Merge master into haskell-updates

2024-03-03 00:13:21 +00:00 · 2024-03-03 00:13:21 +00:00 · b74f04cf79
commit b74f04cf79
parent b86ba9a18e af9110471a
245 changed files with 10708 additions and 2612 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -6041,6 +6041,15 @@
    githubId = 159288204;
    name = "evey";
  };
+  evilbulgarian = {
+    email = "vladi@aresgate.net";
+    github = "evilbulgarian";
+    githubId = 1960413;
+    name = "Vladi Gergov";
+    keys = [{
+      fingerprint = "50D5 67C5 D693 15A2 76F5  5634 3758 5F3C A9EC BFA4";
+    }];
+  };
  evilmav = {
    email = "elenskiy.ilya@gmail.com";
    github = "evilmav";
@ -6404,12 +6413,6 @@
    githubId = 1952914;
    name = "Maxence Maireaux";
  };
-  flexagoon = {
-    email = "flexagoon@pm.me";
-    github = "flexagoon";
-    githubId = 66178592;
-    name = "Pavel Zolotarevskiy";
-  };
  flexiondotorg = {
    name = "Martin Wimpress";
    email = "martin@wimpress.org";
@ -6557,6 +6560,11 @@
    githubId = 726447;
    name = "Francisco Demartino";
  };
+  frankp = {
+    github = "MDM23";
+    githubId = 10290864;
+    name = "Peter Frank";
+  };
  franzmondlichtmann = {
    name = "Franz Schroepf";
    email = "franz-schroepf@t-online.de";
@ -11718,6 +11726,12 @@
    githubId = 1780588;
    name = "Malte Poll";
  };
+  maltejanz = {
+    email = "service.malte.j@protonmail.com";
+    github = "MalteJanz";
+    githubId = 18661391;
+    name = "Malte Janz";
+  };
  malte-v = {
    email = "nixpkgs@mal.tc";
    github = "malte-v";
@ -21058,6 +21072,12 @@
    githubId = 973709;
    name = "Jairo Llopis";
  };
+  yamashitax = {
+    email = "hello@yamashit.ax";
+    github = "yamashitax";
+    githubId = 99486674;
+    name = "山下";
+  };
  yana = {
    email = "yana@riseup.net";
    github = "yanateras";
--- a/nixos/lib/testing/nodes.nix
+++ b/nixos/lib/testing/nodes.nix
@ -14,6 +14,25 @@ let
    types
    ;

+  inherit (hostPkgs) hostPlatform;
+
+  guestSystem =
+    if hostPlatform.isLinux
+    then hostPlatform.system
+    else
+      let
+        hostToGuest = {
+          "x86_64-darwin" = "x86_64-linux";
+          "aarch64-darwin" = "aarch64-linux";
+        };
+
+        supportedHosts = lib.concatStringsSep ", " (lib.attrNames hostToGuest);
+
+        message =
+          "NixOS Test: don't know which VM guest system to pair with VM host system: ${hostPlatform.system}. Perhaps you intended to run the tests on a Linux host, or one of the following systems that may run NixOS tests: ${supportedHosts}";
+      in
+        hostToGuest.${hostPlatform.system} or (throw message);
+
  baseOS =
    import ../eval-config.nix {
      inherit lib;
@ -27,13 +46,14 @@ let
          ({ config, ... }:
            {
              virtualisation.qemu.package = testModuleArgs.config.qemu.package;
+              virtualisation.host.pkgs = hostPkgs;
            })
          ({ options, ... }: {
            key = "nodes.nix-pkgs";
            config = optionalAttrs (!config.node.pkgsReadOnly) (
              mkIf (!options.nixpkgs.pkgs.isDefined) {
                # TODO: switch to nixpkgs.hostPlatform and make sure containers-imperative test still evaluates.
-                nixpkgs.system = hostPkgs.stdenv.hostPlatform.system;
+                nixpkgs.system = guestSystem;
              }
            );
          })
--- a/nixos/lib/testing/pkgs.nix
+++ b/nixos/lib/testing/pkgs.nix
@ -2,7 +2,11 @@
 {
  config = {
    # default pkgs for use in VMs
-    _module.args.pkgs = hostPkgs;
+    _module.args.pkgs =
+      # TODO: deprecate it everywhere; not just on darwin. Throw on darwin?
+      lib.warnIf hostPkgs.stdenv.hostPlatform.isDarwin
+        "Do not use the `pkgs` module argument in tests you want to run on darwin. It is ambiguous, and many tests are broken because of it. If you need to use a package on the VM host, use `hostPkgs`. Otherwise, use `config.node.pkgs`, or `config.nodes.<name>.nixpkgs.pkgs`."
+        hostPkgs;

    defaults = {
      # TODO: a module to set a shared pkgs, if options.nixpkgs.* is untouched by user (highestPrio) */
--- a/nixos/lib/testing/run.nix
+++ b/nixos/lib/testing/run.nix
@ -41,7 +41,9 @@ in
    rawTestDerivation = hostPkgs.stdenv.mkDerivation {
      name = "vm-test-run-${config.name}";

-      requiredSystemFeatures = [ "kvm" "nixos-test" ];
+      requiredSystemFeatures = [ "nixos-test" ]
+        ++ lib.optionals hostPkgs.stdenv.hostPlatform.isLinux [ "kvm" ]
+        ++ lib.optionals hostPkgs.stdenv.hostPlatform.isDarwin [ "apple-virt" ];

      buildCommand = ''
        mkdir -p $out
--- a/nixos/modules/i18n/input-method/fcitx5.nix
+++ b/nixos/modules/i18n/input-method/fcitx5.nix
@ -32,7 +32,8 @@ in
      };
      plasma6Support = mkOption {
        type = types.bool;
-        default = false;
+        default = config.services.xserver.desktopManager.plasma6.enable;
+        defaultText = literalExpression "config.services.xserver.desktopManager.plasma6.enable";
        description = lib.mdDoc ''
          Use qt6 versions of fcitx5 packages.
          Required for configuring fcitx5 in KDE System Settings.
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -719,6 +719,7 @@
  ./services/misc/libreddit.nix
  ./services/misc/lidarr.nix
  ./services/misc/lifecycled.nix
+  ./services/misc/llama-cpp.nix
  ./services/misc/logkeys.nix
  ./services/misc/mame.nix
  ./services/misc/mbpfan.nix
--- a/nixos/modules/programs/kdeconnect.nix
+++ b/nixos/modules/programs/kdeconnect.nix
@ -20,7 +20,10 @@ with lib;
      cfg = config.programs.kdeconnect;
    in
      mkIf cfg.enable {
-        environment.systemPackages = [ cfg.package ];
+        environment.systemPackages = [
+          cfg.package
+          pkgs.sshfs
+        ];
        networking.firewall = rec {
          allowedTCPPortRanges = [ { from = 1714; to = 1764; } ];
          allowedUDPPortRanges = allowedTCPPortRanges;
--- a/nixos/modules/services/home-automation/ebusd.nix
+++ b/nixos/modules/services/home-automation/ebusd.nix
@ -15,12 +15,12 @@ let
    "--port=${toString cfg.port}"
    "--configpath=${cfg.configpath}"
    "--scanconfig=${cfg.scanconfig}"
+    "--log=all:${cfg.logs.all}"
    "--log=main:${cfg.logs.main}"
    "--log=network:${cfg.logs.network}"
    "--log=bus:${cfg.logs.bus}"
    "--log=update:${cfg.logs.update}"
    "--log=other:${cfg.logs.other}"
-    "--log=all:${cfg.logs.all}"
  ] ++ lib.optionals cfg.readonly [
    "--readonly"
  ] ++ lib.optionals cfg.mqtt.enable [
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@ -342,6 +342,7 @@ in
        User = cfg.user;
        Restart = "on-failure";

+        LimitNOFILE = 65536;
        # gunicorn needs setuid, liblapack needs mbind
        SystemCallFilter = defaultServiceConfig.SystemCallFilter ++ [ "@setuid mbind" ];
        # Needs to serve web page
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@ -45,7 +45,7 @@ let
    };
  };

-  webroot = pkgs.runCommand
+  webroot = pkgs.runCommandLocal
    "${cfg.package.name or "nextcloud"}-with-apps"
    { }
    ''
--- a/nixos/modules/services/web-apps/photoprism.nix
+++ b/nixos/modules/services/web-apps/photoprism.nix
@ -104,6 +104,7 @@ in
        StateDirectory = "photoprism";
        WorkingDirectory = "/var/lib/photoprism";
        RuntimeDirectory = "photoprism";
+        ReadWritePaths = [ cfg.originalsPath cfg.importPath cfg.storagePath ];

        LoadCredential = lib.optionalString (cfg.passwordFile != null)
          "PHOTOPRISM_ADMIN_PASSWORD:${cfg.passwordFile}";
--- a/nixos/modules/services/x11/desktop-managers/plasma6.nix
+++ b/nixos/modules/services/x11/desktop-managers/plasma6.nix
@ -10,6 +10,11 @@

  inherit (pkgs) kdePackages;
  inherit (lib) literalExpression mkDefault mkIf mkOption mkPackageOptionMD types;
+
+  activationScript = ''
+    # will be rebuilt automatically
+    rm -fv $HOME/.cache/ksycoca*
+  '';
 in {
  options = {
    services.xserver.desktopManager.plasma6 = {
@ -273,5 +278,14 @@ in {
    };

    programs.kdeconnect.package = kdePackages.kdeconnect-kde;
+
+    # FIXME: ugly hack. See #292632 for details.
+    system.userActivationScripts.rebuildSycoca = activationScript;
+    systemd.user.services.nixos-rebuild-sycoca = {
+      description = "Rebuild KDE system configuration cache";
+      wantedBy = [ "graphical-session-pre.target" ];
+      serviceConfig.Type = "oneshot";
+      script = activationScript;
+    };
  };
 }
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
@ -43,6 +43,7 @@ class BootSpec:
    system: str
    toplevel: str
    specialisations: Dict[str, "BootSpec"]
+    sortKey: str
    initrdSecrets: str | None = None


@ -73,6 +74,7 @@ def system_dir(profile: str | None, generation: int, specialisation: str | None)
        return d

 BOOT_ENTRY = """title {title}
+sort-key {sort_key}
 version Generation {generation} {description}
 linux {kernel}
 initrd {initrd}
@ -123,7 +125,13 @@ def get_bootspec(profile: str | None, generation: int) -> BootSpec:
 def bootspec_from_json(bootspec_json: Dict) -> BootSpec:
    specialisations = bootspec_json['org.nixos.specialisation.v1']
    specialisations = {k: bootspec_from_json(v) for k, v in specialisations.items()}
-    return BootSpec(**bootspec_json['org.nixos.bootspec.v1'], specialisations=specialisations)
+    systemdBootExtension = bootspec_json.get('org.nixos.systemd-boot', {})
+    sortKey = systemdBootExtension.get('sortKey', 'nixos')
+    return BootSpec(
+        **bootspec_json['org.nixos.bootspec.v1'],
+        specialisations=specialisations,
+        sortKey=sortKey
+    )


 def copy_from_file(file: str, dry_run: bool = False) -> str:
@ -170,6 +178,7 @@ def write_entry(profile: str | None, generation: int, specialisation: str | None

    with open(tmp_path, 'w') as f:
        f.write(BOOT_ENTRY.format(title=title,
+                    sort_key=bootspec.sortKey,
                    generation=generation,
                    kernel=kernel,
                    initrd=initrd,
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
@ -87,6 +87,16 @@ in {

  imports =
    [ (mkRenamedOptionModule [ "boot" "loader" "gummiboot" "enable" ] [ "boot" "loader" "systemd-boot" "enable" ])
+      (lib.mkChangedOptionModule
+        [ "boot" "loader" "systemd-boot" "memtest86" "entryFilename" ]
+        [ "boot" "loader" "systemd-boot" "memtest86" "sortKey" ]
+        (config: lib.strings.removeSuffix ".conf" config.boot.loader.systemd-boot.memtest86.entryFilename)
+      )
+      (lib.mkChangedOptionModule
+        [ "boot" "loader" "systemd-boot" "netbootxyz" "entryFilename" ]
+        [ "boot" "loader" "systemd-boot" "netbootxyz" "sortKey" ]
+        (config: lib.strings.removeSuffix ".conf" config.boot.loader.systemd-boot.netbootxyz.entryFilename)
+      )
    ];

  options.boot.loader.systemd-boot = {
@ -102,6 +112,35 @@ in {
      '';
    };

+    sortKey = mkOption {
+      default = "nixos";
+      type = lib.types.str;
+      description = ''
+        The sort key used for the NixOS bootloader entries.
+        This key determines sorting relative to non-NixOS entries.
+        See also https://uapi-group.org/specifications/specs/boot_loader_specification/#sorting
+
+        This option can also be used to control the sorting of NixOS specialisations.
+
+        By default, specialisations inherit the sort key of their parent generation
+        and will have the same value for both the sort-key and the version (i.e. the generation number),
+        systemd-boot will therefore sort them based on their file name, meaning that
+        in your boot menu you will have each main generation directly followed by
+        its specialisations sorted alphabetically by their names.
+
+        If you want a different ordering for a specialisation, you can override
+        its sort-key which will cause the specialisation to be uncoupled from its
+        parent generation. It will then be sorted by its new sort-key just like
+        any other boot entry.
+
+        The sort-key is stored in the generation's bootspec, which means that
+        generations keep their sort-keys even if the original definition of the
+        generation was removed from the NixOS configuration.
+        It also means that updating the sort-key will only affect new generations,
+        while old ones will keep the sort-key that they were originally built with.
+      '';
+    };
+
    editor = mkOption {
      default = true;

@ -184,13 +223,15 @@ in {
        '';
      };

-      entryFilename = mkOption {
-        default = "memtest86.conf";
+      sortKey = mkOption {
+        default = "o_memtest86";
        type = types.str;
        description = lib.mdDoc ''
-          `systemd-boot` orders the menu entries by the config file names,
+          `systemd-boot` orders the menu entries by their sort keys,
          so if you want something to appear after all the NixOS entries,
          it should start with {file}`o` or onwards.
+
+          See also {option}`boot.loader.systemd-boot.sortKey`.
        '';
      };
    };
@ -207,13 +248,15 @@ in {
        '';
      };

-      entryFilename = mkOption {
-        default = "o_netbootxyz.conf";
+      sortKey = mkOption {
+        default = "o_netbootxyz";
        type = types.str;
        description = lib.mdDoc ''
-          `systemd-boot` orders the menu entries by the config file names,
+          `systemd-boot` orders the menu entries by their sort keys,
          so if you want something to appear after all the NixOS entries,
          it should start with {file}`o` or onwards.
+
+          See also {option}`boot.loader.systemd-boot.sortKey`.
        '';
      };
    };
@ -225,6 +268,7 @@ in {
        { "memtest86.conf" = '''
          title Memtest86+
          efi /efi/memtest86/memtest.efi
+          sort-key z_memtest
        '''; }
      '';
      description = lib.mdDoc ''
@ -233,9 +277,10 @@ in {
        Each attribute name denotes the destination file name,
        and the corresponding attribute value is the contents of the entry.

-        `systemd-boot` orders the menu entries by the config file names,
-        so if you want something to appear after all the NixOS entries,
-        it should start with {file}`o` or onwards.
+        To control the ordering of the entry in the boot menu, use the sort-key
+        field, see
+        https://uapi-group.org/specifications/specs/boot_loader_specification/#sorting
+        and {option}`boot.loader.systemd-boot.sortKey`.
      '';
    };

@ -328,19 +373,25 @@ in {

    boot.loader.systemd-boot.extraEntries = mkMerge [
      (mkIf cfg.memtest86.enable {
-        "${cfg.memtest86.entryFilename}" = ''
+        "memtest86.conf" = ''
          title  Memtest86+
          efi    /efi/memtest86/memtest.efi
+          sort-key ${cfg.memtest86.sortKey}
        '';
      })
      (mkIf cfg.netbootxyz.enable {
-        "${cfg.netbootxyz.entryFilename}" = ''
+        "netbootxyz.conf" = ''
          title  netboot.xyz
          efi    /efi/netbootxyz/netboot.xyz.efi
+          sort-key ${cfg.netbootxyz.sortKey}
        '';
      })
    ];

+    boot.bootspec.extensions."org.nixos.systemd-boot" = {
+      inherit (config.boot.loader.systemd-boot) sortKey;
+    };
+
    system = {
      build.installBootLoader = finalSystemdBootBuilder;

--- a/nixos/modules/tasks/filesystems.nix
+++ b/nixos/modules/tasks/filesystems.nix
@ -105,7 +105,7 @@ let
        type = types.bool;
        description = lib.mdDoc ''
          If the device does not currently contain a filesystem (as
-          determined by {command}`blkid`, then automatically
+          determined by {command}`blkid`), then automatically
          format it with the filesystem type specified in
          {option}`fsType`.  Use with caution.
        '';
--- a/nixos/modules/virtualisation/incus.nix
+++ b/nixos/modules/virtualisation/incus.nix
@ -107,6 +107,13 @@ in
  };

  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !(config.networking.firewall.enable && !config.networking.nftables.enable && config.virtualisation.incus.enable);
+        message = "Incus on NixOS is unsupported using iptables. Set `networking.nftables.enable = true;`";
+      }
+    ];
+
    # https://github.com/lxc/incus/blob/f145309929f849b9951658ad2ba3b8f10cbe69d1/doc/reference/server_settings.md
    boot.kernel.sysctl = {
      "fs.aio-max-nr" = lib.mkDefault 524288;
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@ -877,11 +877,9 @@ in
        type = types.package;
        default = (pkgs.OVMF.override {
          secureBoot = cfg.useSecureBoot;
-          systemManagementModeRequired = cfg.useSecureBoot;
        }).fd;
        defaultText = ''(pkgs.OVMF.override {
          secureBoot = cfg.useSecureBoot;
-          systemManagementModeRequired = cfg.useSecureBoot;
        }).fd'';
        description =
        lib.mdDoc "OVMF firmware package, defaults to OVMF configured with secure boot if needed.";
@ -1185,7 +1183,7 @@ in
        "-tpmdev emulator,id=tpm_dev_0,chardev=chrtpm"
        "-device ${cfg.tpm.deviceModel},tpmdev=tpm_dev_0"
      ])
-      (mkIf (cfg.efi.OVMF.systemManagementModeRequired or false) [
+      (mkIf (pkgs.stdenv.hostPlatform.isx86 && cfg.efi.OVMF.systemManagementModeRequired) [
        "-machine" "q35,smm=on"
        "-global" "driver=cfi.pflash01,property=secure,value=on"
      ])
--- a/nixos/tests/acme.nix
+++ b/nixos/tests/acme.nix
@ -1,4 +1,7 @@
-{ pkgs, lib, ... }: let
+{ config, lib, ... }: let
+
+  pkgs = config.node.pkgs;
+
  commonConfig = ./common/acme/client;

  dnsServerIP = nodes: nodes.dnsserver.networking.primaryIPAddress;
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -78,8 +78,9 @@ let
    #       it with `allowAliases = false`?
    # warnIf pkgs.config.allowAliases "nixosTests: pkgs includes aliases."
    {
+      _file = "${__curPos.file} readOnlyPkgs";
      _class = "nixosTest";
-      node.pkgs = pkgs;
+      node.pkgs = pkgs.pkgsLinux;
    };

 in {
--- a/nixos/tests/systemd-boot.nix
+++ b/nixos/tests/systemd-boot.nix
@ -93,6 +93,7 @@ in
      machine.wait_for_unit("multi-user.target")

      machine.succeed("test -e /boot/loader/entries/nixos-generation-1.conf")
+      machine.succeed("grep 'sort-key nixos' /boot/loader/entries/nixos-generation-1.conf")

      # Ensure we actually booted using systemd-boot
      # Magic number is the vendor UUID used by systemd-boot.
@ -115,15 +116,17 @@ in
      virtualisation.useSecureBoot = true;
    };

-    testScript = ''
+    testScript = let
+      efiArch = pkgs.stdenv.hostPlatform.efiArch;
+    in { nodes, ... }: ''
      machine.start(allow_reboot=True)
      machine.wait_for_unit("multi-user.target")

      machine.succeed("sbctl create-keys")
      machine.succeed("sbctl enroll-keys --yes-this-might-brick-my-machine")
-      machine.succeed('sbctl sign /boot/EFI/systemd/systemd-bootx64.efi')
-      machine.succeed('sbctl sign /boot/EFI/BOOT/BOOTX64.EFI')
-      machine.succeed('sbctl sign /boot/EFI/nixos/*bzImage.efi')
+      machine.succeed('sbctl sign /boot/EFI/systemd/systemd-boot${efiArch}.efi')
+      machine.succeed('sbctl sign /boot/EFI/BOOT/BOOT${toUpper efiArch}.EFI')
+      machine.succeed('sbctl sign /boot/EFI/nixos/*${nodes.machine.system.boot.loader.kernelFile}.efi')

      machine.reboot()

@ -164,7 +167,9 @@ in

    nodes.machine = { pkgs, lib, ... }: {
      imports = [ common ];
-      specialisation.something.configuration = {};
+      specialisation.something.configuration = {
+        boot.loader.systemd-boot.sortKey = "something";
+      };
    };

    testScript = ''
@ -177,6 +182,9 @@ in
      machine.succeed(
          "grep -q 'title NixOS (something)' /boot/loader/entries/nixos-generation-1-specialisation-something.conf"
      )
+      machine.succeed(
+          "grep 'sort-key something' /boot/loader/entries/nixos-generation-1-specialisation-something.conf"
+      )
    '';
  };

@ -254,25 +262,25 @@ in
    };

    testScript = ''
-      machine.succeed("test -e /boot/loader/entries/o_netbootxyz.conf")
+      machine.succeed("test -e /boot/loader/entries/netbootxyz.conf")
      machine.succeed("test -e /boot/efi/netbootxyz/netboot.xyz.efi")
    '';
  };

-  entryFilename = makeTest {
-    name = "systemd-boot-entry-filename";
+  memtestSortKey = makeTest {
+    name = "systemd-boot-memtest-sortkey";
    meta.maintainers = with pkgs.lib.maintainers; [ Enzime julienmalka ];

    nodes.machine = { pkgs, lib, ... }: {
      imports = [ common ];
      boot.loader.systemd-boot.memtest86.enable = true;
-      boot.loader.systemd-boot.memtest86.entryFilename = "apple.conf";
+      boot.loader.systemd-boot.memtest86.sortKey = "apple";
    };

    testScript = ''
-      machine.fail("test -e /boot/loader/entries/memtest86.conf")
-      machine.succeed("test -e /boot/loader/entries/apple.conf")
+      machine.succeed("test -e /boot/loader/entries/memtest86.conf")
      machine.succeed("test -e /boot/efi/memtest86/memtest.efi")
+      machine.succeed("grep 'sort-key apple' /boot/loader/entries/memtest86.conf")
    '';
  };

@ -283,7 +291,6 @@ in
    nodes.machine = { pkgs, lib, ... }: {
      imports = [ commonXbootldr ];
      boot.loader.systemd-boot.memtest86.enable = true;
-      boot.loader.systemd-boot.memtest86.entryFilename = "apple.conf";
    };

    testScript = { nodes, ... }: ''
@ -293,8 +300,7 @@ in
      machine.wait_for_unit("multi-user.target")

      machine.succeed("test -e /efi/EFI/systemd/systemd-bootx64.efi")
-      machine.fail("test -e /boot/loader/entries/memtest86.conf")
-      machine.succeed("test -e /boot/loader/entries/apple.conf")
+      machine.succeed("test -e /boot/loader/entries/memtest86.conf")
      machine.succeed("test -e /boot/EFI/memtest86/memtest.efi")
    '';
  };
@ -386,9 +392,9 @@ in
          machine.succeed("${finalSystem}/bin/switch-to-configuration boot")
          machine.fail("test -e /boot/efi/fruits/tomato.efi")
          machine.fail("test -e /boot/efi/nixos/.extra-files/efi/fruits/tomato.efi")
-          machine.succeed("test -e /boot/loader/entries/o_netbootxyz.conf")
+          machine.succeed("test -e /boot/loader/entries/netbootxyz.conf")
          machine.succeed("test -e /boot/efi/netbootxyz/netboot.xyz.efi")
-          machine.succeed("test -e /boot/efi/nixos/.extra-files/loader/entries/o_netbootxyz.conf")
+          machine.succeed("test -e /boot/efi/nixos/.extra-files/loader/entries/netbootxyz.conf")
          machine.succeed("test -e /boot/efi/nixos/.extra-files/efi/netbootxyz/netboot.xyz.efi")
    '';
  };
--- a/pkgs/applications/audio/surge-XT/default.nix
+++ b/pkgs/applications/audio/surge-XT/default.nix
@ -2,6 +2,7 @@
 , lib
 , fetchFromGitHub
 , cmake
+, gitMinimal
 , pkg-config
 , alsa-lib
 , freetype
@ -14,41 +15,23 @@
 , libXrandr
 }:

-let
-  juce-lv2 = stdenv.mkDerivation {
-    pname = "juce-lv2";
-    version = "unstable-2023-03-04";
-
-    # lv2 branch
-    src = fetchFromGitHub {
-      owner = "lv2-porting-project";
-      repo = "JUCE";
-      rev = "e825ad977cf4499a7bfa05b97b208236f8fd253b";
-      sha256 = "sha256-Fqp1y9BN0E9p/12ukG1oh3COhXNRWBAlFRSl0LPyiFc=";
-    };
-
-    dontConfigure = true;
-    dontBuild = true;
-
-    installPhase = ''
-      cp -r . $out
-    '';
-  };
-in
 stdenv.mkDerivation rec {
  pname = "surge-XT";
-  version = "1.2.3";
+  version = "1.3.1";

  src = fetchFromGitHub {
    owner = "surge-synthesizer";
    repo = "surge";
    rev = "release_xt_${version}";
+    branchName = "release-xt/${version}";
    fetchSubmodules = true;
-    sha256 = "sha256-DGzdzoCjMGEDltEwlPvLk2tyMVRH1Ql2Iq1ypogw/m0=";
+    leaveDotGit = true;
+    sha256 = "sha256-q6qs/OhIakF+Gc8Da3pnfkUGYDUoJbvee0o8dfrRI2U=";
  };

  nativeBuildInputs = [
    cmake
+    gitMinimal
    pkg-config
  ];

@ -67,8 +50,7 @@ stdenv.mkDerivation rec {
  enableParallelBuilding = true;

  cmakeFlags = [
-    "-DJUCE_SUPPORTS_LV2=ON"
-    "-DSURGE_JUCE_PATH=${juce-lv2}"
+    "-DSURGE_BUILD_LV2=TRUE"
  ];

  CXXFLAGS = [
--- a/pkgs/applications/blockchains/stellar-core/default.nix
+++ b/pkgs/applications/blockchains/stellar-core/default.nix
@ -2,6 +2,7 @@
 , automake
 , bison
 , fetchFromGitHub
+, fetchpatch
 , flex
 , git
 , lib
@ -25,6 +26,23 @@ stdenv.mkDerivation (finalAttrs: {
    fetchSubmodules = true;
  };

+  patches = [
+    # Fix gcc-13 build failure due to missing <stdexcept> include
+    #   https://github.com/stellar/medida/pull/34
+    (fetchpatch {
+      name = "gcc-13-p1.patch";
+      url = "https://github.com/stellar/medida/commit/f91354b0055de939779d392999975d611b1b1ad5.patch";
+      stripLen = 1;
+      extraPrefix = "lib/libmedida/";
+      hash = "sha256-iVeSUY5Rcy62apIKJdbcHGgxAxpQCkygf85oSjbTTXU=";
+    })
+    (fetchpatch {
+      name = "gcc-13-p2.patch";
+      url = "https://github.com/stellar/stellar-core/commit/477b3135281b629554cabaeacfcdbcdc170aa335.patch";
+      hash = "sha256-UVRcAIA5LEaCn16lWfhg19UU7b/apigzTsfPROLZtYg=";
+    })
+  ];
+
  nativeBuildInputs = [
    automake
    autoconf
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@ -27,12 +27,12 @@
  };
  angular = buildGrammar {
    language = "angular";
-    version = "0.0.0+rev=3946b10";
+    version = "0.0.0+rev=6d02054";
    src = fetchFromGitHub {
      owner = "dlvandenberg";
      repo = "tree-sitter-angular";
-      rev = "3946b1040b98a12458beef2763ce4780a523e3c6";
-      hash = "sha256-z49hTi6fG/00nb23rScIQScGTFm+NS+CL5+9d8mOCFI=";
+      rev = "6d02054ae9aa1fedf5097fe6d93dd78f751dff21";
+      hash = "sha256-Bm3I9a14WMNqL+nt5qr8Bd0Z4BOTCCF25wFrJ07FCSw=";
    };
    meta.homepage = "https://github.com/dlvandenberg/tree-sitter-angular";
  };
@ -50,12 +50,12 @@
  };
  arduino = buildGrammar {
    language = "arduino";
-    version = "0.0.0+rev=a282270";
+    version = "0.0.0+rev=7722d43";
    src = fetchFromGitHub {
      owner = "ObserverOfTime";
      repo = "tree-sitter-arduino";
-      rev = "a282270857b7be447b8be91411468349a31d73b7";
-      hash = "sha256-NAE/E3glGz509nOKO5xsJIwe1Q2OSh6Aj5krUOVhqvw=";
+      rev = "7722d4398d87ea22c4877264f88b45bd7ce0cba5";
+      hash = "sha256-pNiJY+KJ8QrL7xXOX/NRIFxIbXmf9DkVC9FUvXlk5qQ=";
    };
    meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-arduino";
  };
@ -72,12 +72,12 @@
  };
  astro = buildGrammar {
    language = "astro";
-    version = "0.0.0+rev=e924787";
+    version = "0.0.0+rev=dfa0893";
    src = fetchFromGitHub {
      owner = "virchau13";
      repo = "tree-sitter-astro";
-      rev = "e924787e12e8a03194f36a113290ac11d6dc10f3";
-      hash = "sha256-FNnkti4Ypw4RGIrIL9GtgjlYFMmOWZ2f8uQg/h3xesA=";
+      rev = "dfa0893bdc4bdfada102043404758c66e3580568";
+      hash = "sha256-gToRdyLvvDaeE1b9fYRVPFt1mtdR9kSYzqFBDUYpv3k=";
    };
    meta.homepage = "https://github.com/virchau13/tree-sitter-astro";
  };
@ -127,12 +127,12 @@
  };
  beancount = buildGrammar {
    language = "beancount";
-    version = "0.0.0+rev=dd6f4ec";
+    version = "0.0.0+rev=1f19abf";
    src = fetchFromGitHub {
      owner = "polarmutex";
      repo = "tree-sitter-beancount";
-      rev = "dd6f4ec9b01dd18cc4aa8c8517738414fb98cd63";
-      hash = "sha256-HG2L0PeYJm+U0ZUra5iRH9gm41sn44tiaS91vURHe2o=";
+      rev = "1f19abf1e162e1828013cb5434c6cf30f4054e80";
+      hash = "sha256-yb6z5iLMoK1wWCS9laA1muRVLssFwnyAg4SKWVsti0s=";
    };
    meta.homepage = "https://github.com/polarmutex/tree-sitter-beancount";
  };
@ -226,12 +226,12 @@
  };
  chatito = buildGrammar {
    language = "chatito";
-    version = "0.0.0+rev=7162ec1";
+    version = "0.0.0+rev=fe7a2a7";
    src = fetchFromGitHub {
      owner = "ObserverOfTime";
      repo = "tree-sitter-chatito";
-      rev = "7162ec1e8e9154fb334e84aa7637a4af051dfe42";
-      hash = "sha256-phvENW6wEqhKQakeXxsTclhSmFWFgfK9ztCszOGuaYY=";
+      rev = "fe7a2a75d3d74c1215141b7a7ebebb57ae17a370";
+      hash = "sha256-4ianrWSctAIufc/8I1pxWvoij1nG7mcRemQs0fj1Qt8=";
    };
    meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-chatito";
  };
@ -281,12 +281,12 @@
  };
  cooklang = buildGrammar {
    language = "cooklang";
-    version = "0.0.0+rev=5e11341";
+    version = "0.0.0+rev=81c2a86";
    src = fetchFromGitHub {
      owner = "addcninblue";
      repo = "tree-sitter-cooklang";
-      rev = "5e113412aadb78955c27010daa4dbe1d202013cf";
-      hash = "sha256-Ny55gdN+3o7bFJEnXvctstl6gjqkwrp1uE33OobyH7U=";
+      rev = "81c2a8667846b1e60db68b5601d864fe00fd1d3a";
+      hash = "sha256-zlffOW/ZJxpn3T2CMkrznkLLtuqxp7gIxVHEItvMepY=";
    };
    meta.homepage = "https://github.com/addcninblue/tree-sitter-cooklang";
  };
@ -469,12 +469,12 @@
  };
  dtd = buildGrammar {
    language = "dtd";
-    version = "0.0.0+rev=52b3783";
+    version = "0.0.0+rev=c23bd31";
    src = fetchFromGitHub {
      owner = "tree-sitter-grammars";
      repo = "tree-sitter-xml";
-      rev = "52b3783d0c89a69ec64b2d49eee95f44a7fdcd2a";
-      hash = "sha256-DVx/JwQXFEgY3XXo2rOVIWBRHdqprNgja9lAashkh5g=";
+      rev = "c23bd31d0aa72bfc01238b2546d5e823d8006709";
+      hash = "sha256-oPjO7y2xSVxvP0bpCFo/oGP4hPs3kWJ728d/R5PUdK4=";
    };
    location = "dtd";
    meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-xml";
@ -614,12 +614,12 @@
  };
  fidl = buildGrammar {
    language = "fidl";
-    version = "0.0.0+rev=bdbb635";
+    version = "0.0.0+rev=0a8910f";
    src = fetchFromGitHub {
      owner = "google";
      repo = "tree-sitter-fidl";
-      rev = "bdbb635a7f5035e424f6173f2f11b9cd79703f8d";
-      hash = "sha256-+s9AC7kAfPumREnc7xCSsYiaDwLp3uirLntwd2wK6Wo=";
+      rev = "0a8910f293268e27ff554357c229ba172b0eaed2";
+      hash = "sha256-QFAkxQo2w/+OR7nZn9ldBk2yHOd23kzciAcQvIZ5hrY=";
    };
    meta.homepage = "https://github.com/google/tree-sitter-fidl";
  };
@ -722,6 +722,17 @@
    };
    meta.homepage = "https://github.com/PrestonKnopp/tree-sitter-gdscript";
  };
+  gdshader = buildGrammar {
+    language = "gdshader";
+    version = "0.0.0+rev=ffd9f95";
+    src = fetchFromGitHub {
+      owner = "GodOfAvacyn";
+      repo = "tree-sitter-gdshader";
+      rev = "ffd9f958df13cae04593781d7d2562295a872455";
+      hash = "sha256-JWlDs0w10TqsPYgZvvaJwAueOciCYaws1Nr8rb0UKy4=";
+    };
+    meta.homepage = "https://github.com/GodOfAvacyn/tree-sitter-gdshader";
+  };
  git_config = buildGrammar {
    language = "git_config";
    version = "0.0.0+rev=9c2a1b7";
@ -746,23 +757,23 @@
  };
  gitattributes = buildGrammar {
    language = "gitattributes";
-    version = "0.0.0+rev=0750b59";
+    version = "0.0.0+rev=41940e1";
    src = fetchFromGitHub {
      owner = "ObserverOfTime";
      repo = "tree-sitter-gitattributes";
-      rev = "0750b5904f37d6b2f47f6e4655001c2c35a172ec";
-      hash = "sha256-BXsF++uut1WWxe67E+CUh3e6VWrezNJaPfYJhXB0VlY=";
+      rev = "41940e199ba5763abea1d21b4f717014b45f01ea";
+      hash = "sha256-h9RPFI40C4LxjjKZEKkVCnUjNkh6Tgl74msSTpju7ZY=";
    };
    meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-gitattributes";
  };
  gitcommit = buildGrammar {
    language = "gitcommit";
-    version = "0.0.0+rev=7c01af8";
+    version = "0.0.0+rev=6bd8196";
    src = fetchFromGitHub {
      owner = "gbprod";
      repo = "tree-sitter-gitcommit";
-      rev = "7c01af8d227b5344f62aade2ff00f19bd0c458ca";
-      hash = "sha256-2/SttSCDdTwXbhfYsiNOlVbf1V4nxd+3dxaaaTH0VQU=";
+      rev = "6bd81962d1abe309bf5dffde3315e4a5988f35fd";
+      hash = "sha256-aSgnTbhpekeDDUzz9hecebW5ejCnmLiE5d1fTTxP19g=";
    };
    meta.homepage = "https://github.com/gbprod/tree-sitter-gitcommit";
  };
@ -889,12 +900,12 @@
  };
  gpg = buildGrammar {
    language = "gpg";
-    version = "0.0.0+rev=e8a95ae";
+    version = "0.0.0+rev=d4c9cc0";
    src = fetchFromGitHub {
      owner = "ObserverOfTime";
      repo = "tree-sitter-gpg-config";
-      rev = "e8a95ae3deed7d7637c33f635fc5b9fc9dbb3216";
-      hash = "sha256-9spuIVyffwp2R0iFdC0VQ4EYmHQF7/Qvt+RzldonlK8=";
+      rev = "d4c9cc0060cd4d1b8ca6d7add9f34352ad310a09";
+      hash = "sha256-kV9GN0qdVNA7LFYoCM/ISEW4Mpd5v9+oHV83XgEJTRs=";
    };
    meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-gpg-config";
  };
@ -911,12 +922,12 @@
  };
  groovy = buildGrammar {
    language = "groovy";
-    version = "0.0.0+rev=235009a";
+    version = "0.0.0+rev=3c25d1c";
    src = fetchFromGitHub {
      owner = "murtaza64";
      repo = "tree-sitter-groovy";
-      rev = "235009aad0f580211fc12014bb0846c3910130c1";
-      hash = "sha256-Grp1ziaPyMNxoPbsJSiDCiKPXCtWJ/EC/d0OX/jqHF0=";
+      rev = "3c25d1ce6c1eb9da34215060372792dc9f439b0c";
+      hash = "sha256-VWIURpQoofmva6GWnOzq8niYklp5yOHH5ZuE8oDpzfs=";
    };
    meta.homepage = "https://github.com/murtaza64/tree-sitter-groovy";
  };
@ -955,12 +966,12 @@
  };
  haskell = buildGrammar {
    language = "haskell";
-    version = "0.0.0+rev=8a99848";
+    version = "0.0.0+rev=6b5ec20";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-haskell";
-      rev = "8a99848fc734f9c4ea523b3f2a07df133cbbcec2";
-      hash = "sha256-QIGLxc2BPGqglvpInjmmP/9gUoPEX21WrxsoGOKP03o=";
+      rev = "6b5ec205c9d4f23eb36a163f1edc4f2db8c98e4a";
+      hash = "sha256-TFI524Pb5RhoPLHJ0ucSKJcWJDmIX6PJELSHRd2ic7Q=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-haskell";
  };
@ -1010,12 +1021,12 @@
  };
  hlsl = buildGrammar {
    language = "hlsl";
-    version = "0.0.0+rev=f820ee8";
+    version = "0.0.0+rev=ee24be1";
    src = fetchFromGitHub {
      owner = "theHamsta";
      repo = "tree-sitter-hlsl";
-      rev = "f820ee8417451f69020791cf691904ec1b63f20d";
-      hash = "sha256-d80vNrZGaPWlST5tgvf25CliuzS+zSZ60f49cRuucZ4=";
+      rev = "ee24be127560f0de0c4741e382416f45ab47eb76";
+      hash = "sha256-FMmJpyburjO/NKq14bQ9LbvxuiYdjBt5/Gfm/jeye0U=";
    };
    meta.homepage = "https://github.com/theHamsta/tree-sitter-hlsl";
  };
@ -1098,12 +1109,12 @@
  };
  hyprlang = buildGrammar {
    language = "hyprlang";
-    version = "0.0.0+rev=8602513";
+    version = "0.0.0+rev=fc1d331";
    src = fetchFromGitHub {
      owner = "luckasRanarison";
      repo = "tree-sitter-hyprlang";
-      rev = "86025136c12cd1058985479a6b1935829077f1af";
-      hash = "sha256-1HGA4VUWM/iR1XBNmrsdj1PRGo7qPYMw5vmcVQO1BH0=";
+      rev = "fc1d331586e4da2b5f5bcfa89d630ebafe66458b";
+      hash = "sha256-powQTRaYmGGEdkmt59kLfdbLZRkRFbGra6PRnno0AUo=";
    };
    meta.homepage = "https://github.com/luckasRanarison/tree-sitter-hyprlang";
  };
@ -1153,12 +1164,12 @@
  };
  javascript = buildGrammar {
    language = "javascript";
-    version = "0.0.0+rev=9802cc5";
+    version = "0.0.0+rev=51aed72";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-javascript";
-      rev = "9802cc5812a19cd28168076af36e88b463dd3a18";
-      hash = "sha256-vCvpHDbO9/J/qyoSZmpmGQDVf9LweNsf3mKm6eEwdKc=";
+      rev = "51aed7263d33bee46b0a8a5e165ffcb690d5aca8";
+      hash = "sha256-FDnVwYpPgenOTgWaX/VdmtUmmIbCm/TtkiQ3TFoQjYY=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-javascript";
  };
@ -1474,12 +1485,12 @@
  };
  mermaid = buildGrammar {
    language = "mermaid";
-    version = "0.0.0+rev=e26a5f8";
+    version = "0.0.0+rev=e8dac87";
    src = fetchFromGitHub {
      owner = "monaqa";
      repo = "tree-sitter-mermaid";
-      rev = "e26a5f8898a8174f02b4cc9a9050eb3ccfb799f3";
-      hash = "sha256-qDJy2kPpx3wPl8IuhPM5ynhI2DjgutSFWAg5EQY5F+8=";
+      rev = "e8dac87a9f789b23a2c7ab8e55b485a2f5927b98";
+      hash = "sha256-1FCc8goKhFtgxSPeAzFkQhpbpruhZ+GD8VaLRJpnyS4=";
    };
    meta.homepage = "https://github.com/monaqa/tree-sitter-mermaid";
  };
@ -1530,23 +1541,23 @@
  };
  nickel = buildGrammar {
    language = "nickel";
-    version = "0.0.0+rev=19fb551";
+    version = "0.0.0+rev=33a64ec";
    src = fetchFromGitHub {
      owner = "nickel-lang";
      repo = "tree-sitter-nickel";
-      rev = "19fb551196d18b75160631f5e3a8a006b3875276";
-      hash = "sha256-NXyagRPUT3h8G6R+eE4YrTnWtfB3AT/piXeun5ETU6s=";
+      rev = "33a64ec9a27058c52e4195f1030235dcdfc04747";
+      hash = "sha256-gTOePRg5ZEXfBL35biG6abpxW2eycgbHIzaL6w4g8rc=";
    };
    meta.homepage = "https://github.com/nickel-lang/tree-sitter-nickel";
  };
  nim = buildGrammar {
    language = "nim";
-    version = "0.0.0+rev=c5f0ce3";
+    version = "0.0.0+rev=f5cec6a";
    src = fetchFromGitHub {
      owner = "alaviss";
      repo = "tree-sitter-nim";
-      rev = "c5f0ce3b65222f5dbb1a12f9fe894524881ad590";
-      hash = "sha256-KzAZf5vgrdp33esrgle71i0m52MvRJ3z/sMwzb+CueU=";
+      rev = "f5cec6a841b585e4e7388a120ded07e60ae19c43";
+      hash = "sha256-CL041Tjw7CH9EnpjAVl4f66zyOADfG9qwkFxeUjXH0w=";
    };
    meta.homepage = "https://github.com/alaviss/tree-sitter-nim";
  };
@ -1709,46 +1720,46 @@
  };
  pem = buildGrammar {
    language = "pem";
-    version = "0.0.0+rev=db307bb";
+    version = "0.0.0+rev=217ff2a";
    src = fetchFromGitHub {
      owner = "ObserverOfTime";
      repo = "tree-sitter-pem";
-      rev = "db307bbb7dc4f721bf2f5ba7fcedaf58feeb59e0";
-      hash = "sha256-uBZo16QtZtbYc4jHdFt1w/zMx9F+WKBB+ANre8IURHA=";
+      rev = "217ff2af3f2db15a79ab7e3d21ea1e0c17e71a1a";
+      hash = "sha256-KGJ9ulGi3gKUJxNXil5Zai4v5/5ImUSMVP3/19ra3A0=";
    };
    meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-pem";
  };
  perl = buildGrammar {
    language = "perl";
-    version = "0.0.0+rev=fd8b951";
+    version = "0.0.0+rev=6526e5d";
    src = fetchFromGitHub {
      owner = "tree-sitter-perl";
      repo = "tree-sitter-perl";
-      rev = "fd8b951cf6f72d48dfd07679de8cf0260836b231";
-      hash = "sha256-ejbpska3Ar0cjqDGZXXjRkpDLNsnDUJD0TBsb2cZfY4=";
+      rev = "6526e5d5bf31501de0dc51c42ac3583078a8fdab";
+      hash = "sha256-jqLYYHpcwt2ctcz6zbgyhG6p3yRLHvr9TlUMky2cfaM=";
    };
    meta.homepage = "https://github.com/tree-sitter-perl/tree-sitter-perl";
  };
  php = buildGrammar {
    language = "php";
-    version = "0.0.0+rev=710754c";
+    version = "0.0.0+rev=78a78df";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-php";
-      rev = "710754c879435178b7643e525c84cd53f32c510c";
-      hash = "sha256-vOvuctPCcKs5iQ88Tv3Euxk7fDg06o1leRWUic4qzLQ=";
+      rev = "78a78df5e06b4c13173af2a1f607c9a853d0f240";
+      hash = "sha256-N7qbOQethP/ZZHu5r+SJYCdrX4FVg72YuyULpuMUAhw=";
    };
    location = "php";
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-php";
  };
  php_only = buildGrammar {
    language = "php_only";
-    version = "0.0.0+rev=710754c";
+    version = "0.0.0+rev=78a78df";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-php";
-      rev = "710754c879435178b7643e525c84cd53f32c510c";
-      hash = "sha256-vOvuctPCcKs5iQ88Tv3Euxk7fDg06o1leRWUic4qzLQ=";
+      rev = "78a78df5e06b4c13173af2a1f607c9a853d0f240";
+      hash = "sha256-N7qbOQethP/ZZHu5r+SJYCdrX4FVg72YuyULpuMUAhw=";
    };
    location = "php_only";
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-php";
@ -1799,12 +1810,12 @@
  };
  poe_filter = buildGrammar {
    language = "poe_filter";
-    version = "0.0.0+rev=bf912df";
+    version = "0.0.0+rev=592476d";
    src = fetchFromGitHub {
      owner = "ObserverOfTime";
      repo = "tree-sitter-poe-filter";
-      rev = "bf912df70f60b356c70631d9cbb317b41c1ea319";
-      hash = "sha256-EHftq35YJzElvYiJxiu7iIcugoXME7CXuQSo1ktG584=";
+      rev = "592476d81f95d2451f2ca107dc872224c76fecdf";
+      hash = "sha256-dmo/t8gCT7UTlhBvxH4xmliR3Evazv3qsz9EWz7h/gU=";
    };
    meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-poe-filter";
  };
@ -1854,12 +1865,12 @@
  };
  properties = buildGrammar {
    language = "properties";
-    version = "0.0.0+rev=189b3cc";
+    version = "0.0.0+rev=9d09f5f";
    src = fetchFromGitHub {
      owner = "tree-sitter-grammars";
      repo = "tree-sitter-properties";
-      rev = "189b3cc18d36871c27ebb0adcf0cddd123b0cbba";
-      hash = "sha256-5cA2DDMiP8axu8Jl1M+CoxHoB+Jc/VMy3vXME+yxH9o=";
+      rev = "9d09f5f200c356c50c4103d36441309fd61b48d1";
+      hash = "sha256-KrQlLqCH4P5pwm8ql+iVR09khzQuJu2UHXdMT9MZYe8=";
    };
    meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-properties";
  };
@ -1921,34 +1932,34 @@
  };
  purescript = buildGrammar {
    language = "purescript";
-    version = "0.0.0+rev=2517b1e";
+    version = "0.0.0+rev=daf9b3e";
    src = fetchFromGitHub {
      owner = "postsolar";
      repo = "tree-sitter-purescript";
-      rev = "2517b1ee2236353af761edbd22570f740f1603f1";
-      hash = "sha256-iE8v4kwUlq+Xlv26C8IPrZZp1/c9x+X0RHM2HhGfcXM=";
+      rev = "daf9b3e2be18b0b2996a1281f7783e0d041d8b80";
+      hash = "sha256-eY2WF2n0fZUl1zxZZHJVYR8b1FwaAjkCeSeOdSf67m4=";
    };
    meta.homepage = "https://github.com/postsolar/tree-sitter-purescript";
  };
  pymanifest = buildGrammar {
    language = "pymanifest";
-    version = "0.0.0+rev=41a15c4";
+    version = "0.0.0+rev=e3b82b7";
    src = fetchFromGitHub {
      owner = "ObserverOfTime";
      repo = "tree-sitter-pymanifest";
-      rev = "41a15c43252baa083729c25646cde83ee5c88277";
-      hash = "sha256-sOh3j3wy519U1XCBEZhJ4WxIiGZ+/WX5xgj+wy7N9c0=";
+      rev = "e3b82b78721aee07f676dac8473ae69db51debcf";
+      hash = "sha256-pZCqeSdiYctbFthdb8Olw35CAXQmT7jG2LOO/3NN/8s=";
    };
    meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-pymanifest";
  };
  python = buildGrammar {
    language = "python";
-    version = "0.0.0+rev=deba2ba";
+    version = "0.0.0+rev=22d3f87";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-python";
-      rev = "deba2badc88afd18e6cbd4341ee3c18c3a9bb4ed";
-      hash = "sha256-K3zamqQPM1UHk375TrMvT9mXw8f7tUse5bFctI+V1EA=";
+      rev = "22d3f87bdafac2782e907330babe4af574f5d0b4";
+      hash = "sha256-tyEawslx00ZwohMZo4HBa/INfbS7q6Ob2LO7pvowobk=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-python";
  };
@ -2086,12 +2097,12 @@
  };
  requirements = buildGrammar {
    language = "requirements";
-    version = "0.0.0+rev=0008446";
+    version = "0.0.0+rev=8666a4d";
    src = fetchFromGitHub {
      owner = "ObserverOfTime";
      repo = "tree-sitter-requirements";
-      rev = "00084464ccad32dd71da60771c25554eeedb213c";
-      hash = "sha256-84xUmRPhZvBxW+p9RWavOaK3OHJSuhjfbGr/eY4yOto=";
+      rev = "8666a4dfeb3107144398158bc3dd7a3f59d89ccb";
+      hash = "sha256-M+/I0pn79Juk8LRB6LLRAyA3R5zcm6rIoR4viT9SW0c=";
    };
    meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-requirements";
  };
@ -2152,12 +2163,12 @@
  };
  rust = buildGrammar {
    language = "rust";
-    version = "0.0.0+rev=85a21c9";
+    version = "0.0.0+rev=2d7bac5";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-rust";
-      rev = "85a21c96d31b2a5c4369e5836a7f4ab059268fea";
-      hash = "sha256-uxOjdB65+HjNuOybbYb2N9R0I+bt909bIBOzmh9vfVc=";
+      rev = "2d7bac5164c344c95530c16dd5c8fa1319e34308";
+      hash = "sha256-k5/tfG8ONOK8ARgHwpxqB27sJWHioTd5WfCpmMZ1vJY=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-rust";
  };
@ -2263,12 +2274,12 @@
  };
  solidity = buildGrammar {
    language = "solidity";
-    version = "0.0.0+rev=1680203";
+    version = "0.0.0+rev=5cb506a";
    src = fetchFromGitHub {
      owner = "JoranHonig";
      repo = "tree-sitter-solidity";
-      rev = "168020304759ad5d8b4a88a541a699134e3730c5";
-      hash = "sha256-GCSBXB9nNIYpcXlA6v7P1ejn1ojmfXdPzr1sWejB560=";
+      rev = "5cb506ae419c4ad620c77210fd47500d3d169dbc";
+      hash = "sha256-3BQuEGrmQD9Va7JpTuKJaZ6VaJ//tfPtjoEDRj/utcU=";
    };
    meta.homepage = "https://github.com/JoranHonig/tree-sitter-solidity";
  };
@ -2342,12 +2353,12 @@
  };
  ssh_config = buildGrammar {
    language = "ssh_config";
-    version = "0.0.0+rev=b859582";
+    version = "0.0.0+rev=4fab1c9";
    src = fetchFromGitHub {
      owner = "ObserverOfTime";
      repo = "tree-sitter-ssh-config";
-      rev = "b8595820fa331977a5a44f5f9e0a445c456b5cbf";
-      hash = "sha256-0aJ+borC8Ous0hTm000DQGaDxbYvvYjocMG4M0bUBqY=";
+      rev = "4fab1c9116cb7890885508e4630cc8e6a8373a41";
+      hash = "sha256-cZoRQN3vrOC7xaKeURGeKfQ0xAyRMapbgNQrBTCFoHI=";
    };
    meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-ssh-config";
  };
@ -2419,12 +2430,12 @@
  };
  swift = buildGrammar {
    language = "swift";
-    version = "0.0.0+rev=e1ac0c3";
+    version = "0.0.0+rev=fc00cbb";
    src = fetchFromGitHub {
      owner = "alex-pinkus";
      repo = "tree-sitter-swift";
-      rev = "e1ac0c3b48f4c42c40f92f400f14c6561369d4dd";
-      hash = "sha256-7MXH3ZDMH3Im/t5FPMGw6MGKMS+hKaHKUvTXXCrvgtI=";
+      rev = "fc00cbb460b40228b30f322b5a34ea0e8f35a9f8";
+      hash = "sha256-FEac9qZuNAJYn/7mIpRSOy72F3qsiyPHZTn1DUzM2xk=";
    };
    generate = true;
    meta.homepage = "https://github.com/alex-pinkus/tree-sitter-swift";
@ -2475,12 +2486,12 @@
  };
  tcl = buildGrammar {
    language = "tcl";
-    version = "0.0.0+rev=78c7120";
+    version = "0.0.0+rev=56ad1fa";
    src = fetchFromGitHub {
      owner = "tree-sitter-grammars";
      repo = "tree-sitter-tcl";
-      rev = "78c71201c1b0939239e779a837dd35370c308948";
-      hash = "sha256-+dCG0V+eKmLJqvtxCLNpupb8W7a4n3hAsHfURAgnTmk=";
+      rev = "56ad1fa6a34ba800e5495d1025a9b0fda338d5b8";
+      hash = "sha256-GhK92+nbJ+M5/1ZnPbIJ3EuNub332YK+hyWiwyBqUmk=";
    };
    meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-tcl";
  };
@ -2667,23 +2678,23 @@
  };
  typst = buildGrammar {
    language = "typst";
-    version = "0.0.0+rev=c757be0";
+    version = "0.0.0+rev=3c3e5f8";
    src = fetchFromGitHub {
      owner = "uben0";
      repo = "tree-sitter-typst";
-      rev = "c757be0898e2a58f4e9761aa164dc413bf5beaf8";
-      hash = "sha256-z0x47Qrr8mYroDtXapRmzOMHOxlYmQmonN0P7VSCBu0=";
+      rev = "3c3e5f8e0caeba6157e26a1bedf8321e1da62799";
+      hash = "sha256-9XbFIvZvmeeR38Kejt8Yyxidy/XiAtZ5aQMt/rfg4JE=";
    };
    meta.homepage = "https://github.com/uben0/tree-sitter-typst";
  };
  udev = buildGrammar {
    language = "udev";
-    version = "0.0.0+rev=15d89be";
+    version = "0.0.0+rev=8f58696";
    src = fetchFromGitHub {
      owner = "ObserverOfTime";
      repo = "tree-sitter-udev";
-      rev = "15d89be59a3802dcbe2e97e0f9d32b52f3aeda3f";
-      hash = "sha256-cgy50jUlqf9/B9H3n24gD9e4mn2qNsa9QxmE8GdhnaA=";
+      rev = "8f58696e79092b4ad6bf197415bbd0970acf15cd";
+      hash = "sha256-4vkEHlK8r69cvSu7CAXOmyiSSuIRlZcnQAGHtWqx41w=";
    };
    meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-udev";
  };
@ -2734,12 +2745,12 @@
  };
  v = buildGrammar {
    language = "v";
-    version = "0.0.0+rev=56d7905";
+    version = "0.0.0+rev=be121f7";
    src = fetchFromGitHub {
      owner = "vlang";
      repo = "v-analyzer";
-      rev = "56d7905f423b82dff4b23c86e2869ddc06f6e419";
-      hash = "sha256-p6QPrmgmrMZai8zvVfNDkXo6SLDpQ537bitHeNC39ik=";
+      rev = "be121f724e4f3e2159dfa193c876be605c1de7fa";
+      hash = "sha256-nOWhtoPoVjfPitOMxTiU8Y3dBKT3GwGswRFmVYkcZ2E=";
    };
    location = "tree_sitter_v";
    meta.homepage = "https://github.com/vlang/v-analyzer";
@ -2790,12 +2801,12 @@
  };
  vimdoc = buildGrammar {
    language = "vimdoc";
-    version = "0.0.0+rev=40fcd50";
+    version = "0.0.0+rev=b63be26";
    src = fetchFromGitHub {
      owner = "neovim";
      repo = "tree-sitter-vimdoc";
-      rev = "40fcd50a2c7b5a3ef98294795116773b24fb61ab";
-      hash = "sha256-i/O8vIjiyOoFECS1nmKfL/8hofzSvwg5cJo7JooJGOY=";
+      rev = "b63be26fa571259b512e1939f01755d9d6e78fbd";
+      hash = "sha256-gsjepcw8Y8Vm6GhJRKUJKLsCb+Rd0lNyYfnmWijuiLo=";
    };
    meta.homepage = "https://github.com/neovim/tree-sitter-vimdoc";
  };
@ -2834,12 +2845,12 @@
  };
  wing = buildGrammar {
    language = "wing";
-    version = "0.0.0+rev=52ef462";
+    version = "0.0.0+rev=13b79ea";
    src = fetchFromGitHub {
      owner = "winglang";
      repo = "wing";
-      rev = "52ef462f76e199845a5df4834b838339e0a6efdb";
-      hash = "sha256-eZEyk285EyfduzrVH3Ojbwu8mbRFfZY6lrQQQT1kWM8=";
+      rev = "13b79ea3f343b15f233c6e7ac930797748191615";
+      hash = "sha256-2BOPevKjrNoTRNaadwr7erWDBxIDUvU4zLOQgXOB4rE=";
    };
    location = "libs/tree-sitter-wing";
    generate = true;
@ -2847,23 +2858,23 @@
  };
  xcompose = buildGrammar {
    language = "xcompose";
-    version = "0.0.0+rev=7fd1494";
+    version = "0.0.0+rev=2383cc6";
    src = fetchFromGitHub {
      owner = "ObserverOfTime";
      repo = "tree-sitter-xcompose";
-      rev = "7fd14940e0478fce79ea195067ed14a2c42c654a";
-      hash = "sha256-elnm1HjE4hLFMR/XhCPhOcGjqS9FbCULPRb/IntpQ3U=";
+      rev = "2383cc69a2c42cfade41c7cb971fb3862bec6df1";
+      hash = "sha256-N8pJhB35IApb41TKn6NuVMEgmQGC+1Nyu5eQck1K5g8=";
    };
    meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-xcompose";
  };
  xml = buildGrammar {
    language = "xml";
-    version = "0.0.0+rev=52b3783";
+    version = "0.0.0+rev=c23bd31";
    src = fetchFromGitHub {
      owner = "tree-sitter-grammars";
      repo = "tree-sitter-xml";
-      rev = "52b3783d0c89a69ec64b2d49eee95f44a7fdcd2a";
-      hash = "sha256-DVx/JwQXFEgY3XXo2rOVIWBRHdqprNgja9lAashkh5g=";
+      rev = "c23bd31d0aa72bfc01238b2546d5e823d8006709";
+      hash = "sha256-oPjO7y2xSVxvP0bpCFo/oGP4hPs3kWJ728d/R5PUdK4=";
    };
    location = "xml";
    meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-xml";
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -1290,6 +1290,7 @@ https://github.com/svermeulen/vim-subversive/,,
 https://github.com/tpope/vim-surround/,,
 https://github.com/evanleck/vim-svelte/,,
 https://github.com/machakann/vim-swap/,,
+https://github.com/TabbyML/vim-tabby/,HEAD,
 https://github.com/dhruvasagar/vim-table-mode/,,
 https://github.com/kana/vim-tabpagecd/,,
 https://github.com/tpope/vim-tbone/,,
@ -1401,4 +1402,3 @@ https://github.com/ziglang/zig.vim/,,
 https://github.com/mickael-menu/zk-nvim/,HEAD,
 https://github.com/troydm/zoomwintab.vim/,,
 https://github.com/nanotee/zoxide.vim/,,
-https://github.com/TabbyML/vim-tabby/,HEAD,
--- a/pkgs/applications/emulators/citra/generic.nix
+++ b/pkgs/applications/emulators/citra/generic.nix
@ -34,7 +34,7 @@
 , enableQtTranslation ? enableQt, qttools
 , enableWebService ? true
 , enableCubeb ? true, cubeb
-, useDiscordRichPresence ? true, rapidjson
+, useDiscordRichPresence ? false, rapidjson
 }:
 stdenv.mkDerivation {
  inherit pname version src;
@ -72,23 +72,25 @@ stdenv.mkDerivation {
    ++ lib.optional useDiscordRichPresence rapidjson;

  cmakeFlags = [
-    "-DUSE_SYSTEM_LIBS=ON"
+    (lib.cmakeBool "USE_SYSTEM_LIBS" true)

-    "-DDISABLE_SYSTEM_DYNARMIC=ON"
-    "-DDISABLE_SYSTEM_GLSLANG=ON" # The following imported targets are referenced, but are missing: SPIRV-Tools-opt
-    "-DDISABLE_SYSTEM_LODEPNG=ON" # Not packaged in nixpkgs
-    "-DDISABLE_SYSTEM_VMA=ON"
-    "-DDISABLE_SYSTEM_XBYAK=ON"
+    (lib.cmakeBool "DISABLE_SYSTEM_DYNARMIC" true)
+    (lib.cmakeBool "DISABLE_SYSTEM_GLSLANG" true) # The following imported targets are referenced, but are missing: SPIRV-Tools-opt
+    (lib.cmakeBool "DISABLE_SYSTEM_LODEPNG" true) # Not packaged in nixpkgs
+    (lib.cmakeBool "DISABLE_SYSTEM_VMA" true)
+    (lib.cmakeBool "DISABLE_SYSTEM_XBYAK" true)

    # We don't want to bother upstream with potentially outdated compat reports
-    "-DCITRA_ENABLE_COMPATIBILITY_REPORTING=ON"
-    "-DENABLE_COMPATIBILITY_LIST_DOWNLOAD=OFF" # We provide this deterministically
-  ] ++ lib.optional (!enableSdl2Frontend) "-DENABLE_SDL2_FRONTEND=OFF"
-    ++ lib.optional (!enableQt) "-DENABLE_QT=OFF"
-    ++ lib.optional enableQtTranslation "-DENABLE_QT_TRANSLATION=ON"
-    ++ lib.optional (!enableWebService) "-DENABLE_WEB_SERVICE=OFF"
-    ++ lib.optional (!enableCubeb) "-DENABLE_CUBEB=OFF"
-    ++ lib.optional useDiscordRichPresence "-DUSE_DISCORD_PRESENCE=ON";
+    (lib.cmakeBool "CITRA_ENABLE_COMPATIBILITY_REPORTING" true)
+    (lib.cmakeBool "ENABLE_COMPATIBILITY_LIST_DOWNLOAD" false) # We provide this deterministically
+
+    (lib.cmakeBool "ENABLE_SDL2_FRONTEND" enableSdl2Frontend)
+    (lib.cmakeBool "ENABLE_QT" enableQt)
+    (lib.cmakeBool "ENABLE_QT_TRANSLATION" enableQtTranslation)
+    (lib.cmakeBool "ENABLE_WEB_SERVICE" enableWebService)
+    (lib.cmakeBool "ENABLE_CUBEB" enableCubeb)
+    (lib.cmakeBool "USE_DISCORD_PRESENCE" useDiscordRichPresence)
+  ];

  # causes redefinition of _FORTIFY_SOURCE
  hardeningDisable = [ "fortify3" ];
--- a/pkgs/applications/graphics/monado/default.nix
+++ b/pkgs/applications/graphics/monado/default.nix
@ -3,6 +3,7 @@
 , fetchFromGitLab
 , writeText
 , cmake
+, cjson
 , doxygen
 , glslang
 , pkg-config
@ -11,6 +12,7 @@
 , bluez
 , dbus
 , eigen
+, elfutils
 , ffmpeg
 , gst-plugins-base
 , gstreamer
@ -19,11 +21,13 @@
 , libXau
 , libXdmcp
 , libXrandr
+, libXext
 , libbsd
 , libffi
 , libjpeg
-# , librealsense
+, librealsense
 , libsurvive
+, libunwind
 , libusb1
 , libuv
 , libuvc
@ -33,6 +37,9 @@
 , opencv4
 , openhmd
 , openvr
+, orc
+, pcre2
+, shaderc
 , udev
 , vulkan-headers
 , vulkan-loader
@ -41,6 +48,7 @@
 , wayland-scanner
 , libdrm
 , zlib
+, zstd
 , nixosTests
 # Set as 'false' to build monado without service support, i.e. allow VR
 # applications linking against libopenxr_monado.so to use OpenXR standalone
@ -77,8 +85,10 @@ stdenv.mkDerivation {
  buildInputs = [
    SDL2
    bluez
+    cjson
    dbus
    eigen
+    elfutils
    ffmpeg
    gst-plugins-base
    gstreamer
@ -90,8 +100,9 @@ stdenv.mkDerivation {
    libbsd
    libjpeg
    libffi
-    # librealsense.dev - see below
+    librealsense
    libsurvive
+    libunwind
    libusb1
    libuv
    libuvc
@ -101,6 +112,9 @@ stdenv.mkDerivation {
    opencv4
    openhmd
    openvr
+    orc
+    pcre2
+    shaderc
    udev
    vulkan-headers
    vulkan-loader
@ -109,24 +123,14 @@ stdenv.mkDerivation {
    wayland-protocols
    libdrm
    zlib
+    zstd
  ];

-  # known disabled drivers:
-  #  - DRIVER_DEPTHAI - Needs depthai-core https://github.com/luxonis/depthai-core
-  #  - DRIVER_ILLIXR - needs ILLIXR headers https://github.com/ILLIXR/ILLIXR
-  #  - DRIVER_REALSENSE - see below
-  #  - DRIVER_SIMULAVR - needs realsense
-  #  - DRIVER_ULV2 - needs proprietary Leapmotion SDK https://api.leapmotion.com/documentation/v2/unity/devguide/Leap_SDK_Overview.html
-
-  # realsense is disabled, the build ends with the following error:
-  #
-  # CMake Error in src/xrt/drivers/CMakeLists.txt:
-  # Imported target "realsense2::realsense2" includes non-existent path
-  # "/nix/store/2v95aps14hj3jy4ryp86vl7yymv10mh0-librealsense-2.41.0/include"
-  # in its INTERFACE_INCLUDE_DIRECTORIES.
-  #
-  # for some reason cmake is trying to use ${librealsense}/include
-  # instead of ${librealsense.dev}/include as an include directory
+  # known disabled drivers/features:
+  #  - DRIVER_DEPTHAI - Needs depthai-core https://github.com/luxonis/depthai-core (See https://github.com/NixOS/nixpkgs/issues/292618)
+  #  - DRIVER_ILLIXR - needs ILLIXR headers https://github.com/ILLIXR/ILLIXR (See https://github.com/NixOS/nixpkgs/issues/292661)
+  #  - DRIVER_ULV2 - Needs proprietary Leapmotion SDK https://api.leapmotion.com/documentation/v2/unity/devguide/Leap_SDK_Overview.html (See https://github.com/NixOS/nixpkgs/issues/292624)
+  #  - DRIVER_ULV5 - Needs proprietary Leapmotion SDK https://api.leapmotion.com/documentation/v2/unity/devguide/Leap_SDK_Overview.html (See https://github.com/NixOS/nixpkgs/issues/292624)

  # Help openxr-loader find this runtime
  setupHook = writeText "setup-hook" ''
--- a/pkgs/applications/graphics/rnote/Cargo.lock
+++ b/pkgs/applications/graphics/rnote/Cargo.lock
--- a/pkgs/applications/graphics/rnote/default.nix
+++ b/pkgs/applications/graphics/rnote/default.nix
@ -2,6 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , alsa-lib
+, appstream
 , appstream-glib
 , cargo
 , cmake
@ -26,20 +27,20 @@

 stdenv.mkDerivation rec {
  pname = "rnote";
-  version = "0.9.4";
+  version = "0.10.0";

  src = fetchFromGitHub {
    owner = "flxzt";
    repo = "rnote";
    rev = "v${version}";
-    hash = "sha256-twysPSuCu++dVqoRKTNSvxwrO1ljUu4k2vPZEBkaj10=";
+    hash = "sha256-PMg83eWcC21yNiRYdTS6/j9gerTctnDPHXIM4PWktrU=";
  };

  cargoDeps = rustPlatform.importCargoLock {
    lockFile = ./Cargo.lock;
    outputHashes = {
      "ink-stroke-modeler-rs-0.1.0" = "sha256-WfZwezohm8+ZXiKZlssTX+b/Izk1M4jFwxQejeTfc6M=";
-      "piet-0.6.2" = "sha256-WrQok0T7uVQEp8SvNWlgqwQHfS7q0510bnP1ecr+s1Q=";
+      "piet-0.6.2" = "sha256-3juXzuKwoLuxia6MoVwbcBJ3jXBQ9QRNVoxo3yFp2Iw=";
    };
  };

@ -67,6 +68,7 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
+    appstream
    glib
    gstreamer
    gtk4
--- a/pkgs/applications/misc/evtest-qt/default.nix
+++ b/pkgs/applications/misc/evtest-qt/default.nix
@ -1,20 +1,33 @@
-{ mkDerivation, lib, qtbase, cmake, fetchFromGitHub }:
+{ mkDerivation, lib, qtbase, cmake, fetchFromGitHub, fetchpatch, unstableGitUpdater }:

 mkDerivation rec {
  pname = "evtest-qt";
-  version = "0.2.0";
+  version = "0.2.0-unstable-2023-09-13";

  src = fetchFromGitHub {
    owner = "Grumbel";
    repo = pname;
-    rev = "v${version}";
-    sha256 = "1wfzkgq81764qzxgk0y5vvpxcrb3icvrr4dd4mj8njrqgbwmn0mw";
+    rev = "fb087f4d3d51377790f1ff30681c48031bf23145";
+    hash = "sha256-gE47x1J13YZUVyB0b4VRyESIVCm3GbOXp2bX0TP97UU=";
+    fetchSubmodules = true;
  };

+  patches = [
+    # Fix build against gcc-13:
+    #   https://github.com/Grumbel/evtest-qt/pull/14
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/Grumbel/evtest-qt/commit/975dedcfd60853bd329f34d48ce4740add8866eb.patch";
+      hash = "sha256-gR/9oVhO4G9i7dn+CjvDAQN0KLXoX/fatpE0W3gXDc0=";
+    })
+  ];
+
  nativeBuildInputs = [ cmake ];

  buildInputs = [ qtbase ];

+  passthru.updateScript = unstableGitUpdater {};
+
  meta = with lib; {
    description = "Simple input device tester for linux with Qt GUI";
    homepage = "https://github.com/Grumbel/evtest-qt";
--- a/pkgs/applications/misc/monitorcontrol/default.nix
+++ b/pkgs/applications/misc/monitorcontrol/default.nix
@ -14,14 +14,6 @@ stdenv.mkDerivation rec {
  };

  # MonitorControl.${version}.dmg is APFS formatted, unpack with 7zz
-  unpackCmd = ''
-    runHook preUnpack
-
-    7zz x $src
-
-    runHook postUnpack
-  '';
-
  nativeBuildInputs = [ _7zz ];

  sourceRoot = "MonitorControl.app";
--- a/pkgs/applications/misc/qlcplus/default.nix
+++ b/pkgs/applications/misc/qlcplus/default.nix
@ -29,16 +29,20 @@ mkDerivation rec {

  qmakeFlags = [ "INSTALLROOT=$(out)" ];

-  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
-
  postPatch = ''
    patchShebangs .
    sed -i -e '/unix:!macx:INSTALLROOT += \/usr/d' \
            -e "s@\$\$LIBSDIR/qt4/plugins@''${qtPluginPrefix}@" \
            -e "s@/etc/udev/rules.d@''${out}/lib/udev/rules.d@" \
      variables.pri
+
+    # Fix gcc-13 build failure by removing blanket -Werror.
+    fgrep Werror variables.pri
+    substituteInPlace variables.pri --replace-fail "QMAKE_CXXFLAGS += -Werror" ""
  '';

+  enableParallelBuilding = true;
+
  postInstall = ''
    ln -sf $out/lib/*/libqlcplus* $out/lib
  '';
--- a/pkgs/applications/misc/raider/default.nix
+++ b/pkgs/applications/misc/raider/default.nix
@ -1,11 +1,10 @@
-{ appstream-glib
+{ appstream
 , blueprint-compiler
 , desktop-file-utils
 , fetchFromGitHub
 , gettext
 , glib
 , gtk4
-, itstool
 , lib
 , libadwaita
 , meson
@ -15,22 +14,22 @@
 , stdenv
 , wrapGAppsHook4
 }:
+
 stdenv.mkDerivation rec {
  pname = "raider";
-  version = "1.3.1";
+  version = "2.1.0";

  src = fetchFromGitHub {
    owner = "ADBeveridge";
    repo = "raider";
    rev = "v${version}";
-    hash = "sha256-fyE0CsQp2UVh+7bAQo+GHEF0k8Gwl9j4qclh04AQiVI=";
+    hash = "sha256-ZR40sbEKvZxGxRaV5H9D6kBP9ZgUdc425XgIhqidWLI=";
  };

  nativeBuildInputs = [
-    appstream-glib
+    appstream
    blueprint-compiler
    desktop-file-utils
-    itstool
    meson
    ninja
    pkg-config
@ -44,15 +43,23 @@ stdenv.mkDerivation rec {
    libadwaita
  ];

-  postInstall = ''
-    glib-compile-schemas $out/share/glib-2.0/schemas
-  '';
-
  meta = with lib; {
-    description = "Securely delete your files";
-    homepage = "https://apps.gnome.org/app/com.github.ADBeveridge.Raider";
+    description = "Permanently delete your files (also named File Shredder)";
+    longDescription = ''
+      Raider is a shredding program built for the GNOME
+      desktop. It is meant to remove files from your
+      computer permanently. Within a certain limit, it is
+      effective. However, the way data is written physically
+      to SSDs at the hardware level ensures that shredding
+      is never perfect, and no software can fix that.
+      However, top-level agencies are usually the only ones
+      who can recover such data, due to the time, effort,
+      money and patience required to extract it effectively.
+    '';
+    homepage = "https://apps.gnome.org/Raider";
    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ benediktbroich ];
+    mainProgram = "raider";
+    maintainers = with maintainers; [ benediktbroich aleksana ];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/misc/tableplus/default.nix
+++ b/pkgs/applications/misc/tableplus/default.nix
@ -0,0 +1,37 @@
+{ lib
+, fetchurl
+, undmg
+, stdenv
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "tableplus";
+  version = "504";
+  src = fetchurl {
+    url = "https://download.tableplus.com/macos/${finalAttrs.version}/TablePlus.dmg";
+    hash = "sha256-YFUquv71QFEnlmh93+HsFN6XtgoUx6CMOVqfdWAIWfo=";
+  };
+
+  sourceRoot = "TablePlus.app";
+
+  nativeBuildInputs = [ undmg ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/Applications/TablePlus.app"
+    cp -R . "$out/Applications/TablePlus.app"
+    mkdir "$out/bin"
+    ln -s "$out/Applications/TablePlus.app/Contents/MacOS/TablePlus" "$out/bin/${finalAttrs.pname}"
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Database management made easy";
+    homepage = "https://tableplus.com";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ yamashitax ];
+    platforms = platforms.darwin;
+  };
+})
--- a/pkgs/applications/networking/avalanchego/default.nix
+++ b/pkgs/applications/networking/avalanchego/default.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "avalanchego";
-  version = "1.11.1";
+  version = "1.11.2";

  src = fetchFromGitHub {
    owner = "ava-labs";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-uRoo2+1R1sPYN41ybrwGK+msYa2AC02w5h6hzeh9ASs=";
+    hash = "sha256-E75lqQkaCub/WpxvVHB5YP1E1ygjUURJ1VWrjvcV96o=";
  };

-  vendorHash = "sha256-x8AgsJuo2q5vRts4axMgL5rTJKQBfuIW341HnUhzvOI=";
+  vendorHash = "sha256-Xrr4QE0FN6sII4xOjPbhwBlNgEwOlogKRNStjrjH7H0=";
  # go mod vendor has a bug, see: https://github.com/golang/go/issues/57529
  proxyVendor = true;

--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@ -25,7 +25,7 @@
 , bzip2, flac, speex, libopus
 , libevent, expat, libjpeg, snappy
 , libcap
-, xdg-utils, minizip, libwebp
+, minizip, libwebp
 , libusb1, re2
 , ffmpeg, libxslt, libxml2
 , nasm
@ -184,9 +184,6 @@ let
      bzip2 flac speex opusWithCustomModes
      libevent expat libjpeg snappy
      libcap
-    ] ++ lib.optionals (!xdg-utils.meta.broken) [
-      xdg-utils
-    ] ++ [
      minizip libwebp
      libusb1 re2
      ffmpeg libxslt libxml2
@ -295,10 +292,6 @@ let
          '/usr/share/locale/' \
          '${glibc}/share/locale/'

-    '' + lib.optionalString (!xdg-utils.meta.broken) ''
-      sed -i -e 's@"\(#!\)\?.*xdg-@"\1${xdg-utils}/bin/xdg-@' \
-        chrome/browser/shell_integration_linux.cc
-
    '' + lib.optionalString systemdSupport ''
      sed -i -e '/lib_loader.*Load/s!"\(libudev\.so\)!"${lib.getLib systemd}/lib/\1!' \
        device/udev_linux/udev?_loader.cc
--- a/pkgs/applications/networking/browsers/gmni/default.nix
+++ b/pkgs/applications/networking/browsers/gmni/default.nix
@ -14,6 +14,14 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ scdoc ];
  buildInputs = [ bearssl ];

+  # Fix build on `gcc-13`:
+  #       inlined from 'xt_end_chain' at src/tofu.c:82:3,
+  #   ...-glibc-2.38-27-dev/include/bits/stdio2.h:54:10: error: '__builtin___snprintf_chk' specified bound 4 exceeds destination size 3 [-Werror=stringop-overflow]
+  #
+  # The overflow will not happen in practice, but `snprintf()` gets
+  # passed one more byte than available.
+  hardeningDisable = [ "fortify3" ];
+
  meta = with lib; {
    description = "A Gemini client";
    homepage = "https://git.sr.ht/~sircmpwn/gmni";
--- a/pkgs/applications/networking/cluster/acorn/default.nix
+++ b/pkgs/applications/networking/cluster/acorn/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "acorn";
-  version = "0.10.0";
+  version = "0.10.1";

  src = fetchFromGitHub {
    owner = "acorn-io";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-U4VQ8PsmJxeMYj7TlsQQOEPckECDK+ENBQLjq5VFyJ4=";
+    hash = "sha256-Zw/OqN4d5iukh9oUXjczMvNKYkcGSUoDEwfti7uzZXQ=";
  };

-  vendorHash = "sha256-FZJqE7BWGvXsFsfxnnaKUFLInBzz+bUwURq4KvSMrus=";
+  vendorHash = "sha256-d/1Rqh00THUwcMBWloevfKbScaWhVG5r/32Q4zYUaJg=";

  ldflags = [
    "-s"
--- a/pkgs/applications/networking/cluster/clusterctl/default.nix
+++ b/pkgs/applications/networking/cluster/clusterctl/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "clusterctl";
-  version = "1.6.1";
+  version = "1.6.2";

  src = fetchFromGitHub {
    owner = "kubernetes-sigs";
    repo = "cluster-api";
    rev = "v${version}";
-    hash = "sha256-v87QxDx+DA5pJHmu6jNwLcs4dNEsa5fUoRcVAhMnh24=";
+    hash = "sha256-OTOM83dsf6Fk+CYkACQOmguDTYfZvN9qes3S/cFEq/8=";
  };

-  vendorHash = "sha256-1W+nkhbJRHd4AaOzO01ZUu6wFvFIG0SOCzc4dg0Zopk=";
+  vendorHash = "sha256-SwJx3KPdOugDYLLymPyrPam0uMyRWIDpQn79Sd9fhJ4=";

  subPackages = [ "cmd/clusterctl" ];

--- a/pkgs/applications/networking/cluster/kaniko/default.nix
+++ b/pkgs/applications/networking/cluster/kaniko/default.nix
@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "kaniko";
-  version = "1.20.0";
+  version = "1.21.0";

  src = fetchFromGitHub {
    owner = "GoogleContainerTools";
    repo = "kaniko";
    rev = "v${version}";
-    hash = "sha256-/JSrkxhW2w9K+MGp7+4xMGwWM8dpwRoUam02K+8NsCU=";
+    hash = "sha256-OxsRyewBiZHrZtPyhuR7MQGVqtSpoW+qZRmZQDGPWck=";
  };

  vendorHash = null;
--- a/pkgs/applications/networking/cluster/kubebuilder/default.nix
+++ b/pkgs/applications/networking/cluster/kubebuilder/default.nix
@ -12,16 +12,16 @@

 buildGoModule rec {
  pname = "kubebuilder";
-  version = "3.13.0";
+  version = "3.14.0";

  src = fetchFromGitHub {
    owner = "kubernetes-sigs";
    repo = "kubebuilder";
    rev = "v${version}";
-    hash = "sha256-JXI3hQVChM7czCwan1yswsrUSse/IbMzwXw0tnaBiek=";
+    hash = "sha256-em+I2YICcqljaaNQ+zOAnOZ552elmV6Ywbfla8buwaY=";
  };

-  vendorHash = "sha256-yiRxSJIIYJbkV3QAFclrDDnsBoX1t4cSRvGmwVgz/w8=";
+  vendorHash = "sha256-iBwhpVs9u5AQAvmzb69SaewdYHmmaV19Bstd0Tux9CA=";

  subPackages = ["cmd"];

--- a/pkgs/applications/networking/cluster/kubectl-gadget/default.nix
+++ b/pkgs/applications/networking/cluster/kubectl-gadget/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kubectl-gadget";
-  version = "0.24.0";
+  version = "0.25.1";

  src = fetchFromGitHub {
    owner = "inspektor-gadget";
    repo = "inspektor-gadget";
    rev = "v${version}";
-    hash = "sha256-JC6+6PADTfxpVRowh09fXC8EO/qIsUTTba2uYxxxJ/A=";
+    hash = "sha256-RbLc8c2F2Jy9jHwcd1FgqxhC5cl82oOauo/hsZ5zaG0=";
  };

-  vendorHash = "sha256-7pwEQ1O3i4SmVSTTmOX9KPR0ePdDpf2dQgD4e6fDyzQ=";
+  vendorHash = "sha256-/1dDAcICf7+g8hxaIAUsUwR9FNqatMhgAsvXrOuvGyk=";

  CGO_ENABLED = 0;

--- a/pkgs/applications/networking/cluster/kubeone/default.nix
+++ b/pkgs/applications/networking/cluster/kubeone/default.nix
@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "kubeone";
-  version = "1.7.2";
+  version = "1.7.3";

  src = fetchFromGitHub {
    owner = "kubermatic";
    repo = "kubeone";
    rev = "v${version}";
-    hash = "sha256-ajzeiT/4S0zABHxhy31NsgspvcNQU/f+YETLuCQ9ErM=";
+    hash = "sha256-m2RxSKXiKmx1p5g+C8I/l+OtV7wy2KtrFRIK+h9L5lo=";
  };

  vendorHash = "sha256-vUy60CBrdhB9OFMZ4+q05WtrtN4/5ssozYGBV7r4BsM=";
--- a/pkgs/applications/networking/cluster/node-problem-detector/default.nix
+++ b/pkgs/applications/networking/cluster/node-problem-detector/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "node-problem-detector";
-  version = "0.8.14";
+  version = "0.8.15";

  src = fetchFromGitHub {
    owner = "kubernetes";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-kh9rYg6UszBMCWYfVU+tP4ZRoigEm6+Z+7pnZWdbcwU=";
+    sha256 = "sha256-zuI34TBVN+ZOacn/TyTU1gVa4ujEuJfj3nKpcolH5Tg=";
  };

  vendorHash = null;
--- a/pkgs/applications/networking/ssb-patchwork/default.nix
+++ b/pkgs/applications/networking/ssb-patchwork/default.nix
@ -22,7 +22,7 @@ let
  desktopItem = makeDesktopItem {
    name = "ssb-patchwork";
    exec = "${binary}/bin/ssb-patchwork";
-    icon = "ssb-patchwork.png";
+    icon = "ssb-patchwork";
    comment = "Client for the decentralized social network Secure Scuttlebutt";
    desktopName = "Patchwork";
    genericName = "Patchwork";
--- a/pkgs/applications/networking/sync/storj-uplink/default.nix
+++ b/pkgs/applications/networking/sync/storj-uplink/default.nix
@ -5,18 +5,18 @@

 buildGoModule rec {
  pname = "storj-uplink";
-  version = "1.98.2";
+  version = "1.99.1";

  src = fetchFromGitHub {
    owner = "storj";
    repo = "storj";
    rev = "v${version}";
-    hash = "sha256-XnTrQIDUHdW9HwnYRigGFMGmcSCBhdoTXT4xlMCMeCw=";
+    hash = "sha256-UzuKy3pwl+chwYUWtcUEJIrU8wpSg3o2mVryc3qA9EM=";
  };

  subPackages = [ "cmd/uplink" ];

-  vendorHash = "sha256-n7exLjiDyvnoKAKnJXo1Ag+jh1Ccb2eA3Yv5fg7gkDk=";
+  vendorHash = "sha256-RaZ+yEkzsu/V3734joWtVA2m2vCOW+CnjF5s0mwDI/0=";

  ldflags = [ "-s" "-w" ];

--- a/pkgs/applications/office/qownnotes/default.nix
+++ b/pkgs/applications/office/qownnotes/default.nix
@ -19,14 +19,14 @@
 let
  pname = "qownnotes";
  appname = "QOwnNotes";
-  version = "24.2.5";
+  version = "24.2.6";
 in
 stdenv.mkDerivation {
  inherit pname version;

  src = fetchurl {
    url = "https://github.com/pbek/QOwnNotes/releases/download/v${version}/qownnotes-${version}.tar.xz";
-    hash = "sha256-xLrt9ng2Le3eEPHyXuoqTUwSH5h6J+93bKFxIAaEduA=";
+    hash = "sha256-F0AUY82zPDRpV/mBb6kpAdMIImJ2ICwwfIluxh8Z7As=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/math/wxmaxima/default.nix
+++ b/pkgs/applications/science/math/wxmaxima/default.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation (finalAttrs:{
  pname = "wxmaxima";
-  version = "24.02.1";
+  version = "24.02.2";

  src = fetchFromGitHub {
    owner = "wxMaxima-developers";
    repo = "wxmaxima";
    rev = "Version-${finalAttrs.version}";
-    hash = "sha256-ORrIZlLqZsxMpqtw5Z7GMI9dDod50hj94ro6urjBD/A=";
+    hash = "sha256-ewyg+ZhbRbPjJkYTZFuhbOWMDNZGW7ejmSv38zxcTsw=";
  };

  buildInputs = [
--- a/pkgs/applications/science/misc/graphia/default.nix
+++ b/pkgs/applications/science/misc/graphia/default.nix
@ -1,47 +1,47 @@
 { stdenv
 , lib
 , cmake
+, git
 , fetchFromGitHub
 , fetchpatch
 , wrapQtAppsHook
 , qtbase
-, qtquickcontrols2
-, qtgraphicaleffects
+, qtdeclarative
+, qtsvg
+, qtwebengine
 }:

 stdenv.mkDerivation rec {
  pname = "graphia";
-  version = "3.2";
+  version = "4.2";

  src = fetchFromGitHub {
    owner = "graphia-app";
    repo = "graphia";
    rev = version;
-    sha256 = "sha256-9kohXLXF4F/qoHm8qmvPM1y9ak0Thb4xvgKJlVuOPTg=";
+    sha256 = "sha256-8+tlQbTr6BGx+/gjviuNrQQWcxC/j6dJ+PxwB4fYmqQ=";
  };

  patches = [
-    # Fix for a breakpad incompatibility with glibc>2.33
-    # https://github.com/pytorch/pytorch/issues/70297
-    # https://github.com/google/breakpad/commit/605c51ed96ad44b34c457bbca320e74e194c317e
-    ./breakpad-sigstksz.patch
-
-    # FIXME: backport patch fixing build with Qt 5.15, remove for next release
+    # Fix gcc-13 build:
    (fetchpatch {
-      url = "https://github.com/graphia-app/graphia/commit/4b51bb8d465afa7ed0b2b30cb1c5e1c6af95976f.patch";
-      hash = "sha256-GDJAFLxQlRWKvcOgqqPYV/aVTRM7+KDjW7Zp9l7SuyM=";
+      name = "gcc-13.patch";
+      url = "https://github.com/graphia-app/graphia/commit/78fb55a4d73f96e9a182de433c7da60330bd5b5e.patch";
+      hash = "sha256-waI2ur3gOKMQvqB2Qnyz7oMOMConl3jLMVKKmOmTpJs=";
    })
  ];

  nativeBuildInputs = [
    cmake
+    git # needs to define some hash as a version
    wrapQtAppsHook
  ];

  buildInputs = [
    qtbase
-    qtquickcontrols2
-    qtgraphicaleffects
+    qtdeclarative
+    qtsvg
+    qtwebengine
  ];

  meta = with lib; {
@ -50,6 +50,7 @@ stdenv.mkDerivation rec {
    description = "A visualisation tool for the creation and analysis of graphs.";
    homepage = "https://graphia.app";
    license = licenses.gpl3Only;
+    mainProgram = "Graphia";
    maintainers = [ maintainers.bgamari ];
    platforms = platforms.all;
  };
--- a/pkgs/applications/version-management/git-lfs/default.nix
+++ b/pkgs/applications/version-management/git-lfs/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "git-lfs";
-  version = "3.4.1";
+  version = "3.5.0";

  src = fetchFromGitHub {
    owner = "git-lfs";
    repo = "git-lfs";
    rev = "v${version}";
-    hash = "sha256-XqxkNCC2yzUTVOi/1iDsnxtLkw4jfQuBh9UsjtZ1zVc=";
+    hash = "sha256-iBv9kUaoyH9yEoCZYGYm+gmdjb797hWftzwkRNDNu3k=";
  };

-  vendorHash = "sha256-VmPeQYWOHFqFLHKcKH3WHz50yx7GMHVIDPzqiVwwjSg=";
+  vendorHash = "sha256-N8HB2qwBxjzfNucftHxmX2W9srCx62pjmkCWzwiCj/I=";

  nativeBuildInputs = [ asciidoctor installShellFiles ];

--- a/pkgs/applications/virtualization/OVMF/default.nix
+++ b/pkgs/applications/virtualization/OVMF/default.nix
@ -74,7 +74,6 @@ let
 in

 assert platformSpecific ? ${cpuName};
-assert systemManagementModeRequired -> stdenv.hostPlatform.isx86;
 assert msVarsTemplate -> fdSize4MB;
 assert msVarsTemplate -> platformSpecific.${cpuName} ? msVarsArgs;

--- a/pkgs/applications/virtualization/virtualbox/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/default.nix
@ -1,4 +1,4 @@
-{ config, stdenv, fetchurl, lib, acpica-tools, dev86, pam, libxslt, libxml2, wrapQtAppsHook
+{ config, stdenv, fetchurl, fetchpatch, lib, acpica-tools, dev86, pam, libxslt, libxml2, wrapQtAppsHook
 , libX11, xorgproto, libXext, libXcursor, libXmu, libIDL, SDL2, libcap, libGL, libGLU
 , libpng, glib, lvm2, libXrandr, libXinerama, libopus, libtpms, qtbase, qtx11extras
 , qttools, qtsvg, qtwayland, pkg-config, which, docbook_xsl, docbook_xml_dtd_43
@ -85,7 +85,13 @@ in stdenv.mkDerivation {
  patches =
     optional enableHardening ./hardened.patch
     # Since VirtualBox 7.0.8, VBoxSDL requires SDL2, but the build framework uses SDL1
-  ++ optional (!headless) ./fix-sdl.patch
+  ++ optionals (!headless) [ ./fix-sdl.patch
+     # No update patch disables check for update function
+     # https://bugs.launchpad.net/ubuntu/+source/virtualbox-ose/+bug/272212
+     (fetchpatch {
+       url = "https://salsa.debian.org/pkg-virtualbox-team/virtualbox/-/raw/debian/${version}-dfsg-1/debian/patches/16-no-update.patch";
+       hash = "sha256-UJHpuB6QB/BbxJorlqZXUF12lgq8gbLMRHRMsbyqRpY=";
+     })]
  ++ [ ./extra_symbols.patch ]
     # When hardening is enabled, we cannot use wrapQtApp to ensure that VirtualBoxVM sees
     # the correct environment variables needed for Qt to work, specifically QT_PLUGIN_PATH.
--- a/pkgs/applications/window-managers/dk/default.nix
+++ b/pkgs/applications/window-managers/dk/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "dk";
-  version = "1.9";
+  version = "2.0";

  src = fetchFromBitbucket {
    owner = "natemaia";
    repo = "dk";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-OodD2z9C4oGTK6ynAXRlEZSzzdzIkVjmq5vLdUcht1U=";
+    hash = "sha256-AzvpvcH0S8WJNzYXMwvF6CIRDXnh/c6B8g2iWDQI6Qw=";
  };

  buildInputs = [
--- a/pkgs/build-support/testers/default.nix
+++ b/pkgs/build-support/testers/default.nix
@ -1,4 +1,4 @@
-{ pkgs, buildPackages, lib, callPackage, runCommand, stdenv, substituteAll, testers }:
+{ pkgs, pkgsLinux, buildPackages, lib, callPackage, runCommand, stdenv, substituteAll, testers }:
 # Documentation is in doc/builders/testers.chapter.md
 {
  # See https://nixos.org/manual/nixpkgs/unstable/#tester-testBuildFailure
@ -107,7 +107,7 @@
            (lib.setDefaultModuleLocation "the argument that was passed to pkgs.runNixOSTest" testModule)
          ];
          hostPkgs = pkgs;
-          node.pkgs = pkgs;
+          node.pkgs = pkgsLinux;
        };

  # See doc/builders/testers.chapter.md or
@ -123,7 +123,7 @@
          inherit pkgs;
          extraConfigurations = [(
            { lib, ... }: {
-              config.nixpkgs.pkgs = lib.mkDefault pkgs;
+              config.nixpkgs.pkgs = lib.mkDefault pkgsLinux;
            }
          )];
        });
--- a/pkgs/build-support/testers/test/default.nix
+++ b/pkgs/build-support/testers/test/default.nix
@ -27,11 +27,11 @@ lib.recurseIntoAttrs {

  # Check that the wiring of nixosTest is correct.
  # Correct operation of the NixOS test driver should be asserted elsewhere.
-  nixosTest-example = pkgs-with-overlay.testers.nixosTest ({ lib, pkgs, figlet, ... }: {
+  nixosTest-example = pkgs-with-overlay.testers.nixosTest ({ lib, ... }: {
    name = "nixosTest-test";
    nodes.machine = { pkgs, ... }: {
      system.nixos = dummyVersioning;
-      environment.systemPackages = [ pkgs.proof-of-overlay-hello figlet ];
+      environment.systemPackages = [ pkgs.proof-of-overlay-hello pkgs.figlet ];
    };
    testScript = ''
      machine.succeed("hello | figlet >/dev/console")
--- a/pkgs/by-name/bn/bngblaster/package.nix
+++ b/pkgs/by-name/bn/bngblaster/package.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bngblaster";
-  version = "0.8.35";
+  version = "0.8.39";

  src = fetchFromGitHub {
    owner = "rtbrick";
    repo = "bngblaster";
    rev = finalAttrs.version;
-    hash = "sha256-zljpApecUKtdU1HqLmeREeL+rmDUMhBWnycgmENlt1o=";
+    hash = "sha256-w8E/GcwLCH6OYwabRWH+CNQ2p7scMK8ogReRxNFqI4k=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/bp/bpftop/package.nix
+++ b/pkgs/by-name/bp/bpftop/package.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "bpftop";
-  version = "0.2.2";
+  version = "0.2.3";

  src = fetchFromGitHub {
    owner = "Netflix";
    repo = "bpftop";
    rev = "v${version}";
-    hash = "sha256-1Wgfe+M1s3hxcN9g1KiBeZycdgpMiHy5FWlE0jlNq/U=";
+    hash = "sha256-mtif1VRlDL1LsJQ3NQmBEaHTxrt2qMbZAFCEhtm/CtI=";
  };

-  cargoHash = "sha256-CrAH3B3dCg3GsxvRrVp/jx3YSpmEg4/jyNuXUO/zeq0=";
+  cargoHash = "sha256-N3pmet7OkIaI3EnzHfqe5P24RHabNUArEB1cKUYM5rA=";

  buildInputs = [
    elfutils
--- a/pkgs/by-name/br/bruteforce-wallet/package.nix
+++ b/pkgs/by-name/br/bruteforce-wallet/package.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "bruteforce-wallet";
-  version = "1.5.3";
+  version = "1.5.4";

  src = fetchFromGitHub {
    owner = "glv2";
    repo = "bruteforce-wallet";
    rev = version;
-    hash = "sha256-1sMoVlQK3ceFOHyGeXKXUD35HmMxVX8w7qefZrzAj5k=";
+    hash = "sha256-ngzG39c/bWv++PHVgce9r1PXElFhpgYoAepbqD/1Dq0=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/c-/c-graph/package.nix
+++ b/pkgs/by-name/c-/c-graph/package.nix
@ -0,0 +1,26 @@
+{ lib, stdenv, fetchurl, gfortran, gnuplot, makeWrapper }:
+
+stdenv.mkDerivation rec {
+  pname = "c-graph";
+  version = "2.0.1";
+
+  src = fetchurl {
+    url = "mirror://gnu/c-graph/c-graph-${version}.tar.gz";
+    hash = "sha256-LSZ948nXXY3pXltR2hHnql6YEpHumjTvbtz4/qUIRCQ=";
+  };
+
+  nativeBuildInputs = [ gfortran makeWrapper ];
+
+  postInstall = ''
+    wrapProgram $out/bin/c-graph --prefix PATH : ${lib.makeBinPath [ gnuplot ]}
+  '';
+
+  meta = with lib; {
+    description = "A Tool for Learning about Convolution";
+    homepage = "https://www.gnu.org/software/c-graph/";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ sikmir ];
+    platforms = platforms.unix;
+    mainProgram = "c-graph";
+  };
+}
--- a/pkgs/development/tools/rust/cargo-bloat/default.nix
+++ b/pkgs/development/tools/rust/cargo-bloat/default.nix
@ -8,10 +8,10 @@ rustPlatform.buildRustPackage rec {
    owner = "RazrFalcon";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-lCA7C1G2xu65jn3/wzj6prWSrjQz3EqqJyMlPR/HRFs=";
+    hash = "sha256-lCA7C1G2xu65jn3/wzj6prWSrjQz3EqqJyMlPR/HRFs=";
  };

-  cargoSha256 = "sha256-fOenXn5gagFss9DRDXXsGxQlDqVXZ5LZcdM4WsXAyUU=";
+  cargoHash = "sha256-fOenXn5gagFss9DRDXXsGxQlDqVXZ5LZcdM4WsXAyUU=";

  meta = with lib; {
    description = "A tool and Cargo subcommand that helps you find out what takes most of the space in your executable";
@ -19,6 +19,6 @@ rustPlatform.buildRustPackage rec {
    license = licenses.mit;
    platforms = platforms.unix;
    maintainers = with maintainers; [ xrelkd matthiasbeyer ];
+    mainProgram = "cargo-bloat";
  };
 }
-
--- a/pkgs/by-name/ch/chromatic/package.nix
+++ b/pkgs/by-name/ch/chromatic/package.nix
@ -0,0 +1,69 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, meson
+, ninja
+, pkg-config
+, rustc
+, cargo
+, wrapGAppsHook4
+, desktop-file-utils
+, libxml2
+, libadwaita
+, portaudio
+, libpulseaudio
+}:
+
+stdenv.mkDerivation rec {
+  pname = "chromatic";
+  version = "0-unstable-2023-08-05";
+
+  src = fetchFromGitHub {
+    owner = "nate-xyz";
+    repo = "chromatic";
+    rev = "ffaeb50dcce74bf3ba1b05f98423cf48f205f55e";
+    hash = "sha256-E3v3UoQumBBYDOiXMfCRh5J7bfUCkettHth7SAresCE=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-M3UMeGkLf57/I/9BIkyiMpOvjbKQJrOk+axf05vRoW0=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    rustPlatform.cargoSetupHook
+    rustc
+    cargo
+    wrapGAppsHook4
+    desktop-file-utils
+    libxml2.bin # xmllint
+  ];
+
+  buildInputs = [
+    libadwaita
+    portaudio
+    libpulseaudio
+  ];
+
+  meta = with lib; {
+    description = "Fine-tune your instruments";
+    longDescription = ''
+      Fine-tune your instruments with Chromatic. Chromatic
+      detects the frequency of audio input, converts it to
+      a musical note with the correct semitone and octave,
+      and displays the cents error. Cents are displayed on
+      an analog gauge to make tuning more visually intuitive.
+      Requires PulseAudio or PipeWire.
+    '';
+    homepage = "https://github.com/nate-xyz/chromatic";
+    license = licenses.gpl3Plus;
+    mainProgram = "chromatic";
+    maintainers = with maintainers; [ aleksana ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/by-name/dy/dynamodb-local/package.nix
+++ b/pkgs/by-name/dy/dynamodb-local/package.nix
@ -4,6 +4,13 @@
 , jdk_headless
 , jre_minimal
 , makeBinaryWrapper
+, curl
+, jq
+, yq
+, dynamodb-local
+, testers
+, common-updater-scripts
+, writeShellScript
 }:
 let
  jre = jre_minimal.override {
@ -18,11 +25,11 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "dynamodb-local";
-  version = "2023-12-14";
+  version = "2.2.1";

  src = fetchurl {
-    url = "https://d1ni2b6xgvw0s0.cloudfront.net/v2.x/dynamodb_local_${finalAttrs.version}.tar.gz";
-    hash = "sha256-F9xTcLNAVFVbH7l0FlMuVNoLBrJS/UcHKXTkJh1n40w=";
+    url = "https://d1ni2b6xgvw0s0.cloudfront.net/v2.x/dynamodb_local_2024-01-04.tar.gz";
+    hash = "sha256-CbZ9Z9A70JoHu4G6It+7WycaEtzuwjVJ2YrOK+37zYA=";
  };

  sourceRoot = ".";
@ -41,6 +48,29 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    runHook postInstall
  '';

+  passthru = {
+    tests.version = testers.testVersion {
+      package = dynamodb-local;
+    };
+    updateScript = writeShellScript "update-dynamodb-local" ''
+      set -o errexit
+      export PATH="${lib.makeBinPath [ curl jq yq common-updater-scripts ]}:$PATH"
+
+      NEW_VERSION=$(curl -s https://repo1.maven.org/maven2/com/amazonaws/DynamoDBLocal/maven-metadata.xml | xq -r '.metadata.versioning.latest')
+      NEW_VERSION_DATE=$(curl -s https://repo1.maven.org/maven2/com/amazonaws/DynamoDBLocal/maven-metadata.xml | xq -r '.metadata.versioning.lastUpdated | "\(.[:4])-\(.[4:6])-\(.[6:8])"')
+
+      if [[ "${finalAttrs.version}" = "$NEW_VERSION" ]]; then
+          echo "The new version same as the old version."
+          exit 0
+      fi
+
+      DOWNLOAD_URL="https://d1ni2b6xgvw0s0.cloudfront.net/v2.x/dynamodb_local_$NEW_VERSION_DATE.tar.gz"
+      NIX_HASH=$(nix hash to-sri sha256:$(nix-prefetch-url $DOWNLOAD_URL))
+
+      update-source-version "dynamodb-local" "$NEW_VERSION" "$NIX_HASH" "$DOWNLOAD_URL"
+    '';
+  };
+
  meta = with lib; {
    description = "DynamoDB Local is a small client-side database and server that mimics the DynamoDB service.";
    homepage = "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DynamoDBLocal.html";
--- a/pkgs/tools/misc/flashrom-stable/default.nix
+++ b/pkgs/tools/misc/flashrom-stable/default.nix
@ -11,13 +11,13 @@
 }:

 stdenv.mkDerivation rec {
-  pname = "flashrom-stable";
-  version = "1.1";
+  pname = "flashprog";
+  version = "1.0.1";

  src = fetchgit {
-    url = "https://review.coreboot.org/flashrom-stable";
-    rev = "272aae888ce5abf5e999d750ee4577407db32246";
-    hash = "sha256-DR4PAING69+TMsyycGxt1cu0ba1tTlG36+H/pJ0oP4E=";
+    url = "https://review.sourcearcade.org/flashprog";
+    rev = "2ca11f9a4101ea230081d448ab2b570425b7f0bd";
+    hash = "sha256-pm9g9iOJAKnzzY9couzt8RmqZFbIpKcO++zsUJ9o49U=";
  };

  nativeBuildInputs = [
@ -34,15 +34,16 @@ stdenv.mkDerivation rec {
    pciutils
  ];

-  makeFlags = [ "PREFIX=$(out)" "libinstall" ] ++ lib.optionals stdenv.isDarwin [ "CONFIG_ENABLE_LIBPCI_PROGRAMMERS=no" ]
+  makeFlags = [ "PREFIX=$(out)" "libinstall" ]
+    ++ lib.optionals stdenv.isDarwin [ "CONFIG_ENABLE_LIBPCI_PROGRAMMERS=no" ]
    ++ lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [ "CONFIG_INTERNAL_X86=no" "CONFIG_INTERNAL_DMI=no" "CONFIG_RAYER_SPI=0" ];

  meta = with lib; {
-    homepage = "https://www.flashrom.org";
+    homepage = "https://flashprog.org";
    description = "Utility for reading, writing, erasing and verifying flash ROM chips";
    license = with licenses; [ gpl2 gpl2Plus ];
    maintainers = with maintainers; [ felixsinger ];
    platforms = platforms.all;
-    mainProgram = "flashrom";
+    mainProgram = "flashprog";
  };
 }
--- a/pkgs/by-name/la/labwc/package.nix
+++ b/pkgs/by-name/la/labwc/package.nix
@ -1,7 +1,6 @@
 { lib
-, stdenv
-, fetchFromGitHub
 , cairo
+, fetchFromGitHub
 , gettext
 , glib
 , libdrm
@ -16,6 +15,7 @@
 , pango
 , pkg-config
 , scdoc
+, stdenv
 , wayland
 , wayland-protocols
 , wayland-scanner
@ -26,15 +26,17 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "labwc";
-  version = "0.7.0";
+  version = "0.7.1";

  src = fetchFromGitHub {
    owner = "labwc";
    repo = "labwc";
    rev = finalAttrs.version;
-    hash = "sha256-/z2Wo9zhuEVIpk8jHYwg2JbBqkX7tfDP2KTZ9yzj454=";
+    hash = "sha256-6l+pYEMFQT8P0j40IcujSzlKgXzR5GIyuxkAJi65RiY=";
  };

+  outputs = [ "out" "man" ];
+
  nativeBuildInputs = [
    gettext
    meson
@ -62,8 +64,6 @@ stdenv.mkDerivation (finalAttrs: {
    xwayland
  ];

-  outputs = [ "out" "man" ];
-
  strictDeps = true;

  mesonFlags = [
@ -77,8 +77,9 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    homepage = "https://github.com/labwc/labwc";
    description = "A Wayland stacking compositor, inspired by Openbox";
-    changelog = "https://raw.githubusercontent.com/labwc/labwc/${finalAttrs.version}/NEWS.md";
-    license = lib.licenses.gpl2Plus;
+    changelog = "https://github.com/labwc/labwc/blob/${finalAttrs.src.rev}/NEWS.md";
+    license = with lib.licenses; [ gpl2Plus ];
+    mainProgram = "labwc";
    maintainers = with lib.maintainers; [ AndersonTorres ];
    inherit (wayland.meta) platforms;
  };
--- a/pkgs/by-name/la/lan-mouse/Cargo.lock
+++ b/pkgs/by-name/la/lan-mouse/Cargo.lock
--- a/pkgs/by-name/la/lan-mouse/package.nix
+++ b/pkgs/by-name/la/lan-mouse/package.nix
@ -0,0 +1,57 @@
+{ stdenv
+, rustPlatform
+, fetchFromGitHub
+, lib
+, darwin
+, glib
+, gtk4
+, libadwaita
+, libX11
+, libXtst
+, pkg-config
+, wrapGAppsHook4
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "lan-mouse";
+  version = "0.6.0";
+
+  src = fetchFromGitHub {
+    owner = "feschber";
+    repo = "lan-mouse";
+    rev = "v${version}";
+    hash = "sha256-98n0Y9oL/ll90NKHJC/25wkav9K+eVqrO7PlrJMoGmY=";
+  };
+
+  nativeBuildInputs = [
+    glib # needed in both {b,nativeB}uildInptus
+    pkg-config
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    glib
+    gtk4
+    libadwaita
+    libX11
+    libXtst
+  ]
+  ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.CoreGraphics;
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "reis-0.1.0" = "sha256-sRZqm6QdmgqfkTjEENV8erQd+0RL5z1+qjdmY18W3bA=";
+    };
+  };
+
+  meta = {
+    description = "A software KVM switch for sharing a mouse and keyboard with multiple hosts through the network";
+    homepage = "https://github.com/feschber/lan-mouse";
+    changelog = "https://github.com/feschber/lan-mouse/releases/tag/v${version}";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "lan-mouse";
+    maintainers = with lib.maintainers; [ pedrohlc ];
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+}
--- a/pkgs/by-name/li/live555/package.nix
+++ b/pkgs/by-name/li/live555/package.nix
@ -9,7 +9,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "live555";
-  version = "2024.02.23";
+  version = "2024.02.28";

  src = fetchurl {
    urls = [
@ -18,7 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
      "https://download.videolan.org/contrib/live555/live.${finalAttrs.version}.tar.gz"
      "mirror://sourceforge/slackbuildsdirectlinks/live.${finalAttrs.version}.tar.gz"
    ];
-    hash = "sha256-85JWXfsPAvocX5PiKXw9Xkd4zm2akzxMeETsZ3xm2wg=";
+    hash = "sha256-5WjtkdqoofZIijunfomcEeWj6l4CUK9HRoYAle2jSx8=";
  };

  patches = [
--- a/pkgs/by-name/lu/ludtwig/package.nix
+++ b/pkgs/by-name/lu/ludtwig/package.nix
@ -2,23 +2,24 @@

 rustPlatform.buildRustPackage rec {
  pname = "ludtwig";
-  version = "0.8.0";
+  version = "0.8.2";

  src = fetchFromGitHub {
    owner = "MalteJanz";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-WF3tEf3SuXiH35Ny4RGLzvEW7yMsFcnVTX52e5qvK5g=";
+    hash = "sha256-nNr0iis+wBd+xKJYQL7OWlQnU1DhKztsPHCq3+tX79w=";
  };

  checkType = "debug";

-  cargoHash = "sha256-AbT8Jv6v7EVPX5mIplKaBkGrVonA8YWlMvo46coFMzk=";
+  cargoHash = "sha256-Utho/foZOPz5K3WrOZjAkxvw7+J0RtbW0xvw/Txu/xk=";

  meta = with lib; {
-    description = "Linter / Formatter for Twig template files which respects HTML and your time.";
+    description = "Linter / Formatter for Twig template files which respects HTML and your time";
    homepage = "https://github.com/MalteJanz/ludtwig";
    license = licenses.mit;
-    maintainers = with maintainers; [ shyim ];
+    maintainers = with maintainers; [ shyim maltejanz ];
+    mainProgram = "ludtwig";
  };
 }
--- a/pkgs/development/tools/documentation/mdsh/default.nix
+++ b/pkgs/development/tools/documentation/mdsh/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "mdsh";
-  version = "0.7.0";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "zimbatm";
    repo = "mdsh";
    rev = "v${version}";
-    hash = "sha256-Y8ss/aw01zpgM6Z6fCGshP21kcdSOTVG/VqL8H3tlls=";
+    hash = "sha256-ammLbKEKXDSuZMr4DwPpcRSkKh7BzNC+4ZRCqTNNCQk=";
  };

-  cargoSha256 = "sha256-8o4gN6mqUU+o80IqlAYAD5qpZBSQ/FY5HoNbpwzTm0A=";
+  cargoHash = "sha256-wLHMccxk3ceZyGK27t5Kyal48yj9dQNgmEHjH9hR9Pc=";

  meta = with lib; {
    description = "Markdown shell pre-processor";
--- a/pkgs/by-name/mo/mousam/package.nix
+++ b/pkgs/by-name/mo/mousam/package.nix
@ -0,0 +1,58 @@
+{ lib
+, python3Packages
+, fetchFromGitHub
+, meson
+, ninja
+, pkg-config
+, gobject-introspection
+, wrapGAppsHook4
+, desktop-file-utils
+, libadwaita
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "mousam";
+  version = "1.1.0";
+  # built with meson, not a python format
+  format = "other";
+
+  src = fetchFromGitHub {
+    owner = "amit9838";
+    repo = "mousam";
+    rev = "v${version}";
+    hash = "sha256-4NJLJ9aPCufvqZGzqQEjSxryofcg4mwk0UohlgUYcqk=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    gobject-introspection
+    wrapGAppsHook4
+    desktop-file-utils
+  ];
+
+  buildInputs = [
+    libadwaita
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    pygobject3
+    requests
+  ];
+
+  dontWrapGApps = true;
+
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
+  meta = with lib; {
+    description = "Beautiful and lightweight weather app based on Python and GTK4";
+    homepage = "https://amit9838.github.io/mousam";
+    license = with licenses; [ gpl3Plus ];
+    mainProgram = "mousam";
+    maintainers = with maintainers; [ aleksana ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/by-name/no/nosql-workbench/package.nix
+++ b/pkgs/by-name/no/nosql-workbench/package.nix
@ -39,20 +39,12 @@ if stdenv.isDarwin then stdenv.mkDerivation {

  sourceRoot = ".";

-  nativeBuildInputs = [ _7zz ];
-
-  buildInputs = [ jdk21 ];
-
  # DMG file is using APFS which is unsupported by "undmg".
  # Instead, use "7zz" to extract the contents.
  # "undmg" issue: https://github.com/matthewbauer/undmg/issues/4
-  unpackCmd = ''
-    runHook preUnpack
+  nativeBuildInputs = [ _7zz ];

-    7zz x $curSrc
-
-    runHook postUnpack
-  '';
+  buildInputs = [ jdk21 ];

  installPhase = ''
    runHook preInstall
--- a/pkgs/by-name/so/sopwith/package.nix
+++ b/pkgs/by-name/so/sopwith/package.nix
@ -0,0 +1,41 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, glib
+, SDL2
+, libGL
+, pkg-config
+, autoreconfHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "sopwith";
+  version = "2.3.0";
+
+  src = fetchFromGitHub {
+    owner = "fragglet";
+    repo = "sdl-sopwith";
+    rev = "refs/tags/sdl-sopwith-${version}";
+    hash = "sha256-C0OpFA3q3K5lgoVe0F03/zXlNba/zW7YEIH+2BV/nCI=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+
+  buildInputs = [
+    glib
+    SDL2
+    libGL
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/fragglet/sdl-sopwith";
+    description = "Classic biplane shoot ‘em-up game.";
+    license = licenses.gpl2Plus;
+    mainProgram = "sopwith";
+    maintainers = with maintainers; [ evilbulgarian ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/by-name/su/surrealist/Cargo.lock
+++ b/pkgs/by-name/su/surrealist/Cargo.lock
--- a/pkgs/by-name/su/surrealist/package.nix
+++ b/pkgs/by-name/su/surrealist/package.nix
@ -0,0 +1,186 @@
+{ buildGoModule
+, cacert
+, cairo
+, cargo
+, cargo-tauri
+, esbuild
+, fetchFromGitHub
+, gdk-pixbuf
+, gobject-introspection
+, jq
+, lib
+, libsoup
+, llvmPackages_15
+, makeBinaryWrapper
+, moreutils
+, nodePackages
+, pango
+, pkg-config
+, rustc
+, rustPlatform
+, stdenv
+, stdenvNoCC
+, wasm-bindgen-cli
+, webkitgtk
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "surrealist";
+  version = "1.11.5";
+
+  src = fetchFromGitHub {
+    owner = "StarlaneStudios";
+    repo = "Surrealist";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-9hm45bTvOhDHYYFUs7nTdOkHOsDJUiqDv8F6wQqEdFs=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/src-tauri";
+
+  embed = stdenv.mkDerivation {
+    inherit (finalAttrs) src version;
+    pname = "${finalAttrs.pname}-embed";
+    sourceRoot = "${finalAttrs.src.name}/src-embed";
+    auditable = false;
+    dontInstall = true;
+
+    cargoDeps = rustPlatform.fetchCargoTarball {
+      inherit (finalAttrs) src;
+      sourceRoot = "${finalAttrs.src.name}/src-embed";
+      hash = "sha256-sf1sn3lOKvUu5MXxdMohS1DJ8jP9icZGftJKhrWA/JE=";
+    };
+
+    nativeBuildInputs = [
+      cargo
+      rustc
+      llvmPackages_15.clangNoLibc
+      llvmPackages_15.lld
+      rustPlatform.cargoSetupHook
+      wasm-bindgen-cli
+    ];
+
+    postBuild = ''
+      CC=clang CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_LINKER=lld cargo build \
+        --target wasm32-unknown-unknown \
+        --release
+
+      wasm-bindgen \
+        target/wasm32-unknown-unknown/release/surrealist_embed.wasm \
+        --out-dir $out \
+        --out-name surrealist-embed \
+        --target web
+    '';
+  };
+
+  pnpm-deps = stdenvNoCC.mkDerivation {
+    inherit (finalAttrs) src version;
+    pname = "${finalAttrs.pname}-pnpm-deps";
+    dontFixup = true;
+
+    nativeBuildInputs = [ cacert jq moreutils nodePackages.pnpm ];
+
+    postInstall = ''
+      export HOME=$(mktemp -d)
+      pnpm config set store-dir $out
+      # use --ignore-script and --no-optional to avoid downloading binaries
+      # use --frozen-lockfile to avoid checking git deps
+      pnpm install --frozen-lockfile --no-optional --ignore-script
+
+      # Remove timestamp and sort the json files
+      rm -rf $out/v3/tmp
+      for f in $(find $out -name "*.json"); do
+        sed -i -E -e 's/"checkedAt":[0-9]+,//g' $f
+        jq --sort-keys . $f | sponge $f
+      done
+    '';
+
+    outputHashMode = "recursive";
+    outputHash = "sha256-jT0Bw0xiusOw/5o6EUaEV3/GqkD/l6jkwXmOqc3a/nc=";
+  };
+
+  ui = stdenvNoCC.mkDerivation {
+    inherit (finalAttrs) src version;
+    pname = "${finalAttrs.pname}-ui";
+    dontFixup = true;
+
+    ESBUILD_BINARY_PATH = let version = "0.18.20";
+    in "${lib.getExe (esbuild.override {
+      buildGoModule = args:
+        buildGoModule (args // {
+          inherit version;
+          src = fetchFromGitHub {
+            owner = "evanw";
+            repo = "esbuild";
+            rev = "v${version}";
+            hash = "sha256-mED3h+mY+4H465m02ewFK/BgA1i/PQ+ksUNxBlgpUoI=";
+          };
+          vendorHash = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
+        });
+    })}";
+
+    nativeBuildInputs = [ nodePackages.pnpm ];
+
+    postPatch = ''
+      ln -s ${finalAttrs.embed} src/generated
+    '';
+
+    postBuild = ''
+      export HOME=$(mktemp -d)
+      pnpm config set store-dir ${finalAttrs.pnpm-deps}
+      pnpm install --offline --frozen-lockfile --no-optional --ignore-script
+      pnpm build
+    '';
+
+    postInstall = ''
+      cp -r dist $out
+    '';
+  };
+
+  cargoDeps = rustPlatform.importCargoLock {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "tauri-plugin-localhost-0.1.0" =
+        "sha256-7PJgz6t/jPEwX/2xaOe0SYawfPSZw/F1QtOrc6iPiP0=";
+    };
+  };
+
+  nativeBuildInputs = [
+    cargo
+    cargo-tauri
+    makeBinaryWrapper
+    pkg-config
+    rustc
+    rustPlatform.cargoSetupHook
+  ];
+
+  buildInputs =
+    [ cairo gdk-pixbuf gobject-introspection libsoup pango webkitgtk ];
+
+  postPatch = ''
+    substituteInPlace ./tauri.conf.json \
+      --replace '"distDir": "../dist",' '"distDir": "${finalAttrs.ui}",' \
+      --replace '"beforeBuildCommand": "pnpm build",' '"beforeBuildCommand": "",'
+  '';
+
+  postBuild = ''
+    cargo tauri build --bundles deb
+  '';
+
+  postInstall = ''
+    install -Dm555 target/release/bundle/deb/surrealist_${finalAttrs.version}_*/data/usr/bin/surrealist -t $out/bin
+    cp -r target/release/bundle/deb/surrealist_${finalAttrs.version}_*/data/usr/share $out
+  '';
+
+  postFixup = ''
+    wrapProgram "$out/bin/surrealist" --set WEBKIT_DISABLE_COMPOSITING_MODE 1
+  '';
+
+  meta = with lib; {
+    description = "Powerful graphical SurrealDB query playground and database explorer for Browser and Desktop";
+    homepage = "https://surrealist.starlane.studio";
+    license = licenses.mit;
+    mainProgram = "surrealist";
+    maintainers = with maintainers; [ frankp ];
+    platforms = platforms.linux;
+  };
+})
--- a/pkgs/by-name/vi/virtio-win/package.nix
+++ b/pkgs/by-name/vi/virtio-win/package.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "virtio-win";
-  version = "0.1.240-1";
+  version = "0.1.248-1";

  src = fetchurl {
    url = "https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/archive-virtio/virtio-win-${version}/virtio-win.iso";
-    hash = "sha256-69SCWGaPf3jgJu0nbCip0Z2D4CD/oICtaZENyGu8vMY=";
+    hash = "sha256-1bVznPKX8FONJj4wZ41aCbukcKfGvL2N/3TkQVPxZUk=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/wayland/wlogout/default.nix
+++ b/pkgs/tools/wayland/wlogout/default.nix
@ -1,15 +1,16 @@
 { lib
-, stdenv
 , fetchFromGitHub
-, pkg-config
-, meson
-, ninja
-, scdoc
+, gitUpdater
+, gtk-layer-shell
 , gtk3
 , libxkbcommon
+, meson
+, ninja
+, pkg-config
+, scdoc
+, stdenv
 , wayland
 , wayland-protocols
-, gtk-layer-shell
 # gtk-layer-shell fails to cross-compile due to a hard dependency
 # on gobject-introspection.
 # Disable it when cross-compiling since it's an optional dependency.
@ -17,20 +18,30 @@
 , withGtkLayerShell ? (stdenv.buildPlatform == stdenv.hostPlatform)
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "wlogout";
-  version = "1.2";
+  version = "1.2.1";

  src = fetchFromGitHub {
    owner = "ArtsyMacaw";
    repo = "wlogout";
-    rev = version;
-    hash = "sha256-xeTO8MBUrvcVA7WTRY7OhaVGInijuvXsVYEax8JmMZ0=";
+    rev = finalAttrs.version;
+    hash = "sha256-n8r+E6GXXjyDYBTOMiv5musamaUFSpRTM2qHgb047og=";
  };

-  strictDeps = true;
-  depsBuildBuild = [ pkg-config ];
-  nativeBuildInputs = [ pkg-config meson ninja scdoc ];
+  outputs = [ "out" "man" ];
+
+  depsBuildBuild = [
+    pkg-config
+  ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    scdoc
+  ];
+
  buildInputs = [
    gtk3
    libxkbcommon
@ -40,26 +51,32 @@ stdenv.mkDerivation rec {
    gtk-layer-shell
  ];

-  postPatch = ''
-    substituteInPlace style.css \
-      --replace "/usr/share/wlogout" "$out/share/${pname}"
-
-    substituteInPlace main.c \
-      --replace "/etc/wlogout" "$out/etc/${pname}"
-  '';
+  strictDeps = true;

  mesonFlags = [
    "--datadir=${placeholder "out"}/share"
    "--sysconfdir=${placeholder "out"}/etc"
  ];

-  meta = with lib; {
+  postPatch = ''
+    substituteInPlace style.css \
+      --replace "/usr/share/wlogout" "$out/share/wlogout"
+
+    substituteInPlace main.c \
+      --replace "/etc/wlogout" "$out/etc/wlogout"
+  '';
+
+  passthru = {
+    updateScript = gitUpdater { };
+  };
+
+  meta = {
    homepage = "https://github.com/ArtsyMacaw/wlogout";
    description = "A wayland based logout menu";
-    license = licenses.mit;
-    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = platforms.linux;
+    changelog = "https://github.com/ArtsyMacaw/wlogout/releases/tag/${finalAttrs.src.rev}";
+    license = with lib.licenses; [ mit ];
    mainProgram = "wlogout";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    inherit (wayland.meta) platforms;
  };
-}
-# TODO: shell completions
+})
--- a/pkgs/by-name/xi/xiu/package.nix
+++ b/pkgs/by-name/xi/xiu/package.nix
@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "xiu";
-  version = "0.10.0";
+  version = "0.12.4";

  src = fetchFromGitHub {
    owner = "harlanc";
    repo = "xiu";
    rev = "v${version}";
-    hash = "sha256-wJXVxkW+jbqc2zFOn8RGUVI9G0+oow+eFGtF4Nsj5pA=";
+    hash = "sha256-tXZCWbqwt3v20rvfre/gAUzs8i78FpbNd5qAGNOX5VE=";
  };

-  cargoHash = "sha256-gpPEHe/RDmEapkioXq7TicrFRrJlcRqiilY+munQKws=";
+  cargoHash = "sha256-6nWnw31A27VWJe8JGM+S05sqcZwQRrb1aanamv6ITZ4=";

  nativeBuildInputs = [
    cmake
@ -32,7 +32,7 @@ rustPlatform.buildRustPackage rec {
  ] ++ lib.optionals stdenv.isLinux [
    openssl
  ] ++ lib.optionals stdenv.isDarwin [
-    darwin.apple_sdk.frameworks.Security
+    darwin.apple_sdk.frameworks.SystemConfiguration
  ];

  OPENSSL_NO_VENDOR = 1;
--- a/pkgs/data/misc/dbip-country-lite/default.nix
+++ b/pkgs/data/misc/dbip-country-lite/default.nix
@ -5,11 +5,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "dbip-country-lite";
-  version = "2024-02";
+  version = "2024-03";

  src = fetchurl {
    url = "https://download.db-ip.com/free/dbip-country-lite-${finalAttrs.version}.mmdb.gz";
-    hash = "sha256-YeZaFscmH4yVNwwXCHzxf/BlM1zT0gbdZ6Ysdh4gqN4=";
+    hash = "sha256-pWlNmM7CCiIS1GRRX5GRWNOF5tOwPPTytgc7V2+l3LE=";
  };

  dontUnpack = true;
--- a/pkgs/data/themes/gtk-theme-framework/default.nix
+++ b/pkgs/data/themes/gtk-theme-framework/default.nix
@ -31,6 +31,6 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    homepage = "https://github.com/jaxwilko/gtk-theme-framework";
    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ flexagoon ];
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/data/themes/kwin-decorations/kde-rounded-corners/default.nix
+++ b/pkgs/data/themes/kwin-decorations/kde-rounded-corners/default.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "kde-rounded-corners";
-  version = "0.6.0";
+  version = "0.6.1";

  src = fetchFromGitHub {
    owner = "matinlotfali";
    repo = "KDE-Rounded-Corners";
    rev = "v${version}";
-    hash = "sha256-DE3XTu3CQY9mGuOpehWno/4yFyLjHuh4RxdUh+aTU7M=";
+    hash = "sha256-8QkuIuHC0/fMxh8K3/I8GNhNPX+tw7kUMiU2oK12c0U=";
  };

  postConfigure = ''
@ -33,6 +33,6 @@ stdenv.mkDerivation rec {
    description = "Rounds the corners of your windows";
    homepage = "https://github.com/matinlotfali/KDE-Rounded-Corners";
    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ flexagoon ];
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/data/themes/kwin-decorations/sierra-breeze-enhanced/default.nix
+++ b/pkgs/data/themes/kwin-decorations/sierra-breeze-enhanced/default.nix
@ -32,6 +32,6 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/kupiqu/SierraBreezeEnhanced";
    changelog = "https://github.com/kupiqu/SierraBreezeEnhanced/releases/tag/V${version}";
    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ flexagoon ];
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/desktops/xfce/applications/xfce4-taskmanager/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-taskmanager/default.nix
@ -13,10 +13,10 @@
 mkXfceDerivation {
  category = "apps";
  pname = "xfce4-taskmanager";
-  version = "1.5.6";
+  version = "1.5.7";
  odd-unstable = false;

-  sha256 = "sha256-2NkjaK6xXsrMimriO2/gTOZowt9KTX4MrWJpPXM0w68=";
+  sha256 = "sha256-znadP7rrP/IxH22U1D9p6IHZ1J1JfXoCVk8iKUgrkJw=";

  nativeBuildInputs = [
    exo
--- a/pkgs/desktops/xfce/applications/xfce4-terminal/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-terminal/default.nix
@ -17,10 +17,10 @@
 mkXfceDerivation {
  category = "apps";
  pname = "xfce4-terminal";
-  version = "1.1.2";
+  version = "1.1.3";
  odd-unstable = false;

-  sha256 = "sha256-9RJmHYT9yYhtyzyTcg3nnD2hlCgENyi/3TNOGUto494=";
+  sha256 = "sha256-CUIQf22Lmb6MNPd2wk8LlHFNUhdIoC1gzVV6RDP2PfY=";

  nativeBuildInputs = [
    libxslt
--- a/pkgs/desktops/xfce/core/xfce4-panel/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-panel/default.nix
@ -16,9 +16,9 @@
 mkXfceDerivation {
  category = "xfce";
  pname = "xfce4-panel";
-  version = "4.18.5";
+  version = "4.18.6";

-  sha256 = "sha256-1oh9C2ZlpcUulqhxUEPLhX22R7tko0rMmDixgkgaU9o=";
+  sha256 = "sha256-eQLz/LJIx2WkzcSLytRdJdhtGv0woT48mdqG7eHB0U4=";

  nativeBuildInputs = [
    gobject-introspection
@ -44,7 +44,7 @@ mkXfceDerivation {

  postPatch = ''
    substituteInPlace plugins/clock/clock.c \
-       --replace "/usr/share/zoneinfo" "${tzdata}/share/zoneinfo"
+       --replace-fail "/usr/share/zoneinfo" "${tzdata}/share/zoneinfo"
  '';

  meta = with lib; {
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-clipman-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-clipman-plugin/default.nix
@ -1,5 +1,6 @@
 { lib
 , mkXfceDerivation
+, wayland-scanner
 , glib
 , gtk3
 , libX11
@ -10,13 +11,18 @@
 , xfce4-panel
 , xfconf
 , wayland
+, wlr-protocols
 }:

 mkXfceDerivation {
  category = "panel-plugins";
  pname = "xfce4-clipman-plugin";
-  version = "1.6.5";
-  sha256 = "sha256-aKcIwlNlaJEHgIq0S7+VG/os49+zRqkZXsQVse4B9oE=";
+  version = "1.6.6";
+  sha256 = "sha256-wdEoM4etco+s0+dULkBvWJZ3WBCW3Ph2bdY0E/l5VRc=";
+
+  nativeBuildInputs = [
+    wayland-scanner
+  ];

  buildInputs = [
    glib
@ -29,6 +35,7 @@ mkXfceDerivation {
    xfce4-panel
    xfconf
    wayland
+    wlr-protocols
  ];

  meta = with lib; {
--- a/pkgs/development/compilers/llvm/common/mlir/default.nix
+++ b/pkgs/development/compilers/llvm/common/mlir/default.nix
@ -17,22 +17,28 @@ stdenv.mkDerivation rec {
  src = runCommand "${pname}-src-${version}" {} ''
    mkdir -p "$out"
    cp -r ${monorepoSrc}/cmake "$out"
-    cp -r ${monorepoSrc}/${pname} "$out"
+    cp -r ${monorepoSrc}/mlir "$out"
    cp -r ${monorepoSrc}/third-party "$out/third-party"

    mkdir -p "$out/llvm"
  '';

-  sourceRoot = "${src.name}/${pname}";
+  sourceRoot = "${src.name}/mlir";

  patches = [
    ./gnu-install-dirs.patch
  ];

-  nativeBuildInputs = [ cmake ninja ];
-  buildInputs = [ libllvm libxml2 ];
+  nativeBuildInputs = [
+    cmake
+    ninja
+  ];
+
+  buildInputs = [
+    libllvm
+    libxml2
+  ];

-  ninjaFlags = [ "-v " ];
  cmakeFlags = [
    "-DLLVM_BUILD_TOOLS=ON"
    # Install headers as well
@ -45,11 +51,11 @@ stdenv.mkDerivation rec {
    "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
    "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
    "-DLLVM_ENABLE_DUMP=ON"
-  ]  ++ lib.optionals stdenv.hostPlatform.isStatic [
+  ] ++ lib.optionals stdenv.hostPlatform.isStatic [
    # Disables building of shared libs, -fPIC is still injected by cc-wrapper
    "-DLLVM_ENABLE_PIC=OFF"
    "-DLLVM_BUILD_STATIC=ON"
-    "-DLLVM_LINK_LLVM_DYLIB=off"
+    "-DLLVM_LINK_LLVM_DYLIB=OFF"
  ] ++ lib.optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
    "-DLLVM_TABLEGEN_EXE=${buildLlvmTools.llvm}/bin/llvm-tblgen"
    "-DMLIR_TABLEGEN_EXE=${buildLlvmTools.mlir}/bin/mlir-tblgen"
--- a/pkgs/development/compilers/scryer-prolog/default.nix
+++ b/pkgs/development/compilers/scryer-prolog/default.nix
@ -1,7 +1,6 @@
 { lib
 , rustPlatform
 , fetchFromGitHub
-, fetchpatch
 , pkg-config
 , openssl
 , gmp
@ -12,29 +11,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "scryer-prolog";
-  version = "0.9.3";
+  version = "0.9.4";

  src = fetchFromGitHub {
    owner = "mthom";
    repo = "scryer-prolog";
    rev = "v${version}";
-    hash = "sha256-0J69Zl+ONvR6T+xf2YeShwn3/JWOHyFHLpNFwmEaIOI=";
+    hash = "sha256-0c0MsjrHRitg+5VEHB9/iSuiqcPztF+2inDZa9fQpwU=";
  };

-  patches = [
-    (fetchpatch {
-      name = "cargo-lock-version-bump.patch";
-      url = "https://github.com/mthom/scryer-prolog/commit/d6fe5b5aaddb9886a8a34841a65cb28c317c2913.patch";
-      hash = "sha256-xkGsjVV/FcyZXGkI84FlqcRIuDM7isCCWZ1sbKql7es=";
-    })
-  ];
-
-  cargoLock = {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "modular-bitfield-0.11.2" = "sha256-vcx+xt5owZVWOlKwudAr0EB1zlLLL5pVfWokw034BQI=";
-    };
-  };
+  cargoSha256 = "sha256-q8s6HAJhKnMhsgZk5plR+ar3CpLKNqjrD14roDWLwfo=";

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ openssl gmp libmpc mpfr ];
--- a/pkgs/development/libraries/audio/vamp-plugin-sdk/default.nix
+++ b/pkgs/development/libraries/audio/vamp-plugin-sdk/default.nix
@ -8,10 +8,10 @@ stdenv.mkDerivation rec {
  version = "2.10";

  src = fetchFromGitHub {
-    owner = "c4dm";
+    owner = "vamp-plugins";
    repo = "vamp-plugin-sdk";
    rev = "vamp-plugin-sdk-v${version}";
-    sha256 = "1lhmskcyk7qqfikmasiw7wjry74gc8g5q6a3j1iya84yd7ll0cz6";
+    hash = "sha256-5jNA6WmeIOVjkEMZXB5ijxyfJT88alVndBif6dnUFdI=";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/development/libraries/faudio/default.nix
+++ b/pkgs/development/libraries/faudio/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "faudio";
-  version = "24.02";
+  version = "24.03";

  src = fetchFromGitHub {
    owner = "FNA-XNA";
    repo = "FAudio";
    rev = version;
-    sha256 = "sha256-xEieWgPNSpRJNYh65F2+NLXVZIlKA5ZE+959+s9zQ/I=";
+    sha256 = "sha256-O2hnv74Uj3PJCmca9Ynz+jjeJXBw2zbGEWlqax3WfjA=";
  };

  nativeBuildInputs = [cmake];
--- a/pkgs/development/libraries/science/math/mkl/default.nix
+++ b/pkgs/development/libraries/science/math/mkl/default.nix
@ -68,9 +68,7 @@ in stdenvNoCC.mkDerivation ({

  dontUnpack = stdenvNoCC.isLinux;

-  unpackPhase = if stdenvNoCC.isDarwin then ''
-    7zz x $src
-  '' else null;
+  sourceRoot = if stdenvNoCC.isDarwin then "." else null;

  nativeBuildInputs = [ validatePkgConfig ] ++ (if stdenvNoCC.isDarwin
    then
--- a/pkgs/development/libraries/unixODBCDrivers/default.nix
+++ b/pkgs/development/libraries/unixODBCDrivers/default.nix
@ -43,13 +43,13 @@

  mariadb = stdenv.mkDerivation rec {
    pname = "mariadb-connector-odbc";
-    version = "3.1.14";
+    version = "3.1.20";

    src = fetchFromGitHub {
      owner = "mariadb-corporation";
      repo = "mariadb-connector-odbc";
      rev = version;
-      sha256 = "0wvy6m9qfvjii3kanf2d1rhfaww32kg0d7m57643f79qb05gd6vg";
+      hash = "sha256-l+HlS7/A0shwsEXYKDhi+QCmwHaMTeKrtcvo9yYpYws=";
      # this driver only seems to build correctly when built against the mariadb-connect-c subrepo
      # (see https://github.com/NixOS/nixpkgs/issues/73258)
      fetchSubmodules = true;
@ -64,12 +64,13 @@
    buildInputs = [ unixODBC openssl libiconv zlib ]
      ++ lib.optionals stdenv.isDarwin [ libkrb5 ];

-    preConfigure = ''
+    # TODO: remove preConfigure on staging
+    preConfigure = if !stdenv.isDarwin then ''
      # we don't want to build a .pkg
      substituteInPlace CMakeLists.txt \
        --replace "IF(APPLE)" "IF(0)" \
        --replace "CMAKE_SYSTEM_NAME MATCHES AIX" "APPLE"
-    '';
+    '' else null;

    cmakeFlags = [
      "-DWITH_EXTERNAL_ZLIB=ON"
@ -80,6 +81,10 @@
      "-DWITH_IODBC=OFF"
    ];

+    buildFlags = if stdenv.isDarwin then [ "maodbc" ] else null;
+
+    installTargets = if stdenv.isDarwin then [ "install/fast" ] else null;
+
    # see the top of the file for an explanation
    passthru = {
      fancyName = "MariaDB";
--- a/pkgs/development/php-packages/php-cs-fixer/composer.lock
+++ b/pkgs/development/php-packages/php-cs-fixer/composer.lock
--- a/pkgs/development/php-packages/php-cs-fixer/default.nix
+++ b/pkgs/development/php-packages/php-cs-fixer/default.nix
@ -17,7 +17,7 @@ php.buildComposerProject (finalAttrs: {
  # Missing `composer.lock` from the repository.
  # Issue open at https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/issues/7590
  composerLock = ./composer.lock;
-  vendorHash = "sha256-WhLMU4aCZwNPC+k537nWQfQ0qyI/GGrR4JtgT4chuHg=";
+  vendorHash = "sha256-b0vrjv0dqQTD3nuo6nqpUtF4JkD8mj4OnNKKqp6hcvU=";

  meta = {
    changelog = "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/releases/tag/v${finalAttrs.version}";
--- a/pkgs/development/python-modules/aiounittest/default.nix
+++ b/pkgs/development/python-modules/aiounittest/default.nix
@ -3,7 +3,7 @@
 , fetchFromGitHub
 , pythonAtLeast
 , setuptools
-, nose
+, pynose
 , coverage
 , wrapt
 }:
@ -13,9 +13,6 @@ buildPythonPackage rec {
  version = "1.4.2";
  pyproject = true;

-  # requires the imp module
-  disabled = pythonAtLeast "3.12";
-
  src = fetchFromGitHub {
    owner = "kwarunek";
    repo = pname;
@ -32,12 +29,12 @@ buildPythonPackage rec {
  ];

  nativeCheckInputs = [
-    nose
+    pynose
    coverage
  ];

  checkPhase = ''
-    nosetests
+    nosetests -e test_specific_test
  '';

  pythonImportsCheck = [ "aiounittest" ];
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@ -365,14 +365,14 @@

 buildPythonPackage rec {
  pname = "boto3-stubs";
-  version = "1.34.53";
+  version = "1.34.54";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-/zGbNI+nsNbkD2hTeClyZvk5A4wG0E4JGKpazy5TLCw=";
+    hash = "sha256-x7LouZ9Ils8SJt9H1Lraqo33QmAIyWpCi/ACBWlWaek=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "botocore-stubs";
-  version = "1.34.53";
+  version = "1.34.54";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -17,7 +17,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "botocore_stubs";
    inherit version;
-    hash = "sha256-41fme2SpxtfeEOdmzSxmWJJkJXRG26bl7hwt/Ltjvlw=";
+    hash = "sha256-lY8AhDItyeVJ9zFRtob6UbFYWPsrOlc7n0Nn8HP/9GM=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/databases/default.nix
+++ b/pkgs/development/python-modules/databases/default.nix
@ -8,23 +8,28 @@
 , fetchFromGitHub
 , pytestCheckHook
 , pythonOlder
+, setuptools
 , sqlalchemy
 }:

 buildPythonPackage rec {
  pname = "databases";
-  version = "0.8.0";
-  format = "setuptools";
+  version = "0.9.0";
+  pyproject = true;

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "encode";
-    repo = pname;
+    repo = "databases";
    rev = "refs/tags/${version}";
-    hash = "sha256-e3iMZBPdldZFuS7FyhbGj9SufnH5hBBt8MEUjixXfqA=";
+    hash = "sha256-Zf9QqBgDhWAnHdNvzjXtri5rdT00BOjc4YTNzJALldM=";
  };

+  nativeBuildInputs = [
+    setuptools
+  ];
+
  propagatedBuildInputs = [
    sqlalchemy
  ];
@ -78,7 +83,5 @@ buildPythonPackage rec {
    changelog = "https://github.com/encode/databases/releases/tag/${version}";
    license = licenses.bsd3;
    maintainers = with maintainers; [ ];
-    # https://github.com/encode/databases/issues/530
-    broken = lib.versionAtLeast sqlalchemy.version "2.0.0";
  };
 }
--- a/pkgs/development/python-modules/edk2-pytool-library/default.nix
+++ b/pkgs/development/python-modules/edk2-pytool-library/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "edk2-pytool-library";
-  version = "0.21.3";
+  version = "0.21.4";
  pyproject = true;

  disabled = pythonOlder "3.10";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "tianocore";
    repo = "edk2-pytool-library";
    rev = "refs/tags/v${version}";
-    hash = "sha256-tyDRHw3c5Kn9IXm5K7Qpn1xfmu5c3pb9D1mpeqo6SHg=";
+    hash = "sha256-LzIK4GGVWAp4JXlKE7Mo0cPIH2srnJIlu36bzovNkwE=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "hahomematic";
-  version = "2024.2.4";
+  version = "2024.3.0";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "danielperna84";
    repo = "hahomematic";
    rev = "refs/tags/${version}";
-    hash = "sha256-p1LUF57wH8zWCwPo4pYeOGRBEYCNUv8CnYBGNYzKCgE=";
+    hash = "sha256-zSGzdj51StlLMmFZzprQUn6Ry9ahJPUq/Z9hVlKn8oA=";
  };

  __darwinAllowLocalNetworking = true;
--- a/pkgs/development/python-modules/interegular/default.nix
+++ b/pkgs/development/python-modules/interegular/default.nix
@ -0,0 +1,24 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "interegular";
+  version = "0.3.3";
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-2baXshs0iEcROZug8DdpFLgYmc5nADJIbQ0Eg0SnZgA=";
+  };
+
+  pythonImportsCheck = [
+    "interegular"
+  ];
+
+  meta = with lib; {
+    description = "A library to check a subset of python regexes for intersections";
+    homepage = "https://github.com/MegaIng/interegular";
+    license = licenses.mit;
+    maintainers = with maintainers; [ lach ];
+  };
+}
--- a/Show more
+++ b/Show more