Merge master into staging-next

2024-01-20 00:02:16 +00:00 · 2024-01-20 00:02:16 +00:00 · 650e10b010
commit 650e10b010
parent 331c789712 8da872fefa
87 changed files with 3768 additions and 1820 deletions
--- a/doc/languages-frameworks/dart.section.md
+++ b/doc/languages-frameworks/dart.section.md
@ -80,6 +80,8 @@ Do _not_ use `dart run <package_name>`, as this will attempt to download depende

 ### Usage with nix-shell {#ssec-dart-applications-nix-shell}

+#### Using dependencies from the Nix store {#ssec-dart-applications-nix-shell-deps}
+
 As `buildDartApplication` provides dependencies instead of `pub get`, Dart needs to be explicitly told where to find them.

 Run the following commands in the source directory to configure Dart appropriately.
@ -103,6 +105,9 @@ flutter.buildFlutterApplication {
  pname = "firmware-updater";
  version = "unstable-2023-04-30";

+  # To build for the Web, use the targetFlutterPlatform argument.
+  # targetFlutterPlatform = "web";
+
  src = fetchFromGitHub {
    owner = "canonical";
    repo = "firmware-updater";
@ -117,4 +122,15 @@ flutter.buildFlutterApplication {

 ### Usage with nix-shell {#ssec-dart-flutter-nix-shell}

-See the [Dart documentation](#ssec-dart-applications-nix-shell) for nix-shell instructions.
+Flutter-specific `nix-shell` usage notes are included here. See the [Dart documentation](#ssec-dart-applications-nix-shell) for general `nix-shell` instructions.
+
+#### Entering the shell {#ssec-dart-flutter-nix-shell-enter}
+
+By default, dependencies for only the `targetFlutterPlatform` are available in the
+build environment. This is useful for keeping closures small, but be problematic
+during development. It's common, for example, to build Web apps for Linux during
+development to take advantage of native features such as stateful hot reload.
+
+To enter a shell with all the usual target platforms available, use the `multiShell` attribute.
+
+e.g. `nix-shell '<nixpkgs>' -A fluffychat-web.multiShell`.
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -15510,6 +15510,16 @@
    githubId = 1891350;
    name = "Michael Raskin";
  };
+  ratcornu = {
+    email = "ratcornu@skaven.org";
+    github = "RatCornu";
+    githubId = 98173832;
+    name = "Balthazar Patiachvili";
+    matrix = "@ratcornu:skweel.skaven.org";
+    keys = [{
+      fingerprint = "1B91 F087 3D06 1319 D3D0  7F91 FA47 BDA2 6048 9ADA";
+    }];
+  };
  ratsclub = {
    email = "victor@freire.dev.br";
    github = "ratsclub";
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -37,6 +37,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 - [Anki Sync Server](https://docs.ankiweb.net/sync-server.html), the official sync server built into recent versions of Anki. Available as [services.anki-sync-server](#opt-services.anki-sync-server.enable).
 The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been marked deprecated and will be dropped after 24.05 due to lack of maintenance of the anki-sync-server softwares.

+- [Suwayomi Server](https://github.com/Suwayomi/Suwayomi-Server), a free and open source manga reader server that runs extensions built for [Tachiyomi](https://tachiyomi.org). Available as [services.suwayomi-server](#opt-services.suwayomi-server.enable).
+
 - [ping_exporter](https://github.com/czerwonk/ping_exporter), a Prometheus exporter for ICMP echo requests. Available as [services.prometheus.exporters.ping](#opt-services.prometheus.exporters.ping.enable).

 - [Clevis](https://github.com/latchset/clevis), a pluggable framework for automated decryption, used to unlock encrypted devices in initrd. Available as [boot.initrd.clevis.enable](#opt-boot.initrd.clevis.enable).
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1339,6 +1339,7 @@
  ./services/web-apps/restya-board.nix
  ./services/web-apps/rimgo.nix
  ./services/web-apps/sftpgo.nix
+  ./services/web-apps/suwayomi-server.nix
  ./services/web-apps/rss-bridge.nix
  ./services/web-apps/selfoss.nix
  ./services/web-apps/shiori.nix
--- a/nixos/modules/services/databases/firebird.nix
+++ b/nixos/modules/services/databases/firebird.nix
@ -143,7 +143,7 @@ in
      # ConnectionTimeout = 180

      #RemoteServiceName = gds_db
-      RemoteServicePort = ${cfg.port}
+      RemoteServicePort = ${toString cfg.port}

      # randomly choose port for server Event Notification
      #RemoteAuxPort = 0
--- a/nixos/modules/services/misc/nix-ssh-serve.nix
+++ b/nixos/modules/services/misc/nix-ssh-serve.nix
@ -1,4 +1,4 @@
-{ config, lib, ... }:
+{ config, lib, pkgs, ... }:

 with lib;
 let cfg = config.nix.sshServe;
@ -46,7 +46,7 @@ in {
      description = "Nix SSH store user";
      isSystemUser = true;
      group = "nix-ssh";
-      useDefaultShell = true;
+      shell = pkgs.bashInteractive;
    };
    users.groups.nix-ssh = {};

--- a/nixos/modules/services/web-apps/suwayomi-server.md
+++ b/nixos/modules/services/web-apps/suwayomi-server.md
@ -0,0 +1,108 @@
+# Suwayomi-Server {#module-services-suwayomi-server}
+
+A free and open source manga reader server that runs extensions built for Tachiyomi.
+
+## Basic usage {#module-services-suwayomi-server-basic-usage}
+
+By default, the module will execute Suwayomi-Server backend and web UI:
+
+```nix
+{ ... }:
+
+{
+  services.suwayomi-server = {
+    enable = true;
+  };
+}
+```
+
+It runs in the systemd service named `suwayomi-server` in the data directory `/var/lib/suwayomi-server`.
+
+You can change the default parameters with some other parameters:
+```nix
+{ ... }:
+
+{
+  services.suwayomi-server = {
+    enable = true;
+
+    dataDir = "/var/lib/suwayomi"; # Default is "/var/lib/suwayomi-server"
+    openFirewall = true;
+
+    settings = {
+      server.port = 4567;
+    };
+  };
+}
+```
+
+If you want to create a desktop icon, you can activate the system tray option:
+
+```nix
+{ ... }:
+
+{
+  services.suwayomi-server = {
+    enable = true;
+
+    dataDir = "/var/lib/suwayomi"; # Default is "/var/lib/suwayomi-server"
+    openFirewall = true;
+
+    settings = {
+      server.port = 4567;
+      server.enableSystemTray = true;
+    };
+  };
+}
+```
+
+## Basic authentication {#module-services-suwayomi-server-basic-auth}
+
+You can configure a basic authentication to the web interface with:
+
+```nix
+{ ... }:
+
+{
+  services.suwayomi-server = {
+    enable = true;
+
+    openFirewall = true;
+
+    settings = {
+      server.port = 4567;
+      server = {
+        basicAuthEnabled = true;
+        basicAuthUsername = "username";
+
+        # NOTE: this is not a real upstream option
+        basicAuthPasswordFile = ./path/to/the/password/file;
+      };
+    };
+  };
+}
+```
+
+## Extra configuration {#module-services-suwayomi-server-extra-config}
+
+Not all the configuration options are available directly in this module, but you can add the other options of suwayomi-server with:
+
+```nix
+{ ... }:
+
+{
+  services.suwayomi-server = {
+    enable = true;
+
+    openFirewall = true;
+
+    settings = {
+      server = {
+        port = 4567;
+        autoDownloadNewChapters = false;
+        maxSourcesInParallel" = 6;
+      };
+    };
+  };
+}
+```
--- a/nixos/modules/services/web-apps/suwayomi-server.nix
+++ b/nixos/modules/services/web-apps/suwayomi-server.nix
@ -0,0 +1,260 @@
+{ config, pkgs, lib, ... }:
+
+let
+  cfg = config.services.suwayomi-server;
+  inherit (lib) mkOption mdDoc mkEnableOption mkIf types;
+in
+{
+  options = {
+    services.suwayomi-server = {
+      enable = mkEnableOption (mdDoc "Suwayomi, a free and open source manga reader server that runs extensions built for Tachiyomi.");
+
+      package = lib.mkPackageOptionMD pkgs "suwayomi-server" { };
+
+      dataDir = mkOption {
+        type = types.path;
+        default = "/var/lib/suwayomi-server";
+        example = "/var/data/mangas";
+        description = mdDoc ''
+          The path to the data directory in which Suwayomi-Server will download scans.
+        '';
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = "suwayomi";
+        example = "root";
+        description = mdDoc ''
+          User account under which Suwayomi-Server runs.
+        '';
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "suwayomi";
+        example = "medias";
+        description = mdDoc ''
+          Group under which Suwayomi-Server runs.
+        '';
+      };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = mdDoc ''
+          Whether to open the firewall for the port in {option}`services.suwayomi-server.settings.server.port`.
+        '';
+      };
+
+      settings = mkOption {
+        type = types.submodule {
+          freeformType =
+            let
+              recursiveAttrsType = with types; attrsOf (nullOr (oneOf [
+                str
+                path
+                int
+                float
+                bool
+                (listOf str)
+                (recursiveAttrsType // { description = "instances of this type recursively"; })
+              ]));
+            in
+            recursiveAttrsType;
+          options = {
+            server = {
+              ip = mkOption {
+                type = types.str;
+                default = "0.0.0.0";
+                example = "127.0.0.1";
+                description = mdDoc ''
+                  The ip that Suwayomi will bind to.
+                '';
+              };
+
+              port = mkOption {
+                type = types.port;
+                default = 8080;
+                example = 4567;
+                description = mdDoc ''
+                  The port that Suwayomi will listen to.
+                '';
+              };
+
+              basicAuthEnabled = mkEnableOption (mdDoc ''
+                Add basic access authentication to Suwayomi-Server.
+                Enabling this option is useful when hosting on a public network/the Internet
+              '');
+
+              basicAuthUsername = mkOption {
+                type = types.nullOr types.str;
+                default = null;
+                description = mdDoc ''
+                  The username value that you have to provide when authenticating.
+                '';
+              };
+
+              # NOTE: this is not a real upstream option
+              basicAuthPasswordFile = mkOption {
+                type = types.nullOr types.path;
+                default = null;
+                example = "/var/secrets/suwayomi-server-password";
+                description = mdDoc ''
+                  The password file containing the value that you have to provide when authenticating.
+                '';
+              };
+
+              downloadAsCbz = mkOption {
+                type = types.bool;
+                default = false;
+                description = mdDoc ''
+                  Download chapters as `.cbz` files.
+                '';
+              };
+
+              localSourcePath = mkOption {
+                type = types.path;
+                default = cfg.dataDir;
+                defaultText = lib.literalExpression "suwayomi-server.dataDir";
+                example = "/var/data/local_mangas";
+                description = mdDoc ''
+                  Path to the local source folder.
+                '';
+              };
+
+              systemTrayEnabled = mkOption {
+                type = types.bool;
+                default = false;
+                description = mdDoc ''
+                  Whether to enable a system tray icon, if possible.
+                '';
+              };
+            };
+          };
+        };
+        description = mdDoc ''
+          Configuration to write to {file}`server.conf`.
+          See <https://github.com/Suwayomi/Suwayomi-Server/wiki/Configuring-Suwayomi-Server> for more information.
+        '';
+        default = { };
+        example = {
+          server.socksProxyEnabled = true;
+          server.socksProxyHost = "yourproxyhost.com";
+          server.socksProxyPort = "8080";
+        };
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    assertions = [{
+      assertion = with cfg.settings.server; basicAuthEnabled -> (basicAuthUsername != null && basicAuthPasswordFile != null);
+      message = ''
+        [suwayomi-server]: the username and the password file cannot be null when the basic auth is enabled
+      '';
+    }];
+
+    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.settings.server.port ];
+
+    users.groups = mkIf (cfg.group == "suwayomi") {
+      suwayomi = { };
+    };
+
+    users.users = mkIf (cfg.user == "suwayomi") {
+      suwayomi = {
+        group = cfg.group;
+        # Need to set the user home because the package writes to ~/.local/Tachidesk
+        home = cfg.dataDir;
+        description = "Suwayomi Daemon user";
+        isSystemUser = true;
+      };
+    };
+
+    systemd.tmpfiles.settings."10-suwayomi-server" = {
+      "${cfg.dataDir}/.local/share/Tachidesk".d = {
+        mode = "0700";
+        inherit (cfg) user group;
+      };
+    };
+
+    systemd.services.suwayomi-server =
+      let
+        flattenConfig = prefix: config:
+          lib.foldl'
+            lib.mergeAttrs
+            { }
+            (lib.attrValues
+              (lib.mapAttrs
+                (k: v:
+                  if !(lib.isAttrs v)
+                  then { "${prefix}${k}" = v; }
+                  else flattenConfig "${prefix}${k}." v
+                )
+                config
+              )
+            );
+
+        #  HOCON is a JSON superset that suwayomi-server use for configuration
+        toHOCON = attr:
+          let
+            attrType = builtins.typeOf attr;
+          in
+          if builtins.elem attrType [ "string" "path" "int" "float" ]
+          then ''"${toString attr}"''
+          else if attrType == "bool"
+          then lib.boolToString attr
+          else if attrType == "list"
+          then "[\n${lib.concatMapStringsSep ",\n" toHOCON attr}\n]"
+          else # attrs, lambda, null
+            throw ''
+              [suwayomi-server]: invalid config value type '${attrType}'.
+            '';
+
+        configFile = pkgs.writeText "server.conf" (lib.pipe cfg.settings [
+          (settings: lib.recursiveUpdate settings {
+            server.basicAuthPasswordFile = null;
+            server.basicAuthPassword =
+              if settings.server.basicAuthEnabled
+              then "$TACHIDESK_SERVER_BASIC_AUTH_PASSWORD"
+              else null;
+          })
+          (flattenConfig "")
+          (lib.filterAttrs (_: x: x != null))
+          (lib.mapAttrsToList (name: value: ''${name} = ${toHOCON value}''))
+          lib.concatLines
+        ]);
+
+      in
+      {
+        description = "A free and open source manga reader server that runs extensions built for Tachiyomi.";
+
+        wantedBy = [ "multi-user.target" ];
+        wants = [ "network-online.target" ];
+        after = [ "network-online.target" ];
+
+        script = ''
+          ${lib.optionalString cfg.settings.server.basicAuthEnabled ''
+            export TACHIDESK_SERVER_BASIC_AUTH_PASSWORD="$(<${cfg.settings.server.basicAuthPasswordFile})"
+          ''}
+          ${lib.getExe pkgs.envsubst} -i ${configFile} -o ${cfg.dataDir}/.local/share/Tachidesk/server.conf
+          ${lib.getExe cfg.package} -Dsuwayomi.tachidesk.config.server.rootDir=${cfg.dataDir}
+        '';
+
+        serviceConfig = {
+          User = cfg.user;
+          Group = cfg.group;
+
+          Type = "simple";
+          Restart = "on-failure";
+
+          StateDirectory = mkIf (cfg.dataDir == "/var/lib/suwayomi-server") "suwayomi-server";
+        };
+      };
+  };
+
+  meta = {
+    maintainers = with lib.maintainers; [ ratcornu ];
+    doc = ./suwayomi-server.md;
+  };
+}
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
@ -15,6 +15,19 @@ import json
 from typing import NamedTuple, Dict, List
 from dataclasses import dataclass

+# These values will be replaced with actual values during the package build
+EFI_SYS_MOUNT_POINT = "@efiSysMountPoint@"
+TIMEOUT = "@timeout@"
+EDITOR = bool("@editor@")
+CONSOLE_MODE = "@consoleMode@"
+BOOTSPEC_TOOLS = "@bootspecTools@"
+DISTRO_NAME = "@distroName@"
+NIX = "@nix@"
+SYSTEMD = "@systemd@"
+CONFIGURATION_LIMIT = int("@configurationLimit@")
+CAN_TOUCH_EFI_VARIABLES = "@canTouchEfiVariables@"
+GRACEFUL = "@graceful@"
+COPY_EXTRA_FILES = "@copyExtraFiles@"

@dataclass
 class BootSpec:
@ -29,7 +42,6 @@ class BootSpec:
    initrdSecrets: str | None = None


-
 libc = ctypes.CDLL("libc.so.6")

 class SystemIdentifier(NamedTuple):
@ -75,16 +87,16 @@ def generation_conf_filename(profile: str | None, generation: int, specialisatio


 def write_loader_conf(profile: str | None, generation: int, specialisation: str | None) -> None:
-    with open("@efiSysMountPoint@/loader/loader.conf.tmp", 'w') as f:
-        if "@timeout@" != "":
-            f.write("timeout @timeout@\n")
+    with open(f"{EFI_SYS_MOUNT_POINT}/loader/loader.conf.tmp", 'w') as f:
+        if TIMEOUT != "":
+            f.write(f"timeout {TIMEOUT}\n")
        f.write("default %s\n" % generation_conf_filename(profile, generation, specialisation))
-        if not @editor@:
+        if not EDITOR:
            f.write("editor 0\n")
-        f.write("console-mode @consoleMode@\n")
+        f.write(f"console-mode {CONSOLE_MODE}\n")
        f.flush()
        os.fsync(f.fileno())
-    os.rename("@efiSysMountPoint@/loader/loader.conf.tmp", "@efiSysMountPoint@/loader/loader.conf")
+    os.rename(f"{EFI_SYS_MOUNT_POINT}/loader/loader.conf.tmp", f"{EFI_SYS_MOUNT_POINT}/loader/loader.conf")


 def get_bootspec(profile: str | None, generation: int) -> BootSpec:
@ -95,7 +107,7 @@ def get_bootspec(profile: str | None, generation: int) -> BootSpec:
        bootspec_json = json.load(boot_json_f)
    else:
        boot_json_str = subprocess.check_output([
-        "@bootspecTools@/bin/synthesize",
+        f"{BOOTSPEC_TOOLS}/bin/synthesize",
        "--version",
        "1",
        system_directory,
@ -116,7 +128,7 @@ def copy_from_file(file: str, dry_run: bool = False) -> str:
    store_dir = os.path.basename(os.path.dirname(store_file_path))
    efi_file_path = "/efi/nixos/%s-%s.efi" % (store_dir, suffix)
    if not dry_run:
-        copy_if_not_exists(store_file_path, "@efiSysMountPoint@%s" % (efi_file_path))
+        copy_if_not_exists(store_file_path, f"{EFI_SYS_MOUNT_POINT}%s" % (efi_file_path))
    return efi_file_path

 def write_entry(profile: str | None, generation: int, specialisation: str | None,
@ -126,13 +138,14 @@ def write_entry(profile: str | None, generation: int, specialisation: str | None
    kernel = copy_from_file(bootspec.kernel)
    initrd = copy_from_file(bootspec.initrd)

-    title = "@distroName@{profile}{specialisation}".format(
+    title = "{name}{profile}{specialisation}".format(
+        name=DISTRO_NAME,
        profile=" [" + profile + "]" if profile else "",
        specialisation=" (%s)" % specialisation if specialisation else "")

    try:
        if bootspec.initrdSecrets is not None:
-            subprocess.check_call([bootspec.initrdSecrets, "@efiSysMountPoint@%s" % (initrd)])
+            subprocess.check_call([bootspec.initrdSecrets, f"{EFI_SYS_MOUNT_POINT}%s" % (initrd)])
    except subprocess.CalledProcessError:
        if current:
            print("failed to create initrd secrets!", file=sys.stderr)
@ -142,7 +155,7 @@ def write_entry(profile: str | None, generation: int, specialisation: str | None
                  f'for "{title} - Configuration {generation}", an older generation', file=sys.stderr)
            print("note: this is normal after having removed "
                  "or renamed a file in `boot.initrd.secrets`", file=sys.stderr)
-    entry_file = "@efiSysMountPoint@/loader/entries/%s" % (
+    entry_file = f"{EFI_SYS_MOUNT_POINT}/loader/entries/%s" % (
        generation_conf_filename(profile, generation, specialisation))
    tmp_path = "%s.tmp" % (entry_file)
    kernel_params = "init=%s " % bootspec.init
@ -167,7 +180,7 @@ def write_entry(profile: str | None, generation: int, specialisation: str | None

 def get_generations(profile: str | None = None) -> list[SystemIdentifier]:
    gen_list = subprocess.check_output([
-        "@nix@/bin/nix-env",
+        f"{NIX}/bin/nix-env",
        "--list-generations",
        "-p",
        "/nix/var/nix/profiles/%s" % ("system-profiles/" + profile if profile else "system"),
@ -176,7 +189,7 @@ def get_generations(profile: str | None = None) -> list[SystemIdentifier]:
    gen_lines = gen_list.split('\n')
    gen_lines.pop()

-    configurationLimit = @configurationLimit@
+    configurationLimit = CONFIGURATION_LIMIT
    configurations = [
        SystemIdentifier(
            profile=profile,
@ -189,14 +202,14 @@ def get_generations(profile: str | None = None) -> list[SystemIdentifier]:


 def remove_old_entries(gens: list[SystemIdentifier]) -> None:
-    rex_profile = re.compile(r"^@efiSysMountPoint@/loader/entries/nixos-(.*)-generation-.*\.conf$")
-    rex_generation = re.compile(r"^@efiSysMountPoint@/loader/entries/nixos.*-generation-([0-9]+)(-specialisation-.*)?\.conf$")
+    rex_profile = re.compile(r"^" + re.escape(EFI_SYS_MOUNT_POINT) + "/loader/entries/nixos-(.*)-generation-.*\.conf$")
+    rex_generation = re.compile(r"^" + re.escape(EFI_SYS_MOUNT_POINT) + "/loader/entries/nixos.*-generation-([0-9]+)(-specialisation-.*)?\.conf$")
    known_paths = []
    for gen in gens:
        bootspec = get_bootspec(gen.profile, gen.generation)
        known_paths.append(copy_from_file(bootspec.kernel, True))
        known_paths.append(copy_from_file(bootspec.initrd, True))
-    for path in glob.iglob("@efiSysMountPoint@/loader/entries/nixos*-generation-[1-9]*.conf"):
+    for path in glob.iglob(f"{EFI_SYS_MOUNT_POINT}/loader/entries/nixos*-generation-[1-9]*.conf"):
        if rex_profile.match(path):
            prof = rex_profile.sub(r"\1", path)
        else:
@ -207,7 +220,7 @@ def remove_old_entries(gens: list[SystemIdentifier]) -> None:
            continue
        if not (prof, gen_number, None) in gens:
            os.unlink(path)
-    for path in glob.iglob("@efiSysMountPoint@/efi/nixos/*"):
+    for path in glob.iglob(f"{EFI_SYS_MOUNT_POINT}/efi/nixos/*"):
        if not path in known_paths and not os.path.isdir(path):
            os.unlink(path)

@ -230,7 +243,7 @@ def install_bootloader(args: argparse.Namespace) -> None:
        # Since systemd version 232 a machine ID is required and it might not
        # be there on newly installed systems, so let's generate one so that
        # bootctl can find it and we can also pass it to write_entry() later.
-        cmd = ["@systemd@/bin/systemd-machine-id-setup", "--print"]
+        cmd = [f"{SYSTEMD}/bin/systemd-machine-id-setup", "--print"]
        machine_id = subprocess.run(
          cmd, text=True, check=True, stdout=subprocess.PIPE
        ).stdout.rstrip()
@ -242,22 +255,22 @@ def install_bootloader(args: argparse.Namespace) -> None:
    # flags to pass to bootctl install/update
    bootctl_flags = []

-    if "@canTouchEfiVariables@" != "1":
+    if CAN_TOUCH_EFI_VARIABLES != "1":
        bootctl_flags.append("--no-variables")

-    if "@graceful@" == "1":
+    if GRACEFUL == "1":
        bootctl_flags.append("--graceful")

    if os.getenv("NIXOS_INSTALL_BOOTLOADER") == "1":
        # bootctl uses fopen() with modes "wxe" and fails if the file exists.
-        if os.path.exists("@efiSysMountPoint@/loader/loader.conf"):
-            os.unlink("@efiSysMountPoint@/loader/loader.conf")
+        if os.path.exists(f"{EFI_SYS_MOUNT_POINT}/loader/loader.conf"):
+            os.unlink(f"{EFI_SYS_MOUNT_POINT}/loader/loader.conf")

-        subprocess.check_call(["@systemd@/bin/bootctl", "--esp-path=@efiSysMountPoint@"] + bootctl_flags + ["install"])
+        subprocess.check_call([f"{SYSTEMD}/bin/bootctl", f"--esp-path={EFI_SYS_MOUNT_POINT}"] + bootctl_flags + ["install"])
    else:
        # Update bootloader to latest if needed
-        available_out = subprocess.check_output(["@systemd@/bin/bootctl", "--version"], universal_newlines=True).split()[2]
-        installed_out = subprocess.check_output(["@systemd@/bin/bootctl", "--esp-path=@efiSysMountPoint@", "status"], universal_newlines=True)
+        available_out = subprocess.check_output([f"{SYSTEMD}/bin/bootctl", "--version"], universal_newlines=True).split()[2]
+        installed_out = subprocess.check_output([f"{SYSTEMD}/bin/bootctl", f"--esp-path={EFI_SYS_MOUNT_POINT}", "status"], universal_newlines=True)

        # See status_binaries() in systemd bootctl.c for code which generates this
        installed_match = re.search(r"^\W+File:.*/EFI/(?:BOOT|systemd)/.*\.efi \(systemd-boot ([\d.]+[^)]*)\)$",
@ -276,10 +289,10 @@ def install_bootloader(args: argparse.Namespace) -> None:

        if installed_version < available_version:
            print("updating systemd-boot from %s to %s" % (installed_version, available_version))
-            subprocess.check_call(["@systemd@/bin/bootctl", "--esp-path=@efiSysMountPoint@"] + bootctl_flags + ["update"])
+            subprocess.check_call([f"{SYSTEMD}/bin/bootctl", f"--esp-path={EFI_SYS_MOUNT_POINT}"] + bootctl_flags + ["update"])

-    os.makedirs("@efiSysMountPoint@/efi/nixos", exist_ok=True)
-    os.makedirs("@efiSysMountPoint@/loader/entries", exist_ok=True)
+    os.makedirs(f"{EFI_SYS_MOUNT_POINT}/efi/nixos", exist_ok=True)
+    os.makedirs(f"{EFI_SYS_MOUNT_POINT}/loader/entries", exist_ok=True)

    gens = get_generations()
    for profile in get_profiles():
@ -302,9 +315,9 @@ def install_bootloader(args: argparse.Namespace) -> None:
            else:
                raise e

-    for root, _, files in os.walk('@efiSysMountPoint@/efi/nixos/.extra-files', topdown=False):
-        relative_root = root.removeprefix("@efiSysMountPoint@/efi/nixos/.extra-files").removeprefix("/")
-        actual_root = os.path.join("@efiSysMountPoint@", relative_root)
+    for root, _, files in os.walk(f"{EFI_SYS_MOUNT_POINT}/efi/nixos/.extra-files", topdown=False):
+        relative_root = root.removeprefix(f"{EFI_SYS_MOUNT_POINT}/efi/nixos/.extra-files").removeprefix("/")
+        actual_root = os.path.join(f"{EFI_SYS_MOUNT_POINT}", relative_root)

        for file in files:
            actual_file = os.path.join(actual_root, file)
@ -317,14 +330,14 @@ def install_bootloader(args: argparse.Namespace) -> None:
            os.rmdir(actual_root)
        os.rmdir(root)

-    os.makedirs("@efiSysMountPoint@/efi/nixos/.extra-files", exist_ok=True)
+    os.makedirs(f"{EFI_SYS_MOUNT_POINT}/efi/nixos/.extra-files", exist_ok=True)

-    subprocess.check_call("@copyExtraFiles@")
+    subprocess.check_call(COPY_EXTRA_FILES)


 def main() -> None:
-    parser = argparse.ArgumentParser(description='Update @distroName@-related systemd-boot files')
-    parser.add_argument('default_config', metavar='DEFAULT-CONFIG', help='The default @distroName@ config to boot')
+    parser = argparse.ArgumentParser(description=f"Update {DISTRO_NAME}-related systemd-boot files")
+    parser.add_argument('default_config', metavar='DEFAULT-CONFIG', help=f"The default {DISTRO_NAME} config to boot")
    args = parser.parse_args()

    try:
@ -334,9 +347,9 @@ def main() -> None:
        # it can leave the system in an unbootable state, when a crash/outage
        # happens shortly after an update. To decrease the likelihood of this
        # event sync the efi filesystem after each update.
-        rc = libc.syncfs(os.open("@efiSysMountPoint@", os.O_RDONLY))
+        rc = libc.syncfs(os.open(f"{EFI_SYS_MOUNT_POINT}", os.O_RDONLY))
        if rc != 0:
-            print("could not sync @efiSysMountPoint@: {}".format(os.strerror(rc)), file=sys.stderr)
+            print(f"could not sync {EFI_SYS_MOUNT_POINT}: {os.strerror(rc)}", file=sys.stderr)


 if __name__ == '__main__':
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -810,6 +810,7 @@ in {
  stunnel = handleTest ./stunnel.nix {};
  sudo = handleTest ./sudo.nix {};
  sudo-rs = handleTest ./sudo-rs.nix {};
+  suwayomi-server = handleTest ./suwayomi-server.nix {};
  swap-file-btrfs = handleTest ./swap-file-btrfs.nix {};
  swap-partition = handleTest ./swap-partition.nix {};
  swap-random-encryption = handleTest ./swap-random-encryption.nix {};
--- a/nixos/tests/ayatana-indicators.nix
+++ b/nixos/tests/ayatana-indicators.nix
@ -4,7 +4,7 @@ in {
  name = "ayatana-indicators";

  meta = {
-    maintainers = with lib.maintainers; [ OPNA2608 ];
+    maintainers = lib.teams.lomiri.members;
  };

  nodes.machine = { config, ... }: {
@ -28,16 +28,34 @@ in {
      enable = true;
      packages = with pkgs; [
        ayatana-indicator-messages
-      ];
+      ] ++ (with pkgs.lomiri; [
+        lomiri-indicator-network
+      ]);
    };

-    # Services needed by some indicators
+    # Setup needed by some indicators
+
    services.accounts-daemon.enable = true; # messages
+
+    # Lomiri-ish setup for Lomiri indicators
+    # TODO move into a Lomiri module, once the package set is far enough for the DE to start
+
+    networking.networkmanager.enable = true; # lomiri-network-indicator
+    # TODO potentially urfkill for lomiri-network-indicator?
  };

  # TODO session indicator starts up in a semi-broken state, but works fine after a restart. maybe being started before graphical session is truly up & ready?
  testScript = { nodes, ... }: let
-    runCommandPerIndicatorService = command: lib.strings.concatMapStringsSep "\n" command nodes.machine.systemd.user.targets."ayatana-indicators".wants;
+    runCommandOverServiceList = list: command:
+      lib.strings.concatMapStringsSep "\n" command list;
+
+    runCommandOverAyatanaIndicators = runCommandOverServiceList
+      (builtins.filter
+        (service: !(lib.strings.hasPrefix "lomiri" service || lib.strings.hasPrefix "telephony-service" service))
+        nodes.machine.systemd.user.targets."ayatana-indicators".wants);
+
+    runCommandOverAllIndicators = runCommandOverServiceList
+      nodes.machine.systemd.user.targets."ayatana-indicators".wants;
  in ''
    start_all()
    machine.wait_for_x()
@ -50,7 +68,7 @@ in {
    machine.sleep(10)

    # Now check if all indicators were brought up successfully, and kill them for later
-  '' + (runCommandPerIndicatorService (service: let serviceExec = builtins.replaceStrings [ "." ] [ "-" ] service; in ''
+  '' + (runCommandOverAyatanaIndicators (service: let serviceExec = builtins.replaceStrings [ "." ] [ "-" ] service; in ''
    machine.succeed("pgrep -f ${serviceExec}")
    machine.succeed("pkill -f ${serviceExec}")
  '')) + ''
@ -65,7 +83,7 @@ in {
    machine.sleep(10)

    # Now check if all indicator services were brought up successfully
-  '' + runCommandPerIndicatorService (service: ''
+  '' + runCommandOverAllIndicators (service: ''
    machine.wait_for_unit("${service}", "${user}")
  '');
 })
--- a/nixos/tests/haproxy.nix
+++ b/nixos/tests/haproxy.nix
@ -1,22 +1,42 @@
-import ./make-test-python.nix ({ pkgs, ...}: {
+import ./make-test-python.nix ({ lib, pkgs, ...}: {
  name = "haproxy";
  nodes = {
-    machine = { ... }: {
-      services.haproxy = {
+    server = { ... }: {
+     services.haproxy = {
        enable = true;
        config = ''
+          global
+            limited-quic
+
          defaults
+            mode http
            timeout connect 10s
+            timeout client 10s
+            timeout server 10s
+
+            log /dev/log local0 debug err
+            option logasap
+            option httplog
+            option httpslog

          backend http_server
-            mode http
-            server httpd [::1]:8000
+            server httpd [::1]:8000 alpn http/1.1

          frontend http
-            bind *:80
-            mode http
+            bind :80
+            bind :443 ssl strict-sni crt /etc/ssl/fullchain.pem alpn h2,http/1.1
+            bind quic4@:443 ssl strict-sni crt /etc/ssl/fullchain.pem alpn h3 allow-0rtt
+
+            http-after-response add-header alt-svc 'h3=":443"; ma=60' if { ssl_fc }
+
            http-request use-service prometheus-exporter if { path /metrics }
            use_backend http_server
+
+          frontend http-cert-auth
+            bind :8443 ssl strict-sni crt /etc/ssl/fullchain.pem verify required ca-file /etc/ssl/cacert.crt
+            bind quic4@:8443 ssl strict-sni crt /etc/ssl/fullchain.pem verify required ca-file /etc/ssl/cacert.crt alpn h3
+
+            use_backend http_server
        '';
      };
      services.httpd = {
@ -30,24 +50,75 @@ import ./make-test-python.nix ({ pkgs, ...}: {
          }];
        };
      };
+      networking.firewall.allowedTCPPorts = [ 80 443 8443 ];
+      networking.firewall.allowedUDPPorts = [ 443 8443 ];
+     };
+    client = { ... }: {
+      environment.systemPackages = [ pkgs.curlHTTP3 ];
    };
  };
  testScript = ''
+    # Helpers
+    def cmd(command):
+      print(f"+{command}")
+      r = os.system(command)
+      if r != 0:
+        raise Exception(f"Command {command} failed with exit code {r}")
+
+    def openssl(command):
+      cmd(f"${pkgs.openssl}/bin/openssl {command}")
+
+    # Generate CA.
+    openssl("req -new -newkey rsa:4096 -nodes -x509 -days 7 -subj '/C=ZZ/ST=Cloud/L=Unspecified/O=NixOS/OU=Tests/CN=CA Certificate' -keyout cacert.key -out cacert.crt")
+
+    # Generate and sign Server.
+    openssl("req -newkey rsa:4096 -nodes -subj '/CN=server/OU=Tests/O=NixOS' -keyout server.key -out server.csr")
+    openssl("x509 -req -in server.csr -out server.crt -CA cacert.crt -CAkey cacert.key -days 7")
+    cmd("cat server.crt server.key > fullchain.pem")
+
+    # Generate and sign Client.
+    openssl("req -newkey rsa:4096 -nodes -subj '/CN=client/OU=Tests/O=NixOS' -keyout client.key -out client.csr")
+    openssl("x509 -req -in client.csr -out client.crt -CA cacert.crt -CAkey cacert.key -days 7")
+    cmd("cat client.crt client.key > client.pem")
+
+    # Start the actual test.
    start_all()
-    machine.wait_for_unit("multi-user.target")
-    machine.wait_for_unit("haproxy.service")
-    machine.wait_for_unit("httpd.service")
-    assert "We are all good!" in machine.succeed("curl -fk http://localhost:80/index.txt")
-    assert "haproxy_process_pool_allocated_bytes" in machine.succeed(
-        "curl -fk http://localhost:80/metrics"
-    )
+    server.copy_from_host("fullchain.pem", "/etc/ssl/fullchain.pem")
+    server.copy_from_host("cacert.crt", "/etc/ssl/cacert.crt")
+    server.succeed("chmod 0644 /etc/ssl/fullchain.pem /etc/ssl/cacert.crt")
+
+    client.copy_from_host("cacert.crt", "/etc/ssl/cacert.crt")
+    client.copy_from_host("client.pem", "/root/client.pem")
+
+    server.wait_for_unit("multi-user.target")
+    server.wait_for_unit("haproxy.service")
+    server.wait_for_unit("httpd.service")
+
+    assert "We are all good!" in client.succeed("curl -f http://server/index.txt")
+    assert "haproxy_process_pool_allocated_bytes" in client.succeed("curl -f http://server/metrics")
+
+    with subtest("https"):
+      assert "We are all good!" in client.succeed("curl -f --cacert /etc/ssl/cacert.crt https://server/index.txt")
+
+    with subtest("https-cert-auth"):
+      # Client must succeed in authenticating with the right certificate.
+      assert "We are all good!" in client.succeed("curl -f --cacert /etc/ssl/cacert.crt --cert-type pem --cert /root/client.pem https://server:8443/index.txt")
+      # Client must fail without certificate.
+      client.fail("curl --cacert /etc/ssl/cacert.crt https://server:8443/index.txt")
+
+    with subtest("h3"):
+      assert "We are all good!" in client.succeed("curl -f --http3-only --cacert /etc/ssl/cacert.crt https://server/index.txt")
+
+    with subtest("h3-cert-auth"):
+      # Client must succeed in authenticating with the right certificate.
+      assert "We are all good!" in client.succeed("curl -f --http3-only --cacert /etc/ssl/cacert.crt --cert-type pem --cert /root/client.pem https://server:8443/index.txt")
+      # Client must fail without certificate.
+      client.fail("curl -f --http3-only --cacert /etc/ssl/cacert.crt https://server:8443/index.txt")

    with subtest("reload"):
-        machine.succeed("systemctl reload haproxy")
+        server.succeed("systemctl reload haproxy")
        # wait some time to ensure the following request hits the reloaded haproxy
-        machine.sleep(5)
-        assert "We are all good!" in machine.succeed(
-            "curl -fk http://localhost:80/index.txt"
-        )
+        server.sleep(5)
+        assert "We are all good!" in client.succeed("curl -f http://server/index.txt")
  '';
 })
--- a/nixos/tests/suwayomi-server.nix
+++ b/nixos/tests/suwayomi-server.nix
@ -0,0 +1,46 @@
+{ system ? builtins.currentSystem
+, pkgs
+, lib ? pkgs.lib
+}:
+let
+  inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest;
+  inherit (lib) recursiveUpdate;
+
+  baseTestConfig = {
+    meta.maintainers = with lib.maintainers; [ ratcornu ];
+    nodes.machine = { pkgs, ... }: {
+      services.suwayomi-server = {
+        enable = true;
+        settings.server.port = 1234;
+      };
+    };
+    testScript = ''
+      machine.wait_for_unit("suwayomi-server.service")
+      machine.wait_for_open_port(1234)
+      machine.succeed("curl --fail http://localhost:1234/")
+    '';
+  };
+in
+
+{
+  without-auth = makeTest (recursiveUpdate baseTestConfig {
+    name = "suwayomi-server-without-auth";
+  });
+
+  with-auth = makeTest (recursiveUpdate baseTestConfig {
+    name = "suwayomi-server-with-auth";
+
+    nodes.machine = { pkgs, ... }: {
+      services.suwayomi-server = {
+        enable = true;
+
+        settings.server = {
+          port = 1234;
+          basicAuthEnabled = true;
+          basicAuthUsername = "alice";
+          basicAuthPasswordFile = pkgs.writeText "snakeoil-pass.txt" "pass";
+        };
+      };
+    };
+  });
+}
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@ -5,12 +5,12 @@
 {
  ada = buildGrammar {
    language = "ada";
-    version = "0.0.0+rev=f21f13a";
+    version = "0.0.0+rev=ba0894e";
    src = fetchFromGitHub {
      owner = "briot";
      repo = "tree-sitter-ada";
-      rev = "f21f13afe0410311be1f78959a25aee393c569c9";
-      hash = "sha256-Qnw1skHo9Wy88WEXAxfV4kkD4v9rdvLmu/++raLIges=";
+      rev = "ba0894efa03beb70780156b91e28c716b7a4764d";
+      hash = "sha256-30yCHcO9LdZ9VKQpObWRfk49M5tC85IZvutXgzGwTjQ=";
    };
    meta.homepage = "https://github.com/briot/tree-sitter-ada";
  };
@ -62,12 +62,12 @@
  };
  astro = buildGrammar {
    language = "astro";
-    version = "0.0.0+rev=e122a8f";
+    version = "0.0.0+rev=a092afa";
    src = fetchFromGitHub {
      owner = "virchau13";
      repo = "tree-sitter-astro";
-      rev = "e122a8fcd07e808a7b873bfadc2667834067daf1";
-      hash = "sha256-iCVRTX2fMW1g40rHcJEwwE+tfwun+reIaj5y4AFgmKk=";
+      rev = "a092afa5c330495fdfbc652766c29c66ec6880f4";
+      hash = "sha256-yYQPBGNRmr/O9hI11L3a2ydZL/lypLtabfmBdKghnzM=";
    };
    meta.homepage = "https://github.com/virchau13/tree-sitter-astro";
  };
@ -84,12 +84,12 @@
  };
  awk = buildGrammar {
    language = "awk";
-    version = "0.0.0+rev=4b4b46c";
+    version = "0.0.0+rev=dcf4ac4";
    src = fetchFromGitHub {
      owner = "Beaglefoot";
      repo = "tree-sitter-awk";
-      rev = "4b4b46c9a44ec7fb9e8c9ce4a010295edc5be8d5";
-      hash = "sha256-bHlll+YgRpv4cSxzNAfVhexeMB7rgkzy3pdOZ5DW1ww=";
+      rev = "dcf4ac4eaff601d87cc15604765a7ae329c1b2ee";
+      hash = "sha256-ZxSgNVY5jRi6S6psG2XoNhuQnXqAjgUK7NtBK9y1WNo=";
    };
    meta.homepage = "https://github.com/Beaglefoot/tree-sitter-awk";
  };
@ -550,12 +550,12 @@
  };
  erlang = buildGrammar {
    language = "erlang";
-    version = "0.0.0+rev=57e6951";
+    version = "0.0.0+rev=54b6f81";
    src = fetchFromGitHub {
      owner = "WhatsApp";
      repo = "tree-sitter-erlang";
-      rev = "57e69513efd831f9cc8207d65d96bad917ca4aa4";
-      hash = "sha256-7Me0zj/+uNXgBOAyiFgljyA3hLkdGeyBKn+CaBhODMA=";
+      rev = "54b6f814f43c4eac81eeedefaa7cc8762fec6683";
+      hash = "sha256-21pSBjg3hArexHndfqIOy5q2FGl54uWyW2fWwO+3jIw=";
    };
    meta.homepage = "https://github.com/WhatsApp/tree-sitter-erlang";
  };
@ -715,12 +715,12 @@
  };
  gitcommit = buildGrammar {
    language = "gitcommit";
-    version = "0.0.0+rev=7e3ad5f";
+    version = "0.0.0+rev=e8d9eda";
    src = fetchFromGitHub {
      owner = "gbprod";
      repo = "tree-sitter-gitcommit";
-      rev = "7e3ad5fdc61cd701e146ef78e4fc6dcdf6dbca0e";
-      hash = "sha256-Ct7zLvcJVqIaVy/wOGOPvghjwRcsHblPaTuifUcackI=";
+      rev = "e8d9eda4e5ea0b08aa39d48dab0f6553058fbe0f";
+      hash = "sha256-gn945mu9JhLocKjdNbUhQnDvXNy2xxMn36oNOsbNOz4=";
    };
    meta.homepage = "https://github.com/gbprod/tree-sitter-gitcommit";
  };
@ -737,12 +737,12 @@
  };
  gleam = buildGrammar {
    language = "gleam";
-    version = "0.0.0+rev=2b49c49";
+    version = "0.0.0+rev=62c5388";
    src = fetchFromGitHub {
      owner = "gleam-lang";
      repo = "tree-sitter-gleam";
-      rev = "2b49c49ef632928b5c52bb0a7269ff797d5d1414";
-      hash = "sha256-zFdyUqbJn7ighjXH+9EO+0Cf2Oj8ON8IYUZCIQUQ5dA=";
+      rev = "62c5388a7badb4e29315690358267a76a734bf83";
+      hash = "sha256-Mxjifj5eIyw6rKPMAuhEt6bXTeHX2fDeJ1VaiZ70vgE=";
    };
    meta.homepage = "https://github.com/gleam-lang/tree-sitter-gleam";
  };
@ -803,12 +803,12 @@
  };
  gomod = buildGrammar {
    language = "gomod";
-    version = "0.0.0+rev=9b86399";
+    version = "0.0.0+rev=bbe2fe3";
    src = fetchFromGitHub {
      owner = "camdencheek";
      repo = "tree-sitter-go-mod";
-      rev = "9b86399ab733fbd548ba0e817e732cb3351082d2";
-      hash = "sha256-STi1lqsfmaiMKrk7C6fjkmJ0ehhTf+AF6hly34/3BIg=";
+      rev = "bbe2fe3be4b87e06a613e685250f473d2267f430";
+      hash = "sha256-OPtqXe6OMC9c5dgFH8Msj+6DU01LvLKVbCzGLj0PnLI=";
    };
    meta.homepage = "https://github.com/camdencheek/tree-sitter-go-mod";
  };
@ -1353,24 +1353,24 @@
  };
  markdown = buildGrammar {
    language = "markdown";
-    version = "0.0.0+rev=f9820b2";
+    version = "0.0.0+rev=28aa3ba";
    src = fetchFromGitHub {
      owner = "MDeiml";
      repo = "tree-sitter-markdown";
-      rev = "f9820b2db958228f9be339b67d2de874d065866e";
-      hash = "sha256-0T0P018Zb4tfU2D4PLhiW8tunOInlRtrHajPOVqOpwc=";
+      rev = "28aa3baef73bd458d053b613b8bd10fd102b4405";
+      hash = "sha256-HSjKYqjrJKPLbdq1UTvk/KnDqsIzVO7k5syCsIpAZpw=";
    };
    location = "tree-sitter-markdown";
    meta.homepage = "https://github.com/MDeiml/tree-sitter-markdown";
  };
  markdown_inline = buildGrammar {
    language = "markdown_inline";
-    version = "0.0.0+rev=f9820b2";
+    version = "0.0.0+rev=28aa3ba";
    src = fetchFromGitHub {
      owner = "MDeiml";
      repo = "tree-sitter-markdown";
-      rev = "f9820b2db958228f9be339b67d2de874d065866e";
-      hash = "sha256-0T0P018Zb4tfU2D4PLhiW8tunOInlRtrHajPOVqOpwc=";
+      rev = "28aa3baef73bd458d053b613b8bd10fd102b4405";
+      hash = "sha256-HSjKYqjrJKPLbdq1UTvk/KnDqsIzVO7k5syCsIpAZpw=";
    };
    location = "tree-sitter-markdown-inline";
    meta.homepage = "https://github.com/MDeiml/tree-sitter-markdown";
@ -1543,24 +1543,24 @@
  };
  ocaml = buildGrammar {
    language = "ocaml";
-    version = "0.0.0+rev=694c577";
+    version = "0.0.0+rev=4abfdc1";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-ocaml";
-      rev = "694c57718fd85d514f8b81176038e7a4cfabcaaf";
-      hash = "sha256-j3Hv2qOMxeBNOW+WIgIYzG3zMIFWPQpoHe94b2rT+A8=";
+      rev = "4abfdc1c7af2c6c77a370aee974627be1c285b3b";
+      hash = "sha256-ycmjIKfrsVSVHmPP3HCxfk5wcBIF/JFH8OnU8mY1Cc8=";
    };
    location = "ocaml";
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-ocaml";
  };
  ocaml_interface = buildGrammar {
    language = "ocaml_interface";
-    version = "0.0.0+rev=694c577";
+    version = "0.0.0+rev=4abfdc1";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-ocaml";
-      rev = "694c57718fd85d514f8b81176038e7a4cfabcaaf";
-      hash = "sha256-j3Hv2qOMxeBNOW+WIgIYzG3zMIFWPQpoHe94b2rT+A8=";
+      rev = "4abfdc1c7af2c6c77a370aee974627be1c285b3b";
+      hash = "sha256-ycmjIKfrsVSVHmPP3HCxfk5wcBIF/JFH8OnU8mY1Cc8=";
    };
    location = "interface";
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-ocaml";
@ -1634,24 +1634,25 @@
  };
  perl = buildGrammar {
    language = "perl";
-    version = "0.0.0+rev=655632f";
+    version = "0.0.0+rev=9c0cea7";
    src = fetchFromGitHub {
      owner = "tree-sitter-perl";
      repo = "tree-sitter-perl";
-      rev = "655632fa7f9174acbdbf1ad2abdac90ad3aa57a1";
-      hash = "sha256-0EKZTdK9hXWS7VmX8QljwLDPV0yN2d99A7ZnhXRXpPk=";
+      rev = "9c0cea7720f65a5e832c4d924356d7793f519e36";
+      hash = "sha256-HRhUyt2PHP+NiYqoY8iTrO/9F5iZLv4pNYHA7ZjCZmE=";
    };
    meta.homepage = "https://github.com/tree-sitter-perl/tree-sitter-perl";
  };
  php = buildGrammar {
    language = "php";
-    version = "0.0.0+rev=0a99dec";
+    version = "0.0.0+rev=b569a5f";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-php";
-      rev = "0a99deca13c4af1fb9adcb03c958bfc9f4c740a9";
-      hash = "sha256-MfCws6WvaYJPoxoSdk1OUkqfVGCNtfMDTyndSZpABqI=";
+      rev = "b569a5f2c0d592e67430520d1a0e1f765d83ceb0";
+      hash = "sha256-ScPFOsPVy5We1MePbf0fpyMlnqVad1dszj7uyCdi3Og=";
    };
+    location = "php";
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-php";
  };
  phpdoc = buildGrammar {
@ -1720,6 +1721,17 @@
    };
    meta.homepage = "https://github.com/amaanq/tree-sitter-pony";
  };
+  printf = buildGrammar {
+    language = "printf";
+    version = "0.0.0+rev=0469630";
+    src = fetchFromGitHub {
+      owner = "ObserverOfTime";
+      repo = "tree-sitter-printf";
+      rev = "04696305caceab64a78e3a749774718d87ba85a1";
+      hash = "sha256-MWrKImt7+E4LYsrSMKIEifXmb6MeuiNxy3pt1DCCLBQ=";
+    };
+    meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-printf";
+  };
  prisma = buildGrammar {
    language = "prisma";
    version = "0.0.0+rev=eca2596";
@ -2020,12 +2032,12 @@
  };
  ruby = buildGrammar {
    language = "ruby";
-    version = "0.0.0+rev=f257f3f";
+    version = "0.0.0+rev=4d9ad3f";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-ruby";
-      rev = "f257f3f57833d584050336921773738a3fd8ca22";
-      hash = "sha256-0EaU9O67faGwtO1GIxjK4Uv1etd0p1vtfrVB3d6TDF8=";
+      rev = "4d9ad3f010fdc47a8433adcf9ae30c8eb8475ae7";
+      hash = "sha256-d3pN+Z8qGDDKuy8OyguGNVD97m2VasVvi8CckdCsOB8=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-ruby";
  };
@ -2042,12 +2054,12 @@
  };
  scala = buildGrammar {
    language = "scala";
-    version = "0.0.0+rev=696965e";
+    version = "0.0.0+rev=45b5ba0";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-scala";
-      rev = "696965ee3bafd47f4b5204d1e63b4ea4b52d9f9b";
-      hash = "sha256-07C9tAaG7p2xCzoAR2choNh9A7mJyusfQviqgcZmlgE=";
+      rev = "45b5ba0e749a8477a8fd2666f082f352859bdc3c";
+      hash = "sha256-tH2STGmCaVHDL4fOh8whPmiHbwKu8ZxjS4wDt+qVjjs=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-scala";
  };
@ -2188,12 +2200,12 @@
  };
  sql = buildGrammar {
    language = "sql";
-    version = "0.0.0+rev=b599f6a";
+    version = "0.0.0+rev=fd70fb3";
    src = fetchFromGitHub {
      owner = "derekstride";
      repo = "tree-sitter-sql";
-      rev = "b599f6a1ca37cb5bae827a424cd98371a0d91bdc";
-      hash = "sha256-GwDkAgWcMyASzfd8layZjjEigXelJbtQTgWe7VBLgwM=";
+      rev = "fd70fb358d164cd93fbe2674a9cca276dc5203f7";
+      hash = "sha256-GXQH/df33jxrIRXkJg2qRXrP6/3k+PodNxZ1O/ceaT8=";
    };
    meta.homepage = "https://github.com/derekstride/tree-sitter-sql";
  };
@ -2355,12 +2367,12 @@
  };
  templ = buildGrammar {
    language = "templ";
-    version = "0.0.0+rev=14d1057";
+    version = "0.0.0+rev=c3baaab";
    src = fetchFromGitHub {
      owner = "vrischmann";
      repo = "tree-sitter-templ";
-      rev = "14d105789af342f7f0c32bff2fec1a6edec59f60";
-      hash = "sha256-wj0LH5kgMEONd4xi0c52s+UnnQhw1DJ9fE+EumKiIMM=";
+      rev = "c3baaab33f1f1032eedd3613cd932284975bd21f";
+      hash = "sha256-7YMHGcDR4Wd2FolFnh2fZ3M65L5E5BLAoJyMuRsh7Uo=";
    };
    meta.homepage = "https://github.com/vrischmann/tree-sitter-templ";
  };
@ -2411,23 +2423,23 @@
  };
  tlaplus = buildGrammar {
    language = "tlaplus";
-    version = "0.0.0+rev=aeb2e8f";
+    version = "0.0.0+rev=aaf5bb5";
    src = fetchFromGitHub {
      owner = "tlaplus-community";
      repo = "tree-sitter-tlaplus";
-      rev = "aeb2e8fdc417c32ae7d1149cfa2a8ddc3b293600";
-      hash = "sha256-fETWuo/mZA6tCux0Hsdbg/vTxo/cdtIES9VIp75twMw=";
+      rev = "aaf5bb5c1df0a6e583bb51efa519a9ac788b2ad8";
+      hash = "sha256-p/khQ31bReopPyZ1TvUKI6bnFipWiGrxKO7cAYzeku4=";
    };
    meta.homepage = "https://github.com/tlaplus-community/tree-sitter-tlaplus";
  };
  todotxt = buildGrammar {
    language = "todotxt";
-    version = "0.0.0+rev=0207f6a";
+    version = "0.0.0+rev=3937c5c";
    src = fetchFromGitHub {
      owner = "arnarg";
      repo = "tree-sitter-todotxt";
-      rev = "0207f6a4ab6aeafc4b091914d31d8235049a2578";
-      hash = "sha256-FWVW+qWOUSri+qf+qistf8bKWJCTxUKkoO66yUYtwHI=";
+      rev = "3937c5cd105ec4127448651a21aef45f52d19609";
+      hash = "sha256-OeAh51rcFTiexAraRzIZUR/A8h9RPwKY7rmtc3ZzoRQ=";
    };
    meta.homepage = "https://github.com/arnarg/tree-sitter-todotxt.git";
  };
@ -2569,12 +2581,12 @@
  };
  v = buildGrammar {
    language = "v";
-    version = "0.0.0+rev=b59edea";
+    version = "0.0.0+rev=9ac84e6";
    src = fetchFromGitHub {
      owner = "v-analyzer";
      repo = "v-analyzer";
-      rev = "b59edeac4a819999ebc5a78bbd384bd30bf6fa30";
-      hash = "sha256-u1+EV3iEPU1NAHxKdThe1qXUx6jDt1MRBMTEScf8uQw=";
+      rev = "9ac84e62396bb13c8f1d11f967f0c0f2dec1a448";
+      hash = "sha256-a+oV175rnCgf5uTjmYkxTelekesBCEhcTOnKGorM88c=";
    };
    location = "tree_sitter_v";
    meta.homepage = "https://github.com/v-analyzer/v-analyzer";
@ -2625,12 +2637,12 @@
  };
  vimdoc = buildGrammar {
    language = "vimdoc";
-    version = "0.0.0+rev=4f8ba9e";
+    version = "0.0.0+rev=ed8695a";
    src = fetchFromGitHub {
      owner = "neovim";
      repo = "tree-sitter-vimdoc";
-      rev = "4f8ba9e39c8b3fbaf0bb5f70ac255474a9099359";
-      hash = "sha256-WSDz3vP/qNW1VGmXd5aGjO9PrJpjBNN4wdBohSbh9co=";
+      rev = "ed8695ad8de39c3f073da130156f00b1148e2891";
+      hash = "sha256-q5Ln8WPFrtKBfZnaAAlMh3Q/eczEt6wCMZAtx+ISCKg=";
    };
    meta.homepage = "https://github.com/neovim/tree-sitter-vimdoc";
  };
@ -2669,12 +2681,12 @@
  };
  wing = buildGrammar {
    language = "wing";
-    version = "0.0.0+rev=d85ef04";
+    version = "0.0.0+rev=ee58533";
    src = fetchFromGitHub {
      owner = "winglang";
      repo = "wing";
-      rev = "d85ef04bb7e75e2627348b45a5f357a2c7fbee91";
-      hash = "sha256-1N/vRQpgazayL95OA6PxzhxhjU+Uj9lgrEZnflQ4FLE=";
+      rev = "ee58533169c654b8d7fd47fde01241e528674d8a";
+      hash = "sha256-HhOWVBM4SNHgN48wgWARBo6Rd3T9Y1DC91gVm1EzvUo=";
    };
    location = "libs/tree-sitter-wing";
    generate = true;
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -284,6 +284,10 @@
    dependencies = with self; [ nvim-cmp nvim-snippy ];
  };

+  cmp-tabby = super.cmp-tabby.overrideAttrs {
+    dependencies = with self; [ nvim-cmp ];
+  };
+
  cmp-tabnine = super.cmp-tabnine.overrideAttrs {
    buildInputs = [ tabnine ];

@ -1112,7 +1116,7 @@
        pname = "sg-nvim-rust";
        inherit (old) version src;

-        cargoHash = "sha256-U+EGS0GMWzE2yFyMH04gXpR9lR7HRMgWBecqICfTUbE=";
+        cargoHash = "sha256-BDNFZ/7nnfvtBA7T6a7MDNJsq/cOI9tgW0kxUoIcbV8=";

        nativeBuildInputs = [ pkg-config ];

--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -152,6 +152,7 @@ https://github.com/hrsh7th/cmp-path/,,
 https://github.com/lukas-reineke/cmp-rg/,HEAD,
 https://github.com/dcampos/cmp-snippy/,HEAD,
 https://github.com/f3fora/cmp-spell/,,
+https://github.com/nzlov/cmp-tabby/,HEAD,
 https://github.com/tzachar/cmp-tabnine/,,
 https://github.com/andersevenrud/cmp-tmux/,,
 https://github.com/ray-x/cmp-treesitter/,,
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -675,6 +675,22 @@ let
        };
      };

+      carrie999.cyberpunk-2020 = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "cyberpunk-2020";
+          publisher = "carrie999";
+          version = "0.1.4";
+          sha256 = "sha256-tVbd+j9+90Z07+jGAiT0gylZN9YWHdJmq2sh1wf2oGE=";
+        };
+        meta = {
+          description = "A cyberpunk-inspired colour theme to satisfy your neon dreams";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=carrie999.cyberpunk-2020";
+          homepage = "https://github.com/Carrie999/cyberpunk";
+          license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.d3vil0p3r ];
+        };
+      };
+
      catppuccin = {
        catppuccin-vsc = buildVscodeMarketplaceExtension {
          mktplcRef = {
@ -1073,6 +1089,23 @@ let
        meta = { license = lib.licenses.mit; };
      };

+      dhedgecock.radical-vscode = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "radical-vscode";
+          publisher = "dhedgecock";
+          version = "3.3.1";
+          sha256 = "sha256-VvFQovuE+I0lqXU9fHrmk7nWMpuuWafqm9Acwb0+QYg=";
+        };
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/dhedgecock.radical-vscode/changelog";
+          description = "A dark theme for radical hacking inspired by retro futuristic design";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=dhedgecock.radical-vscode";
+          homepage = "https://github.com/dhedgecock/radical-vscode";
+          license = lib.licenses.isc;
+          maintainers = [ lib.maintainers.d3vil0p3r ];
+        };
+      };
+
      disneystreaming.smithy = buildVscodeMarketplaceExtension {
        mktplcRef = {
          publisher = "disneystreaming";
@ -2743,6 +2776,22 @@ let
        };
      };

+      nur.just-black = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "just-black";
+          publisher = "nur";
+          version = "3.1.1";
+          sha256 = "sha256-fatJZquCDsLDFGVzBol2D6LIZUbZ6GzqcVEFAwLodW0=";
+        };
+        meta = {
+          description = "A dark theme designed specifically for syntax highlighting";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=nur.just-black";
+          homepage = "https://github.com/nurmohammed840/extension.vsix/tree/Just-Black";
+          license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.d3vil0p3r ];
+        };
+      };
+
      nvarner.typst-lsp = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "typst-lsp";
@ -3166,6 +3215,23 @@ let
        };
      };

+      silofy.hackthebox = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "hackthebox";
+          publisher = "silofy";
+          version = "0.2.9";
+          sha256 = "sha256-WSPuEh+osu0DpXgPAzMU5Fw0Sh8sZFst7kx26s2BsyQ=";
+        };
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/silofy.hackthebox/changelog";
+          description = "A Visual Studio Code theme built for hackers by hackers";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=silofy.hackthebox";
+          homepage = "https://github.com/silofy/hackthebox";
+          license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.d3vil0p3r ];
+        };
+      };
+
      skellock.just = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "just";
@ -3443,6 +3509,23 @@ let
        meta.license = lib.licenses.mit;
      };

+      thorerik.hacker-theme = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "hacker-theme";
+          publisher = "thorerik";
+          version = "3.0.1";
+          sha256 = "sha256-Ugk9kTJxW1kbD+X6PF96WBc1k7x4KaGu5WbCYPGQ3qE=";
+        };
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/thorerik.hacker-theme/changelog";
+          description = "The perfect theme for writing IP tracers in Visual Basic and reverse-proxying a UNIX-system firewall";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=thorerik.hacker-theme";
+          homepage = "https://github.com/thorerik/vscode-hacker-theme";
+          license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.d3vil0p3r ];
+        };
+      };
+
      tiehuis.zig = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "zig";
--- a/pkgs/applications/misc/chatblade/default.nix
+++ b/pkgs/applications/misc/chatblade/default.nix
@ -2,12 +2,12 @@

 python3Packages.buildPythonApplication rec {
  pname = "chatblade";
-  version = "0.3.1";
+  version = "0.3.4";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-QBURvPfDBbhF+AhQ0SsHYnZzr5RN36Cqa2DrAQZW0gU=";
+    sha256 = "sha256-ODC8n4JS7IOfAJMn7CPzJcBNMhfD5A3eEqVUK1e4mZY=";
  };

  doCheck = false; # there are no tests
--- a/pkgs/applications/networking/cluster/werf/default.nix
+++ b/pkgs/applications/networking/cluster/werf/default.nix
@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "werf";
-  version = "1.2.277";
+  version = "1.2.281";

  src = fetchFromGitHub {
    owner = "werf";
    repo = "werf";
    rev = "v${version}";
-    hash = "sha256-BUoioYirMNp1Xegmsr+qGfG4G3jfYEHED4XC5u8YgOQ=";
+    hash = "sha256-mUCUj8mm5SE/jrUGp24f7Rsa/6MUNlHKOPlHzfIPTqc=";
  };

-  vendorHash = "sha256-dHNvUCOxzFjdvpX+3X+ZOshOSR0DpofKkCR65Ul0hqM=";
+  vendorHash = "sha256-1rurHe3jFs+jOZhqBlH/IOoEyCEZoNpzBYnYC/UqYAU=";

  proxyVendor = true;

--- a/pkgs/applications/networking/feedreaders/goeland/default.nix
+++ b/pkgs/applications/networking/feedreaders/goeland/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "goeland";
-  version = "0.18.2";
+  version = "0.18.3";

  src = fetchFromGitHub {
    owner = "slurdge";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-pi4hkvBg1oMlD1zYv0YNmG+AZb0oZB4UGEtCeURhjfY=";
+    sha256 = "sha256-4xhw6L6CuwW2MepwGvpVLVafMcU/g0bn/2M/8ZSRF/U=";
  };

  vendorHash = "sha256-TZIHYFE4kJu5EOQ9oT8S0Tp/r38d5RhoLdmIrus8Ibc=";
--- a/pkgs/applications/networking/instant-messengers/beeper/default.nix
+++ b/pkgs/applications/networking/instant-messengers/beeper/default.nix
@ -11,11 +11,11 @@
 }:
 let
  pname = "beeper";
-  version = "3.91.55";
+  version = "3.92.23";
  name = "${pname}-${version}";
  src = fetchurl {
-    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.91.55-build-240103fvmyrbzxm-x86_64.AppImage";
-    hash = "sha256-QceHUVOBMDjrkSHCEG5rjHJRzVmOUEDhUJ8p9CTbIKk=";
+    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.92.23-build-240111az2vz7kii-x86_64.AppImage";
+    hash = "sha256-M+3mJ+X/yr6yONOpdnCRECbswYlSuhlqqbg2d6Px/7s=";
  };
  appimage = appimageTools.wrapType2 {
    inherit version pname src;
--- a/pkgs/applications/networking/instant-messengers/fluffychat/default.nix
+++ b/pkgs/applications/networking/instant-messengers/fluffychat/default.nix
@ -1,4 +1,5 @@
 { lib
+, fetchzip
 , fetchFromGitHub
 , imagemagick
 , mesa
@ -7,13 +8,15 @@
 , pulseaudio
 , makeDesktopItem
 , gnome
+
+, targetFlutterPlatform ? "linux"
 }:

 let
  libwebrtcRpath = lib.makeLibraryPath [ mesa libdrm ];
 in
-flutter313.buildFlutterApplication rec {
-  pname = "fluffychat";
+flutter313.buildFlutterApplication (rec {
+  pname = "fluffychat-${targetFlutterPlatform}";
  version = "1.14.1";

  src = fetchFromGitHub {
@ -30,6 +33,25 @@ flutter313.buildFlutterApplication rec {
    wakelock_windows = "sha256-Dfwe3dSScD/6kvkP67notcbb+EgTQ3kEYcH7wpra2dI=";
  };

+  inherit targetFlutterPlatform;
+
+  meta = with lib; {
+    description = "Chat with your friends (matrix client)";
+    homepage = "https://fluffychat.im/";
+    license = licenses.agpl3Plus;
+    maintainers = with maintainers; [ mkg20001 gilice ];
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
+    sourceProvenance = [ sourceTypes.fromSource ];
+  };
+} // lib.optionalAttrs (targetFlutterPlatform == "linux") {
+  nativeBuildInputs = [ imagemagick ];
+
+  runtimeDependencies = [ pulseaudio ];
+
+  extraWrapProgramArgs = "--prefix PATH : ${gnome.zenity}/bin";
+
+  env.NIX_LDFLAGS = "-rpath-link ${libwebrtcRpath}";
+
  desktopItem = makeDesktopItem {
    name = "Fluffychat";
    exec = "@out@/bin/fluffychat";
@ -39,9 +61,6 @@ flutter313.buildFlutterApplication rec {
    categories = [ "Chat" "Network" "InstantMessaging" ];
  };

-  nativeBuildInputs = [ imagemagick ];
-  runtimeDependencies = [ pulseaudio ];
-  extraWrapProgramArgs = "--prefix PATH : ${gnome.zenity}/bin";
  postInstall = ''
    FAV=$out/app/data/flutter_assets/assets/favicon.png
    ICO=$out/share/icons
@ -59,15 +78,21 @@ flutter313.buildFlutterApplication rec {

    patchelf --add-rpath ${libwebrtcRpath} $out/app/lib/libwebrtc.so
  '';
-
-  env.NIX_LDFLAGS = "-rpath-link ${libwebrtcRpath}";
-
-  meta = with lib; {
-    description = "Chat with your friends (matrix client)";
-    homepage = "https://fluffychat.im/";
-    license = licenses.agpl3Plus;
-    maintainers = with maintainers; [ mkg20001 gilice ];
-    platforms = [ "x86_64-linux" "aarch64-linux" ];
-    sourceProvenance = [ sourceTypes.fromSource ];
-  };
-}
+} // lib.optionalAttrs (targetFlutterPlatform == "web") {
+  prePatch =
+    # https://github.com/krille-chan/fluffychat/blob/v1.17.1/scripts/prepare-web.sh
+    let
+      # Use Olm 1.3.2, the oldest version, for FluffyChat 1.14.1 which depends on olm_flutter 1.2.0.
+      # In the future, this should be changed to use self.pubspecLock.dependencyVersions.flutter_olm as the script does.
+      olmVersion = "1.3.2";
+      olmJs = fetchzip {
+        url = "https://github.com/famedly/olm/releases/download/v${olmVersion}/olm.zip";
+        stripRoot = false;
+        hash = "sha256-Vl3Cp2OaYzM5CPOOtTHtUb1W48VXePzOV6FeiIzyD1Y=";
+      };
+    in
+    ''
+      rm -r assets/js/package
+      cp -r '${olmJs}/javascript' assets/js/package
+    '';
+})
--- a/pkgs/applications/networking/instant-messengers/fractal/Cargo.lock
+++ b/pkgs/applications/networking/instant-messengers/fractal/Cargo.lock
--- a/pkgs/applications/networking/instant-messengers/fractal/default.nix
+++ b/pkgs/applications/networking/instant-messengers/fractal/default.nix
@ -25,21 +25,20 @@

 stdenv.mkDerivation rec {
  pname = "fractal";
-  version = "5";
+  version = "6";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "GNOME";
    repo = "fractal";
    rev = version;
-    hash = "sha256-XHb8HjQ5PDL2sen6qUivDllvYEhKnp1vQynD2Lksi30=";
+    hash = "sha256-J4Jb7G5Rfou3N7mytetIdLl0dGY5dSvTjnu8aj4kWXQ=";
  };

  cargoDeps = rustPlatform.importCargoLock {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "matrix-sdk-0.6.2" = "sha256-X+4077rlaE8zjXHXPUfiYwa/+Bg0KTFrcsAg7yCz4ug=";
-      "mas-http-0.5.0-rc.2" = "sha256-XH+I5URcbkSY4NDwfOFhIjb+/swuGz6n9hKufziPgoY=";
+      "matrix-sdk-0.6.2" = "sha256-CY0Ylrd3NkP1IevyQa351IS/+evG2GgrjPnR/ZDFR9Q=";
    };
  };

@ -82,6 +81,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "Matrix group messaging app";
    homepage = "https://gitlab.gnome.org/GNOME/fractal";
+    changelog = "https://gitlab.gnome.org/World/fractal/-/releases/${version}";
    license = licenses.gpl3Plus;
    maintainers = teams.gnome.members ++ (with maintainers; [ anselmschueler dtzWill ]);
    platforms = platforms.linux;
--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@ -45,14 +45,14 @@ let

  pname = "slack";

-  x86_64-darwin-version = "4.36.134";
-  x86_64-darwin-sha256 = "13s7vcbi180y221qh5dpvp9s94511lqwih3k52k61p98xjarrcwv";
+  x86_64-darwin-version = "4.36.138";
+  x86_64-darwin-sha256 = "1dj4q98sva25kbniqnwz2l38lg48dhrdmjx31sg8j0ayrs82hha4";

-  x86_64-linux-version = "4.35.131";
-  x86_64-linux-sha256 = "0mb33vvb36aavn52yvk5fiyc8f7z56cqm1siknaap707iqqfpwpb";
+  x86_64-linux-version = "4.36.138";
+  x86_64-linux-sha256 = "06h258fvpprx37vjvd5sxl6bxnfcq3shviwx9wv8m9fmg2riwnsg";

-  aarch64-darwin-version = "4.36.134";
-  aarch64-darwin-sha256 = "0yyqmyicf4rkpvp6al2kb7g188xhg3m8hyi24a23yhnil8hk2r3v";
+  aarch64-darwin-version = "4.36.138";
+  aarch64-darwin-sha256 = "10xg5aa668iq0n56la1rqgpbzw8jym0y8dgv99f1l7yn03fcwpql";

  version = {
    x86_64-darwin = x86_64-darwin-version;
--- a/pkgs/applications/science/chemistry/molden/default.nix
+++ b/pkgs/applications/science/chemistry/molden/default.nix
@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out/bin
  '';

-  enableParallelBuilding = true;
+  enableParallelBuilding = false;

  meta = with lib; {
     description = "Display and manipulate molecular structures";
--- a/pkgs/applications/video/kodi/addons/inputstream-adaptive/default.nix
+++ b/pkgs/applications/video/kodi/addons/inputstream-adaptive/default.nix
@ -10,13 +10,13 @@ in
 buildKodiBinaryAddon rec {
  pname = "inputstream-adaptive";
  namespace = "inputstream.adaptive";
-  version = "20.3.14";
+  version = "20.3.16";

  src = fetchFromGitHub {
    owner = "xbmc";
    repo = "inputstream.adaptive";
    rev = "${version}-${rel}";
-    sha256 = "sha256-9S98LgeXq2Wc5CLd5WGo7iNM9ZkSuDBO/O35wf0SjZY=";
+    sha256 = "sha256-1OY+3pvpVW8rkj7HL84IECyHpAmWsUQ9mTzuGesH+jI=";
  };

  extraCMakeFlags = [
--- a/pkgs/build-support/dart/build-dart-application/default.nix
+++ b/pkgs/build-support/dart/build-dart-application/default.nix
@ -87,7 +87,7 @@ let
      dartCompileCommand dartOutputType dartRuntimeCommand dartCompileFlags
      dartJitFlags;

-    outputs = args.outputs or [ ] ++ [ "out" "pubcache" ];
+    outputs = [ "out" "pubcache" ] ++ args.outputs or [ ];

    dartEntryPoints =
      if (dartEntryPoints != null)
--- a/pkgs/build-support/dart/build-dart-application/hooks/dart-install-hook.sh
+++ b/pkgs/build-support/dart/build-dart-application/hooks/dart-install-hook.sh
@ -19,15 +19,25 @@ dartInstallHook() {
        fi
    done < <(_getDartEntryPoints)

-    # Install the package_config.json file.
-    mkdir -p "$pubcache"
-    cp .dart_tool/package_config.json "$pubcache/package_config.json"
-
    runHook postInstall

    echo "Finished dartInstallHook"
 }

+dartInstallCacheHook() {
+    echo "Executing dartInstallCacheHook"
+
+    # Install the package_config.json file.
+    mkdir -p "$pubcache"
+    cp .dart_tool/package_config.json "$pubcache/package_config.json"
+
+    echo "Finished dartInstallCacheHook"
+}
+
 if [ -z "${dontDartInstall-}" ] && [ -z "${installPhase-}" ]; then
    installPhase=dartInstallHook
 fi
+
+if [ -z "${dontDartInstallCache-}" ]; then
+    postInstallHooks+=(dartInstallCacheHook)
+fi
--- a/pkgs/build-support/flutter/default.nix
+++ b/pkgs/build-support/flutter/default.nix
@ -17,134 +17,163 @@

 { pubGetScript ? "flutter pub get"
 , flutterBuildFlags ? [ ]
+, targetFlutterPlatform ? "linux"
 , extraWrapProgramArgs ? ""
 , ...
 }@args:

-(buildDartApplication.override {
-  dart = flutter;
-}) (args // {
-  sdkSetupScript = ''
-    # Pub needs SSL certificates. Dart normally looks in a hardcoded path.
-    # https://github.com/dart-lang/sdk/blob/3.1.0/runtime/bin/security_context_linux.cc#L48
-    #
-    # Dart does not respect SSL_CERT_FILE...
-    # https://github.com/dart-lang/sdk/issues/48506
-    # ...and Flutter does not support --root-certs-file, so the path cannot be manually set.
-    # https://github.com/flutter/flutter/issues/56607
-    # https://github.com/flutter/flutter/issues/113594
-    #
-    # libredirect is of no use either, as Flutter does not pass any
-    # environment variables (including LD_PRELOAD) to the Pub process.
-    #
-    # Instead, Flutter is patched to allow the path to the Dart binary used for
-    # Pub commands to be overriden.
-    export NIX_FLUTTER_PUB_DART="${runCommand "dart-with-certs" { nativeBuildInputs = [ makeWrapper ]; } ''
-      mkdir -p "$out/bin"
-      makeWrapper ${flutter.dart}/bin/dart "$out/bin/dart" \
-        --add-flags "--root-certs-file=${cacert}/etc/ssl/certs/ca-bundle.crt"
-    ''}/bin/dart"
+let
+  builderArgs = rec {
+    universal = args // {
+      sdkSetupScript = ''
+        # Pub needs SSL certificates. Dart normally looks in a hardcoded path.
+        # https://github.com/dart-lang/sdk/blob/3.1.0/runtime/bin/security_context_linux.cc#L48
+        #
+        # Dart does not respect SSL_CERT_FILE...
+        # https://github.com/dart-lang/sdk/issues/48506
+        # ...and Flutter does not support --root-certs-file, so the path cannot be manually set.
+        # https://github.com/flutter/flutter/issues/56607
+        # https://github.com/flutter/flutter/issues/113594
+        #
+        # libredirect is of no use either, as Flutter does not pass any
+        # environment variables (including LD_PRELOAD) to the Pub process.
+        #
+        # Instead, Flutter is patched to allow the path to the Dart binary used for
+        # Pub commands to be overriden.
+        export NIX_FLUTTER_PUB_DART="${runCommand "dart-with-certs" { nativeBuildInputs = [ makeWrapper ]; } ''
+          mkdir -p "$out/bin"
+          makeWrapper ${flutter.dart}/bin/dart "$out/bin/dart" \
+            --add-flags "--root-certs-file=${cacert}/etc/ssl/certs/ca-bundle.crt"
+        ''}/bin/dart"

-    export HOME="$NIX_BUILD_TOP"
-    flutter config --no-analytics &>/dev/null # mute first-run
-    flutter config --enable-linux-desktop >/dev/null
-  '';
+        export HOME="$NIX_BUILD_TOP"
+        flutter config --no-analytics &>/dev/null # mute first-run
+        flutter config --enable-linux-desktop >/dev/null
+      '';

-  inherit pubGetScript;
+      inherit pubGetScript;

-  sdkSourceBuilders = {
-    # https://github.com/dart-lang/pub/blob/68dc2f547d0a264955c1fa551fa0a0e158046494/lib/src/sdk/flutter.dart#L81
-    "flutter" = name: runCommand "flutter-sdk-${name}" { passthru.packageRoot = "."; } ''
-      for path in '${flutter}/packages/${name}' '${flutter}/bin/cache/pkg/${name}'; do
-        if [ -d "$path" ]; then
-          ln -s "$path" "$out"
-          break
+      sdkSourceBuilders = {
+        # https://github.com/dart-lang/pub/blob/68dc2f547d0a264955c1fa551fa0a0e158046494/lib/src/sdk/flutter.dart#L81
+        "flutter" = name: runCommand "flutter-sdk-${name}" { passthru.packageRoot = "."; } ''
+          for path in '${flutter}/packages/${name}' '${flutter}/bin/cache/pkg/${name}'; do
+            if [ -d "$path" ]; then
+              ln -s "$path" "$out"
+              break
+            fi
+          done
+
+          if [ ! -e "$out" ]; then
+            echo 1>&2 'The Flutter SDK does not contain the requested package: ${name}!'
+            exit 1
+          fi
+        '';
+      };
+
+      extraPackageConfigSetup = ''
+        # https://github.com/flutter/flutter/blob/3.13.8/packages/flutter_tools/lib/src/dart/pub.dart#L755
+        if [ "$('${yq}/bin/yq' '.flutter.generate // false' pubspec.yaml)" = "true" ]; then
+          '${jq}/bin/jq' '.packages |= . + [{
+            name: "flutter_gen",
+            rootUri: "flutter_gen",
+            languageVersion: "2.12",
+          }]' "$out" | '${moreutils}/bin/sponge' "$out"
        fi
-      done
+      '';
+    };

-      if [ ! -e "$out" ]; then
-        echo 1>&2 'The Flutter SDK does not contain the requested package: ${name}!'
-        exit 1
-      fi
-    '';
-  };
+    linux = universal // {
+      outputs = universal.outputs or [ ] ++ [ "debug" ];

-  extraPackageConfigSetup = ''
-    # https://github.com/flutter/flutter/blob/3.13.8/packages/flutter_tools/lib/src/dart/pub.dart#L755
-    if [ "$('${yq}/bin/yq' '.flutter.generate // false' pubspec.yaml)" = "true" ]; then
-      '${jq}/bin/jq' '.packages |= . + [{
-        name: "flutter_gen",
-        rootUri: "flutter_gen",
-        languageVersion: "2.12",
-      }]' "$out" | '${moreutils}/bin/sponge' "$out"
-    fi
-  '';
+      nativeBuildInputs = (universal.nativeBuildInputs or [ ]) ++ [
+        wrapGAppsHook

-  nativeBuildInputs = (args.nativeBuildInputs or [ ]) ++ [
-    wrapGAppsHook
+        # Flutter requires pkg-config for Linux desktop support, and many plugins
+        # attempt to use it.
+        #
+        # It is available to the `flutter` tool through its wrapper, but it must be
+        # added here as well so the setup hook adds plugin dependencies to the
+        # pkg-config search paths.
+        pkg-config
+      ];

-    # Flutter requires pkg-config for Linux desktop support, and many plugins
-    # attempt to use it.
-    #
-    # It is available to the `flutter` tool through its wrapper, but it must be
-    # added here as well so the setup hook adds plugin dependencies to the
-    # pkg-config search paths.
-    pkg-config
-  ];
+      buildInputs = (universal.buildInputs or [ ]) ++ [ glib ];

-  buildInputs = (args.buildInputs or [ ]) ++ [ glib ];
+      dontDartBuild = true;
+      buildPhase = universal.buildPhase or ''
+        runHook preBuild

-  dontDartBuild = true;
-  buildPhase = args.buildPhase or ''
-    runHook preBuild
+        mkdir -p build/flutter_assets/fonts

-    mkdir -p build/flutter_assets/fonts
+        flutter build linux -v --release --split-debug-info="$debug" ${builtins.concatStringsSep " " (map (flag: "\"${flag}\"") flutterBuildFlags)}

-    flutter build linux -v --release --split-debug-info="$debug" ${builtins.concatStringsSep " " (map (flag: "\"${flag}\"") flutterBuildFlags)}
+        runHook postBuild
+      '';

-    runHook postBuild
-  '';
+      dontDartInstall = true;
+      installPhase = universal.installPhase or ''
+        runHook preInstall

-  dontDartInstall = true;
-  installPhase = args.installPhase or ''
-    runHook preInstall
+        built=build/linux/*/release/bundle

-    built=build/linux/*/release/bundle
+        mkdir -p $out/bin
+        mv $built $out/app

-    mkdir -p $out/bin
-    mv $built $out/app
+        for f in $(find $out/app -iname "*.desktop" -type f); do
+          install -D $f $out/share/applications/$(basename $f)
+        done

-    for f in $(find $out/app -iname "*.desktop" -type f); do
-      install -D $f $out/share/applications/$(basename $f)
-    done
+        for f in $(find $out/app -maxdepth 1 -type f); do
+          ln -s $f $out/bin/$(basename $f)
+        done

-    for f in $(find $out/app -maxdepth 1 -type f); do
-      ln -s $f $out/bin/$(basename $f)
-    done
+        # make *.so executable
+        find $out/app -iname "*.so" -type f -exec chmod +x {} +

-    # make *.so executable
-    find $out/app -iname "*.so" -type f -exec chmod +x {} +
+        # remove stuff like /build/source/packages/ubuntu_desktop_installer/linux/flutter/ephemeral
+        for f in $(find $out/app -executable -type f); do
+          if patchelf --print-rpath "$f" | grep /build; then # this ignores static libs (e,g. libapp.so) also
+            echo "strip RPath of $f"
+            newrp=$(patchelf --print-rpath $f | sed -r "s|/build.*ephemeral:||g" | sed -r "s|/build.*profile:||g")
+            patchelf --set-rpath "$newrp" "$f"
+          fi
+        done

-    # remove stuff like /build/source/packages/ubuntu_desktop_installer/linux/flutter/ephemeral
-    for f in $(find $out/app -executable -type f); do
-      if patchelf --print-rpath "$f" | grep /build; then # this ignores static libs (e,g. libapp.so) also
-        echo "strip RPath of $f"
-        newrp=$(patchelf --print-rpath $f | sed -r "s|/build.*ephemeral:||g" | sed -r "s|/build.*profile:||g")
-        patchelf --set-rpath "$newrp" "$f"
-      fi
-    done
+        runHook postInstall
+      '';

-    # Install the package_config.json file.
-    # This is normally done by dartInstallHook, but we disable it.
-    mkdir -p "$pubcache"
-    cp .dart_tool/package_config.json "$pubcache/package_config.json"
+      dontWrapGApps = true;
+      extraWrapProgramArgs = ''
+        ''${gappsWrapperArgs[@]} \
+        ${extraWrapProgramArgs}
+      '';
+    };

-    runHook postInstall
-  '';
+    web = universal // {
+      dontDartBuild = true;
+      buildPhase = universal.buildPhase or ''
+        runHook preBuild

-  dontWrapGApps = true;
-  extraWrapProgramArgs = ''
-    ''${gappsWrapperArgs[@]} \
-    ${extraWrapProgramArgs}
-  '';
-})
+        mkdir -p build/flutter_assets/fonts
+
+        flutter build web -v --release ${builtins.concatStringsSep " " (map (flag: "\"${flag}\"") flutterBuildFlags)}
+
+        runHook postBuild
+      '';
+
+      dontDartInstall = true;
+      installPhase = universal.installPhase or ''
+        runHook preInstall
+
+        cp -r build/web "$out"
+
+        runHook postInstall
+      '';
+    };
+  }.${targetFlutterPlatform} or (throw "Unsupported Flutter host platform: ${targetFlutterPlatform}");
+
+  minimalFlutter = flutter.override { supportedTargetFlutterPlatforms = [ "universal" targetFlutterPlatform ]; };
+
+  buildAppWith = flutter: buildDartApplication.override { dart = flutter; };
+in
+buildAppWith minimalFlutter (builderArgs // { passthru = builderArgs.passthru or { } // { multiShell = buildAppWith flutter builderArgs; }; })
--- a/pkgs/by-name/bs/bsync/package.nix
+++ b/pkgs/by-name/bs/bsync/package.nix
@ -0,0 +1,50 @@
+{ lib
+, fetchFromGitHub
+, stdenv
+, makeWrapper
+, python3
+, openssh
+, rsync
+, findutils
+, which
+}:
+
+stdenv.mkDerivation {
+  pname = "bsync";
+  version = "unstable-2023-12-21";
+
+  src = fetchFromGitHub {
+    owner  = "dooblem";
+    repo   = "bsync";
+    rev    = "25f77730750720ad68b0ab2773e79d9ca98c3647";
+    hash   = "sha256-k25MjLis0/dp1TTS4aFeJZq/c0T01LmNcWtC+dw/kKY=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm555 bsync -t $out/bin
+    runHook postInstall
+  '';
+
+nativeBuildInputs = [ makeWrapper ];
+buildInputs = [ python3 ];
+
+fixupPhase = ''
+  runHook preFixup
+
+  patchShebangs $out/bin/bsync
+  wrapProgram $out/bin/bsync \
+    --prefix PATH ":" ${lib.makeLibraryPath [ openssh rsync findutils which ]}
+
+  runHook postFixup
+'';
+
+  meta = with lib; {
+    homepage = "https://github.com/dooblem/bsync";
+    description = "Bidirectional Synchronization using Rsync";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers;  [ dietmarw ];
+    platforms = platforms.unix;
+    mainProgram = "bsync";
+  };
+}
--- a/pkgs/by-name/li/libmpdclient/package.nix
+++ b/pkgs/by-name/li/libmpdclient/package.nix
@ -0,0 +1,35 @@
+{ fetchFromGitHub
+, fixDarwinDylibNames
+, lib
+, meson
+, ninja
+, stdenv
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libmpdclient";
+  version = "2.22";
+
+  src = fetchFromGitHub {
+    owner = "MusicPlayerDaemon";
+    repo = "libmpdclient";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-KF8IR9YV6b9ro+L9m6nHs1IggakEZddfcBKm/oKCVZY=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+  ] ++ lib.optionals stdenv.isDarwin [
+    fixDarwinDylibNames
+  ];
+
+  meta = {
+    description = "Client library for MPD (music player daemon)";
+    homepage = "https://www.musicpd.org/libs/libmpdclient/";
+    changelog = "https://raw.githubusercontent.com/MusicPlayerDaemon/libmpdclient/${finalAttrs.src.rev}/NEWS";
+    license = with lib.licenses; [ bsd2 ];
+    maintainers = with lib.maintainers; [ AndersonTorres ehmry ];
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/by-name/mq/mqttx/package.nix
+++ b/pkgs/by-name/mq/mqttx/package.nix
@ -0,0 +1,57 @@
+{ lib
+, stdenv
+, fetchurl
+, appimageTools
+, imagemagick
+}:
+
+let
+  pname = "mqttx";
+  version = "1.9.8";
+
+  suffixedUrl = suffix: "https://github.com/emqx/MQTTX/releases/download/v${version}/MQTTX-${version}${suffix}.AppImage";
+  sources = {
+    "aarch64-linux" = fetchurl {
+      url = suffixedUrl "-arm64";
+      hash = "sha256-pdR9LwWgFdO0Dtn7ByyYKpLrfoBnl75TzQ31aIAJ/gs=";
+    };
+    "x86_64-linux" = fetchurl {
+      url = suffixedUrl "";
+      hash = "sha256-XHAroiFuUcK0aUleNDskI1bfVX7HfTvIvSup9gKJj1w=";
+    };
+  };
+
+  src = sources.${stdenv.hostPlatform.system}
+    or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+
+  appimageContents = appimageTools.extractType2 {
+    inherit pname version src;
+  };
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
+
+  extraPkgs = pkgs: [ ];
+
+  extraInstallCommands = ''
+    mv $out/bin/${pname}-${version} $out/bin/${pname}
+    install -m 444 -D ${appimageContents}/${pname}.desktop $out/share/applications/${pname}.desktop
+    install -m 444 -D ${appimageContents}/${pname}.png $out/share/icons/hicolor/1024x1024/apps/${pname}.png
+
+    ${imagemagick}/bin/convert ${appimageContents}/mqttx.png -resize 512x512 ${pname}_512.png
+    install -m 444 -D ${pname}_512.png $out/share/icons/hicolor/512x512/apps/${pname}.png
+
+    substituteInPlace $out/share/applications/${pname}.desktop \
+      --replace 'Exec=AppRun' 'Exec=${pname}'
+  '';
+
+  meta = with lib; {
+    description = "Powerful cross-platform MQTT 5.0 Desktop, CLI, and WebSocket client tools";
+    homepage = "https://mqttx.app/";
+    changelog = "https://github.com/emqx/MQTTX/releases/tag/v${version}";
+    license = licenses.asl20;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ gaelreyrol ];
+    mainProgram = "mqttx";
+  };
+}
--- a/pkgs/by-name/or/ory/package.nix
+++ b/pkgs/by-name/or/ory/package.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "ory";
-  version = "0.2.2";
+  version = "0.3.1";

  src = fetchFromGitHub {
    owner = "ory";
    repo = "cli";
    rev = "refs/tags/v${version}";
-    hash = "sha256-5N69/Gv4eYLbZNN+sEx+RcFyhGCT0hUxDCje1qrbWiY=";
+    hash = "sha256-dO595NzdkVug955dqji/ttAPb+sMGLxJftXHzHA37Lo=";
  };

  nativeBuildInputs = [
@ -23,7 +23,7 @@ buildGoModule rec {
    "sqlite"
  ];

-  vendorHash = "sha256-J9jyeLIT+1pFnHOUHrzmblVCJikvY05Sw9zMz5qaDOk=";
+  vendorHash = "sha256-H1dM/r7gJvjnexQwlA4uhJ7rUH15yg4AMRW/f0k1Ixw=";

  postInstall = ''
    mv $out/bin/cli $out/bin/ory
@ -36,8 +36,8 @@ buildGoModule rec {
  meta = with lib; {
    mainProgram = "ory";
    description = "The Ory CLI";
-    homepage = "https://www.ory.sh/";
+    homepage = "https://www.ory.sh/cli";
    license = licenses.asl20;
-    maintainers = with maintainers; [ luleyleo ];
+    maintainers = with maintainers; [ luleyleo nicolas-goudry ];
  };
 }
--- a/pkgs/by-name/su/suwayomi-server/package.nix
+++ b/pkgs/by-name/su/suwayomi-server/package.nix
@ -0,0 +1,58 @@
+{ lib
+, stdenvNoCC
+, fetchurl
+, makeWrapper
+, jdk17_headless
+, nixosTests
+}:
+
+let
+  jdk = jdk17_headless;
+in
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "suwayomi-server";
+  version = "0.7.0";
+  revision = 1197;
+
+  src = fetchurl {
+    url = "https://github.com/Suwayomi/Suwayomi-Server/releases/download/v${finalAttrs.version}/Tachidesk-Server-v${finalAttrs.version}-r${toString finalAttrs.revision}.jar";
+    hash = "sha256-4DO1WiBCu/8ypFgJdBmEwQXQ1xaWAlbt8N5TELomVVA=";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  dontUnpack = true;
+
+  buildPhase = ''
+    runHook preBuild
+
+    makeWrapper ${jdk}/bin/java $out/bin/tachidesk-server \
+      --add-flags "-Dsuwayomi.tachidesk.config.server.initialOpenInBrowserEnabled=false -jar $src"
+
+    runHook postBuild
+  '';
+
+  passthru.tests = {
+    suwayomi-server-with-auth = nixosTests.suwayomi-server.with-auth;
+    suwayomi-server-without-auth = nixosTests.suwayomi-server.without-auth;
+  };
+
+  meta = with lib; {
+    description = "A free and open source manga reader server that runs extensions built for Tachiyomi.";
+    longDescription = ''
+      Suwayomi is an independent Tachiyomi compatible software and is not a Fork of Tachiyomi.
+
+      Suwayomi-Server is as multi-platform as you can get. Any platform that runs java and/or has a modern browser can run it. This includes Windows, Linux, macOS, chrome OS, etc.
+    '';
+    homepage = "https://github.com/Suwayomi/Suwayomi-Server";
+    downloadPage = "https://github.com/Suwayomi/Suwayomi-Server/releases";
+    changelog = "https://github.com/Suwayomi/Suwayomi-Server/releases/tag/v${finalAttrs.version}";
+    license = licenses.mpl20;
+    platforms = jdk.meta.platforms;
+    maintainers = with maintainers; [ ratcornu ];
+    mainProgram = "tachidesk-server";
+  };
+})
--- a/pkgs/by-name/vc/vcpkg-tool/package.nix
+++ b/pkgs/by-name/vc/vcpkg-tool/package.nix
@ -18,13 +18,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "vcpkg-tool";
-  version = "2023-12-12";
+  version = "2024-01-11";

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = "vcpkg-tool";
    rev = finalAttrs.version;
-    hash = "sha256-Ol31TDY3cLEzXQk8YpK2Lf3CEnM5RkJqdcm/OQGUetE=";
+    hash = "sha256-PwCJv0O0ysE4CQVOrt+rqp3pjSt/11We+ZI8vdaYpPM=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/xf/xfs-undelete/package.nix
+++ b/pkgs/by-name/xf/xfs-undelete/package.nix
@ -0,0 +1,44 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, makeWrapper
+, coreutils
+, tcl-8_6
+, tcllib
+, installShellFiles
+}:
+
+stdenv.mkDerivation {
+  pname = "xfs_undelete";
+  version = "unstable-2023-04-12";
+
+  src =  fetchFromGitHub {
+    repo = "xfs_undelete";
+    owner = "ianka";
+    rev = "9e2f7abf0d3a466328e335d251c567ce4194e473";
+    sha256 = "0n1718bmr2lfpwx57hajancda51fyrgyk9rbybbadvd8gypvzmhh";
+  };
+
+  buildInputs = [ tcl-8_6 tcllib coreutils ];
+  nativeBuildInputs = [ makeWrapper tcl-8_6.tclPackageHook installShellFiles ];
+
+  tclWrapperArgs = [ "--prefix" "PATH" ":" (lib.makeBinPath [ tcl-8_6 ]) ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm555 xfs_undelete -t $out/bin
+    mv xfs_undelete.man xfs_undelete.8
+    installManPage xfs_undelete.8
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "An undelete tool for the XFS filesystem";
+    homepage = "https://github.com/ianka/xfs_undelete";
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.deepfire ];
+  };
+}
--- a/pkgs/desktops/lomiri/data/lomiri-sounds/default.nix
+++ b/pkgs/desktops/lomiri/data/lomiri-sounds/default.nix
@ -0,0 +1,47 @@
+{ stdenvNoCC
+, lib
+, fetchFromGitLab
+, gitUpdater
+, testers
+, cmake
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "lomiri-sounds";
+  version = "22.02";
+
+  src = fetchFromGitLab {
+    owner = "ubports";
+    repo = "development/core/lomiri-sounds";
+    rev = finalAttrs.version;
+    hash = "sha256-t9JYxrJ5ICslxidHmbD1wa6n7XZMf2a+PgMLcwgsDvU=";
+  };
+
+  postPatch = ''
+    # Doesn't need a compiler, only installs data
+    substituteInPlace CMakeLists.txt \
+      --replace 'project (lomiri-sounds)' 'project (lomiri-sounds LANGUAGES NONE)'
+  '';
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  passthru = {
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    updateScript = gitUpdater { };
+  };
+
+  meta = with lib; {
+    description = "Notification and ringtone sound effects for Lomiri";
+    homepage = "https://gitlab.com/ubports/development/core/lomiri-sounds";
+    license = with licenses; [ cc-by-30 cc0 cc-by-sa-30 cc-by-40 ];
+    maintainers = teams.lomiri.members;
+    platforms = platforms.all;
+    pkgConfigModules = [
+      "lomiri-sounds"
+    ];
+  };
+})
--- a/pkgs/desktops/lomiri/default.nix
+++ b/pkgs/desktops/lomiri/default.nix
@ -12,6 +12,7 @@ let

    #### Data
    lomiri-schemas = callPackage ./data/lomiri-schemas { };
+    lomiri-sounds = callPackage ./data/lomiri-sounds { };
    suru-icon-theme = callPackage ./data/suru-icon-theme { };

    #### Development tools / libraries
@ -38,6 +39,7 @@ let
    hfd-service = callPackage ./services/hfd-service { };
    history-service = callPackage ./services/history-service { };
    lomiri-download-manager = callPackage ./services/lomiri-download-manager { };
+    lomiri-indicator-network = callPackage ./services/lomiri-indicator-network { };
    lomiri-url-dispatcher = callPackage ./services/lomiri-url-dispatcher { };
    mediascanner2 = callPackage ./services/mediascanner2 { };
  };
--- a/pkgs/desktops/lomiri/services/lomiri-indicator-network/default.nix
+++ b/pkgs/desktops/lomiri/services/lomiri-indicator-network/default.nix
@ -0,0 +1,148 @@
+{ stdenv
+, lib
+, fetchFromGitLab
+, fetchpatch
+, gitUpdater
+, nixosTests
+, testers
+, cmake
+, cmake-extras
+, coreutils
+, dbus
+, doxygen
+, gettext
+, glib
+, gmenuharness
+, gtest
+, intltool
+, libsecret
+, libqofono
+, libqtdbusmock
+, libqtdbustest
+, lomiri-api
+, lomiri-url-dispatcher
+, networkmanager
+, ofono
+, pkg-config
+, python3
+, qtdeclarative
+, qtbase
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "lomiri-indicator-network";
+  version = "1.0.1";
+
+  src = fetchFromGitLab {
+    owner = "ubports";
+    repo = "development/core/lomiri-indicator-network";
+    rev = finalAttrs.version;
+    hash = "sha256-rJKWhW082ndVPEQHjuSriKtl0zQw86adxiINkZQq1hY=";
+  };
+
+  outputs = [
+    "out"
+    "dev"
+    "doc"
+  ];
+
+  patches = [
+    # Remove when version > 1.0.1
+    (fetchpatch {
+      name = "0001-lomiri-indicator-network-Make-less-assumptions-about-where-files-will-end-up.patch";
+      url = "https://gitlab.com/ubports/development/core/lomiri-indicator-network/-/commit/065212b22ab9aa8d25a61b5482ad6511e4c8510b.patch";
+      hash = "sha256-WrDTBKusK1808W8LZRGWaTOExu7gKpYBvkQ8hzoHoHk=";
+    })
+
+    # Remove when version > 1.0.1
+    (fetchpatch {
+      name = "0002-lomiri-indicator-network-Honour-CMAKE_INSTALL_DOCDIR_fordocumentation-installation.patch";
+      url = "https://gitlab.com/ubports/development/core/lomiri-indicator-network/-/commit/79b9e12313f765ab6e95b4d4dfefbdbca50ef3c6.patch";
+      hash = "sha256-vRfdegEi892UlrC9c1+5Td7CHLh7u0foPggLNBfc8lw=";
+    })
+  ];
+
+  postPatch = ''
+    # Queried via pkg-config, would need to override a prefix variable
+    # Needs CMake 3.28 or higher to do as part of the call, https://github.com/NixOS/nixpkgs/pull/275284
+    substituteInPlace data/CMakeLists.txt \
+      --replace 'pkg_get_variable(DBUS_SESSION_BUS_SERVICES_DIR dbus-1 session_bus_services_dir)' 'set(DBUS_SESSION_BUS_SERVICES_DIR "''${CMAKE_INSTALL_SYSCONFDIR}/dbus-1/services")' \
+      --replace 'pkg_get_variable(SYSTEMD_USER_DIR systemd systemduserunitdir)' 'set(SYSTEMD_USER_DIR "''${CMAKE_INSTALL_PREFIX}/lib/systemd/user")'
+  '';
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+    doxygen
+    gettext
+    intltool
+    pkg-config
+    qtdeclarative
+  ];
+
+  buildInputs = [
+    cmake-extras
+    dbus
+    glib
+    libqofono
+    libsecret
+    lomiri-api
+    lomiri-url-dispatcher
+    networkmanager
+    ofono
+    qtbase
+  ];
+
+  nativeCheckInputs = [
+    (python3.withPackages (ps: with ps; [
+      python-dbusmock
+    ]))
+  ];
+
+  checkInputs = [
+    gmenuharness
+    gtest
+    libqtdbusmock
+    libqtdbustest
+  ];
+
+  dontWrapQtApps = true;
+
+  cmakeFlags = [
+    (lib.cmakeBool "GSETTINGS_LOCALINSTALL" true)
+    (lib.cmakeBool "GSETTINGS_COMPILE" true)
+    (lib.cmakeBool "ENABLE_TESTS" finalAttrs.doCheck)
+    (lib.cmakeBool "ENABLE_UBUNTU_COMPAT" true) # just in case something needs it
+    (lib.cmakeBool "BUILD_DOC" true) # lacks QML docs, needs qdoc: https://github.com/NixOS/nixpkgs/pull/245379
+  ];
+
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+
+  postInstall = ''
+    substituteInPlace $out/etc/dbus-1/services/com.lomiri.connectivity1.service \
+      --replace '/bin/false' '${lib.getExe' coreutils "false"}'
+  '';
+
+  passthru = {
+    ayatana-indicators = [
+      "lomiri-indicator-network"
+    ];
+    tests = {
+      pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+      vm = nixosTests.ayatana-indicators;
+    };
+    updateScript = gitUpdater { };
+  };
+
+  meta = with lib; {
+    description = "Ayatana indiator exporting the network settings menu through D-Bus";
+    homepage = "https://gitlab.com/ubports/development/core/lomiri-indicator-network";
+    license = licenses.gpl3Only;
+    maintainers = teams.lomiri.members;
+    platforms = platforms.linux;
+    pkgConfigModules = [
+      "lomiri-connectivity-qt1"
+    ];
+  };
+})
--- a/pkgs/development/compilers/flutter/default.nix
+++ b/pkgs/development/compilers/flutter/default.nix
@ -51,12 +51,7 @@ let
    (mkCustomFlutter args).overrideAttrs (prev: next: {
      passthru = next.passthru // rec {
        inherit wrapFlutter mkCustomFlutter mkFlutter;
-        buildFlutterApplication = callPackage ../../../build-support/flutter {
-          # Package a minimal version of Flutter that only uses Linux desktop release artifacts.
-          flutter = (wrapFlutter (mkCustomFlutter args)).override {
-            supportedTargetFlutterPlatforms = [ "universal" "linux" ];
-          };
-        };
+        buildFlutterApplication = callPackage ../../../build-support/flutter { flutter = wrapFlutter (mkCustomFlutter args); };
      };
    });

--- a/pkgs/development/compilers/graalvm/community-edition/truffleruby/hashes.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/truffleruby/hashes.nix
@ -1,22 +1,22 @@
 # Generated by update.sh script
 {
-  "version" = "23.1.1";
+  "version" = "23.1.2";
  "hashes" = {
    "aarch64-linux" = {
-      sha256 = "0d8lxbfafgyirgs06bmfbmww61h8w3sr95z7y4x0ykfs7mghsnpd";
-      url = "https://github.com/oracle/truffleruby/releases/download/graal-23.1.1/truffleruby-community-23.1.1-linux-aarch64.tar.gz";
+      sha256 = "0bmrpp88zny0hbq4hqhs4xajqr96qxj6p5nj12m7kcr8hzh2vkf3";
+      url = "https://github.com/oracle/truffleruby/releases/download/graal-23.1.2/truffleruby-community-23.1.2-linux-aarch64.tar.gz";
    };
    "x86_64-linux" = {
-      sha256 = "1304yvllffnhwmpbcdsgcwkhc5w5w7r1rhxdwb709if8kglx793y";
-      url = "https://github.com/oracle/truffleruby/releases/download/graal-23.1.1/truffleruby-community-23.1.1-linux-amd64.tar.gz";
+      sha256 = "0hrab1jrs59swpx33zg111wa4nv2215ygyckv47x6mmjibf30c86";
+      url = "https://github.com/oracle/truffleruby/releases/download/graal-23.1.2/truffleruby-community-23.1.2-linux-amd64.tar.gz";
    };
    "x86_64-darwin" = {
-      sha256 = "09lfski3dj3zzp7cdfrndjafx48ln0wdgb7cs3an3krh6xjchi8l";
-      url = "https://github.com/oracle/truffleruby/releases/download/graal-23.1.1/truffleruby-community-23.1.1-macos-amd64.tar.gz";
+      sha256 = "1y68wz6rv2vksbnhmf57zlk8smgv9954np07d8ywdls99a92217z";
+      url = "https://github.com/oracle/truffleruby/releases/download/graal-23.1.2/truffleruby-community-23.1.2-macos-amd64.tar.gz";
    };
    "aarch64-darwin" = {
-      sha256 = "152mrz5hfnmsf5k1gd6rsb6yacy3zyjm2jl8q3zjl18n784np57b";
-      url = "https://github.com/oracle/truffleruby/releases/download/graal-23.1.1/truffleruby-community-23.1.1-macos-aarch64.tar.gz";
+      sha256 = "0za4ff3wlj2fgl2z3vzp2p4jf9x0fkvd98qwk1dm7lmffghfb14n";
+      url = "https://github.com/oracle/truffleruby/releases/download/graal-23.1.2/truffleruby-community-23.1.2-macos-aarch64.tar.gz";
    };
  };
 }
--- a/pkgs/development/cuda-modules/generic-builders/multiplex.nix
+++ b/pkgs/development/cuda-modules/generic-builders/multiplex.nix
@ -63,11 +63,12 @@ let
  # computeName :: Package -> String
  computeName = {version, ...}: mkVersionedPackageName pname version;

-  # Check whether a package supports our CUDA version
+  # Check whether a package supports our CUDA version and platform.
  # isSupported :: Package -> Bool
  isSupported =
    package:
-    !(strings.hasPrefix "unsupported" package.platform)
+    # The `platform` attribute of the package is NVIDIA's name for a redistributable architecture.
+    redistArch == package.platform
    && strings.versionAtLeast cudaVersion package.minCudaVersion
    && strings.versionAtLeast package.maxCudaVersion cudaVersion;

--- a/pkgs/development/embedded/arduino/arduino-cli/default.nix
+++ b/pkgs/development/embedded/arduino/arduino-cli/default.nix
@ -4,13 +4,13 @@ let

  pkg = buildGoModule rec {
    pname = "arduino-cli";
-    version = "0.34.2";
+    version = "0.35.1";

    src = fetchFromGitHub {
      owner = "arduino";
      repo = pname;
-      rev = version;
-      hash = "sha256-X7vrcaJkVqzZoaIFLWJhhdlgRpckLG69uVmUUZd/XXY=";
+      rev = "v${version}";
+      hash = "sha256-5XMdI+TMUd+U6bvDQT9Q62ATxtbnRAJ/XDYWHgVEUbU=";
    };

    nativeBuildInputs = [
@ -23,7 +23,7 @@ let

    subPackages = [ "." ];

-    vendorHash = "sha256-cr5D7QDh65xWZJ4gq32ehklwrHWyQEWW/FZZ4gPTJBk=";
+    vendorHash = "sha256-y7YxcBFjKcQK6ilCKOyoszq64/0xG5GgTehKrKThknU=";

    postPatch = let
      skipTests = [
--- a/pkgs/development/python-modules/aiomqtt/default.nix
+++ b/pkgs/development/python-modules/aiomqtt/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "aiomqtt";
-  version = "1.2.1";
+  version = "2.0.0";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "sbtinstruments";
    repo = "aiomqtt";
    rev = "refs/tags/v${version}";
-    hash = "sha256-P8p21wjmFDvI0iobpQsWkKYleY4M0R3yod3/mJ7V+Og=";
+    hash = "sha256-Ww4NdCtT04b4tRmarJjB4xmfRBNIQekP8iARAdpmBH0=";
  };

  nativeBuildInputs = [
@ -50,7 +50,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "The idiomatic asyncio MQTT client, wrapped around paho-mqtt";
    homepage = "https://github.com/sbtinstruments/aiomqtt";
-    changelog = "https://github.com/sbtinstruments/aiomqtt/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/sbtinstruments/aiomqtt/blob/${src.rev}/CHANGELOG.md";
    license = licenses.bsd3;
    maintainers = with maintainers; [ ];
  };
--- a/pkgs/development/python-modules/astropy-healpix/default.nix
+++ b/pkgs/development/python-modules/astropy-healpix/default.nix
@ -14,13 +14,13 @@

 buildPythonPackage rec {
  pname = "astropy-healpix";
-  version = "1.0.1";
+  version = "1.0.2";
  pyproject = true;

  src = fetchPypi {
    inherit version;
    pname = lib.replaceStrings ["-"] ["_"] pname;
-    hash = "sha256-74k4vfcpdXw4CowXNHlNc3StAOB2f8Si+mOma+8SYkI=";
+    hash = "sha256-BW+m7ZOWvtx3HTdNh3zeg9lGCj9ip4/gXb+boDlAMjo=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/asyncclick/default.nix
+++ b/pkgs/development/python-modules/asyncclick/default.nix
@ -10,16 +10,16 @@

 buildPythonPackage rec {
  pname = "asyncclick";
-  version = "8.1.3.2";
-  format = "setuptools";
+  version = "8.1.7.1";
+  pyproject = true;

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.9";

  src = fetchFromGitHub {
    owner = "python-trio";
-    repo = pname;
-    rev = version;
-    hash = "sha256-by1clF+WAfN/gjOg/F60O1tCZ3qAhWqiiJJY04iMzQ8=";
+    repo = "asyncclick";
+    rev = "refs/tags/${version}";
+    hash = "sha256-gx7s/HikvjsXalc0Z73JWMKc1SlhR+kohwk2sW4o19I=";
  };

  nativeBuildInputs = [
@ -40,15 +40,18 @@ buildPythonPackage rec {
  ];

  disabledTests = [
-    # RuntimeWarning: coroutine 'Context.invoke' was never awaited
-    "test_context_invoke_type"
+    # AttributeError: 'Context' object has no attribute '_ctx_mgr'
+    "test_context_pushing"
  ];

-  pythonImportsCheck = [ "asyncclick" ];
+  pythonImportsCheck = [
+    "asyncclick"
+  ];

  meta = with lib; {
    description = "Python composable command line utility";
    homepage = "https://github.com/python-trio/asyncclick";
+    changelog = "https://github.com/python-trio/asyncclick/blob/${version}/CHANGES.rst";
    license = with licenses; [ bsd3 ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/django-import-export/default.nix
+++ b/pkgs/development/python-modules/django-import-export/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "django-import-export";
-  version = "3.3.5";
+  version = "3.3.6";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "django-import-export";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-bYb000KRnvuMSMTTicqrJ+0zU/XguQFcLATqxUvc5V0=";
+    hash = "sha256-1c+ZGCVrHqqT9aUua+7fI8fYZYBq4I/qq1yIjdVLJPY=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/google-cloud-tasks/default.nix
+++ b/pkgs/development/python-modules/google-cloud-tasks/default.nix
@ -9,20 +9,25 @@
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
+, setuptools
 }:

 buildPythonPackage rec {
  pname = "google-cloud-tasks";
-  version = "2.15.0";
-  format = "setuptools";
+  version = "2.15.1";
+  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-SpmTjbARHVU3hkG1I1uY5r12S8jip+JN9wb4uGO98nw=";
+    hash = "sha256-wkk3hefFhfDvL7iSFbOZqzTLaVBJPydSItjt5P4/zxY=";
  };

+  nativeBuildInputs = [
+    setuptools
+  ];
+
  propagatedBuildInputs = [
    google-api-core
    grpc-google-iam-v1
--- a/pkgs/development/python-modules/impacket/default.nix
+++ b/pkgs/development/python-modules/impacket/default.nix
@ -4,19 +4,21 @@
 , dsinternals
 , fetchPypi
 , flask
+, ldap3
 , ldapdomaindump
 , pyasn1
 , pycryptodomex
 , pyopenssl
 , pythonOlder
 , setuptools
+, pytestCheckHook
 , six
 }:

 buildPythonPackage rec {
  pname = "impacket";
  version = "0.11.0";
-  format = "setuptools";
+  pyproject = true;

  disabled = pythonOlder "3.7";

@ -25,25 +27,36 @@ buildPythonPackage rec {
    hash = "sha256-7kA5tNKu3o9fZEeLxZ+qyGA2eWviTeqNwY8An7CQXko=";
  };

+  nativeBuildInputs = [
+    setuptools
+  ];
+
  propagatedBuildInputs = [
    charset-normalizer
    dsinternals
    flask
+    ldap3
    ldapdomaindump
    pyasn1
    pycryptodomex
    pyopenssl
-    setuptools
    six
  ];

-  # RecursionError: maximum recursion depth exceeded
-  doCheck = false;
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];

  pythonImportsCheck = [
    "impacket"
  ];

+  disabledTestPaths = [
+    # Skip all RPC related tests
+    "tests/dcerpc/"
+    "tests/SMB_RPC/"
+  ];
+
  meta = with lib; {
    description = "Network protocols Constructors and Dissectors";
    homepage = "https://github.com/SecureAuthCorp/impacket";
--- a/pkgs/development/python-modules/lmcloud/default.nix
+++ b/pkgs/development/python-modules/lmcloud/default.nix
@ -0,0 +1,51 @@
+{ lib
+, authlib
+, bleak
+, buildPythonPackage
+, fetchFromGitHub
+, httpx
+, pythonOlder
+, setuptools
+, websockets
+}:
+
+buildPythonPackage rec {
+  pname = "lmcloud";
+  version = "0.4.35";
+  pyproject = true;
+
+  disabled = pythonOlder "3.11";
+
+  src = fetchFromGitHub {
+    owner = "zweckj";
+    repo = "lmcloud";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-TUve21yamtEmEceK/V1w7IZjnMgKConMfSY/GlqFpp8=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    authlib
+    bleak
+    httpx
+    websockets
+  ];
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "lmcloud"
+  ];
+
+  meta = with lib; {
+    description = "Library to interface with La Marzocco's cloud";
+    homepage = "https://github.com/zweckj/lmcloud";
+    changelog = "https://github.com/zweckj/lmcloud/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/pdfrw2/default.nix
+++ b/pkgs/development/python-modules/pdfrw2/default.nix
@ -0,0 +1,38 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pillow
+, pycryptodome
+, reportlab
+, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "pdfrw2";
+  version = "0.5.0";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-5qnMq4Pnaaeov+Lb3fD0ndfr5SAy6SlXTwG7v6IZce0=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    pillow
+    reportlab
+    pycryptodome
+  ];
+
+  pythonImportCheck = [ "pdfrw" ];
+
+  meta = with lib; {
+    description = "Pure Python library that reads and writes PDFs";
+    homepage = "https://github.com/sarnold/pdfrw";
+    maintainers = with maintainers; [ loicreynier ];
+    license = licenses.mit;
+  };
+}
--- a/pkgs/development/python-modules/pins/default.nix
+++ b/pkgs/development/python-modules/pins/default.nix
@ -0,0 +1,104 @@
+{ lib
+, adlfs
+, appdirs
+, buildPythonPackage
+, fastparquet
+, fetchFromGitHub
+, fsspec
+, gcsfs
+, humanize
+, importlib-metadata
+, importlib-resources
+, jinja2
+, joblib
+, pandas
+, pyarrow
+, pytest-cases
+, pytest-parallel
+, pytestCheckHook
+, pythonOlder
+, pyyaml
+, requests
+, s3fs
+, setuptools
+, setuptools-scm
+, xxhash
+}:
+
+buildPythonPackage rec {
+  pname = "pins";
+  version = "0.8.4";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "rstudio";
+    repo = "pins-python";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-rNIjHwFELHoxDxC/T5vPzHA6Ifjz01rJpTK6kjUxOIM=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    appdirs
+    fsspec
+    humanize
+    importlib-metadata
+    importlib-resources
+    jinja2
+    joblib
+    pandas
+    pyyaml
+    requests
+    xxhash
+  ];
+
+  passthru.optional-dependencies = {
+    aws = [
+      s3fs
+    ];
+    azure = [
+      adlfs
+    ];
+    gcs = [
+      gcsfs
+    ];
+  };
+
+  nativeCheckInputs = [
+    fastparquet
+    pyarrow
+    pytest-cases
+    pytest-parallel
+    pytestCheckHook
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
+
+  pythonImportsCheck = [
+    "pins"
+  ];
+
+  pytestFlagsArray = [
+    "pins/tests/"
+  ];
+
+  disabledTestPaths = [
+    # Tests require network access
+    "pins/tests/test_boards.py"
+    "pins/tests/test_compat.py"
+    "pins/tests/test_constructors.py"
+    "pins/tests/test_rsconnect_api.py"
+  ];
+
+  meta = with lib; {
+    description = "Module to publishes data, models and other Python objects";
+    homepage = "https://github.com/rstudio/pins-python";
+    changelog = "https://github.com/rstudio/pins-python/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/pyarrow-hotfix/default.nix
+++ b/pkgs/development/python-modules/pyarrow-hotfix/default.nix
@ -0,0 +1,37 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, hatchling
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "pyarrow-hotfix";
+  version = "0.6";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "pitrou";
+    repo = "pyarrow-hotfix";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-LlSbxIxvouzvlP6PB8J8fJaxWoRbxz4wTs7Gb5LbM4A=";
+  };
+
+  nativeBuildInputs = [
+    hatchling
+  ];
+
+  pythonImportsCheck = [
+    "pyarrow_hotfix"
+  ];
+
+  meta = with lib; {
+    description = "Hotfix for the PyArrow security vulnerability CVE-2023-47248";
+    homepage = "https://github.com/pitrou/pyarrow-hotfix";
+    changelog = "https://github.com/pitrou/pyarrow-hotfix/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/pydash/default.nix
+++ b/pkgs/development/python-modules/pydash/default.nix
@ -1,47 +1,63 @@
-{ stdenv
-, lib
+{ lib
+, stdenv
 , buildPythonPackage
 , fetchFromGitHub
 , invoke
 , mock
 , pytestCheckHook
 , pythonOlder
+, setuptools
 , sphinx-rtd-theme
+, typing-extensions
 }:

 buildPythonPackage rec {
  pname = "pydash";
-  version = "5.1.1";
-  format = "pyproject";
+  version = "7.0.6";
+  pyproject = true;

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "dgilland";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-VbuRzKwPMh5S4GZQYnh0sZOBi4LNFjMuol95tMC43b0=";
+    repo = "pydash";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-zwtUdP2fFFE5X0SDkBDetAQbKnZ1v24DGdzN3fQLa0A=";
  };

-  nativeCheckInputs = [
-    invoke
-    mock
-    sphinx-rtd-theme
-    pytestCheckHook
-  ];
-
  postPatch = ''
    sed -i "/--cov/d" setup.cfg
    sed -i "/--no-cov/d" setup.cfg
  '';

+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    typing-extensions
+  ];
+
+  nativeCheckInputs = [
+    invoke
+    mock
+    pytestCheckHook
+    sphinx-rtd-theme
+  ];
+
  pythonImportsCheck = [
    "pydash"
  ];

+  disabledTestPaths = [
+    # Disable mypy testing
+    "tests/pytest_mypy_testing/"
+  ];
+
  meta = with lib; {
    description = "Python utility libraries for doing stuff in a functional way";
    homepage = "https://pydash.readthedocs.io";
+    changelog = "https://github.com/dgilland/pydash/blob/v${version}/CHANGELOG.rst";
    license = licenses.mit;
    maintainers = with maintainers; [ ma27 ];
  };
--- a/pkgs/development/python-modules/sphinx-markdown-parser/default.nix
+++ b/pkgs/development/python-modules/sphinx-markdown-parser/default.nix
@ -1,24 +1,27 @@
-{ stdenv
-, lib
+{ lib
+, stdenv
 , buildPythonPackage
-, fetchFromGitHub
-, sphinx
-, markdown
 , commonmark
-, recommonmark
+, fetchFromGitHub
+, markdown
 , pydash
+, pytestCheckHook
+, pythonOlder
 , pyyaml
+, recommonmark
+, setuptools
+, sphinx
 , unify
 , yapf
-, python
 }:

 buildPythonPackage rec {
  pname = "sphinx-markdown-parser";
  version = "0.2.4";
-  format = "setuptools";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";

-  # PyPi release does not include requirements.txt
  src = fetchFromGitHub {
    owner = "clayrisser";
    repo = "sphinx-markdown-parser";
@ -28,20 +31,44 @@ buildPythonPackage rec {
    sha256 = "0i0hhapmdmh83yx61lxi2h4bsmhnzddamz95844g2ghm132kw5mv";
  };

-  propagatedBuildInputs = [ sphinx markdown commonmark pydash pyyaml unify yapf recommonmark ];
+  nativeBuildInputs = [
+    setuptools
+  ];

-  # Avoids running broken tests in test_markdown.py
-  checkPhase = ''
-    ${python.interpreter} -m unittest -v tests/test_basic.py tests/test_sphinx.py
-  '';
+  propagatedBuildInputs = [
+    commonmark
+    markdown
+    pydash
+    pyyaml
+    recommonmark
+    unify
+    yapf
+  ];

-  pythonImportsCheck = [ "sphinx_markdown_parser" ];
+  buildInputs = [
+    sphinx
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "sphinx_markdown_parser"
+  ];
+
+  disabledTests = [
+    # AssertionError
+    "test_heading"
+    "test_headings"
+    "test_integration"
+  ];

  meta = with lib; {
-    broken = (stdenv.isLinux && stdenv.isAarch64) || stdenv.isDarwin;
    description = "Write markdown inside of docutils & sphinx projects";
    homepage = "https://github.com/clayrisser/sphinx-markdown-parser";
    license = licenses.mit;
    maintainers = with maintainers; [ FlorianFranzen ];
+    broken = (stdenv.isLinux && stdenv.isAarch64) || stdenv.isDarwin;
  };
 }
--- a/pkgs/development/python-modules/sqlglot/default.nix
+++ b/pkgs/development/python-modules/sqlglot/default.nix
@ -1,41 +1,56 @@
 { lib
 , buildPythonPackage
+, duckdb
 , fetchFromGitHub
-, pythonOlder
 , pytestCheckHook
 , python-dateutil
-, duckdb
+, pythonOlder
+, setuptools
 , setuptools-scm
 }:
+
 buildPythonPackage rec {
  pname = "sqlglot";
-  version = "17.14.2";
-  format = "setuptools";
+  version = "20.9.0";
+  pyproject = true;

  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    repo = "sqlglot";
    owner = "tobymao";
-    rev = "v${version}";
-    hash = "sha256-aImshQ5jf0k62ucpK4X8G7uHGAFQkhGgjMYo4mvSvew=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-4czhmAJUDRj0x8dCmIXg5BQ1Uvie5vx+UtWdSSY5mnM=";
  };

-  nativeBuildInputs = [ setuptools-scm ];
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];

-  # optional dependency used in the sqlglot optimizer
-  propagatedBuildInputs = [ python-dateutil ];
+  propagatedBuildInputs = [
+    # Optional dependency used in the sqlglot optimizer
+    python-dateutil
+  ];

-  nativeCheckInputs = [ pytestCheckHook duckdb ];
+  nativeCheckInputs = [
+    pytestCheckHook
+    duckdb
+  ];

-  # these integration tests assume a running Spark instance
-  disabledTestPaths = [ "tests/dataframe/integration" ];
+  disabledTestPaths = [
+    # These integration tests assume a running Spark instance
+    "tests/dataframe/integration"
+  ];

-  pythonImportsCheck = [ "sqlglot" ];
+  pythonImportsCheck = [
+    "sqlglot"
+  ];

  meta = with lib; {
    description = "A no dependency Python SQL parser, transpiler, and optimizer";
    homepage = "https://github.com/tobymao/sqlglot";
+    changelog = "https://github.com/tobymao/sqlglot/blob/v${version}/CHANGELOG.md";
    license = licenses.mit;
    maintainers = with maintainers; [ cpcloud ];
  };
--- a/pkgs/development/python-modules/unify/default.nix
+++ b/pkgs/development/python-modules/unify/default.nix
@ -1,26 +1,47 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonOlder
+, setuptools
+, pytestCheckHook
 , untokenize
-, unittestCheckHook
 }:

 buildPythonPackage rec {
  pname = "unify";
  version = "0.5";
-  format = "setuptools";
+  pyproject = true;
+
+  disabled = pythonOlder "3.9";

-  # PyPi release is missing tests (see https://github.com/myint/unify/pull/18)
  src = fetchFromGitHub {
    owner = "myint";
    repo = "unify";
-    rev = "v${version}";
-    sha256 = "1l6xxygaigacsxf0g5f7w5gpqha1ava6mcns81kqqy6vw91pyrbi";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-cWV/Q+LbeIxnQNqyatRWQUF8X+HHlQdc10y9qJ7v3dA=";
  };

-  propagatedBuildInputs = [ untokenize ];
+  nativeBuildInputs = [
+    setuptools
+  ];

-  nativeCheckInputs = [ unittestCheckHook ];
+  propagatedBuildInputs = [
+    untokenize
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "unify"
+  ];
+
+  disabledTests = [
+    # https://github.com/myint/unify/issues/21
+    "test_format_code"
+    "test_format_code_with_backslash_in_comment"
+  ];

  meta = with lib; {
    description = "Modifies strings to all use the same quote where possible";
--- a/pkgs/development/tools/castxml/default.nix
+++ b/pkgs/development/tools/castxml/default.nix
@ -17,13 +17,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "castxml";
-  version = "0.6.2";
+  version = "0.6.3";

  src = fetchFromGitHub {
    owner = "CastXML";
    repo = "CastXML";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-x27koa0q+rDqPmfHMf7v7KTx3bfDgqS/FkPAX5auqaw=";
+    hash = "sha256-g/BgKkU8Me6EacDm+KFAsKq5++v/b+Par0x7lzBzHw8=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/tools/distgen/default.nix
+++ b/pkgs/development/tools/distgen/default.nix
@ -2,11 +2,11 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "distgen";
-  version = "1.5";
+  version = "1.17";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "08f9rw5irgv0gw7jizk5f9csn0yhrdnb84k40px1zbypsylvr5c5";
+    sha256 = "sha256-Md6R1thUtPQ7BFZsWmTDuNdD7UHMMFlEVksIJZAyjk4=";
  };

  nativeCheckInputs = with python3.pkgs; [
--- a/pkgs/development/tools/kdash/default.nix
+++ b/pkgs/development/tools/kdash/default.nix
@ -12,13 +12,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "kdash";
-  version = "0.4.5";
+  version = "0.4.7";

  src = fetchFromGitHub {
    owner = "kdash-rs";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-6jCbsF9Nl5A7PZM59Z1ozcJ3V0ajA/4V3A6hunrB9Xg=";
+    sha256 = "sha256-KQ1SLnXtox/bIV32guEfC2LSt8LDWGSG5b9i0gqS2Yc=";
  };

  nativeBuildInputs = [ perl python3 pkg-config ];
@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
  buildInputs = [ openssl xorg.xcbutil ]
    ++ lib.optional stdenv.isDarwin AppKit;

-  cargoHash = "sha256-EwlY4kBieFYxXGreeFb2VxLMwFZnYB6+d/Zv7fjsJls=";
+  cargoHash = "sha256-bgS93o654xDVz2OMFy1mwxCKQESV8MPZ4Mjb0IdypLU=";

  meta = with lib; {
    description = "A simple and fast dashboard for Kubernetes";
--- a/pkgs/development/tools/language-servers/neocmakelsp/default.nix
+++ b/pkgs/development/tools/language-servers/neocmakelsp/default.nix
@ -5,16 +5,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "neocmakelsp";
-  version = "0.6.17";
+  version = "0.6.19";

  src = fetchFromGitHub {
    owner = "Decodetalkers";
    repo = "neocmakelsp";
    rev = "v${version}";
-    hash = "sha256-0Rc5oPm6BAjPmoRHUO3gVivbQt2p2y62VbT5NIzHtpI=";
+    hash = "sha256-nYZ9H66sA5umOTn/w/P62kJy3WHLwYPWWs1B74bTAEM=";
  };

-  cargoHash = "sha256-7ifdmW9JBjz0jxpltn5gFa60oNsB4daA6cXCLnBne7o=";
+  cargoHash = "sha256-1jpKo/fSWLf0pFgzTvnkaghz/Fdy+MJhZsKQPaJHlfs=";

  meta = with lib; {
    description = "A cmake lsp based on tower-lsp and treesitter";
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/default.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/default.nix
@ -49,6 +49,7 @@
  tree-sitter-json5 = lib.importJSON ./tree-sitter-json5.json;
  tree-sitter-jsonnet = lib.importJSON ./tree-sitter-jsonnet.json;
  tree-sitter-julia = lib.importJSON ./tree-sitter-julia.json;
+  tree-sitter-just = lib.importJSON ./tree-sitter-just.json;
  tree-sitter-kotlin = lib.importJSON ./tree-sitter-kotlin.json;
  tree-sitter-latex = lib.importJSON ./tree-sitter-latex.json;
  tree-sitter-ledger = lib.importJSON ./tree-sitter-ledger.json;
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-just.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-just.json
@ -0,0 +1,12 @@
+{
+  "url": "https://github.com/IndianBoy42/tree-sitter-just",
+  "rev": "f807ab33c36651ecb503a291aed933932754864d",
+  "date": "2024-01-11T04:53:14-05:00",
+  "path": "/nix/store/f6b4xvxkbzrwmxk8vr1gz4c3g3pqh2hz-tree-sitter-just",
+  "sha256": "1ng49slp5x98s9ydc7gha7gkcj93ks4iv0ixc7n0z9dr4akqrbw8",
+  "hash": "sha256-iK+MpyK5pQ/sYT2CHYmeI0k231HwHdZ80ij1cqlO5Nk=",
+  "fetchLFS": false,
+  "fetchSubmodules": false,
+  "deepClone": false,
+  "leaveDotGit": false
+}
--- a/pkgs/development/tools/parsing/tree-sitter/update.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/update.nix
@ -108,6 +108,10 @@ let
      orga = "wilfred";
      repo = "tree-sitter-elisp";
    };
+    "tree-sitter-just" = {
+      orga = "IndianBoy42";
+      repo = "tree-sitter-just";
+    };
    "tree-sitter-nix" = {
      orga = "cstrahan";
      repo = "tree-sitter-nix";
--- a/pkgs/development/tools/rufo/Gemfile.lock
+++ b/pkgs/development/tools/rufo/Gemfile.lock
@ -1,7 +1,7 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    rufo (0.16.2)
+    rufo (0.17.0)

 PLATFORMS
  ruby
@ -10,4 +10,4 @@ DEPENDENCIES
  rufo

 BUNDLED WITH
-   2.4.20
+   2.5.3
--- a/pkgs/development/tools/rufo/gemset.nix
+++ b/pkgs/development/tools/rufo/gemset.nix
@ -4,9 +4,9 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "11nm1vzr3vd85yy4rd7ndrrx1ygm3m2jmw9r0b9lfxlj8rc1rip2";
+      sha256 = "1rqq6mf7fvwvc9m3d5w5ysch3h7z4ml1vvdvy26064fb6lrnn5ai";
      type = "gem";
    };
-    version = "0.16.2";
+    version = "0.17.0";
  };
 }
--- a/pkgs/development/tools/sentry-cli/default.nix
+++ b/pkgs/development/tools/sentry-cli/default.nix
@ -10,13 +10,13 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "sentry-cli";
-  version = "2.23.2";
+  version = "2.25.2";

  src = fetchFromGitHub {
    owner = "getsentry";
    repo = "sentry-cli";
    rev = version;
-    sha256 = "sha256-txxDA/8pQDiZsoxrdWz6JZmjpyeILWHl1rUHzPacJN8=";
+    sha256 = "sha256-IAtOlWIs1BScr569s8Y8A+m1CzzGrSXX/CaqkXubZfA=";
  };
  doCheck = false;

@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ CoreServices Security SystemConfiguration ];
  nativeBuildInputs = [ pkg-config ];

-  cargoHash = "sha256-KytXqILji1pbiMz7OX+O5B2bw5MMlKf/MYh13+nd+bg=";
+  cargoHash = "sha256-oydBeEOFTmDibUZZSwe7WMcU5eDshsDogPRlxrrx1i8=";

  meta = with lib; {
    homepage = "https://docs.sentry.io/cli/";
--- a/pkgs/misc/fastly/default.nix
+++ b/pkgs/misc/fastly/default.nix
@ -10,13 +10,13 @@

 buildGoModule rec {
  pname = "fastly";
-  version = "10.7.0";
+  version = "10.8.0";

  src = fetchFromGitHub {
    owner = "fastly";
    repo = "cli";
    rev = "refs/tags/v${version}";
-    hash = "sha256-KqFBsSoiKzvbSG5XanlFcU8NkveksnEbfqNuPeWEb48=";
+    hash = "sha256-XlfTtA4jYFrs1W8pyulkqbhrRt8vS+oPB/g9/tIW8Ws=";
    # The git commit is part of the `fastly version` original output;
    # leave that output the same in nixpkgs. Use the `.git` directory
    # to retrieve the commit SHA, and remove the directory afterwards,
@ -33,7 +33,7 @@ buildGoModule rec {
    "cmd/fastly"
  ];

-  vendorHash = "sha256-Mh737emdQkIoNOAkaTafCoMQnLqXIGMKX6X5ClsmMzc=";
+  vendorHash = "sha256-sN6kJspIG3XKW71sTjINE+hoWHNbd8ZmVEXNcvuvThg=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/os-specific/linux/linuxptp/default.nix
+++ b/pkgs/os-specific/linux/linuxptp/default.nix
@ -15,7 +15,10 @@ stdenv.mkDerivation rec {
       '/usr/include/linux/' "${linuxHeaders}/include/linux/"
  '';

-  makeFlags = [ "prefix=" ];
+  makeFlags = [
+    "prefix="
+    "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
+  ];

  preInstall = ''
    export DESTDIR=$out
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@ -4507,7 +4507,8 @@
      paho-mqtt
    ];
    "snmp" = ps: with ps; [
-    ]; # missing inputs: pysnmp-lextudio
+      pysnmp-lextudio
+    ];
    "snooz" = ps: with ps; [
      aioesphomeapi
      aiohttp-cors
@ -6317,6 +6318,7 @@
    "smtp"
    "snapcast"
    "snips"
+    "snmp"
    "snooz"
    "solaredge"
    "solarlog"
--- a/pkgs/servers/mpd/libmpdclient.nix
+++ b/pkgs/servers/mpd/libmpdclient.nix
@ -1,30 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, meson
-, ninja
-, fixDarwinDylibNames
-}:
-
-stdenv.mkDerivation rec {
-  pname = "libmpdclient";
-  version = "2.20";
-
-  src = fetchFromGitHub {
-    owner  = "MusicPlayerDaemon";
-    repo   = pname;
-    rev    = "v${version}";
-    sha256 = "sha256-qEgdwG7ygVblIa3uRf1tddxHg7T1yvY17nbhZ7NRNvg=";
-  };
-
-  nativeBuildInputs = [ meson ninja ]
-  ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
-
-  meta = with lib; {
-    description = "Client library for MPD (music player daemon)";
-    homepage = "https://www.musicpd.org/libs/libmpdclient/";
-    license = licenses.bsd2;
-    maintainers = with maintainers; [ ehmry AndersonTorres ];
-    platforms = platforms.unix;
-  };
-}
--- a/pkgs/servers/tailscale/default.nix
+++ b/pkgs/servers/tailscale/default.nix
@ -1,7 +1,7 @@
 { lib, stdenv, buildGoModule, fetchFromGitHub, makeWrapper, iptables, iproute2, procps, shadow, getent }:

 let
-  version = "1.56.1";
+  version = "1.58.0";
 in
 buildGoModule {
  pname = "tailscale";
@ -11,9 +11,9 @@ buildGoModule {
    owner = "tailscale";
    repo = "tailscale";
    rev = "v${version}";
-    hash = "sha256-kMk5Q/KvNcsohHNLDMmpBm+gUxQEOeO8o/odukcJi0A=";
+    hash = "sha256-ue1opjT8wkL+hYzMxU/GtOrJd3/KPSOptU8A8nklacY=";
  };
-  vendorHash = "sha256-bG/ydsJf2UncOcDo8/BXdvQJO3Mk0tl8JGje1b6kto4=";
+  vendorHash = "sha256-BK1zugKGtx2RpWHDvFZaFqz/YdoewsG8SscGt25uwtQ=";

  nativeBuildInputs = lib.optionals stdenv.isLinux [ makeWrapper ];

--- a/pkgs/test/nixpkgs-check-by-name/scripts/pinned-tool.json
+++ b/pkgs/test/nixpkgs-check-by-name/scripts/pinned-tool.json
@ -1,4 +1,4 @@
 {
-  "rev": "9b19f5e77dd906cb52dade0b7bd280339d2a1f3d",
-  "ci-path": "/nix/store/qlls5ca8q88qpyygg9ddi60gl1nmvpij-nixpkgs-check-by-name"
+  "rev": "842d9d80cfd4560648c785f8a4e6f3b096790e19",
+  "ci-path": "/nix/store/8habk3j25bs2a34zn5q5p17b9dl3fywg-nixpkgs-check-by-name"
 }
--- a/pkgs/test/nixpkgs-check-by-name/scripts/run-local.sh
+++ b/pkgs/test/nixpkgs-check-by-name/scripts/run-local.sh
@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p jq
+#!nix-shell -i bash -p jq -I nixpkgs=../../../..

 set -o pipefail -o errexit -o nounset

--- a/pkgs/test/nixpkgs-check-by-name/scripts/update-pinned-tool.sh
+++ b/pkgs/test/nixpkgs-check-by-name/scripts/update-pinned-tool.sh
@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p jq
+#!nix-shell -i bash -p jq -I nixpkgs=../../../..

 set -o pipefail -o errexit -o nounset

--- a/pkgs/tools/admin/ansible/lint.nix
+++ b/pkgs/tools/admin/ansible/lint.nix
@ -6,12 +6,12 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "ansible-lint";
-  version = "6.21.1";
+  version = "6.22.2";
  format = "pyproject";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-Bf/G38jzy79W9/l3CzQ2/HkJutXB11Rw76BkUx8C324=";
+    hash = "sha256-L0Cf6Y762mHan4q3zfNKW2feQ+EzjO4GGfXVH0+LFd0=";
  };

  postPatch = ''
--- a/pkgs/tools/misc/github-copilot-cli/default.nix
+++ b/pkgs/tools/misc/github-copilot-cli/default.nix
@ -2,14 +2,14 @@

 buildNpmPackage rec {
  pname = "github-copilot-cli";
-  version = "0.1.33";
+  version = "0.1.36";

  src = fetchzip {
    url = "https://registry.npmjs.org/@githubnext/${pname}/-/${pname}-${version}.tgz";
-    hash = "sha256-uTv6Z/AzvINinMiIfaaqRZDCmsAQ7tOE5SpuecpzGug=";
+    hash = "sha256-7n+7sN61OrqMVGaKll85+HwX7iGG9M/UW5lf2Pd5sRU=";
  };

-  npmDepsHash = "sha256-VIg9a63GH246SbmK4Q8CwA2jdaaOwNUXoJkuDVwy5jE=";
+  npmDepsHash = "sha256-h0StxzGbl3ZeOQ4Jy1BgJ5sJ0pAbubMCRsiIOYpU04w=";

  postPatch = ''
    cp ${./package-lock.json} package-lock.json
--- a/pkgs/tools/misc/github-copilot-cli/package-lock.json
+++ b/pkgs/tools/misc/github-copilot-cli/package-lock.json
--- a/pkgs/tools/misc/instaloader/default.nix
+++ b/pkgs/tools/misc/instaloader/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "instaloader";
-  version = "4.9.6";
+  version = "4.10.3";
  format = "pyproject";

  disabled = pythonOlder "3.6";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "instaloader";
    repo = "instaloader";
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-ZxvJPDj+r7KSyXpYNQIgnda5OS77GOFM901ZHgR6c4k=";
+    sha256 = "sha256-+K15MlyOONC5E8ZjtzbYnGGzQEMDGEGBFDbLZp7FeWQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/misc/plocate/default.nix
+++ b/pkgs/tools/misc/plocate/default.nix
@ -10,12 +10,12 @@
 }:
 stdenv.mkDerivation rec {
  pname = "plocate";
-  version = "1.1.21";
+  version = "1.1.22";

  src = fetchgit {
    url = "https://git.sesse.net/plocate";
    rev = version;
-    sha256 = "sha256-ucCRm1w3ON3Qh7qt1Pf5/3kvXVGP+dJwjSuwYGcDMcs=";
+    sha256 = "sha256-ejv1IsjbImnvI1oorvMoIvTBu3HuVy7VtgHNTIkqqro=";
  };

  postPatch = ''
--- a/pkgs/tools/misc/yutto/default.nix
+++ b/pkgs/tools/misc/yutto/default.nix
@ -9,14 +9,14 @@ with python3.pkgs;

 buildPythonApplication rec {
  pname = "yutto";
-  version = "2.0.0b32";
+  version = "2.0.0b33";
  format = "pyproject";

  disabled = pythonOlder "3.9";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-tncuRrEq59OPO2ZuWUowDHLsqJ1Dof9vroVOxQQ9hpE=";
+    hash = "sha256-TUyjppAHmWCZxifeQeOpFMPBksqLRSYdqgG7NEMVILY=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/networking/haproxy/default.nix
+++ b/pkgs/tools/networking/haproxy/default.nix
@ -1,39 +1,44 @@
 { useLua ? true
 , usePcre ? true
-# QUIC "is currently supported as an experimental feature" so shouldn't be enabled by default
-, useQuicTls ? false
 , withPrometheusExporter ? true
+, sslLibrary ? "quictls"
 , stdenv
 , lib
 , fetchurl
 , nixosTests
 , zlib
 , libxcrypt
-, openssl ? null
-, quictls ? null
-, lua5_3 ? null
-, pcre ? null
-, systemd ? null
+, wolfssl
+, libressl
+, quictls
+, openssl
+, lua5_4
+, pcre2
+, systemd
 }:

-assert useLua -> lua5_3 != null;
-assert usePcre -> pcre != null;
-assert useQuicTls -> quictls != null;
-assert !useQuicTls -> openssl != null;
-
-let sslPkg = if useQuicTls then quictls else openssl;
+assert lib.assertOneOf "sslLibrary" sslLibrary [ "quictls" "openssl" "libressl" "wolfssl" ];
+let
+  sslPkgs = {
+    inherit quictls openssl libressl;
+    wolfssl = wolfssl.override {
+      variant = "haproxy";
+      extraConfigureFlags = [ "--enable-quic" ];
+    };
+  };
+  sslPkg = sslPkgs.${sslLibrary};
 in stdenv.mkDerivation (finalAttrs: {
  pname = "haproxy";
-  version = "2.9.2";
+  version = "2.9.3";

  src = fetchurl {
    url = "https://www.haproxy.org/download/${lib.versions.majorMinor finalAttrs.version}/src/haproxy-${finalAttrs.version}.tar.gz";
-    hash = "sha256-hRrugw7CjBeRJGqf1EePZD0RWlY92Qf2YSzDgalSqzw=";
+    hash = "sha256-7VF8ZavYaUVBH2vLGMfsZXpwaTHLeB6igwY7oKdYWMA=";
  };

  buildInputs = [ sslPkg zlib libxcrypt ]
-    ++ lib.optional useLua lua5_3
-    ++ lib.optional usePcre pcre
+    ++ lib.optional useLua lua5_4
+    ++ lib.optional usePcre pcre2
    ++ lib.optional stdenv.isLinux systemd;

  # TODO: make it work on bsd as well
@ -46,20 +51,23 @@ in stdenv.mkDerivation (finalAttrs: {
  ];

  buildFlags = [
-    "USE_OPENSSL=yes"
-    "SSL_LIB=${sslPkg}/lib"
-    "SSL_INC=${sslPkg}/include"
    "USE_ZLIB=yes"
-  ] ++ lib.optionals useQuicTls [
-    "USE_QUIC=1"
+    "USE_OPENSSL=yes"
+    "SSL_INC=${lib.getDev sslPkg}/include"
+    "SSL_LIB=${lib.getDev sslPkg}/lib"
+    "USE_QUIC=yes"
+  ] ++ lib.optionals (sslLibrary == "openssl") [
+    "USE_QUIC_OPENSSL_COMPAT=yes"
+  ] ++ lib.optionals (sslLibrary == "wolfssl") [
+    "USE_OPENSSL_WOLFSSL=yes"
  ] ++ lib.optionals usePcre [
-    "USE_PCRE=yes"
-    "USE_PCRE_JIT=yes"
+    "USE_PCRE2=yes"
+    "USE_PCRE2_JIT=yes"
  ] ++ lib.optionals useLua [
    "USE_LUA=yes"
    "LUA_LIB_NAME=lua"
-    "LUA_LIB=${lua5_3}/lib"
-    "LUA_INC=${lua5_3}/include"
+    "LUA_LIB=${lua5_4}/lib"
+    "LUA_INC=${lua5_4}/include"
  ] ++ lib.optionals stdenv.isLinux [
    "USE_SYSTEMD=yes"
    "USE_GETADDRINFO=1"
@ -84,7 +92,7 @@ in stdenv.mkDerivation (finalAttrs: {
      tens of thousands of connections is clearly realistic with todays
      hardware.
    '';
-    maintainers = with lib.maintainers; [ ];
+    maintainers = with lib.maintainers; [ vifino ];
    platforms = with lib.platforms; linux ++ darwin;
    mainProgram = "haproxy";
  };
--- a/pkgs/tools/security/sudo/default.nix
+++ b/pkgs/tools/security/sudo/default.nix
@ -12,12 +12,12 @@
 , withSssd ? false
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "sudo";
  version = "1.9.15p5";

  src = fetchurl {
-    url = "https://www.sudo.ws/dist/${pname}-${version}.tar.gz";
+    url = "https://www.sudo.ws/dist/sudo-${finalAttrs.version}.tar.gz";
    hash = "sha256-VY0QuaGZH7O5+n+nsH7EQFt677WzywsIcdvIHjqI5Vg=";
  };

@ -85,5 +85,6 @@ stdenv.mkDerivation rec {
    license = with licenses; [ sudo bsd2 bsd3 zlib ];
    maintainers = with maintainers; [ delroth ];
    platforms = platforms.linux;
+    mainProgram = "sudo";
  };
-}
+})
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -3851,6 +3851,8 @@ with pkgs;

  fluffychat = callPackage  ../applications/networking/instant-messengers/fluffychat { };

+  fluffychat-web = fluffychat.override { targetFlutterPlatform = "web"; };
+
  fxlinuxprintutil = callPackage ../tools/misc/fxlinuxprintutil { };

  gbl = callPackage ../tools/archivers/gbl {
@ -26653,8 +26655,6 @@ with pkgs;
    inherit (darwin.apple_sdk.frameworks) AudioToolbox AudioUnit;
  }) mpd mpd-small mpdWithFeatures;

-  libmpdclient = callPackage ../servers/mpd/libmpdclient.nix { };
-
  mpdscribble = callPackage ../tools/misc/mpdscribble { };

  mtprotoproxy = python3.pkgs.callPackage ../servers/mtprotoproxy { };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -6587,6 +6587,8 @@ self: super: with self; {
    llvm = pkgs.llvm_14;
  };

+  lmcloud = callPackage ../development/python-modules/lmcloud { };
+
  lmdb = callPackage ../development/python-modules/lmdb {
    inherit (pkgs) lmdb;
  };
@ -9093,6 +9095,8 @@ self: super: with self; {

  pdfrw = callPackage ../development/python-modules/pdfrw { };

+  pdfrw2 = callPackage ../development/python-modules/pdfrw2 { };
+
  pdftotext = callPackage ../development/python-modules/pdftotext { };

  pdfx = callPackage ../development/python-modules/pdfx { };
@ -9178,6 +9182,8 @@ self: super: with self; {

  ping3 = callPackage ../development/python-modules/ping3 { };

+  pins = callPackage ../development/python-modules/pins { };
+
  pg8000 = callPackage ../development/python-modules/pg8000 { };

  pgcli = callPackage ../development/python-modules/pgcli { };
@ -10064,6 +10070,8 @@ self: super: with self; {
    inherit (pkgs) arrow-cpp cmake;
  };

+  pyarrow-hotfix = callPackage ../development/python-modules/pyarrow-hotfix { };
+
  pyasn = callPackage ../development/python-modules/pyasn { };

  pyasn1 = callPackage ../development/python-modules/pyasn1 { };