutils}/bin/sleep
-    '';
-
    extraNativeBuildInputs = [pkg-config];
    extraBuildInputs = [systemd];

--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@ -159,6 +159,8 @@ stdenv.mkDerivation rec {

  doCheck = false; # tries to access the net

+  passthru.shellPath = "/bin/ash";
+
  meta = with lib; {
    description = "Tiny versions of common UNIX utilities in a single small executable";
    homepage = "https://busybox.net/";
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@ -4,16 +4,16 @@ let
  # comments with variant added for update script
  # ./update-zen.py zen
  zenVariant = {
-    version = "6.8.4"; #zen
+    version = "6.8.6"; #zen
    suffix = "zen1"; #zen
-    sha256 = "0cbcij31gar4is5zcrl748ijn91jly74i2gggf43ndh8yrzdni85"; #zen
+    sha256 = "09233xbvkwjd8yglzjh50pbw5n3pk7d8l5pb270ric9rnnl383jn"; #zen
    isLqx = false;
  };
  # ./update-zen.py lqx
  lqxVariant = {
-    version = "6.8.4"; #lqx
-    suffix = "lqx1"; #lqx
-    sha256 = "1hv9hvx9nw51qki5wbhm4dgyvgw7jjwxl8fvslaazn3r0rqch7z2"; #lqx
+    version = "6.8.6"; #lqx
+    suffix = "lqx2"; #lqx
+    sha256 = "0mxbl0h8s021m0ab12yy778qyhdlb5789qjbn66l8qxsw0dv4ags"; #lqx
    isLqx = true;
  };
  zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {
--- a/pkgs/servers/db-rest/default.nix
+++ b/pkgs/servers/db-rest/default.nix
@ -4,6 +4,7 @@
 , nodejs_18
 , nix-update-script
 , fetchpatch
+, nixosTests
 }:
 buildNpmPackage rec {
  pname = "db-rest";
@ -25,6 +26,9 @@ buildNpmPackage rec {
  '';

  passthru.updateScript = nix-update-script { };
+  passthru.tests = {
+    inherit (nixosTests) db-rest;
+  };

  meta = {
    description = "A clean REST API wrapping around the Deutsche Bahn API";
--- a/pkgs/servers/matrix-synapse/matrix-appservice-irc/default.nix
+++ b/pkgs/servers/matrix-synapse/matrix-appservice-irc/default.nix
@ -12,19 +12,19 @@

 let
  pname = "matrix-appservice-irc";
-  version = "1.0.1";
+  version = "2.0.0";

  src = fetchFromGitHub {
    owner = "matrix-org";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-wUbWvCa9xvot73nXZjF3/RawM98ffBCW5YR2+ZKzmEo=";
+    hash = "sha256-voZJVBggsuwmGw/imt2HYmqiYBkRYMpppt/Nemh6fsM=";
  };

  yarnOfflineCache = fetchYarnDeps {
    name = "${pname}-${version}-offline-cache";
    yarnLock = "${src}/yarn.lock";
-    hash = "sha256-P9u5sK9rIHWRE8kFMj05fVjv26jwsawvHBZgSn7j5BE=";
+    hash = "sha256-hapEbdjvvzeZHfrpYRW9W3vXkQVNyGZ0qydO34+mQqQ=";
  };

 in
@ -83,6 +83,7 @@ stdenv.mkDerivation {
  passthru.updateScript = nix-update-script { };

  meta = with lib; {
+    changelog = "https://github.com/matrix-org/matrix-appservice-irc/releases/tag/${version}";
    description = "Node.js IRC bridge for Matrix";
    mainProgram = "matrix-appservice-irc";
    maintainers = with maintainers; [ rhysmdnz ];
--- a/pkgs/servers/nosql/influxdb2/cli.nix
+++ b/pkgs/servers/nosql/influxdb2/cli.nix
@ -4,13 +4,13 @@
 }:

 let
-  version = "2.7.3";
+  version = "2.7.4";

  src = fetchFromGitHub {
    owner = "influxdata";
    repo = "influx-cli";
    rev = "v${version}";
-    sha256 = "sha256-hRv7f2NeURsgLQ1zNgAhZvTjS0ei4+5lqokIu0iN+aI=";
+    sha256 = "sha256-g/3hakOTRjRA6DU0DT5A+ChUF6ED/sdg3p4ZB5nbbU0=";
  };

 in buildGoModule {
@ -18,7 +18,7 @@ in buildGoModule {
  version = version;
  inherit src;

-  vendorHash = "sha256-QNhL5RPkNLTXoQ0NqcZuKec3ZBc3CDTc/XTWvjy55wk=";
+  vendorHash = "sha256-Ov0TPoMm0qi7kkWUUni677sCP1LwkT9+n3KHcAlQkDA=";
  subPackages = [ "cmd/influx" ];

  ldflags = [ "-X main.commit=v${version}" "-X main.version=${version}" ];
--- a/pkgs/shells/zsh/oh-my-zsh/default.nix
+++ b/pkgs/shells/zsh/oh-my-zsh/default.nix
@ -5,14 +5,14 @@
 , git, nix, nixfmt-classic, jq, coreutils, gnused, curl, cacert, bash }:

 stdenv.mkDerivation rec {
-  version = "2023-11-29";
+  version = "2024-04-12";
  pname = "oh-my-zsh";

  src = fetchFromGitHub {
    owner = "ohmyzsh";
    repo = "ohmyzsh";
-    rev = "418046e9583f635b0303e4b8cf31c356b175cec3";
-    sha256 = "sha256-r36vF37J+3rLGg0QzmT4U8Lp5nqRhAs8We0aDtBJKJM=";
+    rev = "31f2025e0fa963788655fe197e0179c47588b175";
+    sha256 = "sha256-tQD7H1f2KKSo647rWtplSIoBUiiNWAvAxSWw6e26BNk=";
  };

  strictDeps = true;
--- a/pkgs/tools/text/textpieces/default.nix
+++ b/pkgs/tools/text/textpieces/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , python3
 , meson
 , ninja
@ -61,6 +62,13 @@ stdenv.mkDerivation (finalAttrs: {
    pythonEnv
  ];

+  patches = [
+  (fetchpatch {
+    url = "https://github.com/liferooter/textpieces/commit/26348782b9fddc5f2ffb9497cf18ec8ce9592960.patch";
+    hash = "sha256-w86PCeDhoyMPm63GCBa2Ax8KfCdlxtmGeUrmt1ZSz1k=";
+  })
+  ];
+
  postPatch = ''
    chmod +x build-aux/meson/postinstall.py
    patchShebangs build-aux/meson/postinstall.py
@ -74,6 +82,5 @@ stdenv.mkDerivation (finalAttrs: {
    license = licenses.gpl3Plus;
    platforms = platforms.linux;
    maintainers = with maintainers; [ zendo ];
-    broken = true; # https://github.com/liferooter/textpieces/issues/130
  };
 })
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -11616,10 +11616,7 @@ with pkgs;
  osl = libsForQt5.callPackage ../development/compilers/osl {
    boost = boost179;
    libclang = llvmPackages_15.libclang;
-    clang =
-      if stdenv.cc.libcxx != null
-      then (overrideLibcxx llvmPackages_15.stdenv).cc
-      else clang_15;
+    clang = clang_15;
    llvm = llvm_15;
    openexr = openexr_3;
  };
@ -30767,7 +30764,7 @@ with pkgs;
  espeakup = callPackage ../applications/accessibility/espeakup { };

  espflash = callPackage ../by-name/es/espflash/package.nix {
-    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
+    inherit (darwin.apple_sdk.frameworks) CoreServices Security SystemConfiguration;
  };

  etebase-server = with python3Packages; toPythonApplication etebase-server;
@ -34692,7 +34689,7 @@ with pkgs;
  printrun = callPackage ../applications/misc/printrun { };

  prusa-slicer = darwin.apple_sdk_11_0.callPackage ../applications/misc/prusa-slicer {
-    stdenv = if stdenv.isDarwin then overrideLibcxx darwin.apple_sdk_11_0.llvmPackages_14.stdenv else stdenv;
+    stdenv = if stdenv.isDarwin then overrideSDK llvmPackages_14.stdenv "11.0" else stdenv;
  };

  super-slicer = darwin.apple_sdk_11_0.callPackage ../applications/misc/prusa-slicer/super-slicer.nix { };