Merge staging-next into staging

2024-09-26 00:14:18 +00:00 · 2024-09-26 00:14:18 +00:00 · 3b110ff21b
commit 3b110ff21b
parent c0d2c08a87 57b5c92d8e
203 changed files with 3212 additions and 2137 deletions
--- a/doc/build-helpers/images/dockertools.section.md
+++ b/doc/build-helpers/images/dockertools.section.md
@ -453,7 +453,7 @@ See [](#ex-dockerTools-streamLayeredImage-exploringlayers) to understand how the
 `streamLayeredImage` allows scripts to be run when creating the additional layer with symlinks, allowing custom behaviour to affect the final results of the image (see the documentation of the `extraCommands` and `fakeRootCommands` attributes).

 The resulting repository tarball will list a single image as specified by the `name` and `tag` attributes.
-By default, that image will use a static creation date (see documentation for the `created` attribute).
+By default, that image will use a static creation date (see documentation for the `created` and `mtime` attributes).
 This allows the function to produce reproducible images.

 ### Inputs {#ssec-pkgs-dockerTools-streamLayeredImage-inputs}
@ -516,6 +516,7 @@ This allows the function to produce reproducible images.
 `created` (String; _optional_)

 : Specifies the time of creation of the generated image.
+  This date will be used for the image metadata.
  This should be either a date and time formatted according to [ISO-8601](https://en.wikipedia.org/wiki/ISO_8601) or `"now"`, in which case the current date will be used.

  :::{.caution}
@ -524,6 +525,18 @@ This allows the function to produce reproducible images.

  _Default value:_ `"1970-01-01T00:00:01Z"`.

+`mtime` (String; _optional_)
+
+: Specifies the time used for the modification timestamp of files within the layers of the generated image.
+  This should be either a date and time formatted according to [ISO-8601](https://en.wikipedia.org/wiki/ISO_8601) or `"now"`, in which case the current date will be used.
+
+  :::{.caution}
+  Using a non-constant date will cause built layers to have a different hash each time, preventing deduplication.
+  Using `"now"` also means that the generated image will not be reproducible anymore (because the date will always change whenever it's built).
+  :::
+
+  _Default value:_ `"1970-01-01T00:00:01Z"`.
+
 `uid` (Number; _optional_) []{#dockerTools-buildLayeredImage-arg-uid}
 `gid` (Number; _optional_) []{#dockerTools-buildLayeredImage-arg-gid}
 `uname` (String; _optional_) []{#dockerTools-buildLayeredImage-arg-uname}
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -3339,6 +3339,12 @@
    githubId = 141733;
    name = "Andrew Bruce";
  };
+  camerondugan = {
+    email = "cameron.dugan@protonmail.com";
+    github = "camerondugan";
+    githubId = 54632731;
+    name = "Cameron Dugan";
+  };
  cameronfyfe = {
    email = "cameron.j.fyfe@gmail.com";
    github = "cameronfyfe";
@ -9168,6 +9174,12 @@
    githubId = 1817528;
    name = "Igor Polyakov";
  };
+  iosmanthus = {
+    email = "myosmanthustree@gmail.com";
+    github = "iosmanthus";
+    githubId = 16307070;
+    name = "iosmanthus";
+  };
  iquerejeta = {
    github = "iquerejeta";
    githubId = 31273774;
@ -18205,12 +18217,6 @@
    github = "rosehobgoblin";
    githubId = 84164410;
  };
-  roshaen = {
-    name = "Roshan Kumar";
-    email = "roshaen09@gmail.com";
-    github = "roshaen";
-    githubId = 58213083;
-  };
  RossComputerGuy = {
    name = "Tristan Ross";
    email = "tristan.ross@midstall.com";
@ -23295,6 +23301,12 @@
    github = "YoshiRulz";
    githubId = 13409956;
  };
+  youhaveme9 = {
+    name = "Roshan Kumar";
+    email = "roshaen09@gmail.com";
+    github = "youhaveme9";
+    githubId = 58213083;
+  };
  yrashk = {
    email = "yrashk@gmail.com";
    github = "yrashk";
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1192,6 +1192,7 @@
  ./services/networking/scion/scion-daemon.nix
  ./services/networking/scion/scion-dispatcher.nix
  ./services/networking/scion/scion-router.nix
+  ./services/networking/scion/scion-ip-gateway.nix
  ./services/networking/seafile.nix
  ./services/networking/searx.nix
  ./services/networking/shadowsocks.nix
@ -1640,6 +1641,7 @@
  ./system/boot/systemd/sysupdate.nix
  ./system/boot/systemd/sysusers.nix
  ./system/boot/systemd/tmpfiles.nix
+  ./system/boot/systemd/tpm2.nix
  ./system/boot/systemd/user.nix
  ./system/boot/systemd/userdbd.nix
  ./system/boot/systemd/homed.nix
--- a/nixos/modules/services/databases/tigerbeetle.md
+++ b/nixos/modules/services/databases/tigerbeetle.md
@ -35,3 +35,10 @@ Note that the TigerBeetle module won't open any firewall ports automatically, so

 A complete list of options for TigerBeetle can be found [here](#opt-services.tigerbeetle.enable).

+## Upgrading {#module-services-tigerbeetle-upgrading}
+
+Usually, TigerBeetle's [upgrade process](https://docs.tigerbeetle.com/operating/upgrading) only requires replacing the binary used for the servers.
+This is not directly possible with NixOS since the new binary will be located at a different place in the Nix store.
+
+However, since TigerBeetle is managed through systemd on NixOS, the only action you need to take when upgrading is to make sure the version of TigerBeetle you're upgrading to supports upgrades from the version you're currently running.
+This information will be on the [release notes](https://github.com/tigerbeetle/tigerbeetle/releases) for the version you're upgrading to.
--- a/nixos/modules/services/databases/tigerbeetle.nix
+++ b/nixos/modules/services/databases/tigerbeetle.nix
@ -42,8 +42,8 @@ in
      };

      cacheGridSize = mkOption {
-        type = types.strMatching "[0-9]+(K|M|G)B";
-        default = "1GB";
+        type = types.strMatching "[0-9]+(K|M|G)iB";
+        default = "1GiB";
        description = ''
          The grid cache size.
          The grid cache acts like a page cache for TigerBeetle.
@ -97,16 +97,26 @@ in
        '';

        serviceConfig = {
-          Type = "exec";
-
-          DynamicUser = true;
-          ProtectHome = true;
          DevicePolicy = "closed";
-
+          DynamicUser = true;
+          ExecStart = "${lib.getExe cfg.package} start --cache-grid=${cfg.cacheGridSize} --addresses=${lib.escapeShellArg (builtins.concatStringsSep "," cfg.addresses)} ${replicaDataPath}";
+          LockPersonality = true;
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "noaccess";
+          ProtectSystem = "strict";
+          RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
          StateDirectory = "tigerbeetle";
          StateDirectoryMode = 700;
-
-          ExecStart = "${lib.getExe cfg.package} start --cache-grid=${cfg.cacheGridSize} --addresses=${lib.escapeShellArg (builtins.concatStringsSep "," cfg.addresses)} ${replicaDataPath}";
+          Type = "exec";
        };
      };

--- a/nixos/modules/services/mail/mailman.nix
+++ b/nixos/modules/services/mail/mailman.nix
@ -30,6 +30,10 @@ let
      ENGINE = "haystack.backends.whoosh_backend.WhooshEngine";
      PATH = "/var/lib/mailman-web/fulltext-index";
    };
+  } // lib.optionalAttrs cfg.enablePostfix {
+    EMAIL_BACKEND = "django.core.mail.backends.smtp.EmailBackend";
+    EMAIL_HOST = "127.0.0.1";
+    EMAIL_PORT = 25;
  } // cfg.webSettings;

  webSettingsJSON = pkgs.writeText "settings.json" (builtins.toJSON webSettings);
--- a/nixos/modules/services/networking/scion/scion-ip-gateway.nix
+++ b/nixos/modules/services/networking/scion/scion-ip-gateway.nix
@ -0,0 +1,92 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+with lib;
+
+let
+  globalCfg = config.services.scion;
+  cfg = config.services.scion.scion-ip-gateway;
+  toml = pkgs.formats.toml { };
+  json = pkgs.formats.json { };
+  connectionDir = if globalCfg.stateless then "/run" else "/var/lib";
+  defaultConfig = {
+    tunnel = { };
+    gateway = {
+      traffic_policy_file = "${trafficConfigFile}";
+    };
+  };
+  defaultTrafficConfig = {
+    ASes = { };
+    ConfigVersion = 9001;
+  };
+  configFile = toml.generate "scion-ip-gateway.toml" (recursiveUpdate defaultConfig cfg.config);
+  trafficConfigFile = json.generate "scion-ip-gateway-traffic.json" (
+    recursiveUpdate defaultTrafficConfig cfg.trafficConfig
+  );
+in
+{
+  options.services.scion.scion-ip-gateway = {
+    enable = mkEnableOption "the scion-ip-gateway service";
+    config = mkOption {
+      default = { };
+      type = toml.type;
+      example = literalExpression ''
+        {
+          tunnel = {
+            src_ipv4 = "172.16.100.1";
+          };
+        }
+      '';
+      description = ''
+        scion-ip-gateway daemon configuration
+      '';
+    };
+    trafficConfig = mkOption {
+      default = { };
+      type = json.type;
+      example = literalExpression ''
+        {
+          ASes = {
+            "2-ffaa:0:b" = {
+              Nets = [
+                  "172.16.1.0/24"
+              ];
+            };
+          };
+          ConfigVersion = 9001;
+        }
+      '';
+      description = ''
+        scion-ip-gateway traffic configuration
+      '';
+    };
+  };
+  config = mkIf cfg.enable {
+    systemd.services.scion-ip-gateway = {
+      description = "SCION IP Gateway Service";
+      after = [
+        "network-online.target"
+        "scion-dispatcher.service"
+      ];
+      wants = [
+        "network-online.target"
+        "scion-dispatcher.service"
+      ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "simple";
+        Group = if (config.services.scion.scion-dispatcher.enable == true) then "scion" else null;
+        ExecStart = "${globalCfg.package}/bin/scion-ip-gateway --config ${configFile}";
+        DynamicUser = true;
+        AmbientCapabilities = [ "CAP_NET_ADMIN" ];
+        Restart = "on-failure";
+        KillMode = "control-group";
+        RemainAfterExit = false;
+      };
+    };
+  };
+}
--- a/nixos/modules/services/networking/scion/scion.nix
+++ b/nixos/modules/services/networking/scion/scion.nix
@ -42,6 +42,7 @@ in
      scion-daemon.enable = true;
      scion-router.enable = true;
      scion-control.enable = true;
+      scion-ip-gateway.enable = true;
    };
    assertions = [
      { assertion = cfg.bypassBootstrapWarning == true;
--- a/nixos/modules/services/printing/cupsd.nix
+++ b/nixos/modules/services/printing/cupsd.nix
@ -339,7 +339,7 @@ in
    services.dbus.packages = [ cups.out ] ++ optional polkitEnabled cups-pk-helper;
    services.udev.packages = cfg.drivers;

-    # Allow asswordless printer admin for members of wheel group
+    # Allow passwordless printer admin for members of wheel group
    security.polkit.extraConfig = mkIf polkitEnabled ''
      polkit.addRule(function(action, subject) {
          if (action.id == "org.opensuse.cupspkhelper.mechanism.all-edit" &&
--- a/nixos/modules/services/web-apps/stirling-pdf.nix
+++ b/nixos/modules/services/web-apps/stirling-pdf.nix
@ -59,6 +59,7 @@ in
          pngquant
          tesseract
          python3Packages.weasyprint
+          ghostscript_headless
        ]
        ++ lib.optional (cfg.environment.INSTALL_BOOK_AND_ADVANCED_HTML_OPS or "false" == "true") calibre;

--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@ -1088,6 +1088,8 @@ in
      storePaths = [
        "${config.boot.initrd.systemd.package}/bin/systemd-cryptsetup"
        "${config.boot.initrd.systemd.package}/lib/systemd/system-generators/systemd-cryptsetup-generator"
+      ] ++ lib.optionals config.boot.initrd.systemd.tpm2.enable [
+        "${config.boot.initrd.systemd.package}/lib/cryptsetup/libcryptsetup-token-systemd-tpm2.so"
      ];

    };
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@ -37,8 +37,6 @@ let
      "cryptsetup.target"
      "cryptsetup-pre.target"
      "remote-cryptsetup.target"
-    ] ++ optionals cfg.package.withTpm2Tss [
-      "tpm2.target"
    ] ++ [
      "sigpwr.target"
      "timers.target"
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@ -68,7 +68,6 @@ let
    "systemd-reboot.service"
    "systemd-sysctl.service"
    "timers.target"
-    "tpm2.target"
    "umount.target"
    "systemd-bsod.service"
  ] ++ cfg.additionalUpstreamUnits;
@ -349,15 +348,6 @@ in {
      visible = "shallow";
      description = "Definition of slice configurations.";
    };
-
-    enableTpm2 = mkOption {
-      default = cfg.package.withTpm2Tss;
-      defaultText = "boot.initrd.systemd.package.withTpm2Tss";
-      type = types.bool;
-      description = ''
-        Whether to enable TPM2 support in the initrd.
-      '';
-    };
  };

  config = mkIf (config.boot.initrd.enable && cfg.enable) {
@ -394,9 +384,7 @@ in {
      # systemd needs this for some features
      "autofs"
      # systemd-cryptenroll
-    ] ++ lib.optional cfg.enableTpm2 "tpm-tis"
-    ++ lib.optional (cfg.enableTpm2 && !(pkgs.stdenv.hostPlatform.isRiscV64 || pkgs.stdenv.hostPlatform.isArmv7)) "tpm-crb"
-    ++ lib.optional cfg.package.withEfi "efivarfs";
+    ] ++ lib.optional cfg.package.withEfi "efivarfs";

    boot.kernelParams = [
      "root=${config.boot.initrd.systemd.root}"
@ -495,10 +483,6 @@ in {

        # so NSS can look up usernames
        "${pkgs.glibc}/lib/libnss_files.so.2"
-      ] ++ optionals (cfg.package.withCryptsetup && cfg.enableTpm2) [
-        # tpm2 support
-        "${cfg.package}/lib/cryptsetup/libcryptsetup-token-systemd-tpm2.so"
-        pkgs.tpm2-tss
      ] ++ optionals cfg.package.withCryptsetup [
        # fido2 support
        "${cfg.package}/lib/cryptsetup/libcryptsetup-token-systemd-fido2.so"
--- a/nixos/modules/system/boot/systemd/tpm2.nix
+++ b/nixos/modules/system/boot/systemd/tpm2.nix
@ -0,0 +1,80 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+{
+  meta.maintainers = [ lib.maintainers.elvishjerricco ];
+
+  imports = [
+    (lib.mkRenamedOptionModule
+      [
+        "boot"
+        "initrd"
+        "systemd"
+        "enableTpm2"
+      ]
+      [
+        "boot"
+        "initrd"
+        "systemd"
+        "tpm2"
+        "enable"
+      ]
+    )
+  ];
+
+  options = {
+    systemd.tpm2.enable = lib.mkEnableOption "systemd TPM2 support" // {
+      default = config.systemd.package.withTpm2Tss;
+      defaultText = "systemd.package.withTpm2Tss";
+    };
+
+    boot.initrd.systemd.tpm2.enable = lib.mkEnableOption "systemd initrd TPM2 support" // {
+      default = config.boot.initrd.systemd.package.withTpm2Tss;
+      defaultText = "boot.initrd.systemd.package.withTpm2Tss";
+    };
+  };
+
+  # TODO: pcrphase, pcrextend, pcrfs, pcrmachine
+  config = lib.mkMerge [
+    # Stage 2
+    (
+      let
+        cfg = config.systemd;
+      in
+      lib.mkIf cfg.tpm2.enable {
+        systemd.additionalUpstreamSystemUnits = [
+          "tpm2.target"
+          "systemd-tpm2-setup-early.service"
+          "systemd-tpm2-setup.service"
+        ];
+      }
+    )
+
+    # Stage 1
+    (
+      let
+        cfg = config.boot.initrd.systemd;
+      in
+      lib.mkIf cfg.tpm2.enable {
+        boot.initrd.systemd.additionalUpstreamUnits = [
+          "tpm2.target"
+          "systemd-tpm2-setup-early.service"
+        ];
+
+        boot.initrd.availableKernelModules =
+          [ "tpm-tis" ]
+          ++ lib.optional (
+            !(pkgs.stdenv.hostPlatform.isRiscV64 || pkgs.stdenv.hostPlatform.isArmv7)
+          ) "tpm-crb";
+        boot.initrd.systemd.storePaths = [
+          pkgs.tpm2-tss
+          "${cfg.package}/lib/systemd/systemd-tpm2-setup"
+          "${cfg.package}/lib/systemd/system-generators/systemd-tpm2-generator"
+        ];
+      }
+    )
+  ];
+}
--- a/nixos/modules/tasks/auto-upgrade.nix
+++ b/nixos/modules/tasks/auto-upgrade.nix
@ -168,7 +168,7 @@ in {
    assertions = [{
      assertion = !((cfg.channel != null) && (cfg.flake != null));
      message = ''
-        The options 'system.autoUpgrade.channels' and 'system.autoUpgrade.flake' cannot both be set.
+        The options 'system.autoUpgrade.channel' and 'system.autoUpgrade.flake' cannot both be set.
      '';
    }];

--- a/nixos/modules/tasks/filesystems/nfs.nix
+++ b/nixos/modules/tasks/filesystems/nfs.nix
@ -16,7 +16,7 @@ let
    lib.optionalAttrs (cfg.server.nproc != null) {
      nfsd.threads = cfg.server.nproc;
    } // lib.optionalAttrs (cfg.server.hostName != null) {
-      nfsd.host= cfg.hostName;
+      nfsd.host = cfg.server.hostName;
    } // lib.optionalAttrs (cfg.server.mountdPort != null) {
      mountd.port = cfg.server.mountdPort;
    } // lib.optionalAttrs (cfg.server.statdPort != null) {
--- a/nixos/tests/scion/freestanding-deployment/bootstrap.sh
+++ b/nixos/tests/scion/freestanding-deployment/bootstrap.sh
@ -0,0 +1,73 @@
+set -euo pipefail
+
+mkdir /tmp/tutorial-scion-certs && cd /tmp/tutorial-scion-certs
+mkdir AS{1..5}
+
+# Create voting and root keys and (self-signed) certificates for core ASes
+pushd AS1
+scion-pki certificate create --not-after=3650d --profile=sensitive-voting <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 sensitive voting cert"}') sensitive-voting.pem sensitive-voting.key
+scion-pki certificate create --not-after=3650d --profile=regular-voting <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 regular voting cert"}') regular-voting.pem regular-voting.key
+scion-pki certificate create --not-after=3650d --profile=cp-root <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 cp root cert"}') cp-root.pem cp-root.key
+popd
+
+pushd AS2
+scion-pki certificate create --not-after=3650d --profile=cp-root <(echo '{"isd_as": "42-ffaa:1:2", "common_name": "42-ffaa:1:2 cp root cert"}') cp-root.pem cp-root.key
+popd
+
+pushd AS3
+scion-pki certificate create --not-after=3650d --profile=sensitive-voting <(echo '{"isd_as": "42-ffaa:1:3", "common_name": "42-ffaa:1:3 sensitive voting cert"}') sensitive-voting.pem sensitive-voting.key
+scion-pki certificate create --not-after=3650d --profile=regular-voting <(echo '{"isd_as": "42-ffaa:1:3", "common_name": "42-ffaa:1:3 regular voting cert"}') regular-voting.pem regular-voting.key
+popd
+
+# Create the TRC (Trust Root Configuration)
+mkdir tmp
+echo '
+isd = 42
+description = "Demo ISD 42"
+serial_version = 1
+base_version = 1
+voting_quorum = 2
+
+core_ases = ["ffaa:1:1", "ffaa:1:2", "ffaa:1:3"]
+authoritative_ases = ["ffaa:1:1", "ffaa:1:2", "ffaa:1:3"]
+cert_files = ["AS1/sensitive-voting.pem", "AS1/regular-voting.pem", "AS1/cp-root.pem", "AS2/cp-root.pem", "AS3/sensitive-voting.pem", "AS3/regular-voting.pem"]
+
+[validity]
+not_before = '$(date +%s)'
+validity = "365d"' \
+> trc-B1-S1-pld.tmpl
+
+scion-pki trc payload --out=tmp/ISD42-B1-S1.pld.der --template trc-B1-S1-pld.tmpl
+rm trc-B1-S1-pld.tmpl
+
+# Sign and bundle the TRC
+scion-pki trc sign tmp/ISD42-B1-S1.pld.der AS1/sensitive-voting.{pem,key} --out tmp/ISD42-B1-S1.AS1-sensitive.trc
+scion-pki trc sign tmp/ISD42-B1-S1.pld.der AS1/regular-voting.{pem,key} --out tmp/ISD42-B1-S1.AS1-regular.trc
+scion-pki trc sign tmp/ISD42-B1-S1.pld.der AS3/sensitive-voting.{pem,key} --out tmp/ISD42-B1-S1.AS3-sensitive.trc
+scion-pki trc sign tmp/ISD42-B1-S1.pld.der AS3/regular-voting.{pem,key} --out tmp/ISD42-B1-S1.AS3-regular.trc
+
+scion-pki trc combine tmp/ISD42-B1-S1.AS{1,3}-{sensitive,regular}.trc --payload tmp/ISD42-B1-S1.pld.der --out ISD42-B1-S1.trc
+rm tmp -r
+
+# Create CA key and certificate for issuing ASes
+pushd AS1
+scion-pki certificate create --profile=cp-ca <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 CA cert"}') cp-ca.pem cp-ca.key --ca cp-root.pem --ca-key cp-root.key
+popd
+pushd AS2
+scion-pki certificate create --profile=cp-ca <(echo '{"isd_as": "42-ffaa:1:2", "common_name": "42-ffaa:1:2 CA cert"}') cp-ca.pem cp-ca.key --ca cp-root.pem --ca-key cp-root.key
+popd
+
+# Create AS key and certificate chains
+scion-pki certificate create --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 AS cert"}') AS1/cp-as.pem AS1/cp-as.key --ca AS1/cp-ca.pem --ca-key AS1/cp-ca.key --bundle
+scion-pki certificate create --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:2", "common_name": "42-ffaa:1:2 AS cert"}') AS2/cp-as.pem AS2/cp-as.key --ca AS2/cp-ca.pem --ca-key AS2/cp-ca.key --bundle
+scion-pki certificate create --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:3", "common_name": "42-ffaa:1:3 AS cert"}') AS3/cp-as.pem AS3/cp-as.key --ca AS1/cp-ca.pem --ca-key AS1/cp-ca.key --bundle
+scion-pki certificate create --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:4", "common_name": "42-ffaa:1:4 AS cert"}') AS4/cp-as.pem AS4/cp-as.key --ca AS1/cp-ca.pem --ca-key AS1/cp-ca.key --bundle
+scion-pki certificate create --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:5", "common_name": "42-ffaa:1:5 AS cert"}') AS5/cp-as.pem AS5/cp-as.key --ca AS2/cp-ca.pem --ca-key AS2/cp-ca.key --bundle
+
+for i in {1..5}
+do
+  mkdir -p $out/AS$i
+  cp AS$i/cp-as.{key,pem} $out/AS$i
+done
+
+mv *.trc $out
--- a/nixos/tests/scion/freestanding-deployment/default.nix
+++ b/nixos/tests/scion/freestanding-deployment/default.nix
@ -5,81 +5,8 @@ let
    buildInputs = [
      pkgs.scion
    ];
-  } ''
-    set -euo pipefail
+  } (builtins.readFile ./bootstrap.sh);

-    mkdir /tmp/tutorial-scion-certs && cd /tmp/tutorial-scion-certs
-    mkdir AS{1..5}
-
-    # Create voting and root keys and (self-signed) certificates for core ASes
-    pushd AS1
-    scion-pki certificate create --not-after=3650d --profile=sensitive-voting <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 sensitive voting cert"}') sensitive-voting.pem sensitive-voting.key
-    scion-pki certificate create --not-after=3650d --profile=regular-voting <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 regular voting cert"}') regular-voting.pem regular-voting.key
-    scion-pki certificate create --not-after=3650d --profile=cp-root <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 cp root cert"}') cp-root.pem cp-root.key
-    popd
-
-    pushd AS2
-    scion-pki certificate create --not-after=3650d --profile=cp-root <(echo '{"isd_as": "42-ffaa:1:2", "common_name": "42-ffaa:1:2 cp root cert"}') cp-root.pem cp-root.key
-    popd
-
-    pushd AS3
-    scion-pki certificate create --not-after=3650d --profile=sensitive-voting <(echo '{"isd_as": "42-ffaa:1:3", "common_name": "42-ffaa:1:3 sensitive voting cert"}') sensitive-voting.pem sensitive-voting.key
-    scion-pki certificate create --not-after=3650d --profile=regular-voting <(echo '{"isd_as": "42-ffaa:1:3", "common_name": "42-ffaa:1:3 regular voting cert"}') regular-voting.pem regular-voting.key
-    popd
-
-    # Create the TRC (Trust Root Configuration)
-    mkdir tmp
-    echo '
-    isd = 42
-    description = "Demo ISD 42"
-    serial_version = 1
-    base_version = 1
-    voting_quorum = 2
-
-    core_ases = ["ffaa:1:1", "ffaa:1:2", "ffaa:1:3"]
-    authoritative_ases = ["ffaa:1:1", "ffaa:1:2", "ffaa:1:3"]
-    cert_files = ["AS1/sensitive-voting.pem", "AS1/regular-voting.pem", "AS1/cp-root.pem", "AS2/cp-root.pem", "AS3/sensitive-voting.pem", "AS3/regular-voting.pem"]
-
-    [validity]
-    not_before = '$(date +%s)'
-    validity = "365d"' \
-    > trc-B1-S1-pld.tmpl
-
-    scion-pki trc payload --out=tmp/ISD42-B1-S1.pld.der --template trc-B1-S1-pld.tmpl
-    rm trc-B1-S1-pld.tmpl
-
-    # Sign and bundle the TRC
-    scion-pki trc sign tmp/ISD42-B1-S1.pld.der AS1/sensitive-voting.{pem,key} --out tmp/ISD42-B1-S1.AS1-sensitive.trc
-    scion-pki trc sign tmp/ISD42-B1-S1.pld.der AS1/regular-voting.{pem,key} --out tmp/ISD42-B1-S1.AS1-regular.trc
-    scion-pki trc sign tmp/ISD42-B1-S1.pld.der AS3/sensitive-voting.{pem,key} --out tmp/ISD42-B1-S1.AS3-sensitive.trc
-    scion-pki trc sign tmp/ISD42-B1-S1.pld.der AS3/regular-voting.{pem,key} --out tmp/ISD42-B1-S1.AS3-regular.trc
-
-    scion-pki trc combine tmp/ISD42-B1-S1.AS{1,3}-{sensitive,regular}.trc --payload tmp/ISD42-B1-S1.pld.der --out ISD42-B1-S1.trc
-    rm tmp -r
-
-    # Create CA key and certificate for issuing ASes
-    pushd AS1
-    scion-pki certificate create --profile=cp-ca <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 CA cert"}') cp-ca.pem cp-ca.key --ca cp-root.pem --ca-key cp-root.key
-    popd
-    pushd AS2
-    scion-pki certificate create --profile=cp-ca <(echo '{"isd_as": "42-ffaa:1:2", "common_name": "42-ffaa:1:2 CA cert"}') cp-ca.pem cp-ca.key --ca cp-root.pem --ca-key cp-root.key
-    popd
-
-    # Create AS key and certificate chains
-    scion-pki certificate create --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 AS cert"}') AS1/cp-as.pem AS1/cp-as.key --ca AS1/cp-ca.pem --ca-key AS1/cp-ca.key --bundle
-    scion-pki certificate create --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:2", "common_name": "42-ffaa:1:2 AS cert"}') AS2/cp-as.pem AS2/cp-as.key --ca AS2/cp-ca.pem --ca-key AS2/cp-ca.key --bundle
-    scion-pki certificate create --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:3", "common_name": "42-ffaa:1:3 AS cert"}') AS3/cp-as.pem AS3/cp-as.key --ca AS1/cp-ca.pem --ca-key AS1/cp-ca.key --bundle
-    scion-pki certificate create --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:4", "common_name": "42-ffaa:1:4 AS cert"}') AS4/cp-as.pem AS4/cp-as.key --ca AS1/cp-ca.pem --ca-key AS1/cp-ca.key --bundle
-    scion-pki certificate create --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:5", "common_name": "42-ffaa:1:5 AS cert"}') AS5/cp-as.pem AS5/cp-as.key --ca AS2/cp-ca.pem --ca-key AS2/cp-ca.key --bundle
-
-    for i in {1..5}
-    do
-      mkdir -p $out/AS$i
-      cp AS$i/cp-as.{key,pem} $out/AS$i
-    done
-
-    mv *.trc $out
-  '';
  imports = hostId: [
    ({
      services.scion = {
@ -121,9 +48,47 @@ in
    };
    scion04 = { ... }: {
      imports = (imports 4);
+      networking.interfaces."lo".ipv4.addresses = [{ address = "172.16.1.1"; prefixLength = 32; }];
+      services.scion.scion-ip-gateway = {
+        enable = true;
+        config = {
+          tunnel = {
+            src_ipv4 = "172.16.1.1";
+          };
+        };
+        trafficConfig = {
+          ASes = {
+            "42-ffaa:1:5" = {
+              Nets = [
+                "172.16.100.0/24"
+              ];
+            };
+          };
+          ConfigVersion = 9001;
+        };
+      };
    };
    scion05 = { ... }: {
      imports = (imports 5);
+      networking.interfaces."lo".ipv4.addresses = [{ address = "172.16.100.1"; prefixLength = 32; }];
+      services.scion.scion-ip-gateway = {
+        enable = true;
+        config = {
+          tunnel = {
+            src_ipv4 = "172.16.100.1";
+          };
+        };
+        trafficConfig = {
+          ASes = {
+            "42-ffaa:1:4" = {
+              Nets = [
+                "172.16.1.0/24"
+              ];
+            };
+          };
+          ConfigVersion = 9001;
+        };
+      };
    };
  };
  testScript = let
@ -131,25 +96,35 @@ in
      addresses="42-ffaa:1:1 42-ffaa:1:2 42-ffaa:1:3 42-ffaa:1:4 42-ffaa:1:5"
      timeout=100
      wait_for_all() {
+        ret=0
        for as in "$@"
        do
          scion showpaths $as --no-probe > /dev/null
-          return 1
+          ret=$?
+          if [ "$ret" -ne "0" ]; then
+            break
+          fi
        done
-        return 0
+        return $ret
      }
      ping_all() {
+        ret=0
        for as in "$@"
        do
          scion ping "$as,127.0.0.1" -c 3
+          ret=$?
+          if [ "$ret" -ne "0" ]; then
+            break
+          fi
        done
-        return 0
+        return $ret
      }
      for i in $(seq 0 $timeout); do
-        wait_for_all $addresses && exit 0
-        ping_all $addresses && exit 0
        sleep 1
+        wait_for_all $addresses || continue
+        ping_all $addresses && exit 0
      done
+      exit 1
    '';
  in
  ''
@ -183,9 +158,16 @@ in
    # Wait for scion-control.service on all instances
    wait_for_unit("scion-control.service")

+    # Ensure cert is valid against TRC
+    succeed("scion-pki certificate verify --trc /etc/scion/certs/*.trc /etc/scion/crypto/as/*.pem >&2")
+
    # Execute pingAll command on all instances
    succeed("${pingAll} >&2")

+    # Execute ICMP pings across scion-ip-gateway
+    scion04.succeed("ping -c 3 172.16.100.1 >&2")
+    scion05.succeed("ping -c 3 172.16.1.1 >&2")
+
    # Restart all scion services and ping again to test robustness
    succeed("systemctl restart scion-* >&2")
    succeed("${pingAll} >&2")
--- a/nixos/tests/scion/freestanding-deployment/topology4.json
+++ b/nixos/tests/scion/freestanding-deployment/topology4.json
@ -36,5 +36,11 @@
        }
      }
    }
+  },
+  "sigs": {
+    "sig-1": {
+      "ctrl_addr": "127.0.0.1:30256",
+      "data_addr": "127.0.0.1:30056"
+    }
  }
 }
--- a/nixos/tests/scion/freestanding-deployment/topology5.json
+++ b/nixos/tests/scion/freestanding-deployment/topology5.json
@ -36,5 +36,11 @@
        }
      }
    }
+  },
+  "sigs": {
+    "sig-1": {
+      "ctrl_addr": "127.0.0.1:30256",
+      "data_addr": "127.0.0.1:30056"
+    }
  }
 }
--- a/pkgs/applications/audio/amberol/default.nix
+++ b/pkgs/applications/audio/amberol/default.nix
@ -1,79 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitLab
-, rustPlatform
-, cargo
-, desktop-file-utils
-, appstream-glib
-, meson
-, ninja
-, pkg-config
-, reuse
-, rustc
-, m4
-, wrapGAppsHook4
-, glib
-, gtk4
-, gst_all_1
-, libadwaita
-, dbus
-}:
-
-stdenv.mkDerivation rec {
-  pname = "amberol";
-  version = "0.10.3";
-
-  src = fetchFromGitLab {
-    domain = "gitlab.gnome.org";
-    owner = "World";
-    repo = pname;
-    rev = version;
-    hash = "sha256-nAoUO0bGToNGD2W8qJmTegrETOJDdM04hI1jjiYkZXI=";
-  };
-
-  cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src;
-    name = "${pname}-${version}";
-    hash = "sha256-4ZoliqQ665KPDFl+1eBCE+1fZgr+FA7vesPstoRs0RU=";
-  };
-
-  postPatch = ''
-    patchShebangs build-aux
-  '';
-
-  nativeBuildInputs = [
-    appstream-glib
-    desktop-file-utils
-    meson
-    ninja
-    pkg-config
-    reuse
-    m4
-    wrapGAppsHook4
-    rustPlatform.cargoSetupHook
-    cargo
-    rustc
-  ];
-
-  buildInputs = [
-    glib
-    gtk4
-    libadwaita
-    gst_all_1.gstreamer
-    gst_all_1.gst-plugins-base
-    gst_all_1.gst-plugins-good
-    gst_all_1.gst-plugins-bad
-    gst_all_1.gst-plugins-ugly
-    gst_all_1.gst-libav
-    dbus
-  ];
-
-  meta = with lib; {
-    homepage = "https://gitlab.gnome.org/World/amberol";
-    description = "Small and simple sound and music player";
-    maintainers = with maintainers; [ linsui ];
-    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
-    mainProgram = "amberol";
-  };
-}
--- a/pkgs/applications/audio/cardinal/default.nix
+++ b/pkgs/applications/audio/cardinal/default.nix
@ -26,11 +26,11 @@

 stdenv.mkDerivation rec {
  pname = "cardinal";
-  version = "24.05";
+  version = "24.09";

  src = fetchurl {
    url = "https://github.com/DISTRHO/Cardinal/releases/download/${version}/cardinal+deps-${version}.tar.xz";
-    hash = "sha256-ZUJI5utUtST+idlL7WKBIs850EpK98cnmO47g8/iZcI=";
+    hash = "sha256-vJxKtZ0rVjf0RJfTNRxpzps1F2k0hHuiPnd1OwpULhQ=";
  };

  prePatch = ''
--- a/pkgs/applications/audio/ncmpcpp/default.nix
+++ b/pkgs/applications/audio/ncmpcpp/default.nix
@ -1,53 +1,88 @@
-{ lib
-, stdenv
-, fetchurl
-, boost
-, libmpdclient
-, ncurses
-, pkg-config
-, readline
-, libiconv
-, icu
-, curl
-, outputsSupport ? true # outputs screen
-, visualizerSupport ? false, fftw # visualizer screen
-, clockSupport ? true # clock screen
-, taglibSupport ? true, taglib # tag editor
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  boost,
+  libmpdclient,
+  ncurses,
+  pkg-config,
+  readline,
+  libiconv,
+  icu,
+  curl,
+  autoconf,
+  automake,
+  libtool,
+  outputsSupport ? true, # outputs screen
+  visualizerSupport ? false,
+  fftw, # visualizer screen
+  clockSupport ? true, # clock screen
+  taglibSupport ? true,
+  taglib, # tag editor
 }:

 stdenv.mkDerivation rec {
  pname = "ncmpcpp";
-  version = "0.9.2";
+  version = "0.10";

-  src = fetchurl {
-    url = "https://rybczak.net/ncmpcpp/stable/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-+qv2FXyMsbJKBZryduFi+p+aO5zTgQxDuRKIYMk4Ohs=";
+  src = fetchFromGitHub {
+    owner = "ncmpcpp";
+    repo = "ncmpcpp";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-HRJQ+IOQ8xP1QkPlLI+VtDUWaI2m0Aw0fCDWHhgsOLY=";
  };

  enableParallelBuilding = true;

  strictDeps = true;

-  configureFlags = [ "BOOST_LIB_SUFFIX=" ]
-    ++ lib.optional outputsSupport "--enable-outputs"
-    ++ lib.optional visualizerSupport "--enable-visualizer --with-fftw"
-    ++ lib.optional clockSupport "--enable-clock"
-    ++ lib.optional taglibSupport "--with-taglib";
+  configureFlags = [
+    "BOOST_LIB_SUFFIX="
+    (lib.enableFeature outputsSupport "outputs")
+    (lib.enableFeature visualizerSupport "enable-visualizer")
+    (lib.withFeature visualizerSupport "fftw")
+    (lib.enableFeature clockSupport "clock")
+    (lib.withFeature taglibSupport "taglib")
+  ];

-  nativeBuildInputs = [ pkg-config ]
+  nativeBuildInputs = [
+    autoconf
+    automake
+    libtool
+    pkg-config
+  ];
+
+  buildInputs = [
+    boost
+    libmpdclient
+    ncurses
+    readline
+    libiconv
+    icu
+    curl
+  ] ++ lib.optional visualizerSupport fftw
    ++ lib.optional taglibSupport taglib;

-  buildInputs = [ boost libmpdclient ncurses readline libiconv icu curl ]
-    ++ lib.optional visualizerSupport fftw
-    ++ lib.optional taglibSupport taglib;
+  preConfigure =
+    ''
+      ./autogen.sh
+    ''
+    + lib.optionalString stdenv.isDarwin ''
+      # std::result_of was removed in c++20 and unusable for clang16
+      substituteInPlace ./configure \
+        --replace-fail "std=c++20" "std=c++17"
+    '';

-  meta = with lib; {
+  meta =  {
    description = "Featureful ncurses based MPD client inspired by ncmpc";
-    homepage    = "https://rybczak.net/ncmpcpp/";
-    changelog   = "https://github.com/ncmpcpp/ncmpcpp/blob/${version}/CHANGELOG.md";
-    license     = licenses.gpl2Plus;
-    maintainers = with maintainers; [ koral lovek323 ];
-    platforms   = platforms.all;
+    homepage = "https://rybczak.net/ncmpcpp/";
+    changelog = "https://github.com/ncmpcpp/ncmpcpp/blob/${version}/CHANGELOG.md";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [
+      koral
+      lovek323
+    ];
+    platforms = lib.platforms.all;
    mainProgram = "ncmpcpp";
  };
 }
--- a/pkgs/applications/backup/unifi-protect-backup/default.nix
+++ b/pkgs/applications/backup/unifi-protect-backup/default.nix
@ -1,25 +1,11 @@
-{ lib
-, fetchFromGitHub
-, python3
+{
+  lib,
+  fetchFromGitHub,
+  fetchpatch,
+  python3,
 }:

-let
-  python = python3.override {
-    packageOverrides = self: super: {
-      pyunifiprotect = super.pyunifiprotect.overridePythonAttrs {
-        version = "unstable-2024-06-08";
-        src = fetchFromGitHub {
-          owner = "ep1cman";
-          repo = "pyunifiprotect";
-          rev = "d967bca2c65e0aa6a7363afb6367c3745c076747";
-          hash = "sha256-gSAK/T9cjIiRC/WjwrdLP+LHzEEUsNbwpXClYqpnMio=";
-        };
-      };
-    };
-  };
-in
-
-python.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
  pname = "unifi-protect-backup";
  version = "0.11.0";
  pyproject = true;
@ -31,18 +17,25 @@ python.pkgs.buildPythonApplication rec {
    hash = "sha256-t4AgPFqKS6u9yITIkUUB19/SxVwR7X8Cc01oPx3M+E0=";
  };

+  patches = [
+    # Switch to using UIProtect library, https://github.com/ep1cman/unifi-protect-backup/pull/160
+    (fetchpatch {
+      name = "switch-uiprotect.patch";
+      url = "https://github.com/ep1cman/unifi-protect-backup/commit/ccf2cde27229ade5c70ebfa902f289bf1a439f64.patch";
+      hash = "sha256-kogl/crvLE+7t9DLTuZqeW3/WB5/sytWDgbndoBw+RQ=";
+    })
+  ];
+
  pythonRelaxDeps = [
    "aiorun"
    "aiosqlite"
    "click"
-    "pyunifiprotect"
+    "uiprotect"
  ];

-  nativeBuildInputs = with python.pkgs; [
-    poetry-core
-  ];
+  nativeBuildInputs = with python3.pkgs; [ poetry-core ];

-  propagatedBuildInputs = with python.pkgs; [
+  propagatedBuildInputs = with python3.pkgs; [
    aiocron
    aiolimiter
    aiorun
@ -52,12 +45,10 @@ python.pkgs.buildPythonApplication rec {
    click
    expiring-dict
    python-dateutil
-    pyunifiprotect
+    uiprotect
  ];

-  nativeCheckInputs = with python.pkgs; [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = with python3.pkgs; [ pytestCheckHook ];

  meta = with lib; {
    description = "Python tool to backup unifi event clips in realtime";
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@ -38,12 +38,12 @@
  };
  apex = buildGrammar {
    language = "apex";
-    version = "0.0.0+rev=602cc4b";
+    version = "0.0.0+rev=69330ef";
    src = fetchFromGitHub {
      owner = "aheber";
      repo = "tree-sitter-sfapex";
-      rev = "602cc4b050ef1e14a69acc2ea094968bf928fa59";
-      hash = "sha256-OEaeH+iVWOtDKVBAAbFPN96uyKlcuDHIObsk6SP78SY=";
+      rev = "69330ef89fb6b7b2dd16b639d86811e9262c7369";
+      hash = "sha256-OO+KttgnPk18EtYmxNphn3if2p3QRNRrXQTYZOmmglc=";
    };
    location = "apex";
    meta.homepage = "https://github.com/aheber/tree-sitter-sfapex";
@ -193,12 +193,12 @@
  };
  c = buildGrammar {
    language = "c";
-    version = "0.0.0+rev=bc85948";
+    version = "0.0.0+rev=f4c2115";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-c";
-      rev = "bc85948c0bec746ebe921f72d2296d47e17d4ea7";
-      hash = "sha256-nwo4V6eliE4P5ub3jx9DSBjLRjfFViMZKXfP1RdSMM8=";
+      rev = "f4c21152f1952a99f4744e8c41d3ffb8038ae78c";
+      hash = "sha256-DcW6KZVTjJtPx0iNXvizeAXWW8iaShKGF4+sHrwXPvs=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-c";
  };
@ -325,12 +325,12 @@
  };
  cpp = buildGrammar {
    language = "cpp";
-    version = "0.0.0+rev=30f973c";
+    version = "0.0.0+rev=30d2fa3";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-cpp";
-      rev = "30f973c2244f0bff444186185f475c3bd76bc3a5";
-      hash = "sha256-r0rtjx0crbUK8euu5BAUW6NHdxC835tLW4YttvLNpkk=";
+      rev = "30d2fa385735378388a55917e2910965fce19748";
+      hash = "sha256-O7EVmGvkMCLTzoxNc+Qod6eCTWs6y8DYVpQqw+ziqGo=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-cpp";
  };
@ -381,12 +381,12 @@
  };
  d = buildGrammar {
    language = "d";
-    version = "0.0.0+rev=ac58458";
+    version = "0.0.0+rev=45e5f1e";
    src = fetchFromGitHub {
      owner = "gdamore";
      repo = "tree-sitter-d";
-      rev = "ac584585a15c4cacd6cda8e6bfe7cb1ca7b3898e";
-      hash = "sha256-+6+9x+5pyjv252X3XzpN2CnrUXVzMvaCrCPVhhjEELo=";
+      rev = "45e5f1e9d6de2c68591bc8e5ec662cf18e950b4a";
+      hash = "sha256-q96RgJWrMop2HBBsQloVTspe3EaMtUL3wmVuT9xnE/g=";
    };
    meta.homepage = "https://github.com/gdamore/tree-sitter-d";
  };
@ -526,12 +526,12 @@
  };
  editorconfig = buildGrammar {
    language = "editorconfig";
-    version = "0.0.0+rev=faf014c";
+    version = "0.0.0+rev=a761198";
    src = fetchFromGitHub {
      owner = "ValdezFOmar";
      repo = "tree-sitter-editorconfig";
-      rev = "faf014c607f912ff666b20183d32a03dcfc3111d";
-      hash = "sha256-gkbPpwe/FNeZuZEWOxchccWOk1erRMU8jabWoIFl2AY=";
+      rev = "a761198025448c77ea11bcf22505b395a77fc0d0";
+      hash = "sha256-KuaXFJGp1kxn0hqssiAFYL36zb0HY22warBb/40Ftzg=";
    };
    meta.homepage = "https://github.com/ValdezFOmar/tree-sitter-editorconfig";
  };
@ -570,12 +570,12 @@
  };
  elm = buildGrammar {
    language = "elm";
-    version = "0.0.0+rev=09dbf22";
+    version = "0.0.0+rev=27f502e";
    src = fetchFromGitHub {
      owner = "elm-tooling";
      repo = "tree-sitter-elm";
-      rev = "09dbf221d7491dc8d8839616b27c21b9c025c457";
-      hash = "sha256-Bq2oWtqEAsKyV0iHNKC+hXW4fh4yUwbfUhPtZWg5pug=";
+      rev = "27f502ed0a1cbd3c5912d284cc7934ee0d4cdddc";
+      hash = "sha256-o5ou/9/TCzc9HuGzvSSZE2iyWCOwYk0c28KEgGrOiiI=";
    };
    meta.homepage = "https://github.com/elm-tooling/tree-sitter-elm";
  };
@ -713,12 +713,12 @@
  };
  fortran = buildGrammar {
    language = "fortran";
-    version = "0.0.0+rev=8f84294";
+    version = "0.0.0+rev=c52e978";
    src = fetchFromGitHub {
      owner = "stadelmanma";
      repo = "tree-sitter-fortran";
-      rev = "8f842945abefb76b9a68c0835619b37060b8f098";
-      hash = "sha256-7nVAFWegMr/oShjSLaq9DESvaguPEK/bCCFu0Ru1QPQ=";
+      rev = "c52e978afadf3faed52bb3c8082cc472c915f4e7";
+      hash = "sha256-MQmS6IR/fyTo9qyYxt+g5kO4eToR6URrOHMN47rQ8kk=";
    };
    meta.homepage = "https://github.com/stadelmanma/tree-sitter-fortran";
  };
@ -933,12 +933,12 @@
  };
  go = buildGrammar {
    language = "go";
-    version = "0.0.0+rev=81a11f8";
+    version = "0.0.0+rev=ecc2086";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-go";
-      rev = "81a11f8252998ee6b98d59e6da91fc307491e53d";
-      hash = "sha256-q6ChXb4nHkFlMz4QWX8DMlCMaHnTgq27c7a3hufYOvg=";
+      rev = "ecc20866d1bd4d80f3aef06456ed3014d4d598e6";
+      hash = "sha256-elPqkvVYs0vADOuN/umDteWP5hqcXhQAoSkqYDtTxaU=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-go";
  };
@ -1209,12 +1209,12 @@
  };
  http = buildGrammar {
    language = "http";
-    version = "0.0.0+rev=7c68e1c";
+    version = "0.0.0+rev=231f1b1";
    src = fetchFromGitHub {
      owner = "rest-nvim";
      repo = "tree-sitter-http";
-      rev = "7c68e1c8ce6eeef6bc4b749330c540dbbda5ba44";
-      hash = "sha256-0Tj/hTVU8lK8j4MkcvlzpnbFFFZcNcXVdHvnB87AnyY=";
+      rev = "231f1b1bafd12e46c8ed8c21dbbdd940d9f15e94";
+      hash = "sha256-q8g7u3ctpfl0vq+RVBw7g7js/4SwAIkHg4CCRCuQ28w=";
    };
    meta.homepage = "https://github.com/rest-nvim/tree-sitter-http";
  };
@ -1264,12 +1264,12 @@
  };
  inko = buildGrammar {
    language = "inko";
-    version = "0.0.0+rev=234c87b";
+    version = "0.0.0+rev=3a8887c";
    src = fetchFromGitHub {
      owner = "inko-lang";
      repo = "tree-sitter-inko";
-      rev = "234c87be1dac20f766ddf6f486a7bde2a4bc5594";
-      hash = "sha256-7BADt6NjH9chOzCDtJSLjBZaRqeLvOH006q0hI4pZaI=";
+      rev = "3a8887ca16dd8add3905216ce63796d4097c7a6f";
+      hash = "sha256-kJ3xJGlLdvvcJIOoooOMf0BGpk88etQJhRS74enVmNQ=";
    };
    meta.homepage = "https://github.com/inko-lang/tree-sitter-inko";
  };
@ -1462,12 +1462,12 @@
  };
  lalrpop = buildGrammar {
    language = "lalrpop";
-    version = "0.0.0+rev=854a40e";
+    version = "0.0.0+rev=194c255";
    src = fetchFromGitHub {
      owner = "traxys";
      repo = "tree-sitter-lalrpop";
-      rev = "854a40e99f7c70258e522bdb8ab584ede6196e2e";
-      hash = "sha256-rVWmYF26DbPHoNRBv9FKEeacSbgw93PHy/wrQDGzlWk=";
+      rev = "194c25539f435de415ee0551a5f07058833da915";
+      hash = "sha256-I2Kozd0N8R0CCOVl4xTAL4fhZ5BIzSzW+MRQOfZ3cMY=";
    };
    meta.homepage = "https://github.com/traxys/tree-sitter-lalrpop";
  };
@ -1774,12 +1774,12 @@
  };
  nix = buildGrammar {
    language = "nix";
-    version = "0.0.0+rev=537095d";
+    version = "0.0.0+rev=01bc5b1";
    src = fetchFromGitHub {
      owner = "cstrahan";
      repo = "tree-sitter-nix";
-      rev = "537095ddc80cf610fa75a2a0149fe9799b011014";
-      hash = "sha256-MMaeGnlNTKHjjzZd70OGCO0GOXhbjcL6bvRKpnLmDw0=";
+      rev = "01bc5b18693055aab7a863d7608f4b3f85843cf8";
+      hash = "sha256-hzHCcKl3T+zEHhK5U4Ym+puvOjgr+etdDHNpuCbOSzU=";
    };
    meta.homepage = "https://github.com/cstrahan/tree-sitter-nix";
  };
@ -1829,24 +1829,24 @@
  };
  ocaml = buildGrammar {
    language = "ocaml";
-    version = "0.0.0+rev=14beb5e";
+    version = "0.0.0+rev=45ddc92";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-ocaml";
-      rev = "14beb5ef0e7488bf1d93b8c67f69942324fee557";
-      hash = "sha256-N8iqUa9CJ27wlUtfoMd9UO72q+kxTOGPVCblW07C0HU=";
+      rev = "45ddc92d18fa11b2ca1a18cd94de4e63feea0806";
+      hash = "sha256-xeUb/x1PennKS5N5TMPG0F+jLgAeY8DuIUkkbQ79QYQ=";
    };
    location = "grammars/ocaml";
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-ocaml";
  };
  ocaml_interface = buildGrammar {
    language = "ocaml_interface";
-    version = "0.0.0+rev=14beb5e";
+    version = "0.0.0+rev=45ddc92";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-ocaml";
-      rev = "14beb5ef0e7488bf1d93b8c67f69942324fee557";
-      hash = "sha256-N8iqUa9CJ27wlUtfoMd9UO72q+kxTOGPVCblW07C0HU=";
+      rev = "45ddc92d18fa11b2ca1a18cd94de4e63feea0806";
+      hash = "sha256-xeUb/x1PennKS5N5TMPG0F+jLgAeY8DuIUkkbQ79QYQ=";
    };
    location = "grammars/interface";
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-ocaml";
@ -1920,12 +1920,12 @@
  };
  perl = buildGrammar {
    language = "perl";
-    version = "0.0.0+rev=4659839";
+    version = "0.0.0+rev=81c57e2";
    src = fetchFromGitHub {
      owner = "tree-sitter-perl";
      repo = "tree-sitter-perl";
-      rev = "465983954cae2d2f984eae82de5ed5f11ca291dc";
-      hash = "sha256-jSVmxGkumDXExLjT+Nnsu+E0IBB3z6wBb4y8hpp5IQs=";
+      rev = "81c57e274c541c30d6c204c8dbceb90ec647ed8d";
+      hash = "sha256-xtsLJx9tzj3KNhlCDuXnAGBz3EYnJ/J+EJ0UKHVN4g4=";
    };
    meta.homepage = "https://github.com/tree-sitter-perl/tree-sitter-perl";
  };
@ -2233,12 +2233,12 @@
  };
  r = buildGrammar {
    language = "r";
-    version = "0.0.0+rev=4279b69";
+    version = "0.0.0+rev=2097fa5";
    src = fetchFromGitHub {
      owner = "r-lib";
      repo = "tree-sitter-r";
-      rev = "4279b699c47fa87956045980c46c7d30f8c0121b";
-      hash = "sha256-9IjhdtkQNshRJq48jBW6cvDd/tVNwgYfRK2YWhdFG84=";
+      rev = "2097fa502efa21349d26af0ffee55d773015e481";
+      hash = "sha256-a7vgmOY9K8w8vwMlOLBmUnXpWpVP+YlOilGODaI07y4=";
    };
    meta.homepage = "https://github.com/r-lib/tree-sitter-r";
  };
@ -2487,12 +2487,12 @@
  };
  sflog = buildGrammar {
    language = "sflog";
-    version = "0.0.0+rev=602cc4b";
+    version = "0.0.0+rev=69330ef";
    src = fetchFromGitHub {
      owner = "aheber";
      repo = "tree-sitter-sfapex";
-      rev = "602cc4b050ef1e14a69acc2ea094968bf928fa59";
-      hash = "sha256-OEaeH+iVWOtDKVBAAbFPN96uyKlcuDHIObsk6SP78SY=";
+      rev = "69330ef89fb6b7b2dd16b639d86811e9262c7369";
+      hash = "sha256-OO+KttgnPk18EtYmxNphn3if2p3QRNRrXQTYZOmmglc=";
    };
    location = "sflog";
    meta.homepage = "https://github.com/aheber/tree-sitter-sfapex";
@ -2565,24 +2565,24 @@
  };
  soql = buildGrammar {
    language = "soql";
-    version = "0.0.0+rev=602cc4b";
+    version = "0.0.0+rev=69330ef";
    src = fetchFromGitHub {
      owner = "aheber";
      repo = "tree-sitter-sfapex";
-      rev = "602cc4b050ef1e14a69acc2ea094968bf928fa59";
-      hash = "sha256-OEaeH+iVWOtDKVBAAbFPN96uyKlcuDHIObsk6SP78SY=";
+      rev = "69330ef89fb6b7b2dd16b639d86811e9262c7369";
+      hash = "sha256-OO+KttgnPk18EtYmxNphn3if2p3QRNRrXQTYZOmmglc=";
    };
    location = "soql";
    meta.homepage = "https://github.com/aheber/tree-sitter-sfapex";
  };
  sosl = buildGrammar {
    language = "sosl";
-    version = "0.0.0+rev=602cc4b";
+    version = "0.0.0+rev=69330ef";
    src = fetchFromGitHub {
      owner = "aheber";
      repo = "tree-sitter-sfapex";
-      rev = "602cc4b050ef1e14a69acc2ea094968bf928fa59";
-      hash = "sha256-OEaeH+iVWOtDKVBAAbFPN96uyKlcuDHIObsk6SP78SY=";
+      rev = "69330ef89fb6b7b2dd16b639d86811e9262c7369";
+      hash = "sha256-OO+KttgnPk18EtYmxNphn3if2p3QRNRrXQTYZOmmglc=";
    };
    location = "sosl";
    meta.homepage = "https://github.com/aheber/tree-sitter-sfapex";
@ -2677,12 +2677,12 @@
  };
  supercollider = buildGrammar {
    language = "supercollider";
-    version = "0.0.0+rev=affa438";
+    version = "0.0.0+rev=1a8ee0d";
    src = fetchFromGitHub {
      owner = "madskjeldgaard";
      repo = "tree-sitter-supercollider";
-      rev = "affa4389186b6939d89673e1e9d2b28364f5ca6f";
-      hash = "sha256-j4CTKkSdKnSGdgC3zGglmZ6uQvbC2ObQ+WWlY0afSwo=";
+      rev = "1a8ee0da9a4f2df5a8a22f4d637ac863623a78a7";
+      hash = "sha256-G23AZO1zvTvRE9ciV7qMuSoaCYulhyOkwiRwgK06NRQ=";
    };
    meta.homepage = "https://github.com/madskjeldgaard/tree-sitter-supercollider";
  };
@ -2710,12 +2710,12 @@
  };
  swift = buildGrammar {
    language = "swift";
-    version = "0.0.0+rev=7d303df";
+    version = "0.0.0+rev=032930d";
    src = fetchFromGitHub {
      owner = "alex-pinkus";
      repo = "tree-sitter-swift";
-      rev = "7d303df70012edb7385a6a3b3938e0e7b89ecfbd";
-      hash = "sha256-aTzbNyg248RG00qj7LiLDQAI63c7cXx++TGoANkyp2c=";
+      rev = "032930d6218d8ae23bde074cf29ce8d276b87533";
+      hash = "sha256-VhQ+OwkqOVJH9/R2eDVkCJbmh50EmZjVGX8Pk4uMGBw=";
    };
    generate = true;
    meta.homepage = "https://github.com/alex-pinkus/tree-sitter-swift";
@ -2867,12 +2867,12 @@
  };
  tlaplus = buildGrammar {
    language = "tlaplus";
-    version = "0.0.0+rev=bba02e7";
+    version = "0.0.0+rev=a9f9c13";
    src = fetchFromGitHub {
      owner = "tlaplus-community";
      repo = "tree-sitter-tlaplus";
-      rev = "bba02e79f85e335f310fc95e21c677e49f2c4439";
-      hash = "sha256-FbOBkEtsFFD9jIWM2+fETstnvQyIj2DAF81v0dXjouo=";
+      rev = "a9f9c136baa9b73c63850be92301fb5f1fc9b2fd";
+      hash = "sha256-BakN8qW6IyEK2GfSpPDogiJXTZXGjRiHN0LNyVH7Z2Q=";
    };
    meta.homepage = "https://github.com/tlaplus-community/tree-sitter-tlaplus";
  };
@ -3058,12 +3058,12 @@
  };
  v = buildGrammar {
    language = "v";
-    version = "0.0.0+rev=83b7286";
+    version = "0.0.0+rev=4f93826";
    src = fetchFromGitHub {
      owner = "vlang";
      repo = "v-analyzer";
-      rev = "83b7286d8f4f33c88dff102bad22149d8e29d9eb";
-      hash = "sha256-O9NXsijpl7+7KWLYwH95Pa4QeWfik6i+wAK5OWV/xgc=";
+      rev = "4f93826aeb31066eb241f4ccbca61f052239803f";
+      hash = "sha256-Tl4q6QksNu7Pm0Pt8rJka6o55LNN2GN6zK732XmLXb8=";
    };
    location = "tree_sitter_v";
    meta.homepage = "https://github.com/vlang/v-analyzer";
@ -3280,12 +3280,12 @@
  };
  zig = buildGrammar {
    language = "zig";
-    version = "0.0.0+rev=21e2218";
+    version = "0.0.0+rev=eb7d58c";
    src = fetchFromGitHub {
      owner = "tree-sitter-grammars";
      repo = "tree-sitter-zig";
-      rev = "21e2218e0ec7f4e3c0640d16bf8c67e6f0a61e18";
-      hash = "sha256-BJ7rexbUbi92FRg5rhXTUpips4T9YtkEA/hVtd1tBFY=";
+      rev = "eb7d58c2dc4fbeea4745019dee8df013034ae66b";
+      hash = "sha256-iyb79SiMsV94RrWH/1Oi2aKBiX5io0Dp+zZf8qWZHwg=";
    };
    meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-zig";
  };
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -382,12 +382,12 @@ in

  codeium-nvim = let
    # Update according to https://github.com/Exafunction/codeium.nvim/blob/main/lua/codeium/versions.json
-    codeiumVersion = "1.8.80";
+    codeiumVersion = "1.16.18";
    codeiumHashes = {
-      x86_64-linux = "sha256-ULHO7NrbW0DDlOYiSHGXwJ+NOa68Ma+HMHgq2WyAKBA=";
-      aarch64-linux = "sha256-WVqPV/D9jPADkxt5XmydqXjSG8461URPsk1+W/kyZV0=";
-      x86_64-darwin = "sha256-0P/eYZp0Wieza0btOA+yxqKtoIYlUN6MhN0dI6R8GEg=";
-      aarch64-darwin = "sha256-2Cv22+Ii+otKLDQ404l9R/x42PkKTEzPB72/gc9wfig=";
+      x86_64-linux = "sha256-/m+t4abPgVWeGpfDkPm5DGCIXm1LoM5znHfES9lotAo=";
+      aarch64-linux = "sha256-0kR799yuxSFmyedJ14f5/EqOiFHs9cWjeJKvDIpIRl0=";
+      x86_64-darwin = "sha256-7Go5qZVAe2UHn547HZG4fmh84iF2r15+0IIlJK72Fqg=";
+      aarch64-darwin = "sha256-fe4GrgLRr66Qmme3p0X5BEwvKZhqG1aiE8xs5A1Dt6E=";
    };

    codeium' = codeium.overrideAttrs rec {
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -1816,8 +1816,8 @@ let
        mktplcRef = {
          name = "dependi";
          publisher = "fill-labs";
-          version = "0.7.9";
-          hash = "sha256-VsjISVDZGGh6/pf3Fd5g8pYDvWXA1+0oZKlQEGLBp4M=";
+          version = "0.7.10";
+          hash = "sha256-m8W21ztTmEOjDI1KCymeBgQzg9jdgKG9dCFp+U1D818=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/fill-labs.dependi/changelog";
--- a/pkgs/applications/editors/vscode/extensions/tekumara.typos-vscode/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/tekumara.typos-vscode/default.nix
@ -13,19 +13,19 @@ let
    {
      x86_64-linux = {
        arch = "linux-x64";
-        hash = "sha256-fvDzsFOG1pdmpC3RDY8zGP0yL/TzX6i00LnIX+yceVU=";
+        hash = "sha256-NdVSQQ5OeBPGSLbynUArNbfm+a2HCc/gwJMKfEDgzDM=";
      };
      aarch64-linux = {
        arch = "linux-arm64";
-        hash = "sha256-3yRZzOTuiTbkUUz1D3mZo7G5vayM6W9YBbJxTiVou9g=";
+        hash = "sha256-4FjA3mUz+DVBiMUJAlGkUbpDtZuDYuUHPWA4QUiqd5w=";
      };
      x86_64-darwin = {
        arch = "darwin-x64";
-        hash = "sha256-fKvR2bea4UxvnZ+LlWR/ahpKe8mk5f4mZrjqTFpsC5A=";
+        hash = "sha256-aexe9hrUxb3ZnrgJrvEXu2PZPmxOGdkk9exrfDaXA7s=";
      };
      aarch64-darwin = {
        arch = "darwin-arm64";
-        hash = "sha256-nkK3BH+MRi6KdThq4kYR9ZAfnuSkC2r/lKWpEtmD7Ak=";
+        hash = "sha256-ijmKU+eU3R3mxeFxFr5AtVwGYVBuYWecD8W+0gHzP5w=";
      };
    }
    .${system} or (throw "Unsupported system: ${system}");
@ -37,7 +37,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
    # Please update the corresponding binary (typos-lsp)
    # when updating this extension.
    # See pkgs/by-name/ty/typos-lsp/package.nix
-    version = "0.1.19";
+    version = "0.1.26";
    inherit (extInfo) hash arch;
  };

--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@ -107,18 +107,18 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "blender";
-  version = "4.2.1";
+  version = "4.2.2";

  srcs = [
    (fetchzip {
      name = "source";
      url = "https://download.blender.org/source/blender-${finalAttrs.version}.tar.xz";
-      hash = "sha256-+Y4JbzeK+30fO8WdEmvjOeQjm094ofsUhRFXs9mkcxI=";
+      hash = "sha256-wv9EwB4DXSVS5K+lb+7gU3pTrMDO/ELeV2eErivfsWU=";
    })
    (fetchgit {
      name = "assets";
      url = "https://projects.blender.org/blender/blender-assets.git";
-      rev = "6864f1832e71a31e1e04f72bb7a5a1f53f0cd01c";
+      rev = "v${finalAttrs.version}";
      fetchLFS = true;
      hash = "sha256-vepK0inPMuleAJBSipwoI99nMBBiFaK/eSMHDetEtjY=";
    })
--- a/pkgs/applications/networking/cluster/calico/default.nix
+++ b/pkgs/applications/networking/cluster/calico/default.nix
@ -2,16 +2,16 @@

 builtins.mapAttrs (pname: { doCheck ? true, mainProgram ? pname, subPackages }: buildGoModule rec {
  inherit pname;
-  version = "3.28.1";
+  version = "3.28.2";

  src = fetchFromGitHub {
    owner = "projectcalico";
    repo = "calico";
    rev = "v${version}";
-    hash = "sha256-IQGDuxk3ZDtrY/RLp2DfdCWtBNMTYPOitcVCcxH7HoY=";
+    hash = "sha256-ZENlUmSLI+aY33a69LNsfer/TLz8gmzxEv8Gddz6faU=";
  };

-  vendorHash = "sha256-F44n+n9jfGYBQC1I33ylp8ZJtMi+uzjOLeG+5MbVePs=";
+  vendorHash = "sha256-6ZHb4SUa22/KfN4B2hg710FOSpg69rlT9FbZ/wCjpDc=";

  inherit doCheck subPackages;

--- a/pkgs/applications/networking/cluster/pluto/default.nix
+++ b/pkgs/applications/networking/cluster/pluto/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "pluto";
-  version = "5.20.2";
+  version = "5.20.3";

  src = fetchFromGitHub {
    owner = "FairwindsOps";
    repo = "pluto";
    rev = "v${version}";
-    hash = "sha256-JMpqZnlFMHC6b+nQ6UIcOF0HKz4VE8/YXEnofUMHhxY=";
+    hash = "sha256-WbXIg453VewOejX/hyGi1DEi0cSwcQ+hKUFG8Ne4cPE=";
  };

  vendorHash = "sha256-VkaFANSzKOpmHWUwFp7YjwvsJegcJOrvJOBNNAIxOak=";
--- a/pkgs/applications/networking/instant-messengers/rambox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/rambox/default.nix
@ -2,11 +2,11 @@

 let
  pname = "rambox";
-  version = "2.3.4";
+  version = "2.4.0";

  src = fetchurl {
    url = "https://github.com/ramboxapp/download/releases/download/v${version}/Rambox-${version}-linux-x64.AppImage";
-    hash = "sha256-YaLvqd0yr0wlsvjtoN/9GXoZIpjH26DInhWC0Vg62Rs=";
+    hash = "sha256-pm4Ji1gv5vNMgB9ZWNKMLZSUE9wBklQ/MnFOKHP+Rcc=";
  };

  desktopItem = (makeDesktopItem {
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@ -14,13 +14,13 @@

 stdenv.mkDerivation rec {
  pname = "signalbackup-tools";
-  version = "20240913";
+  version = "20240924-2";

  src = fetchFromGitHub {
    owner = "bepaald";
    repo = "signalbackup-tools";
    rev = version;
-    hash = "sha256-Rtoxa0LYL2ElBtt6KxRmKAkRDc8PNvRCoP0s51h+sIM=";
+    hash = "sha256-YnblQjZpKsnphbaRQ6FyHhssnns7U5VoNe/r3goQ0g8=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/nextcloud-client/default.nix
+++ b/pkgs/applications/networking/nextcloud-client/default.nix
@ -94,7 +94,7 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    changelog = "https://github.com/nextcloud/desktop/releases/tag/v${version}";
-    description = "Nextcloud themed desktop client";
+    description = "Desktop sync client for Nextcloud";
    homepage = "https://nextcloud.com";
    license = licenses.gpl2Plus;
    maintainers = with maintainers; [ kranzes SuperSandro2000 ];
--- a/pkgs/applications/networking/p2p/qbittorrent/default.nix
+++ b/pkgs/applications/networking/p2p/qbittorrent/default.nix
@ -30,13 +30,13 @@ stdenv.mkDerivation rec {
  pname = "qbittorrent"
    + lib.optionalString (guiSupport && qtVersion == "5") "-qt5"
    + lib.optionalString (!guiSupport) "-nox";
-  version = "4.6.5";
+  version = "4.6.7";

  src = fetchFromGitHub {
    owner = "qbittorrent";
    repo = "qBittorrent";
    rev = "release-${version}";
-    hash = "sha256-umJObvPv4VjdAZdQEuhqFCRvi1eZQViu1IO88oeTTq8=";
+    hash = "sha256-vUC8YIuyoGnl46FajfJG/XFXG+2lM9EaHWl2Hfo3T7c=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/shellhub-agent/default.nix
+++ b/pkgs/applications/networking/shellhub-agent/default.nix
@ -11,18 +11,18 @@

 buildGoModule rec {
  pname = "shellhub-agent";
-  version = "0.16.0";
+  version = "0.16.2";

  src = fetchFromGitHub {
    owner = "shellhub-io";
    repo = "shellhub";
    rev = "v${version}";
-    hash = "sha256-CJ9ZkoQmZlDI9mgZkEOWuJn66Dvt2f1DjPGf140qJDg=";
+    hash = "sha256-oIRMzifp/MVw+0s/QjhZpW7HEjNPHiCyEoNQq6ZRBGE=";
  };

  modRoot = "./agent";

-  vendorHash = "sha256-QWscqQlkvpfvJnI4C74qqD2P9V7ZAY29kCLF1WTTJ7Q=";
+  vendorHash = "sha256-qqh9KdhOt6KDgwUhf6lzb6I7YAhocBSZ7UeyBT0e0eM=";

  ldflags = [ "-s" "-w" "-X main.AgentVersion=v${version}" ];

--- a/pkgs/applications/networking/sync/rclone/default.nix
+++ b/pkgs/applications/networking/sync/rclone/default.nix
@ -6,7 +6,7 @@

 buildGoModule rec {
  pname = "rclone";
-  version = "1.68.0";
+  version = "1.68.1";

  outputs = [ "out" "man" ];

@ -14,7 +14,7 @@ buildGoModule rec {
    owner = "rclone";
    repo = "rclone";
    rev = "v${version}";
-    hash = "sha256-xLTzfS3/9XBqh0B7/VeRKYEHAgc4rY3QcIUS3f1/e0M=";
+    hash = "sha256-qVk1l6PLB2S9KlUiccBN60wbaApZnPXTjq1LYsf7pyE=";
  };

  vendorHash = "sha256-vZxdayoKTo/fs5PgEdT4gepNq0kNNmLQhlybWY5kpx0=";
--- a/pkgs/applications/office/paperless-ngx/default.nix
+++ b/pkgs/applications/office/paperless-ngx/default.nix
@ -25,13 +25,13 @@
 }:

 let
-  version = "2.11.6";
+  version = "2.12.1";

  src = fetchFromGitHub {
    owner = "paperless-ngx";
    repo = "paperless-ngx";
    rev = "refs/tags/v${version}";
-    hash = "sha256-RNX+KS2h9zrOK8QzeQWH55pkNPTDW4gic2HLG+XXLRg=";
+    hash = "sha256-txqwVGLUel74ObCqwMWSqa4Nd2eDRf0SqAIes5tlMDg=";
  };

  # subpath installation is broken with uvicorn >= 0.26
@ -76,7 +76,7 @@ let
      cd src-ui
    '';

-    npmDepsHash = "sha256-ML1Yp3JIMbRF6kVu190ReoY7oDUtUfNkHE7dHF6YUAE=";
+    npmDepsHash = "sha256-hb2z2cPMTN5bHtUldTR5Mvgo4nZL8/S+Uhfis37gF44=";

    nativeBuildInputs = [
      pkg-config
@ -116,16 +116,22 @@ let
 in
 python.pkgs.buildPythonApplication rec {
  pname = "paperless-ngx";
-  format = "other";
+  pyproject = false;

  inherit version src;

+  postPatch = ''
+    # pytest-xdist makes the tests flaky
+    substituteInPlace src/setup.cfg \
+      --replace-fail "--numprocesses auto --maxprocesses=16" ""
+  '';
+
  nativeBuildInputs = [
    gettext
    xorg.lndir
  ];

-  propagatedBuildInputs = with python.pkgs; [
+  dependencies = with python.pkgs; [
    bleach
    channels
    channels-redis
@ -192,7 +198,7 @@ python.pkgs.buildPythonApplication rec {
  '';

  installPhase = let
-    pythonPath = python.pkgs.makePythonPath propagatedBuildInputs;
+    pythonPath = python.pkgs.makePythonPath dependencies;
  in ''
    runHook preInstall

@ -203,7 +209,7 @@ python.pkgs.buildPythonApplication rec {
    makeWrapper $out/lib/paperless-ngx/src/manage.py $out/bin/paperless-ngx \
      --prefix PYTHONPATH : "${pythonPath}" \
      --prefix PATH : "${path}"
-    makeWrapper ${python.pkgs.celery}/bin/celery $out/bin/celery \
+    makeWrapper ${lib.getExe python.pkgs.celery} $out/bin/celery \
      --prefix PYTHONPATH : "${pythonPath}:$out/lib/paperless-ngx/src" \
      --prefix PATH : "${path}"

@ -225,7 +231,6 @@ python.pkgs.buildPythonApplication rec {
    pytest-httpx
    pytest-mock
    pytest-rerunfailures
-    pytest-xdist
    pytestCheckHook
  ];

--- a/pkgs/applications/office/planify/default.nix
+++ b/pkgs/applications/office/planify/default.nix
@ -28,13 +28,13 @@

 stdenv.mkDerivation rec {
  pname = "planify";
-  version = "4.11.2";
+  version = "4.11.4";

  src = fetchFromGitHub {
    owner = "alainm23";
    repo = "planify";
    rev = version;
-    hash = "sha256-yEe8zBaczCCY5Cs9lIc2J3GYSeDwmB1vsX9cANXQIC0=";
+    hash = "sha256-ADNMSXvfeAT53coAtCu3CVCU5XUFhLbvAH3WPFoKJVE=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/biology/messer-slim/default.nix
+++ b/pkgs/applications/science/biology/messer-slim/default.nix
@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, cmake, gcc, gcc-unwrapped }:

 stdenv.mkDerivation rec {
-  version = "4.2.2";
+  version = "4.3";
  pname = "messer-slim";

  src = fetchFromGitHub {
    owner = "MesserLab";
    repo = "SLiM";
    rev = "v${version}";
-    sha256 = "sha256-TlB7Hj4pVN4p4VanACWjQBeTxP9/DvRvdCdgelrXx60=";
+    hash = "sha256-Hgh1ianEdITRUIDKLiLW32kQlPlXKIfN4PSv3cOXTGI=";
  };

  nativeBuildInputs = [ cmake gcc gcc-unwrapped ];
--- a/pkgs/applications/science/misc/foldingathome/control.nix
+++ b/pkgs/applications/science/misc/foldingathome/control.nix
@ -1,57 +0,0 @@
-{ lib, stdenv
-, dpkg
-, fahviewer
-, fetchurl
-, makeWrapper
-, python2
-}:
-let
-  majMin = lib.versions.majorMinor version;
-  version = "7.6.21";
-
-  python = python2.withPackages
-    (
-      ps: [
-        ps.pycairo
-        ps.pygobject2
-        ps.pygtk
-      ]
-    );
-in
-stdenv.mkDerivation rec {
-  inherit version;
-  pname = "fahcontrol";
-
-  src = fetchurl {
-    url = "https://download.foldingathome.org/releases/public/release/fahcontrol/debian-stable-64bit/v${majMin}/fahcontrol_${version}-1_all.deb";
-    sha256 = "1vfrdqkrvdlyxaw3f6z92w5dllrv6810lmf8yhcmjcwmphipvf71";
-  };
-
-  nativeBuildInputs = [
-    dpkg
-    makeWrapper
-  ];
-
-  buildInputs = [ fahviewer python ];
-
-  unpackPhase = ''
-    dpkg-deb -x ${src} ./
-  '';
-
-  installPhase = "cp -ar usr $out";
-
-  postFixup = ''
-    sed -e "s|/usr/bin|$out/bin|g" -i $out/share/applications/FAHControl.desktop
-    wrapProgram "$out/bin/FAHControl" \
-      --suffix PATH : "${fahviewer.outPath}/bin" \
-      --set PYTHONPATH "$out/lib/python2.7/dist-packages"
-  '';
-
-  meta = {
-    description = "Folding@home control";
-    homepage = "https://foldingathome.org/";
-    license = lib.licenses.unfree;
-    maintainers = [ lib.maintainers.zimbatm ];
-    platforms = [ "x86_64-linux" ];
-  };
-}
--- a/pkgs/applications/science/misc/foldingathome/viewer.nix
+++ b/pkgs/applications/science/misc/foldingathome/viewer.nix
@ -1,56 +0,0 @@
-{ lib, stdenv
-, autoPatchelfHook
-, dpkg
-, fetchurl
-, libglut
-, gcc-unwrapped
-, libGL
-, libGLU
-, makeWrapper
-, zlib
-}:
-let
-  majMin = lib.versions.majorMinor version;
-  version = "7.6.21";
-in
-stdenv.mkDerivation rec {
-  inherit version;
-  pname = "fahviewer";
-
-  src = fetchurl {
-    url = "https://download.foldingathome.org/releases/public/release/fahviewer/debian-stable-64bit/v${majMin}/fahviewer_${version}_amd64.deb";
-    sha256 = "00fd00pf6fcpplcaahvy9ir60mk69d9rcmwsyq3jrv9mxqm9aq7p";
-  };
-
-  nativeBuildInputs = [
-    autoPatchelfHook
-    dpkg
-    makeWrapper
-  ];
-
-  buildInputs = [
-    libglut
-    gcc-unwrapped.lib
-    libGL
-    libGLU
-    zlib
-  ];
-
-  unpackPhase = ''
-    dpkg-deb -x ${src} ./
-    sed -e "s|/usr/bin|$out/bin|g" -i usr/share/applications/FAHViewer.desktop
-  '';
-
-  installPhase = ''
-    cp -ar usr $out
-  '';
-
-  meta = {
-    description = "Folding@home viewer";
-    homepage = "https://foldingathome.org/";
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    license = lib.licenses.unfree;
-    maintainers = [ lib.maintainers.zimbatm ];
-    platforms = [ "x86_64-linux" ];
-  };
-}
--- a/pkgs/applications/version-management/git-repo/default.nix
+++ b/pkgs/applications/version-management/git-repo/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "git-repo";
-  version = "2.46";
+  version = "2.47";

  src = fetchFromGitHub {
    owner = "android";
    repo = "tools_repo";
    rev = "v${version}";
-    hash = "sha256-eWRDarMx0QzTdTx3nFl1y12k25NqxGzuhLZd52Yr4qU=";
+    hash = "sha256-LFzUvDMNGxp5HzdjlaN0VS7HpIzN8GA5MQL61teKRvo=";
  };

  # Fix 'NameError: name 'ssl' is not defined'
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@ -323,15 +323,15 @@ rec {
  };

  docker_27 = callPackage dockerGen rec {
-    version = "27.2.0";
+    version = "27.3.0";
    cliRev = "v${version}";
-    cliHash = "sha256-Fa1EUwJjxh5jzhQJ4tllDZBfB7KACHDEe9ETVzMfUNY=";
+    cliHash = "sha256-1z2MmWq+HD2fhpZqXu0G7oBL3Mc0NN/fR69aMWRelns=";
    mobyRev = "v${version}";
-    mobyHash = "sha256-grxKlsbhxumQZNOyM96aURSiVFE1Fe5NFxUoPzFX/Qk=";
-    runcRev = "v1.1.13";
-    runcHash = "sha256-RQsM8Q7HogDVGbNpen3wxXNGR9lfqmNhkXTRoC+LBk8=";
-    containerdRev = "v1.7.21";
-    containerdHash = "sha256-cL1RKFg+B2gTPMg963DKup5BCLLgF9t9VZn2WlmmWPI=";
+    mobyHash = "sha256-AKl06k2ePWOFhL3oH086HcLLYs2Da+wLOcGjGnQ0SXE=";
+    runcRev = "v1.1.14";
+    runcHash = "sha256-7PYbSZqCQLTaeFppuNz5mxDlwEyLkA5zpdMhWy1tWmc=";
+    containerdRev = "v1.7.22";
+    containerdHash = "sha256-8IHBKai4PvvTuHPDTgx9wFEBzz4MM7Mwo8Q/bzFRzfk=";
    tiniRev = "v0.19.0";
    tiniHash = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI=";
  };
--- a/pkgs/applications/virtualization/spike/default.nix
+++ b/pkgs/applications/virtualization/spike/default.nix
@ -1,30 +1,21 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, dtc, pkgsCross }:
+{ lib, stdenv, fetchFromGitHub, dtc, pkgsCross }:

 stdenv.mkDerivation rec {
  pname = "spike";
-  version = "1.1.0";
+  version = "1.1.0-unstable-2024-09-21";

  src = fetchFromGitHub {
    owner = "riscv";
    repo = "riscv-isa-sim";
-    rev = "v${version}";
-    sha256 = "sha256-4D2Fezej0ioOOupw3kgMT5VLs+/jXQjwvek6v0AVMzI=";
+    rev = "de5094a1a901d77ff44f89b38e00fefa15d4018e";
+    sha256 = "sha256-mAgR2VzDgeuIdmPEgrb+MaA89BnWfmNanOVidqn0cgc=";
  };

-  patches = [
-    (fetchpatch {
-      name = "fesvr-fix-compilation-with-gcc-13.patch";
-      url = "https://github.com/riscv-software-src/riscv-isa-sim/commit/0a7bb5403d0290cea8b2356179d92e4c61ffd51d.patch";
-      hash = "sha256-JUMTbGawvLkoOWKkruzLzUFQytVR3wqTlGu/eegRFEE=";
-    })
-  ];
-
  nativeBuildInputs = [ dtc ];
  enableParallelBuilding = true;

  postPatch = ''
    patchShebangs scripts/*.sh
-    patchShebangs tests/ebreak.py
  '';

  doCheck = true;
--- a/pkgs/build-support/closure-info.nix
+++ b/pkgs/build-support/closure-info.nix
@ -4,13 +4,13 @@
 # "nix-store --load-db" and "nix-store --register-validity
 # --hash-given".

-{ stdenv, coreutils, jq }:
+{ stdenvNoCC, coreutils, jq }:

 { rootPaths }:

 assert builtins.langVersion >= 5;

-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
  name = "closure-info";

  __structuredAttrs = true;
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@ -907,6 +907,7 @@ rec {
    , config ? { }
    , architecture ? defaultArchitecture
    , created ? "1970-01-01T00:00:01Z"
+    , mtime ? "1970-01-01T00:00:01Z"
    , uid ? 0
    , gid ? 0
    , uname ? "root"
@ -1009,7 +1010,7 @@ rec {

        conf = runCommand "${baseName}-conf.json"
          {
-            inherit fromImage maxLayers created uid gid uname gname;
+            inherit fromImage maxLayers created mtime uid gid uname gname;
            imageName = lib.toLower name;
            preferLocalBuild = true;
            passthru.imageTag =
@ -1029,10 +1030,13 @@ rec {
            imageTag="${tag}"
          ''}

-          # convert "created" to iso format
+          # convert "created" and "mtime" to iso format
          if [[ "$created" != "now" ]]; then
              created="$(date -Iseconds -d "$created")"
          fi
+          if [[ "$mtime" != "now" ]]; then
+              mtime="$(date -Iseconds -d "$mtime")"
+          fi

          paths() {
            cat $paths ${lib.concatMapStringsSep " "
@ -1089,6 +1093,7 @@ rec {
              "customisation_layer", $customisation_layer,
              "repo_tag": $repo_tag,
              "created": $created,
+              "mtime": $mtime,
              "uid": $uid,
              "gid": $gid,
              "uname": $uname,
@ -1100,6 +1105,7 @@ rec {
              --arg customisation_layer ${customisationLayer} \
              --arg repo_tag "$imageName:$imageTag" \
              --arg created "$created" \
+              --arg mtime "$mtime" \
              --arg uid "$uid" \
              --arg gid "$gid" \
              --arg uname "$uname" \
--- a/pkgs/build-support/docker/stream_layered_image.py
+++ b/pkgs/build-support/docker/stream_layered_image.py
@ -307,6 +307,15 @@ def add_bytes(tar, path, content, mtime):
    tar.addfile(ti, io.BytesIO(content))


+now = datetime.now(tz=timezone.utc)
+
+
+def parse_time(s):
+    if s == "now":
+        return now
+    return datetime.fromisoformat(s)
+
+
 def main():
    arg_parser = argparse.ArgumentParser(
        description="""
@ -342,12 +351,8 @@ Docker Image Specification v1.2 as reference [1].
    with open(args.conf, "r") as f:
        conf = json.load(f)

-    created = (
-        datetime.now(tz=timezone.utc)
-        if conf["created"] == "now"
-        else datetime.fromisoformat(conf["created"])
-    )
-    mtime = int(created.timestamp())
+    created = parse_time(conf["created"])
+    mtime = int(parse_time(conf["mtime"]).timestamp())
    uid = int(conf["uid"])
    gid = int(conf["gid"])
    uname = conf["uname"]
--- a/pkgs/by-name/ae/aerogramme/0001-update-time-rs.patch
+++ b/pkgs/by-name/ae/aerogramme/0001-update-time-rs.patch
@ -0,0 +1,59 @@
+From ad754664a05808bdbb976906a86ad0b08f16eb32 Mon Sep 17 00:00:00 2001
+From: wxt <3264117476@qq.com>
+Date: Tue, 24 Sep 2024 20:38:19 +0800
+Subject: [PATCH] update time-rs
+
+---
+ Cargo.lock | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/Cargo.lock b/Cargo.lock
+index 0a159ae..cf6b1c4 100644
+--- a/Cargo.lock
+++ b/Cargo.lock
+@@ -2468,6 +2468,12 @@ dependencies = [
+  "num-traits",
+ ]
+ 
+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
+ [[package]]
+ name = "num-integer"
+ version = "0.1.45"
+@@ -3579,12 +3585,13 @@ dependencies = [
+ 
+ [[package]]
+ name = "time"
+-version = "0.3.31"
+version = "0.3.36"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "f657ba42c3f86e7680e53c8cd3af8abbe56b5491790b46e22e19c0d57463583e"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
+ dependencies = [
+  "deranged",
+  "itoa",
+ "num-conv",
+  "powerfmt",
+  "serde",
+  "time-core",
+@@ -3599,10 +3606,11 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
+ 
+ [[package]]
+ name = "time-macros"
+-version = "0.2.16"
+version = "0.2.18"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "26197e33420244aeb70c3e8c78376ca46571bc4e701e4791c2cd9f57dcb3a43f"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
+ dependencies = [
+ "num-conv",
+  "time-core",
+ ]
+ 
+-- 
+2.46.0
+
--- a/pkgs/by-name/ae/aerogramme/Cargo.lock
+++ b/pkgs/by-name/ae/aerogramme/Cargo.lock
@ -2468,6 +2468,12 @@ dependencies = [
 "num-traits",
 ]

+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
 [[package]]
 name = "num-integer"
 version = "0.1.45"
@ -3579,12 +3585,13 @@ dependencies = [

 [[package]]
 name = "time"
-version = "0.3.31"
+version = "0.3.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f657ba42c3f86e7680e53c8cd3af8abbe56b5491790b46e22e19c0d57463583e"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
 dependencies = [
 "deranged",
 "itoa",
+ "num-conv",
 "powerfmt",
 "serde",
 "time-core",
@ -3599,10 +3606,11 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"

 [[package]]
 name = "time-macros"
-version = "0.2.16"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26197e33420244aeb70c3e8c78376ca46571bc4e701e4791c2cd9f57dcb3a43f"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
 dependencies = [
+ "num-conv",
 "time-core",
 ]

--- a/pkgs/by-name/ae/aerogramme/package.nix
+++ b/pkgs/by-name/ae/aerogramme/package.nix
@ -6,17 +6,20 @@
  openssl,
 }:

-rustPlatform.buildRustPackage {
-  RUSTC_BOOTSTRAP = true;
-
+rustPlatform.buildRustPackage rec {
  pname = "aerogramme";
  version = "0.3.0";

  src = fetchgit {
    url = "https://git.deuxfleurs.fr/Deuxfleurs/aerogramme/";
+    rev = "refs/tags/${version}";
    hash = "sha256-ER+P/XGqNzTLwDLK5EBZq/Dl29ZZKl2FdxDb+oLEJ8Y=";
  };

+  cargoPatches = [
+    ./0001-update-time-rs.patch
+  ];
+
  # must use our own Cargo.lock due to git dependencies
  cargoLock = {
    lockFile = ./Cargo.lock;
@ -31,8 +34,11 @@ rustPlatform.buildRustPackage {
  # disable network tests as Nix sandbox breaks them
  doCheck = false;

-  # get openssl-sys to use pkg-config
-  OPENSSL_NO_VENDOR = 1;
+  env = {
+    # get openssl-sys to use pkg-config
+    OPENSSL_NO_VENDOR = true;
+    RUSTC_BOOTSTRAP = true;
+  };

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ openssl ];
--- a/pkgs/by-name/am/amberol/package.nix
+++ b/pkgs/by-name/am/amberol/package.nix
@ -0,0 +1,83 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  rustPlatform,
+  cargo,
+  desktop-file-utils,
+  appstream-glib,
+  meson,
+  ninja,
+  pkg-config,
+  reuse,
+  rustc,
+  m4,
+  wrapGAppsHook4,
+  glib,
+  gtk4,
+  gst_all_1,
+  libadwaita,
+  dbus,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "amberol";
+  version = "2024.1";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "World";
+    repo = "amberol";
+    rev = version;
+    hash = "sha256-WuyvTgh9Qc5WcgEssxkytwQpSACd82l5WKeMD0NFOp8=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "amberol-${version}";
+    hash = "sha256-C1ENyNUpgwGlZus/zIWD1mUrmWT9L0fH/1T4QaIxGJw=";
+  };
+
+  postPatch = ''
+    patchShebangs build-aux
+  '';
+
+  nativeBuildInputs = [
+    appstream-glib
+    cargo
+    desktop-file-utils
+    m4
+    meson
+    ninja
+    pkg-config
+    reuse
+    rustc
+    rustPlatform.cargoSetupHook
+    wrapGAppsHook4
+  ];
+
+  buildInputs =
+    [
+      dbus
+      glib
+      gtk4
+      libadwaita
+    ]
+    ++ (with gst_all_1; [
+      gstreamer
+      gst-plugins-base
+      gst-plugins-good
+      gst-plugins-bad
+      gst-plugins-ugly
+      gst-libav
+    ]);
+
+  meta = {
+    homepage = "https://gitlab.gnome.org/World/amberol";
+    description = "Small and simple sound and music player";
+    maintainers = with lib.maintainers; [ linsui ];
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+    mainProgram = "amberol";
+  };
+}
--- a/pkgs/by-name/an/anchor/0001-update-time-rs.patch
+++ b/pkgs/by-name/an/anchor/0001-update-time-rs.patch
@ -0,0 +1,88 @@
+From ff4dfb52767695c066b4ad027983c0d4958094b3 Mon Sep 17 00:00:00 2001
+From: wxt <3264117476@qq.com>
+Date: Tue, 24 Sep 2024 17:20:19 +0800
+Subject: [PATCH] update time-rs
+
+---
+ Cargo.lock | 30 ++++++++++++++++++++++++------
+ 1 file changed, 24 insertions(+), 6 deletions(-)
+
+diff --git a/Cargo.lock b/Cargo.lock
+index d588e86c..f09caad8 100644
+--- a/Cargo.lock
+++ b/Cargo.lock
+@@ -1432,9 +1432,12 @@ dependencies = [
+ 
+ [[package]]
+ name = "deranged"
+-version = "0.3.8"
+version = "0.3.11"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "f2696e8a945f658fd14dc3b87242e6b80cd0f36ff04ea560fa39082368847946"
+checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
+dependencies = [
+ "powerfmt",
+]
+ 
+ [[package]]
+ name = "derivation-path"
+@@ -2629,6 +2632,12 @@ dependencies = [
+  "num-traits",
+ ]
+ 
+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
+ [[package]]
+ name = "num-derive"
+ version = "0.3.3"
+@@ -3014,6 +3023,12 @@ dependencies = [
+  "rand 0.8.5",
+ ]
+ 
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+ [[package]]
+ name = "ppv-lite86"
+ version = "0.2.17"
+@@ -5276,12 +5291,14 @@ dependencies = [
+ 
+ [[package]]
+ name = "time"
+-version = "0.3.29"
+version = "0.3.36"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "426f806f4089c493dcac0d24c29c01e2c38baf8e30f1b716ee37e83d200b18fe"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
+ dependencies = [
+  "deranged",
+  "itoa",
+ "num-conv",
+ "powerfmt",
+  "serde",
+  "time-core",
+  "time-macros",
+@@ -5295,10 +5312,11 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
+ 
+ [[package]]
+ name = "time-macros"
+-version = "0.2.15"
+version = "0.2.18"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "4ad70d68dba9e1f8aceda7aa6711965dfec1cac869f311a51bd08b3a2ccbce20"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
+ dependencies = [
+ "num-conv",
+  "time-core",
+ ]
+ 
+-- 
+2.46.0
+
--- a/pkgs/by-name/an/anchor/Cargo.lock
+++ b/pkgs/by-name/an/anchor/Cargo.lock
@ -1432,9 +1432,12 @@ dependencies = [

 [[package]]
 name = "deranged"
-version = "0.3.8"
+version = "0.3.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2696e8a945f658fd14dc3b87242e6b80cd0f36ff04ea560fa39082368847946"
+checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
+dependencies = [
+ "powerfmt",
+]

 [[package]]
 name = "derivation-path"
@ -2629,6 +2632,12 @@ dependencies = [
 "num-traits",
 ]

+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
 [[package]]
 name = "num-derive"
 version = "0.3.3"
@ -3014,6 +3023,12 @@ dependencies = [
 "rand 0.8.5",
 ]

+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
 [[package]]
 name = "ppv-lite86"
 version = "0.2.17"
@ -5276,12 +5291,14 @@ dependencies = [

 [[package]]
 name = "time"
-version = "0.3.29"
+version = "0.3.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "426f806f4089c493dcac0d24c29c01e2c38baf8e30f1b716ee37e83d200b18fe"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
 dependencies = [
 "deranged",
 "itoa",
+ "num-conv",
+ "powerfmt",
 "serde",
 "time-core",
 "time-macros",
@ -5295,10 +5312,11 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"

 [[package]]
 name = "time-macros"
-version = "0.2.15"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ad70d68dba9e1f8aceda7aa6711965dfec1cac869f311a51bd08b3a2ccbce20"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
 dependencies = [
+ "num-conv",
 "time-core",
 ]

--- a/pkgs/by-name/an/anchor/package.nix
+++ b/pkgs/by-name/an/anchor/package.nix
@ -1,8 +1,9 @@
-{ lib
-, rustPlatform
-, fetchFromGitHub
-, stdenv
-, darwin
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  stdenv,
+  darwin,
 }:

 rustPlatform.buildRustPackage rec {
@ -17,6 +18,10 @@ rustPlatform.buildRustPackage rec {
    fetchSubmodules = true;
  };

+  cargoPatches = [
+    ./0001-update-time-rs.patch
+  ];
+
  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
@ -36,7 +41,6 @@ rustPlatform.buildRustPackage rec {
    "--skip=tests::test_get_anchor_version_from_commit"
  ];

-
  meta = with lib; {
    description = "Solana Sealevel Framework";
    homepage = "https://github.com/coral-xyz/anchor";
--- a/pkgs/by-name/ba/bazecor/package.nix
+++ b/pkgs/by-name/ba/bazecor/package.nix
@ -6,12 +6,12 @@
 }:
 let
  pname = "bazecor";
-  version = "1.4.5";
+  version = "1.5.0";
  src = appimageTools.extract {
    inherit pname version;
    src = fetchurl {
      url = "https://github.com/Dygmalab/Bazecor/releases/download/v${version}/Bazecor-${version}-x64.AppImage";
-      hash = "sha256-cvzUjOmeTWB07vSe6taUyGDmTlN62fhsQw/OMgvIJ2M=";
+      hash = "sha256-cxDTNtxy2APAjnHw/cVd1/hUazASJs46rCHNGQ/JbSM=";
    };

    # Workaround for https://github.com/Dygmalab/Bazecor/issues/370
--- a/pkgs/development/tools/bloaty/default.nix
+++ b/pkgs/development/tools/bloaty/default.nix
@ -1,16 +1,19 @@
-{ lib, stdenv, cmake, zlib, fetchFromGitHub, re2, abseil-cpp, protobuf, capstone, gtest, pkg-config, lit, llvmPackages_16 }:
-
-stdenv.mkDerivation rec {
-  pname = "bloaty";
-  version = "1.1-unstable-2023-11-06";
-
-  src = fetchFromGitHub {
-    owner = "google";
-    repo = "bloaty";
-    rev = "16f9fe54d9cd0e9abe1d25fc1a9b44c214cfaa9f";
-    hash = "sha256-mIVlNMKtJMfH2QdYZ6+oV7619oYzvKkq3fHY6uofqlM=";
-  };
-
+{
+  lib,
+  stdenv,
+  cmake,
+  zlib,
+  fetchFromGitHub,
+  re2,
+  abseil-cpp,
+  protobuf,
+  capstone,
+  gtest,
+  pkg-config,
+  lit,
+  llvmPackages_16,
+}:
+let
  # Old vendored package which has no other use than here, so not packaged in nixpkgs.
  demumble = fetchFromGitHub {
    owner = "nico";
@ -18,6 +21,17 @@ stdenv.mkDerivation rec {
    rev = "01098eab821b33bd31b9778aea38565cd796aa85";
    hash = "sha256-605SsXd7TSdm3BH854ChHIZbOXcHI/n8RN+pFMz4Ex4=";
  };
+in
+stdenv.mkDerivation {
+  pname = "bloaty";
+  version = "1.1-unstable-2024-09-23";
+
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = "bloaty";
+    rev = "0c89acd7e8b9d91fd1e9c8c129be627b4e47f1ea";
+    hash = "sha256-txZDPytWnkjkiVkPL2SWLwCPEtVvqoI/MVRvbJ2kBGw=";
+  };

  cmakeFlags = [
    "-DLIT_EXECUTABLE=${lit}/bin/lit"
@ -39,9 +53,21 @@ stdenv.mkDerivation rec {
    rm -rf tests/wasm
  '';

-  nativeBuildInputs = [ cmake pkg-config ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];

-  buildInputs = [ zlib re2 abseil-cpp protobuf capstone gtest lit llvmPackages_16.libllvm ];
+  buildInputs = [
+    zlib
+    re2
+    abseil-cpp
+    protobuf
+    capstone
+    gtest
+    lit
+    llvmPackages_16.libllvm
+  ];

  doCheck = true;

@ -54,12 +80,12 @@ stdenv.mkDerivation rec {
    install -Dm755 {.,$out/bin}/bloaty
  '';

-  meta = with lib; {
+  meta = {
    description = "Size profiler for binaries";
    mainProgram = "bloaty";
    homepage = "https://github.com/google/bloaty";
-    license = licenses.asl20;
-    platforms = platforms.unix;
-    maintainers = [ ];
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ momeemt ];
  };
 }
--- a/pkgs/by-name/bl/blockbench/package.nix
+++ b/pkgs/by-name/bl/blockbench/package.nix
@ -12,13 +12,13 @@

 buildNpmPackage rec {
  pname = "blockbench";
-  version = "4.10.4";
+  version = "4.11.0";

  src = fetchFromGitHub {
    owner = "JannisX11";
    repo = "blockbench";
    rev = "v${version}";
-    hash = "sha256-TjT93nx52PxuHuW4NONTfI3G7+Dl0NFX2aKpZDEF8+8=";
+    hash = "sha256-SmG8JMHdFTGkxLCTTbD1IhjQgmsRMvxQsB4rluHy6yI=";
  };

  nativeBuildInputs =
@ -28,7 +28,7 @@ buildNpmPackage rec {
      copyDesktopItems
    ];

-  npmDepsHash = "sha256-WkOn1bLJ9xmJdQcY6ak+hs/YW+crIXhTWA6tjMSVq9I=";
+  npmDepsHash = "sha256-vbwoKijDt7TbXfU8Il5dwnfyGc2HsbLdAJhQzYuq6eo=";

  env.ELECTRON_SKIP_BINARY_DOWNLOAD = 1;

--- a/pkgs/by-name/ca/cargo2junit/0001-update-time-rs.patch
+++ b/pkgs/by-name/ca/cargo2junit/0001-update-time-rs.patch
@ -0,0 +1,154 @@
+From 84e19417eb0c7768922cd5e05bc246b278c64ce2 Mon Sep 17 00:00:00 2001
+From: wxt <3264117476@qq.com>
+Date: Tue, 24 Sep 2024 21:12:03 +0800
+Subject: [PATCH] update time-rs
+
+---
+ Cargo.lock | 61 ++++++++++++++++++++++++++++++++++++++----------------
+ 1 file changed, 43 insertions(+), 18 deletions(-)
+
+diff --git a/Cargo.lock b/Cargo.lock
+index c56ff81..b20dca4 100644
+--- a/Cargo.lock
+++ b/Cargo.lock
+@@ -28,6 +28,15 @@ dependencies = [
+  "strip-ansi-escapes",
+ ]
+ 
+[[package]]
+name = "deranged"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
+dependencies = [
+ "powerfmt",
+]
+
+ [[package]]
+ name = "derive-getters"
+ version = "0.2.0"
+@@ -64,20 +73,32 @@ version = "2.5.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+ 
+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+ [[package]]
+ name = "proc-macro2"
+-version = "1.0.55"
+version = "1.0.86"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "1d0dd4be24fcdcfeaa12a432d588dc59bbad6cad3510c67e74a2b6b2fc950564"
+checksum = "5e719e8df665df0d1c8fbfd238015744736151d4445ec0836b8e628aae103b77"
+ dependencies = [
+  "unicode-ident",
+ ]
+ 
+ [[package]]
+ name = "quote"
+-version = "1.0.26"
+version = "1.0.37"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "4424af4bf778aae2051a77b60283332f386554255d722233d09fbfc7e30da2fc"
+checksum = "b5b9d34b8991d19d98081b46eacdd8eb58c6f2b201139f7c5f643cc155a633af"
+ dependencies = [
+  "proc-macro2",
+ ]
+@@ -107,22 +128,22 @@ checksum = "f91339c0467de62360649f8d3e185ca8de4224ff281f66000de5eb2a77a79041"
+ 
+ [[package]]
+ name = "serde"
+-version = "1.0.159"
+version = "1.0.210"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "3c04e8343c3daeec41f58990b9d77068df31209f2af111e059e9fe9646693065"
+checksum = "c8e3592472072e6e22e0a54d5904d9febf8508f65fb8552499a1abc7d1078c3a"
+ dependencies = [
+  "serde_derive",
+ ]
+ 
+ [[package]]
+ name = "serde_derive"
+-version = "1.0.159"
+version = "1.0.210"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "4c614d17805b093df4b147b51339e7e44bf05ef59fba1e45d83500bcfb4d8585"
+checksum = "243902eda00fad750862fc144cea25caca5e20d615af0a81bee94ca738f1df1f"
+ dependencies = [
+  "proc-macro2",
+  "quote",
+- "syn 2.0.13",
+ "syn 2.0.77",
+ ]
+ 
+ [[package]]
+@@ -158,9 +179,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "syn"
+-version = "2.0.13"
+version = "2.0.77"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "4c9da457c5285ac1f936ebd076af6dac17a61cfe7826f2076b4d015cf47bc8ec"
+checksum = "9f35bcdf61fd8e7be6caf75f429fdca8beb3ed76584befb503b1569faee373ed"
+ dependencies = [
+  "proc-macro2",
+  "quote",
+@@ -184,16 +205,19 @@ checksum = "f9456a42c5b0d803c8cd86e73dd7cc9edd429499f37a3550d286d5e86720569f"
+ dependencies = [
+  "proc-macro2",
+  "quote",
+- "syn 2.0.13",
+ "syn 2.0.77",
+ ]
+ 
+ [[package]]
+ name = "time"
+-version = "0.3.20"
+version = "0.3.36"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "cd0cbfecb4d19b5ea75bb31ad904eb5b9fa13f21079c3b92017ebdf4999a5890"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
+ dependencies = [
+ "deranged",
+  "itoa",
+ "num-conv",
+ "powerfmt",
+  "serde",
+  "time-core",
+  "time-macros",
+@@ -201,16 +225,17 @@ dependencies = [
+ 
+ [[package]]
+ name = "time-core"
+-version = "0.1.0"
+version = "0.1.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "2e153e1f1acaef8acc537e68b44906d2db6436e2b35ac2c6b42640fff91f00fd"
+checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
+ 
+ [[package]]
+ name = "time-macros"
+-version = "0.2.8"
+version = "0.2.18"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "fd80a657e71da814b8e5d60d3374fc6d35045062245d80224748ae522dd76f36"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
+ dependencies = [
+ "num-conv",
+  "time-core",
+ ]
+ 
+-- 
+2.46.0
+
--- a/pkgs/development/tools/rust/cargo2junit/default.nix
+++ b/pkgs/development/tools/rust/cargo2junit/default.nix
@ -1,4 +1,8 @@
-{ fetchCrate, lib, rustPlatform }:
+{
+  fetchCrate,
+  lib,
+  rustPlatform,
+}:

 rustPlatform.buildRustPackage rec {
  pname = "cargo2junit";
@ -9,7 +13,11 @@ rustPlatform.buildRustPackage rec {
    hash = "sha256-R3a87nXCnGhdeyR7409hFR5Cj3TFUWqaLNOtlXPsvto=";
  };

-  cargoHash = "sha256-u5Pd967qxjqFl9fV/KkClLDBwKql7p66WqbIVBvWKuM=";
+  cargoPatches = [
+    ./0001-update-time-rs.patch
+  ];
+
+  cargoHash = "sha256-ncRELlbT8Dy8huLgZrroRWohCLeN5cRjMWrIW4JNcCM=";

  meta = with lib; {
    description = "Converts cargo's json output (from stdin) to JUnit XML (to stdout)";
--- a/pkgs/by-name/co/cosmic-screenshot/package.nix
+++ b/pkgs/by-name/co/cosmic-screenshot/package.nix
@ -8,7 +8,7 @@

 rustPlatform.buildRustPackage rec {
  pname = "cosmic-screenshot";
-  version = "1.0.0-alpha.1";
+  version = "1.0.0-alpha.2";

  src = fetchFromGitHub {
    owner = "pop-os";
@ -17,7 +17,7 @@ rustPlatform.buildRustPackage rec {
    hash = "sha256-+yHpRbK+AWnpcGrC5U0wKbt0u8tm3CFGjKTCDQpb3G0=";
  };

-  cargoHash = "sha256-d56y35npMPrQM0yF0ytNcOdMKBz9IQvEz37DNvKBBSk=";
+  cargoHash = "sha256-fzIVyxzNknEjGJoR9sgXkY+gyuTC0T4Sy513X8umbWA=";

  nativeBuildInputs = [ just pkg-config ];

--- a/pkgs/by-name/cy/cyme/package.nix
+++ b/pkgs/by-name/cy/cyme/package.nix
@ -13,16 +13,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cyme";
-  version = "1.8.2";
+  version = "1.8.3";

  src = fetchFromGitHub {
    owner = "tuna-f1sh";
    repo = "cyme";
    rev = "v${version}";
-    hash = "sha256-bmVgl6E+MdjzM4wfhKHdii+58srAStRTYU+IP/OTqdU=";
+    hash = "sha256-DFO12ylrUIPxxOf3+sSXf/MN918U/IUeUfr72Lbnxvc=";
  };

-  cargoHash = "sha256-dpdtjeejt+jfSlSN1NZeAWSMcDq8mOGAHTJlmBkp/4s=";
+  cargoHash = "sha256-uw+Z0F2NoU1BFGwsNaIKT9hWclhqmJK2se5mm0xUQyc=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/da/databricks-cli/package.nix
+++ b/pkgs/by-name/da/databricks-cli/package.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "databricks-cli";
-  version = "0.227.0";
+  version = "0.228.1";

  src = fetchFromGitHub {
    owner = "databricks";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-bmTPtxkVtGzjxgmXpIHus7vUUg3IKGWmlUT8iOU+dtM=";
+    hash = "sha256-zQ39PwVjyxOTo6P+RA4F20/28loMbu3Bprd4C3jgu5A=";
  };

-  vendorHash = "sha256-ItcGzgGIDQOnAwUA/mPy+oNjChKPTVo7QK3gsidB1xQ=";
+  vendorHash = "sha256-SOeVIwMbx1eRzBvyfT3aaJOL7BCb745yezn1QYrf5vU=";

  excludedPackages = [ "bundle/internal" ];

--- a/pkgs/development/web/deno/librusty_v8.nix
+++ b/pkgs/development/web/deno/librusty_v8.nix
--- a/pkgs/development/web/deno/default.nix
+++ b/pkgs/development/web/deno/default.nix
@ -1,28 +1,28 @@
-{ stdenv
-, lib
-, callPackage
-, fetchFromGitHub
-, rustPlatform
-, cmake
-, protobuf
-, installShellFiles
-, libiconv
-, darwin
-, librusty_v8 ? callPackage ./librusty_v8.nix { }
-,
+{
+  stdenv,
+  lib,
+  callPackage,
+  fetchFromGitHub,
+  rustPlatform,
+  cmake,
+  protobuf,
+  installShellFiles,
+  libiconv,
+  darwin,
+  librusty_v8 ? callPackage ./librusty_v8.nix { },
 }:
 rustPlatform.buildRustPackage rec {
  pname = "deno";
-  version = "1.46.2";
+  version = "1.46.3";

  src = fetchFromGitHub {
    owner = "denoland";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-6rmAgGX7BnhbyDk0Pmp1uLBDywlK4cptTOfuvNhm0KE=";
+    repo = "deno";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-AM6SjcIHo6Koxcnznhkv3cXoKaMy2TEVpiWe/bczDuA=";
  };

-  cargoHash = "sha256-B+O2QYQDH+mqbnJhLumFWnv1b7dvnbpR7JG/3IS5tnI=";
+  cargoHash = "sha256-D+CZpb6OTzM5Il0k8GQB7qSONy4myE5yKlaSkLLqHT8=";

  postPatch = ''
    # upstream uses lld on aarch64-darwin for faster builds
@ -39,8 +39,11 @@ rustPlatform.buildRustPackage rec {
    protobuf
    installShellFiles
  ];
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
-    [ libiconv darwin.libobjc ]
+  buildInputs = lib.optionals stdenv.isDarwin (
+    [
+      libiconv
+      darwin.libobjc
+    ]
    ++ (with darwin.apple_sdk_11_0.frameworks; [
      Security
      CoreServices
@ -102,6 +105,14 @@ rustPlatform.buildRustPackage rec {
    license = licenses.mit;
    mainProgram = "deno";
    maintainers = with maintainers; [ jk ];
-    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "x86_64-darwin"
+      "aarch64-darwin"
+    ];
+    # NOTE: `aligned_alloc` error on darwin SDK < 10.15. Can't do usual overrideSDK with rust toolchain in current implementation.
+    # Should be fixed with darwin SDK refactor and can be revisited.
+    broken = stdenv.isDarwin && stdenv.isx86_64;
  };
 }
--- a/pkgs/development/web/deno/tests/basic.ts
+++ b/pkgs/development/web/deno/tests/basic.ts
--- a/pkgs/development/web/deno/tests/default.nix
+++ b/pkgs/development/web/deno/tests/default.nix
--- a/pkgs/development/web/deno/tests/import-json/data.json
+++ b/pkgs/development/web/deno/tests/import-json/data.json
--- a/pkgs/development/web/deno/tests/import-json/index.ts
+++ b/pkgs/development/web/deno/tests/import-json/index.ts
--- a/pkgs/development/web/deno/tests/import-ts/index.ts
+++ b/pkgs/development/web/deno/tests/import-ts/index.ts
--- a/pkgs/development/web/deno/tests/import-ts/lib.ts
+++ b/pkgs/development/web/deno/tests/import-ts/lib.ts
--- a/pkgs/development/web/deno/tests/read-file/data.txt
+++ b/pkgs/development/web/deno/tests/read-file/data.txt
--- a/pkgs/development/web/deno/tests/read-file/index.ts
+++ b/pkgs/development/web/deno/tests/read-file/index.ts
--- a/pkgs/development/web/deno/update/common.ts
+++ b/pkgs/development/web/deno/update/common.ts
--- a/pkgs/development/web/deno/update/librusty_v8.ts
+++ b/pkgs/development/web/deno/update/librusty_v8.ts
--- a/pkgs/development/web/deno/update/src.ts
+++ b/pkgs/development/web/deno/update/src.ts
--- a/pkgs/development/web/deno/update/update.ts
+++ b/pkgs/development/web/deno/update/update.ts
@ -12,8 +12,8 @@ const nixpkgs = Deno.cwd();
 // TODO: Read values from default.nix
 const owner = "denoland";
 const repo = "deno";
-const denoDir = `${nixpkgs}/pkgs/development/web/${repo}`;
-const src = `${denoDir}/default.nix`;
+const denoDir = `${nixpkgs}/pkgs/by-name/de/${repo}`;
+const src = `${denoDir}/package.nix`;
 const librusty_v8 = `${denoDir}/librusty_v8.nix`;
 const architectures: Architecture[] = [
  { nix: "x86_64-linux", rust: "x86_64-unknown-linux-gnu" },
--- a/pkgs/by-name/de/devenv/package.nix
+++ b/pkgs/by-name/de/devenv/package.nix
@ -27,7 +27,7 @@ let
    doInstallCheck = false;
  });

-  version = "1.1";
+  version = "1.2";
 in rustPlatform.buildRustPackage {
  pname = "devenv";
  inherit version;
@ -36,10 +36,10 @@ in rustPlatform.buildRustPackage {
    owner = "cachix";
    repo = "devenv";
    rev = "v${version}";
-    hash = "sha256-7o2OBUwE51ZNMCBB4rg5LARc8S6C9vuzRXnqk3d/lN4=";
+    hash = "sha256-95MYldiApQ7gqoUa79yolPahudKmFv6B2HnF+ZqWiGI=";
  };

-  cargoHash = "sha256-Yos8iOWfRJcOqbanskUg75cX05dvxWnq42NhmQt/jf4=";
+  cargoHash = "sha256-A2s+DXq00T0DCVXUHy2ZN6XvqpHy6PmL0H9l1NIfFVU=";

  buildAndTestSubdir = "devenv";

--- a/pkgs/development/tools/ejs/default.nix
+++ b/pkgs/development/tools/ejs/default.nix
@ -1,17 +1,20 @@
-{ lib
-, buildNpmPackage
-, fetchFromGitHub
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
 }:
-
-buildNpmPackage rec {
+let
+  version = "3.1.10";
+in
+buildNpmPackage {
  pname = "ejs";
-  version = "3.1.9";
+  inherit version;

  src = fetchFromGitHub {
    owner = "mde";
    repo = "ejs";
    rev = "v${version}";
-    hash = "sha256-bOZclhsnV3onxc32ZGfLpuGS5Jz6S12/BmkmwL4M6Dg=";
+    hash = "sha256-3Rq+7oiYJlIY7sGPasx728sz2zj0ndAvKpHGsQX4tlc=";
  };

  npmDepsHash = "sha256-829eWfJiMw9KRlhdmzD0ha//bgUQ5nPEzO+ayUPLxXY=";
@ -29,6 +32,6 @@ buildNpmPackage rec {
    homepage = "http://ejs.co";
    license = lib.licenses.asl20;
    mainProgram = "ejs";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ momeemt ];
  };
 }
--- a/pkgs/by-name/fa/fastcompmgr/package.nix
+++ b/pkgs/by-name/fa/fastcompmgr/package.nix
@ -0,0 +1,45 @@
+{
+  stdenv,
+  fetchFromGitHub,
+  xorg,
+  pkgs,
+  lib,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "fastcompmgr";
+  version = "0.3";
+
+  src = fetchFromGitHub {
+    owner = "tycho-kirchner";
+    repo = "fastcompmgr";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-UKX0gjhbbXSXfyw/NGA31vTOfgd4kdnxO7lIs+mkgFs=";
+  };
+
+  nativeBuildInputs = [ pkgs.pkg-config ];
+
+  buildInputs = [
+    xorg.libX11
+    xorg.libXcomposite
+    xorg.libXdamage
+    xorg.libXfixes
+    xorg.libXrender
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp fastcompmgr $out/bin
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Fast compositor for X11";
+    homepage = "https://github.com/tycho-kirchner/fastcompmgr";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ camerondugan ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/fo/follow/package.nix
+++ b/pkgs/by-name/fo/follow/package.nix
@ -0,0 +1,107 @@
+{
+  electron,
+  fetchFromGitHub,
+  imagemagick,
+  lib,
+  makeDesktopItem,
+  makeWrapper,
+  nodejs,
+  pnpm,
+  stdenv,
+}:
+stdenv.mkDerivation rec {
+  pname = "follow";
+
+  version = "0.0.1-alpha.17";
+
+  src = fetchFromGitHub {
+    owner = "RSSNext";
+    repo = "Follow";
+    rev = "v${version}";
+    hash = "sha256-amW+jpJ2E7muKwiWbblONRFzH849js2SaT+poUWQWZI=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    pnpm.configHook
+    makeWrapper
+    imagemagick
+  ];
+
+  pnpmDeps = pnpm.fetchDeps {
+    inherit pname version src;
+    hash = "sha256-JFAONU1C8pB2Hu4PJqqdqcXk9Ec+iPiAL8J+dk4oPj0=";
+  };
+
+  env = {
+    ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+
+    # This environment variables inject the production Vite config at build time.
+    # Copy from:
+    # 1. https://github.com/RSSNext/Follow/blob/0745ac07dd2a4a34e4251c034678ace15c302697/.github/workflows/build.yml#L18
+    # 2. And logs in the corresponding GitHub Actions: https://github.com/RSSNext/Follow/actions/workflows/build.yml
+    VITE_WEB_URL = "https://app.follow.is";
+    VITE_API_URL = "https://api.follow.is";
+    VITE_IMGPROXY_URL = "https://thumbor.follow.is";
+    VITE_SENTRY_DSN = "https://e5bccf7428aa4e881ed5cb713fdff181@o4507542488023040.ingest.us.sentry.io/4507570439979008";
+    VITE_BUILD_TYPE = "production";
+    VITE_POSTHOG_KEY = "phc_EZGEvBt830JgBHTiwpHqJAEbWnbv63m5UpreojwEWNL";
+  };
+
+  desktopItem = makeDesktopItem {
+    name = "follow";
+    desktopName = "Follow";
+    comment = "Next generation information browser";
+    icon = "follow";
+    exec = "follow";
+    categories = [ "Utility" ];
+    mimeTypes = [ "x-scheme-handler/follow" ];
+  };
+
+  icon = src + "/resources/icon.png";
+
+  buildPhase = ''
+    runHook preBuild
+
+    pnpm --offline electron-vite build
+    # Remove dev dependencies.
+    pnpm --ignore-scripts prune --prod
+    # Clean up broken symlinks left behind by `pnpm prune`
+    find node_modules/.bin -xtype l -delete
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/{applications,follow}
+    cp -r . $out/share/follow
+    rm -rf $out/share/follow/{.vscode,.github}
+
+    makeWrapper "${electron}/bin/electron" "$out/bin/follow" \
+      --inherit-argv0 \
+      --add-flags --disable-gpu-compositing \
+      --add-flags $out/share/follow \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
+
+    install -m 444 -D "${desktopItem}/share/applications/"* \
+        -t $out/share/applications/
+
+    for size in 16 24 32 48 64 128 256 512; do
+      mkdir -p $out/share/icons/hicolor/"$size"x"$size"/apps
+      convert -background none -resize "$size"x"$size" ${icon} $out/share/icons/hicolor/"$size"x"$size"/apps/follow.png
+    done
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Next generation information browser";
+    homepage = "https://github.com/RSSNext/Follow";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ iosmanthus ];
+    platforms = [ "x86_64-linux" ];
+    mainProgram = "follow";
+  };
+}
--- a/pkgs/by-name/fo/forbidden/package.nix
+++ b/pkgs/by-name/fo/forbidden/package.nix
@ -5,14 +5,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "forbidden";
-  version = "11.2";
+  version = "12.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "ivan-sincek";
    repo = "forbidden";
    rev = "refs/tags/v${version}";
-    hash = "sha256-XRN5zQgyBbMxDKAutW3XNIAbBVdAeXZtxsNbmjLyKRc=";
+    hash = "sha256-ZxEkkg1gFs/pSAnrW85UqDQKczXqLW1q4kW58TagEA0=";
  };

  build-system = with python3.pkgs; [
@ -20,6 +20,7 @@ python3.pkgs.buildPythonApplication rec {
  ];

  dependencies = with python3.pkgs; [
+    alive-progress
    colorama
    datetime
    pycurl
--- a/pkgs/by-name/fw/fwupd/package.nix
+++ b/pkgs/by-name/fw/fwupd/package.nix
@ -121,7 +121,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "fwupd";
-  version = "1.9.24";
+  version = "1.9.25";

  # libfwupd goes to lib
  # daemon, plug-ins and libfwupdplugin go to out
@ -132,7 +132,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "fwupd";
    repo = "fwupd";
    rev = finalAttrs.version;
-    hash = "sha256-jAR/c8hedprteCj5wrjST4yo8TxJ4JmLbPXSwBO3gJs=";
+    hash = "sha256-Yfj2Usto4BSnnBSvffdF02UeK4Ys8ZKzEsxrd2/XZe8=";
  };

  patches = [
--- a/pkgs/by-name/gi/git-upstream/package.nix
+++ b/pkgs/by-name/gi/git-upstream/package.nix
@ -5,7 +5,7 @@
  nix-update-script,
 }: let
  pname = "git-upstream";
-  version = "1.1.0";
+  version = "1.2.0";
 in
  rustPlatform.buildRustPackage {
    inherit pname version;
@ -14,17 +14,17 @@ in
      owner = "9999years";
      repo = pname;
      rev = "refs/tags/v${version}";
-      hash = "sha256-Pq0Z1WwrTP7dCwk6V/E0zu9sLLWr3kNuT3aJRZuRzhI=";
+      hash = "sha256-GnsqZSztDLXMO4T16nfcOKMKXap88CJzJ5nObzGwhMA=";
    };

-    cargoHash = "sha256-jNpleFrOvt1m2TXTeBXfhTSjWNpCknNoKooF2xsO46w=";
+    cargoHash = "sha256-a12C/fpeo0ZJ0MFQlKHVZER9dVrXF95YI1i8MwCTCJo=";

-    meta = with lib; {
+    meta = {
      homepage = "https://github.com/9999years/git-upstream";
      changelog = "https://github.com/9999years/git-upstream/releases/tag/v${version}";
      description = "Shortcut for `git push --set-upstream`";
-      license = [licenses.mit];
-      maintainers = [maintainers._9999years];
+      license = [lib.licenses.mit];
+      maintainers = [lib.maintainers._9999years];
      mainProgram = "git-upstream";
    };

--- a/pkgs/development/tools/continuous-integration/gitea-actions-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/gitea-actions-runner/default.nix
@ -1,23 +1,24 @@
-{ lib
-, fetchFromGitea
-, buildGoModule
-, testers
-, gitea-actions-runner
+{
+  lib,
+  fetchFromGitea,
+  buildGo123Module,
+  testers,
+  gitea-actions-runner,
 }:

-buildGoModule rec {
+buildGo123Module rec {
  pname = "gitea-actions-runner";
-  version = "0.2.10";
+  version = "0.2.11";

  src = fetchFromGitea {
    domain = "gitea.com";
    owner = "gitea";
    repo = "act_runner";
    rev = "v${version}";
-    hash = "sha256-YRWFBMHw9Fcmzkmglh2I1kXJkAAivqvCBcenLTjE/bI=";
+    hash = "sha256-PmDa8XIe1uZ4SSrs9zh5HBmFaOuj+uuLm7jJ4O5V1dI=";
  };

-  vendorHash = "sha256-8sdSQhg9DnRLgghDZzWrUMM4vjinhCgu3dTKU7MBVQU=";
+  vendorHash = "sha256-lYJFySGqkhT89vHDp1FcTiiC7DG4ziQ1DaBHLh/kXQc=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/gr/granian/Cargo.lock
+++ b/pkgs/by-name/gr/granian/Cargo.lock
@ -17,6 +17,17 @@ version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"

+[[package]]
+name = "aes"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures",
+]
+
 [[package]]
 name = "anyhow"
 version = "1.0.86"
@ -62,6 +73,12 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"

+[[package]]
+name = "base64ct"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c3c1a368f70d6cf7302d78f8f7093da241fb8e8807c05cc9e51a125895a6d5b"
+
 [[package]]
 name = "bitflags"
 version = "2.6.0"
@ -77,6 +94,15 @@ dependencies = [
 "generic-array",
 ]

+[[package]]
+name = "block-padding"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8894febbff9f758034a5b8e12d87918f56dfc64a8e1fe757d65e29041538d93"
+dependencies = [
+ "generic-array",
+]
+
 [[package]]
 name = "byteorder"
 version = "1.5.0"
@ -85,15 +111,27 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"

 [[package]]
 name = "bytes"
-version = "1.6.1"
+version = "1.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a12916984aab3fa6e39d655a33e09c0071eb36d6ab3aea5c2d78551f1df6d952"
+checksum = "8318a53db07bb3f8dca91a600466bdb3f2eaadeedfdbcf02e1accbad9271ba50"
+
+[[package]]
+name = "cbc"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26b52a9543ae338f279b96b0b9fed9c8093744685043739079ce85cd58f289a6"
+dependencies = [
+ "cipher",
+]

 [[package]]
 name = "cc"
-version = "1.1.7"
+version = "1.1.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26a5c3fd7bfa1ce3897a3a3501d362b2d87b7f2583ebcb4a949ec25911025cbc"
+checksum = "57b6a275aa2903740dc87da01c62040406b8812552e97129a63ea8850a17c6e6"
+dependencies = [
+ "shlex",
+]

 [[package]]
 name = "cfg-if"
@ -102,10 +140,26 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"

 [[package]]
-name = "cpufeatures"
-version = "0.2.12"
+name = "cipher"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53fe5e26ff1b7aef8bca9c6080520cfb8d9333c7568e1829cef191a9723e5504"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common",
+ "inout",
+]
+
+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51e852e6dc9a5bed1fae92dd2375037bf2b768725bf3be87811edee3249d09ad"
 dependencies = [
 "libc",
 ]
@ -141,6 +195,16 @@ version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e8566979429cf69b49a5c740c60791108e86440e8be149bbea4fe54d2c32d6e2"

+[[package]]
+name = "der"
+version = "0.7.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f55bf8e7b65898637379c1b74eb1551107c8294ed26d855ceb9fd1a09cfc9bc0"
+dependencies = [
+ "const-oid",
+ "zeroize",
+]
+
 [[package]]
 name = "digest"
 version = "0.10.7"
@ -149,6 +213,7 @@ checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
 "block-buffer",
 "crypto-common",
+ "subtle",
 ]

 [[package]]
@ -287,7 +352,7 @@ checksum = "40ecd4077b5ae9fd2e9e169b102c6c330d0605168eb0e8bf79952b256dbefffd"

 [[package]]
 name = "granian"
-version = "1.5.2"
+version = "1.6.0"
 dependencies = [
 "anyhow",
 "crossbeam-channel",
@ -298,8 +363,10 @@ dependencies = [
 "itertools",
 "log",
 "mimalloc",
+ "pem",
 "percent-encoding",
 "pin-project",
+ "pkcs8",
 "pyo3",
 "pyo3-log",
 "rustls-pemfile",
@ -314,9 +381,9 @@ dependencies = [

 [[package]]
 name = "h2"
-version = "0.4.5"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa82e28a107a8cc405f0839610bdc9b15f1e25ec7d696aa5cf173edbcb1486ab"
+checksum = "524e8ac6999421f49a846c2d4411f337e53497d8ec55d67753beffa43c5d9205"
 dependencies = [
 "atomic-waker",
 "bytes",
@ -349,6 +416,15 @@ version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"

+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest",
+]
+
 [[package]]
 name = "http"
 version = "1.1.0"
@ -417,9 +493,9 @@ dependencies = [

 [[package]]
 name = "hyper-util"
-version = "0.1.6"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ab92f4f49ee4fb4f997c784b7a2e0fa70050211e0b6a287f898c3c9785ca956"
+checksum = "cde7055719c54e36e95e8719f95883f22072a48ede39db7fc17a4e1d5281e9b9"
 dependencies = [
 "bytes",
 "futures-util",
@ -432,9 +508,9 @@ dependencies = [

 [[package]]
 name = "indexmap"
-version = "2.2.6"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "168fb715dda47215e360912c096649d23d58bf392ac62f73919e831745e40f26"
+checksum = "68b900aa2f7301e21c36462b170ee99994de34dff39a4a6a528e80e7376d07e5"
 dependencies = [
 "equivalent",
 "hashbrown",
@ -446,6 +522,16 @@ version = "2.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b248f5224d1d606005e02c97f5aa4e88eeb230488bcc03bc9ca4d7991399f2b5"

+[[package]]
+name = "inout"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0c10553d664a4d0bcff9f4215d0aac67a639cc68ef660840afe309b807bc9f5"
+dependencies = [
+ "block-padding",
+ "generic-array",
+]
+
 [[package]]
 name = "itertools"
 version = "0.13.0"
@ -463,9 +549,9 @@ checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"

 [[package]]
 name = "libc"
-version = "0.2.155"
+version = "0.2.158"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97b3888a4aecf77e811145cadf6eef5901f4782c53886191b2f693f24761847c"
+checksum = "d8adc4bb1803a324070e64a98ae98f38934d91957a99cfb3a43dcbc01bc56439"

 [[package]]
 name = "libmimalloc-sys"
@ -528,9 +614,9 @@ dependencies = [

 [[package]]
 name = "mio"
-version = "1.0.1"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4569e456d394deccd22ce1c1913e6ea0e54519f577285001215d33557431afe4"
+checksum = "80e04d1dcff3aae0704555fe5fee3bcfaf3d1fdf8a7e521d5b9d2b42acb52cec"
 dependencies = [
 "hermit-abi",
 "libc",
@ -540,9 +626,9 @@ dependencies = [

 [[package]]
 name = "object"
-version = "0.36.2"
+version = "0.36.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f203fa8daa7bb185f760ae12bd8e097f63d17041dcdcaf675ac54cdf863170e"
+checksum = "084f1a5821ac4c651660a94a7153d27ac9d8a53736203f58b31945ded098070a"
 dependencies = [
 "memchr",
 ]
@ -576,6 +662,26 @@ dependencies = [
 "windows-targets",
 ]

+[[package]]
+name = "pbkdf2"
+version = "0.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2"
+dependencies = [
+ "digest",
+ "hmac",
+]
+
+[[package]]
+name = "pem"
+version = "3.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e459365e590736a54c3fa561947c84837534b8e9af6fc5bf781307e82658fae"
+dependencies = [
+ "base64",
+ "serde",
+]
+
 [[package]]
 name = "percent-encoding"
 version = "2.3.1"
@ -614,6 +720,33 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"

+[[package]]
+name = "pkcs5"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e847e2c91a18bfa887dd028ec33f2fe6f25db77db3619024764914affe8b69a6"
+dependencies = [
+ "aes",
+ "cbc",
+ "der",
+ "pbkdf2",
+ "scrypt",
+ "sha2",
+ "spki",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der",
+ "pkcs5",
+ "rand_core",
+ "spki",
+]
+
 [[package]]
 name = "portable-atomic"
 version = "1.7.0"
@ -622,12 +755,11 @@ checksum = "da544ee218f0d287a911e9c99a39a8c9bc8fcad3cb8db5959940044ecfc67265"

 [[package]]
 name = "ppv-lite86"
-version = "0.2.19"
+version = "0.2.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2288c0e17cc8d342c712bb43a257a80ebffce59cdb33d5000d8348f3ec02528b"
+checksum = "77957b295656769bb8ad2b6a6b09d897d94f05c41b069aede1fcdaa675eaea04"
 dependencies = [
 "zerocopy",
- "zerocopy-derive",
 ]

 [[package]]
@ -725,9 +857,9 @@ dependencies = [

 [[package]]
 name = "quote"
-version = "1.0.36"
+version = "1.0.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
+checksum = "b5b9d34b8991d19d98081b46eacdd8eb58c6f2b201139f7c5f643cc155a633af"
 dependencies = [
 "proc-macro2",
 ]
@ -808,9 +940,9 @@ dependencies = [

 [[package]]
 name = "rustls-pemfile"
-version = "2.1.2"
+version = "2.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29993a25686778eb88d4189742cd713c9bce943bc54251a33509dc63cbacf73d"
+checksum = "196fe16b00e106300d3e45ecfcb764fa292a535d7326a29a5875c579c7417425"
 dependencies = [
 "base64",
 "rustls-pki-types",
@ -833,12 +965,52 @@ dependencies = [
 "untrusted",
 ]

+[[package]]
+name = "salsa20"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97a22f5af31f73a954c10289c93e8a50cc23d971e80ee446f1f6f7137a088213"
+dependencies = [
+ "cipher",
+]
+
 [[package]]
 name = "scopeguard"
 version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"

+[[package]]
+name = "scrypt"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0516a385866c09368f0b5bcd1caff3366aace790fcd46e2bb032697bb172fd1f"
+dependencies = [
+ "pbkdf2",
+ "salsa20",
+ "sha2",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.209"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "99fce0ffe7310761ca6bf9faf5115afbc19688edd00171d81b1bb1b116c63e09"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.209"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5831b979fd7b5439637af1752d535ff49f4860c0f341d1baeb6faf0f4242170"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "sha1"
 version = "0.10.6"
@ -850,6 +1022,23 @@ dependencies = [
 "digest",
 ]

+[[package]]
+name = "sha2"
+version = "0.10.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "793db75ad2bcafc3ffa7c68b215fee268f537982cd901d132f89c6343f3a3dc8"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
 [[package]]
 name = "signal-hook-registry"
 version = "1.4.2"
@ -890,6 +1079,16 @@ version = "0.9.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"

+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
 [[package]]
 name = "subtle"
 version = "2.6.1"
@ -898,9 +1097,9 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"

 [[package]]
 name = "syn"
-version = "2.0.72"
+version = "2.0.77"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc4b9b9bf2add8093d3f2c0204471e951b2285580335de42f9d2534f3ae7a8af"
+checksum = "9f35bcdf61fd8e7be6caf75f429fdca8beb3ed76584befb503b1569faee373ed"
 dependencies = [
 "proc-macro2",
 "quote",
@ -909,9 +1108,9 @@ dependencies = [

 [[package]]
 name = "target-lexicon"
-version = "0.12.15"
+version = "0.12.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4873307b7c257eddcb50c9bedf158eb669578359fb28428bef438fec8e6ba7c2"
+checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1"

 [[package]]
 name = "thiserror"
@ -935,9 +1134,9 @@ dependencies = [

 [[package]]
 name = "tikv-jemalloc-sys"
-version = "0.5.4+5.3.0-patched"
+version = "0.6.0+5.3.0-1-ge13ca993e8ccb9ba9847cc330696e02839f328f7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9402443cb8fd499b6f327e40565234ff34dbda27460c5b47db0db77443dd85d1"
+checksum = "cd3c60906412afa9c2b5b5a48ca6a5abe5736aec9eb48ad05037a677e52e4e2d"
 dependencies = [
 "cc",
 "libc",
@ -945,9 +1144,9 @@ dependencies = [

 [[package]]
 name = "tikv-jemallocator"
-version = "0.5.4"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "965fe0c26be5c56c94e38ba547249074803efd52adfb66de62107d95aab3eaca"
+checksum = "4cec5ff18518d81584f477e9bfdf957f5bb0979b0bac3af4ca30b5b3ae2d2865"
 dependencies = [
 "libc",
 "tikv-jemalloc-sys",
@ -968,9 +1167,9 @@ dependencies = [

 [[package]]
 name = "tokio"
-version = "1.39.2"
+version = "1.40.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "daa4fb1bc778bd6f04cbfc4bb2d06a7396a8f299dc33ea1900cedaa316f467b1"
+checksum = "e2b070231665d27ad9ec9b8df639893f46727666c6767db40317fbe920a5d998"
 dependencies = [
 "backtrace",
 "bytes",
--- a/pkgs/by-name/gr/granian/package.nix
+++ b/pkgs/by-name/gr/granian/package.nix
@ -8,14 +8,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "granian";
-  version = "1.5.2";
+  version = "1.6.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "emmett-framework";
    repo = "granian";
    rev = "v${version}";
-    hash = "sha256-3kwdPLOkKKSY1w42av3ejarrRKNtai8KB80ZrujSjPo=";
+    hash = "sha256-ZIwZrLl7goweYUj3t5e0yaOqeppFHXvK9PL3chNZZRw=";
  };

  cargoDeps = rustPlatform.importCargoLock {
--- a/pkgs/by-name/gr/grype/package.nix
+++ b/pkgs/by-name/gr/grype/package.nix
@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "grype";
-  version = "0.80.0";
+  version = "0.80.2";

  src = fetchFromGitHub {
    owner = "anchore";
    repo = "grype";
    rev = "refs/tags/v${version}";
-    hash = "sha256-28/BR4oKOW7CK4gv4ESVZsvsyd6gKwW2XPvA1vU8/Wc=";
+    hash = "sha256-Q3KixUjyiPMLxoBIafyAUOeYRK6fhqgc150bLdwEk7M=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@ -30,7 +30,7 @@ buildGoModule rec {

  proxyVendor = true;

-  vendorHash = "sha256-F8r332smhjVRxAQ42CvJDmBl2rjxgwUZpoMDhFsBYSA=";
+  vendorHash = "sha256-PXx5SyuKvxOZwJBspIiL8L7QzXzort6ZU3ZfrE8o700=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/gu/gungnir/package.nix
+++ b/pkgs/by-name/gu/gungnir/package.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "gungnir";
-  version = "1.0.9";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "g0ldencybersec";
    repo = "gungnir";
    rev = "v${version}";
-    hash = "sha256-A4MPRsUSeYwKlhCHByty6T33wEp/BopZMDWOnOqlQqQ=";
+    hash = "sha256-iMawBuSPPeJztQ3Pdd2dUKSNaWCbbKcUW/IGBFifyng=";
  };

-  vendorHash = "sha256-r2aU59L0fnSdc/lpR04K/GQ1eZ7ihV+tKlyuS6sPX2o=";
+  vendorHash = "sha256-2RCIZS8oawaXtAYZDiLgNsco9llWCxNwQcA67F51rag=";

  ldflags = [ "-s" "-w" ];

--- a/pkgs/by-name/it/itch/package.nix
+++ b/pkgs/by-name/it/itch/package.nix
@ -91,6 +91,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    makeWrapper ${steam-run}/bin/steam-run $out/bin/itch \
      --add-flags ${electron}/bin/electron \
      --add-flags $out/share/itch/resources/app \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
      --set BROTH_USE_LOCAL butler,itch-setup \
      --prefix PATH : ${butler}:${itch-setup}
  '';
--- a/pkgs/by-name/ka/kas/package.nix
+++ b/pkgs/by-name/ka/kas/package.nix
@ -2,13 +2,13 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "kas";
-  version = "4.4";
+  version = "4.5";

  src = fetchFromGitHub {
    owner = "siemens";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-ws2V16HSGn2zyMmcG601ScHfONSE/DBVO3Gaj8dktf4=";
+    hash = "sha256-J64yy2G8+5uT31Vpwhge5R7ZqId+NzE5ykXBHjc0qgQ=";
  };

  propagatedBuildInputs = with python3.pkgs; [ setuptools kconfiglib jsonschema distro pyyaml gitpython ];
--- a/pkgs/by-name/kb/kbld/package.nix
+++ b/pkgs/by-name/kb/kbld/package.nix
@ -0,0 +1,35 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "kbld";
+  version = "0.44.1";
+
+  src = fetchFromGitHub {
+    owner = "carvel-dev";
+    repo = "kbld";
+    rev = "v${version}";
+    hash = "sha256-sEzCA32r3nSY1hT1r4EPPWsF9Kgn0rXnaAKlatFjZIo=";
+  };
+
+  vendorHash = null;
+
+  subPackages = [ "cmd/kbld" ];
+
+  CGO_ENABLED = 0;
+
+  ldflags = [
+    "-X=carvel.dev/kbld/pkg/kbld/version.Version=${version}"
+  ];
+
+  meta = {
+    description = "Seamlessly incorporates image building and image pushing into your development and deployment workflows";
+    homepage = "https://carvel.dev/kbld/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ benchand ];
+    mainProgram = "kbld";
+  };
+}
--- a/pkgs/by-name/kc/kchat/package.nix
+++ b/pkgs/by-name/kc/kchat/package.nix
@ -5,12 +5,12 @@

 appimageTools.wrapType2 rec {
  pname = "kchat";
-  version = "3.3.1";
+  version = "3.3.3";

  src = fetchurl {
    url = "https://download.storage5.infomaniak.com/kchat/kchat-desktop-${version}-linux-x86_64.AppImage";
    name = "kchat-${version}.AppImage";
-    hash = "sha256-f9wWgZSPSMP7bLZGfR5F6l/eAVHVhRmF1c7S6/qLgIA=";
+    hash = "sha256-5Nk2IMGk7BDDL7fuoOBO3wEcbtJDDDnQvUiqa8Pt8yU=";
  };

  extraInstallCommands =
--- a/pkgs/by-name/lu/lubelogger/package.nix
+++ b/pkgs/by-name/lu/lubelogger/package.nix
@ -6,13 +6,13 @@

 buildDotnetModule rec {
  pname = "lubelogger";
-  version = "1.3.6";
+  version = "1.3.7";

  src = fetchFromGitHub {
    owner = "hargata";
    repo = "lubelog";
    rev = "v${version}";
-    hash = "sha256-gfnfxm/xxFx77UnEinr+D8GoIN/KMz3BEbjpCYqQ6as=";
+    hash = "sha256-Rs+aB6H5FzeADpJjK68srjI2JE2QDV0sCIKQwbnFTMg=";
  };

  projectFile = "CarCareTracker.sln";
--- a/pkgs/by-name/mo/mov-cli/mov-cli-test.nix
+++ b/pkgs/by-name/mo/mov-cli/mov-cli-test.nix
@ -34,6 +34,6 @@ buildPythonPackage rec {
    description = "A mov-cli plugin that let's you test mov-cli's capabilities by watching free films and animations in the creative commons";
    homepage = "https://github.com/mov-cli/mov-cli-test";
    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ roshaen ];
+    maintainers = with lib.maintainers; [ youhaveme9 ];
  };
 }
--- a/pkgs/by-name/na/navidrome/package.nix
+++ b/pkgs/by-name/na/navidrome/package.nix
@ -1,4 +1,4 @@
-{ buildGoModule
+{ buildGo123Module
 , buildPackages
 , fetchFromGitHub
 , fetchNpmDeps
@ -15,25 +15,25 @@
 , ffmpegSupport ? true
 }:

-buildGoModule rec {
+buildGo123Module rec {
  pname = "navidrome";
-  version = "0.52.5";
+  version = "0.53.2";

  src = fetchFromGitHub {
    owner = "navidrome";
    repo = "navidrome";
    rev = "v${version}";
-    hash = "sha256-M1BxR4Mmkfbr9Wb2YwWEeVGgKOCtD/8pgFZiv8mTi7s=";
+    hash = "sha256-ghjQZc+KWtgDcW9nU7L2FV8mOL6nn7V5Dn0JiG5gii8=";
  };

-  vendorHash = "sha256-puldHJs5GiaXvyvwuzAX00nMLUxoBESpxLOEtBYD7o4=";
+  vendorHash = "sha256-+acLAn9cicXYRVn3tL+GzFeCxHtXHDMgKisu4BzvGQs=";

  npmRoot = "ui";

  npmDeps = fetchNpmDeps {
    inherit src;
    sourceRoot = "${src.name}/ui";
-    hash = "sha256-OZvEPC+MobCJn16d3MsMtrStbsmRD9Ef0/leVSXtVZ8=";
+    hash = "sha256-SebqSsng/t6g2874Hejc9wubiyYLE0jb3oLFnGwTRMA=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/op/open-webui/package.nix
+++ b/pkgs/by-name/op/open-webui/package.nix
@ -7,19 +7,19 @@
 }:
 let
  pname = "open-webui";
-  version = "0.3.28";
+  version = "0.3.29";

  src = fetchFromGitHub {
    owner = "open-webui";
    repo = "open-webui";
    rev = "refs/tags/v${version}";
-    hash = "sha256-DjwHylu6ke74dxPuMDbLMrfWL9yvmh4W8QGyLzzUZVg=";
+    hash = "sha256-W1AjHzoQNCoK/Kbu+XX+tZG+aZqngDUkNKBM73kLBB0=";
  };

  frontend = buildNpmPackage {
    inherit pname version src;

-    npmDepsHash = "sha256-AWKIqijjTKJJFOzFIcSas+cAq0mZSsYGsVNpk2yQ4ZE=";
+    npmDepsHash = "sha256-9oe+6kEAGE/pHjBkHf3v/W53XPJAQ7Yfn0VecH3ZiQM=";

    # Disabling `pyodide:fetch` as it downloads packages during `buildPhase`
    # Until this is solved, running python packages from the browser will not work.
--- a/pkgs/by-name/po/portfolio/package.nix
+++ b/pkgs/by-name/po/portfolio/package.nix
@ -33,13 +33,13 @@ let
    webkitgtk
  ];
 in
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "PortfolioPerformance";
-  version = "0.70.4";
+  version = "0.71.1";

  src = fetchurl {
-    url = "https://github.com/buchen/portfolio/releases/download/${version}/PortfolioPerformance-${version}-linux.gtk.x86_64.tar.gz";
-    hash = "sha256-4L2hoWUFAmxyUCbQFWoIQlIhbdyncN0fGFmahPMk0FU=";
+    url = "https://github.com/buchen/portfolio/releases/download/${finalAttrs.version}/PortfolioPerformance-${finalAttrs.version}-linux.gtk.x86_64.tar.gz";
+    hash = "sha256-bZZTsL2jf4m6Gvc9cXDbAsiPoluljnb1AKshMM4325Q=";
  };

  nativeBuildInputs = [
@ -68,12 +68,12 @@ stdenvNoCC.mkDerivation rec {

  passthru.updateScript = gitUpdater { url = "https://github.com/buchen/portfolio.git"; };

-  meta = with lib; {
+  meta = {
    description = "Simple tool to calculate the overall performance of an investment portfolio";
    homepage = "https://www.portfolio-performance.info/";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.epl10;
-    maintainers = with maintainers; [
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.epl10;
+    maintainers = with lib.maintainers; [
      kilianar
      oyren
      shawn8901
@ -81,4 +81,4 @@ stdenvNoCC.mkDerivation rec {
    mainProgram = "portfolio";
    platforms = [ "x86_64-linux" ];
  };
-}
+})
--- a/pkgs/by-name/pr/pragtical/package.nix
+++ b/pkgs/by-name/pr/pragtical/package.nix
@ -20,7 +20,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "pragtical";
-  version = "3.4.4";
+  version = "3.5.0";
  pluginManagerVersion = "1.2.9";

  src = fetchFromGitHub {
@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
      find subprojects -type d -name .git -prune -execdir rm -r {} +
    '';

-    hash = "sha256-YAIndKTqne4I+wuCrVtfkjdp1rsFF+xyBnl5WcuDyz4=";
+    hash = "sha256-a9LnLKtJ33YHtlnhWmKBeW5dOjjwa7PmaZjYh0+Nx9g=";
  };

  nativeBuildInputs = [
--- a/Show More
+++ b/Show More