Merge staging-next into staging

2024-09-16 12:06:19 +00:00 · 2024-09-16 12:06:19 +00:00 · 1c3463dc7a
commit 1c3463dc7a
parent 6c7030c7a4 1e68c5c8e0
77 changed files with 1427 additions and 1424 deletions
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@ -315,6 +315,22 @@ When reviewing a pull request, please always be nice and polite. Controversial c

 GitHub provides reactions as a simple and quick way to provide feedback to pull requests or any comments. The thumb-down reaction should be used with care and if possible accompanied with some explanation so the submitter has directions to improve their contribution.

+When doing a review:
+- Aim to drive the proposal to a timely conclusion.
+- Focus on the proposed changes to keep the scope of the discussion narrow.
+- Help the contributor prioritise their efforts towards getting their change merged.
+
+If you find anything related that could be improved but is not immediately required for acceptance, consider
+- Implementing the changes yourself in a follow-up pull request (and request review from the person who inspired you)
+- Tracking your idea in an issue
+- Offering the original contributor to review a follow-up pull request
+- Making concrete [suggestions](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/incorporating-feedback-in-your-pull-request) in the same pull request.
+
+For example, follow-up changes could involve refactoring code in the affected files.
+
+But please remember not to make such additional considerations a blocker, and communicate that to the contributor, for example by following the [conventional comments](https://conventionalcomments.org/) pattern.
+If the related change is essential for the contribution at hand, make clear why you think it is important to address that first.
+
 Pull request reviews should include a list of what has been reviewed in a comment, so other reviewers and mergers can know the state of the review.

 All the review template samples provided in this section are generic and meant as examples. Their usage is optional and the reviewer is free to adapt them to their liking.
--- a/lib/default.nix
+++ b/lib/default.nix
@ -79,7 +79,8 @@ let
      fromHexString toHexString toBaseDigits inPureEvalMode isBool isInt pathExists
      genericClosure readFile;
    inherit (self.fixedPoints) fix fix' converge extends composeExtensions
-      composeManyExtensions makeExtensible makeExtensibleWithCustomName;
+      composeManyExtensions makeExtensible makeExtensibleWithCustomName
+      toExtension;
    inherit (self.attrsets) attrByPath hasAttrByPath setAttrByPath
      getAttrFromPath attrVals attrNames attrValues getAttrs catAttrs filterAttrs
      filterAttrsRecursive foldlAttrs foldAttrs collect nameValuePair mapAttrs
--- a/lib/fixed-points.nix
+++ b/lib/fixed-points.nix
@ -438,4 +438,76 @@ rec {
        ${extenderName} = f: makeExtensibleWithCustomName extenderName (extends f rattrs);
      }
    );
+
+  /**
+    Convert to an extending function (overlay).
+
+    `toExtension` is the `toFunction` for extending functions (a.k.a. extensions or overlays).
+    It converts a non-function or a single-argument function to an extending function,
+    while returning a two-argument function as-is.
+
+    That is, it takes a value of the shape `x`, `prev: x`, or `final: prev: x`,
+    and returns `final: prev: x`, assuming `x` is not a function.
+
+    This function takes care of the input to `stdenv.mkDerivation`'s
+    `overrideAttrs` function.
+    It bridges the gap between `<pkg>.overrideAttrs`
+    before and after the overlay-style support.
+
+    # Inputs
+
+    `f`
+    : The function or value to convert to an extending function.
+
+    # Type
+
+    ```
+    toExtension ::
+      b' -> Any -> Any -> b'
+    or
+    toExtension ::
+      (a -> b') -> Any -> a -> b'
+    or
+    toExtension ::
+      (a -> a -> b) -> a -> a -> b
+    where b' = ! Callable
+
+    Set a = b = b' = AttrSet & ! Callable to make toExtension return an extending function.
+    ```
+
+    # Examples
+    :::{.example}
+    ## `lib.fixedPoints.toExtension` usage example
+
+    ```nix
+    fix (final: { a = 0; c = final.a; })
+    => { a = 0; c = 0; };
+
+    fix (extends (toExtension { a = 1; b = 2; }) (final: { a = 0; c = final.a; }))
+    => { a = 1; b = 2; c = 1; };
+
+    fix (extends (toExtension (prev: { a = 1; b = prev.a; })) (final: { a = 0; c = final.a; }))
+    => { a = 1; b = 0; c = 1; };
+
+    fix (extends (toExtension (final: prev: { a = 1; b = prev.a; c = final.a + 1 })) (final: { a = 0; c = final.a; }))
+    => { a = 1; b = 0; c = 2; };
+    ```
+    :::
+  */
+  toExtension =
+    f:
+    if lib.isFunction f then
+      final: prev:
+      let
+        fPrev = f prev;
+      in
+      if lib.isFunction fPrev then
+        # f is (final: prev: { ... })
+        f final prev
+      else
+        # f is (prev: { ... })
+        fPrev
+    else
+      # f is not a function; probably { ... }
+      final: prev: f;
 }
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@ -45,6 +45,7 @@ let
    const
    escapeXML
    evalModules
+    extends
    filter
    fix
    fold
@ -102,6 +103,7 @@ let
    take
    testAllTrue
    toBaseDigits
+    toExtension
    toHexString
    fromHexString
    toInt
@ -233,11 +235,6 @@ runTests {
    ];
  };

-  testFix = {
-    expr = fix (x: {a = if x ? a then "a" else "b";});
-    expected = {a = "a";};
-  };
-
  testComposeExtensions = {
    expr = let obj = makeExtensible (self: { foo = self.bar; });
               f = self: super: { bar = false; baz = true; };
@ -1237,6 +1234,28 @@ runTests {
    attrsToList { someFunc= a: a + 1;}
  );

+# FIXED-POINTS
+
+  testFix = {
+    expr = fix (x: {a = if x ? a then "a" else "b";});
+    expected = {a = "a";};
+  };
+
+  testToExtension = {
+    expr = [
+      (fix (final: { a = 0; c = final.a; }))
+      (fix (extends (toExtension { a = 1; b = 2; }) (final: { a = 0; c = final.a; })))
+      (fix (extends (toExtension (prev: { a = 1; b = prev.a; })) (final: { a = 0; c = final.a; })))
+      (fix (extends (toExtension (final: prev: { a = 1; b = prev.a; c = final.a + 1; })) (final: { a = 0; c = final.a; })))
+    ];
+    expected = [
+      { a = 0; c = 0; }
+      { a = 1; b = 2; c = 1; }
+      { a = 1; b = 0; c = 1; }
+      { a = 1; b = 0; c = 2; }
+    ];
+  };
+
 # GENERATORS
 # these tests assume attributes are converted to lists
 # in alphabetical order
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -19701,11 +19701,11 @@
    name = "Kylie McClain";
  };
  SomeoneSerge = {
-    email = "sergei.kozlukov@aalto.fi";
+    email = "else+nixpkgs@someonex.net";
    matrix = "@ss:someonex.net";
    github = "SomeoneSerge";
    githubId = 9720532;
-    name = "Sergei K";
+    name = "Else Someone";
  };
  sontek = {
    email = "sontek@gmail.com";
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@ -183,6 +183,16 @@ with lib.maintainers;
    githubTeams = [ "cuda-maintainers" ];
  };

+  cyberus = {
+    # Verify additions by approval of an already existing member of the team.
+    members = [
+      xanderio
+      blitz
+    ];
+    scope = "Team for Cyberus Technology employees who collectively maintain packages.";
+    shortName = "Cyberus Technology employees";
+  };
+
  darwin = {
    members = [ toonn ];
    githubTeams = [ "darwin-maintainers" ];
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@ -358,6 +358,9 @@
 - `zx` was updated to v8, which introduces several breaking changes.
  See the [v8 changelog](https://github.com/google/zx/releases/tag/8.0.0) for more information.

+- The `dnscrypt-wrapper` module was removed since the project has been effectively unmaintained since 2018; moreover the NixOS module had to rely on an abandoned version of dnscrypt-proxy v1 for the rotation of keys.
+  To wrap a resolver with DNSCrypt you can instead use `dnsdist`. See options `services.dnsdist.dnscrypt.*`
+
 - The `portunus` package and service do not support weak password hashes anymore.
  If you installed Portunus on NixOS 23.11 or earlier, upgrade to NixOS 24.05 first to get support for strong password hashing.
  Then, follow the instructions on the [upstream release notes](https://github.com/majewsky/portunus/releases/tag/v2.0.0) to upgrade all existing user accounts to strong password hashes.
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1014,7 +1014,6 @@
  ./services/networking/dhcpcd.nix
  ./services/networking/dnscache.nix
  ./services/networking/dnscrypt-proxy2.nix
-  ./services/networking/dnscrypt-wrapper.nix
  ./services/networking/dnsdist.nix
  ./services/networking/dnsmasq.nix
  ./services/networking/dnsproxy.nix
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@ -61,6 +61,12 @@ in
    (mkRemovedOptionModule [ "services" "couchpotato" ] "The corresponding package was removed from nixpkgs.")
    (mkRemovedOptionModule [ "services" "dd-agent" ] "dd-agent was removed from nixpkgs in favor of the newer datadog-agent.")
    (mkRemovedOptionModule [ "services" "dnscrypt-proxy" ] "Use services.dnscrypt-proxy2 instead")
+    (mkRemovedOptionModule [ "services" "dnscrypt-wrapper" ] ''
+      The dnscrypt-wrapper module was removed since the project has been effectively unmaintained since 2018;
+      moreover the NixOS module had to rely on an abandoned version of dnscrypt-proxy v1 for the rotation of keys.
+
+      To wrap a resolver with DNSCrypt you can instead use dnsdist. See options `services.dnsdist.dnscrypt.*`
+    '')
    (mkRemovedOptionModule [ "services" "exhibitor" ] "The corresponding package was removed from nixpkgs.")
    (mkRemovedOptionModule [ "services" "firefox" "syncserver" ] "The corresponding package was removed from nixpkgs.")
    (mkRemovedOptionModule [ "services" "flashpolicyd" ] "The flashpolicyd module has been removed. Adobe Flash Player is deprecated.")
--- a/nixos/modules/services/networking/dnscrypt-wrapper.nix
+++ b/nixos/modules/services/networking/dnscrypt-wrapper.nix
@ -1,273 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg     = config.services.dnscrypt-wrapper;
-  dataDir = "/var/lib/dnscrypt-wrapper";
-
-  mkPath = path: default:
-    if path != null
-      then toString path
-      else default;
-
-  publicKey = mkPath cfg.providerKey.public "${dataDir}/public.key";
-  secretKey = mkPath cfg.providerKey.secret "${dataDir}/secret.key";
-
-  daemonArgs = with cfg; [
-    "--listen-address=${address}:${toString port}"
-    "--resolver-address=${upstream.address}:${toString upstream.port}"
-    "--provider-name=${providerName}"
-    "--provider-publickey-file=${publicKey}"
-    "--provider-secretkey-file=${secretKey}"
-    "--provider-cert-file=${providerName}.crt"
-    "--crypt-secretkey-file=${providerName}.key"
-  ];
-
-  genKeys = ''
-    # generates time-limited keypairs
-    keyGen() {
-      dnscrypt-wrapper --gen-crypt-keypair \
-        --crypt-secretkey-file=${cfg.providerName}.key
-
-      dnscrypt-wrapper --gen-cert-file \
-        --crypt-secretkey-file=${cfg.providerName}.key \
-        --provider-cert-file=${cfg.providerName}.crt \
-        --provider-publickey-file=${publicKey} \
-        --provider-secretkey-file=${secretKey} \
-        --cert-file-expire-days=${toString cfg.keys.expiration}
-    }
-
-    cd ${dataDir}
-
-    # generate provider keypair (first run only)
-    ${lib.optionalString (cfg.providerKey.public == null || cfg.providerKey.secret == null) ''
-      if [ ! -f ${publicKey} ] || [ ! -f ${secretKey} ]; then
-        dnscrypt-wrapper --gen-provider-keypair
-      fi
-    ''}
-
-    # generate new keys for rotation
-    if [ ! -f ${cfg.providerName}.key ] || [ ! -f ${cfg.providerName}.crt ]; then
-      keyGen
-    fi
-  '';
-
-  rotateKeys = ''
-    # check if keys are not expired
-    keyValid() {
-      fingerprint=$(dnscrypt-wrapper \
-        --show-provider-publickey \
-        --provider-publickey-file=${publicKey} \
-        | awk '{print $(NF)}')
-      dnscrypt-proxy --test=${toString (cfg.keys.checkInterval + 1)} \
-        --resolver-address=127.0.0.1:${toString cfg.port} \
-        --provider-name=${cfg.providerName} \
-        --provider-key=$fingerprint
-    }
-
-    cd ${dataDir}
-
-    # archive old keys and restart the service
-    if ! keyValid; then
-      echo "certificate soon to become invalid; backing up old cert"
-      mkdir -p oldkeys
-      mv -v "${cfg.providerName}.key" "oldkeys/${cfg.providerName}-$(date +%F-%T).key"
-      mv -v "${cfg.providerName}.crt" "oldkeys/${cfg.providerName}-$(date +%F-%T).crt"
-      kill "$(pidof -s dnscrypt-wrapper)"
-    fi
-  '';
-
-
-  # This is the fork of the original dnscrypt-proxy maintained by Dyne.org.
-  # dnscrypt-proxy2 doesn't provide the `--test` feature that is needed to
-  # correctly implement key rotation of dnscrypt-wrapper ephemeral keys.
-  dnscrypt-proxy1 = pkgs.callPackage
-    ({ stdenv, fetchFromGitHub, autoreconfHook
-    , pkg-config, libsodium, ldns, openssl, systemd }:
-
-    stdenv.mkDerivation rec {
-      pname = "dnscrypt-proxy";
-      version = "2019-08-20";
-
-      src = fetchFromGitHub {
-        owner = "dyne";
-        repo = "dnscrypt-proxy";
-        rev = "07ac3825b5069adc28e2547c16b1d983a8ed8d80";
-        sha256 = "0c4mq741q4rpmdn09agwmxap32kf0vgfz7pkhcdc5h54chc3g3xy";
-      };
-
-      configureFlags = lib.optional stdenv.isLinux "--with-systemd";
-
-      nativeBuildInputs = [ autoreconfHook pkg-config ];
-
-      # <ldns/ldns.h> depends on <openssl/ssl.h>
-      buildInputs = [ libsodium openssl.dev ldns ] ++ lib.optional stdenv.isLinux systemd;
-
-      postInstall = ''
-        # Previous versions required libtool files to load plugins; they are
-        # now strictly optional.
-        rm $out/lib/dnscrypt-proxy/*.la
-      '';
-
-      meta = {
-        description = "A tool for securing communications between a client and a DNS resolver";
-        homepage = "https://github.com/dyne/dnscrypt-proxy";
-        license = lib.licenses.isc;
-        maintainers = with lib.maintainers; [ rnhmjoj ];
-        platforms = lib.platforms.linux;
-      };
-    }) { };
-
-in {
-
-
-  ###### interface
-
-  options.services.dnscrypt-wrapper = {
-    enable = lib.mkEnableOption "DNSCrypt wrapper";
-
-    address = lib.mkOption {
-      type = lib.types.str;
-      default = "127.0.0.1";
-      description = ''
-        The DNSCrypt wrapper will bind to this IP address.
-      '';
-    };
-
-    port = lib.mkOption {
-      type = lib.types.port;
-      default = 5353;
-      description = ''
-        The DNSCrypt wrapper will listen for DNS queries on this port.
-      '';
-    };
-
-    providerName = lib.mkOption {
-      type = lib.types.str;
-      default = "2.dnscrypt-cert.${config.networking.hostName}";
-      defaultText = lib.literalExpression ''"2.dnscrypt-cert.''${config.networking.hostName}"'';
-      example = "2.dnscrypt-cert.myresolver";
-      description = ''
-        The name that will be given to this DNSCrypt resolver.
-        Note: the resolver name must start with `2.dnscrypt-cert.`.
-      '';
-    };
-
-    providerKey.public = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
-      default = null;
-      example = "/etc/secrets/public.key";
-      description = ''
-        The filepath to the provider public key. If not given a new
-        provider key pair will be generated on the first run.
-      '';
-    };
-
-    providerKey.secret = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
-      default = null;
-      example = "/etc/secrets/secret.key";
-      description = ''
-        The filepath to the provider secret key. If not given a new
-        provider key pair will be generated on the first run.
-      '';
-    };
-
-    upstream.address = lib.mkOption {
-      type = lib.types.str;
-      default = "127.0.0.1";
-      description = ''
-        The IP address of the upstream DNS server DNSCrypt will "wrap".
-      '';
-    };
-
-    upstream.port = lib.mkOption {
-      type = lib.types.port;
-      default = 53;
-      description = ''
-        The port of the upstream DNS server DNSCrypt will "wrap".
-      '';
-    };
-
-    keys.expiration = lib.mkOption {
-      type = lib.types.int;
-      default = 30;
-      description = ''
-        The duration (in days) of the time-limited secret key.
-        This will be automatically rotated before expiration.
-      '';
-    };
-
-    keys.checkInterval = lib.mkOption {
-      type = lib.types.int;
-      default = 1440;
-      description = ''
-        The time interval (in minutes) between key expiration checks.
-      '';
-    };
-
-  };
-
-
-  ###### implementation
-
-  config = lib.mkIf cfg.enable {
-
-    users.users.dnscrypt-wrapper = {
-      description = "dnscrypt-wrapper daemon user";
-      home = "${dataDir}";
-      createHome = true;
-      isSystemUser = true;
-      group = "dnscrypt-wrapper";
-    };
-    users.groups.dnscrypt-wrapper = { };
-
-    systemd.services.dnscrypt-wrapper = {
-      description = "dnscrypt-wrapper daemon";
-      after    = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-      path     = [ pkgs.dnscrypt-wrapper ];
-
-      serviceConfig = {
-        User = "dnscrypt-wrapper";
-        WorkingDirectory = dataDir;
-        Restart   = "always";
-        ExecStart = "${pkgs.dnscrypt-wrapper}/bin/dnscrypt-wrapper ${toString daemonArgs}";
-      };
-
-      preStart = genKeys;
-    };
-
-
-    systemd.services.dnscrypt-wrapper-rotate = {
-      after    = [ "network.target" ];
-      requires = [ "dnscrypt-wrapper.service" ];
-      description = "Rotates DNSCrypt wrapper keys if soon to expire";
-
-      path   = with pkgs; [ dnscrypt-wrapper dnscrypt-proxy1 gawk procps ];
-      script = rotateKeys;
-      serviceConfig.User = "dnscrypt-wrapper";
-    };
-
-
-    systemd.timers.dnscrypt-wrapper-rotate = {
-      description = "Periodically check DNSCrypt wrapper keys for expiration";
-      wantedBy = [ "multi-user.target" ];
-
-      timerConfig = {
-        Unit = "dnscrypt-wrapper-rotate.service";
-        OnBootSec = "1min";
-        OnUnitActiveSec = cfg.keys.checkInterval * 60;
-      };
-    };
-
-    assertions = with cfg; [
-      { assertion = (providerKey.public == null && providerKey.secret == null) ||
-                    (providerKey.secret != null && providerKey.public != null);
-        message = "The secret and public provider key must be set together.";
-      }
-    ];
-
-  };
-
-  meta.maintainers = with lib.maintainers; [ rnhmjoj ];
-
-}
--- a/nixos/modules/services/web-apps/flarum.nix
+++ b/nixos/modules/services/web-apps/flarum.nix
@ -203,10 +203,13 @@ in {
        ln -sf ${cfg.package}/share/php/flarum/public/index.php public/
      '' + optionalString (cfg.createDatabaseLocally && cfg.database.driver == "mysql") ''
        if [ ! -f config.php ]; then
-            php flarum install --file=${flarumInstallConfig}
+          php flarum install --file=${flarumInstallConfig}
+        fi
+      '' + ''
+        if [ -f config.php ]; then
+          php flarum migrate
+          php flarum cache:clear
        fi
-        php flarum migrate
-        php flarum cache:clear
      '';
    };
  };
--- a/nixos/modules/services/web-apps/plausible.nix
+++ b/nixos/modules/services/web-apps/plausible.nix
@ -329,6 +329,6 @@ in {
    ];
  };

-  meta.maintainers = with maintainers; [ xanderio ];
+  meta.maintainers = teams.cyberus.members;
  meta.doc = ./plausible.md;
 }
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -260,7 +260,6 @@ in {
  disable-installer-tools = handleTest ./disable-installer-tools.nix {};
  discourse = handleTest ./discourse.nix {};
  dnscrypt-proxy2 = handleTestOn ["x86_64-linux"] ./dnscrypt-proxy2.nix {};
-  dnscrypt-wrapper = runTestOn ["x86_64-linux"] ./dnscrypt-wrapper;
  dnsdist = import ./dnsdist.nix { inherit pkgs runTest; };
  doas = handleTest ./doas.nix {};
  docker = handleTestOn ["aarch64-linux" "x86_64-linux"] ./docker.nix {};
--- a/nixos/tests/dnscrypt-wrapper/default.nix
+++ b/nixos/tests/dnscrypt-wrapper/default.nix
@ -1,148 +0,0 @@
-
-{ lib, pkgs, ... }:
-
-let
-  snakeoil = import ../common/acme/server/snakeoil-certs.nix;
-
-  hosts = lib.mkForce
-   { "fd::a" = [ "server" snakeoil.domain ];
-     "fd::b" = [ "client" ];
-   };
-in
-
-{
-  name = "dnscrypt-wrapper";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ rnhmjoj ];
-  };
-
-  nodes = {
-    server = {
-      networking.hosts = hosts;
-      networking.interfaces.eth1.ipv6.addresses = lib.singleton
-        { address = "fd::a"; prefixLength = 64; };
-
-        services.dnscrypt-wrapper =
-          { enable = true;
-            address = "[::]";
-            port = 5353;
-            keys.expiration = 5; # days
-            keys.checkInterval = 2;  # min
-            # The keypair was generated by the command:
-            # dnscrypt-wrapper --gen-provider-keypair \
-            #  --provider-name=2.dnscrypt-cert.server \
-            providerKey.public = "${./public.key}";
-            providerKey.secret = "${./secret.key}";
-          };
-
-        # nameserver
-        services.bind.enable = true;
-        services.bind.zones = lib.singleton
-          { name = ".";
-            master = true;
-            file = pkgs.writeText "root.zone" ''
-              $TTL 3600
-              . IN SOA example.org. admin.example.org. ( 1 3h 1h 1w 1d )
-              . IN NS example.org.
-              example.org. IN AAAA 2001:db8::1
-            '';
-          };
-
-        # webserver
-        services.nginx.enable = true;
-        services.nginx.virtualHosts.${snakeoil.domain} =
-          { onlySSL = true;
-            listenAddresses = [ "localhost" ];
-            sslCertificate = snakeoil.${snakeoil.domain}.cert;
-            sslCertificateKey = snakeoil.${snakeoil.domain}.key;
-            locations."/ip".extraConfig = ''
-              default_type text/plain;
-              return 200 "Ciao $remote_addr!\n";
-            '';
-          };
-
-        # demultiplex HTTP and DNS from port 443
-        services.sslh =
-          { enable = true;
-            method = "ev";
-            settings.transparent = true;
-            settings.listen = lib.mkForce
-              [ { host = "server"; port = "443"; is_udp = false; }
-                { host = "server"; port = "443"; is_udp = true; }
-              ];
-            settings.protocols =
-              [ # Send TLS to webserver (TCP)
-                { name = "tls"; host= "localhost"; port= "443"; }
-                # Send DNSCrypt to dnscrypt-wrapper (TCP or UDP)
-                { name = "anyprot"; host = "localhost"; port = "5353"; }
-                { name = "anyprot"; host = "localhost"; port = "5353"; is_udp = true;}
-              ];
-          };
-
-        networking.firewall.allowedTCPPorts = [ 443 ];
-        networking.firewall.allowedUDPPorts = [ 443 ];
-      };
-
-    client = {
-      networking.hosts = hosts;
-      networking.interfaces.eth1.ipv6.addresses = lib.singleton
-        { address = "fd::b"; prefixLength = 64; };
-
-      services.dnscrypt-proxy2.enable = true;
-      services.dnscrypt-proxy2.upstreamDefaults = false;
-      services.dnscrypt-proxy2.settings =
-        { server_names = [ "server" ];
-          listen_addresses = [ "[::1]:53" ];
-          cache = false;
-          # Computed using https://dnscrypt.info/stamps/
-          static.server.stamp =
-            "sdns://AQAAAAAAAAAADzE5Mi4xNjguMS4yOjQ0MyAUQdg6"
-            +"_RIIpK6pHkINhrv7nxwIG5c7b_m5NJVT3A1AXRYyLmRuc2NyeXB0LWNlcnQuc2VydmVy";
-        };
-      networking.nameservers = [ "::1" ];
-      security.pki.certificateFiles = [ snakeoil.ca.cert ];
-    };
-
-  };
-
-  testScript = ''
-    with subtest("The server can generate the ephemeral keypair"):
-        server.wait_for_unit("dnscrypt-wrapper")
-        server.wait_for_file("/var/lib/dnscrypt-wrapper/2.dnscrypt-cert.server.key")
-        server.wait_for_file("/var/lib/dnscrypt-wrapper/2.dnscrypt-cert.server.crt")
-        almost_expiration = server.succeed("date --date '4days 23 hours 56min'").strip()
-
-    with subtest("The DNSCrypt client can connect to the server"):
-        server.wait_for_unit("sslh")
-        client.wait_until_succeeds("journalctl -u dnscrypt-proxy2 --grep '\[server\] OK'")
-
-    with subtest("HTTP client can connect to the server"):
-        server.wait_for_unit("nginx")
-        client.succeed("curl -s --fail https://${snakeoil.domain}/ip | grep -q fd::b")
-
-    with subtest("DNS queries over UDP are working"):
-        server.wait_for_unit("bind")
-        client.wait_for_open_port(53)
-        assert "2001:db8::1" in client.wait_until_succeeds(
-            "host -U example.org"
-        ), "The IP address of 'example.org' does not match 2001:db8::1"
-
-    with subtest("DNS queries over TCP are working"):
-        server.wait_for_unit("bind")
-        client.wait_for_open_port(53)
-        assert "2001:db8::1" in client.wait_until_succeeds(
-            "host -T example.org"
-        ), "The IP address of 'example.org' does not match 2001:db8::1"
-
-    with subtest("The server rotates the ephemeral keys"):
-        # advance time by a little less than 5 days
-        server.succeed(f"date -s '{almost_expiration}'")
-        client.succeed(f"date -s '{almost_expiration}'")
-        server.wait_for_file("/var/lib/dnscrypt-wrapper/oldkeys")
-
-    with subtest("The client can still connect to the server"):
-        client.systemctl("restart dnscrypt-proxy2")
-        client.wait_until_succeeds("host -T example.org")
-        client.wait_until_succeeds("host -U example.org")
-  '';
-}
--- a/nixos/tests/dnscrypt-wrapper/public.key
+++ b/nixos/tests/dnscrypt-wrapper/public.key
@ -1 +0,0 @@
-A<>:<3A><08><><EFBFBD>B
<0A><><EFBFBD><EFBFBD><1B>;o<><6F>4<EFBFBD>S<EFBFBD>
@]
--- a/nixos/tests/dnscrypt-wrapper/secret.key
+++ b/nixos/tests/dnscrypt-wrapper/secret.key
@ -1 +0,0 @@
-G½>ֶ©» ל>׀א¥(ׂ²‡¼J•«÷=<3D>„<EFBFBD>ֱ<EFBFBD>lלA״:‎₪®©B
†»<E280A0><C2BB>—;oש¹4•S<E280A2>
@]
--- a/nixos/tests/outline.nix
+++ b/nixos/tests/outline.nix
@ -13,7 +13,7 @@ in
 {
  name = "outline";

-  meta.maintainers = with lib.maintainers; [ xanderio ];
+  meta.maintainers = lib.teams.cyberus.members;

  nodes = {
    outline = { pkgs, config, ... }: {
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/gn-mode-from-sources/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/gn-mode-from-sources/package.nix
@ -0,0 +1,28 @@
+{
+  lib,
+  gn,
+  melpaBuild,
+}:
+
+melpaBuild {
+  pname = "gn-mode-from-sources";
+  ename = "gn-mode";
+  version = "0-unstable-${gn.version}";
+  inherit (gn) src;
+
+  files = ''("misc/emacs/gn-mode.el")'';
+
+  # Fixes the malformed header error
+  postPatch = ''
+    substituteInPlace misc/emacs/gn-mode.el \
+      --replace-fail ";;; gn-mode.el - " ";;; gn-mode.el --- "
+  '';
+
+  ignoreCompilationError = false;
+
+  meta = {
+    inherit (gn.meta) homepage license;
+    maintainers = with lib.maintainers; [ ];
+    description = "Major mode for editing GN files; taken from GN sources";
+  };
+}
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -8537,6 +8537,18 @@ final: prev:
    meta.homepage = "https://github.com/olrtg/nvim-rename-state/";
  };

+  nvim-rip-substitute = buildVimPlugin {
+    pname = "nvim-rip-substitute";
+    version = "2024-08-30";
+    src = fetchFromGitHub {
+      owner = "chrisgrieser";
+      repo = "nvim-rip-substitute";
+      rev = "4e5ed58d74d210b853255e3d1a4ab6410f3007b5";
+      sha256 = "0p6ycz1bq8j5xafn59kyn5xdashbir66gnzlqdpdmzmigw3z9vq1";
+    };
+    meta.homepage = "https://github.com/chrisgrieser/nvim-rip-substitute/";
+  };
+
  nvim-scrollbar = buildVimPlugin {
    pname = "nvim-scrollbar";
    version = "2024-06-03";
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -717,6 +717,7 @@ https://github.com/gennaro-tedesco/nvim-peekup/,,
 https://github.com/yorickpeterse/nvim-pqf/,HEAD,
 https://github.com/jamestthompson3/nvim-remote-containers/,HEAD,
 https://github.com/olrtg/nvim-rename-state/,HEAD,
+https://github.com/chrisgrieser/nvim-rip-substitute/,,
 https://github.com/petertriho/nvim-scrollbar/,HEAD,
 https://github.com/dstein64/nvim-scrollview/,,
 https://github.com/s1n7ax/nvim-search-and-replace/,HEAD,
--- a/pkgs/applications/networking/browsers/firefox-bin/update.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/update.nix
@ -12,6 +12,7 @@
 , baseName ? "firefox"
 , basePath ? "pkgs/applications/networking/browsers/firefox-bin"
 , baseUrl
+, versionSuffix ? ""
 }:

 let
@ -47,7 +48,7 @@ in writeScript "update-${pname}" ''
           grep "^[0-9]" | \
           sort --version-sort | \
           grep -v "funnelcake" | \
-           grep -e "${lib.optionalString isBeta "b"}\([[:digit:]]\|[[:digit:]][[:digit:]]\)$" | ${lib.optionalString (!isBeta) "grep -v \"b\" |"} \
+           grep -e "${lib.optionalString isBeta "b"}\([[:digit:]]\|[[:digit:]][[:digit:]]\)${versionSuffix}$" | ${lib.optionalString (!isBeta) "grep -v \"b\" |"} \
           tail -1`

  curl --silent -o $HOME/shasums "$url$version/SHA256SUMS"
--- a/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix
@ -3,48 +3,10 @@
 # To update `thunderbird-bin`'s `release_sources.nix`, run from the nixpkgs root:
 #
 #     nix-shell maintainers/scripts/update.nix --argstr package pkgs.thunderbird-bin-unwrapped
-{ lib, stdenv, fetchurl, config, wrapGAppsHook3
+{ lib, stdenv, fetchurl, config, wrapGAppsHook3, autoPatchelfHook
 , alsa-lib
-, atk
-, cairo
 , curl
-, cups
-, dbus-glib
-, dbus
-, fontconfig
-, freetype
-, gdk-pixbuf
-, glib
-, glibc
-, gtk2
 , gtk3
-, libkrb5
-, libX11
-, libXScrnSaver
-, libxcb
-, libXcomposite
-, libXcursor
-, libXdamage
-, libXext
-, libXfixes
-, libXi
-, libXinerama
-, libXrender
-, libXrandr
-, libXt
-, libXtst
-, libcanberra
-, libnotify
-, adwaita-icon-theme
-, libGLU, libGL
-, nspr
-, nss_latest
-, pango
-, pipewire
-, pciutils
-, heimdal
-, libpulseaudio
-, systemd
 , writeScript
 , writeText
 , xidel
@ -52,10 +14,9 @@
 , gnused
 , gnugrep
 , gnupg
-, ffmpeg
 , runtimeShell
-, mesa # thunderbird wants gbm for drm+dmabuf
 , systemLocale ? config.i18n.defaultLocale or "en_US"
+, patchelfUnstable  # have to use patchelfUnstable to support --no-clobber-old-sections
 , generated
 }:

@ -86,83 +47,30 @@ let
    else lib.replaceStrings ["_"] ["-"] systemLocale;

  source = lib.findFirst (sourceMatches mozLocale) defaultSource sources;
+
+  pname = "thunderbird-bin";
 in

 stdenv.mkDerivation {
-  pname = "thunderbird-bin";
-  inherit version;
+  inherit pname version;

  src = fetchurl {
    url = "https://download-installer.cdn.mozilla.net/pub/thunderbird/releases/${version}/${source.arch}/${source.locale}/thunderbird-${version}.tar.bz2";
    inherit (source) sha256;
  };

-  libPath = lib.makeLibraryPath
-    [ stdenv.cc.cc
-      alsa-lib
-      atk
-      cairo
-      curl
-      cups
-      dbus-glib
-      dbus
-      fontconfig
-      freetype
-      gdk-pixbuf
-      glib
-      glibc
-      gtk2
-      gtk3
-      libkrb5
-      mesa
-      libX11
-      libXScrnSaver
-      libXcomposite
-      libXcursor
-      libxcb
-      libXdamage
-      libXext
-      libXfixes
-      libXi
-      libXinerama
-      libXrender
-      libXrandr
-      libXt
-      libXtst
-      libcanberra
-      libnotify
-      libGLU libGL
-      nspr
-      nss_latest
-      pango
-      pipewire
-      pciutils
-      heimdal
-      libpulseaudio
-      systemd
-      ffmpeg
-    ] + ":" + lib.makeSearchPathOutput "lib" "lib64" [
-      stdenv.cc.cc
-    ];
-
-  inherit gtk3;
-
-  nativeBuildInputs = [ wrapGAppsHook3 ];
-
-  buildInputs = [ gtk3 adwaita-icon-theme ];
-
-  # "strip" after "patchelf" may break binaries.
-  # See: https://github.com/NixOS/patchelf/issues/10
-  dontStrip = true;
-  dontPatchELF = true;
+  nativeBuildInputs = [ wrapGAppsHook3 autoPatchelfHook patchelfUnstable ];
+  buildInputs = [
+    alsa-lib
+  ];
+  # Thunderbird uses "relrhack" to manually process relocations from a fixed offset
+  patchelfFlags = [ "--no-clobber-old-sections" ];

  patchPhase = ''
    # Don't download updates from Mozilla directly
    echo 'pref("app.update.auto", "false");' >> defaults/pref/channel-prefs.js
  '';

-  # See "Note on GPG support" in `../thunderbird/default.nix` for explanations
-  # on adding `gnupg` and `gpgme` into PATH/LD_LIBRARY_PATH.
  installPhase =
    ''
      mkdir -p "$prefix/usr/lib/thunderbird-bin-${version}"
@ -171,21 +79,6 @@ stdenv.mkDerivation {
      mkdir -p "$out/bin"
      ln -s "$prefix/usr/lib/thunderbird-bin-${version}/thunderbird" "$out/bin/"

-      for executable in \
-        thunderbird thunderbird-bin plugin-container \
-        updater crashreporter webapprt-stub \
-        glxtest vaapitest
-      do
-        if [ -e "$out/usr/lib/thunderbird-bin-${version}/$executable" ]; then
-          patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-            "$out/usr/lib/thunderbird-bin-${version}/$executable"
-        fi
-      done
-
-      find . -executable -type f -exec \
-        patchelf --set-rpath "$libPath" \
-          "$out/usr/lib/thunderbird-bin-${version}/{}" \;
-
      # wrapThunderbird expects "$out/lib" instead of "$out/usr/lib"
      ln -s "$out/usr/lib" "$out/lib"

@ -197,16 +90,18 @@ stdenv.mkDerivation {
    '';

  passthru.updateScript = import ./../../browsers/firefox-bin/update.nix {
-    inherit lib writeScript xidel coreutils gnused gnugrep curl gnupg runtimeShell;
-    pname = "thunderbird-bin";
+    inherit pname lib writeScript xidel coreutils gnused gnugrep curl gnupg runtimeShell;
    baseName = "thunderbird";
    channel = "release";
    basePath = "pkgs/applications/networking/mailreaders/thunderbird-bin";
    baseUrl = "http://archive.mozilla.org/pub/thunderbird/releases/";
+    versionSuffix = "esr";
  };

  passthru = {
    binaryName = "thunderbird";
+    gssSupport = true;
+    gtk3 = gtk3;
  };

  meta = with lib; {
--- a/pkgs/applications/networking/mailreaders/thunderbird-bin/release_sources.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird-bin/release_sources.nix
@ -1,665 +1,665 @@
 {
-  version = "115.13.0";
+  version = "128.2.0esr";
  sources = [
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/af/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/af/thunderbird-128.2.0esr.tar.bz2";
      locale = "af";
      arch = "linux-x86_64";
-      sha256 = "73600c9de1e75f0a2baf7e13d9ecded491e93f7fb4d5aa63e8e4ec2f5c95ab2d";
+      sha256 = "f4b3a3087afc240c9c1b4439316b1f0fda190143cca1da0d0c10d537ec47fdf2";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/ar/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/ar/thunderbird-128.2.0esr.tar.bz2";
      locale = "ar";
      arch = "linux-x86_64";
-      sha256 = "8eee06c6f5d347d23fa2401862bc733065162415e15a8decba31d7f71afaf8f5";
+      sha256 = "d49d17d785de3f9145f5640e3c835a1cd6ec7b205868be4c0a598160835bfe25";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/ast/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/ast/thunderbird-128.2.0esr.tar.bz2";
      locale = "ast";
      arch = "linux-x86_64";
-      sha256 = "6ebcc36fc7306e49513ce6ba9090817acbfcc65eefacac552d4c1fbb3d2ee452";
+      sha256 = "7d2e82951778bf97279fe5c1eb9a36010af6d28ac3eaaaec7cff6da26cb51593";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/be/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/be/thunderbird-128.2.0esr.tar.bz2";
      locale = "be";
      arch = "linux-x86_64";
-      sha256 = "386cd002e1986c4ae5e3d05e3279713994b610453745b25199906427db3874ee";
+      sha256 = "e77107193165eb5050286965e752b326fa15f33cc891e011f01ab09b90e92d91";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/bg/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/bg/thunderbird-128.2.0esr.tar.bz2";
      locale = "bg";
      arch = "linux-x86_64";
-      sha256 = "c909a752e7f09c37ce67cd7995562eaa30cdb5f604bda70a222e376eacdab8b2";
+      sha256 = "f64b546fe7803e808a82de46f9bd118b897004afdfb10baa2de9a190e3572ce0";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/br/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/br/thunderbird-128.2.0esr.tar.bz2";
      locale = "br";
      arch = "linux-x86_64";
-      sha256 = "511f1af492da3cd5a6aea641a8cc67f5f779196cbd81a940f3b0390dc0c1809f";
+      sha256 = "a64ed5e163431a5fccfa452a565b109badbc80556cbe13bf00285afdb6fa1c1f";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/ca/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/ca/thunderbird-128.2.0esr.tar.bz2";
      locale = "ca";
      arch = "linux-x86_64";
-      sha256 = "c7f087af3ed5b3fa60b94cd5380aabf019397479591be08b60d23ca782ac144d";
+      sha256 = "b0fb10db25845009c25e1bdbb408a1cc6935dd742c8cc1acd7c398bff4a600d0";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/cak/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/cak/thunderbird-128.2.0esr.tar.bz2";
      locale = "cak";
      arch = "linux-x86_64";
-      sha256 = "fe7c6fe3e99f0d4d8d6e2561e1fb2e5e8ce6def6caa119d4bb73c55605c3222d";
+      sha256 = "74a8c917565f27eced4b9ec952fee871da7e51c2323e509225227ccdb231cb79";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/cs/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/cs/thunderbird-128.2.0esr.tar.bz2";
      locale = "cs";
      arch = "linux-x86_64";
-      sha256 = "222a9a0898375e5edfe09ff67a6db89a340eab4c7b195f895dbe891b5157846c";
+      sha256 = "63537a0b0efff24f47e9e8ea35bd28a55c6b96917c06a2dfa141d8f107f3194c";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/cy/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/cy/thunderbird-128.2.0esr.tar.bz2";
      locale = "cy";
      arch = "linux-x86_64";
-      sha256 = "19e3060fb67039a6fd70bbbce712aeab7def908528a3d54cc77387cac8c58d83";
+      sha256 = "fd459d4fcd1c6143f7a03ae3069073f4e4b8d097733d504dd0221069520fcc6e";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/da/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/da/thunderbird-128.2.0esr.tar.bz2";
      locale = "da";
      arch = "linux-x86_64";
-      sha256 = "a2462934c90fb2433692b8ccf342c1669770a20be0c3703ecc54f65e5aaa2487";
+      sha256 = "7b75d5ab21254ef75a96217d715fc0a951ab38e8da61c2411820daea4b2ab979";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/de/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/de/thunderbird-128.2.0esr.tar.bz2";
      locale = "de";
      arch = "linux-x86_64";
-      sha256 = "d45733c83c65abc1a3df8f6fc0cb2880c55405a4b2a798a5062304dc93f4ac43";
+      sha256 = "cb05aa781c9cb360b23c597ab4566954e2506c01e214b14b0f7e863b2d5cadc0";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/dsb/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/dsb/thunderbird-128.2.0esr.tar.bz2";
      locale = "dsb";
      arch = "linux-x86_64";
-      sha256 = "e91883128422d834b7713f1ffc0d8095882e4f4e594940c5adf825f38ca8c1e7";
+      sha256 = "0d79340c7ae3af1e3be717ec92fe1ee14a53a680991ee2fb092dc9d4894b62c3";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/el/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/el/thunderbird-128.2.0esr.tar.bz2";
      locale = "el";
      arch = "linux-x86_64";
-      sha256 = "f54b76e5ae958ad3eb5bf651f892fbfef460732dee8364df70ed5f8b24a77a5c";
+      sha256 = "58049b7f1224ed79f63e053c1dabf795f851e6441c09044e6b7272074cbaeb15";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/en-CA/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/en-CA/thunderbird-128.2.0esr.tar.bz2";
      locale = "en-CA";
      arch = "linux-x86_64";
-      sha256 = "fff09666b871aff621cc513aa8fab7843cb1d019e1914c9b654e8af797edfc04";
+      sha256 = "338d69c084b4a9dcf93b0536417ab8a3dfa258647229e74e2f6b487a3d381900";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/en-GB/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/en-GB/thunderbird-128.2.0esr.tar.bz2";
      locale = "en-GB";
      arch = "linux-x86_64";
-      sha256 = "2762b9c0c2da7b1d35b51231f395b34d6e7ed8a8c34c56a3c36fd1af40152d57";
+      sha256 = "cc87b7ea712cc7f426129245a32d26724047932c12c4f5ac262e52ca551d7378";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/en-US/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/en-US/thunderbird-128.2.0esr.tar.bz2";
      locale = "en-US";
      arch = "linux-x86_64";
-      sha256 = "b70d487213fca89aaed8c2a1da07e179597cf70c6bc56e5fcc93855afdf66365";
+      sha256 = "4200c48e8b57bddde15c7ad6757077e560d2f52a29da1902a35bcce945e751aa";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/es-AR/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/es-AR/thunderbird-128.2.0esr.tar.bz2";
      locale = "es-AR";
      arch = "linux-x86_64";
-      sha256 = "37341713a27b90cd8324585cbe2b4413ed0ce3415366b27f1cbfb97f91595e22";
+      sha256 = "a1cf08ad3e0a80b90814c779e031a97aa9dba9797b02acf8c2e45fb1e994d54f";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/es-ES/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/es-ES/thunderbird-128.2.0esr.tar.bz2";
      locale = "es-ES";
      arch = "linux-x86_64";
-      sha256 = "c2412ebe923dfcdc464bd6d7576c0fdfde748d26b5684b75618b21fa3396d69a";
+      sha256 = "2e0a4a2d9001c587b9f61478de6611a94de912ab8fe1ed3bace2959f3bfb57ee";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/es-MX/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/es-MX/thunderbird-128.2.0esr.tar.bz2";
      locale = "es-MX";
      arch = "linux-x86_64";
-      sha256 = "6a1e03cdf4605b768feb802502dc00b9cf7567804c8c2cc7eebf7855c10e555c";
+      sha256 = "e47fb45e3c8e05a0027bff1bf2b9a9fe07b73c28144beeceef5fe40b40fbd5a0";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/et/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/et/thunderbird-128.2.0esr.tar.bz2";
      locale = "et";
      arch = "linux-x86_64";
-      sha256 = "e8d92ff29455577680ea1c24f5025387ec502ae5ce65a528c3d526dc2b0e23d5";
+      sha256 = "c45c5801a736a578c06993f3e061e0df5c798fefc49f415d5ed1196c93d3b07f";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/eu/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/eu/thunderbird-128.2.0esr.tar.bz2";
      locale = "eu";
      arch = "linux-x86_64";
-      sha256 = "0added0bc1846f7231a8806bbf5d4478743fb9dab3ba12270a540cb298ce2e12";
+      sha256 = "f709c4440888772dca99dd6cc667a9d72d20a6e1eb5c84dfbb0a7a8e488a6f74";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/fi/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/fi/thunderbird-128.2.0esr.tar.bz2";
      locale = "fi";
      arch = "linux-x86_64";
-      sha256 = "08ecb359ec9f1bb79271fae375f4094f32232ca17ba516b4dc68d33a49fe26a4";
+      sha256 = "e6f32dfc0095065326ce886f0ccc46259a13ae4339f609b2519f74226cf88e02";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/fr/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/fr/thunderbird-128.2.0esr.tar.bz2";
      locale = "fr";
      arch = "linux-x86_64";
-      sha256 = "5cbb360a2f824a63a06996d8d7bd11184f04a154acca6d11f9d9ad149add7211";
+      sha256 = "92ba3a5b2ebddd5e6f60c52e948f3336360e69fb3c21ca97f5629f16b6c74158";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/fy-NL/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/fy-NL/thunderbird-128.2.0esr.tar.bz2";
      locale = "fy-NL";
      arch = "linux-x86_64";
-      sha256 = "8c489d2e33c2c0d0d1ecb7c8d8766fce2498ee1256cd37e12f4c975b5533a98d";
+      sha256 = "7f905d1e7d17dd314f3e58286bdac0f4fcfacdddf1df809dd95a80a992f3ac03";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/ga-IE/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/ga-IE/thunderbird-128.2.0esr.tar.bz2";
      locale = "ga-IE";
      arch = "linux-x86_64";
-      sha256 = "5841ef91f177e47ff8a272e76cb57968863c341531b45a42c14bac80979b3187";
+      sha256 = "10421949c685172e8c842fa99ab11ee249a4e8357b9595a10d9a93659d5f45b5";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/gd/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/gd/thunderbird-128.2.0esr.tar.bz2";
      locale = "gd";
      arch = "linux-x86_64";
-      sha256 = "a07eacd6df3834980886517a9eb1f5d4a6c05d087bb6aac024456b1867079ab6";
+      sha256 = "8861ac36c0c65b00e15fbe3ecb6b288c612b4226bc06d688189548e95abe46f7";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/gl/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/gl/thunderbird-128.2.0esr.tar.bz2";
      locale = "gl";
      arch = "linux-x86_64";
-      sha256 = "d5359822c6817dc8937a3d24e3e50efa27d450c1f9d48d5b79c63b7ffce54439";
+      sha256 = "44259d867c523488b62c06b41a340e5efdceda7e42faa98564643249c6409110";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/he/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/he/thunderbird-128.2.0esr.tar.bz2";
      locale = "he";
      arch = "linux-x86_64";
-      sha256 = "5320ef08555bf368c4e09a80524429482f2b23fb27b8b2850ef4a1f60eaf34b0";
+      sha256 = "56b6152345ae31bf2e721aa1c4256493214969d1e6237bb3d861b784d0ff61d1";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/hr/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/hr/thunderbird-128.2.0esr.tar.bz2";
      locale = "hr";
      arch = "linux-x86_64";
-      sha256 = "dd6a69a320ed40b662814da28af7165ac499cbcdca1371bba86ef4c84f0d0949";
+      sha256 = "64c7bf327329149f0f8f0138db5759fd0d2f032d58ea795b95f23c44e6cd2124";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/hsb/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/hsb/thunderbird-128.2.0esr.tar.bz2";
      locale = "hsb";
      arch = "linux-x86_64";
-      sha256 = "fdc547651aa09c3874366180d4e3fcca407fc8efba5745344cfca1f5c4597003";
+      sha256 = "b23577fb06f2813a6b8a0a0e8b76d029ec0d129758814696de4b5679e8b46d3f";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/hu/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/hu/thunderbird-128.2.0esr.tar.bz2";
      locale = "hu";
      arch = "linux-x86_64";
-      sha256 = "85b1b6f9b3f52258ddae7fd03dcd12dc87564d5d797cf7dd8c9fa6f1278da233";
+      sha256 = "9f2a7bb6990dfdd7b35922132701ead5505343ad53b12ef44743fffef8d4878e";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/hy-AM/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/hy-AM/thunderbird-128.2.0esr.tar.bz2";
      locale = "hy-AM";
      arch = "linux-x86_64";
-      sha256 = "13c0f0e3b112ac7d4ec0c794458b81057f9965ca718b10bf2b7880be4f4a85fd";
+      sha256 = "176130e7a7701022fdb308edfa8504c432639794e2582c214807d9496583de95";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/id/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/id/thunderbird-128.2.0esr.tar.bz2";
      locale = "id";
      arch = "linux-x86_64";
-      sha256 = "700393b3b121a6398e3f809d035e5b90fd8f3879f0a751a4ed362fb973b3ccfd";
+      sha256 = "80d9b02e4125d1e8f59cb7384c2ea6559c77a517675c84e286f8574d86459aeb";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/is/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/is/thunderbird-128.2.0esr.tar.bz2";
      locale = "is";
      arch = "linux-x86_64";
-      sha256 = "8eb368b9ffc00aa06238af03c16c3b183858aff829d5741100e515498bee065a";
+      sha256 = "677d0f4bc43d2efefc1fb052706cf7307ccf7b8bd529c76c1860e6f121daaf2e";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/it/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/it/thunderbird-128.2.0esr.tar.bz2";
      locale = "it";
      arch = "linux-x86_64";
-      sha256 = "c3d8d2136e3a0096c07413c0c591cc60e322ee1b929b5f6cd99708413014913c";
+      sha256 = "f7160c5183922bdcecdaf87100b1556081072dc31c2436690ac707e47511d36b";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/ja/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/ja/thunderbird-128.2.0esr.tar.bz2";
      locale = "ja";
      arch = "linux-x86_64";
-      sha256 = "af6109dade0343a3354e5b8c82df8505ecca189bb9eae0037a578db4fcf99f1b";
+      sha256 = "9b1144c1911f0186d4ad6b1b4526d55aad0a6de2157e02cd8bf593c827ac28f3";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/ka/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/ka/thunderbird-128.2.0esr.tar.bz2";
      locale = "ka";
      arch = "linux-x86_64";
-      sha256 = "ad7c22e31b575f28268794b390d75021bcf67cb2a4d7ecbdfc3a5bce8f547160";
+      sha256 = "1dbc9c8419f6f7d131c00851d54bab714ca30f75be97529bf5f679a859014050";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/kab/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/kab/thunderbird-128.2.0esr.tar.bz2";
      locale = "kab";
      arch = "linux-x86_64";
-      sha256 = "0356017444c3a046c85599f7188d012f1a8260a5a76d42e8bddb3e937ff1d0db";
+      sha256 = "fe5fbf0b7c3e5f10846a0ab019baf5ddddc7b7bbb04b32e56cfca6bde5d92fb6";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/kk/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/kk/thunderbird-128.2.0esr.tar.bz2";
      locale = "kk";
      arch = "linux-x86_64";
-      sha256 = "d278f53f92f4514b1a1b0cc87a6329e1cfe53d82c815557d2d1038b192fb0a03";
+      sha256 = "77055d3004bbe6fce489cb4ea8c9e6f75d19ad35d0015caceb24920d372036f3";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/ko/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/ko/thunderbird-128.2.0esr.tar.bz2";
      locale = "ko";
      arch = "linux-x86_64";
-      sha256 = "0cda6697ab6041f0983447e5594158e185905d34a7b3ec70022f258403dba6d5";
+      sha256 = "1711d530249728789931831680cb3062c1da2addd90482a195d27ccb2d69cb33";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/lt/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/lt/thunderbird-128.2.0esr.tar.bz2";
      locale = "lt";
      arch = "linux-x86_64";
-      sha256 = "f783e465629993c2e5d7c5f71fa421b289ca1051ab461ea4e128a9facf370e21";
+      sha256 = "e3fd07e0bf2c1c6586b5826c92e4aa2341faea04791e686c8e6213a0d0f4e00c";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/lv/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/lv/thunderbird-128.2.0esr.tar.bz2";
      locale = "lv";
      arch = "linux-x86_64";
-      sha256 = "b64684c99509c9b2751d4afaced2a2f6067251345f672eb84d2337f9082fee67";
+      sha256 = "432cce43817a60790d8295c49b6e04b5d595811a3bf5024d733302ea755ab1c3";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/ms/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/ms/thunderbird-128.2.0esr.tar.bz2";
      locale = "ms";
      arch = "linux-x86_64";
-      sha256 = "a001272f61877db602f26aa80c485f0ad7be82acc26343fbf18a95040aeed429";
+      sha256 = "110ea1d59a3d00d45198505ecb15100d9cbcc77bfba69fb9000ecdfcc9db1d4c";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/nb-NO/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/nb-NO/thunderbird-128.2.0esr.tar.bz2";
      locale = "nb-NO";
      arch = "linux-x86_64";
-      sha256 = "6d9b817608399d59a20d34da172529eacb950e19ddb3cb3966f8acb2704099e1";
+      sha256 = "7d7bac855a4e27055e0a8561172cde744058e74aa8233554504d87dfc68f29f6";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/nl/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/nl/thunderbird-128.2.0esr.tar.bz2";
      locale = "nl";
      arch = "linux-x86_64";
-      sha256 = "259e8b433b7c757c507f8deb5ae9453f593f353a7544ec6d8e4b798b3c9958e1";
+      sha256 = "4820f08e4979e9eddc4182fea39d023defcb450e7edac9c8a2d3b09c62669959";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/nn-NO/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/nn-NO/thunderbird-128.2.0esr.tar.bz2";
      locale = "nn-NO";
      arch = "linux-x86_64";
-      sha256 = "0af2bea6b0b4b56dfbbf0b3a4845d5540d17a2998ee000c16a9dee0e63814ee7";
+      sha256 = "835b1befa30afa3d8cd50f4cd9a2922cb63815ac1c9b240c491d114f4e8542cf";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/pa-IN/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/pa-IN/thunderbird-128.2.0esr.tar.bz2";
      locale = "pa-IN";
      arch = "linux-x86_64";
-      sha256 = "7a686986ed8d899ffd00dd770c04c16a0ba5ef66e6889dbf34e86d9794d27448";
+      sha256 = "cee9b2f3aee4e978772222f2946c99986ce36695f34e51708cae928bc66ab6ef";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/pl/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/pl/thunderbird-128.2.0esr.tar.bz2";
      locale = "pl";
      arch = "linux-x86_64";
-      sha256 = "d736d10c5c57a2b8b5c7ddd8620eea673e83a4efb66288dcac4f39fb9cafdeef";
+      sha256 = "ba29593feccd45c43605c6aaaddaa99afd25308e810e6059ca873a162a054eae";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/pt-BR/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/pt-BR/thunderbird-128.2.0esr.tar.bz2";
      locale = "pt-BR";
      arch = "linux-x86_64";
-      sha256 = "2666dfb8ed5cdcc747d91b5a8f396a268243c9e46aada60b26a62ac1904f11d0";
+      sha256 = "5e1bb94d66d757a62e093835f91b097586980702985931813d2825bf7b90f5c6";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/pt-PT/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/pt-PT/thunderbird-128.2.0esr.tar.bz2";
      locale = "pt-PT";
      arch = "linux-x86_64";
-      sha256 = "ba1a76293cac33601f8317e538b54c4a05b277f862d3e76e11944a0d51d0b4c2";
+      sha256 = "f437bdc00cc4cd70995000c4a23dc7407f8b0b42dd42d3e536e95ea6d79f0ebf";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/rm/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/rm/thunderbird-128.2.0esr.tar.bz2";
      locale = "rm";
      arch = "linux-x86_64";
-      sha256 = "d55625a4a75b671cc614f04fa55337df80d0949906256c8852274b0c73f9d8c1";
+      sha256 = "b068a55935501994c69390b2d45b3592e2d3f7fb8e270fb058aec8882a353e90";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/ro/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/ro/thunderbird-128.2.0esr.tar.bz2";
      locale = "ro";
      arch = "linux-x86_64";
-      sha256 = "ff56d88c4c003bf8e5aa245b65ae17d0d2a3f40ab5cf341fedf7b2bbcfec7088";
+      sha256 = "6f6fce04d2676a21dad81a77f0b875a3730e996810f249452fd49d277d13b39a";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/ru/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/ru/thunderbird-128.2.0esr.tar.bz2";
      locale = "ru";
      arch = "linux-x86_64";
-      sha256 = "a9eb569ff312c13fc651c44f192c64cd46eb27624f71a4ad9399b0531cdf1a57";
+      sha256 = "2044141931cb4735ef1236b8c000aeed718266cbbd3c28b5d3fd3ddda4f64317";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/sk/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/sk/thunderbird-128.2.0esr.tar.bz2";
      locale = "sk";
      arch = "linux-x86_64";
-      sha256 = "82bb11f5491a90404d40692218848a36c62ee1f73294f94abaf89102c185dfae";
+      sha256 = "bdf6d92e16397237d5c9168d3d5f14d0ffc8df04e9b435a5f1e7a49138cf593f";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/sl/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/sl/thunderbird-128.2.0esr.tar.bz2";
      locale = "sl";
      arch = "linux-x86_64";
-      sha256 = "b5400b07f12e0712157bbaedafd9f88e7d2326e1407b9a989ae9da8fc245c558";
+      sha256 = "21aa9cd554c5a5d6f23f433c4697e47e3fca90d957f9a413d3b7aeb030055544";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/sq/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/sq/thunderbird-128.2.0esr.tar.bz2";
      locale = "sq";
      arch = "linux-x86_64";
-      sha256 = "cff26cd2e27db6c374d1b34da18bd513010bd4572a5abd3179cb6b0bb062a750";
+      sha256 = "f8bfdbb24d67341cd5d3e88012883835a2d48f18e0d6efe33c1b726431bc279b";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/sr/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/sr/thunderbird-128.2.0esr.tar.bz2";
      locale = "sr";
      arch = "linux-x86_64";
-      sha256 = "bce534608ef8da85ea0083dfc86c40759b4b073c90369f94ed98df3d41c3e1c9";
+      sha256 = "f906ca1bd4391ccad57eed53d247d32fd62b3328a005e034e5f76e74ea37aa4b";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/sv-SE/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/sv-SE/thunderbird-128.2.0esr.tar.bz2";
      locale = "sv-SE";
      arch = "linux-x86_64";
-      sha256 = "3a2e9f610436b140e3a7098ac27516c3ce5fe2dd672e23a85050bbd896bb2738";
+      sha256 = "697c1c80cc743f5446c3d6744cfac640bf5968d9b8322697546af9a4cffe6517";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/th/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/th/thunderbird-128.2.0esr.tar.bz2";
      locale = "th";
      arch = "linux-x86_64";
-      sha256 = "3753527489a666c2e89cc1c4be85d85a52890069700ef9bd809e14a50d253d37";
+      sha256 = "62bf8a81688e3405ebde85623df7cbb9c87a41ed0b86ef32f791c1a3b383c185";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/tr/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/tr/thunderbird-128.2.0esr.tar.bz2";
      locale = "tr";
      arch = "linux-x86_64";
-      sha256 = "90d37e9512c46db20d8ce44863dabb1c72b196fb26e462e310f83bf7472763b1";
+      sha256 = "af3b01def0092f1abd3dc7517ac68e41d92fa816ff0ee0045a14fffd257dc732";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/uk/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/uk/thunderbird-128.2.0esr.tar.bz2";
      locale = "uk";
      arch = "linux-x86_64";
-      sha256 = "07f8d8809d3dc079e9f5d25f0b553b96efa975c69f4b94ddc5772bbb07c6f2a9";
+      sha256 = "0b5c83c3e28b59c7feeba5ce953b0b60d115f33f567e7942d450c804e4f0d236";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/uz/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/uz/thunderbird-128.2.0esr.tar.bz2";
      locale = "uz";
      arch = "linux-x86_64";
-      sha256 = "7d3d207fe4f427b5492771a6db5f6716d0f49ea2452f3521c53d06da15090135";
+      sha256 = "45091cbd6336995b86d3e2b5e0ef82792dc5484a90ca94de905526d3122853c2";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/vi/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/vi/thunderbird-128.2.0esr.tar.bz2";
      locale = "vi";
      arch = "linux-x86_64";
-      sha256 = "48de00ce91f678f9e2b2fdddd57b164feee7c06079c10796707cd1be67452cf1";
+      sha256 = "448a8ed43b80448994b918f3f91c3de3698b106f578b776efbaa7b4e4c4d3fc1";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/zh-CN/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/zh-CN/thunderbird-128.2.0esr.tar.bz2";
      locale = "zh-CN";
      arch = "linux-x86_64";
-      sha256 = "686dd1d40c6e5d473b7f768919567d71d7a32bf277aa4f20ee160850d4a19812";
+      sha256 = "53cbdf5039e2f6d724b45ecf948c63af367e7df4f7766e628fb945fce33734f8";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-x86_64/zh-TW/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-x86_64/zh-TW/thunderbird-128.2.0esr.tar.bz2";
      locale = "zh-TW";
      arch = "linux-x86_64";
-      sha256 = "3be64c8cb88ab2e93ce85249110e91da26f958f5f667f9b2c3524d9337aa3ae6";
+      sha256 = "147e2983179d906c7878a889a4e05be792fb54336f029b7c4c7f26f115ed9217";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/af/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/af/thunderbird-128.2.0esr.tar.bz2";
      locale = "af";
      arch = "linux-i686";
-      sha256 = "fc6f36e813419ef33d9491c0317c8f73a7d08a10d2767446a6e708499d0664db";
+      sha256 = "282558d2d07b3c44de23c5684771e8f2eab9f67f5fef844f569f84474687da04";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/ar/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/ar/thunderbird-128.2.0esr.tar.bz2";
      locale = "ar";
      arch = "linux-i686";
-      sha256 = "d7134af862d2f588623a9414d0e09702b04c20577f674ade2c67269db25e7bbf";
+      sha256 = "972d674e174433e6dd91627942a1d2e3e06b16c9fcc5288b9ab1f92a0a2526f8";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/ast/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/ast/thunderbird-128.2.0esr.tar.bz2";
      locale = "ast";
      arch = "linux-i686";
-      sha256 = "5632d2264f4ad78115c66542bb9a30bd92044e2e480612f0755d1f2bbac1fa39";
+      sha256 = "bb7c12421185c2a1db8e94bcd7d0c7b9d461272652ab22fa5a05f08e83a226c3";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/be/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/be/thunderbird-128.2.0esr.tar.bz2";
      locale = "be";
      arch = "linux-i686";
-      sha256 = "522b1219b3586e028023a0b40b5a0b807fd5bbf26981ae0b28fed41111dfd97f";
+      sha256 = "0a731f7c5caa910719d3efbf8d65a8d7149a3195631263de13e0ccdc51eb5268";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/bg/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/bg/thunderbird-128.2.0esr.tar.bz2";
      locale = "bg";
      arch = "linux-i686";
-      sha256 = "cee2dbcb5d3e6cff325cc5a9132d574c48cc356a524b619ab0efea481fed87a5";
+      sha256 = "af55dd242ea2edceb2b7faabcf26f1c976efb9f8b5ff76d5b07cfbd9c6eb55d5";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/br/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/br/thunderbird-128.2.0esr.tar.bz2";
      locale = "br";
      arch = "linux-i686";
-      sha256 = "5583cf26d49f32dfaf5a7000c8c670d3b7fd1e839595960bc73e81e5bed8b2b1";
+      sha256 = "b5b249a78710ba4c7d1bc696fccfa7a63a517d537ac4f011ba7a22f2d3fffb0a";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/ca/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/ca/thunderbird-128.2.0esr.tar.bz2";
      locale = "ca";
      arch = "linux-i686";
-      sha256 = "7ecbeb64308d4a8962c86a75742dcf86ac4f3a0009fa60071f1ba90e3fd89cc3";
+      sha256 = "2dc876760e6520cd3ace249943e37d363f98388e799c0e0fb2d51e751404de40";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/cak/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/cak/thunderbird-128.2.0esr.tar.bz2";
      locale = "cak";
      arch = "linux-i686";
-      sha256 = "4c55e8fa96c9763d1b8e9d8c47b55683827dfceac982514206c422edd34afe37";
+      sha256 = "836350ae188d39899231a26d7e10eaa029559c83a3395b7c74536d37f73d795f";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/cs/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/cs/thunderbird-128.2.0esr.tar.bz2";
      locale = "cs";
      arch = "linux-i686";
-      sha256 = "6f0e483d77b6322fcd50decd868994c9a22e8f7f8ede4a8cc6def64cebf3fd36";
+      sha256 = "1b3bdd19f3e880bab7428e831f490c0ce69fe1db20b8699402e956f09b77c5ff";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/cy/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/cy/thunderbird-128.2.0esr.tar.bz2";
      locale = "cy";
      arch = "linux-i686";
-      sha256 = "0c727b6364d07666417f7ab03dbf9e8e1cc040d855cbe361e1385cb2d4aa4242";
+      sha256 = "b1153a70b2bcf6e9f0deaaaf175a5085921f7d1e1a1f319136c94ce57bef54ed";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/da/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/da/thunderbird-128.2.0esr.tar.bz2";
      locale = "da";
      arch = "linux-i686";
-      sha256 = "819b01b0fb03eab22d58de73f464e98133778154e122463d20693b4aa1090ecb";
+      sha256 = "a2eb8ba6175dd4b7336ab05fe4834527a31ab5e13abb0381f187e91f836031e3";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/de/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/de/thunderbird-128.2.0esr.tar.bz2";
      locale = "de";
      arch = "linux-i686";
-      sha256 = "84db18d8ebc383fac729a9e5be2554169368aaaac34523450151ec9c4f8015b1";
+      sha256 = "1c23af1559f2e8f090cc651c827d4130e74f7141daae585ddc43c0287b8b0e0a";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/dsb/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/dsb/thunderbird-128.2.0esr.tar.bz2";
      locale = "dsb";
      arch = "linux-i686";
-      sha256 = "4d23aead7db91ca8f657f6eefc3cb37d08be537586d492122b2583c5e4bac516";
+      sha256 = "341d6a892f5b79836bb18fcd97df1b2fab695791a50af6ded0d966f1d0439008";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/el/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/el/thunderbird-128.2.0esr.tar.bz2";
      locale = "el";
      arch = "linux-i686";
-      sha256 = "44833b968bf29d784163776cc7343d23a9c4a781aa36728dcea9fad23b776aa8";
+      sha256 = "8eb920d8e41cc1ca8607580f124061f9c10a549377b591ac5cfb53b2859248d9";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/en-CA/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/en-CA/thunderbird-128.2.0esr.tar.bz2";
      locale = "en-CA";
      arch = "linux-i686";
-      sha256 = "c29f159ff4a8aa234f8117c936fc1621aac4ad12841ac261a85c7326d9ad8704";
+      sha256 = "ca2c7d3eee2129e3da7bc4a7d25db4b867c23408084a9438c4a600c1d35c9853";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/en-GB/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/en-GB/thunderbird-128.2.0esr.tar.bz2";
      locale = "en-GB";
      arch = "linux-i686";
-      sha256 = "51a2633ed89f3eb08df77153a1a894983b9609fab6aed998cbad7e78129845aa";
+      sha256 = "f8f1aeddf0b5711e10ae4a4d785380230a9f8871d73baebe95ae43f3bf4b2a45";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/en-US/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/en-US/thunderbird-128.2.0esr.tar.bz2";
      locale = "en-US";
      arch = "linux-i686";
-      sha256 = "badce662962c90cc0fe4a0e89c7b69185fcf11ac1fdebcb12078226d06eec7cd";
+      sha256 = "c89cda02e8a17ff8e455085ef22c1a14f8d42217239e68133ab0d3076a4df170";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/es-AR/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/es-AR/thunderbird-128.2.0esr.tar.bz2";
      locale = "es-AR";
      arch = "linux-i686";
-      sha256 = "6e26898de69237d3915c7b7b18ee565e1b882a0a62ff89d0c64de74f4cf32b06";
+      sha256 = "30b6d06405cdc824d2ea2e8ae3352403d631e02d182621035c9c4b89a2f5d3e8";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/es-ES/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/es-ES/thunderbird-128.2.0esr.tar.bz2";
      locale = "es-ES";
      arch = "linux-i686";
-      sha256 = "8de6a6bc3c688375239fd56a72c8f9b5db45dbc01793cdb4e508b89b600957cf";
+      sha256 = "4a52ee0cad2c6adb85a5e847b71761fa931f2baa34f310c2135249a1f74d1e81";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/es-MX/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/es-MX/thunderbird-128.2.0esr.tar.bz2";
      locale = "es-MX";
      arch = "linux-i686";
-      sha256 = "d7fa892b266cde71881c6bc1a2926c273ac9990a5f555a1da7ad92e8da7d2079";
+      sha256 = "5e3ee38af26a47df39c542da9cad4f0f5fcd761b93cc25aa3b3e484afea342a2";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/et/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/et/thunderbird-128.2.0esr.tar.bz2";
      locale = "et";
      arch = "linux-i686";
-      sha256 = "7e3f6026fd7eb69fcc716b1fd512e43bb24e666fd9792b9c0fcdecc6c2080c64";
+      sha256 = "bad8263e3754045770662250327c14ea50a11d46d786fcf0d41f761e0cc2c60f";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/eu/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/eu/thunderbird-128.2.0esr.tar.bz2";
      locale = "eu";
      arch = "linux-i686";
-      sha256 = "6992361227e6455834651d2d4c322d68b2772e81f5d41495bc891c6968a31fb3";
+      sha256 = "8433875ae5b054541f6fc70ef566482acabc9f013a0010d4d3125c09acbd4e2c";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/fi/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/fi/thunderbird-128.2.0esr.tar.bz2";
      locale = "fi";
      arch = "linux-i686";
-      sha256 = "eb2f64b6079a7fc82ac9cb300a3263682c30f5d5ca88b7e8ffc239b0eeff2e4b";
+      sha256 = "4a077df147a2a27eff7cae97bf33c1d2ed92c11f6f6f6e71307bda9951137fe7";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/fr/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/fr/thunderbird-128.2.0esr.tar.bz2";
      locale = "fr";
      arch = "linux-i686";
-      sha256 = "2cd90fda0de39c0c5f880967d5b3c887b82a4b2b2cff68e563cacf918d1067c2";
+      sha256 = "4373edef98045ff52146a9899159f4d0614cefc0a49740c538ea52692097d45b";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/fy-NL/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/fy-NL/thunderbird-128.2.0esr.tar.bz2";
      locale = "fy-NL";
      arch = "linux-i686";
-      sha256 = "79e3d745529f8ba10c47bf47c530d251a60fba60ae6434c28b21d6d920715343";
+      sha256 = "0397b53ac71755e8ce65a946d3aa1eb2d025ee3e211857d31519f13d560e99f7";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/ga-IE/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/ga-IE/thunderbird-128.2.0esr.tar.bz2";
      locale = "ga-IE";
      arch = "linux-i686";
-      sha256 = "eecef1ff59423519f2dcda87e5bbe2d627324c1e2812d2ee8554fe4624ae5f13";
+      sha256 = "ea0f51dce8b5f51cb857c112eda213599a0cf85f03de718c3cccb575afe8c311";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/gd/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/gd/thunderbird-128.2.0esr.tar.bz2";
      locale = "gd";
      arch = "linux-i686";
-      sha256 = "98061b5bbba7663a76ba1fd81c45da1b819dc60d7eb328865bb4e6054893e68c";
+      sha256 = "4f2f2d90b84349889b93be998eadff420dc547b36ed2e232c3cdf6a4269a7c1e";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/gl/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/gl/thunderbird-128.2.0esr.tar.bz2";
      locale = "gl";
      arch = "linux-i686";
-      sha256 = "20b27324d5d1007898432a5149be39e023d0574cd9412e1981644fa437559462";
+      sha256 = "8737b1b7a116da2e2a7054c579d5898ecca15abff78a179d86734ea9a58e717e";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/he/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/he/thunderbird-128.2.0esr.tar.bz2";
      locale = "he";
      arch = "linux-i686";
-      sha256 = "d0b623cb12b09e8da788a248d9d0c73075a47ab400cd5e9636d63f802d81239f";
+      sha256 = "2260a9384ac575b3232dc5ceed92e76d56ffd44072784d26f4efaa30a7c4d33c";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/hr/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/hr/thunderbird-128.2.0esr.tar.bz2";
      locale = "hr";
      arch = "linux-i686";
-      sha256 = "a4c6f3c8c4e39677e4fa7a7260bff44764fa66e571919d70349f615429ded199";
+      sha256 = "30ffe91315ac17eaecbe112d4f7db5482c464843c80dcf45f2cb7739b6f957c2";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/hsb/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/hsb/thunderbird-128.2.0esr.tar.bz2";
      locale = "hsb";
      arch = "linux-i686";
-      sha256 = "e059202e8add45d767878d96af50d08e540e21af6239e101825153ad3bcde087";
+      sha256 = "4ab8a3ad84614e9b5efeb953e34a7258cdad035235d4de1e802351c04d135889";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/hu/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/hu/thunderbird-128.2.0esr.tar.bz2";
      locale = "hu";
      arch = "linux-i686";
-      sha256 = "a02b0c0460e6bdc54f4d9be92e78ff5c6f8730e1f7199f5f0eceefc220d585ab";
+      sha256 = "e710ec3beb0656fb14962cfae06b29be24d30f5c2cefd1cbb4e8e09471193d54";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/hy-AM/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/hy-AM/thunderbird-128.2.0esr.tar.bz2";
      locale = "hy-AM";
      arch = "linux-i686";
-      sha256 = "53b02544de8294c1292311510f5e72b0b0c6c0209e3d01d92d603e5e52f988b6";
+      sha256 = "18941e2454d60b17aeebdc95aad7854b989e71c4e928b0147c0beb36eff54f3f";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/id/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/id/thunderbird-128.2.0esr.tar.bz2";
      locale = "id";
      arch = "linux-i686";
-      sha256 = "014a9d5214ccd346df23168d1f523374bc5058d247a3817fa8a3df1af7255230";
+      sha256 = "029c210861312a5d2d3c59f69b692692b133296b27d125367ac2cc2419e0a8d5";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/is/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/is/thunderbird-128.2.0esr.tar.bz2";
      locale = "is";
      arch = "linux-i686";
-      sha256 = "f81280dd398b1e5f6e003ec040052f739d20e3f5bc6ebf79ba5ddef068ab9cd7";
+      sha256 = "bdc4447638fc299cf5974adf5ca268d6d4a46f6d1b22b51e54b2de46f1c266c8";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/it/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/it/thunderbird-128.2.0esr.tar.bz2";
      locale = "it";
      arch = "linux-i686";
-      sha256 = "54a9b84390fe010708a901aeedd95a1a6b51aeeb44c47760ee68c261898fa52a";
+      sha256 = "b3a39203e13635e59b6f58fbd053ebe630c5da786325c48f62f2493e00237d32";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/ja/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/ja/thunderbird-128.2.0esr.tar.bz2";
      locale = "ja";
      arch = "linux-i686";
-      sha256 = "a3a1e497d31244a7acc5ea99a1cd4129c28fc00d82d750b5ce360165e7c6b915";
+      sha256 = "d684e3c5423710c07f5f6918257acabff6ee3c7fa685fb19269f482a6c6f9c61";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/ka/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/ka/thunderbird-128.2.0esr.tar.bz2";
      locale = "ka";
      arch = "linux-i686";
-      sha256 = "df4ea755689a82315627d851fa7b59d5cb9730064785099273431e1993ccb529";
+      sha256 = "5363ebecae103a8b5d37dbd0011e6bdc284e28beb4a32dae17314d3ab420cd22";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/kab/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/kab/thunderbird-128.2.0esr.tar.bz2";
      locale = "kab";
      arch = "linux-i686";
-      sha256 = "e40f72751b40fe6896ab0cdd78ab540ece04d1650c35d1d9af944f5e9983da69";
+      sha256 = "06a8be9cd3cdd3a7b6dd1c9d854a92858c3bde93a1ec49986a9e9325d883527a";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/kk/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/kk/thunderbird-128.2.0esr.tar.bz2";
      locale = "kk";
      arch = "linux-i686";
-      sha256 = "aee0ac4b2bf06468b0fd4d302507693c3e5a76426d4aa2b4deb9081f054156b3";
+      sha256 = "48f9e2bb1efd842fa78cd593305771b43c80d25bbc5ae3336123af43a50a8676";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/ko/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/ko/thunderbird-128.2.0esr.tar.bz2";
      locale = "ko";
      arch = "linux-i686";
-      sha256 = "32cbdac8073fdc47feda1e17754a1966d668d10b881d137d593f10ef61f1c8a8";
+      sha256 = "09c25ebf06fb2524b3717f17a63c4ffc95925a626d0f102ce926108ba1fb4f0e";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/lt/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/lt/thunderbird-128.2.0esr.tar.bz2";
      locale = "lt";
      arch = "linux-i686";
-      sha256 = "be4a3241453d43ec04586d27c7a2d09c96ab0558eba5c52a6242b5cc39f7be89";
+      sha256 = "721c02bd8e8016494d7a32465cb69cac923fb8ba48bd32dbedde6c7e3d88a1be";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/lv/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/lv/thunderbird-128.2.0esr.tar.bz2";
      locale = "lv";
      arch = "linux-i686";
-      sha256 = "6b92c31b2e2cbb9f2dcf73d29004233f4a4128dfa315fcc0e642aab59ea65c82";
+      sha256 = "2f60dcfa5fbadb856aeb15b3542f27952469aa8b333fcb91d3d1e7f69cb9b3a2";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/ms/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/ms/thunderbird-128.2.0esr.tar.bz2";
      locale = "ms";
      arch = "linux-i686";
-      sha256 = "87cc4f4a7cf59361c899990e023a57ffd6cd7f8b575fa4f06b5045d71b7d0ba8";
+      sha256 = "cdf054772acb4130e300ba0aac0e803298387e775af0d890476239e3d7be7c05";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/nb-NO/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/nb-NO/thunderbird-128.2.0esr.tar.bz2";
      locale = "nb-NO";
      arch = "linux-i686";
-      sha256 = "5a21efede9c8f142e77c37dd569a42467408c9863c03b791b26153c4e09a962a";
+      sha256 = "1c56b63aff8096f946388498eee83ba509c46b2f8a609665eded59f13b729d22";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/nl/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/nl/thunderbird-128.2.0esr.tar.bz2";
      locale = "nl";
      arch = "linux-i686";
-      sha256 = "d6158645ee629b89a6d518d1e62f6777f3f453e6546ad177979473f432dfb376";
+      sha256 = "d93de2c117308f4843d9c9377ad336730834132ce823d2d0a1f49c40160c0933";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/nn-NO/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/nn-NO/thunderbird-128.2.0esr.tar.bz2";
      locale = "nn-NO";
      arch = "linux-i686";
-      sha256 = "1528148ba47eabfce476ca351ba0c7341a5454d38c798c3b6dfb1c2f02efd3f8";
+      sha256 = "4f183fe49f3725defcd1c2b4ae65bd95a5ff135b5f2ba0ef348fdecf04c2f7d4";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/pa-IN/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/pa-IN/thunderbird-128.2.0esr.tar.bz2";
      locale = "pa-IN";
      arch = "linux-i686";
-      sha256 = "8d6c1f3ce92af5e19e24661aa7bbbe815e3c9ac7ff3e9b6db7c2662e8f56f97c";
+      sha256 = "f9c8787bd95bdedc4e21fb9ee13b2d4ce7bb051bc3890d104b805b5f859ab922";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/pl/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/pl/thunderbird-128.2.0esr.tar.bz2";
      locale = "pl";
      arch = "linux-i686";
-      sha256 = "b26ab380e57e442047092f8f12ce701fc062d3dffb3fb905ffde8ec1c2bd9975";
+      sha256 = "f536ba3b737d23dc9e0b0f9bf6d0bef06c08c35f37ae92e8f56ce49760422614";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/pt-BR/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/pt-BR/thunderbird-128.2.0esr.tar.bz2";
      locale = "pt-BR";
      arch = "linux-i686";
-      sha256 = "23ff7b60b2a754c34bf243851ce7896cba6918126615ebffb030180fc4df754b";
+      sha256 = "5d7a8b873affd479fcefbe88db6677fdbe616ad67031ccf7fdeee4e740e99653";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/pt-PT/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/pt-PT/thunderbird-128.2.0esr.tar.bz2";
      locale = "pt-PT";
      arch = "linux-i686";
-      sha256 = "f6667f60d0a54f4e5c25b7c15d843f7215fb0ff8f65962b9ed219f9fa1cac9c1";
+      sha256 = "999f812b3ca0cec36503a425b0d756555bc159e2a1cd952a06d65034d28aa0f9";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/rm/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/rm/thunderbird-128.2.0esr.tar.bz2";
      locale = "rm";
      arch = "linux-i686";
-      sha256 = "c6c6d412f9a01824bedb46094239caec8c8f32b249f5c9bcce455166472e0c8a";
+      sha256 = "081809c7c14f8056db296ff3ac97e2a9aaaf56302a40ffb8ede62d83e17fc944";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/ro/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/ro/thunderbird-128.2.0esr.tar.bz2";
      locale = "ro";
      arch = "linux-i686";
-      sha256 = "d87bb9e6262ca8639db9c72dc512ccd6e2c5c644b2540b76f1d8db2c6cc11681";
+      sha256 = "61ffe80eb8d740dda615ced1365b96f6a453947cd174bc3e96577538e3ffb8b3";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/ru/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/ru/thunderbird-128.2.0esr.tar.bz2";
      locale = "ru";
      arch = "linux-i686";
-      sha256 = "933509f254d0a83807eb8423a812b44fa293a34302179bde31f8e7c63f29f17a";
+      sha256 = "c71adef5e11819e3cb7d8ba9c4081058e76f5e3a07e57f8e6c66dd4baf53945c";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/sk/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/sk/thunderbird-128.2.0esr.tar.bz2";
      locale = "sk";
      arch = "linux-i686";
-      sha256 = "7075f022ecbc76d4c00a9816f85f22a08998bd44080b3edf7bb2b15f78a5ca98";
+      sha256 = "28f2ead6651a8fd9d2e75ad3eca88161e93aa13b0ab4e4efa22a5b4e0f77804d";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/sl/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/sl/thunderbird-128.2.0esr.tar.bz2";
      locale = "sl";
      arch = "linux-i686";
-      sha256 = "66bd3ea1238198fdf240fa471c846b83ae6ddcb7bb164d3e0bad8480c2b0c9cc";
+      sha256 = "ace141250862bd1ed339e2a808c059e453ee48cc655e1fec00539c44c12fc77a";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/sq/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/sq/thunderbird-128.2.0esr.tar.bz2";
      locale = "sq";
      arch = "linux-i686";
-      sha256 = "0fa98fbe0ebd473ffb247546fba6e7ebcb994bbd4bbbbffb868c2d27984ed8e2";
+      sha256 = "4463332d93d5f055a39aefefee061c496e4df909c5f605e561bdad524df0ec8b";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/sr/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/sr/thunderbird-128.2.0esr.tar.bz2";
      locale = "sr";
      arch = "linux-i686";
-      sha256 = "8388932ebc71148cfd3be78d5fd31754c78c4e249930ec5290876655e115207a";
+      sha256 = "c6b2bc17a929cce1f829809870cbee9be414c0847ce00a51afa923977a1e0bb7";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/sv-SE/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/sv-SE/thunderbird-128.2.0esr.tar.bz2";
      locale = "sv-SE";
      arch = "linux-i686";
-      sha256 = "793f43ad4062323b408527cbf98988291452fb5007938fc6c75f794a95f6fbbd";
+      sha256 = "71241892935c67e156ea3b37e46056896ac9e60ec90f328ff6fbde1d3fc15bff";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/th/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/th/thunderbird-128.2.0esr.tar.bz2";
      locale = "th";
      arch = "linux-i686";
-      sha256 = "ccd43eb6dd39d0be2af3ab4581a1d49563b78aa1389ff227b5b9c7ae83a782b1";
+      sha256 = "23a404e4f2ad01295a8a6b8439e6a4a733b4ee26eeb709c71ef76a6fb859a244";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/tr/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/tr/thunderbird-128.2.0esr.tar.bz2";
      locale = "tr";
      arch = "linux-i686";
-      sha256 = "61cef2f34fba3606af62ed2cdeff626f73d1bf628af17c9a30b151da4f7357e2";
+      sha256 = "e418a2be53df374d9ea08fd64a890dbe076e420d9b0e2db3dd58035433801d57";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/uk/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/uk/thunderbird-128.2.0esr.tar.bz2";
      locale = "uk";
      arch = "linux-i686";
-      sha256 = "51daf721ea9864fb199eab9908792b67031005238067543f4a69ebc5ad4fb10c";
+      sha256 = "0185113bbdda3bf7fc03578ff8cd7c2cabf691608d3ff67e598bb669c60690fb";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/uz/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/uz/thunderbird-128.2.0esr.tar.bz2";
      locale = "uz";
      arch = "linux-i686";
-      sha256 = "83acb46cce8a7e94e16bb0dd323af816284728d507c2787ae3a8e77fd78662d9";
+      sha256 = "dda399a258e14ce9f38b5b1c4b9c366c52ed0d3158ae8eda45da3e28648bba6e";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/vi/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/vi/thunderbird-128.2.0esr.tar.bz2";
      locale = "vi";
      arch = "linux-i686";
-      sha256 = "2ddc9a1b085f1a936e1ac10fb84440cb6159d77baab95ee7a2073202b3341987";
+      sha256 = "fadfa641fd7363d82856b2957645a619c9f8f582c9bda78b6a74a825729aec91";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/zh-CN/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/zh-CN/thunderbird-128.2.0esr.tar.bz2";
      locale = "zh-CN";
      arch = "linux-i686";
-      sha256 = "6468070bca4ab013646945206c04a03a9b5ac5bac5b07cd48543aa0b7e980353";
+      sha256 = "667e7244f358e12973df794afd4077bb1ceb7e4cbaee88f0832cb2c25d151d1d";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/115.13.0/linux-i686/zh-TW/thunderbird-115.13.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/128.2.0esr/linux-i686/zh-TW/thunderbird-128.2.0esr.tar.bz2";
      locale = "zh-TW";
      arch = "linux-i686";
-      sha256 = "27a73e84abdea7e4f9d4fe595129f08dd92dc9fdb4d2a3c275481096be90cb8a";
+      sha256 = "becf451ca9483fb8a8d0b9d76942eac71df2d4ea063ff8f5411e84d9b8392898";
    }
    ];
 }
--- a/pkgs/applications/version-management/gitlab/gitlab-container-registry/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-container-registry/default.nix
@ -28,7 +28,7 @@ buildGoModule rec {
  meta = with lib; {
    description = "GitLab Docker toolset to pack, ship, store, and deliver content";
    license = licenses.asl20;
-    maintainers = with maintainers; [ yayayayaka xanderio ];
+    maintainers = with maintainers; [ yayayayaka ] ++ teams.cyberus.members;
    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/version-management/gitlab/gitlab-elasticsearch-indexer/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-elasticsearch-indexer/default.nix
@ -21,6 +21,6 @@ buildGoModule rec {
    description = "Indexes Git repositories into Elasticsearch for GitLab";
    mainProgram = "gitlab-elasticsearch-indexer";
    license = licenses.mit;
-    maintainers = with maintainers; [ xanderio yayayayaka ];
+    maintainers = with maintainers; [ yayayayaka ] ++ teams.cyberus.members;
  };
 }
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@ -63,20 +63,6 @@ let
  GO111MODULE = "on";
  GOTOOLCHAIN = "local";

-  toExtension =
-    overlay0:
-    if lib.isFunction overlay0 then
-      final: prev:
-      if lib.isFunction (overlay0 prev) then
-        # `overlay0` is `final: prev: { ... }`
-        overlay0 final prev
-      else
-        # `overlay0` is `prev: { ... }`
-        overlay0 prev
-    else
-      # `overlay0` is `{ ... }`
-      final: prev: overlay0;
-
 in
 (stdenv.mkDerivation (finalAttrs:
  args
@ -333,7 +319,7 @@ in
      # Canonicallize `overrideModAttrs` as an attribute overlay.
      # `passthru.overrideModAttrs` will be overridden
      # when users want to override `goModules`.
-      overrideModAttrs = toExtension overrideModAttrs;
+      overrideModAttrs = lib.toExtension overrideModAttrs;
    } // passthru;

    meta = {
--- a/pkgs/by-name/fc/fcitx5-pinyin-moegirl/package.nix
+++ b/pkgs/by-name/fc/fcitx5-pinyin-moegirl/package.nix
@ -6,11 +6,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "fcitx5-pinyin-moegirl";
-  version = "20240809";
+  version = "20240909";

  src = fetchurl {
    url = "https://github.com/outloudvi/mw2fcitx/releases/download/${finalAttrs.version}/moegirl.dict";
-    hash = "sha256-2jSKzDgjxuz0/Agqefy4JrScmqM7SXnIuZlLMkqAGT0=";
+    hash = "sha256-+e4azEWHYSh3Gy9Xa+Y8E7f7rAA8YlWlbvbva9kNXCI=";
  };

  dontUnpack = true;
--- a/pkgs/by-name/fc/fcitx5-pinyin-zhwiki/package.nix
+++ b/pkgs/by-name/fc/fcitx5-pinyin-zhwiki/package.nix
@ -6,11 +6,11 @@
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "fcitx5-pinyin-zhwiki";
  version = "0.2.5";
-  date = "20240509";
+  date = "20240909";

  src = fetchurl {
    url = "https://github.com/felixonmars/fcitx5-pinyin-zhwiki/releases/download/${finalAttrs.version}/zhwiki-${finalAttrs.date}.dict";
-    hash = "sha256-uRpKPq+/xJ8akKB8ol/JRF79VfDIQ8L4SxLDXzpfPxg=";
+    hash = "sha256-djXrwl1MmiAf0U5Xvm4S7Fk2fKNRm5jtc94KUYIrcm8=";
  };

  dontUnpack = true;
--- a/pkgs/by-name/ll/llm-ls/fix-time-compilation-failure.patch
+++ b/pkgs/by-name/ll/llm-ls/fix-time-compilation-failure.patch
@ -0,0 +1,97 @@
+From cb0a3da737d933614bcd011e91048f2009036d09 Mon Sep 17 00:00:00 2001
+From: a-kenji <aks.kenji@protonmail.com>
+Date: Wed, 14 Aug 2024 09:29:18 +0200
+Subject: [PATCH] Fix `time` compilation failure
+
+This allows `llm-ls` to be compiled with `rustc --version`: 1.80, using
+the Cargo.lock file.
+
+Reference: https://github.com/rust-lang/rust/issues/127343
+---
+ Cargo.lock | 34 ++++++++++++++++++++++++++--------
+ 1 file changed, 26 insertions(+), 8 deletions(-)
+
+diff --git a/Cargo.lock b/Cargo.lock
+index 1806f0be28f65ab1283954c5a72ae20594044624..e8328e602e50fd5e47ba55c5dc9c7881a308a0a5 100644
+--- a/Cargo.lock
+++ b/Cargo.lock
+@@ -487,9 +487,12 @@ dependencies = [
+ 
+ [[package]]
+ name = "deranged"
+-version = "0.3.8"
+version = "0.3.11"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "f2696e8a945f658fd14dc3b87242e6b80cd0f36ff04ea560fa39082368847946"
+checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
+dependencies = [
+ "powerfmt",
+]
+ 
+ [[package]]
+ name = "derive_builder"
+@@ -1210,6 +1213,12 @@ dependencies = [
+  "winapi",
+ ]
+ 
+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
+ [[package]]
+ name = "num_cpus"
+ version = "1.16.0"
+@@ -1403,6 +1412,12 @@ version = "0.3.27"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "26072860ba924cbfa98ea39c8c19b4dd6a4a25423dbdf219c1eca91aa0cf6964"
+ 
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+ [[package]]
+ name = "ppv-lite86"
+ version = "0.2.17"
+@@ -2033,12 +2048,14 @@ dependencies = [
+ 
+ [[package]]
+ name = "time"
+-version = "0.3.28"
+version = "0.3.36"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "17f6bb557fd245c28e6411aa56b6403c689ad95061f50e4be16c274e70a17e48"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
+ dependencies = [
+  "deranged",
+  "itoa",
+ "num-conv",
+ "powerfmt",
+  "serde",
+  "time-core",
+  "time-macros",
+@@ -2046,16 +2063,17 @@ dependencies = [
+ 
+ [[package]]
+ name = "time-core"
+-version = "0.1.1"
+version = "0.1.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "7300fbefb4dadc1af235a9cef3737cea692a9d97e1b9cbcd4ebdae6f8868e6fb"
+checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
+ 
+ [[package]]
+ name = "time-macros"
+-version = "0.2.14"
+version = "0.2.18"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "1a942f44339478ef67935ab2bbaec2fb0322496cf3cbe84b261e06ac3814c572"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
+ dependencies = [
+ "num-conv",
+  "time-core",
+ ]
+ 
--- a/pkgs/by-name/ll/llm-ls/package.nix
+++ b/pkgs/by-name/ll/llm-ls/package.nix
@ -1,8 +1,13 @@
 { lib
+, stdenv
 , rustPlatform
 , fetchFromGitHub
+, fetchpatch
 , pkg-config
-, openssl
+, libiconv
+, darwin
+, testers
+, llm-ls
 }:

 let
@ -19,13 +24,31 @@ rustPlatform.buildRustPackage {
    hash = "sha256-ICMM2kqrHFlKt2/jmE4gum1Eb32afTJkT3IRoqcjJJ8=";
  };

-  cargoHash = "sha256-Fat67JxTYIkxkdwGNAyTfnuLt8ofUGVJ2609sbn1frU=";
+  cargoHash = "sha256-m/w9aJZCCh1rgnHlkGQD/pUDoWn2/WRVt5X4pFx9nC4=";
+
+  cargoPatches = [
+    # https://github.com/huggingface/llm-ls/pull/102
+    ./fix-time-compilation-failure.patch
+    (fetchpatch {
+      name = "fix-version.patch";
+      url = "https://github.com/huggingface/llm-ls/commit/479401f3a5173f2917a888c8068f84e29b7dceed.patch?full_index=1";
+      hash = "sha256-4gXasfMqlrrP8II+FiV/qGfO7a9qFkDQMiax7yEua5E=";
+    })
+  ];

  buildAndTestSubdir = "crates/llm-ls";

  nativeBuildInputs = [ pkg-config ];

-  buildInputs = [ openssl ];
+  buildInputs = [
+    libiconv
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.Security
+  ];
+
+  passthru.tests.version = testers.testVersion {
+    package = llm-ls;
+  };

  meta = with lib; {
    description = "LSP server leveraging LLMs for code completion (and more?)";
@ -33,7 +56,6 @@ rustPlatform.buildRustPackage {
    license = licenses.asl20;
    maintainers = with maintainers; [ jfvillablanca ];
    platforms = platforms.all;
-    badPlatforms = platforms.darwin;
    mainProgram = "llm-ls";
  };
 }
--- a/pkgs/by-name/nb/nb-cli/package.nix
+++ b/pkgs/by-name/nb/nb-cli/package.nix
@ -8,13 +8,13 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "nb-cli";
-  version = "1.4.1";
+  version = "1.4.2";
  pyproject = true;

  src = fetchPypi {
    pname = "nb_cli";
    inherit version;
-    hash = "sha256-kI3Uy79mv0b+h5wjrRN3My9jOFzryhkStieqaG0YFvM=";
+    hash = "sha256-HZey1RVpx/fHNxdEue1LczYbwYUxEb3i3fHpkKHhn+8=";
  };

  build-system = [
--- a/pkgs/by-name/rt/rtorrent/package.nix
+++ b/pkgs/by-name/rt/rtorrent/package.nix
@ -20,13 +20,13 @@

 stdenv.mkDerivation {
  pname = "rakshasa-rtorrent";
-  version = "0.9.8-unstable-2024-08-31";
+  version = "0.9.8-unstable-2024-09-07";

  src = fetchFromGitHub {
    owner = "rakshasa";
    repo = "rtorrent";
-    rev = "4e246a401f2572d6c8a3295cbe0335baa316cd24";
-    hash = "sha256-tq/0Vq+rIyCn1UQlyo7lcTSVf6WW1I8MTfxiAwQYD/o=";
+    rev = "9a93281ded3f6c6bb40593f9bbd3597683cff263";
+    hash = "sha256-dbZ0Q6v6vu8rlr7p1rPc3Cx/9R53OelkoTNsdAVQAxE=";
  };

  outputs = [ "out" "man" ];
--- a/pkgs/by-name/sc/screenly-cli/package.nix
+++ b/pkgs/by-name/sc/screenly-cli/package.nix
@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "screenly-cli";
-  version = "1.0.0";
+  version = "1.0.1";

  src = fetchFromGitHub {
    owner = "screenly";
    repo = "cli";
    rev = "refs/tags/v${version}";
-    hash = "sha256-th/V0hyTMcraJHbRM5VoSM19oE6CKqIQ3qdM86TR4vE=";
+    hash = "sha256-7Y9n6qo5kqaV8xHYn4BFbPBF/7mCV9DJJTSz4dqrgPc=";
  };

-  cargoHash = "sha256-sv59Yu+oSxp/IVePokHrXD4FI+bZcz6aERSTLScYaLk=";
+  cargoHash = "sha256-4fPC/BW2irA1iTKkxBhPOsxzS4uSfM3vOXhrx/7qRxg=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/si/silverbullet/package.nix
+++ b/pkgs/by-name/si/silverbullet/package.nix
@ -7,11 +7,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "silverbullet";
-  version = "0.9.2";
+  version = "0.9.4";

  src = fetchurl {
    url = "https://github.com/silverbulletmd/silverbullet/releases/download/${finalAttrs.version}/silverbullet.js";
-    hash = "sha256-USk15jzTLcy+t8IzLEAySRZJMlIompugIpqAJTcoxho=";
+    hash = "sha256-J0fy1e/ObpujBNSRKA55oU30kXNfus+5P2ebggEN6Dw=";
  };

  dontUnpack = true;
--- a/pkgs/by-name/so/soupault/package.nix
+++ b/pkgs/by-name/so/soupault/package.nix
@ -9,7 +9,7 @@

 ocamlPackages.buildDunePackage rec {
  pname = "soupault";
-  version = "4.10.0";
+  version = "4.11.0";

  minimalOCamlVersion = "4.13";

@ -18,7 +18,7 @@ ocamlPackages.buildDunePackage rec {
      "https://github.com/PataphysicalSociety/soupault/archive/${version}.tar.gz"
      "https://codeberg.org/PataphysicalSociety/soupault/archive/${version}.tar.gz"
    ];
-    hash = "sha256-mkbRWw4Qj7pk2MQJERA9cAuC8DXD/fOShVXz2zPtXZ4=";
+    hash = "sha256-UABbrNNcNaN9NgtAjCs4HUoNXMaK4QvCuWERuEnMG6I=";
  };

  nativeBuildInputs = lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [ darwin.sigtool ];
--- a/pkgs/by-name/sp/spacectl/package.nix
+++ b/pkgs/by-name/sp/spacectl/package.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "spacectl";
-  version = "1.0.1";
+  version = "1.5.0";

  src = fetchFromGitHub {
    owner = "spacelift-io";
    repo = "spacectl";
    rev = "v${version}";
-    hash = "sha256-w49nsPzEWfYeYxWNOl4VrWdQvL3zGafLxL5kUH4YaqM=";
+    hash = "sha256-wEu7AmFn1782XTKKb7JxQWn/ZSHrQbuZ/SDldn6pUNo=";
  };

-  vendorHash = "sha256-hVAQaM8Xank+l283D1Tq9TA/yiOiLGO7/3IyZkXj15Q=";
+  vendorHash = "sha256-SYfXG6YM0Q2rCnoTM2tYvE17uBCD8yQiW/5DTCxMPWo=";

  meta = {
    homepage = "https://github.com/spacelift-io/spacectl";
--- a/pkgs/by-name/ta/tailscale-gitops-pusher/package.nix
+++ b/pkgs/by-name/ta/tailscale-gitops-pusher/package.nix
@ -23,6 +23,6 @@ buildGo123Module {
    description = "Allows users to use a GitOps flow for managing Tailscale ACLs";
    license = licenses.bsd3;
    mainProgram = "gitops-pusher";
-    maintainers = with maintainers; [ xanderio ];
+    maintainers = teams.cyberus.members;
  };
 }
--- a/pkgs/by-name/wa/waybar/package.nix
+++ b/pkgs/by-name/wa/waybar/package.nix
@ -6,6 +6,7 @@
  SDL2,
  alsa-lib,
  catch2_3,
+  fetchpatch,
  fftw,
  glib,
  gobject-introspection,
@ -81,15 +82,27 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "waybar";
-  version = "0.10.4";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "Alexays";
    repo = "Waybar";
-    rev = finalAttrs.version;
-    hash = "sha256-/JW3WnRLpfz8j+9Zc9YkK63i8DjHrKwv9PWKIMz3MVI=";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-3lc0voMU5RS+mEtxKuRayq/uJO09X7byq6Rm5NZohq8=";
  };

+  patches = [
+    # Fix a regression introduced in release 0.11.0
+    # TODO: remove this patch when updating to the next release
+    # Issue: https://github.com/Alexays/Waybar/issues/3597
+    # PR: https://github.com/Alexays/Waybar/pull/3604
+    (fetchpatch {
+      name = "fix-tray";
+      url = "https://github.com/Alexays/Waybar/commit/0d02f6877d88551ea2be0cd151c1e6354e208b1c.patch";
+      hash = "sha256-wpdK6AY+14jt85dOQy6xkh8tNGDN2F9GA9zOfAuOaIc=";
+    })
+  ];
+
  postUnpack = lib.optional cavaSupport ''
    pushd "$sourceRoot"
    cp -R --no-preserve=mode,ownership ${libcava.src} subprojects/cava-0.10.2
--- a/pkgs/by-name/ya/yamlscript/package.nix
+++ b/pkgs/by-name/ya/yamlscript/package.nix
@ -2,11 +2,11 @@

 buildGraalvmNativeImage rec {
  pname = "yamlscript";
-  version = "0.1.74";
+  version = "0.1.75";

  src = fetchurl {
    url = "https://github.com/yaml/yamlscript/releases/download/${version}/yamlscript.cli-${version}-standalone.jar";
-    hash = "sha256-kAuUXOc3QQ9gxBO+HKZDGm5Y4H/lKeFzyiDlz+GMjv8=";
+    hash = "sha256-GdnrEHVdJmwcs6l1Fw3pXJ8hS+spcNpDQ346d6F0OTM=";
  };

  executable = "ys";
--- a/pkgs/development/coq-modules/mtac2/default.nix
+++ b/pkgs/development/coq-modules/mtac2/default.nix
@ -0,0 +1,22 @@
+{ lib, mkCoqDerivation, coq, unicoq, version ? null }:
+
+mkCoqDerivation {
+  pname = "Mtac2";
+  owner = "Mtac2";
+  inherit version;
+  defaultVersion = with lib.versions; lib.switch coq.version [
+    { case = range "8.19" "8.19"; out = "1.4-coq${coq.coq-version}"; }
+  ] null;
+  release."1.4-coq8.19".sha256 = "sha256-G9eK0eLyECdT20/yf8yyz7M8Xq2WnHHaHpxVGP0yTtU=";
+  releaseRev = v: "v${v}";
+  mlPlugin = true;
+  propagatedBuildInputs = [ unicoq ];
+  meta = with lib; {
+    description = "Typed tactic language for Coq";
+    license = licenses.mit;
+  };
+  preBuild = ''
+    coq_makefile -f _CoqProject -o Makefile
+    patchShebangs tests/sf-5/configure.sh
+  '';
+}
--- a/pkgs/development/coq-modules/unicoq/default.nix
+++ b/pkgs/development/coq-modules/unicoq/default.nix
@ -0,0 +1,20 @@
+{ lib, mkCoqDerivation, coq, version ? null }:
+
+mkCoqDerivation {
+  pname = "unicoq";
+  owner = "unicoq";
+  inherit version;
+  defaultVersion = with lib.versions; lib.switch coq.version [
+    { case = range "8.19" "8.19"; out = "1.6-${coq.coq-version}"; }
+  ] null;
+  release."1.6-8.19".sha256 = "sha256-fDk60B8AzJwiemxHGgWjNu6PTu6NcJoI9uK7Ww2AT14=";
+  releaseRev = v: "v${v}";
+  mlPlugin = true;
+  meta = with lib; {
+    description = "An enhanced unification algorithm for Coq";
+    license = licenses.mit;
+  };
+  preBuild = ''
+    coq_makefile -f _CoqProject -o Makefile
+  '';
+}
--- a/pkgs/development/libraries/librealsense/default.nix
+++ b/pkgs/development/libraries/librealsense/default.nix
@ -23,7 +23,7 @@ assert enablePython -> pythonPackages != null;

 stdenv.mkDerivation rec {
  pname = "librealsense";
-  version = "2.55.1";
+  version = "2.56.1";

  outputs = [ "out" "dev" ];

@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
    owner = "IntelRealSense";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-MNHvfWk58WRtu6Xysfvn+lx8J1+HlNw5AmmgaTAzuok=";
+    sha256 = "sha256-1ICSJqr5WRePLIHsD3T2L0Nxdn1LWaHqHDJrfTIRl88=";
  };

  buildInputs = [
--- a/pkgs/development/python-modules/django-appconf/default.nix
+++ b/pkgs/development/python-modules/django-appconf/default.nix
@ -1,27 +1,30 @@
 {
  lib,
  buildPythonPackage,
-  fetchFromGitHub,
-  pythonOlder,
  django,
+  fetchFromGitHub,
  python,
+  pythonOlder,
+  setuptools,
 }:

 buildPythonPackage rec {
  pname = "django-appconf";
-  version = "1.0.5";
-  format = "setuptools";
+  version = "1.0.6";
+  pyproject = true;

  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "django-compressor";
    repo = "django-appconf";
-    rev = "v${version}";
-    hash = "sha256-nS4Hwp/NYg1XGvZO1tiE9mzJA7WFifyvgAjyp3YpqS4=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-H9MwX5LtHkYN6TshP7rRKlX/iOJZHbQVsZeki95yks4=";
  };

-  propagatedBuildInputs = [ django ];
+  build-system = [ setuptools ];
+
+  dependencies = [ django ];

  preCheck = ''
    # prove we're running tests against installed package, not build dir
@ -30,13 +33,18 @@ buildPythonPackage rec {

  checkPhase = ''
    runHook preCheck
+
    ${python.interpreter} -m django test --settings=tests.test_settings
+
    runHook postCheck
  '';

+  pythonImportsCheck = [ "appconf" ];
+
  meta = with lib; {
    description = "Helper class for handling configuration defaults of packaged apps gracefully";
    homepage = "https://django-appconf.readthedocs.org/";
+    changelog = "https://github.com/django-compressor/django-appconf/blob/v${version}/docs/changelog.rst";
    license = licenses.bsd2;
    maintainers = with maintainers; [ desiderius ];
  };
--- a/pkgs/development/python-modules/django-celery-beat/default.nix
+++ b/pkgs/development/python-modules/django-celery-beat/default.nix
@ -5,7 +5,7 @@
  cron-descriptor,
  django-timezone-field,
  ephem,
-  fetchPypi,
+  fetchFromGitHub,
  pytest-django,
  pytest-timeout,
  pytestCheckHook,
@ -17,21 +17,23 @@

 buildPythonPackage rec {
  pname = "django-celery-beat";
-  version = "2.6.0";
+  version = "2.7.0";
  pyproject = true;

  disabled = pythonOlder "3.8";

-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-91stEpcx8SFL6Dg+GPrmv+rNtV3/shFs6EkiLAEG+a0=";
+  src = fetchFromGitHub {
+    owner = "celery";
+    repo = "django-celery-beat";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-XWcmKQXNw8eoGkld77E3rHpR9ofa1i2qO/JI8Hnpi9M=";
  };

-  nativeBuildInputs = [ setuptools ];
-
  pythonRelaxDeps = [ "django" ];

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    cron-descriptor
    python-crontab
    celery
--- a/pkgs/development/python-modules/ffcv/default.nix
+++ b/pkgs/development/python-modules/ffcv/default.nix
@ -17,6 +17,7 @@
  psutil,
  torchvision,
  webdataset,
+  stdenv,
 }:

 buildPythonPackage rec {
@ -108,5 +109,8 @@ buildPythonPackage rec {
      samuela
      djacu
    ];
+    # OSError: dlopen(libc.so.6, 0x0006): tried: '/usr/lib/libc.so.6' (no such file, not in dyld cache),
+    # 'libc.so.6' (no such file), '/usr/local/lib/libc.so.6' (no such file), '/usr/lib/libc.so.6' (no such file, not in dyld cache)
+    broken = stdenv.isDarwin;
  };
 }
--- a/pkgs/development/python-modules/huggingface-hub/default.nix
+++ b/pkgs/development/python-modules/huggingface-hub/default.nix
@ -1,7 +1,6 @@
 {
  lib,
  buildPythonPackage,
-  pythonOlder,
  fetchFromGitHub,

  # build-system
@ -19,16 +18,14 @@

 buildPythonPackage rec {
  pname = "huggingface-hub";
-  version = "0.24.6";
+  version = "0.24.7";
  pyproject = true;

-  disabled = pythonOlder "3.8";
-
  src = fetchFromGitHub {
    owner = "huggingface";
    repo = "huggingface_hub";
    rev = "refs/tags/v${version}";
-    hash = "sha256-1W+hfe2m5mXidbepVPMObnOZH6LCQG9dvFRbo9iUjKg=";
+    hash = "sha256-7JW98PVJy3dKn3V+JmyxCZJplFUpqPckMbOJR45ZH7o=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/manifestoo-core/default.nix
+++ b/pkgs/development/python-modules/manifestoo-core/default.nix
@ -11,13 +11,13 @@

 buildPythonPackage rec {
  pname = "manifestoo-core";
-  version = "1.7";
+  version = "1.8";
  format = "pyproject";

  src = fetchPypi {
    inherit version;
    pname = "manifestoo_core";
-    hash = "sha256-CLYySNkMysd81ZBA2yfHGSvBuuf8vEvVXkzVsTeEoNM=";
+    hash = "sha256-AjvwG9j2TILslTR4GwK6eHfql4l7I+QIwUd6XQ2ojmg=";
  };

  nativeBuildInputs = [ hatch-vcs ];
--- a/pkgs/development/python-modules/opower/default.nix
+++ b/pkgs/development/python-modules/opower/default.nix
@ -4,6 +4,7 @@
  aiozoneinfo,
  arrow,
  buildPythonPackage,
+  cryptography,
  fetchFromGitHub,
  pyotp,
  python-dotenv,
@ -14,7 +15,7 @@

 buildPythonPackage rec {
  pname = "opower";
-  version = "0.7.0";
+  version = "0.8.0";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -23,7 +24,7 @@ buildPythonPackage rec {
    owner = "tronikos";
    repo = "opower";
    rev = "refs/tags/v${version}";
-    hash = "sha256-H1OOj/KYwHAh6SAmwejAaQFLR/mJ92vm0+cLaTqdSWI=";
+    hash = "sha256-gDd2Ht8SgUkqD1t5AY/zg/J/YG5Gyje8gbPp+5rP+M0=";
  };

  build-system = [ setuptools ];
@ -32,6 +33,7 @@ buildPythonPackage rec {
    aiohttp
    aiozoneinfo
    arrow
+    cryptography
    pyotp
  ];

--- a/pkgs/development/python-modules/pdfplumber/default.nix
+++ b/pkgs/development/python-modules/pdfplumber/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "pdfplumber";
-  version = "0.11.1";
+  version = "0.11.4";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "jsvine";
    repo = "pdfplumber";
    rev = "refs/tags/v${version}";
-    hash = "sha256-5A1hjmC6GCS0Uqq5AiCEGqDTwASbJBX0pJGNNyvP3+4=";
+    hash = "sha256-62S5DMQwSgehl0BcjeRaTocko8xg72pQQ5YLoL3+QbU=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/pick/default.nix
+++ b/pkgs/development/python-modules/pick/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "pick";
-  version = "2.3.2";
+  version = "2.4.0";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "wong2";
    repo = "pick";
    rev = "refs/tags/v${version}";
-    hash = "sha256-6bkV9XEum5kbANqv/Xth+taCUl4nmuWskucq4jmV+Lc=";
+    hash = "sha256-SnH37n0MCjO60IU6kUPxJkIC5vBCVGZXBhFfwvRI/tQ=";
  };

  build-system = [ poetry-core ];
--- a/pkgs/development/python-modules/plugwise/default.nix
+++ b/pkgs/development/python-modules/plugwise/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "plugwise";
-  version = "1.3.1";
+  version = "1.4.0";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "plugwise";
    repo = "python-plugwise";
    rev = "refs/tags/v${version}";
-    hash = "sha256-lwg+iyYRW1eFjMxBDQf6MFXlLbo81jGRpQSh3rUqGKY=";
+    hash = "sha256-CVgcqyg5DDtEJxE/oen5MJP+mV4B+Sq0uopEZTOCfV0=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/psycopg/default.nix
+++ b/pkgs/development/python-modules/psycopg/default.nix
@ -35,13 +35,13 @@

 let
  pname = "psycopg";
-  version = "3.2.1";
+  version = "3.2.2";

  src = fetchFromGitHub {
    owner = "psycopg";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-jQMIgfMyQpd9bD3F1IhPff39BrFaBD6U7Exryna+Acw=";
+    hash = "sha256-Udysl00lB6rxmQByME6PI3KL4tlzIZ0/CZNWLVKssS8=";
  };

  patches = [
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "publicsuffixlist";
-  version = "1.0.2.20240913";
+  version = "1.0.2.20240915";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-H7+HSF0XKfAOA8LI+/O3Ke495Yhrwb2LWAz4bd2FC18=";
+    hash = "sha256-fUo6D2QF1TMpC04Em97V1QDKN4mBq5bJzLbOT5xmZVM=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/pyexploitdb/default.nix
+++ b/pkgs/development/python-modules/pyexploitdb/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "pyexploitdb";
-  version = "0.2.34";
+  version = "0.2.35";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "pyExploitDb";
    inherit version;
-    hash = "sha256-5vWR6LNJknxVQ5Mmgw+c4clXhVQsHc68R1MMdzdsMgM=";
+    hash = "sha256-lwsLP29lQmb7MJYPrOfgspdj4qepx7TirEksMASqrb4=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/pytorch-pfn-extras/default.nix
+++ b/pkgs/development/python-modules/pytorch-pfn-extras/default.nix
@ -1,40 +1,38 @@
 {
+  lib,
  buildPythonPackage,
  fetchFromGitHub,
-  fetchpatch,
-  lib,
-  numpy,
-  onnx,
-  packaging,
-  pytestCheckHook,
-  pythonAtLeast,
+
+  # build-system
  setuptools,
-  stdenv,
+
+  # dependencies
+  numpy,
+  packaging,
  torch,
-  torchvision,
  typing-extensions,
+
+  # tests
+  onnx,
+  pytestCheckHook,
+  torchvision,
+
+  pythonAtLeast,
+  stdenv,
 }:

 buildPythonPackage rec {
  pname = "pytorch-pfn-extras";
-  version = "0.7.6";
+  version = "0.7.7";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pfnet";
    repo = "pytorch-pfn-extras";
    rev = "refs/tags/v${version}";
-    hash = "sha256-vSon/0GxQfaRtSPsQbYAvE3s/F0HEN59VpzE3w1PnVE=";
+    hash = "sha256-0+ltkm7OH18hlpHYyZCmy1rRleF52IM2BjLoW44tJUY=";
  };

-  patches = [
-    (fetchpatch {
-      name = "relax-setuptools.patch";
-      url = "https://github.com/pfnet/pytorch-pfn-extras/commit/96abe38c4baa6a144d604bdd4744c55627e55440.patch";
-      hash = "sha256-85UDGcgJyQS5gINbgpNM58b3XJGvf+ArtGhwJ5EXdhk=";
-    })
-  ];
-
  build-system = [ setuptools ];

  dependencies = [
@ -54,10 +52,26 @@ buildPythonPackage rec {
    # Requires CUDA access which is not possible in the nix environment.
    "-m 'not gpu and not mpi'"
    "-Wignore::DeprecationWarning"
+
+    # FutureWarning: You are using `torch.load` with `weights_only=False` (the current default value), which uses the default pickle module implicitly...
+    "-Wignore::FutureWarning"
  ];

  pythonImportsCheck = [ "pytorch_pfn_extras" ];

+  disabledTests =
+    [
+      # AssertionError: assert 4 == 0
+      # where 4 = <MagicMock id='140733587469184'>.call_count
+      "test_lr_scheduler_wait_for_first_optimizer_step"
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
+      # torch.distributed is not available on darwin
+      "test_create_distributed_evaluator"
+      "test_distributed_evaluation"
+      "test_distributed_evaluator_progress_bar"
+    ];
+
  disabledTestPaths =
    [
      # Requires optuna which is currently (2022-02-16) marked as broken.
@ -84,6 +98,11 @@ buildPythonPackage rec {
    ]
    ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
      # torch.distributed is not available on darwin
+      "tests/pytorch_pfn_extras_tests/distributed_tests/test_distributed_validation_sampler.py"
+      "tests/pytorch_pfn_extras_tests/nn_tests/parallel_tests/test_distributed.py"
+      "tests/pytorch_pfn_extras_tests/profiler_tests/test_record.py"
+      "tests/pytorch_pfn_extras_tests/profiler_tests/test_time_summary.py"
+      "tests/pytorch_pfn_extras_tests/training_tests/extensions_tests/test_accumulate.py"
      "tests/pytorch_pfn_extras_tests/training_tests/extensions_tests/test_sharded_snapshot.py"
    ]
    ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
@ -92,10 +111,11 @@ buildPythonPackage rec {
      "tests/pytorch_pfn_extras_tests/nn_tests/modules_tests/test_lazy_conv.py"
    ];

-  meta = with lib; {
+  meta = {
    description = "Supplementary components to accelerate research and development in PyTorch";
    homepage = "https://github.com/pfnet/pytorch-pfn-extras";
-    license = licenses.mit;
-    maintainers = with maintainers; [ samuela ];
+    changelog = "https://github.com/pfnet/pytorch-pfn-extras/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ samuela ];
  };
 }
--- a/pkgs/development/python-modules/stanza/default.nix
+++ b/pkgs/development/python-modules/stanza/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "stanza";
-  version = "1.8.2";
+  version = "1.9.2";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "stanfordnlp";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-twgMWKWUvhnGNqQ42MOptnikdSBiDFpiMCI2RPo+3XU=";
+    hash = "sha256-hrRn6ITsN7kFL1T6VjSXPDytANEeJYKwMaSdCG+YJyM=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/tesla-fleet-api/default.nix
+++ b/pkgs/development/python-modules/tesla-fleet-api/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "tesla-fleet-api";
-  version = "0.7.4";
+  version = "0.7.5";
  pyproject = true;

  disabled = pythonOlder "3.10";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "Teslemetry";
    repo = "python-tesla-fleet-api";
    rev = "refs/tags/v${version}";
-    hash = "sha256-lZuluzOiqqeDFf+DrX0/KNbsUKanUn2xglp3HW0ITso=";
+    hash = "sha256-9klPi+nscylkhvWRSqegT7aCBSH2/wc39u6aNJwpicU=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "checkov";
-  version = "3.2.253";
+  version = "3.2.254";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "bridgecrewio";
    repo = "checkov";
    rev = "refs/tags/${version}";
-    hash = "sha256-ARtJBQsY46pIrKzYXBfH4diMh1ECFiilY2AZlN34/vY=";
+    hash = "sha256-+3hx6MEJWDbTby0bvUSe/AGoneqJ/ojzkkpb8oF4ZIo=";
  };

  patches = [ ./flake8-compat-5.x.patch ];
--- a/pkgs/development/tools/gomplate/default.nix
+++ b/pkgs/development/tools/gomplate/default.nix
@ -5,38 +5,37 @@

 buildGoModule rec {
  pname = "gomplate";
-  version = "3.11.8";
+  version = "4.1.0";

  src = fetchFromGitHub {
    owner = "hairyhenderson";
-    repo = pname;
+    repo = "gomplate";
    rev = "refs/tags/v${version}";
-    hash = "sha256-pE9TLEBY1KQvgMFwVJfn5kojESqZURcbCwRt4jrexhk=";
+    hash = "sha256-shbG0q86wlSjoCK2K7hNdUCwNPiQp94GWQJ1e71A1T0=";
  };

-  vendorHash = "sha256-09QUEudbWnO11iwJafF9zoYqbTr7SVBUiPWTHGnZ06Q=";
+  vendorHash = "sha256-UKqSKypAm6gt2JUCZh/DyfWo8uJeMp0M+4FiqwzzHIA=";

-  postPatch = ''
+  ldflags = [
+    "-s"
+    "-X github.com/${src.owner}/${pname}/v4/version.Version=${version}"
+  ];
+
+  preCheck = ''
    # some tests require network access
    rm net/net_test.go \
      internal/tests/integration/datasources_blob_test.go \
-      internal/tests/integration/datasources_git_test.go
+      internal/tests/integration/datasources_git_test.go \
+      render_test.go
    # some tests rely on external tools we'd rather not depend on
    rm internal/tests/integration/datasources_consul_test.go \
      internal/tests/integration/datasources_vault*_test.go
  '';

-  # TestInputDir_RespectsUlimit
-  preCheck = ''
-    ulimit -n 1024
+  postInstall = ''
+    rm $out/bin/gen
  '';

-  ldflags = [
-    "-s"
-    "-w"
-    "-X github.com/${src.owner}/${pname}/v3/version.Version=${version}"
-  ];
-
  meta = with lib; {
    description = "Flexible commandline tool for template rendering";
    mainProgram = "gomplate";
--- a/pkgs/games/minetest/default.nix
+++ b/pkgs/games/minetest/default.nix
@ -42,13 +42,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "minetest";
-  version = "5.9.0";
+  version = "5.9.1";

  src = fetchFromGitHub {
    owner = "minetest";
    repo = "minetest";
    rev = finalAttrs.version;
-    hash = "sha256-cxbiuoD1J3WFoveUgxeR/XXdE7MMR0UEDFleDiaxnsA=";
+    hash = "sha256-0WTDhFt7GDzN4AK8U17iLkjeSMK+gOWZRq46HBTeO3w=";
  };

  cmakeFlags = [
--- a/pkgs/games/warzone2100/default.nix
+++ b/pkgs/games/warzone2100/default.nix
@ -46,11 +46,11 @@ in

 stdenv.mkDerivation (finalAttrs: {
  inherit pname;
-  version  = "4.5.2";
+  version  = "4.5.3";

  src = fetchurl {
    url = "mirror://sourceforge/project/warzone2100/releases/${finalAttrs.version}/warzone2100_src.tar.xz";
-    hash = "sha256-J8IJH2/A2OO7YP9moWOM77qDW7TdZ40MLVv/y0xDAms=";
+    hash = "sha256-7tSfLkVth9nbGSwn1uNWeFrHx5ac+jaO3Gk9Bb+hLIk=";
  };

  buildInputs = [
--- a/pkgs/servers/home-assistant/custom-components/average/default.nix
+++ b/pkgs/servers/home-assistant/custom-components/average/default.nix
@ -0,0 +1,25 @@
+{
+  lib,
+  buildHomeAssistantComponent,
+  fetchFromGitHub,
+}:
+
+buildHomeAssistantComponent rec {
+  owner = "Limych";
+  domain = "average";
+  version = "2.3.4";
+
+  src = fetchFromGitHub {
+    inherit owner;
+    repo = "ha-average";
+    rev = version;
+    hash = "sha256-PfN2F1/ScVScXfh5jKQDZ6rK4XlqD9+YW8k4f4i3bk0=";
+  };
+
+  meta = with lib; {
+    description = "Average Sensor for Home Assistant";
+    homepage = "https://github.com/Limych/ha-average";
+    maintainers = with maintainers; [ matthiasbeyer ];
+    license = licenses.cc-by-nc-40;
+  };
+}
--- a/pkgs/servers/home-assistant/custom-components/default.nix
+++ b/pkgs/servers/home-assistant/custom-components/default.nix
@ -10,6 +10,8 @@

  awtrix = callPackage ./awtrix {};

+  average = callPackage ./average {};
+
  better_thermostat = callPackage ./better_thermostat {};

  dwd = callPackage ./dwd { };
--- a/pkgs/servers/mediamtx/default.nix
+++ b/pkgs/servers/mediamtx/default.nix
@ -15,16 +15,16 @@ in
 buildGoModule rec {
  pname = "mediamtx";
  # check for hls.js version updates in internal/servers/hls/hlsjsdownloader/VERSION
-  version = "1.9.0";
+  version = "1.9.1";

  src = fetchFromGitHub {
    owner = "bluenviron";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-iCUCQLMWB0cH9SuudP1KvSD1X58hvYgE30nIh2FpKlY=";
+    hash = "sha256-DCt0P0DHlWFAQ5i4+7U5+Q2XcCPlSZrlj+Ljcyg/Wj0=";
  };

-  vendorHash = "sha256-TiI02M6k1zN/iWJntOfc9EY5xFo3ESOtdDSumxYmSU0=";
+  vendorHash = "sha256-YKNNQPEdO8K7Lpm/S86GKD3QcNcyvwZSrBspZJMJ78Y=";

  postPatch = ''
    cp ${hlsJs} internal/servers/hls/hls.min.js
--- a/pkgs/servers/web-apps/outline/default.nix
+++ b/pkgs/servers/web-apps/outline/default.nix
@ -85,7 +85,7 @@ stdenv.mkDerivation rec {
    homepage = "https://www.getoutline.com/";
    changelog = "https://github.com/outline/outline/releases";
    license = licenses.bsl11;
-    maintainers = with maintainers; [ cab404 yrd xanderio ];
+    maintainers = with maintainers; [ cab404 yrd ] ++ teams.cyberus.members;
    platforms = platforms.linux;
  };
 }
--- a/pkgs/servers/web-apps/plausible/default.nix
+++ b/pkgs/servers/web-apps/plausible/default.nix
@ -89,7 +89,7 @@ beamPackages.mixRelease {
    changelog = "https://github.com/plausible/analytics/blob/${src.rev}/CHANGELOG.md";
    description = " Simple, open-source, lightweight (< 1 KB) and privacy-friendly web analytics alternative to Google Analytics";
    mainProgram = "plausible";
-    maintainers = with maintainers; [ xanderio ];
+    maintainers = teams.cyberus.members;
    platforms = platforms.unix;
  };
 }
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@ -67,26 +67,8 @@ let
      #              ^^^^

      overrideAttrs = f0:
-        let
-          f = self: super:
-            # Convert f0 to an overlay. Legacy is:
-            #   overrideAttrs (super: {})
-            # We want to introduce self. We follow the convention of overlays:
-            #   overrideAttrs (self: super: {})
-            # Which means the first parameter can be either self or super.
-            # This is surprising, but far better than the confusion that would
-            # arise from flipping an overlay's parameters in some cases.
-            let x = f0 super;
-            in
-              if builtins.isFunction x
-              then
-                # Can't reuse `x`, because `self` comes first.
-                # Looks inefficient, but `f0 super` was a cheap thunk.
-                f0 self super
-              else x;
-        in
-          makeDerivationExtensible
-            (self: let super = rattrs self; in super // (if builtins.isFunction f0 || f0?__functor then f self super else f0));
+        makeDerivationExtensible
+          (lib.extends (lib.toExtension f0) rattrs);

      finalPackage =
        mkDerivationSimple overrideAttrs args;
--- a/pkgs/tools/admin/google-cloud-sdk/components.json
+++ b/pkgs/tools/admin/google-cloud-sdk/components.json
--- a/pkgs/tools/admin/google-cloud-sdk/data.nix
+++ b/pkgs/tools/admin/google-cloud-sdk/data.nix
@ -1,32 +1,32 @@
 # DO NOT EDIT! This file is generated automatically by update.sh
 { }:
 {
-  version = "485.0.0";
+  version = "492.0.0";
  googleCloudSdkPkgs = {
    x86_64-linux =
      {
-        url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-485.0.0-linux-x86_64.tar.gz";
-        sha256 = "17y6gbn0qnmrmawijg9l3kgygd8mbg57rgf5fcx05x57m7jy07v7";
+        url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-492.0.0-linux-x86_64.tar.gz";
+        sha256 = "00vdmq7j67b6wdkz17wbh06lfzdq9yw4532p5jygbbg469smi8av";
      };
    x86_64-darwin =
      {
-        url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-485.0.0-darwin-x86_64.tar.gz";
-        sha256 = "0zh6z567dm6a75xi8mz724xg7xw9n7xzp3kbaj01qmvwmri7rahi";
+        url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-492.0.0-darwin-x86_64.tar.gz";
+        sha256 = "0hg24ffqcwy3xg7wjjgg6y00djwcb46866msach9s2q419cvz2z0";
      };
    aarch64-linux =
      {
-        url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-485.0.0-linux-arm.tar.gz";
-        sha256 = "0mw80qs8qzjyjlbirqzpc9r22dv5m6i90v3p016na4w4hgc15v33";
+        url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-492.0.0-linux-arm.tar.gz";
+        sha256 = "11ygy5qjx81nxlkgkyxwcd1z0ippkrshdxg7bfjgpw9c17zx3mp0";
      };
    aarch64-darwin =
      {
-        url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-485.0.0-darwin-arm.tar.gz";
-        sha256 = "1x6s521iad1mzi7af0874qh421ldyxc1dd3952ayxi2zm8misg63";
+        url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-492.0.0-darwin-arm.tar.gz";
+        sha256 = "0y1f7bg0ji0vvaik7dlyhkqlgix89xj96dhsps51hal6m92dibpb";
      };
    i686-linux =
      {
-        url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-485.0.0-linux-x86.tar.gz";
-        sha256 = "05b9lg3gnqknx8y5smz2msr61803zib827283bsf7zmmr7bnignh";
+        url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-492.0.0-linux-x86.tar.gz";
+        sha256 = "1f7fbfzyq8ycsn1whvrrncq7gycv4aswhgca8f8d1bpjcmcshs2n";
      };
  };
 }
--- a/pkgs/tools/audio/beets/builtin-plugins.nix
+++ b/pkgs/tools/audio/beets/builtin-plugins.nix
@ -128,6 +128,11 @@
    testPaths = [ ];
  };
  autobpm = {
+    propagatedBuildInputs = with python3Packages; [
+      librosa
+      # An optional dependency of librosa, needed for beets' autobpm
+      resampy
+    ];
    testPaths = [ ];
  };
  listenbrainz = {
--- a/pkgs/tools/misc/cyclonedx-python/default.nix
+++ b/pkgs/tools/misc/cyclonedx-python/default.nix
@ -34,7 +34,7 @@ python3Packages.buildPythonApplication rec {
    homepage = "https://github.com/CycloneDX/cyclonedx-python";
    changelog = "https://github.com/CycloneDX/cyclonedx-python/releases/tag/v${version}";
    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ xanderio ];
+    maintainers = lib.teams.cyberus.members;
    mainProgram = "cyclonedx-py";
  };
 }
--- a/pkgs/tools/networking/dnscrypt-wrapper/default.nix
+++ b/pkgs/tools/networking/dnscrypt-wrapper/default.nix
@ -1,34 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, libsodium, libevent, nixosTests }:
-
-stdenv.mkDerivation rec {
-  pname = "dnscrypt-wrapper";
-  version = "0.4.2";
-
-  src = fetchFromGitHub {
-    owner = "Cofyc";
-    repo = "dnscrypt-wrapper";
-    rev = "v${version}";
-    sha256 = "055vxpcfg80b1456p6p0p236pwykknph9x3c9psg8ya3i8qqywkl";
-  };
-
-  enableParallelBuilding = true;
-
-  # causes `dnscrypt-wrapper --gen-provider-keypair` to crash
-  hardeningDisable = [ "fortify3" ];
-
-  nativeBuildInputs = [ pkg-config autoreconfHook ];
-  buildInputs = [ libsodium libevent ];
-
-  passthru.tests = {
-    inherit (nixosTests) dnscrypt-wrapper;
-  };
-
-  meta = with lib; {
-    description = "Tool for adding dnscrypt support to any name resolver";
-    homepage = "https://dnscrypt.info/";
-    license = licenses.isc;
-    maintainers = with maintainers; [ joachifm ];
-    platforms = platforms.linux;
-    mainProgram = "dnscrypt-wrapper";
-  };
-}
--- a/pkgs/tools/security/smbmap/default.nix
+++ b/pkgs/tools/security/smbmap/default.nix
@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "smbmap";
-  version = "1.10.4";
+  version = "1.10.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "ShawnDEvans";
    repo = "smbmap";
    rev = "refs/tags/v${version}";
-    hash = "sha256-CU0pio+R8JI/vQi13mOmiEeWC+r4EuLwWOQYLnm4Oao=";
+    hash = "sha256-xeQ3o0Pt4eDeMnSJKdEJfHhA0oPiD7tmX9TQAb3b9I8=";
  };

  build-system = with python3.pkgs; [ setuptools ];
--- a/pkgs/tools/typesetting/lowdown/default.nix
+++ b/pkgs/tools/typesetting/lowdown/default.nix
@ -1,4 +1,5 @@
 { lib, stdenv, fetchurl, fixDarwinDylibNames, which, dieHook
+, fetchpatch
 , enableShared ? !stdenv.hostPlatform.isStatic
 , enableStatic ? stdenv.hostPlatform.isStatic
 # for passthru.tests
@ -16,6 +17,40 @@ stdenv.mkDerivation rec {
    hash = "sha512-EpAWTz7Zy+2qqJGgzLrt0tK7WEZ+hHbdyqzAmMiaqc6uNXscR88git6/UbTjvB9Yanvetvw9huSuyhcORCEIug==";
  };

+  patches = [
+    # Improve UTF-8 handling on macOS by not treating bytes >=0x80, which tend to be
+    # UTF-8 continuation bytes, as control characters.
+    #
+    # This leaves control characters U+0080 through U+009F in the output
+    # (incorrectly) but doesn't mangle other UTF-8 characters, so it's a net
+    # win.
+    #
+    # See: https://github.com/kristapsdz/lowdown/pull/140
+    (fetchpatch {
+      url = "https://github.com/kristapsdz/lowdown/commit/5a02866dd682363a8e4f6b344c223cfe8b597da9.diff";
+      hash = "sha256-7tGhZJQQySeBv4h6A4r69BBbQkPRX/3JTw/80A8YXjQ=";
+    })
+    (fetchpatch {
+      url = "https://github.com/kristapsdz/lowdown/commit/c033a6886e4d6efb948782fbc389fe5f673acf36.diff";
+      hash = "sha256-7DvKFerAMoPifuTn7rOX4ru888HfBkpspH1opIbzj08=";
+    })
+
+    # Don't output a newline after .SH
+    #
+    # This fixes `makewhatis` output on macOS and (as a result) `man`
+    # completions for `fish` on macOS.
+    #
+    # See: https://github.com/kristapsdz/lowdown/pull/138
+    (fetchpatch {
+      url = "https://github.com/kristapsdz/lowdown/commit/e05929a09a697de3d2eb14d0f0a087a6fae22e11.diff";
+      hash = "sha256-P03W+hFeBKwfJB+DhGCPq0DtiOiLLc+0ZvWrWqXFvVU=";
+    })
+    (fetchpatch {
+      url = "https://github.com/kristapsdz/lowdown/commit/9906f8ceac586c54eb39ae78105fd84653a89c33.diff";
+      hash = "sha256-nBnAgTb8RDe/QpUhow3lyeR7UIVJX2o4lmP78e2fw/E=";
+    })
+  ];
+
  nativeBuildInputs = [ which dieHook ]
    ++ lib.optionals stdenv.isDarwin [ fixDarwinDylibNames ];

--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -339,6 +339,7 @@ mapAliases ({
  dhcp = throw "dhcp (ISC DHCP) has been removed from nixpkgs, because it reached its end of life"; # Added 2023-04-04
  dibbler = throw "dibbler was removed because it is not maintained anymore"; # Added 2024-05-14
  dnnl = oneDNN; # Added 2020-04-22
+  dnscrypt-wrapper = throw "dnscrypt-wrapper was removed because it has been effectively unmaintained since 2018. Use DNSCcrypt support in dnsdist instead"; # Added 2024-09-14
  docker-compose_1 = throw "'docker-compose_1' has been removed because it has been unmaintained since May 2021. Use docker-compose instead."; # Added 2024-07-29
  docker-distribution = distribution; # Added 2023-12-26
  docker-machine = throw "'docker-machine' has been removed, because the upstream project was archived"; # Added 2023-12-27
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -7017,8 +7017,6 @@ with pkgs;

  dnscrypt-proxy = callPackage ../tools/networking/dnscrypt-proxy { };

-  dnscrypt-wrapper = callPackage ../tools/networking/dnscrypt-wrapper { };
-
  dnscontrol = callPackage ../applications/networking/dnscontrol { };

  dnsenum = callPackage ../tools/security/dnsenum { };
--- a/pkgs/top-level/coq-packages.nix
+++ b/pkgs/top-level/coq-packages.nix
@ -115,6 +115,7 @@ let
      metacoq-safechecker  = self.metacoq.safechecker;
      metacoq-erasure      = self.metacoq.erasure;
      metalib = callPackage ../development/coq-modules/metalib { };
+      mtac2 = callPackage ../development/coq-modules/mtac2 {};
      multinomials = callPackage ../development/coq-modules/multinomials {};
      odd-order = callPackage ../development/coq-modules/odd-order { };
      paco = callPackage ../development/coq-modules/paco {};
@ -138,6 +139,7 @@ let
      tlc = callPackage ../development/coq-modules/tlc {};
      topology = callPackage ../development/coq-modules/topology {};
      trakt = callPackage ../development/coq-modules/trakt {};
+      unicoq = callPackage ../development/coq-modules/unicoq {};
      vcfloat = callPackage ../development/coq-modules/vcfloat (lib.optionalAttrs
        (lib.versions.range "8.16" "8.18" self.coq.version) {
          interval = self.interval.override { version = "4.9.0"; };
				`@ -1 +0,0 @@`
				`A<>:<3A><08><><EFBFBD>B <0A><><EFBFBD><EFBFBD><1B>;o<><6F>4<EFBFBD>S<EFBFBD> @]`
				`@ -1 +0,0 @@`
				`G½>ֶ©» ל>׀א¥(ׂ²‡¼J•«÷=<3D>„<EFBFBD>ֱ<EFBFBD>lלA״:‎₪®©B †»<E280A0><C2BB>—;oש¹4•S<E280A2> @]`