275 changed files with 3898 additions and 6804 deletions
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@ -95,14 +95,6 @@
        - pkgs/top-level/haskell-packages.nix
        - pkgs/top-level/release-haskell.nix

-"6.topic: julia":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - doc/languages-frameworks/julia.section.md
-        - pkgs/development/compilers/julia/**/*
-        - pkgs/development/julia-modules/**/*
-
 "6.topic: jupyter":
  - any:
    - changed-files:
@ -130,7 +122,6 @@
  - any:
    - changed-files:
      - any-glob-to-any-file:
-        - pkgs/development/tools/misc/luarocks/*
        - pkgs/development/interpreters/lua-5/**/*
        - pkgs/development/interpreters/luajit/**/*
        - pkgs/development/lua-modules/**/*
--- a/doc/languages-frameworks/lua.section.md
+++ b/doc/languages-frameworks/lua.section.md
@ -17,9 +17,6 @@ The main package set contains aliases to these package sets, e.g.
 `luaPackages` refers to `lua5_1.pkgs` and `lua52Packages` to
 `lua5_2.pkgs`.

-Note that nixpkgs patches the non-luajit interpreters to avoid referring to
-`/usr` and have `;;` (a [placeholder](https://www.lua.org/manual/5.1/manual.html#pdf-package.path) replaced with the default LUA_PATH) work correctly.
-
 ### Installing Lua and packages {#installing-lua-and-packages}

 #### Lua environment defined in separate `.nix` file {#lua-environment-defined-in-separate-.nix-file}
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -15774,12 +15774,6 @@
    githubId = 4201956;
    name = "pongo1231";
  };
-  poptart = {
-    email = "poptart@hosakacorp.net";
-    github = "terrorbyte";
-    githubId = 1601039;
-    name = "Cale Black";
-  };
  portothree = {
    name = "Gustavo Porto";
    email = "gus@p8s.co";
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@ -8,7 +8,6 @@ busted,,,,,,
 cassowary,,,,,,marsam alerque
 cldr,,,,,,alerque
 compat53,,,,,,vcunat
-commons.nvim,,,,,,mrcjkb
 cosmo,,,,,,marsam
 coxpcall,,,,1.17.0-1,,
 cqueues,,,,,,vcunat
@ -19,8 +18,6 @@ fennel,,,,,,misterio77
 fidget.nvim,,,,,,mrcjkb
 fifo,,,,,,
 fluent,,,,,,alerque
-funnyfiles.nvim,,,,,,mrcjkb
-fzf-lua,,,,,,mrcjkb
 fzy,,,,,,mrcjkb
 gitsigns.nvim,https://github.com/lewis6991/gitsigns.nvim.git,,,,5.1,
 haskell-tools.nvim,,,,,,
@ -88,7 +85,6 @@ luaunbound,,,,,,
 luaunit,,,,,,lockejan
 luautf8,,,,,,pstn
 luazip,,,,,,
-lua-utils.nvim,,,,,,mrcjkb
 lua-yajl,,,,,,pstn
 lua-iconv,,,,7.0.0,,
 luuid,,,,20120509-2,,
@ -102,7 +98,6 @@ middleclass,,,,,,
 mimetypes,,,,,,
 mpack,,,,,,
 moonscript,https://github.com/leafo/moonscript.git,dev-1,,,,arobyn
-neotest,,,,,,mrcjkb
 nlua,,,,,,teto
 nui.nvim,,,,,,mrcjkb
 nvim-cmp,https://github.com/hrsh7th/nvim-cmp,,,,,
@ -112,10 +107,6 @@ plenary.nvim,https://github.com/nvim-lua/plenary.nvim.git,,,,5.1,
 rapidjson,https://github.com/xpol/lua-rapidjson.git,,,,,
 rocks.nvim,,,,,5.1,teto mrcjkb
 rest.nvim,,,,,5.1,teto
-rocks.nvim,,,,,,mrcjkb
-rocks-git.nvim,,,,,,mrcjkb
-rocks-config.nvim,,,,,,mrcjkb
-rocks-dev.nvim,,,,,,mrcjkb
 rustaceanvim,,,,,,mrcjkb
 say,https://github.com/Olivine-Labs/say.git,,,,,
 serpent,,,,,,lockejan
--- a/nixos/doc/manual/development/option-declarations.section.md
+++ b/nixos/doc/manual/development/option-declarations.section.md
@ -12,7 +12,7 @@ looks like this:
      type = type specification;
      default = default value;
      example = example value;
-      description = "Description for use in the NixOS manual.";
+      description = lib.mdDoc "Description for use in the NixOS manual.";
    };
  };
 }
@ -58,9 +58,12 @@ The function `mkOption` accepts the following arguments.

 `description`

-:   A textual description of the option in [Nixpkgs-flavored Markdown](
-    https://nixos.org/nixpkgs/manual/#sec-contributing-markup) format that will be
-    included in the NixOS manual.
+:   A textual description of the option, in [Nixpkgs-flavored Markdown](
+    https://nixos.org/nixpkgs/manual/#sec-contributing-markup) format, that will be
+    included in the NixOS manual. During the migration process from DocBook
+    it is necessary to mark descriptions written in CommonMark with `lib.mdDoc`.
+    The description may still be written in DocBook (without any marker), but this
+    is discouraged and will be deprecated in the future.

 ## Utility functions for common option patterns {#sec-option-declarations-util}

@ -78,13 +81,13 @@ For example:
 ::: {#ex-options-declarations-util-mkEnableOption-magic .example}
 ### `mkEnableOption` usage
 ```nix
-lib.mkEnableOption "magic"
+lib.mkEnableOption (lib.mdDoc "magic")
 # is like
 lib.mkOption {
  type = lib.types.bool;
  default = false;
  example = true;
-  description = "Whether to enable magic.";
+  description = lib.mdDoc "Whether to enable magic.";
 }
 ```
 :::
@ -132,7 +135,7 @@ lib.mkOption {
  type = lib.types.package;
  default = pkgs.hello;
  defaultText = lib.literalExpression "pkgs.hello";
-  description = "The hello package to use.";
+  description = lib.mdDoc "The hello package to use.";
 }
 ```
 :::
@ -150,7 +153,7 @@ lib.mkOption {
  default = pkgs.ghc;
  defaultText = lib.literalExpression "pkgs.ghc";
  example = lib.literalExpression "pkgs.haskell.packages.ghc92.ghc.withPackages (hkgs: [ hkgs.primes ])";
-  description = "The GHC package to use.";
+  description = lib.mdDoc "The GHC package to use.";
 }
 ```
 :::
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -63,9 +63,6 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
  }
  ```

- lua interpreters default LUA_PATH and LUA_CPATH are not overriden by nixpkgs
-  anymore, we patch LUA_ROOT instead which is more respectful to upstream.
-
 - Plasma 6 is now available and can be installed with `services.xserver.desktopManager.plasma6.enable = true;`. Plasma 5 will likely be deprecated in the next release (24.11). Note that Plasma 6 runs as Wayland by default, and the X11 session needs to be explicitly selected if necessary.

 ## New Services {#sec-release-24.05-new-services}
--- a/nixos/lib/make-options-doc/default.nix
+++ b/nixos/lib/make-options-doc/default.nix
@ -117,7 +117,9 @@
 # deprecated since 23.11.
 # TODO remove in a while.
 , allowDocBook ? false
-# TODO remove in a while (see https://github.com/NixOS/nixpkgs/issues/300735)
+# whether lib.mdDoc is required for descriptions to be read as markdown.
+# deprecated since 23.11.
+# TODO remove in a while.
 , markdownByDefault ? true
 }:

--- a/nixos/lib/systemd-types.nix
+++ b/nixos/lib/systemd-types.nix
@ -31,6 +31,7 @@ let
    ;

  inherit (lib)
+    mdDoc
    mkDefault
    mkDerivedConfig
    mkEnableOption
@ -80,11 +81,11 @@ rec {

  initrdContents = attrsOf (submodule ({ config, options, name, ... }: {
    options = {
-      enable = (mkEnableOption "copying of this file and symlinking it") // { default = true; };
+      enable = mkEnableOption (mdDoc "copying of this file and symlinking it") // { default = true; };

      target = mkOption {
        type = path;
-        description = ''
+        description = mdDoc ''
          Path of the symlink.
        '';
        default = name;
@ -93,12 +94,12 @@ rec {
      text = mkOption {
        default = null;
        type = nullOr lines;
-        description = "Text of the file.";
+        description = mdDoc "Text of the file.";
      };

      source = mkOption {
        type = path;
-        description = "Path of the source file.";
+        description = mdDoc "Path of the source file.";
      };
    };

--- a/nixos/lib/systemd-unit-options.nix
+++ b/nixos/lib/systemd-unit-options.nix
@ -17,6 +17,7 @@ let
    concatMap
    filterOverrides
    isList
+    mdDoc
    mergeEqualOption
    mkIf
    mkMerge
@ -54,7 +55,7 @@ in rec {
    enable = mkOption {
      default = true;
      type = types.bool;
-      description = ''
+      description = mdDoc ''
        If set to false, this unit will be a symlink to
        /dev/null. This is primarily useful to prevent specific
        template instances
@ -68,7 +69,7 @@ in rec {
    overrideStrategy = mkOption {
      default = "asDropinIfExists";
      type = types.enum [ "asDropinIfExists" "asDropin" ];
-      description = ''
+      description = mdDoc ''
        Defines how unit configuration is provided for systemd:

        `asDropinIfExists` creates a unit file when no unit file is provided by the package
@ -84,7 +85,7 @@ in rec {
    requiredBy = mkOption {
      default = [];
      type = types.listOf unitNameType;
-      description = ''
+      description = mdDoc ''
        Units that require (i.e. depend on and need to go down with) this unit.
        As discussed in the `wantedBy` option description this also creates
        `.requires` symlinks automatically.
@ -94,7 +95,7 @@ in rec {
    upheldBy = mkOption {
      default = [];
      type = types.listOf unitNameType;
-      description = ''
+      description = mdDoc ''
        Keep this unit running as long as the listed units are running. This is a continuously
        enforced version of wantedBy.
      '';
@ -103,7 +104,7 @@ in rec {
    wantedBy = mkOption {
      default = [];
      type = types.listOf unitNameType;
-      description = ''
+      description = mdDoc ''
        Units that want (i.e. depend on) this unit. The default method for
        starting a unit by default at boot time is to set this option to
        `["multi-user.target"]` for system services. Likewise for user units
@ -121,7 +122,7 @@ in rec {
    aliases = mkOption {
      default = [];
      type = types.listOf unitNameType;
-      description = "Aliases of that unit.";
+      description = mdDoc "Aliases of that unit.";
    };

  };
@ -131,12 +132,12 @@ in rec {
    text = mkOption {
      type = types.nullOr types.str;
      default = null;
-      description = "Text of this systemd unit.";
+      description = mdDoc "Text of this systemd unit.";
    };

    unit = mkOption {
      internal = true;
-      description = "The generated unit.";
+      description = mdDoc "The generated unit.";
    };

  };
@ -147,19 +148,19 @@ in rec {
      description = mkOption {
        default = "";
        type = types.singleLineStr;
-        description = "Description of this unit used in systemd messages and progress indicators.";
+        description = mdDoc "Description of this unit used in systemd messages and progress indicators.";
      };

      documentation = mkOption {
        default = [];
        type = types.listOf types.str;
-        description = "A list of URIs referencing documentation for this unit or its configuration.";
+        description = mdDoc "A list of URIs referencing documentation for this unit or its configuration.";
      };

      requires = mkOption {
        default = [];
        type = types.listOf unitNameType;
-        description = ''
+        description = mdDoc ''
          Start the specified units when this unit is started, and stop
          this unit when the specified units are stopped or fail.
        '';
@ -168,7 +169,7 @@ in rec {
      wants = mkOption {
        default = [];
        type = types.listOf unitNameType;
-        description = ''
+        description = mdDoc ''
          Start the specified units when this unit is started.
        '';
      };
@ -176,7 +177,7 @@ in rec {
      upholds = mkOption {
        default = [];
        type = types.listOf unitNameType;
-        description = ''
+        description = mdDoc ''
          Keeps the specified running while this unit is running. A continuous version of `wants`.
        '';
      };
@ -184,7 +185,7 @@ in rec {
      after = mkOption {
        default = [];
        type = types.listOf unitNameType;
-        description = ''
+        description = mdDoc ''
          If the specified units are started at the same time as
          this unit, delay this unit until they have started.
        '';
@ -193,7 +194,7 @@ in rec {
      before = mkOption {
        default = [];
        type = types.listOf unitNameType;
-        description = ''
+        description = mdDoc ''
          If the specified units are started at the same time as
          this unit, delay them until this unit has started.
        '';
@ -202,7 +203,7 @@ in rec {
      bindsTo = mkOption {
        default = [];
        type = types.listOf unitNameType;
-        description = ''
+        description = mdDoc ''
          Like ‘requires’, but in addition, if the specified units
          unexpectedly disappear, this unit will be stopped as well.
        '';
@ -211,7 +212,7 @@ in rec {
      partOf = mkOption {
        default = [];
        type = types.listOf unitNameType;
-        description = ''
+        description = mdDoc ''
          If the specified units are stopped or restarted, then this
          unit is stopped or restarted as well.
        '';
@ -220,7 +221,7 @@ in rec {
      conflicts = mkOption {
        default = [];
        type = types.listOf unitNameType;
-        description = ''
+        description = mdDoc ''
          If the specified units are started, then this unit is stopped
          and vice versa.
        '';
@ -229,7 +230,7 @@ in rec {
      requisite = mkOption {
        default = [];
        type = types.listOf unitNameType;
-        description = ''
+        description = mdDoc ''
          Similar to requires. However if the units listed are not started,
          they will not be started and the transaction will fail.
        '';
@ -239,7 +240,7 @@ in rec {
        default = {};
        example = { RequiresMountsFor = "/data"; };
        type = types.attrsOf unitOption;
-        description = ''
+        description = mdDoc ''
          Each attribute in this set specifies an option in the
          `[Unit]` section of the unit.  See
          {manpage}`systemd.unit(5)` for details.
@ -249,7 +250,7 @@ in rec {
      onFailure = mkOption {
        default = [];
        type = types.listOf unitNameType;
-        description = ''
+        description = mdDoc ''
          A list of one or more units that are activated when
          this unit enters the "failed" state.
        '';
@ -258,7 +259,7 @@ in rec {
      onSuccess = mkOption {
        default = [];
        type = types.listOf unitNameType;
-        description = ''
+        description = mdDoc ''
          A list of one or more units that are activated when
          this unit enters the "inactive" state.
        '';
@ -266,7 +267,7 @@ in rec {

      startLimitBurst = mkOption {
         type = types.int;
-         description = ''
+         description = mdDoc ''
           Configure unit start rate limiting. Units which are started
           more than startLimitBurst times within an interval time
           interval are not permitted to start any more.
@ -275,7 +276,7 @@ in rec {

      startLimitIntervalSec = mkOption {
         type = types.int;
-         description = ''
+         description = mdDoc ''
           Configure unit start rate limiting. Units which are started
           more than startLimitBurst times within an interval time
           interval are not permitted to start any more.
@ -294,7 +295,7 @@ in rec {
      restartTriggers = mkOption {
        default = [];
        type = types.listOf types.unspecified;
-        description = ''
+        description = mdDoc ''
          An arbitrary list of items such as derivations.  If any item
          in the list changes between reconfigurations, the service will
          be restarted.
@ -304,7 +305,7 @@ in rec {
      reloadTriggers = mkOption {
        default = [];
        type = types.listOf unitOption;
-        description = ''
+        description = mdDoc ''
          An arbitrary list of items such as derivations.  If any item
          in the list changes between reconfigurations, the service will
          be reloaded.  If anything but a reload trigger changes in the
@ -322,13 +323,13 @@ in rec {
        default = {};
        type = with types; attrsOf (nullOr (oneOf [ str path package ]));
        example = { PATH = "/foo/bar/bin"; LANG = "nl_NL.UTF-8"; };
-        description = "Environment variables passed to the service's processes.";
+        description = mdDoc "Environment variables passed to the service's processes.";
      };

      path = mkOption {
        default = [];
        type = with types; listOf (oneOf [ package str ]);
-        description = ''
+        description = mdDoc ''
          Packages added to the service's {env}`PATH`
          environment variable.  Both the {file}`bin`
          and {file}`sbin` subdirectories of each
@ -342,7 +343,7 @@ in rec {
          { RestartSec = 5;
          };
        type = types.addCheck (types.attrsOf unitOption) checkService;
-        description = ''
+        description = mdDoc ''
          Each attribute in this set specifies an option in the
          `[Service]` section of the unit.  See
          {manpage}`systemd.service(5)` for details.
@ -352,14 +353,14 @@ in rec {
      script = mkOption {
        type = types.lines;
        default = "";
-        description = "Shell commands executed as the service's main process.";
+        description = mdDoc "Shell commands executed as the service's main process.";
      };

      scriptArgs = mkOption {
        type = types.str;
        default = "";
        example = "%i";
-        description = ''
+        description = mdDoc ''
          Arguments passed to the main process script.
          Can contain specifiers (`%` placeholders expanded by systemd, see {manpage}`systemd.unit(5)`).
        '';
@ -368,7 +369,7 @@ in rec {
      preStart = mkOption {
        type = types.lines;
        default = "";
-        description = ''
+        description = mdDoc ''
          Shell commands executed before the service's main process
          is started.
        '';
@ -377,7 +378,7 @@ in rec {
      postStart = mkOption {
        type = types.lines;
        default = "";
-        description = ''
+        description = mdDoc ''
          Shell commands executed after the service's main process
          is started.
        '';
@ -386,7 +387,7 @@ in rec {
      reload = mkOption {
        type = types.lines;
        default = "";
-        description = ''
+        description = mdDoc ''
          Shell commands executed when the service's main process
          is reloaded.
        '';
@ -395,7 +396,7 @@ in rec {
      preStop = mkOption {
        type = types.lines;
        default = "";
-        description = ''
+        description = mdDoc ''
          Shell commands executed to stop the service.
        '';
      };
@ -403,7 +404,7 @@ in rec {
      postStop = mkOption {
        type = types.lines;
        default = "";
-        description = ''
+        description = mdDoc ''
          Shell commands executed after the service's main process
          has exited.
        '';
@ -412,7 +413,7 @@ in rec {
      jobScripts = mkOption {
        type = with types; coercedTo path singleton (listOf path);
        internal = true;
-        description = "A list of all job script derivations of this unit.";
+        description = mdDoc "A list of all job script derivations of this unit.";
        default = [];
      };

@ -457,7 +458,7 @@ in rec {
      restartIfChanged = mkOption {
        type = types.bool;
        default = true;
-        description = ''
+        description = mdDoc ''
          Whether the service should be restarted during a NixOS
          configuration switch if its definition has changed.
        '';
@ -466,7 +467,7 @@ in rec {
      reloadIfChanged = mkOption {
        type = types.bool;
        default = false;
-        description = ''
+        description = mdDoc ''
          Whether the service should be reloaded during a NixOS
          configuration switch if its definition has changed.  If
          enabled, the value of {option}`restartIfChanged` is
@ -482,7 +483,7 @@ in rec {
      stopIfChanged = mkOption {
        type = types.bool;
        default = true;
-        description = ''
+        description = mdDoc ''
          If set, a changed unit is restarted by calling
          {command}`systemctl stop` in the old configuration,
          then {command}`systemctl start` in the new one.
@ -498,7 +499,7 @@ in rec {
        type = with types; either str (listOf str);
        default = [];
        example = "Sun 14:00:00";
-        description = ''
+        description = mdDoc ''
          Automatically start this unit at the given date/time, which
          must be in the format described in
          {manpage}`systemd.time(7)`.  This is equivalent
@ -525,7 +526,7 @@ in rec {
        default = [];
        type = types.listOf types.str;
        example = [ "0.0.0.0:993" "/run/my-socket" ];
-        description = ''
+        description = mdDoc ''
          For each item in this list, a `ListenStream`
          option in the `[Socket]` section will be created.
        '';
@ -535,7 +536,7 @@ in rec {
        default = [];
        type = types.listOf types.str;
        example = [ "0.0.0.0:993" "/run/my-socket" ];
-        description = ''
+        description = mdDoc ''
          For each item in this list, a `ListenDatagram`
          option in the `[Socket]` section will be created.
        '';
@ -545,7 +546,7 @@ in rec {
        default = {};
        example = { ListenStream = "/run/my-socket"; };
        type = types.attrsOf unitOption;
-        description = ''
+        description = mdDoc ''
          Each attribute in this set specifies an option in the
          `[Socket]` section of the unit.  See
          {manpage}`systemd.socket(5)` for details.
@ -577,7 +578,7 @@ in rec {
        default = {};
        example = { OnCalendar = "Sun 14:00:00"; Unit = "foo.service"; };
        type = types.attrsOf unitOption;
-        description = ''
+        description = mdDoc ''
          Each attribute in this set specifies an option in the
          `[Timer]` section of the unit.  See
          {manpage}`systemd.timer(5)` and
@ -610,7 +611,7 @@ in rec {
        default = {};
        example = { PathChanged = "/some/path"; Unit = "changedpath.service"; };
        type = types.attrsOf unitOption;
-        description = ''
+        description = mdDoc ''
          Each attribute in this set specifies an option in the
          `[Path]` section of the unit.  See
          {manpage}`systemd.path(5)` for details.
@ -641,13 +642,13 @@ in rec {
      what = mkOption {
        example = "/dev/sda1";
        type = types.str;
-        description = "Absolute path of device node, file or other resource. (Mandatory)";
+        description = mdDoc "Absolute path of device node, file or other resource. (Mandatory)";
      };

      where = mkOption {
        example = "/mnt";
        type = types.str;
-        description = ''
+        description = mdDoc ''
          Absolute path of a directory of the mount point.
          Will be created if it doesn't exist. (Mandatory)
        '';
@ -657,21 +658,21 @@ in rec {
        default = "";
        example = "ext4";
        type = types.str;
-        description = "File system type.";
+        description = mdDoc "File system type.";
      };

      options = mkOption {
        default = "";
        example = "noatime";
        type = types.commas;
-        description = "Options used to mount the file system.";
+        description = mdDoc "Options used to mount the file system.";
      };

      mountConfig = mkOption {
        default = {};
        example = { DirectoryMode = "0775"; };
        type = types.attrsOf unitOption;
-        description = ''
+        description = mdDoc ''
          Each attribute in this set specifies an option in the
          `[Mount]` section of the unit.  See
          {manpage}`systemd.mount(5)` for details.
@ -701,7 +702,7 @@ in rec {
      where = mkOption {
        example = "/mnt";
        type = types.str;
-        description = ''
+        description = mdDoc ''
          Absolute path of a directory of the mount point.
          Will be created if it doesn't exist. (Mandatory)
        '';
@ -711,7 +712,7 @@ in rec {
        default = {};
        example = { DirectoryMode = "0775"; };
        type = types.attrsOf unitOption;
-        description = ''
+        description = mdDoc ''
          Each attribute in this set specifies an option in the
          `[Automount]` section of the unit.  See
          {manpage}`systemd.automount(5)` for details.
@ -742,7 +743,7 @@ in rec {
        default = {};
        example = { MemoryMax = "2G"; };
        type = types.attrsOf unitOption;
-        description = ''
+        description = mdDoc ''
          Each attribute in this set specifies an option in the
          `[Slice]` section of the unit.  See
          {manpage}`systemd.slice(5)` for details.
--- a/nixos/lib/testing/driver.nix
+++ b/nixos/lib/testing/driver.nix
@ -1,6 +1,6 @@
 { config, lib, hostPkgs, ... }:
 let
-  inherit (lib) mkOption types literalMD;
+  inherit (lib) mkOption types literalMD mdDoc;

  # Reifies and correctly wraps the python test driver for
  # the respective qemu version and with or without ocr support
@ -104,13 +104,13 @@ in
  options = {

    driver = mkOption {
-      description = "Package containing a script that runs the test.";
+      description = mdDoc "Package containing a script that runs the test.";
      type = types.package;
      defaultText = literalMD "set by the test framework";
    };

    hostPkgs = mkOption {
-      description = "Nixpkgs attrset used outside the nodes.";
+      description = mdDoc "Nixpkgs attrset used outside the nodes.";
      type = types.raw;
      example = lib.literalExpression ''
        import nixpkgs { inherit system config overlays; }
@ -118,14 +118,14 @@ in
    };

    qemu.package = mkOption {
-      description = "Which qemu package to use for the virtualisation of [{option}`nodes`](#test-opt-nodes).";
+      description = mdDoc "Which qemu package to use for the virtualisation of [{option}`nodes`](#test-opt-nodes).";
      type = types.package;
      default = hostPkgs.qemu_test;
      defaultText = "hostPkgs.qemu_test";
    };

    globalTimeout = mkOption {
-      description = ''
+      description = mdDoc ''
        A global timeout for the complete test, expressed in seconds.
        Beyond that timeout, every resource will be killed and released and the test will fail.

@ -137,7 +137,7 @@ in
    };

    enableOCR = mkOption {
-      description = ''
+      description = mdDoc ''
        Whether to enable Optical Character Recognition functionality for
        testing graphical programs. See [Machine objects](`ssec-machine-objects`).
      '';
@ -146,7 +146,7 @@ in
    };

    extraPythonPackages = mkOption {
-      description = ''
+      description = mdDoc ''
        Python packages to add to the test driver.

        The argument is a Python package set, similar to `pkgs.pythonPackages`.
@ -159,7 +159,7 @@ in
    };

    extraDriverArgs = mkOption {
-      description = ''
+      description = mdDoc ''
        Extra arguments to pass to the test driver.

        They become part of [{option}`driver`](#test-opt-driver) via `wrapProgram`.
@ -171,7 +171,7 @@ in
    skipLint = mkOption {
      type = types.bool;
      default = false;
-      description = ''
+      description = mdDoc ''
        Do not run the linters. This may speed up your iteration cycle, but it is not something you should commit.
      '';
    };
@ -179,7 +179,7 @@ in
    skipTypeCheck = mkOption {
      type = types.bool;
      default = false;
-      description = ''
+      description = mdDoc ''
        Disable type checking. This must not be enabled for new NixOS tests.

        This may speed up your iteration cycle, unless you're working on the [{option}`testScript`](#test-opt-testScript).
--- a/nixos/lib/testing/interactive.nix
+++ b/nixos/lib/testing/interactive.nix
@ -1,11 +1,11 @@
 { config, lib, moduleType, hostPkgs, ... }:
 let
-  inherit (lib) mkOption types;
+  inherit (lib) mkOption types mdDoc;
 in
 {
  options = {
    interactive = mkOption {
-      description = ''
+      description = mdDoc ''
        Tests [can be run interactively](#sec-running-nixos-tests-interactively)
        using the program in the test derivation's `.driverInteractive` attribute.

--- a/nixos/lib/testing/meta.nix
+++ b/nixos/lib/testing/meta.nix
@ -1,11 +1,11 @@
 { lib, ... }:
 let
-  inherit (lib) types mkOption;
+  inherit (lib) types mkOption mdDoc;
 in
 {
  options = {
    meta = lib.mkOption {
-      description = ''
+      description = mdDoc ''
        The [`meta`](https://nixos.org/manual/nixpkgs/stable/#chap-meta) attributes that will be set on the returned derivations.

        Not all [`meta`](https://nixos.org/manual/nixpkgs/stable/#chap-meta) attributes are supported, but more can be added as desired.
@ -16,21 +16,21 @@ in
          maintainers = lib.mkOption {
            type = types.listOf types.raw;
            default = [];
-            description = ''
+            description = mdDoc ''
              The [list of maintainers](https://nixos.org/manual/nixpkgs/stable/#var-meta-maintainers) for this test.
            '';
          };
          timeout = lib.mkOption {
            type = types.nullOr types.int;
            default = 3600;  # 1 hour
-            description = ''
+            description = mdDoc ''
              The [{option}`test`](#test-opt-test)'s [`meta.timeout`](https://nixos.org/manual/nixpkgs/stable/#var-meta-timeout) in seconds.
            '';
          };
          broken = lib.mkOption {
            type = types.bool;
            default = false;
-            description = ''
+            description = mdDoc ''
              Sets the [`meta.broken`](https://nixos.org/manual/nixpkgs/stable/#var-meta-broken) attribute on the [{option}`test`](#test-opt-test) derivation.
            '';
          };
--- a/nixos/lib/testing/name.nix
+++ b/nixos/lib/testing/name.nix
@ -1,10 +1,10 @@
 { lib, ... }:
 let
-  inherit (lib) mkOption types;
+  inherit (lib) mkOption types mdDoc;
 in
 {
  options.name = mkOption {
-    description = ''
+    description = mdDoc ''
      The name of the test.

      This is used in the derivation names of the [{option}`driver`](#test-opt-driver) and [{option}`test`](#test-opt-test) runner.
--- a/nixos/lib/testing/network.nix
+++ b/nixos/lib/testing/network.nix
@ -5,6 +5,7 @@ let
    attrNames concatMap concatMapStrings flip forEach head
    listToAttrs mkDefault mkOption nameValuePair optionalString
    range toLower types zipListsWith zipLists
+    mdDoc
    ;

  nodeNumbers =
@ -88,7 +89,7 @@ let
        default = name;
        # We need to force this in specilisations, otherwise it'd be
        # readOnly = true;
-        description = ''
+        description = mdDoc ''
          The `name` in `nodes.<name>`; stable across `specialisations`.
        '';
      };
@ -97,7 +98,7 @@ let
        type = types.int;
        readOnly = true;
        default = nodeNumbers.${config.virtualisation.test.nodeName};
-        description = ''
+        description = mdDoc ''
          A unique number assigned for each node in `nodes`.
        '';
      };
--- a/nixos/lib/testing/nodes.nix
+++ b/nixos/lib/testing/nodes.nix
@ -5,6 +5,7 @@ let
    literalExpression
    literalMD
    mapAttrs
+    mdDoc
    mkDefault
    mkIf
    mkOption mkForce
@ -75,7 +76,7 @@ in
    nodes = mkOption {
      type = types.lazyAttrsOf config.node.type;
      visible = "shallow";
-      description = ''
+      description = mdDoc ''
        An attribute set of NixOS configuration modules.

        The configurations are augmented by the [`defaults`](#test-opt-defaults) option.
@ -87,7 +88,7 @@ in
    };

    defaults = mkOption {
-      description = ''
+      description = mdDoc ''
        NixOS configuration that is applied to all [{option}`nodes`](#test-opt-nodes).
      '';
      type = types.deferredModule;
@ -95,7 +96,7 @@ in
    };

    extraBaseModules = mkOption {
-      description = ''
+      description = mdDoc ''
        NixOS configuration that, like [{option}`defaults`](#test-opt-defaults), is applied to all [{option}`nodes`](#test-opt-nodes) and can not be undone with [`specialisation.<name>.inheritParentConfig`](https://search.nixos.org/options?show=specialisation.%3Cname%3E.inheritParentConfig&from=0&size=50&sort=relevance&type=packages&query=specialisation).
      '';
      type = types.deferredModule;
@ -103,7 +104,7 @@ in
    };

    node.pkgs = mkOption {
-      description = ''
+      description = mdDoc ''
        The Nixpkgs to use for the nodes.

        Setting this will make the `nixpkgs.*` options read-only, to avoid mistakenly testing with a Nixpkgs configuration that diverges from regular use.
@ -116,7 +117,7 @@ in
    };

    node.pkgsReadOnly = mkOption {
-      description = ''
+      description = mdDoc ''
        Whether to make the `nixpkgs.*` options read-only. This is only relevant when [`node.pkgs`](#test-opt-node.pkgs) is set.

        Set this to `false` when any of the [`nodes`](#test-opt-nodes) needs to configure any of the `nixpkgs.*` options. This will slow down evaluation of your test a bit.
@ -129,7 +130,7 @@ in
    node.specialArgs = mkOption {
      type = types.lazyAttrsOf types.raw;
      default = { };
-      description = ''
+      description = mdDoc ''
        An attribute set of arbitrary values that will be made available as module arguments during the resolution of module `imports`.

        Note that it is not possible to override these from within the NixOS configurations. If you argument is not relevant to `imports`, consider setting {option}`defaults._module.args.<name>` instead.
@ -138,7 +139,7 @@ in

    nodesCompat = mkOption {
      internal = true;
-      description = ''
+      description = mdDoc ''
        Basically `_module.args.nodes`, but with backcompat and warnings added.

        This will go away.
--- a/nixos/lib/testing/run.nix
+++ b/nixos/lib/testing/run.nix
@ -1,12 +1,12 @@
 { config, hostPkgs, lib, ... }:
 let
-  inherit (lib) types mkOption;
+  inherit (lib) types mkOption mdDoc;
 in
 {
  options = {
    passthru = mkOption {
      type = types.lazyAttrsOf types.raw;
-      description = ''
+      description = mdDoc ''
        Attributes to add to the returned derivations,
        which are not necessarily part of the build.

@ -18,7 +18,7 @@ in

    rawTestDerivation = mkOption {
      type = types.package;
-      description = ''
+      description = mdDoc ''
        Unfiltered version of `test`, for troubleshooting the test framework and `testBuildFailure` in the test framework's test suite.
        This is not intended for general use. Use `test` instead.
      '';
@ -28,7 +28,7 @@ in
    test = mkOption {
      type = types.package;
      # TODO: can the interactive driver be configured to access the network?
-      description = ''
+      description = mdDoc ''
        Derivation that runs the test as its "build" process.

        This implies that NixOS tests run isolated from the network, making them
--- a/nixos/lib/testing/testScript.nix
+++ b/nixos/lib/testing/testScript.nix
@ -1,13 +1,13 @@
 testModuleArgs@{ config, lib, hostPkgs, nodes, moduleType, ... }:
 let
-  inherit (lib) mkOption types;
+  inherit (lib) mkOption types mdDoc;
  inherit (types) either str functionTo;
 in
 {
  options = {
    testScript = mkOption {
      type = either str (functionTo str);
-      description = ''
+      description = mdDoc ''
        A series of python declarations and statements that you write to perform
        the test.
      '';
@ -25,7 +25,7 @@ in
    };
    withoutTestScriptReferences = mkOption {
      type = moduleType;
-      description = ''
+      description = mdDoc ''
        A parallel universe where the testScript is invalid and has no references.
      '';
      internal = true;
--- a/nixos/modules/services/databases/postgresql.md
+++ b/nixos/modules/services/databases/postgresql.md
@ -118,7 +118,7 @@ are already created.
      before = "service1.service";
      after = "postgresql.service";
      serviceConfig.User = "postgres";
-      environment.PSQL = "psql --port=${toString services.postgresql.settings.port}";
+      environment.PSQL = "psql --port=${toString services.postgresql.port}";
      path = [ postgresql ];
      script = ''
        $PSQL service1 -c 'GRANT SELECT ON ALL TABLES IN SCHEMA public TO "extraUser1"'
@ -139,7 +139,7 @@ are already created.

 ```nix
  {
-    environment.PSQL = "psql --port=${toString services.postgresql.settings.port}";
+    environment.PSQL = "psql --port=${toString services.postgresql.port}";
    path = [ postgresql ];
    systemd.services."service1".preStart = ''
      $PSQL -c 'GRANT SELECT ON ALL TABLES IN SCHEMA public TO "extraUser1"'
@ -159,7 +159,7 @@ are already created.
      before = "service1.service";
      after = "postgresql.service";
      serviceConfig.User = "service1";
-      environment.PSQL = "psql --port=${toString services.postgresql.settings.port}";
+      environment.PSQL = "psql --port=${toString services.postgresql.port}";
      path = [ postgresql ];
      script = ''
        $PSQL -c 'GRANT SELECT ON ALL TABLES IN SCHEMA public TO "extraUser1"'
--- a/nixos/modules/services/databases/postgresql.nix
+++ b/nixos/modules/services/databases/postgresql.nix
@ -27,7 +27,7 @@ let
    else toString value;

  # The main PostgreSQL configuration file.
-  configFile = pkgs.writeTextDir "postgresql.conf" (concatStringsSep "\n" (mapAttrsToList (n: v: "${n} = ${toStr v}") (filterAttrs (const (x: x != null)) cfg.settings)));
+  configFile = pkgs.writeTextDir "postgresql.conf" (concatStringsSep "\n" (mapAttrsToList (n: v: "${n} = ${toStr v}") cfg.settings));

  configFileCheck = pkgs.runCommand "postgresql-configfile-check" {} ''
    ${cfg.package}/bin/postgres -D${configFile} -C config_file >/dev/null
@ -41,9 +41,6 @@ in
 {
  imports = [
    (mkRemovedOptionModule [ "services" "postgresql" "extraConfig" ] "Use services.postgresql.settings instead.")
-
-    (mkRenamedOptionModule [ "services" "postgresql" "logLinePrefix" ] [ "services" "postgresql" "settings" "log_line_prefix" ])
-    (mkRenamedOptionModule [ "services" "postgresql" "port" ] [ "services" "postgresql" "settings" "port" ])
  ];

  ###### interface
@ -60,6 +57,14 @@ in
        example = "postgresql_15";
      };

+      port = mkOption {
+        type = types.port;
+        default = 5432;
+        description = lib.mdDoc ''
+          The port on which PostgreSQL listens.
+        '';
+      };
+
      checkConfig = mkOption {
        type = types.bool;
        default = true;
@ -347,6 +352,17 @@ in
        '';
      };

+      logLinePrefix = mkOption {
+        type = types.str;
+        default = "[%p] ";
+        example = "%m [%p] ";
+        description = lib.mdDoc ''
+          A printf-style string that is output at the beginning of each log line.
+          Upstream default is `'%m [%p] '`, i.e. it includes the timestamp. We do
+          not include the timestamp, because journal has it anyway.
+        '';
+      };
+
      extraPlugins = mkOption {
        type = with types; coercedTo (listOf path) (path: _ignorePg: path) (functionTo (listOf path));
        default = _: [];
@ -357,38 +373,7 @@ in
      };

      settings = mkOption {
-        type = with types; submodule {
-          freeformType = attrsOf (oneOf [ bool float int str ]);
-          options = {
-            shared_preload_libraries = mkOption {
-              type = nullOr (coercedTo (listOf str) (concatStringsSep ", ") str);
-              default = null;
-              example = literalExpression ''[ "auto_explain" "anon" ]'';
-              description = mdDoc ''
-                List of libraries to be preloaded.
-              '';
-            };
-
-            log_line_prefix = mkOption {
-              type = types.str;
-              default = "[%p] ";
-              example = "%m [%p] ";
-              description = lib.mdDoc ''
-                A printf-style string that is output at the beginning of each log line.
-                Upstream default is `'%m [%p] '`, i.e. it includes the timestamp. We do
-                not include the timestamp, because journal has it anyway.
-              '';
-            };
-
-            port = mkOption {
-              type = types.port;
-              default = 5432;
-              description = lib.mdDoc ''
-                The port on which PostgreSQL listens.
-              '';
-            };
-          };
-        };
+        type = with types; attrsOf (oneOf [ bool float int str ]);
        default = {};
        description = lib.mdDoc ''
          PostgreSQL configuration. Refer to
@ -454,7 +439,9 @@ in
        hba_file = "${pkgs.writeText "pg_hba.conf" cfg.authentication}";
        ident_file = "${pkgs.writeText "pg_ident.conf" cfg.identMap}";
        log_destination = "stderr";
+        log_line_prefix = cfg.logLinePrefix;
        listen_addresses = if cfg.enableTCPIP then "*" else "localhost";
+        port = cfg.port;
        jit = mkDefault (if cfg.enableJIT then "on" else "off");
      };

@ -537,7 +524,7 @@ in
        # Wait for PostgreSQL to be ready to accept connections.
        postStart =
          ''
-            PSQL="psql --port=${toString cfg.settings.port}"
+            PSQL="psql --port=${toString cfg.port}"

            while ! $PSQL -d postgres -c "" 2> /dev/null; do
                if ! kill -0 "$MAINPID"; then exit 1; fi
--- a/nixos/modules/services/misc/forgejo.nix
+++ b/nixos/modules/services/misc/forgejo.nix
@ -114,11 +114,11 @@ in

        port = mkOption {
          type = types.port;
-          default = if usePostgresql then pg.settings.port else 3306;
+          default = if !usePostgresql then 3306 else pg.port;
          defaultText = literalExpression ''
            if config.${opt.database.type} != "postgresql"
            then 3306
-            else 5432
+            else config.${options.services.postgresql.port}
          '';
          description = mdDoc "Database host port.";
        };
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@ -100,11 +100,11 @@ in

        port = mkOption {
          type = types.port;
-          default = if usePostgresql then pg.settings.port else 3306;
+          default = if !usePostgresql then 3306 else pg.port;
          defaultText = literalExpression ''
            if config.${opt.database.type} != "postgresql"
            then 3306
-            else 5432
+            else config.${options.services.postgresql.port}
          '';
          description = lib.mdDoc "Database host port.";
        };
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@ -901,16 +901,6 @@ in {
        '';
      };

-      sidekiq.concurrency = mkOption {
-        type = with types; nullOr int;
-        default = null;
-        description = lib.mdDoc ''
-          How many processor threads to use for processing sidekiq background job queues. When null, the GitLab default is used.
-
-          See <https://docs.gitlab.com/ee/administration/sidekiq/extra_sidekiq_processes.html#manage-thread-counts-explicitly> for details.
-        '';
-      };
-
      sidekiq.memoryKiller.enable = mkOption {
        type = types.bool;
        default = true;
@ -1464,17 +1454,12 @@ in {
        TimeoutSec = "infinity";
        Restart = "always";
        WorkingDirectory = "${cfg.packages.gitlab}/share/gitlab";
-        ExecStart = utils.escapeSystemdExecArgs (
-          [
-            "${cfg.packages.gitlab}/share/gitlab/bin/sidekiq-cluster"
-            "*" # all queue groups
-          ] ++ lib.optionals (cfg.sidekiq.concurrency != null) [
-            "--concurrency" (toString cfg.sidekiq.concurrency)
-          ] ++ [
-            "--environment" "production"
-            "--require" "."
-          ]
-        );
+        ExecStart = utils.escapeSystemdExecArgs [
+          "${cfg.packages.gitlab}/share/gitlab/bin/sidekiq-cluster"
+          "-e" "production"
+          "-r" "."
+          "*" # all queue groups
+        ];
      };
    };

--- a/nixos/modules/services/misc/llama-cpp.nix
+++ b/nixos/modules/services/misc/llama-cpp.nix
@ -20,7 +20,7 @@ in {
      extraFlags = lib.mkOption {
        type = lib.types.listOf lib.types.str;
        description = "Extra flags passed to llama-cpp-server.";
-        example = ["-c" "4096" "-ngl" "32" "--numa" "numactl"];
+        example = ["-c" "4096" "-ngl" "32" "--numa"];
        default = [];
      };

--- a/nixos/modules/services/monitoring/zabbix-proxy.nix
+++ b/nixos/modules/services/monitoring/zabbix-proxy.nix
@ -103,11 +103,11 @@ in

        port = mkOption {
          type = types.port;
-          default = if cfg.database.type == "mysql" then mysql.port else pgsql.services.port;
+          default = if cfg.database.type == "mysql" then mysql.port else pgsql.port;
          defaultText = literalExpression ''
            if config.${opt.database.type} == "mysql"
            then config.${options.services.mysql.port}
-            else config.services.postgresql.settings.port
+            else config.${options.services.postgresql.port}
          '';
          description = lib.mdDoc "Database host port.";
        };
--- a/nixos/modules/services/monitoring/zabbix-server.nix
+++ b/nixos/modules/services/monitoring/zabbix-server.nix
@ -95,11 +95,11 @@ in

        port = mkOption {
          type = types.port;
-          default = if cfg.database.type == "mysql" then mysql.port else pgsql.settings.port;
+          default = if cfg.database.type == "mysql" then mysql.port else pgsql.port;
          defaultText = literalExpression ''
            if config.${opt.database.type} == "mysql"
            then config.${options.services.mysql.port}
-            else config.services.postgresql.settings.port
+            else config.${options.services.postgresql.port}
          '';
          description = lib.mdDoc "Database host port.";
        };
--- a/nixos/modules/services/networking/cjdns.nix
+++ b/nixos/modules/services/networking/cjdns.nix
@ -246,8 +246,12 @@ in
            shopt -s lastpipe
            ${pkg}/bin/makekeys | { read private ipv6 public; }

-            install -m 600 <(echo "CJDNS_PRIVATE_KEY=$private") /etc/cjdns.keys
-            install -m 444 <(echo -e "CJDNS_IPV6=$ipv6\nCJDNS_PUBLIC_KEY=$public") /etc/cjdns.public
+            umask 0077
+            echo "CJDNS_PRIVATE_KEY=$private" >> /etc/cjdns.keys
+            echo -e "CJDNS_IPV6=$ipv6\nCJDNS_PUBLIC_KEY=$public" > /etc/cjdns.public
+
+            chmod 600 /etc/cjdns.keys
+            chmod 444 /etc/cjdns.public
        fi

        if [ -z "$CJDNS_ADMIN_PASSWORD" ]; then
--- a/nixos/modules/services/web-apps/invidious.nix
+++ b/nixos/modules/services/web-apps/invidious.nix
@ -346,8 +346,8 @@ in

      port = lib.mkOption {
        type = types.port;
-        default = config.services.postgresql.settings.port;
-        defaultText = lib.literalExpression "config.services.postgresql.settings.port";
+        default = options.services.postgresql.port.default;
+        defaultText = lib.literalExpression "options.services.postgresql.port.default";
        description = lib.mdDoc ''
          The port of the database Invidious should use.

--- a/nixos/modules/services/web-apps/zabbix.nix
+++ b/nixos/modules/services/web-apps/zabbix.nix
@ -76,11 +76,11 @@ in
          type = types.port;
          default =
            if cfg.database.type == "mysql" then config.services.mysql.port
-            else if cfg.database.type == "pgsql" then config.services.postgresql.settings.port
+            else if cfg.database.type == "pgsql" then config.services.postgresql.port
            else 1521;
          defaultText = literalExpression ''
            if config.${opt.database.type} == "mysql" then config.${options.services.mysql.port}
-            else if config.${opt.database.type} == "pgsql" then config.services.postgresql.settings.port
+            else if config.${opt.database.type} == "pgsql" then config.${options.services.postgresql.port}
            else 1521
          '';
          description = lib.mdDoc "Database host port.";
--- a/nixos/tests/gitlab.nix
+++ b/nixos/tests/gitlab.nix
@ -89,10 +89,6 @@ in {
          dbFile = pkgs.writeText "dbsecret" "we2quaeZ";
          jwsFile = pkgs.runCommand "oidcKeyBase" {} "${pkgs.openssl}/bin/openssl genrsa 2048 > $out";
        };
-
-        # reduce memory usage
-        sidekiq.concurrency = 1;
-        puma.workers = 2;
      };
    };
  };
--- a/nixos/tests/invidious.nix
+++ b/nixos/tests/invidious.nix
@ -18,7 +18,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
          host invidious invidious samenet scram-sha-256
        '';
      };
-      networking.firewall.allowedTCPPorts = [ config.services.postgresql.settings.port ];
+      networking.firewall.allowedTCPPorts = [ config.services.postgresql.port ];
    };
    machine = { config, lib, pkgs, ... }: {
      services.invidious = {
--- a/nixos/tests/miniflux.nix
+++ b/nixos/tests/miniflux.nix
@ -76,7 +76,7 @@ in
      systemd.services.postgresql.postStart = lib.mkAfter ''
        $PSQL -tAd miniflux -c 'CREATE EXTENSION hstore;'
      '';
-      networking.firewall.allowedTCPPorts = [ config.services.postgresql.settings.port ];
+      networking.firewall.allowedTCPPorts = [ config.services.postgresql.port ];
    };
    externalDb = { ... }: {
      security.apparmor.enable = true;
--- a/nixos/tests/pg_anonymizer.nix
+++ b/nixos/tests/pg_anonymizer.nix
@ -7,7 +7,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
    services.postgresql = {
      enable = true;
      extraPlugins = ps: [ ps.anonymizer ];
-      settings.shared_preload_libraries = [ "anon" ];
+      settings.shared_preload_libraries = "anon";
    };
  };

--- a/nixos/tests/pgmanage.nix
+++ b/nixos/tests/pgmanage.nix
@ -21,7 +21,7 @@ in
        pgmanage = {
          enable = true;
          connections = {
-            ${conn} = "hostaddr=127.0.0.1 port=${toString config.services.postgresql.settings.port} dbname=postgres";
+            ${conn} = "hostaddr=127.0.0.1 port=${toString config.services.postgresql.port} dbname=postgres";
          };
        };
      };
--- a/nixos/tests/web-apps/mastodon/remote-databases.nix
+++ b/nixos/tests/web-apps/mastodon/remote-databases.nix
@ -33,7 +33,7 @@ in
        extraHosts = hosts;
        firewall.allowedTCPPorts = [
          config.services.redis.servers.mastodon.port
-          config.services.postgresql.settings.port
+          config.services.postgresql.port
        ];
      };

--- a/pkgs/applications/audio/musescore/default.nix
+++ b/pkgs/applications/audio/musescore/default.nix
@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , wrapQtAppsHook
 , pkg-config
@ -128,7 +129,7 @@ in stdenv'.mkDerivation (finalAttrs: {
    mkdir -p "$out/Applications"
    mv "$out/mscore.app" "$out/Applications/mscore.app"
    mkdir -p $out/bin
-    ln -s $out/Applications/mscore.app/Contents/MacOS/mscore $out/bin/mscore
+    ln -s $out/Applications/mscore.app/Contents/MacOS/mscore $out/bin/mscore.
  '';

  # Don't run bundled upstreams tests, as they require a running X window system.
@ -142,6 +143,5 @@ in stdenv'.mkDerivation (finalAttrs: {
    license = licenses.gpl3Only;
    maintainers = with maintainers; [ vandenoever doronbehar ];
    mainProgram = "mscore";
-    platforms = platforms.unix;
  };
 })
--- a/pkgs/applications/blockchains/ergo/default.nix
+++ b/pkgs/applications/blockchains/ergo/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "ergo";
-  version = "5.0.21";
+  version = "5.0.20";

  src = fetchurl {
    url = "https://github.com/ergoplatform/ergo/releases/download/v${version}/ergo-${version}.jar";
-    sha256 = "sha256-WtBsChSHnYbRBojxRUGdMnXlG+45hp4ZSd8GLx5n/88=";
+    sha256 = "sha256-wC3KnuKHsUw1jt7EXVAgPhB6Sk8630sVaM3yn6CGPqs=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/editors/emacs/elisp-packages/elpa-devel-generated.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/elpa-devel-generated.nix
--- a/pkgs/applications/editors/emacs/elisp-packages/elpa-generated.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/elpa-generated.nix
@ -34,10 +34,10 @@
      elpaBuild {
        pname = "activities";
        ename = "activities";
-        version = "0.7";
+        version = "0.5.1";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/activities-0.7.tar";
-          sha256 = "17vwbblcwayf1lqfvc64s606cyv1pyh094i3d8fz0k5ivgfp6ybi";
+          url = "https://elpa.gnu.org/packages/activities-0.5.1.tar";
+          sha256 = "0ng9sgajcpal881s3kavkmz0fc38f2h207hpqj62cf14z7bsk0zk";
        };
        packageRequires = [ emacs persist ];
        meta = {
@ -261,21 +261,6 @@
          license = lib.licenses.free;
        };
      }) {};
-    assess = callPackage ({ elpaBuild, emacs, fetchurl, lib, m-buffer }:
-      elpaBuild {
-        pname = "assess";
-        ename = "assess";
-        version = "0.7";
-        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/assess-0.7.tar";
-          sha256 = "0ixs6ab5j12q69bn9h423a6c7mpc7r5spf6m039x3rl14yc04cy4";
-        };
-        packageRequires = [ emacs m-buffer ];
-        meta = {
-          homepage = "https://elpa.gnu.org/packages/assess.html";
-          license = lib.licenses.free;
-        };
-      }) {};
    async = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
      elpaBuild {
        pname = "async";
@ -295,10 +280,10 @@
      elpaBuild {
        pname = "auctex";
        ename = "auctex";
-        version = "14.0.4";
+        version = "14.0.3";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/auctex-14.0.4.tar";
-          sha256 = "03w6qs4f0ksb8f54zsx189775w3wdyfaqg3dwn20a77y5cvisk52";
+          url = "https://elpa.gnu.org/packages/auctex-14.0.3.tar";
+          sha256 = "1xk29nk3r7ilxk2vag3diacamqvlws7mbjk5a0iivz5y6fy7hmjc";
        };
        packageRequires = [ emacs ];
        meta = {
@ -565,10 +550,10 @@
      elpaBuild {
        pname = "brief";
        ename = "brief";
-        version = "5.90";
+        version = "5.88.22.2";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/brief-5.90.tar";
-          sha256 = "18v0qf3aj14sh6njrrjdahzaghsqy50hdjrwl3k1m7x2jqvzxd1z";
+          url = "https://elpa.gnu.org/packages/brief-5.88.22.2.tar";
+          sha256 = "1i4sdm8kcrazzp22gb4hi1gd4lfq6hdh6pnldmi1zjjyhl1gbzn3";
        };
        packageRequires = [ cl-lib nadvice ];
        meta = {
@ -580,10 +565,10 @@
      elpaBuild {
        pname = "buffer-env";
        ename = "buffer-env";
-        version = "0.6";
+        version = "0.5";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/buffer-env-0.6.tar";
-          sha256 = "08li070s2s64lifgzns0z6xjk1qyaik56d6sbdp3gsyghc1sx7rn";
+          url = "https://elpa.gnu.org/packages/buffer-env-0.5.tar";
+          sha256 = "17q0flxp0rp52ksyh5ijcamvvm003icbyzv28r6vknrw3qsphb3p";
        };
        packageRequires = [ compat emacs ];
        meta = {
@ -674,10 +659,10 @@
      elpaBuild {
        pname = "cape";
        ename = "cape";
-        version = "1.4";
+        version = "1.3";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/cape-1.4.tar";
-          sha256 = "1y0b0lx6qb27x3d0yn3gxykfir07cw4w5jkkw3ff8x1ak6wrf4zv";
+          url = "https://elpa.gnu.org/packages/cape-1.3.tar";
+          sha256 = "1178f6js821zcmsc3zrlclnaf4sswgvzs2qazzi975dkcfqcn3vq";
        };
        packageRequires = [ compat emacs ];
        meta = {
@ -824,10 +809,10 @@
      elpaBuild {
        pname = "comint-mime";
        ename = "comint-mime";
-        version = "0.4";
+        version = "0.3";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/comint-mime-0.4.tar";
-          sha256 = "1wgr1dq3qdnsvziylcqaiwhjafdqph4jrnq4cp0lcr1j796vp1dz";
+          url = "https://elpa.gnu.org/packages/comint-mime-0.3.tar";
+          sha256 = "0dlzwzmiwq9z8riq6h1gpq1g713x09kxgaz2m4anxkbmgb95r7hf";
        };
        packageRequires = [ emacs ];
        meta = {
@ -922,10 +907,10 @@
      elpaBuild {
        pname = "compat";
        ename = "compat";
-        version = "29.1.4.5";
+        version = "29.1.4.4";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/compat-29.1.4.5.tar";
-          sha256 = "191cjzrw9xm5bvcf8s1yr9hdcn9i02789xfd8pz33lk65s0rq413";
+          url = "https://elpa.gnu.org/packages/compat-29.1.4.4.tar";
+          sha256 = "0710g552b1nznnfx2774gmg6yizs27s0bakqm95nsjrp6kgznbfr";
        };
        packageRequires = [ emacs seq ];
        meta = {
@ -937,10 +922,10 @@
      elpaBuild {
        pname = "consult";
        ename = "consult";
-        version = "1.4";
+        version = "1.3";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/consult-1.4.tar";
-          sha256 = "1vxc9i4jwnq4q8svgqjzn6nqqjzh3b6gp81iyfcr5n2122y0aq1y";
+          url = "https://elpa.gnu.org/packages/consult-1.3.tar";
+          sha256 = "1qyqvc4rp0287lidpzhvi669ygjnqmlw8wq0hc0nks2703p283c8";
        };
        packageRequires = [ compat emacs ];
        meta = {
@ -948,7 +933,8 @@
          license = lib.licenses.free;
        };
      }) {};
-    consult-hoogle = callPackage ({ elpaBuild
+    consult-hoogle = callPackage ({ consult
+                                  , elpaBuild
                                  , emacs
                                  , fetchurl
                                  , haskell-mode
@ -956,12 +942,12 @@
      elpaBuild {
        pname = "consult-hoogle";
        ename = "consult-hoogle";
-        version = "0.2.0";
+        version = "0.1.1";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/consult-hoogle-0.2.0.tar";
-          sha256 = "1wzd7i7sfd1l8fkfgfaj5vyc9nx9aycfr4yp5yxg1mr6fz8m2rmz";
+          url = "https://elpa.gnu.org/packages/consult-hoogle-0.1.1.tar";
+          sha256 = "1bcl7h5ykcgrsfj27wkv9l9jvbj2bbkh0w9d60663m1bkp0p3y2r";
        };
-        packageRequires = [ emacs haskell-mode ];
+        packageRequires = [ consult emacs haskell-mode ];
        meta = {
          homepage = "https://elpa.gnu.org/packages/consult-hoogle.html";
          license = lib.licenses.free;
@ -1166,10 +1152,10 @@
      elpaBuild {
        pname = "dape";
        ename = "dape";
-        version = "0.9.0";
+        version = "0.7.0";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/dape-0.9.0.tar";
-          sha256 = "13xvl24l8lr64ndc8rk1dxdgsbvwxhn90844xkdzl7qs8i3hyw1l";
+          url = "https://elpa.gnu.org/packages/dape-0.7.0.tar";
+          sha256 = "0fbafwmrs9dlv875vcg1c9gh0hqs1zpnyqxgkdvbrazww7ffn60g";
        };
        packageRequires = [ emacs jsonrpc ];
        meta = {
@ -1256,10 +1242,10 @@
      elpaBuild {
        pname = "denote";
        ename = "denote";
-        version = "2.3.0";
+        version = "2.2.4";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/denote-2.3.0.tar";
-          sha256 = "0h6pdn9w1ggyrmfniqvy307wnlf49n05asa2z5wqxvj6mnvjza1y";
+          url = "https://elpa.gnu.org/packages/denote-2.2.4.tar";
+          sha256 = "0a0f4s715nfb7kly82m1gb2ady69z089wlay5i53n9bxzi61x3j7";
        };
        packageRequires = [ emacs ];
        meta = {
@ -1301,10 +1287,10 @@
      elpaBuild {
        pname = "devdocs";
        ename = "devdocs";
-        version = "0.6";
+        version = "0.5";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/devdocs-0.6.tar";
-          sha256 = "17av2l61mr4y8la4cqiq1dnaznni4xirr5k3wdix1jzl3q1apypy";
+          url = "https://elpa.gnu.org/packages/devdocs-0.5.tar";
+          sha256 = "0qyp8lhf76yv2ym7cryvygvf2m9jah5nsl1g79gqjrsin6vlhqka";
        };
        packageRequires = [ emacs ];
        meta = {
@ -1667,10 +1653,10 @@
      elpaBuild {
        pname = "eev";
        ename = "eev";
-        version = "20240309";
+        version = "20240205";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/eev-20240309.tar";
-          sha256 = "0j9hz5raxrk3d2ashbsp9yvi04d5ap0chb4lpljr4pbh2lnyjr4h";
+          url = "https://elpa.gnu.org/packages/eev-20240205.tar";
+          sha256 = "06psmcf3yi7pincsbhjrcrml0wzwgmlv6xy2fbpg1sg8vlibbgi3";
        };
        packageRequires = [ emacs ];
        meta = {
@ -1682,10 +1668,10 @@
      elpaBuild {
        pname = "ef-themes";
        ename = "ef-themes";
-        version = "1.6.1";
+        version = "1.5.1";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/ef-themes-1.6.1.tar";
-          sha256 = "1ms0rqivxdsbx7jv6d5h1khvm4ghml152ab831chg4z77apmq1ga";
+          url = "https://elpa.gnu.org/packages/ef-themes-1.5.1.tar";
+          sha256 = "00qh5b7kx0dlms7drnzj95mvgwfzg5h5m9prkbr8qi4ssx939gdw";
        };
        packageRequires = [ emacs ];
        meta = {
@ -1792,16 +1778,22 @@
          license = lib.licenses.free;
        };
      }) {};
-    ellama = callPackage ({ elpaBuild, emacs, fetchurl, lib, llm, spinner }:
+    ellama = callPackage ({ dash
+                          , elpaBuild
+                          , emacs
+                          , fetchurl
+                          , lib
+                          , llm
+                          , spinner }:
      elpaBuild {
        pname = "ellama";
        ename = "ellama";
-        version = "0.8.13";
+        version = "0.8.7";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/ellama-0.8.13.tar";
-          sha256 = "012j3rnvwj8ajyjdlgdx6nrs773i71dyl5brs0jgx010jibzmafi";
+          url = "https://elpa.gnu.org/packages/ellama-0.8.7.tar";
+          sha256 = "0qmd7zrh026rjic26bdp9zinb7vkppdm14inwpwaashqxa5brwi5";
        };
-        packageRequires = [ emacs llm spinner ];
+        packageRequires = [ dash emacs llm spinner ];
        meta = {
          homepage = "https://elpa.gnu.org/packages/ellama.html";
          license = lib.licenses.free;
@ -1901,10 +1893,10 @@
      elpaBuild {
        pname = "emms";
        ename = "emms";
-        version = "19";
+        version = "18";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/emms-19.tar";
-          sha256 = "13c884s92ddn52psgkaz3zvb94g23gq41dbidpx7x4gzdhd9qqxm";
+          url = "https://elpa.gnu.org/packages/emms-18.tar";
+          sha256 = "1jslk37kx7yzvwy4hq1a6b71kp4a3bgfzzp8bpplv7z6vcmwrmgq";
        };
        packageRequires = [ cl-lib nadvice seq ];
        meta = {
@ -2133,10 +2125,10 @@
      elpaBuild {
        pname = "filechooser";
        ename = "filechooser";
-        version = "0.2.0";
+        version = "0.1.2";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/filechooser-0.2.0.tar";
-          sha256 = "1pl6n6d6gymdm0gx0nz96hwps8v1s2zpqph41d0h5hdvsvxacx6w";
+          url = "https://elpa.gnu.org/packages/filechooser-0.1.2.tar";
+          sha256 = "0s0mdc851zd2hy8hfpbamiimbh7c788cyz8mxnwzkpmf6jlj6xdw";
        };
        packageRequires = [ compat emacs ];
        meta = {
@ -2562,10 +2554,10 @@
      elpaBuild {
        pname = "greader";
        ename = "greader";
-        version = "0.9.19";
+        version = "0.9.7";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/greader-0.9.19.tar";
-          sha256 = "1d04d1shzb505qs2mf7387dvl56pwlwh4b349s5fq2prwqrq71l7";
+          url = "https://elpa.gnu.org/packages/greader-0.9.7.tar";
+          sha256 = "08q2qfcwyxrnmjbzblgk16xhshhn2314swjs0kr5jrdijdgpfghh";
        };
        packageRequires = [ emacs ];
        meta = {
@ -2592,10 +2584,10 @@
      elpaBuild {
        pname = "gtags-mode";
        ename = "gtags-mode";
-        version = "1.1";
+        version = "1.0";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/gtags-mode-1.1.tar";
-          sha256 = "0fgs6iqrivmyxfkjl6hxxs3zfjkkdas61z34q08qfjgw0ixz188h";
+          url = "https://elpa.gnu.org/packages/gtags-mode-1.0.tar";
+          sha256 = "0nyzsr3fnds931ihw2dp5xlgv151kzph7qv1n751r1cajimzlp7n";
        };
        packageRequires = [ emacs ];
        meta = {
@ -2734,10 +2726,10 @@
      elpaBuild {
        pname = "hyperbole";
        ename = "hyperbole";
-        version = "9.0.1";
+        version = "9.0.0";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/hyperbole-9.0.1.tar";
-          sha256 = "0a7py2dvszh0rf2smbmm8msjrc8vbbvlqnsqw0m2l12v8vllmxnb";
+          url = "https://elpa.gnu.org/packages/hyperbole-9.0.0.tar";
+          sha256 = "07kpyp3ggf4knakn18niy819l184apx4d9vbcwv57j8zyqgn4c3l";
        };
        packageRequires = [ emacs ];
        meta = {
@ -2794,10 +2786,10 @@
      elpaBuild {
        pname = "isearch-mb";
        ename = "isearch-mb";
-        version = "0.8";
+        version = "0.7";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/isearch-mb-0.8.tar";
-          sha256 = "06241rwz01z4ysgmizczq12zl0cc6xvfyds48glzk1jp82zp4adp";
+          url = "https://elpa.gnu.org/packages/isearch-mb-0.7.tar";
+          sha256 = "1dfjh4ya9515vx0q2dv1brddw350gxd40h1g1vsa783ivvm0hm75";
        };
        packageRequires = [ emacs ];
        meta = {
@ -2964,10 +2956,10 @@
      elpaBuild {
        pname = "jinx";
        ename = "jinx";
-        version = "1.4";
+        version = "1.3";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/jinx-1.4.tar";
-          sha256 = "1vv85pbhcpwjvd3iwnr8ksjpbydrsk7m3zm34hcbybg703yk2nl7";
+          url = "https://elpa.gnu.org/packages/jinx-1.3.tar";
+          sha256 = "0xlfw1sw92qf8bwpw9qnjhkz4ax6n7kcl72ypqm3swmj92jbgsg7";
        };
        packageRequires = [ compat emacs ];
        meta = {
@ -2979,10 +2971,10 @@
      elpaBuild {
        pname = "jit-spell";
        ename = "jit-spell";
-        version = "0.4";
+        version = "0.3";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/jit-spell-0.4.tar";
-          sha256 = "1p83spcq52l7k63p56y3w5r3kl49wbrs4abynwn25ikhkd4wl8x3";
+          url = "https://elpa.gnu.org/packages/jit-spell-0.3.tar";
+          sha256 = "0q8wd9phd0zcjhc92j633vz82fr0ji8zc9vir7kcn1msrf6jspwz";
        };
        packageRequires = [ compat emacs ];
        meta = {
@ -3024,10 +3016,10 @@
      elpaBuild {
        pname = "jsonrpc";
        ename = "jsonrpc";
-        version = "1.0.25";
+        version = "1.0.24";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/jsonrpc-1.0.25.tar";
-          sha256 = "0hlc70xlm3a53il7k24s6s25dhnd09l2454r5qkpfnjdz9p5ih6f";
+          url = "https://elpa.gnu.org/packages/jsonrpc-1.0.24.tar";
+          sha256 = "05nwxfybczxx7pmflq762dq3wypm3pmcfljqs5kh81icxvdqvk8s";
        };
        packageRequires = [ emacs ];
        meta = {
@ -3145,40 +3137,6 @@
          license = lib.licenses.free;
        };
      }) {};
-    lentic = callPackage ({ dash, elpaBuild, emacs, fetchurl, lib, m-buffer }:
-      elpaBuild {
-        pname = "lentic";
-        ename = "lentic";
-        version = "0.12";
-        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/lentic-0.12.tar";
-          sha256 = "15sb126sq5aw3n09vqydmsl1l5svfar70iz42hnqi783cpw1lh0m";
-        };
-        packageRequires = [ dash emacs m-buffer ];
-        meta = {
-          homepage = "https://elpa.gnu.org/packages/lentic.html";
-          license = lib.licenses.free;
-        };
-      }) {};
-    lentic-server = callPackage ({ elpaBuild
-                                 , fetchurl
-                                 , lentic
-                                 , lib
-                                 , web-server }:
-      elpaBuild {
-        pname = "lentic-server";
-        ename = "lentic-server";
-        version = "0.2";
-        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/lentic-server-0.2.tar";
-          sha256 = "1vifs91r4rm57rka8by50f8zg5pr2hjqwbdz28mbbxhkj3war6s5";
-        };
-        packageRequires = [ lentic web-server ];
-        meta = {
-          homepage = "https://elpa.gnu.org/packages/lentic-server.html";
-          license = lib.licenses.free;
-        };
-      }) {};
    let-alist = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
      elpaBuild {
        pname = "let-alist";
@ -3224,36 +3182,14 @@
          license = lib.licenses.free;
        };
      }) {};
-    listen = callPackage ({ elpaBuild
-                          , emacs
-                          , fetchurl
-                          , lib
-                          , persist
-                          , taxy
-                          , taxy-magit-section
-                          , transient }:
-      elpaBuild {
-        pname = "listen";
-        ename = "listen";
-        version = "0.8";
-        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/listen-0.8.tar";
-          sha256 = "1vj9fsyp5v1qh87asj23k625080x6c8mgkas4933lrz7l2g7h1y2";
-        };
-        packageRequires = [ emacs persist taxy taxy-magit-section transient ];
-        meta = {
-          homepage = "https://elpa.gnu.org/packages/listen.html";
-          license = lib.licenses.free;
-        };
-      }) {};
    llm = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
      elpaBuild {
        pname = "llm";
        ename = "llm";
-        version = "0.12.1";
+        version = "0.9.1";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/llm-0.12.1.tar";
-          sha256 = "11z56fqp0y13jmvm2611xyqsz41k01rsqdjvrzvbf33n56vsw713";
+          url = "https://elpa.gnu.org/packages/llm-0.9.1.tar";
+          sha256 = "0vib0zl41fsacc5d79f1l52j2vxnbqc37471b86cxw9rha0clr8m";
        };
        packageRequires = [ emacs ];
        meta = {
@ -3381,21 +3317,6 @@
          license = lib.licenses.free;
        };
      }) {};
-    m-buffer = callPackage ({ elpaBuild, fetchurl, lib, seq }:
-      elpaBuild {
-        pname = "m-buffer";
-        ename = "m-buffer";
-        version = "0.16";
-        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/m-buffer-0.16.tar";
-          sha256 = "1mb03hrszxxsk61yvh70rnkn7iiwx1vx6n1br02clkpn2q2c0mq5";
-        };
-        packageRequires = [ seq ];
-        meta = {
-          homepage = "https://elpa.gnu.org/packages/m-buffer.html";
-          license = lib.licenses.free;
-        };
-      }) {};
    map = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
      elpaBuild {
        pname = "map";
@ -3595,10 +3516,10 @@
      elpaBuild {
        pname = "modus-themes";
        ename = "modus-themes";
-        version = "4.4.0";
+        version = "4.3.0";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/modus-themes-4.4.0.tar";
-          sha256 = "1n6fmgj2kpdy2mmwg5hh6dic30zy0gd3ap6hlipl9qn08lawbbgq";
+          url = "https://elpa.gnu.org/packages/modus-themes-4.3.0.tar";
+          sha256 = "0zsglzqc36bw9r7fgvxjdcrdjar6xwad29kwyqd2k36bq3pivzq3";
        };
        packageRequires = [ emacs ];
        meta = {
@ -3606,21 +3527,6 @@
          license = lib.licenses.free;
        };
      }) {};
-    mpdired = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
-      elpaBuild {
-        pname = "mpdired";
-        ename = "mpdired";
-        version = "1";
-        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/mpdired-1.tar";
-          sha256 = "1b7xsdgsrwy7qkshkk83bizz9r78g4pdfnavwl6riyb947gk6zkx";
-        };
-        packageRequires = [ emacs ];
-        meta = {
-          homepage = "https://elpa.gnu.org/packages/mpdired.html";
-          license = lib.licenses.free;
-        };
-      }) {};
    multi-mode = callPackage ({ elpaBuild, fetchurl, lib }:
      elpaBuild {
        pname = "multi-mode";
@ -3994,10 +3900,10 @@
      elpaBuild {
        pname = "orderless";
        ename = "orderless";
-        version = "1.1";
+        version = "1.0";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/orderless-1.1.tar";
-          sha256 = "19iy0ps8h1qjh16mdybayd9i25bn27sa2slqsa6nslh251pxc0rk";
+          url = "https://elpa.gnu.org/packages/orderless-1.0.tar";
+          sha256 = "0kslgrs857h3mm837hcb8v52ankbv0hm2pz0q136imckzj32m43s";
        };
        packageRequires = [ emacs ];
        meta = {
@ -4009,10 +3915,10 @@
      elpaBuild {
        pname = "org";
        ename = "org";
-        version = "9.6.23";
+        version = "9.6.19";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/org-9.6.23.tar";
-          sha256 = "0yqn3kag4anzm8ahfgjxrxjndzq6rbs6kayfq93gx4rn0qxa334q";
+          url = "https://elpa.gnu.org/packages/org-9.6.19.tar";
+          sha256 = "0ibgw0i7nsn589k0ynifwdp1f3ia6p8369myhjqgmwy392cwrcxg";
        };
        packageRequires = [ emacs ];
        meta = {
@ -4069,10 +3975,10 @@
      elpaBuild {
        pname = "org-modern";
        ename = "org-modern";
-        version = "1.2";
+        version = "1.1";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/org-modern-1.2.tar";
-          sha256 = "1kgvrsmbgadbr7wk48sgx1prlgpbp31nih9bl9div35d496njcnw";
+          url = "https://elpa.gnu.org/packages/org-modern-1.1.tar";
+          sha256 = "1aclips7y3dasjh6rjdcx1b6fkaripjam6120b7wm487qpjcrzc8";
        };
        packageRequires = [ compat emacs ];
        meta = {
@ -4470,21 +4376,6 @@
          license = lib.licenses.free;
        };
      }) {};
-    pq = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
-      elpaBuild {
-        pname = "pq";
-        ename = "pq";
-        version = "0.2";
-        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/pq-0.2.tar";
-          sha256 = "0gy3i2l1fxwpav6l57yf3mml15lhwh9xp8sm40hlpgyn15nyz4c6";
-        };
-        packageRequires = [ emacs ];
-        meta = {
-          homepage = "https://elpa.gnu.org/packages/pq.html";
-          license = lib.licenses.free;
-        };
-      }) {};
    project = callPackage ({ elpaBuild, emacs, fetchurl, lib, xref }:
      elpaBuild {
        pname = "project";
@ -4684,10 +4575,10 @@
      elpaBuild {
        pname = "rcirc-sqlite";
        ename = "rcirc-sqlite";
-        version = "0.1.4";
+        version = "0.1.3";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/rcirc-sqlite-0.1.4.tar";
-          sha256 = "0hz0nm35jq6fg9pr4j725r2awxbf1q23bzn85nhcbpafzb8mmajl";
+          url = "https://elpa.gnu.org/packages/rcirc-sqlite-0.1.3.tar";
+          sha256 = "1pwxkw6dzwbg5g3rxilpp6iy3mzxgpn0mw59i3dcx25hdyizqhip";
        };
        packageRequires = [ emacs ];
        meta = {
@ -4954,10 +4845,10 @@
      elpaBuild {
        pname = "rt-liberation";
        ename = "rt-liberation";
-        version = "7";
+        version = "6";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/rt-liberation-7.tar";
-          sha256 = "0gb1an3a68ib27jrc8x8grq5z3xya4b1gl8ii82a1clzf87n7k63";
+          url = "https://elpa.gnu.org/packages/rt-liberation-6.tar";
+          sha256 = "1l87q2h1hqm5zpg1fz835gmbf5fgl9fvcqg42c17v6kim4has8zd";
        };
        packageRequires = [];
        meta = {
@ -5324,10 +5215,10 @@
      elpaBuild {
        pname = "spacious-padding";
        ename = "spacious-padding";
-        version = "0.4.1";
+        version = "0.3.0";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/spacious-padding-0.4.1.tar";
-          sha256 = "02bc0r20b4mgnlzryq26q0jq45wfgpvv7y3zhvnaaqj11rw7779f";
+          url = "https://elpa.gnu.org/packages/spacious-padding-0.3.0.tar";
+          sha256 = "1iiaxgl18k8hkwwyz3qnargv6q8kwzyh39ai46k5xbpmyrsj4b16";
        };
        packageRequires = [ emacs ];
        meta = {
@ -5798,10 +5689,10 @@
      elpaBuild {
        pname = "tramp";
        ename = "tramp";
-        version = "2.6.2.2";
+        version = "2.6.2.1";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/tramp-2.6.2.2.tar";
-          sha256 = "0bbsff2qr71f70nxhdi19b3jzpv6bgfb7x7qkrccsygvsvgyrb2h";
+          url = "https://elpa.gnu.org/packages/tramp-2.6.2.1.tar";
+          sha256 = "145riknpdvw7rvpz20m766yci3w012f241mw38pbbb9cb8pn2rbf";
        };
        packageRequires = [ emacs ];
        meta = {
@ -5858,10 +5749,10 @@
      elpaBuild {
        pname = "transient";
        ename = "transient";
-        version = "0.6.0";
+        version = "0.5.3";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/transient-0.6.0.tar";
-          sha256 = "1lsh8cvg1kspa8gl9fml0x7r61fbhjajmjqjf4r2s7qz102z66xb";
+          url = "https://elpa.gnu.org/packages/transient-0.5.3.tar";
+          sha256 = "12ak6rykg627rkwwiga5d9g9pzcrq2sliynqbr3lm8rvlwbdhkhx";
        };
        packageRequires = [ compat emacs seq ];
        meta = {
@ -6008,10 +5899,10 @@
      elpaBuild {
        pname = "urgrep";
        ename = "urgrep";
-        version = "0.4.1";
+        version = "0.4.0";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/urgrep-0.4.1.tar";
-          sha256 = "1kwcb7xxk9lcby5s8gpd5dchya7qq063j217rxsjyn8vv9z91lfc";
+          url = "https://elpa.gnu.org/packages/urgrep-0.4.0.tar";
+          sha256 = "0l0gswml6hkna48gfljj3hajhcx3bbc1rqwb2v01hvqab05an7zs";
        };
        packageRequires = [ compat emacs project ];
        meta = {
@ -6215,10 +6106,10 @@
      elpaBuild {
        pname = "verilog-mode";
        ename = "verilog-mode";
-        version = "2024.3.1.121933719";
+        version = "2023.6.6.141322628";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/verilog-mode-2024.3.1.121933719.tar";
-          sha256 = "047kna2j1mbsibw1psxdp8qmg91dnjrdrskdzhys9pmaqggfl5ry";
+          url = "https://elpa.gnu.org/packages/verilog-mode-2023.6.6.141322628.tar";
+          sha256 = "14qls4v5yxrgyiimvvggimw5ddlx0ll387a1r6awm274rj4p3d19";
        };
        packageRequires = [];
        meta = {
--- a/pkgs/applications/editors/emacs/elisp-packages/nongnu-generated.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/nongnu-generated.nix
@ -64,10 +64,10 @@
      elpaBuild {
        pname = "annotate";
        ename = "annotate";
-        version = "2.2.0";
+        version = "2.1.0";
        src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/annotate-2.2.0.tar";
-          sha256 = "1h1whavdrwfsc79kcvh2vbvjzqd7n01xzjb1acgyiy9wkyl79p7b";
+          url = "https://elpa.nongnu.org/nongnu/annotate-2.1.0.tar";
+          sha256 = "07q8s3qi3lm8g01ypvqqq0cn5jx5jrgyv74fbfam3mmz5l3mqp6q";
        };
        packageRequires = [];
        meta = {
@ -306,10 +306,10 @@
      elpaBuild {
        pname = "buttercup";
        ename = "buttercup";
-        version = "1.34";
+        version = "1.33";
        src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/buttercup-1.34.tar";
-          sha256 = "0bdlky9d5fzc9x9wpjxyvrclz1rmzsnvc89lf0m5fhyp4r8jvxy4";
+          url = "https://elpa.nongnu.org/nongnu/buttercup-1.33.tar";
+          sha256 = "0245fq4iny1jnm440dzkq0fadw10ncnhkj28mayqs9iyyzj9g5h4";
        };
        packageRequires = [ emacs ];
        meta = {
@ -459,26 +459,6 @@
          license = lib.licenses.free;
        };
      }) {};
-    consult-flycheck = callPackage ({ consult
-                                    , elpaBuild
-                                    , emacs
-                                    , fetchurl
-                                    , flycheck
-                                    , lib }:
-      elpaBuild {
-        pname = "consult-flycheck";
-        ename = "consult-flycheck";
-        version = "1.0";
-        src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/consult-flycheck-1.0.tar";
-          sha256 = "0901wliqdzj5dmam1kkbq0nxhywqf11182q7yxjxh98czy5w3xh8";
-        };
-        packageRequires = [ consult emacs flycheck ];
-        meta = {
-          homepage = "https://elpa.gnu.org/packages/consult-flycheck.html";
-          license = lib.licenses.free;
-        };
-      }) {};
    corfu-terminal = callPackage ({ corfu
                                  , elpaBuild
                                  , emacs
@ -499,16 +479,16 @@
          license = lib.licenses.free;
        };
      }) {};
-    crux = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+    crux = callPackage ({ elpaBuild, fetchurl, lib, seq }:
      elpaBuild {
        pname = "crux";
        ename = "crux";
-        version = "0.5.0";
+        version = "0.4.0";
        src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/crux-0.5.0.tar";
-          sha256 = "0zdzfglzvhkzyvnkk2d217c6f8gnbcxlp8adimwrxgqh7c6gwihp";
+          url = "https://elpa.nongnu.org/nongnu/crux-0.4.0.tar";
+          sha256 = "01yg54s2l3zr4h7h3nw408bqzrr4yds9rfgc575b76006v5d3ciy";
        };
-        packageRequires = [ emacs ];
+        packageRequires = [ seq ];
        meta = {
          homepage = "https://elpa.gnu.org/packages/crux.html";
          license = lib.licenses.free;
@ -762,10 +742,10 @@
      elpaBuild {
        pname = "elpher";
        ename = "elpher";
-        version = "3.6.0";
+        version = "3.5.1";
        src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/elpher-3.6.0.tar";
-          sha256 = "0pa8y3zc768wdgp43546qvwr6ly2q9gznfrl6qmm90gkv5wrc5ln";
+          url = "https://elpa.nongnu.org/nongnu/elpher-3.5.1.tar";
+          sha256 = "0687npypihavghz9bjs8f6h10awjgjv5fdd11dmh43p1krhrga2w";
        };
        packageRequires = [ emacs ];
        meta = {
@ -2702,10 +2682,10 @@
      elpaBuild {
        pname = "racket-mode";
        ename = "racket-mode";
-        version = "1.0.20240319.160226";
+        version = "1.0.20240219.135847";
        src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/racket-mode-1.0.20240319.160226.tar";
-          sha256 = "1alqiagpkbxqi8nyrn1qzfx23fagpn1ml9hqpyj897jwf5f03zsh";
+          url = "https://elpa.nongnu.org/nongnu/racket-mode-1.0.20240219.135847.tar";
+          sha256 = "06g1ci7kq8fxjh65qwwnh530xvvh6pr9ha52f7xmbjf56iifn1da";
        };
        packageRequires = [ emacs ];
        meta = {
@ -3402,10 +3382,10 @@
      elpaBuild {
        pname = "visual-fill-column";
        ename = "visual-fill-column";
-        version = "2.6.2";
+        version = "2.6.0";
        src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/visual-fill-column-2.6.2.tar";
-          sha256 = "13z87xyzldllvga8iygb33qaqvrrc2qnc315zalvbmydw174cq1i";
+          url = "https://elpa.nongnu.org/nongnu/visual-fill-column-2.6.0.tar";
+          sha256 = "1gpjby6g9wq8p25q1a35hr56nfb4sbcdrf0bjxidh1diw5g5saw4";
        };
        packageRequires = [ emacs ];
        meta = {
@ -3417,10 +3397,10 @@
      elpaBuild {
        pname = "web-mode";
        ename = "web-mode";
-        version = "17.3.19";
+        version = "17.3.18";
        src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/web-mode-17.3.19.tar";
-          sha256 = "1z33y7p1dilwpwydb9q14n55q48n80mynm7fjr7ih91wvk8zz5di";
+          url = "https://elpa.nongnu.org/nongnu/web-mode-17.3.18.tar";
+          sha256 = "18ylzq12gsayp3cmd8qjdqsnyiymjd95ffqs3xcyva6sl8d41hmy";
        };
        packageRequires = [ emacs ];
        meta = {
@ -3580,10 +3560,10 @@
      elpaBuild {
        pname = "xah-fly-keys";
        ename = "xah-fly-keys";
-        version = "24.24.20240324101507";
+        version = "24.21.20240220095736";
        src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/xah-fly-keys-24.24.20240324101507.tar";
-          sha256 = "1lqrrs5j523q33vvs85j3dlnd56bmnzglfkc8jilv6yq44dmv7v7";
+          url = "https://elpa.nongnu.org/nongnu/xah-fly-keys-24.21.20240220095736.tar";
+          sha256 = "04ra1m9mwhz3zh0776gbzfn4kn0yxgbfbh1hq78r2zxggvpjfikv";
        };
        packageRequires = [ emacs ];
        meta = {
--- a/pkgs/applications/editors/emacs/elisp-packages/recipes-archive-melpa.json
+++ b/pkgs/applications/editors/emacs/elisp-packages/recipes-archive-melpa.json
--- a/pkgs/applications/editors/emacs/sources.nix
+++ b/pkgs/applications/editors/emacs/sources.nix
@ -98,10 +98,10 @@ in

  emacs29 = import ./make-emacs.nix (mkArgs {
    pname = "emacs";
-    version = "29.3";
+    version = "29.2";
    variant = "mainline";
-    rev = "29.3";
-    hash = "sha256-4yN81djeKb9Hlr6MvaDdXqf4XOl0oolXEYGqkA+KUO0=";
+    rev = "29.2";
+    hash = "sha256-qSQmQzVyEGSr4GAI6rqnEwBvhl09D2D8MNasHqZQPL8=";
  });

  emacs28-macport = import ./make-emacs.nix (mkArgs {
--- a/pkgs/applications/editors/vim/plugins/neovim-require-check-hook.sh
+++ b/pkgs/applications/editors/vim/plugins/neovim-require-check-hook.sh
@ -10,7 +10,7 @@ neovimRequireCheckHook () {
 		# editorconfig-checker-disable
        export HOME="$TMPDIR"
        @nvimBinary@ -es --headless -n -u NONE -i NONE --clean -V1 \
-            --cmd "set rtp+=$out,${dependencies/ /,}" \
+            --cmd "set rtp+=$out" \
            --cmd "lua require('$nvimRequireCheck')"
    fi
 }
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -670,9 +670,6 @@

  hardhat-nvim = super.hardhat-nvim.overrideAttrs {
    dependencies = with self; [ overseer-nvim plenary-nvim ];
-
-    doInstallCheck = true;
-    nvimRequireCheck = "hardhat";
  };

  harpoon = super.harpoon.overrideAttrs {
--- a/pkgs/applications/emulators/dolphin-emu/default.nix
+++ b/pkgs/applications/emulators/dolphin-emu/default.nix
@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , cmake
 , pkg-config
 , wrapQtAppsHook
@ -72,12 +71,6 @@ stdenv.mkDerivation rec {
  patches = [
    # Remove when merged https://github.com/dolphin-emu/dolphin/pull/12070
    ./find-minizip-ng.patch
-
-    # fix buidl w/ glibc-2.39
-    (fetchpatch {
-      url = "https://github.com/dolphin-emu/dolphin/commit/3da2e15e6b95f02f66df461e87c8b896e450fdab.patch";
-      hash = "sha256-+8yGF412wQUYbyEuYWd41pgOgEbhCaezexxcI5CNehc=";
-    })
  ];

  strictDeps = true;
--- a/pkgs/applications/misc/cherrytree/default.nix
+++ b/pkgs/applications/misc/cherrytree/default.nix
@ -20,13 +20,13 @@

 stdenv.mkDerivation rec {
  pname = "cherrytree";
-  version = "1.1.0";
+  version = "1.0.4";

  src = fetchFromGitHub {
    owner = "giuspen";
    repo = "cherrytree";
    rev = "refs/tags/v${version}";
-    hash = "sha256-YoHaWc/olJrbV1A4hqDgYOLVlpHBrgI0x2TFr9oeqh4=";
+    hash = "sha256-SMx3a0pzhNahRzmenZwPQPCBgqoBGo9n3RcNcimNGBE=";
  };

  nativeBuildInputs = [
@ -66,6 +66,5 @@ stdenv.mkDerivation rec {
    changelog = "https://raw.githubusercontent.com/giuspen/cherrytree/${version}/changelog.txt";
    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ ];
-    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/networking/bee/bee.nix
+++ b/pkgs/applications/networking/bee/bee.nix
@ -5,27 +5,27 @@

 buildGoModule rec {
  pname = "bee";
-  version = "2.0.0";
+  version = "1.18.2";

  src = fetchFromGitHub {
    owner = "ethersphere";
    repo = "bee";
    rev = "v${version}";
-    sha256 = "sha256-gZDmFufk/zBftQe7Ju4rDpZqw0hm2nf9YQg1Oa8540s=";
+    sha256 = "sha256-LUOKF1073GmQWG2q4w0cTErSHw7ok5N6PQZ45xpjYx4=";
  };

-  vendorHash = "sha256-GpazHMQ8xZ6P7mADvsG3bXxDxEWnCJRIsBwDnL/McZA=";
+  vendorHash = "sha256-UdsF/otjXqS1NY3PkCimRiD93hGntHG3Xhw6avFtHog=";

  subPackages = [ "cmd/bee" ];

  ldflags = [
    "-s"
    "-w"
-    "-X github.com/ethersphere/bee/v2.version=${version}"
-    "-X github.com/ethersphere/bee/v2/pkg/api.Version=5.2.0"
-    "-X github.com/ethersphere/bee/v2/pkg/api.DebugVersion=4.1.1"
-    "-X github.com/ethersphere/bee/v2/pkg/p2p/libp2p.reachabilityOverridePublic=false"
-    "-X github.com/ethersphere/bee/v2/pkg/postage/listener.batchFactorOverridePublic=5"
+    "-X github.com/ethersphere/bee.version=${version}"
+    "-X github.com/ethersphere/bee/pkg/api.Version=5.2.0"
+    "-X github.com/ethersphere/bee/pkg/api.DebugVersion=4.1.0"
+    "-X github.com/ethersphere/bee/pkg/p2p/libp2p.reachabilityOverridePublic=false"
+    "-X github.com/ethersphere/bee/pkg/postage/listener.batchFactorOverridePublic=5"
  ];

  CGO_ENABLED = 0;
--- a/pkgs/applications/networking/browsers/badwolf/default.nix
+++ b/pkgs/applications/networking/browsers/badwolf/default.nix
@ -1,49 +1,39 @@
-{ lib
-, stdenv
+{ stdenv
+, lib
 , fetchgit
-, ninja
 , pkg-config
-, ed
 , wrapGAppsHook
 , webkitgtk
 , libxml2
+, glib
 , glib-networking
 , gettext
 }:
-
 stdenv.mkDerivation rec {
  pname = "badwolf";
-  version = "1.3.0";
+  version = "1.2.2";

  src = fetchgit {
-    url = "https://hacktivis.me/git/badwolf.git";
+    url = "git://hacktivis.me/git/badwolf.git";
    rev = "v${version}";
-    hash = "sha256-feWSxK9TJ5MWxUKutuTcdmMk5IbLjNseUAvfm20kQ1U=";
+    hash = "sha256-HfAsq6z+1kqMAsNxJjWJx9nd2cbv0XN4KRS8cYuhOsQ=";
  };

-  # configure script not accepting '--prefix'
-  prefixKey = "PREFIX=";
+  preConfigure = ''
+    export PREFIX=$out
+  '';

-  nativeBuildInputs = [
-    ninja
-    pkg-config
-    ed
-    wrapGAppsHook
-  ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook ];

-  buildInputs = [
-    webkitgtk
-    libxml2
-    gettext
-    glib-networking
-  ];
+  buildInputs = [ webkitgtk libxml2 gettext glib glib-networking ];

  meta = with lib; {
    description = "Minimalist and privacy-oriented WebKitGTK+ browser";
    mainProgram = "badwolf";
    homepage = "https://hacktivis.me/projects/badwolf";
-    license = with licenses; [ bsd3 cc-by-sa-40 ];
+    license = licenses.bsd3;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ laalsaas aleksana ];
+    maintainers = with maintainers; [ laalsaas ];
  };
+
 }
--- a/pkgs/applications/networking/browsers/litebrowser/default.nix
+++ b/pkgs/applications/networking/browsers/litebrowser/default.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation {
  pname = "litebrowser";
-  version = "unstable-2024-02-25";
+  version = "unstable-2022-10-31";

  src = fetchFromGitHub {
    owner = "litehtml";
    repo = "litebrowser-linux";
-    rev = "8130cf50af90e07d201d43b934b5a57f7ed4e68d";
-    hash = "sha256-L/pd4VypDfjLKfh+HLpc4um+POWGzGa4OOttudwJxyk=";
+    rev = "4654f8fb2d5e2deba7ac6223b6639341bd3b7eba";
+    hash = "sha256-SvW1AOxLBLKqa+/2u2Zn+/t33ZzQHmqlcLRl6z0rK9U=";
    fetchSubmodules = true; # litehtml submodule
  };

@ -46,7 +46,6 @@ stdenv.mkDerivation {
  '';

  meta = with lib; {
-    broken = stdenv.cc.isClang;  # https://github.com/litehtml/litebrowser-linux/issues/19
    description = "A simple browser based on the litehtml engine";
    mainProgram = "litebrowser";
    homepage = "https://github.com/litehtml/litebrowser-linux";
--- a/pkgs/applications/networking/browsers/microsoft-edge/browser.nix
+++ b/pkgs/applications/networking/browsers/microsoft-edge/browser.nix
@ -22,7 +22,6 @@
 , expat
 , libdrm
 , libxkbcommon
-, pipewire
 , gtk3
 , pango
 , cairo
@ -82,7 +81,7 @@ stdenv.mkDerivation rec {
        xorg.libxcb cups.lib dbus.lib expat libdrm
        xorg.libXcomposite xorg.libXdamage xorg.libXext
        xorg.libXfixes xorg.libXrandr libxkbcommon
-        pipewire gtk3 pango cairo gdk-pixbuf mesa
+        gtk3 pango cairo gdk-pixbuf mesa
        alsa-lib at-spi2-core xorg.libxshmfence systemd wayland
      ];
      naclHelper = lib.makeLibraryPath [
--- a/pkgs/applications/networking/cluster/cilium/default.nix
+++ b/pkgs/applications/networking/cluster/cilium/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "cilium-cli";
-  version = "0.16.4";
+  version = "0.16.3";

  src = fetchFromGitHub {
    owner = "cilium";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-fhTjYhRCtJu18AGYF6hiTdRMEdlNO+DmDwh2hZBXzPk=";
+    hash = "sha256-WD0CUPl9Qkalhog2IbefMkiLiVZFW59X21sYH4hUqZs=";
  };

  vendorHash = null;
@ -37,12 +37,11 @@ buildGoModule rec {
      --zsh <($out/bin/cilium completion zsh)
  '';

-  meta = {
-    changelog = "https://github.com/cilium/cilium-cli/releases/tag/v${version}";
+  meta = with lib; {
    description = "CLI to install, manage & troubleshoot Kubernetes clusters running Cilium";
-    license = lib.licenses.asl20;
+    license = licenses.asl20;
    homepage = "https://www.cilium.io/";
-    maintainers = with lib.maintainers; [ bryanasdev000 humancalico qjoly superherointj ];
+    maintainers = with maintainers; [ humancalico bryanasdev000 qjoly ];
    mainProgram = "cilium";
  };
 }
--- a/pkgs/applications/networking/cluster/fn-cli/default.nix
+++ b/pkgs/applications/networking/cluster/fn-cli/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "fn";
-  version = "0.6.31";
+  version = "0.6.30";

  src = fetchFromGitHub {
    owner = "fnproject";
    repo = "cli";
    rev = version;
-    hash = "sha256-tL5mygomRdxHdWUAp6umMOhyKq/ZFcjn+5wZcqD2mVA=";
+    hash = "sha256-1j0Hd/SYoBhelCIFUFxkByczWSYFXjTE9TVH9E3Km+Y=";
  };

  vendorHash = null;
--- a/pkgs/applications/networking/cluster/kubebuilder/default.nix
+++ b/pkgs/applications/networking/cluster/kubebuilder/default.nix
@ -12,16 +12,16 @@

 buildGoModule rec {
  pname = "kubebuilder";
-  version = "3.14.1";
+  version = "3.14.0";

  src = fetchFromGitHub {
    owner = "kubernetes-sigs";
    repo = "kubebuilder";
    rev = "v${version}";
-    hash = "sha256-TMKixwZonYGPXIqOtgnuilbH7BaIRyqJU6uKtp9ANKM=";
+    hash = "sha256-em+I2YICcqljaaNQ+zOAnOZ552elmV6Ywbfla8buwaY=";
  };

-  vendorHash = "sha256-Hl01dFSffYv59zensKTjXWLXxwfkQYAO5xadlc5iBJY=";
+  vendorHash = "sha256-iBwhpVs9u5AQAvmzb69SaewdYHmmaV19Bstd0Tux9CA=";

  subPackages = ["cmd"];

--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@ -6,7 +6,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "flexget";
-  version = "3.11.27";
+  version = "3.11.25";
  pyproject = true;

  # Fetch from GitHub in order to use `requirements.in`
@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "Flexget";
    repo = "Flexget";
    rev = "refs/tags/v${version}";
-    hash = "sha256-0ENBUOH+/pe4OsVQ6cu1xLTPPHtUMNARQGVyxOk60X0=";
+    hash = "sha256-bvCogSBB990LIkk273EMTlqNN303JKr5WCI8g7hLU9Q=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "signalbackup-tools";
-  version = "20240328-1";
+  version = "20240320";

  src = fetchFromGitHub {
    owner = "bepaald";
    repo = pname;
    rev = version;
-    hash = "sha256-oEwWbTs8Orpo+qRCKVvkeJYEob8O/qkKmv/iA5JUpfQ=";
+    hash = "sha256-2H+VGVPnSHdsx62hPygWc5uz5vH6DS7AfmYSlBZuB4A=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@ -45,14 +45,14 @@ let

  pname = "slack";

-  x86_64-darwin-version = "4.37.94";
-  x86_64-darwin-sha256 = "01v7v977fq8mfsl0lipdc7ig55p2sknxzr1jmh8qxiq4f4y0rj5g";
+  x86_64-darwin-version = "4.36.140";
+  x86_64-darwin-sha256 = "0w1fxza3aglh7513znv190gsha12rk7k1ybdp4ml2pffwmm8diad";

-  x86_64-linux-version = "4.37.94";
-  x86_64-linux-sha256 = "1f1spl767ldrarvpxrayry2d0nyr22b8xacxl4g1r8raryvnyz0x";
+  x86_64-linux-version = "4.36.140";
+  x86_64-linux-sha256 = "0zahhhpcb1dxdhfmam32iqr5w3pspzbmcdv53ciqfnbkmwzkc3xr";

-  aarch64-darwin-version = "4.37.94";
-  aarch64-darwin-sha256 = "0gh45gvlbjzxh0fn24z15glxqih5lggam8w6kpawsxgivkw6rjcc";
+  aarch64-darwin-version = "4.36.140";
+  aarch64-darwin-sha256 = "118mzkpk431dcm61gkbj5m4sdxkwnk6fvmxg9f96xiv6n22n7pnx";

  version = {
    x86_64-darwin = x86_64-darwin-version;
--- a/pkgs/applications/science/misc/colmap/default.nix
+++ b/pkgs/applications/science/misc/colmap/default.nix
@ -1,9 +1,7 @@
 { mkDerivation, lib, fetchFromGitHub, cmake, boost179, ceres-solver, eigen,
  freeimage, glog, libGLU, glew, qtbase,
-  autoAddDriverRunpath,
  config,
-  cudaSupport ? config.cudaSupport, cudaPackages
-}:
+  cudaSupport ? config.cudaSupport, cudaPackages }:

 assert cudaSupport -> cudaPackages != { };

@ -39,7 +37,7 @@ mkDerivation rec {
  nativeBuildInputs = [
    cmake
  ] ++ lib.optionals cudaSupport [
-    autoAddDriverRunpath
+    cudaPackages.autoAddDriverRunpath
  ];

  meta = with lib; {
--- a/pkgs/applications/virtualization/tart/default.nix
+++ b/pkgs/applications/virtualization/tart/default.nix
@ -10,11 +10,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "tart";
-  version = "2.7.2";
+  version = "2.6.0";

  src = fetchurl {
      url = "https://github.com/cirruslabs/tart/releases/download/${finalAttrs.version}/tart-arm64.tar.gz";
-      hash = "sha256-Z/LZ8g1/FYT7Jh943tFxN8L5HeNf0CVz1VEJj+2fCd8=";
+      hash = "sha256-QtVqgmjYpLAhFibW1DIVWNYiOjHB1X/YY6zRVB+1soA=";
  };
  sourceRoot = ".";

--- a/pkgs/build-support/agda/default.nix
+++ b/pkgs/build-support/agda/default.nix
@ -2,28 +2,14 @@

 { stdenv, lib, self, Agda, runCommand, makeWrapper, writeText, ghcWithPackages, nixosTests }:

+with lib.strings;
+
 let
-  inherit (lib)
-    attrValues
-    elem
-    filter
-    filterAttrs
-    isAttrs
-    isList
-    platforms
-    ;
-
-  inherit (lib.strings)
-    concatMapStrings
-    concatMapStringsSep
-    optionalString
-    ;
-
  withPackages' = {
    pkgs,
    ghc ? ghcWithPackages (p: with p; [ ieee754 ])
  }: let
-    pkgs' = if isList pkgs then pkgs else pkgs self;
+    pkgs' = if builtins.isList pkgs then pkgs else pkgs self;
    library-file = writeText "libraries" ''
      ${(concatMapStringsSep "\n" (p: "${p}/${p.libraryFile}") pkgs')}
    '';
@ -37,7 +23,7 @@ let
      inherit withPackages;
      tests = {
        inherit (nixosTests) agda;
-        allPackages = withPackages (filter self.lib.isUnbrokenAgdaPackage (attrValues self));
+        allPackages = withPackages (lib.filter self.lib.isUnbrokenAgdaPackage (lib.attrValues self));
      };
    };
    inherit (Agda) meta;
@ -49,7 +35,7 @@ let
    ln -s ${Agda}/bin/agda-mode $out/bin/agda-mode
    '';

-  withPackages = arg: if isAttrs arg then withPackages' arg else withPackages' { pkgs = arg; };
+  withPackages = arg: if builtins.isAttrs arg then withPackages' arg else withPackages' { pkgs = arg; };

  extensions = [
    "agda"
@ -76,7 +62,7 @@ let
    , extraExtensions ? []
    , ...
    }: let
-      agdaWithArgs = withPackages (filter (p: p ? isAgdaDerivation) buildInputs);
+      agdaWithArgs = withPackages (builtins.filter (p: p ? isAgdaDerivation) buildInputs);
      includePathArgs = concatMapStrings (path: "-i" + path + " ") (includePaths ++ [(dirOf everythingFile)]);
    in
      {
@ -105,13 +91,13 @@ let
        # darwin, it seems that there is no standard such locale; luckily,
        # the referenced issue doesn't seem to surface on darwin. Hence let's
        # set this only on non-darwin.
-        LC_ALL = optionalString (!stdenv.isDarwin) "C.UTF-8";
+        LC_ALL = lib.optionalString (!stdenv.isDarwin) "C.UTF-8";

-        meta = if meta.broken or false then meta // { hydraPlatforms = platforms.none; } else meta;
+        meta = if meta.broken or false then meta // { hydraPlatforms = lib.platforms.none; } else meta;

        # Retrieve all packages from the finished package set that have the current package as a dependency and build them
-        passthru.tests =
-          filterAttrs (name: pkg: self.lib.isUnbrokenAgdaPackage pkg && elem pname (map (pkg: pkg.pname) pkg.buildInputs)) self;
+        passthru.tests = with builtins;
+          lib.filterAttrs (name: pkg: self.lib.isUnbrokenAgdaPackage pkg && elem pname (map (pkg: pkg.pname) pkg.buildInputs)) self;
      };
 in
 {
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@ -35,7 +35,7 @@

 # Note: the hardening flags are part of the bintools-wrapper, rather than
 # the cc-wrapper, because a few of them are handled by the linker.
-, defaultHardeningFlags ? [
+, defaultHardeningFlags ? with stdenvNoCC; [
    "bindnow"
    "format"
    "fortify"
@ -44,7 +44,7 @@
    "relro"
    "stackprotector"
    "strictoverflow"
-  ] ++ lib.optional (with stdenvNoCC;
+  ] ++ lib.optional (
    # Musl-based platforms will keep "pie", other platforms will not.
    # If you change this, make sure to update section `{#sec-hardening-in-nixpkgs}`
    # in the nixpkgs manual to inform users about the defaults.
@ -59,30 +59,15 @@
 , postLinkSignHook ? null, signingUtils ? null
 }:

+with lib;
+
 assert nativeTools -> !propagateDoc && nativePrefix != "";
-assert !nativeTools -> bintools != null && coreutils != null && gnugrep != null;
+assert !nativeTools ->
+  bintools != null && coreutils != null && gnugrep != null;
 assert !(nativeLibc && noLibc);
 assert (noLibc || nativeLibc) == (libc == null);

 let
-  inherit (lib)
-    attrByPath
-    concatStringsSep
-    getBin
-    getDev
-    getLib
-    getName
-    getVersion
-    hasSuffix
-    optional
-    optionalAttrs
-    optionals
-    optionalString
-    platforms
-    removePrefix
-    replaceStrings
-    ;
-
  stdenv = stdenvNoCC;
  inherit (stdenv) hostPlatform targetPlatform;

@ -90,18 +75,18 @@ let
  #
  # TODO(@Ericson2314) Make unconditional, or optional but always true by
  # default.
-  targetPrefix = optionalString (targetPlatform != hostPlatform)
+  targetPrefix = lib.optionalString (targetPlatform != hostPlatform)
                                        (targetPlatform.config + "-");

-  bintoolsVersion = getVersion bintools;
-  bintoolsName = removePrefix targetPrefix (getName bintools);
+  bintoolsVersion = lib.getVersion bintools;
+  bintoolsName = lib.removePrefix targetPrefix (lib.getName bintools);

-  libc_bin = optionalString (libc != null) (getBin libc);
-  libc_dev = optionalString (libc != null) (getDev libc);
-  libc_lib = optionalString (libc != null) (getLib libc);
-  bintools_bin = optionalString (!nativeTools) (getBin bintools);
+  libc_bin = lib.optionalString (libc != null) (getBin libc);
+  libc_dev = lib.optionalString (libc != null) (getDev libc);
+  libc_lib = lib.optionalString (libc != null) (getLib libc);
+  bintools_bin = lib.optionalString (!nativeTools) (getBin bintools);
  # The wrapper scripts use 'cat' and 'grep', so we may need coreutils.
-  coreutils_bin = optionalString (!nativeTools) (getBin coreutils);
+  coreutils_bin = lib.optionalString (!nativeTools) (getBin coreutils);

  # See description in cc-wrapper.
  suffixSalt = replaceStrings ["-" "."] ["_" "_"] targetPlatform.config;
@ -129,11 +114,11 @@ let
    else if targetPlatform.isLoongArch64              then "${sharedLibraryLoader}/lib/ld-linux-loongarch*.so.1"
    else if targetPlatform.isDarwin                   then "/usr/lib/dyld"
    else if targetPlatform.isFreeBSD                  then "/libexec/ld-elf.so.1"
-    else if hasSuffix "pc-gnu" targetPlatform.config then "ld.so.1"
+    else if lib.hasSuffix "pc-gnu" targetPlatform.config then "ld.so.1"
    else "";

  expand-response-params =
-    optionalString (buildPackages ? stdenv && buildPackages.stdenv.hasCC && buildPackages.stdenv.cc != "/dev/null")
+    lib.optionalString (buildPackages ? stdenv && buildPackages.stdenv.hasCC && buildPackages.stdenv.cc != "/dev/null")
    (import ../expand-response-params { inherit (buildPackages) stdenv; });

 in
@ -141,7 +126,7 @@ in
 stdenv.mkDerivation {
  pname = targetPrefix
    + (if name != "" then name else "${bintoolsName}-wrapper");
-  version = optionalString (bintools != null) bintoolsVersion;
+  version = lib.optionalString (bintools != null) bintoolsVersion;

  preferLocalBuild = true;

@ -211,7 +196,7 @@ stdenv.mkDerivation {
    # as it must have both the GNU assembler from cctools (installed as `gas`)
    # and the Clang integrated assembler (installed as `as`).
    # See pkgs/os-specific/darwin/binutils/default.nix for details.
-    + optionalString wrapGas ''
+    + lib.optionalString wrapGas ''
      if [ -e $ldPath/${targetPrefix}gas ]; then
        ln -s $ldPath/${targetPrefix}gas $out/bin/${targetPrefix}gas
      fi
@ -288,7 +273,7 @@ stdenv.mkDerivation {

        ${if targetPlatform.isDarwin then ''
          printf "export LD_DYLD_PATH=%q\n" "$dynamicLinker" >> $out/nix-support/setup-hook
-        '' else optionalString (sharedLibraryLoader != null) ''
+        '' else lib.optionalString (sharedLibraryLoader != null) ''
          if [ -e ${sharedLibraryLoader}/lib/32/ld-linux.so.2 ]; then
            echo ${sharedLibraryLoader}/lib/32/ld-linux.so.2 > $out/nix-support/dynamic-linker-m32
          fi
@ -305,7 +290,7 @@ stdenv.mkDerivation {
    # install the wrapper, you get tools like objdump (same for any
    # binaries of libc).
    + optionalString (!nativeTools) ''
-      printWords ${bintools_bin} ${optionalString (libc != null) libc_bin} > $out/nix-support/propagated-user-env-packages
+      printWords ${bintools_bin} ${lib.optionalString (libc != null) libc_bin} > $out/nix-support/propagated-user-env-packages
    ''

    ##
@ -421,7 +406,7 @@ stdenv.mkDerivation {
    # for substitution in utils.bash
    expandResponseParams = "${expand-response-params}/bin/expand-response-params";
    shell = getBin shell + shell.shellPath or "";
-    gnugrep_bin = optionalString (!nativeTools) gnugrep;
+    gnugrep_bin = lib.optionalString (!nativeTools) gnugrep;
    wrapperName = "BINTOOLS_WRAPPER";
    inherit dynamicLinker targetPrefix suffixSalt coreutils_bin;
    inherit bintools_bin libc_bin libc_dev libc_lib;
@ -429,13 +414,13 @@ stdenv.mkDerivation {
  };

  meta =
-    let bintools_ = optionalAttrs (bintools != null) bintools; in
-    (optionalAttrs (bintools_ ? meta) (removeAttrs bintools.meta ["priority"])) //
+    let bintools_ = lib.optionalAttrs (bintools != null) bintools; in
+    (lib.optionalAttrs (bintools_ ? meta) (removeAttrs bintools.meta ["priority"])) //
    { description =
-        attrByPath ["meta" "description"] "System binary utilities" bintools_
+        lib.attrByPath ["meta" "description"] "System binary utilities" bintools_
        + " (wrapper script)";
      priority = 10;
  } // optionalAttrs useMacosReexportHack {
-    platforms = platforms.darwin;
+    platforms = lib.platforms.darwin;
  };
 }
--- a/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
+++ b/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
@ -31,20 +31,10 @@

 assert (pname != null || version != null) -> (name == null && pname != null); # You must declare either a name or pname + version (preferred).

+with builtins;
 let
-  inherit (lib)
-    concatLines
-    concatStringsSep
-    escapeShellArgs
-    filter
-    optionalString
-    splitString
-    ;
-
-  inherit (lib.attrsets) removeAttrs;
-
  pname = if args ? name && args.name != null then args.name else args.pname;
-  versionStr = optionalString (version != null) ("-" + version);
+  versionStr = lib.optionalString (version != null) ("-" + version);
  name = pname + versionStr;

  buildFHSEnv = callPackage ./buildFHSEnv.nix { };
@ -126,10 +116,10 @@ let
    exec ${run} "$@"
  '';

-  indentLines = str: concatLines (map (s: "  " + s) (filter (s: s != "") (splitString "\n" str)));
+  indentLines = str: lib.concatLines (map (s: "  " + s) (filter (s: s != "") (lib.splitString "\n" str)));
  bwrapCmd = { initArgs ? "" }: ''
    ${extraPreBwrapCmds}
-    ignored=(/nix /dev /proc /etc ${optionalString privateTmp "/tmp"})
+    ignored=(/nix /dev /proc /etc ${lib.optionalString privateTmp "/tmp"})
    ro_mounts=()
    symlinks=()
    etc_ignored=()
@ -174,7 +164,7 @@ let
    fi

    # link selected etc entries from the actual root
-    for i in ${escapeShellArgs etcBindEntries}; do
+    for i in ${lib.escapeShellArgs etcBindEntries}; do
      if [[ "''${etc_ignored[@]}" =~ "$i" ]]; then
        continue
      fi
@ -205,7 +195,7 @@ let
      x11_args+=(--ro-bind-try "$local_socket" "$local_socket")
    fi

-    ${optionalString privateTmp ''
+    ${lib.optionalString privateTmp ''
    # sddm places XAUTHORITY in /tmp
    if [[ "$XAUTHORITY" == /tmp/* ]]; then
      x11_args+=(--ro-bind-try "$XAUTHORITY" "$XAUTHORITY")
@ -230,15 +220,15 @@ let
      --dev-bind /dev /dev
      --proc /proc
      --chdir "$(pwd)"
-      ${optionalString unshareUser "--unshare-user"}
-      ${optionalString unshareIpc "--unshare-ipc"}
-      ${optionalString unsharePid "--unshare-pid"}
-      ${optionalString unshareNet "--unshare-net"}
-      ${optionalString unshareUts "--unshare-uts"}
-      ${optionalString unshareCgroup "--unshare-cgroup"}
-      ${optionalString dieWithParent "--die-with-parent"}
+      ${lib.optionalString unshareUser "--unshare-user"}
+      ${lib.optionalString unshareIpc "--unshare-ipc"}
+      ${lib.optionalString unsharePid "--unshare-pid"}
+      ${lib.optionalString unshareNet "--unshare-net"}
+      ${lib.optionalString unshareUts "--unshare-uts"}
+      ${lib.optionalString unshareCgroup "--unshare-cgroup"}
+      ${lib.optionalString dieWithParent "--die-with-parent"}
      --ro-bind /nix /nix
-      ${optionalString privateTmp "--tmpfs /tmp"}
+      ${lib.optionalString privateTmp "--tmpfs /tmp"}
      # Our glibc will look for the cache in its own path in `/nix/store`.
      # As such, we need a cache to exist there, because pressure-vessel
      # depends on the existence of an ld cache. However, adding one
@ -252,7 +242,7 @@ let
      --symlink /etc/ld.so.cache ${glibc}/etc/ld.so.cache \
      --ro-bind ${glibc}/etc/rpc ${glibc}/etc/rpc \
      --remount-ro ${glibc}/etc \
-  '' + optionalString (stdenv.isx86_64 && stdenv.isLinux) (indentLines ''
+  '' + lib.optionalString (stdenv.isx86_64 && stdenv.isLinux) (indentLines ''
      --tmpfs ${pkgsi686Linux.glibc}/etc \
      --symlink /etc/ld.so.conf ${pkgsi686Linux.glibc}/etc/ld.so.conf \
      --symlink /etc/ld.so.cache ${pkgsi686Linux.glibc}/etc/ld.so.cache \
--- a/pkgs/build-support/coq/default.nix
+++ b/pkgs/build-support/coq/default.nix
@ -1,33 +1,10 @@
 { lib, stdenv, coqPackages, coq, which, fetchzip }@args:
-
+let lib = import ./extra-lib.nix {inherit (args) lib;}; in
+with builtins; with lib;
 let
-  lib = import ./extra-lib.nix {
-    inherit (args) lib;
-  };
-
-  inherit (lib)
-    concatStringsSep
-    flip
-    foldl
-    isFunction
-    isString
-    optional
-    optionalAttrs
-    optionals
-    optionalString
-    pred
-    remove
-    switch
-    versions
-    ;
-
-  inherit (lib.attrsets) removeAttrs;
-  inherit (lib.strings) match;
-
  isGitHubDomain = d: match "^github.*" d != null;
  isGitLabDomain = d: match "^gitlab.*" d != null;
 in
-
 { pname,
  version ? null,
  fetcher ? null,
--- a/pkgs/build-support/coq/extra-lib.nix
+++ b/pkgs/build-support/coq/extra-lib.nix
@ -1,25 +1,5 @@
 { lib }:
-
-let
-  inherit (lib)
-    all
-    concatStringsSep
-    findFirst
-    flip
-    getAttr
-    head
-    isFunction
-    length
-    recursiveUpdate
-    splitVersion
-    tail
-    take
-    versionAtLeast
-    versionOlder
-    zipListsWith
-    ;
-in
-recursiveUpdate lib (rec {
+with builtins; with lib; recursiveUpdate lib (rec {

  versions =
    let
--- a/pkgs/build-support/coq/meta-fetch/default.nix
+++ b/pkgs/build-support/coq/meta-fetch/default.nix
@ -1,33 +1,8 @@
 { lib, stdenv, fetchzip }@args:
-
+let lib' = lib; in
+let lib = import ../extra-lib.nix {lib = lib';}; in
+with builtins; with lib;
 let
-  lib = import ../extra-lib.nix {
-    inherit (args) lib;
-  };
-
-  inherit (lib)
-    attrNames
-    fakeSha256
-    filter
-    findFirst
-    head
-    isAttrs
-    isPath
-    isString
-    last
-    length
-    optionalAttrs
-    pathExists
-    pred
-    sort
-    switch
-    switch-if
-    versionAtLeast
-    versions
-    ;
-
-  inherit (lib.strings) match split;
-
  default-fetcher = {domain ? "github.com", owner ? "", repo, rev, name ? "source", sha256 ? null, ...}@args:
    let ext = if args?sha256 then "zip" else "tar.gz";
        fmt = if args?sha256 then "zip" else "tarball";
@ -42,7 +17,7 @@ let
          { cond = (match "(www.)?mpi-sws.org" domain) != null;
            out = "https://www.mpi-sws.org/~${owner}/${repo}/download/${repo}-${rev}.${ext}";}
        ] (throw "meta-fetch: no fetcher found for domain ${domain} on ${rev}");
-        fetch = x: if args?sha256 then fetchzip (x // { inherit sha256; }) else builtins.fetchTarball x;
+        fetch = x: if args?sha256 then fetchzip (x // { inherit sha256; }) else fetchTarball x;
    in fetch { inherit url ; };
 in
 {
@ -63,12 +38,11 @@ switch arg [
  { case = isNull;       out = { version = "broken"; src = ""; broken = true; }; }
  { case = isPathString; out = { version = "dev"; src = arg; }; }
  { case = pred.union isVersion isShortVersion;
-    out = let
-      v = if isVersion arg then arg else shortVersion arg;
-      given-sha256 = release.${v}.sha256 or "";
-      sha256 = if given-sha256 == "" then fakeSha256 else given-sha256;
-      rv = release.${v} // { inherit sha256; };
-    in
+    out = let v = if isVersion arg then arg else shortVersion arg; in
+      let
+        given-sha256 = release.${v}.sha256 or "";
+        sha256 = if given-sha256 == "" then lib.fakeSha256 else given-sha256;
+        rv = release.${v} // { inherit sha256; }; in
      {
        version = rv.version or v;
        src = rv.src or fetcher (location // { rev = releaseRev v; } // rv);
--- a/pkgs/build-support/fetchrepoproject/default.nix
+++ b/pkgs/build-support/fetchrepoproject/default.nix
@ -9,14 +9,9 @@
 assert repoRepoRev != "" -> repoRepoURL != "";
 assert createMirror -> !useArchive;

-let
-  inherit (lib)
-    concatMapStringsSep
-    concatStringsSep
-    fetchers
-    optionalString
-    ;
+with lib;

+let
  extraRepoInitFlags = [
    (optionalString (repoRepoURL != "") "--repo-url=${repoRepoURL}")
    (optionalString (repoRepoRev != "") "--repo-branch=${repoRepoRev}")
--- a/pkgs/build-support/fetchsourcehut/default.nix
+++ b/pkgs/build-support/fetchsourcehut/default.nix
@ -1,14 +1,6 @@
 { fetchgit, fetchhg, fetchzip, lib }:

-let
-  inherit (lib)
-    assertOneOf
-    makeOverridable
-    optionalString
-    ;
-in
-
-makeOverridable (
+lib.makeOverridable (
 { owner
 , repo, rev
 , domain ? "sr.ht"
@ -18,7 +10,9 @@ makeOverridable (
 , ... # For hash agility
 } @ args:

-assert (assertOneOf "vc" vc [ "hg" "git" ]);
+with lib;
+
+assert (lib.assertOneOf "vc" vc [ "hg" "git" ]);

 let
  urlFor = resource: "https://${resource}.${domain}/${owner}/${repo}";
--- a/pkgs/build-support/nix-gitignore/default.nix
+++ b/pkgs/build-support/nix-gitignore/default.nix
@ -7,32 +7,9 @@
 # - zero or more directories. For example, "a/**/b" matches "a/b",
 # - "a/x/b", "a/x/y/b" and so on.

+with builtins;
+
 let
-  inherit (builtins) filterSource;
-
-  inherit (lib)
-    concatStringsSep
-    elemAt
-    filter
-    head
-    isList
-    length
-    optionals
-    optionalString
-    pathExists
-    readFile
-    removePrefix
-    replaceStrings
-    stringLength
-    sub
-    substring
-    toList
-    trace
-    ;
-
-
-  inherit (lib.strings) match split typeOf;
-
  debug = a: trace a a;
  last = l: elemAt l ((length l) - 1);
 in rec {
@ -40,7 +17,7 @@ in rec {
  filterPattern = patterns: root:
    (name: _type:
      let
-        relPath = removePrefix ((toString root) + "/") name;
+        relPath = lib.removePrefix ((toString root) + "/") name;
        matches = pair: (match (head pair) relPath) != null;
        matched = map (pair: [(matches pair) (last pair)]) patterns;
      in
@ -68,7 +45,7 @@ in rec {
          escs = "\\*?";
          splitString =
            let recurse = str : [(substring 0 1 str)] ++
-                                 (optionals (str != "") (recurse (substring 1 (stringLength(str)) str) ));
+                                 (lib.optionals (str != "") (recurse (substring 1 (stringLength(str)) str) ));
            in str : recurse str;
          chars = s: filter (c: c != "" && !isList c) (splitString s);
          escape = s: map (c: "\\" + c) (chars s);
@ -89,7 +66,7 @@ in rec {
      handleSlashPrefix = l:
        let
          split = (match "^(/?)(.*)" l);
-          findSlash = l: optionalString ((match ".+/.+" l) == null) l;
+          findSlash = l: lib.optionalString ((match ".+/.+" l) == null) l;
          hasSlash = mapAroundCharclass findSlash l != l;
        in
          (if (elemAt split 0) == "/" || hasSlash
@ -117,12 +94,12 @@ in rec {
  gitignoreCompileIgnore = file_str_patterns: root:
    let
      onPath = f: a: if typeOf a == "path" then f a else a;
-      str_patterns = map (onPath readFile) (toList file_str_patterns);
+      str_patterns = map (onPath readFile) (lib.toList file_str_patterns);
    in concatStringsSep "\n" str_patterns;

-  gitignoreFilterPure = predicate: patterns: root: name: type:
+  gitignoreFilterPure = filter: patterns: root: name: type:
    gitignoreFilter (gitignoreCompileIgnore patterns root) root name type
-    && predicate name type;
+    && filter name type;

  # This is a very hacky way of programming this!
  # A better way would be to reuse existing filtering by making multiple gitignore functions per each root.
@ -168,23 +145,23 @@ in rec {
      '');

  withGitignoreFile = patterns: root:
-    toList patterns ++ [ ".git" ] ++ [(root + "/.gitignore")];
+    lib.toList patterns ++ [ ".git" ] ++ [(root + "/.gitignore")];

  withRecursiveGitignoreFile = patterns: root:
-    toList patterns ++ [ ".git" ] ++ [(compileRecursiveGitignore root)];
+    lib.toList patterns ++ [ ".git" ] ++ [(compileRecursiveGitignore root)];

  # filterSource derivatives

-  gitignoreFilterSourcePure = predicate: patterns: root:
-    filterSource (gitignoreFilterPure predicate patterns root) root;
+  gitignoreFilterSourcePure = filter: patterns: root:
+    filterSource (gitignoreFilterPure filter patterns root) root;

-  gitignoreFilterSource = predicate: patterns: root:
-    gitignoreFilterSourcePure predicate (withGitignoreFile patterns root) root;
+  gitignoreFilterSource = filter: patterns: root:
+    gitignoreFilterSourcePure filter (withGitignoreFile patterns root) root;

-  gitignoreFilterRecursiveSource = predicate: patterns: root:
-    gitignoreFilterSourcePure predicate (withRecursiveGitignoreFile patterns root) root;
+  gitignoreFilterRecursiveSource = filter: patterns: root:
+    gitignoreFilterSourcePure filter (withRecursiveGitignoreFile patterns root) root;

-  # "Predicate"-less alternatives
+  # "Filter"-less alternatives

  gitignoreSourcePure = gitignoreFilterSourcePure (_: _: true);
  gitignoreSource = patterns: let type = typeOf patterns; in
--- a/pkgs/build-support/pkg-config-wrapper/default.nix
+++ b/pkgs/build-support/pkg-config-wrapper/default.nix
@ -10,17 +10,9 @@
 , extraPackages ? [], extraBuildCommands ? ""
 }:

-let
-  inherit (lib)
-    attrByPath
-    getBin
-    optional
-    optionalAttrs
-    optionals
-    optionalString
-    replaceStrings
-    ;
+with lib;

+let
  stdenv = stdenvNoCC;
  inherit (stdenv) hostPlatform targetPlatform;

@ -28,7 +20,7 @@ let
  #
  # TODO(@Ericson2314) Make unconditional, or optional but always true by
  # default.
-  targetPrefix = optionalString (targetPlatform != hostPlatform)
+  targetPrefix = lib.optionalString (targetPlatform != hostPlatform)
                                        (targetPlatform.config + "-");

  # See description in cc-wrapper.
@ -57,7 +49,7 @@ stdenv.mkDerivation {
  dontUnpack = true;

  # Additional flags passed to pkg-config.
-  addFlags = optional stdenv.targetPlatform.isStatic "--static";
+  addFlags = lib.optional stdenv.targetPlatform.isStatic "--static";

  installPhase =
    ''
@ -127,10 +119,10 @@ stdenv.mkDerivation {
  };

  meta =
-    let pkg-config_ = optionalAttrs (pkg-config != null) pkg-config; in
-    (optionalAttrs (pkg-config_ ? meta) (removeAttrs pkg-config.meta ["priority"])) //
+    let pkg-config_ = lib.optionalAttrs (pkg-config != null) pkg-config; in
+    (lib.optionalAttrs (pkg-config_ ? meta) (removeAttrs pkg-config.meta ["priority"])) //
    { description =
-        attrByPath ["meta" "description"] "pkg-config" pkg-config_
+        lib.attrByPath ["meta" "description"] "pkg-config" pkg-config_
        + " (wrapper script)";
      priority = 10;
  };
--- a/pkgs/build-support/release/default.nix
+++ b/pkgs/build-support/release/default.nix
@ -1,24 +1,6 @@
 { lib, pkgs }:

-let
-  inherit (lib) optionalString;
-
-  inherit (pkgs)
-    autoconf
-    automake
-    checkinstall
-    clang-analyzer
-    cov-build
-    enableGCOVInstrumentation
-    lcov
-    libtool
-    makeGCOVReport
-    runCommand
-    stdenv
-    vmTools
-    xz
-    ;
-in
+with pkgs;

 rec {

@ -109,7 +91,7 @@ rec {
      dontConfigure = true;
      dontBuild = true;

-      patchPhase = optionalString isNixOS ''
+      patchPhase = lib.optionalString isNixOS ''
        touch .update-on-nixos-rebuild
      '';

--- a/pkgs/build-support/replace-dependency.nix
+++ b/pkgs/build-support/replace-dependency.nix
@ -19,20 +19,9 @@
 # (and all of its dependencies) without rebuilding further.
 { drv, oldDependency, newDependency, verbose ? true }:

-let
-  inherit (lib)
-    any
-    attrNames
-    concatStringsSep
-    elem
-    filter
-    filterAttrs
-    listToAttrs
-    mapAttrsToList
-    stringLength
-    substring
-    ;
+with lib;

+let
  warn = if verbose then builtins.trace else (x: y: y);
  references = import (runCommandLocal "references.nix" { exportReferencesGraph = [ "graph" drv ]; } ''
    (echo {
@ -65,7 +54,7 @@ let
    (drv: { name = discard (toString drv);
            value = elem oldStorepath (referencesOf drv) ||
                    any dependsOnOld (referencesOf drv);
-          }) (attrNames references));
+          }) (builtins.attrNames references));

  dependsOnOld = drv: dependsOnOldMemo.${discard (toString drv)};

@ -85,9 +74,9 @@ let
  rewriteMemo = listToAttrs (map
    (drv: { name = discard (toString drv);
            value = rewriteHashes (builtins.storePath drv)
-              (filterAttrs (n: v: elem (builtins.storePath (discard (toString n))) (referencesOf drv)) rewriteMemo);
+              (filterAttrs (n: v: builtins.elem (builtins.storePath (discard (toString n))) (referencesOf drv)) rewriteMemo);
          })
-    (filter dependsOnOld (attrNames references))) // rewrittenDeps;
+    (filter dependsOnOld (builtins.attrNames references))) // rewrittenDeps;

  drvHash = discard (toString drv);
 in assert (stringLength (drvName (toString oldDependency)) == stringLength (drvName (toString newDependency)));
--- a/pkgs/build-support/setup-hooks/auto-patchelf.sh
+++ b/pkgs/build-support/setup-hooks/auto-patchelf.sh
@ -88,21 +88,22 @@ autoPatchelf() {
        --extra-args "${patchelfFlagsArray[@]}"
 }

-autoPatchelfPostFixup() {
-    # XXX: This should ultimately use fixupOutputHooks but we currently don't have
-    # a way to enforce the order. If we have $runtimeDependencies set, the setup
-    # hook of patchelf is going to ruin everything and strip out those additional
-    # RPATHs.
-    #
-    # So what we do here is basically run in postFixup and emulate the same
-    # behaviour as fixupOutputHooks because the setup hook for patchelf is run in
-    # fixupOutput and the postFixup hook runs later.
-    if [[ -z "${dontAutoPatchelf-}" ]]; then
+# XXX: This should ultimately use fixupOutputHooks but we currently don't have
+# a way to enforce the order. If we have $runtimeDependencies set, the setup
+# hook of patchelf is going to ruin everything and strip out those additional
+# RPATHs.
+#
+# So what we do here is basically run in postFixup and emulate the same
+# behaviour as fixupOutputHooks because the setup hook for patchelf is run in
+# fixupOutput and the postFixup hook runs later.
+#
+# shellcheck disable=SC2016
+# (Expressions don't expand in single quotes, use double quotes for that.)
+postFixupHooks+=('
+    if [ -z "${dontAutoPatchelf-}" ]; then
        autoPatchelf -- $(for output in $(getAllOutputNames); do
            [ -e "${!output}" ] || continue
            echo "${!output}"
        done)
    fi
-}
-
-postFixupHooks+=(autoPatchelfPostFixup)
+')
--- a/pkgs/build-support/setup-hooks/make-binary-wrapper/make-binary-wrapper.sh
+++ b/pkgs/build-support/setup-hooks/make-binary-wrapper/make-binary-wrapper.sh
@ -19,7 +19,6 @@ assertExecutable() {
 #                          (if unset or empty, defaults to EXECUTABLE)
 # --inherit-argv0        : the executable inherits argv0 from the wrapper.
 #                          (use instead of --argv0 '$0')
-# --resolve-argv0        : if argv0 doesn't include a / character, resolve it against PATH
 # --set          VAR VAL : add VAR with value VAL to the executable's environment
 # --set-default  VAR VAL : like --set, but only adds VAR if not already set in
 #                          the environment
@ -88,7 +87,6 @@ makeDocumentedCWrapper() {
 makeCWrapper() {
    local argv0 inherit_argv0 n params cmd main flagsBefore flagsAfter flags executable length
    local uses_prefix uses_suffix uses_assert uses_assert_success uses_stdio uses_asprintf
-    local resolve_path
    executable=$(escapeStringLiteral "$1")
    params=("$@")
    length=${#params[*]}
@ -171,12 +169,6 @@ makeCWrapper() {
                # Whichever comes last of --argv0 and --inherit-argv0 wins
                inherit_argv0=1
            ;;
-            --resolve-argv0)
-                # this gets processed after other argv0 flags
-                uses_stdio=1
-                uses_string=1
-                resolve_argv0=1
-            ;;
            *) # Using an error macro, we will make sure the compiler gives an understandable error message
                main="$main#error makeCWrapper: Unknown argument ${p}"$'\n'
            ;;
@ -184,7 +176,6 @@ makeCWrapper() {
    done
    [[ -z "$flagsBefore" && -z "$flagsAfter" ]] || main="$main"${main:+$'\n'}$(addFlags "$flagsBefore" "$flagsAfter")$'\n'$'\n'
    [ -z "$inherit_argv0" ] && main="${main}argv[0] = \"${argv0:-${executable}}\";"$'\n'
-    [ -z "$resolve_argv0" ] || main="${main}argv[0] = resolve_argv0(argv[0]);"$'\n'
    main="${main}return execv(\"${executable}\", argv);"$'\n'

    [ -z "$uses_asprintf" ] || printf '%s\n' "#define _GNU_SOURCE         /* See feature_test_macros(7) */"
@ -192,11 +183,9 @@ makeCWrapper() {
    printf '%s\n' "#include <stdlib.h>"
    [ -z "$uses_assert" ]   || printf '%s\n' "#include <assert.h>"
    [ -z "$uses_stdio" ]    || printf '%s\n' "#include <stdio.h>"
-    [ -z "$uses_string" ]   || printf '%s\n' "#include <string.h>"
    [ -z "$uses_assert_success" ] || printf '\n%s\n' "#define assert_success(e) do { if ((e) < 0) { perror(#e); abort(); } } while (0)"
    [ -z "$uses_prefix" ] || printf '\n%s\n' "$(setEnvPrefixFn)"
    [ -z "$uses_suffix" ] || printf '\n%s\n' "$(setEnvSuffixFn)"
-    [ -z "$resolve_argv0" ] || printf '\n%s\n' "$(resolveArgv0Fn)"
    printf '\n%s' "int main(int argc, char **argv) {"
    printf '\n%s' "$(indent4 "$main")"
    printf '\n%s\n' "}"
@ -349,41 +338,6 @@ void set_env_suffix(char *env, char *sep, char *suffix) {
 "
 }

-resolveArgv0Fn() {
-  printf '%s' "\
-char *resolve_argv0(char *argv0) {
-  if (strchr(argv0, '/') != NULL) {
-    return argv0;
-  }
-  char *path = getenv(\"PATH\");
-  if (path == NULL) {
-    return argv0;
-  }
-  char *path_copy = strdup(path);
-  if (path_copy == NULL) {
-    return argv0;
-  }
-  char *dir = strtok(path_copy, \":\");
-  while (dir != NULL) {
-    char *candidate = malloc(strlen(dir) + strlen(argv0) + 2);
-    if (candidate == NULL) {
-      free(path_copy);
-      return argv0;
-    }
-    sprintf(candidate, \"%s/%s\", dir, argv0);
-    if (access(candidate, X_OK) == 0) {
-      free(path_copy);
-      return candidate;
-    }
-    free(candidate);
-    dir = strtok(NULL, \":\");
-  }
-  free(path_copy);
-  return argv0;
-}
-"
-}
-
 # Embed a C string which shows up as readable text in the compiled binary wrapper,
 # giving instructions for recreating the wrapper.
 # Keep in sync with makeBinaryWrapper.extractCmd
--- a/pkgs/build-support/setup-hooks/make-wrapper.sh
+++ b/pkgs/build-support/setup-hooks/make-wrapper.sh
@ -15,7 +15,6 @@ assertExecutable() {
 #                          (if unset or empty, defaults to EXECUTABLE)
 # --inherit-argv0        : the executable inherits argv0 from the wrapper.
 #                          (use instead of --argv0 '$0')
-# --resolve-argv0        : if argv0 doesn't include a / character, resolve it against PATH
 # --set          VAR VAL : add VAR with value VAL to the executable's environment
 # --set-default  VAR VAL : like --set, but only adds VAR if not already set in
 #                          the environment
@ -178,9 +177,6 @@ makeShellWrapper() {
        elif [[ "$p" == "--inherit-argv0" ]]; then
            # Whichever comes last of --argv0 and --inherit-argv0 wins
            argv0='$0'
-        elif [[ "$p" == "--resolve-argv0" ]]; then
-            # this is noop in shell wrappers, since bash will always resolve $0
-            resolve_argv0=1
        else
            die "makeWrapper doesn't understand the arg $p"
        fi
--- a/pkgs/build-support/vm/test.nix
+++ b/pkgs/build-support/vm/test.nix
@ -1,21 +1,5 @@
-let
-  pkgs = import ../../.. { };
-
-  inherit (pkgs)
-    hello
-    patchelf
-    pcmanfm
-    stdenv
-    ;
-
-  inherit (pkgs.vmTools)
-    buildRPM
-    diskImages
-    makeImageTestScript
-    runInLinuxImage
-    runInLinuxVM
-    ;
-in
+with import ../../.. { };
+with vmTools;

 {

--- a/pkgs/build-support/writers/scripts.nix
+++ b/pkgs/build-support/writers/scripts.nix
@ -1,14 +1,4 @@
-{
-  buildPackages,
-  gixy,
-  lib,
-  libiconv,
-  makeBinaryWrapper,
-  mkNugetDeps,
-  mkNugetSource,
-  pkgs,
-  stdenv,
-}:
+{ pkgs, buildPackages, lib, stdenv, libiconv, mkNugetDeps, mkNugetSource, gixy }:
 let
  inherit (lib)
    concatMapStringsSep
@ -16,6 +6,7 @@ let
    escapeShellArg
    last
    optionalString
+    stringLength
    strings
    types
    ;
@ -27,285 +18,137 @@ rec {
  # Examples:
  #   writeBash = makeScriptWriter { interpreter = "${pkgs.bash}/bin/bash"; }
  #   makeScriptWriter { interpreter = "${pkgs.dash}/bin/dash"; } "hello" "echo hello world"
-  makeScriptWriter = { interpreter, check ? "", makeWrapperArgs ? [], }: nameOrPath: content:
+  makeScriptWriter = { interpreter, check ? "" }: nameOrPath: content:
    assert (types.path.check nameOrPath) || (builtins.match "([0-9A-Za-z._])[0-9A-Za-z._-]*" nameOrPath != null);
    assert (types.path.check content) || (types.str.check content);
    let
-      nameIsPath = types.path.check nameOrPath;
      name = last (builtins.split "/" nameOrPath);
-      path = if nameIsPath then nameOrPath else "/bin/${name}";
-      # The inner derivation which creates the executable under $out/bin (never at $out directly)
-      # This is required in order to support wrapping, as wrapped programs consist of at least two files: the executable and the wrapper.
-      inner =
-        pkgs.runCommandLocal name (
-          {
-            inherit makeWrapperArgs;
-            nativeBuildInputs = [
-              makeBinaryWrapper
-            ];
-            meta.mainProgram = name;
-          }
-          // (
-            if (types.str.check content) then {
-              inherit content interpreter;
-              passAsFile = [ "content" ];
-            } else {
-              inherit interpreter;
-              contentPath = content;
-            }
-          )
-        )
-        ''
-          # On darwin a script cannot be used as an interpreter in a shebang but
-          # there doesn't seem to be a limit to the size of shebang and multiple
-          # arguments to the interpreter are allowed.
-          if [[ -n "${toString pkgs.stdenvNoCC.isDarwin}" ]] && isScript $interpreter
-          then
-            wrapperInterpreterLine=$(head -1 "$interpreter" | tail -c+3)
-            # Get first word from the line (note: xargs echo remove leading spaces)
-            wrapperInterpreter=$(echo "$wrapperInterpreterLine" | xargs echo | cut -d " " -f1)
+    in

-            if isScript $wrapperInterpreter
-            then
-              echo "error: passed interpreter ($interpreter) is a script which has another script ($wrapperInterpreter) as an interpreter, which is not supported."
-              exit 1
-            fi
+    pkgs.runCommandLocal name (
+      lib.optionalAttrs (nameOrPath == "/bin/${name}") {
+        meta.mainProgram = name;
+      }
+      // (
+        if (types.str.check content) then {
+          inherit content interpreter;
+          passAsFile = [ "content" ];
+        } else {
+          inherit interpreter;
+          contentPath = content;
+        }
+      )
+    )
+    ''
+      # On darwin a script cannot be used as an interpreter in a shebang but
+      # there doesn't seem to be a limit to the size of shebang and multiple
+      # arguments to the interpreter are allowed.
+      if [[ -n "${toString pkgs.stdenvNoCC.isDarwin}" ]] && isScript $interpreter
+      then
+        wrapperInterpreterLine=$(head -1 "$interpreter" | tail -c+3)
+        # Get first word from the line (note: xargs echo remove leading spaces)
+        wrapperInterpreter=$(echo "$wrapperInterpreterLine" | xargs echo | cut -d " " -f1)

-            # This should work as long as wrapperInterpreter is a shell, which is
-            # the case for programs wrapped with makeWrapper, like
-            # python3.withPackages etc.
-            interpreterLine="$wrapperInterpreterLine $interpreter"
-          else
-            interpreterLine=$interpreter
-          fi
+        if isScript $wrapperInterpreter
+        then
+          echo "error: passed interpreter ($interpreter) is a script which has another script ($wrapperInterpreter) as an interpreter, which is not supported."
+          exit 1
+        fi

-          echo "#! $interpreterLine" > $out
-          cat "$contentPath" >> $out
-          ${optionalString (check != "") ''
-            ${check} $out
-          ''}
-          chmod +x $out
-
-          # Relocate executable
-          # Wrap it if makeWrapperArgs are specified
-          mv $out tmp
-            mkdir -p $out/$(dirname "${path}")
-            mv tmp $out/${path}
-          if [ -n "''${makeWrapperArgs+''${makeWrapperArgs[@]}}" ]; then
-              wrapProgram $out/${path} ''${makeWrapperArgs[@]}
-          fi
-        '';
-      in
-        if nameIsPath
-        then inner
-        # In case nameOrPath is a name, the user intends the executable to be located at $out.
-        # This is achieved by creating a separate derivation containing a symlink at $out linking to ${inner}/bin/${name}.
-        # This breaks the override pattern.
-        # In case this turns out to be a problem, we can still add more magic
-        else pkgs.runCommandLocal name {} ''
-          ln -s ${inner}/bin/${name} $out
-        '';
+        # This should work as long as wrapperInterpreter is a shell, which is
+        # the case for programs wrapped with makeWrapper, like
+        # python3.withPackages etc.
+        interpreterLine="$wrapperInterpreterLine $interpreter"
+      else
+        interpreterLine=$interpreter
+      fi

+      echo "#! $interpreterLine" > $out
+      cat "$contentPath" >> $out
+      ${optionalString (check != "") ''
+        ${check} $out
+      ''}
+      chmod +x $out
+      ${optionalString (types.path.check nameOrPath) ''
+        mv $out tmp
+        mkdir -p $out/$(dirname "${nameOrPath}")
+        mv tmp $out/${nameOrPath}
+      ''}
+    '';

  # Base implementation for compiled executables.
  # Takes a compile script, which in turn takes the name as an argument.
  #
  # Examples:
  #   writeSimpleC = makeBinWriter { compileScript = name: "gcc -o $out $contentPath"; }
-  makeBinWriter = { compileScript, strip ? true, makeWrapperArgs ? [] }: nameOrPath: content:
+  makeBinWriter = { compileScript, strip ? true }: nameOrPath: content:
    assert (types.path.check nameOrPath) || (builtins.match "([0-9A-Za-z._])[0-9A-Za-z._-]*" nameOrPath != null);
    assert (types.path.check content) || (types.str.check content);
    let
-      nameIsPath = types.path.check nameOrPath;
      name = last (builtins.split "/" nameOrPath);
-      path = if nameIsPath then nameOrPath else "/bin/${name}";
-      # The inner derivation which creates the executable under $out/bin (never at $out directly)
-      # This is required in order to support wrapping, as wrapped programs consist of at least two files: the executable and the wrapper.
-      inner =
-        pkgs.runCommandLocal name (
-          {
-            inherit makeWrapperArgs;
-            nativeBuildInputs = [
-              makeBinaryWrapper
-            ];
-            meta.mainProgram = name;
-          }
-          // (
-            if (types.str.check content) then {
-            inherit content;
-            passAsFile = [ "content" ];
-          } else {
-            contentPath = content;
-                  }
-          )
-        )
-        ''
-          ${compileScript}
-          ${lib.optionalString strip
-              "${lib.getBin buildPackages.bintools-unwrapped}/bin/${buildPackages.bintools-unwrapped.targetPrefix}strip -S $out"}
-          # Sometimes binaries produced for darwin (e. g. by GHC) won't be valid
-          # mach-o executables from the get-go, but need to be corrected somehow
-          # which is done by fixupPhase.
-          ${lib.optionalString pkgs.stdenvNoCC.hostPlatform.isDarwin "fixupPhase"}
-          mv $out tmp
-          mkdir -p $out/$(dirname "${path}")
-          mv tmp $out/${path}
-          if [ -n "''${makeWrapperArgs+''${makeWrapperArgs[@]}}" ]; then
-            wrapProgram $out/${path} ''${makeWrapperArgs[@]}
-          fi
-        '';
    in
-      if nameIsPath
-      then inner
-      # In case nameOrPath is a name, the user intends the executable to be located at $out.
-      # This is achieved by creating a separate derivation containing a symlink at $out linking to ${inner}/bin/${name}.
-      # This breaks the override pattern.
-      # In case this turns out to be a problem, we can still add more magic
-      else pkgs.runCommandLocal name {} ''
-        ln -s ${inner}/bin/${name} $out
-      '';
+    pkgs.runCommand name ((if (types.str.check content) then {
+      inherit content;
+      passAsFile = [ "content" ];
+    } else {
+      contentPath = content;
+    }) // lib.optionalAttrs (nameOrPath == "/bin/${name}") {
+      meta.mainProgram = name;
+    }) ''
+      ${compileScript}
+      ${lib.optionalString strip
+          "${lib.getBin buildPackages.bintools-unwrapped}/bin/${buildPackages.bintools-unwrapped.targetPrefix}strip -S $out"}
+      # Sometimes binaries produced for darwin (e. g. by GHC) won't be valid
+      # mach-o executables from the get-go, but need to be corrected somehow
+      # which is done by fixupPhase.
+      ${lib.optionalString pkgs.stdenvNoCC.hostPlatform.isDarwin "fixupPhase"}
+      ${optionalString (types.path.check nameOrPath) ''
+        mv $out tmp
+        mkdir -p $out/$(dirname "${nameOrPath}")
+        mv tmp $out/${nameOrPath}
+      ''}
+    '';

  # Like writeScript but the first line is a shebang to bash
  #
-  # Can be called with or without extra arguments.
-  #
-  # Example without arguments:
+  # Example:
  #   writeBash "example" ''
  #     echo hello world
  #   ''
-  #
-  # Example with arguments:
-  #   writeBash "example"
-  #     {
-  #       makeWrapperArgs = [
-  #         "--prefix" "PATH" ":" "${pkgs.hello}/bin"
-  #       ];
-  #     }
-  #     ''
-  #       hello
-  #     ''
-  writeBash = name: argsOrScript:
-    if lib.isAttrs argsOrScript && ! lib.isDerivation argsOrScript
-    then makeScriptWriter (argsOrScript // { interpreter = "${lib.getExe pkgs.bash}"; }) name
-    else makeScriptWriter { interpreter = "${lib.getExe pkgs.bash}"; } name argsOrScript;
+  writeBash = makeScriptWriter {
+    interpreter = "${lib.getExe pkgs.bash}";
+  };

  # Like writeScriptBin but the first line is a shebang to bash
-  #
-  # Can be called with or without extra arguments.
-  #
-  # Example without arguments:
-  #   writeBashBin "example" ''
-  #     echo hello world
-  #   ''
-  #
-  # Example with arguments:
-  #  writeBashBin "example"
-  #    {
-  #      makeWrapperArgs = [
-  #        "--prefix", "PATH", ":", "${pkgs.hello}/bin",
-  #      ];
-  #    }
-  #    ''
-  #      hello
-  #    ''
  writeBashBin = name:
    writeBash "/bin/${name}";

  # Like writeScript but the first line is a shebang to dash
  #
-  # Can be called with or without extra arguments.
-  #
-  # Example without arguments:
+  # Example:
  #   writeDash "example" ''
  #     echo hello world
  #   ''
-  #
-  # Example with arguments:
-  #   writeDash "example"
-  #     {
-  #       makeWrapperArgs = [
-  #         "--prefix", "PATH", ":", "${pkgs.hello}/bin",
-  #       ];
-  #     }
-  #     ''
-  #       hello
-  #     ''
-  writeDash = name: argsOrScript:
-    if lib.isAttrs argsOrScript && ! lib.isDerivation argsOrScript
-    then makeScriptWriter (argsOrScript // { interpreter = "${lib.getExe pkgs.dash}"; }) name
-    else makeScriptWriter { interpreter = "${lib.getExe pkgs.dash}"; } name argsOrScript;
+  writeDash = makeScriptWriter {
+    interpreter = "${lib.getExe pkgs.dash}";
+  };

  # Like writeScriptBin but the first line is a shebang to dash
-  #
-  # Can be called with or without extra arguments.
-  #
-  # Example without arguments:
-  #   writeDashBin "example" ''
-  #     echo hello world
-  #   ''
-  #
-  # Example with arguments:
-  #  writeDashBin "example"
-  #    {
-  #      makeWrapperArgs = [
-  #        "--prefix", "PATH", ":", "${pkgs.hello}/bin",
-  #      ];
-  #    }
-  #    ''
-  #      hello
-  #    ''
  writeDashBin = name:
    writeDash "/bin/${name}";

  # Like writeScript but the first line is a shebang to fish
  #
-  # Can be called with or without extra arguments.
-  #
-  # Example without arguments:
+  # Example:
  #   writeFish "example" ''
  #     echo hello world
  #   ''
-  #
-  # Example with arguments:
-  #   writeFish "example"
-  #     {
-  #       makeWrapperArgs = [
-  #         "--prefix", "PATH", ":", "${pkgs.hello}/bin",
-  #       ];
-  #     }
-  #     ''
-  #       hello
-  #     ''
-  writeFish = name: argsOrScript:
-    if lib.isAttrs argsOrScript && ! lib.isDerivation argsOrScript
-    then makeScriptWriter (argsOrScript // {
-      interpreter = "${lib.getExe pkgs.fish} --no-config";
-      check = "${lib.getExe pkgs.fish} --no-config --no-execute";  # syntax check only
-    }) name
-    else makeScriptWriter {
-      interpreter = "${lib.getExe pkgs.fish} --no-config";
-      check = "${lib.getExe pkgs.fish} --no-config --no-execute";  # syntax check only
-    } name argsOrScript;
+  writeFish = makeScriptWriter {
+    interpreter = "${lib.getExe pkgs.fish} --no-config";
+    check = "${lib.getExe pkgs.fish} --no-config --no-execute";  # syntax check only
+  };

  # Like writeScriptBin but the first line is a shebang to fish
-  #
-  # Can be called with or without extra arguments.
-  #
-  # Example without arguments:
-  #   writeFishBin "example" ''
-  #     echo hello world
-  #   ''
-  #
-  # Example with arguments:
-  #   writeFishBin "example"
-  #     {
-  #       makeWrapperArgs = [
-  #         "--prefix", "PATH", ":", "${pkgs.hello}/bin",
-  #       ];
-  #     }
-  #     ''
-  #       hello
-  #     ''
  writeFishBin = name:
    writeFish "/bin/${name}";

@ -319,12 +162,11 @@ rec {
  #     main = launchMissiles
  #   '';
  writeHaskell = name: {
+    libraries ? [],
    ghc ? pkgs.ghc,
    ghcArgs ? [],
-    libraries ? [],
-    makeWrapperArgs ? [],
-    strip ? true,
    threadedRuntime ? true,
+    strip ? true
  }:
    let
      appendIfNotSet = el: list: if elem el list then list else list ++ [ el ];
@ -336,7 +178,7 @@ rec {
        ${(ghc.withPackages (_: libraries ))}/bin/ghc ${lib.escapeShellArgs ghcArgs'} tmp.hs
        mv tmp $out
      '';
-      inherit makeWrapperArgs strip;
+      inherit strip;
    } name;

  # writeHaskellBin takes the same arguments as writeHaskell but outputs a directory (like writeScriptBin)
@ -345,72 +187,36 @@ rec {

  # Like writeScript but the first line is a shebang to nu
  #
-  # Can be called with or without extra arguments.
-  #
-  # Example without arguments:
+  # Example:
  #   writeNu "example" ''
  #     echo hello world
  #   ''
-  #
-  # Example with arguments:
-  #   writeNu "example"
-  #     {
-  #       makeWrapperArgs = [
-  #         "--prefix", "PATH", ":", "${pkgs.hello}/bin",
-  #       ];
-  #     }
-  #     ''
-  #       hello
-  #     ''
-  writeNu = name: argsOrScript:
-    if lib.isAttrs argsOrScript && ! lib.isDerivation argsOrScript
-    then makeScriptWriter (argsOrScript // { interpreter = "${lib.getExe pkgs.nushell} --no-config-file"; }) name
-    else makeScriptWriter { interpreter = "${lib.getExe pkgs.nushell} --no-config-file"; } name argsOrScript;
-
+  writeNu = makeScriptWriter {
+    interpreter = "${lib.getExe pkgs.nushell} --no-config-file";
+  };

  # Like writeScriptBin but the first line is a shebang to nu
-  #
-  # Can be called with or without extra arguments.
-  #
-  # Example without arguments:
-  #   writeNuBin "example" ''
-  #     echo hello world
-  #   ''
-  #
-  # Example with arguments:
-  #   writeNuBin "example"
-  #     {
-  #       makeWrapperArgs = [
-  #         "--prefix", "PATH", ":", "${pkgs.hello}/bin",
-  #       ];
-  #     }
-  #    ''
-  #      hello
-  #    ''
  writeNuBin = name:
    writeNu "/bin/${name}";

  # makeRubyWriter takes ruby and compatible rubyPackages and produces ruby script writer,
  # If any libraries are specified, ruby.withPackages is used as interpreter, otherwise the "bare" ruby is used.
-  makeRubyWriter = ruby: rubyPackages: buildRubyPackages: name: { libraries ? [], ... } @ args:
-  makeScriptWriter (
-    (builtins.removeAttrs args ["libraries"])
-    // {
-      interpreter =
-        if libraries == []
-        then "${ruby}/bin/ruby"
-        else "${(ruby.withPackages (ps: libraries))}/bin/ruby";
-      # Rubocop doesn't seem to like running in this fashion.
-      #check = (writeDash "rubocop.sh" ''
-      #  exec ${lib.getExe buildRubyPackages.rubocop} "$1"
-      #'');
-    }
-  ) name;
+  makeRubyWriter = ruby: rubyPackages: buildRubyPackages: name: { libraries ? [], }:
+  makeScriptWriter {
+    interpreter =
+      if libraries == []
+      then "${ruby}/bin/ruby"
+      else "${(ruby.withPackages (ps: libraries))}/bin/ruby";
+    # Rubocop doesnt seem to like running in this fashion.
+    #check = (writeDash "rubocop.sh" ''
+    #  exec ${lib.getExe buildRubyPackages.rubocop} "$1"
+    #'');
+  } name;

  # Like writeScript but the first line is a shebang to ruby
  #
  # Example:
-  #   writeRuby "example" { libraries = [ pkgs.rubyPackages.git ]; } ''
+  #   writeRuby "example" ''
  #    puts "hello world"
  #   ''
  writeRuby = makeRubyWriter pkgs.ruby pkgs.rubyPackages buildPackages.rubyPackages;
@ -421,20 +227,17 @@ rec {
  # makeLuaWriter takes lua and compatible luaPackages and produces lua script writer,
  # which validates the script with luacheck at build time. If any libraries are specified,
  # lua.withPackages is used as interpreter, otherwise the "bare" lua is used.
-  makeLuaWriter = lua: luaPackages: buildLuaPackages: name: { libraries ? [], ... } @ args:
-  makeScriptWriter (
-    (builtins.removeAttrs args ["libraries"])
-    // {
-      interpreter = lua.interpreter;
-        # if libraries == []
-        # then lua.interpreter
-        # else (lua.withPackages (ps: libraries)).interpreter
-        # This should support packages! I just cant figure out why some dependency collision happens whenever I try to run this.
-      check = (writeDash "luacheck.sh" ''
-        exec ${buildLuaPackages.luacheck}/bin/luacheck "$1"
-      '');
-    }
-   ) name;
+  makeLuaWriter = lua: luaPackages: buildLuaPackages: name: { libraries ? [], }:
+  makeScriptWriter {
+    interpreter = lua.interpreter;
+      # if libraries == []
+      # then lua.interpreter
+      # else (lua.withPackages (ps: libraries)).interpreter
+      # This should support packages! I just cant figure out why some dependency collision happens whenever I try to run this.
+    check = (writeDash "luacheck.sh" ''
+      exec ${buildLuaPackages.luacheck}/bin/luacheck "$1"
+    '');
+  } name;

  # writeLua takes a name an attributeset with libraries and some lua source code and
  # returns an executable (should also work with luajit)
@ -462,10 +265,9 @@ rec {
    writeLua "/bin/${name}";

  writeRust = name: {
-    makeWrapperArgs ? [],
-    rustc ? pkgs.rustc,
-    rustcArgs ? [],
-    strip ? true,
+      rustc ? pkgs.rustc,
+      rustcArgs ? [],
+      strip ? true
  }:
  let
    darwinArgs = lib.optionals stdenv.isDarwin [ "-L${lib.getLib libiconv}/lib" ];
@ -475,7 +277,7 @@ rec {
        cp "$contentPath" tmp.rs
        PATH=${lib.makeBinPath [pkgs.gcc]} ${rustc}/bin/rustc ${lib.escapeShellArgs rustcArgs} ${lib.escapeShellArgs darwinArgs} -o "$out" tmp.rs
      '';
-      inherit makeWrapperArgs strip;
+      inherit strip;
    } name;

  writeRustBin = name:
@ -535,13 +337,10 @@ rec {
  #     use boolean;
  #     print "Howdy!\n" if true;
  #   ''
-  writePerl = name: { libraries ? [], ... } @ args:
-    makeScriptWriter (
-      (builtins.removeAttrs args ["libraries"])
-      // {
-        interpreter = "${lib.getExe (pkgs.perl.withPackages (p: libraries))}";
-      }
-    ) name;
+  writePerl = name: { libraries ? [] }:
+    makeScriptWriter {
+      interpreter = "${lib.getExe (pkgs.perl.withPackages (p: libraries))}";
+    } name;

  # writePerlBin takes the same arguments as writePerl but outputs a directory (like writeScriptBin)
  writePerlBin = name:
@ -550,27 +349,22 @@ rec {
  # makePythonWriter takes python and compatible pythonPackages and produces python script writer,
  # which validates the script with flake8 at build time. If any libraries are specified,
  # python.withPackages is used as interpreter, otherwise the "bare" python is used.
-  makePythonWriter = python: pythonPackages: buildPythonPackages: name: { libraries ? [], flakeIgnore ? [], ... } @ args:
+  makePythonWriter = python: pythonPackages: buildPythonPackages: name: { libraries ? [], flakeIgnore ? [] }:
  let
    ignoreAttribute = optionalString (flakeIgnore != []) "--ignore ${concatMapStringsSep "," escapeShellArg flakeIgnore}";
  in
-  makeScriptWriter
-    (
-      (builtins.removeAttrs args ["libraries" "flakeIgnore"])
-      // {
-        interpreter =
-          if pythonPackages != pkgs.pypy2Packages || pythonPackages != pkgs.pypy3Packages then
-            if libraries == []
-            then python.interpreter
-            else (python.withPackages (ps: libraries)).interpreter
-          else python.interpreter
-        ;
-        check = optionalString python.isPy3k (writeDash "pythoncheck.sh" ''
-          exec ${buildPythonPackages.flake8}/bin/flake8 --show-source ${ignoreAttribute} "$1"
-        '');
-      }
-    )
-    name;
+  makeScriptWriter {
+    interpreter =
+      if pythonPackages != pkgs.pypy2Packages || pythonPackages != pkgs.pypy3Packages then
+        if libraries == []
+        then python.interpreter
+        else (python.withPackages (ps: libraries)).interpreter
+      else python.interpreter
+    ;
+    check = optionalString python.isPy3k (writeDash "pythoncheck.sh" ''
+      exec ${buildPythonPackages.flake8}/bin/flake8 --show-source ${ignoreAttribute} "$1"
+    '');
+  } name;

  # writePyPy2 takes a name an attributeset with libraries and some pypy2 sourcecode and
  # returns an executable
@ -627,7 +421,7 @@ rec {
    writePyPy3 "/bin/${name}";


-  makeFSharpWriter = { dotnet-sdk ? pkgs.dotnet-sdk, fsi-flags ? "", libraries ? _: [], ... } @ args: nameOrPath:
+  makeFSharpWriter = { dotnet-sdk ? pkgs.dotnet-sdk, fsi-flags ? "", libraries ? _: [] }: nameOrPath:
  let
    fname = last (builtins.split "/" nameOrPath);
    path = if strings.hasSuffix ".fsx" nameOrPath then nameOrPath else "${nameOrPath}.fsx";
@ -648,12 +442,9 @@ rec {
      ${lib.getExe dotnet-sdk} fsi --quiet --nologo --readline- ${fsi-flags} "$@" < "$script"
    '';

-  in content: makeScriptWriter (
-    (builtins.removeAttrs args ["dotnet-sdk" "fsi-flags" "libraries"])
-    // {
-      interpreter = fsi;
-    }
-  ) path
+  in content: makeScriptWriter {
+    interpreter = fsi;
+  } path
  ''
    #i "nuget: ${nuget-source}/lib"
    ${ content }
@ -665,4 +456,5 @@ rec {

  writeFSharpBin = name:
    writeFSharp "/bin/${name}";
+
 }
--- a/pkgs/build-support/writers/test.nix
+++ b/pkgs/build-support/writers/test.nix
@ -1,8 +1,13 @@
-{ haskellPackages
+{ glib
+, haskellPackages
 , lib
 , nodePackages
 , perlPackages
+, pypy2Packages
 , python3Packages
+, pypy3Packages
+, luaPackages
+, rubyPackages
 , runCommand
 , testers
 , writers
@ -11,38 +16,8 @@

 # If you are reading this, you can test these writers by running: nix-build . -A tests.writers

+with writers;
 let
-  inherit (lib) getExe recurseIntoAttrs;
-
-  inherit (writers)
-    makeFSharpWriter
-    writeBash
-    writeBashBin
-    writeDash
-    writeDashBin
-    writeFish
-    writeFishBin
-    writeFSharp
-    writeHaskell
-    writeHaskellBin
-    writeJS
-    writeJSBin
-    writeJSON
-    writeLua
-    writeNu
-    writePerl
-    writePerlBin
-    writePyPy3
-    writePython3
-    writePython3Bin
-    writeRuby
-    writeRust
-    writeRustBin
-    writeText
-    writeTOML
-    writeYAML
-    ;
-
  expectSuccess = test:
    runCommand "run-${test.name}" {} ''
      if [[ "$(${test})" != success ]]; then
@ -55,7 +30,7 @@ let

  expectSuccessBin = test:
    runCommand "run-${test.name}" {} ''
-      if [[ "$(${getExe test})" != success ]]; then
+      if [[ "$(${lib.getExe test})" != success ]]; then
        echo 'test ${test.name} failed'
        exit 1
      fi
@ -69,8 +44,8 @@ let
    in
    testers.testEqualContents { expected = expectedFile; actual = file; assertion = "${file.name} matches"; };
 in
-recurseIntoAttrs {
-  bin = recurseIntoAttrs {
+lib.recurseIntoAttrs {
+  bin = lib.recurseIntoAttrs {
    bash = expectSuccessBin (writeBashBin "test-writers-bash-bin" ''
     if [[ "test" == "test" ]]; then echo "success"; fi
    '');
@ -170,7 +145,7 @@ recurseIntoAttrs {
    #'');
  };

-  simple = recurseIntoAttrs {
+  simple = lib.recurseIntoAttrs {
    bash = expectSuccess (writeBash "test-writers-bash" ''
     if [[ "test" == "test" ]]; then echo "success"; fi
    '');
@ -295,7 +270,7 @@ recurseIntoAttrs {
    '');
  };

-  path = recurseIntoAttrs {
+  path = lib.recurseIntoAttrs {
    bash = expectSuccess (writeBash "test-writers-bash-path" (writeText "test" ''
      if [[ "test" == "test" ]]; then echo "success"; fi
    ''));
@ -335,85 +310,4 @@ recurseIntoAttrs {
      expected = "hello: world\n";
    };
  };
-
-  wrapping = recurseIntoAttrs {
-    bash-bin = expectSuccessBin (
-      writeBashBin "test-writers-wrapping-bash-bin"
-        {
-          makeWrapperArgs = [
-            "--set"
-            "ThaigerSprint"
-            "Thailand"
-          ];
-        }
-        ''
-          if [[ "$ThaigerSprint" == "Thailand" ]]; then
-            echo "success"
-          fi
-        ''
-    );
-
-    bash = expectSuccess (
-      writeBash "test-writers-wrapping-bash"
-        {
-          makeWrapperArgs = [
-            "--set"
-            "ThaigerSprint"
-            "Thailand"
-          ];
-        }
-        ''
-          if [[ "$ThaigerSprint" == "Thailand" ]]; then
-            echo "success"
-          fi
-        ''
-    );
-
-    python = expectSuccess (
-      writePython3 "test-writers-wrapping-python"
-        {
-          makeWrapperArgs = [
-            "--set"
-            "ThaigerSprint"
-            "Thailand"
-          ];
-        }
-        ''
-          import os
-
-          if os.environ.get("ThaigerSprint") == "Thailand":
-              print("success")
-        ''
-    );
-
-    rust = expectSuccess (
-      writeRust "test-writers-wrapping-rust"
-        {
-          makeWrapperArgs = [
-            "--set"
-            "ThaigerSprint"
-            "Thailand"
-          ];
-        }
-        ''
-          fn main(){
-            if std::env::var("ThaigerSprint").unwrap() == "Thailand" {
-              println!("success")
-            }
-          }
-        ''
-    );
-
-    no-empty-wrapper = let
-      bin = writeBashBin "bin" { makeWrapperArgs = []; } ''true'';
-    in runCommand "run-test-writers-wrapping-no-empty-wrapper" {} ''
-      ls -A ${bin}/bin
-      if [ $(ls -A ${bin}/bin | wc -l) -eq 1 ]; then
-        touch $out
-      else
-        echo "Error: Empty wrapper was created" >&2
-        exit 1
-      fi
-    '';
-  };
 }
--- a/pkgs/by-name/ba/bat/package.nix
+++ b/pkgs/by-name/ba/bat/package.nix
@ -52,8 +52,6 @@ rustPlatform.buildRustPackage rec {
    "--skip=pager_more"
    "--skip=pager_most"
    "--skip=pager_overwrite"
-    # Fails if the filesystem performs UTF-8 validation (such as ZFS with utf8only=on)
-    "--skip=file_with_invalid_utf8_filename"
  ];

  doInstallCheck = true;
--- a/pkgs/by-name/bo/boxbuddy/package.nix
+++ b/pkgs/by-name/bo/boxbuddy/package.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "boxbuddy";
-  version = "2.2.0";
+  version = "2.1.5";

  src = fetchFromGitHub {
    owner = "Dvlv";
    repo = "BoxBuddyRS";
    rev = version;
-    hash = "sha256-Fb3Df+P2ovSVQhtDxhed/hH06UKnJY/iugt3Pi9/Jp0=";
+    hash = "sha256-XMLgUYOv2ObHqYxqPch5i0Q1/BvfDuC1Lti5FYAVmnk=";
  };

-  cargoHash = "sha256-dmBQdE4rsL8ygXOGupjtZrWuXjVAy5m1p/xJlUdUwkY=";
+  cargoHash = "sha256-zbhdGpF3TonGlvRXCWF00PhIc0k1ZO2xIMXuwYD90mY=";

  # The software assumes it is installed either in flatpak or in the home directory
  # so the xdg data path needs to be patched here
--- a/pkgs/by-name/go/go-bare/package.nix
+++ b/pkgs/by-name/go/go-bare/package.nix
@ -1,25 +0,0 @@
-{ buildGoModule, fetchFromSourcehut, lib }:
-
-buildGoModule rec {
-  pname = "go-bare";
-  version = "0-unstable-2021-04-06";
-
-  src = fetchFromSourcehut {
-    owner = "~sircmpwn";
-    repo = "go-bare";
-    rev = "ab86bc2846d997bc8760fdb0d06d4a55e746b1db";
-    hash = "sha256-SKTYDKidB1Ia3Jg4EBg5rPAtqlXAa19RY5qieS82A34=";
-  };
-
-  vendorHash = "sha256-OhJb/q1XJ/U/AvCcCXw2Ll86UKlkHGuURHS5J6aXNTs=";
-
-  subPackages = [ "cmd/gen" ];
-
-  meta = with lib; {
-    description = "An implementation of the BARE message format for Go";
-    mainProgram = "gen";
-    homepage = "https://git.sr.ht/~sircmpwn/go-bare";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ poptart ];
-  };
-}
--- a/pkgs/by-name/mi/miru/package.nix
+++ b/pkgs/by-name/mi/miru/package.nix
@ -5,12 +5,12 @@

 appimageTools.wrapType2 rec {
  pname = "miru";
-  version = "5.0.3";
+  version = "5.0.0";

  src = fetchurl {
    url = "https://github.com/ThaUnknown/miru/releases/download/v${version}/linux-Miru-${version}.AppImage";
    name = "${pname}-${version}.AppImage";
-    sha256 = "sha256-vKV1Scd+YiJMIV8EWx4udoOxTXW9NA7k/CxRVNRqrjk=";
+    sha256 = "sha256-Gp3pP973+peSr0pfUDqKQWZFiY4jdOp4tsn1336wcwY=";
  };

  extraInstallCommands =
@ -29,7 +29,7 @@ appimageTools.wrapType2 rec {

  meta = with lib; {
    description = "Stream anime torrents, real-time with no waiting for downloads";
-    homepage = "https://miru.watch";
+    homepage = "https://github.com/ThaUnknown/miru#readme";
    license = licenses.gpl3Plus;
    maintainers = [ maintainers.d4ilyrun ];
    mainProgram = "miru";
--- a/pkgs/by-name/ni/nim_lk/lock.json
+++ b/pkgs/by-name/ni/nim_lk/lock.json
@ -1,33 +1,12 @@
 {
  "depends": [
-    {
-      "method": "fetchzip",
-      "packages": [
-        "atlas"
-      ],
-      "path": "/nix/store/v015scfifr10ialyimn7xxm0rdg4dha2-source",
-      "rev": "60681b93af4c8914afbd8eae9fc9820ba4d198a0",
-      "sha256": "1kc47w20ipbdh31s1gcblcikzlvlagmmha1qw3by70fc7mgazrxf",
-      "srcDir": "src",
-      "url": "https://github.com/nim-lang/atlas/archive/60681b93af4c8914afbd8eae9fc9820ba4d198a0.tar.gz"
-    },
-    {
-      "method": "fetchzip",
-      "packages": [
-        "bigints"
-      ],
-      "path": "/nix/store/jvrm392g8adfsgf36prgwkbyd7vh5jsw-source",
-      "rev": "86ea14d31eea9275e1408ca34e6bfe9c99989a96",
-      "sha256": "15pcpmnk1bnw3k8769rjzcpg00nahyrypwbxs88jnwr4aczp99j4",
-      "srcDir": "src",
-      "url": "https://github.com/ehmry/nim-bigints/archive/86ea14d31eea9275e1408ca34e6bfe9c99989a96.tar.gz"
-    },
    {
      "method": "fetchzip",
      "packages": [
        "npeg"
      ],
      "path": "/nix/store/ffkxmjmigfs7zhhiiqm0iw2c34smyciy-source",
+      "ref": "1.2.1",
      "rev": "26d62fdc40feb84c6533956dc11d5ee9ea9b6c09",
      "sha256": "0xpzifjkfp49w76qmaylan8q181bs45anmp46l4bwr3lkrr7bpwh",
      "srcDir": "src",
@ -38,11 +17,12 @@
      "packages": [
        "preserves"
      ],
-      "path": "/nix/store/6nnn5di5vip1vladlb7z56rbw18d1y7j-source",
-      "rev": "2825bceecf33a15b9b7942db5331a32cbc39b281",
-      "sha256": "145vf46fy3wc52j6vs509fm9bi5lx7c53gskbkpcfbkv82l86dgk",
+      "path": "/nix/store/nrcpzf9hx70kry3gwhrdzcs3qicjncjh-source",
+      "ref": "20231021",
+      "rev": "edece399be70818208bf2263c30cb2bcf435bbff",
+      "sha256": "0xmw35wmw3a4lja9q4qvlvpxv3xk0hnkjg4fwfw6f3inh6zfiqki",
      "srcDir": "src",
-      "url": "https://git.syndicate-lang.org/ehmry/preserves-nim/archive/2825bceecf33a15b9b7942db5331a32cbc39b281.tar.gz"
+      "url": "https://git.syndicate-lang.org/ehmry/preserves-nim/archive/edece399be70818208bf2263c30cb2bcf435bbff.tar.gz"
    }
  ]
 }
--- a/pkgs/by-name/ni/nim_lk/package.nix
+++ b/pkgs/by-name/ni/nim_lk/package.nix
@ -8,28 +8,25 @@
 , makeWrapper
 }:

-let nim' = nim.passthru.nim;
-in buildNimPackage (finalAttrs: {
+buildNimPackage (finalAttrs: {
  pname = "nim_lk";
-  version = "20240210";
+  version = "20231031";

  src = fetchFromSourcehut {
    owner = "~ehmry";
    repo = "nim_lk";
    rev = finalAttrs.version;
-    hash = "sha256-LLOf8HNee0Mol+e7/dvu9hQUCmpaVBNggTxaAl/wV6Y=";
+    hash = "sha256-dXm3dfXAxgucek19f1KdRShOsJyELPTB32qgGSKId6A=";
  };

-  lockFile = ./lock.json;
-
  buildInputs = [ openssl ];
  nativeBuildInputs = [ makeWrapper ];

-  nimFlags = [ "--path:${nim'}/nim" ];
+  lockFile = ./lock.json;

  postFixup = ''
    wrapProgram $out/bin/nim_lk \
-      --suffix PATH : ${lib.makeBinPath [ nim' nix-prefetch nix-prefetch-git ]}
+      --suffix PATH : ${lib.makeBinPath [ nim nix-prefetch nix-prefetch-git ]}
  '';

  meta = finalAttrs.src.meta // {
--- a/pkgs/by-name/nu/nuclei-templates/package.nix
+++ b/pkgs/by-name/nu/nuclei-templates/package.nix
@ -1,35 +0,0 @@
-{ lib
-, stdenvNoCC
-, fetchFromGitHub
-}:
-
-stdenvNoCC.mkDerivation rec {
-  pname = "nuclei-templates";
-  version = "9.8.0";
-
-  src = fetchFromGitHub {
-    owner = "projectdiscovery";
-    repo = "nuclei-templates";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-1aLy8wNWMFouZRjhCSiwSq1uo20C9wN7LPxyBqK6K0k=";
-  };
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/share/nuclei-templates
-    cp -R cloud code config dns file headless helpers http javascript network ssl \
-      $out/share/nuclei-templates/
-
-    runHook postInstall
-  '';
-
-  meta = with lib; {
-    description = "Templates for the nuclei engine to find security vulnerabilities";
-    homepage = "https://github.com/projectdiscovery/nuclei-templates";
-    changelog = "https://github.com/projectdiscovery/nuclei-templates/releases/tag/v${version}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ fab ];
-    platforms = platforms.all;
-  };
-}
--- a/pkgs/by-name/of/offat/package.nix
+++ b/pkgs/by-name/of/offat/package.nix
@ -1,60 +0,0 @@
-{ lib
-, fetchFromGitHub
-, python3
-}:
-
-python3.pkgs.buildPythonApplication rec {
-  pname = "offat";
-  version = "0.16.0";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "OWASP";
-    repo = "OFFAT";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-ald+hanICvY0jTgL7GtIMiArLWazykaJAJSfzPKE4/I=";
-  };
-
-  sourceRoot = "${src.name}/src";
-
-  build-system = with python3.pkgs; [
-    poetry-core
-  ];
-
-  dependencies = with python3.pkgs; [
-    aiohttp
-    aiolimiter
-    fastapi
-    openapi-spec-validator
-    requests
-    rich
-    setuptools
-    tenacity
-  ];
-
-  passthru.optional-dependencies = {
-    api = with python3.pkgs; [
-      fastapi
-      uvicorn
-      redis
-      rq
-      python-dotenv
-    ];
-  };
-
-  # Project has no tests
-  doCheck = false;
-
-  pythonImportsCheck = [
-    "offat"
-  ];
-
-  meta = with lib; {
-    description = "Tool to test APIs for prevalent vulnerabilities";
-    homepage = "https://github.com/OWASP/OFFAT/";
-    changelog = "https://github.com/OWASP/OFFAT/releases/tag/v${version}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ fab ];
-    mainProgram = "offat";
-  };
-}
--- a/pkgs/by-name/on/onevpl-intel-gpu/package.nix
+++ b/pkgs/by-name/on/onevpl-intel-gpu/package.nix
@ -1,38 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, cmake
-, pkg-config
-, libdrm
-, libva
-}:
-
-stdenv.mkDerivation rec {
-  pname = "onevpl-intel-gpu";
-  version = "23.4.3";
-
-  outputs = [ "out" "dev" ];
-
-  src = fetchFromGitHub {
-    owner = "oneapi-src";
-    repo = "oneVPL-intel-gpu";
-    rev = "intel-onevpl-${version}";
-    sha256 = "sha256-oDwDMUq6JpRJH5nbANb7TJLW7HRYA9y0xZxEsoepx/U=";
-  };
-
-  nativeBuildInputs = [ cmake pkg-config ];
-
-  buildInputs = [ libdrm libva ];
-
-  meta = {
-    description = "oneAPI Video Processing Library Intel GPU implementation";
-    homepage = "https://github.com/oneapi-src/oneVPL-intel-gpu";
-    changelog = "https://github.com/oneapi-src/oneVPL-intel-gpu/releases/tag/${src.rev}";
-    license = [ lib.licenses.mit ];
-    platforms = lib.platforms.linux;
-    # CMake adds x86 specific compiler flags in <source>/builder/FindGlobals.cmake
-    # NOTE: https://github.com/oneapi-src/oneVPL-intel-gpu/issues/303
-    broken = !stdenv.hostPlatform.isx86;
-    maintainers = [ lib.maintainers.evanrichter ];
-  };
-}
--- a/pkgs/by-name/si/simdutf/package.nix
+++ b/pkgs/by-name/si/simdutf/package.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "simdutf";
-  version = "5.2.0";
+  version = "5.0.0";

  src = fetchFromGitHub {
    owner = "simdutf";
    repo = "simdutf";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-4yo962iiwSPW1JeQq5mLse5DJUub7AWqMDA+AdpsRBo=";
+    hash = "sha256-ZCpLSMmgZSLAlVKzXFsaENnZwQAeKbNfKkj241PM26c=";
  };

  # Fix build on darwin
--- a/pkgs/by-name/ux/uxn/package.nix
+++ b/pkgs/by-name/ux/uxn/package.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "uxn";
-  version = "unstable-2024-03-30";
+  version = "unstable-2024-03-18";

  src = fetchFromSourcehut {
    owner = "~rabbits";
    repo = "uxn";
-    rev = "fc6ec0b387723940868133fade8854ad37648881";
-    hash = "sha256-Ver8oI3IzxwF6KeZ85d3mmiCwARVoH+RZoFNCxhGFDc=";
+    rev = "250aecc920a6f12d2d5479a5230a31630dac2a1e";
+    hash = "sha256-nhKlcuhXkrhecRwVIuSf+jOmFbX0NMhmmc5pj6MCNdQ=";
  };

  outputs = [ "out" "projects" ];
--- a/pkgs/by-name/vu/vulkan-volk/package.nix
+++ b/pkgs/by-name/vu/vulkan-volk/package.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "volk";
-  version = "1.3.280.0";
+  version = "1.3.275.0";

  src = fetchFromGitHub {
    owner = "zeux";
    repo = "volk";
    rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-e4TLGRqn0taYeiRVxc9WevURjO5dsVq3RpOwZBGDknQ=";
+    hash = "sha256-uTjLgJMGN8nOVhVIl/GNhO2jXe9ebhc9vzAwCDwfuf4=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/wa/waf/package.nix
+++ b/pkgs/by-name/wa/waf/package.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "waf";
-  version = "2.0.27";
+  version = "2.0.26";

  src = fetchFromGitLab {
    owner = "ita1024";
    repo = "waf";
    rev = "waf-${finalAttrs.version}";
-    hash = "sha256-GeEoD5CHubwR4ndGk7J7czEf0hWtPQr88TqJDPqeK0s=";
+    hash = "sha256-AXDMWlwivJ0Xot6iwuIIlbV2Anz6ieghyOI9jA4yrko=";
  };

  nativeBuildInputs = [
--- a/pkgs/data/fonts/lxgw-neoxihei/default.nix
+++ b/pkgs/data/fonts/lxgw-neoxihei/default.nix
@ -5,11 +5,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "lxgw-neoxihei";
-  version = "1.120.2";
+  version = "1.120.1";

  src = fetchurl {
    url = "https://github.com/lxgw/LxgwNeoXiHei/releases/download/v${version}/LXGWNeoXiHei.ttf";
-    hash = "sha256-RN0OmNS3aSRMK19nNiqXYJ4PIAQh6u5W/+L8DCeqMcE=";
+    hash = "sha256-shzJ5y2mjvodtSHct9gm+09CludxUpR38qi9zvewjaQ=";
  };

  dontUnpack = true;
--- a/pkgs/data/misc/sing-geosite/default.nix
+++ b/pkgs/data/misc/sing-geosite/default.nix
@ -38,7 +38,6 @@ buildGoModule {
  installPhase = ''
    runHook preInstall
    install -Dm644 geosite.db $out/share/sing-box/geosite.db
-    install -Dm644 rule-set/* -t $out/share/sing-box/rule-set
    runHook postInstall
  '';

--- a/pkgs/data/misc/sing-geosite/main.go
+++ b/pkgs/data/misc/sing-geosite/main.go
@ -16,37 +16,4 @@ func main() {
 	if err != nil {
 		panic(err)
 	}
-
-	ruleSetOutput := "rule-set"
-	err = os.MkdirAll(ruleSetOutput, 0o755)
-	if err != nil {
-		panic(err)
-	}
-	for code, domains := range domainMap {
-		var headlessRule option.DefaultHeadlessRule
-		defaultRule := geosite.Compile(domains)
-		headlessRule.Domain = defaultRule.Domain
-		headlessRule.DomainSuffix = defaultRule.DomainSuffix
-		headlessRule.DomainKeyword = defaultRule.DomainKeyword
-		headlessRule.DomainRegex = defaultRule.DomainRegex
-		var plainRuleSet option.PlainRuleSet
-		plainRuleSet.Rules = []option.HeadlessRule{
-			{
-				Type:           C.RuleTypeDefault,
-				DefaultOptions: headlessRule,
-			},
-		}
-		srsPath, _ := filepath.Abs(filepath.Join(ruleSetOutput, "geosite-"+code+".srs"))
-		os.Stderr.WriteString("write " + srsPath + "\n")
-		outputRuleSet, err := os.Create(srsPath)
-		if err != nil {
-			panic(err)
-		}
-		err = srs.Write(outputRuleSet, plainRuleSet)
-		if err != nil {
-			outputRuleSet.Close()
-			panic(err)
-		}
-		outputRuleSet.Close()
-	}
 }
--- a/pkgs/data/misc/v2ray-domain-list-community/default.nix
+++ b/pkgs/data/misc/v2ray-domain-list-community/default.nix
@ -3,12 +3,12 @@
 let
  generator = pkgsBuildBuild.buildGoModule rec {
    pname = "v2ray-domain-list-community";
-    version = "20240402003241";
+    version = "20240324094850";
    src = fetchFromGitHub {
      owner = "v2fly";
      repo = "domain-list-community";
      rev = version;
-      hash = "sha256-tIQqTvrQUGjLeZL1aQiqaViZSAysUfX+QlTkhH7N3Iw=";
+      hash = "sha256-Fdb0Bk0dk0SkBmUdeBjMH8/++fDvw1GtiKCYXdVAfCc=";
    };
    vendorHash = "sha256-azvMUi8eLNoNofRa2X4SKTTiMd6aOyO6H/rOiKjkpIY=";
    meta = with lib; {
--- a/pkgs/data/themes/orchis-theme/default.nix
+++ b/pkgs/data/themes/orchis-theme/default.nix
@ -26,13 +26,13 @@ lib.checkListOfEnum "${pname}: theme tweaks" validTweaks tweaks
 stdenvNoCC.mkDerivation
 rec {
  inherit pname;
-  version = "2024-04-01";
+  version = "2023-10-20";

  src = fetchFromGitHub {
    repo = "Orchis-theme";
    owner = "vinceliuice";
    rev = version;
-    hash = "sha256-gszyUZGWlgrBTQnaz6Ws7jzfTN5KAfX5SjVwmVrP9QE=";
+    hash = "sha256-GhSzTtbuvbAuXxKNm29sJX5kXE2s2jMDB6Ww6Q7GNSo=";
  };

  nativeBuildInputs = [ gtk3 sassc ];
--- a/pkgs/desktops/gnome/misc/gnome-extensions-cli/default.nix
+++ b/pkgs/desktops/gnome/misc/gnome-extensions-cli/default.nix
@ -33,7 +33,6 @@ buildPythonApplication rec {

  pythonRelaxDeps = [
    "more-itertools"
-    "packaging"
  ];

  propagatedBuildInputs = [
--- a/pkgs/development/compilers/dotnet/combine-deps.nix
+++ b/pkgs/development/compilers/dotnet/combine-deps.nix
@ -4,22 +4,11 @@
  otherRids,
  pkgs ? import ../../../.. {}
 }:
+with pkgs.lib;
 let
  inherit (pkgs) writeText;

-  inherit (pkgs.lib)
-    concatMap
-    concatMapStringsSep
-    generators
-    optionals
-    replaceStrings
-    sortOn
-    strings
-    unique
-    ;
-
  fns = map (file: import file) list;
-
  packages = unique
    (concatMap (fn: fn { fetchNuGet = package: package; }) fns);

--- a/pkgs/development/compilers/gcc/common/builder.nix
+++ b/pkgs/development/compilers/gcc/common/builder.nix
@ -1,7 +1,6 @@
 { lib
 , stdenv
 , enableMultilib
-, targetConfig
 }:

 let
@ -197,13 +196,6 @@ originalAttrs: (stdenv.mkDerivation (finalAttrs: originalAttrs // {
    mkdir -p "$out/''${targetConfig}/lib"
    mkdir -p "''${!outputLib}/''${targetConfig}/lib"
  '' +
-  # if cross-compiling, link from $lib/lib to $lib/${targetConfig}.
-  # since native-compiles have $lib/lib as a directory (not a
-  # symlink), this ensures that in every case we can assume that
-  # $lib/lib contains the .so files
-  lib.optionalString (with stdenv; targetPlatform.config != hostPlatform.config) ''
-    ln -Ts "''${!outputLib}/''${targetConfig}/lib" $lib/lib
-  '' +
  # Make `lib64` symlinks to `lib`.
  lib.optionalString (!enableMultilib && stdenv.hostPlatform.is64bit && !stdenv.hostPlatform.isMips64n32) ''
    ln -s lib "$out/''${targetConfig}/lib64"
--- a/pkgs/development/compilers/gcc/common/libgcc.nix
+++ b/pkgs/development/compilers/gcc/common/libgcc.nix
@ -83,6 +83,10 @@ in
    lib.optionalString (!langC) ''
      rm -f $out/lib/libgcc_s.so*
    ''
+    + lib.optionalString (hostPlatform != targetPlatform) ''
+      mkdir -p $lib/lib/
+      ln -s ${targetPlatformSlash}lib $lib/lib
+    ''

    # TODO(amjoseph): remove the `libgcc_s.so` symlinks below and replace them
    # with a `-L${gccForLibs.libgcc}/lib` in cc-wrapper's
--- a/pkgs/development/compilers/gcc/default.nix
+++ b/pkgs/development/compilers/gcc/default.nix
@ -103,7 +103,6 @@ let inherit version;
    disableBootstrap = atLeast11 && !stdenv.hostPlatform.isDarwin && (atLeast12 -> !profiledCompiler);

    inherit (stdenv) buildPlatform hostPlatform targetPlatform;
-    targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;

    patches = callFile ./patches {};

@ -125,7 +124,6 @@ let inherit version;
        buildPlatform
        hostPlatform
        targetPlatform
-        targetConfig
        patches
        crossMingw
        stageNameAddon
@ -331,7 +329,7 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
    ++ optional (is7 && targetPlatform.isAarch64) "--enable-fix-cortex-a53-843419"
    ++ optional (is7 && targetPlatform.isNetBSD) "--disable-libcilkrts";

-  inherit targetConfig;
+  targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;

  buildFlags =
    # we do not yet have Nix-driven profiling
--- a/pkgs/development/compilers/gerbil/gerbil-support.nix
+++ b/pkgs/development/compilers/gerbil/gerbil-support.nix
@ -1,52 +1,11 @@
 { pkgs, lib, callPackage, ... }:

-let
-  inherit (builtins) filterSource;
+with pkgs.gerbil-support; {

-  inherit (lib)
-    commitIdFromGitRepo
-    concatStringsSep
-    elem
-    elemAt
-    hasSuffix
-    listToAttrs
-    mapAttrs
-    optionalString
-    pathExists
-    readFile
-    removeSuffix
-    substring
-    traceSeqN
-    ;
-
-  inherit (lib.strings) match;
-
-  # Implicitly calls through to this file, similar to `let .. in` or `rec`.
-  inherit (pkgs.gerbil-support)
-    callPpp
-    gerbilLoadPath
-    gerbilPackage
-    gerbilPackages-unstable
-    gerbilSkippableFiles
-    gerbilSourceFilter
-    overrideSrcIfShaDiff
-    ppaToPl
-    pppToKV
-    pppToName
-    ppplToPpa
-    prePackage-defaults
-    prePackages-unstable
-    resolve-pre-src
-    sha256-of-pre-src
-    view
-    ;
-in
-
-{
-  pppToName = ppp: removeSuffix ".nix" (baseNameOf ppp); # from pre-package path to name
+  pppToName = ppp: lib.removeSuffix ".nix" (baseNameOf ppp); # from pre-package path to name
  callPpp = ppp: callPackage ppp prePackage-defaults; # from pre-package path to pre-package
  pppToKV = ppp: { name = pppToName ppp; value = callPpp ppp; }; # from pre-package path to name
-  ppplToPpa = ppps: listToAttrs (map pppToKV ppps); # from pre-package path list to name/pre-package attr
+  ppplToPpa = ppps: builtins.listToAttrs (map pppToKV ppps); # from pre-package path list to name/pre-package attr

  prePackages-unstable =
    ppplToPpa
@ -73,37 +32,37 @@ in
    softwareName = "";
  };

-  ppaToPl = mapAttrs (_: gerbilPackage);
+  ppaToPl = builtins.mapAttrs (_: gerbilPackage);
  gerbilPackages-unstable = ppaToPl prePackages-unstable;

  resolve-pre-src = pre-src: pre-src.fun (removeAttrs pre-src ["fun"]);

  gerbilVersionFromGit = srcDir: version-path:
    let version-file = "${srcDir}/${version-path}.ss"; in
-    if pathExists version-file then
+    if builtins.pathExists version-file then
      let m =
-        match "\\(import :clan/versioning.*\\)\n\\(register-software \"([-_.A-Za-z0-9]+)\" \"([-_.A-Za-z0-9]+)\"\\) ;; ([-0-9]+)\n"
-          (readFile version-file); in
-          { version = "${elemAt m 2}-git"; git-version = elemAt m 1; }
+        builtins.match "\\(import :clan/versioning.*\\)\n\\(register-software \"([-_.A-Za-z0-9]+)\" \"([-_.A-Za-z0-9]+)\"\\) ;; ([-0-9]+)\n"
+          (builtins.readFile version-file); in
+          { version = "${builtins.elemAt m 2}-git"; git-version = builtins.elemAt m 1; }
     else { version = "0.0-git";
            git-version = let gitpath = "${srcDir}/.git"; in
-              if pathExists gitpath then commitIdFromGitRepo gitpath else "0"; };
+              if builtins.pathExists gitpath then lib.commitIdFromGitRepo gitpath else "0"; };

  gerbilSkippableFiles = [".git" ".build" ".build_outputs" "run" "result" "dep" "BLAH" "tmp.nix"];

  gerbilSourceFilter = path: type:
    let baseName = baseNameOf path; in
-      ! (elem baseName gerbilSkippableFiles || hasSuffix "~" baseName);
+      ! (builtins.elem baseName gerbilSkippableFiles || lib.hasSuffix "~" baseName);

-  gerbilFilterSource = filterSource gerbilSourceFilter;
+  gerbilFilterSource = builtins.filterSource gerbilSourceFilter;

  # Use this function in any package that uses Gerbil libraries, to define the GERBIL_LOADPATH.
  gerbilLoadPath =
-    gerbilInputs: concatStringsSep ":" (map (x: x + "/gerbil/lib") gerbilInputs);
+    gerbilInputs: builtins.concatStringsSep ":" (map (x: x + "/gerbil/lib") gerbilInputs);

  path-src = path: { fun = _: path; };

-  view = traceSeqN 4;
+  view = lib.debug.traceSeqN 4;

  sha256-of-pre-src = pre-src: if pre-src ? sha256 then pre-src.sha256 else "none";

@ -116,7 +75,7 @@ in
                       pre-src = new-pre-src;
                       version = "override";
                       git-version = if new-pre-src ? rev
-                                     then substring 0 7 new-pre-src.rev
+                                     then lib.substring 0 7 new-pre-src.rev
                                     else "unknown";};
                     };

@ -143,10 +102,10 @@ in

      postPatch = ''
        set -e ;
-        ${optionalString (version-path != "")
-          ''echo -e '(import :clan/versioning${concatStringsSep ""
+        ${lib.optionalString (version-path != "")
+          ''echo -e '(import :clan/versioning${builtins.concatStringsSep ""
                     (map (x: let px = x.passthru.pre-pkg; in
-                              optionalString (px.version-path != "")
+                              lib.optionalString (px.version-path != "")
                                " :${px.gerbil-package}/${px.version-path}")
                          gerbilInputs)
                     })\n(register-software "${softwareName}" "v${git-version}")\n' > "${version-path}.ss"''}
--- a/pkgs/development/compilers/swift/sourcekit-lsp/default.nix
+++ b/pkgs/development/compilers/swift/sourcekit-lsp/default.nix
@ -1,7 +1,6 @@
 { lib
 , stdenv
 , callPackage
-, fetchpatch
 , pkg-config
 , swift
 , swiftpm
@ -42,11 +41,7 @@ stdenv.mkDerivation {
    patch -p1 -d .build/checkouts/indexstore-db -i ${./patches/indexstore-db-macos-target.patch}

    swiftpmMakeMutable swift-tools-support-core
-    patch -p1 -d .build/checkouts/swift-tools-support-core -i ${fetchpatch {
-      url = "https://github.com/apple/swift-tools-support-core/commit/990afca47e75cce136d2f59e464577e68a164035.patch";
-      hash = "sha256-PLzWsp+syiUBHhEFS8+WyUcSae5p0Lhk7SSRdNvfouE=";
-      includes = [ "Sources/TSCBasic/FileSystem.swift" ];
-    }}
+    patch -p1 -d .build/checkouts/swift-tools-support-core -i ${./patches/force-unwrap-file-handles.patch}

    # This toggles a section specific to Xcode XCTest, which doesn't work on
    # Darwin, where we also use swift-corelibs-xctest.
--- a/Show More
+++ b/Show More