Merge master into staging-next

2024-09-20 04:19:00 +02:00 · 2024-03-05 06:01:12 +00:00 · 2024-03-05 06:01:12 +00:00 · 16bca48d25
parent 8778339575 5cdb38bb16
commit 16bca48d25
60 changed files with 1694 additions and 1008 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -10533,6 +10533,15 @@
    githubId = 70764075;
    name = "kud";
  };
+  kugland = {
+    email = "kugland@gmail.com";
+    github = "kugland";
+    githubId = 1173932;
+    name = "André Kugland";
+    keys = [{
+      fingerprint = "6A62 5E60 E3FF FCAE B3AA  50DC 1DA9 3817 80CD D833";
+    }];
+  };
  kupac = {
    github = "Kupac";
    githubId = 8224569;
--- a/nixos/modules/virtualisation/virtualbox-host.nix
+++ b/nixos/modules/virtualisation/virtualbox-host.nix
@ -6,7 +6,7 @@ let
  cfg = config.virtualisation.virtualbox.host;

  virtualbox = cfg.package.override {
-    inherit (cfg) enableHardening headless enableWebService;
+    inherit (cfg) enableHardening headless enableWebService enableKvm;
    extensionPack = if cfg.enableExtensionPack then pkgs.virtualboxExtpack else null;
  };

@ -81,13 +81,24 @@ in
        Build VirtualBox web service tool (vboxwebsrv) to allow managing VMs via other webpage frontend tools. Useful for headless servers.
      '';
    };
+
+    enableKvm = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Enable KVM support for VirtualBox. This increases compatibility with Linux kernel versions, because the VirtualBox kernel modules
+        are not required.
+
+        This option is incompatible with `enableHardening` and `addNetworkInterface`.
+
+        Note: This is experimental. Please check https://github.com/cyberus-technology/virtualbox-kvm/issues.
+      '';
+    };
  };

  config = mkIf cfg.enable (mkMerge [{
    warnings = mkIf (pkgs.config.virtualbox.enableExtensionPack or false)
      ["'nixpkgs.virtualbox.enableExtensionPack' has no effect, please use 'virtualisation.virtualbox.host.enableExtensionPack'"];
-    boot.kernelModules = [ "vboxdrv" "vboxnetadp" "vboxnetflt" ];
-    boot.extraModulePackages = [ kernelModules ];
    environment.systemPackages = [ virtualbox ];

    security.wrappers = let
@ -114,17 +125,43 @@ in

    services.udev.extraRules =
      ''
-        KERNEL=="vboxdrv",    OWNER="root", GROUP="vboxusers", MODE="0660", TAG+="systemd"
-        KERNEL=="vboxdrvu",   OWNER="root", GROUP="root",      MODE="0666", TAG+="systemd"
-        KERNEL=="vboxnetctl", OWNER="root", GROUP="vboxusers", MODE="0660", TAG+="systemd"
        SUBSYSTEM=="usb_device", ACTION=="add", RUN+="${virtualbox}/libexec/virtualbox/VBoxCreateUSBNode.sh $major $minor $attr{bDeviceClass}"
        SUBSYSTEM=="usb", ACTION=="add", ENV{DEVTYPE}=="usb_device", RUN+="${virtualbox}/libexec/virtualbox/VBoxCreateUSBNode.sh $major $minor $attr{bDeviceClass}"
        SUBSYSTEM=="usb_device", ACTION=="remove", RUN+="${virtualbox}/libexec/virtualbox/VBoxCreateUSBNode.sh --remove $major $minor"
        SUBSYSTEM=="usb", ACTION=="remove", ENV{DEVTYPE}=="usb_device", RUN+="${virtualbox}/libexec/virtualbox/VBoxCreateUSBNode.sh --remove $major $minor"
      '';
+  } (mkIf cfg.enableKvm {
+    assertions = [
+      {
+        assertion = !cfg.addNetworkInterface;
+        message = "VirtualBox KVM only supports standard NAT networking for VMs. Please turn off virtualisation.virtualbox.host.addNetworkInferface.";
+      }
+
+      {
+        assertion = !cfg.enableHardening;
+        message = "VirtualBox KVM is not compatible with hardening: Please turn off virtualisation.virtualbox.host.enableHardening.";
+      }
+    ];
+
+    warnings = [
+      ''
+        KVM support in VirtualBox is experimental. Not all security features are available yet.
+        See: https://github.com/cyberus-technology/virtualbox-kvm/issues/12
+      ''
+    ];
+  }) (mkIf (!cfg.enableKvm) {
+    boot.kernelModules = [ "vboxdrv" "vboxnetadp" "vboxnetflt" ];
+    boot.extraModulePackages = [ kernelModules ];
+
+    services.udev.extraRules =
+      ''
+        KERNEL=="vboxdrv",    OWNER="root", GROUP="vboxusers", MODE="0660", TAG+="systemd"
+        KERNEL=="vboxdrvu",   OWNER="root", GROUP="root",      MODE="0666", TAG+="systemd"
+        KERNEL=="vboxnetctl", OWNER="root", GROUP="vboxusers", MODE="0660", TAG+="systemd"
+     '';

    # Since we lack the right setuid/setcap binaries, set up a host-only network by default.
-  } (mkIf cfg.addNetworkInterface {
+  }) (mkIf cfg.addNetworkInterface {
    systemd.services.vboxnet0 =
      { description = "VirtualBox vboxnet0 Interface";
        requires = [ "dev-vboxnetctl.device" ];
--- a/nixos/tests/akkoma.nix
+++ b/nixos/tests/akkoma.nix
@ -31,16 +31,12 @@ let

    export REQUESTS_CA_BUNDLE="/etc/ssl/certs/ca-certificates.crt"

-    echo '${userPassword}' | ${pkgs.toot}/bin/toot login_cli -i "akkoma.nixos.test" -e "jamy@nixos.test"
-    echo "y" | ${pkgs.toot}/bin/toot post "hello world Jamy here"
-
-    # Retrieving timeline with toot currently broken due to incompatible timestamp format
-    # cf. <https://akkoma.dev/AkkomaGang/akkoma/issues/637> and <https://github.com/ihabunek/toot/issues/399>
-    #echo "y" | ${pkgs.toot}/bin/toot timeline | grep -F -q "hello world Jamy here"
+    ${pkgs.toot}/bin/toot login_cli -i "akkoma.nixos.test" -e "jamy@nixos.test" -p '${userPassword}'
+    ${pkgs.toot}/bin/toot post "hello world Jamy here"
+    ${pkgs.toot}/bin/toot timeline -1 | grep -F -q "hello world Jamy here"

    # Test file upload
-    echo "y" | ${pkgs.toot}/bin/toot upload <(dd if=/dev/zero bs=1024 count=1024 status=none) \
-      | grep -F -q "https://akkoma.nixos.test/media"
+    ${pkgs.toot}/bin/toot upload <(dd if=/dev/zero bs=1024 count=1024 status=none)
  '';

  checkFe = pkgs.writers.writeBashBin "checkFe" ''
--- a/nixos/tests/virtualbox.nix
+++ b/nixos/tests/virtualbox.nix
@ -3,6 +3,7 @@
  pkgs ? import ../.. { inherit system config; },
  debug ? false,
  enableUnfree ? false,
+  enableKvm ? false,
  use64bitGuest ? true
 }:

@ -340,7 +341,7 @@ let
    testExtensionPack.vmFlags = enableExtensionPackVMFlags;
  };

-  mkVBoxTest = useExtensionPack: vms: name: testScript: makeTest {
+  mkVBoxTest = vboxHostConfig: vms: name: testScript: makeTest {
    name = "virtualbox-${name}";

    nodes.machine = { lib, config, ... }: {
@ -349,14 +350,23 @@ let
        vmConfigs = mapAttrsToList mkVMConf vms;
      in [ ./common/user-account.nix ./common/x11.nix ] ++ vmConfigs;
      virtualisation.memorySize = 2048;
-      virtualisation.qemu.options = ["-cpu" "kvm64,svm=on,vmx=on"];
-      virtualisation.virtualbox.host.enable = true;
+
+      virtualisation.qemu.options = let
+        # IvyBridge is reasonably ancient to be compatible with recent
+        # Intel/AMD hosts and sufficient for the KVM flavor.
+        guestCpu = if config.virtualisation.virtualbox.host.enableKvm then "IvyBridge" else "kvm64";
+      in ["-cpu" "${guestCpu},svm=on,vmx=on"];
+
      test-support.displayManager.auto.user = "alice";
      users.users.alice.extraGroups = let
        inherit (config.virtualisation.virtualbox.host) enableHardening;
-      in lib.mkIf enableHardening (lib.singleton "vboxusers");
-      virtualisation.virtualbox.host.enableExtensionPack = useExtensionPack;
-      nixpkgs.config.allowUnfree = useExtensionPack;
+      in lib.mkIf enableHardening [ "vboxusers" ];
+
+      virtualisation.virtualbox.host = {
+        enable = true;
+      } // vboxHostConfig;
+
+      nixpkgs.config.allowUnfree = config.virtualisation.virtualbox.host.enableExtensionPack;
    };

    testScript = ''
@ -390,7 +400,7 @@ let
    };
  };

-  unfreeTests = mapAttrs (mkVBoxTest true vboxVMsWithExtpack) {
+  unfreeTests = mapAttrs (mkVBoxTest { enableExtensionPack = true; } vboxVMsWithExtpack) {
    enable-extension-pack = ''
      create_vm_testExtensionPack()
      vbm("startvm testExtensionPack")
@ -409,7 +419,24 @@ let
    '';
  };

-in mapAttrs (mkVBoxTest false vboxVMs) {
+  kvmTests = mapAttrs (mkVBoxTest {
+    enableKvm = true;
+
+    # Once the KVM version supports these, we can enable them.
+    addNetworkInterface = false;
+    enableHardening = false;
+  } vboxVMs) {
+    kvm-headless = ''
+      create_vm_headless()
+      machine.succeed(ru("VBoxHeadless --startvm headless >&2 & disown %1"))
+      wait_for_startup_headless()
+      wait_for_vm_boot_headless()
+      shutdown_vm_headless()
+      destroy_vm_headless()
+    '';
+  };
+
+in mapAttrs (mkVBoxTest {} vboxVMs) {
  simple-gui = ''
    # Home to select Tools, down to move to the VM, enter to start it.
    def send_vm_startup():
@ -519,4 +546,6 @@ in mapAttrs (mkVBoxTest false vboxVMs) {
    destroy_vm_test1()
    destroy_vm_test2()
  '';
-} // (optionalAttrs enableUnfree unfreeTests)
+}
+// (optionalAttrs enableKvm kvmTests)
+// (optionalAttrs enableUnfree unfreeTests)
--- a/pkgs/applications/audio/faust/faust2.nix
+++ b/pkgs/applications/audio/faust/faust2.nix
@ -63,6 +63,14 @@ let
        ncurses_static
      ];

+      patches = [
+        (fetchpatch {
+          name = "fix-CsigFFun-API-declaration.patch";
+          url = "https://github.com/grame-cncm/faust/commit/10ce960e91a6237c7bff14a338e770757076ce9e.patch";
+          hash = "sha256-WMFLpLGTZpG7ni3lhI5VJHsmJViWZf4pAFuhYmFVRCE=";
+        })
+      ];
+
      passthru = { inherit wrap wrapWithBuildEnv faust2ApplBase; };

      preConfigure = ''
--- a/pkgs/applications/audio/open-music-kontrollers/mephisto.nix
+++ b/pkgs/applications/audio/open-music-kontrollers/mephisto.nix
@ -1,17 +1,50 @@
-{ callPackage, faust, fontconfig, cmake, libvterm-neovim, libevdev, libglvnd, fira-code, ... } @ args:
+{ stdenv
+, lib
+, fetchFromSourcehut
+, pkg-config
+, cmake
+, meson
+, ninja
+, faust
+, fontconfig
+, glew
+, libvterm-neovim
+, lv2
+, lv2lint
+, sord
+, xorg
+}:

-callPackage ./generic.nix (args // rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "mephisto";
-  version = "0.16.0";
+  version = "0.18.2";

-  sha256 = "0vgr3rsvdj4w0xpc5iqpvyqilk42wr9zs8bg26sfv3f2wi4hb6gx";
+  src = fetchFromSourcehut {
+    domain = "open-music-kontrollers.ch";
+    owner = "~hp";
+    repo = "mephisto.lv2";
+    rev = finalAttrs.version;
+    hash = "sha256-ab6OGt1XVgynKNdszzdXwJ/jVKJSzgSmAv6j1U3/va0=";
+  };

-  additionalBuildInputs = [ faust fontconfig cmake libvterm-neovim libevdev libglvnd fira-code ];
+  nativeBuildInputs = [ pkg-config meson ninja fontconfig cmake ];

-  # see: https://github.com/OpenMusicKontrollers/mephisto.lv2/issues/6
-  postPatch = ''
-    sed -i 's/llvm-c-dsp/llvm-dsp-c/g' mephisto.c
-  '';
+  buildInputs = [
+    faust
+    libvterm-neovim
+    lv2
+    sord
+    xorg.libX11
+    xorg.libXext
+    glew
+    lv2lint
+  ];

-  description = "A Just-in-time FAUST embedded in an LV2 plugin";
+  meta = with lib; {
+    description = "A Just-in-time FAUST embedded in an LV2 plugin";
+    homepage = "https://git.open-music-kontrollers.ch/~hp/mephisto.lv2";
+    license = licenses.artistic2;
+    maintainers = [ maintainers.magnetophon ];
+    platforms = platforms.linux;
+  };
 })
--- a/pkgs/applications/backup/pika-backup/borg-path.patch
+++ b/pkgs/applications/backup/pika-backup/borg-path.patch
@ -1,22 +1,13 @@
 diff --git a/src/borg/process.rs b/src/borg/process.rs
-index 63ea0ee..e3535e0 100644
+index 9af8da7..85bcbf8 100644
 --- a/src/borg/process.rs
 +++ b/src/borg/process.rs
-@@ -203,7 +203,7 @@ impl BorgCall {
+@@ -278,7 +278,7 @@ impl BorgCall {
     }
 
-     pub fn cmd(&self) -> Result<process::Command> {
-        let mut cmd = process::Command::new("borg");
-+        let mut cmd = process::Command::new("@borg@");
- 
-         cmd.envs([self.set_password()?]);
- 
-@@ -221,7 +221,7 @@ impl BorgCall {
-     }
- 
-     pub fn cmd_async(&self) -> Result<async_process::Command> {
+     pub(super) fn command(&self) -> Result<(async_process::Command, UnixStream)> {
 -        let mut cmd = async_process::Command::new("borg");
 +        let mut cmd = async_process::Command::new("@borg@");
 
-         cmd.envs([self.set_password()?]);
+         let unix_stream = self.stream_password(&mut cmd)?;
 
--- a/pkgs/applications/backup/pika-backup/default.nix
+++ b/pkgs/applications/backup/pika-backup/default.nix
@ -21,26 +21,26 @@

 stdenv.mkDerivation rec {
  pname = "pika-backup";
-  version = "0.6.2";
+  version = "0.7.0";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "World";
    repo = "pika-backup";
    rev = "v${version}";
-    hash = "sha256-RTeRlfRmA/fXBcdzP41mbs88ArKlbU49AA0lnW3xRlg=";
+    hash = "sha256-WeFc/4TEIxw6uzLroJX1D/rEA419sghkjBt1nsPv2Ho=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-2B0N/Yq9A4LqKh8EKWmzNzTelwGE3Y9FL9IAqAgFSV8=";
+    hash = "sha256-fgPgUZxye9YUyX9/+hTye3cUypgRAegZMUTKfPxVH4s=";
  };

  patches = [
    (substituteAll {
      src = ./borg-path.patch;
-      borg = "${borgbackup}/bin/borg";
+      borg = lib.getExe borgbackup;
    })
  ];

--- a/pkgs/applications/graphics/pqiv/default.nix
+++ b/pkgs/applications/graphics/pqiv/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation (rec {
  pname = "pqiv";
-  version = "2.12";
+  version = "2.13";

  src = fetchFromGitHub {
    owner = "phillipberndt";
    repo = "pqiv";
    rev = version;
-    sha256 = "18nvrqmlifh4m8nfs0d19sb9d1l3a95xc89qxqdr881jcxdsgflw";
+    sha256 = "sha256-Jlc6sd9lRWUC1/2GZnJ0EmVRHxCXP8dTZNZEhJBS7oQ=";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/applications/misc/cobalt/default.nix
+++ b/pkgs/applications/misc/cobalt/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cobalt";
-  version = "0.19.0";
+  version = "0.19.2";

  src = fetchFromGitHub {
    owner = "cobalt-org";
    repo = "cobalt.rs";
    rev = "v${version}";
-    sha256 = "sha256-cW9Pj4dTBZ0UmHvrWpx0SREBBaEIb2aaX2cdCUdlFLw=";
+    sha256 = "sha256-W0XbNZDSeSK6oxOD1JeLNF+c6/6cy/WQrrmQbSKeqk4=";
  };

-  cargoHash = "sha256-/xkZuGyinQdUGWix/SRtJMJ5nmpXJu39/LxJoTHnT4Q=";
+  cargoHash = "sha256-IM2SKovb8FYwA/c4R3N7M+oVuGfuc5sK+r6FP9YMk+I=";

  buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];

--- a/pkgs/applications/misc/numberstation/default.nix
+++ b/pkgs/applications/misc/numberstation/default.nix
@ -15,7 +15,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "numberstation";
-  version = "1.3.0";
+  version = "1.4.0";

  format = "other";

@ -23,7 +23,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "~martijnbraam";
    repo = "numberstation";
    rev = version;
-    hash = "sha256-l4ev47ofBZeUqjJjdhQOHX+mNL9nIHH0mfYdqZW1LMs=";
+    hash = "sha256-0T/Dc2i6auuZiWjcPR72JT8yOrzmdEmbW2PS5YhmEwI=";
  };

  postPatch = ''
@ -60,6 +60,7 @@ python3.pkgs.buildPythonApplication rec {
  '';

  meta = with lib; {
+    changelog = "https://git.sr.ht/~martijnbraam/numberstation/refs/${version}";
    description = "TOTP Authentication application for mobile";
    homepage = "https://sr.ht/~martijnbraam/numberstation/";
    license = licenses.gpl3Only;
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -87,8 +87,9 @@ let
  enableFeatures = optionals enableVideoAcceleration [ "VaapiVideoDecoder" "VaapiVideoEncoder" ]
    ++ optional enableVulkan "Vulkan";

+  disableFeatures = [ "OutdatedBuildDetector" ] # disable automatic updates
    # The feature disable is needed for VAAPI to work correctly: https://github.com/brave/brave-browser/issues/20935
-  disableFeatures = optional enableVideoAcceleration "UseChromeOSDirectVideoDecoder";
+    ++ optionals enableVideoAcceleration  [ "UseChromeOSDirectVideoDecoder" ];
 in

 stdenv.mkDerivation rec {
--- a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -3,10 +3,10 @@
 {
  firefox = buildMozillaMach rec {
    pname = "firefox";
-    version = "123.0";
+    version = "123.0.1";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "a19567a13e1b663e538c4af17491146adad1f0ab977995e8da9ce9ed428008ad20902dee4efb82d54e1319a0e31768609696bc822563d75732b622760129d8bb";
+      sha512 = "e9af61c1ca800edd16ab7a0d24c9a36bbb34813ed0a11ff62389aa38fa83deba394bca5d95cdaad55ad29ffa3c0e5d3dd15ac1099f7fa3649f4b6c835b7498c2";
    };

    extraPatches = [
--- a/pkgs/applications/networking/cluster/argo/default.nix
+++ b/pkgs/applications/networking/cluster/argo/default.nix
@ -34,16 +34,16 @@ let
 in
 buildGoModule rec {
  pname = "argo";
-  version = "3.5.4";
+  version = "3.5.5";

  src = fetchFromGitHub {
    owner = "argoproj";
    repo = "argo";
    rev = "refs/tags/v${version}";
-    hash = "sha256-23O8YNnMONrlWcTj6gxXQ0xJw0s0pa/ZoY0OKhzEv5o=";
+    hash = "sha256-SONi7GmFgBEA+5l8ftjFP3+hk55eZmhkLLuu5FfyVFo=";
  };

-  vendorHash = "sha256-bUCbrHr7N3IB0tnnQ0TlHjaW7tp4iIGFO28KoJEj2sg=";
+  vendorHash = "sha256-XjwtgJdBk9YIro1WlunYmKkuZSrSJTN/BLXn7i3+9xY=";

  doCheck = false;

--- a/pkgs/applications/networking/cluster/glooctl/default.nix
+++ b/pkgs/applications/networking/cluster/glooctl/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "glooctl";
-  version = "1.16.4";
+  version = "1.16.5";

  src = fetchFromGitHub {
    owner = "solo-io";
    repo = "gloo";
    rev = "v${version}";
-    hash = "sha256-gLm9PEcNg/YeAjT97W9jDOi4ECBrmp2ZAuUTkhZNxyw=";
+    hash = "sha256-pxF5X3fCBeWFLQj8S0xYDcQNRs375RJIrl62nGjZZr0=";
  };

-  vendorHash = "sha256-GTd38gSlCKTjfLkAW/Tz22oQJ4FhZB+9vpN/8q4JSCo=";
+  vendorHash = "sha256-kbbgEnpqev7b4Sycmhs8xbu+yO4oMELh9xDmw7YyWYU=";

  subPackages = [ "projects/gloo/cli/cmd" ];

--- a/pkgs/applications/virtualization/virtualbox/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/default.nix
@ -17,9 +17,13 @@
 , headless ? false
 , enable32bitGuests ? true
 , enableWebService ? false
+, enableKvm ? false
 , extraConfigureFlags ? ""
 }:

+# See https://github.com/cyberus-technology/virtualbox-kvm/issues/12
+assert enableKvm -> !enableHardening;
+
 with lib;

 let
@ -27,6 +31,10 @@ let
  # Use maintainers/scripts/update.nix to update the version and all related hashes or
  # change the hashes in extpack.nix and guest-additions/default.nix as well manually.
  version = "7.0.14";
+
+  # The KVM build is not compatible to VirtualBox's kernel modules. So don't export
+  # modsrc at all.
+  withModsrc = !enableKvm;
 in stdenv.mkDerivation {
  pname = "virtualbox";
  inherit version;
@ -36,7 +44,7 @@ in stdenv.mkDerivation {
    sha256 = "45860d834804a24a163c1bb264a6b1cb802a5bc7ce7e01128072f8d6a4617ca9";
  };

-  outputs = [ "out" "modsrc" ];
+  outputs = [ "out" ] ++ optional withModsrc "modsrc";

  nativeBuildInputs = [ pkg-config which docbook_xsl docbook_xml_dtd_43 yasm glslang ]
    ++ optional (!headless) wrapQtAppsHook;
@ -103,7 +111,17 @@ in stdenv.mkDerivation {
  ++ optional (!headless && enableHardening) (substituteAll {
      src = ./qt-env-vars.patch;
      qtPluginPath = "${qtbase.bin}/${qtbase.qtPluginPrefix}:${qtsvg.bin}/${qtbase.qtPluginPrefix}:${qtwayland.bin}/${qtbase.qtPluginPrefix}";
-    })
+  })
+     # While the KVM patch should not break any other behavior if --with-kvm is not specified,
+     # we don't take any chances and only apply it if people actually want to use KVM support.
+  ++ optional enableKvm (fetchpatch
+    (let
+      patchVersion = "20240226";
+    in {
+      name = "virtualbox-${version}-kvm-dev-${patchVersion}.patch";
+      url = "https://github.com/cyberus-technology/virtualbox-kvm/releases/download/dev-${patchVersion}/virtualbox-${version}-kvm-dev-${patchVersion}.patch";
+      hash = "sha256-3YT1ZN/TwoNWNb2eqOcPF8GTrVGfOPaPb8vpGoPNISY=";
+    }))
  ++ [
    ./qt-dependency-paths.patch
    # https://github.com/NixOS/nixpkgs/issues/123851
@ -165,6 +183,7 @@ in stdenv.mkDerivation {
      ${optionalString (!enable32bitGuests) "--disable-vmmraw"} \
      ${optionalString enableWebService "--enable-webservice"} \
      ${optionalString (open-watcom-bin != null) "--with-ow-dir=${open-watcom-bin}"} \
+      ${optionalString (enableKvm) "--with-kvm"} \
      ${extraConfigureFlags} \
      --disable-kmods
    sed -e 's@PKG_CONFIG_PATH=.*@PKG_CONFIG_PATH=${libIDL}/lib/pkgconfig:${glib.dev}/lib/pkgconfig ${libIDL}/bin/libIDL-config-2@' \
@ -224,7 +243,9 @@ in stdenv.mkDerivation {
      ln -sv $libexec/nls "$out/share/virtualbox"
    ''}

-    cp -rv out/linux.*/${buildType}/bin/src "$modsrc"
+    ${optionalString withModsrc ''
+      cp -rv out/linux.*/${buildType}/bin/src "$modsrc"
+    ''}

    mkdir -p "$out/share/virtualbox"
    cp -rv src/VBox/Main/UnattendedTemplates "$out/share/virtualbox"
--- a/pkgs/by-name/ap/api-linter/package.nix
+++ b/pkgs/by-name/ap/api-linter/package.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "api-linter";
-  version = "1.63.6";
+  version = "1.64.0";

  src = fetchFromGitHub {
    owner = "googleapis";
    repo = "api-linter";
    rev = "v${version}";
-    hash = "sha256-v4giqOTfHVfrEZk/4zf19OFhXJ1n+kqe2Yeioi/VK5w=";
+    hash = "sha256-fkO7wcWivQ1do+KYQJe3OX+WN/jS3cd4pYsZUHojfiU=";
  };

-  vendorHash = "sha256-1p7fcg6ZMHxwrk6+KwGhy3jdXX3FpgufbYIv1BIGNKk=";
+  vendorHash = "sha256-RWB2sq3uNRrxGdBzKI03diaa5fF6LvglUV8L4Nz4fyk=";

  subPackages = [ "cmd/api-linter" ];

--- a/pkgs/by-name/kr/krr/package.nix
+++ b/pkgs/by-name/kr/krr/package.nix
@ -0,0 +1,68 @@
+{ lib
+, python3
+, fetchFromGitHub
+, testers
+, krr
+}:
+
+python3.pkgs.buildPythonPackage rec {
+  pname = "krr";
+  version = "1.7.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "robusta-dev";
+    repo = "krr";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-8K97v/8lsLqr88MSOT3peOy0GZp1so9GaipG/t2uR88=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail 'aiostream = "^0.4.5"' 'aiostream = "*"' \
+      --replace-fail 'kubernetes = "^26.1.0"' 'kubernetes = "*"' \
+      --replace-fail 'pydantic = "1.10.7"' 'pydantic = "*"' \
+      --replace-fail 'typer = { extras = ["all"], version = "^0.7.0" }' 'typer = { extras = ["all"], version = "*" }'
+  '';
+
+  propagatedBuildInputs = with python3.pkgs; [
+    aiostream
+    alive-progress
+    kubernetes
+    numpy
+    poetry-core
+    prometheus-api-client
+    prometrix
+    pydantic_1
+    slack-sdk
+    typer
+  ] ++ typer.optional-dependencies.all;
+
+  nativeCheckInputs = with python3.pkgs; [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "robusta_krr"
+  ];
+
+  passthru.tests.version = testers.testVersion {
+    package = krr;
+    command = "krr version";
+  };
+
+  meta = with lib; {
+    description = "Prometheus-based Kubernetes resource recommendations";
+    longDescription = ''
+      Robusta KRR (Kubernetes Resource Recommender) is a CLI tool for optimizing
+      resource allocation in Kubernetes clusters. It gathers Pod usage data from
+      Prometheus and recommends requests and limits for CPU and memory. This
+      reduces costs and improves performance.
+    '';
+    homepage = "https://github.com/robusta-dev/krr";
+    changelog = "https://github.com/robusta-dev/krr/releases/tag/v${src.rev}";
+    license = licenses.mit;
+    maintainers = with lib.maintainers; [ azahi ];
+    mainProgram = "krr";
+  };
+}
--- a/pkgs/by-name/no/nowplaying-cli/package.nix
+++ b/pkgs/by-name/no/nowplaying-cli/package.nix
@ -0,0 +1,40 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, darwin
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "nowplaying-cli";
+  version = "1.2.1";
+
+  src = fetchFromGitHub {
+    owner = "kirtan-shah";
+    repo = "nowplaying-cli";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-FkyrtgsGzpK2rLNr+oxfPUbX43TVXYeiBg7CN1JUg8Y=";
+  };
+
+  buildInputs = [
+    darwin.apple_sdk.frameworks.Foundation
+    darwin.apple_sdk.frameworks.AppKit
+    darwin.apple_sdk.frameworks.Cocoa
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D nowplaying-cli $out/bin/nowplaying-cli
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "macOS command-line utility for retrieving currently playing media";
+    homepage = "https://github.com/kirtan-shah/nowplaying-cli";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ emilytrau ];
+    platforms = platforms.darwin;
+    mainProgram = "nowplaying-cli";
+  };
+})
--- a/pkgs/by-name/py/pynitrokey/package.nix
+++ b/pkgs/by-name/py/pynitrokey/package.nix
@ -0,0 +1,28 @@
+{ python3
+, fetchPypi
+, rustPlatform
+}:
+
+let
+  python = python3.override {
+    packageOverrides = self: super: {
+      # https://github.com/nxp-mcuxpresso/spsdk/issues/64
+      cryptography = super.cryptography.overridePythonAttrs (old: rec {
+        version = "41.0.7";
+        src = fetchPypi {
+          inherit (old) pname;
+          inherit version;
+          hash = "sha256-E/k86b6oAWwlOzSvxr1qdZk+XEBnLtVAWpyDLw1KALw=";
+        };
+        cargoDeps = rustPlatform.fetchCargoTarball {
+          inherit src;
+          sourceRoot = "${old.pname}-${version}/${old.cargoRoot}";
+          name = "${old.pname}-${version}";
+          hash = "sha256-VeZhKisCPDRvmSjGNwCgJJeVj65BZ0Ge+yvXbZw86Rw=";
+        };
+        patches = [ ];
+        doCheck = false; # would require overriding cryptography-vectors
+      });
+    };
+  };
+in with python.pkgs; toPythonApplication pynitrokey
--- a/pkgs/by-name/py/pyprland/package.nix
+++ b/pkgs/by-name/py/pyprland/package.nix
@ -2,7 +2,7 @@

 python3Packages.buildPythonApplication rec {
  pname = "pyprland";
-  version = "2.0.4";
+  version = "2.0.5";
  format = "pyproject";

  disabled = python3Packages.pythonOlder "3.10";
@ -11,7 +11,7 @@ python3Packages.buildPythonApplication rec {
    owner = "hyprland-community";
    repo = "pyprland";
    rev = "refs/tags/${version}";
-    hash = "sha256-5N1kDD3ZDQMgO2mwggzfonUa/iXW19uBarrtzeWFS3I=";
+    hash = "sha256-VaNJ6hSdcH23Vk7JJpmNV6Qxb7gK5xWK6WHdeyfjUvQ=";
  };

  nativeBuildInputs = with python3Packages; [ poetry-core ];
--- a/pkgs/by-name/so/sopwith/package.nix
+++ b/pkgs/by-name/so/sopwith/package.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "sopwith";
-  version = "2.3.0";
+  version = "2.4.0";

  src = fetchFromGitHub {
    owner = "fragglet";
    repo = "sdl-sopwith";
    rev = "refs/tags/sdl-sopwith-${version}";
-    hash = "sha256-C0OpFA3q3K5lgoVe0F03/zXlNba/zW7YEIH+2BV/nCI=";
+    hash = "sha256-7/xTg41NYxzeGNyt/ClbM/uHMTAE87wn6vc9Ai6P+30=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/su/subtitlecomposer/package.nix
+++ b/pkgs/by-name/su/subtitlecomposer/package.nix
@ -0,0 +1,51 @@
+{ lib
+, fetchFromGitLab
+, cmake
+, extra-cmake-modules
+, ffmpeg
+, openal
+, stdenv
+, libsForQt5
+}:
+
+stdenv.mkDerivation rec {
+  pname = "subtitlecomposer";
+  version = "0.8.0";
+
+  src = fetchFromGitLab {
+    domain = "invent.kde.org";
+    owner = "multimedia";
+    repo = "subtitlecomposer";
+    rev = "v${version}";
+    hash = "sha256-RKS3VTtpxnox0hzessMHmoGPpT+Ho0b3fxtQMGw9OrM=";
+  };
+
+  nativeBuildInputs = [ cmake extra-cmake-modules libsForQt5.wrapQtAppsHook ];
+  buildInputs = [ ffmpeg openal ] ++ (with libsForQt5; [
+    kcodecs
+    kconfig
+    kconfigwidgets
+    kcoreaddons
+    ki18n
+    kio
+    ktextwidgets
+    kwidgetsaddons
+    kxmlgui
+    sonnet
+  ]);
+
+  meta = with lib; {
+    homepage = "https://apps.kde.org/subtitlecomposer";
+    description = "An open source text-based subtitle editor";
+    longDescription = ''
+      An open source text-based subtitle editor that supports basic and
+      advanced editing operations, aiming to become an improved version of
+      Subtitle Workshop for every platform supported by Plasma Frameworks.
+    '';
+    changelog = "https://invent.kde.org/multimedia/subtitlecomposer/-/blob/master/ChangeLog";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ kugland ];
+    mainProgram = "subtitlecomposer";
+    platforms = with platforms; linux ++ freebsd ++ windows;
+  };
+}
--- a/pkgs/by-name/uv/uv/Cargo.lock
+++ b/pkgs/by-name/uv/uv/Cargo.lock
@ -421,15 +421,6 @@ dependencies = [
 "tempfile",
 ]

-[[package]]
-name = "camino"
-version = "1.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c59e92b5a388f549b863a7bea62612c09f24c8393560709a54558a9abdfb3b9c"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "cargo-util"
 version = "0.2.9"
@ -1276,29 +1267,6 @@ dependencies = [
 "scroll",
 ]

-[[package]]
-name = "gourgeist"
-version = "0.0.4"
-dependencies = [
- "anstream",
- "cachedir",
- "camino",
- "clap",
- "directories",
- "fs-err",
- "platform-host",
- "serde",
- "serde_json",
- "tempfile",
- "thiserror",
- "tracing",
- "tracing-subscriber",
- "uv-cache",
- "uv-fs",
- "uv-interpreter",
- "which",
-]
-
 [[package]]
 name = "h2"
 version = "0.3.24"
@ -4133,7 +4101,7 @@ checksum = "f00cc9702ca12d3c81455259621e676d0f7251cec66a21e98fe2e9a37db93b2a"

 [[package]]
 name = "uv"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "anstream",
 "anyhow",
@ -4152,7 +4120,6 @@ dependencies = [
 "flate2",
 "fs-err",
 "futures",
- "gourgeist",
 "indexmap 2.2.3",
 "indicatif",
 "indoc",
@ -4199,6 +4166,7 @@ dependencies = [
 "uv-normalize",
 "uv-resolver",
 "uv-traits",
+ "uv-virtualenv",
 "uv-warnings",
 "which",
 ]
@ -4218,7 +4186,6 @@ dependencies = [
 "anyhow",
 "distribution-types",
 "fs-err",
- "gourgeist",
 "indoc",
 "insta",
 "itertools 0.12.1",
@ -4240,6 +4207,7 @@ dependencies = [
 "uv-fs",
 "uv-interpreter",
 "uv-traits",
+ "uv-virtualenv",
 ]

 [[package]]
@ -4322,7 +4290,6 @@ dependencies = [
 "distribution-types",
 "fs-err",
 "futures",
- "gourgeist",
 "indicatif",
 "install-wheel-rs",
 "itertools 0.12.1",
@ -4358,6 +4325,7 @@ dependencies = [
 "uv-normalize",
 "uv-resolver",
 "uv-traits",
+ "uv-virtualenv",
 "which",
 ]

@ -4369,7 +4337,6 @@ dependencies = [
 "distribution-types",
 "fs-err",
 "futures",
- "gourgeist",
 "itertools 0.12.1",
 "pep508_rs",
 "platform-host",
@ -4387,6 +4354,7 @@ dependencies = [
 "uv-interpreter",
 "uv-resolver",
 "uv-traits",
+ "uv-virtualenv",
 ]

 [[package]]
@ -4575,7 +4543,6 @@ dependencies = [
 "either",
 "fs-err",
 "futures",
- "gourgeist",
 "indexmap 2.2.3",
 "insta",
 "install-wheel-rs",
@ -4609,6 +4576,7 @@ dependencies = [
 "uv-interpreter",
 "uv-normalize",
 "uv-traits",
+ "uv-virtualenv",
 "uv-warnings",
 "zip",
 ]
@ -4630,6 +4598,28 @@ dependencies = [
 "uv-normalize",
 ]

+[[package]]
+name = "uv-virtualenv"
+version = "0.0.4"
+dependencies = [
+ "anstream",
+ "cachedir",
+ "clap",
+ "directories",
+ "fs-err",
+ "platform-host",
+ "serde",
+ "serde_json",
+ "tempfile",
+ "thiserror",
+ "tracing",
+ "tracing-subscriber",
+ "uv-cache",
+ "uv-fs",
+ "uv-interpreter",
+ "which",
+]
+
 [[package]]
 name = "uv-warnings"
 version = "0.0.1"
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@ -10,13 +10,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "uv";
-  version = "0.1.13";
+  version = "0.1.14";

  src = fetchFromGitHub {
    owner = "astral-sh";
    repo = "uv";
    rev = version;
-    hash = "sha256-MPDzuk6pE+uKr9ic0Q9gIk1yByZ/FdcVZx6ZheECR8A=";
+    hash = "sha256-2YqmqqkC6tnjuJ+bekf4WHRohxYS0nvJsH6AvLdCVKs=";
  };

  cargoLock = {
--- a/pkgs/development/python-modules/awkward-cpp/default.nix
+++ b/pkgs/development/python-modules/awkward-cpp/default.nix
@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "awkward-cpp";
-  version = "29";
+  version = "30";
  pyproject = true;

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-r0t4kbeLkDFxvONB6I0q3YQFn6Fn8I6KmTAFmZ0bnRs=";
+    hash = "sha256-W+lMpzUdjkIcuUeKm3EBb6dnNiH6Ei1HfQsHu2iqfUw=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/awkward/default.nix
+++ b/pkgs/development/python-modules/awkward/default.nix
@ -24,7 +24,7 @@

 buildPythonPackage rec {
  pname = "awkward";
-  version = "2.6.1";
+  version = "2.6.2";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -33,7 +33,7 @@ buildPythonPackage rec {
    owner = "scikit-hep";
    repo = "awkward";
    rev = "refs/tags/v${version}";
-    hash = "sha256-G9jXAo37mhvXzn7cQ/DEUGauGs+P7JxBntfu7ZPfaHc=";
+    hash = "sha256-5wUTEB0iVffyCi671y4EsTum+7K1GDeAHlhdLpRgKnQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/nbdime/default.nix
+++ b/pkgs/development/python-modules/nbdime/default.nix
@ -1,20 +1,11 @@
 { lib
 , buildPythonPackage
-, fetchPypi
 , pythonOlder
-, hypothesis
-, setuptools-scm
-, six
-, attrs
-, py
-, setuptools
-, pytest-timeout
-, pytest-tornado
-, mock
-, tabulate
+, fetchPypi
+, hatch-jupyter-builder
+, hatchling
+, jupyterlab
 , nbformat
-, jsonschema
-, pytestCheckHook
 , colorama
 , pygments
 , tornado
@ -22,14 +13,16 @@
 , gitpython
 , jupyter-server
 , jupyter-server-mathjax
-, notebook
 , jinja2
+, git
+, pytest-tornado
+, pytestCheckHook
 }:

 buildPythonPackage rec {
  pname = "nbdime";
  version = "4.0.1";
-  format = "setuptools";
+  pyproject = true;

  disabled = pythonOlder "3.6";

@ -39,48 +32,42 @@ buildPythonPackage rec {
  };

  nativeBuildInputs = [
-    setuptools-scm
+    hatch-jupyter-builder
+    hatchling
+    jupyterlab
  ];

  propagatedBuildInputs = [
-    attrs
-    py
-    setuptools
-    six
-    jupyter-server-mathjax
    nbformat
    colorama
    pygments
    tornado
    requests
    gitpython
-    notebook
+    jupyter-server
+    jupyter-server-mathjax
    jinja2
  ];

  nativeCheckInputs = [
-    hypothesis
-    pytest-timeout
+    git
    pytest-tornado
-    jsonschema
-    mock
-    tabulate
    pytestCheckHook
  ];

  disabledTests = [
-    "test_apply_filter_no_repo"
-    "test_diff_api_checkpoint"
-    "test_filter_cmd_invalid_filter"
-    "test_inline_merge_source_add"
-    "test_inline_merge_source_patches"
-    "test_inline_merge_source_replace"
-    "test_inline_merge_cells_insertion"
-    "test_inline_merge_cells_replacement"
-    "test_interrogate_filter_no_repo"
-    "test_merge_input_strategy_inline"
+    "test_git_diffdriver"
+    "test_git_difftool"
+    "test_git_mergedriver"
+    "test_git_mergetool"
  ];

+  preCheck = ''
+    export HOME="$TEMP"
+    git config --global user.email "janedoe@example.com"
+    git config --global user.name "Jane Doe"
+  '';
+
  __darwinAllowLocalNetworking = true;

  pythonImportsCheck = [
@ -89,7 +76,8 @@ buildPythonPackage rec {

  meta = with lib; {
    homepage = "https://github.com/jupyter/nbdime";
-    description = "Tools for diffing and merging of Jupyter notebooks.";
+    changelog = "https://github.com/jupyter/nbdime/blob/${version}/CHANGELOG.md";
+    description = "Tools for diffing and merging of Jupyter notebooks";
    license = licenses.bsd3;
    maintainers = with maintainers; [ tbenst ];
  };
--- a/pkgs/development/python-modules/prometheus-api-client/default.nix
+++ b/pkgs/development/python-modules/prometheus-api-client/default.nix
@ -0,0 +1,62 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, dateparser
+, httmock
+, matplotlib
+, numpy
+, pandas
+, requests
+}:
+
+buildPythonPackage rec {
+  pname = "prometheus-api-client";
+  version = "0.5.5";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "4n4nd";
+    repo = "prometheus-api-client-python";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-tUu0+ZUOFxBCj//lHhNm88rhFbS01j1x508+nqIkCfQ=";
+  };
+
+  propagatedBuildInputs = [
+    dateparser
+    matplotlib
+    numpy
+    pandas
+    requests
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  checkInputs = [
+    httmock
+  ];
+
+  disabledTestPaths = [
+    "tests/test_prometheus_connect.py"
+  ];
+
+  pythonImportsCheck = [
+    "prometheus_api_client"
+  ];
+
+
+  meta = with lib; {
+    description = "A Python wrapper for the Prometheus HTTP API";
+    longDescription = ''
+      The prometheus-api-client library consists of multiple modules which
+      assist in connecting to a Prometheus host, fetching the required metrics
+      and performing various aggregation operations on the time series data.
+    '';
+    homepage = "https://github.com/4n4nd/prometheus-api-client-python";
+    changelog = "https://github.com/4n4nd/prometheus-api-client-python/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ azahi ];
+  };
+}
--- a/pkgs/development/python-modules/prometrix/default.nix
+++ b/pkgs/development/python-modules/prometrix/default.nix
@ -0,0 +1,62 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, boto3
+, botocore
+, dateparser
+, matplotlib
+, numpy
+, pandas
+, poetry-core
+, prometheus-api-client
+, pydantic_1
+, requests
+}:
+
+buildPythonPackage rec {
+  pname = "prometrix";
+  version = "unstable-2024-02-20";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "robusta-dev";
+    repo = "prometrix";
+    rev = "ab2dad2192ed3df91c1a25446a4f54b8f2f6742f";
+    hash = "sha256-/72Qkd2BojYgiQi5rq7dVsEje7M0aQQXhenvIM7lSy4=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail 'pydantic = "^1.8.1"' 'pydantic = "*"'
+  '';
+
+  propagatedBuildInputs = [
+    boto3
+    botocore
+    dateparser
+    matplotlib
+    numpy
+    pandas
+    prometheus-api-client
+    pydantic_1
+    requests
+  ];
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  pythonImportsCheck = [
+    "prometrix"
+  ];
+
+  meta = with lib; {
+    description = "Unified Prometheus client";
+    longDescription = ''
+      This Python package provides a unified Prometheus client that can be used
+      to connect to and query various types of Prometheus instances.
+    '';
+    license = licenses.mit;
+    maintainers = with maintainers; [ azahi ];
+  };
+}
--- a/pkgs/development/python-modules/pyocd-pemicro/default.nix
+++ b/pkgs/development/python-modules/pyocd-pemicro/default.nix
@ -0,0 +1,43 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, setuptools-scm
+, pyocd
+, pypemicro
+}:
+
+buildPythonPackage rec {
+  pname = "pyocd-pemicro";
+  version = "1.1.5";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "pyocd";
+    repo = "pyocd-pemicro";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-qi803s8fkrLizcCLeDRz7CTQ56NGLQ4PPwCbxiRigwc=";
+  };
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    pyocd
+    pypemicro
+  ];
+
+  # upstream has no tests
+  doCheck = false;
+
+  meta = {
+    changelog = "https://github.com/pyocd/pyocd-pemicro/releases/tag/v${version}";
+    description = "PEMicro probe plugin for pyOCD";
+    homepage = "https://github.com/pyocd/pyocd-pemicro";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ dotlambda ];
+  };
+}
--- a/pkgs/development/python-modules/pytest-notebook/default.nix
+++ b/pkgs/development/python-modules/pytest-notebook/default.nix
@ -0,0 +1,82 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, flit-core
+, pythonRelaxDepsHook
+, attrs
+, jsonschema
+, nbclient
+, nbdime
+, nbformat
+, pytest
+, black
+, coverage
+, ipykernel
+, pytest-cov
+, pytest-regressions
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "pytest-notebook";
+  version = "0.10.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "chrisjsewell";
+    repo = "pytest-notebook";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-LoK0wb7rAbVbgyURCbSfckWvJDef3tPY+7V4YU1IBRU=";
+  };
+
+  nativeBuildInputs = [
+    flit-core
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "attrs"
+    "nbclient"
+  ];
+
+  propagatedBuildInputs = [
+    attrs
+    jsonschema
+    nbclient
+    nbdime
+    nbformat
+  ];
+
+  buildInputs = [
+    pytest
+  ];
+
+  pythonImportsCheck = [ "pytest_notebook" ];
+
+  nativeCheckInputs = [
+    black
+    coverage
+    ipykernel
+    pytest-cov
+    pytest-regressions
+    pytestCheckHook
+  ];
+
+  preCheck = ''
+    export HOME="$TEMP"
+  '';
+
+  disabledTests = [
+    "test_diff_to_string"
+    "test_execute_notebook_with_coverage"
+    "test_regression_coverage"
+  ];
+
+  meta = {
+    changelog = "https://github.com/chrisjsewell/pytest-notebook/blob/${src.rev}/docs/source/changelog.md";
+    description = "Pytest plugin for regression testing and regenerating Jupyter Notebooks";
+    homepage = "https://github.com/chrisjsewell/pytest-notebook";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ dotlambda ];
+  };
+}
--- a/pkgs/development/python-modules/python-rapidjson/default.nix
+++ b/pkgs/development/python-modules/python-rapidjson/default.nix
@ -6,7 +6,8 @@
 , rapidjson
 , pytestCheckHook
 , pytz
-, glibcLocales
+, setuptools
+, substituteAll
 }:

 let
@ -25,25 +26,30 @@ let
        hash = "sha256-BjSZEwfCXA/9V+kxQ/2JPWbc26jQn35CfN8+8NW24s4=";
      })
    ];
-    # valgrind_unittest failed
-    cmakeFlags = old.cmakeFlags ++ [ "-DCMAKE_CTEST_ARGUMENTS=-E;valgrind_unittest" ];
  });
 in buildPythonPackage rec {
-  version = "1.14";
+  version = "1.16";
  pname = "python-rapidjson";
  disabled = pythonOlder "3.8";

-  format = "setuptools";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "python-rapidjson";
    repo = "python-rapidjson";
    rev = "refs/tags/v${version}";
-    hash = "sha256-fCC6jYUIB89HlEnbsmL0MeCBOO4NAZtePuPgZKYxoM8=";
+    hash = "sha256-4Z8cNu6tK5/yAu6b9Vb/EdXQj+fQgeT0QIszTEUurVM=";
  };

-  setupPyBuildFlags = [
-    "--rj-include-dir=${lib.getDev rapidjson'}/include"
+  patches = [
+    (substituteAll {
+      src = ./rapidjson-include-dir.patch;
+      rapidjson = lib.getDev rapidjson';
+    })
+  ];
+
+  nativeBuildInputs = [
+    setuptools
  ];

  nativeCheckInputs = [
--- a/pkgs/development/python-modules/python-rapidjson/rapidjson-include-dir.patch
+++ b/pkgs/development/python-modules/python-rapidjson/rapidjson-include-dir.patch
@ -0,0 +1,25 @@
+diff --git a/setup.py b/setup.py
+index e86b1b2..9d34d0d 100644
+--- a/setup.py
+++ b/setup.py
+@@ -29,19 +29,7 @@ if sys.version_info < (3, 6):
+ 
+ ROOT_PATH = os.path.abspath(os.path.dirname(__file__))
+ 
+-rj_include_dir = './rapidjson/include'
+-
+-for idx, arg in enumerate(sys.argv[:]):
+-    if arg.startswith('--rj-include-dir='):
+-        sys.argv.pop(idx)
+-        rj_include_dir = arg.split('=', 1)[1]
+-        break
+-else:
+-    if not os.path.isdir(os.path.join(ROOT_PATH, 'rapidjson', 'include')):
+-        raise RuntimeError("RapidJSON sources not found: if you cloned the git"
+-                           " repository, you should initialize the rapidjson submodule"
+-                           " as explained in the README.rst; in all other cases you may"
+-                           " want to report the issue.")
+rj_include_dir = '@rapidjson@/include'
+ 
+ with open('version.txt', encoding='utf-8') as f:
+     VERSION = f.read()
--- a/pkgs/development/python-modules/scikit-hep-testdata/default.nix
+++ b/pkgs/development/python-modules/scikit-hep-testdata/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "scikit-hep-testdata";
-  version = "0.4.38";
+  version = "0.4.39";
  format = "pyproject";

  disabled = pythonOlder "3.6";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "scikit-hep";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-/+1eENbpng/X1g108cEGiTZlIkdcqqnm9wyN9ECH5D4=";
+    hash = "sha256-tcKEJrqB7cblcmH4PtSmx0heUew2+aDE4+mk2v9cUuo=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/spsdk/default.nix
+++ b/pkgs/development/python-modules/spsdk/default.nix
@ -9,21 +9,19 @@
 , click
 , click-command-tree
 , click-option-group
-, cmsis-pack-manager
-, commentjson
+, colorama
 , crcmod
 , cryptography
 , deepmerge
 , fastjsonschema
 , hexdump
-, importlib-metadata
-, jinja2
 , libusbsio
 , oscrypto
-, pycryptodome
-, pyftdi
+, platformdirs
+, prettytable
 , pylink-square
 , pyocd
+, pyocd-pemicro
 , pypemicro
 , pyserial
 , requests
@ -33,20 +31,22 @@
 , spsdk
 , testers
 , typing-extensions
+, ipykernel
+, pytest-notebook
 , pytestCheckHook
 , voluptuous
 }:

 buildPythonPackage rec {
  pname = "spsdk";
-  version = "2.0.1";
+  version = "2.1.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "nxp-mcuxpresso";
-    repo = pname;
-    rev = version;
-    hash = "sha256-C6cz5jhIHI4WkCYT0rURFa4kBAu6cMcKpQHiHACIiu8=";
+    repo = "spsdk";
+    rev = "refs/tags/${version}";
+    hash = "sha256-ZXNqger5WBk2AjTszJLmemYDPClUPy+kNtBWSPcTDro=";
  };

  nativeBuildInputs = [
@ -55,21 +55,7 @@ buildPythonPackage rec {
  ];

  pythonRelaxDeps = [
-    "bincopy"
-    "bitstring"
-    "cmsis-pack-manager"
-    "deepmerge"
-    "jinja2"
-    "pycryptodome"
-    "pylink-square"
-    "pyocd"
-    "typing-extensions"
    "click"
-    "ruamel.yaml"
-  ];
-
-  pythonRemoveDeps = [
-    "pyocd-pemicro"
  ];

  propagatedBuildInputs = [
@ -80,20 +66,19 @@ buildPythonPackage rec {
    click
    click-command-tree
    click-option-group
-    cmsis-pack-manager
-    commentjson
+    colorama
    crcmod
    cryptography
    deepmerge
    fastjsonschema
    hexdump
-    importlib-metadata
-    jinja2
    libusbsio
    oscrypto
-    pycryptodome
+    platformdirs
+    prettytable
    pylink-square
    pyocd
+    pyocd-pemicro
    pypemicro
    pyserial
    requests
@ -103,16 +88,23 @@ buildPythonPackage rec {
  ];

  nativeCheckInputs = [
-    pyftdi
+    ipykernel
+    pytest-notebook
    pytestCheckHook
    voluptuous
  ];

+  disabledTests = [
+    "test_nxpcrypto_create_signature_algorithm"
+    "test_nxpimage_sb31_kaypair_not_matching"
+  ];
+
  pythonImportsCheck = [ "spsdk" ];

  passthru.tests.version = testers.testVersion { package = spsdk; };

  meta = with lib; {
+    broken = versionAtLeast cryptography.version "41.1";
    changelog = "https://github.com/nxp-mcuxpresso/spsdk/blob/${src.rev}/docs/release_notes.rst";
    description = "NXP Secure Provisioning SDK";
    homepage = "https://github.com/nxp-mcuxpresso/spsdk";
--- a/pkgs/development/tools/algolia-cli/default.nix
+++ b/pkgs/development/tools/algolia-cli/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "algolia-cli";
-  version = "1.5.0";
+  version = "1.6.1";

  src = fetchFromGitHub {
    owner = "algolia";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-iaqr8/jPYEnOhGoiUC5lmd7l+AAOFh3iYVW+mbBV/V8=";
+    hash = "sha256-XcsVU/yV6c6jzuJdZvqs+kAu6XwR8ygVcJ6KEI04x9I=";
  };

  vendorHash = "sha256-cNuBTH7L2K4TgD0H9FZ9CjhE5AGXADaniGLD9Lhrtrk=";
--- a/pkgs/development/tools/database/sqlite-web/default.nix
+++ b/pkgs/development/tools/database/sqlite-web/default.nix
@ -5,11 +5,11 @@

 python3Packages.buildPythonApplication rec {
  pname = "sqlite-web";
-  version = "0.6.2";
+  version = "0.6.3";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-VIbmYN6KjCRpE+kvJyBV75deYmh+zRjcQXZ2/7mseYU=";
+    sha256 = "sha256-cDSlSh0vnwvbJZFDPqvJ5oXz68gN9yzodcQYkXUAytE=";
  };

  propagatedBuildInputs = with python3Packages; [ flask peewee pygments ];
--- a/pkgs/development/tools/ginkgo/default.nix
+++ b/pkgs/development/tools/ginkgo/default.nix
@ -2,15 +2,15 @@

 buildGoModule rec {
  pname = "ginkgo";
-  version = "2.15.0";
+  version = "2.16.0";

  src = fetchFromGitHub {
    owner = "onsi";
    repo = "ginkgo";
    rev = "v${version}";
-    sha256 = "sha256-0Fwn62VORPmaufd7RqTkXjlXygXPVVixf8WwHgE57Lg=";
+    sha256 = "sha256-7pxGDWNVTB7N91yYnGvxo7h2xvYWeBdbceU2F/opRTs=";
  };
-  vendorHash = "sha256-F3z6gowVkei782qaSIOh7Ymeq1SFGxBaHM9fTSPG6qI=";
+  vendorHash = "sha256-XtO7HiaE/xCT3tjVZzzMcO9y8Yk8Wyy1S3S1qioMaQU=";

  # integration tests expect more file changes
  # types tests are missing CodeLocation
--- a/pkgs/development/tools/github/github-release/default.nix
+++ b/pkgs/development/tools/github/github-release/default.nix
@ -1,6 +1,6 @@
-{ buildGoPackage, fetchFromGitHub, lib }:
+{ buildGoModule, fetchFromGitHub, fetchpatch, lib, testers, github-release }:

-buildGoPackage rec {
+buildGoModule rec {
  pname = "github-release";
  version = "0.10.0";

@ -8,10 +8,32 @@ buildGoPackage rec {
    owner = "github-release";
    repo = "github-release";
    rev = "v${version}";
-    sha256 = "sha256-J5Y0Kvon7DstTueCsoYvw6x4cOH/C1IaVArE0bXtZts=";
+    hash = "sha256-J5Y0Kvon7DstTueCsoYvw6x4cOH/C1IaVArE0bXtZts=";
  };

-  goPackagePath = "github.com/github-release/github-release";
+  vendorHash = null;
+
+  patches = [
+    # Update version info
+    (fetchpatch {
+      url = "https://github.com/github-release/github-release/commit/ee13bb17b74135bfe646d9be1807a6bc577ba7c6.patch";
+      hash = "sha256-9ZcHwai0HOgapDcpvn3xssrVP9cuNAz9rTgrR4Jfdfg=";
+    })
+
+    # Add Go Modules support.
+    # See https://github.com/Homebrew/homebrew-core/pull/162414.
+    (fetchpatch {
+      url = "https://github.com/github-release/github-release/pull/129/commits/074f4e8e1688642f50a7a3cc92b5777c7b484139.patch";
+      hash = "sha256-OBFbOvNhqcNiuSCP0AfClntj7y5habn+r2eBkmClsgI=";
+    })
+  ];
+
+  ldflags = [ "-s" "-w" ];
+
+  passthru.tests.version = testers.testVersion {
+    package = github-release;
+    version = "v${version}";
+  };

  meta = with lib; {
    description = "Commandline app to create and edit releases on Github (and upload artifacts)";
--- a/pkgs/development/tools/oh-my-posh/default.nix
+++ b/pkgs/development/tools/oh-my-posh/default.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "oh-my-posh";
-  version = "19.11.6";
+  version = "19.11.7";

  src = fetchFromGitHub {
    owner = "jandedobbeleer";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-wo8ngZ/rWugYESc1/0WjOa8Zs6aEfXv7VJ7fqqbmSCE=";
+    hash = "sha256-CBAIojr+J84spnd0SQHT0xLoLuOPQsZEhWfKZMuj12Q=";
  };

  vendorHash = "sha256-OkcwcQfI1CeKIQaaS/Bd1Hct2yebp0TB98lsGAVRWqk=";
--- a/pkgs/development/tools/pscale/default.nix
+++ b/pkgs/development/tools/pscale/default.nix
@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "pscale";
-  version = "0.183.0";
+  version = "0.185.0";

  src = fetchFromGitHub {
    owner = "planetscale";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "sha256-+zmfMOp+ygVUErggHz+9AkpJ7AjfUBjCRcE4Uqusjz4=";
+    sha256 = "sha256-UzNfNuOt6ZmzxVx/H8aEmQL6b4PPyNkQzxSqhBtoLT8=";
  };

  vendorHash = "sha256-oENe7OGAW/i5LJbqPn7PJDemdxfSsLwmpER28R6zza4=";
--- a/pkgs/development/tools/sentry-cli/default.nix
+++ b/pkgs/development/tools/sentry-cli/default.nix
@ -11,13 +11,13 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "sentry-cli";
-  version = "2.28.6";
+  version = "2.29.1";

  src = fetchFromGitHub {
    owner = "getsentry";
    repo = "sentry-cli";
    rev = version;
-    sha256 = "sha256-cynq7w0xLnLafStcfrG27PNHVoMu4TxFIwwrWjj9ynM=";
+    sha256 = "sha256-hSAd+fGEVpCAyG2HzrF0W09yk6ghxX/lwdPQNuGsZW0=";
  };
  doCheck = false;

@ -27,7 +27,7 @@ rustPlatform.buildRustPackage rec {
  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ CoreServices Security SystemConfiguration ];
  nativeBuildInputs = [ installShellFiles pkg-config ];

-  cargoHash = "sha256-MChhtWbwi5/1GMXxlKov8LrO+kp7D6u4u1lmEjZvyP8=";
+  cargoHash = "sha256-g+rGWS/wZncyq9zPOOI+Zq1WEsQarMK2TkccVohJTUs=";

  postInstall = ''
    installShellCompletion --cmd sentry-cli \
--- a/pkgs/development/tools/vsce/default.nix
+++ b/pkgs/development/tools/vsce/default.nix
@ -12,16 +12,16 @@

 buildNpmPackage rec {
  pname = "vsce";
-  version = "2.23.0";
+  version = "2.24.0";

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = "vscode-vsce";
    rev = "v${version}";
-    hash = "sha256-2s8hG3HNDQnuwFXZX1mCTSbKCm4n7YAzhHDaWVYTyys=";
+    hash = "sha256-MX+tGjz/Nn18ivfjQeOlQtQiyRkB1cGnLl2jlz5Str8=";
  };

-  npmDepsHash = "sha256-1PVUDEecFW+lFmZOZUTlgeKsLwLK9O4vFHi6gOLjBfo=";
+  npmDepsHash = "sha256-Difk9a9TYmfwzP9SawEuaxm7iHVjdfO+FxFCE7aEMzM=";

  postPatch = ''
    substituteInPlace package.json --replace '"version": "0.0.0"' '"version": "${version}"'
--- a/pkgs/servers/akkoma/admin-fe/default.nix
+++ b/pkgs/servers/akkoma/admin-fe/default.nix
@ -7,14 +7,14 @@

 stdenv.mkDerivation rec {
  pname = "admin-fe";
-  version = "unstable-2023-02-11";
+  version = "unstable-2024-02-25";

  src = fetchFromGitea {
    domain = "akkoma.dev";
    owner = "AkkomaGang";
    repo = "admin-fe";
-    rev = "130c17808bc50269f8444612f4ab378a08cd5e43";
-    hash = "sha256-+ZU8J4rOyRMSZP+CUyLeOhRI2fKiw2s31coTYAoReWM=";
+    rev = "2a1e175f7c2b02e66d728f808cb7e9449231a288";
+    hash = "sha256-PLSJ+doZUZ2n4hWUahY299VoCvNq76Tm8qpdvOIHD9c=";
  };

  patches = [ ./deps.patch ];
--- a/pkgs/servers/akkoma/akkoma-fe/default.nix
+++ b/pkgs/servers/akkoma/akkoma-fe/default.nix
@ -7,14 +7,14 @@

 stdenv.mkDerivation rec {
  pname = "akkoma-fe";
-  version = "unstable-2023-08-05";
+  version = "3.11.0";

  src = fetchFromGitea {
    domain = "akkoma.dev";
    owner = "AkkomaGang";
    repo = "akkoma-fe";
-    rev = "e7a558a533dd31de174791f130afdaa5b6893b74";
-    hash = "sha256-BRmfppsC7NjDdcLxQHuLbQZmYGkj4DFPRtQOf/pRCpI=";
+    rev = "7cc6c3565466b330043e0a811a6e1e2db487ec8d";
+    hash = "sha256-Z7psmIyOo8Rvwcip90JgxLhZ5SkkGB94QInEgm8UOjQ=";
  };

  offlineCache = fetchYarnDeps {
--- a/pkgs/servers/akkoma/default.nix
+++ b/pkgs/servers/akkoma/default.nix
@ -9,14 +9,14 @@

 beamPackages.mixRelease rec {
  pname = "pleroma";
-  version = "3.10.4";
+  version = "3.11.0";

  src = fetchFromGitea {
    domain = "akkoma.dev";
    owner = "AkkomaGang";
    repo = "akkoma";
    rev = "v${version}";
-    hash = "sha256-MPUZFcIxZ21fe3edwi+/Kt8qpwNBCh40wheC3QMqw2M=";
+    hash = "sha256-cVZx3pjbmDR4SwSLz1aSTIs3SS2oz5m43RJzRttFpPs=";
  };

  postPatch = ''
@ -36,6 +36,7 @@ beamPackages.mixRelease rec {
    overrides = (final: prev: {
      # mix2nix does not support git dependencies yet,
      # so we need to add them manually
+
      captcha = beamPackages.buildMix rec {
        name = "captcha";
        version = "0.1.0";
@ -45,13 +46,14 @@ beamPackages.mixRelease rec {
          group = "pleroma";
          owner = "elixir-libraries";
          repo = "elixir-captcha";
-          rev = "3bbfa8b5ea13accc1b1c40579a380d8e5cfd6ad2";
-          hash = "sha256-skZ0QwF46lUTfsgACMR0AR5ymY2F50BQy1AUBjWVdro=";
+          rev = "90f6ce7672f70f56708792a98d98bd05176c9176";
+          hash = "sha256-s7EuAhmCsQA/4p2NJHJSWB/DZ5hA+7EelPsUOvKr2Po=";
        };

        # the binary is not getting installed by default
        postInstall = "mv priv/* $out/lib/erlang/lib/${name}-${version}/priv/";
      };
+
      concurrent_limiter = beamPackages.buildMix rec {
        name = "concurrent_limiter";
        version = "0.1.1";
@ -64,6 +66,7 @@ beamPackages.mixRelease rec {
          hash = "sha256-A7ucZnXks4K+JDVY5vV2cT5KfEOUOo/OHO4rga5mGys=";
        };
      };
+
      elasticsearch = beamPackages.buildMix rec {
        name = "elasticsearch";
        version = "1.0.1";
@ -76,6 +79,33 @@ beamPackages.mixRelease rec {
          hash = "sha256-CtmQHVl+VTpemne+nxbkYGcErrgCo+t3ZBPbkFSpyF0=";
        };
      };
+
+      file_ex = beamPackages.buildMix rec {
+        name = "file_ex";
+        version = "0.1.0";
+
+        src = fetchFromGitea {
+          domain = "akkoma.dev";
+          owner = "AkkomaGang";
+          repo = "file_ex";
+          rev = "cc7067c7d446c2526e9ecf91d40896b088851569";
+          hash = "sha256-3sxfdOy0cpst4jiutoaabk72VFJ2USKiJN9ODN01Dco=";
+        };
+      };
+
+      http_signatures = beamPackages.buildMix rec {
+        name = "http_signatures";
+        version = "0.1.1";
+
+        src = fetchFromGitea {
+          domain = "akkoma.dev";
+          owner = "AkkomaGang";
+          repo = "http_signatures";
+          rev = "6640ce7d24c783ac2ef56e27d00d12e8dc85f396";
+          hash = "sha256-Q/IoVbM/TBgGCmx8AxiBHF2hARb0FbPml8N1HjN3CsE=";
+        };
+      };
+
      linkify = beamPackages.buildMix rec {
        name = "linkify";
        version = "0.5.2";
@ -88,20 +118,38 @@ beamPackages.mixRelease rec {
          hash = "sha256-e3wzlbRuyw/UB5Tb7IozX/WR1T+sIBf9C/o5Thki9vg=";
        };
      };
+
+      majic = beamPackages.buildMix rec {
+        name = "majic";
+        version = "1.0.0";
+
+        src = fetchFromGitea {
+          domain = "akkoma.dev";
+          owner = "AkkomaGang";
+          repo = "majic";
+          rev = "80540b36939ec83f48e76c61e5000e0fd67706f0";
+          hash = "sha256-OMM9aDRvbqCOBIE+iPySU8ONRn1BqHDql22rRSmdW08=";
+        };
+
+        beamDeps = with final; [ elixir_make mime nimble_pool plug ];
+        buildInputs = [ file ];
+      };
+
      mfm_parser = beamPackages.buildMix rec {
        name = "mfm_parser";
-        version = "0.1.1";
+        version = "0.1.0";

        src = fetchFromGitea {
          domain = "akkoma.dev";
          owner = "AkkomaGang";
          repo = "mfm-parser";
-          rev = "912fba81152d4d572e457fd5427f9875b2bc3dbe";
-          hash = "sha256-n3WmERxKK8VM8jFIBAPS6GkbT7/zjqi3AjjWbjOdMzs=";
+          rev = "b21ab7754024af096f2d14247574f55f0063295b";
+          hash = "sha256-couG5jrAo0Fbk/WABd4n3vhXpDUp+9drxExKc5NM9CI=";
        };

        beamDeps = with final; [ phoenix_view temple ];
      };
+
      search_parser = beamPackages.buildMix rec {
        name = "search_parser";
        version = "0.1.0";
@ -115,6 +163,7 @@ beamPackages.mixRelease rec {

        beamDeps = with final; [ nimble_parsec ];
      };
+
      temple = beamPackages.buildMix rec {
        name = "temple";
        version = "0.9.0-rc.0";
@ -137,14 +186,7 @@ beamPackages.mixRelease rec {
        nativeBuildInputs = [ cmake ];
        dontUseCmakeConfigure = true;
      };
-      http_signatures = prev.http_signatures.override {
-        patchPhase = ''
-          substituteInPlace mix.exs --replace ":logger" ":logger, :public_key"
-        '';
-      };
-      majic = prev.majic.override {
-        buildInputs = [ file ];
-      };
+
      syslog = prev.syslog.override {
        buildPlugins = with beamPackages; [ pc ];
      };
@ -152,13 +194,18 @@ beamPackages.mixRelease rec {
      mime = prev.mime.override {
        patchPhase = let
          cfgFile = writeText "config.exs" ''
-            use Mix.Config
+            import Config
+
            config :mime, :types, %{
-              "application/activity+json" => ["activity+json"],
-              "application/jrd+json" => ["jrd+json"],
-              "application/ld+json" => ["activity+json"],
              "application/xml" => ["xml"],
-              "application/xrd+xml" => ["xrd+xml"]
+              "application/xrd+xml" => ["xrd+xml"],
+              "application/jrd+json" => ["jrd+json"],
+              "application/activity+json" => ["activity+json"],
+              "application/ld+json" => ["activity+json"]
+            }
+
+            config :mime, :extensions, %{
+              "activity+json" => "application/activity+json"
            }
          '';
        in ''
--- a/pkgs/servers/akkoma/mix.nix
+++ b/pkgs/servers/akkoma/mix.nix
--- a/pkgs/servers/sql/postgresql/ext/pgvector.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgvector.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "pgvector";
-  version = "0.6.0";
+  version = "0.6.1";

  src = fetchFromGitHub {
    owner = "pgvector";
    repo = "pgvector";
    rev = "v${version}";
-    hash = "sha256-hXm+k0BZ9xZP1Tnek14jPoKCPQkA5ovscu9IX2mW7Kc=";
+    hash = "sha256-NS9iNgrVnoqmAIXd4sJFnPISQvYYl8YQ84bnLjpChx4=";
  };

  buildInputs = [ postgresql ];
--- a/pkgs/tools/misc/grizzly/default.nix
+++ b/pkgs/tools/misc/grizzly/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "grizzly";
-  version = "0.3.1";
+  version = "0.4.0";

  src = fetchFromGitHub {
    owner = "grafana";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-d/DUazWBT96+dnwVXo667RHALUM2FHxXoI54fFU2HZw=";
+    hash = "sha256-c+QT3NwfnkVzAb1mqNIuNhSJJOnzME4e3ASawdNBFmg=";
  };

-  vendorHash = "sha256-8myfB2LKDPUCFV9GBSXrBo9E+WrCOCm0ZHKTQ1dEb9U=";
+  vendorHash = "sha256-EVP2w0mvzzBcrhohM2VmetK8UQu7fauelSa+C+q3n+g=";

  subPackages = [ "cmd/grr" ];

--- a/pkgs/tools/misc/pre-commit/default.nix
+++ b/pkgs/tools/misc/pre-commit/default.nix
@ -18,7 +18,7 @@
 with python3Packages;
 buildPythonApplication rec {
  pname = "pre-commit";
-  version = "3.6.1";
+  version = "3.6.2";
  format = "setuptools";

  disabled = pythonOlder "3.9";
@ -27,7 +27,7 @@ buildPythonApplication rec {
    owner = "pre-commit";
    repo = "pre-commit";
    rev = "refs/tags/v${version}";
-    hash = "sha256-UmQ1GehoMDXKEXo8wgPLxTDbtObk7YC2cfk1yNqesJM=";
+    hash = "sha256-rlGkoaVLrTCEPgPFNUWefJf6MJaKTA2RDSbV7eGtaAU=";
  };

  patches = [
@ -134,6 +134,7 @@ buildPythonApplication rec {
    "test_docker_hook"
    "test_docker_image_hook_via_args"
    "test_docker_image_hook_via_entrypoint"
+    "test_during_commit_all"
    "test_golang_default_version"
    "test_golang_hook"
    "test_golang_hook_still_works_when_gobin_is_set"
--- a/pkgs/tools/networking/snowflake/default.nix
+++ b/pkgs/tools/networking/snowflake/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "snowflake";
-  version = "2.9.0";
+  version = "2.9.1";

  src = fetchFromGitLab {
    domain = "gitlab.torproject.org";
@ -10,10 +10,10 @@ buildGoModule rec {
    owner = "anti-censorship/pluggable-transports";
    repo = "snowflake";
    rev = "v${version}";
-    sha256 = "sha256-h8T8kc7idZcfepVjhpX+0RIypFDp2nMt3ZZ61YmeLQk=";
+    sha256 = "sha256-LDr/Fzg1fC2lf7W+yTD1y5q4C2pPXZz+ZJf9sI1BxcQ=";
  };

-  vendorHash = "sha256-TSB0UDVD9ijOFgOmIh7ppnKJn/VWzejeDcb1+30+Mnc=";
+  vendorHash = "sha256-IT2+5HmgkV6BKPEARkCZbULyVr7VDLtwGUCF22YuodA=";

  meta = with lib; {
    description = "System to defeat internet censorship";
--- a/pkgs/tools/networking/vopono/default.nix
+++ b/pkgs/tools/networking/vopono/default.nix
@ -5,14 +5,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "vopono";
-  version = "0.10.8";
+  version = "0.10.9";

  src = fetchCrate {
    inherit pname version;
-    hash = "sha256-D+yROQidu+a3qzCNrVxn0RNutIHNcIjMSNqPLHwA+zA=";
+    hash = "sha256-j8o9UxyBE7uML/7gw9UYbXLNYK9ka2jhUw5/v7pxIc8=";
  };

-  cargoHash = "sha256-oKoSHjABtaJYGyJ/G0zXC42XpXiUXwdPsOhyL1+D3GI=";
+  cargoHash = "sha256-foJSaifllpGNMfxWMGm4BWwItOdtAmUcaOO1j1JMCpo=";

  meta = with lib; {
    description = "Run applications through VPN connections in network namespaces";
--- a/pkgs/tools/security/arti/default.nix
+++ b/pkgs/tools/security/arti/default.nix
@ -10,7 +10,7 @@

 rustPlatform.buildRustPackage rec {
  pname = "arti";
-  version = "1.1.13";
+  version = "1.2.0";

  src = fetchFromGitLab {
    domain = "gitlab.torproject.org";
@ -18,10 +18,10 @@ rustPlatform.buildRustPackage rec {
    owner = "core";
    repo = "arti";
    rev = "arti-v${version}";
-    hash = "sha256-Afbys0ChT1640PfKnAH/0Knl2IfKcrsCqqoxryFDPo0=";
+    hash = "sha256-ba07btx3eorFiocRk1YbkkGcblgsWaMI14r1SaPNr9g=";
  };

-  cargoHash = "sha256-Y4JpVQU1wVwCWWaE5HMT+SaoRpmqzzhZjefbOOwPPRg=";
+  cargoHash = "sha256-+TVmmyjAFLDlnXMED0+S0M3VbGBRHds4C1GNyTGD4wI=";

  nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config ];

@ -35,8 +35,8 @@ rustPlatform.buildRustPackage rec {

  meta = with lib; {
    description = "An implementation of Tor in Rust";
-    homepage = "https://gitlab.torproject.org/tpo/core/arti";
-    changelog = "https://gitlab.torproject.org/tpo/core/arti/-/raw/${src.rev}/CHANGELOG.md";
+    homepage = "https://arti.torproject.org/";
+    changelog = "https://gitlab.torproject.org/tpo/core/arti/-/blob/${src.rev}/CHANGELOG.md";
    license = with licenses; [ asl20 /* or */ mit ];
    maintainers = with maintainers; [ marsam ];
  };
--- a/pkgs/tools/security/nitrokey-app2/default.nix
+++ b/pkgs/tools/security/nitrokey-app2/default.nix
@ -1,20 +1,38 @@
 { lib
-, buildPythonApplication
+, python3
+, fetchPypi
+, rustPlatform
 , fetchFromGitHub
-, pythonOlder
-, pyside6
-, poetry-core
-, pynitrokey
-, pyudev
-, qt-material
 }:

-buildPythonApplication rec {
+let
+  python = python3.override {
+    packageOverrides = self: super: {
+      # https://github.com/nxp-mcuxpresso/spsdk/issues/64
+      cryptography = super.cryptography.overridePythonAttrs (old: rec {
+        version = "41.0.7";
+        src = fetchPypi {
+          inherit (old) pname;
+          inherit version;
+          hash = "sha256-E/k86b6oAWwlOzSvxr1qdZk+XEBnLtVAWpyDLw1KALw=";
+        };
+        cargoDeps = rustPlatform.fetchCargoTarball {
+          inherit src;
+          sourceRoot = "${old.pname}-${version}/${old.cargoRoot}";
+          name = "${old.pname}-${version}";
+          hash = "sha256-VeZhKisCPDRvmSjGNwCgJJeVj65BZ0Ge+yvXbZw86Rw=";
+        };
+        patches = [ ];
+        doCheck = false; # would require overriding cryptography-vectors
+      });
+    };
+  };
+in python.pkgs.buildPythonApplication rec {
  pname = "nitrokey-app2";
  version = "2.1.5";
  pyproject = true;

-  disabled = pythonOlder "3.9";
+  disabled = python.pythonOlder "3.9";

  src = fetchFromGitHub {
    owner = "Nitrokey";
@ -31,11 +49,11 @@ buildPythonApplication rec {
    substituteInPlace pyproject.toml --replace 'pynitrokey = "' 'pynitrokey = ">='
  '';

-  nativeBuildInputs = [
+  nativeBuildInputs = with python.pkgs; [
    poetry-core
  ];

-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python.pkgs; [
    pynitrokey
    pyudev
    pyside6
--- a/pkgs/tools/wayland/wl-screenrec/default.nix
+++ b/pkgs/tools/wayland/wl-screenrec/default.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "wl-screenrec";
-  version = "unstable-2023-09-17";
+  version = "0.1.3";

  src = fetchFromGitHub {
    owner = "russelltg";
    repo = pname;
-    rev = "a36c5923009b44f2131196d8a3a234948f8e0102";
-    hash = "sha256-V29eB9vozVKIBq8dO7zgA4nirsh1eDBjJN+rwVkeDLE=";
+    rev = "v${version}";
+    hash = "sha256-ThPZPV1GyMFRu94O9WwUpXbR4gnIML26K7TyIfXZlcI=";
  };

-  cargoHash = "sha256-uUfEweLWn/NdqgY8O7Ld+YnGPKQV1tpJi/Gd4MZB4xI=";
+  cargoHash = "sha256-DtlVsUFKNKXcwqNvGvqkSKUE+kRHX8wajL4fR0c9ZuQ=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -1563,8 +1563,8 @@ with pkgs;
  adminer = callPackage ../servers/adminer { };

  akkoma = callPackage ../servers/akkoma {
-    elixir = elixir_1_14;
-    beamPackages = beamPackages.extend (self: super: { elixir = elixir_1_14; });
+    elixir = elixir_1_16;
+    beamPackages = beamPackages.extend (self: super: { elixir = elixir_1_16; });
  };
  akkoma-frontends = recurseIntoAttrs {
    akkoma-fe = callPackage ../servers/akkoma/akkoma-fe { };
@ -35880,6 +35880,10 @@ with pkgs;
    inherit (gnome2) libIDL;
  };

+  virtualboxKvm = lowPrio (virtualbox.override {
+    enableKvm = true;
+  });
+
  virtualboxHardened = lowPrio (virtualbox.override {
    enableHardening = true;
  });
@ -41339,11 +41343,9 @@ with pkgs;

  xrq = callPackage ../applications/misc/xrq { };

-  pynitrokey = with python3Packages; toPythonApplication pynitrokey;
-
  nitrokey-app = libsForQt5.callPackage ../tools/security/nitrokey-app { };

-  nitrokey-app2 = python3Packages.callPackage ../tools/security/nitrokey-app2 { };
+  nitrokey-app2 = callPackage ../tools/security/nitrokey-app2 { };

  fpm2 = callPackage ../tools/security/fpm2 { };

--- a/pkgs/top-level/kodi-packages.nix
+++ b/pkgs/top-level/kodi-packages.nix
@ -1,5 +1,4 @@
-{ config, lib, newScope, kodi, libretro
-, disable-warnings-if-gcc13 }:
+{ config, lib, newScope, kodi, libretro }:

 with lib;

@ -159,7 +158,7 @@ let self = rec {

  inputstream-adaptive = callPackage ../applications/video/kodi/addons/inputstream-adaptive { };

-  inputstream-ffmpegdirect = disable-warnings-if-gcc13 (callPackage ../applications/video/kodi/addons/inputstream-ffmpegdirect { });
+  inputstream-ffmpegdirect = callPackage ../applications/video/kodi/addons/inputstream-ffmpegdirect { };

  inputstream-rtmp = callPackage ../applications/video/kodi/addons/inputstream-rtmp { };

--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -10049,10 +10049,14 @@ self: super: with self; {

  progress = callPackage ../development/python-modules/progress { };

+  prometheus-api-client = callPackage ../development/python-modules/prometheus-api-client { };
+
  prometheus-client = callPackage ../development/python-modules/prometheus-client { };

  prometheus-flask-exporter = callPackage ../development/python-modules/prometheus-flask-exporter { };

+  prometrix = callPackage ../development/python-modules/prometrix { };
+
  promise = callPackage ../development/python-modules/promise { };

  prompt-toolkit = callPackage ../development/python-modules/prompt-toolkit { };
@ -11129,6 +11133,8 @@ self: super: with self; {

  pyocd = callPackage ../development/python-modules/pyocd { };

+  pyocd-pemicro = callPackage ../development/python-modules/pyocd-pemicro { };
+
  pyocr = callPackage ../development/python-modules/pyocr {
    tesseract = pkgs.tesseract4;
  };
@ -11821,6 +11827,8 @@ self: super: with self; {

  pytest-mypy-plugins = callPackage ../development/python-modules/pytest-mypy-plugins { };

+  pytest-notebook = callPackage ../development/python-modules/pytest-notebook { };
+
  pytest-openfiles = callPackage ../development/python-modules/pytest-openfiles { };

  pytest-order = callPackage ../development/python-modules/pytest-order { };