Merge master into haskell-updates

2023-10-13 00:12:19 +00:00 · 2023-10-13 00:12:19 +00:00 · 55a0671553
commit 55a0671553
parent fcbc81b282 8f12da6c8d
298 changed files with 7283 additions and 6411 deletions
--- a/lib/fixed-points.nix
+++ b/lib/fixed-points.nix
@ -1,26 +1,76 @@
 { lib, ... }:
 rec {
  /*
-    Compute the fixed point of the given function `f`, which is usually an
-    attribute set that expects its final, non-recursive representation as an
-    argument:
+    `fix f` computes the fixed point of the given function `f`. In other words, the return value is `x` in `x = f x`.

-    ```
-    f = self: { foo = "foo"; bar = "bar"; foobar = self.foo + self.bar; }
+    `f` must be a lazy function.
+    This means that `x` must be a value that can be partially evaluated,
+    such as an attribute set, a list, or a function.
+    This way, `f` can use one part of `x` to compute another part.
+
+    **Relation to syntactic recursion**
+
+    This section explains `fix` by refactoring from syntactic recursion to a call of `fix` instead.
+
+    For context, Nix lets you define attributes in terms of other attributes syntactically using the [`rec { }` syntax](https://nixos.org/manual/nix/stable/language/constructs.html#recursive-sets).
+
+    ```nix
+    nix-repl> rec {
+      foo = "foo";
+      bar = "bar";
+      foobar = foo + bar;
+    }
+    { bar = "bar"; foo = "foo"; foobar = "foobar"; }
    ```

-    Nix evaluates this recursion until all references to `self` have been
-    resolved. At that point, the final result is returned and `f x = x` holds:
+    This is convenient when constructing a value to pass to a function for example,
+    but an equivalent effect can be achieved with the `let` binding syntax:

+    ```nix
+    nix-repl> let self = {
+      foo = "foo";
+      bar = "bar";
+      foobar = self.foo + self.bar;
+    }; in self
+    { bar = "bar"; foo = "foo"; foobar = "foobar"; }
    ```
+
+    But in general you can get more reuse out of `let` bindings by refactoring them to a function.
+
+    ```nix
+    nix-repl> f = self: {
+      foo = "foo";
+      bar = "bar";
+      foobar = self.foo + self.bar;
+    }
+    ```
+
+    This is where `fix` comes in, it contains the syntactic that's not in `f` anymore.
+
+    ```nix
+    nix-repl> fix = f:
+      let self = f self; in self;
+    ```
+
+    By applying `fix` we get the final result.
+
+    ```nix
    nix-repl> fix f
    { bar = "bar"; foo = "foo"; foobar = "foobar"; }
    ```

+    Such a refactored `f` using `fix` is not useful by itself.
+    See [`extends`](#function-library-lib.fixedPoints.extends) for an example use case.
+    There `self` is also often called `final`.
+
    Type: fix :: (a -> a) -> a

-    See https://en.wikipedia.org/wiki/Fixed-point_combinator for further
-    details.
+    Example:
+      fix (self: { foo = "foo"; bar = "bar"; foobar = self.foo + self.bar; })
+      => { bar = "bar"; foo = "foo"; foobar = "foobar"; }
+
+      fix (self: [ 1 2 (elemAt self 0 + elemAt self 1) ])
+      => [ 1 2 3 ]
  */
  fix = f: let x = f x; in x;

--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -3701,6 +3701,12 @@
    githubId = 490965;
    name = "Craig Swank";
  };
+  ctron = {
+    email = "ctron@dentrassi.de";
+    github = "ctron";
+    githubId = 202474;
+    name = "Jens Reimann";
+  };
  cust0dian = {
    email = "serg@effectful.software";
    github = "cust0dian";
@ -3968,7 +3974,7 @@
  };
  davidarmstronglewis = {
    email = "davidlewis@mac.com";
-    github = "davidarmstronglewis";
+    github = "oceanlewis";
    githubId = 6754950;
    name = "David Armstrong Lewis";
  };
@ -8174,6 +8180,12 @@
    githubId = 6445082;
    name = "Joseph Lukasik";
  };
+  jgoux = {
+    email = "hi@jgoux.dev";
+    github = "jgoux";
+    githubId = 1443499;
+    name = "Julien Goux";
+  };
  jhh = {
    email = "jeff@j3ff.io";
    github = "jhh";
@ -11029,12 +11041,6 @@
    githubId = 4708337;
    name = "Marcelo A. de L. Santos";
  };
-  maxhille = {
-    email = "mh@lambdasoup.com";
-    github = "maxhille";
-    githubId = 693447;
-    name = "Max Hille";
-  };
  maximsmol = {
    email = "maximsmol@gmail.com";
    github = "maximsmol";
@ -15128,15 +15134,6 @@
    }];
    name = "Rahul Butani";
  };
-  rs0vere = {
-    email = "rs0vere@proton.me";
-    github = "rs0vere";
-    githubId = 140035635;
-    keys = [{
-      fingerprint = "C6D8 B5C2 FA79 901B DCCF  95E1 FEC4 5C5A ED00 C58D";
-    }];
-    name = "Red Star Over Earth";
-  };
  rski = {
    name = "rski";
    email = "rom.skiad+nix@gmail.com";
@ -15392,7 +15389,7 @@
  };
  SamirTalwar = {
    email = "lazy.git@functional.computer";
-    github = "SamirTalwar";
+    github = "abstracte";
    githubId = 47852;
    name = "Samir Talwar";
  };
@ -17807,12 +17804,6 @@
    githubId = 10110;
    name = "Travis B. Hartwell";
  };
-  travisdavis-ops = {
-    email = "travisdavismedia@gmail.com";
-    github = "TravisDavis-ops";
-    githubId = 52011418;
-    name = "Travis Davis";
-  };
  traxys = {
    email = "quentin+dev@familleboyer.net";
    github = "traxys";
@ -19257,6 +19248,13 @@
    github = "YorikSar";
    githubId = 428074;
  };
+  YoshiRulz = {
+    name = "YoshiRulz";
+    email = "OSSYoshiRulz+Nixpkgs@gmail.com";
+    matrix = "@YoshiRulz:matrix.org";
+    github = "YoshiRulz";
+    githubId = 13409956;
+  };
  yrashk = {
    email = "yrashk@gmail.com";
    github = "yrashk";
--- a/maintainers/scripts/fix-maintainers.pl
+++ b/maintainers/scripts/fix-maintainers.pl
@ -13,12 +13,15 @@ STDOUT->autoflush(1);

 my $ua = LWP::UserAgent->new();

+if (!defined $ENV{GH_TOKEN}) {
+    die "Set GH_TOKEN before running this script";
+}
+
 keys %$maintainers_json; # reset the internal iterator so a prior each() doesn't affect the loop
 while(my($k, $v) = each %$maintainers_json) {
    my $current_user = %$v{'github'};
    if (!defined $current_user) {
        print "$k has no github handle\n";
-        next;
    }
    my $github_id = %$v{'githubId'};
    if (!defined $github_id) {
@ -37,13 +40,16 @@ while(my($k, $v) = each %$maintainers_json) {
        sleep($ratelimit_reset - time() + 5);
    }
    if ($resp->code != 200) {
-        print $current_user . " likely deleted their github account\n";
+        print "$k likely deleted their github account\n";
        next;
    }
    my $resp_json = from_json($resp->content);
    my $api_user = %$resp_json{"login"};
-    if (lc($current_user) ne lc($api_user)) {
-        print $current_user . " is now known on github as " . $api_user . ". Editing maintainer-list.nix…\n";
+    if (!defined $current_user) {
+        print "$k is known on github as $api_user.\n";
+    }
+    elsif (lc($current_user) ne lc($api_user)) {
+        print "$k is now known on github as $api_user. Editing maintainer-list.nix…\n";
        my $file = path($maintainers_list_nix);
        my $data = $file->slurp_utf8;
        $data =~ s/github = "$current_user";$/github = "$api_user";/m;
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@ -682,6 +682,18 @@ with lib.maintainers; {
    shortName = "Numtide team";
  };

+  ocaml = {
+    members = [
+      alizter
+    ];
+    githubTeams = [
+      "ocaml"
+    ];
+    scope = "Maintain the OCaml compiler and package set.";
+    shortName = "OCaml";
+    enableFeatureFreezePing = true;
+  };
+
  openstack = {
    members = [
      SuperSandro2000
--- a/nixos/doc/manual/configuration/x-windows.chapter.md
+++ b/nixos/doc/manual/configuration/x-windows.chapter.md
@ -45,8 +45,8 @@ services.xserver.displayManager.gdm.enable = true;
 You can set the keyboard layout (and optionally the layout variant):

 ```nix
-services.xserver.layout = "de";
-services.xserver.xkbVariant = "neo";
+services.xserver.xkb.layout = "de";
+services.xserver.xkb.variant = "neo";
 ```

 The X server is started automatically at boot time. If you don't want
@ -266,7 +266,7 @@ Once the configuration is applied, and you did a logout/login cycle, the
 layout should be ready to use. You can try it by e.g. running
 `setxkbmap us-greek` and then type `<alt>+a` (it may not get applied in
 your terminal straight away). To change the default, the usual
-`services.xserver.layout` option can still be used.
+`services.xserver.xkb.layout` option can still be used.

 A layout can have several other components besides `xkb_symbols`, for
 example we will define new keycodes for some multimedia key and bind
--- a/nixos/doc/manual/development/option-declarations.section.md
+++ b/nixos/doc/manual/development/option-declarations.section.md
@ -90,7 +90,7 @@ lib.mkOption {
 ```
 :::

-### `mkPackageOption`, `mkPackageOptionMD` {#sec-option-declarations-util-mkPackageOption}
+### `mkPackageOption` {#sec-option-declarations-util-mkPackageOption}

 Usage:

@ -121,15 +121,13 @@ valid attribute path in pkgs (if name is a list).

 If you wish to explicitly provide no default, pass `null` as `default`.

-During the transition to CommonMark documentation `mkPackageOption` creates an option with a DocBook description attribute, once the transition is completed it will create a CommonMark description instead. `mkPackageOptionMD` always creates an option with a CommonMark description attribute and will be removed some time after the transition is completed.
-
 []{#ex-options-declarations-util-mkPackageOption}
 Examples:

 ::: {#ex-options-declarations-util-mkPackageOption-hello .example}
 ### Simple `mkPackageOption` usage
 ```nix
-lib.mkPackageOptionMD pkgs "hello" { }
+lib.mkPackageOption pkgs "hello" { }
 # is like
 lib.mkOption {
  type = lib.types.package;
@ -143,7 +141,7 @@ lib.mkOption {
 ::: {#ex-options-declarations-util-mkPackageOption-ghc .example}
 ### `mkPackageOption` with explicit default and example
 ```nix
-lib.mkPackageOptionMD pkgs "GHC" {
+lib.mkPackageOption pkgs "GHC" {
  default = [ "ghc" ];
  example = "pkgs.haskell.packages.ghc92.ghc.withPackages (hkgs: [ hkgs.primes ])";
 }
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@ -96,6 +96,8 @@

 - [netclient](https://github.com/gravitl/netclient), an automated WireGuard® Management Client. Available as [services.netclient](#opt-services.netclient.enable).

+- [trunk-ng](https://github.com/ctron/trunk), A fork of `trunk`: Build, bundle & ship your Rust WASM application to the web
+
 ## Backward Incompatibilities {#sec-release-23.11-incompatibilities}

 - `network-online.target` has been fixed to no longer time out for systems with `networking.useDHCP = true` and `networking.useNetworkd = true`.
@ -269,6 +271,8 @@
  order, or relying on `mkBefore` and `mkAfter`, but may impact users calling
  `mkOrder n` with n ≤ 400.

+- X keyboard extension (XKB) options have been reorganized into a single attribute set, `services.xserver.xkb`. Specifically, `services.xserver.layout` is now `services.xserver.xkb.layout`, `services.xserver.xkbModel` is now `services.xserver.xkb.model`, `services.xserver.xkbOptions` is now `services.xserver.xkb.options`, `services.xserver.xkbVariant` is now `services.xserver.xkb.variant`, and `services.xserver.xkbDir` is now `services.xserver.xkb.dir`.
+
 - `networking.networkmanager.firewallBackend` was removed as NixOS is now using iptables-nftables-compat even when using iptables, therefore Networkmanager now uses the nftables backend unconditionally.

 - [`lib.lists.foldl'`](https://nixos.org/manual/nixpkgs/stable#function-library-lib.lists.foldl-prime) now always evaluates the initial accumulator argument first.
@ -442,4 +446,3 @@ The module update takes care of the new config syntax and the data itself (user
 - The `electron` packages now places its application files in `$out/libexec/electron` instead of `$out/lib/electron`. Packages using electron-builder will fail to build and need to be adjusted by changing `lib` to `libexec`.

 - `teleport` has been upgraded from major version 12 to major version 14. Please see upstream [upgrade instructions](https://goteleport.com/docs/management/operations/upgrading/) and release notes for versions [13](https://goteleport.com/docs/changelog/#1300-050823) and [14](https://goteleport.com/docs/changelog/#1400-092023). Note that Teleport does not officially support upgrades across more than one major version at a time. If you're running Teleport server components, it is recommended to first upgrade to an intermediate 13.x version by setting `services.teleport.package = pkgs.teleport_13`. Afterwards, this option can be removed to upgrade to the default version (14).
-
--- a/nixos/modules/config/console.nix
+++ b/nixos/modules/config/console.nix
@ -127,8 +127,8 @@ in
              ${optionalString (config.environment.sessionVariables ? XKB_CONFIG_ROOT)
                "-I${config.environment.sessionVariables.XKB_CONFIG_ROOT}"
              } \
-              -model '${xkbModel}' -layout '${layout}' \
-              -option '${xkbOptions}' -variant '${xkbVariant}' > "$out"
+              -model '${xkb.model}' -layout '${xkb.layout}' \
+              -option '${xkb.options}' -variant '${xkb.variant}' > "$out"
          '');
    }

--- a/nixos/modules/config/gnu.nix
+++ b/nixos/modules/config/gnu.nix
@ -1,43 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  options = {
-    gnu = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      description = lib.mdDoc ''
-        When enabled, GNU software is chosen by default whenever a there is
-        a choice between GNU and non-GNU software (e.g., GNU lsh
-        vs. OpenSSH).
-      '';
-    };
-  };
-
-  config = lib.mkIf config.gnu {
-
-    environment.systemPackages = with pkgs;
-      # TODO: Adjust `requiredPackages' from `system-path.nix'.
-      # TODO: Add Inetutils once it has the new `ifconfig'.
-      [ parted
-        #fdisk  # XXX: GNU fdisk currently fails to build and it's redundant
-                # with the `parted' command.
-        nano zile
-        texinfo # for the stand-alone Info reader
-      ]
-      ++ lib.optional (!stdenv.isAarch32) grub2;
-
-
-    # GNU GRUB, where available.
-    boot.loader.grub.enable = !pkgs.stdenv.isAarch32;
-
-    # GNU lsh.
-    services.openssh.enable = false;
-    services.lshd.enable = true;
-    programs.ssh.startAgent = false;
-    services.xserver.startGnuPGAgent = true;
-
-    # TODO: GNU dico.
-    # TODO: GNU Inetutils' inetd.
-    # TODO: GNU Pies.
-  };
-}
--- a/nixos/modules/installer/tools/tools.nix
+++ b/nixos/modules/installer/tools/tools.nix
@ -163,15 +163,15 @@ in
        # console = {
        #   font = "Lat2-Terminus16";
        #   keyMap = "us";
-        #   useXkbConfig = true; # use xkbOptions in tty.
+        #   useXkbConfig = true; # use xkb.options in tty.
        # };

      $xserverConfig

      $desktopConfiguration
        # Configure keymap in X11
-        # services.xserver.layout = "us";
-        # services.xserver.xkbOptions = "eurosign:e,caps:escape";
+        # services.xserver.xkb.layout = "us";
+        # services.xserver.xkb.options = "eurosign:e,caps:escape";

        # Enable CUPS to print documents.
        # services.printing.enable = true;
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -6,7 +6,6 @@
  ./config/fonts/fontdir.nix
  ./config/fonts/ghostscript.nix
  ./config/fonts/packages.nix
-  ./config/gnu.nix
  ./config/gtk/gtk-icon-cache.nix
  ./config/i18n.nix
  ./config/iproute2.nix
--- a/nixos/modules/programs/bandwhich.nix
+++ b/nixos/modules/programs/bandwhich.nix
@ -24,7 +24,7 @@ in {
    security.wrappers.bandwhich = {
      owner = "root";
      group = "root";
-      capabilities = "cap_net_raw,cap_net_admin+ep";
+      capabilities = "cap_sys_ptrace,cap_dac_read_search,cap_net_raw,cap_net_admin+ep";
      source = "${pkgs.bandwhich}/bin/bandwhich";
    };
  };
--- a/nixos/modules/services/mail/mailman.nix
+++ b/nixos/modules/services/mail/mailman.nix
@ -314,7 +314,7 @@ in {
        queue_dir = "$var_dir/queue";
        template_dir = "$var_dir/templates";
        log_dir = "/var/log/mailman";
-        lock_dir = "$var_dir/lock";
+        lock_dir = "/run/mailman/lock";
        etc_dir = "/etc";
        pid_file = "/run/mailman/master.pid";
      };
--- a/nixos/modules/services/network-filesystems/kubo.nix
+++ b/nixos/modules/services/network-filesystems/kubo.nix
@ -203,10 +203,8 @@ in
              default = [
                "/ip4/0.0.0.0/tcp/4001"
                "/ip6/::/tcp/4001"
-                "/ip4/0.0.0.0/udp/4001/quic"
                "/ip4/0.0.0.0/udp/4001/quic-v1"
                "/ip4/0.0.0.0/udp/4001/quic-v1/webtransport"
-                "/ip6/::/udp/4001/quic"
                "/ip6/::/udp/4001/quic-v1"
                "/ip6/::/udp/4001/quic-v1/webtransport"
              ];
--- a/nixos/modules/services/networking/searx.nix
+++ b/nixos/modules/services/networking/searx.nix
@ -43,12 +43,8 @@ in
      [ "services" "searx" "settingsFile" ])
  ];

-  ###### interface
-
  options = {
-
    services.searx = {
-
      enable = mkOption {
        type = types.bool;
        default = false;
@ -149,8 +145,8 @@ in

      package = mkOption {
        type = types.package;
-        default = pkgs.searx;
-        defaultText = literalExpression "pkgs.searx";
+        default = pkgs.searxng;
+        defaultText = literalExpression "pkgs.searxng";
        description = lib.mdDoc "searx package to use.";
      };

@ -190,21 +186,7 @@ in

  };

-
-  ###### implementation
-
  config = mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = (cfg.limiterSettings != { }) -> cfg.package.pname == "searxng";
-        message = "services.searx.limiterSettings requires services.searx.package to be searxng.";
-      }
-      {
-        assertion = cfg.redisCreateLocally -> cfg.package.pname == "searxng";
-        message = "services.searx.redisCreateLocally requires services.searx.package to be searxng.";
-      }
-    ];
-
    environment.systemPackages = [ cfg.package ];

    users.users.searx =
@ -245,10 +227,10 @@ in
      };
    };

-    systemd.services.uwsgi = mkIf (cfg.runInUwsgi)
-      { requires = [ "searx-init.service" ];
-        after = [ "searx-init.service" ];
-      };
+    systemd.services.uwsgi = mkIf cfg.runInUwsgi {
+      requires = [ "searx-init.service" ];
+      after = [ "searx-init.service" ];
+    };

    services.searx.settings = {
      # merge NixOS settings with defaults settings.yml
@ -256,7 +238,7 @@ in
      redis.url = lib.mkIf cfg.redisCreateLocally "unix://${config.services.redis.servers.searx.unixSocket}";
    };

-    services.uwsgi = mkIf (cfg.runInUwsgi) {
+    services.uwsgi = mkIf cfg.runInUwsgi {
      enable = true;
      plugins = [ "python3" ];

@ -270,6 +252,7 @@ in
        enable-threads = true;
        module = "searx.webapp";
        env = [
+          # TODO: drop this as it is only required for searx
          "SEARX_SETTINGS_PATH=${cfg.settingsFile}"
          # searxng compatibility https://github.com/searxng/searxng/issues/1519
          "SEARXNG_SETTINGS_PATH=${cfg.settingsFile}"
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@ -74,6 +74,19 @@ let
      };
    };

+    options.openssh.authorizedPrincipals = mkOption {
+      type = with types; listOf types.singleLineStr;
+      default = [];
+      description = mdDoc ''
+        A list of verbatim principal names that should be added to the user's
+        authorized principals.
+      '';
+      example = [
+        "example@host"
+        "foo@bar"
+      ];
+    };
+
  };

  authKeysFiles = let
@ -89,6 +102,16 @@ let
    ));
  in listToAttrs (map mkAuthKeyFile usersWithKeys);

+  authPrincipalsFiles = let
+    mkAuthPrincipalsFile = u: nameValuePair "ssh/authorized_principals.d/${u.name}" {
+      mode = "0444";
+      text = concatStringsSep "\n" u.openssh.authorizedPrincipals;
+    };
+    usersWithPrincipals = attrValues (flip filterAttrs config.users.users (n: u:
+      length u.openssh.authorizedPrincipals != 0
+    ));
+  in listToAttrs (map mkAuthPrincipalsFile usersWithPrincipals);
+
 in

 {
@ -285,6 +308,14 @@ in
        type = types.submodule ({name, ...}: {
          freeformType = settingsFormat.type;
          options = {
+            AuthorizedPrincipalsFile = mkOption {
+              type = types.str;
+              default = "none"; # upstream default
+              description = lib.mdDoc ''
+                Specifies a file that lists principal names that are accepted for certificate authentication. The default
+                is `"none"`, i.e. not to use	a principals file.
+              '';
+            };
            LogLevel = mkOption {
              type = types.enum [ "QUIET" "FATAL" "ERROR" "INFO" "VERBOSE" "DEBUG" "DEBUG1" "DEBUG2" "DEBUG3" ];
              default = "INFO"; # upstream default
@ -444,7 +475,7 @@ in
    services.openssh.moduliFile = mkDefault "${cfgc.package}/etc/ssh/moduli";
    services.openssh.sftpServerExecutable = mkDefault "${cfgc.package}/libexec/sftp-server";

-    environment.etc = authKeysFiles //
+    environment.etc = authKeysFiles // authPrincipalsFiles //
      { "ssh/moduli".source = cfg.moduliFile;
        "ssh/sshd_config".source = sshconf;
      };
@ -541,6 +572,8 @@ in
    services.openssh.authorizedKeysFiles =
      [ "%h/.ssh/authorized_keys" "/etc/ssh/authorized_keys.d/%u" ];

+    services.openssh.settings.AuthorizedPrincipalsFile = mkIf (authPrincipalsFiles != {}) "/etc/ssh/authorized_principals.d/%u";
+
    services.openssh.extraConfig = mkOrder 0
      ''
        UsePAM yes
--- a/nixos/modules/services/x11/desktop-managers/enlightenment.nix
+++ b/nixos/modules/services/x11/desktop-managers/enlightenment.nix
@ -90,7 +90,7 @@ in
        };
    };

-    environment.etc."X11/xkb".source = xcfg.xkbDir;
+    environment.etc."X11/xkb".source = xcfg.xkb.dir;

    fonts.packages = [ pkgs.dejavu_fonts pkgs.ubuntu_font_family ];

--- a/nixos/modules/services/x11/desktop-managers/plasma5.nix
+++ b/nixos/modules/services/x11/desktop-managers/plasma5.nix
@ -309,7 +309,7 @@ in
        "/share"
      ];

-      environment.etc."X11/xkb".source = xcfg.xkbDir;
+      environment.etc."X11/xkb".source = xcfg.xkb.dir;

      environment.sessionVariables = {
        PLASMA_USE_QT_SCALING = mkIf cfg.useQtScaling "1";
--- a/nixos/modules/services/x11/display-managers/sddm.nix
+++ b/nixos/modules/services/x11/display-managers/sddm.nix
@ -204,10 +204,10 @@ in
                left-handed = xcfg.libinput.mouse.leftHanded;
              };
              keyboard = {
-                keymap_model = xcfg.xkbModel;
-                keymap_layout = xcfg.layout;
-                keymap_variant = xcfg.xkbVariant;
-                keymap_options = xcfg.xkbOptions;
+                keymap_model = xcfg.xkb.model;
+                keymap_layout = xcfg.xkb.layout;
+                keymap_variant = xcfg.xkb.variant;
+                keymap_options = xcfg.xkb.options;
              };
            }; in "${pkgs.weston}/bin/weston --shell=fullscreen-shell.so -c ${westonIni}";
          description = lib.mdDoc "Command used to start the selected compositor";
--- a/nixos/modules/services/x11/extra-layouts.nix
+++ b/nixos/modules/services/x11/extra-layouts.nix
@ -121,11 +121,11 @@ in
    environment.sessionVariables = {
      # runtime override supported by multiple libraries e. g. libxkbcommon
      # https://xkbcommon.org/doc/current/group__include-path.html
-      XKB_CONFIG_ROOT = config.services.xserver.xkbDir;
+      XKB_CONFIG_ROOT = config.services.xserver.xkb.dir;
    };

    services.xserver = {
-      xkbDir = "${xkb_patched}/etc/X11/xkb";
+      xkb.dir = "${xkb_patched}/etc/X11/xkb";
      exportConfiguration = config.services.xserver.displayManager.startx.enable
        || config.services.xserver.displayManager.sx.enable;
    };
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@ -175,6 +175,31 @@ in
        "Use services.xserver.fontPath instead of useXFS")
      (mkRemovedOptionModule [ "services" "xserver" "useGlamor" ]
        "Option services.xserver.useGlamor was removed because it is unnecessary. Drivers that uses Glamor will use it automatically.")
+      (lib.mkRenamedOptionModuleWith {
+        sinceRelease = 2311;
+        from = [ "services" "xserver" "layout" ];
+        to = [ "services" "xserver" "xkb" "layout" ];
+      })
+      (lib.mkRenamedOptionModuleWith {
+        sinceRelease = 2311;
+        from = [ "services" "xserver" "xkbModel" ];
+        to = [ "services" "xserver" "xkb" "model" ];
+      })
+      (lib.mkRenamedOptionModuleWith {
+        sinceRelease = 2311;
+        from = [ "services" "xserver" "xkbOptions" ];
+        to = [ "services" "xserver" "xkb" "options" ];
+      })
+      (lib.mkRenamedOptionModuleWith {
+        sinceRelease = 2311;
+        from = [ "services" "xserver" "xkbVariant" ];
+        to = [ "services" "xserver" "xkb" "variant" ];
+      })
+      (lib.mkRenamedOptionModuleWith {
+        sinceRelease = 2311;
+        from = [ "services" "xserver" "xkbDir" ];
+        to = [ "services" "xserver" "xkb" "dir" ];
+      })
    ];


@ -339,48 +364,56 @@ in
        '';
      };

-      layout = mkOption {
-        type = types.str;
-        default = "us";
-        description = lib.mdDoc ''
-          Keyboard layout, or multiple keyboard layouts separated by commas.
-        '';
-      };
+      xkb = mkOption {
+        default = { };
+        description = "X keyboard extension (XKB) configuration";
+        type = types.submodule {
+          options = {
+            layout = mkOption {
+              type = types.str;
+              default = "us";
+              description = lib.mdDoc ''
+                Keyboard layout, or multiple keyboard layouts separated by commas.
+              '';
+            };

-      xkbModel = mkOption {
-        type = types.str;
-        default = "pc104";
-        example = "presario";
-        description = lib.mdDoc ''
-          Keyboard model.
-        '';
-      };
+            model = mkOption {
+              type = types.str;
+              default = "pc104";
+              example = "presario";
+              description = lib.mdDoc ''
+                Keyboard model.
+              '';
+            };

-      xkbOptions = mkOption {
-        type = types.commas;
-        default = "terminate:ctrl_alt_bksp";
-        example = "grp:caps_toggle,grp_led:scroll";
-        description = lib.mdDoc ''
-          X keyboard options; layout switching goes here.
-        '';
-      };
+            options = mkOption {
+              type = types.commas;
+              default = "terminate:ctrl_alt_bksp";
+              example = "grp:caps_toggle,grp_led:scroll";
+              description = lib.mdDoc ''
+                X keyboard options; layout switching goes here.
+              '';
+            };

-      xkbVariant = mkOption {
-        type = types.str;
-        default = "";
-        example = "colemak";
-        description = lib.mdDoc ''
-          X keyboard variant.
-        '';
-      };
+            variant = mkOption {
+              type = types.str;
+              default = "";
+              example = "colemak";
+              description = lib.mdDoc ''
+                X keyboard variant.
+              '';
+            };

-      xkbDir = mkOption {
-        type = types.path;
-        default = "${pkgs.xkeyboard_config}/etc/X11/xkb";
-        defaultText = literalExpression ''"''${pkgs.xkeyboard_config}/etc/X11/xkb"'';
-        description = lib.mdDoc ''
-          Path used for -xkbdir xserver parameter.
-        '';
+            dir = mkOption {
+              type = types.path;
+              default = "${pkgs.xkeyboard_config}/etc/X11/xkb";
+              defaultText = literalExpression ''"''${pkgs.xkeyboard_config}/etc/X11/xkb"'';
+              description = lib.mdDoc ''
+                Path used for -xkbdir xserver parameter.
+              '';
+            };
+          };
+        };
      };

      config = mkOption {
@ -667,7 +700,7 @@ in
        {
          "X11/xorg.conf".source = "${configFile}";
          # -xkbdir command line option does not seems to be passed to xkbcomp.
-          "X11/xkb".source = "${cfg.xkbDir}";
+          "X11/xkb".source = "${cfg.xkb.dir}";
        })
      # localectl looks into 00-keyboard.conf
      //{
@ -675,10 +708,10 @@ in
            Section "InputClass"
              Identifier "Keyboard catchall"
              MatchIsKeyboard "on"
-              Option "XkbModel" "${cfg.xkbModel}"
-              Option "XkbLayout" "${cfg.layout}"
-              Option "XkbOptions" "${cfg.xkbOptions}"
-              Option "XkbVariant" "${cfg.xkbVariant}"
+              Option "XkbModel" "${cfg.xkb.model}"
+              Option "XkbLayout" "${cfg.xkb.layout}"
+              Option "XkbOptions" "${cfg.xkb.options}"
+              Option "XkbVariant" "${cfg.xkb.variant}"
            EndSection
          '';
        }
@ -759,7 +792,7 @@ in

    services.xserver.displayManager.xserverArgs =
      [ "-config ${configFile}"
-        "-xkbdir" "${cfg.xkbDir}"
+        "-xkbdir" "${cfg.xkb.dir}"
      ] ++ optional (cfg.display != null) ":${toString cfg.display}"
        ++ optional (cfg.tty     != null) "vt${toString cfg.tty}"
        ++ optional (cfg.dpi     != null) "-dpi ${toString cfg.dpi}"
@ -777,14 +810,14 @@ in
      ];

    system.checks = singleton (pkgs.runCommand "xkb-validated" {
-      inherit (cfg) xkbModel layout xkbVariant xkbOptions;
+      inherit (cfg.xkb) model layout variant options;
      nativeBuildInputs = with pkgs.buildPackages; [ xkbvalidate ];
      preferLocalBuild = true;
    } ''
      ${optionalString (config.environment.sessionVariables ? XKB_CONFIG_ROOT)
        "export XKB_CONFIG_ROOT=${config.environment.sessionVariables.XKB_CONFIG_ROOT}"
      }
-      xkbvalidate "$xkbModel" "$layout" "$xkbVariant" "$xkbOptions"
+      xkbvalidate "$model" "$layout" "$variant" "$options"
      touch "$out"
    '');

--- a/nixos/tests/keymap.nix
+++ b/nixos/tests/keymap.nix
@ -31,7 +31,7 @@ let

    nodes.machine.console.keyMap = mkOverride 900 layout;
    nodes.machine.services.xserver.desktopManager.xterm.enable = false;
-    nodes.machine.services.xserver.layout = mkOverride 900 layout;
+    nodes.machine.services.xserver.xkb.layout = mkOverride 900 layout;
    nodes.machine.imports = [ ./common/x11.nix extraConfig ];

    testScript = ''
@ -116,7 +116,7 @@ in pkgs.lib.mapAttrs mkKeyboardTest {
    };

    extraConfig.console.keyMap = "fr";
-    extraConfig.services.xserver.layout = "fr";
+    extraConfig.services.xserver.xkb.layout = "fr";
  };

  bone = {
@ -130,8 +130,8 @@ in pkgs.lib.mapAttrs mkKeyboardTest {
    };

    extraConfig.console.keyMap = "bone";
-    extraConfig.services.xserver.layout = "de";
-    extraConfig.services.xserver.xkbVariant = "bone";
+    extraConfig.services.xserver.xkb.layout = "de";
+    extraConfig.services.xserver.xkb.variant = "bone";
  };

  colemak = {
@ -141,8 +141,8 @@ in pkgs.lib.mapAttrs mkKeyboardTest {
    };

    extraConfig.console.keyMap = "colemak";
-    extraConfig.services.xserver.layout = "us";
-    extraConfig.services.xserver.xkbVariant = "colemak";
+    extraConfig.services.xserver.xkb.layout = "us";
+    extraConfig.services.xserver.xkb.variant = "colemak";
  };

  dvorak = {
@ -154,8 +154,8 @@ in pkgs.lib.mapAttrs mkKeyboardTest {
    };

    extraConfig.console.keyMap = "dvorak";
-    extraConfig.services.xserver.layout = "us";
-    extraConfig.services.xserver.xkbVariant = "dvorak";
+    extraConfig.services.xserver.xkb.layout = "us";
+    extraConfig.services.xserver.xkb.variant = "dvorak";
  };

  dvorak-programmer = {
@ -170,8 +170,8 @@ in pkgs.lib.mapAttrs mkKeyboardTest {
    };

    extraConfig.console.keyMap = "dvorak-programmer";
-    extraConfig.services.xserver.layout = "us";
-    extraConfig.services.xserver.xkbVariant = "dvp";
+    extraConfig.services.xserver.xkb.layout = "us";
+    extraConfig.services.xserver.xkb.variant = "dvp";
  };

  neo = {
@ -185,8 +185,8 @@ in pkgs.lib.mapAttrs mkKeyboardTest {
    };

    extraConfig.console.keyMap = "neo";
-    extraConfig.services.xserver.layout = "de";
-    extraConfig.services.xserver.xkbVariant = "neo";
+    extraConfig.services.xserver.xkb.layout = "de";
+    extraConfig.services.xserver.xkb.variant = "neo";
  };

  qwertz = {
@ -199,7 +199,7 @@ in pkgs.lib.mapAttrs mkKeyboardTest {
    };

    extraConfig.console.keyMap = "de";
-    extraConfig.services.xserver.layout = "de";
+    extraConfig.services.xserver.xkb.layout = "de";
  };

  custom = {
@ -212,7 +212,7 @@ in pkgs.lib.mapAttrs mkKeyboardTest {
    };

    extraConfig.console.useXkbConfig = true;
-    extraConfig.services.xserver.layout = "us-greek";
+    extraConfig.services.xserver.xkb.layout = "us-greek";
    extraConfig.services.xserver.extraLayouts.us-greek =
      { description = "US layout with alt-gr greek";
        languages   = [ "eng" ];
--- a/nixos/tests/mailman.nix
+++ b/nixos/tests/mailman.nix
@ -63,5 +63,11 @@ import ./make-test-python.nix {
        wait_for_api()
        machine.succeed("curl --fail-with-body -sLSu restadmin:secretpassword http://localhost:8001/3.1/domains")
        machine.succeed("curl --fail-with-body -sILS http://localhost/")
+
+    with subtest("service locking"):
+        machine.fail("su -s /bin/sh -c 'mailman start' mailman")
+        machine.execute("systemctl kill --signal=SIGKILL mailman")
+        machine.succeed("systemctl restart mailman")
+        wait_for_api()
  '';
 }
--- a/nixos/tests/sabnzbd.nix
+++ b/nixos/tests/sabnzbd.nix
@ -18,5 +18,8 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
    machine.wait_until_succeeds(
        "curl --fail -L http://localhost:8080/"
    )
+    _, out = machine.execute("grep SABCTools /var/lib/sabnzbd/logs/sabnzbd.log")
+    machine.log(out)
+    machine.fail("grep 'SABCTools disabled: no correct version found!' /var/lib/sabnzbd/logs/sabnzbd.log")
  '';
 })
--- a/nixos/tests/wordpress.nix
+++ b/nixos/tests/wordpress.nix
@ -67,7 +67,7 @@ rec {
      networking.hosts."127.0.0.1" = [ "site1.local" "site2.local" ];
    };
  }) {} [
-    "6_1" "6_2" "6_3"
+    "6_3"
  ];

  testScript = ''
--- a/pkgs/applications/audio/furnace/default.nix
+++ b/pkgs/applications/audio/furnace/default.nix
@ -1,6 +1,5 @@
 { stdenv
 , lib
-, gitUpdater
 , testers
 , furnace
 , fetchFromGitHub
@ -104,9 +103,7 @@ stdenv.mkDerivation rec {
  '';

  passthru = {
-    updateScript = gitUpdater {
-      rev-prefix = "v";
-    };
+    updateScript = ./update.sh;
    tests.version = testers.testVersion {
      package = furnace;
    };
--- a/pkgs/applications/audio/furnace/update.sh
+++ b/pkgs/applications/audio/furnace/update.sh
@ -0,0 +1,12 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p common-updater-scripts curl jql
+
+set -eu -o pipefail
+
+# Because upstream uses release tags that don't always sort correctly, query for latest release
+version="$(
+  curl -Ls 'https://api.github.com/repos/tildearrow/furnace/releases/latest' \
+  | jql -r '"tag_name"' \
+  | sed 's/^v//'
+)"
+update-source-version furnace "$version"
--- a/pkgs/applications/audio/go-musicfox/default.nix
+++ b/pkgs/applications/audio/go-musicfox/default.nix
@ -1,5 +1,5 @@
 { lib
-, buildGoModule
+, buildGo121Module
 , fetchFromGitHub
 , pkg-config
 , alsa-lib
@ -7,27 +7,27 @@
 , nix-update-script
 }:

-buildGoModule rec {
+buildGo121Module rec {
  pname = "go-musicfox";
-  version = "4.1.4";
+  version = "4.2.1";

  src = fetchFromGitHub {
    owner = "go-musicfox";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-z4zyLHflmaX5k69KvPTISRIEHVjDmEGZenNXfYd3UUk=";
+    hash = "sha256-yl7PirSt4zEy8ZoDGq3dn5TjJtbJeAgXgbynw/D0d38=";
  };

  deleteVendor = true;

-  vendorHash = "sha256-S1OIrcn55wm/b7B3lz55guuS+mrv5MswNMO2UyfgjRc=";
+  vendorHash = "sha256-ILO4v4ii1l9JokXG7R3vuN7i5hDi/hLHTFiClA2vdf0=";

  subPackages = [ "cmd/musicfox.go" ];

  ldflags = [
    "-s"
    "-w"
-    "-X github.com/go-musicfox/go-musicfox/pkg/constants.AppVersion=${version}"
+    "-X github.com/go-musicfox/go-musicfox/internal/types.AppVersion=${version}"
  ];

  nativeBuildInputs = [
--- a/pkgs/applications/audio/goodvibes/default.nix
+++ b/pkgs/applications/audio/goodvibes/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "goodvibes";
-  version = "0.7.6";
+  version = "0.7.7";

  src = fetchFromGitLab {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-w0nmTYcq2DBHSjQ23zWxT6optyH+lRAMRa210F7XEvE=";
+    hash = "sha256-7AhdygNl6st5ryaMjrloBvTVz6PN48Y6VVpde5g3+D4=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/audio/openutau/default.nix
+++ b/pkgs/applications/audio/openutau/default.nix
@ -2,6 +2,7 @@
 , stdenv
 , buildDotnetModule
 , fetchFromGitHub
+, fetchpatch
 , dotnetCorePackages
 , dbus
 , fontconfig
@ -22,6 +23,19 @@ buildDotnetModule rec {
    hash = "sha256-/+hlL2sj/juzWrDcb5dELp8Zdg688XK8OnjKz20rx/M=";
  };

+  patches = [
+    # Needed until stakira/OpenUtau#836 is merged and released to fix crashing issues. See stakira/OpenUtau#822
+    (fetchpatch {
+      name = "openutau-update-avalonia-to-11.0.4.patch";
+      url = "https://github.com/stakira/OpenUtau/commit/0130d7387fb626a72850305dc61d7c175caccc0f.diff";
+      hash = "sha256-w9PLnfiUtiKY/8+y4qqINeEul4kP72nKEVc5c8p2g7c=";
+      # It looks like fetched files use CRLF but patch comes back with LF
+      decode = "sed -e 's/$/\\r/'";
+    })
+  ];
+  # Needs binary for above patch due to CRLF shenanigans otherwise being ignored
+  patchFlags = [ "-p1" "--binary" ];
+
  dotnet-sdk = dotnetCorePackages.sdk_7_0;
  dotnet-runtime = dotnetCorePackages.runtime_7_0;

@ -47,8 +61,8 @@ buildDotnetModule rec {
  # needed until upstream bumps to dotnet 7
  postPatch = ''
    substituteInPlace OpenUtau/OpenUtau.csproj OpenUtau.Test/OpenUtau.Test.csproj --replace \
-      "<TargetFramework>net6.0</TargetFramework>" \
-      "<TargetFramework>net7.0</TargetFramework>"
+      '<TargetFramework>net6.0</TargetFramework>' \
+      '<TargetFramework>net7.0</TargetFramework>'
  '';

  # need to make sure proprietary worldline resampler is copied
--- a/pkgs/applications/audio/openutau/deps.nix
+++ b/pkgs/applications/audio/openutau/deps.nix
@ -3,22 +3,22 @@

 { fetchNuGet }: [
  (fetchNuGet { pname = "AsyncIO"; version = "0.1.69"; sha256 = "1anby58bs94gf338vmn6vvwxw0kcz6y8yap57vgh8dgm9vysl0i5"; })
-  (fetchNuGet { pname = "Avalonia"; version = "11.0.0-rc1.1"; sha256 = "15gn6qbbx6zars37fvfdsyvqg9303zr8dsx7k1v6a4mzm190xhmm"; })
+  (fetchNuGet { pname = "Avalonia"; version = "11.0.4"; sha256 = "0jid0x90dc8m609wqwbq87014yzih2iimz74wm6zi1j02k080jk0"; })
  (fetchNuGet { pname = "Avalonia.Angle.Windows.Natives"; version = "2.1.0.2023020321"; sha256 = "1az4s1g22ipak9a3xfh55z2h3rm6lpqh7svbpw6ag4ysrgsjjsjd"; })
-  (fetchNuGet { pname = "Avalonia.BuildServices"; version = "0.0.19"; sha256 = "1vlhyjb2g98hh5gnisg4bdl9p93x8lmnkc97d24hpxgflcd7szs7"; })
-  (fetchNuGet { pname = "Avalonia.Controls.ColorPicker"; version = "11.0.0-rc1.1"; sha256 = "0nflr62lywmgby1lc6zasn24rinkq72imkazhv77wnj28ayid3bx"; })
-  (fetchNuGet { pname = "Avalonia.Controls.DataGrid"; version = "11.0.0-rc1.1"; sha256 = "088xz8llm8298agk4dkpzrb1bqyksgvzhj3pw1s4r1fcdfl0z64j"; })
-  (fetchNuGet { pname = "Avalonia.Desktop"; version = "11.0.0-rc1.1"; sha256 = "06580q0il62f3464vq2113gbv0yng4jqm79k2wvn3brzl82pyhvq"; })
-  (fetchNuGet { pname = "Avalonia.Diagnostics"; version = "11.0.0-rc1.1"; sha256 = "1jia97djk33za7spfr9276plvx8mybm7i3ckp1wprlnmh5b6nykp"; })
-  (fetchNuGet { pname = "Avalonia.FreeDesktop"; version = "11.0.0-rc1.1"; sha256 = "1mpm34lgxcxh5hglyq2fpggdf18cadzx9030kxax5ilp69mk93df"; })
-  (fetchNuGet { pname = "Avalonia.Native"; version = "11.0.0-rc1.1"; sha256 = "0hzk1gb4zh9n5k3wv2n8nw9qcgyj9pvwysph3shg9m8wwrdhkiy5"; })
-  (fetchNuGet { pname = "Avalonia.ReactiveUI"; version = "11.0.0-rc1.1"; sha256 = "08116ixw118i2v11dylhwkj1ilgkpk29cp9n7zqj3zk7pxkln2f7"; })
-  (fetchNuGet { pname = "Avalonia.Remote.Protocol"; version = "11.0.0-rc1.1"; sha256 = "1m3r05b14vw4mn1m9ak91j00q0ppnkysb6m7w86sacqjfhpl8faa"; })
-  (fetchNuGet { pname = "Avalonia.Skia"; version = "11.0.0-rc1.1"; sha256 = "0a8xvqd0hgi8bynjipvvhg0cm9qr63p0h3ji1wbn3y9vrysliykh"; })
-  (fetchNuGet { pname = "Avalonia.Themes.Fluent"; version = "11.0.0-rc1.1"; sha256 = "03lp3m40hwbpasa4q6gykj1y5772lpzzr59y5k1nbi54k2n3fl3k"; })
-  (fetchNuGet { pname = "Avalonia.Themes.Simple"; version = "11.0.0-rc1.1"; sha256 = "0bgz8djfmb17qrf44bivcyf9hwdfccl5f8hgyq158y7ag4a313sn"; })
-  (fetchNuGet { pname = "Avalonia.Win32"; version = "11.0.0-rc1.1"; sha256 = "1zslv10kcmclx5ajd74yi6j1f8p3a9iy2r0w4k8kwkc56d5jg30c"; })
-  (fetchNuGet { pname = "Avalonia.X11"; version = "11.0.0-rc1.1"; sha256 = "0b4bmza84bv8hbh6jmy1kxxp9pnz4q4wq6bw8jc30w4jkdhp588r"; })
+  (fetchNuGet { pname = "Avalonia.BuildServices"; version = "0.0.29"; sha256 = "05mm7f0jssih3gbzqfgjnfq5cnqa85ihsg0z1897ciihv8qd3waq"; })
+  (fetchNuGet { pname = "Avalonia.Controls.ColorPicker"; version = "11.0.4"; sha256 = "1sqdcaknqazq4mw2x1jb6pfmfnyhpkd4xh6fl4ld85qikzzj7796"; })
+  (fetchNuGet { pname = "Avalonia.Controls.DataGrid"; version = "11.0.4"; sha256 = "10kc1pfyi0jq29xavq059vfjm51igi45yikz7i1ys061zbjs0n62"; })
+  (fetchNuGet { pname = "Avalonia.Desktop"; version = "11.0.4"; sha256 = "101jlqx24d19nk0nd7x19pvbjjybckzgqh9h78c85vb98xbwh3ky"; })
+  (fetchNuGet { pname = "Avalonia.Diagnostics"; version = "11.0.4"; sha256 = "1dxylsvaffzravz64rwq2wjjlr3392i5153nmkqk89ldaq70wjja"; })
+  (fetchNuGet { pname = "Avalonia.FreeDesktop"; version = "11.0.4"; sha256 = "1sbgs6d1b751h0ipq249w7z3aclpfb42sw3f7g31vin9w8wxwa6q"; })
+  (fetchNuGet { pname = "Avalonia.Native"; version = "11.0.4"; sha256 = "10fyr63sqb4xyr7rlk94rzjbnb9mbln95mb9papip5kb3sm8jx60"; })
+  (fetchNuGet { pname = "Avalonia.ReactiveUI"; version = "11.0.4"; sha256 = "1hs29qvbhm5qdhys0j3d89c37qfalx1pcpxl3hh9adz11wc0nb3b"; })
+  (fetchNuGet { pname = "Avalonia.Remote.Protocol"; version = "11.0.4"; sha256 = "096436hhg45v02pp4f43mf00xn6blx7x66sb8fq5j4jn7479fynp"; })
+  (fetchNuGet { pname = "Avalonia.Skia"; version = "11.0.4"; sha256 = "1ysmq4f8bxabpq3nhcrrvgwvxb9z7gx9565bvdyksdhsq16wyxym"; })
+  (fetchNuGet { pname = "Avalonia.Themes.Fluent"; version = "11.0.4"; sha256 = "03zdixi6m9g4mcxmp24z8dzamzqqy9i0wg069m4gl5p3wcvfbqla"; })
+  (fetchNuGet { pname = "Avalonia.Themes.Simple"; version = "11.0.4"; sha256 = "1rncb8ifqarjc5gfh6ld0ldahvxy57a2hzi7vs826an4zl3r0yrx"; })
+  (fetchNuGet { pname = "Avalonia.Win32"; version = "11.0.4"; sha256 = "07ijkpbhz59gvsxsik8mib8rhpm5yrpnjz66sjnxl8m0ghqnkf02"; })
+  (fetchNuGet { pname = "Avalonia.X11"; version = "11.0.4"; sha256 = "0xq6xqd3cwwdcqsipvrs4rpf82nqhr45ispwjj4dxlyn4i1n8ryd"; })
  (fetchNuGet { pname = "BunLabs.NAudio.Flac"; version = "2.0.1"; sha256 = "1ps7fs451ydsaz5g4j7bhcfawp8fys6vcah3rsrl36g7ni0dwf3v"; })
  (fetchNuGet { pname = "Concentus"; version = "1.1.7"; sha256 = "0y5z444wrbhlmsqpy2sxmajl1fbf74843lvgj3y6vz260dn2q0l0"; })
  (fetchNuGet { pname = "Concentus.Oggfile"; version = "1.0.4"; sha256 = "12n5bcg1i91daqgnl7q6d55phbkv1srkrvk2k7k8vxpyv231yb6v"; })
--- a/pkgs/applications/audio/spotify/update.sh
+++ b/pkgs/applications/audio/spotify/update.sh
@ -39,12 +39,11 @@ snap_info=($(
 # just for human consumption. Revision is just an integer that gets increased
 # by one every (stable or unstable) release.
 revision="${snap_info[0]}"
-sha512="${snap_info[1]}"
+# We need to escape the slashes
+hash="$(nix-hash --to-sri --type sha512 ${snap_info[1]} | sed 's|/|\\/|g')"
 upstream_version="${snap_info[2]}"
 last_updated="${snap_info[3]}"
-
 echo "Latest $channel release is $upstream_version from $last_updated."
-
 #
 # read the current spotify version from the currently *committed* nix expression
 #
@ -70,7 +69,7 @@ echo "Updating from ${current_nix_version} to ${upstream_version}, released on $
 # search-and-replace revision, hash and version
 sed --regexp-extended \
  -e 's/rev\s*=\s*"[0-9]+"\s*;/rev = "'"${revision}"'";/' \
-  -e 's/sha512\s*=\s*"[^"]*"\s*;/sha512 = "'"${sha512}"'";/' \
+  -e 's/hash\s*=\s*"[^"]*"\s*;/hash = "'"${hash}"'";/' \
  -e 's/version\s*=\s*".*"\s*;/version = "'"${upstream_version}"'";/' \
  -i "$spotify_nix"

--- a/pkgs/applications/blockchains/ergo/default.nix
+++ b/pkgs/applications/blockchains/ergo/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "ergo";
-  version = "5.0.13";
+  version = "5.0.14";

  src = fetchurl {
    url = "https://github.com/ergoplatform/ergo/releases/download/v${version}/ergo-${version}.jar";
-    sha256 = "sha256-ZnWiP6Mk6EnrqPT+apSQ0igIEVHy+B8QVbsXRna7up0=";
+    sha256 = "sha256-YcFjnDs1hAmkYmJlq3yvY/IP6P9SPVGknbzapl5C2B4=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/editors/rstudio/default.nix
+++ b/pkgs/applications/editors/rstudio/default.nix
@ -145,6 +145,9 @@ in
        --replace '@node@' ${nodejs} \
        --replace './lib/quarto' ${quartoSrc}

+      substituteInPlace src/cpp/conf/rsession-dev.conf \
+        --replace '@node@' ${nodejs}
+
      substituteInPlace src/cpp/core/libclang/LibClang.cpp \
        --replace '@libclang@' ${llvmPackages.libclang.lib} \
        --replace '@libclang.so@' ${llvmPackages.libclang.lib}/lib/libclang.so
--- a/pkgs/applications/editors/rstudio/use-system-node.patch
+++ b/pkgs/applications/editors/rstudio/use-system-node.patch
@ -1,5 +1,33 @@
+diff --git a/src/cpp/conf/rsession-dev.conf b/src/cpp/conf/rsession-dev.conf
+index d18362b..98cdd4c 100644
+--- a/src/cpp/conf/rsession-dev.conf
+++ b/src/cpp/conf/rsession-dev.conf
+@@ -39,7 +39,7 @@ external-mathjax-path=${RSTUDIO_DEPENDENCIES_MATHJAX_DIR}
+ external-pandoc-path=${RSTUDIO_DEPENDENCIES_PANDOC_DIR}
+ external-quarto-path=${RSTUDIO_DEPENDENCIES_QUARTO_DIR}
+ external-libclang-path=${RSTUDIO_DEPENDENCIES_DIR}/common/libclang
+-external-node-path=${RSTUDIO_DEPENDENCIES_DIR}/common/node/16.14.0/bin/node
+external-node-path=@node@/bin/node
+ 
+ # enable copilot
+ copilot-enabled=1
+diff --git a/src/cpp/server/CMakeLists.txt b/src/cpp/server/CMakeLists.txt
+index 30dd638..cb4a645 100644
+--- a/src/cpp/server/CMakeLists.txt
+++ b/src/cpp/server/CMakeLists.txt
+@@ -250,10 +250,6 @@ if (UNIX AND NOT APPLE)
+            DESTINATION ${RSERVER_SYSTEMD_DIR})
+ 
+    # install node
+-   install(
+-      DIRECTORY "${RSTUDIO_DEPENDENCIES_DIR}/common/node/${RSTUDIO_NODE_VERSION}/"
+-      DESTINATION "${RSTUDIO_INSTALL_BIN}/node"
+-      USE_SOURCE_PERMISSIONS)
+ 
+ elseif(APPLE)
+ 
 diff --git a/src/gwt/build.xml b/src/gwt/build.xml
-index 83e9433..f1ee63d 100644
+index 033d605..f1ee63d 100644
 --- a/src/gwt/build.xml
 +++ b/src/gwt/build.xml
@@ -87,29 +87,7 @@
--- a/pkgs/applications/emulators/fs-uae/launcher.nix
+++ b/pkgs/applications/emulators/fs-uae/launcher.nix
@ -36,10 +36,11 @@ stdenv.mkDerivation (finalAttrs: {
    wrapQtApp "$out/bin/fs-uae-launcher" \
      --set PYTHONPATH "$PYTHONPATH"

-    # fs-uae-launcher search side by side for fs-uae
+    # fs-uae-launcher search side by side for executables and shared files
    # see $src/fsgs/plugins/pluginexecutablefinder.py#find_executable
    ln -s ${fsuae}/bin/fs-uae $out/bin
    ln -s ${fsuae}/bin/fs-uae-device-helper $out/bin
+    ln -s ${fsuae}/share/fs-uae $out/share/fs-uae
  '';

  meta = {
--- a/pkgs/applications/graphics/darktable/default.nix
+++ b/pkgs/applications/graphics/darktable/default.nix
@ -10,7 +10,7 @@
 , ninja
 , curl
 , perl
-, llvm_13
+, llvmPackages_13
 , desktop-file-utils
 , exiv2
 , glib
@ -53,7 +53,6 @@
 , libheif
 , libaom
 , portmidi
-, fetchpatch
 , lua
 }:

@ -66,7 +65,9 @@ stdenv.mkDerivation rec {
    sha256 = "c11d28434fdf2e9ce572b9b1f9bc4e64dcebf6148e25080b4c32eb51916cfa98";
  };

-  nativeBuildInputs = [ cmake ninja llvm_13 pkg-config intltool perl desktop-file-utils wrapGAppsHook ];
+  nativeBuildInputs = [ cmake ninja llvmPackages_13.llvm pkg-config intltool perl desktop-file-utils wrapGAppsHook ]
+    # LLVM Clang C compiler version 11.1.0 is too old and is unsupported. Version 12+ is required.
+    ++ lib.optionals stdenv.isDarwin [ llvmPackages_13.clang ];

  buildInputs = [
    cairo
--- a/pkgs/applications/misc/anytype/default.nix
+++ b/pkgs/applications/misc/anytype/default.nix
@ -6,7 +6,7 @@ let
  name = "Anytype-${version}";
  nameExecutable = pname;
  src = fetchurl {
-    url = "https://anytype-release.fra1.cdn.digitaloceanspaces.com/Anytype-${version}.AppImage";
+    url = "https://github.com/anyproto/anytype-ts/releases/download/v${version}/${name}.AppImage";
    name = "Anytype-${version}.AppImage";
    sha256 = "sha256-heS+3ucxv4WTiqegdmjpv8aWuC+3knxC00SDDg4R8iU=";
  };
--- a/pkgs/applications/misc/klayout/default.nix
+++ b/pkgs/applications/misc/klayout/default.nix
@ -5,13 +5,13 @@

 mkDerivation rec {
  pname = "klayout";
-  version = "0.28.11";
+  version = "0.28.12";

  src = fetchFromGitHub {
    owner = "KLayout";
    repo = "klayout";
    rev = "v${version}";
-    hash = "sha256-PEWb2QBWK3XMuOAkSI2nAk6UJronG+3+NBU92uWO5LQ=";
+    hash = "sha256-QvEoXKJ9sH5WIarYPsYEWwoFwA/pZa2etegA+AD8rPo=";
  };

  postPatch = ''
--- a/pkgs/applications/misc/limesctl/default.nix
+++ b/pkgs/applications/misc/limesctl/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "limesctl";
-  version = "3.2.1";
+  version = "3.3.0";

  src = fetchFromGitHub {
    owner = "sapcc";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-TR3cFIGU5hmZuzlYUJX+84vb8gmErSIZizK9J5Ieagk=";
+    hash = "sha256-zR0+tTPRdmv04t3V0KDA/hG5ZJMT2RYI3+2dkmZHdhk=";
  };

  vendorHash = null;
--- a/pkgs/applications/misc/nhentai/default.nix
+++ b/pkgs/applications/misc/nhentai/default.nix
@ -1,13 +1,21 @@
-{ lib, python3Packages, fetchPypi }:
+{ lib
+, python3Packages
+, fetchFromGitHub
+}:

 python3Packages.buildPythonApplication rec {
  pname = "nhentai";
-  version = "0.4.16";
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-2lzrQqUx3lPM+OAUO/SwT+fAuG7kWmUnTACNUiP7d1M=";
+  version = "0.5.3";
+  src = fetchFromGitHub {
+    owner = "RicterZ";
+    repo = pname;
+    rev = version;
+    hash = "sha256-SjWIctAyczjYGP4buXQBA/RcrdikMSuSBtfhORNmXMc=";
  };

+  # tests require a network connection
+  doCheck = false;
+
  propagatedBuildInputs = with python3Packages; [
    requests
    iso8601
@ -21,6 +29,6 @@ python3Packages.buildPythonApplication rec {
    homepage = "https://github.com/RicterZ/nhentai";
    description = "nHentai is a CLI tool for downloading doujinshi from <http://nhentai.net>";
    license = licenses.mit;
-    maintainers = with maintainers; [ travisdavis-ops ];
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/applications/misc/octoprint/default.nix
+++ b/pkgs/applications/misc/octoprint/default.nix
@ -80,13 +80,13 @@ let
          self: super: {
            octoprint = self.buildPythonPackage rec {
              pname = "OctoPrint";
-              version = "1.9.2";
+              version = "1.9.3";

              src = fetchFromGitHub {
                owner = "OctoPrint";
                repo = "OctoPrint";
                rev = version;
-                hash = "sha256-DSngV8nWHNqfPEBIfGq3HQeC1p9s6Q+GX+LcJiAiS4E=";
+                hash = "sha256-SYN/BrcukHMDwk70XGu/pO45fSPr/KOEyd4wxtz2Fo0=";
              };

              propagatedBuildInputs = with self; [
--- a/pkgs/applications/misc/pdfstudio/default.nix
+++ b/pkgs/applications/misc/pdfstudio/default.nix
@ -11,7 +11,7 @@
 { lib
 , stdenv
 , program ? "pdfstudio"
-, year ? "2022"
+, year ? "2023"
 , fetchurl
 , callPackage
 , jdk11
@ -31,27 +31,23 @@ in
 {
  pdfstudioviewer = callPackage ./common.nix rec {
    inherit desktopName pname program year;
-    version = "${year}.2.4";
+    version = "${year}.0.3";
    longDescription = ''
      PDF Studio Viewer is an easy to use, full-featured PDF editing software. This is the free edition. For the standard/pro edition, see the package pdfstudio.
    '';
    src = fetchurl {
      url = "https://download.qoppa.com/pdfstudioviewer/PDFStudioViewer_linux64.deb";
-      sha256 = "sha256-QXNsH1T+ItV3s9r8CnwgRUo1mhVbe8LkEun9gUmlVQg=";
+      sha256 = "sha256-JQx5yJLjwW4VRXLM+/VNDXFN8ZcHJxlxyKDIzc++hEs=";
    };
    jdk = jdk17;
-
-    # Bad hash, got sha256-afRhx9VCVRFUJoUnqs1bzF0yXpz3yEgLiFjMRB9xvsk=
-    # Likely unstable.
-    broken = true;
  };

  pdfstudio2021 = callPackage ./common.nix rec {
    inherit desktopName longDescription pname program year;
-    version = "${year}.2.1";
+    version = "${year}.2.2";
    src = fetchurl {
      url = "https://download.qoppa.com/pdfstudio/v${year}/PDFStudio_v${dot2dash version}_linux64.deb";
-      sha256 = "sha256-yELpza2C3HJJIP+ZQP7x3Tfez0Nl6ctCbHCmTmpX3jo=";
+      sha256 = "sha256-HdkwRMqwquAaW6l3AukGReFtw2f5n36tZ8vXo6QiPvU=";
    };
    extraBuildInputs = [
      (lib.getLib stdenv.cc.cc)  # for libstdc++.so.6 and libgomp.so.1
@ -61,14 +57,24 @@ in

  pdfstudio2022 = callPackage ./common.nix rec {
    inherit desktopName longDescription pname program year;
-    version = "${year}.2.4";
+    version = "${year}.2.5";
    src = fetchurl {
      url = "https://download.qoppa.com/pdfstudio/v${year}/PDFStudio_v${dot2dash version}_linux64.deb";
-      sha256 = "sha256-bti+WI8JdOmUsHq8ijfxGC4ZsWXwbwwM26kuBgPDUMQ=";
+      sha256 = "sha256-3faZyWUnFe//S+gOskWhsZ6jzHw67FRsv/xP77R1jj4=";
    };
    extraBuildInputs = [
      (lib.getLib stdenv.cc.cc)  # for libstdc++.so.6 and libgomp.so.1
    ];
    jdk = jdk17;
  };
+
+  pdfstudio2023 = callPackage ./common.nix rec {
+    inherit desktopName longDescription pname program year;
+    version = "${year}.0.3";
+    src = fetchurl {
+      url = "https://download.qoppa.com/pdfstudio/v${year}/PDFStudio_v${dot2dash version}_linux64.deb";
+      sha256 = "sha256-Po7BMmEWoC46rP7tUwZT9Ji/Wi8lKc6WN8x47fx2DXg=";
+    };
+    jdk = jdk17;
+  };
 }.${pname}
--- a/pkgs/applications/misc/pot/Cargo.lock
+++ b/pkgs/applications/misc/pot/Cargo.lock
--- a/pkgs/applications/misc/pot/default.nix
+++ b/pkgs/applications/misc/pot/default.nix
@ -23,13 +23,13 @@

 stdenv.mkDerivation rec {
  pname = "pot";
-  version = "2.4.2";
+  version = "2.6.2";

  src = fetchFromGitHub {
    owner = "pot-app";
    repo = "pot-desktop";
    rev = version;
-    hash = "sha256-n12uO5QbD/HgD5Rq5d+TQ8j8Gn5hl6wTi27TqFmunIM=";
+    hash = "sha256-0NnZe1o8HsB1GR6wp8Da/CTLhcve/sGIumD2qb9DC3s=";
  };

  sourceRoot = "${src.name}/src-tauri";
@ -66,15 +66,14 @@ stdenv.mkDerivation rec {

    dontFixup = true;
    outputHashMode = "recursive";
-    outputHash = "sha256-/5bB4czTPS3ZM9f7NBIHbwd95BqY2dRwKaBOWVsef04=";
+    outputHash = "sha256-m83cDKtFfwA3Xv8EqXNyF37ss+8qFDdFhu/1X1g7n/0=";
  };

  cargoDeps = rustPlatform.importCargoLock {
    lockFile = ./Cargo.lock;
    outputHashes = {
      # All other crates in the same workspace reuse this hash.
-      "tauri-plugin-autostart-0.0.0" = "sha256-7Qi07yRb+ww569+sEXFIwAtS8jbUNQx6LsrUnMl5YOo=";
-      "reqwest_dav-0.1.3" = "sha256-nWOH1SOoNA2o2lmGAIEJj3OLOlP39FjlXqK8LPZ95hI=";
+      "tauri-plugin-autostart-0.0.0" = "sha256-hvR9tUp7yFhSP2bqE0mGwT8NHL7fGOYQ3Gz2wYi0bXI=";
    };
  };

--- a/pkgs/applications/misc/sfwbar/default.nix
+++ b/pkgs/applications/misc/sfwbar/default.nix
@ -10,17 +10,19 @@
 , libpulseaudio
 , libmpdclient
 , libxkbcommon
+, alsa-lib
+, makeWrapper
 ,
 }:
 stdenv.mkDerivation rec {
  pname = "sfwbar";
-  version = "1.0_beta11";
+  version = "1.0_beta13";

  src = fetchFromGitHub {
    owner = "LBCrion";
    repo = pname;
    rev = "v${version}";
-    sha256 = "PmpiO5gvurpaFpoq8bQdZ53FYSVDnyjN8MxDpelMnAU=";
+    hash = "sha256-7oiuTEqdXDReKdakJX6+HRaSi1XovM+MkHFkaFZtq64=";
  };

  buildInputs = [
@ -30,14 +32,21 @@ stdenv.mkDerivation rec {
    libpulseaudio
    libmpdclient
    libxkbcommon
+    alsa-lib
  ];

  nativeBuildInputs = [
    meson
    ninja
    pkg-config
+    makeWrapper
  ];

+  postFixup = ''
+    wrapProgram $out/bin/sfwbar \
+      --suffix XDG_DATA_DIRS : $out/share
+  '';
+
  meta = with lib; {
    homepage = "https://github.com/LBCrion/sfwbar";
    description = "A flexible taskbar application for wayland compositors, designed with a stacking layout in mind";
--- a/pkgs/applications/misc/sweethome3d/default.nix
+++ b/pkgs/applications/misc/sweethome3d/default.nix
@ -111,13 +111,13 @@ in {

  application = mkSweetHome3D rec {
    pname = lib.toLower module + "-application";
-    version = "7.0.2";
+    version = "7.2";
    module = "SweetHome3D";
    description = "Design and visualize your future home";
    license = lib.licenses.gpl2Plus;
    src = fetchurl {
      url = "mirror://sourceforge/sweethome3d/${module}-${version}-src.zip";
-      sha256 = "sha256-9Jv/U7afG6+LwPB6IhqLePjQA67bPKelP+UcuvizBqo=";
+      sha256 = "sha256-Io3HfussfSy6CLHE0JCAk0gjBAla/u+pS1Gan8BxozY=";
    };
    desktopName = "Sweet Home 3D";
    icons = {
--- a/pkgs/applications/misc/wallust/default.nix
+++ b/pkgs/applications/misc/wallust/default.nix
@ -3,14 +3,17 @@
 , rustPlatform
 , nix-update-script
 }:
-rustPlatform.buildRustPackage rec {
-  pname = "wallust";
+let
  version = "2.7.1";
+in
+rustPlatform.buildRustPackage {
+  pname = "wallust";
+  inherit version;

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "explosion-mental";
-    repo = pname;
+    repo = "wallust";
    rev = version;
    hash = "sha256-WhL2HWM1onRrCqWJPLnAVMd/f/xfLrK3mU8jFSLFjAM=";
  };
@ -19,13 +22,13 @@ rustPlatform.buildRustPackage rec {

  passthru.updateScript = nix-update-script { };

-  meta = with lib; {
+  meta = {
    description = "A better pywal";
    homepage = "https://codeberg.org/explosion-mental/wallust";
-    license = licenses.mit;
-    maintainers = with maintainers; [ onemoresuza iynaix ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ onemoresuza iynaix ];
    downloadPage = "https://codeberg.org/explosion-mental/wallust/releases/tag/${version}";
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
    mainProgram = "wallust";
  };
 }
--- a/pkgs/applications/networking/aether/default.nix
+++ b/pkgs/applications/networking/aether/default.nix
@ -1,112 +0,0 @@
-{ autoPatchelfHook, makeDesktopItem, lib, stdenv, wrapGAppsHook
-, alsa-lib, at-spi2-atk, at-spi2-core, atk, cairo, cups, dbus, expat, fontconfig
-, freetype, gdk-pixbuf, glib, gtk3, libcxx, libdrm, libnotify, libpulseaudio, libuuid
-, libX11, libXScrnSaver, libXcomposite, libXcursor, libXdamage, libXext
-, libXfixes, libXi, libXrandr, libXrender, libXtst, libxcb, libxshmfence
-, mesa, nspr, nss, pango, systemd, libappindicator-gtk3, libdbusmenu
-, fetchurl, fetchFromGitHub, imagemagick, copyDesktopItems
-}:
-
-let
-  binaryName = "AetherP2P";
-  aether-app-git = fetchFromGitHub {
-    owner = "aethereans";
-    repo = "aether-app";
-    rev = "53b6c8b2a9253cbf056ea3ebb077e0e08cbc5b1d";
-    sha256 = "1kgkzh7ih2q9dsckdkinh5dbzvr7gdykf8yz6h8pyhvzyjhk1v0r";
-  };
-in
-stdenv.mkDerivation rec {
-  pname = "aether";
-  version = "2.0.0-dev.15";
-
-  src = fetchurl {
-    url = "https://static.getaether.net/Releases/Aether-${version}/2011262249.19338c93/linux/Aether-${version}%2B2011262249.19338c93.tar.gz";
-    sha256 = "1hi8w83zal3ciyzg2m62shkbyh6hj7gwsidg3dn88mhfy68himf7";
-    # % in the url / canonical filename causes an error
-    name = "aether-tarball.tar.gz";
-  };
-
-  # there is no logo in the tarball so we grab it from github and convert it in the build phase
-  buildPhase = ''
-    convert ${aether-app-git}/aether-core/aether/client/src/app/ext_dep/images/Linux-Windows-App-Icon.png -resize 512x512 aether.png
-  '';
-
-  dontWrapGApps = true;
-
-  buildInputs = [
-    alsa-lib
-    cups
-    libdrm
-    libuuid
-    libXdamage
-    libX11
-    libXScrnSaver
-    libXtst
-    libxcb
-    libxshmfence
-    mesa
-    nss
-  ];
-
-  nativeBuildInputs = [
-    imagemagick
-    autoPatchelfHook
-    wrapGAppsHook
-    copyDesktopItems
-  ];
-
-  desktopItems = [
-    (makeDesktopItem {
-      name = pname;
-      exec = binaryName;
-      icon = pname;
-      desktopName = "Aether";
-      genericName = meta.description;
-      categories = [ "Network" ];
-      mimeTypes = [ "x-scheme-handler/aether" ];
-    })
-  ];
-
-  installPhase =
-  let
-    libPath = lib.makeLibraryPath [
-      libcxx systemd libpulseaudio libdrm mesa
-      stdenv.cc.cc alsa-lib atk at-spi2-atk at-spi2-core cairo cups dbus expat fontconfig freetype
-      gdk-pixbuf glib gtk3 libnotify libX11 libXcomposite libuuid
-      libXcursor libXdamage libXext libXfixes libXi libXrandr libXrender
-      libXtst nspr nss libxcb pango systemd libXScrnSaver
-      libappindicator-gtk3 libdbusmenu
-    ];
-  in
-  ''
-    mkdir -p $out/{bin,opt/${binaryName},share/icons/hicolor/512x512/apps}
-    mv * $out/opt/${binaryName}
-
-    chmod +x $out/opt/${binaryName}/${binaryName}
-    patchelf --set-interpreter ${stdenv.cc.bintools.dynamicLinker} \
-        $out/opt/${binaryName}/${binaryName}
-
-    wrapProgram $out/opt/${binaryName}/${binaryName} \
-        "''${gappsWrapperArgs[@]}" \
-        --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}" \
-        --prefix LD_LIBRARY_PATH : ${libPath}
-
-    ln -s $out/opt/${binaryName}/${binaryName} $out/bin/
-
-    ln -s $out/opt/${binaryName}/aether.png $out/share/icons/hicolor/512x512/apps/
-
-    runHook postInstall
-  '';
-
-  meta = with lib; {
-    description = "Peer-to-peer ephemeral public communities";
-    homepage = "https://getaether.net/";
-    downloadPage = "https://getaether.net/download/";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.agpl3Only;
-    maintainers = with maintainers; [ maxhille ];
-    # other platforms could be supported by building from source
-    platforms = [ "x86_64-linux" ];
-  };
-}
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -92,11 +92,11 @@ in

 stdenv.mkDerivation rec {
  pname = "brave";
-  version = "1.58.137";
+  version = "1.59.117";

  src = fetchurl {
    url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "sha256-6vsdQU9NbEKFp/1A0bNQvutF4I+vI0zfrx70QvU1KV4=";
+    sha256 = "sha256-yckxTKAgglk6YRXist9RZufZdI22iitecmb01NmYPGQ=";
  };

  dontConfigure = true;
--- a/pkgs/applications/networking/cluster/hubble/default.nix
+++ b/pkgs/applications/networking/cluster/hubble/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "hubble";
-  version = "0.12.0";
+  version = "0.12.1";

  src = fetchFromGitHub {
    owner = "cilium";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-QtslAJC9qPR1jnyK4SLPVv8YTxOUvrzrSA1TzEwajS8=";
+    sha256 = "sha256-YJrL4fLJnTkfzZQp4MzPZL8ZZOGhFbHUzOpvaA5JrOA=";
  };

  vendorHash = null;
--- a/pkgs/applications/networking/cluster/k0sctl/default.nix
+++ b/pkgs/applications/networking/cluster/k0sctl/default.nix
@ -1,32 +1,35 @@
 { lib
-, buildGoModule
+, buildGo121Module
 , fetchFromGitHub
 , installShellFiles
 }:

-buildGoModule rec {
+buildGo121Module rec {
  pname = "k0sctl";
-  version = "0.15.5";
+  version = "0.16.0";

  src = fetchFromGitHub {
    owner = "k0sproject";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-ntjrk2OEIkAmNpf9Ag6HkSIOSA3NtO9hSJOBgvne4b0=";
+    hash = "sha256-DUDvsF4NCFimpW9isqEhodieiJXwjhwhfXR2t/ho3kE=";
  };

-  vendorHash = "sha256-JlaXQqDO/b1xe9NA2JtuB1DZZlphWu3Mo/Mf4lhmKNo=";
+  vendorHash = "sha256-eJTVUSAcgE1AaOCEEc202sC0yIfMj30UoK/ObowJ9Zk=";

  ldflags = [
    "-s"
    "-w"
    "-X github.com/k0sproject/k0sctl/version.Environment=production"
-    "-X github.com/carlmjohnson/versioninfo.Version=${version}"
-    "-X github.com/carlmjohnson/versioninfo.Revision=${version}"
+    "-X github.com/carlmjohnson/versioninfo.Version=v${version}" # Doesn't work currently: https://github.com/carlmjohnson/versioninfo/discussions/12
+    "-X github.com/carlmjohnson/versioninfo.Revision=v${version}"
  ];

  nativeBuildInputs = [ installShellFiles ];

+  # https://github.com/k0sproject/k0sctl/issues/569
+  checkFlags = [ "-skip=^Test(Unmarshal|VersionDefaulting)/version_not_given$" ];
+
  postInstall = ''
    for shell in bash zsh fish; do
      installShellCompletion --cmd ${pname} \
@ -38,6 +41,7 @@ buildGoModule rec {
    description = "A bootstrapping and management tool for k0s clusters.";
    homepage = "https://k0sproject.io/";
    license = licenses.asl20;
+    mainProgram = pname;
    maintainers = with maintainers; [ nickcao qjoly ];
  };
 }
--- a/pkgs/applications/networking/cluster/timoni/default.nix
+++ b/pkgs/applications/networking/cluster/timoni/default.nix
@ -6,13 +6,13 @@

 buildGo121Module rec {
  pname = "timoni";
-  version = "0.14.1";
+  version = "0.14.2";

  src = fetchFromGitHub {
    owner = "stefanprodan";
    repo = "timoni";
    rev = "v${version}";
-    hash = "sha256-DzJNNikvODP3v1jgQLbFcXEhcFfTeIYR6qHhUzEP/Ns=";
+    hash = "sha256-45OIj57gb8njYoks7SgIlcMjz07ShEz2G/EECaTRTQg=";
  };

  vendorHash = "sha256-lRZFRnft8vEntVxiLOBcR00FP8AXexLyo3h2LCNWN00=";
--- a/pkgs/applications/networking/instant-messengers/beeper/default.nix
+++ b/pkgs/applications/networking/instant-messengers/beeper/default.nix
@ -1,11 +1,21 @@
-{ lib, fetchurl, mkDerivation, appimageTools, libsecret, makeWrapper }:
+{ lib
+, fetchurl
+, mkDerivation
+, appimageTools
+, libsecret
+, makeWrapper
+, writeShellApplication
+, curl
+, yq
+, common-updater-scripts
+}:
 let
  pname = "beeper";
-  version = "3.71.16";
+  version = "3.80.17";
  name = "${pname}-${version}";
  src = fetchurl {
-    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-${version}.AppImage";
-    hash = "sha256-Ho5zFmhNzkOmzo/btV+qZfP2GGx5XvV/1JncEKlH4vc=";
+    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.80.17-build-231010czwkkgnej.AppImage";
+    hash = "sha256-cfzfeM1czhZKz0HbbJw2PD3laJFg9JWppA2fKUb5szU=";
  };
  appimage = appimageTools.wrapType2 {
    inherit version pname src;
@ -16,7 +26,7 @@ let
  };
 in
 mkDerivation rec {
-  inherit name pname;
+  inherit name pname version;

  src = appimage;

@ -44,6 +54,20 @@ mkDerivation rec {
    runHook postInstall
  '';

+  passthru = {
+    updateScript = lib.getExe (writeShellApplication {
+      name = "update-beeper";
+      runtimeInputs = [ curl yq common-updater-scripts ];
+      text = ''
+        set -o errexit
+        latestLinux="$(curl -s https://download.todesktop.com/2003241lzgn20jd/latest-linux.yml)"
+        version="$(echo "$latestLinux" | yq -r .version)"
+        filename="$(echo "$latestLinux" | yq -r '.files[] | .url | select(. | endswith(".AppImage"))')"
+        update-source-version beeper "$version" "" "https://download.todesktop.com/2003241lzgn20jd/$filename" --source-key=src.src
+      '';
+    });
+  };
+
  meta = with lib; {
    description = "Universal chat app.";
    longDescription = ''
@ -53,7 +77,7 @@ mkDerivation rec {
    '';
    homepage = "https://beeper.com";
    license = licenses.unfree;
-    maintainers = with maintainers; [ jshcmpbll ];
+    maintainers = with maintainers; [ jshcmpbll mjm ];
    platforms = [ "x86_64-linux" ];
  };
 }
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/generic.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/generic.nix
@ -159,7 +159,7 @@ stdenv.mkDerivation rec {
    # Fix the desktop link and fix showing application icon in tray
    substituteInPlace $out/share/applications/${pname}.desktop \
      --replace "/opt/${dir}/${pname}" $out/bin/${pname} \
-      --replace "bin/signal-desktop" "bin/signal-desktop --use-tray-icon"
+      ${if pname == "signal-desktop" then "--replace \"bin/signal-desktop\" \"bin/signal-desktop --use-tray-icon\"" else ""}

    autoPatchelf --no-recurse -- "$out/lib/${dir}/"
    patchelf --add-needed ${libpulseaudio}/lib/libpulse.so "$out/lib/${dir}/resources/app.asar.unpacked/node_modules/@signalapp/ringrtc/build/linux/libringrtc-x64.node"
--- a/pkgs/applications/networking/kubo/default.nix
+++ b/pkgs/applications/networking/kubo/default.nix
@ -6,15 +6,15 @@

 buildGoModule rec {
  pname = "kubo";
-  version = "0.22.0"; # When updating, also check if the repo version changed and adjust repoVersion below
+  version = "0.23.0"; # When updating, also check if the repo version changed and adjust repoVersion below
  rev = "v${version}";

-  passthru.repoVersion = "14"; # Also update kubo-migrator when changing the repo version
+  passthru.repoVersion = "15"; # Also update kubo-migrator when changing the repo version

  # Kubo makes changes to its source tarball that don't match the git source.
  src = fetchurl {
    url = "https://github.com/ipfs/kubo/releases/download/${rev}/kubo-source.tar.gz";
-    hash = "sha256-TX5ZM8Kyj3LZ12Ro7MsHRd+P5XLk/mU7DUxZaopSEV0=";
+    hash = "sha256-ycXn8h8sFGJXVMldneN51lZgXoPaZ/XeXLtqqJ4w6H0=";
  };

  # tarball contains multiple files/directories
@ -37,9 +37,9 @@ buildGoModule rec {

  postPatch = ''
    substituteInPlace 'misc/systemd/ipfs.service' \
-      --replace '/usr/bin/ipfs' "$out/bin/ipfs"
+      --replace '/usr/local/bin/ipfs' "$out/bin/ipfs"
    substituteInPlace 'misc/systemd/ipfs-hardened.service' \
-      --replace '/usr/bin/ipfs' "$out/bin/ipfs"
+      --replace '/usr/local/bin/ipfs' "$out/bin/ipfs"
  '';

  postInstall = ''
--- a/pkgs/applications/networking/mullvad-vpn/default.nix
+++ b/pkgs/applications/networking/mullvad-vpn/default.nix
@ -64,7 +64,7 @@ let
    systemd
  ];

-  version = "2023.4";
+  version = "2023.5";

  selectSystem = attrs: attrs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");

@ -74,8 +74,8 @@ let
  };

  hash = selectSystem {
-    x86_64-linux = "sha256-7NoifrX1/3pUJHTYK+2dVos/oFsKiYwyhCGi07SsEhM=";
-    aarch64-linux = "sha256-e0lp+SpBUmtYBcJPvql8ALeCkVtneZ1Cd3IFMVX6R2Q=";
+    x86_64-linux = "sha256-FpVruI80PmpBo2JrMvgvOg7ou6LceTeit9HbWKgcPa4=";
+    aarch64-linux = "sha256-NlYh8K5Xbad4xSoZ02yC5fh3SrQzyNyS9uoA73REcpo=";
  };
 in

--- a/pkgs/applications/networking/nali/default.nix
+++ b/pkgs/applications/networking/nali/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "nali";
-  version = "0.7.3";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "zu1k";
    repo = "nali";
    rev = "v${version}";
-    sha256 = "sha256-ZKLxsq7ybom96NKWkioROAVXUoY20zFBZn7ksk4XvT4=";
+    sha256 = "sha256-JIP0QX1okCfDj2Y6wZ5TaV3QH0WP3oU3JjaKK6vMfWY=";
  };

-  vendorHash = "sha256-l3Fs1Hd0kXI56uotic1407tb4ltkCSMzqqozFpvobH8=";
+  vendorHash = "sha256-wIp/ShUddz+RIcsEuKWUfxsV/wNB2X1jZtIltBZ0ROM=";
  subPackages = [ "." ];

  nativeBuildInputs = [ installShellFiles ];
--- a/pkgs/applications/office/qownnotes/default.nix
+++ b/pkgs/applications/office/qownnotes/default.nix
@ -19,14 +19,14 @@
 let
  pname = "qownnotes";
  appname = "QOwnNotes";
-  version = "23.10.0";
+  version = "23.10.1";
 in
 stdenv.mkDerivation {
  inherit pname appname version;

  src = fetchurl {
    url = "https://github.com/pbek/QOwnNotes/releases/download/v${version}/qownnotes-${version}.tar.xz";
-    hash = "sha256-wPZrKAWaWv88BeVu6e73b9/Ydo0ew4GLig46fyNSxtc=";
+    hash = "sha256-+BtzN+CdaxriA466m6aF0y7Jdvx1DGtSR+i6gGeAxSM=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/radio/uhd/default.nix
+++ b/pkgs/applications/radio/uhd/default.nix
@ -49,9 +49,11 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "uhd";
-  # UHD seems to use three different version number styles: x.y.z, xxx_yyy_zzz
-  # and xxx.yyy.zzz. Hrmpf... style keeps changing
-  version = "4.4.0.0";
+  # NOTE: Use the following command to update the package, and the uhdImageSrc attribute:
+  #
+  #     nix-shell maintainers/scripts/update.nix --argstr package uhd --argstr commit true
+  #
+  version = "4.5.0.0";

  outputs = [ "out" "dev" ];

@ -59,14 +61,24 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "EttusResearch";
    repo = "uhd";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-khVOHlvacZc4EMg4m55rxEqPvLY1xURpAfOW905/3jg=";
+    # The updateScript relies on the `src` using `hash`, and not `sha256. To
+    # update the correct hash for the `src` vs the `uhdImagesSrc`
+    hash = "sha256-0EqMBaQiNr8PE542YNkPvX3o1HhnhrO0Kz1euphY6Ps=";
  };
  # Firmware images are downloaded (pre-built) from the respective release on Github
  uhdImagesSrc = fetchurl {
    url = "https://github.com/EttusResearch/uhd/releases/download/v${finalAttrs.version}/uhd-images_${finalAttrs.version}.tar.xz";
-    sha256 = "V8ldW8bvYWbrDAvpWpHcMeLf9YvF8PIruDAyNK/bru4=";
+    # Please don't convert this to a hash, in base64, see comment near src's
+    # hash.
+    sha256 = "13cn41wv7vldk4vx7vy3jbb3wb3a5vpfg3ay893klpi6vzxc1dly";
+  };
+  passthru = {
+    updateScript = [
+      ./update.sh
+      # Pass it this file name as argument
+      (builtins.unsafeGetAttrPos "pname" finalAttrs.finalPackage).file
+    ];
  };
-  # TODO: Add passthru.updateScript that will update both of the above hashes...

  cmakeFlags = [
    "-DENABLE_LIBUHD=ON"
--- a/pkgs/applications/radio/uhd/update.sh
+++ b/pkgs/applications/radio/uhd/update.sh
@ -0,0 +1,27 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p jq nix nix-prefetch-github
+
+set -euo pipefail
+echoerr() { echo "$@" 1>&2; }
+
+fname="$1"
+echoerr got fname $fname
+shift
+latest_release=$(curl --silent https://api.github.com/repos/EttusResearch/uhd/releases/latest)
+version=$(jq -r '.tag_name' <<<"$latest_release" | cut -c2-)
+# Update version, if needed
+if grep -q 'version = "'$version $fname; then
+    echoerr Current version $version is the latest available
+    exit 0;
+fi
+echoerr got version $version
+sed -i -E 's/(version = ").*(";)/\1'$version'\2/g' $fname
+# Verify the sed command above did not fail
+grep -q $version $fname
+# Update srcHash
+srcHash="$(nix-prefetch-github EttusResearch uhd --rev v${version} | jq --raw-output .hash)"
+sed -i -E 's#(hash = ").*(";)#\1'$srcHash'\2#g' $fname
+grep -q $srcHash $fname
+imageHash="$(nix-prefetch-url https://github.com/EttusResearch/uhd/releases/download/v${version}/uhd-images_${version}.tar.xz)"
+sed -i -E 's#(sha256 = ").*(";)#\1'$imageHash'\2#g' $fname
+grep -q $imageHash $fname
--- a/pkgs/applications/science/biology/blast/bin.nix
+++ b/pkgs/applications/science/biology/blast/bin.nix
@ -13,20 +13,20 @@
 }:
 let
  pname = "blast-bin";
-  version = "2.13.0";
+  version = "2.14.1";

  srcs = rec {
    x86_64-linux = fetchurl {
      url = "https://ftp.ncbi.nlm.nih.gov/blast/executables/blast+/${version}/ncbi-blast-${version}+-x64-linux.tar.gz";
-      hash = "sha256-QPK3OdT++GoNI1NHyEpu2/hB2hqHYPQ/vNXFAVCwVEc=";
+      hash = "sha256-OO8MNOk6k0J9FlAGyCOhP+hirEIT6lL+rIInB8dQWEU=";
    };
    aarch64-linux = fetchurl {
-      url = "https://ftp.ncbi.nlm.nih.gov/blast/executables/blast+/${version}/ncbi-blast-${version}+-x64-arm-linux.tar.gz";
-      hash = "sha256-vY8K66k7KunpBUjFsJTTb+ur5n1XmU0/mYxhZsi9ycs=";
+      url = "https://ftp.ncbi.nlm.nih.gov/blast/executables/blast+/${version}/ncbi-blast-${version}+-aarch64-linux.tar.gz";
+      hash = "sha256-JlOyoxZQBbvUcHIMv5muTuGQgrh2uom3rzDurhHQ+FM=";
    };
    x86_64-darwin = fetchurl {
      url = "https://ftp.ncbi.nlm.nih.gov/blast/executables/blast+/${version}/ncbi-blast-${version}+-x64-macosx.tar.gz";
-      hash = "sha256-Y0JlOUl9Ego6LTxTCNny3P5c1H3fApPXQm7Z6Zhq9RA=";
+      hash = "sha256-eMfuwMCD6VlDgeshLslDhYBBp0YOpL+6q/zSchR0bAs=";
    };
    aarch64-darwin = x86_64-darwin;
  };
@ -55,6 +55,7 @@ stdenv.mkDerivation {
  meta = with lib; {
    inherit (blast.meta) description homepage license;
    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
    maintainers = with maintainers; [ natsukium ];
  };
 }
--- a/pkgs/applications/science/chemistry/gwyddion/default.nix
+++ b/pkgs/applications/science/chemistry/gwyddion/default.nix
@ -21,10 +21,10 @@ in

 stdenv.mkDerivation rec {
  pname = "gwyddion";
-   version = "2.61";
+   version = "2.63";
  src = fetchurl {
    url = "mirror://sourceforge/gwyddion/gwyddion-${version}.tar.xz";
-    sha256 = "sha256-rDhYVMDTH9mSu90HZAX8ap4HF//8fYhW/ozzJdIrUgo=";
+    sha256 = "sha256-FSs/Dbnr1shEw/W51DhUFPb61tM+0atc6wxY81EiTdM=";
  };

  nativeBuildInputs = [ pkg-config file ];
--- a/pkgs/applications/science/chemistry/marvin/default.nix
+++ b/pkgs/applications/science/chemistry/marvin/default.nix
@ -4,12 +4,12 @@ with lib;

 stdenv.mkDerivation rec {
  pname = "marvin";
-  version = "23.4.0";
+  version = "23.12.0";

  src = fetchurl {
    name = "marvin-${version}.deb";
    url = "http://dl.chemaxon.com/marvin/${version}/marvin_linux_${versions.majorMinor version}.deb";
-    sha256 = "sha256-+jzGcuAcbXOwsyAL+Hr9Fas2vO2S8ZKSaZeCf/bnl7A=";
+    hash = "sha256-5ycOteXcdgZaeDl3WQ95H2lD0OnnobCbmnVlfYwVdeI=";
  };

  nativeBuildInputs = [ dpkg makeWrapper ];
--- a/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
+++ b/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
@ -27,6 +27,10 @@ in stdenv.mkDerivation rec {
    sha256 = "sha256-vOFIByfksruQBBO3XZmjJm81B4d9pPWy1JHfeY+fza4=";
  };

+  patches = [ ./pkgconfig.patch ];
+
+  outputs = [ "out" "dev" "man" ];
+
  nativeBuildInputs = [ cmake ];

  buildInputs = [
@ -64,10 +68,8 @@ in stdenv.mkDerivation rec {
     ]
  ) ++ lib.optional enableCuda "-DGMX_GPU=CUDA";

-  postFixup = ''
-    substituteInPlace "$out"/lib/pkgconfig/*.pc \
-      --replace '=''${prefix}//' '=/' \
-      --replace "$out/$out/" "$out/"
+  postInstall = ''
+    moveToOutput share/cmake $dev
  '';

  meta = with lib; {
--- a/pkgs/applications/science/molecular-dynamics/gromacs/pkgconfig.patch
+++ b/pkgs/applications/science/molecular-dynamics/gromacs/pkgconfig.patch
@ -0,0 +1,24 @@
+diff --git a/src/external/muparser/muparser.pc.in b/src/external/muparser/muparser.pc.in
+index 646787cb53..9b97ad57f7 100644
+--- a/src/external/muparser/muparser.pc.in
+++ b/src/external/muparser/muparser.pc.in
+@@ -1,7 +1,5 @@
+-prefix=@CMAKE_INSTALL_PREFIX@
+-exec_prefix=${prefix}
+-libdir=${prefix}/@CMAKE_INSTALL_LIBDIR@
+-includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@
+libdir=@CMAKE_INSTALL_FULL_LIBDIR@
+includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@
+ 
+ Name: @PACKAGE_NAME@
+ Description: Mathematical expressions parser library
+diff --git a/src/gromacs/libgromacs.pc.cmakein b/src/gromacs/libgromacs.pc.cmakein
+index ec1ed6684e..ca1105474a 100644
+--- a/src/gromacs/libgromacs.pc.cmakein
+++ b/src/gromacs/libgromacs.pc.cmakein
+@@ -1,4 +1,4 @@
+-libdir=@CMAKE_INSTALL_PREFIX@/@CMAKE_INSTALL_LIBDIR@
+libdir=@CMAKE_INSTALL_FULL_LIBDIR@
+ 
+ Name: libgromacs@GMX_LIBS_SUFFIX@
+ Description: Gromacs library
--- a/pkgs/applications/version-management/git-mit/default.nix
+++ b/pkgs/applications/version-management/git-mit/default.nix
@ -10,7 +10,7 @@
 }:

 let
-  version = "5.12.157";
+  version = "5.12.158";
 in
 rustPlatform.buildRustPackage {
  pname = "git-mit";
@ -20,10 +20,10 @@ rustPlatform.buildRustPackage {
    owner = "PurpleBooth";
    repo = "git-mit";
    rev = "v${version}";
-    hash = "sha256-Okb+HOCgtGLKSbhmhwA63BxS43ulZlSkHDOPsYzO2ZE=";
+    hash = "sha256-vMrIkM8ShfaSrIEFiY6Jiwo8/6LMrjlqpD1B8DNtWcI=";
  };

-  cargoHash = "sha256-I3sP6nhjMBXnANRrPT3+3HlY62TvfX6lFea7tHefOV8=";
+  cargoHash = "sha256-kdXnj1O9AWFwFWQwZ6QPe5ePlxjr/F68vJEpAZgph6I=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/applications/video/obs-studio/plugins/obs-move-transition.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-move-transition.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "obs-move-transition";
-  version = "2.9.4";
+  version = "2.9.5";

  src = fetchFromGitHub {
    owner = "exeldro";
    repo = "obs-move-transition";
    rev = version;
-    sha256 = "sha256-TY+sR7IaOlbFeeh7GL5dgM779pcpiCqzBo7VTK8Uz0E=";
+    sha256 = "sha256-7qgFUZmKldIfnUXthzWd07CtOmaJROnqCGnzjlZlN3E=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/video/obs-studio/plugins/obs-vkcapture.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-vkcapture.nix
@ -20,13 +20,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "obs-vkcapture";
-  version = "1.4.3";
+  version = "1.4.4";

  src = fetchFromGitHub {
    owner = "nowrep";
    repo = finalAttrs.pname;
    rev = "v${finalAttrs.version}";
-    hash = "sha256-hFweWZalWMGbGXhM6uxaGoWkr9srqxRChJo5yUBiBXs=";
+    hash = "sha256-sDgYHa6zwUsGAinWptFeeaTG5n9t7SCLYgjDurdMT6g=";
  };

  cmakeFlags = lib.optionals stdenv.isi686 [
--- a/pkgs/applications/video/youtube-tui/Cargo.lock
+++ b/pkgs/applications/video/youtube-tui/Cargo.lock
--- a/pkgs/applications/video/youtube-tui/default.nix
+++ b/pkgs/applications/video/youtube-tui/default.nix
@ -7,24 +7,29 @@
 , stdenv
 , python3
 , libsixel
+, mpv
 , CoreFoundation
 , Security
 , AppKit
-,
 }:

 rustPlatform.buildRustPackage rec {
  pname = "youtube-tui";
-  version = "0.7.4";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "Siriusmart";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-UN70V+RGYlYJxCQGPH8cnQDSqpihGuwzETYEhbG6Ggo=";
+    hash = "sha256-FOiK3yQcQuwdCEjBtRPW4iBd+8uNsvZ6l5tclHVzL+M=";
  };

-  cargoHash = "sha256-kAhxsSFIJAoKlmN7hVUoTSSHQ2G23f21rEvxcIRQ+kw=";
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "libmpv-2.0.1" = "sha256-efbXk0oXkzlIqgbP4wKm7sWlVZBT2vzDSN3iwsw2vL0=";
+    };
+  };

  nativeBuildInputs = [
    pkg-config
@ -35,6 +40,7 @@ rustPlatform.buildRustPackage rec {
    openssl
    xorg.libxcb
    libsixel
+    mpv
  ] ++ lib.optionals stdenv.isDarwin [
    CoreFoundation
    Security
--- a/pkgs/applications/virtualization/firecracker/default.nix
+++ b/pkgs/applications/virtualization/firecracker/default.nix
@ -1,7 +1,7 @@
 { fetchurl, lib, stdenv }:

 let
-  version = "1.4.0";
+  version = "1.5.0";
  # nixpkgs-update: no auto update

  suffix = {
@ -23,8 +23,8 @@ stdenv.mkDerivation {

  sourceRoot = ".";
  src = dlbin {
-    x86_64-linux = "sha256-WSa8fd0OSPo1HFkH6i8cGMNH1df88xI6PCx39ONb73c=";
-    aarch64-linux = "sha256-eOsO/nbwKT50tC5g6INPELh2yVb5C3EGqNLQLT7IGBs=";
+    x86_64-linux = "sha256-TzNPWcLDKOv12eJ9PHckdJ7tfdlozPoXj2fbdOzHfAk=";
+    aarch64-linux = "sha256-cHNMfcoHCBw+BnWx9USny8jyvH97gXCCJW1aKvPXgCs=";
  };

  dontConfigure = true;
@ -50,6 +50,8 @@ stdenv.mkDerivation {
  meta = with lib; {
    description = "Secure, fast, minimal micro-container virtualization";
    homepage = "http://firecracker-microvm.io";
+    changelog = "https://github.com/firecracker-microvm/firecracker/releases/tag/v${version}";
+    mainProgram = "firecracker";
    license = licenses.asl20;
    platforms = [ "x86_64-linux" "aarch64-linux" ];
    maintainers = with maintainers; [ thoughtpolice endocrimes ];
--- a/pkgs/build-support/build-graalvm-native-image/default.nix
+++ b/pkgs/build-support/build-graalvm-native-image/default.nix
@ -13,6 +13,7 @@
 , nativeImageBuildArgs ? [
    (lib.optionalString stdenv.isDarwin "-H:-CheckToolchain")
    "-H:Name=${executable}"
+    "-march=compatibility"
    "--verbose"
  ]
  # Extra arguments to be passed to the native-image
--- a/pkgs/build-support/kernel/make-initrd-ng/Cargo.lock
+++ b/pkgs/build-support/kernel/make-initrd-ng/Cargo.lock
@ -2,12 +2,6 @@
 # It is not intended for manual editing.
 version = 3

-[[package]]
-name = "cfg-if"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
-
 [[package]]
 name = "eyre"
 version = "0.6.8"
@ -20,9 +14,9 @@ dependencies = [

 [[package]]
 name = "goblin"
-version = "0.5.3"
+version = "0.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91766b1121940d622933a13e20665857648681816089c9bc2075c4b75a6e4f6b"
+checksum = "a7666983ed0dd8d21a6f6576ee00053ca0926fb281a5522577a4dbd0f1b54143"
 dependencies = [
 "log",
 "plain",
@ -37,12 +31,9 @@ checksum = "ce23b50ad8242c51a442f3ff322d56b02f08852c77e4c0b4d3fd684abc89c683"

 [[package]]
 name = "log"
-version = "0.4.17"
+version = "0.4.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "abb12e687cfb44aa40f41fc3978ef76448f9b6038cad6aef4259d3c095a2382e"
-dependencies = [
- "cfg-if",
-]
+checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"

 [[package]]
 name = "make-initrd-ng"
@ -54,9 +45,9 @@ dependencies = [

 [[package]]
 name = "once_cell"
-version = "1.17.1"
+version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7e5500299e16ebb147ae15a00a942af264cf3688f47923b8fc2cd5858f23ad3"
+checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"

 [[package]]
 name = "plain"
@ -66,18 +57,18 @@ checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"

 [[package]]
 name = "proc-macro2"
-version = "1.0.42"
+version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c278e965f1d8cf32d6e0e96de3d3e79712178ae67986d9cf9151f51e95aac89b"
+checksum = "134c189feb4956b20f6f547d2cf727d4c0fe06722b20a0eec87ed445a97f92da"
 dependencies = [
 "unicode-ident",
 ]

 [[package]]
 name = "quote"
-version = "1.0.20"
+version = "1.0.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3bcdf212e9776fbcb2d23ab029360416bb1706b1aea2d1a5ba002727cbcab804"
+checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
 dependencies = [
 "proc-macro2",
 ]
@ -93,9 +84,9 @@ dependencies = [

 [[package]]
 name = "scroll_derive"
-version = "0.11.0"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bdbda6ac5cd1321e724fa9cee216f3a61885889b896f073b8f82322789c5250e"
+checksum = "1db149f81d46d2deba7cd3c50772474707729550221e69588478ebf9ada425ae"
 dependencies = [
 "proc-macro2",
 "quote",
@ -104,9 +95,9 @@ dependencies = [

 [[package]]
 name = "syn"
-version = "1.0.98"
+version = "2.0.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c50aef8a904de4c23c788f104b7dddc7d6f79c647c7c8ce4cc8f73eb0ca773dd"
+checksum = "e96b79aaa137db8f61e26363a0c9b47d8b4ec75da28b7d1d614c2303e232408b"
 dependencies = [
 "proc-macro2",
 "quote",
@ -115,6 +106,6 @@ dependencies = [

 [[package]]
 name = "unicode-ident"
-version = "1.0.2"
+version = "1.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15c61ba63f9235225a22310255a29b806b907c9b8c964bcbd0a2c70f3f2deea7"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
--- a/pkgs/build-support/node/fetch-npm-deps/Cargo.lock
+++ b/pkgs/build-support/node/fetch-npm-deps/Cargo.lock
@ -4,24 +4,24 @@ version = 3

 [[package]]
 name = "aho-corasick"
-version = "1.0.2"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43f6cb1bf222025340178f382c426f13757b2960e89779dfcb319c32542a5a41"
+checksum = "b2969dcb958b36655471fc61f7e416fa76033bdd4bfed0678d8fee1e2d07a1f0"
 dependencies = [
 "memchr",
 ]

 [[package]]
 name = "anyhow"
-version = "1.0.71"
+version = "1.0.75"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c7d0618f0e0b7e8ff11427422b64564d5fb0be1940354bfe2e0529b18a9d9b8"
+checksum = "a4668cab20f66d8d020e1fbc0ebe47217433c1b6c8f2040faf858554e394ace6"

 [[package]]
 name = "async-channel"
-version = "1.8.0"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf46fee83e5ccffc220104713af3292ff9bc7c64c7de289f66dae8e38d826833"
+checksum = "81953c529336010edd6d8e358f886d9581267795c61b19475b71314bffa46d35"
 dependencies = [
 "concurrent-queue",
 "event-listener",
@ -47,9 +47,9 @@ dependencies = [

 [[package]]
 name = "base64"
-version = "0.21.2"
+version = "0.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "604178f6c5c21f02dc555784810edfb88d34ac2c73b2eae109655649ee73ce3d"
+checksum = "9ba43ea6f343b788c8764558649e08df62f86c6ef251fdaeb1ffd010a9ae50a2"

 [[package]]
 name = "bitflags"
@ -59,9 +59,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"

 [[package]]
 name = "bitflags"
-version = "2.3.3"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "630be753d4e58660abd17930c71b647fe46c27ea6b63cc59e1e3851406972e42"
+checksum = "b4682ae6287fcf752ecaabbfcc7b6f9b72aa33933dc23a554d853aea8eea8635"

 [[package]]
 name = "block-buffer"
@ -74,9 +74,9 @@ dependencies = [

 [[package]]
 name = "bytes"
-version = "1.4.0"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89b2fd2a0dcf38d7971e2194b6b6eebab45ae01067456a7fd93d5547a61b70be"
+checksum = "a2bd12c1caf447e69cd4528f47f94d203fd2582878ecb9e9465484c4148a8223"

 [[package]]
 name = "castaway"
@ -86,9 +86,12 @@ checksum = "a2698f953def977c68f935bb0dfa959375ad4638570e969e2f1e9f433cbf1af6"

 [[package]]
 name = "cc"
-version = "1.0.79"
+version = "1.0.83"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50d30906286121d95be3d479533b458f87493b30a4b5f79a607db8f5d11aa91f"
+checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
+dependencies = [
+ "libc",
+]

 [[package]]
 name = "cfg-if"
@ -98,32 +101,22 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"

 [[package]]
 name = "concurrent-queue"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62ec6771ecfa0762d24683ee5a32ad78487a3d3afdc0fb8cae19d2c5deb50b7c"
+checksum = "f057a694a54f12365049b0958a1685bb52d567f5593b355fbf685838e873d400"
 dependencies = [
 "crossbeam-utils",
 ]

 [[package]]
 name = "cpufeatures"
-version = "0.2.8"
+version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03e69e28e9f7f77debdedbaafa2866e1de9ba56df55a8bd7cfc724c25a09987c"
+checksum = "a17b76ff3a4162b0b27f354a0c87015ddad39d35f9c0c36607a3bdd175dde1f1"
 dependencies = [
 "libc",
 ]

-[[package]]
-name = "crossbeam-channel"
-version = "0.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a33c2bf77f2df06183c3aa30d1e96c0695a313d4f9c453cc3762a6db39f99200"
-dependencies = [
- "cfg-if",
- "crossbeam-utils",
-]
-
 [[package]]
 name = "crossbeam-deque"
 version = "0.8.3"
@ -184,9 +177,9 @@ dependencies = [

 [[package]]
 name = "curl-sys"
-version = "0.4.63+curl-8.1.2"
+version = "0.4.67+curl-8.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aeb0fef7046022a1e2ad67a004978f0e3cacb9e3123dc62ce768f92197b771dc"
+checksum = "3cc35d066510b197a0f72de863736641539957628c8a42e70e27c66849e77c34"
 dependencies = [
 "cc",
 "libc",
@ -194,7 +187,7 @@ dependencies = [
 "openssl-sys",
 "pkg-config",
 "vcpkg",
- "winapi",
+ "windows-sys",
 ]

 [[package]]
@ -209,9 +202,9 @@ dependencies = [

 [[package]]
 name = "either"
-version = "1.8.1"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fcaabb2fef8c910e7f4c7ce9f67a1283a1715879a7c230ca9d6d1ae31f16d91"
+checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"

 [[package]]
 name = "env_logger"
@ -228,25 +221,14 @@ dependencies = [

 [[package]]
 name = "errno"
-version = "0.3.1"
+version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bcfec3a70f97c962c307b2d2c56e358cf1d00b558d74262b5f929ee8cc7e73a"
+checksum = "ac3e13f66a2f95e32a39eaa81f6b95d42878ca0e1db0c7543723dfe12557e860"
 dependencies = [
- "errno-dragonfly",
 "libc",
 "windows-sys",
 ]

-[[package]]
-name = "errno-dragonfly"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa68f1b12764fab894d2755d2518754e71b4fd80ecfb822714a1206c2aab39bf"
-dependencies = [
- "cc",
- "libc",
-]
-
 [[package]]
 name = "event-listener"
 version = "2.5.3"
@ -262,6 +244,12 @@ dependencies = [
 "instant",
 ]

+[[package]]
+name = "fastrand"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25cbce373ec4653f1a01a31e8a5e5ec0c622dc27ff9c4e6606eefef5cbbed4a5"
+
 [[package]]
 name = "fnv"
 version = "1.0.7"
@ -295,7 +283,7 @@ version = "1.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "49a9d51ce47660b1e808d3c990b4709f2f415d928835a17dfd16991515c46bce"
 dependencies = [
- "fastrand",
+ "fastrand 1.9.0",
 "futures-core",
 "futures-io",
 "memchr",
@ -327,9 +315,9 @@ dependencies = [

 [[package]]
 name = "hermit-abi"
-version = "0.3.2"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "443144c8cdadd93ebf52ddb4056d257f5b52c04d3c804e657d19eb73fc33668b"
+checksum = "d77f7ec81a6d05a3abb01ab6eb7590f6083d08449fe5a1c8b1e620283546ccb7"

 [[package]]
 name = "http"
@ -367,25 +355,14 @@ dependencies = [
 "cfg-if",
 ]

-[[package]]
-name = "io-lifetimes"
-version = "1.0.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eae7b9aee968036d54dce06cebaefd919e4472e753296daccd6d344e3e2df0c2"
-dependencies = [
- "hermit-abi",
- "libc",
- "windows-sys",
-]
-
 [[package]]
 name = "is-terminal"
-version = "0.4.8"
+version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24fddda5af7e54bf7da53067d6e802dbcc381d0a8eef629df528e3ebf68755cb"
+checksum = "cb0889898416213fab133e1d33a0e5858a48177452750691bde3666d0fdbaf8b"
 dependencies = [
 "hermit-abi",
- "rustix 0.38.2",
+ "rustix",
 "windows-sys",
 ]

@ -416,21 +393,21 @@ dependencies = [

 [[package]]
 name = "itoa"
-version = "1.0.8"
+version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62b02a5381cc465bd3041d84623d0fa3b66738b52b8e2fc3bab8ad63ab032f4a"
+checksum = "af150ab688ff2122fcef229be89cb50dd66af9e01a4ff320cc137eecc9bacc38"

 [[package]]
 name = "libc"
-version = "0.2.147"
+version = "0.2.149"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4668fb0ea861c1df094127ac5f1da3409a82116a4ba74fca2e58ef927159bb3"
+checksum = "a08173bc88b7955d1b3145aa561539096c421ac8debde8cbc3612ec635fee29b"

 [[package]]
 name = "libz-sys"
-version = "1.1.9"
+version = "1.1.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56ee889ecc9568871456d42f603d6a0ce59ff328d291063a45cbdf0036baf6db"
+checksum = "d97137b25e321a73eef1418d1d5d2eda4d77e12813f8e6dead84bc52c5870a7b"
 dependencies = [
 "cc",
 "libc",
@ -440,27 +417,21 @@ dependencies = [

 [[package]]
 name = "linux-raw-sys"
-version = "0.3.8"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef53942eb7bf7ff43a617b3e2c1c4a5ecf5944a7c1bc12d7ee39bbb15e5c1519"
-
-[[package]]
-name = "linux-raw-sys"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09fc20d2ca12cb9f044c93e3bd6d32d523e6e2ec3db4f7b2939cd99026ecd3f0"
+checksum = "da2479e8c062e40bf0066ffa0bc823de0a9368974af99c9f6df941d2c231e03f"

 [[package]]
 name = "log"
-version = "0.4.19"
+version = "0.4.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b06a4cde4c0f271a446782e3eff8de789548ce57dbc8eca9292c27f4a42004b4"
+checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"

 [[package]]
 name = "memchr"
-version = "2.5.0"
+version = "2.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+checksum = "f665ee40bc4a3c5590afb1e9677db74a508659dfd71e126420da8274909a0167"

 [[package]]
 name = "memoffset"
@ -471,16 +442,6 @@ dependencies = [
 "autocfg",
 ]

-[[package]]
-name = "num_cpus"
-version = "1.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
-dependencies = [
- "hermit-abi",
- "libc",
-]
-
 [[package]]
 name = "once_cell"
 version = "1.18.0"
@ -495,9 +456,9 @@ checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"

 [[package]]
 name = "openssl-sys"
-version = "0.9.90"
+version = "0.9.93"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "374533b0e45f3a7ced10fcaeccca020e66656bc03dac384f852e4e5a7a8104a6"
+checksum = "db4d56a4c0478783083cfafcc42493dd4a981d41669da64b4572a2a089b51b1d"
 dependencies = [
 "cc",
 "libc",
@ -507,9 +468,9 @@ dependencies = [

 [[package]]
 name = "parking"
-version = "2.1.0"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14f2252c834a40ed9bb5422029649578e63aa341ac401f74e719dd1afda8394e"
+checksum = "e52c774a4c39359c1d1c52e43f73dd91a75a614652c825408eec30c95a9b2067"

 [[package]]
 name = "percent-encoding"
@ -519,18 +480,18 @@ checksum = "9b2a4787296e9989611394c33f193f676704af1686e70b8f8033ab5ba9a35a94"

 [[package]]
 name = "pin-project"
-version = "1.1.2"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "030ad2bc4db10a8944cb0d837f158bdfec4d4a4873ab701a95046770d11f8842"
+checksum = "fda4ed1c6c173e3fc7a83629421152e01d7b1f9b7f65fb301e490e8cfc656422"
 dependencies = [
 "pin-project-internal",
 ]

 [[package]]
 name = "pin-project-internal"
-version = "1.1.2"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec2e072ecce94ec471b13398d5402c188e76ac03cf74dd1a975161b23a3f6d9c"
+checksum = "4359fd9c9171ec6e8c62926d6faaf553a8dc3f64e1507e76da7911b4f6a04405"
 dependencies = [
 "proc-macro2",
 "quote",
@ -539,9 +500,9 @@ dependencies = [

 [[package]]
 name = "pin-project-lite"
-version = "0.2.10"
+version = "0.2.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c40d25201921e5ff0c862a505c6557ea88568a4e3ace775ab55e93f2f4f9d57"
+checksum = "8afb450f006bf6385ca15ef45d71d2288452bc3683ce2e2cacc0d18e4be60b58"

 [[package]]
 name = "pkg-config"
@ -593,18 +554,18 @@ dependencies = [

 [[package]]
 name = "proc-macro2"
-version = "1.0.63"
+version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b368fba921b0dce7e60f5e04ec15e565b3303972b42bcfde1d0713b881959eb"
+checksum = "134c189feb4956b20f6f547d2cf727d4c0fe06722b20a0eec87ed445a97f92da"
 dependencies = [
 "unicode-ident",
 ]

 [[package]]
 name = "quote"
-version = "1.0.29"
+version = "1.0.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "573015e8ab27661678357f27dc26460738fd2b6c86e46f386fde94cb5d913105"
+checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
 dependencies = [
 "proc-macro2",
 ]
@ -641,9 +602,9 @@ dependencies = [

 [[package]]
 name = "rayon"
-version = "1.7.0"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d2df5196e37bcc87abebc0053e20787d73847bb33134a69841207dd0a47f03b"
+checksum = "9c27db03db7734835b3f53954b534c91069375ce6ccaa2e065441e07d9b6cdb1"
 dependencies = [
 "either",
 "rayon-core",
@ -651,14 +612,12 @@ dependencies = [

 [[package]]
 name = "rayon-core"
-version = "1.11.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b8f95bd6966f5c87776639160a66bd8ab9895d9d4ab01ddba9fc60661aebe8d"
+checksum = "5ce3fb6ad83f861aac485e76e1985cd109d9a3713802152be56c3b1f0e0658ed"
 dependencies = [
- "crossbeam-channel",
 "crossbeam-deque",
 "crossbeam-utils",
- "num_cpus",
 ]

 [[package]]
@ -672,9 +631,21 @@ dependencies = [

 [[package]]
 name = "regex"
-version = "1.8.4"
+version = "1.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0ab3ca65655bb1e41f2a8c8cd662eb4fb035e67c3f78da1d61dffe89d07300f"
+checksum = "ebee201405406dbf528b8b672104ae6d6d63e6d118cb10e4d51abbc7b58044ff"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59b23e92ee4318893fa3fe3e6fb365258efbfe6ac6ab30f090cdcbb7aa37efa9"
 dependencies = [
 "aho-corasick",
 "memchr",
@ -683,42 +654,28 @@ dependencies = [

 [[package]]
 name = "regex-syntax"
-version = "0.7.2"
+version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "436b050e76ed2903236f032a59761c1eb99e1b0aead2c257922771dab1fc8c78"
+checksum = "dbb5fb1acd8a1a18b3dd5be62d25485eb770e05afb408a9627d14d451bae12da"

 [[package]]
 name = "rustix"
-version = "0.37.22"
+version = "0.38.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8818fa822adcc98b18fedbb3632a6a33213c070556b5aa7c4c8cc21cff565c4c"
+checksum = "5a74ee2d7c2581cd139b42447d7d9389b889bdaad3a73f1ebb16f2a3237bb19c"
 dependencies = [
- "bitflags 1.3.2",
- "errno",
- "io-lifetimes",
- "libc",
- "linux-raw-sys 0.3.8",
- "windows-sys",
-]
-
-[[package]]
-name = "rustix"
-version = "0.38.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aabcb0461ebd01d6b79945797c27f8529082226cb630a9865a71870ff63532a4"
-dependencies = [
- "bitflags 2.3.3",
+ "bitflags 2.4.0",
 "errno",
 "libc",
- "linux-raw-sys 0.4.3",
+ "linux-raw-sys",
 "windows-sys",
 ]

 [[package]]
 name = "ryu"
-version = "1.0.14"
+version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe232bdf6be8c8de797b22184ee71118d63780ea42ac85b61d1baa6d3b782ae9"
+checksum = "1ad4cc8da4ef723ed60bced201181d83791ad433213d8c24efffda1eec85d741"

 [[package]]
 name = "same-file"
@ -740,24 +697,24 @@ dependencies = [

 [[package]]
 name = "scopeguard"
-version = "1.1.0"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"

 [[package]]
 name = "serde"
-version = "1.0.166"
+version = "1.0.188"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d01b7404f9d441d3ad40e6a636a7782c377d2abdbe4fa2440e2edcc2f4f10db8"
+checksum = "cf9e0fcba69a370eed61bcf2b728575f726b50b55cba78064753d708ddc7549e"
 dependencies = [
 "serde_derive",
 ]

 [[package]]
 name = "serde_derive"
-version = "1.0.166"
+version = "1.0.188"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5dd83d6dde2b6b2d466e14d9d1acce8816dedee94f735eac6395808b3483c6d6"
+checksum = "4eca7ac642d82aa35b60049a6eccb4be6be75e599bd2e9adb5f875a737654af2"
 dependencies = [
 "proc-macro2",
 "quote",
@ -766,9 +723,9 @@ dependencies = [

 [[package]]
 name = "serde_json"
-version = "1.0.99"
+version = "1.0.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46266871c240a00b8f503b877622fe33430b3c7d963bdc0f2adc511e54a1eae3"
+checksum = "6b420ce6e3d8bd882e9b243c6eed35dbc9a6110c9769e74b584e0d68d1f20c65"
 dependencies = [
 "itoa",
 "ryu",
@ -777,9 +734,9 @@ dependencies = [

 [[package]]
 name = "sha1"
-version = "0.10.5"
+version = "0.10.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f04293dc80c3993519f2d7f6f511707ee7094fe0c6d3406feb330cdb3540eba3"
+checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
 dependencies = [
 "cfg-if",
 "cpufeatures",
@ -788,9 +745,9 @@ dependencies = [

 [[package]]
 name = "sha2"
-version = "0.10.7"
+version = "0.10.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "479fb9d862239e610720565ca91403019f2f00410f1864c5aa7479b950a76ed8"
+checksum = "793db75ad2bcafc3ffa7c68b215fee268f537982cd901d132f89c6343f3a3dc8"
 dependencies = [
 "cfg-if",
 "cpufeatures",
@ -799,9 +756,9 @@ dependencies = [

 [[package]]
 name = "slab"
-version = "0.4.8"
+version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6528351c9bc8ab22353f9d776db39a20288e8d6c37ef8cfe3317cf875eecfc2d"
+checksum = "8f92a496fb766b417c996b9c5e57daf2f7ad3b0bebe1ccfca4856390e3d3bb67"
 dependencies = [
 "autocfg",
 ]
@ -829,9 +786,9 @@ dependencies = [

 [[package]]
 name = "syn"
-version = "2.0.23"
+version = "2.0.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59fb7d6d8281a51045d62b8eb3a7d1ce347b76f312af50cd3dc0af39c87c1737"
+checksum = "e96b79aaa137db8f61e26363a0c9b47d8b4ec75da28b7d1d614c2303e232408b"
 dependencies = [
 "proc-macro2",
 "quote",
@ -840,23 +797,22 @@ dependencies = [

 [[package]]
 name = "tempfile"
-version = "3.6.0"
+version = "3.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31c0432476357e58790aaa47a8efb0c5138f137343f3b5f23bd36a27e3b0a6d6"
+checksum = "cb94d2f3cc536af71caac6b6fcebf65860b347e7ce0cc9ebe8f70d3e521054ef"
 dependencies = [
- "autocfg",
 "cfg-if",
- "fastrand",
+ "fastrand 2.0.1",
 "redox_syscall",
- "rustix 0.37.22",
+ "rustix",
 "windows-sys",
 ]

 [[package]]
 name = "termcolor"
-version = "1.2.0"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be55cf8942feac5c765c2c993422806843c9a9a45d4d5c407ad6dd2ea95eb9b6"
+checksum = "6093bad37da69aab9d123a8091e4be0aa4a03e4d601ec641c327398315f62b64"
 dependencies = [
 "winapi-util",
 ]
@ -921,9 +877,9 @@ dependencies = [

 [[package]]
 name = "typenum"
-version = "1.16.0"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "497961ef93d974e23eb6f433eb5fe1b7930b659f06d12dec6fc44a8f554c0bba"
+checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"

 [[package]]
 name = "unicode-bidi"
@ -933,9 +889,9 @@ checksum = "92888ba5573ff080736b3648696b70cafad7d250551175acbaa4e0385b3e1460"

 [[package]]
 name = "unicode-ident"
-version = "1.0.10"
+version = "1.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22049a19f4a68748a168c0fc439f9516686aa045927ff767eca0a85101fb6e73"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"

 [[package]]
 name = "unicode-normalization"
@ -948,9 +904,9 @@ dependencies = [

 [[package]]
 name = "url"
-version = "2.4.0"
+version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50bff7831e19200a85b17131d085c25d7811bc4e186efdaf54bbd132994a88cb"
+checksum = "143b538f18257fac9cad154828a57c6bf5157e1aa604d4816b5995bf6de87ae5"
 dependencies = [
 "form_urlencoded",
 "idna",
@ -972,15 +928,15 @@ checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"

 [[package]]
 name = "waker-fn"
-version = "1.1.0"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d5b2c62b4012a3e1eca5a7e077d13b3bf498c4073e33ccd58626607748ceeca"
+checksum = "f3c4517f54858c779bbcbf228f4fca63d121bf85fbecb2dc578cdf4a39395690"

 [[package]]
 name = "walkdir"
-version = "2.3.3"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "36df944cda56c7d8d8b7496af378e6b16de9284591917d307c9b4d313c44e698"
+checksum = "d71d857dc86794ca4c280d616f7da00d2dbfd8cd788846559a6813e6aa4b54ee"
 dependencies = [
 "same-file",
 "winapi-util",
@ -1010,9 +966,9 @@ checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"

 [[package]]
 name = "winapi-util"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
+checksum = "f29e6f9198ba0d26b4c9f07dbe6f9ed633e1f3d5b8b414090084349e46a52596"
 dependencies = [
 "winapi",
 ]
@ -1034,9 +990,9 @@ dependencies = [

 [[package]]
 name = "windows-targets"
-version = "0.48.1"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05d4b17490f70499f20b9e791dcf6a299785ce8af4d709018206dc5b4953e95f"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
 dependencies = [
 "windows_aarch64_gnullvm",
 "windows_aarch64_msvc",
@ -1049,42 +1005,42 @@ dependencies = [

 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91ae572e1b79dba883e0d315474df7305d12f569b400fcf90581b06062f7e1bc"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"

 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2ef27e0d7bdfcfc7b868b317c1d32c641a6fe4629c171b8928c7b08d98d7cf3"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"

 [[package]]
 name = "windows_i686_gnu"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "622a1962a7db830d6fd0a69683c80a18fda201879f0f447f065a3b7467daa241"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"

 [[package]]
 name = "windows_i686_msvc"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4542c6e364ce21bf45d69fdd2a8e455fa38d316158cfd43b3ac1c5b1b19f8e00"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"

 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca2b8a661f7628cbd23440e50b05d705db3686f894fc9580820623656af974b1"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"

 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7896dbc1f41e08872e9d5e8f8baa8fdd2677f29468c4e156210174edc7f7b953"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"

 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a515f5799fe4961cb532f983ce2b23082366b898e52ffbce459c86f67c8378a"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
--- a/pkgs/build-support/node/fetch-npm-deps/Cargo.toml
+++ b/pkgs/build-support/node/fetch-npm-deps/Cargo.toml
@ -6,17 +6,17 @@ edition = "2021"
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

 [dependencies]
-anyhow = "1.0.71"
+anyhow = "1.0.75"
 backoff = "0.4.0"
-base64 = "0.21.2"
+base64 = "0.21.4"
 digest = "0.10.7"
 env_logger = "0.10.0"
 isahc = { version = "1.7.2", default_features = false }
-rayon = "1.7.0"
-serde = { version = "1.0.164", features = ["derive"] }
-serde_json = "1.0.99"
-sha1 = "0.10.5"
-sha2 = "0.10.7"
-tempfile = "3.6.0"
-url = { version = "2.4.0", features = ["serde"] }
-walkdir = "2.3.3"
+rayon = "1.8.0"
+serde = { version = "1.0.188", features = ["derive"] }
+serde_json = "1.0.107"
+sha1 = "0.10.6"
+sha2 = "0.10.8"
+tempfile = "3.8.0"
+url = { version = "2.4.1", features = ["serde"] }
+walkdir = "2.4.0"
--- a/pkgs/build-support/node/fetch-npm-deps/src/parse/mod.rs
+++ b/pkgs/build-support/node/fetch-npm-deps/src/parse/mod.rs
@ -4,7 +4,7 @@ use rayon::prelude::*;
 use serde_json::{Map, Value};
 use std::{
    fs,
-    io::{self, Read},
+    io::Write,
    process::{Command, Stdio},
 };
 use tempfile::{tempdir, TempDir};
@ -106,7 +106,7 @@ impl Package {

        let specifics = match get_hosted_git_url(&resolved)? {
            Some(hosted) => {
-                let mut body = util::get_url_with_retry(&hosted)?;
+                let body = util::get_url_body_with_retry(&hosted)?;

                let workdir = tempdir()?;

@ -120,7 +120,7 @@ impl Package {
                    .stdin(Stdio::piped())
                    .spawn()?;

-                io::copy(&mut body, &mut cmd.stdin.take().unwrap())?;
+                cmd.stdin.take().unwrap().write_all(&body)?;

                let exit = cmd.wait()?;

@ -154,13 +154,7 @@ impl Package {

    pub fn tarball(&self) -> anyhow::Result<Vec<u8>> {
        match &self.specifics {
-            Specifics::Registry { .. } => {
-                let mut body = Vec::new();
-
-                util::get_url_with_retry(&self.url)?.read_to_end(&mut body)?;
-
-                Ok(body)
-            }
+            Specifics::Registry { .. } => Ok(util::get_url_body_with_retry(&self.url)?),
            Specifics::Git { workdir } => Ok(Command::new("tar")
                .args([
                    "--sort=name",
--- a/pkgs/build-support/node/fetch-npm-deps/src/util.rs
+++ b/pkgs/build-support/node/fetch-npm-deps/src/util.rs
@ -4,7 +4,7 @@ use isahc::{
    Body, Request, RequestExt,
 };
 use serde_json::{Map, Value};
-use std::{env, path::Path};
+use std::{env, io::Read, path::Path};
 use url::Url;

 pub fn get_url(url: &Url) -> Result<Body, isahc::Error> {
@ -28,7 +28,7 @@ pub fn get_url(url: &Url) -> Result<Body, isahc::Error> {
    if let Some(host) = url.host_str() {
        if let Ok(npm_tokens) = env::var("NIX_NPM_TOKENS") {
            if let Ok(tokens) = serde_json::from_str::<Map<String, Value>>(&npm_tokens) {
-                if let Some(token) = tokens.get(host).and_then(|val| val.as_str()) {
+                if let Some(token) = tokens.get(host).and_then(serde_json::Value::as_str) {
                    request = request.header("Authorization", format!("Bearer {token}"));
                }
            }
@ -38,15 +38,23 @@ pub fn get_url(url: &Url) -> Result<Body, isahc::Error> {
    Ok(request.body(())?.send()?.into_body())
 }

-pub fn get_url_with_retry(url: &Url) -> Result<Body, isahc::Error> {
+pub fn get_url_body_with_retry(url: &Url) -> Result<Vec<u8>, isahc::Error> {
    retry(ExponentialBackoff::default(), || {
-        get_url(url).map_err(|err| {
-            if err.is_network() || err.is_timeout() {
-                backoff::Error::transient(err)
-            } else {
-                backoff::Error::permanent(err)
-            }
-        })
+        get_url(url)
+            .and_then(|mut body| {
+                let mut buf = Vec::new();
+
+                body.read_to_end(&mut buf)?;
+
+                Ok(buf)
+            })
+            .map_err(|err| {
+                if err.is_network() || err.is_timeout() {
+                    backoff::Error::transient(err)
+                } else {
+                    backoff::Error::permanent(err)
+                }
+            })
    })
    .map_err(|backoff_err| match backoff_err {
        backoff::Error::Permanent(err)
--- a/pkgs/by-name/ba/base16-shell-preview/package.nix
+++ b/pkgs/by-name/ba/base16-shell-preview/package.nix
--- a/pkgs/by-name/ba/bat/package.nix
+++ b/pkgs/by-name/ba/bat/package.nix
@ -4,27 +4,27 @@
 , fetchFromGitHub
 , pkg-config
 , less
-, Security
 , libiconv
 , installShellFiles
 , makeWrapper
+, darwin
 }:

 rustPlatform.buildRustPackage rec {
  pname = "bat";
-  version = "0.23.0";
+  version = "0.24.0";

  src = fetchFromGitHub {
    owner = "sharkdp";
    repo = "bat";
    rev = "v${version}";
-    hash = "sha256-cGHxB3Wp8yEcJBMtSOec6l7iBsMLhUtJ7nh5fijnWZs=";
+    hash = "sha256-1RjlJEmY/jMf0IYQbrWrT1CHFyiqgarOl72u9xjjQiQ=";
  };
-  cargoHash = "sha256-wZNdYGCLKD80gV1QUTgKsFSNYkbDubknPB3e6dsyEgs=";
+  cargoHash = "sha256-b7wNWdKQ4QLeCf7bNZRfzT9hD/D/oDglU7Xyb65IrGY=";

  nativeBuildInputs = [ pkg-config installShellFiles makeWrapper ];

-  buildInputs = lib.optionals stdenv.isDarwin [ Security libiconv ];
+  buildInputs = lib.optionals stdenv.isDarwin [ libiconv darwin.apple_sdk.frameworks.Security ];

  postInstall = ''
    installManPage $releaseDir/build/bat-*/out/assets/manual/bat.1
@ -38,7 +38,21 @@ rustPlatform.buildRustPackage rec {
      --prefix PATH : "${lib.makeBinPath [ less ]}"
  '';

-  checkFlags = [ "--skip=pager_more" "--skip=pager_most" ];
+  # Skip test cases which depends on `more`
+  checkFlags = [
+    "--skip=alias_pager_disable_long_overrides_short"
+    "--skip=config_read_arguments_from_file"
+    "--skip=env_var_bat_paging"
+    "--skip=pager_arg_override_env_noconfig"
+    "--skip=pager_arg_override_env_withconfig"
+    "--skip=pager_basic"
+    "--skip=pager_basic_arg"
+    "--skip=pager_env_bat_pager_override_config"
+    "--skip=pager_env_pager_nooverride_config"
+    "--skip=pager_more"
+    "--skip=pager_most"
+    "--skip=pager_overwrite"
+  ];

  doInstallCheck = true;
  installCheckPhase = ''
--- a/pkgs/by-name/cl/clarity-city/package.nix
+++ b/pkgs/by-name/cl/clarity-city/package.nix
@ -0,0 +1,33 @@
+{ lib, stdenvNoCC, fetchFromGitHub }:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "clarity-city";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "vmware";
+    repo = "clarity-city";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-1POSdd2ICnyNNmGadIujezNK8qvARD0kkLR4yWjs5kA=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 TrueType/*.ttf -t $out/share/fonts/truetype
+    install -Dm644 OpenType/*.otf -t $out/share/fonts/opentype
+    install -Dm644 Webfonts/EOT/*.eot -t $out/share/fonts/eot
+    install -Dm644 Webfonts/WOFF/*.woff -t $out/share/fonts/woff
+    install -Dm644 Webfonts/WOFF2/*.woff2 -t $out/share/fonts/woff2
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "An open source sans-serif typeface";
+    homepage = "https://github.com/vmware/clarity-city";
+    license = licenses.ofl;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ sagikazarmark ];
+  };
+})
--- a/pkgs/by-name/cl/clzip/package.nix
+++ b/pkgs/by-name/cl/clzip/package.nix
@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://www.nongnu.org/lzip/clzip.html";
    description = "C language version of lzip";
    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ rs0vere ];
+    maintainers = with maintainers; [ ];
    platforms = platforms.all;
  };
 })
--- a/pkgs/applications/emulators/dosbox-staging/default.nix
+++ b/pkgs/applications/emulators/dosbox-staging/default.nix
--- a/pkgs/by-name/ez/eza/package.nix
+++ b/pkgs/by-name/ez/eza/package.nix
@ -17,16 +17,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "eza";
-  version = "0.14.1";
+  version = "0.14.2";

  src = fetchFromGitHub {
    owner = "eza-community";
    repo = "eza";
    rev = "v${version}";
-    hash = "sha256-6Hb+Zt9brnmxVXVUPhJa6yh8fccrD56UXoCw/wZGowI=";
+    hash = "sha256-eST70KMdGgbTo4FNL3K5YGn9lwIGroG4y4ExKDb30hU=";
  };

-  cargoHash = "sha256-01LuDse7bbq8jT7q8P9ncyQUqCAXR9pK6GmsaDUNYck=";
+  cargoHash = "sha256-h5ooNR0IeXWyY6PuZM/bQLkX4F0eZsEY2eoIgo0nRFA=";

  nativeBuildInputs = [ cmake pkg-config installShellFiles pandoc ];
  buildInputs = [ zlib ]
--- a/pkgs/applications/terminal-emulators/germinal/default.nix
+++ b/pkgs/applications/terminal-emulators/germinal/default.nix
@ -1,29 +1,35 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
-, autoreconfHook
-, pkg-config
 , appstream-glib
+, autoreconfHook
 , dbus
 , pango
 , pcre2
+, pkg-config
 , tmux
 , vte
 , wrapGAppsHook
 , nixosTests
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "germinal";
  version = "26";

  src = fetchFromGitHub {
    owner = "Keruspe";
    repo = "Germinal";
-    rev = "v${version}";
-    sha256 = "sha256-HUi+skF4bJj5CY2cNTOC4tl7jhvpXYKqBx2rqKzjlo0=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-HUi+skF4bJj5CY2cNTOC4tl7jhvpXYKqBx2rqKzjlo0=";
  };

-  nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    wrapGAppsHook
+  ];
+
  buildInputs = [
    appstream-glib
    dbus
@ -48,11 +54,12 @@ stdenv.mkDerivation rec {

  passthru.tests.test = nixosTests.terminal-emulators.germinal;

-  meta = with lib; {
+  meta = {
    description = "A minimal terminal emulator";
    homepage = "https://github.com/Keruspe/Germinal";
-    license = with licenses; gpl3Plus;
-    platforms = with platforms; unix;
-    maintainers = with maintainers; [ AndersonTorres ];
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "germinal";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.unix;
  };
-}
+})
--- a/pkgs/applications/misc/haunt/default.nix
+++ b/pkgs/applications/misc/haunt/default.nix
@ -3,6 +3,7 @@
 , fetchurl
 , fetchpatch
 , autoreconfHook
+, callPackage
 , guile
 , guile-commonmark
 , guile-reader
@ -10,12 +11,12 @@
 , pkg-config
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "haunt";
  version = "0.2.6";

  src = fetchurl {
-    url = "https://files.dthompson.us/${pname}/${pname}-${version}.tar.gz";
+    url = "https://files.dthompson.us/haunt/haunt-${finalAttrs.version}.tar.gz";
    hash = "sha256-vPKLQ9hDJdimEAXwIBGgRRlefM8/77xFQoI+0J/lkNs=";
  };

@ -40,6 +41,7 @@ stdenv.mkDerivation rec {
    makeWrapper
    pkg-config
  ];
+
  buildInputs = [
    guile
    guile-commonmark
@ -55,14 +57,13 @@ stdenv.mkDerivation rec {
      --prefix GUILE_LOAD_COMPILED_PATH : "$out/${guile.siteCcacheDir}:$GUILE_LOAD_COMPILED_PATH"
  '';

-  doInstallCheck = true;
-  installCheckPhase = ''
-    runHook preInstallCheck
-    $out/bin/haunt --version
-    runHook postInstallCheck
-  '';
+  passthru = {
+    tests = {
+      expectVersion = callPackage ./tests/001-test-version.nix { };
+    };
+  };

-  meta = with lib; {
+  meta = {
    homepage = "https://dthompson.us/projects/haunt.html";
    description = "Guile-based static site generator";
    longDescription = ''
@ -81,8 +82,8 @@ stdenv.mkDerivation rec {
      feeds, authors should feel empowered to tweak, replace, or create builders
      to do things that aren't provided out-of-the-box.
    '';
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ AndersonTorres AluisioASG ];
-    platforms = guile.meta.platforms;
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ AndersonTorres AluisioASG ];
+    inherit (guile.meta) platforms;
  };
-}
+})
--- a/pkgs/by-name/ha/haunt/tests/001-test-version.nix
+++ b/pkgs/by-name/ha/haunt/tests/001-test-version.nix
@ -0,0 +1,21 @@
+{ lib
+, stdenv
+, haunt
+}:
+
+stdenv.mkDerivation {
+  pname = "haunt-test-version";
+  inherit (haunt) version;
+
+  nativeBuildInputs = [ haunt ];
+
+  dontInstall = true;
+
+  buildCommand = ''
+    haunt --version
+
+    touch $out
+  '';
+
+  meta.timeout = 10;
+}
--- a/pkgs/applications/terminal-emulators/havoc/default.nix
+++ b/pkgs/applications/terminal-emulators/havoc/default.nix
@ -3,19 +3,19 @@
 , fetchFromGitHub
 , libxkbcommon
 , pkg-config
+, wayland
 , wayland-protocols
 , wayland-scanner
-, wayland
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "havoc";
  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "ii8";
-    repo = pname;
-    rev = version;
+    repo = "havoc";
+    rev = finalAttrs.version;
    hash = "sha256-jvGm2gFdMS61otETF7gOEpYn6IuLfqI95IpEVfIv+C4=";
  };

@ -38,19 +38,19 @@ stdenv.mkDerivation rec {
  installFlags = [ "PREFIX=$$out" ];

  postInstall = ''
-    install -D -m 644 havoc.cfg -t $out/etc/${pname}/
-    install -D -m 644 README.md -t $out/share/doc/${pname}-${version}/
+    install -Dm 644 havoc.cfg -t $out/etc/havoc/
+    install -Dm 644 README.md -t $out/share/doc/havoc-${finalAttrs.version}/
  '';

  enableParallelBuilding = true;

-  meta = with lib; {
+  meta = {
    homepage = "https://github.com/ii8/havoc";
    description = "A minimal terminal emulator for Wayland";
-    license = with licenses; [ mit publicDomain ];
-    platforms = with platforms; unix;
-    maintainers = with maintainers; [ AndersonTorres ];
-    # fatal error: 'sys/epoll.h' file not found
-    broken = stdenv.isDarwin;
+    license = with lib.licenses; [ mit publicDomain ];
+    mainProgram = "havoc";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    inherit (wayland.meta) platforms;
+    broken = stdenv.isDarwin; # fatal error: 'sys/epoll.h' file not found
  };
-}
+})
--- a/pkgs/by-name/im/immersed-vr/package.nix
+++ b/pkgs/by-name/im/immersed-vr/package.nix
@ -0,0 +1,31 @@
+{ lib
+, appimageTools
+, fetchurl
+}:
+appimageTools.wrapType2 rec {
+  pname = "immersed-vr";
+  version = "9.6";
+  name = "${pname}-${version}";
+
+  src = fetchurl {
+    url = "http://web.archive.org/web/20231011083250/https://static.immersed.com/dl/Immersed-x86_64.AppImage";
+    hash = "sha256-iA0SQlPktETFXEqCbSoWV9NaWVahkPa6qO4Cfju0aBQ=";
+  };
+
+  extraInstallCommands = ''
+    mv $out/bin/{${name},${pname}}
+  '';
+
+  extraPkgs = pkgs: with pkgs; [
+    libthai
+  ];
+
+  meta = with lib; {
+    description = "A VR coworking platform";
+    homepage = "https://immersed.com";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ haruki7049 ];
+    platforms = [ "x86_64-linux" ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+  };
+}
--- a/pkgs/applications/terminal-emulators/kermit-terminal/default.nix
+++ b/pkgs/applications/terminal-emulators/kermit-terminal/default.nix
@ -15,11 +15,13 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchFromGitHub {
    owner = "orhun";
-    repo = finalAttrs.pname;
+    repo = "kermit";
    rev = finalAttrs.version;
    hash = "sha256-XPHF33Nu+H8OcQFwsuUOhDBDWKm8sh5B36sfROeSWPg=";
  };

+  outputs = [ "out" "man" ];
+
  nativeBuildInputs = [
    cmake
    pkg-config
@ -33,12 +35,13 @@ stdenv.mkDerivation (finalAttrs: {

  passthru.tests.test = nixosTests.terminal-emulators.kermit;

-  meta = with lib; {
+  meta = {
    homepage = "https://github.com/orhun/kermit";
    description = "A VTE-based, simple and froggy terminal emulator";
    changelog = "https://github.com/orhun/kermit/releases/tag/${finalAttrs.version}";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = with platforms; unix;
+    license = lib.licenses.gpl3Only;
+    mainProgram = "kermit";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.unix;
  };
 })
--- a/pkgs/by-name/le/lemminx/package.nix
+++ b/pkgs/by-name/le/lemminx/package.nix
@ -56,7 +56,8 @@ maven.buildMavenPackage rec {
    !XMLSchemaDiagnosticsTest,
    !MissingChildElementCodeActionTest,
    !XSDValidationExternalResourcesTest,
-    !DocumentLifecycleParticipantTest"
+    !DocumentLifecycleParticipantTest,
+    !DTDValidationExternalResourcesTest"
  ];

  installPhase = ''
--- a/pkgs/development/interpreters/nickel/Cargo.lock
+++ b/pkgs/development/interpreters/nickel/Cargo.lock
--- a/pkgs/development/interpreters/nickel/default.nix
+++ b/pkgs/development/interpreters/nickel/default.nix
@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {

  src = fetchFromGitHub {
    owner = "tweag";
-    repo = pname;
+    repo = "nickel";
    rev = "refs/tags/${version}";
    hash = "sha256-g7pRTwa2sniIOmgdYCxfYxGRtxnQP8zaVWuPjzEZTSg=";
  };
--- a/pkgs/development/tools/language-servers/nls/default.nix
+++ b/pkgs/development/tools/language-servers/nls/default.nix
--- a/pkgs/applications/graphics/nsxiv/default.nix
+++ b/pkgs/applications/graphics/nsxiv/default.nix
@ -10,18 +10,20 @@
 , conf ? null
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "nsxiv";
-  version = "31";
+  version = "32";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "nsxiv";
    repo = "nsxiv";
-    rev = "v${version}";
-    hash = "sha256-X1ZMr5OADs9GIe/kp/kEqKMMHZMymd58m9+f0SPzn7s=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-UWaet7hVtgfuWTiNY4VcsMWTfS6L9r5w1fb/0dWz8SI=";
  };

+  outputs = [ "out" "man" "doc" ];
+
  buildInputs = [
    giflib
    imlib2
@ -30,11 +32,11 @@ stdenv.mkDerivation rec {
    libwebp
  ] ++ lib.optional stdenv.isDarwin libinotify-kqueue;

-  preBuild = lib.optionalString (conf!=null) ''
+  postPatch = lib.optionalString (conf != null) ''
    cp ${(builtins.toFile "config.def.h" conf)} config.def.h
  '';

-  NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-linotify";
+  env.NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-linotify";

  makeFlags = [ "CC:=$(CC)" ];

@ -42,7 +44,7 @@ stdenv.mkDerivation rec {

  installTargets = [ "install-all" ];

-  meta = with lib; {
+  meta = {
    homepage = "https://nsxiv.codeberg.page/";
    description = "New Suckless X Image Viewer";
    longDescription = ''
@ -59,9 +61,9 @@ stdenv.mkDerivation rec {
      - Display image information in status bar
      - Display image name/path in X title
    '';
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ AndersonTorres sikmir ];
-    platforms = platforms.unix;
-    changelog = "https://codeberg.org/nsxiv/nsxiv/src/tag/${src.rev}/etc/CHANGELOG.md";
+    changelog = "https://codeberg.org/nsxiv/nsxiv/src/tag/${finalAttrs.src.rev}/etc/CHANGELOG.md";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ AndersonTorres sikmir ];
+    platforms = lib.platforms.unix;
  };
-}
+})
--- a/pkgs/by-name/pr/pru/Gemfile
+++ b/pkgs/by-name/pr/pru/Gemfile
--- a/pkgs/by-name/pr/pru/Gemfile.lock
+++ b/pkgs/by-name/pr/pru/Gemfile.lock
--- a/pkgs/by-name/pr/pru/gemset.nix
+++ b/pkgs/by-name/pr/pru/gemset.nix
--- a/pkgs/by-name/pr/pru/package.nix
+++ b/pkgs/by-name/pr/pru/package.nix
--- a/pkgs/by-name/py/pyp/package.nix
+++ b/pkgs/by-name/py/pyp/package.nix
--- a/Show More
+++ b/Show More