Merge master into haskell-updates

2024-09-19 20:09:01 +02:00 · 2024-03-30 00:12:08 +00:00 · 2024-03-30 00:12:08 +00:00 · 506e353092
parent 201e6de9c7 cd75d22750
commit 506e353092
163 changed files with 2063 additions and 1159 deletions
--- a/doc/stdenv/meta.chapter.md
+++ b/doc/stdenv/meta.chapter.md
@ -47,6 +47,10 @@ Release branch. Used to specify that a package is not going to receive updates t

 The package’s homepage. Example: `https://www.gnu.org/software/hello/manual/`

+### `repository` {#var-meta-repository}
+
+A webpage where the package's source code can be viewed.  `https` links are preferred if available.  Automatically set to a default value if the package uses a `fetchFrom*` fetcher for its `src`. Example: `https://github.com/forthy42/gforth`
+
 ### `downloadPage` {#var-meta-downloadPage}

 The page where a link to the current version can be found. Example: `https://ftp.gnu.org/gnu/hello/`
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -11231,6 +11231,12 @@
      fingerprint = "92D8 A09D 03DD B774 AABD 53B9 E136 2F07 D750 DB5C";
    }];
  };
+  lilacious = {
+    email = "yuchenhe126@gmail.com";
+    github = "Lilacious";
+    githubId = 101508537;
+    name = "Yuchen He";
+  };
  lillycham = {
    email = "lillycat332@gmail.com";
    github = "lillycat332";
@ -17420,6 +17426,12 @@
    githubId = 92817635;
    name = "Sanskar Gurdasani";
  };
+  sarahec = {
+    email = "sarahec@nextquestion.net";
+    github = "sarahec";
+    githubId = 11277967;
+    name = "Sarah Clark";
+  };
  sarcasticadmin = {
    email = "rob@sarcasticadmin.com";
    github = "sarcasticadmin";
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@ -1001,7 +1001,7 @@ Make sure to also check the many updates in the [Nixpkgs library](#sec-release-2
  Satellite](https://github.com/synesthesiam/homeassistant-satellite), a
  streaming audio satellite for Home Assistant voice pipelines, where you can
  reuse existing mic and speaker hardware. Available as
-  [services.homeassistant-satellite](#opt-services.homeassistant-satellite.enable).
+  `services.homeassistant-satellite`.

 - [Apache Guacamole](https://guacamole.apache.org/), a cross-platform,
  clientless remote desktop gateway. Available as
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -126,6 +126,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - [armagetronad](https://wiki.armagetronad.org), a mid-2000s 3D lightcycle game widely played at iD Tech Camps. You can define multiple servers using `services.armagetronad.<server>.enable`.

+- [wyoming-satellite](https://github.com/rhasspy/wyoming-satellite), a voice assistant satellite for Home Assistant using the Wyoming protocol. Available as [services.wyoming.satellite]($opt-services.wyoming.satellite.enable).
+
 - [TuxClocker](https://github.com/Lurkki14/tuxclocker), a hardware control and monitoring program. Available as [programs.tuxclocker](#opt-programs.tuxclocker.enable).

 - [ALVR](https://github.com/alvr-org/alvr), a VR desktop streamer. Available as [programs.alvr](#opt-programs.alvr.enable)
@ -284,6 +286,10 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 - `services.archisteamfarm` no longer uses the abbreviation `asf` for its state directory (`/var/lib/asf`), user and group (both `asf`). Instead the long name `archisteamfarm` is used.
  Configurations with `system.stateVersion` 23.11 or earlier, default to the old stateDirectory until the 24.11 release and must either set the option explicitly or move the data to the new directory.

+- `xfsprogs` was updated to version 6.6.0, which enables reverse mapping (rmapbt) and large extent counts (nrext64) by default.
+   Support for these features was added in kernel 4.9 and 5.19 and nrext64 was deemed stable in kernel 6.5.
+   Format your filesystems with `mkfs.xfs -i nrext64=0`, if they need to be readable by GRUB2 before 2.12 or kernels older than 5.19.
+
 - `networking.iproute2.enable` now does not set `environment.etc."iproute2/rt_tables".text`.

  Setting `environment.etc."iproute2/{CONFIG_FILE_NAME}".text` will override the whole configuration file instead of appending it to the upstream configuration file.
@ -373,6 +379,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 - The Matrix homeserver [Synapse](https://element-hq.github.io/synapse/) module now supports configuring UNIX domain socket [listeners](#opt-services.matrix-synapse.settings.listeners) through the `path` option.
  The default replication worker on the main instance has been migrated away from TCP sockets to UNIX domain sockets.

+- The initrd ssh daemon module got a new option to add authorized keys via a list of files using `boot.initrd.network.ssh.authorizedKeyFiles`.
+
 - Programs written in [Nim](https://nim-lang.org/) are built with libraries selected by lockfiles.
  The `nimPackages` and `nim2Packages` sets have been removed.
  See https://nixos.org/manual/nixpkgs/unstable#nim for more information.
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -331,6 +331,7 @@
  ./security/systemd-confinement.nix
  ./security/tpm2.nix
  ./security/wrappers/default.nix
+  ./services/admin/docuum.nix
  ./services/admin/meshcentral.nix
  ./services/admin/oxidized.nix
  ./services/admin/pgadmin.nix
@ -362,9 +363,6 @@
  ./services/audio/spotifyd.nix
  ./services/audio/squeezelite.nix
  ./services/audio/tts.nix
-  ./services/audio/wyoming/faster-whisper.nix
-  ./services/audio/wyoming/openwakeword.nix
-  ./services/audio/wyoming/piper.nix
  ./services/audio/ympd.nix
  ./services/backup/automysqlbackup.nix
  ./services/backup/bacula.nix
@ -587,8 +585,11 @@
  ./services/home-automation/evcc.nix
  ./services/home-automation/govee2mqtt.nix
  ./services/home-automation/home-assistant.nix
-  ./services/home-automation/homeassistant-satellite.nix
  ./services/home-automation/matter-server.nix
+  ./services/home-automation/wyoming/faster-whisper.nix
+  ./services/home-automation/wyoming/openwakeword.nix
+  ./services/home-automation/wyoming/piper.nix
+  ./services/home-automation/wyoming/satellite.nix
  ./services/home-automation/zigbee2mqtt.nix
  ./services/home-automation/zwave-js.nix
  ./services/logging/SystemdJournal2Gelf.nix
@ -712,6 +713,7 @@
  ./services/misc/homepage-dashboard.nix
  ./services/misc/ihaskell.nix
  ./services/misc/input-remapper.nix
+  ./services/misc/invidious-router.nix
  ./services/misc/irkerd.nix
  ./services/misc/jackett.nix
  ./services/misc/jellyfin.nix
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@ -62,6 +62,7 @@ in
    (mkRemovedOptionModule [ "services" "fourStoreEndpoint" ] "The fourStoreEndpoint module has been removed")
    (mkRemovedOptionModule [ "services" "fprot" ] "The corresponding package was removed from nixpkgs.")
    (mkRemovedOptionModule [ "services" "frab" ] "The frab module has been removed")
+    (mkRemovedOptionModule [ "services" "homeassistant-satellite"] "The `services.homeassistant-satellite` module has been replaced by `services.wyoming-satellite`.")
    (mkRemovedOptionModule [ "services" "ihatemoney" ] "The ihatemoney module has been removed for lack of downstream maintainer")
    (mkRemovedOptionModule [ "services" "kippo" ] "The corresponding package was removed from nixpkgs.")
    (mkRemovedOptionModule [ "services" "mailpile" ] "The corresponding package was removed from nixpkgs.")
--- a/nixos/modules/services/admin/docuum.nix
+++ b/nixos/modules/services/admin/docuum.nix
@ -0,0 +1,45 @@
+{ config, pkgs, lib, utils, ... }:
+
+let
+  cfg = config.services.docuum;
+  inherit (lib) mkIf mkEnableOption mkOption getExe types;
+in
+{
+  options.services.docuum = {
+    enable = mkEnableOption "docuum daemon";
+
+    threshold = mkOption {
+      description = "Threshold for deletion in bytes, like `10 GB`, `10 GiB`, `10GB` or percentage-based thresholds like `50%`";
+      type = types.str;
+      default = "10 GB";
+      example = "50%";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.virtualisation.docker.enable;
+        message = "docuum requires docker on the host";
+      }
+    ];
+
+    systemd.services.docuum = {
+      after = [ "docker.socket" ];
+      requires = [ "docker.socket" ];
+      wantedBy = [ "multi-user.target" ];
+      path = [ config.virtualisation.docker.package ];
+      environment.HOME = "/var/lib/docuum";
+
+      serviceConfig = {
+        DynamicUser = true;
+        StateDirectory = "docuum";
+        SupplementaryGroups = [ "docker" ];
+        ExecStart = utils.escapeSystemdExecArgs [
+          (getExe pkgs.docuum)
+          "--threshold" cfg.threshold
+        ];
+      };
+    };
+  };
+}
--- a/nixos/modules/services/home-automation/homeassistant-satellite.nix
+++ b/nixos/modules/services/home-automation/homeassistant-satellite.nix
@ -1,225 +0,0 @@
-{ config
-, lib
-, pkgs
-, ...
-}:
-
-let
-  cfg = config.services.homeassistant-satellite;
-
-  inherit (lib)
-    escapeShellArg
-    escapeShellArgs
-    mkOption
-    mdDoc
-    mkEnableOption
-    mkIf
-    mkPackageOption
-    types
-    ;
-
-  inherit (builtins)
-    toString
-    ;
-
-  # override the package with the relevant vad dependencies
-  package = cfg.package.overridePythonAttrs (oldAttrs: {
-    propagatedBuildInputs = oldAttrs.propagatedBuildInputs
-      ++ lib.optional (cfg.vad == "webrtcvad") cfg.package.optional-dependencies.webrtc
-      ++ lib.optional (cfg.vad == "silero") cfg.package.optional-dependencies.silerovad
-      ++ lib.optional (cfg.pulseaudio.enable) cfg.package.optional-dependencies.pulseaudio;
-  });
-
-in
-
-{
-  meta.buildDocsInSandbox = false;
-
-  options.services.homeassistant-satellite = with types; {
-    enable = mkEnableOption (mdDoc "Home Assistant Satellite");
-
-    package = mkPackageOption pkgs "homeassistant-satellite" { };
-
-    user = mkOption {
-      type = str;
-      example = "alice";
-      description = mdDoc ''
-        User to run homeassistant-satellite under.
-      '';
-    };
-
-    group = mkOption {
-      type = str;
-      default = "users";
-      description = mdDoc ''
-        Group to run homeassistant-satellite under.
-      '';
-    };
-
-    host = mkOption {
-      type = str;
-      example = "home-assistant.local";
-      description = mdDoc ''
-        Hostname on which your Home Assistant instance can be reached.
-      '';
-    };
-
-    port = mkOption {
-      type = port;
-      example = 8123;
-      description = mdDoc ''
-        Port on which your Home Assistance can be reached.
-      '';
-      apply = toString;
-    };
-
-    protocol = mkOption {
-      type = enum [ "http" "https" ];
-      default = "http";
-      example = "https";
-      description = mdDoc ''
-        The transport protocol used to connect to Home Assistant.
-      '';
-    };
-
-    tokenFile = mkOption {
-      type = path;
-      example = "/run/keys/hass-token";
-      description = mdDoc ''
-        Path to a file containing a long-lived access token for your Home Assistant instance.
-      '';
-      apply = escapeShellArg;
-    };
-
-    sounds = {
-      awake = mkOption {
-        type = nullOr str;
-        default = null;
-        description = mdDoc ''
-          Audio file to play when the wake word is detected.
-        '';
-      };
-
-      done = mkOption {
-        type = nullOr str;
-        default = null;
-        description = mdDoc ''
-          Audio file to play when the voice command is done.
-        '';
-      };
-    };
-
-    vad = mkOption {
-      type = enum [ "disabled" "webrtcvad" "silero" ];
-      default = "disabled";
-      example = "silero";
-      description = mdDoc ''
-        Voice activity detection model. With `disabled` sound will be transmitted continously.
-      '';
-    };
-
-    pulseaudio = {
-      enable = mkEnableOption "recording/playback via PulseAudio or PipeWire";
-
-      socket = mkOption {
-        type = nullOr str;
-        default = null;
-        example = "/run/user/1000/pulse/native";
-        description = mdDoc ''
-          Path or hostname to connect with the PulseAudio server.
-        '';
-      };
-
-      duckingVolume = mkOption {
-        type = nullOr float;
-        default = null;
-        example = 0.4;
-        description = mdDoc ''
-          Reduce output volume (between 0 and 1) to this percentage value while recording.
-        '';
-      };
-
-      echoCancellation = mkEnableOption "acoustic echo cancellation";
-    };
-
-    extraArgs = mkOption {
-      type = listOf str;
-      default = [ ];
-      description = mdDoc ''
-        Extra arguments to pass to the commandline.
-      '';
-      apply = escapeShellArgs;
-    };
-  };
-
-  config = mkIf cfg.enable {
-    systemd.services."homeassistant-satellite" = {
-      description = "Home Assistant Satellite";
-      after = [
-        "network-online.target"
-      ];
-      wants = [
-        "network-online.target"
-      ];
-      wantedBy = [
-        "multi-user.target"
-      ];
-      path = with pkgs; [
-        ffmpeg-headless
-      ] ++ lib.optionals (!cfg.pulseaudio.enable) [
-        alsa-utils
-      ];
-      serviceConfig = {
-        User = cfg.user;
-        Group = cfg.group;
-        # https://github.com/rhasspy/hassio-addons/blob/master/assist_microphone/rootfs/etc/s6-overlay/s6-rc.d/assist_microphone/run
-        ExecStart = ''
-          ${package}/bin/homeassistant-satellite \
-            --host ${cfg.host} \
-            --port ${cfg.port} \
-            --protocol ${cfg.protocol} \
-            --token-file ${cfg.tokenFile} \
-            --vad ${cfg.vad} \
-            ${lib.optionalString cfg.pulseaudio.enable "--pulseaudio"}${lib.optionalString (cfg.pulseaudio.socket != null) "=${cfg.pulseaudio.socket}"} \
-            ${lib.optionalString (cfg.pulseaudio.enable && cfg.pulseaudio.duckingVolume != null) "--ducking-volume=${toString cfg.pulseaudio.duckingVolume}"} \
-            ${lib.optionalString (cfg.pulseaudio.enable && cfg.pulseaudio.echoCancellation) "--echo-cancel"} \
-            ${lib.optionalString (cfg.sounds.awake != null) "--awake-sound=${toString cfg.sounds.awake}"} \
-            ${lib.optionalString (cfg.sounds.done != null) "--done-sound=${toString cfg.sounds.done}"} \
-            ${cfg.extraArgs}
-        '';
-        CapabilityBoundingSet = "";
-        DeviceAllow = "";
-        DevicePolicy = "closed";
-        LockPersonality = true;
-        MemoryDenyWriteExecute = false; # onnxruntime/capi/onnxruntime_pybind11_state.so: cannot enable executable stack as shared object requires: Operation not permitted
-        PrivateDevices = true;
-        PrivateUsers = true;
-        ProtectHome = false; # Would deny access to local pulse/pipewire server
-        ProtectHostname = true;
-        ProtectKernelLogs = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        ProtectControlGroups = true;
-        ProtectProc = "invisible";
-        ProcSubset = "all"; # Error in cpuinfo: failed to parse processor information from /proc/cpuinfo
-        Restart = "always";
-        RestrictAddressFamilies = [
-          "AF_INET"
-          "AF_INET6"
-          "AF_UNIX"
-        ];
-        RestrictNamespaces = true;
-        RestrictRealtime = true;
-        SupplementaryGroups = [
-          "audio"
-        ];
-        SystemCallArchitectures = "native";
-        SystemCallFilter = [
-          "@system-service"
-          "~@privileged"
-        ];
-        UMask = "0077";
-      };
-    };
-  };
-}
--- a/nixos/modules/services/home-automation/wyoming/faster-whisper.nix
+++ b/nixos/modules/services/home-automation/wyoming/faster-whisper.nix
--- a/nixos/modules/services/home-automation/wyoming/openwakeword.nix
+++ b/nixos/modules/services/home-automation/wyoming/openwakeword.nix
--- a/nixos/modules/services/home-automation/wyoming/piper.nix
+++ b/nixos/modules/services/home-automation/wyoming/piper.nix
--- a/nixos/modules/services/home-automation/wyoming/satellite.nix
+++ b/nixos/modules/services/home-automation/wyoming/satellite.nix
@ -0,0 +1,244 @@
+{ config
+, lib
+, pkgs
+, ...
+}:
+
+let
+  cfg = config.services.wyoming.satellite;
+
+  inherit (lib)
+    elem
+    escapeShellArgs
+    getExe
+    literalExpression
+    mkOption
+    mkEnableOption
+    mkIf
+    mkPackageOption
+    optional
+    optionals
+    types
+  ;
+
+  finalPackage = cfg.package.overridePythonAttrs (oldAttrs: {
+    propagatedBuildInputs = oldAttrs.propagatedBuildInputs
+      # for audio enhancements like auto-gain, noise suppression
+      ++ cfg.package.optional-dependencies.webrtc
+      # vad is currently optional, because it is broken on aarch64-linux
+      ++ optionals cfg.vad.enable cfg.package.optional-dependencies.silerovad;
+    });
+in
+
+{
+  meta.buildDocsInSandbox = false;
+
+  options.services.wyoming.satellite = with types; {
+    enable = mkEnableOption "Wyoming Satellite";
+
+    package = mkPackageOption pkgs "wyoming-satellite" { };
+
+    user = mkOption {
+      type = str;
+      example = "alice";
+      description = ''
+        User to run wyoming-satellite under.
+      '';
+    };
+
+    group = mkOption {
+      type = str;
+      default = "users";
+      description = ''
+        Group to run wyoming-satellite under.
+      '';
+    };
+
+    uri = mkOption {
+      type = str;
+      default = "tcp://0.0.0.0:10700";
+      description = ''
+        URI where wyoming-satellite will bind its socket.
+      '';
+    };
+
+    name = mkOption {
+      type = str;
+      default = config.networking.hostName;
+      defaultText = literalExpression ''
+        config.networking.hostName
+      '';
+      description = ''
+        Name of the satellite.
+      '';
+    };
+
+    area = mkOption {
+      type = nullOr str;
+      default = null;
+      example = "Kitchen";
+      description = ''
+        Area to the satellite.
+      '';
+    };
+
+    microphone = {
+      command = mkOption {
+        type = str;
+        default = "arecord -r 16000 -c 1 -f S16_LE -t raw";
+        description = ''
+          Program to run for audio input.
+        '';
+      };
+
+      autoGain = mkOption {
+        type = ints.between 0 31;
+        default = 5;
+        example = 15;
+        description = ''
+          Automatic gain control in dbFS, with 31 being the loudest value. Set to 0 to disable.
+        '';
+      };
+
+      noiseSuppression = mkOption {
+        type = ints.between 0 4;
+        default = 2;
+        example = 3;
+        description = ''
+          Noise suppression level with 4 being the maximum suppression,
+          which may cause audio distortion. Set to 0 to disable.
+        '';
+      };
+    };
+
+    sound = {
+      command = mkOption {
+        type = nullOr str;
+        default = "aplay -r 22050 -c 1 -f S16_LE -t raw";
+        description = ''
+          Program to run for sound output.
+        '';
+      };
+    };
+
+    sounds = {
+      awake = mkOption {
+        type = nullOr path;
+        default = null;
+        description = ''
+          Path to audio file in WAV format to play when wake word is detected.
+        '';
+      };
+
+      done = mkOption {
+        type = nullOr path;
+        default = null;
+        description = ''
+          Path to audio file in WAV format to play when voice command recording has ended.
+        '';
+      };
+    };
+
+    vad = {
+      enable = mkOption {
+        type = bool;
+        default = true;
+        description = ''
+          Whether to enable voice activity detection.
+
+          Enabling will result in only streaming audio, when speech gets
+          detected.
+        '';
+      };
+    };
+
+    extraArgs = mkOption {
+      type = listOf str;
+      default = [ ];
+      description = ''
+        Extra arguments to pass to the executable.
+
+        Check `wyoming-satellite --help` for possible options.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services."wyoming-satellite" = {
+      description = "Wyoming Satellite";
+      after = [
+        "network-online.target"
+        "sound.target"
+      ];
+      wants = [
+        "network-online.target"
+        "sound.target"
+      ];
+      wantedBy = [
+        "multi-user.target"
+      ];
+      path = with pkgs; [
+        alsa-utils
+      ];
+      script = let
+        optionalParam = param: argument: optionals (!elem argument [ null 0 false ]) [
+          param argument
+        ];
+      in ''
+        export XDG_RUNTIME_DIR=/run/user/$UID
+        ${escapeShellArgs ([
+          (getExe finalPackage)
+          "--uri" cfg.uri
+          "--name" cfg.name
+          "--mic-command" cfg.microphone.command
+        ]
+        ++ optionalParam "--mic-auto-gain" cfg.microphone.autoGain
+        ++ optionalParam "--mic-noise-suppression" cfg.microphone.noiseSuppression
+        ++ optionalParam "--area" cfg.area
+        ++ optionalParam "--snd-command" cfg.sound.command
+        ++ optionalParam "--awake-wav" cfg.sounds.awake
+        ++ optionalParam "--done-wav" cfg.sounds.done
+        ++ optional cfg.vad.enable "--vad"
+        ++ cfg.extraArgs)}
+      '';
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        # https://github.com/rhasspy/hassio-addons/blob/master/assist_microphone/rootfs/etc/s6-overlay/s6-rc.d/assist_microphone/run
+        CapabilityBoundingSet = "";
+        DeviceAllow = "";
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = false; # onnxruntime/capi/onnxruntime_pybind11_state.so: cannot enable executable stack as shared object requires: Operation not permitted
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProtectHome = false; # Would deny access to local pulse/pipewire server
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectControlGroups = true;
+        ProtectProc = "invisible";
+        ProcSubset = "all"; # Error in cpuinfo: failed to parse processor information from /proc/cpuinfo
+        Restart = "always";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+          "AF_NETLINK"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SupplementaryGroups = [
+          "audio"
+        ];
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+        ];
+        UMask = "0077";
+      };
+    };
+  };
+}
--- a/nixos/modules/services/misc/invidious-router.nix
+++ b/nixos/modules/services/misc/invidious-router.nix
@ -0,0 +1,121 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  cfg = config.services.invidious-router;
+  settingsFormat = pkgs.formats.yaml {};
+  configFile = settingsFormat.generate "config.yaml" cfg.settings;
+in {
+  meta.maintainers = [lib.maintainers.s1ls];
+
+  options.services.invidious-router = {
+    enable = lib.mkEnableOption "Enables the invidious-router service";
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 8050;
+      description = lib.mdDoc ''
+        Port to bind to.
+      '';
+    };
+    address = lib.mkOption {
+      type = lib.types.str;
+      default = "127.0.0.1";
+      description = lib.mdDoc ''
+        Address on which invidious-router should listen on.
+      '';
+    };
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = settingsFormat.type;
+      };
+      default = {
+        app = {
+          listen = "127.0.0.1:8050";
+          enable_youtube_fallback = false;
+          reload_instance_list_interval = "60s";
+        };
+        api = {
+          enabled = true;
+          url = "https://api.invidious.io/instances.json";
+          filter_regions = true;
+          allowed_regions = [
+            "AT"
+            "DE"
+            "CH"
+          ];
+        };
+        healthcheck = {
+          path = "/";
+          allowed_status_codes = [
+            200
+          ];
+          timeout = "1s";
+          interval = "10s";
+          filter_by_response_time = {
+            enabled = true;
+            qty_of_top_results = 3;
+          };
+          minimum_ratio = 0.2;
+          remove_no_ratio = true;
+          text_not_present = "YouTube is currently trying to block Invidious instances";
+        };
+      };
+      description = lib.mdDoc ''
+        Configuration for invidious-router.
+        Check https://gitlab.com/gaincoder/invidious-router#configuration
+        for configuration options.
+      '';
+    };
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.invidious-router;
+      defaultText = lib.literalExpression "pkgs.invidious-router";
+      description = lib.mdDoc ''
+        The invidious-router package to use.
+      '';
+    };
+    nginx = {
+      enable = lib.mkEnableOption (lib.mdDoc ''
+        Automatic nginx proxy configuration
+      '');
+      domain = lib.mkOption {
+        type = lib.types.str;
+        example = "invidious-router.example.com";
+        description = lib.mdDoc ''
+          The domain on which invidious-router should be served.
+        '';
+      };
+      extraDomains = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [];
+        description = lib.mdDoc ''
+          Additional domains to serve invidious-router on.
+        '';
+      };
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    systemd.services.invidious-router = {
+      wantedBy = ["multi-user.target"];
+      serviceConfig = {
+        Restart = "on-failure";
+        ExecStart = "${lib.getExe cfg.package} --configfile ${configFile}";
+        DynamicUser = "yes";
+      };
+    };
+
+    services.nginx.virtualHosts = lib.mkIf cfg.nginx.enable {
+      ${cfg.nginx.domain} = {
+        locations."/" = {
+          recommendedProxySettings = true;
+          proxyPass = "http://${cfg.address}:${toString cfg.port}";
+        };
+        enableACME = true;
+        forceSSL = true;
+        serverAliases = cfg.nginx.extraDomains;
+      };
+    };
+  };
+}
--- a/nixos/modules/services/networking/mycelium.nix
+++ b/nixos/modules/services/networking/mycelium.nix
@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, utils, ... }:

 let
  cfg = config.services.mycelium;
@ -46,6 +46,15 @@ in
        Adds the hosted peers from https://github.com/threefoldtech/mycelium#hosted-public-nodes.
      '';
    };
+    extraArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = ''
+        Extra command-line arguments to pass to mycelium.
+
+        See `mycelium --help` for all available options.
+      '';
+    };
  };
  config = lib.mkIf cfg.enable {
    networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall [ 9651 ];
@ -87,6 +96,7 @@ in
          )
          "--tun-name"
          "mycelium"
+          "${utils.escapeSystemdExecArgs cfg.extraArgs}"
        ] ++
        (lib.optional (cfg.addHostedPublicNodes || cfg.peers != [ ]) "--peers")
        ++ cfg.peers ++ (lib.optionals cfg.addHostedPublicNodes [
@ -130,4 +140,3 @@ in
    maintainers = with lib.maintainers; [ flokli lassulus ];
  };
 }
-
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@ -390,7 +390,7 @@ in
          };
        });
        default = [ ];
-        example = literalExpression ''[{ name = "03f0:4e1d"; script = "''${pkgs.modemmanager}/share/ModemManager/fcc-unlock.available.d/03f0:4e1d"; }]'';
+        example = literalExpression ''[{ id = "03f0:4e1d"; path = "''${pkgs.modemmanager}/share/ModemManager/fcc-unlock.available.d/03f0:4e1d"; }]'';
        description = lib.mdDoc ''
          List of FCC unlock scripts to enable on the system, behaving as described in
          https://modemmanager.org/docs/modemmanager/fcc-unlock/#integration-with-third-party-fcc-unlock-tools.
--- a/nixos/modules/services/web-apps/jitsi-meet.nix
+++ b/nixos/modules/services/web-apps/jitsi-meet.nix
@ -188,7 +188,14 @@ in
      description = lib.mdDoc ''The port which the Excalidraw backend for Jitsi should listen to.'';
    };

-    secureDomain.enable = mkEnableOption (lib.mdDoc "Authenticated room creation");
+    secureDomain = {
+      enable = mkEnableOption (lib.mdDoc "Authenticated room creation");
+      authentication = mkOption {
+        type = types.str;
+        default = "internal_hashed";
+        description = lib.mdDoc ''The authentication type to be used by jitsi'';
+      };
+    };
  };

  config = mkIf cfg.enable {
@ -309,7 +316,7 @@ in
        enabled = true;
        domain = cfg.hostName;
        extraConfig = ''
-          authentication = ${if cfg.secureDomain.enable then "\"internal_hashed\"" else "\"jitsi-anonymous\""}
+          authentication = ${if cfg.secureDomain.enable then "\"${cfg.secureDomain.authentication}\"" else "\"jitsi-anonymous\""}
          c2s_require_encryption = false
          admins = { "focus@auth.${cfg.hostName}" }
          smacks_max_unacked_stanzas = 5
--- a/nixos/modules/services/x11/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/x11/desktop-managers/pantheon.nix
@ -174,12 +174,38 @@ in
        # https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/1443
        pkgs.pantheon.mutter
      ];
-      systemd.packages = [
-        pkgs.pantheon.gnome-settings-daemon
+      systemd.packages = with pkgs; [
+        gnome.gnome-session
+        pantheon.gala
+        pantheon.gnome-settings-daemon
+        pantheon.elementary-session-settings
      ];
      programs.dconf.enable = true;
      networking.networkmanager.enable = mkDefault true;

+      systemd.user.targets."gnome-session-x11-services".wants = [
+        "org.gnome.SettingsDaemon.XSettings.service"
+      ];
+      systemd.user.targets."gnome-session-x11-services-ready".wants = [
+        "org.gnome.SettingsDaemon.XSettings.service"
+      ];
+
+      # https://github.com/elementary/gala/issues/1826#issuecomment-1890461298
+      systemd.user.services."io.elementary.gala.daemon@" = {
+        unitConfig = {
+          Description = "Gala Daemon";
+          BindsTo = "io.elementary.gala@.service";
+          After = "io.elementary.gala@.service";
+        };
+
+        serviceConfig = {
+          Type = "dbus";
+          BusName = "org.pantheon.gala.daemon";
+          ExecStart = "${pkgs.pantheon.gala}/bin/gala-daemon";
+          Slice = "session.slice";
+        };
+      };
+
      # Global environment
      environment.systemPackages = (with pkgs.pantheon; [
        elementary-session-settings
--- a/nixos/modules/services/x11/display-managers/default.nix
+++ b/nixos/modules/services/x11/display-managers/default.nix
@ -40,7 +40,7 @@ let
        IFS=:
        for i in $XDG_CURRENT_DESKTOP; do
          case $i in
-            KDE|GNOME|X-NIXOS-SYSTEMD-AWARE) echo "1"; exit; ;;
+            KDE|GNOME|Pantheon|X-NIXOS-SYSTEMD-AWARE) echo "1"; exit; ;;
            *) ;;
          esac
        done
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@ -111,7 +111,7 @@ let
    }
      ''
        echo 'Section "Files"' >> $out
-        echo $fontpath >> $out
+        echo "$fontpath" >> $out

        for i in ${toString fontsForXServer}; do
          if test "''${i:0:''${#NIX_STORE}}" == "$NIX_STORE"; then
@ -121,11 +121,9 @@ let
          fi
        done

-        for i in $(find ${toString cfg.modules} -type d | sort); do
-          if test $(echo $i/*.so* | wc -w) -ne 0; then
-            echo "  ModulePath \"$i\"" >> $out
-          fi
-        done
+        ${concatMapStrings (m: ''
+        echo "  ModulePath \"${m}/lib/xorg/modules\"" >> "$out"
+        '') cfg.modules}

        echo '${cfg.filesSection}' >> $out
        echo 'EndSection' >> $out
--- a/nixos/modules/system/boot/initrd-ssh.nix
+++ b/nixos/modules/system/boot/initrd-ssh.nix
@ -93,6 +93,21 @@ in
      defaultText = literalExpression "config.users.users.root.openssh.authorizedKeys.keys";
      description = lib.mdDoc ''
        Authorized keys for the root user on initrd.
+        You can combine the `authorizedKeys` and `authorizedKeyFiles` options.
+      '';
+      example = [
+        "ssh-rsa AAAAB3NzaC1yc2etc/etc/etcjwrsh8e596z6J0l7 example@host"
+        "ssh-ed25519 AAAAC3NzaCetcetera/etceteraJZMfk3QPfQ foo@bar"
+      ];
+    };
+
+    authorizedKeyFiles = mkOption {
+      type = types.listOf types.path;
+      default = config.users.users.root.openssh.authorizedKeys.keyFiles;
+      defaultText = literalExpression "config.users.users.root.openssh.authorizedKeys.keyFiles";
+      description = lib.mdDoc ''
+        Authorized keys taken from files for the root user on initrd.
+        You can combine the `authorizedKeyFiles` and `authorizedKeys` options.
      '';
    };

@ -152,7 +167,7 @@ in
  in mkIf enabled {
    assertions = [
      {
-        assertion = cfg.authorizedKeys != [];
+        assertion = cfg.authorizedKeys != [] || cfg.authorizedKeyFiles != [];
        message = "You should specify at least one authorized key for initrd SSH";
      }

@ -206,6 +221,9 @@ in
      ${concatStrings (map (key: ''
        echo ${escapeShellArg key} >> /root/.ssh/authorized_keys
      '') cfg.authorizedKeys)}
+      ${concatStrings (map (keyFile: ''
+        cat ${keyFile} >> /root/.ssh/authorized_keys
+      '') cfg.authorizedKeyFiles)}

      ${flip concatMapStrings cfg.hostKeys (path: ''
        # keys from Nix store are world-readable, which sshd doesn't like
@ -236,9 +254,13 @@ in

      users.root.shell = mkIf (config.boot.initrd.network.ssh.shell != null) config.boot.initrd.network.ssh.shell;

-      contents."/etc/ssh/authorized_keys.d/root".text =
-        concatStringsSep "\n" config.boot.initrd.network.ssh.authorizedKeys;
-      contents."/etc/ssh/sshd_config".text = sshdConfig;
+      contents = {
+        "/etc/ssh/sshd_config".text = sshdConfig;
+        "/etc/ssh/authorized_keys.d/root".text =
+          concatStringsSep "\n" (
+            config.boot.initrd.network.ssh.authorizedKeys ++
+            (map (file: lib.fileContents file) config.boot.initrd.network.ssh.authorizedKeyFiles));
+      };
      storePaths = ["${package}/bin/sshd"];

      services.sshd = {
--- a/nixos/modules/virtualisation/incus.nix
+++ b/nixos/modules/virtualisation/incus.nix
@ -60,8 +60,26 @@ let
  }'';

  # https://github.com/lxc/incus/blob/cff35a29ee3d7a2af1f937cbb6cf23776941854b/internal/server/instance/drivers/driver_qemu.go#L123
+  OVMF2MB = pkgs.OVMF.override {
+    secureBoot = true;
+    fdSize2MB = true;
+  };
  ovmf-prefix = if pkgs.stdenv.hostPlatform.isAarch64 then "AAVMF" else "OVMF";
  ovmf = pkgs.linkFarm "incus-ovmf" [
+    # 2MB must remain the default or existing VMs will fail to boot. New VMs will prefer 4MB
+    {
+      name = "OVMF_CODE.fd";
+      path = "${OVMF2MB.fd}/FV/${ovmf-prefix}_CODE.fd";
+    }
+    {
+      name = "OVMF_VARS.fd";
+      path = "${OVMF2MB.fd}/FV/${ovmf-prefix}_VARS.fd";
+    }
+    {
+      name = "OVMF_VARS.ms.fd";
+      path = "${OVMF2MB.fd}/FV/${ovmf-prefix}_VARS.fd";
+    }
+
    {
      name = "OVMF_CODE.4MB.fd";
      path = "${pkgs.OVMFFull.fd}/FV/${ovmf-prefix}_CODE.fd";
--- a/nixos/tests/lvm2/default.nix
+++ b/nixos/tests/lvm2/default.nix
@ -36,9 +36,14 @@ lib.listToAttrs (
    lib.flip lib.concatMap kernelVersionsToTest (version:
      let
        v' = lib.replaceStrings [ "." ] [ "_" ] version;
+        mkXfsFlags = lib.optionalString (lib.versionOlder version "5.10") " -m bigtime=0 -m inobtcount=0 "
+                     + lib.optionalString (lib.versionOlder version "5.19") " -i nrext64=0 ";
      in
      lib.flip lib.mapAttrsToList tests (name: t:
-        lib.nameValuePair "lvm-${name}-linux-${v'}" (lib.optionalAttrs (builtins.elem version (t.kernelFilter kernelVersionsToTest)) (t.test ({ kernelPackages = pkgs."linuxPackages_${v'}"; } // builtins.removeAttrs t [ "test" "kernelFilter" ])))
+        lib.nameValuePair "lvm-${name}-linux-${v'}" (lib.optionalAttrs (builtins.elem version (t.kernelFilter kernelVersionsToTest)) (t.test ({
+          kernelPackages = pkgs."linuxPackages_${v'}";
+          inherit mkXfsFlags;
+        } // builtins.removeAttrs t [ "test" "kernelFilter" ])))
      )
    )
  )
--- a/nixos/tests/lvm2/systemd-stage-1.nix
+++ b/nixos/tests/lvm2/systemd-stage-1.nix
@ -1,4 +1,4 @@
-{ kernelPackages ? null, flavour }: let
+{ kernelPackages ? null, flavour, mkXfsFlags ? "" }: let
  preparationCode = {
    raid = ''
      machine.succeed("vgcreate test_vg /dev/vdb /dev/vdc")
@ -71,7 +71,7 @@ in import ../make-test-python.nix ({ pkgs, lib, ... }: {
    boot.loader.systemd-boot.enable = true;
    boot.loader.efi.canTouchEfiVariables = true;

-    environment.systemPackages = with pkgs; [ e2fsprogs ]; # for mkfs.ext4
+    environment.systemPackages = with pkgs; [ xfsprogs ];
    boot = {
      initrd.systemd = {
        enable = true;
@ -88,7 +88,7 @@ in import ../make-test-python.nix ({ pkgs, lib, ... }: {
    machine.wait_for_unit("multi-user.target")
    # Create a VG for the root
    ${preparationCode}
-    machine.succeed("mkfs.ext4 /dev/test_vg/test_lv")
+    machine.succeed("mkfs.xfs ${mkXfsFlags} /dev/test_vg/test_lv")
    machine.succeed("mkdir -p /mnt && mount /dev/test_vg/test_lv /mnt && echo hello > /mnt/test && umount /mnt")

    # Boot from LVM
--- a/nixos/tests/lvm2/thinpool.nix
+++ b/nixos/tests/lvm2/thinpool.nix
@ -1,4 +1,4 @@
-{ kernelPackages ? null }:
+{ kernelPackages ? null, mkXfsFlags ? "" }:
 import ../make-test-python.nix ({ pkgs, lib, ... }: {
  name = "lvm2-thinpool";
  meta.maintainers = lib.teams.helsinki-systems.members;
@ -18,7 +18,8 @@ import ../make-test-python.nix ({ pkgs, lib, ... }: {
  };

  testScript = let
-    mkXfsFlags = lib.optionalString (lib.versionOlder kernelPackages.kernel.version "5.10") "-m bigtime=0 -m inobtcount=0";
+    mkXfsFlags = lib.optionalString (lib.versionOlder kernelPackages.kernel.version "5.10") " -m bigtime=0 -m inobtcount=0 "
+               + lib.optionalString (lib.versionOlder kernelPackages.kernel.version "5.19") " -i nrext64=0 ";
  in ''
    machine.succeed("vgcreate test_vg /dev/vdb")
    machine.succeed("lvcreate -L 512M -T test_vg/test_thin_pool")
--- a/nixos/tests/lvm2/vdo.nix
+++ b/nixos/tests/lvm2/vdo.nix
@ -1,4 +1,4 @@
-{ kernelPackages ? null }:
+{ kernelPackages ? null, mkXfsFlags ? "" }:
 import ../make-test-python.nix ({ pkgs, lib, ... }: {
  name = "lvm2-vdo";
  meta.maintainers = lib.teams.helsinki-systems.members;
@ -17,7 +17,7 @@ import ../make-test-python.nix ({ pkgs, lib, ... }: {
  testScript = ''
    machine.succeed("vgcreate test_vg /dev/vdb")
    machine.succeed("lvcreate --type vdo -n vdo_lv -L 6G -V 12G test_vg/vdo_pool_lv")
-    machine.succeed("mkfs.xfs -K /dev/test_vg/vdo_lv")
+    machine.succeed("mkfs.xfs ${mkXfsFlags} -K /dev/test_vg/vdo_lv")
    machine.succeed("mkdir /mnt; mount /dev/test_vg/vdo_lv /mnt")
    assert "/dev/mapper/test_vg-vdo_lv" == machine.succeed("findmnt -no SOURCE /mnt").strip()
    machine.succeed("umount /mnt")
--- a/nixos/tests/pantheon.nix
+++ b/nixos/tests/pantheon.nix
@ -50,11 +50,11 @@ import ./make-test-python.nix ({ pkgs, lib, ...} :
            machine.wait_until_succeeds(f"pgrep -f {i}")
        for i in ["gala", "io.elementary.wingpanel", "plank"]:
            machine.wait_for_window(i)
-        machine.wait_for_unit("bamfdaemon.service", "${user.name}")
-        machine.wait_for_unit("io.elementary.files.xdg-desktop-portal.service", "${user.name}")
+        for i in ["io.elementary.gala.daemon@x11.service", "bamfdaemon.service", "io.elementary.files.xdg-desktop-portal.service"]:
+            machine.wait_for_unit(i, "${user.name}")

    with subtest("Check if various environment variables are set"):
-        cmd = "xargs --null --max-args=1 echo < /proc/$(pgrep -xf /run/current-system/sw/bin/gala)/environ"
+        cmd = "xargs --null --max-args=1 echo < /proc/$(pgrep -xf ${pkgs.pantheon.gala}/bin/gala)/environ"
        machine.succeed(f"{cmd} | grep 'XDG_CURRENT_DESKTOP' | grep 'Pantheon'")
        # Hopefully from the sessionPath option.
        machine.succeed(f"{cmd} | grep 'XDG_DATA_DIRS' | grep 'gsettings-schemas/pantheon-agent-geoclue2'")
--- a/pkgs/applications/audio/jacktrip/default.nix
+++ b/pkgs/applications/audio/jacktrip/default.nix
@ -11,7 +11,7 @@
 }:

 stdenv.mkDerivation rec {
-  version = "2.2.4";
+  version = "2.2.5";
  pname = "jacktrip";

  src = fetchFromGitHub {
@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
    repo = "jacktrip";
    rev = "v${version}";
    fetchSubmodules = true;
-    sha256 = "sha256-H1zjBNEFPvZRDEaFOiL1ZAlHQsNxeT4WbXEOqg0+eFg=";
+    sha256 = "sha256-rZ8oaud+ovJ7t+SGnWe7QbqjQns1EkbbwpdE+rLr6nc=";
  };

  preConfigure = ''
--- a/pkgs/applications/audio/schismtracker/default.nix
+++ b/pkgs/applications/audio/schismtracker/default.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "schismtracker";
-  version = "20240308";
+  version = "20240328";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = version;
-    sha256 = "sha256-6MzMmeD4HCS/7VTFTAcOhyKjz5NvzvDEzcSpHGUwFvM=";
+    sha256 = "sha256-hoP/14lbqsuQ37oJDErPoQWWk04UshImmApCFrf5wno=";
  };

  configureFlags = [ "--enable-dependency-tracking" ]
--- a/pkgs/applications/audio/spotify-player/default.nix
+++ b/pkgs/applications/audio/spotify-player/default.nix
@ -33,16 +33,16 @@ assert lib.assertOneOf "withAudioBackend" withAudioBackend [ "" "alsa" "pulseaud

 rustPlatform.buildRustPackage rec {
  pname = "spotify-player";
-  version = "0.17.1";
+  version = "0.17.2";

  src = fetchFromGitHub {
    owner = "aome510";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-1aq+J1dP+hGJHq3boxZLUFfLLSFDY2uN6BwYXqHjCtk=";
+    hash = "sha256-TwMQtyg8ygFTI5DgT5rBVkZE31U4puaANIo5S8W0TXU=";
  };

-  cargoHash = "sha256-nULTz1H52L1kiTtViYfvxL+jrJ0uDk68oe8t5Hd7aCU=";
+  cargoHash = "sha256-RTvMywRWdZiBgNMjlUGa4jlD0HYOL3ESkVppGlsl4So=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/applications/audio/squeezelite/default.nix
+++ b/pkgs/applications/audio/squeezelite/default.nix
@ -45,13 +45,13 @@ stdenv.mkDerivation {
  pname = binName;
  # versions are specified in `squeezelite.h`
  # see https://github.com/ralph-irving/squeezelite/issues/29
-  version = "2.0.0.1473";
+  version = "2.0.0.1476";

  src = fetchFromGitHub {
    owner = "ralph-irving";
    repo = "squeezelite";
-    rev = "66c9b6a21834019a0230c39fcee74b6bf2891f7d";
-    hash = "sha256-MCH7vltF3jLGfxcRspXg9eQMx+e+lHSoxIanf91NrE0=";
+    rev = "7bba683e26f84b7dccc6ef5f40762a67b4f63606";
+    hash = "sha256-iRrZRnSIp8NbZ/Pi8WoQjyeBgxoU0mchNEf00W1Gsvo=";
  };

  buildInputs = [ flac libmad libvorbis mpg123 ]
--- a/pkgs/applications/blockchains/erigon/default.nix
+++ b/pkgs/applications/blockchains/erigon/default.nix
@ -2,7 +2,7 @@

 let
  pname = "erigon";
-  version = "2.55.1";
+  version = "2.59.2";
 in
 buildGoModule {
  inherit pname version;
@ -11,11 +11,11 @@ buildGoModule {
    owner = "ledgerwatch";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-ttBJIx2QR3H5JFyquoGwZpWwT10r7X7GnGE4uEzuRZA=";
+    hash = "sha256-gSoaPoyPyryC1yzYaafnPXKpMNzI9fw9Yd0nKzziAKw=";
    fetchSubmodules = true;
  };

-  vendorHash = "sha256-QLuWxec1gwMnVo0Zw8z4Ef8vzxc4xFpLL/TT986Sljo=";
+  vendorHash = "sha256-B3xbCI0szSAo9ULHDiqoTTR8tvgZUry7spDGuldu0lU=";
  proxyVendor = true;

  # Build errors in mdbx when format hardening is enabled:
@ -34,6 +34,14 @@ buildGoModule {
    "cmd/rlpdump"
  ];

+  # Matches the tags to upstream's release build configuration
+  # https://github.com/ledgerwatch/erigon/blob/0c0dbe5f3a81cf8f16da8e4838312ab80ebe5302/.goreleaser.yml
+  #
+  # Enabling silkworm also breaks the build as it requires dynamically linked libraries.
+  # If we need it in the future, we should consider packaging silkworm and silkworm-go
+  # as depenedencies explicitly.
+  tags = "-tags=nosqlite,noboltdb,nosilkworm";
+
  passthru.updateScript = nix-update-script { };

  meta = with lib; {
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -20,6 +20,7 @@
 , millet
 , craftos-pc
 , shfmt
+, tinymist
 , typst-lsp
 , typst-preview
 , autoPatchelfHook
@ -2345,6 +2346,22 @@ let
        };
      };

+      jbockle.jbockle-format-files = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "jbockle-format-files";
+          publisher = "jbockle";
+          version = "3.4.0";
+          sha256 = "sha256-BHw+T2EPdQq/wOD5kzvSln5SBFTYUXip8QDjnAGBfFY=";
+        };
+        meta = {
+          description = "A VSCode extension to formats all files in the current workspace";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=jbockle.jbockle-format-files";
+          homepage = "https://github.com/jbockle/format-files";
+          license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.wackbyte ];
+        };
+      };
+
      jdinhlife.gruvbox = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "gruvbox";
@ -3169,6 +3186,37 @@ let
        };
      };

+      myriad-dreamin.tinymist = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "tinymist";
+          publisher = "myriad-dreamin";
+          # Please update the corresponding binary (tinymist) when updating
+          # this extension.
+          version = "0.11.1";
+          sha256 = "sha256-jyZBnT8UW94TVnZKZna1cJa/UIj+DwYwlAbU4pnaf04=";
+        };
+
+        nativeBuildInputs = [ jq moreutils ];
+
+        buildInputs = [
+          tinymist
+        ];
+
+        postInstall = ''
+          cd "$out/$installPrefix"
+          jq '.contributes.configuration.properties."tinymist.serverPath".default = "${lib.getExe tinymist}"' package.json | sponge package.json
+        '';
+
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/myriad-dreamin.tinymist/changelog";
+          description = "A VSCode extension for providing an integration solution for Typst";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=myriad-dreamin.tinymist";
+          homepage = "https://github.com/myriad-dreamin/tinymist";
+          license = lib.licenses.asl20;
+          maintainers = [ lib.maintainers.drupol ];
+        };
+      };
+
      naumovs.color-highlight = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "color-highlight";
--- a/pkgs/applications/graphics/oculante/default.nix
+++ b/pkgs/applications/graphics/oculante/default.nix
@ -22,16 +22,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "oculante";
-  version = "0.8.16";
+  version = "0.8.17";

  src = fetchFromGitHub {
    owner = "woelper";
    repo = "oculante";
    rev = version;
-    hash = "sha256-C8USTDW5C+mjj/fr242is/42RpmUvcK3lUeaq0/BSGA=";
+    hash = "sha256-kSCmBdTh4Z6b49fItv68w+hdIFH98g8lCfIVqj08wgg=";
  };

-  cargoHash = "sha256-w8k0QG509PRHHB1e4WThYnM6R0PwWMbSBxs2B0zQ0ww=";
+  cargoHash = "sha256-vZwzIV0l9iHEf2Iz/n1jY9Ai+YU5UkeSJPSqDkKy+nI=";

  nativeBuildInputs = [
    cmake
--- a/pkgs/applications/graphics/pureref/default.nix
+++ b/pkgs/applications/graphics/pureref/default.nix
@ -1,14 +1,16 @@
-{ lib, appimageTools, requireFile }:
+{ lib, appimageTools, runCommand, curl, gnugrep, cacert }:

 appimageTools.wrapType1 rec {
  pname = "pureref";
  version = "1.11.1";

-  src = requireFile {
-    name = "PureRef-${version}_x64.Appimage";
-    sha256 = "05naywdgykqrsgc3xybskr418cyvbx7vqs994yv9w8zf98gxvbvm";
-    url = "https://www.pureref.com/download.php";
-  };
+  src = runCommand "PureRef-${version}_x64.Appimage" {
+    nativeBuildInputs = [ curl gnugrep cacert ];
+    outputHash = "sha256-da/dH0ruI562JylpvE9f2zMUSJ56+T7Y0xlP/xr3yhY=";
+  } ''
+    key="$(curl "https://www.pureref.com/download.php" --silent | grep '%3D%3D' | cut -d '"' -f2)"
+    curl "https://www.pureref.com/files/build.php?build=LINUX64.Appimage&version=${version}&downloadKey=$key" --output $out
+  '';

  extraInstallCommands = ''
    mv $out/bin/${pname}-${version} $out/bin/${pname}
--- a/pkgs/applications/misc/gramps/default.nix
+++ b/pkgs/applications/misc/gramps/default.nix
@ -23,7 +23,7 @@ let
  inherit (pythonPackages) buildPythonApplication pythonOlder;
 in
 buildPythonApplication rec {
-  version = "5.2.0";
+  version = "5.2.1";
  pname = "gramps";
  pyproject = true;

@ -33,7 +33,7 @@ buildPythonApplication rec {
    owner = "gramps-project";
    repo = "gramps";
    rev = "v${version}";
-    hash = "sha256-8iQcaWLiBegVjcV16TfZbp8/4N/9f5pEl7mdV78CeEY=";
+    hash = "sha256-KgUc6AFLVFf3SYpjY/le0g4jNhGe4gpYcnkDEIZ/gxQ=";
  };

  patches = [
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -94,11 +94,11 @@ in

 stdenv.mkDerivation rec {
  pname = "brave";
-  version = "1.64.109";
+  version = "1.64.113";

  src = fetchurl {
    url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    hash = "sha256-36igba0U3p8i7t91RxeG6PqlKYyHDDlj295ICcYmCNc=";
+    hash = "sha256-T0uVq1yxDXNi6x9ot5bs3NRaOQ+RwBThvULS6EZ+Bdg=";
  };

  dontConfigure = true;
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-aarch64.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-aarch64.nix
@ -2,7 +2,7 @@
 callPackage ./generic.nix { } rec {
  pname = "signal-desktop";
  dir = "Signal";
-  version = "6.46.0";
+  version = "7.3.0";
  url = "https://github.com/0mniteck/Signal-Desktop-Mobian/raw/${version}/builds/release/signal-desktop_${version}_arm64.deb";
-  hash = "sha256-rHmG2brzlQtYd3l5EFhjndPF5T7nQWzUhEe7LsEFVpc=";
+  hash = "sha256-RIOMIAXdBMr1Bi1TDFr4VD0w8JfBKzwEjpYS/DfV5kc=";
 }
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
@ -2,7 +2,7 @@
 callPackage ./generic.nix { } rec {
  pname = "signal-desktop-beta";
  dir = "Signal Beta";
-  version = "7.4.0-beta.1";
+  version = "7.4.0-beta.2";
  url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop-beta/signal-desktop-beta_${version}_amd64.deb";
-  hash = "sha256-Pjz55iVBww7d7WIAonTeX+cdEobitltoAyOU79RY40c=";
+  hash = "sha256-oBkZ9BaKbmosTkC/OZFjt6PmU/9XqclyzbllwYPj3Q4=";
 }
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
@ -2,7 +2,7 @@
 callPackage ./generic.nix { } rec {
  pname = "signal-desktop";
  dir = "Signal";
-  version = "7.2.1";
+  version = "7.3.1";
  url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-  hash = "sha256-IJ808xvPqGivccqH/mOMSHu/mU/JLFJ798UztwXWtm0=";
+  hash = "sha256-J99mSSzl+TxWb6whzJ4oZs8a7NnKFVL3iNvWmvlQIaw=";
 }
--- a/pkgs/applications/networking/sync/storj-uplink/default.nix
+++ b/pkgs/applications/networking/sync/storj-uplink/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "storj-uplink";
-  version = "1.100.3";
+  version = "1.100.4";

  src = fetchFromGitHub {
    owner = "storj";
    repo = "storj";
    rev = "v${version}";
-    hash = "sha256-/aR6M/zL7xL+ujmGgu9J8Toiy7/0ou76nYJ0vwd5RVM=";
+    hash = "sha256-LPckEiuw+3WlEnW07jql+TFggB6mEzrvC7NI+pVBCLY=";
  };

  subPackages = [ "cmd/uplink" ];
--- a/pkgs/applications/office/planify/default.nix
+++ b/pkgs/applications/office/planify/default.nix
@ -27,13 +27,13 @@

 stdenv.mkDerivation rec {
  pname = "planify";
-  version = "4.5.8";
+  version = "4.5.11";

  src = fetchFromGitHub {
    owner = "alainm23";
    repo = "planify";
    rev = version;
-    hash = "sha256-VTBnVVxv3hCyDKJlY/hE8oEDMNuMMWtm+NKzfD3tVzk=";
+    hash = "sha256-LMN+1ORp44uWVqzw1sjiZzx81s9l2msPFM3+sJ7qw8U=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/logic/dafny/default.nix
+++ b/pkgs/applications/science/logic/dafny/default.nix
@ -8,13 +8,13 @@

 buildDotnetModule rec {
  pname = "Dafny";
-  version = "4.5.0";
+  version = "4.6.0";

  src = fetchFromGitHub {
    owner = "dafny-lang";
    repo = "dafny";
    rev = "v${version}";
-    hash = "sha256-NsQhJY++IaLyFc5jqo7TyZBcz0P8VUizGLxdIe9KEO4=";
+    hash = "sha256-3t0drxM7PZzrLbxBKYa6Gja2u6GK6Pc+ejoswag3P3k=";
  };

  postPatch = ''
--- a/pkgs/applications/version-management/lucky-commit/default.nix
+++ b/pkgs/applications/version-management/lucky-commit/default.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "lucky-commit";
-  version = "2.2.2";
+  version = "2.2.3";

  src = fetchFromGitHub {
    owner = "not-an-aardvark";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-DrgZBzcJmqSP7iCHZyy623iRZYfTE/z/zzx7I+BAOBo=";
+    sha256 = "sha256-jxcsTtQcSuL+2vwdxIVxqTpKh8Bfvna+hkGt+Rx21FE=";
  };

-  cargoHash = "sha256-5P0CiLCf86Jul4EaIDqHGkp4XNifLKnWJZXtrLkpLMY=";
+  cargoHash = "sha256-8JkodGtMdYP/IIBqRcJFD5syiZi+VakDyX7VcvR0HLo=";

  buildInputs = lib.optional withOpenCL (if stdenv.isDarwin then OpenCL else ocl-icd);

--- a/pkgs/by-name/ad/advcpmv/package.nix
+++ b/pkgs/by-name/ad/advcpmv/package.nix
@ -1,62 +0,0 @@
-{ coreutils
-, fetchFromGitHub
-}:
-
-let
-  advcpmv-data = {
-    pname = "advcpmv";
-    patch-version = "0.9";
-    coreutils-version = "9.4";
-    version = "${advcpmv-data.patch-version}-${advcpmv-data.coreutils-version}";
-    src = fetchFromGitHub {
-      owner = "jarun";
-      repo = "advcpmv";
-      rev = "a1f8b505e691737db2f7f2b96275802c45f65c59";
-      hash = "sha256-IHfMu6PyGRPc87J/hbxMUdosmLq13K0oWa5fPLWKOvo=";
-    };
-    patch-file = advcpmv-data.src + "/advcpmv-${advcpmv-data.version}.patch";
-  };
-  coreutilsNoSingleBinary = coreutils.override { singleBinary = false; };
-in
-assert (advcpmv-data.coreutils-version == coreutils.version);
-coreutilsNoSingleBinary.overrideAttrs (old: {
-  inherit (advcpmv-data) pname version;
-
-  patches = (old.patches or [ ]) ++ [
-    advcpmv-data.patch-file
-  ];
-
-  outputs = [ "out" ]; # Since we don't need info files
-
-  configureFlags = (old.configureFlags or [ ]) ++ [
-    # To not conflict with regular coreutils
-    "--program-prefix=adv"
-  ];
-
-  # Only cpg and mvg are desired, the others are not touched and therefore can
-  # be removed. Equally, the info directory is removed.
-  postFixup = (old.postFixup or "") + ''
-    rm -rf $out/share/info
-    pushd $out/bin
-    mv advcp cpg
-    mv advmv mvg
-    rm adv*
-    mv cpg advcp
-    mv mvg advmv
-    ln -s advcp cpg
-    ln -s advcp acp
-    ln -s advmv mvg
-    ln -s advmv amv
-    popd
-  '';
-
-  meta = old.meta // {
-    homepage = "https://github.com/jarun/advcpmv";
-    description = "Patched cp and mv from Coreutils that provides progress bars";
-    longDescription = ''
-      Advanced Copy is a mod for the GNU cp and GNU mv tools which adds a
-      progress bar and provides some info on what's going on. It was written by
-      Florian Zwicke and released under the GPL.
-    '';
-  };
-})
--- a/pkgs/by-name/bu/bunbun/package.nix
+++ b/pkgs/by-name/bu/bunbun/package.nix
@ -0,0 +1,40 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, stdenv
+, darwin
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "bunbun";
+  version = "1.3.0";
+
+  src = fetchFromGitHub {
+    owner = "devraza";
+    repo = "bunbun";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-jqokKvJYu/xHJHJVuNlTns3cYPLx1osbRUrCpVTCJZ0=";
+  };
+
+  cargoHash = "sha256-dWZ5aNaHyTkEmkn88Dx5nCnGyiBmpJ6p5iYC7xj/mBw=";
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.CoreFoundation
+    darwin.apple_sdk.frameworks.IOKit
+    darwin.apple_sdk.frameworks.SystemConfiguration
+  ];
+
+  # Cargo.lock is outdated
+  preConfigure = ''
+    cargo update --offline
+  '';
+
+  meta = with lib; {
+    description = "A simple and adorable sysinfo utility written in Rust";
+    homepage = "https://github.com/devraza/bunbun";
+    changelog = "https://github.com/devraza/bunbun/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ GaetanLepage ];
+    mainProgram = "bunbun";
+  };
+}
--- a/pkgs/by-name/bu/buttermanager/package.nix
+++ b/pkgs/by-name/bu/buttermanager/package.nix
@ -0,0 +1,51 @@
+{ lib
+, fetchFromGitHub
+, python3Packages
+, wrapGAppsHook
+, qt5
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "buttermanager";
+  version = "2.5.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "egara";
+    repo = "buttermanager";
+    rev = version;
+    hash = "sha256-MLYJt7OMYlTFk8FCAlZJ1RGlFFXKfeAthWGp4JN+PfY=";
+  };
+
+  propagatedBuildInputs = with python3Packages; [
+    pyqt5
+    pyyaml
+    sip
+    tkinter
+  ];
+
+  nativeBuildInputs = [
+    wrapGAppsHook
+    qt5.wrapQtAppsHook
+  ];
+
+  dontWrapQtApps = true;
+  dontWrapGApps = true;
+  makeWrapperArgs = [ "\${qtWrapperArgs[@]}" "\${gappsWrapperArgs[@]}"];
+
+  postInstall = ''
+    substituteInPlace packaging/buttermanager.desktop \
+      --replace-fail /opt/buttermanager/gui/buttermanager.svg buttermanager
+
+    install -Dm444 packaging/buttermanager.desktop -t $out/share/applications
+    install -Dm444 packaging/buttermanager.svg -t $out/share/icons/hicolor/scalable/apps
+  '';
+
+  meta = with lib; {
+    description = "Btrfs tool for managing snapshots, balancing filesystems and upgrading the system safetly";
+    homepage = "https://github.com/egara/buttermanager";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ t4ccer ];
+    mainProgram = "buttermanager";
+  };
+}
--- a/pkgs/by-name/cl/clash-verge-rev/package.nix
+++ b/pkgs/by-name/cl/clash-verge-rev/package.nix
@ -5,11 +5,11 @@

 clash-verge.overrideAttrs (old: rec {
  pname = "clash-verge-rev";
-  version = "1.5.10";
+  version = "1.5.11";

  src = fetchurl {
    url = "https://github.com/clash-verge-rev/clash-verge-rev/releases/download/v${version}/clash-verge_${version}_amd64.deb";
-    hash = "sha256-xv6xKAjpHL4eyFEcgiuHZQi3EDhYkzGHAKbcKm4rIGk=";
+    hash = "sha256-FoNWCH4SE7DnKoDMwdUiTnWoFwHSUCAIDQhvgZdgyeU=";
  };

  meta = old.meta // (with lib; {
--- a/pkgs/by-name/do/docuum/package.nix
+++ b/pkgs/by-name/do/docuum/package.nix
@ -0,0 +1,38 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, stdenv
+, darwin
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "docuum";
+  version = "0.23.1";
+
+  src = fetchFromGitHub {
+    owner = "stepchowfun";
+    repo = "docuum";
+    rev = "v${version}";
+    hash = "sha256-jZJkI4rk/8O6MsHjuDqmIiRc1LJpTajk/rSUVYnHiOs=";
+  };
+
+  cargoHash = "sha256-qBigfW0W3t0a43y99H22gmKBnhsu08Yd1CTTatsRfRs=";
+
+  checkFlags = [
+    # fails, no idea why
+    "--skip=format::tests::code_str_display"
+  ];
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.IOKit
+  ];
+
+  meta = with lib; {
+    description = "Least recently used (LRU) eviction of Docker images";
+    homepage = "https://github.com/stepchowfun/docuum";
+    changelog = "https://github.com/stepchowfun/docuum/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ mkg20001 ];
+    mainProgram = "docuum";
+  };
+}
--- a/pkgs/by-name/do/doge/package.nix
+++ b/pkgs/by-name/do/doge/package.nix
@ -5,13 +5,13 @@
 }:
 python3Packages.buildPythonApplication rec {
  pname = "doge";
-  version = "3.7.0";
+  version = "3.8.0";

  src = fetchFromGitHub {
    owner = "Olivia5k";
    repo = "doge";
    rev = version;
-    hash = "sha256-LmEbDQUZe/3lg/Ze+WUNyYfC8zMr88/rn10sL0jgbGA=";
+    hash = "sha256-CZw9Pz9YPVmDMOfDp5yIp/yStOvXEzAgb/HvKpxhQ8I=";
  };

  pyproject = true;
--- a/pkgs/by-name/dy/dynamodb-local/package.nix
+++ b/pkgs/by-name/dy/dynamodb-local/package.nix
@ -19,6 +19,7 @@ let
      "java.xml"
      "java.desktop"
      "java.management"
+      "java.naming"
    ];
    jdk = jdk_headless;
  };
--- a/pkgs/by-name/ha/hacompanion/package.nix
+++ b/pkgs/by-name/ha/hacompanion/package.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "hacompanion";
-  version = "1.0.11";
+  version = "1.0.12";

  src = fetchFromGitHub {
    owner = "tobias-kuendig";
    repo = "hacompanion";
    rev = "v${version}";
-    hash = "sha256-gTsA5XBjLlm/cITwQwYNudPK9SbSEaiAIjjdvRS3+8Q=";
+    hash = "sha256-3uPn139e8TyP0rE9hfRKw192YyexG+f3KmlHMmgCN7A=";
  };

  vendorHash = "sha256-ZZ8nxN+zUeFhSXyoHLMgzeFllnIkKdoVnbVK5KjrLEQ=";
--- a/pkgs/by-name/ht/httpy-cli/package.nix
+++ b/pkgs/by-name/ht/httpy-cli/package.nix
@ -0,0 +1,53 @@
+{ lib
+, python3Packages
+, fetchPypi
+, curl
+ }:
+
+python3Packages.buildPythonPackage rec {
+  pname = "httpy-cli";
+  version = "1.1.0";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit version;
+    pname = "httpy-cli";
+    hash = "sha256-uhF/jF4buHMDiXOuuqjskynioz4qVBevQhdcUbH+91Q=";
+  };
+
+  propagatedBuildInputs = with python3Packages; [
+    colorama
+    pygments
+    requests
+    urllib3
+  ];
+
+  build-system = with python3Packages; [
+      setuptools
+  ];
+
+  pythonImportsCheck = [
+    "httpy"
+  ];
+
+  nativeCheckInputs = [
+      python3Packages.pytest
+      curl
+    ];
+
+  checkPhase = ''
+    runHook preCheck
+    echo "line1\nline2\nline3" > tests/test_file.txt
+    # ignore the test_args according to pytest.ini in the repo
+    pytest tests/ --ignore=tests/test_args.py
+    runHook postCheck
+  '';
+
+  meta = with lib; {
+    description = "Modern, user-friendly, programmable command-line HTTP client for the API";
+    homepage = "https://github.com/knid/httpy";
+    license = licenses.mit;
+    mainProgram = "httpy";
+    maintainers = with maintainers; [ eymeric ];
+  };
+}
--- a/pkgs/by-name/km/kmeet/package.nix
+++ b/pkgs/by-name/km/kmeet/package.nix
@ -0,0 +1,43 @@
+{ lib
+, fetchurl
+, appimageTools
+}:
+
+appimageTools.wrapType2 rec {
+  pname = "kmeet";
+  version = "2.0.1";
+
+  src = fetchurl {
+    url = "https://download.storage5.infomaniak.com/meet/kmeet-desktop-${version}-linux-x86_64.AppImage";
+    name = "kmeet-${version}.AppImage";
+    hash = "sha256-0lygBbIwaEydvFEfvADiL2k5GWzVpM1jX4orweriBYw=";
+  };
+
+  extraInstallCommands =
+    let
+      contents = appimageTools.extractType2 { inherit pname version src; };
+    in
+    ''
+      mkdir -p "$out/share/applications"
+      mkdir -p "$out/share/lib/kmeet"
+      cp -r ${contents}/{locales,resources} "$out/share/lib/kmeet"
+      cp -r ${contents}/usr/* "$out"
+      cp "${contents}/kMeet.desktop" "$out/share/applications/"
+      mv "$out/bin/kmeet-${version}" "$out/bin/${meta.mainProgram}"
+      substituteInPlace $out/share/applications/kMeet.desktop --replace 'Exec=AppRun' 'Exec=${meta.mainProgram}'
+    '';
+
+  meta = with lib; {
+    description = "Organise secure online meetings via your web browser, your mobile, your tablet or your computer.";
+    homepage = "https://www.infomaniak.com/en/apps/download-kmeet";
+    license = licenses.unfree;
+    maintainers = [ maintainers.vinetos ];
+    mainProgram = "kmeet";
+    platforms = [ "x86_64-linux" ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    longDescription = ''
+      kMeet allows you to organise secure online meetings via your web browser, your mobile, your tablet or your
+      computer.
+    '';
+  };
+}
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@ -71,13 +71,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
  pname = "llama-cpp";
-  version = "2481";
+  version = "2568";

  src = fetchFromGitHub {
    owner = "ggerganov";
    repo = "llama.cpp";
    rev = "refs/tags/b${finalAttrs.version}";
-    hash = "sha256-40GSZZEnjM9L9KVVKdSKtBoSRy996l98ORM4NeltsSM=";
+    hash = "sha256-yBlLChtzfAi2TAGUO1zdnpHCvi5YDCzjdflQgTWh98Y=";
  };

  postPatch = ''
@ -107,7 +107,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
    (cmakeBool "BUILD_SHARED_LIBS" true)
    (cmakeBool "LLAMA_BLAS" blasSupport)
    (cmakeBool "LLAMA_CLBLAST" openclSupport)
-    (cmakeBool "LLAMA_CUBLAS" cudaSupport)
+    (cmakeBool "LLAMA_CUDA" cudaSupport)
    (cmakeBool "LLAMA_HIPBLAS" rocmSupport)
    (cmakeBool "LLAMA_METAL" metalSupport)
    (cmakeBool "LLAMA_MPI" mpiSupport)
@ -131,7 +131,10 @@ effectiveStdenv.mkDerivation (finalAttrs: {
        # Should likely use `rocmPackages.clr.gpuTargets`.
        "-DAMDGPU_TARGETS=gfx803;gfx900;gfx906:xnack-;gfx908:xnack-;gfx90a:xnack+;gfx90a:xnack-;gfx940;gfx941;gfx942;gfx1010;gfx1012;gfx1030;gfx1100;gfx1101;gfx1102"
      ]
-      ++ optionals metalSupport [ (cmakeFeature "CMAKE_C_FLAGS" "-D__ARM_FEATURE_DOTPROD=1") ];
+      ++ optionals metalSupport [
+        (cmakeFeature "CMAKE_C_FLAGS" "-D__ARM_FEATURE_DOTPROD=1")
+        (cmakeBool "LLAMA_METAL_EMBED_LIBRARY" true)
+      ];

  # upstream plans on adding targets at the cmakelevel, remove those
  # additional steps after that
--- a/pkgs/by-name/lu/lubelogger/package.nix
+++ b/pkgs/by-name/lu/lubelogger/package.nix
@ -6,13 +6,13 @@

 buildDotnetModule rec {
  pname = "lubelogger";
-  version = "1.2.8";
+  version = "1.2.9";

  src = fetchFromGitHub {
    owner = "hargata";
    repo = "lubelog";
    rev = "v${version}";
-    hash = "sha256-22I4OJZLeFLstGZF1fY/s8Y5tPgGJpJR/sPZpkHvUmY=";
+    hash = "sha256-bzCPoWgI7JA5dEYKl2m1ZzNPXxNRAzZz1lFa7fVCkNw=";
  };

  projectFile = "CarCareTracker.sln";
--- a/pkgs/by-name/my/mycelium/Cargo.lock
+++ b/pkgs/by-name/my/mycelium/Cargo.lock
@ -218,6 +218,12 @@ version = "0.21.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"

+[[package]]
+name = "base64"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9475866fec1451be56a3c2400fd081ff546538961565ccb5b7142cbd22bc7a51"
+
 [[package]]
 name = "bitflags"
 version = "1.3.2"
@ -241,9 +247,9 @@ dependencies = [

 [[package]]
 name = "blake3"
-version = "1.5.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0231f06152bf547e9c2b5194f247cd97aacf6dcd8b15d8e5ec0663f64580da87"
+checksum = "30cca6d3674597c30ddf2c587bf8d9d65c9a84d2326d941cc79c9842dfe0ef52"
 dependencies = [
 "arrayref",
 "arrayvec",
@ -275,9 +281,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"

 [[package]]
 name = "bytes"
-version = "1.5.0"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2bd12c1caf447e69cd4528f47f94d203fd2582878ecb9e9465484c4148a8223"
+checksum = "514de17de45fdb8dc022b1a7975556c53c86f9f0aa5f534b98977b171857c2c9"

 [[package]]
 name = "c2rust-bitfields"
@ -332,9 +338,9 @@ dependencies = [

 [[package]]
 name = "clap"
-version = "4.4.18"
+version = "4.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e578d6ec4194633722ccf9544794b71b1385c3c027efe0c55db226fc880865c"
+checksum = "90bc066a67923782aa8515dbaea16946c5bcc5addbd668bb80af688e53e548a0"
 dependencies = [
 "clap_builder",
 "clap_derive",
@ -342,9 +348,9 @@ dependencies = [

 [[package]]
 name = "clap_builder"
-version = "4.4.18"
+version = "4.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4df4df40ec50c46000231c914968278b1eb05098cf8f1b3a518a95030e71d1c7"
+checksum = "ae129e2e766ae0ec03484e609954119f123cc1fe650337e155d03b022f24f7b4"
 dependencies = [
 "anstream",
 "anstyle",
@ -354,9 +360,9 @@ dependencies = [

 [[package]]
 name = "clap_derive"
-version = "4.4.7"
+version = "4.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf9804afaaf59a91e75b022a30fb7229a7901f60c755489cc61c9b423b836442"
+checksum = "528131438037fd55894f62d6e9f068b8f45ac57ffa77517819645d10aed04f64"
 dependencies = [
 "heck",
 "proc-macro2",
@ -366,9 +372,9 @@ dependencies = [

 [[package]]
 name = "clap_lex"
-version = "0.6.0"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "702fc72eb24e5a1e48ce58027a675bc24edd52096d5397d4aea7c6dd9eca0bd1"
+checksum = "98cc8fbded0c607b7ba9dd60cd98df59af97e84d24e49c8557331cfc26d301ce"

 [[package]]
 name = "colorchoice"
@ -523,9 +529,9 @@ dependencies = [

 [[package]]
 name = "faster-hex"
-version = "0.8.1"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "239f7bfb930f820ab16a9cd95afc26f88264cf6905c960b340a615384aa3338a"
+checksum = "a2a2b11eda1d40935b26cf18f6833c526845ae8c41e58d09af6adeb6f0269183"
 dependencies = [
 "serde",
 ]
@ -736,9 +742,9 @@ checksum = "290f1a1d9242c78d09ce40a5e87e7554ee637af1351968159f4952f028f75604"

 [[package]]
 name = "heck"
-version = "0.4.1"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"

 [[package]]
 name = "hermit-abi"
@ -1068,11 +1074,11 @@ dependencies = [

 [[package]]
 name = "mycelium"
-version = "0.4.3"
+version = "0.4.5"
 dependencies = [
 "aes-gcm",
 "axum",
- "base64",
+ "base64 0.22.0",
 "blake2",
 "blake3",
 "bytes",
@ -1120,14 +1126,14 @@ dependencies = [

 [[package]]
 name = "netlink-packet-route"
-version = "0.17.1"
+version = "0.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "053998cea5a306971f88580d0829e90f270f940befd7cf928da179d4187a5a66"
+checksum = "74c171cd77b4ee8c7708da746ce392440cb7bcf618d122ec9ecc607b12938bf4"
 dependencies = [
 "anyhow",
- "bitflags 1.3.2",
 "byteorder",
 "libc",
+ "log",
 "netlink-packet-core",
 "netlink-packet-utils",
 ]
@ -1174,9 +1180,9 @@ dependencies = [

 [[package]]
 name = "network-interface"
-version = "1.1.1"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d68759ef97fe9c9e46f79ea8736c19f1d28992e24c8dc8ce86752918bfeaae7"
+checksum = "8ee524f98ddbe7772762a7477cfb22356df075cac4069bf81ac5082a46db742c"
 dependencies = [
 "cc",
 "libc",
@ -1184,17 +1190,6 @@ dependencies = [
 "winapi",
 ]

-[[package]]
-name = "nix"
-version = "0.26.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "598beaf3cc6fdd9a5dfb1630c2800c7acd31df7aaf0f565796fba2b53ca1af1b"
-dependencies = [
- "bitflags 1.3.2",
- "cfg-if",
- "libc",
-]
-
 [[package]]
 name = "nix"
 version = "0.27.1"
@ -1278,7 +1273,7 @@ version = "3.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b8fcc794035347fb64beda2d3b462595dd2753e3f268d89c5aae77e8cf2c310"
 dependencies = [
- "base64",
+ "base64 0.21.7",
 "serde",
 ]

@ -1517,7 +1512,7 @@ version = "0.11.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "37b1ae8d9ac08420c66222fb9096fc5de435c3c48542bc5336c51892cffafb41"
 dependencies = [
- "base64",
+ "base64 0.21.7",
 "bytes",
 "encoding_rs",
 "futures-core",
@ -1577,9 +1572,9 @@ dependencies = [

 [[package]]
 name = "rtnetlink"
-version = "0.13.1"
+version = "0.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a552eb82d19f38c3beed3f786bd23aa434ceb9ac43ab44419ca6d67a7e186c0"
+checksum = "b684475344d8df1859ddb2d395dd3dac4f8f3422a1aa0725993cb375fc5caba5"
 dependencies = [
 "futures",
 "log",
@ -1588,7 +1583,7 @@ dependencies = [
 "netlink-packet-utils",
 "netlink-proto",
 "netlink-sys",
- "nix 0.26.4",
+ "nix 0.27.1",
 "thiserror",
 "tokio",
 ]
@ -1801,9 +1796,9 @@ checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"

 [[package]]
 name = "strsim"
-version = "0.10.0"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
+checksum = "5ee073c9e4cd00e28217186dbe12796d692868f432bf2e97ee73bed0c56dfa01"

 [[package]]
 name = "subtle"
@ -1963,9 +1958,9 @@ dependencies = [

 [[package]]
 name = "tokio-stream"
-version = "0.1.14"
+version = "0.1.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "397c988d37662c7dda6d2208364a706264bf3d6138b11d436cbac0ad38832842"
+checksum = "267ac89e0bec6e691e5813911606935d77c476ff49024f98abcea3e7b15e37af"
 dependencies = [
 "futures-core",
 "pin-project-lite",
@ -2001,9 +1996,9 @@ dependencies = [

 [[package]]
 name = "toml"
-version = "0.8.10"
+version = "0.8.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a9aad4a3066010876e8dcf5a8a06e70a558751117a145c6ce2b82c2e2054290"
+checksum = "e9dd1545e8208b4a5af1aa9bbd0b4cf7e9ea08fabc5d0a5c67fcaafa17433aa3"
 dependencies = [
 "serde",
 "serde_spanned",
@ -2022,9 +2017,9 @@ dependencies = [

 [[package]]
 name = "toml_edit"
-version = "0.22.6"
+version = "0.22.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c1b5fd4128cc8d3e0cb74d4ed9a9cc7c7284becd4df68f5f940e1ad123606f6"
+checksum = "c12219811e0c1ba077867254e5ad62ee2c9c190b0d957110750ac0cda1ae96cd"
 dependencies = [
 "indexmap",
 "serde",
--- a/pkgs/by-name/my/mycelium/package.nix
+++ b/pkgs/by-name/my/mycelium/package.nix
@ -7,13 +7,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "mycelium";
-  version = "0.4.3";
+  version = "0.4.5";

  src = fetchFromGitHub {
    owner = "threefoldtech";
    repo = "mycelium";
    rev = "v${version}";
-    hash = "sha256-bA3ci+vqXBCPBaxMvfUdFcqdaZbAw/+r5UbH/as/fnc=";
+    hash = "sha256-AJA1yd7P9zHOIdSOR2bAHgL5NyoyqzgNIEs8ObgD4Mo=";
  };

  cargoLock = {
--- a/pkgs/by-name/pd/pdf4qt/find_lcms2_path.patch
+++ b/pkgs/by-name/pd/pdf4qt/find_lcms2_path.patch
@ -0,0 +1,21 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 98752ec..aa029b3 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -55,7 +55,15 @@ endif()
+ qt_standard_project_setup()
+ 
+ find_package(OpenSSL REQUIRED)
+-find_package(lcms REQUIRED)
+SET(LCMS2_NAMES ${LCMS2_NAMES} lcms2 liblcms2 liblcms2_static)
+FIND_LIBRARY(LCMS2_LIBRARY NAMES ${LCMS2_NAMES} )
+FIND_PATH(LCMS2_INCLUDE_DIR lcms2.h)
+add_library(lcms2::lcms2 UNKNOWN IMPORTED)
+set_target_properties(lcms2::lcms2 PROPERTIES
+    IMPORTED_LOCATION ${LCMS2_LIBRARY}
+    INTERFACE_INCLUDE_DIRECTORIES ${LCMS2_INCLUDE_DIR}
+    INTERFACE_COMPILE_DEFINITIONS "HAVE_LCMS2=1;CMS_NO_REGISTER_KEYWORD=1")
+set_property(GLOBAL APPEND PROPERTY INTERNAL_DEPS_PROP lcms2::lcms2)
+ find_package(ZLIB REQUIRED)
+ find_package(Freetype REQUIRED)
+ find_package(OpenJPEG CONFIG REQUIRED)
--- a/pkgs/by-name/pd/pdf4qt/package.nix
+++ b/pkgs/by-name/pd/pdf4qt/package.nix
@ -0,0 +1,67 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, substituteAll
+, lcms
+, cmake
+, pkg-config
+, qt6
+, openjpeg
+, tbb_2021_8
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "pdf4qt";
+  version = "1.3.7";
+
+  src = fetchFromGitHub {
+    owner = "JakubMelka";
+    repo = "PDF4QT";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-wZJDMLEaHGBPSToQ+ObSfB5tw/fTIX1i5tmNPmIa7Ck=";
+  };
+
+  patches = [
+    # lcms2 cmake module only appears when built with vcpkg.
+    # We directly search for the corresponding libraries and
+    # header files instead.
+    ./find_lcms2_path.patch
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    qt6.qttools
+    qt6.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    qt6.qtbase
+    qt6.qtwayland
+    qt6.qtsvg
+    qt6.qtspeech
+    lcms
+    openjpeg
+    tbb_2021_8
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "PDF4QT_INSTALL_TO_USR" false)
+  ];
+
+  meta = {
+    description = "Open source PDF editor";
+    longDescription = ''
+      This software is consisting of PDF rendering library,
+      and several applications, such as advanced document
+      viewer, command line tool, and document page
+      manipulator application. Software is implementing PDF
+      functionality based on PDF Reference 2.0.
+    '';
+    homepage = "https://jakubmelka.github.io";
+    license = lib.licenses.lgpl3Only;
+    mainProgram = "Pdf4QtViewerLite";
+    maintainers = with lib.maintainers; [ aleksana ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/pg/pgmoneta/package.nix
+++ b/pkgs/by-name/pg/pgmoneta/package.nix
@ -19,13 +19,13 @@

 stdenv.mkDerivation rec {
  pname = "pgmoneta";
-  version = "0.9.0";
+  version = "0.10.0";

  src = fetchFromGitHub {
    owner = "pgmoneta";
    repo = "pgmoneta";
    rev = version;
-    hash = "sha256-KVweAsmAQGUkBAxR7gPJe6mygfG7xApvJFRiCbSFq9E=";
+    hash = "sha256-wNBomyyr078Twzg7fuu3et1NUxpb+vqIbsnpmF73t18=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/pot/Cargo.lock
+++ b/pkgs/applications/misc/pot/Cargo.lock
@ -2791,9 +2791,9 @@ dependencies = [

 [[package]]
 name = "lingua"
-version = "1.6.1"
+version = "1.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73989d32b4cd00a69e78d979203fa3b87e43fae0236a29544331c2ccfa180fdd"
+checksum = "d109aef84956f04b8b5866db17e59f964152411915ad27b6e291b262d63a442c"
 dependencies = [
 "ahash",
 "brotli",
@ -2821,6 +2821,7 @@ dependencies = [
 "lingua-spanish-language-model",
 "lingua-thai-language-model",
 "lingua-turkish-language-model",
+ "lingua-ukrainian-language-model",
 "lingua-vietnamese-language-model",
 "maplit",
 "once_cell",
@ -3014,6 +3015,15 @@ dependencies = [
 "include_dir",
 ]

+[[package]]
+name = "lingua-ukrainian-language-model"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14ed035dd4b7ec5f76fe3b07e5f499d76c4cdb2a6d275459e4cdd3a3d21f131a"
+dependencies = [
+ "include_dir",
+]
+
 [[package]]
 name = "lingua-vietnamese-language-model"
 version = "1.1.0"
@ -3582,9 +3592,9 @@ dependencies = [

 [[package]]
 name = "once_cell"
-version = "1.18.0"
+version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
+checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"

 [[package]]
 name = "open"
@ -4650,9 +4660,9 @@ dependencies = [

 [[package]]
 name = "serde-wasm-bindgen"
-version = "0.6.1"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17ba92964781421b6cef36bf0d7da26d201e96d84e1b10e7ae6ed416e516906d"
+checksum = "4c1432112bce8b966497ac46519535189a3250a3812cd27a999678a69756f79f"
 dependencies = [
 "js-sys",
 "serde",
--- a/pkgs/applications/misc/pot/default.nix
+++ b/pkgs/applications/misc/pot/default.nix
@ -24,13 +24,13 @@

 stdenv.mkDerivation rec {
  pname = "pot";
-  version = "2.7.4";
+  version = "2.7.9";

  src = fetchFromGitHub {
    owner = "pot-app";
    repo = "pot-desktop";
    rev = version;
-    hash = "sha256-c7FHkp/utvrr7qasY+XKaTnPaiZWb8M5EGiFne52osQ=";
+    hash = "sha256-Y2gFLvRNBjOGxdpIeoY1CXEip0Ht73aymWIP5wuc9kU=";
  };

  sourceRoot = "${src.name}/src-tauri";
@ -68,7 +68,7 @@ stdenv.mkDerivation rec {

    dontFixup = true;
    outputHashMode = "recursive";
-    outputHash = "sha256-BQ5M+pKEXGJzWmxMchNgxpvLpgFCRIg33GQCvO4TLz4=";
+    outputHash = "sha256-LuY5vh642DgSa91eUcA/AT+ovDcP9tZFE2dKyicCOeQ=";
  };

  cargoDeps = rustPlatform.importCargoLock {
--- a/pkgs/by-name/ra/railway-travel/package.nix
+++ b/pkgs/by-name/ra/railway-travel/package.nix
@ -0,0 +1,76 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  cargo,
+  desktop-file-utils,
+  meson,
+  ninja,
+  pkg-config,
+  rustPlatform,
+  rustc,
+  wrapGAppsHook4,
+  cairo,
+  gdk-pixbuf,
+  glib,
+  gtk4,
+  libadwaita,
+  pango,
+  darwin,
+}:
+stdenv.mkDerivation rec {
+  pname = "railway-travel";
+  version = "2.4.0";
+
+  src = fetchFromGitLab {
+    owner = "schmiddi-on-mobile";
+    repo = "railway";
+    rev = version;
+    hash = "sha256-2iLxErEP0OG+BcG7fvJBzNjh95EkNoC3NC7rKxPLhYk=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-yalFC7Pw9rq1ylLwoxLi4joTyjQsZJ/ZC61GhTNc49w=";
+  };
+
+  nativeBuildInputs = [
+    desktop-file-utils
+    cargo
+    meson
+    ninja
+    pkg-config
+    rustPlatform.cargoSetupHook
+    rustc
+    wrapGAppsHook4
+  ];
+
+  buildInputs =
+    [
+      cairo
+      gdk-pixbuf
+      glib
+      gtk4
+      libadwaita
+      pango
+    ]
+    ++ lib.optionals stdenv.isDarwin [
+      darwin.apple_sdk.frameworks.Foundation
+      darwin.apple_sdk.frameworks.Security
+    ];
+
+  env.NIX_CFLAGS_COMPILE = toString (
+    lib.optionals stdenv.cc.isClang [ "-Wno-error=incompatible-function-pointer-types" ]
+  );
+
+  meta = with lib; {
+    description = "Find all your travel information";
+    homepage = "https://gitlab.com/schmiddi-on-mobile/railway";
+    changelog = "https://gitlab.com/schmiddi-on-mobile/railway/-/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ lilacious ];
+    mainProgram = "diebahn";
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/by-name/se/sesh/package.nix
+++ b/pkgs/by-name/se/sesh/package.nix
@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
  pname = "sesh";
-  version = "0.15.0";
+  version = "1.0.1";

  src = fetchFromGitHub {
    owner = "joshmedeski";
    repo = "sesh";
    rev = "v${version}";
-    hash = "sha256-vV1b0YhDBt/dJJCrxvVV/FIuOIleTg4mI496n4/Y/Hk=";
+    hash = "sha256-eFqqiGIbS9HW7czAtSIPmvbynvg2gsu4luKsL25vxn4=";
  };

  vendorHash = "sha256-zt1/gE4bVj+3yr9n0kT2FMYMEmiooy3k1lQ77rN6sTk=";
--- a/pkgs/by-name/ti/tinymist/package.nix
+++ b/pkgs/by-name/ti/tinymist/package.nix
@ -11,6 +11,8 @@

 rustPlatform.buildRustPackage rec {
  pname = "tinymist";
+  # Please update the corresponding vscode extension when updating
+  # this derivation.
  version = "0.11.1";

  src = fetchFromGitHub {
--- a/pkgs/by-name/tl/tlrc/package.nix
+++ b/pkgs/by-name/tl/tlrc/package.nix
@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "tlrc";
-  version = "1.9.0";
+  version = "1.9.1";

  src = fetchFromGitHub {
    owner = "tldr-pages";
    repo = "tlrc";
    rev = "v${version}";
-    hash = "sha256-SoWGZXBAqWWg5kwwpWuiA7iGqq9RNok/LqsjPAy6O+k=";
+    hash = "sha256-RzGw4rvak055V48bkeuzKAH6F/wlFMLya8Ny3mgU+H4=";
  };

-  cargoHash = "sha256-+HxRu8t6nofeE9WrDxQhebWIgeMYeMSXnHtHR1OHGzw=";
+  cargoHash = "sha256-BbBt6oCO9y++EWx9/CXISGfB/FEcEPKYeXNXcejevrg=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/tr/treedome/package.nix
+++ b/pkgs/by-name/tr/treedome/package.nix
@ -19,12 +19,12 @@

 let
  pname = "treedome";
-  version = "0.4.3";
+  version = "0.4.5";

  src = fetchgit {
    url = "https://codeberg.org/solver-orgz/treedome";
    rev = version;
-    hash = "sha256-FBzRsBoV3wnt2nu5WMnaTnBNC51jG120E0Orm55KhBg=";
+    hash = "sha256-YkyjG/ee5WeO5OD4FZnWaqcOJO3YC0uQkbwGkCNBxC8=";
    fetchLFS = true;
  };

--- a/pkgs/by-name/ty/typstyle/package.nix
+++ b/pkgs/by-name/ty/typstyle/package.nix
@ -0,0 +1,46 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, libgit2
+, zlib
+, stdenv
+, darwin
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "typstyle";
+  version = "0.11.5";
+
+  src = fetchFromGitHub {
+    owner = "Enter-tainer";
+    repo = "typstyle";
+    rev = "v${version}";
+    hash = "sha256-jAsKktTgvmZ4NKr1QpJPYjI2HRSw8CPBfJTETVyiRhg=";
+  };
+
+  cargoHash = "sha256-oLJWgF5byM3sY3Bs/wpSrBqjNg4sHDF3RIsWZBiguGI=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    libgit2
+    zlib
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.CoreFoundation
+    darwin.apple_sdk.frameworks.CoreServices
+    darwin.apple_sdk.frameworks.Security
+    darwin.apple_sdk.frameworks.SystemConfiguration
+  ];
+
+  meta = {
+    changelog = "https://github.com/Enter-tainer/typstyle/blob/${src.rev}/CHANGELOG.md";
+    description = "Format your typst source code";
+    homepage = "https://github.com/Enter-tainer/typstyle";
+    license = lib.licenses.asl20;
+    mainProgram = "typstyle";
+    maintainers = with lib.maintainers; [ drupol ];
+  };
+}
--- a/pkgs/by-name/wy/wyoming-satellite/package.nix
+++ b/pkgs/by-name/wy/wyoming-satellite/package.nix
@ -0,0 +1,60 @@
+{ lib
+, python3Packages
+, fetchFromGitHub
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "wyoming-satellite";
+  version = "1.2.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "rhasspy";
+    repo = "wyoming-satellite";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-KIWhWE9Qaxs72fJ1LRTkvk6QtpBJOFlmZv2od69O15g=";
+  };
+
+  nativeBuildInputs = with python3Packages; [
+    setuptools
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "zeroconf"
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    pyring-buffer
+    wyoming
+    zeroconf
+  ];
+
+  passthru.optional-dependencies = {
+    silerovad = with python3Packages; [
+      pysilero-vad
+    ];
+    webrtc = with python3Packages; [
+      webrtc-noise-gain
+    ];
+  };
+
+  pythonImportsCheck = [
+    "wyoming_satellite"
+  ];
+
+  nativeCheckInputs = with python3Packages; [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+
+  meta = with lib; {
+    description = "Remote voice satellite using Wyoming protocol";
+    homepage = "https://github.com/rhasspy/wyoming-satellite";
+    changelog = "https://github.com/rhasspy/wyoming-satellite/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ hexa ];
+    mainProgram = "wyoming-satellite";
+  };
+}
--- a/pkgs/by-name/zi/zircolite/package.nix
+++ b/pkgs/by-name/zi/zircolite/package.nix
@ -6,23 +6,23 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "zircolite";
-  version = "2.10.0";
+  version = "2.20.0";
  format = "other";

  src = fetchFromGitHub {
    owner = "wagga40";
    repo = "Zircolite";
    rev = "refs/tags/${version}";
-    hash = "sha256-r5MIoP+6CnAGsOtK4YLshLBVSZN2NVrwnkuHHDdLZrQ=";
+    hash = "sha256-a7xwF0amsh2SycOjtZpk3dylcBGG9uYd7vmbnz/f9Ug=";
  };

  __darwinAllowLocalNetworking = true;

-  nativeBuildInputs = [
+  build-system = [
    makeWrapper
  ];

-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3.pkgs; [
    aiohttp
    colorama
    elastic-transport
--- a/pkgs/data/fonts/google-fonts/default.nix
+++ b/pkgs/data/fonts/google-fonts/default.nix
@ -40,12 +40,10 @@ stdenvNoCC.mkDerivation {

  dontBuild = true;

-  # The font files are in the fonts directory and use two naming schemes:
-  # FamilyName-StyleName.ttf and FamilyName[param1,param2,...].ttf
-  # This installs all fonts if fonts is empty and otherwise only
-  # the specified fonts by FamilyName. To do this, it invokes
-  # `find` 2 times for every font, anyone is free to do this
-  # in a more efficient way.
+  # The font files are in the fonts directory and use three naming schemes:
+  # FamilyName-StyleName.ttf, FamilyName[param1,param2,...].ttf, and
+  # FamilyName.ttf. This installs all fonts if fonts is empty and otherwise
+  # only the specified fonts by FamilyName.
  fonts = map (font: builtins.replaceStrings [" "] [""] font) fonts;
  installPhase = ''
    adobeBlankDest=$adobeBlank/share/fonts/truetype
@ -56,8 +54,7 @@ stdenvNoCC.mkDerivation {
    find . -name '*.ttf' -exec install -m 444 -Dt $dest '{}' +
  '' else ''
    for font in $fonts; do
-      find . -name "$font-*.ttf" -exec install -m 444 -Dt $dest '{}' +
-      find . -name "$font[*.ttf" -exec install -m 444 -Dt $dest '{}' +
+      find . \( -name "$font-*.ttf" -o -name "$font[*.ttf" -o -name "$font.ttf" \) -exec install -m 444 -Dt $dest '{}' +
    done
  '');

--- a/pkgs/desktops/pantheon/desktop/elementary-session-settings/default.nix
+++ b/pkgs/desktops/pantheon/desktop/elementary-session-settings/default.nix
@ -72,7 +72,7 @@ let
    export XDG_DATA_DIRS=@out@/share:$XDG_DATA_DIRS

    # Start pantheon session. Keep in sync with upstream
-    exec ${gnome-session}/bin/gnome-session --builtin --session=pantheon "$@"
+    exec ${gnome-session}/bin/gnome-session --session=pantheon "$@"
  '';

  # Absolute path patched version of the upstream xsession
--- a/pkgs/desktops/pantheon/desktop/gala/default.nix
+++ b/pkgs/desktops/pantheon/desktop/gala/default.nix
@ -70,6 +70,9 @@ stdenv.mkDerivation rec {
  postPatch = ''
    chmod +x build-aux/meson/post_install.py
    patchShebangs build-aux/meson/post_install.py
+
+    # https://github.com/elementary/gala/issues/1826#issuecomment-1890461298
+    sed '2i Wants=io.elementary.gala.daemon@.service' -i 'data/gala@x11.service.in'
  '';

  passthru = {
--- a/pkgs/development/compilers/dotnet/common.nix
+++ b/pkgs/development/compilers/dotnet/common.nix
@ -4,6 +4,8 @@
 , writeText
 , testers
 , runCommand
+, expect
+, curl
 }: type: args: stdenv.mkDerivation (finalAttrs: args // {
  doInstallCheck = true;

@ -27,37 +29,97 @@

 } // lib.optionalAttrs (type == "sdk") {
  passthru = {
-    tests = {
+    tests = let
+      mkDotnetTest =
+        {
+          name,
+          template,
+          usePackageSource ? false,
+          build,
+          # TODO: use correct runtimes instead of sdk
+          runtime ? finalAttrs.finalPackage,
+          runInputs ? [],
+          run ? null,
+        }:
+        let
+          built = runCommand "dotnet-test-${name}" { buildInputs = [ finalAttrs.finalPackage ]; } (''
+            HOME=$PWD/.home
+            dotnet new nugetconfig
+            dotnet nuget disable source nuget
+          '' + lib.optionalString usePackageSource ''
+            dotnet nuget add source ${finalAttrs.finalPackage.packages}
+          '' + ''
+            dotnet new ${template} -n test -o .
+          '' + build);
+        in
+          if run == null
+            then build
+          else
+            runCommand "${built.name}-run" { src = built; nativeBuildInputs = runInputs; } (
+              lib.optionalString (runtime != null) ''
+                # TODO: use runtime here
+                export DOTNET_ROOT=${runtime}
+              '' + run);
+
+      checkConsoleOutput = command: ''
+        output="$(${command})"
+        # yes, older SDKs omit the comma
+        [[ "$output" =~ Hello,?\ World! ]] && touch "$out"
+      '';
+
+    in {
      version = testers.testVersion {
        package = finalAttrs.finalPackage;
      };

-      console = runCommand "dotnet-test-console" {
-        nativeBuildInputs = [ finalAttrs.finalPackage ];
-      } ''
-        HOME=$(pwd)/fake-home
-        dotnet new nugetconfig
-        dotnet nuget disable source nuget
-        dotnet new console -n test -o .
-        output="$(dotnet run)"
-        # yes, older SDKs omit the comma
-        [[ "$output" =~ Hello,?\ World! ]] && touch "$out"
-      '';
+      console = mkDotnetTest {
+        name = "console";
+        template = "console";
+        build = checkConsoleOutput "dotnet run";
+      };

-      single-file = let build = runCommand "dotnet-test-build-single-file" {
-        nativeBuildInputs = [ finalAttrs.finalPackage ];
-      } ''
-        HOME=$(pwd)/fake-home
-        dotnet new nugetconfig
-        dotnet nuget disable source nuget
-        dotnet nuget add source ${finalAttrs.finalPackage.packages}
-        dotnet new console -n test -o .
-        dotnet publish --use-current-runtime -p:PublishSingleFile=true -o $out
-      ''; in runCommand "dotnet-test-run-single-file" {} ''
-        output="$(${build}/test)"
-        # yes, older SDKs omit the comma
-        [[ "$output" =~ Hello,?\ World! ]] && touch "$out"
-      '';
+      publish = mkDotnetTest {
+        name = "publish";
+        template = "console";
+        build = "dotnet publish -o $out";
+        run = checkConsoleOutput "$src/test";
+      };
+
+      single-file = mkDotnetTest {
+        name = "single-file";
+        template = "console";
+        usePackageSource = true;
+        build = "dotnet publish --use-current-runtime -p:PublishSingleFile=true -o $out";
+        runtime = null;
+        run = checkConsoleOutput "$src/test";
+      };
+
+      web = mkDotnetTest {
+        name = "publish";
+        template = "web";
+        build = "dotnet publish -o $out";
+        runInputs = [ expect curl ];
+        run = ''
+          expect <<"EOF"
+            set status 1
+            spawn $env(src)/test
+            expect_before default abort
+            expect -re {Now listening on: ([^\r]+)\r} {
+              set url $expect_out(1,string)
+            }
+            expect "Application started. Press Ctrl+C to shut down."
+            set output [exec curl -sSf $url]
+            if {$output != "Hello World!"} {
+              send_error "Unexpected output: $output\n"
+              exit 1
+            }
+            send \x03
+            catch wait result
+            exit [lindex $result 3]
+          EOF
+          touch $out
+        '';
+      };
    } // args.passthru.tests or {};
  } // args.passthru or {};
 })
--- a/pkgs/development/compilers/idris2/build-idris.nix
+++ b/pkgs/development/compilers/idris2/build-idris.nix
@ -32,28 +32,34 @@ let
    "idrisLibraries"
  ];

-  sharedAttrs = drvAttrs // {
-    pname = ipkgName;
-    inherit version;
-    src = src;
-    nativeBuildInputs = [ idris2 makeWrapper ] ++ attrs.nativeBuildInputs or [];
-    buildInputs = propagatedIdrisLibraries ++ attrs.buildInputs or [];
+  derivation = stdenv.mkDerivation (finalAttrs:
+    drvAttrs // {
+      pname = ipkgName;
+      inherit version;
+      src = src;
+      nativeBuildInputs = [ idris2 makeWrapper ] ++ attrs.nativeBuildInputs or [];
+      buildInputs = propagatedIdrisLibraries ++ attrs.buildInputs or [];

-    IDRIS2_PACKAGE_PATH = libDirs;
+      IDRIS2_PACKAGE_PATH = libDirs;

-    buildPhase = ''
-      runHook preBuild
-      idris2 --build ${ipkgFileName}
-      runHook postBuild
-    '';
+      buildPhase = ''
+        runHook preBuild
+        idris2 --build ${ipkgFileName}
+        runHook postBuild
+      '';

-    passthru = {
-      inherit propagatedIdrisLibraries;
-    };
-  };
+      passthru = {
+        inherit propagatedIdrisLibraries;
+      };
+
+      shellHook = ''
+        export IDRIS2_PACKAGE_PATH="${finalAttrs.IDRIS2_PACKAGE_PATH}"
+      '';
+    }
+  );

 in {
-  executable = stdenv.mkDerivation (sharedAttrs // {
+  executable = derivation.overrideAttrs {
    installPhase = ''
      runHook preInstall
      mkdir -p $out/bin
@ -76,11 +82,11 @@ in {
      fi
      runHook postInstall
    '';
-  });
+  };

  library = { withSource ? false }:
    let installCmd = if withSource then "--install-with-src" else "--install";
-    in stdenv.mkDerivation (sharedAttrs // {
+    in derivation.overrideAttrs {
      installPhase = ''
        runHook preInstall
        mkdir -p $out/${libSuffix}
@ -88,5 +94,5 @@ in {
        idris2 ${installCmd} ${ipkgFileName}
        runHook postInstall
      '';
-    });
+    };
 }
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@ -14,15 +14,10 @@ let
    # https://github.com/openembedded/openembedded-core/blob/a5440d4288e09d3e/meta/recipes-devtools/vala/vala/disable-graphviz.patch
    graphvizPatch =
      {
-        "0.48" = ./disable-graphviz-0.46.1.patch;
-
-        "0.54" = ./disable-graphviz-0.46.1.patch;
-
        "0.56" = ./disable-graphviz-0.56.8.patch;
-
      }.${lib.versions.majorMinor version} or (throw "no graphviz patch for this version of vala");

-    disableGraphviz = lib.versionAtLeast version "0.38" && !withGraphviz;
+    disableGraphviz = !withGraphviz;

  in stdenv.mkDerivation rec {
    pname = "vala";
@ -55,14 +50,14 @@ let

    nativeBuildInputs = [
      pkg-config flex bison libxslt
-    ] ++ lib.optional (stdenv.isDarwin && (lib.versionAtLeast version "0.38")) expat
+    ] ++ lib.optional (stdenv.isDarwin) expat
      ++ lib.optional disableGraphviz autoreconfHook # if we changed our ./configure script, need to reconfigure
      ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [ vala ]
      ++ extraNativeBuildInputs;

    buildInputs = [
      glib libiconv libintl
-    ] ++ lib.optional (lib.versionAtLeast version "0.38" && withGraphviz) graphviz
+    ] ++ lib.optional (withGraphviz) graphviz
      ++ extraBuildInputs;

    enableParallelBuilding = true;
@ -90,16 +85,6 @@ let
  });

 in rec {
-  vala_0_48 = generic {
-    version = "0.48.25";
-    sha256 = "UMs8Xszdx/1DaL+pZBSlVgReedKxWmiRjHJ7jIOxiiQ=";
-  };
-
-  vala_0_54 = generic {
-    version = "0.54.9";
-    sha256 = "hXLA6Nd9eMFZfVFgCPBUDH50leA10ou0wlzJk+U85LQ=";
-  };
-
  vala_0_56 = generic {
    version = "0.56.14";
    sha256 = "k4LCaMqb3AKq7cgVKpgYvzk1JzBB9inFbeQQ42Cj9Vc=";
--- a/pkgs/development/compilers/vala/disable-graphviz-0.46.1.patch
+++ b/pkgs/development/compilers/vala/disable-graphviz-0.46.1.patch
@ -1,280 +0,0 @@
-diff --git a/Makefile.am b/Makefile.am
-index f70234759..b3d6c3833 100644
--- a/Makefile.am
-+++ b/Makefile.am
-@@ -13,19 +13,9 @@ SUBDIRS = \
- 	doc \
- 	gobject-introspection \
- 	vapigen \
-	$(NULL)
-
-if ENABLE_VALADOC
-SUBDIRS += \
- 	libvaladoc \
- 	valadoc \
- 	$(NULL)
-endif
-
-DISTCHECK_CONFIGURE_FLAGS = \
-	--enable-valadoc \
-	--enable-unversioned \
-	$(NULL)
- 
- if ENABLE_UNVERSIONED
- aclocaldir = $(datadir)/aclocal
-diff --git a/configure.ac b/configure.ac
-index 6de326bbb..91f159b16 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -160,10 +160,11 @@ AC_SUBST(GMODULE_CFLAGS)
- AC_SUBST(GMODULE_LIBS)
- 
- AC_ARG_WITH(cgraph, AS_HELP_STRING([--with-cgraph], [Required flag for cross-compilation to define capability of graphviz]), [], with_cgraph=check)
-AC_ARG_ENABLE(valadoc, AS_HELP_STRING([--disable-valadoc], [Disable valadoc]), enable_valadoc=$enableval, enable_valadoc=yes)
-if test x$enable_valadoc = xyes; then
-+AC_ARG_ENABLE(graphviz, AS_HELP_STRING([--disable-graphviz], [Disable graphviz usage for valadoc]), enable_graphviz=$enableval, enable_graphviz=yes)
-+if test x$enable_graphviz = xyes; then
- 	PKG_CHECK_MODULES(LIBGVC, libgvc >= $LIBGVC_REQUIRED)
- 	AC_MSG_CHECKING([for CGRAPH])
-+	VALAFLAGS="$VALAFLAGS -D HAVE_GRAPHVIZ"
- 	cgraph_tmp_LIBADD="$LIBADD"
- 	cgraph_tmp_CFLAGS="$CFLAGS"
- 	LIBADD="$LIBADD $LIBGVC_LIBS"
-@@ -201,8 +202,8 @@ if test x$enable_valadoc = xyes; then
- 	LIBADD="$cgraph_tmp_LIBADD"
- 	CFLAGS="$cgraph_tmp_CFLAGS"
- fi
-+AM_CONDITIONAL(ENABLE_GRAPHVIZ, test x$enable_graphviz = xyes)
- AM_CONDITIONAL(HAVE_CGRAPH, test "$have_cgraph" = "yes")
-AM_CONDITIONAL(ENABLE_VALADOC, test x$enable_valadoc = xyes)
- 
- AC_PATH_PROG([XSLTPROC], [xsltproc], :)
- AM_CONDITIONAL(HAVE_XSLTPROC, test "$XSLTPROC" != :)
-diff --git a/doc/Makefile.am b/doc/Makefile.am
-index d2684a0e0..b343c7c10 100644
--- a/doc/Makefile.am
-+++ b/doc/Makefile.am
-@@ -6,16 +6,11 @@ SUBDIRS = \
- 
- dist_man_MANS = \
- 	valac.1 \
-+	valadoc.1 \
- 	vala-gen-introspect.1 \
- 	vapigen.1 \
- 	$(NULL)
- 
-if ENABLE_VALADOC
-dist_man_MANS += \
-	valadoc.1 \
-	$(NULL)
-endif
-
- EXTRA_DIST = \
- 	valac.h2m \
- 	valadoc.h2m \
-@@ -24,11 +19,7 @@ EXTRA_DIST = \
- 	$(NULL)
- 
- if HAVE_HELP2MAN
-if ENABLE_VALADOC
- manpages: valac.1 valadoc.1 vala-gen-introspect.1 vapigen.1
-else
-manpages: valac.1 vala-gen-introspect.1 vapigen.1
-endif
- 	@rm $^
- 	$(MAKE) $(AM_MAKEFLAGS) $^
- 
-@@ -37,13 +28,11 @@ valac.1:
- 		--include $(srcdir)/valac.h2m \
- 		--libtool --no-info \
- 		--output=$@
-if ENABLE_VALADOC
- valadoc.1:
- 	$(HELP2MAN) $(top_builddir)/valadoc/valadoc \
- 		--include $(srcdir)/valadoc.h2m \
- 		--libtool --no-info \
- 		--output=$@
-endif
- vala-gen-introspect.1:
- 	$(HELP2MAN) $(top_builddir)/gobject-introspection/gen-introspect \
- 		--include $(srcdir)/vala-gen-introspect.h2m \
-@@ -60,15 +49,12 @@ endif
- if ENABLE_UNVERSIONED
- install-data-hook:
- 	cd $(DESTDIR)$(man1dir) && $(LN_S) -f valac@PACKAGE_SUFFIX@.1 valac.1
-if ENABLE_VALADOC
- 	cd $(DESTDIR)$(man1dir) && $(LN_S) -f valadoc@PACKAGE_SUFFIX@.1 valadoc.1
-endif
- 	cd $(DESTDIR)$(man1dir) && $(LN_S) -f vala-gen-introspect@PACKAGE_SUFFIX@.1 vala-gen-introspect.1
- 	cd $(DESTDIR)$(man1dir) && $(LN_S) -f vapigen@PACKAGE_SUFFIX@.1 vapigen.1
- endif
- 
- 
-if ENABLE_VALADOC
- COMMON_VALADOCFLAGS = \
- 	--force \
- 	--verbose \
-@@ -150,7 +136,6 @@ internal-apis/valadoc: $(valadoc_VALASOURCES) internal-apis/codegen
- 	@touch $@
- 
- internal-api-docs: internal-apis/gee internal-apis/vala internal-apis/ccode internal-apis/codegen internal-apis/valadoc
-endif
- 
- clean-local:
- 	rm -rf $(builddir)/internal-apis
-diff --git a/libvaladoc/Makefile.am b/libvaladoc/Makefile.am
-index 8a3924b54..81fde9ac8 100644
--- a/libvaladoc/Makefile.am
-+++ b/libvaladoc/Makefile.am
-@@ -119,10 +119,6 @@ libvaladoc_la_VALASOURCES = \
- 	content/tablerow.vala \
- 	content/taglet.vala \
- 	content/text.vala \
-	charts/chart.vala \
-	charts/chartfactory.vala \
-	charts/hierarchychart.vala \
-	charts/simplechartfactory.vala \
- 	parser/manyrule.vala \
- 	parser/oneofrule.vala \
- 	parser/optionalrule.vala \
-@@ -149,13 +145,24 @@ libvaladoc_la_VALASOURCES = \
- 	highlighter/codetoken.vala \
- 	highlighter/highlighter.vala \
- 	html/basicdoclet.vala \
-	html/htmlchartfactory.vala \
- 	html/linkhelper.vala \
- 	html/cssclassresolver.vala \
- 	html/htmlmarkupwriter.vala \
- 	html/htmlrenderer.vala \
- 	$(NULL)
- 
-+if ENABLE_GRAPHVIZ
-+libvaladoc_la_VALASOURCES += \
-+	charts/chart.vala \
-+	charts/chartfactory.vala \
-+	charts/hierarchychart.vala \
-+	charts/simplechartfactory.vala \
-+	html/htmlchartfactory.vala \
-+	$(NULL)
-+
-+LIBGVC_PKG = --vapidir $(top_srcdir)/vapi --pkg libgvc
-+endif
-+
- libvaladoc@PACKAGE_SUFFIX@_la_SOURCES = \
- 	libvaladoc.vala.stamp \
- 	$(libvaladoc_la_VALASOURCES:.vala=.c) \
-@@ -175,11 +182,11 @@ libvaladoc.vala.stamp: $(libvaladoc_la_VALASOURCES)
- 		--library valadoc \
- 		--vapi valadoc@PACKAGE_SUFFIX@.vapi \
- 		--vapidir $(top_srcdir)/vapi --pkg gmodule-2.0 \
-		--vapidir $(top_srcdir)/vapi --pkg libgvc \
- 		--vapidir $(top_srcdir)/gee --pkg gee \
- 		--vapidir $(top_srcdir)/vala --pkg vala \
- 		--vapidir $(top_srcdir)/ccode --pkg ccode \
- 		--vapidir $(top_srcdir)/codegen --pkg codegen \
-+		$(LIBGVC_PKG) \
- 		--pkg config \
- 		$(filter %.vala %.c,$^)
- 	touch $@
-@@ -207,6 +214,9 @@ nodist_pkgconfig_DATA = valadoc@PACKAGE_SUFFIX@.pc
- 
- valadoc@PACKAGE_SUFFIX@.pc: valadoc.pc
- 	cp $< $@
-+if !ENABLE_GRAPHVIZ
-+	sed -i "s/libgvc //g" $@
-+endif
- 
- vapidir = $(datadir)/vala/vapi
- dist_vapi_DATA = valadoc@PACKAGE_SUFFIX@.vapi
-@@ -214,6 +224,9 @@ nodist_vapi_DATA = valadoc@PACKAGE_SUFFIX@.deps
- 
- valadoc@PACKAGE_SUFFIX@.deps: valadoc.deps
- 	cp $< $@
-+if !ENABLE_GRAPHVIZ
-+	sed -i "s/libgvc//g" $@
-+endif
- 
- EXTRA_DIST = \
- 	$(libvaladoc_la_VALASOURCES) \
-diff --git a/libvaladoc/html/basicdoclet.vala b/libvaladoc/html/basicdoclet.vala
-index 46578c28f..f6ce7097c 100644
--- a/libvaladoc/html/basicdoclet.vala
-+++ b/libvaladoc/html/basicdoclet.vala
-@@ -46,7 +46,11 @@ public abstract class Valadoc.Html.BasicDoclet : Api.Visitor, Doclet {
- 	protected HtmlRenderer _renderer;
- 	protected Html.MarkupWriter writer;
- 	protected Html.CssClassResolver cssresolver;
-+#if HAVE_GRAPHVIZ
- 	protected Charts.Factory image_factory;
-+#else
-+	protected void* image_factory;
-+#endif
- 	protected ErrorReporter reporter;
- 	protected string package_list_link = "../index.html";
- 
-@@ -120,7 +124,9 @@ public abstract class Valadoc.Html.BasicDoclet : Api.Visitor, Doclet {
- 		this.linker = new LinkHelper ();
- 
- 		_renderer = new HtmlRenderer (settings, this.linker, this.cssresolver);
-+#if HAVE_GRAPHVIZ
- 		this.image_factory = new SimpleChartFactory (settings, linker);
-+#endif
- 	}
- 
- 
-@@ -1025,6 +1031,7 @@ public abstract class Valadoc.Html.BasicDoclet : Api.Visitor, Doclet {
- 	}
- 
- 	protected void write_image_block (Api.Node element) {
-+#if HAVE_GRAPHVIZ
- 		if (element is Class || element is Interface || element is Struct) {
- 			unowned string format = (settings.use_svg_images ? "svg" : "png");
- 			var chart = new Charts.Hierarchy (image_factory, element);
-@@ -1044,6 +1051,7 @@ public abstract class Valadoc.Html.BasicDoclet : Api.Visitor, Doclet {
- 									   this.get_img_path_html (element, format)});
- 			writer.add_usemap (chart);
- 		}
-+#endif
- 	}
- 
- 	public void write_namespace_content (Namespace node, Api.Node? parent) {
-diff --git a/libvaladoc/html/htmlmarkupwriter.vala b/libvaladoc/html/htmlmarkupwriter.vala
-index 5aa4afdea..e79b0b8f5 100644
--- a/libvaladoc/html/htmlmarkupwriter.vala
-+++ b/libvaladoc/html/htmlmarkupwriter.vala
-@@ -51,12 +51,16 @@ public class Valadoc.Html.MarkupWriter : Valadoc.MarkupWriter {
- 		}
- 	}
- 
-+#if HAVE_GRAPHVIZ
- 	public unowned MarkupWriter add_usemap (Charts.Chart chart) {
- 		string? buf = (string?) chart.write_buffer ("cmapx");
- 		if (buf != null) {
- 			raw_text ("\n");
- 			raw_text ((!) buf);
- 		}
-+#else
-+	public unowned MarkupWriter add_usemap (void* chart) {
-+#endif
- 
- 		return this;
- 	}
-diff --git i/libvaladoc/Makefile.am w/libvaladoc/Makefile.am
-index 8dc398cf1..a5d8a45b4 100644
--- i/libvaladoc/Makefile.am
-+++ w/libvaladoc/Makefile.am
-@@ -176,9 +176,13 @@ endif
- libvaladoc@PACKAGE_SUFFIX@_la_SOURCES = \
- 	libvaladoc.vala.stamp \
- 	$(libvaladoc_la_VALASOURCES:.vala=.c) \
-	gvc-compat.c \
- 	$(NULL)
- 
-+if ENABLE_GRAPHVIZ
-+libvaladoc@PACKAGE_SUFFIX@_la_SOURCES += \
-+	gvc-compat.c
-+endif
-+
- valadoc@PACKAGE_SUFFIX@.vapi valadoc.h: libvaladoc.vala.stamp
- libvaladoc.vala.stamp: $(libvaladoc_la_VALASOURCES)
- 	$(VALA_V)$(VALAC) \
--- a/pkgs/development/coq-modules/metacoq/default.nix
+++ b/pkgs/development/coq-modules/metacoq/default.nix
@ -13,8 +13,9 @@ let
      { case = "8.14"; out = "1.1-8.14"; }
      { case = "8.15"; out = "1.1-8.15"; }
      { case = "8.16"; out = "1.1-8.16"; }
-      { case = "8.17"; out = "1.2.1-8.17"; }
-      { case = "8.18"; out = "1.2.1-8.18"; }
+      { case = "8.17"; out = "1.3.1-8.17"; }
+      { case = "8.18"; out = "1.3.1-8.18"; }
+      { case = "8.19"; out = "1.3.1-8.19"; }
    ] null;
  release = {
    "1.0-beta2-8.11".sha256 = "sha256-I9YNk5Di6Udvq5/xpLSNflfjRyRH8fMnRzbo3uhpXNs=";
@ -28,6 +29,9 @@ let
    "1.1-8.16".sha256 = "sha256-cTK4ptxpPPlqxAhasZFX3RpSlsoTZwhTqs2A3BZy9sA=";
    "1.2.1-8.17".sha256 = "sha256-FP4upuRsG8B5Q5FIr76t+ecRirrOUX0D1QiLq0/zMyE=";
    "1.2.1-8.18".sha256 = "sha256-49g5db2Bv8HpltptJdxA7zrmgNFGC6arx5h2mKHhrko=";
+    "1.3.1-8.17".sha256 = "sha256-l0/QLC7V3zSk/FsaE2eL6tXy2BzbcI5MAk/c+FESwnc=";
+    "1.3.1-8.18".sha256 = "sha256-L6Ym4Auwqaxv5tRmJLSVC812dxCqdUU5aN8+t5HVYzY=";
+    "1.3.1-8.19".sha256 = "sha256-fZED/Uel1jt5XF83dR6HfyhSkfBdLkET8C/ArDgsm64=";
  };
  releaseRev = v: "v${v}";

--- a/pkgs/development/coq-modules/serapi/default.nix
+++ b/pkgs/development/coq-modules/serapi/default.nix
@ -71,7 +71,8 @@ in
          if version == "8.11.0+0.11.1" then version
          else builtins.replaceStrings [ "+" ] [ "." ] version
        }.tbz";
-    sha256 = release."${version}".sha256;
+    # abort/syntax error will fail package set eval, but throw is "fine"
+    sha256 = release."${version}".sha256 or (throw "Unknown version '${version}'");
  };

  patches =
--- a/pkgs/development/libraries/libkrun/default.nix
+++ b/pkgs/development/libraries/libkrun/default.nix
@ -13,18 +13,18 @@

 stdenv.mkDerivation rec {
  pname = "libkrun";
-  version = "1.7.2";
+  version = "1.8.1";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "libkrun";
    rev = "refs/tags/v${version}";
-    hash = "sha256-cP+Pxl/9QIsoGysXTBZJ86q57cIMA7TJenMWtcOI+Y4=";
+    hash = "sha256-rrNiqwx4aEOB3fTyv8xcZEDsNJX4NNPhp13W0qnl1O0=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit pname version src;
-    hash = "sha256-qVyHC015QJEt6LZ8br3H0nucYKhYGBMtyB2IBaixTqk=";
+    hash = "sha256-6Zfy0LtxUDZzwlhul2fZpsI1c7GWntAMfsT6j+QefVs=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/misc/brev-cli/default.nix
+++ b/pkgs/development/misc/brev-cli/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "brev-cli";
-  version = "0.6.277";
+  version = "0.6.279";

  src = fetchFromGitHub {
    owner = "brevdev";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-s80veDxN0GfHKOwDhxx1ArZXqk8OPSl+d/Ruxj0oLJA=";
+    sha256 = "sha256-jQkaMFTArXPSCm6aBQb/vb4JEkgHtmzJl/Iz/f/pBSY=";
  };

  vendorHash = "sha256-IR/tgqh8rS4uN5jSOcopCutbHCKHSU9icUfRhOgu4t8=";
--- a/pkgs/development/php-packages/phpstan/default.nix
+++ b/pkgs/development/php-packages/phpstan/default.nix
@ -2,16 +2,16 @@

 php.buildComposerProject (finalAttrs: {
  pname = "phpstan";
-  version = "1.10.65";
+  version = "1.10.66";

  src = fetchFromGitHub {
    owner = "phpstan";
    repo = "phpstan-src";
    rev = finalAttrs.version;
-    hash = "sha256-mKNix5TEnr0aUHxn9cYvFafU7yLhTe8AVkHZcu0/a1M=";
+    hash = "sha256-ZEQ6oP6zyi0cL69J9ck8gAht5taPkzH+iW5ALC4saAQ=";
  };

-  vendorHash = "sha256-NezEoraSomeeMbY7qz2pH2EwLr/VXO1tmWJ5/2fS/qU=";
+  vendorHash = "sha256-Qp/eMhcKK32N1EMgeIspBDs28Oofwn6n2bEFKqvSx9E=";
  composerStrictValidation = false;

  meta = {
--- a/pkgs/development/python-modules/aadict/default.nix
+++ b/pkgs/development/python-modules/aadict/default.nix
@ -2,27 +2,40 @@
 , buildPythonPackage
 , fetchPypi
 , six
-, nose
-, coverage
+, pynose
+, setuptools
 }:

 buildPythonPackage rec {
  pname = "aadict";
  version = "0.2.3";
-  format = "setuptools";
+  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    sha256 = "013pn9ii6mkql6khgdvsd1gi7zmya418fhclm5fp7dfvann2hwx7";
+    hash = "sha256-p3MorFXbtXNdqZRBhwJRvv4TX2h6twenoXhWE2OydwQ=";
  };

-  propagatedBuildInputs = [ six ];
-  nativeCheckInputs = [ nose coverage ];
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    six
+  ];
+
+  nativeCheckInputs = [
+    pynose
+  ];
+
+  pythonImportsCheck = [
+    "aadict"
+  ];

  meta = with lib; {
+    description = "An auto-attribute dict (and a couple of other useful dict functions)";
    homepage = "https://github.com/metagriffin/aadict";
-    description = "An auto-attribute dict (and a couple of other useful dict functions).";
+    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ glittershark ];
-    license = licenses.gpl3;
  };
 }
--- a/pkgs/development/python-modules/actdiag/default.nix
+++ b/pkgs/development/python-modules/actdiag/default.nix
@ -2,7 +2,7 @@
 , blockdiag
 , buildPythonPackage
 , fetchFromGitHub
-, nose
+, pynose
 , pytestCheckHook
 , pythonOlder
 , setuptools
@ -11,24 +11,27 @@
 buildPythonPackage rec {
  pname = "actdiag";
  version = "3.0.0";
-  format = "setuptools";
+  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "blockdiag";
-    repo = pname;
-    rev = version;
+    repo = "actdiag";
+    rev = "refs/tags/${version}";
    hash = "sha256-WmprkHOgvlsOIg8H77P7fzEqxGnj6xaL7Df7urRkg3o=";
  };

-  propagatedBuildInputs = [
-    blockdiag
+  build-system = [
    setuptools
  ];

+  propagatedBuildInputs = [
+    blockdiag
+  ];
+
  nativeCheckInputs = [
-    nose
+    pynose
    pytestCheckHook
  ];

@ -36,16 +39,23 @@ buildPythonPackage rec {
    "src/actdiag/tests/"
  ];

+  disabledTests = [
+    # AttributeError: 'TestRstDirectives' object has no attribute 'assertRegexpMatches'
+    "svg"
+    "noviewbox"
+  ];
+
  pythonImportsCheck = [
    "actdiag"
  ];

  meta = with lib; {
    description = "Generate activity-diagram image from spec-text file (similar to Graphviz)";
-    mainProgram = "actdiag";
    homepage = "http://blockdiag.com/";
+    changelog = "https://github.com/blockdiag/actdiag/blob/${version}/CHANGES.rst";
    license = licenses.asl20;
-    platforms = platforms.unix;
    maintainers = with maintainers; [ bjornfor ];
+    mainProgram = "actdiag";
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@ -8,23 +8,23 @@

 buildPythonPackage rec {
  pname = "ailment";
-  version = "9.2.84";
+  version = "9.2.96";
  pyproject = true;

  disabled = pythonOlder "3.11";

  src = fetchFromGitHub {
    owner = "angr";
-    repo = pname;
+    repo = "ailment";
    rev = "refs/tags/v${version}";
-    hash = "sha256-I4lZrp4coJOBB8gREmeQsCiNhMC0MqhYxd5BmYXq9BA=";
+    hash = "sha256-xc9/J360ftynKT5HYNcjR/0WX04DUDmszaAHb8h3Iao=";
  };

-  nativeBuildInputs = [
+  build-system = [
    setuptools
  ];

-  propagatedBuildInputs = [
+  dependencies = [
    pyvex
  ];

--- a/pkgs/development/python-modules/aioraven/default.nix
+++ b/pkgs/development/python-modules/aioraven/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "aioraven";
-  version = "0.5.2";
+  version = "0.5.3";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -21,14 +21,14 @@ buildPythonPackage rec {
    owner = "cottsay";
    repo = "aioraven";
    rev = "refs/tags/${version}";
-    hash = "sha256-ysmIxWy+gufX5oUfQ7Zw5xv0t/yxihFB+eAdYAWAmXs=";
+    hash = "sha256-kGCFwpMaLWxLUp8k5H5AnL21KrwohbUYLswLcLqmc3M=";
  };

-  nativeBuildInputs = [
+  build-system = [
    setuptools
  ];

-  propagatedBuildInputs = [
+  dependencies = [
    iso4217
    pyserial
    pyserial-asyncio
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@ -20,19 +20,23 @@
 , protobuf
 , psutil
 , pycparser
+, pyformlang
 , pythonOlder
+, pythonRelaxDepsHook
 , pyvex
 , rich
 , rpyc
+, setuptools
 , sortedcontainers
 , sqlalchemy
 , sympy
 , unicorn
+, unique-log-filter
 }:

 buildPythonPackage rec {
  pname = "angr";
-  version = "9.2.84";
+  version = "9.2.96";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -41,10 +45,19 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "angr";
    rev = "refs/tags/v${version}";
-    hash = "sha256-qav9SUvQtcEad9lvgyrMhOcFhPAhzU/9s7ekTfohqRc=";
+    hash = "sha256-eyXjmU/K8zv5nxrt+oKkyxS00tHOYrkbTc2X9esTSSA=";
  };

-  propagatedBuildInputs = [
+  pythonRelaxDeps = [
+    "capstone"
+  ];
+
+  build-system = [
+    pythonRelaxDepsHook
+    setuptools
+  ];
+
+  dependencies = [
    ailment
    archinfo
    cachetools
@ -63,6 +76,7 @@ buildPythonPackage rec {
    protobuf
    psutil
    pycparser
+    pyformlang
    pyvex
    rich
    rpyc
@ -70,6 +84,7 @@ buildPythonPackage rec {
    sqlalchemy
    sympy
    unicorn
+    unique-log-filter
  ];

  setupPyBuildFlags = lib.optionals stdenv.isLinux [
--- a/pkgs/development/python-modules/angrcli/default.nix
+++ b/pkgs/development/python-modules/angrcli/default.nix
@ -1,5 +1,4 @@
-{ stdenv
-, lib
+{ lib
 , angr
 , buildPythonPackage
 , cmd2
@ -8,28 +7,34 @@
 , pygments
 , pytestCheckHook
 , pythonOlder
+, setuptools
+, stdenv
 }:

 buildPythonPackage rec {
  pname = "angrcli";
  version = "1.2.0";
-  format = "setuptools";
+  pyproject = true;

  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "fmagin";
    repo = "angr-cli";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
    hash = "sha256-a5ajUBQwt3xUNkeSOeGOAFf47wd4UVk+LcuAHGqbq4s=";
  };

  postPatch = ''
    substituteInPlace tests/test_derefs.py \
-      --replace "/bin/ls" "${coreutils}/bin/ls"
+      --replace-fail "/bin/ls" "${coreutils}/bin/ls"
  '';

-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
    angr
    cmd2
    pygments
--- a/pkgs/development/python-modules/angrop/default.nix
+++ b/pkgs/development/python-modules/angrop/default.nix
@ -11,22 +11,22 @@
 buildPythonPackage rec {
  pname = "angrop";
  version = "9.2.8";
-  format = "pyproject";
+  pyproject = true;

  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "angr";
-    repo = pname;
+    repo = "angrop";
    rev = "refs/tags/v${version}";
    hash = "sha256-zmWdGbFzwLDP7MUqEprZcIgA7lAdCrafWYohAehJyh0=";
  };

-  nativeBuildInputs = [
+  build-system = [
    setuptools
  ];

-  propagatedBuildInputs = [
+  dependencies = [
    angr
    progressbar
    tqdm
--- a/pkgs/development/python-modules/approvaltests/default.nix
+++ b/pkgs/development/python-modules/approvaltests/default.nix
@ -5,6 +5,7 @@
 , buildPythonPackage
 , empty-files
 , fetchFromGitHub
+, fetchpatch2
 , mock
 , mrjob
 , numpy
@ -20,7 +21,7 @@

 buildPythonPackage rec {
  pname = "approvaltests";
-  version = "11.1.2";
+  version = "11.1.3";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -29,14 +30,21 @@ buildPythonPackage rec {
    owner = "approvals";
    repo = "ApprovalTests.Python";
    rev = "refs/tags/v${version}";
-    hash = "sha256-VM4TP98bS9NmhxZz+YHMJrHKr5g6E6aYidxjKQyXp7k=";
+    hash = "sha256-VqE2Oj3b+ZfKT+fhJ9DxBClfa8Wz8w/puAnAotN3eG4=";
  };

-  nativeBuildInputs = [
+  patches = [
+    (fetchpatch2 {
+      url = "https://github.com/approvals/ApprovalTests.Python/commit/dac7c8a8aa62f31dca7a687d4dbf08158351d5e1.patch";
+      hash = "sha256-TMyfXNtzpGci6tdFRhxiKJRjCWRD5LkaffPY8EVj53E=";
+    })
+  ];
+
+  build-system = [
    setuptools
  ];

-  propagatedBuildInputs = [
+  dependencies = [
    allpairspy
    approval-utilities
    beautifulsoup4
@ -56,7 +64,7 @@ buildPythonPackage rec {
  ];

  disabledTests = [
-    # Tests expects paths below ApprovalTests.Python directory
+    # Tests expect paths below ApprovalTests.Python directory
    "test_received_filename"
    "test_pytest_namer"
  ];
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@ -9,23 +9,23 @@

 buildPythonPackage rec {
  pname = "archinfo";
-  version = "9.2.84";
+  version = "9.2.96";
  pyproject = true;

  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "angr";
-    repo = pname;
+    repo = "archinfo";
    rev = "refs/tags/v${version}";
-    hash = "sha256-drZuQRQ2XukCimH/SG6CRCL4avyMEcKxuj+Rinp7lJQ=";
+    hash = "sha256-g/fxj/6dMVLoW4hFtVDEjHjdJiB3KE2XB3c0ihclqeM=";
  };

-  nativeBuildInputs = [
+  build-system = [
    setuptools
  ];

-  propagatedBuildInputs = lib.optionals (pythonOlder "3.11") [
+  dependencies = lib.optionals (pythonOlder "3.11") [
    backports-strenum
  ];

--- a/pkgs/development/python-modules/argilla/default.nix
+++ b/pkgs/development/python-modules/argilla/default.nix
@ -65,7 +65,7 @@
 }:
 let
  pname = "argilla";
-  version = "1.26.0";
+  version = "1.26.1";
  optional-dependencies = {
    server = [
      fastapi
@ -126,7 +126,7 @@ buildPythonPackage {
    owner = "argilla-io";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-+8oN3afbpBQU2tRb2Oq12IlmoCg4O1LUHtt4hl2FOEI=";
+    hash = "sha256-7d8zvP06GrHrSEJn2NNv2BUNea1wamf21e+qa1dZU18=";
  };

  pythonRelaxDeps = [
--- a/pkgs/development/python-modules/asciimatics/default.nix
+++ b/pkgs/development/python-modules/asciimatics/default.nix
@ -1,45 +1,40 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, setuptools-scm
-, pyfiglet
 , pillow
+, pyfiglet
+, pytestCheckHook
+, pythonOlder
+, setuptools-scm
 , wcwidth
-, future
-, mock
-, nose
 }:

 buildPythonPackage rec {
  pname = "asciimatics";
  version = "1.15.0";
-  format = "setuptools";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
    hash = "sha256-z905gEJydRnYtz5iuO+CwL7P7U60IImcO5bJjQuWgho=";
  };

-  nativeBuildInputs = [
+  build-system = [
    setuptools-scm
  ];

-  propagatedBuildInputs = [
+  dependencies = [
    pyfiglet
    pillow
    wcwidth
-    future
  ];

  nativeCheckInputs = [
-    mock
-    nose
+    pytestCheckHook
  ];

-  # tests require a pty emulator
-  # which is too complicated to setup here
-  doCheck = false;
-
  pythonImportsCheck =  [
    "asciimatics.effects"
    "asciimatics.renderers"
@ -48,8 +43,9 @@ buildPythonPackage rec {
  ];

  meta = with lib; {
-    description = "Helps to create full-screen text UIs (from interactive forms to ASCII animations) on any platform";
+    description = "Module to create full-screen text UIs (from interactive forms to ASCII animations)";
    homepage = "https://github.com/peterbrittain/asciimatics";
+    changelog = "https://github.com/peterbrittain/asciimatics/releases/tag/${version}";
    license = licenses.asl20;
    maintainers = with maintainers; [ cmcdragonkai ];
  };
--- a/pkgs/development/python-modules/b2sdk/default.nix
+++ b/pkgs/development/python-modules/b2sdk/default.nix
@ -19,7 +19,7 @@

 buildPythonPackage rec {
  pname = "b2sdk";
-  version = "1.32.0";
+  version = "1.33.0";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -28,7 +28,7 @@ buildPythonPackage rec {
    owner = "Backblaze";
    repo = "b2-sdk-python";
    rev = "refs/tags/v${version}";
-    hash = "sha256-xBLMvH51zbrSuBOtMxLeQJt7Wv31OcxBbD72EuLHzuU=";
+    hash = "sha256-eMFgsjEb0DMTLqG+8IZru1dEAuKZW4dEszrznZxR+mc=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/bc-python-hcl2/default.nix
+++ b/pkgs/development/python-modules/bc-python-hcl2/default.nix
@ -2,14 +2,15 @@
 , buildPythonPackage
 , fetchPypi
 , lark
-, nose
+, pynose
 , pythonOlder
+, setuptools
 }:

 buildPythonPackage rec {
  pname = "bc-python-hcl2";
  version = "0.4.2";
-  format = "setuptools";
+  pyproject = true;

  disabled = pythonOlder "3.6";

@ -20,10 +21,11 @@ buildPythonPackage rec {

  # Nose is required during build process, so can not use `nativeCheckInputs`.
  buildInputs = [
-    nose
+    pynose
+    setuptools
  ];

-  propagatedBuildInputs = [
+  dependencies = [
    lark
  ];

@ -36,7 +38,6 @@ buildPythonPackage rec {

  meta = with lib; {
    description = "Parser for HCL2 written in Python using Lark";
-    mainProgram = "hcl2tojson";
    longDescription = ''
      This parser only supports HCL2 and isn't backwards compatible with HCL v1.
      It can be used to parse any HCL2 config file such as Terraform.
@ -46,5 +47,6 @@ buildPythonPackage rec {
    homepage = "https://github.com/amplify-education/python-hcl2";
    license = licenses.mit;
    maintainers = with maintainers; [ anhdle14 ];
+    mainProgram = "hcl2tojson";
  };
 }
--- a/pkgs/development/python-modules/blockdiag/default.nix
+++ b/pkgs/development/python-modules/blockdiag/default.nix
@ -1,31 +1,30 @@
 { lib
 , buildPythonPackage
 , docutils
+, ephem
 , fetchFromGitHub
 , fetchpatch
 , funcparserlib
-, nose
 , pillow
-, ephem
-, pythonOlder
+, pynose
 , pytestCheckHook
+, pythonOlder
 , reportlab
 , setuptools
 , webcolors
-, python
 }:

 buildPythonPackage rec {
  pname = "blockdiag";
  version = "3.0.0";
-  format = "setuptools";
+  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "blockdiag";
    repo = "blockdiag";
-    rev = version;
+    rev = "refs/tags/${version}";
    hash = "sha256-j8FoNUIJJOaahaol1MRPyY2jcPCEIlaAD4bmM2QKFFI=";
  };

@ -38,18 +37,21 @@ buildPythonPackage rec {
    })
  ];

-  propagatedBuildInputs = [
+  build-system = [
    setuptools
+  ];
+
+  dependencies = [
+    docutils
    funcparserlib
    pillow
-    webcolors
    reportlab
-    docutils
+    webcolors
  ];

  nativeCheckInputs = [
    ephem
-    nose
+    pynose
    pytestCheckHook
  ];

@ -68,10 +70,11 @@ buildPythonPackage rec {

  meta = with lib; {
    description = "Generate block-diagram image from spec-text file (similar to Graphviz)";
-    mainProgram = "blockdiag";
    homepage = "http://blockdiag.com/";
+    changelog = "https://github.com/blockdiag/blockdiag/blob/${version}/CHANGES.rst";
    license = licenses.asl20;
-    platforms = platforms.unix;
    maintainers = with maintainers; [ bjornfor ];
+    mainProgram = "blockdiag";
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@ -365,14 +365,14 @@

 buildPythonPackage rec {
  pname = "boto3-stubs";
-  version = "1.34.72";
+  version = "1.34.73";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-eQPciiA763TWI3smauBk/1qbJ2B0r3UAt9tIVEZJWWo=";
+    hash = "sha256-ok9aPF2xGPxYxkh/GozIpKggYmB5Fr+pcxKXygspBpc=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@ -1,19 +1,19 @@
 { lib
 , buildPythonPackage
-, setuptools
 , cachetools
 , decorator
 , fetchFromGitHub
-, future
 , pysmt
-, pythonOlder
 , pytestCheckHook
+, pythonOlder
+, pythonRelaxDepsHook
+, setuptools
 , z3-solver
 }:

 buildPythonPackage rec {
  pname = "claripy";
-  version = "9.2.84";
+  version = "9.2.96";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -22,20 +22,25 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "claripy";
    rev = "refs/tags/v${version}";
-    hash = "sha256-wgCWMngda0gB+AEDFpRxQ2ots5YXE4bkBSxMtYJqLEo=";
+    hash = "sha256-rXJzJCyhsScFW1L/mVARciGDlOOBCFT69VBivjV6oig=";
  };

-  nativeBuildInputs = [
+  # z3 does not provide a dist-info, so python-runtime-deps-check will fail
+  pythonRemoveDeps = [
+    "z3-solver"
+  ];
+
+  build-system = [
+    pythonRelaxDepsHook
    setuptools
  ];

-  propagatedBuildInputs = [
+  dependencies = [
    cachetools
    decorator
-    future
    pysmt
    z3-solver
-  ];
+  ] ++ z3-solver.requiredPythonModules;

  nativeCheckInputs = [
    pytestCheckHook
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@ -1,11 +1,12 @@
 { lib
+, archinfo
 , buildPythonPackage
 , cffi
 , fetchFromGitHub
 , minidump
-, nose
 , pefile
 , pyelftools
+, pynose
 , pytestCheckHook
 , pythonOlder
 , pyvex
@ -16,14 +17,14 @@

 let
  # The binaries are following the argr projects release cycle
-  version = "9.2.84";
+  version = "9.2.96";

  # Binary files from https://github.com/angr/binaries (only used for testing and only here)
  binaries = fetchFromGitHub {
    owner = "angr";
    repo = "binaries";
    rev = "refs/tags/v${version}";
-    hash = "sha256-sU9Rv2kTLYMpaalrkcOv6HlHt1u4oG482M+d7OSjJ3Y=";
+    hash = "sha256-eC9qQCrms4pSXYTrKJlfdejhl/kzUmmyfYhjlEPpgzA=";
  };

 in
@ -38,14 +39,15 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "cle";
    rev = "refs/tags/v${version}";
-    hash = "sha256-N0z5wgaeWkoPuhIUj7bj1kDKgZ7pWChm1uEU4MjXjqI=";
+    hash = "sha256-osClaoAzjf3mOng38disxxSFncbc/V7Uuc1HCTdX4SQ=";
  };

-  nativeBuildInputs = [
+  build-system = [
    setuptools
  ];

-  propagatedBuildInputs = [
+  dependencies = [
+    archinfo
    cffi
    minidump
    pefile
@ -56,7 +58,7 @@ buildPythonPackage rec {
  ];

  nativeCheckInputs = [
-    nose
+    pynose
    pytestCheckHook
  ];

--- a/pkgs/development/python-modules/django-webpush/default.nix
+++ b/pkgs/development/python-modules/django-webpush/default.nix
@ -22,17 +22,21 @@ buildPythonPackage rec {
    hash = "sha256-Mwp53apdPpBcn7VfDbyDlvLAVAG65UUBhT0w9OKjKbU=";
  };

-  nativeBuildInputs = [
+  pythonRelaxDeps = [
+    "pywebpush"
+  ];
+
+  build-system = [
    pythonRelaxDepsHook
    setuptools-scm
  ];

-  propagatedBuildInputs = [
+  dependencies = [
    django
    pywebpush
  ];

-  # nothing to test
+  # Module has no tests
  doCheck = false;

  pythonImportsCheck = [
@ -40,7 +44,7 @@ buildPythonPackage rec {
  ];

  meta = with lib; {
-    description = "A Package made for integrating and sending Web Push Notification in Django Application";
+    description = "Module for integrating and sending Web Push Notification in Django Application";
    homepage = "https://github.com/safwanrahman/django-webpush/";
    changelog = "https://github.com/safwanrahman/django-webpush/releases/tag/${src.rev}";
    license = licenses.gpl3Plus;
--- a/Show more
+++ b/Show more