Merge branch 'staging-next' into staging

2024-02-23 05:12:00 +01:00 · 2024-02-23 05:12:00 +01:00 · 2930699c8c
commit 2930699c8c
parent 85e26d06ac 5f5062d1ef
197 changed files with 5174 additions and 2180 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@ -271,13 +271,13 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/applications/editors/vscode/extensions   @jonringer

 # PHP interpreter, packages, extensions, tests and documentation
-/doc/languages-frameworks/php.section.md          @aanderse @drupol @etu @globin @ma27 @talyz
-/nixos/tests/php                                  @aanderse @drupol @etu @globin @ma27 @talyz
-/pkgs/build-support/php/build-pecl.nix            @aanderse @drupol @etu @globin @ma27 @talyz
-/pkgs/build-support/php                                     @drupol @etu
-/pkgs/development/interpreters/php       @jtojnar @aanderse @drupol @etu @globin @ma27 @talyz
-/pkgs/development/php-packages                    @aanderse @drupol @etu @globin @ma27 @talyz
-/pkgs/top-level/php-packages.nix         @jtojnar @aanderse @drupol @etu @globin @ma27 @talyz
+/doc/languages-frameworks/php.section.md          @aanderse @drupol @globin @ma27 @talyz
+/nixos/tests/php                                  @aanderse @drupol @globin @ma27 @talyz
+/pkgs/build-support/php/build-pecl.nix            @aanderse @drupol @globin @ma27 @talyz
+/pkgs/build-support/php                                     @drupol
+/pkgs/development/interpreters/php       @jtojnar @aanderse @drupol @globin @ma27 @talyz
+/pkgs/development/php-packages                    @aanderse @drupol @globin @ma27 @talyz
+/pkgs/top-level/php-packages.nix         @jtojnar @aanderse @drupol @globin @ma27 @talyz

 # Docker tools
 /pkgs/build-support/docker                   @roberth
--- a/doc/build-helpers/fetchers.chapter.md
+++ b/doc/build-helpers/fetchers.chapter.md
@ -80,6 +80,10 @@ stdenv.mkDerivation {

 The main difference between `fetchurl` and `fetchzip` is in how they store the contents. `fetchurl` will store the unaltered contents of the URL within the Nix store. `fetchzip` on the other hand, will decompress the archive for you, making files and directories directly accessible in the future. `fetchzip` can only be used with archives. Despite the name, `fetchzip` is not limited to .zip files and can also be used with any tarball.

+Additional parameters to `fetchurl`:
+- `downloadToTemp`: Defaults to `false`. If `true`, saves the source to `$downloadedFile`, to be used in conjunction with `postFetch`
+- `postFetch`: Shell code executed after the file has been fetched successfully. Use it for postprocessing, to check or transform the file.
+
 ## `fetchpatch` {#fetchpatch}

 `fetchpatch` works very similarly to `fetchurl` with the same arguments expected. It expects patch files as a source and performs normalization on them before computing the checksum. For example, it will remove comments or other unstable parts that are sometimes added by version control systems and can change over time.
--- a/lib/modules.nix
+++ b/lib/modules.nix
@ -1256,7 +1256,78 @@ let
      (opt.highestPrio or defaultOverridePriority)
      (f opt.value);

-  doRename = { from, to, visible, warn, use, withPriority ? true, condition ? true }:
+  /*
+    Return a module that help declares an option that has been renamed.
+    When a value is defined for the old option, it is forwarded to the `to` option.
+   */
+  doRename = {
+    # List of strings representing the attribute path of the old option.
+    from,
+    # List of strings representing the attribute path of the new option.
+    to,
+    # Boolean, whether the old option is to be included in documentation.
+    visible,
+    # Whether to warn when a value is defined for the old option.
+    # NOTE: This requires the NixOS assertions module to be imported, so
+    #        - this generally does not work in submodules
+    #        - this may or may not work outside NixOS
+    warn,
+    # A function that is applied to the option value, to form the value
+    # of the old `from` option.
+    #
+    # For example, the identity function can be passed, to return the option value unchanged.
+    # ```nix
+    # use = x: x;
+    # ```
+    #
+    # To add a warning, you can pass the partially applied `warn` function.
+    # ```nix
+    # use = lib.warn "Obsolete option `${opt.old}' is used. Use `${opt.to}' instead.";
+    # ```
+    use,
+    # Legacy option, enabled by default: whether to preserve the priority of definitions in `old`.
+    withPriority ? true,
+    # A boolean that defines the `mkIf` condition for `to`.
+    # If the condition evaluates to `true`, and the `to` path points into an
+    # `attrsOf (submodule ...)`, then `doRename` would cause an empty module to
+    # be created, even if the `from` option is undefined.
+    # By setting this to an expression that may return `false`, you can inhibit
+    # this undesired behavior.
+    #
+    # Example:
+    #
+    # ```nix
+    # { config, lib, ... }:
+    # let
+    #   inherit (lib) mkOption mkEnableOption types doRename;
+    # in
+    # {
+    #   options = {
+    #
+    #     # Old service
+    #     services.foo.enable = mkEnableOption "foo";
+    #
+    #     # New multi-instance service
+    #     services.foos = mkOption {
+    #       type = types.attrsOf (types.submodule …);
+    #     };
+    #   };
+    #   imports = [
+    #     (doRename {
+    #       from = [ "services" "foo" "bar" ];
+    #       to = [ "services" "foos" "" "bar" ];
+    #       visible = true;
+    #       warn = false;
+    #       use = x: x;
+    #       withPriority = true;
+    #       # Only define services.foos."" if needed. (It's not just about `bar`)
+    #       condition = config.services.foo.enable;
+    #     })
+    #   ];
+    # }
+    # ```
+    condition ? true
+  }:
    { config, options, ... }:
    let
      fromOpt = getAttrFromPath from options;
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -4590,6 +4590,12 @@
    githubId = 47436522;
    name = "deliciouslytyped";
  };
+  delliott = {
+    name = "Darragh Elliott";
+    github = "delliottxyz";
+    githubId = 150736012;
+    email = "me+git@delliott.xyz";
+  };
  delroth = {
    email = "delroth@gmail.com";
    github = "delroth";
@ -5931,7 +5937,7 @@
  };
  etu = {
    email = "elis@hirwing.se";
-    matrix = "@etu:semi.social";
+    matrix = "@etu:failar.nu";
    github = "etu";
    githubId = 461970;
    name = "Elis Hirwing";
@ -6707,6 +6713,16 @@
    githubId = 29337229;
    name = "mtths";
  };
+  fx-chun = {
+    email = "faye@lolc.at";
+    matrix = "@faye:lolc.at";
+    github = "fx-chun";
+    githubId = 40049608;
+    name = "Faye Chun";
+    keys = [{
+      fingerprint = "ACB8 DB1F E88D A908 6332  BDB1 5A71 B010 2FD7 3FC0";
+    }];
+  };
  fxfactorial = {
    email = "edgar.factorial@gmail.com";
    github = "fxfactorial";
@ -13926,13 +13942,6 @@
    githubId = 47303199;
    name = "Simon Gutgesell";
  };
-  noneucat = {
-    email = "andy@lolc.at";
-    matrix = "@noneucat:lolc.at";
-    github = "noneucat";
-    githubId = 40049608;
-    name = "Andy Chun";
-  };
  noodlez1232 = {
    email = "contact@nathanielbarragan.xyz";
    matrix = "@noodlez1232:matrix.org";
@ -15814,6 +15823,12 @@
    github = "rafaelrc7";
    githubId = 5376043;
  };
+  rafameou = {
+    email = "rafaelmazz22@gmail.com";
+    name = "Rafael Mazzutti";
+    github = "rafameou";
+    githubId = 26395874;
+  };
  ragge = {
    email = "r.dahlen@gmail.com";
    github = "ragnard";
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@ -775,7 +775,6 @@ with lib.maintainers; {
    members = [
      aanderse
      drupol
-      etu
      ma27
      talyz
    ];
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -25,6 +25,10 @@ In addition to numerous new and upgraded packages, this release has the followin
 - A new option `systemd.sysusers.enable` was added. If enabled, users and
  groups are created with systemd-sysusers instead of with a custom perl script.

+- A new option `virtualisation.containers.cdi` was added. It contains `static` and `dynamic` attributes (corresponding to `/etc/cdi` and `/run/cdi` respectively) to configure the Container Device Interface (CDI).
+
+- `virtualisation.docker.enableNvidia` and `virtualisation.podman.enableNvidia` options are deprecated. `virtualisation.containers.cdi.dynamic.nvidia.enable` should be used instead. This option will expose GPUs on containers with the `--device` CLI option. This is supported by Docker 25, Podman 3.2.0 and Singularity 4. Any container runtime that supports the CDI specification will take advantage of this feature.
+
 - A new option `system.etc.overlay.enable` was added. If enabled, `/etc` is
  mounted via an overlayfs instead of being created by a custom perl script.

@ -81,6 +85,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - [RustDesk](https://rustdesk.com), a full-featured open source remote control alternative for self-hosting and security with minimal configuration. Alternative to TeamViewer.

+- [Scrutiny](https://github.com/AnalogJ/scrutiny), a S.M.A.R.T monitoring tool for hard disks with a web frontend.
+
 - [systemd-lock-handler](https://git.sr.ht/~whynothugo/systemd-lock-handler/), a bridge between logind D-Bus events and systemd targets. Available as [services.systemd-lock-handler.enable](#opt-services.systemd-lock-handler.enable).

 ## Backward Incompatibilities {#sec-release-24.05-incompatibilities}
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -546,6 +546,7 @@
  ./services/hardware/kanata.nix
  ./services/hardware/lcd.nix
  ./services/hardware/lirc.nix
+  ./services/hardware/nvidia-container-toolkit-cdi-generator
  ./services/hardware/nvidia-optimus.nix
  ./services/hardware/openrgb.nix
  ./services/hardware/pcscd.nix
@ -840,6 +841,7 @@
  ./services/monitoring/riemann.nix
  ./services/monitoring/rustdesk-server.nix
  ./services/monitoring/scollector.nix
+  ./services/monitoring/scrutiny.nix
  ./services/monitoring/smartd.nix
  ./services/monitoring/snmpd.nix
  ./services/monitoring/statsd.nix
--- a/nixos/modules/services/games/archisteamfarm.nix
+++ b/nixos/modules/services/games/archisteamfarm.nix
@ -270,6 +270,6 @@ in

  meta = {
    buildDocsInSandbox = false;
-    maintainers = with lib.maintainers; [ lom SuperSandro2000 ];
+    maintainers = with lib.maintainers; [ SuperSandro2000 ];
  };
 }
--- a/nixos/modules/services/hardware/nvidia-container-toolkit-cdi-generator/cdi-generate.nix
+++ b/nixos/modules/services/hardware/nvidia-container-toolkit-cdi-generator/cdi-generate.nix
@ -0,0 +1,39 @@
+{ config, lib, pkgs }: let
+  mountOptions = { options = ["ro" "nosuid" "nodev" "bind"]; };
+  mounts = [
+    { hostPath = "${lib.getBin config.hardware.nvidia.package}/bin/nvidia-cuda-mps-control";
+      containerPath = "/usr/bin/nvidia-cuda-mps-control"; }
+    { hostPath = "${lib.getBin config.hardware.nvidia.package}/bin/nvidia-cuda-mps-server";
+      containerPath = "/usr/bin/nvidia-cuda-mps-server"; }
+    { hostPath = "${lib.getBin config.hardware.nvidia.package}/bin/nvidia-debugdump";
+      containerPath = "/usr/bin/nvidia-debugdump"; }
+    { hostPath = "${lib.getBin config.hardware.nvidia.package}/bin/nvidia-powerd";
+      containerPath = "/usr/bin/nvidia-powerd"; }
+    { hostPath = "${lib.getBin config.hardware.nvidia.package}/bin/nvidia-smi";
+      containerPath = "/usr/bin/nvidia-smi"; }
+    { hostPath = "${pkgs.nvidia-container-toolkit}/bin/nvidia-ctk";
+      containerPath = "/usr/bin/nvidia-ctk"; }
+    { hostPath = "${pkgs.glibc}/lib";
+      containerPath = "${pkgs.glibc}/lib"; }
+    { hostPath = "${pkgs.glibc}/lib64";
+      containerPath = "${pkgs.glibc}/lib64"; }
+  ];
+  jqAddMountExpression = ".containerEdits.mounts[.containerEdits.mounts | length] |= . +";
+  mountsToJq = lib.concatMap
+    (mount:
+      ["${pkgs.jq}/bin/jq '${jqAddMountExpression} ${builtins.toJSON (mount // mountOptions)}'"])
+    mounts;
+in ''
+#! ${pkgs.runtimeShell}
+
+function cdiGenerate {
+  ${pkgs.nvidia-container-toolkit}/bin/nvidia-ctk cdi generate \
+    --format json \
+    --ldconfig-path ${pkgs.glibc.bin}/bin/ldconfig \
+    --library-search-path ${config.hardware.nvidia.package}/lib \
+    --nvidia-ctk-path ${pkgs.nvidia-container-toolkit}/bin/nvidia-ctk
+}
+
+cdiGenerate | \
+  ${lib.concatStringsSep " | " mountsToJq} > $RUNTIME_DIRECTORY/nvidia-container-toolkit.json
+''
--- a/nixos/modules/services/hardware/nvidia-container-toolkit-cdi-generator/default.nix
+++ b/nixos/modules/services/hardware/nvidia-container-toolkit-cdi-generator/default.nix
@ -0,0 +1,38 @@
+{ config, lib, pkgs, ... }:
+
+{
+
+  options = {
+
+    hardware.nvidia-container-toolkit-cdi-generator.enable = lib.mkOption {
+      default = false;
+      internal = true;
+      visible = false;
+      type = lib.types.bool;
+      description = lib.mdDoc ''
+        Enable dynamic CDI configuration for NVidia devices by running
+        nvidia-container-toolkit on boot.
+      '';
+    };
+
+  };
+
+  config = {
+
+    systemd.services.nvidia-container-toolkit-cdi-generator = lib.mkIf config.hardware.nvidia-container-toolkit-cdi-generator.enable {
+      description = "Container Device Interface (CDI) for Nvidia generator";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "systemd-udev-settle.service" ];
+      serviceConfig = {
+        RuntimeDirectory = "cdi";
+        RemainAfterExit = true;
+        ExecStart = let
+          script = (pkgs.writeScriptBin "nvidia-cdi-generator"
+            (import ./cdi-generate.nix { inherit config lib pkgs; })); in (lib.getExe script);
+        Type = "oneshot";
+      };
+    };
+
+  };
+
+}
--- a/nixos/modules/services/monitoring/prometheus/exporters/fastly.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/fastly.nix
@ -1,41 +1,54 @@
-{ config, lib, pkgs, options }:
+{ config
+, lib
+, pkgs
+, options
+}:

-with lib;
+let
+  inherit (lib)
+    escapeShellArgs
+    mkOption
+    optionals
+    types
+  ;

-let cfg = config.services.prometheus.exporters.fastly;
+  cfg = config.services.prometheus.exporters.fastly;
 in
 {
  port = 9118;
-  extraOpts = {
-    debug = mkEnableOption (lib.mdDoc "Debug logging mode for fastly-exporter");
-
+  extraOpts = with types; {
    configFile = mkOption {
-      type = types.nullOr types.path;
+      type = nullOr path;
      default = null;
-      description = lib.mdDoc ''
+      example = "./fastly-exporter-config.txt";
+      description = ''
        Path to a fastly-exporter configuration file.
        Example one can be generated with `fastly-exporter --config-file-example`.
      '';
-      example = "./fastly-exporter-config.txt";
    };

    tokenPath = mkOption {
-      type = types.nullOr types.path;
-      apply = final: if final == null then null else toString final;
-      description = lib.mdDoc ''
+      type = path;
+      description = ''
        A run-time path to the token file, which is supposed to be provisioned
        outside of Nix store.
      '';
    };
  };
  serviceOpts = {
-    script = ''
-      ${optionalString (cfg.tokenPath != null)
-      "export FASTLY_API_TOKEN=$(cat ${toString cfg.tokenPath})"}
-      ${pkgs.prometheus-fastly-exporter}/bin/fastly-exporter \
-        -listen http://${cfg.listenAddress}:${toString cfg.port}
-        ${optionalString cfg.debug "-debug true"} \
-        ${optionalString (cfg.configFile != null) "-config-file ${cfg.configFile}"}
+    serviceConfig = {
+      LoadCredential = "fastly-api-token:${cfg.tokenPath}";
+    };
+    script = let
+      call = escapeShellArgs ([
+        "${pkgs.prometheus-fastly-exporter}/bin/fastly-exporter"
+        "-listen" "${cfg.listenAddress}:${toString cfg.port}"
+      ] ++ optionals (cfg.configFile != null) [
+        "--config-file" cfg.configFile
+      ] ++ cfg.extraFlags);
+    in ''
+      export FASTLY_API_TOKEN="$(cat $CREDENTIALS_DIRECTORY/fastly-api-token)"
+      ${call}
    '';
  };
 }
--- a/nixos/modules/services/monitoring/scrutiny.nix
+++ b/nixos/modules/services/monitoring/scrutiny.nix
@ -0,0 +1,221 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.scrutiny;
+  # Define the settings format used for this program
+  settingsFormat = pkgs.formats.yaml { };
+in
+{
+  options = {
+    services.scrutiny = {
+      enable = lib.mkEnableOption "Enables the scrutiny web application.";
+
+      package = lib.mkPackageOptionMD pkgs "scrutiny" { };
+
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Open the default ports in the firewall for Scrutiny.";
+      };
+
+      influxdb.enable = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = lib.mdDoc ''
+          Enables InfluxDB on the host system using the `services.influxdb2` NixOS module
+          with default options.
+
+          If you already have InfluxDB configured, or wish to connect to an external InfluxDB
+          instance, disable this option.
+        '';
+      };
+
+      settings = lib.mkOption {
+        description = lib.mdDoc ''
+          Scrutiny settings to be rendered into the configuration file.
+
+          See https://github.com/AnalogJ/scrutiny/blob/master/example.scrutiny.yaml.
+        '';
+        default = { };
+        type = lib.types.submodule {
+          freeformType = settingsFormat.type;
+
+          options.web.listen.port = lib.mkOption {
+            type = lib.types.port;
+            default = 8080;
+            description = lib.mdDoc "Port for web application to listen on.";
+          };
+
+          options.web.listen.host = lib.mkOption {
+            type = lib.types.str;
+            default = "0.0.0.0";
+            description = lib.mdDoc "Interface address for web application to bind to.";
+          };
+
+          options.web.listen.basepath = lib.mkOption {
+            type = lib.types.str;
+            default = "";
+            example = "/scrutiny";
+            description = lib.mdDoc ''
+              If Scrutiny will be behind a path prefixed reverse proxy, you can override this
+              value to serve Scrutiny on a subpath.
+            '';
+          };
+
+          options.log.level = lib.mkOption {
+            type = lib.types.enum [ "INFO" "DEBUG" ];
+            default = "INFO";
+            description = lib.mdDoc "Log level for Scrutiny.";
+          };
+
+          options.web.influxdb.scheme = lib.mkOption {
+            type = lib.types.str;
+            default = "http";
+            description = lib.mdDoc "URL scheme to use when connecting to InfluxDB.";
+          };
+
+          options.web.influxdb.host = lib.mkOption {
+            type = lib.types.str;
+            default = "0.0.0.0";
+            description = lib.mdDoc "IP or hostname of the InfluxDB instance.";
+          };
+
+          options.web.influxdb.port = lib.mkOption {
+            type = lib.types.port;
+            default = 8086;
+            description = lib.mdDoc "The port of the InfluxDB instance.";
+          };
+
+          options.web.influxdb.tls.insecure_skip_verify = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            description = lib.mdDoc "Skip TLS verification when connecting to InfluxDB.";
+          };
+
+          options.web.influxdb.token = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = lib.mdDoc "Authentication token for connecting to InfluxDB.";
+          };
+
+          options.web.influxdb.org = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = lib.mdDoc "InfluxDB organisation under which to store data.";
+          };
+
+          options.web.influxdb.bucket = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            description = lib.mdDoc "InfluxDB bucket in which to store data.";
+          };
+        };
+      };
+
+      collector = {
+        enable = lib.mkEnableOption "Enables the scrutiny metrics collector.";
+
+        package = lib.mkPackageOptionMD pkgs "scrutiny-collector" { };
+
+        schedule = lib.mkOption {
+          type = lib.types.str;
+          default = "*:0/15";
+          description = lib.mdDoc ''
+            How often to run the collector in systemd calendar format.
+          '';
+        };
+
+        settings = lib.mkOption {
+          description = lib.mdDoc ''
+            Collector settings to be rendered into the collector configuration file.
+
+            See https://github.com/AnalogJ/scrutiny/blob/master/example.collector.yaml.
+          '';
+          default = { };
+          type = lib.types.submodule {
+            freeformType = settingsFormat.type;
+
+            options.host.id = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+              description = lib.mdDoc "Host ID for identifying/labelling groups of disks";
+            };
+
+            options.api.endpoint = lib.mkOption {
+              type = lib.types.str;
+              default = "http://localhost:8080";
+              description = lib.mdDoc "Scrutiny app API endpoint for sending metrics to.";
+            };
+
+            options.log.level = lib.mkOption {
+              type = lib.types.enum [ "INFO" "DEBUG" ];
+              default = "INFO";
+              description = lib.mdDoc "Log level for Scrutiny collector.";
+            };
+          };
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf (cfg.enable || cfg.collector.enable) {
+    services.influxdb2.enable = cfg.influxdb.enable;
+
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.settings.web.listen.port ];
+    };
+
+    services.smartd = lib.mkIf cfg.collector.enable {
+      enable = true;
+      extraOptions = [
+        "-A /var/log/smartd/"
+        "--interval=600"
+      ];
+    };
+
+    systemd = {
+      services = {
+        scrutiny = lib.mkIf cfg.enable {
+          description = "Hard Drive S.M.A.R.T Monitoring, Historical Trends & Real World Failure Thresholds";
+          wantedBy = [ "multi-user.target" ];
+          after = [ "network.target" ];
+          environment = {
+            SCRUTINY_VERSION = "1";
+            SCRUTINY_WEB_DATABASE_LOCATION = "/var/lib/scrutiny/scrutiny.db";
+            SCRUTINY_WEB_SRC_FRONTEND_PATH = "${cfg.package}/share/scrutiny";
+          };
+          serviceConfig = {
+            DynamicUser = true;
+            ExecStart = "${lib.getExe cfg.package} start --config ${settingsFormat.generate "scrutiny.yaml" cfg.settings}";
+            Restart = "always";
+            StateDirectory = "scrutiny";
+            StateDirectoryMode = "0750";
+          };
+        };
+
+        scrutiny-collector = lib.mkIf cfg.collector.enable {
+          description = "Scrutiny Collector Service";
+          environment = {
+            COLLECTOR_VERSION = "1";
+            COLLECTOR_API_ENDPOINT = cfg.collector.settings.api.endpoint;
+          };
+          serviceConfig = {
+            Type = "oneshot";
+            ExecStart = "${lib.getExe cfg.collector.package} run --config ${settingsFormat.generate "scrutiny-collector.yaml" cfg.collector.settings}";
+          };
+        };
+      };
+
+      timers = lib.mkIf cfg.collector.enable {
+        scrutiny-collector = {
+          timerConfig = {
+            OnCalendar = cfg.collector.schedule;
+            Persistent = true;
+            Unit = "scrutiny-collector.service";
+          };
+        };
+      };
+    };
+  };
+
+  meta.maintainers = [ lib.maintainers.jnsgruk ];
+}
--- a/nixos/modules/virtualisation/containers.nix
+++ b/nixos/modules/virtualisation/containers.nix
@ -28,6 +28,43 @@ in
      description = lib.mdDoc "Enable the OCI seccomp BPF hook";
    };

+    cdi = {
+      dynamic.nvidia.enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = lib.mdDoc ''
+          Enable dynamic CDI configuration for NVidia devices by running nvidia-container-toolkit on boot.
+        '';
+      };
+
+      static = mkOption {
+        type = types.attrs;
+        default = { };
+        description = lib.mdDoc ''
+          Declarative CDI specification. Each key of the attribute set
+          will be mapped to a file in /etc/cdi. It is required for every
+          key to be provided in JSON format.
+        '';
+        example = {
+          some-vendor = builtins.fromJSON ''
+              {
+                "cdiVersion": "0.5.0",
+                "kind": "some-vendor.com/foo",
+                "devices": [],
+                "containerEdits": []
+              }
+            '';
+
+          some-other-vendor = {
+            cdiVersion = "0.5.0";
+            kind = "some-other-vendor.com/bar";
+            devices = [];
+            containerEdits = [];
+          };
+        };
+      };
+    };
+
    containersConf.settings = mkOption {
      type = toml.type;
      default = { };
@ -113,6 +150,8 @@ in

  config = lib.mkIf cfg.enable {

+    hardware.nvidia-container-toolkit-cdi-generator.enable = lib.mkIf cfg.cdi.dynamic.nvidia.enable true;
+
    virtualisation.containers.containersConf.cniPlugins = [ pkgs.cni-plugins ];

    virtualisation.containers.containersConf.settings = {
@ -124,19 +163,28 @@ in
      };
    };

-    environment.etc."containers/containers.conf".source =
-      toml.generate "containers.conf" cfg.containersConf.settings;
+    environment.etc = let
+      cdiStaticConfigurationFiles = (lib.attrsets.mapAttrs'
+        (name: value:
+          lib.attrsets.nameValuePair "cdi/${name}.json"
+            { text = builtins.toJSON value; })
+        cfg.cdi.static);
+    in {
+      "containers/containers.conf".source =
+        toml.generate "containers.conf" cfg.containersConf.settings;

-    environment.etc."containers/storage.conf".source =
-      toml.generate "storage.conf" cfg.storage.settings;
+      "containers/storage.conf".source =
+        toml.generate "storage.conf" cfg.storage.settings;

-    environment.etc."containers/registries.conf".source = toml.generate "registries.conf" {
-      registries = lib.mapAttrs (n: v: { registries = v; }) cfg.registries;
-    };
+      "containers/registries.conf".source = toml.generate "registries.conf" {
+        registries = lib.mapAttrs (n: v: { registries = v; }) cfg.registries;
+      };
+
+      "containers/policy.json".source =
+        if cfg.policy != { } then pkgs.writeText "policy.json" (builtins.toJSON cfg.policy)
+        else "${pkgs.skopeo.policy}/default-policy.json";
+    } // cdiStaticConfigurationFiles;

-    environment.etc."containers/policy.json".source =
-      if cfg.policy != { } then pkgs.writeText "policy.json" (builtins.toJSON cfg.policy)
-      else "${pkgs.skopeo.policy}/default-policy.json";
  };

 }
--- a/nixos/modules/virtualisation/docker.nix
+++ b/nixos/modules/virtualisation/docker.nix
@ -72,6 +72,8 @@ in
        type = types.bool;
        default = false;
        description = lib.mdDoc ''
+          **Deprecated**, please use virtualisation.containers.cdi.dynamic.nvidia.enable instead.
+
          Enable nvidia-docker wrapper, supporting NVIDIA GPUs inside docker containers.
        '';
      };
@ -185,6 +187,16 @@ in
      users.groups.docker.gid = config.ids.gids.docker;
      systemd.packages = [ cfg.package ];

+      # Docker 25.0.0 supports CDI by default
+      # (https://docs.docker.com/engine/release-notes/25.0/#new). Encourage
+      # moving to CDI as opposed to having deprecated runtime
+      # wrappers.
+      warnings = lib.optionals (cfg.enableNvidia && (lib.strings.versionAtLeast cfg.package.version "25")) [
+        ''
+          You have set virtualisation.docker.enableNvidia. This option is deprecated, please set virtualisation.containers.cdi.dynamic.nvidia.enable instead.
+        ''
+      ];
+
      systemd.services.docker = {
        wantedBy = optional cfg.enableOnBoot "multi-user.target";
        after = [ "network.target" "docker.socket" ];
--- a/nixos/modules/virtualisation/podman/default.nix
+++ b/nixos/modules/virtualisation/podman/default.nix
@ -82,6 +82,8 @@ in
      type = types.bool;
      default = false;
      description = lib.mdDoc ''
+        **Deprecated**, please use virtualisation.containers.cdi.dynamic.nvidia.enable instead.
+
        Enable use of NVidia GPUs from within podman containers.
      '';
    };
@ -166,6 +168,12 @@ in
      inherit (networkConfig) dns_enabled network_interface;
    in
    lib.mkIf cfg.enable {
+      warnings = lib.optionals cfg.enableNvidia [
+        ''
+          You have set virtualisation.podman.enableNvidia. This option is deprecated, please set virtualisation.containers.cdi.dynamic.nvidia.enable instead.
+        ''
+      ];
+
      environment.systemPackages = [ cfg.package ]
        ++ lib.optional cfg.dockerCompat dockerCompat;

--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -539,6 +539,7 @@ in {
  mongodb = handleTest ./mongodb.nix {};
  moodle = handleTest ./moodle.nix {};
  moonraker = handleTest ./moonraker.nix {};
+  morph-browser = handleTest ./morph-browser.nix { };
  morty = handleTest ./morty.nix {};
  mosquitto = handleTest ./mosquitto.nix {};
  moosefs = handleTest ./moosefs.nix {};
@ -771,6 +772,7 @@ in {
  sanoid = handleTest ./sanoid.nix {};
  scaphandre = handleTest ./scaphandre.nix {};
  schleuder = handleTest ./schleuder.nix {};
+  scrutiny = handleTest ./scrutiny.nix {};
  sddm = handleTest ./sddm.nix {};
  seafile = handleTest ./seafile.nix {};
  searx = handleTest ./searx.nix {};
--- a/nixos/tests/morph-browser.nix
+++ b/nixos/tests/morph-browser.nix
@ -0,0 +1,53 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }: {
+  name = "morph-browser-standalone";
+  meta.maintainers = lib.teams.lomiri.members;
+
+  nodes.machine = { config, pkgs, ... }: {
+    imports = [
+      ./common/x11.nix
+    ];
+
+    services.xserver.enable = true;
+
+    environment = {
+      systemPackages = with pkgs.lomiri; [
+        suru-icon-theme
+        morph-browser
+      ];
+      variables = {
+        UITK_ICON_THEME = "suru";
+      };
+    };
+
+    i18n.supportedLocales = [ "all" ];
+
+    fonts.packages = with pkgs; [
+      # Intended font & helps with OCR
+      ubuntu_font_family
+    ];
+  };
+
+  enableOCR = true;
+
+  testScript =
+    ''
+      machine.wait_for_x()
+
+      with subtest("morph browser launches"):
+          machine.execute("morph-browser >&2 &")
+          machine.wait_for_text(r"Web Browser|New|sites|Bookmarks")
+          machine.screenshot("morph_open")
+
+      with subtest("morph browser displays HTML"):
+          machine.send_chars("file://${pkgs.valgrind.doc}/share/doc/valgrind/html/index.html\n")
+          machine.wait_for_text("Valgrind Documentation")
+          machine.screenshot("morph_htmlcontent")
+
+      machine.succeed("pkill -f morph-browser")
+
+      with subtest("morph browser localisation works"):
+          machine.execute("env LANG=de_DE.UTF-8 morph-browser >&2 &")
+          machine.wait_for_text(r"Web-Browser|Neuer|Seiten|Lesezeichen")
+          machine.screenshot("morph_localised")
+    '';
+})
--- a/nixos/tests/nextcloud/with-postgresql-and-redis.nix
+++ b/nixos/tests/nextcloud/with-postgresql-and-redis.nix
@ -84,7 +84,7 @@ in {
        "${withRcloneEnv} ${copySharedFile}"
    )
    client.wait_for_unit("multi-user.target")
-    client.execute("${pkgs.nextcloud-notify_push.passthru.test_client}/bin/test_client http://nextcloud ${adminuser} ${adminpass} >&2 &")
+    client.execute("${pkgs.lib.getExe pkgs.nextcloud-notify_push.passthru.test_client} http://nextcloud ${adminuser} ${adminpass} >&2 &")
    client.succeed(
        "${withRcloneEnv} ${diffSharedFile}"
    )
--- a/nixos/tests/scrutiny.nix
+++ b/nixos/tests/scrutiny.nix
@ -0,0 +1,70 @@
+import ./make-test-python.nix ({ lib, ... }:
+
+{
+  name = "scrutiny";
+  meta.maintainers = with lib.maintainers; [ jnsgruk ];
+
+  nodes = {
+    machine = { self, pkgs, lib, ... }: {
+      services = {
+        scrutiny.enable = true;
+        scrutiny.collector.enable = true;
+      };
+
+      environment.systemPackages =
+        let
+          seleniumScript = pkgs.writers.writePython3Bin "selenium-script"
+            {
+              libraries = with pkgs.python3Packages; [ selenium ];
+            } ''
+            from selenium import webdriver
+            from selenium.webdriver.common.by import By
+            from selenium.webdriver.firefox.options import Options
+            from selenium.webdriver.support.ui import WebDriverWait
+            from selenium.webdriver.support import expected_conditions as EC
+
+            options = Options()
+            options.add_argument("--headless")
+            service = webdriver.FirefoxService(executable_path="${lib.getExe pkgs.geckodriver}")  # noqa: E501
+
+            driver = webdriver.Firefox(options=options, service=service)
+            driver.implicitly_wait(10)
+            driver.get("http://localhost:8080/web/dashboard")
+
+            wait = WebDriverWait(driver, 10).until(
+              EC.text_to_be_present_in_element(
+                (By.TAG_NAME, "body"), "Drive health at a glance")
+            )
+
+            body_text = driver.find_element(By.TAG_NAME, "body").text
+            assert "Temperature history for each device" in body_text
+
+            driver.close()
+          '';
+        in
+        with pkgs; [ curl firefox-unwrapped geckodriver seleniumScript ];
+    };
+  };
+  # This is the test code that will check if our service is running correctly:
+  testScript = ''
+    start_all()
+
+    # Wait for InfluxDB to be available
+    machine.wait_for_unit("influxdb2")
+    machine.wait_for_open_port(8086)
+
+    # Wait for Scrutiny to be available
+    machine.wait_for_unit("scrutiny")
+    machine.wait_for_open_port(8080)
+
+    # Ensure the API responds as we expect
+    output = machine.succeed("curl localhost:8080/api/health")
+    assert output == '{"success":true}'
+
+    # Start the collector service to send some metrics
+    collect = machine.succeed("systemctl start scrutiny-collector.service")
+
+    # Ensure the application is actually rendered by the Javascript
+    machine.succeed("PYTHONUNBUFFERED=1 selenium-script")
+  '';
+})
--- a/pkgs/applications/audio/ledfx/default.nix
+++ b/pkgs/applications/audio/ledfx/default.nix
@ -5,12 +5,12 @@

 python3.pkgs.buildPythonPackage rec {
  pname = "ledfx";
-  version = "2.0.93";
+  version = "2.0.94";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-A34GY7uhkHcrofjeFzK3l/Uzr+aoQQ5JERK+HUhoosM=";
+    hash = "sha256-l498NXt3Ib9QLTWoJcpngAwkbY6JqLbVLKhTWQye7Fs=";
  };

  pythonRelaxDeps = true;
--- a/pkgs/applications/audio/mimic/default.nix
+++ b/pkgs/applications/audio/mimic/default.nix
@ -53,6 +53,6 @@ stdenv.mkDerivation rec {
    homepage = "https://mimic.mycroft.ai/";
    license = lib.licenses.free;
    platforms = lib.platforms.linux;
-    maintainers = [ lib.maintainers.noneucat ];
+    maintainers = [ lib.maintainers.fx-chun ];
  };
 }
--- a/pkgs/applications/audio/picard/default.nix
+++ b/pkgs/applications/audio/picard/default.nix
@ -60,7 +60,7 @@ pythonPackages.buildPythonApplication rec {
    pyyaml
  ];

-  setupPyGlobalFlags = [ "build" "--disable-autoupdate" ];
+  setupPyGlobalFlags = [ "build" "--disable-autoupdate" "--localedir=$out/share/locale" ];

  preCheck = ''
    export HOME=$(mktemp -d)
--- a/pkgs/applications/blockchains/particl-core/default.nix
+++ b/pkgs/applications/blockchains/particl-core/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "particl-core";
-  version = "23.0.3.0";
+  version = "23.2.7.0";

  src = fetchFromGitHub {
    owner = "particl";
    repo = "particl-core";
    rev = "v${version}";
-    sha256 = "sha256-jrIsErKeHP9CMUWsrD42RmfmApP7J091OLA5JNY0fe0=";
+    hash = "sha256-RxkLt+7u+r5jNwEWiArTUpZ8ykYwWtvIDFXTSKhGN/w=";
  };

  nativeBuildInputs = [ pkg-config autoreconfHook ];
--- a/pkgs/applications/blockchains/trezor-suite/default.nix
+++ b/pkgs/applications/blockchains/trezor-suite/default.nix
@ -8,7 +8,7 @@

 let
  pname = "trezor-suite";
-  version = "24.1.2";
+  version = "24.2.2";
  name = "${pname}-${version}";

  suffix = {
@ -19,8 +19,8 @@ let
  src = fetchurl {
    url = "https://github.com/trezor/${pname}/releases/download/v${version}/Trezor-Suite-${version}-${suffix}.AppImage";
    hash = { # curl -Lfs https://github.com/trezor/trezor-suite/releases/latest/download/latest-linux{-arm64,}.yml | grep ^sha512 | sed 's/: /-/'
-      aarch64-linux = "sha512-/D3mwyF00YWgDVq0GNDyegc8mLF63cxCOe/vnpGyLz9/Oj5aBl3oG32cj+c8e11+eHYigkKb72nFz5zBoPx8Bw==";
-      x86_64-linux  = "sha512-ehIIOksVzKLGYs6GNZ8w5XvellFRb9sHVORS7MOXmwbbikjgkNX/nlfjwmUKOysxI4PwPzIbqtuX2GYyC9lXHw==";
+      aarch64-linux = "sha512-8ws6umKaHGJQNRp6JV+X4W347bQeO1XSLRgJcLU2A+3qH8U7o/6G9rbTMhRlFNsDtIfyqWjn5W5FcXmZCk7kFw==";
+      x86_64-linux  = "sha512-s1MwQeEYmOM+OxdqryP3FaZEMxOk5c9nHvxZerSe+jXQMkQLhy0ivXCIz2KXoxUxxEiVgwu/uemv19FLy+q0MQ==";
    }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  };

--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -1321,6 +1321,23 @@ let
        };
      };

+      earthly.earthfile-syntax-highlighting = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "earthfile-syntax-highlighting";
+          publisher = "earthly";
+          version = "0.0.16";
+          sha256 = "c54d6fd4d2f503a1031be92ff118b5eb1b997907511734e730e08b1a90a6960f";
+        };
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/earthly.earthfile-syntax-highlighting/changelog";
+          description = "Syntax highlighting for Earthly build Earthfiles.";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=earthly.earthfile-syntax-highlighting";
+          homepage = "https://github.com/earthly/earthfile-grammar";
+          license = lib.licenses.mpl20;
+          maintainers = [ lib.maintainers.DataHearth ];
+        };
+      };
+
      ecmel.vscode-html-css = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "vscode-html-css";
--- a/pkgs/applications/graphics/imv/default.nix
+++ b/pkgs/applications/graphics/imv/default.nix
@ -17,10 +17,11 @@
 , libGLU
 , wayland
 # "libnsgif" is disabled until https://todo.sr.ht/~exec64/imv/55 is solved
-, withBackends ? [ "freeimage" "libtiff" "libjpeg" "libpng" "librsvg" "libheif" ]
+, withBackends ? [ "libjxl" "libtiff" "libjpeg" "libpng" "librsvg" "libheif" ]
 , freeimage
 , libtiff
 , libjpeg_turbo
+, libjxl
 , libpng
 , librsvg
 , netsurf
@ -41,7 +42,7 @@ let
  };

  backends = {
-    inherit freeimage libtiff libpng librsvg libheif;
+    inherit freeimage libtiff libpng librsvg libheif libjxl;
    libjpeg = libjpeg_turbo;
    inherit (netsurf) libnsgif;
  };
@ -63,14 +64,14 @@ assert builtins.all

 stdenv.mkDerivation rec {
  pname = "imv";
-  version = "4.4.0";
+  version = "4.5.0";
  outputs = [ "out" "man" ];

  src = fetchFromSourcehut {
    owner = "~exec64";
    repo = "imv";
    rev = "v${version}";
-    sha256 = "sha256-LLEEbriHzZhAOQivqHqdr6g7lh4uj++ytlme8AfRjf4=";
+    sha256 = "sha256-aJ2EXgsS0WUTxMqC1Q+uOWLG8BeuwAyXPmJB/9/NCCU=";
  };

  mesonFlags = [
--- a/pkgs/applications/misc/ArchiSteamFarm/default.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/default.nix
@ -11,13 +11,13 @@
 buildDotnetModule rec {
  pname = "ArchiSteamFarm";
  # nixpkgs-update: no auto update
-  version = "5.5.0.11";
+  version = "5.5.2.3";

  src = fetchFromGitHub {
    owner = "JustArchiNET";
    repo = "ArchiSteamFarm";
    rev = version;
-    hash = "sha256-VlJiTCdoH6hlVtQgECIlbsQvg3S58B5IIy1zRxh1eOg=";
+    hash = "sha256-8MrVeJ4XVU7WdYv0mbwz64hIGglisb6+vUoicl4/WC0=";
  };

  dotnet-runtime = dotnetCorePackages.aspnetcore_8_0;
@ -76,6 +76,6 @@ buildDotnetModule rec {
    homepage = "https://github.com/JustArchiNET/ArchiSteamFarm";
    license = licenses.asl20;
    mainProgram = "ArchiSteamFarm";
-    maintainers = with maintainers; [ SuperSandro2000 lom ];
+    maintainers = with maintainers; [ SuperSandro2000 ];
  };
 }
--- a/pkgs/applications/misc/ArchiSteamFarm/deps.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/deps.nix
@ -58,6 +58,7 @@
  (fetchNuGet { pname = "Humanizer.Core.zh-Hant"; version = "2.14.1"; sha256 = "0qxjnbdj645l5sd6y3100yyrq1jy5misswg6xcch06x8jv7zaw1p"; })
  (fetchNuGet { pname = "JetBrains.Annotations"; version = "2023.3.0"; sha256 = "0vp4mpn6gfckn8grzjm1jxlbqiq2fglm2rk9wq787adw7rxs8k7w"; })
  (fetchNuGet { pname = "Markdig.Signed"; version = "0.34.0"; sha256 = "1jrs5fc8k99mh1kipvvlgwm0qlacrsh82bbpdclb84xz0h6nwwrh"; })
+  (fetchNuGet { pname = "Microsoft.ApplicationInsights"; version = "2.21.0"; sha256 = "1q034jbqkxb8lddkd0ijp0wp0ymnnf3bg2mjpay027zv7jswnc4x"; })
  (fetchNuGet { pname = "Microsoft.AspNetCore.JsonPatch"; version = "7.0.0"; sha256 = "1f13vsfs1rp9bmdp3khk4mk2fif932d72yxm2wszpsr239x4s2bf"; })
  (fetchNuGet { pname = "Microsoft.AspNetCore.Mvc.NewtonsoftJson"; version = "7.0.0"; sha256 = "1w49rg0n5wb1m5wnays2mmym7qy7bsi2b1zxz97af2rkbw3s3hbd"; })
  (fetchNuGet { pname = "Microsoft.Bcl.AsyncInterfaces"; version = "6.0.0"; sha256 = "15gqy2m14fdlvy1g59207h5kisznm355kbw010gy19vh47z8gpz3"; })
@ -71,19 +72,25 @@
  (fetchNuGet { pname = "Microsoft.Extensions.Logging.Abstractions"; version = "8.0.0"; sha256 = "1klcqhg3hk55hb6vmjiq2wgqidsl81aldw0li2z98lrwx26msrr6"; })
  (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "8.0.0"; sha256 = "0p50qn6zhinzyhq9sy5svnmqqwhw2jajs2pbjh9sah504wjvhscz"; })
  (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "8.0.0"; sha256 = "0aldaz5aapngchgdr7dax9jw5wy7k7hmjgjpfgfv1wfif27jlkqm"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Abstractions"; version = "7.0.3"; sha256 = "0njmg2lygnirnfjv9gck2f5lq4ly5rgws9cpf8qj3kwcwxfp0b9s"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.JsonWebTokens"; version = "7.0.3"; sha256 = "1ayh85xqdq8rqjk2iqcn7iaczcl7d8qg6bxk0b4rgx59fmsmbqj7"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "7.0.3"; sha256 = "13cjqmf59k895q6gkd5ycl89mnpalckda7rhsdl11jdyr32hsfnv"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "7.0.3"; sha256 = "1pmhd0imh9wlhvbvvwjrpjsqvzagi2ly22nddwr4r0pi234khyz1"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Abstractions"; version = "7.3.0"; sha256 = "1x183b0gz1vcfiljggrn30g6jvixlwks0lfpl4hl9nnjbpg0fdvq"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.JsonWebTokens"; version = "7.3.0"; sha256 = "03nnqmz0w42wiqgf5y0wkn6w0n3m93q8ihqmrrz7rdh85v06f999"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "7.3.0"; sha256 = "1b24pf0ippwbdjc3k1wzr13lr1zqlcbymi2hpvfmxmk4i6vzn4mv"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "7.3.0"; sha256 = "1qdcqcnczaqfd0cii3bcymbc7rvkypm25idxgx7hfc81h9ysh79h"; })
  (fetchNuGet { pname = "Microsoft.NET.ILLink.Tasks"; version = "8.0.1"; sha256 = "1drbgqdcvbpisjn8mqfgba1pwb6yri80qc4mfvyczqwrcsj5k2ja"; })
  (fetchNuGet { pname = "Microsoft.NET.Test.Sdk"; version = "17.8.0"; sha256 = "1syvl3g0hbrcgfi9rq6pld8s8hqqww4dflf1lxn59ccddyyx0gmv"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "5.0.0"; sha256 = "0mwpwdflidzgzfx2dlpkvvnkgkr2ayaf0s80737h4wa35gaj11rc"; })
  (fetchNuGet { pname = "Microsoft.OpenApi"; version = "1.2.3"; sha256 = "07b19k89whj69j87afkz86gp9b3iybw8jqwvlgcn43m7fb2y99rr"; })
+  (fetchNuGet { pname = "Microsoft.Testing.Extensions.Telemetry"; version = "1.0.0"; sha256 = "1b52s7z01wkg83dpkpyg7girjflm84zr65pacsfwm2hvhb9xa2w6"; })
+  (fetchNuGet { pname = "Microsoft.Testing.Extensions.TrxReport.Abstractions"; version = "1.0.0"; sha256 = "0pvr4yga99fqr4z8s8js9hxki5c92qy7scvpqwslws5mri625m38"; })
+  (fetchNuGet { pname = "Microsoft.Testing.Extensions.VSTestBridge"; version = "1.0.0"; sha256 = "0zzrwp5in56fhc2cdmn4i44v2jf13frbjwpb9v8s7fkr9ky4wh5w"; })
+  (fetchNuGet { pname = "Microsoft.Testing.Platform"; version = "1.0.0"; sha256 = "1qbf922frk4c0cam57d98f3d5q5226pgrgjm7pfcamwy5whvx5sh"; })
+  (fetchNuGet { pname = "Microsoft.Testing.Platform.MSBuild"; version = "1.0.0"; sha256 = "0my1fihyh86rckfzbrvl5kdcq34yp0ywl8azs2gx3c27sg4pjrp2"; })
+  (fetchNuGet { pname = "Microsoft.TestPlatform.ObjectModel"; version = "17.5.0"; sha256 = "0qkjyf3ky6xpjg5is2sdsawm99ka7fzgid2bvpglwmmawqgm8gls"; })
  (fetchNuGet { pname = "Microsoft.TestPlatform.ObjectModel"; version = "17.8.0"; sha256 = "0b0i7lmkrcfvim8i3l93gwqvkhhhfzd53fqfnygdqvkg6np0cg7m"; })
  (fetchNuGet { pname = "Microsoft.TestPlatform.TestHost"; version = "17.8.0"; sha256 = "0f5jah93kjkvxwmhwb78lw11m9pkkq9fvf135hpymmmpxqbdh97q"; })
  (fetchNuGet { pname = "Microsoft.Win32.Registry"; version = "5.0.0"; sha256 = "102hvhq2gmlcbq8y2cb7hdr2dnmjzfp2k3asr1ycwrfacwyaak7n"; })
-  (fetchNuGet { pname = "MSTest.TestAdapter"; version = "3.1.1"; sha256 = "0y3ic8jv5jhld6gan2qfa2wyk4z57f7y4y5a47njr0jvxxnarg2c"; })
-  (fetchNuGet { pname = "MSTest.TestFramework"; version = "3.1.1"; sha256 = "1lbgkrbrkmw4c54g61cwbmwc4zl8hyqmp283ymvj93lq7chbxasn"; })
+  (fetchNuGet { pname = "MSTest.TestAdapter"; version = "3.2.0"; sha256 = "0n7iw8ppjyps4sg0rfh5pags4wq58yg1g9vnxfwa73z38jws2c10"; })
+  (fetchNuGet { pname = "MSTest.TestFramework"; version = "3.2.0"; sha256 = "0n9aab1cxf8w23dl4yw7rqpi47v7gd02csq3zisc5whsrb9i0xbq"; })
  (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.1"; sha256 = "0fijg0w6iwap8gvzyjnndds0q4b8anwxxvik7y8vgq97dram4srb"; })
  (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.3"; sha256 = "0xrwysmrn4midrjal8g2hr1bbg38iyisl0svamb11arqws4w2bw7"; })
  (fetchNuGet { pname = "Newtonsoft.Json.Bson"; version = "1.0.2"; sha256 = "0c27bhy9x3c2n26inq32kmp6drpm71n6mqnmcr19wrlcaihglj35"; })
@ -91,9 +98,10 @@
  (fetchNuGet { pname = "Nito.AsyncEx.Tasks"; version = "5.1.2"; sha256 = "11wp47kc69sjdxrbg5pgx0wlffqlp0x5kr54ggnz2v19kmjz362v"; })
  (fetchNuGet { pname = "Nito.Collections.Deque"; version = "1.1.1"; sha256 = "152564q3s0n5swfv5p5rx0ghn2sm0g2xsnbd7gv8vb9yfklv7yg8"; })
  (fetchNuGet { pname = "Nito.Disposables"; version = "2.2.1"; sha256 = "1hx5k8497j34kxxgh060bvij0vfnraw90dmm3h9bmamcdi8wp80l"; })
-  (fetchNuGet { pname = "NLog"; version = "5.2.7"; sha256 = "1gq5l9qv3vnl0rvxa110bbqsq6m43h8h912xijqab1hsjdpb46q3"; })
-  (fetchNuGet { pname = "NLog.Extensions.Logging"; version = "5.3.7"; sha256 = "1hv2v4hqqq86vjvxa0cbk4klaii8n8h1wjrlsfzbp9nnxnzg9pzi"; })
-  (fetchNuGet { pname = "NLog.Web.AspNetCore"; version = "5.3.7"; sha256 = "1jifwnvkfi3jankan7543q985gzrywddvajlqrf573aa2dbp5n1f"; })
+  (fetchNuGet { pname = "NLog"; version = "5.2.8"; sha256 = "1z3h20m5rjnizm1jbf5j0vpdc1f373rzzkg6478p1lxv5j385c12"; })
+  (fetchNuGet { pname = "NLog.Extensions.Logging"; version = "5.3.8"; sha256 = "1qnz91099f51vk7f5g2ig0041maw5hcbyqllxvj5zj7zkp0qw9b8"; })
+  (fetchNuGet { pname = "NLog.Web.AspNetCore"; version = "5.3.8"; sha256 = "05a6bzvdf63lbnn6sj3yfggxcgv96j91kdbcw0ac5hxl58df58r6"; })
+  (fetchNuGet { pname = "NuGet.Frameworks"; version = "5.11.0"; sha256 = "0wv26gq39hfqw9md32amr5771s73f5zn1z9vs4y77cgynxr73s4z"; })
  (fetchNuGet { pname = "NuGet.Frameworks"; version = "6.5.0"; sha256 = "0s37d1p4md0k6d4cy6sq36f2dgkd9qfbzapxhkvi8awwh0vrynhj"; })
  (fetchNuGet { pname = "protobuf-net"; version = "3.2.26"; sha256 = "1mcg46xnhgqwjacy6j8kvp3rylpi26wjnmhwv8mh5cwjya9nynqb"; })
  (fetchNuGet { pname = "protobuf-net.Core"; version = "3.2.26"; sha256 = "1wrr38ygdanf121bkl8b1d4kz1pawm064z69bqf3qbr46h4j575w"; })
@ -112,7 +120,7 @@
  (fetchNuGet { pname = "System.Composition.Hosting"; version = "8.0.0"; sha256 = "1gbfimhxx6v6073pblv4rl5shz3kgx8lvfif5db26ak8pl5qj4kb"; })
  (fetchNuGet { pname = "System.Composition.Runtime"; version = "8.0.0"; sha256 = "0snljpgfmg0wlkwilkvn9qjjghq1pjdfgdpnwhvl2qw6vzdij703"; })
  (fetchNuGet { pname = "System.Composition.TypedParts"; version = "8.0.0"; sha256 = "0skwla26d8clfz3alr8m42qbzsrbi7dhg74z6ha832b6730mm4pr"; })
-  (fetchNuGet { pname = "System.IdentityModel.Tokens.Jwt"; version = "7.0.3"; sha256 = "1fls88ffq34j1gr6zay1crm27v3sjs5fa4mvj9akqjq05bxanlhk"; })
+  (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "5.0.0"; sha256 = "0phd2qizshjvglhzws1jd0cq4m54gscz4ychzr3x6wbgl4vvfrga"; })
  (fetchNuGet { pname = "System.Linq.Async"; version = "6.0.1"; sha256 = "10ira8hmv0i54yp9ggrrdm1c06j538sijfjpn1kmnh9j2xk5yzmq"; })
  (fetchNuGet { pname = "System.Reflection.Metadata"; version = "1.6.0"; sha256 = "1wdbavrrkajy7qbdblpbpbalbdl48q3h34cchz24gvdgyrlf15r4"; })
  (fetchNuGet { pname = "System.Security.AccessControl"; version = "5.0.0"; sha256 = "17n3lrrl6vahkqmhlpn3w20afgz09n7i6rv0r3qypngwi7wqdr5r"; })
--- a/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
@ -2,7 +2,7 @@

 buildNpmPackage rec {
  pname = "asf-ui";
-  version = "f84a296f0ab029e56baba3cca45e5cf21129fd76";
+  version = "b341e7f78f1f73fb3a11a3f3cfbfbed929242606";

  src = fetchFromGitHub {
    owner = "JustArchiNET";
@ -10,10 +10,10 @@ buildNpmPackage rec {
    # updated by the update script
    # this is always the commit that should be used with asf-ui from the latest asf version
    rev = version;
-    hash = "sha256-NISUhxClFAzLQp4o9AzMzasPV9+aBAyDd1tuNT7HJw4=";
+    hash = "sha256-QrHBmLqvnVfHhBC+AF3YZUOx3ZEKA/FjtjXZW7ust8w=";
  };

-  npmDepsHash = "sha256-kI7kgSw0xs8Hsa/5lhLteDo8TgwyxIxKE1QK92D1Qio=";
+  npmDepsHash = "sha256-MmNckugDMNlBs6dNg/JRE+Qf5P8LbwIesul+7Osd16Y=";

  installPhase = ''
    runHook preInstall
--- a/pkgs/applications/misc/cobang/default.nix
+++ b/pkgs/applications/misc/cobang/default.nix
@ -1,72 +1,72 @@
 { lib
-, atk
 , buildPythonApplication
 , fetchFromGitHub
-, gdk-pixbuf
-, gobject-introspection
-, gst-plugins-good
+, brotlicffi
 , gst-python
-, gtk3
 , kiss-headers
-, libhandy
-, librsvg
 , logbook
-, networkmanager
-, pango
 , pillow
-, poetry-core
 , pygobject3
-, pytestCheckHook
-, python
 , python-zbar
-, pythonRelaxDepsHook
 , requests
 , single-version
+, gobject-introspection
+, gst-plugins-good
+, gtk3
+, libhandy
+, librsvg
+, networkmanager
+, setuptools
+, python
+, pytestCheckHook
 , wrapGAppsHook
 }:

 buildPythonApplication rec {
  pname = "cobang";
-  version = "0.10.1";
-  format = "pyproject";
+  version = "0.10.5";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "hongquan";
    repo = "CoBang";
    rev = "refs/tags/v${version}";
-    hash = "sha256-yNDnBTBmwcP3g51UkkLNyF4eHYjblwxPxS2lMwbFKUM=";
+    hash = "sha256-CfT/farNOJiWIioFBPx2q7bAFAE4khcojdZ7AsYaU6o=";
  };

-  pythonRelaxDeps = [
-    "logbook"
-    "Pillow"
-  ];
+  postPatch = ''
+    # Fixes "Multiple top-level packages discovered in a flat-layout"
+    sed -i '$ a\[tool.setuptools]' pyproject.toml
+    sed -i '$ a\packages = ["cobang"]' pyproject.toml
+  '';

  nativeBuildInputs = [
+    # Needed to recognize gobject namespaces
    gobject-introspection
-    pythonRelaxDepsHook
    wrapGAppsHook
+    setuptools
  ];

  buildInputs = [
-    atk
-    gdk-pixbuf
+    # Requires v4l2src
    gst-plugins-good
+    # For gobject namespaces
    libhandy
    networkmanager
-    pango
  ];

  propagatedBuildInputs = [
-    gst-python
+    brotlicffi
    kiss-headers
    logbook
    pillow
-    poetry-core
-    pygobject3
-    python-zbar
    requests
    single-version
+    # Unlisted dependencies
+    pygobject3
+    python-zbar
+    # Needed as a gobject namespace and to fix 'Caps' object is not subscriptable
+    gst-python
  ];

  nativeCheckInputs = [
@ -82,9 +82,8 @@ buildPythonApplication rec {

    # Icons and applications
    install -Dm 644 $out/${python.sitePackages}/data/vn.hoabinh.quan.CoBang.svg -t $out/share/pixmaps/
-    install -Dm 644 $out/${python.sitePackages}/data/vn.hoabinh.quan.CoBang.desktop -t $out/share/applications/
-    substituteInPlace $out/share/applications/vn.hoabinh.quan.CoBang.desktop \
-      --replace "Exec=" "Exec=$out/bin/"
+    install -Dm 644 $out/${python.sitePackages}/data/vn.hoabinh.quan.CoBang.desktop.in -t $out/share/applications/
+    mv $out/${python.sitePackages}/data/vn.hoabinh.quan.CoBang.desktop{.in,}
  '';

  preFixup = ''
@ -99,6 +98,7 @@ buildPythonApplication rec {
    homepage = "https://github.com/hongquan/CoBang";
    license = licenses.gpl3Only;
    maintainers = with maintainers; [ wolfangaukang ];
+    mainProgram = "cobang";
    platforms = [ "x86_64-linux" ];
  };
 }
--- a/pkgs/applications/misc/nwg-panel/default.nix
+++ b/pkgs/applications/misc/nwg-panel/default.nix
@ -16,13 +16,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "nwg-panel";
-  version = "0.9.23";
+  version = "0.9.24";

  src = fetchFromGitHub {
    owner = "nwg-piotr";
    repo = "nwg-panel";
-    rev = "v${version}";
-    hash = "sha256-NCMGqKRcwqy4e3gF9y2oykiAoL8X3IZbcGzq6N3CAMU=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-qd2fnGdpHXX35ZtNGe59GnmhYGn6VJibc0KEr60VIJM=";
  };

  # No tests
--- a/pkgs/applications/misc/polar-bookshelf/default.nix
+++ b/pkgs/applications/misc/polar-bookshelf/default.nix
@ -125,7 +125,7 @@ stdenv.mkDerivation rec {
    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
    license = lib.licenses.gpl3Only;
    platforms = lib.platforms.linux;
-    maintainers = [ lib.maintainers.noneucat ];
+    maintainers = [ ];
  };

 }
--- a/pkgs/applications/networking/browsers/floorp/default.nix
+++ b/pkgs/applications/networking/browsers/floorp/default.nix
@ -7,26 +7,26 @@

 ((buildMozillaMach rec {
  pname = "floorp";
-  packageVersion = "11.9.0";
+  packageVersion = "11.10.2";
  applicationName = "Floorp";
  binaryName = "floorp";
+  branding = "browser/branding/official";

  # Must match the contents of `browser/config/version.txt` in the source tree
-  version = "115.7.0";
+  version = "115.8.0";

  src = fetchFromGitHub {
    owner = "Floorp-Projects";
    repo = "Floorp";
    fetchSubmodules = true;
    rev = "v${packageVersion}";
-    hash = "sha256-Mk/5bkaSLQYFFGhCSjVho8CUilZSYDGarnIt4Wg9/6g=";
+    hash = "sha256-fjLYR59AZaR6S1zcAT+DNpdsCdrW+3NdkRQBoVNdwYw=";
  };

  extraConfigureFlags = [
    "--with-app-name=${pname}"
    "--with-app-basename=${applicationName}"
-    "--with-branding=browser/branding/official"
-    "--with-distribution-id=app.floorp.Floorp"
+    "--with-distribution-id=one.ablaze.floorp"
    "--with-unsigned-addon-scopes=app,system"
    "--allow-addon-sideload"
  ];
@ -41,12 +41,19 @@
                                           # not in `badPlatforms` because cross-compilation on 64-bit machine might work.
    maxSilent = 14400; # 4h, double the default of 7200s (c.f. #129212, #129115)
    license = lib.licenses.mpl20;
+    mainProgram = "floorp";
  };
  tests = [ nixosTests.floorp ];
 }).override {
+  # Upstream build configuration can be found at
+  # .github/workflows/src/linux/shared/mozconfig_linux_base
  privacySupport = true;
  webrtcSupport = true;
  enableOfficialBranding = false;
+  googleAPISupport = true;
+  mlsAPISupport = true;
 }).overrideAttrs (prev: {
+  MOZ_DATA_REPORTING = "";
  MOZ_REQUIRE_SIGNING = "";
+  MOZ_TELEMETRY_REPORTING = "";
 })
--- a/pkgs/applications/networking/browsers/mullvad-browser/default.nix
+++ b/pkgs/applications/networking/browsers/mullvad-browser/default.nix
@ -90,7 +90,7 @@ let
      ++ lib.optionals mediaSupport [ ffmpeg ]
  );

-  version = "13.0.9";
+  version = "13.0.10";

  sources = {
    x86_64-linux = fetchurl {
@ -102,7 +102,7 @@ let
        "https://tor.eff.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
        "https://tor.calyxinstitute.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
      ];
-      hash = "sha256-TAtBlSkfpqsROq3bV9kwDYIJQAXSVkwxQwj3wIYEI7k=";
+      hash = "sha256-+8b3K3XLSPlndR12KNUH0lsPquhTupxQrLBuSEGac7Y=";
    };
  };

--- a/pkgs/applications/networking/browsers/tor-browser/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser/default.nix
@ -101,7 +101,7 @@ lib.warnIf (useHardenedMalloc != null)
      ++ lib.optionals mediaSupport [ ffmpeg ]
  );

-  version = "13.0.9";
+  version = "13.0.10";

  sources = {
    x86_64-linux = fetchurl {
@ -111,7 +111,7 @@ lib.warnIf (useHardenedMalloc != null)
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
        "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
      ];
-      hash = "sha256-qcB3DLVt2J4WNJLunDSnZdyflMY9/NIsGrj+TkQeJEg=";
+      hash = "sha256-/Lpz8R2NvMuV+3NzBy7gC/vWheHliNm9thQQw/9bkuw=";
    };

    i686-linux = fetchurl {
@ -121,7 +121,7 @@ lib.warnIf (useHardenedMalloc != null)
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
        "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
      ];
-      hash = "sha256-aq2WffQ3ZUL0vopbDU5n9bWb8MC7rHoaz54kz2oaXz8=";
+      hash = "sha256-zDiXXNRik/R3DBQEWBuXD31MI+Kg4UL1KK6em+JtyCs=";
    };
  };

--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "kubernetes-helm";
-  version = "3.14.1";
+  version = "3.14.2";

  src = fetchFromGitHub {
    owner = "helm";
    repo = "helm";
    rev = "v${version}";
-    sha256 = "sha256-J7hREQMPN1RrnPmOyK2XgfvbAH2dl2H5TopnH8fF1V8=";
+    sha256 = "sha256-7Cd5lxPSXXCvYLLh334qnDmd9zbF1LMxTNoZEBpzHS4=";
  };
  vendorHash = "sha256-pYB9J7Zf6MApGpFL7HzqIDcC/vERiVE4z8SsipIeJ7c=";

--- a/pkgs/applications/networking/cluster/kompose/default.nix
+++ b/pkgs/applications/networking/cluster/kompose/default.nix
@ -1,24 +1,17 @@
-{ lib, buildGoModule, fetchFromGitHub, fetchpatch, installShellFiles, testers, kompose, git }:
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles, testers, kompose, git }:

 buildGoModule rec {
  pname = "kompose";
-  version = "1.26.1";
+  version = "1.32.0";

  src = fetchFromGitHub {
    owner = "kubernetes";
    repo = "kompose";
    rev = "v${version}";
-    sha256 = "sha256-NfzqGG5ZwPpmjhvcvXN1AA+kfZG/oujbAEtXkm1mzeU=";
+    hash = "sha256-W9KAjyMp8fbnZunH5hwj0uctNYxEN/vbEDGaFJpv5hM=";
  };

-  vendorHash = "sha256-/i4R50heqf0v2F2GTZCKGq10+xKKr+zPkqWKa+afue8=";
-
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/kubernetes/kompose/commit/0964a7ccd16504b6e5ef49a07978c87cca803d46.patch";
-      hash = "sha256-NMHLxx7Ae6Z+pacj538ivxIby7rNz3IbfDPbeLA0sMc=";
-    })
-  ];
+  vendorHash = "sha256-nY0d3r3faowHa7ylqDkUrX6MrGW3g1jYjm1MLFW/jK8=";

  nativeBuildInputs = [ installShellFiles git ];

--- a/pkgs/applications/networking/cluster/kubecfg/default.nix
+++ b/pkgs/applications/networking/cluster/kubecfg/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "kubecfg";
-  version = "0.34.2";
+  version = "0.34.3";

  src = fetchFromGitHub {
    owner = "kubecfg";
    repo = "kubecfg";
    rev = "v${version}";
-    hash = "sha256-+qQ/80wXSKvPg2nRuvkYZe0+fwnxKsegR0IjsxBKDNQ=";
+    hash = "sha256-zy7SuJ5ChR09CvZ362z6ZDRd/eIyqg06fpv+JP7C4T0=";
  };

-  vendorHash = "sha256-X+EvvrAnqMw/jpVdF/UJq9zFH+1NLFLYOu5RsxykynY=";
+  vendorHash = "sha256-TDXZy2I1sxMmtHiE5l9wgW1kJolFYsV5Otv3xfoErWM=";

  ldflags = [
    "-s"
--- a/pkgs/applications/networking/cluster/temporal/default.nix
+++ b/pkgs/applications/networking/cluster/temporal/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "temporal";
-  version = "1.22.4";
+  version = "1.22.5";

  src = fetchFromGitHub {
    owner = "temporalio";
    repo = "temporal";
    rev = "v${version}";
-    hash = "sha256-M/2Zm9B2VeA2BKcF7A7R1Y7T61VZiU2uKGwxGgdy4Sg=";
+    hash = "sha256-PHdRyYOhNoJ6NpSKNbCF2hddZeY5mIF34HQP05n/sy0=";
  };

  vendorHash = "sha256-Aum5OsdJ69MkP8tXXGWa6IdouX6F4xKjD/ndAqShMhw=";
--- a/pkgs/applications/networking/discordo/default.nix
+++ b/pkgs/applications/networking/discordo/default.nix
@ -3,16 +3,16 @@

 buildGoModule rec {
  pname = "discordo";
-  version = "unstable-2024-02-16";
+  version = "unstable-2024-02-21";

  src = fetchFromGitHub {
    owner = "ayn2op";
    repo = pname;
-    rev = "7476d8b391f23fa576f8f34eef3829c6212c6331";
-    hash = "sha256-x1/CXHqfiT0HgIPsiRluifPOJUrulN+fih0aOrj3us0=";
+    rev = "3486f6ced9db8eb865641632e50daa2550a55ef8";
+    hash = "sha256-iSc9WiX0xu9X1GCSPEnf99OpTaKVlNN7sGp+f1S89SM=";
  };

-  vendorHash = "sha256-PW0PPMlNB5aa81tsYWUk9mWfSyafI5A0OxqJTCe0OdI=";
+  vendorHash = "sha256-89WJZuqUnYGT2eTWcfxdouwc2kZ15Lt38EyLP/DLSWI=";

  CGO_ENABLED = 0;

--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@ -3,7 +3,7 @@ let
  versions =
    if stdenv.isLinux then {
      stable = "0.0.43";
-      ptb = "0.0.67";
+      ptb = "0.0.69";
      canary = "0.0.278";
      development = "0.0.13";
    } else {
@ -21,7 +21,7 @@ let
      };
      ptb = fetchurl {
        url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-LySb261stSdUWMfCZ6Ca/MZMhnJ+CEEKmm38cuD1k1s=";
+        hash = "sha256-xAfKqWopvrosogQ43feMJlM3mMx+vbdhNe7jo6cpkW0=";
      };
      canary = fetchurl {
        url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
--- a/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
+++ b/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
@ -1,61 +1,37 @@
-{ stdenv, lib, fetchurl, makeDesktopItem, copyDesktopItems, makeWrapper,
-electron, libsecret }:
+{ lib
+, appimageTools
+, fetchurl
+}:

-stdenv.mkDerivation rec {
+appimageTools.wrapType2 rec {
  pname = "tutanota-desktop";
-  version = "3.119.3";
+  version = "3.122.5";

  src = fetchurl {
-    url = "https://github.com/tutao/tutanota/releases/download/tutanota-desktop-release-${version}/${pname}-${version}-unpacked-linux.tar.gz";
-    name = "tutanota-desktop-${version}.tar.gz";
-    hash = "sha256-TdjvU12nh1sTfGTdBn+7dbEunaF38YjDvceEns4iRbA=";
+    url = "https://github.com/tutao/tutanota/releases/download/tutanota-desktop-release-${version}/tutanota-desktop-linux.AppImage";
+    hash = "sha256-3M53Re6FbxEXHBl5KBLDjZg0uTIv8JIT0DlawNRPXBc=";
  };

-  nativeBuildInputs = [
-    copyDesktopItems
-    makeWrapper
-  ];
+  extraPkgs = pkgs: (appimageTools.defaultFhsEnvArgs.multiPkgs pkgs) ++ [ pkgs.libsecret ];

-  dontConfigure = true;
-  dontBuild = true;
+  extraInstallCommands =
+    let appimageContents = appimageTools.extract { inherit pname version src; };
+    in ''
+      mv $out/bin/${pname}-${version} $out/bin/${pname}

-  desktopItems = makeDesktopItem {
-    name = pname;
-    exec = "tutanota-desktop";
-    icon = "tutanota-desktop";
-    comment = meta.description;
-    desktopName = "Tutanota Desktop";
-    genericName = "Email Reader";
-  };
+      install -Dm 444 ${appimageContents}/tutanota-desktop.desktop -t $out/share/applications
+      install -Dm 444 ${appimageContents}/tutanota-desktop.png -t $out/share/pixmaps

-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/bin $out/opt/tutanota-desktop $out/share/tutanota-desktop
-
-    cp -r ./ $out/opt/tutanota-desktop
-    mv $out/opt/tutanota-desktop/{locales,resources} $out/share/tutanota-desktop
-
-    for icon_size in 64 512; do
-      icon=resources/icons/icon/$icon_size.png
-      path=$out/share/icons/hicolor/$icon_size'x'$icon_size/apps/tutanota-desktop.png
-      install -Dm644 $icon $path
-    done
-
-    makeWrapper ${electron}/bin/electron \
-      $out/bin/tutanota-desktop \
-      --add-flags $out/share/tutanota-desktop/resources/app.asar \
-      --run "mkdir -p /tmp/tutanota" \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libsecret stdenv.cc.cc.lib ]}
-
-    runHook postInstall
-  '';
+      substituteInPlace $out/share/applications/tutanota-desktop.desktop \
+        --replace 'Exec=AppRun' 'Exec=${pname}'
+    '';

  meta = with lib; {
-    description = "Tutanota official desktop client";
-    homepage = "https://tutanota.com/";
+    description = "Tuta official desktop client";
+    homepage = "https://tuta.com/";
    changelog = "https://github.com/tutao/tutanota/releases/tag/tutanota-desktop-release-${version}";
    license = licenses.gpl3Only;
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
    maintainers = with maintainers; [ wolfangaukang ];
    mainProgram = "tutanota-desktop";
    platforms = [ "x86_64-linux" ];
--- a/pkgs/applications/networking/p2p/flood-for-transmission/default.nix
+++ b/pkgs/applications/networking/p2p/flood-for-transmission/default.nix
@ -6,13 +6,13 @@

 buildNpmPackage rec {
  pname = "flood-for-transmission";
-  version = "2024-01-24T16-52-06";
+  version = "2024-02-10T19-10-27";

  src = fetchFromGitHub {
    owner = "johman10";
    repo = pname;
    rev = version;
-    hash = "sha256-ZV/Gk9DlYkMh8j034YGvMVN7MeOJgFARyOr9Atrs3j4=";
+    hash = "sha256-JhUBtjHWtfFwjOScDu+WtjE42yhWYPA6KD+kJsltbsY=";
  };

  npmDepsHash = "sha256-VHWM0vxFKucrmoJiwYpjw7QqhBQw9rPPQVIIevp6Wn0=";
--- a/pkgs/applications/science/biology/octopus/default.nix
+++ b/pkgs/applications/science/biology/octopus/default.nix
@ -19,10 +19,17 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-VaUr63v7mzhh4VBghH7a7qrqOYwl6vucmmKzTi9yAjY=";
  }) ];

-  env.NIX_CFLAGS_COMPILE = toString [
-    # Needed with GCC 12
-    "-Wno-error=deprecated-declarations"
-  ];
+  postPatch = ''
+    # Disable -Werror to avoid build failure on fresh toolchains like
+    # gcc-13.
+    substituteInPlace lib/date/CMakeLists.txt --replace-fail ' -Werror ' ' '
+    substituteInPlace lib/ranger/CMakeLists.txt --replace-fail ' -Werror ' ' '
+    substituteInPlace lib/tandem/CMakeLists.txt --replace-fail ' -Werror ' ' '
+    substituteInPlace src/CMakeLists.txt --replace-fail ' -Werror ' ' '
+
+    # Fix gcc-13 build due to missing <cstdint> header.
+    sed -e '1i #include <cstdint>' -i src/core/tools/vargen/utils/assembler.hpp
+  '';

  postInstall = ''
    mkdir $out/bin
--- a/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
+++ b/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
@ -19,6 +19,10 @@
 , cpuAcceleration ? null
 }:

+
+# CUDA is only implemented for single precission
+assert enableCuda -> singlePrec;
+
 let
  inherit (cudaPackages.cudaFlags) cudaCapabilities dropDot;

@ -75,6 +79,7 @@ in stdenv.mkDerivation rec {
    lapack
  ] ++ lib.optional enableMpi mpi
  ++ lib.optionals enableCuda [
+    cudaPackages.cuda_cccl
    cudaPackages.cuda_cudart
    cudaPackages.libcufft
    cudaPackages.cuda_profiler_api
--- a/pkgs/applications/version-management/forgejo/default.nix
+++ b/pkgs/applications/version-management/forgejo/default.nix
@ -39,14 +39,14 @@ let
 in
 buildGoModule rec {
  pname = "forgejo";
-  version = "1.21.5-0";
+  version = "1.21.6-0";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "forgejo";
    repo = "forgejo";
    rev = "v${version}";
-    hash = "sha256-SmNmMlO9bEccrk0oWm7VnBaIRGJgTQ5hOSIn6DRiYqk=";
+    hash = "sha256-YvLdqNo/zGutPnRVkcxCTcX7Xua0FXUs3veQ2NBgaAA=";
  };

  vendorHash = "sha256-5BznZiPZCwFEl74JVf7ujFtzsTyG6AcKvQG0LdaMKe4=";
--- a/pkgs/applications/virtualization/virtualbox/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/default.nix
@ -214,6 +214,8 @@ in stdenv.mkDerivation {
        mkdir -p $out/share/icons/hicolor/$size/apps
        ln -s $libexec/icons/$size/*.png $out/share/icons/hicolor/$size/apps
      done
+      # Translation
+      ln -sv $libexec/nls "$out/share/virtualbox"
    ''}

    cp -rv out/linux.*/${buildType}/bin/src "$modsrc"
--- a/pkgs/build-support/appimage/default.nix
+++ b/pkgs/build-support/appimage/default.nix
@ -209,6 +209,7 @@ rec {
      xorg.libxshmfence # for apple-music-electron
      at-spi2-core
      pciutils # for FreeCAD
+      pipewire # immersed-vr wayland support
    ];
  };
 }
--- a/pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix
+++ b/pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix
@ -251,7 +251,7 @@ let

 in runCommandLocal "${name}-fhs" {
  passthru = {
-    inherit args baseTargetPaths targetPaths baseMultiPaths multiPaths ldconfig;
+    inherit args baseTargetPaths targetPaths baseMultiPaths ldconfig;
  };
 } ''
  mkdir -p $out
--- a/pkgs/by-name/dd/ddns-updater/package.nix
+++ b/pkgs/by-name/dd/ddns-updater/package.nix
@ -0,0 +1,37 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+buildGoModule rec {
+  pname = "ddns-updater";
+  version = "2.6.0";
+
+  src = fetchFromGitHub {
+    owner = "qdm12";
+    repo = "ddns-updater";
+    rev = "v${version}";
+    hash = "sha256-NU6KXVjggsXVCKImGqbB1AXcph+ycRfkk5S4JNq0cHg=";
+  };
+
+  vendorHash = "sha256-Ibrv0m3Tz/5JbkHYmiJ9Ijo37fjHc7TP100K7ZTwO8I=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  subPackages = [ "cmd/updater" ];
+
+  postInstall = ''
+    mv $out/bin/updater $out/bin/ddns-updater
+  '';
+
+  meta = with lib; {
+    description = "Container to update DNS records periodically with WebUI for many DNS providers";
+    homepage = "https://github.com/qdm12/ddns-updater";
+    license = licenses.mit;
+    maintainers = with maintainers; [ delliott ];
+    mainProgram = "ddns-updater";
+  };
+}
--- a/pkgs/by-name/de/delfin/package.nix
+++ b/pkgs/by-name/de/delfin/package.nix
@ -21,29 +21,22 @@

 stdenv.mkDerivation rec {
  pname = "delfin";
-  version = "0.3.0";
+  version = "0.4.0";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "avery42";
    repo = "delfin";
    rev = "v${version}";
-    hash = "sha256-1Q3Aywf80CCXxorWSymwxJwMU1I4k7juDoWG5J18AXY=";
+    hash = "sha256-QwxdNPLL7PBokq5WaPylD4bBmXmJWyEQsWKN7DM2utk=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-/RZD4b7hrbC1Z5MtHDdib5TFEmxAh9odjNPo4m+FqK4=";
+    hash = "sha256-ElB9TbfmYn/A1Y3+oQ752zHqkC+f2RJPxfGXH0m5C/E=";
  };

-  # upstream pinned the linker to clang/mold through 0.3.0, unnecessarily.
-  # remove this patch for version > 0.3.0.
-  # see: <https://codeberg.org/avery42/delfin/commit/e6deee77e9a6a6ba2425d1cc88dcbdeb471d1fdc>
-  postPatch = ''
-    rm .cargo/config.toml
-  '';
-
  nativeBuildInputs = [
    appstream
    desktop-file-utils
--- a/pkgs/by-name/do/doublecmd/package.nix
+++ b/pkgs/by-name/do/doublecmd/package.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "doublecmd";
-  version = "1.1.9";
+  version = "1.1.10";

  src = fetchFromGitHub {
    owner = "doublecmd";
    repo = "doublecmd";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-NgCN72yACSzsnQdDxBM4QQCE8m5+FT31Ia51yEiXBfY=";
+    hash = "sha256-vRB4qUws3kqCf7gp8Lzt8e9p68FaAfQyFHj4oJS9QtI=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ez/eza/package.nix
+++ b/pkgs/by-name/ez/eza/package.nix
@ -17,16 +17,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "eza";
-  version = "0.18.3";
+  version = "0.18.4";

  src = fetchFromGitHub {
    owner = "eza-community";
    repo = "eza";
    rev = "v${version}";
-    hash = "sha256-gxJajnq9VU9SDjClEV7QPAvI5dX3flTzyK228Iy0Mhk=";
+    hash = "sha256-G8Ow38vNSMMYINYhGp33rls5AV4EFZDEJhkNn5H64LA=";
  };

-  cargoHash = "sha256-p6r0sR32M0/3GoybA2N1qs0M4Bmtq+s97GT5PMAolcg=";
+  cargoHash = "sha256-A/EIkWSdMqSdrnjMTfIdg0scSBK/xsI5PPsOn+cRogA=";

  nativeBuildInputs = [ cmake pkg-config installShellFiles pandoc ];
  buildInputs = [ zlib ]
--- a/pkgs/by-name/ho/hoppscotch/package.nix
+++ b/pkgs/by-name/ho/hoppscotch/package.nix
@ -0,0 +1,71 @@
+{ lib
+, stdenv
+, fetchurl
+, appimageTools
+, undmg
+, nix-update-script
+}:
+
+let
+  pname = "hoppscotch";
+  version = "23.12.5";
+
+  src = fetchurl {
+    aarch64-darwin = {
+      url = "https://github.com/hoppscotch/releases/releases/download/v${version}-1/Hoppscotch_mac_aarch64.dmg";
+      hash = "sha256-WUJW38vQ7o5KEmCxhVnJ03/f5tPOTYcczrEcmt6NSCY=";
+    };
+    x86_64-darwin = {
+      url = "https://github.com/hoppscotch/releases/releases/download/v${version}-1/Hoppscotch_mac_x64.dmg";
+      hash = "sha256-bQFD+9IoelinWYUndzbVvPNaRde6ACPvw9ifX9mYdno=";
+    };
+    x86_64-linux = {
+      url = "https://github.com/hoppscotch/releases/releases/download/v${version}-1/Hoppscotch_linux_x64.AppImage";
+      hash = "sha256-MYQ7SRm+CUPIXROZxejbbZ0/wH+U5DQO4YGbE/HQAj8=";
+    };
+  }.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
+
+  meta = {
+    description = "Open source API development ecosystem";
+    homepage = "https://hoppscotch.com";
+    changelog = "https://github.com/hoppscotch/hoppscotch/releases/tag/${version}";
+    platforms = [ "aarch64-darwin" "x86_64-darwin" "x86_64-linux" ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ DataHearth ];
+  };
+in
+if stdenv.isDarwin then stdenv.mkDerivation
+{
+  inherit pname version src meta;
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [ undmg ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/Applications"
+    mv Hoppscotch.app $out/Applications/
+
+    runHook postInstall
+  '';
+}
+else appimageTools.wrapType2 {
+  inherit pname version src meta;
+
+  extraPkgs = pkgs:
+    appimageTools.defaultFhsEnvArgs.multiPkgs pkgs;
+
+  extraInstallCommands =
+    let
+      appimageContents = appimageTools.extractType2 { inherit pname version src; };
+    in
+    ''
+      mv $out/bin/${pname}-${version} $out/bin/${pname}
+
+      # Install .desktop files
+      install -Dm444 ${appimageContents}/hoppscotch.desktop -t $out/share/applications
+      install -Dm444 ${appimageContents}/hoppscotch.png -t $out/share/pixmaps
+    '';
+}
--- a/pkgs/by-name/hy/hypridle/package.nix
+++ b/pkgs/by-name/hy/hypridle/package.nix
@ -0,0 +1,45 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, pkg-config
+, cmake
+, wayland
+, wayland-protocols
+, hyprlang
+, sdbus-cpp
+, systemd
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "hypridle";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "hyprwm";
+    repo = "hypridle";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-0x5R6v82nKBualYf+TxAduMsvG80EZAl7gofTIYtpf4=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    hyprlang
+    sdbus-cpp
+    systemd
+    wayland
+    wayland-protocols
+  ];
+
+  meta = {
+    description = "Hyprland's idle daemon";
+    homepage = "https://github.com/hyprwm/hypridle";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ iogamaster ];
+    mainProgram = "hypridle";
+    platforms = [ "aarch64-linux" "x86_64-linux" ];
+  };
+})
--- a/pkgs/by-name/hy/hyprlang/package.nix
+++ b/pkgs/by-name/hy/hyprlang/package.nix
@ -4,15 +4,16 @@
  fetchFromGitHub,
  cmake,
 }:
+
 stdenv.mkDerivation (finalAttrs: {
  pname = "hyprlang";
-  version = "0.3.2";
+  version = "0.4.0";

  src = fetchFromGitHub {
    owner = "hyprwm";
    repo = "hyprlang";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-9TT3xk++LI5/SPYgjYX34xZ4ebR93c1uerIq+SE/ues=";
+    hash = "sha256-nW3Zrhh9RJcMTvOcXAaKADnJM/g6tDf3121lJtTHnYo=";
  };

  nativeBuildInputs = [cmake];
@ -26,5 +27,6 @@ stdenv.mkDerivation (finalAttrs: {
    description = "The official implementation library for the hypr config language";
    license = licenses.gpl3Plus;
    platforms = platforms.linux;
+    maintainers = with maintainers; [ iogamaster fufexan ];
  };
 })
--- a/pkgs/by-name/jo/jogl/package.nix
+++ b/pkgs/by-name/jo/jogl/package.nix
@ -38,7 +38,31 @@ stdenv.mkDerivation {

  unpackCmd = "cp -r $curSrc \${curSrc##*-}";

-  postPatch = lib.optionalString stdenv.isDarwin ''
+  postPatch = ''
+    substituteInPlace gluegen/src/java/com/jogamp/common/util/IOUtil.java \
+      --replace-fail '#!/bin/true' '#!${coreutils}/bin/true'
+  ''
+  # set timestamp of files in jar to a fixed point in time
+  + ''
+    xmlstarlet ed --inplace \
+      --append //jar --type attr -n modificationtime --value 1980-01-01T00:00Z \
+      gluegen/make/{build.xml,gluegen-cpptasks-base.xml} \
+      jogl/make/{build.xml,build-nativewindow.xml,build-jogl.xml}
+  ''
+  # prevent looking for native libraries in /usr/lib
+  + ''
+    substituteInPlace jogl/make/build-*.xml \
+      --replace-warn 'dir="''${TARGET_PLATFORM_USRLIBS}"' ""
+  ''
+  # force way to do disfunctional "ant -Dsetup.addNativeBroadcom=false" and disable dependency on raspberrypi drivers
+  # if arm/aarch64 support will be added, this block might be commented out on those platforms
+  # on x86 compiling with default "setup.addNativeBroadcom=true" leads to unsatisfied import "vc_dispmanx_resource_delete" in libnewt.so
+  + ''
+    xmlstarlet ed --inplace \
+      --delete '//*[@if="setup.addNativeBroadcom"]' \
+      jogl/make/build-newt.xml
+  ''
+  + lib.optionalString stdenv.isDarwin ''
    sed -i '/if="use.macos/d' gluegen/make/gluegen-cpptasks-base.xml
    rm -r jogl/oculusvr-sdk
  '';
@ -67,46 +91,35 @@ stdenv.mkDerivation {
    darwin.apple_sdk_11_0.frameworks.Cocoa
  ];

-  # Workaround build failure on -fno-common toolchains:
-  #   ld: ../obj/Bindingtest1p1Impl_JNI.o:(.bss+0x8): multiple definition of
-  #     `unsigned_size_t_1'; ../obj/TK_Surface_JNI.o:(.bss+0x8): first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon"; # copied from 2.3.2, is this still needed?
+  env = {
+    SOURCE_LEVEL = "1.8";
+    TARGET_LEVEL = "1.8";
+    TARGET_RT_JAR = "null.jar";
+    # error: incompatible pointer to integer conversion returning 'GLhandleARB' (aka 'void *') from a function with result type 'jlong' (aka 'long long')
+    NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-int-conversion";
+  };

  buildPhase = ''
-    ( cd gluegen/make
-      substituteInPlace ../src/java/com/jogamp/common/util/IOUtil.java --replace '#!/bin/true' '#!${coreutils}/bin/true'
+    runHook preBuild

-      # set timestamp of files in jar to a fixed point in time
-      xmlstarlet ed --inplace \
-         --append //jar --type attr -n modificationtime --value 1980-01-01T00:00Z \
-         build.xml gluegen-cpptasks-base.xml
+    for f in gluegen jogl; do
+      pushd $f/make
+      ant
+      popd
+    done

-      ant -Dtarget.sourcelevel=8 -Dtarget.targetlevel=8 -Dtarget.rt.jar='null.jar' )
-
-    ( cd jogl/make
-
-      # prevent looking for native libraries in /usr/lib
-      substituteInPlace build-*.xml \
-        --replace 'dir="''${TARGET_PLATFORM_USRLIBS}"' ""
-
-      # force way to do disfunctional "ant -Dsetup.addNativeBroadcom=false" and disable dependency on raspberrypi drivers
-      # if arm/aarch64 support will be added, this block might be commented out on those platforms
-      # on x86 compiling with default "setup.addNativeBroadcom=true" leads to unsatisfied import "vc_dispmanx_resource_delete" in libnewt.so
-      xmlstarlet ed --inplace --delete '//*[@if="setup.addNativeBroadcom"]' build-newt.xml
-
-      # set timestamp of files in jar to a fixed point in time
-      xmlstarlet ed --inplace \
-         --append //jar --type attr -n modificationtime --value 1980-01-01T00:00Z \
-         build.xml build-nativewindow.xml build-jogl.xml
-
-      ant -Dtarget.sourcelevel=8 -Dtarget.targetlevel=8 -Dtarget.rt.jar='null.jar' )
+    runHook postBuild
  '';

  installPhase = ''
+    runHook preInstall
+
    mkdir -p $out/share/java
    cp -v $NIX_BUILD_TOP/gluegen/build/gluegen-rt{,-natives-linux-*}.jar $out/share/java/
    cp -v $NIX_BUILD_TOP/jogl/build/jar/jogl-all{,-natives-linux-*}.jar  $out/share/java/
    cp -v $NIX_BUILD_TOP/jogl/build/nativewindow/nativewindow{,-awt,-natives-linux-*,-os-drm,-os-x11}.jar  $out/share/java/
+
+    runHook postInstall
  '';

  meta = with lib; {
--- a/pkgs/applications/misc/nhentai/default.nix
+++ b/pkgs/applications/misc/nhentai/default.nix
@ -29,7 +29,7 @@ python3Packages.buildPythonApplication rec {

  meta = {
    homepage = "https://github.com/RicterZ/nhentai";
-    description = "nHentai is a CLI tool for downloading doujinshi from <http://nhentai.net>";
+    description = "CLI tool for downloading doujinshi from adult site(s)";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ ];
    mainProgram = "nhentai";
--- a/pkgs/applications/virtualization/nvidia-container-toolkit/0001-Add-dlopen-discoverer.patch
+++ b/pkgs/applications/virtualization/nvidia-container-toolkit/0001-Add-dlopen-discoverer.patch
--- a/pkgs/by-name/nv/nvidia-container-toolkit/nvidia-docker.nix
+++ b/pkgs/by-name/nv/nvidia-container-toolkit/nvidia-docker.nix
--- a/pkgs/applications/virtualization/nvidia-container-toolkit/default.nix
+++ b/pkgs/applications/virtualization/nvidia-container-toolkit/default.nix
@ -6,8 +6,8 @@
 , linkFarm
 , writeShellScript
 , formats
-, containerRuntimePath
-, configTemplate
+, containerRuntimePath ? null
+, configTemplate ? null
 , configTemplatePath ? null
 , libnvidia-container
 , cudaPackages
@ -91,7 +91,7 @@ buildGoModule rec {
    makeWrapper
  ];

-  preConfigure = ''
+  preConfigure = lib.optionalString (containerRuntimePath != null) ''
    # Ensure the runc symlink isn't broken:
    if ! readlink --quiet --canonicalize-existing "${isolatedContainerRuntimePath}/runc" ; then
      echo "${isolatedContainerRuntimePath}/runc: broken symlink" >&2
@ -109,7 +109,7 @@ buildGoModule rec {
    in
    [ "-skip" "${builtins.concatStringsSep "|" skippedTests}" ];

-  postInstall = ''
+  postInstall = lib.optionalString (containerRuntimePath != null) ''
    mkdir -p $out/etc/nvidia-container-runtime

    # nvidia-container-runtime invokes docker-runc or runc if that isn't
--- a/pkgs/applications/virtualization/nvidia-container-toolkit/packages.nix
+++ b/pkgs/applications/virtualization/nvidia-container-toolkit/packages.nix
@ -29,7 +29,7 @@ lib.makeScope newScope (
        ldconfig = "@@glibcbin@/bin/ldconfig";
      };
    };
-    nvidia-container-toolkit-docker = self.callPackage ./. {
+    nvidia-container-toolkit-docker = self.callPackage ./package.nix {
      containerRuntimePath = "${docker}/libexec/docker/docker";
      configTemplate = self.dockerConfig;
    };
@ -65,7 +65,8 @@ lib.makeScope newScope (
      ];
      inherit (self.nvidia-docker-unwrapped) meta;
    };
-    nvidia-docker-unwrapped = self.callPackage ../nvidia-docker { };
+    nvidia-docker-unwrapped =
+      self.callPackage ./nvidia-docker.nix { };

    nvidia-podman = symlinkJoin {
      name = "nvidia-podman";
--- a/pkgs/by-name/os/osc-cli/package.nix
+++ b/pkgs/by-name/os/osc-cli/package.nix
@ -0,0 +1,41 @@
+{
+  lib
+  , python3
+  , fetchFromGitHub
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "osc-cli";
+  version = "1.11.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "outscale";
+    repo = "osc-cli";
+    rev = "v${version}";
+    hash = "sha256-7WXy+1NHwFvYmyi5xGfWpq/mbVGJ3WkgP5WQd5pvcC0=";
+  };
+
+  nativeBuildInputs = [
+    python3.pkgs.setuptools
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    defusedxml
+    fire
+    requests
+    typing-extensions
+    xmltodict
+  ];
+
+  # Skipping tests as they require working access and secret keys
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Official Outscale CLI providing connectors to Outscale API";
+    homepage = "https://github.com/outscale/osc-cli";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ nicolas-goudry ];
+    mainProgram = "osc-cli";
+  };
+}
--- a/pkgs/by-name/pl/plumber/package.nix
+++ b/pkgs/by-name/pl/plumber/package.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "plumber";
-  version = "2.5.3";
+  version = "2.5.4";

  src = fetchFromGitHub {
    owner = "streamdal";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-0uQYNOmG84kJo6fBZNv4/ua8uVzg2OWOWVFdGIcbm5U=";
+    hash = "sha256-6nPH+HQtpFJ4MAtblFWjaQjDSKtpIxW9tGt2o1ICtos=";
  };

  vendorHash = null;
--- a/pkgs/by-name/s3/s3proxy/package.nix
+++ b/pkgs/by-name/s3/s3proxy/package.nix
@ -0,0 +1,40 @@
+{ lib
+, fetchFromGitHub
+, jre
+, makeWrapper
+, maven
+}:
+
+let
+  pname = "s3proxy";
+  version = "2.1.0";
+in
+maven.buildMavenPackage {
+  inherit pname version;
+  mvnHash = "sha256-85mE/pZ0DXkzOKvTAqBXGatAt8gc4VPRCxmEyIlyVGI=";
+
+  src = fetchFromGitHub {
+    owner = "gaul";
+    repo = pname;
+    rev = "s3proxy-${version}";
+    hash = "sha256-GhZPvo8wlXInHwg8rSmpwMMkZVw5SMpnZyKqFUYLbrE=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    install -D --mode=644 --target-directory=$out/share/s3proxy target/s3proxy-${version}-jar-with-dependencies.jar
+
+    makeWrapper ${jre}/bin/java $out/bin/s3proxy \
+      --add-flags "-jar $out/share/s3proxy/s3proxy-${version}-jar-with-dependencies.jar"
+  '';
+
+  meta = with lib; {
+    description = "Access other storage backends via the S3 API";
+    homepage = "https://github.com/gaul/s3proxy";
+    changelog = "https://github.com/gaul/s3proxy/releases/tag/s3proxy-${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ camelpunch ];
+  };
+}
+
--- a/pkgs/by-name/sc/scrutiny-collector/package.nix
+++ b/pkgs/by-name/sc/scrutiny-collector/package.nix
@ -0,0 +1,53 @@
+{ buildGoModule
+, fetchFromGitHub
+, makeWrapper
+, smartmontools
+, nixosTests
+, lib
+}:
+let
+  version = "0.7.2";
+in
+buildGoModule rec {
+  inherit version;
+  pname = "scrutiny-collector";
+
+  src = fetchFromGitHub {
+    owner = "AnalogJ";
+    repo = "scrutiny";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-UYKi+WTsasUaE6irzMAHr66k7wXyec8FXc8AWjEk0qs=";
+  };
+
+  subPackages = "collector/cmd/collector-metrics";
+
+  vendorHash = "sha256-SiQw6pq0Fyy8Ia39S/Vgp9Mlfog2drtVn43g+GXiQuI=";
+
+  buildInputs = [ makeWrapper ];
+
+  CGO_ENABLED = 0;
+
+  ldflags = [ "-extldflags=-static" ];
+
+  tags = [ "static" ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    cp $GOPATH/bin/collector-metrics $out/bin/scrutiny-collector-metrics
+    wrapProgram $out/bin/scrutiny-collector-metrics \
+      --prefix PATH : ${lib.makeBinPath [ smartmontools ]}
+    runHook postInstall
+  '';
+
+  passthru.tests.scrutiny-collector = nixosTests.scrutiny;
+
+  meta = {
+    description = "Hard disk metrics collector for Scrutiny.";
+    homepage = "https://github.com/AnalogJ/scrutiny";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jnsgruk ];
+    mainProgram = "scrutiny-collector-metrics";
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/by-name/sc/scrutiny/package.nix
+++ b/pkgs/by-name/sc/scrutiny/package.nix
@ -0,0 +1,68 @@
+{ buildNpmPackage
+, buildGoModule
+, fetchFromGitHub
+, nixosTests
+, lib
+}:
+let
+  pname = "scrutiny";
+  version = "0.7.2";
+
+  src = fetchFromGitHub {
+    owner = "AnalogJ";
+    repo = "scrutiny";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-UYKi+WTsasUaE6irzMAHr66k7wXyec8FXc8AWjEk0qs=";
+  };
+
+  frontend = buildNpmPackage {
+    inherit version;
+    pname = "${pname}-webapp";
+    src = "${src}/webapp/frontend";
+
+    npmDepsHash = "sha256-M8P41LPg7oJ/C9abDuNM5Mn+OO0zK56CKi2BwLxv8oQ=";
+
+    buildPhase = ''
+      runHook preBuild
+      mkdir dist
+      npm run build:prod --offline -- --output-path=dist
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      mkdir $out
+      cp -r dist/* $out
+      runHook postInstall
+    '';
+  };
+in
+buildGoModule rec {
+  inherit pname src version;
+
+  subPackages = "webapp/backend/cmd/scrutiny";
+
+  vendorHash = "sha256-SiQw6pq0Fyy8Ia39S/Vgp9Mlfog2drtVn43g+GXiQuI=";
+
+  CGO_ENABLED = 0;
+
+  ldflags = [ "-extldflags=-static" ];
+
+  tags = [ "static" ];
+
+  postInstall = ''
+    mkdir -p $out/share/scrutiny
+    cp -r ${frontend}/* $out/share/scrutiny
+  '';
+
+  passthru.tests.scrutiny = nixosTests.scrutiny;
+
+  meta = {
+    description = "Hard Drive S.M.A.R.T Monitoring, Historical Trends & Real World Failure Thresholds.";
+    homepage = "https://github.com/AnalogJ/scrutiny";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jnsgruk ];
+    mainProgram = "scrutiny";
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/by-name/ue/uefisettings/package.nix
+++ b/pkgs/by-name/ue/uefisettings/package.nix
@ -0,0 +1,30 @@
+{ fetchFromGitHub
+, lib
+, rustPlatform
+}:
+
+rustPlatform.buildRustPackage {
+  name = "uefisettings";
+  version = "unstable-2024-02-20";
+
+  src = fetchFromGitHub {
+    owner = "linuxboot";
+    repo = "uefisettings";
+    rev = "eae8b8b622b7ac3c572eeb3b3513ed623e272fcc";
+    hash = "sha256-zLgrxYBj5bEMZRw5sKWqKuV3jQOJ6dnzbzpoqE0OhKs=";
+  };
+
+  cargoHash = "sha256-FCQ/1E6SZyVOOAlpqyaDWEZx0y0Wk3Caosvr48VamAA=";
+
+  # Tests expect filesystem access to directories like /proc
+  doCheck = false;
+
+  meta = with lib; {
+    description = "CLI tool to read/get/extract and write/change/modify BIOS/UEFI settings.";
+    homepage = "https://github.com/linuxboot/uefisettings";
+    license = with licenses; [ bsd3 ];
+    mainProgram = "uefisettings";
+    maintainers = with maintainers; [ surfaceflinger ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/by-name/uv/uv/Cargo.lock
+++ b/pkgs/by-name/uv/uv/Cargo.lock
@ -876,7 +876,7 @@ name = "distribution-filename"
 version = "0.0.1"
 dependencies = [
 "insta",
- "pep440_rs 0.4.0",
+ "pep440_rs",
 "platform-tags",
 "rkyv",
 "serde",
@ -896,7 +896,7 @@ dependencies = [
 "fs-err",
 "itertools 0.12.1",
 "once_cell",
- "pep440_rs 0.4.0",
+ "pep440_rs",
 "pep508_rs",
 "platform-tags",
 "pypi-types",
@ -906,6 +906,7 @@ dependencies = [
 "serde_json",
 "sha2",
 "thiserror",
+ "tracing",
 "url",
 "urlencoding",
 "uv-fs",
@ -1292,6 +1293,7 @@ dependencies = [
 "tracing",
 "tracing-subscriber",
 "uv-cache",
+ "uv-fs",
 "uv-interpreter",
 "which",
 ]
@ -1588,7 +1590,7 @@ dependencies = [
 "indoc",
 "mailparse",
 "once_cell",
- "pep440_rs 0.4.0",
+ "pep440_rs",
 "platform-host",
 "platform-info",
 "plist",
@ -2156,16 +2158,6 @@ dependencies = [
 "parking_lot_core 0.8.6",
 ]

-[[package]]
-name = "parking_lot"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3742b2c103b9f06bc9fff0a37ff4912935851bee6d36f3c02bcc755bcfec228f"
-dependencies = [
- "lock_api",
- "parking_lot_core 0.9.9",
-]
-
 [[package]]
 name = "parking_lot_core"
 version = "0.8.6"
@ -2201,19 +2193,7 @@ checksum = "de3145af08024dea9fa9914f381a17b8fc6034dfb00f3a84013f7ff43f29ed4c"

 [[package]]
 name = "pep440_rs"
-version = "0.3.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "887f66cc62717ea72caac4f1eb4e6f392224da3ffff3f40ec13ab427802746d6"
-dependencies = [
- "lazy_static",
- "regex",
- "serde",
- "unicode-width",
-]
-
-[[package]]
-name = "pep440_rs"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
 "indoc",
 "once_cell",
@ -2228,13 +2208,13 @@ dependencies = [

 [[package]]
 name = "pep508_rs"
-version = "0.2.3"
+version = "0.4.2"
 dependencies = [
 "derivative",
 "indoc",
 "log",
 "once_cell",
- "pep440_rs 0.4.0",
+ "pep440_rs",
 "pyo3",
 "pyo3-log",
 "regex",
@ -2477,7 +2457,7 @@ dependencies = [
 [[package]]
 name = "pubgrub"
 version = "0.2.1"
-source = "git+https://github.com/zanieb/pubgrub?rev=9b6d89cb8a0c7902815c8b2ae99106ba322ffb14#9b6d89cb8a0c7902815c8b2ae99106ba322ffb14"
+source = "git+https://github.com/zanieb/pubgrub?rev=aab132a3d4d444dd8dd41d8c4e605abd69dacfe1#aab132a3d4d444dd8dd41d8c4e605abd69dacfe1"
 dependencies = [
 "indexmap 2.2.3",
 "log",
@ -2496,7 +2476,7 @@ dependencies = [
 "indoc",
 "libc",
 "memoffset",
- "parking_lot 0.12.1",
+ "parking_lot",
 "pyo3-build-config",
 "pyo3-ffi",
 "pyo3-macros",
@ -2567,7 +2547,7 @@ dependencies = [
 "insta",
 "mailparse",
 "once_cell",
- "pep440_rs 0.4.0",
+ "pep440_rs",
 "pep508_rs",
 "regex",
 "rkyv",
@ -2583,12 +2563,12 @@ dependencies = [

 [[package]]
 name = "pyproject-toml"
-version = "0.8.1"
+version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46d4a5e69187f23a29f8aa0ea57491d104ba541bc55f76552c2a74962aa20e04"
+checksum = "3b80f889b6d413c3f8963a2c7db03f95dd6e1d85e1074137cb2013ea2faa8898"
 dependencies = [
 "indexmap 2.2.3",
- "pep440_rs 0.3.12",
+ "pep440_rs",
 "pep508_rs",
 "serde",
 "toml",
@ -2793,7 +2773,7 @@ dependencies = [
 "insta",
 "itertools 0.10.5",
 "once_cell",
- "pep440_rs 0.4.0",
+ "pep440_rs",
 "pep508_rs",
 "regex",
 "serde",
@ -2882,7 +2862,7 @@ dependencies = [
 "getrandom",
 "http",
 "hyper",
- "parking_lot 0.11.2",
+ "parking_lot",
 "reqwest",
 "reqwest-middleware",
 "retry-policies",
@ -3510,17 +3490,6 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"

-[[package]]
-name = "tar"
-version = "0.4.40"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b16afcea1f22891c49a00c751c7b63b2233284064f11a200fc624137c51e2ddb"
-dependencies = [
- "filetime",
- "libc",
- "xattr",
-]
-
 [[package]]
 name = "target-lexicon"
 version = "0.12.13"
@ -4158,12 +4127,13 @@ checksum = "f00cc9702ca12d3c81455259621e676d0f7251cec66a21e98fe2e9a37db93b2a"

 [[package]]
 name = "uv"
-version = "0.1.6"
+version = "0.1.8"
 dependencies = [
 "anstream",
 "anyhow",
 "assert_cmd",
 "assert_fs",
+ "base64 0.21.7",
 "chrono",
 "clap",
 "clap_complete_command",
@ -4185,7 +4155,7 @@ dependencies = [
 "miette",
 "mimalloc",
 "owo-colors 4.0.0",
- "pep440_rs 0.4.0",
+ "pep440_rs",
 "pep508_rs",
 "platform-host",
 "platform-tags",
@ -4292,7 +4262,7 @@ dependencies = [
 "http",
 "insta",
 "install-wheel-rs",
- "pep440_rs 0.4.0",
+ "pep440_rs",
 "pep508_rs",
 "platform-tags",
 "pypi-types",
@ -4338,7 +4308,7 @@ dependencies = [
 "itertools 0.12.1",
 "mimalloc",
 "owo-colors 4.0.0",
- "pep440_rs 0.4.0",
+ "pep440_rs",
 "pep508_rs",
 "petgraph",
 "platform-host",
@ -4410,7 +4380,7 @@ dependencies = [
 "futures",
 "install-wheel-rs",
 "nanoid",
- "pep440_rs 0.4.0",
+ "pep440_rs",
 "pep508_rs",
 "platform-tags",
 "pypi-types",
@ -4445,7 +4415,6 @@ dependencies = [
 "futures",
 "rayon",
 "rustc-hash",
- "tar",
 "thiserror",
 "tokio",
 "tokio-tar",
@ -4502,7 +4471,7 @@ dependencies = [
 "futures",
 "install-wheel-rs",
 "once-map",
- "pep440_rs 0.4.0",
+ "pep440_rs",
 "pep508_rs",
 "platform-tags",
 "pypi-types",
@ -4536,7 +4505,7 @@ dependencies = [
 "insta",
 "itertools 0.12.1",
 "once_cell",
- "pep440_rs 0.4.0",
+ "pep440_rs",
 "pep508_rs",
 "platform-host",
 "platform-tags",
@ -4586,7 +4555,7 @@ dependencies = [
 "once-map",
 "once_cell",
 "owo-colors 4.0.0",
- "pep440_rs 0.4.0",
+ "pep440_rs",
 "pep508_rs",
 "petgraph",
 "platform-host",
@ -4812,7 +4781,7 @@ checksum = "be0ecb0db480561e9a7642b5d3e4187c128914e58aa84330b9493e3eb68c5e7f"
 dependencies = [
 "futures",
 "js-sys",
- "parking_lot 0.11.2",
+ "parking_lot",
 "pin-utils",
 "wasm-bindgen",
 "wasm-bindgen-futures",
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@ -15,21 +15,21 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "uv";
-  version = "0.1.6";
+  version = "0.1.8";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "astral-sh";
    repo = "uv";
    rev = version;
-    hash = "sha256-cwnZBKJcMgdSkOV0rojxF8kLQH59iOxjaE5yZkkY2/4=";
+    hash = "sha256-nFhCl/5s+Ts3pTXtweoUXfBA3PN2jm08eHalMekPwnM=";
  };

  cargoDeps = rustPlatform.importCargoLock {
    lockFile = ./Cargo.lock;
    outputHashes = {
      "async_zip-0.0.16" = "sha256-M94ceTCtyQc1AtPXYrVGplShQhItqZZa/x5qLiL+gs0=";
-      "pubgrub-0.2.1" = "sha256-yCeUJp0Cy5Fe0g3Ba9ZFqTJ7IzSFqrX8Dv3+N8DAEZs=";
+      "pubgrub-0.2.1" = "sha256-p6RQ0pmatTnwp1s37ZktkhwakPTTehMlI3H5JUzwVrI=";
    };
  };

--- a/pkgs/by-name/wa/wayland-pipewire-idle-inhibit/package.nix
+++ b/pkgs/by-name/wa/wayland-pipewire-idle-inhibit/package.nix
@ -0,0 +1,46 @@
+{ clang
+, lib
+, libclang
+, fetchFromGitHub
+, pipewire
+, pkg-config
+, rustPlatform
+, wayland
+, wayland-protocols
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "wayland-pipewire-idle-inhibit";
+  version = "0.4.5";
+
+  src = fetchFromGitHub {
+    owner = "rafaelrc7";
+    repo = "wayland-pipewire-idle-inhibit";
+    rev = "v${version}";
+    sha256 = "sha256-VOP1VOeXOyjn+AJfSHzVNT0l+rgm63ev9p4uTfMfYY0=";
+  };
+
+  cargoSha256 = "sha256-7XuDZ57+F8Ot5oNO9/BXjFljNmoMgNgURfmPEIy2PHo=";
+
+  nativeBuildInputs = [
+    clang
+    pkg-config
+  ];
+
+  buildInputs = [
+    pipewire
+    wayland
+    wayland-protocols
+  ];
+
+  LIBCLANG_PATH = "${libclang.lib}/lib";
+
+  meta = with lib; {
+    description = "Suspends automatic idling of Wayland compositors when media is being played through Pipewire.";
+    homepage = "https://github.com/rafaelrc7/wayland-pipewire-idle-inhibit/";
+    license = licenses.gpl3Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ rafameou ];
+    mainProgram = "wayland-pipewire-idle-inhibit";
+  };
+}
+
--- a/pkgs/by-name/we/weasis/package.nix
+++ b/pkgs/by-name/we/weasis/package.nix
@ -14,12 +14,12 @@ let

 in stdenv.mkDerivation rec {
  pname = "weasis";
-  version = "4.2.1";
+  version = "4.3.0";

  # Their build instructions indicate to use the packaging script
  src = fetchzip {
    url = "https://github.com/nroduit/Weasis/releases/download/v${version}/weasis-native.zip";
-    hash = "sha256-HDlylpe8cHZRaIXndfGh6XmUn8o2PQB1Av7hLCp679U=";
+    hash = "sha256-4Ew7RG8eM8pa6AiblREgt03fGOQVKVzkQMR87GIJIVM=";
    stripRoot = false;
  };

--- a/pkgs/by-name/wi/wiremock/package.nix
+++ b/pkgs/by-name/wi/wiremock/package.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "wiremock";
-  version = "3.4.0";
+  version = "3.4.1";

  src = fetchurl {
    url = "mirror://maven/org/wiremock/wiremock-standalone/${version}/wiremock-standalone-${version}.jar";
-    hash = "sha256-YD7bx8AAZZ7sj49Vt2dc3berLCmd8/eC6NDBbST0jYc=";
+    hash = "sha256-SqyPd6eHDzNFn7vzIPOW3l/KtpaiiLC6uMIKqL3GN3s=";
  };

  dontUnpack = true;
--- a/pkgs/by-name/zx/zxtune/package.nix
+++ b/pkgs/by-name/zx/zxtune/package.nix
@ -41,7 +41,7 @@ let
    ++ lib.optional withQt (if (supportWayland) then qt5.qtwayland else qt5.qtbase);
 in stdenv.mkDerivation rec {
  pname = "zxtune";
-  version = "5055";
+  version = "5056";

  outputs = [ "out" ];

@ -49,7 +49,7 @@ in stdenv.mkDerivation rec {
    owner = "zxtune";
    repo = "zxtune";
    rev = "r${version}";
-    hash = "sha256-ABXGbzjdsPUuQnwZQOho4s2xRSDGzbZdA6/hCkBb7zE=";
+    hash = "sha256-zvLbgS8AFW4kkvTccGXcr1KEw3EH47XcHwzq6CKzusQ=";
  };

  passthru.updateScript = nix-update-script {
--- a/pkgs/desktops/lomiri/applications/morph-browser/default.nix
+++ b/pkgs/desktops/lomiri/applications/morph-browser/default.nix
@ -0,0 +1,139 @@
+{ stdenv
+, lib
+, fetchFromGitLab
+, fetchpatch
+, gitUpdater
+, nixosTests
+, cmake
+, content-hub
+, gettext
+, libapparmor
+, lomiri-action-api
+, lomiri-ui-extras
+, lomiri-ui-toolkit
+, pkg-config
+, qqc2-suru-style
+, qtbase
+, qtdeclarative
+, qtquickcontrols2
+, qtsystems
+, qtwebengine
+, wrapQtAppsHook
+, xvfb-run
+}:
+
+let
+  listToQtVar = suffix: lib.makeSearchPathOutput "bin" suffix;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "morph-browser";
+  version = "1.1.0";
+
+  src = fetchFromGitLab {
+    owner = "ubports";
+    repo = "development/core/morph-browser";
+    rev = finalAttrs.version;
+    hash = "sha256-C5iXv8VS8Mm1ryxK7Vi5tVmiM01OSIFiTyH0vP9B/xA=";
+  };
+
+  patches = [
+    # Remove when https://gitlab.com/ubports/development/core/morph-browser/-/merge_requests/575 merged & in release
+    (fetchpatch {
+      name = "0001-morph-browser-tst_SessionUtilsTests-Set-permissions-on-temporary-xdg-runtime-directory.patch";
+      url = "https://gitlab.com/ubports/development/core/morph-browser/-/commit/e90206105b8b287fbd6e45ac37ca1cd259981928.patch";
+      hash = "sha256-5htFn+OGVVBn3mJQaZcF5yt0mT+2QRlKyKFesEhklfA=";
+    })
+
+    # Remove when https://gitlab.com/ubports/development/core/morph-browser/-/merge_requests/576 merged & in release
+    (fetchpatch {
+      name = "0002-morph-browser-Call-i18n-bindtextdomain-with-buildtime-determined-locale-path.patch";
+      url = "https://gitlab.com/ubports/development/core/morph-browser/-/commit/0527a1e01fb27c62f5e0011274f73bad400e9691.patch";
+      hash = "sha256-zx/pP72uNqAi8TZR4bKeONuqcJyK/vGtPglTA+5R5no=";
+    })
+  ];
+
+  postPatch = ''
+    substituteInPlace src/{Morph,Ubuntu}/CMakeLists.txt \
+      --replace '/usr/lib/''${CMAKE_LIBRARY_ARCHITECTURE}/qt5/qml' "\''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}"
+
+    # Don't use absolute paths in desktop file
+    substituteInPlace src/app/webbrowser/morph-browser.desktop.in.in \
+      --replace 'Icon=@CMAKE_INSTALL_FULL_DATADIR@/morph-browser/morph-browser.svg' 'Icon=morph-browser' \
+      --replace 'X-Lomiri-Splash-Image=@CMAKE_INSTALL_FULL_DATADIR@/morph-browser/morph-browser-splash.svg' 'X-Lomiri-Splash-Image=lomiri-app-launch/splash/morph-browser.svg'
+  '' + lib.optionalString (!finalAttrs.doCheck) ''
+    substituteInPlace CMakeLists.txt \
+      --replace 'add_subdirectory(tests)' ""
+  '';
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+    gettext
+    pkg-config
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    libapparmor
+    qtbase
+    qtdeclarative
+    qtwebengine
+
+    # QML
+    content-hub
+    lomiri-action-api
+    lomiri-ui-extras
+    lomiri-ui-toolkit
+    qqc2-suru-style
+    qtquickcontrols2
+    qtsystems
+  ];
+
+  nativeCheckInputs = [
+    xvfb-run
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" (lib.concatStringsSep ";" [
+      # Exclude tests
+      "-E" (lib.strings.escapeShellArg "(${lib.concatStringsSep "|" [
+        # Don't care about linter failures
+        "^flake8"
+
+        # Runs into ShapeMaterial codepath in lomiri-ui-toolkit which needs OpenGL, see LUITK for details
+        "^tst_QmlTests"
+      ]})")
+    ]))
+  ];
+
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+
+  preCheck = ''
+    export HOME=$TMPDIR
+    export QT_PLUGIN_PATH=${listToQtVar qtbase.qtPluginPrefix [ qtbase ]}
+    export QML2_IMPORT_PATH=${listToQtVar qtbase.qtQmlPrefix ([ lomiri-ui-toolkit qtwebengine qtdeclarative qtquickcontrols2 qtsystems ] ++ lomiri-ui-toolkit.propagatedBuildInputs)}
+  '';
+
+  postInstall = ''
+    mkdir -p $out/share/{icons/hicolor/scalable/apps,lomiri-app-launch/splash}
+
+    ln -s $out/share/{morph-browser,icons/hicolor/scalable/apps}/morph-browser.svg
+    ln -s $out/share/{morph-browser/morph-browser-splash.svg,lomiri-app-launch/splash/morph-browser.svg}
+  '';
+
+  passthru = {
+    updateScript = gitUpdater { };
+    tests.standalone = nixosTests.morph-browser;
+  };
+
+  meta = with lib; {
+    description = "Lightweight web browser tailored for Ubuntu Touch";
+    homepage = "https://gitlab.com/ubports/development/core/morph-browser";
+    changelog = "https://gitlab.com/ubports/development/core/morph-browser/-/blob/${finalAttrs.version}/ChangeLog";
+    license = with licenses; [ gpl3Only cc-by-sa-30 ];
+    mainProgram = "morph-browser";
+    maintainers = teams.lomiri.members;
+    platforms = platforms.linux;
+  };
+})
--- a/pkgs/desktops/lomiri/default.nix
+++ b/pkgs/desktops/lomiri/default.nix
@ -9,6 +9,7 @@ let
  in {
    #### Core Apps
    lomiri-terminal-app = callPackage ./applications/lomiri-terminal-app { };
+    morph-browser = callPackage ./applications/morph-browser { };

    #### Data
    lomiri-schemas = callPackage ./data/lomiri-schemas { };
--- a/pkgs/development/compilers/cakelisp/default.nix
+++ b/pkgs/development/compilers/cakelisp/default.nix
@ -1,13 +1,14 @@
-{ lib, stdenv, fetchgit, gcc }:
+{ lib, stdenv, fetchgit, fetchpatch, gcc, unstableGitUpdater }:

 stdenv.mkDerivation rec {
  pname = "cakelisp";
-  version = "0.1.0";
+  # using unstable as it's the only version that builds against gcc-13
+  version = "0.3.0-unstable-2023-12-18";

  src = fetchgit {
    url = "https://macoy.me/code/macoy/cakelisp";
-    rev = "v${version}";
-    sha256 = "sha256-r7Yg8+2U8qQTYRP3KFET7oBRCZHIZS6Y8TsfL1NR24g=";
+    rev = "866fa2806d3206cc9dd398f0e86640db5be42bd6";
+    hash = "sha256-vwMZUNy+updwk69ahA/D9LhO68eV6wH0Prq+o/i1Q/A=";
  };

  buildInputs = [ gcc ];
@ -35,6 +36,10 @@ stdenv.mkDerivation rec {
    runHook postInstall
  '';

+  passthru.updateScript = unstableGitUpdater {
+    url = "https://macoy.me/code/macoy/cakelisp";
+  };
+
  meta = with lib; {
    description = "A performance-oriented Lisp-like language";
    homepage = "https://macoy.me/code/macoy/cakelisp";
--- a/pkgs/development/compilers/llvm/17/default.nix
+++ b/pkgs/development/compilers/llvm/17/default.nix
@ -144,6 +144,10 @@ in let
      inherit llvm_meta;
    };

+    mlir = callPackage ./mlir {
+      inherit llvm_meta;
+    };
+
    lldb = callPackage ../common/lldb.nix {
      src = callPackage ({ runCommand }: runCommand "lldb-src-${version}" {} ''
        mkdir -p "$out"
--- a/pkgs/development/compilers/llvm/17/mlir/default.nix
+++ b/pkgs/development/compilers/llvm/17/mlir/default.nix
@ -0,0 +1,71 @@
+{ lib, stdenv, llvm_meta
+, buildLlvmTools
+, monorepoSrc, runCommand
+, cmake
+, ninja
+, libxml2
+, libllvm
+, version
+, doCheck ? (!stdenv.isx86_32 /* TODO: why */) && (!stdenv.hostPlatform.isMusl)
+}:
+
+stdenv.mkDerivation rec {
+  pname = "mlir";
+  inherit version doCheck;
+
+  # Blank llvm dir just so relative path works
+  src = runCommand "${pname}-src-${version}" {} ''
+    mkdir -p "$out"
+    cp -r ${monorepoSrc}/cmake "$out"
+    cp -r ${monorepoSrc}/${pname} "$out"
+    cp -r ${monorepoSrc}/third-party "$out/third-party"
+
+    mkdir -p "$out/llvm"
+  '';
+
+  sourceRoot = "${src.name}/${pname}";
+
+  patches = [
+    ./gnu-install-dirs.patch
+  ];
+
+  nativeBuildInputs = [ cmake ninja ];
+  buildInputs = [ libllvm libxml2 ];
+
+  ninjaFlags = [ "-v " ];
+  cmakeFlags = [
+    "-DLLVM_BUILD_TOOLS=ON"
+    # Install headers as well
+    "-DLLVM_INSTALL_TOOLCHAIN_ONLY=OFF"
+    "-DMLIR_TOOLS_INSTALL_DIR=${placeholder "out"}/bin/"
+    "-DLLVM_ENABLE_IDE=OFF"
+    "-DLLD_INSTALL_PACKAGE_DIR=${placeholder "out"}/lib/cmake/mlir"
+    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
+    "-DLLVM_ENABLE_FFI=ON"
+    "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
+    "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
+    "-DLLVM_ENABLE_DUMP=ON"
+  ]  ++ lib.optionals stdenv.hostPlatform.isStatic [
+    # Disables building of shared libs, -fPIC is still injected by cc-wrapper
+    "-DLLVM_ENABLE_PIC=OFF"
+    "-DLLVM_BUILD_STATIC=ON"
+    "-DLLVM_LINK_LLVM_DYLIB=off"
+  ] ++ lib.optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
+    "-DLLVM_TABLEGEN_EXE=${buildLlvmTools.llvm}/bin/llvm-tblgen"
+    "-DMLIR_TABLEGEN_EXE=${buildLlvmTools.mlir}/bin/mlir-tblgen"
+  ];
+
+  outputs = [ "out" "dev" ];
+
+  meta = llvm_meta // {
+    homepage = "https://mlir.llvm.org/";
+    description = "Multi-Level IR Compiler Framework";
+    longDescription = ''
+      The MLIR project is a novel approach to building reusable and extensible
+      compiler infrastructure. MLIR aims to address software fragmentation,
+      improve compilation for heterogeneous hardware, significantly reduce
+      the cost of building domain specific compilers, and aid in connecting
+      existing compilers together.
+    '';
+  };
+}
--- a/pkgs/development/compilers/llvm/17/mlir/gnu-install-dirs.patch
+++ b/pkgs/development/compilers/llvm/17/mlir/gnu-install-dirs.patch
@ -0,0 +1,15 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index c91e9cd93dc8..23b6032a46b7 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -32,8 +32,8 @@ if(MLIR_STANDALONE_BUILD)
+   endif()
+ 
+   set(CMAKE_LIBRARY_OUTPUT_DIRECTORY
+-    "${CMAKE_CURRENT_BINARY_DIR}/lib${LLVM_LIBDIR_SUFFIX}")
+-  set(CMAKE_RUNTIME_OUTPUT_DIRECTORY "${CMAKE_CURRENT_BINARY_DIR}/bin")
+    "${CMAKE_INSTALL_LIBDIR}/${LLVM_LIBDIR_SUFFIX}")
+  set(CMAKE_RUNTIME_OUTPUT_DIRECTORY "${CMAKE_INSTALL_BINDIR}")
+ 
+   set(LLVM_LIT_ARGS "-sv" CACHE STRING "Default options for lit")
+ endif()
--- a/pkgs/development/compilers/llvm/git/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/git/compiler-rt/default.nix
@ -116,7 +116,7 @@ stdenv.mkDerivation {
      --replace "#include <stdlib.h>" ""
    substituteInPlace lib/builtins/clear_cache.c \
      --replace "#include <assert.h>" ""
-    substituteInPlace lib/builtins/cpu_model.c \
+    substituteInPlace lib/builtins/cpu_model${lib.optionalString (lib.versionAtLeast version "18") "/x86"}.c \
      --replace "#include <assert.h>" ""
  '';

--- a/pkgs/development/compilers/llvm/git/default.nix
+++ b/pkgs/development/compilers/llvm/git/default.nix
@ -17,12 +17,7 @@
    else pkgs.bintools
 , darwin
 # LLVM release information; specify one of these but not both:
-, gitRelease ? {
-  version = "18.0.0";
-  rev = "2fd7657b6609454af7adb75765d164ec7d1bb80b";
-  rev-version = "18.0.0-unstable-2023-12-13";
-  sha256 = "sha256-/sMQzzFid0tAnreOIV9SUm2H6QbEGhpNcizl3LDPM5s=";
-}
+, gitRelease ? null
  # i.e.:
  # {
  #   version = /* i.e. "15.0.0" */;
@ -30,7 +25,7 @@
  #   rev-version = /* human readable version; i.e. "unstable-2022-26-07" */;
  #   sha256 = /* checksum for this release, can omit if specifying your own `monorepoSrc` */;
  # }
-, officialRelease ? null
+, officialRelease ? { version = "18.1.0-rc3"; sha256 = "sha256-qRzY2kTLeRxXQCSuVP592Awafm5wjVeFY60d6082mSc="; }
  # i.e.:
  # {
  #   version = /* i.e. "15.0.0" */;
--- a/pkgs/development/compilers/llvm/git/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/git/libcxx/default.nix
@ -45,17 +45,6 @@ stdenv.mkDerivation rec {
    chmod -R u+w .
  '';

-  patches = [
-    # fix for https://github.com/NixOS/nixpkgs/issues/269548
-    # https://github.com/llvm/llvm-project/pull/77218
-    (fetchpatch {
-      name = "darwin-system-libcxxabi-link-flags.patch";
-      url = "https://github.com/llvm/llvm-project/commit/c5b89b29ee6e3c444a355fd1cf733ce7ab2e316a.patch";
-      hash = "sha256-LNoPg1KCoP8RWxU/AzHR52f4Dww24I9BGQJedMhFxyQ=";
-      relative = "libcxx";
-    })
-  ];
-
  postPatch = ''
    cd ../runtimes
  '';
@ -82,7 +71,9 @@ stdenv.mkDerivation rec {
    "-DLIBCXX_CXX_ABI=${if headersOnly then "none" else libcxx_cxx_abi_opt}"
  ] ++ lib.optional (!headersOnly && cxxabi.libName == "c++abi") "-DLIBCXX_CXX_ABI_INCLUDE_PATHS=${cxxabi.dev}/include/c++/v1"
    ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) "-DLIBCXX_HAS_MUSL_LIBC=1"
-    ++ lib.optionals (stdenv.hostPlatform.useLLVM or false) [
+    ++ lib.optionals (lib.versionAtLeast version "18" && !(stdenv.hostPlatform.useLLVM or false) && stdenv.hostPlatform.libc == "glibc" && !stdenv.hostPlatform.isStatic) [
+    "-DLIBCXX_ADDITIONAL_LIBRARIES=gcc_s"
+  ] ++ lib.optionals (stdenv.hostPlatform.useLLVM or false) [
      "-DLIBCXX_USE_COMPILER_RT=ON"
      # There's precedent for this in llvm-project/libcxx/cmake/caches.
      # In a monorepo build you might do the following in the libcxxabi build:
--- a/pkgs/development/compilers/llvm/git/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/git/libcxxabi/default.nix
@ -44,6 +44,20 @@ stdenv.mkDerivation rec {
      sha256 = "1xyjd56m4pfwq8p3xh6i8lhkk9kq15jaml7qbhxdf87z4jjkk63a";
      stripLen = 1;
    })
+  ] ++ lib.optionals (lib.versionAtLeast version "18") [
+    # Allow building libcxxabi alone when using LLVM unwinder
+    (fetchpatch {
+      url = "https://github.com/llvm/llvm-project/commit/77610dd10454e87bb387040d2b51100a17ac5755.patch";
+      stripLen = 1;
+      revert = true;
+      hash = "sha256-Jogx/cvTJ6fdyprTD1QzMIeRWcBlZZMWE/y9joOtVH0=";
+    })
+    (fetchpatch {
+      url = "https://github.com/llvm/llvm-project/commit/48e5b5ea92674ded69b998cf35724d9012c0f57d.patch";
+      stripLen = 1;
+      revert = true;
+      hash = "sha256-7VeBFjG7CnEMWn0hpBvyNOyhRfz50PnD3zyQNDhNChk=";
+    })
  ];

  postPatch = ''
@ -63,6 +77,8 @@ stdenv.mkDerivation rec {
    # CMake however checks for this anyways; this flag tells it not to. See:
    # https://github.com/llvm/llvm-project/blob/4bd3f3759259548e159aeba5c76efb9a0864e6fa/llvm/runtimes/CMakeLists.txt#L243
    "-DCMAKE_CXX_COMPILER_WORKS=ON"
+  ] ++ lib.optionals (lib.versionAtLeast version "18" && !(stdenv.hostPlatform.useLLVM or false && !stdenv.hostPlatform.isWasm)) [
+    "-DLIBCXXABI_USE_LLVM_UNWINDER=OFF"
  ] ++ lib.optionals (stdenv.hostPlatform.useLLVM or false && !stdenv.hostPlatform.isWasm) [
    "-DLLVM_ENABLE_LIBCXX=ON"
    "-DLIBCXXABI_USE_LLVM_UNWINDER=ON"
--- a/pkgs/development/compilers/llvm/git/llvm/gnu-install-dirs-polly.patch
+++ b/pkgs/development/compilers/llvm/git/llvm/gnu-install-dirs-polly.patch
@ -6,14 +6,14 @@ diff --git a/tools/polly/cmake/polly_macros.cmake b/tools/polly/cmake/polly_macr
 index 518a09b45a42..bd9d6f5542ad 100644
 --- a/tools/polly/cmake/polly_macros.cmake
 +++ b/tools/polly/cmake/polly_macros.cmake
-@@ -44,8 +44,8 @@ macro(add_polly_library name)
-   if (NOT LLVM_INSTALL_TOOLCHAIN_ONLY OR ${name} STREQUAL "LLVMPolly")
+@@ -45,8 +45,8 @@ macro(add_polly_library name)
     install(TARGETS ${name}
+       COMPONENT ${name}
       EXPORT LLVMExports
 -      LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX}
 -      ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX})
-+	  LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}
+      LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}
 +      ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX})
+     add_llvm_install_targets(install-${name}
+       COMPONENT ${name})
   endif()
-   set_property(GLOBAL APPEND PROPERTY LLVM_EXPORTS ${name})
- endmacro(add_polly_library)
--- a/pkgs/development/compilers/llvm/git/openmp/gnu-install-dirs.patch
+++ b/pkgs/development/compilers/llvm/git/openmp/gnu-install-dirs.patch
@ -6,17 +6,17 @@ index b6ddbe90516d..311ab1d50e7f 100644
   set(OPENMP_LIBDIR_SUFFIX "" CACHE STRING
     "Suffix of lib installation directory, e.g. 64 => lib64")
   # Do not use OPENMP_LIBDIR_SUFFIX directly, use OPENMP_INSTALL_LIBDIR.
-  set(OPENMP_INSTALL_LIBDIR "lib${OPENMP_LIBDIR_SUFFIX}")
-+  set(OPENMP_INSTALL_LIBDIR "${CMAKE_INSTALL_LIBDIR}${OPENMP_LIBDIR_SUFFIX}")
+-  set(OPENMP_INSTALL_LIBDIR "lib${OPENMP_LIBDIR_SUFFIX}" CACHE STRING
+  set(OPENMP_INSTALL_LIBDIR "${CMAKE_INSTALL_LIBDIR}${OPENMP_LIBDIR_SUFFIX}" CACHE STRING
+       "Path where built OpenMP libraries should be installed.")
 
   # Group test settings.
-   set(OPENMP_TEST_C_COMPILER ${CMAKE_C_COMPILER} CACHE STRING
-@@ -40,7 +40,7 @@ if (OPENMP_STANDALONE_BUILD)
+@@ -47,7 +47,7 @@ if (OPENMP_STANDALONE_BUILD)
 else()
   set(OPENMP_ENABLE_WERROR ${LLVM_ENABLE_WERROR})
   # If building in tree, we honor the same install suffix LLVM uses.
-  set(OPENMP_INSTALL_LIBDIR "lib${LLVM_LIBDIR_SUFFIX}")
-+  set(OPENMP_INSTALL_LIBDIR "${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}")
+-  set(OPENMP_INSTALL_LIBDIR "lib${LLVM_LIBDIR_SUFFIX}" CACHE STRING
+  set(OPENMP_INSTALL_LIBDIR "${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}" CACHE STRING
+       "Path where built OpenMP libraries should be installed.")
 
   if (NOT MSVC)
-     set(OPENMP_TEST_C_COMPILER ${LLVM_RUNTIME_OUTPUT_INTDIR}/clang)
--- a/pkgs/development/interpreters/babashka/default.nix
+++ b/pkgs/development/interpreters/babashka/default.nix
@ -9,11 +9,11 @@
 let
  babashka-unwrapped = buildGraalvmNativeImage rec {
    pname = "babashka-unwrapped";
-    version = "1.3.188";
+    version = "1.3.189";

    src = fetchurl {
      url = "https://github.com/babashka/babashka/releases/download/v${version}/babashka-${version}-standalone.jar";
-      sha256 = "sha256-EjsSUPWiLQcCos2oyVXt3VzLlGEfiXK5CqJZ1NMvF/E=";
+      sha256 = "sha256-C3N++tTTvebtQid3p+zrnBgHTqQmECQhiS2/3VIEojI=";
    };

    graalvmDrv = graalvmCEPackages.graalvm-ce;
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@ -95,9 +95,6 @@ assert x11Support -> tcl != null

 assert bluezSupport -> bluez != null;

-assert lib.assertMsg (bluezSupport -> stdenv.isLinux)
-  "Bluez support is only available on Linux.";
-
 assert lib.assertMsg (enableFramework -> stdenv.isDarwin)
  "Framework builds are only supported on Darwin.";

--- a/pkgs/development/libraries/appstream/default.nix
+++ b/pkgs/development/libraries/appstream/default.nix
@ -25,10 +25,11 @@
 , curl
 , systemd
 , nixosTests
+, testers
 , withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "appstream";
  version = "1.0.1";

@ -37,7 +38,7 @@ stdenv.mkDerivation rec {
  src = fetchFromGitHub {
    owner = "ximion";
    repo = "appstream";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
    sha256 = "sha256-ULqRHepWVuAluXsXJUoqxqJfrN168MGlwdVkoLLwSN0=";
  };

@ -97,9 +98,10 @@ stdenv.mkDerivation rec {
    "-Dsystemd=false"
  ];

-  passthru = {
-    tests = {
-      installed-tests = nixosTests.installed-tests.appstream;
+  passthru.tests = {
+    installed-tests = nixosTests.installed-tests.appstream;
+    pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
    };
  };

@ -115,5 +117,6 @@ stdenv.mkDerivation rec {
    license = licenses.lgpl21Plus;
    mainProgram = "appstreamcli";
    platforms = platforms.unix;
+    pkgConfigModules = [ "appstream" ];
  };
-}
+})
--- a/pkgs/development/libraries/expat/default.nix
+++ b/pkgs/development/libraries/expat/default.nix
@ -7,6 +7,7 @@
 , haskellPackages
 , luaPackages
 , ocamlPackages
+, testers
 }:

 # Note: this package is used for bootstrapping fetchurl, and thus
@ -14,15 +15,12 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.

-let
-  version = "2.6.0";
-  tag = "R_${lib.replaceStrings ["."] ["_"] version}";
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "expat";
-  inherit version;
+  version = "2.6.0";

  src = fetchurl {
-    url = "https://github.com/libexpat/libexpat/releases/download/${tag}/${pname}-${version}.tar.xz";
+    url = with finalAttrs; "https://github.com/libexpat/libexpat/releases/download/R_${lib.replaceStrings ["."] ["_"] version}/${pname}-${version}.tar.xz";
    hash = "sha256-y19ajqIR4cq9Wb4KkzpS48Aswyboak04fY0hjn7kej4=";
  };

@ -51,7 +49,7 @@ in stdenv.mkDerivation rec {
  # CMake files incorrectly calculate library path from dev prefix
  # https://github.com/libexpat/libexpat/issues/501
  postFixup = ''
-    substituteInPlace $dev/lib/cmake/expat-${version}/expat-noconfig.cmake \
+    substituteInPlace $dev/lib/cmake/expat-${finalAttrs.version}/expat-noconfig.cmake \
      --replace "$"'{_IMPORT_PREFIX}' $out
  '';

@ -62,6 +60,9 @@ in stdenv.mkDerivation rec {
    inherit (perlPackages) XMLSAXExpat XMLParser;
    inherit (luaPackages) luaexpat;
    inherit (ocamlPackages) ocaml_expat;
+    pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+    };
  };

  meta = with lib; {
@ -70,5 +71,6 @@ in stdenv.mkDerivation rec {
    description = "A stream-oriented XML parser library written in C";
    platforms = platforms.all;
    license = licenses.mit; # expat version
+    pkgConfigModules = [ "expat" ];
  };
-}
+})
--- a/pkgs/development/libraries/fontconfig/default.nix
+++ b/pkgs/development/libraries/fontconfig/default.nix
@ -10,16 +10,17 @@
 , dejavu_fonts
 , autoreconfHook
 , CoreFoundation
+, testers
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "fontconfig";
  version = "2.15.0";

  outputs = [ "bin" "dev" "lib" "out" ]; # $out contains all the config

  src = fetchurl {
-    url = "https://www.freedesktop.org/software/fontconfig/release/${pname}-${version}.tar.xz";
+    url = with finalAttrs; "https://www.freedesktop.org/software/fontconfig/release/${pname}-${version}.tar.xz";
    hash = "sha256-Y6BljQ4G4PqIYQZFK1jvBPIfWCAuoCqUw53g0zNdfA4=";
  };

@ -77,11 +78,18 @@ stdenv.mkDerivation rec {
    rm -r $bin/share/man/man3
  '';

+  passthru.tests = {
+    pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+    };
+  };
+
  meta = with lib; {
    description = "A library for font customization and configuration";
    homepage = "http://fontconfig.org/";
    license = licenses.bsd2; # custom but very bsd-like
    platforms = platforms.all;
    maintainers = with maintainers; teams.freedesktop.members ++ [ ];
+    pkgConfigModules = [ "fontconfig" ];
  };
-}
+})
--- a/pkgs/development/libraries/fribidi/default.nix
+++ b/pkgs/development/libraries/fribidi/default.nix
@ -6,9 +6,10 @@
 , pkg-config
 , fixDarwinDylibNames
 , python3
+, testers
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "fribidi";
  version = "1.0.13";

@ -16,7 +17,7 @@ stdenv.mkDerivation rec {

  # NOTE: Only URL tarball has "Have pre-generated man pages: true", which works-around upstream usage of some rare ancient `c2man` fossil application.
  src = fetchurl {
-    url = "https://github.com/fribidi/fribidi/releases/download/v${version}/${pname}-${version}.tar.xz";
+    url = with finalAttrs; "https://github.com/fribidi/fribidi/releases/download/v${version}/${pname}-${version}.tar.xz";
    sha256 = "sha256-f6FsgMgb1iL3sZjTE1baE5zDGKY/x3YSF69BMJA/VKI=";
  };

@ -32,10 +33,17 @@ stdenv.mkDerivation rec {
  doCheck = true;
  nativeCheckInputs = [ python3 ];

+  passthru.tests = {
+    pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+    };
+  };
+
  meta = with lib; {
    homepage = "https://github.com/fribidi/fribidi";
    description = "GNU implementation of the Unicode Bidirectional Algorithm (bidi)";
    license = licenses.lgpl21;
    platforms = platforms.unix;
+    pkgConfigModules = [ "fribidi" ];
  };
-}
+})
--- a/pkgs/development/libraries/graphene/default.nix
+++ b/pkgs/development/libraries/graphene/default.nix
@ -19,9 +19,10 @@
 , gobject-introspection
 , withIntrospection ? lib.meta.availableOn stdenv.hostPlatform gobject-introspection && stdenv.hostPlatform.emulatorAvailable buildPackages
 , makeWrapper
+, testers
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "graphene";
  version = "1.10.8";

@ -31,8 +32,8 @@ stdenv.mkDerivation rec {

  src = fetchFromGitHub {
    owner = "ebassi";
-    repo = pname;
-    rev = version;
+    repo = finalAttrs.pname;
+    rev = finalAttrs.version;
    sha256 = "P6JQhSktzvyMHatP/iojNGXPmcsxsFxdYerXzS23ojI=";
  };

@ -109,6 +110,9 @@ stdenv.mkDerivation rec {
  passthru = {
    tests = {
      installedTests = nixosTests.installed-tests.graphene;
+      pkg-config = testers.hasPkgConfigModules {
+        package = finalAttrs.finalPackage;
+      };
    };

    updateScript = nix-update-script { };
@ -120,5 +124,6 @@ stdenv.mkDerivation rec {
    license = licenses.mit;
    maintainers = teams.gnome.members ++ (with maintainers; [ ]);
    platforms = platforms.unix;
+    pkgConfigModules = [ "graphene-1.0" "graphene-gobject-1.0" ];
  };
-}
+})
--- a/pkgs/development/libraries/gtk/4.x.nix
+++ b/pkgs/development/libraries/gtk/4.x.nix
@ -54,6 +54,7 @@
 , Cocoa
 , libexecinfo
 , broadwaySupport ? true
+, testers
 }:

 let
@ -66,7 +67,7 @@ let

 in

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "gtk4";
  version = "4.12.5";

@ -79,7 +80,7 @@ stdenv.mkDerivation rec {
  ];

  src = fetchurl {
-    url = "mirror://gnome/sources/gtk/${lib.versions.majorMinor version}/gtk-${version}.tar.xz";
+    url = with finalAttrs; "mirror://gnome/sources/gtk/${lib.versions.majorMinor version}/gtk-${version}.tar.xz";
    sha256 = "KLNW1ZDuaO9ibi75ggst0hRBSEqaBCpaPwxA6d/E9Pg=";
  };

@ -104,7 +105,7 @@ stdenv.mkDerivation rec {
    wayland-scanner
  ] ++ lib.optionals vulkanSupport [
    shaderc # for glslc
-  ] ++ setupHooks;
+  ] ++ finalAttrs.setupHooks;

  buildInputs = [
    libxkbcommon
@ -240,7 +241,7 @@ stdenv.mkDerivation rec {

    for program in ''${demos[@]}; do
      wrapProgram $dev/bin/$program \
-        --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH:$out/share/gsettings-schemas/${pname}-${version}"
+        --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH:$out/share/gsettings-schemas/${finalAttrs.pname}-${finalAttrs.version}"
    done
  '' + lib.optionalString x11Support ''
    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
@ -253,6 +254,11 @@ stdenv.mkDerivation rec {
      versionPolicy = "odd-unstable";
      attrPath = "gtk4";
    };
+    tests = {
+      pkg-config = testers.hasPkgConfigModules {
+        package = finalAttrs.finalPackage;
+      };
+    };
  };

  meta = with lib; {
@ -271,6 +277,13 @@ stdenv.mkDerivation rec {
    license = licenses.lgpl2Plus;
    maintainers = teams.gnome.members ++ (with maintainers; [ raskin ]);
    platforms = platforms.all;
-    changelog = "https://gitlab.gnome.org/GNOME/gtk/-/raw/${version}/NEWS";
+    changelog = "https://gitlab.gnome.org/GNOME/gtk/-/raw/${finalAttrs.version}/NEWS";
+    pkgConfigModules = [
+      "gtk4"
+      "gtk4-broadway"
+      "gtk4-unix-print"
+      "gtk4-wayland"
+      "gtk4-x11"
+    ];
  };
-}
+})
--- a/pkgs/development/libraries/iso-codes/default.nix
+++ b/pkgs/development/libraries/iso-codes/default.nix
@ -1,11 +1,11 @@
-{ lib, stdenv, fetchurl, gettext, python3 }:
+{ lib, stdenv, fetchurl, gettext, python3, testers }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "iso-codes";
  version = "4.16.0";

  src = fetchurl {
-    url = "https://salsa.debian.org/iso-codes-team/iso-codes/-/archive/v${version}/${pname}-v${version}.tar.gz";
+    url = with finalAttrs; "https://salsa.debian.org/iso-codes-team/iso-codes/-/archive/v${version}/${pname}-v${version}.tar.gz";
    sha256 = "sha256-fJkPw5oFl1vtsBdeP/Cfw4MEiBX2i0Yqu/BVqAMuZsw=";
  };

@ -13,10 +13,17 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

+  passthru.tests = {
+    pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+    };
+  };
+
  meta = with lib; {
    homepage = "https://salsa.debian.org/iso-codes-team/iso-codes";
    description = "Various ISO codes packaged as XML files";
    license = licenses.lgpl21;
    platforms = platforms.all;
+    pkgConfigModules = [ "iso-codes" ];
  };
-}
+})
--- a/pkgs/development/libraries/libadwaita/default.nix
+++ b/pkgs/development/libraries/libadwaita/default.nix
@ -17,9 +17,10 @@
 , xvfb-run
 , AppKit
 , Foundation
+, testers
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "libadwaita";
  version = "1.4.3";

@ -30,7 +31,7 @@ stdenv.mkDerivation rec {
    domain = "gitlab.gnome.org";
    owner = "GNOME";
    repo = "libadwaita";
-    rev = version;
+    rev = finalAttrs.version;
    hash = "sha256-ctHAN0SY6k68jaBpmIpMm8DngC9DPiL1vAmGhECpNic=";
  };

@ -50,7 +51,7 @@ stdenv.mkDerivation rec {

  mesonFlags = [
    "-Dgtk_doc=true"
-  ] ++ lib.optionals (!doCheck) [
+  ] ++ lib.optionals (!finalAttrs.doCheck) [
    "-Dtests=false"
  ];

@ -106,16 +107,20 @@ stdenv.mkDerivation rec {

  passthru = {
    updateScript = gnome.updateScript {
-      packageName = pname;
+      packageName = finalAttrs.pname;
+    };
+    tests.pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
    };
  };

  meta = with lib; {
-    changelog = "https://gitlab.gnome.org/GNOME/libadwaita/-/blob/${src.rev}/NEWS";
+    changelog = "https://gitlab.gnome.org/GNOME/libadwaita/-/blob/${finalAttrs.src.rev}/NEWS";
    description = "Library to help with developing UI for mobile devices using GTK/GNOME";
    homepage = "https://gitlab.gnome.org/GNOME/libadwaita";
    license = licenses.lgpl21Plus;
    maintainers = teams.gnome.members ++ (with maintainers; [ dotlambda ]);
    platforms = platforms.unix;
+    pkgConfigModules = [ "libadwaita-1" ];
  };
-}
+})
--- a/pkgs/development/libraries/libdeflate/default.nix
+++ b/pkgs/development/libraries/libdeflate/default.nix
@ -4,15 +4,17 @@
 , fixDarwinDylibNames
 , pkgsStatic
 , cmake
+, testers
 }:
-stdenv.mkDerivation rec {
+
+stdenv.mkDerivation (finalAttrs: {
  pname = "libdeflate";
  version = "1.19";

  src = fetchFromGitHub {
    owner = "ebiggers";
    repo = "libdeflate";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
    sha256 = "sha256-HgZ2an1PCPhiLsd3ZA7tgZ1wVTOdHzDr8FHrqJhEbQw=";
  };

@ -21,14 +23,20 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ cmake ]
    ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;

-  passthru.tests.static = pkgsStatic.libdeflate;
+  passthru.tests = {
+    static = pkgsStatic.libdeflate;
+    pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+    };
+  };

  meta = with lib; {
    description = "Fast DEFLATE/zlib/gzip compressor and decompressor";
    license = licenses.mit;
    homepage = "https://github.com/ebiggers/libdeflate";
-    changelog = "https://github.com/ebiggers/libdeflate/blob/v${version}/NEWS.md";
+    changelog = "https://github.com/ebiggers/libdeflate/blob/v${finalAttrs.version}/NEWS.md";
    platforms = platforms.unix;
    maintainers = with maintainers; [ orivej kaction ];
+    pkgConfigModules = [ "libdeflate" ];
  };
-}
+})
--- a/pkgs/development/libraries/libepoxy/default.nix
+++ b/pkgs/development/libraries/libepoxy/default.nix
@ -11,13 +11,14 @@
 , Carbon
 , OpenGL
 , x11Support ? !stdenv.isDarwin
+, testers
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "libepoxy";
  version = "1.5.10";

-  src = fetchFromGitHub {
+  src = with finalAttrs; fetchFromGitHub {
    owner = "anholt";
    repo = pname;
    rev = version;
@ -58,7 +59,7 @@ stdenv.mkDerivation rec {
  mesonFlags = [
    "-Degl=${if (x11Support && !stdenv.isDarwin) then "yes" else "no"}"
    "-Dglx=${if x11Support then "yes" else "no"}"
-    "-Dtests=${lib.boolToString doCheck}"
+    "-Dtests=${lib.boolToString finalAttrs.doCheck}"
    "-Dx11=${lib.boolToString x11Support}"
  ];

@ -66,6 +67,12 @@ stdenv.mkDerivation rec {

  doCheck = true;

+  passthru.tests = {
+    pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+    };
+  };
+
  meta = with lib; {
    description = "A library for handling OpenGL function pointer management";
    homepage = "https://github.com/anholt/libepoxy";
@ -74,4 +81,4 @@ stdenv.mkDerivation rec {
    platforms = platforms.unix;
    pkgConfigModules = [ "epoxy" ];
  };
-}
+})
--- a/pkgs/development/libraries/libffi/default.nix
+++ b/pkgs/development/libraries/libffi/default.nix
@ -6,14 +6,15 @@
 , doCheck ? !(stdenv.hostPlatform.isStatic)
 , dejagnu
 , nix-update-script
+, testers
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "libffi";
  version = "3.4.6";

  src = fetchurl {
-    url = "https://github.com/libffi/libffi/releases/download/v${version}/${pname}-${version}.tar.gz";
+    url = with finalAttrs; "https://github.com/libffi/libffi/releases/download/v${version}/${pname}-${version}.tar.gz";
    hash = "sha256-sN6p3yPIY6elDoJUQPPr/6vWXfFJcQjl1Dd0eEOJWk4=";
  };

@ -50,6 +51,11 @@ stdenv.mkDerivation rec {

  passthru = {
    updateScript = nix-update-script { };
+    tests = {
+      pkg-config = testers.hasPkgConfigModules {
+        package = finalAttrs.finalPackage;
+      };
+    };
  };

  meta = with lib; {
@ -72,5 +78,6 @@ stdenv.mkDerivation rec {
    license = licenses.mit;
    maintainers = with maintainers; [ matthewbauer ];
    platforms = platforms.all;
+    pkgConfigModules = [ "libffi" ];
  };
-}
+})
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@ -20,9 +20,10 @@
 , gdal
 , openimageio
 , freeimage
+, testers
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "libtiff";
  version = "4.6.0";

@ -32,7 +33,7 @@ stdenv.mkDerivation rec {
  src = fetchFromGitLab {
    owner = "libtiff";
    repo = "libtiff";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
    hash = "sha256-qCg5qjsPPynCHIg0JsPJldwVdcYkI68zYmyNAKUCoyw=";
  };

@ -77,6 +78,9 @@ stdenv.mkDerivation rec {
    tests = {
      inherit libgeotiff imagemagick graphicsmagick gdal openimageio freeimage;
      inherit (python3Packages) pillow imread;
+      pkg-config = testers.hasPkgConfigModules {
+        package = finalAttrs.finalPackage;
+      };
    };
    updateScript = nix-update-script { };
  };
@ -84,8 +88,9 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "Library and utilities for working with the TIFF image file format";
    homepage = "https://libtiff.gitlab.io/libtiff";
-    changelog = "https://libtiff.gitlab.io/libtiff/v${version}.html";
+    changelog = "https://libtiff.gitlab.io/libtiff/v${finalAttrs.version}.html";
    license = licenses.libtiff;
    platforms = platforms.unix;
+    pkgConfigModules = [ "libtiff-4" ];
  };
-}
+})
--- a/Show more
+++ b/Show more