Merge master into haskell-updates

2024-04-23 00:13:31 +00:00 · 2024-04-23 00:13:31 +00:00 · 69d32db544
commit 69d32db544
parent 1c8747bc8c 16da38cd4f
296 changed files with 5696 additions and 4150 deletions
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@ -20,7 +20,7 @@ jobs:
    if: github.repository_owner == 'NixOS' && github.event.pull_request.merged == true && (github.event_name != 'labeled' || startsWith('backport', github.event.label.name))
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
        with:
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Create backport PRs
--- a/.github/workflows/basic-eval.yml
+++ b/.github/workflows/basic-eval.yml
@ -18,7 +18,7 @@ jobs:
    runs-on: ubuntu-latest
    # we don't limit this action to only NixOS repo since the checks are cheap and useful developer feedback
    steps:
-    - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+    - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
    - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
    - uses: cachix/cachix-action@18cf96c7c98e048e10a83abd92116114cd8504be # v14
      with:
--- a/.github/workflows/check-by-name.yml
+++ b/.github/workflows/check-by-name.yml
@ -84,7 +84,7 @@ jobs:
            exit 1
          fi
          echo "mergedSha=$mergedSha" >> "$GITHUB_ENV"
-      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
        with:
          # pull_request_target checks out the base branch by default
          ref: ${{ env.mergedSha }}
@ -107,6 +107,10 @@ jobs:
          # Adds a result symlink as a GC root
          nix-store --realise "$toolPath" --add-root result
      - name: Running nixpkgs-check-by-name
+        env:
+          # Force terminal colors to be enabled. The library that
+          # nixpkgs-check-by-name uses respects: https://bixense.com/clicolors/
+          CLICOLOR_FORCE: 1
        run: |
          if result/bin/nixpkgs-check-by-name --base "$base" .; then
            exit 0
--- a/.github/workflows/check-cherry-picks.yml
+++ b/.github/workflows/check-cherry-picks.yml
@ -12,7 +12,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository_owner == 'NixOS'
    steps:
-    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+    - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
      with:
        fetch-depth: 0
        filter: blob:none
--- a/.github/workflows/check-maintainers-sorted.yaml
+++ b/.github/workflows/check-maintainers-sorted.yaml
@ -12,7 +12,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository_owner == 'NixOS'
    steps:
-      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
        with:
          # pull_request_target checks out the base branch by default
          ref: refs/pull/${{ github.event.pull_request.number }}/merge
--- a/.github/workflows/check-nix-format.yml
+++ b/.github/workflows/check-nix-format.yml
@ -15,7 +15,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository_owner == 'NixOS'
    steps:
-      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
        with:
          # pull_request_target checks out the base branch by default
          ref: refs/pull/${{ github.event.pull_request.number }}/merge
--- a/.github/workflows/editorconfig.yml
+++ b/.github/workflows/editorconfig.yml
@ -24,7 +24,7 @@ jobs:
    - name: print list of changed files
      run: |
        cat "$HOME/changed_files"
-    - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+    - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
      with:
        # pull_request_target checks out the base branch by default
        ref: refs/pull/${{ github.event.pull_request.number }}/merge
--- a/.github/workflows/manual-nixos.yml
+++ b/.github/workflows/manual-nixos.yml
@ -14,7 +14,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository_owner == 'NixOS'
    steps:
-      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
        with:
          # pull_request_target checks out the base branch by default
          ref: refs/pull/${{ github.event.pull_request.number }}/merge
--- a/.github/workflows/manual-nixpkgs.yml
+++ b/.github/workflows/manual-nixpkgs.yml
@ -16,7 +16,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository_owner == 'NixOS'
    steps:
-      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
        with:
          # pull_request_target checks out the base branch by default
          ref: refs/pull/${{ github.event.pull_request.number }}/merge
--- a/.github/workflows/nix-parse.yml
+++ b/.github/workflows/nix-parse.yml
@ -24,7 +24,7 @@ jobs:
        if [[ -s "$HOME/changed_files" ]]; then
          echo "CHANGED_FILES=$HOME/changed_files" > "$GITHUB_ENV"
        fi
-    - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+    - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
      with:
        # pull_request_target checks out the base branch by default
        ref: refs/pull/${{ github.event.pull_request.number }}/merge
--- a/.github/workflows/periodic-merge-24h.yml
+++ b/.github/workflows/periodic-merge-24h.yml
@ -41,7 +41,7 @@ jobs:
            into: staging-23.11
    name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
    steps:
-      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3

      - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
        uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0
--- a/.github/workflows/periodic-merge-6h.yml
+++ b/.github/workflows/periodic-merge-6h.yml
@ -39,7 +39,7 @@ jobs:
            into: staging
    name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
    steps:
-      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3

      - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
        uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0
--- a/.github/workflows/update-terraform-providers.yml
+++ b/.github/workflows/update-terraform-providers.yml
@ -16,7 +16,7 @@ jobs:
    if: github.repository_owner == 'NixOS' && github.ref == 'refs/heads/master' # ensure workflow_dispatch only runs on master
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
        with:
          nix_path: nixpkgs=channel:nixpkgs-unstable
--- a/lib/default.nix
+++ b/lib/default.nix
@ -47,7 +47,7 @@ let
    # misc
    asserts = callLibs ./asserts.nix;
    debug = callLibs ./debug.nix;
-    misc = callLibs ./deprecated.nix;
+    misc = callLibs ./deprecated/misc.nix;

    # domain-specific
    fetchers = callLibs ./fetchers.nix;
@ -89,7 +89,7 @@ let
      recurseIntoAttrs dontRecurseIntoAttrs cartesianProduct cartesianProductOfSets
      mapCartesianProduct updateManyAttrsByPath;
    inherit (self.lists) singleton forEach foldr fold foldl foldl' imap0 imap1
-      concatMap flatten remove findSingle findFirst any all count
+      ifilter0 concatMap flatten remove findSingle findFirst any all count
      optional optionals toList range replicate partition zipListsWith zipLists
      reverseList listDfs toposort sort sortOn naturalSort compareLists take
      drop sublist last init crossLists unique allUnique intersectLists
--- a/lib/deprecated/README.md
+++ b/lib/deprecated/README.md
@ -0,0 +1,11 @@
+
+# lib/deprecated
+
+Do not add any new functions to this directory.
+
+This directory contains the `lib.misc` sublibrary, which - as a location - is deprecated.
+Furthermore, some of the functions inside are of *dubious* utility, and should perhaps be avoided,
+while some functions *may still be needed*.
+
+This directory does not play a role in the deprecation process for library functions.
+They should be deprecated in place, by putting a `lib.warn` or `lib.warnIf` call around the function.
--- a/lib/deprecated/misc.nix
+++ b/lib/deprecated/misc.nix
--- a/lib/lists.nix
+++ b/lib/lists.nix
@ -4,7 +4,7 @@
 { lib }:
 let
  inherit (lib.strings) toInt;
-  inherit (lib.trivial) compare min id warn;
+  inherit (lib.trivial) compare min id warn pipe;
  inherit (lib.attrsets) mapAttrs;
 in
 rec {
@ -333,6 +333,54 @@ rec {
  */
  imap1 = f: list: genList (n: f (n + 1) (elemAt list n)) (length list);

+  /**
+    Filter a list for elements that satisfy a predicate function.
+    The predicate function is called with both the index and value for each element.
+    It must return `true`/`false` to include/exclude a given element in the result.
+    This function is strict in the result of the predicate function for each element.
+    This function has O(n) complexity.
+
+    Also see [`builtins.filter`](https://nixos.org/manual/nix/stable/language/builtins.html#builtins-filter) (available as `lib.lists.filter`),
+    which can be used instead when the index isn't needed.
+
+    # Inputs
+
+    `ipred`
+
+    : The predicate function, it takes two arguments:
+      - 1. (int): the index of the element.
+      - 2. (a): the value of the element.
+
+      It must return `true`/`false` to include/exclude a given element from the result.
+
+    `list`
+
+    : The list to filter using the predicate.
+
+    # Type
+    ```
+    ifilter0 :: (int -> a -> bool) -> [a] -> [a]
+    ```
+
+    # Examples
+    :::{.example}
+    ## `lib.lists.ifilter0` usage example
+
+    ```nix
+    ifilter0 (i: v: i == 0 || v > 2) [ 1 2 3 ]
+    => [ 1 3 ]
+    ```
+    :::
+  */
+  ifilter0 =
+    ipred:
+    input:
+    map (idx: elemAt input idx) (
+      filter (idx: ipred idx (elemAt input idx)) (
+        genList (x: x) (length input)
+      )
+    );
+
  /**
    Map and concatenate the result.

--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@ -63,8 +63,10 @@ let
    hasAttrByPath
    hasInfix
    id
+    ifilter0
    isStorePath
    lazyDerivation
+    length
    lists
    listToAttrs
    makeExtensible
@ -651,6 +653,31 @@ runTests {
    expected = ["b" "c"];
  };

+  testIfilter0Example = {
+    expr = ifilter0 (i: v: i == 0 || v > 2) [ 1 2 3 ];
+    expected = [ 1 3 ];
+  };
+  testIfilter0Empty = {
+    expr = ifilter0 (i: v: abort "shouldn't be evaluated!") [ ];
+    expected = [ ];
+  };
+  testIfilter0IndexOnly = {
+    expr = length (ifilter0 (i: v: mod i 2 == 0) [ (throw "0") (throw "1") (throw "2") (throw "3")]);
+    expected = 2;
+  };
+  testIfilter0All = {
+    expr = ifilter0 (i: v: true) [ 10 11 12 13 14 15 ];
+    expected = [ 10 11 12 13 14 15 ];
+  };
+  testIfilter0First = {
+    expr = ifilter0 (i: v: i == 0) [ 10 11 12 13 14 15 ];
+    expected = [ 10 ];
+  };
+  testIfilter0Last = {
+    expr = ifilter0 (i: v: i == 5) [ 10 11 12 13 14 15 ];
+    expected = [ 15 ];
+  };
+
  testFold =
    let
      f = op: fold: fold op 0 (range 0 100);
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1448,6 +1448,12 @@
    githubId = 4194320;
    name = "Anton Schirg";
  };
+  anytimetraveler = {
+    email = "simon@simonscode.org";
+    github = "AnyTimeTraveler";
+    githubId = 19378309;
+    name = "Simon Struck";
+  };
  aorith = {
    email = "aomanu+nixpkgs@gmail.com";
    github = "aorith";
@ -16509,6 +16515,13 @@
      fingerprint = "7573 56D7 79BB B888 773E  415E 736C CDF9 EF51 BD97";
    }];
  };
+  qyriad = {
+    email = "qyriad@qyriad.me";
+    github = "Qyriad";
+    githubId = 1542224;
+    matrix = "@qyriad:katesiria.org";
+    name = "Qyriad";
+  };
  r3dl3g = {
    email = "redleg@rothfuss-web.de";
    github = "r3dl3g";
@ -21898,12 +21911,6 @@
    githubId = 36407913;
    name = "Uli Baum";
  };
-  xfix = {
-    email = "kamila@borowska.pw";
-    github = "KamilaBorowska";
-    githubId = 1297598;
-    name = "Kamila Borowska";
-  };
  xfnw = {
    email = "xfnw+nixos@riseup.net";
    github = "xfnw";
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -50,7 +50,7 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi

 - `virtualisation.docker.enableNvidia` and `virtualisation.podman.enableNvidia` options are deprecated. `virtualisation.containers.cdi.dynamic.nvidia.enable` should be used instead. This option will expose GPUs on containers with the `--device` CLI option. This is supported by Docker 25, Podman 3.2.0 and Singularity 4. Any container runtime that supports the CDI specification will take advantage of this feature.

- A new option `system.etc.overlay.enable` was added. If enabled, `/etc` is
+- `system.etc.overlay.enable` option was added. If enabled, `/etc` is
  mounted via an overlayfs instead of being created by a custom perl script.

 - NixOS AMIs are now uploaded regularly to a new AWS Account.
@ -237,7 +237,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - `nvtop` family of packages was reorganized into nested attrset. `nvtop` has been renamed to `nvtopPackages.full`, and all `nvtop-{amd,nvidia,intel,msm}` packages are now named as `nvtopPackages.{amd,nvidia,intel,msm}`

- `neo4j` has been updated to 5, you may want to read the [release notes for Neo4j 5](https://neo4j.com/release-notes/database/neo4j-5/)
+- `neo4j` has been updated to version 5, you may want to read the [release notes for Neo4j 5](https://neo4j.com/release-notes/database/neo4j-5/)

 - `services.neo4j.allowUpgrade` was removed and no longer has any effect. Neo4j 5 supports automatic rolling upgrades.

@ -251,37 +251,37 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - `services.aria2.rpcSecret` has been replaced with `services.aria2.rpcSecretFile`.
  This was done so that secrets aren't stored in the world-readable nix store.
-  To migrate, you will have create a file with the same exact string, and change
+  To migrate, you will have to create a file with the same exact string, and change
  your module options to point to that file. For example, `services.aria2.rpcSecret =
  "mysecret"` becomes `services.aria2.rpcSecretFile = "/path/to/secret_file"`
  where the file `secret_file` contains the string `mysecret`.

 - `openssh`, `openssh_hpn` and `openssh_gssapi` are now compiled without support for the DSA signature algorithm as it is being deprecated upstream. Users still relying on DSA keys should consider upgrading
-  to another signature algorithm. It is however possible, for the time being, to restore the DSA keys support using `override` to set `dsaKeysSupport = true`.
+  to another signature algorithm. However, for the time being it is possible to restore DSA key support using `override` to set `dsaKeysSupport = true`.

- `buildGoModule` now throws error when `vendorHash` is not specified. `vendorSha256`, deprecated in Nixpkgs 23.11, is now ignored and is no longer a `vendorHash` alias.
+- `buildGoModule` now throws an error when `vendorHash` is not specified. `vendorSha256`, deprecated in Nixpkgs 23.11, is now ignored and is no longer a `vendorHash` alias.

- Invidious has changed its default database username from `kemal` to `invidious`. Setups involving an externally provisioned database (i.e. `services.invidious.database.createLocally == false`) should adjust their configuration accordingly. The old `kemal` user will not be removed automatically even when the database is provisioned automatically.(https://github.com/NixOS/nixpkgs/pull/265857)
+- `services.invidious.settings.db.user`, the default database username, has changed from `kemal` to `invidious`. Setups involving an externally-provisioned database (i.e. `services.invidious.database.createLocally == false`) should adjust their configuration accordingly. The old `kemal` user will not be removed automatically even when the database is provisioned automatically.(https://github.com/NixOS/nixpkgs/pull/265857)

 - `writeReferencesToFile` is deprecated in favour of the new trivial build helper `writeClosure`. The latter accepts a list of paths and has an unambiguous name and cleaner implementation.

 - `inetutils` now has a lower priority to avoid shadowing the commonly used `util-linux`. If one wishes to restore the default priority, simply use `lib.setPrio 5 inetutils` or override with `meta.priority = 5`.

- `paperless`' `services.paperless.extraConfig` setting has been removed and converted to the freeform type and option named `services.paperless.settings`.
+- `paperless`' `services.paperless.extraConfig` setting has been removed and converted to the free-form type and option named `services.paperless.settings`.

- `davfs2`' `services.davfs2.extraConfig` setting has been deprecated and converted to the freeform type option named `services.davfs2.settings` according to RFC42.
+- `davfs2`' `services.davfs2.extraConfig` setting has been deprecated and converted to the free-form type option named `services.davfs2.settings` according to RFC42.

- `services.homepage-dashboard` now takes it's configuration using native Nix expressions, rather than dumping templated configurations into `/var/lib/homepage-dashboard` where they were previously managed manually. There are now new options which allow the configuration of bookmarks, services, widgets and custom CSS/JS natively in Nix.
+- `services.homepage-dashboard` now takes its configuration using native Nix expressions, rather than dumping templated configurations into `/var/lib/homepage-dashboard` where they were previously managed manually. There are now new options which allow the configuration of bookmarks, services, widgets and custom CSS/JS natively in Nix.

 - `hare` may now be cross-compiled. For that to work, however, `haredoc` needed to stop being built together with it. Thus, the latter is now its own package with the name of `haredoc`.

- The legacy and long deprecated systemd target `network-interfaces.target` has been removed. Use `network.target` instead.
+- `network-interfaces.target` system target was removed as it has been deprecated for a long time. Use `network.target` instead.

 - `azure-cli` now has extension support. For example, to install the `aks-preview` extension, use

  ```nix
  environment.systemPackages = [
-    (azure-cli.withExtensions [ azure-cli.extensions.aks-preview ]);
+    (azure-cli.withExtensions [ azure-cli.extensions.aks-preview ])
  ];
  ```
  To make the `azure-cli` immutable and prevent clashes in case `azure-cli` is also installed via other package managers, some configuration files were moved into the derivation.
@ -401,7 +401,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
  upgrade NetBox by changing `services.netbox.package`. Database migrations
  will be run automatically.

- The executable file names for `firefox-devedition`, `firefox-beta`, `firefox-esr` now matches their package names, which is consistent with the `firefox-*-bin` packages. The desktop entries are also updated so that you can have multiple editions of firefox in your app launcher.
+- `firefox-devedition`, `firefox-beta`, `firefox-esr` executable file names for now match their package names, which is consistent with the `firefox-*-bin` packages. The desktop entries are also updated so that you can have multiple editions of firefox in your app launcher.

 - switch-to-configuration does not directly call systemd-tmpfiles anymore.
  Instead, the new artificial sysinit-reactivation.target is introduced which
@ -472,14 +472,14 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - `addDriverRunpath` has been added to facilitate the deprecation of the old `addOpenGLRunpath` setuphook. This change is motivated by the evolution of the setuphook to include all hardware acceleration.

- Cinnamon has been updated to 6.0. Please beware that the [Wayland session](https://blog.linuxmint.com/?p=4591) is still experimental in this release and could potentially [affect Xorg sessions](https://blog.linuxmint.com/?p=4639). We suggest a reboot when switching between sessions.
+- (TODO awaiting feedback on code-casing package names) Cinnamon has been updated to 6.0. Please beware that the [Wayland session](https://blog.linuxmint.com/?p=4591) is still experimental in this release and could potentially [affect Xorg sessions](https://blog.linuxmint.com/?p=4639). We suggest a reboot when switching between sessions.

- MATE has been updated to 1.28.
+- (TODO awaiting feedback on code-casing package names) MATE has been updated to 1.28.
  - To properly support panel plugins built with Wayland (in-process) support, we are introducing `services.xserver.desktopManager.mate.extraPanelApplets` option, please use that for installing panel applets.
  - Similarly, please use `services.xserver.desktopManager.mate.extraCajaExtensions` option for installing Caja extensions.
  - To use the Wayland session, enable `services.xserver.desktopManager.mate.enableWaylandSession`. This is opt-in for now as it is in early stage and introduces a new set of Wayfire closure. Due to [known issues with LightDM](https://github.com/canonical/lightdm/issues/63), we suggest using SDDM for display manager.

- The Budgie module installs gnome-terminal by default (instead of mate-terminal).
+- The (TODO awaiting feedback on code-casing package names) Budgie module installs gnome-terminal by default (instead of mate-terminal).

 - New `boot.loader.systemd-boot.xbootldrMountPoint` allows setting up a separate [XBOOTLDR partition](https://uapi-group.org/specifications/specs/boot_loader_specification/) to store boot files. Useful on systems with a small EFI System partition that cannot be easily repartitioned.

@ -491,7 +491,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 - The Matrix homeserver [Synapse](https://element-hq.github.io/synapse/) module now supports configuring UNIX domain socket [listeners](#opt-services.matrix-synapse.settings.listeners) through the `path` option.
  The default replication worker on the main instance has been migrated away from TCP sockets to UNIX domain sockets.

- The initrd ssh daemon module got a new option to add authorized keys via a list of files using `boot.initrd.network.ssh.authorizedKeyFiles`.
+- `boot.initrd.network.ssh.authorizedKeyFiles` is a new option in the initrd ssh daemon module, for adding authorized keys via list of files.

 - Programs written in [Nim](https://nim-lang.org/) are built with libraries selected by lockfiles.
  The `nimPackages` and `nim2Packages` sets have been removed.
@ -509,9 +509,9 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - `libass` now uses the native CoreText backend on Darwin, which may fix subtitle rendering issues with `mpv`, `ffmpeg`, etc.

- [Lilypond](https://lilypond.org/index.html) and [Denemo](https://www.denemo.org) are now compiled with Guile 3.0.
+- (TODO awaiting feedback on code-casing package names) [Lilypond](https://lilypond.org/index.html) and [Denemo](https://www.denemo.org) are now compiled with Guile 3.0.

- Garage has been updated to v1.x.x. Users should read the [upstream release notes](https://git.deuxfleurs.fr/Deuxfleurs/garage/releases/tag/v1.0.0) and follow the documentation when changing over their `services.garage.package` and performing this manual upgrade.
+- (TODO awaiting feedback on code-casing package names) Garage has been updated to v1.x.x. Users should read the [upstream release notes](https://git.deuxfleurs.fr/Deuxfleurs/garage/releases/tag/v1.0.0) and follow the documentation when changing over their `services.garage.package` and performing this manual upgrade.

 - The EC2 image module now enables the [Amazon SSM Agent](https://docs.aws.amazon.com/systems-manager/latest/userguide/ssm-agent.html) by default.

@ -546,7 +546,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 - New options were added to the dnsdist module to enable and configure a DNSCrypt endpoint (see `services.dnsdist.dnscrypt.enable`, etc.).
  The module can generate the DNSCrypt provider key pair, certificates and also performs their rotation automatically with no downtime.

- With a bump to `sonarr` v4, existing config database files will be upgraded automatically, but note that some old apparently-working configs [might actually be corrupt and fail to upgrade cleanly](https://forums.sonarr.tv/t/sonarr-v4-released/33089).
+- `sonarr` bumped to v4. Consequently existing config database files will be upgraded automatically, but note that some old apparently-working configs [might actually be corrupt and fail to upgrade cleanly](https://forums.sonarr.tv/t/sonarr-v4-released/33089).

 - The Yama LSM is now enabled by default in the kernel, which prevents ptracing
  non-child processes. This means you will not be able to attach gdb to an
@ -556,15 +556,13 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 - The netbird module now allows running multiple tunnels in parallel through [`services.netbird.tunnels`](#opt-services.netbird.tunnels).

 - [Nginx virtual hosts](#opt-services.nginx.virtualHosts) using `forceSSL` or
-  `globalRedirect` can now have redirect codes other than 301 through
+  `globalRedirect` can now have redirect codes other than 301 through `redirectCode`.

 - `bacula` now allows to configure `TLS` for encrypted communication.

-  `redirectCode`.
-
 - `libjxl` 0.9.0 [dropped support for the butteraugli API](https://github.com/libjxl/libjxl/pull/2576). You will no longer be able to set `enableButteraugli` on `libaom`.

- The source of the `mockgen` package has changed to the [go.uber.org/mock](https://github.com/uber-go/mock) fork because [the original repository is no longer maintained](https://github.com/golang/mock#gomock).
+- `mockgen` package source has changed to the [go.uber.org/mock](https://github.com/uber-go/mock) fork because [the original repository is no longer maintained](https://github.com/golang/mock#gomock).

 - `security.pam.enableSSHAgentAuth` was renamed to `security.pam.sshAgentAuth.enable` and an `authorizedKeysFiles`
  option was added, to control which `authorized_keys` files are trusted.  It defaults to the previous behaviour,
@ -581,7 +579,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - `nextcloud-setup.service` no longer changes the group of each file & directory inside `/var/lib/nextcloud/{config,data,store-apps}` if one of these directories has the wrong owner group. This was part of transitioning the group used for `/var/lib/nextcloud`, but isn't necessary anymore.

- `services.kavita` now uses the freeform option `services.kavita.settings` for the application settings file.
+- `services.kavita` now uses the free-form option `services.kavita.settings` for the application settings file.
  The options `services.kavita.ipAdresses` and `services.kavita.port` now exist at `services.kavita.settings.IpAddresses`
  and `services.kavita.settings.IpAddresses`. The file at `services.kavita.tokenKeyFile` now needs to contain a secret with
  512+ bits instead of 128+ bits.
@ -592,7 +590,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - `services.soju` now has a wrapper for the `sojuctl` command, pointed at the service config file. It also has the new option `adminSocket.enable`, which creates a unix admin socket at `/run/soju/admin`.

- Gitea 1.21 upgrade has several breaking changes, including:
+- `gitea` upgrade to 1.21 has several breaking changes, including:
  - Custom themes and other assets that were previously stored in `custom/public/*` now belong in `custom/public/assets/*`
  - New instances of Gitea using MySQL now ignore the `[database].CHARSET` config option and always use the `utf8mb4` charset, existing instances should migrate via the `gitea doctor convert` CLI command.

@ -604,10 +602,10 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - The `services.networkmanager.extraConfig` was renamed to `services.networkmanager.settings` and was changed to use the ini type instead of using a multiline string.

- The module `services.github-runner` has been removed. To configure a single GitHub Actions Runner refer to `services.github-runners.*`. Note that this will trigger a new runner registration.
+- `services.github-runner` module has been removed. To configure a single GitHub Actions Runner refer to `services.github-runners.*`. Note that this will trigger a new runner registration.

 - The `services.slskd` has been refactored to include more configuation options in
-  the freeform `services.slskd.settings` option, and some defaults (including listen ports)
+  the free-form `services.slskd.settings` option, and some defaults (including listen ports)
  have been changed to match the upstream defaults. Additionally, disk logging is now
  disabled by default, and the log rotation timer has been removed.
  The nginx virtualhost option is now of the `vhost-options` type.
--- a/nixos/modules/services/mail/roundcube.nix
+++ b/nixos/modules/services/mail/roundcube.nix
@ -7,7 +7,7 @@ let
  fpm = config.services.phpfpm.pools.roundcube;
  localDB = cfg.database.host == "localhost";
  user = cfg.database.username;
-  phpWithPspell = pkgs.php81.withExtensions ({ enabled, all }: [ all.pspell ] ++ enabled);
+  phpWithPspell = pkgs.php83.withExtensions ({ enabled, all }: [ all.pspell ] ++ enabled);
 in
 {
  options.services.roundcube = {
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@ -829,7 +829,7 @@ in
      sslCiphers = mkOption {
        type = types.nullOr types.str;
        # Keep in sync with https://ssl-config.mozilla.org/#server=nginx&config=intermediate
-        default = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
+        default = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305";
        description = "Ciphers to choose from when negotiating TLS handshakes.";
      };

--- a/nixos/tests/caddy.nix
+++ b/nixos/tests/caddy.nix
@ -1,7 +1,7 @@
 import ./make-test-python.nix ({ pkgs, ... }: {
  name = "caddy";
  meta = with pkgs.lib.maintainers; {
-    maintainers = [ xfix Br1ght0ne ];
+    maintainers = [ Br1ght0ne ];
  };

  nodes = {
--- a/nixos/tests/radicale.nix
+++ b/nixos/tests/radicale.nix
@ -6,7 +6,7 @@ let
  port = "5232";
  filesystem_folder = "/data/radicale";

-  cli = "${pkgs.calendar-cli}/bin/calendar-cli --caldav-user ${user} --caldav-pass ${password}";
+  cli = "${lib.getExe pkgs.calendar-cli} --caldav-user ${user} --caldav-pass ${password}";
 in {
  name = "radicale3";
  meta.maintainers = with lib.maintainers; [ dotlambda ];
--- a/pkgs/applications/audio/audacity/default.nix
+++ b/pkgs/applications/audio/audacity/default.nix
@ -62,13 +62,13 @@

 stdenv.mkDerivation rec {
  pname = "audacity";
-  version = "3.4.2";
+  version = "3.5.0";

  src = fetchFromGitHub {
    owner = "audacity";
    repo = "audacity";
    rev = "Audacity-${version}";
-    hash = "sha256-YlRWCu6kQYdzast7Mf29p4FvpXJHQLG7vqqo/5SNQCQ=";
+    hash = "sha256-vJhCONoEC4Bdd1ZOLLobjNgLb/DT6auuMGk8L9lj6TU=";
  };

  postPatch = ''
--- a/pkgs/applications/audio/csound/csound-qt/default.nix
+++ b/pkgs/applications/audio/csound/csound-qt/default.nix
@ -1,5 +1,5 @@
 { lib, stdenv, csound, desktop-file-utils,
-  fetchFromGitHub, python, python-qt, qmake,
+  fetchFromGitHub, python3, python-qt, qmake,
  qtwebengine, qtxmlpatterns, rtmidi, wrapQtAppsHook }:

 stdenv.mkDerivation rec {
@ -26,13 +26,13 @@ stdenv.mkDerivation rec {
                 "CSOUND_INCLUDE_DIR=${csound}/include/csound"
                 "CSOUND_LIBRARY_DIR=${csound}/lib"
                 "RTMIDI_DIR=${rtmidi.src}"
-                 "PYTHONQT_SRC_DIR=${python-qt}/include/PythonQt"
+                 "PYTHONQT_SRC_DIR=${python-qt.src}"
                 "PYTHONQT_LIB_DIR=${python-qt}/lib"
                 "LIBS+=-L${python-qt}/lib"
-                 "INCLUDEPATH+=${python-qt}/include/PythonQt"
-                 "INCLUDEPATH+=${python}/include/python${python.pythonVersion}"
                 "INSTALL_DIR=${placeholder "out"}"
                 "SHARE_DIR=${placeholder "out"}/share"
+                 "PYTHON_DIR=${python3}"
+                 "PYTHON_VERSION=3.${python3.sourceVersion.minor}"
                 ];

  meta = with lib; {
--- a/pkgs/applications/audio/reaper/default.nix
+++ b/pkgs/applications/audio/reaper/default.nix
@ -28,13 +28,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "reaper";
-  version = "7.14";
+  version = "7.15";

  src = fetchurl {
    url = url_for_platform version stdenv.hostPlatform.qemuArch;
-    hash = if stdenv.isDarwin then "sha256-cPxHriUNIG1EUmvOoW00V2Y0j+7BuxSIEbPy+qy5ZEM=" else {
-      x86_64-linux = "sha256-RgKteq157r4r088mr9wvPPa/rhmX88/lmVJ7mS17px4=";
-      aarch64-linux = "sha256-Qnb6ZoDIkfRct6dvqXKeYHgXyyEFLSj9R0hwa2bUiXo=";
+    hash = if stdenv.isDarwin then "sha256-7tWgbHIkARgsPi0buvbQb4qTqndyPwRRqut1Gj4WNZE=" else {
+      x86_64-linux = "sha256-O1xh+DKwPKTcQrNhWMX5ErKa1hXq0yeyt/XJMQav11c=";
+      aarch64-linux = "sha256-rQE8Aa+iFWpA18udCXm4JW8BPTEDeEQAupy353Sbcl8=";
    }.${stdenv.hostPlatform.system};
  };

--- a/pkgs/applications/blockchains/bitcoin/default.nix
+++ b/pkgs/applications/blockchains/bitcoin/default.nix
@ -13,7 +13,6 @@
 , miniupnpc
 , zeromq
 , zlib
-, db48
 , sqlite
 , qrencode
 , qtbase ? null
@ -51,7 +50,7 @@ stdenv.mkDerivation rec {
    ++ lib.optionals withGui [ wrapQtAppsHook ];

  buildInputs = [ boost libevent miniupnpc zeromq zlib ]
-    ++ lib.optionals withWallet [ db48 sqlite ]
+    ++ lib.optionals withWallet [ sqlite ]
    ++ lib.optionals withGui [ qrencode qtbase qttools ];

  postInstall = ''
--- a/pkgs/applications/editors/neovim/wrapper.nix
+++ b/pkgs/applications/editors/neovim/wrapper.nix
@ -83,8 +83,12 @@ let
      ;

    perlEnv = perl.withPackages (p: [ p.NeovimExt p.Appcpanminus ]);
+
+    pname = "neovim";
+    version = lib.getVersion neovim-unwrapped;
  in {
-      name = "neovim-${lib.getVersion neovim-unwrapped}${extraName}";
+      name = "${pname}-${version}${extraName}";
+      inherit pname version;

      __structuredAttrs = true;
      dontUnpack = true;
--- a/pkgs/applications/editors/poke/default.nix
+++ b/pkgs/applications/editors/poke/default.nix
@ -1,37 +1,35 @@
 { lib
 , stdenv
 , fetchurl
-, gettext
 , help2man
 , pkg-config
 , texinfo
 , boehmgc
 , readline
-, guiSupport ? false, makeWrapper, tcl, tcllib, tk
-, miSupport ? true, json_c
 , nbdSupport ? !stdenv.isDarwin, libnbd
-, textStylingSupport ? true
+, textStylingSupport ? true, gettext
 , dejagnu

-# update script only
+  # update script only
 , writeScript
 }:

 let
  isCross = stdenv.hostPlatform != stdenv.buildPlatform;
-in stdenv.mkDerivation rec {
+in
+stdenv.mkDerivation (finalAttrs: {
  pname = "poke";
-  version = "3.2";
+  version = "4.0";

  src = fetchurl {
-    url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
-    hash = "sha256-dY5VHdU6bM5U7JTY/CH6TWtSon0cJmcgbVmezcdPDZc=";
+    url = "mirror://gnu/poke/poke-${finalAttrs.version}.tar.gz";
+    hash = "sha256-ArqyLLH6YVOhtqknyLs81Y1QhUPBRIQqbX7nTxmXOnc=";
  };

  outputs = [ "out" "dev" "info" "lib" ]
-  # help2man can't cross compile because it runs `poke --help` to
-  # generate the man page
-  ++ lib.optional (!isCross) "man";
+    # help2man can't cross compile because it runs `poke --help` to
+    # generate the man page
+    ++ lib.optional (!isCross) "man";

  postPatch = ''
    patchShebangs .
@ -40,53 +38,33 @@ in stdenv.mkDerivation rec {
  strictDeps = true;

  nativeBuildInputs = [
-    gettext
    pkg-config
    texinfo
  ] ++ lib.optionals (!isCross) [
    help2man
-  ] ++ lib.optionals guiSupport [
-    makeWrapper
-    tcl.tclPackageHook
  ];

  buildInputs = [ boehmgc readline ]
-  ++ lib.optionals guiSupport [ tcl tcllib tk ]
-  ++ lib.optional miSupport json_c
-  ++ lib.optional nbdSupport libnbd
-  ++ lib.optional textStylingSupport gettext
-  ++ lib.optional (!isCross) dejagnu;
+    ++ lib.optional nbdSupport libnbd
+    ++ lib.optional textStylingSupport gettext
+    ++ lib.optional finalAttrs.finalPackage.doCheck dejagnu;

  configureFlags = [
    # libpoke depends on $datadir/poke, so we specify the datadir in
    # $lib, and later move anything else it doesn't depend on to $out
    "--datadir=${placeholder "lib"}/share"
-  ] ++ lib.optionals guiSupport [
-    "--enable-gui"
-    "--with-tcl=${tcl}/lib"
-    "--with-tk=${tk}/lib"
-    "--with-tkinclude=${tk.dev}/include"
  ];

  enableParallelBuilding = true;

-  doCheck = !isCross;
-  nativeCheckInputs = lib.optionals (!isCross) [ dejagnu ];
+  doCheck = true;
+  nativeCheckInputs = [ dejagnu ];

  postInstall = ''
    moveToOutput share/emacs "$out"
    moveToOutput share/vim "$out"
  '';

-  # Prevent tclPackageHook from auto-wrapping all binaries, we only
-  # need to wrap poke-gui
-  dontWrapTclBinaries = true;
-
-  postFixup = lib.optionalString guiSupport ''
-    wrapProgram "$out/bin/poke-gui" \
-      --prefix TCLLIBPATH ' ' "$TCLLIBPATH"
-  '';
-
  passthru = {
    updateScript = writeScript "update-poke" ''
      #!/usr/bin/env nix-shell
@ -97,18 +75,17 @@ in stdenv.mkDerivation rec {
      # Expect the text in format of '<a href="...">poke 2.0</a>'
      new_version="$(curl -s https://www.jemarch.net/poke |
          pcregrep -o1 '>poke ([0-9.]+)</a>')"
-      update-source-version ${pname} "$new_version"
+      update-source-version poke "$new_version"
    '';
  };

-  meta = with lib; {
+  meta = {
    description = "Interactive, extensible editor for binary data";
    homepage = "http://www.jemarch.net/poke";
-    changelog = "https://git.savannah.gnu.org/cgit/poke.git/plain/ChangeLog?h=releases/poke-${version}";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ AndersonTorres kira-bruneau ];
-    platforms = platforms.unix;
+    changelog = "https://git.savannah.gnu.org/cgit/poke.git/plain/ChangeLog?h=releases/poke-${finalAttrs.version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ AndersonTorres kira-bruneau ];
+    platforms = lib.platforms.unix;
+    broken = stdenv.isDarwin && stdenv.isAarch64;
  };
-}
-
-# TODO: Enable guiSupport by default once it's more than just a stub
+})
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -689,6 +689,18 @@ final: prev:
    meta.homepage = "https://github.com/vim-scripts/argtextobj.vim/";
  };

+  arrow-nvim = buildVimPlugin {
+    pname = "arrow.nvim";
+    version = "2024-04-19";
+    src = fetchFromGitHub {
+      owner = "otavioschwanck";
+      repo = "arrow.nvim";
+      rev = "37f32c94cf6e01826af5d96337c70d2f9be0a280";
+      sha256 = "0v23gw86rmciaqbi27ifd3f5mw0vknm2482yznb30dpq3pk53327";
+    };
+    meta.homepage = "https://github.com/otavioschwanck/arrow.nvim/";
+  };
+
  astrotheme = buildVimPlugin {
    pname = "astrotheme";
    version = "2024-04-10";
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -56,6 +56,7 @@ https://github.com/pearofducks/ansible-vim/,,
 https://github.com/ckarnell/antonys-macro-repeater/,,
 https://github.com/solarnz/arcanist.vim/,,
 https://github.com/vim-scripts/argtextobj.vim/,,
+https://github.com/otavioschwanck/arrow.nvim/,,
 https://github.com/AstroNvim/astrotheme/,,
 https://github.com/prabirshrestha/async.vim/,,
 https://github.com/prabirshrestha/asyncomplete-buffer.vim/,HEAD,
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -2073,6 +2073,22 @@ let
        };
      };

+      hiukky.flate = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "flate";
+          publisher = "hiukky";
+          version = "0.7.0";
+          hash = "sha256-6ouYQk7mHCJdGrcutM1EXolJAT7/Sp1hi+Bu0983GKw=";
+        };
+        meta = {
+          description = "Colorful dark themes for VS Code";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=hiukky.flate";
+          homepage = "https://github.com/hiukky/flate";
+          license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.stunkymonkey ];
+        };
+      };
+
      hookyqr.beautify = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "beautify";
--- a/pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix
@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "vscode-pylance";
    publisher = "MS-python";
-    version = "2023.8.50";
-    hash = "sha256-xJU/j5r/Idp/0VorEfciT4SFKRBpMCv9Z0LKO/++1Gk=";
+    version = "2024.4.1";
+    hash = "sha256-huKu6yefGXOay5Az4vksopRt8heoLxvKUrg/J1NlQFo=";
  };

  buildInputs = [ pyright ];
--- a/pkgs/applications/emulators/cemu/default.nix
+++ b/pkgs/applications/emulators/cemu/default.nix
@ -46,13 +46,13 @@ let

 in stdenv.mkDerivation rec {
  pname = "cemu";
-  version = "2.0-78";
+  version = "2.0-79";

  src = fetchFromGitHub {
    owner = "cemu-project";
    repo = "Cemu";
    rev = "v${version}";
-    hash = "sha256-ivdqO44+8sDgOshUDFc+4eTgzcEDSiPPIawyktYpob4=";
+    hash = "sha256-vSZLiRzOOJJMgycjI5xpgJcUAj5WCz241mAABgNuECw=";
  };

  patches = [
--- a/pkgs/applications/emulators/dolphin-emu/default.nix
+++ b/pkgs/applications/emulators/dolphin-emu/default.nix
@ -204,7 +204,6 @@ stdenv.mkDerivation rec {
    maintainers = with maintainers; [
      MP2E
      ashkitten
-      xfix
      ivar
    ];
  };
--- a/pkgs/applications/emulators/lambda-delta/default.nix
+++ b/pkgs/applications/emulators/lambda-delta/default.nix
@ -13,6 +13,10 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ autoreconfHook pkg-config ];
  buildInputs = [ SDL2 ];
+  env = lib.optionalAttrs stdenv.cc.isClang {
+    NIX_CFLAGS_COMPILE = "-std=c89";
+  };
+

  configureFlags = [ "--without-SDL1" ];

--- a/pkgs/applications/emulators/melonDS/default.nix
+++ b/pkgs/applications/emulators/melonDS/default.nix
@ -65,7 +65,6 @@ stdenv.mkDerivation (finalAttrs: {
      artemist
      benley
      shamilton
-      xfix
    ];
    platforms = lib.platforms.linux;
  };
--- a/pkgs/applications/emulators/retroarch/hashes.json
+++ b/pkgs/applications/emulators/retroarch/hashes.json
@ -85,10 +85,10 @@
        "src": {
            "owner": "libretro",
            "repo": "beetle-psx-libretro",
-            "rev": "9c9b44a7b9b373f2d8f9a3f16bc8373d6469cf98",
-            "hash": "sha256-XQ7EVPj0Eprs94yjqaUGCphHteRdbcv2nqp3gojYjzc="
+            "rev": "ab39d37f868ba8ff3982ce52c4ec22c162888dd7",
+            "hash": "sha256-Ay3wI9WToSsJNjkNFnHXTt9JUQ6nt+S9jI378E/kK8U="
        },
-        "version": "unstable-2024-04-12"
+        "version": "unstable-2024-04-19"
    },
    "beetle-saturn": {
        "fetcher": "fetchFromGitHub",
@ -226,10 +226,10 @@
        "src": {
            "owner": "libretro",
            "repo": "dolphin",
-            "rev": "2f4b0f7902257d40a054f60b2c670d6e314f2a04",
-            "hash": "sha256-9WYWbLehExYbPmGJpguhVFXqFJ9aR6VxzFVChd4QOEg="
+            "rev": "89a4df725d4eb24537728f7d655cddb1add25c18",
+            "hash": "sha256-f9O3//EuoCSPQC7GWmf0EzAEpjoKof30kIDBCDw0dbs="
        },
-        "version": "unstable-2022-12-17"
+        "version": "unstable-2024-04-19"
    },
    "dosbox": {
        "fetcher": "fetchFromGitHub",
@ -287,10 +287,10 @@
        "src": {
            "owner": "libretro",
            "repo": "fbneo",
-            "rev": "97f01ed6075b6034aeb16829a2a259bbe8a254f9",
-            "hash": "sha256-qXym7CzAXfOSK+hmq6JfCIrq9w11uA2UQ2Ps+lFHrfI="
+            "rev": "c821b1008e31d40b6d0464f67a3bc0b1a3da4cce",
+            "hash": "sha256-yZimJ1eH5Oi+6+4eMtXppj75awCrPXMiWhalsR+Bfik="
        },
-        "version": "unstable-2024-04-15"
+        "version": "unstable-2024-04-20"
    },
    "fceumm": {
        "fetcher": "fetchFromGitHub",
@ -307,11 +307,11 @@
        "src": {
            "owner": "flyinghead",
            "repo": "flycast",
-            "rev": "7438094d7cdf191e6eb2a39e73cb0f512ea2a714",
-            "hash": "sha256-T19GJbN/MKC03Q/yS1C6qL5Rv++OlaBol4UYf9//l3s=",
+            "rev": "3c38fc1f16cc6518db46a5ad350e8b3738eefb48",
+            "hash": "sha256-NfJJcu7noefSgFlCFCgovnrb6FSzIXu3MGQHu6TCJWo=",
            "fetchSubmodules": true
        },
-        "version": "unstable-2024-04-12"
+        "version": "unstable-2024-04-19"
    },
    "fmsx": {
        "fetcher": "fetchFromGitHub",
@ -358,10 +358,10 @@
        "src": {
            "owner": "libretro",
            "repo": "Genesis-Plus-GX",
-            "rev": "b063aa81b90682ca89ae6fd1e958bc589b4ce34d",
-            "hash": "sha256-Tz6if6NfbwvZVDb5Ggr/tXuLNymOjcMkghKwZq6tl6I="
+            "rev": "cbacea723690e88e0b11a4b1d0e5b88b1b7eb9d4",
+            "hash": "sha256-7qFBzATlhf89ILHsEoF+SWwD4Pwd5+08VnK5xU1EDuI="
        },
-        "version": "unstable-2024-04-05"
+        "version": "unstable-2024-04-20"
    },
    "gpsp": {
        "fetcher": "fetchFromGitHub",
@ -438,10 +438,10 @@
        "src": {
            "owner": "libretro",
            "repo": "mame2003-plus-libretro",
-            "rev": "7ca870c4168e69819923f73ae0289c38d57b01dc",
-            "hash": "sha256-eoLzRNsZtIo6Pc9SovQGh9sHxdXhBSQj71RDcQqjji0="
+            "rev": "bb864ca20b40908b8fbc49a350939160d6af29f6",
+            "hash": "sha256-3AvjOpgBh/p0p9xq4rD8xSKqZWzulw7AKUGQ1o9B2Ck="
        },
-        "version": "unstable-2024-04-13"
+        "version": "unstable-2024-04-19"
    },
    "mame2010": {
        "fetcher": "fetchFromGitHub",
@ -630,10 +630,10 @@
        "src": {
            "owner": "libretro",
            "repo": "pcsx_rearmed",
-            "rev": "2f326fa15ff26df057ef10da232ebc07a410803a",
-            "hash": "sha256-mnJJ1NzxZoA3kwfPOyvpP65SKI0I/9FCPNW8TR8NY8k="
+            "rev": "e5cb0939ab32d3c3b90b39e2d49a1652a7cf0db1",
+            "hash": "sha256-K96w3NGXpsnVAmORPdwwhwIJ6PcvaDOEUtLkF4ftX3s="
        },
-        "version": "unstable-2024-04-14"
+        "version": "unstable-2024-04-18"
    },
    "picodrive": {
        "fetcher": "fetchFromGitHub",
@ -651,22 +651,22 @@
        "src": {
            "owner": "jpd002",
            "repo": "Play-",
-            "rev": "5c8f4a818be5c1e4df568abfec169c2b08df6674",
-            "hash": "sha256-IyxqH0ZAAiJ8V9kaVSwhf1zJnVlxhJWghr51AXcvQvs=",
+            "rev": "57f8a1389f7f2987ab2ad99fdc846663994603ad",
+            "hash": "sha256-MwqLSTDL6C823grCMRYZrwjhIhbVipAR+4vF5k8UhyE=",
            "fetchSubmodules": true
        },
-        "version": "unstable-2024-04-10"
+        "version": "unstable-2024-04-15"
    },
    "ppsspp": {
        "fetcher": "fetchFromGitHub",
        "src": {
            "owner": "hrydgard",
            "repo": "ppsspp",
-            "rev": "efe2302548fcbd2dc68c9b5b1fb39dc7976532fd",
-            "hash": "sha256-zwC3HniJO11/6ApBo0UNn6WMu4Jmj099XaUY4QuKaZI=",
+            "rev": "1786a4ddb097f7df1c75b55b4c4b163032614371",
+            "hash": "sha256-nAyGfgSfcJ4dF5oF3FHy+aqzabf9wUOiP0w+GIY1svg=",
            "fetchSubmodules": true
        },
-        "version": "unstable-2024-04-14"
+        "version": "unstable-2024-04-20"
    },
    "prboom": {
        "fetcher": "fetchFromGitHub",
@ -693,10 +693,10 @@
        "src": {
            "owner": "libretro",
            "repo": "libretro-uae",
-            "rev": "3c4f02622bd9ab4bbfc5e90cea9c7e60cf410073",
-            "hash": "sha256-UMbD1RcgQmilBwwzvakUIWWWwg78sl1YT9EOE3Rhyao="
+            "rev": "4806716da70cf1f030788b43190d71aae61e2041",
+            "hash": "sha256-MNqk8ItSC//82HsRfXVYCH+Xd2GV8OA/2heZprx89PY="
        },
-        "version": "unstable-2024-04-12"
+        "version": "unstable-2024-04-19"
    },
    "quicknes": {
        "fetcher": "fetchFromGitHub",
@ -753,10 +753,10 @@
        "src": {
            "owner": "snes9xgit",
            "repo": "snes9x",
-            "rev": "9d22dbb8d866f10042fe564db7dc7b41078a580b",
-            "hash": "sha256-y2kPj1BugXVZGzyxs0Ph/qM5SMe82kjxnQA25DIpzac="
+            "rev": "8077396d399424de89d0a6cc15134523965658e0",
+            "hash": "sha256-p6apk/8bRKSM3H3hGPr/fYGsDFgMv7syVmTHV0zgmOg="
        },
-        "version": "unstable-2024-04-13"
+        "version": "unstable-2024-04-20"
    },
    "snes9x2002": {
        "fetcher": "fetchFromGitHub",
@ -813,10 +813,10 @@
        "src": {
            "owner": "libretro",
            "repo": "swanstation",
-            "rev": "77aeeea58a45cccae7a8be37645f8f5a27ff101b",
-            "hash": "sha256-z+9Y9hoQ832caip5U+siQXh9GFxLMnX0HcmLa93B/lc="
+            "rev": "c7fefb5bfdec2569c2528f8daa6e75b7a3de0880",
+            "hash": "sha256-dE8F/NXGIEMrdmBWUTzanCSlT0ddkwG8RLZFmy1XvzQ="
        },
-        "version": "unstable-2024-01-26"
+        "version": "unstable-2024-04-18"
    },
    "tgbdual": {
        "fetcher": "fetchFromGitHub",
--- a/pkgs/applications/emulators/retroarch/retroarch-assets.nix
+++ b/pkgs/applications/emulators/retroarch/retroarch-assets.nix
@ -6,13 +6,13 @@

 stdenvNoCC.mkDerivation {
  pname = "retroarch-assets";
-  version = "unstable-2024-01-02";
+  version = "unstable-2024-04-18";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "retroarch-assets";
-    rev = "923b711dc6772a168d83dc8915e9260730fcf3a1";
-    hash = "sha256-Hwgga2hCJEdf/j2mU+hLGAsWdYcfuzjCycxSF37I4qk=";
+    rev = "912f652740986549f41967d615d9da27c325c2b9";
+    hash = "sha256-HpmRnbj6CQp7+rmZY46MyT8Ga6832COm1it2z9rKUEU=";
  };

  makeFlags = [
--- a/pkgs/applications/emulators/snes9x/default.nix
+++ b/pkgs/applications/emulators/snes9x/default.nix
@ -120,7 +120,7 @@ stdenv.mkDerivation rec {
      license = licenses.unfreeRedistributable // {
        url = "https://github.com/snes9xgit/snes9x/blob/${version}/LICENSE";
      };
-      maintainers = with maintainers; [ qknight xfix thiagokokada ];
+      maintainers = with maintainers; [ qknight thiagokokada ];
      platforms = platforms.unix;
      broken = (withGtk && stdenv.isDarwin);
      mainProgram = "snes9x";
--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@ -32,11 +32,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "calibre";
-  version = "7.8.0";
+  version = "7.9.0";

  src = fetchurl {
    url = "https://download.calibre-ebook.com/${finalAttrs.version}/calibre-${finalAttrs.version}.tar.xz";
-    hash = "sha256-FxYuQzzuaWZihSsmeJc6ssG3VBr2YNEi3TkXyyymLUQ=";
+    hash = "sha256-Ilzv4HXW6ZmEVNUWQm04cHZ71FEgjfWVX9IvrfYCHIk=";
  };

  patches = [
@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
    (fetchpatch {
      name = "0001-only-plugin-update.patch";
      url = "https://raw.githubusercontent.com/debian-calibre/calibre/debian/${finalAttrs.version}+ds-1/debian/patches/0001-only-plugin-update.patch";
-      hash = "sha256-uL1mSjgCl5ZRLbSuKxJM6XTfvVwog70F7vgKtQzQNEQ=";
+      hash = "sha256-mHZkUoVcoVi9XBOSvM5jyvpOTCcM91g9+Pa/lY6L5p8=";
    })
    (fetchpatch {
      name = "0007-Hardening-Qt-code.patch";
--- a/pkgs/applications/misc/projectlibre/default.nix
+++ b/pkgs/applications/misc/projectlibre/default.nix
@ -1,46 +1,68 @@
-{ lib, stdenv, fetchgit, ant, jdk, makeWrapper, jre, coreutils, which }:
+{ lib
+, stdenv
+, fetchgit
+, ant
+, jdk
+, stripJavaArchivesHook
+, makeWrapper
+, jre
+, coreutils
+, which
+}:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
  pname = "projectlibre";
  version = "1.7.0";

  src = fetchgit {
    url = "https://git.code.sf.net/p/projectlibre/code";
    rev = "0c939507cc63e9eaeb855437189cdec79e9386c2"; # version 1.7.0 was not tagged
-    sha256 = "0vy5vgbp45ai957gaby2dj1hvmbxfdlfnwcanwqm9f8q16qipdbq";
+    hash = "sha256-eLUbsQkYuVQxt4px62hzfdUNg2zCL/VOSVEVctfbxW8=";
  };

-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ ant jdk ];
-  buildPhase = ''
-    export ANT_OPTS=-Dbuild.sysclasspath=ignore
-    ${ant}/bin/ant -f openproj_build/build.xml
-  '';
+  nativeBuildInputs = [
+    ant
+    jdk
+    stripJavaArchivesHook
+    makeWrapper
+  ];

-  resourcesPath = "openproj_build/resources";
-  desktopItem = "${resourcesPath}/projectlibre.desktop";
+  buildPhase = ''
+    runHook preBuild
+    ant -f openproj_build/build.xml
+    runHook postBuild
+  '';

  installPhase = ''
-    mkdir -p $out/share/{applications,projectlibre/samples,pixmaps,doc/projectlibre} $out/bin
+    runHook preInstall
+
+    mkdir -p $out/share/{projectlibre/samples,doc/projectlibre}
+
+    pushd openproj_build
+    cp -R dist/* $out/share/projectlibre
+    cp -R license $out/share/doc/projectlibre
+    cp -R resources/samples/* $out/share/projectlibre/samples
+    install -Dm644 resources/projectlibre.desktop -t $out/share/applications
+    install -Dm644 resources/projectlibre.png -t $out/share/pixmaps
+    install -Dm755 resources/projectlibre -t $out/bin
+    popd
+
+    substituteInPlace $out/bin/projectlibre \
+        --replace-fail "/usr/share/projectlibre" "$out/share/projectlibre"

-    substitute $resourcesPath/projectlibre $out/bin/projectlibre \
-      --replace "\"/usr/share/projectlibre\"" "\"$out/share/projectlibre\""
-    chmod +x $out/bin/projectlibre
    wrapProgram $out/bin/projectlibre \
-     --prefix PATH : "${jre}/bin:${coreutils}/bin:${which}/bin"
+        --prefix PATH : ${lib.makeBinPath [ jre coreutils which ]}

-    cp -R openproj_build/dist/* $out/share/projectlibre
-    cp -R openproj_build/license $out/share/doc/projectlibre
-    cp $desktopItem $out/share/applications
-    cp $resourcesPath/projectlibre.png $out/share/pixmaps
-    cp -R $resourcesPath/samples/* $out/share/projectlibre/samples
+    runHook postInstall
  '';

-  meta = with lib; {
-    homepage = "https://www.projectlibre.com/";
+  meta = {
    description = "Project-Management Software similar to MS-Project";
+    homepage = "https://www.projectlibre.com/";
+    license = lib.licenses.cpal10;
    mainProgram = "projectlibre";
-    maintainers = [ maintainers.Mogria ];
-    license = licenses.cpal10;
+    maintainers = with lib.maintainers; [ Mogria tomasajt ];
+    platforms = jre.meta.platforms;
  };
 }
+
--- a/pkgs/applications/misc/skytemple/default.nix
+++ b/pkgs/applications/misc/skytemple/default.nix
@ -67,6 +67,6 @@ python3Packages.buildPythonApplication rec {
    description = "ROM hacking tool for Pokémon Mystery Dungeon Explorers of Sky";
    mainProgram = "skytemple";
    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ xfix marius851000 ];
+    maintainers = with maintainers; [ marius851000 ];
  };
 }
--- a/pkgs/applications/misc/terminal-stocks/default.nix
+++ b/pkgs/applications/misc/terminal-stocks/default.nix
@ -2,16 +2,16 @@

 buildNpmPackage rec {
  pname = "terminal-stocks";
-  version = "1.0.16";
+  version = "1.0.17";

  src = fetchFromGitHub {
    owner = "shweshi";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-tu6SKeTVEqIqDJXimoSkMK9+l0uGqWSrlIO0KHoROSQ=";
+    hash = "sha256-hCKUUISn/TIr2o3ZtG2kSTgmUCut4NVzIzfIrg84PYI=";
  };

-  npmDepsHash = "sha256-13RiEBLhmKW04Tesg1s7c9rCYtRGOd/prnVARb6jpGQ=";
+  npmDepsHash = "sha256-t71SfoPYVFLWcrjv2ErWazDeaVTO4W46g4lFler86Sc=";
  dontNpmBuild = true;

  passthru.updateScript = nix-update-script {};
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -6,17 +6,17 @@ callPackage ./make-brave.nix (removeAttrs args [ "callPackage" ])
    if stdenv.isAarch64 then
      {
        pname = "brave";
-        version = "1.64.122";
-        url = "https://github.com/brave/brave-browser/releases/download/v1.64.122/brave-browser_1.64.122_arm64.deb";
-        hash = "sha256-PBYiCTy/QaPfxvWAzUnXLEzBELISNSKX0kG/mYTDDEA=";
+        version = "1.65.114";
+        url = "https://github.com/brave/brave-browser/releases/download/v1.65.114/brave-browser_1.65.114_arm64.deb";
+        hash = "sha256-E5IqMmkgnwn1eyKcPQ3SZX4QpGor2W8JH+rmERuUonA=";
        platform = "aarch64-linux";
      }
    else if stdenv.isx86_64 then
      {
        pname = "brave";
-        version = "1.64.122";
-        url = "https://github.com/brave/brave-browser/releases/download/v1.64.122/brave-browser_1.64.122_amd64.deb";
-        hash = "sha256-9tSoOn9XGbX/b8n9vD9Hmpi26jzmUVJomoCFdSJoaoU=";
+        version = "1.65.114";
+        url = "https://github.com/brave/brave-browser/releases/download/v1.65.114/brave-browser_1.65.114_amd64.deb";
+        hash = "sha256-Dn6havSLcf6KCxI1hd8Ad4FsLIOYBH2KO2oCJJQHJm8=";
        platform = "x86_64-linux";
      }
    else
--- a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -3,10 +3,10 @@
 {
  firefox = buildMozillaMach rec {
    pname = "firefox";
-    version = "125.0.1";
+    version = "125.0.2";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "6f2f336de8b0ec9cb19ba20c909407b7b88c0319ee3b2f1f3429133516b0c45b4c7846f287985a0cdb9f34acc7d5378ed14fb48e26bef113c8ac360501a30c4d";
+      sha512 = "f6d5fff7c5c532d2e41a246d0403bdd746981cfcb7c43f9d3d8ec85a7acc3310a52043d1e18848475cef1b63c24769e81b2b06d68ae007b68016ee51436032f1";
    };

    extraPatches = [
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@ -1,15 +1,15 @@
 {
-  "packageVersion": "124.0.2-1",
+  "packageVersion": "125.0.1-1",
  "source": {
-    "rev": "124.0.2-1",
-    "sha256": "0qh40l1pif0b6n1amiw18pr13gvmi7rjd89q6n1qz8y14yf9w5xp"
+    "rev": "125.0.1-1",
+    "sha256": "1h2x08gdpw3bldmfkws5qafp73r4w11a7ad3xc6flyg96b8a6h4f"
  },
  "settings": {
-    "rev": "8a499ecdab8a5136faee50aae1fdd48997711de6",
-    "sha256": "1c12y7b09rrz8zlpar8nnd9k2nvldjqq3cicbc57g6s1npnf8rz6"
+    "rev": "6b2b6a89fc15a705388955e4d1375f453d8cdc89",
+    "sha256": "0yginhc8pn00k1gh8h7bzvrl4vi2wimbmrrgnmvvblv28bxhwnh0"
  },
  "firefox": {
-    "version": "124.0.2",
-    "sha512": "8cf340de6e34812f8ae3363265859a263330af770d981c3dd1ca1e7e0cfe513604d3e68184d4aa1446569aefbdf359d561fbc200faf19a5ed020a1709d9ef10e"
+    "version": "125.0.1",
+    "sha512": "6f2f336de8b0ec9cb19ba20c909407b7b88c0319ee3b2f1f3429133516b0c45b4c7846f287985a0cdb9f34acc7d5378ed14fb48e26bef113c8ac360501a30c4d"
  }
 }
--- a/pkgs/applications/networking/cluster/hubble/default.nix
+++ b/pkgs/applications/networking/cluster/hubble/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "hubble";
-  version = "0.13.2";
+  version = "0.13.3";

  src = fetchFromGitHub {
    owner = "cilium";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-0SCuQzRwluowF48lzyLxY+0rvTOyDbpkMI7Iwb6GHJo=";
+    sha256 = "sha256-tHkLUoccOUcUjODecy1QyeuDb/aXv67sK8JHJ1IspC8=";
  };

  vendorHash = null;
--- a/pkgs/applications/networking/cluster/kubectl-klock/default.nix
+++ b/pkgs/applications/networking/cluster/kubectl-klock/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "kubectl-klock";
-  version = "0.5.1";
+  version = "0.6.1";

  nativeBuildInputs = [ makeWrapper ];

@ -10,10 +10,10 @@ buildGoModule rec {
    owner = "applejag";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-q7Wq1mTjOB7tT66+LWIwwqltQcQSHD/VHLO7nCTZTQ0=";
+    hash = "sha256-QzleoHRQ/A5ImMl43kze5ppUdiLa4n/VT02lMnaXVkg=";
  };

-  vendorHash = "sha256-3CJ/tmFFkmq6wHxbqk8u+GxxbSrUpB/JD5s/S7hegB8=";
+  vendorHash = "sha256-smE8mdyZ8xJOevgHs4+ozS6VOlko+Whhs/37B+hIbxo=";

  postInstall = ''
    makeWrapper $out/bin/kubectl-klock $out/bin/kubectl_complete-klock --add-flags __complete
--- a/pkgs/applications/networking/cluster/pachyderm/default.nix
+++ b/pkgs/applications/networking/cluster/pachyderm/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "pachyderm";
-  version = "2.9.3";
+  version = "2.9.4";

  src = fetchFromGitHub {
    owner = "pachyderm";
    repo = "pachyderm";
    rev = "v${version}";
-    hash = "sha256-4ER0kjp3H5B2TrR4pI3XMvmtGrUv5ZuSM8dbDeufm2s=";
+    hash = "sha256-RF8JEmZpvUf8w89wRa+d3ItMFnInEoxxQzLJvrx1mZE=";
  };

-  vendorHash = "sha256-+0Df3pelty9mE1E8V+4L99/SrGK5msWn68LeB0nmAIA=";
+  vendorHash = "sha256-bAB2vMPHIcJaMobPukQyKiCq0Af0n4b5mjImTswGFTo=";

  subPackages = [ "src/server/cmd/pachctl" ];

--- a/pkgs/applications/networking/cluster/pv-migrate/default.nix
+++ b/pkgs/applications/networking/cluster/pv-migrate/default.nix
@ -2,18 +2,18 @@

 buildGoModule rec {
  pname = "pv-migrate";
-  version = "1.7.1";
+  version = "1.8.0";

  src = fetchFromGitHub {
    owner = "utkuozdemir";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-xbg32ckxAUQkkN/yumHz4v1U4FvUcmx5ftd3+4zc3/c=";
+    sha256 = "sha256-HeK8/IZTqkrJxfmNIYOm8/jY3Fbof8t7/emdHONvMZo=";
  };

  subPackages = [ "cmd/pv-migrate" ];

-  vendorHash = "sha256-AqR9Gy8sAX4wrKGPnQUj33juBOfhUn0BR8OyJPiDrO0=";
+  vendorHash = "sha256-q8/Rb26ZY/Rn3FnESnAvPr+LrIvFFlSJnN6c0k8+sHg=";

  ldflags = [
    "-s"
--- a/pkgs/applications/networking/cluster/velero/default.nix
+++ b/pkgs/applications/networking/cluster/velero/default.nix
@ -2,14 +2,14 @@

 buildGoModule rec {
  pname = "velero";
-  version = "1.13.1";
+  version = "1.13.2";


  src = fetchFromGitHub {
    owner = "vmware-tanzu";
    repo = "velero";
    rev = "v${version}";
-    sha256 = "sha256-Fz3FqNj2NbqU9CvtdjM8cjkZh5xLCA+AAIF/QgLJ7UA=";
+    sha256 = "sha256-Dqz8UFoGb5uG5f8mrIUIRWJUYH/ZuFavhRy2wie75/Q=";
  };

  ldflags = [
@ -20,7 +20,7 @@ buildGoModule rec {
    "-X github.com/vmware-tanzu/velero/pkg/buildinfo.GitSHA=none"
  ];

-  vendorHash = "sha256-Fu4T2VEW5s/KCdgJLk3bf0wIUhKULK6QuNEmL99MUCI=";
+  vendorHash = "sha256-L1QTqw0L/aE4bFlLWg4/mmdHL7Sb5EsT3eL0jZIpBsA=";

  excludedPackages = [ "issue-template-gen" "release-tools" "v1" "velero-restic-restore-helper" ];

--- a/pkgs/applications/networking/instant-messengers/cinny-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/cinny-desktop/default.nix
@ -1,6 +1,10 @@
 { lib
+, stdenv
+, darwin
 , fetchFromGitHub
+, rust
 , rustPlatform
+, cargo-tauri
 , cinny
 , copyDesktopItems
 , wrapGAppsHook
@ -16,6 +20,7 @@

 rustPlatform.buildRustPackage rec {
  pname = "cinny-desktop";
+  # We have to be using the same version as cinny-web or this isn't going to work.
  version = "3.1.0";

  src = fetchFromGitHub {
@ -37,33 +42,48 @@ rustPlatform.buildRustPackage rec {
  in ''
    substituteInPlace tauri.conf.json \
      --replace '"distDir": "../cinny/dist",' '"distDir": "${cinny'}",'
-
+    substituteInPlace tauri.conf.json \
+      --replace '"cd cinny && npm run build"' '""'
+  '' + lib.optionalString stdenv.hostPlatform.isLinux ''
    substituteInPlace $cargoDepsCopy/libappindicator-sys-*/src/lib.rs \
      --replace "libayatana-appindicator3.so.1" "${libayatana-appindicator}/lib/libayatana-appindicator3.so.1"
  '';

-  postInstall = ''
+  postBuild = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    cargo tauri build --bundles app --target "${rust.envVars.rustHostPlatform}"
+  '';
+
+  postInstall = lib.optionalString stdenv.hostPlatform.isLinux ''
    install -DT icons/128x128@2x.png $out/share/icons/hicolor/256x256@2/apps/cinny.png
    install -DT icons/128x128.png $out/share/icons/hicolor/128x128/apps/cinny.png
    install -DT icons/32x32.png $out/share/icons/hicolor/32x32/apps/cinny.png
+  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    mkdir -p "$out/Applications/"
+    cp -r "target/${rust.envVars.rustHostPlatform}/release/bundle/macos/Cinny.app" "$out/Applications/"
+    ln -sf "$out/Applications/Cinny.app/Contents/MacOS/Cinny" "$out/bin/cinny"
  '';

  nativeBuildInputs = [
    copyDesktopItems
    wrapGAppsHook
    pkg-config
+    cargo-tauri
  ];

  buildInputs = [
    openssl
    dbus
    glib
+  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
    glib-networking
    libayatana-appindicator
    webkitgtk
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    darwin.DarwinTools
+    darwin.apple_sdk.frameworks.WebKit
  ];

-  desktopItems = [
+  desktopItems = lib.optionals stdenv.hostPlatform.isLinux [
    (makeDesktopItem {
      name = "cinny";
      exec = "cinny";
@ -77,9 +97,9 @@ rustPlatform.buildRustPackage rec {
  meta = with lib; {
    description = "Yet another matrix client for desktop";
    homepage = "https://github.com/cinnyapp/cinny-desktop";
-    maintainers = [ ];
+    maintainers = with maintainers; [ qyriad ];
    license = licenses.agpl3Only;
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
    mainProgram = "cinny";
  };
 }
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@ -2,14 +2,14 @@
 let
  versions =
    if stdenv.isLinux then {
-      stable = "0.0.49";
-      ptb = "0.0.78";
-      canary = "0.0.346";
+      stable = "0.0.50";
+      ptb = "0.0.80";
+      canary = "0.0.357";
      development = "0.0.17";
    } else {
-      stable = "0.0.300";
-      ptb = "0.0.107";
-      canary = "0.0.468";
+      stable = "0.0.301";
+      ptb = "0.0.109";
+      canary = "0.0.477";
      development = "0.0.39";
    };
  version = versions.${branch};
@ -17,15 +17,15 @@ let
    x86_64-linux = {
      stable = fetchurl {
        url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-rVSYAkTZTlurnbUeYJFCgsPcsCqjJ1bJneQQiyhmvwQ=";
+        hash = "sha256-6VXdVLk7Z8NGQMiSdgBRd8NIueUktkId6BXYKNABb+4=";
      };
      ptb = fetchurl {
        url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-Fp94BsR6Fzy4tV+c5ToP9GKg6GC/TryGvHWLupew4Z8=";
+        hash = "sha256-y/ntnHIYcY35Jszh0PrFy395eJ5dBWwLNpzHMoSZuNA=";
      };
      canary = fetchurl {
        url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-/FBVo3ptZk2YQPoq+VpyxMlSWYlVb8ChpKW5YH/BM7U=";
+        hash = "sha256-sDwC5kPzAfvQmsrq6M/GPFtUaT9pNAEB4uGI5Mn3oXs=";
      };
      development = fetchurl {
        url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
@ -35,15 +35,15 @@ let
    x86_64-darwin = {
      stable = fetchurl {
        url = "https://dl.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-f9YIlzRESzzxtD9/us1DY5acu2HYo+UrwS7GWk9RwCk=";
+        hash = "sha256-h7C1wCKtUGcMFUhoKVdD7Vq9TGUaXfmjlVhwmRdhqYw=";
      };
      ptb = fetchurl {
        url = "https://dl-ptb.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-etxXrO9Ksacbdes3DT1Tm4kKD/t40jGUeSAegdexRqc=";
+        hash = "sha256-xxLnzELuI0X2r/weP1K2Bb51uRh1JjR72p7cXzy12Kc=";
      };
      canary = fetchurl {
        url = "https://dl-canary.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-UOoXDwAa5pFukqTCmUfM89QVK5jB13id8ek/gwWajMM=";
+        hash = "sha256-xEDtEtZNhOTtz+zRLLQBSeLbntlVAVQsocAGyAaVePM=";
      };
      development = fetchurl {
        url = "https://dl-development.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
--- a/pkgs/applications/science/engineering/brmodelo/default.nix
+++ b/pkgs/applications/science/engineering/brmodelo/default.nix
@ -2,27 +2,34 @@
 , stdenv
 , fetchFromGitHub
 , fetchpatch
-, openjdk8
 , ant
+, jdk8
 , makeWrapper
 , makeDesktopItem
 , copyDesktopItems
+, strip-nondeterminism
+, stripJavaArchivesHook
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "brmodelo";
  version = "3.31";

  src = fetchFromGitHub {
    owner = "chcandido";
-    repo = pname;
-    rev = version;
-    sha256 = "09qrhqhv264x8phnf3pnb0cwq75l7xdsj9xkwlvhry81nxz0d5v0";
+    repo = "brmodelo";
+    rev = finalAttrs.version;
+    hash = "sha256-YJcGfrcB+Qw35bMnqVs/tBzMGVj2DmfhRZ0YsSGGGSc=";
  };

-  nativeBuildInputs = [ ant makeWrapper copyDesktopItems ];
-
-  buildInputs = [ openjdk8 ];
+  nativeBuildInputs = [
+    ant
+    jdk8
+    makeWrapper
+    copyDesktopItems
+    strip-nondeterminism
+    stripJavaArchivesHook
+  ];

  patches = [
    # Fixes for building with Ant.
@ -30,22 +37,22 @@ stdenv.mkDerivation rec {
    (fetchpatch {
      name = "fix-self-closing-element-not-allowed.patch";
      url = "https://github.com/yuuyins/brModelo/commit/0d712b74fd5d29d67be07480ed196da28a77893b.patch";
-      sha256 = "sha256-yy03arE6xetotzyvpToi9o9crg3KnMRn1J70jDUvSXE=";
+      hash = "sha256-yy03arE6xetotzyvpToi9o9crg3KnMRn1J70jDUvSXE=";
    })
    (fetchpatch {
      name = "fix-tag-closing.patch";
      url = "https://github.com/yuuyins/brModelo/commit/e8530ff75f024cf6effe0408ed69985405e9709c.patch";
-      sha256 = "sha256-MNuh/ORbaAkB5qDSlA/nPrXN+tqzz4oOglVyEtSangI=";
+      hash = "sha256-MNuh/ORbaAkB5qDSlA/nPrXN+tqzz4oOglVyEtSangI=";
    })
    (fetchpatch {
      name = "fix-bad-use-greater-than.patch";
      url = "https://github.com/yuuyins/brModelo/commit/498a6ef8129daff5a472b318f93c8f7f2897fc7f.patch";
-      sha256 = "sha256-MmAwYUmx38DGRsiSxCWCObtpqxk0ykUQiDSC76bCpFc=";
+      hash = "sha256-MmAwYUmx38DGRsiSxCWCObtpqxk0ykUQiDSC76bCpFc=";
    })
    (fetchpatch {
      name = "fix-param-errors.patch";
      url = "https://github.com/yuuyins/brModelo/commit/8a508aaba0bcffe13a3f95cff495230beea36bc4.patch";
-      sha256 = "sha256-qME9gZChSMzu1vs9HaosD+snb+jlOrQLY97meNoA8oU=";
+      hash = "sha256-qME9gZChSMzu1vs9HaosD+snb+jlOrQLY97meNoA8oU=";
    })

    # Add SVG icons.
@ -53,12 +60,14 @@ stdenv.mkDerivation rec {
    (fetchpatch {
      name = "add-brmodelo-logo-icons-svg.patch";
      url = "https://github.com/yuuyins/brModelo/commit/f260b82b664fad3325bbf3ebd7a15488d496946b.patch";
-      sha256 = "sha256-UhgcWxsHkNFS1GgaRnmlZohjDR8JwHof2cIb3SBetYs=";
+      hash = "sha256-UhgcWxsHkNFS1GgaRnmlZohjDR8JwHof2cIb3SBetYs=";
    })
  ];

  buildPhase = ''
+    runHook postBuild
    ant
+    runHook preBuild
  '';

  desktopItems = [
@ -68,15 +77,16 @@ stdenv.mkDerivation rec {
      genericName = "Entity-relationship diagramming tool";
      exec = "brmodelo";
      icon = "brmodelo";
-      comment = meta.description;
+      comment = finalAttrs.meta.description;
      categories = [ "Development" "Education" "Database" "2DGraphics" "ComputerScience" "DataVisualization" "Engineering" "Java" ];
    })
  ];

  installPhase = ''
-    install -d $out/bin $out/share/doc/${pname} $out/share/java
+    runHook preInstall

-    cp -rv ./dist/javadoc $out/share/doc/${pname}/
+    mkdir -p $out/share/doc/brmodelo
+    cp -rv ./dist/javadoc $out/share/doc/brmodelo/

    install -Dm755 ./dist/brModelo.jar -t $out/share/java/
    # NOTE: The standard Java GUI toolkit has a
@ -85,26 +95,28 @@ stdenv.mkDerivation rec {
    # in WMs that are not in that list (e.g. XMonad).
    # Solution/Workaround: set the environment variable
    # _JAVA_AWT_WM_NONREPARENTING=1.
-    makeWrapper ${openjdk8}/bin/java $out/bin/brmodelo \
+    makeWrapper ${jdk8}/bin/java $out/bin/brmodelo \
       --prefix _JAVA_AWT_WM_NONREPARENTING : 1 \
       --prefix _JAVA_OPTIONS : "-Dawt.useSystemAAFontSettings=on" \
       --add-flags "-jar $out/share/java/brModelo.jar"

-    runHook postInstall
-  '';
-
-  postInstall = ''
    for size in 16 24 32 48 64 128 256; do
      install -Dm644 ./src/imagens/icone_"$size"x"$size".svg \
        $out/share/icons/hicolor/"$size"x"$size"/apps/brmodelo.svg
    done
+
+    runHook postInstall
+  '';
+
+  preFixup = ''
+    find $out/share/doc/brmodelo/javadoc -name "*.html" -exec strip-nondeterminism --type javadoc {} +
  '';

  meta = with lib; {
    description = "Entity-relationship diagram tool for making conceptual and logical database models";
-    mainProgram = "brmodelo";
    homepage = "https://github.com/chcandido/brModelo";
    license = licenses.gpl3;
+    mainProgram = "brmodelo";
    maintainers = with maintainers; [ yuu ];
  };
-}
+})
--- a/pkgs/applications/science/misc/snakemake/default.nix
+++ b/pkgs/applications/science/misc/snakemake/default.nix
@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "snakemake";
-  version = "8.10.6";
+  version = "8.10.7";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "snakemake";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-THp8sqAFZVA5V2k0ruv9qwmPNjSVi2uVx8tla0Y3awE=";
+    hash = "sha256-tRjyv7pTTTDj3LrcIP3OWOX+9FldHV6rtbPdOYr70E4=";
    # https://github.com/python-versioneer/python-versioneer/issues/217
    postFetch = ''
      sed -i "$out"/snakemake/_version.py -e 's#git_refnames = ".*"#git_refnames = " (tag: v${version})"#'
--- a/pkgs/applications/version-management/git-town/default.nix
+++ b/pkgs/applications/version-management/git-town/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "git-town";
-  version = "14.0.0";
+  version = "14.1.0";

  src = fetchFromGitHub {
    owner = "git-town";
    repo = "git-town";
    rev = "v${version}";
-    hash = "sha256-GF1nNb/poFDXKwpqYZvQrTZ7CkNgO39KrrDuc94o/tw=";
+    hash = "sha256-BhtKl052P3PGxGXb5lSOIsncJLiNlevzBMEF2kCuFpM=";
  };

  vendorHash = null;
--- a/pkgs/applications/video/kodi/addons/jellyfin/default.nix
+++ b/pkgs/applications/video/kodi/addons/jellyfin/default.nix
@ -5,13 +5,13 @@ in
 buildKodiAddon rec {
  pname = "jellyfin";
  namespace = "plugin.video.jellyfin";
-  version = "1.0.1";
+  version = "1.0.2";

  src = fetchFromGitHub {
    owner = "jellyfin";
    repo = "jellyfin-kodi";
    rev = "v${version}";
-    sha256 = "sha256-i9lRPMHniUmKTeNSzgp6dF11uYOcjH3PgJEa+Jasx68=";
+    sha256 = "sha256-yCgsQnzmlmyYAjp1q0J9QxGDRg5JCd23H9xgVozHiGM=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/window-managers/miriway/default.nix
+++ b/pkgs/applications/window-managers/miriway/default.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "miriway";
-  version = "unstable-2024-04-04";
+  version = "unstable-2024-04-16";

  src = fetchFromGitHub {
    owner = "Miriway";
    repo = "Miriway";
-    rev = "add1e0cd695985020328b0d76c91f85cc88207ff";
-    hash = "sha256-Vp9ZbN5lY26t3LhkflapsG84XEy0YQE4Kvxia0VlQyg=";
+    rev = "d7f43ac201e6f1aa7aeee668f5d16683f48917f1";
+    hash = "sha256-hUTK7kd7gTvms4HMF7BgYWomRYZyRkqUfjhVtEF+YRE=";
  };

  strictDeps = true;
--- a/pkgs/build-support/node/fetch-npm-deps/Cargo.lock
+++ b/pkgs/build-support/node/fetch-npm-deps/Cargo.lock
@ -4,18 +4,66 @@ version = 3

 [[package]]
 name = "aho-corasick"
-version = "1.1.2"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2969dcb958b36655471fc61f7e416fa76033bdd4bfed0678d8fee1e2d07a1f0"
+checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
 dependencies = [
 "memchr",
 ]

 [[package]]
-name = "anyhow"
-version = "1.0.75"
+name = "anstream"
+version = "0.6.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4668cab20f66d8d020e1fbc0ebe47217433c1b6c8f2040faf858554e394ace6"
+checksum = "d96bd03f33fe50a863e394ee9718a706f988b9079b20c3784fb726e7678b62fb"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8901269c6307e8d93993578286ac0edf7f195079ffff5ebdeea6a59ffb7e36bc"
+
+[[package]]
+name = "anstyle-parse"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c75ac65da39e5fe5ab759307499ddad880d724eed2f6ce5b5e8a26f4f387928c"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e28923312444cdd728e4738b3f9c9cac739500909bb3d3c94b43551b16517648"
+dependencies = [
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1cd54b81ec8d6180e24654d0b371ad22fc3dd083b6ff8ba325b72e00c87660a7"
+dependencies = [
+ "anstyle",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.82"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f538837af36e6f6a9be0faa67f9a314f8119e4e4b5867c6ab40ed60360142519"

 [[package]]
 name = "async-channel"
@ -30,9 +78,9 @@ dependencies = [

 [[package]]
 name = "autocfg"
-version = "1.1.0"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+checksum = "f1fdabc7756949593fe60f30ec81974b613357de856987752631dea1e3394c80"

 [[package]]
 name = "backoff"
@ -45,12 +93,6 @@ dependencies = [
 "rand",
 ]

-[[package]]
-name = "base64"
-version = "0.21.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35636a1494ede3b646cc98f74f8e62c773a38a659ebc777a2cf26b9b74171df9"
-
 [[package]]
 name = "bitflags"
 version = "1.3.2"
@ -59,9 +101,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"

 [[package]]
 name = "bitflags"
-version = "2.4.1"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "327762f6e5a765692301e5bb513e0d9fef63be86bbc14528052b1cd3e6f03e07"
+checksum = "cf4b9d6a944f767f8e5e0db018570623c85f3d925ac718db4e06d0187adb21c1"

 [[package]]
 name = "block-buffer"
@ -74,9 +116,15 @@ dependencies = [

 [[package]]
 name = "bytes"
-version = "1.5.0"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2bd12c1caf447e69cd4528f47f94d203fd2582878ecb9e9465484c4148a8223"
+checksum = "514de17de45fdb8dc022b1a7975556c53c86f9f0aa5f534b98977b171857c2c9"
+
+[[package]]
+name = "camino"
+version = "1.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c59e92b5a388f549b863a7bea62612c09f24c8393560709a54558a9abdfb3b9c"

 [[package]]
 name = "castaway"
@ -86,12 +134,9 @@ checksum = "a2698f953def977c68f935bb0dfa959375ad4638570e969e2f1e9f433cbf1af6"

 [[package]]
 name = "cc"
-version = "1.0.83"
+version = "1.0.94"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
-dependencies = [
- "libc",
-]
+checksum = "17f6e324229dc011159fcc089755d1e2e216a90d43a7dea6853ca740b84f35e7"

 [[package]]
 name = "cfg-if"
@ -100,55 +145,53 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"

 [[package]]
-name = "concurrent-queue"
-version = "2.3.0"
+name = "colorchoice"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f057a694a54f12365049b0958a1685bb52d567f5593b355fbf685838e873d400"
+checksum = "acbf1af155f9b9ef647e42cdc158db4b64a1b61f743629225fde6f3e0be2a7c7"
+
+[[package]]
+name = "concurrent-queue"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d16048cd947b08fa32c24458a22f5dc5e835264f689f4f5653210c69fd107363"
 dependencies = [
 "crossbeam-utils",
 ]

 [[package]]
 name = "cpufeatures"
-version = "0.2.11"
+version = "0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce420fe07aecd3e67c5f910618fe65e94158f6dcc0adf44e00d69ce2bdfe0fd0"
+checksum = "53fe5e26ff1b7aef8bca9c6080520cfb8d9333c7568e1829cef191a9723e5504"
 dependencies = [
 "libc",
 ]

 [[package]]
 name = "crossbeam-deque"
-version = "0.8.3"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce6fd6f855243022dcecf8702fef0c297d4338e226845fe067f6341ad9fa0cef"
+checksum = "613f8cc01fe9cf1a3eb3d7f488fd2fa8388403e97039e2f73692932e291a770d"
 dependencies = [
- "cfg-if",
 "crossbeam-epoch",
 "crossbeam-utils",
 ]

 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.15"
+version = "0.9.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae211234986c545741a7dc064309f67ee1e5ad243d0e48335adc0484d960bcc7"
+checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
 dependencies = [
- "autocfg",
- "cfg-if",
 "crossbeam-utils",
- "memoffset",
- "scopeguard",
 ]

 [[package]]
 name = "crossbeam-utils"
-version = "0.8.16"
+version = "0.8.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a22b2d63d4d1dc0b7f1b6b2747dd0088008a9be28b6ddf0b1e7d335e3037294"
-dependencies = [
- "cfg-if",
-]
+checksum = "248e3bacc7dc6baa3b21e405ee045c3047101a49145e7e9eca583ab4c2ca5345"

 [[package]]
 name = "crypto-common"
@ -162,9 +205,9 @@ dependencies = [

 [[package]]
 name = "curl"
-version = "0.4.44"
+version = "0.4.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "509bd11746c7ac09ebd19f0b17782eae80aadee26237658a6b4808afb5c11a22"
+checksum = "1e2161dd6eba090ff1594084e95fd67aeccf04382ffea77999ea94ed42ec67b6"
 dependencies = [
 "curl-sys",
 "libc",
@ -172,14 +215,14 @@ dependencies = [
 "openssl-sys",
 "schannel",
 "socket2",
- "winapi",
+ "windows-sys 0.52.0",
 ]

 [[package]]
 name = "curl-sys"
-version = "0.4.68+curl-8.4.0"
+version = "0.4.72+curl-8.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4a0d18d88360e374b16b2273c832b5e57258ffc1d4aa4f96b108e0738d5752f"
+checksum = "29cbdc8314c447d11e8fd156dcdd031d9e02a7a976163e396b548c03153bc9ea"
 dependencies = [
 "cc",
 "libc",
@ -187,9 +230,15 @@ dependencies = [
 "openssl-sys",
 "pkg-config",
 "vcpkg",
- "windows-sys",
+ "windows-sys 0.52.0",
 ]

+[[package]]
+name = "data-encoding"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e962a19be5cfc3f3bf6dd8f61eb50107f356ad6270fbb3ed41476571db78be5"
+
 [[package]]
 name = "digest"
 version = "0.10.7"
@ -202,31 +251,41 @@ dependencies = [

 [[package]]
 name = "either"
-version = "1.9.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
+checksum = "a47c1c47d2f5964e29c61246e81db715514cd532db6b5116a25ea3c03d6780a2"
+
+[[package]]
+name = "env_filter"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a009aa4810eb158359dda09d0c87378e4bbb89b5a801f016885a4707ba24f7ea"
+dependencies = [
+ "log",
+ "regex",
+]

 [[package]]
 name = "env_logger"
-version = "0.10.1"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95b3f3e67048839cb0d0781f445682a35113da7121f7c949db0e2be96a4fbece"
+checksum = "38b35839ba51819680ba087cd351788c9a3c476841207e0b8cee0b04722343b9"
 dependencies = [
+ "anstream",
+ "anstyle",
+ "env_filter",
 "humantime",
- "is-terminal",
 "log",
- "regex",
- "termcolor",
 ]

 [[package]]
 name = "errno"
-version = "0.3.7"
+version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f258a7194e7f7c2a7837a8913aeab7fd8c383457034fa20ce4dd3dcb813e8eb8"
+checksum = "a258e46cdc063eb8519c00b9fc845fc47bcfca4130e2f08e88665ceda8474245"
 dependencies = [
 "libc",
- "windows-sys",
+ "windows-sys 0.52.0",
 ]

 [[package]]
@ -246,9 +305,9 @@ dependencies = [

 [[package]]
 name = "fastrand"
-version = "2.0.1"
+version = "2.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25cbce373ec4653f1a01a31e8a5e5ec0c622dc27ff9c4e6606eefef5cbbed4a5"
+checksum = "658bd65b1cf4c852a3cc96f18a8ce7b5640f6b703f905c7d74532294c2a63984"

 [[package]]
 name = "fnv"
@ -258,24 +317,24 @@ checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"

 [[package]]
 name = "form_urlencoded"
-version = "1.2.0"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a62bc1cf6f830c2ec14a513a9fb124d0a213a629668a4186f329db21fe045652"
+checksum = "e13624c2627564efccf4934284bdd98cbaa14e79b0b5a141218e507b3a823456"
 dependencies = [
 "percent-encoding",
 ]

 [[package]]
 name = "futures-core"
-version = "0.3.29"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb1d22c66e66d9d72e1758f0bd7d4fd0bee04cad842ee34587d68c07e45d088c"
+checksum = "dfc6580bb841c5a68e9ef15c77ccc837b40a7504914d52e47b8b0e9bbda25a1d"

 [[package]]
 name = "futures-io"
-version = "0.3.29"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bf34a163b5c4c52d0478a4d757da8fb65cabef42ba90515efee0f6f9fa45aaa"
+checksum = "a44623e20b9681a318efdd71c299b6b222ed6f231972bfe2f224ebad6311f0c1"

 [[package]]
 name = "futures-lite"
@ -304,26 +363,20 @@ dependencies = [

 [[package]]
 name = "getrandom"
-version = "0.2.11"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe9006bed769170c11f845cf00c7c1e9092aeb3f268e007c3e760ac68008070f"
+checksum = "94b22e06ecb0110981051723910cbf0b5f5e09a2062dd7663334ee79a9d1286c"
 dependencies = [
 "cfg-if",
 "libc",
 "wasi",
 ]

-[[package]]
-name = "hermit-abi"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d77f7ec81a6d05a3abb01ab6eb7590f6083d08449fe5a1c8b1e620283546ccb7"
-
 [[package]]
 name = "http"
-version = "0.2.11"
+version = "0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8947b1a6fad4393052c7ba1f4cd97bed3e953a95c79c92ad9b051a04611d9fbb"
+checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1"
 dependencies = [
 "bytes",
 "fnv",
@ -338,9 +391,9 @@ checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"

 [[package]]
 name = "idna"
-version = "0.4.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d20d6b07bfbc108882d88ed8e37d39636dcc260e15e30c45e6ba089610b917c"
+checksum = "634d9b1461af396cad843f47fdba5597a4f9e6ddd4bfb6ff5d85028c25cb12f6"
 dependencies = [
 "unicode-bidi",
 "unicode-normalization",
@ -356,14 +409,12 @@ dependencies = [
 ]

 [[package]]
-name = "is-terminal"
-version = "0.4.9"
+name = "is_executable"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb0889898416213fab133e1d33a0e5858a48177452750691bde3666d0fdbaf8b"
+checksum = "fa9acdc6d67b75e626ad644734e8bc6df893d9cd2a834129065d3dd6158ea9c8"
 dependencies = [
- "hermit-abi",
- "rustix",
- "windows-sys",
+ "winapi",
 ]

 [[package]]
@ -393,21 +444,21 @@ dependencies = [

 [[package]]
 name = "itoa"
-version = "1.0.9"
+version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af150ab688ff2122fcef229be89cb50dd66af9e01a4ff320cc137eecc9bacc38"
+checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"

 [[package]]
 name = "libc"
-version = "0.2.150"
+version = "0.2.153"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89d92a4743f9a61002fae18374ed11e7973f530cb3a3255fb354818118b2203c"
+checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd"

 [[package]]
 name = "libz-sys"
-version = "1.1.12"
+version = "1.1.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d97137b25e321a73eef1418d1d5d2eda4d77e12813f8e6dead84bc52c5870a7b"
+checksum = "5e143b5e666b2695d28f6bca6497720813f699c9602dd7f5cac91008b8ada7f9"
 dependencies = [
 "cc",
 "libc",
@ -417,36 +468,39 @@ dependencies = [

 [[package]]
 name = "linux-raw-sys"
-version = "0.4.11"
+version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "969488b55f8ac402214f3f5fd243ebb7206cf82de60d3172994707a4bcc2b829"
+checksum = "01cda141df6706de531b6c46c3a33ecca755538219bd484262fa09410c13539c"

 [[package]]
 name = "log"
-version = "0.4.20"
+version = "0.4.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
+checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"

 [[package]]
 name = "memchr"
-version = "2.6.4"
+version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f665ee40bc4a3c5590afb1e9677db74a508659dfd71e126420da8274909a0167"
+checksum = "6c8640c5d730cb13ebd907d8d04b52f55ac9a2eec55b440c8892f40d56c76c1d"

 [[package]]
-name = "memoffset"
-version = "0.9.0"
+name = "nix-nar"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a634b1c61a95585bd15607c6ab0c4e5b226e695ff2800ba0cdccddf208c406c"
+checksum = "d5549158a8b179c4fcd06a19f4bcc557db60c9cbd6771add9563f46c8d0325b5"
 dependencies = [
- "autocfg",
+ "camino",
+ "is_executable",
+ "symlink",
+ "thiserror",
 ]

 [[package]]
 name = "once_cell"
-version = "1.18.0"
+version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
+checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"

 [[package]]
 name = "openssl-probe"
@ -456,9 +510,9 @@ checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"

 [[package]]
 name = "openssl-sys"
-version = "0.9.95"
+version = "0.9.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40a4130519a360279579c2053038317e40eff64d13fd3f004f9e1b72b8a6aaf9"
+checksum = "c597637d56fbc83893a35eb0dd04b2b8e7a50c91e64e9493e398b5df4fb45fa2"
 dependencies = [
 "cc",
 "libc",
@ -474,24 +528,24 @@ checksum = "bb813b8af86854136c6922af0598d719255ecb2179515e6e7730d468f05c9cae"

 [[package]]
 name = "percent-encoding"
-version = "2.3.0"
+version = "2.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b2a4787296e9989611394c33f193f676704af1686e70b8f8033ab5ba9a35a94"
+checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"

 [[package]]
 name = "pin-project"
-version = "1.1.3"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fda4ed1c6c173e3fc7a83629421152e01d7b1f9b7f65fb301e490e8cfc656422"
+checksum = "b6bf43b791c5b9e34c3d182969b4abb522f9343702850a2e57f460d00d09b4b3"
 dependencies = [
 "pin-project-internal",
 ]

 [[package]]
 name = "pin-project-internal"
-version = "1.1.3"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4359fd9c9171ec6e8c62926d6faaf553a8dc3f64e1507e76da7911b4f6a04405"
+checksum = "2f38a4412a78282e09a2cf38d195ea5420d15ba0602cb375210efbc877243965"
 dependencies = [
 "proc-macro2",
 "quote",
@ -500,15 +554,15 @@ dependencies = [

 [[package]]
 name = "pin-project-lite"
-version = "0.2.13"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8afb450f006bf6385ca15ef45d71d2288452bc3683ce2e2cacc0d18e4be60b58"
+checksum = "bda66fc9667c18cb2758a2ac84d1167245054bcf85d5d1aaa6923f45801bdd02"

 [[package]]
 name = "pkg-config"
-version = "0.3.27"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26072860ba924cbfa98ea39c8c19b4dd6a4a25423dbdf219c1eca91aa0cf6964"
+checksum = "d231b230927b5e4ad203db57bbcbee2802f6bce620b1e4a9024a07d94e2907ec"

 [[package]]
 name = "polling"
@ -523,7 +577,7 @@ dependencies = [
 "libc",
 "log",
 "pin-project-lite",
- "windows-sys",
+ "windows-sys 0.48.0",
 ]

 [[package]]
@ -538,11 +592,12 @@ version = "0.1.0"
 dependencies = [
 "anyhow",
 "backoff",
- "base64",
+ "data-encoding",
 "digest",
 "env_logger",
 "isahc",
 "log",
+ "nix-nar",
 "rayon",
 "serde",
 "serde_json",
@ -555,18 +610,18 @@ dependencies = [

 [[package]]
 name = "proc-macro2"
-version = "1.0.69"
+version = "1.0.81"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "134c189feb4956b20f6f547d2cf727d4c0fe06722b20a0eec87ed445a97f92da"
+checksum = "3d1597b0c024618f09a9c3b8655b7e430397a36d23fdafec26d6965e9eec3eba"
 dependencies = [
 "unicode-ident",
 ]

 [[package]]
 name = "quote"
-version = "1.0.33"
+version = "1.0.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
+checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
 dependencies = [
 "proc-macro2",
 ]
@ -603,9 +658,9 @@ dependencies = [

 [[package]]
 name = "rayon"
-version = "1.8.0"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c27db03db7734835b3f53954b534c91069375ce6ccaa2e065441e07d9b6cdb1"
+checksum = "b418a60154510ca1a002a752ca9714984e21e4241e804d32555251faf8b78ffa"
 dependencies = [
 "either",
 "rayon-core",
@ -613,28 +668,19 @@ dependencies = [

 [[package]]
 name = "rayon-core"
-version = "1.12.0"
+version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ce3fb6ad83f861aac485e76e1985cd109d9a3713802152be56c3b1f0e0658ed"
+checksum = "1465873a3dfdaa8ae7cb14b4383657caab0b3e8a0aa9ae8e04b044854c8dfce2"
 dependencies = [
 "crossbeam-deque",
 "crossbeam-utils",
 ]

-[[package]]
-name = "redox_syscall"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa"
-dependencies = [
- "bitflags 1.3.2",
-]
-
 [[package]]
 name = "regex"
-version = "1.10.2"
+version = "1.10.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "380b951a9c5e80ddfd6136919eef32310721aa4aacd4889a8d39124b026ab343"
+checksum = "c117dbdfde9c8308975b6a18d71f3f385c89461f7b3fb054288ecf2a2058ba4c"
 dependencies = [
 "aho-corasick",
 "memchr",
@ -644,9 +690,9 @@ dependencies = [

 [[package]]
 name = "regex-automata"
-version = "0.4.3"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f804c7828047e88b2d32e2d7fe5a105da8ee3264f01902f796c8e067dc2483f"
+checksum = "86b83b8b9847f9bf95ef68afb0b8e6cdb80f498442f5179a29fad448fcc1eaea"
 dependencies = [
 "aho-corasick",
 "memchr",
@ -655,28 +701,28 @@ dependencies = [

 [[package]]
 name = "regex-syntax"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
+checksum = "adad44e29e4c806119491a7f06f03de4d1af22c3a680dd47f1e6e179439d1f56"

 [[package]]
 name = "rustix"
-version = "0.38.25"
+version = "0.38.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc99bc2d4f1fed22595588a013687477aedf3cdcfb26558c559edb67b4d9b22e"
+checksum = "65e04861e65f21776e67888bfbea442b3642beaa0138fdb1dd7a84a52dffdb89"
 dependencies = [
- "bitflags 2.4.1",
+ "bitflags 2.5.0",
 "errno",
 "libc",
 "linux-raw-sys",
- "windows-sys",
+ "windows-sys 0.52.0",
 ]

 [[package]]
 name = "ryu"
-version = "1.0.15"
+version = "1.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ad4cc8da4ef723ed60bced201181d83791ad433213d8c24efffda1eec85d741"
+checksum = "e86697c916019a8588c99b5fac3cead74ec0b4b819707a682fd4d23fa0ce1ba1"

 [[package]]
 name = "same-file"
@ -689,33 +735,27 @@ dependencies = [

 [[package]]
 name = "schannel"
-version = "0.1.22"
+version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c3733bf4cf7ea0880754e19cb5a462007c4a8c1914bff372ccc95b464f1df88"
+checksum = "fbc91545643bcf3a0bbb6569265615222618bdf33ce4ffbbd13c4bbd4c093534"
 dependencies = [
- "windows-sys",
+ "windows-sys 0.52.0",
 ]

-[[package]]
-name = "scopeguard"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
-
 [[package]]
 name = "serde"
-version = "1.0.193"
+version = "1.0.198"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25dd9975e68d0cb5aa1120c288333fc98731bd1dd12f561e468ea4728c042b89"
+checksum = "9846a40c979031340571da2545a4e5b7c4163bdae79b301d5f86d03979451fcc"
 dependencies = [
 "serde_derive",
 ]

 [[package]]
 name = "serde_derive"
-version = "1.0.193"
+version = "1.0.198"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43576ca501357b9b071ac53cdc7da8ef0cbd9493d8df094cd821777ea6e894d3"
+checksum = "e88edab869b01783ba905e7d0153f9fc1a6505a96e4ad3018011eedb838566d9"
 dependencies = [
 "proc-macro2",
 "quote",
@ -724,9 +764,9 @@ dependencies = [

 [[package]]
 name = "serde_json"
-version = "1.0.108"
+version = "1.0.116"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d1c7e3eac408d115102c4c24ad393e0821bb3a5df4d506a80f85f7a742a526b"
+checksum = "3e17db7126d17feb94eb3fad46bf1a96b034e8aacbc2e775fe81505f8b0b2813"
 dependencies = [
 "itoa",
 "ryu",
@ -777,19 +817,25 @@ dependencies = [

 [[package]]
 name = "socket2"
-version = "0.4.10"
+version = "0.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f7916fc008ca5542385b89a3d3ce689953c143e9304a9bf8beec1de48994c0d"
+checksum = "05ffd9c0a93b7543e062e759284fcf5f5e3b098501104bfbdde4d404db792871"
 dependencies = [
 "libc",
- "winapi",
+ "windows-sys 0.52.0",
 ]

 [[package]]
-name = "syn"
-version = "2.0.39"
+name = "symlink"
+version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23e78b90f2fcf45d3e842032ce32e3f2d1545ba6636271dcbf24fa306d87be7a"
+checksum = "a7973cce6668464ea31f176d85b13c7ab3bba2cb3b77a2ed26abd7801688010a"
+
+[[package]]
+name = "syn"
+version = "2.0.59"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a6531ffc7b071655e4ce2e04bd464c4830bb585a61cabb96cf808f05172615a"
 dependencies = [
 "proc-macro2",
 "quote",
@ -798,24 +844,34 @@ dependencies = [

 [[package]]
 name = "tempfile"
-version = "3.8.1"
+version = "3.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ef1adac450ad7f4b3c28589471ade84f25f731a7a0fe30d71dfa9f60fd808e5"
+checksum = "85b77fafb263dd9d05cbeac119526425676db3784113aa9295c88498cbf8bff1"
 dependencies = [
 "cfg-if",
- "fastrand 2.0.1",
- "redox_syscall",
+ "fastrand 2.0.2",
 "rustix",
- "windows-sys",
+ "windows-sys 0.52.0",
 ]

 [[package]]
-name = "termcolor"
-version = "1.4.0"
+name = "thiserror"
+version = "1.0.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff1bc3d3f05aff0403e8ac0d92ced918ec05b666a43f83297ccef5bea8a3d449"
+checksum = "03468839009160513471e86a034bb2c5c0e4baae3b43f79ffc55c4a5427b3297"
 dependencies = [
- "winapi-util",
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c61f3ba182994efc43764a46c018c347bc492c79f024e705f46567b418f6d4f7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
 ]

 [[package]]
@ -883,9 +939,9 @@ checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"

 [[package]]
 name = "unicode-bidi"
-version = "0.3.13"
+version = "0.3.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92888ba5573ff080736b3648696b70cafad7d250551175acbaa4e0385b3e1460"
+checksum = "08f95100a766bf4f8f28f90d77e0a5461bbdb219042e7679bebe79004fed8d75"

 [[package]]
 name = "unicode-ident"
@ -895,18 +951,18 @@ checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"

 [[package]]
 name = "unicode-normalization"
-version = "0.1.22"
+version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c5713f0fc4b5db668a2ac63cdb7bb4469d8c9fed047b1d0292cc7b0ce2ba921"
+checksum = "a56d1686db2308d901306f92a263857ef59ea39678a5458e7cb17f01415101f5"
 dependencies = [
 "tinyvec",
 ]

 [[package]]
 name = "url"
-version = "2.4.1"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "143b538f18257fac9cad154828a57c6bf5157e1aa604d4816b5995bf6de87ae5"
+checksum = "31e6302e3bb753d46e83516cae55ae196fc0c309407cf11ab35cc51a4c2a4633"
 dependencies = [
 "form_urlencoded",
 "idna",
@ -914,6 +970,12 @@ dependencies = [
 "serde",
 ]

+[[package]]
+name = "utf8parse"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "711b9620af191e0cdc7468a8d14e709c3dcdb115b36f838e601583af800a370a"
+
 [[package]]
 name = "vcpkg"
 version = "0.2.15"
@ -934,9 +996,9 @@ checksum = "f3c4517f54858c779bbcbf228f4fca63d121bf85fbecb2dc578cdf4a39395690"

 [[package]]
 name = "walkdir"
-version = "2.4.0"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71d857dc86794ca4c280d616f7da00d2dbfd8cd788846559a6813e6aa4b54ee"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
 dependencies = [
 "same-file",
 "winapi-util",
@ -985,7 +1047,16 @@ version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
 dependencies = [
- "windows-targets",
+ "windows-targets 0.48.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.5",
 ]

 [[package]]
@ -994,13 +1065,29 @@ version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
 dependencies = [
- "windows_aarch64_gnullvm",
- "windows_aarch64_msvc",
- "windows_i686_gnu",
- "windows_i686_msvc",
- "windows_x86_64_gnu",
- "windows_x86_64_gnullvm",
- "windows_x86_64_msvc",
+ "windows_aarch64_gnullvm 0.48.5",
+ "windows_aarch64_msvc 0.48.5",
+ "windows_i686_gnu 0.48.5",
+ "windows_i686_msvc 0.48.5",
+ "windows_x86_64_gnu 0.48.5",
+ "windows_x86_64_gnullvm 0.48.5",
+ "windows_x86_64_msvc 0.48.5",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f0713a46559409d202e70e28227288446bf7841d3211583a4b53e3f6d96e7eb"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.5",
+ "windows_aarch64_msvc 0.52.5",
+ "windows_i686_gnu 0.52.5",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc 0.52.5",
+ "windows_x86_64_gnu 0.52.5",
+ "windows_x86_64_gnullvm 0.52.5",
+ "windows_x86_64_msvc 0.52.5",
 ]

 [[package]]
@ -1009,38 +1096,86 @@ version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"

+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7088eed71e8b8dda258ecc8bac5fb1153c5cffaf2578fc8ff5d61e23578d3263"
+
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"

+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9985fd1504e250c615ca5f281c3f7a6da76213ebd5ccc9561496568a2752afb6"
+
 [[package]]
 name = "windows_i686_gnu"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"

+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88ba073cf16d5372720ec942a8ccbf61626074c6d4dd2e745299726ce8b89670"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87f4261229030a858f36b459e748ae97545d6f1ec60e5e0d6a3d32e0dc232ee9"
+
 [[package]]
 name = "windows_i686_msvc"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"

+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db3c2bf3d13d5b658be73463284eaf12830ac9a26a90c717b7f771dfe97487bf"
+
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"

+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e4246f76bdeff09eb48875a0fd3e2af6aada79d409d33011886d3e1581517d9"
+
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"

+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "852298e482cd67c356ddd9570386e2862b5673c85bd5f88df9ab6802b334c596"
+
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bec47e5bfd1bff0eeaf6d8b485cc1074891a197ab4225d504cb7a1ab88b02bf0"
--- a/pkgs/build-support/node/fetch-npm-deps/Cargo.toml
+++ b/pkgs/build-support/node/fetch-npm-deps/Cargo.toml
@ -6,18 +6,19 @@ edition = "2021"
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

 [dependencies]
-anyhow = "1.0.75"
+anyhow = "1.0.82"
 backoff = "0.4.0"
-base64 = "0.21.5"
+data-encoding = "2.5.0"
 digest = "0.10.7"
-env_logger = "0.10.1"
+env_logger = "0.11.3"
 isahc = { version = "1.7.2", default_features = false }
-log = "0.4.20"
-rayon = "1.8.0"
-serde = { version = "1.0.193", features = ["derive"] }
-serde_json = "1.0.108"
+log = "0.4.21"
+nix-nar = "0.3.0"
+rayon = "1.10.0"
+serde = { version = "1.0.198", features = ["derive"] }
+serde_json = "1.0.116"
 sha1 = "0.10.6"
 sha2 = "0.10.8"
-tempfile = "3.8.1"
-url = { version = "2.4.1", features = ["serde"] }
-walkdir = "2.4.0"
+tempfile = "3.10.1"
+url = { version = "2.5.0", features = ["serde"] }
+walkdir = "2.5.0"
--- a/pkgs/build-support/node/fetch-npm-deps/default.nix
+++ b/pkgs/build-support/node/fetch-npm-deps/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenvNoCC, rustPlatform, makeWrapper, pkg-config, curl, gnutar, gzip, nix, testers, fetchurl, cacert, prefetch-npm-deps, fetchNpmDeps }:
+{ lib, stdenvNoCC, rustPlatform, makeWrapper, pkg-config, curl, gnutar, gzip, testers, fetchurl, cacert, prefetch-npm-deps, fetchNpmDeps }:

 {
  prefetch-npm-deps = rustPlatform.buildRustPackage {
@ -20,7 +20,7 @@
    buildInputs = [ curl ];

    postInstall = ''
-      wrapProgram "$out/bin/prefetch-npm-deps" --prefix PATH : ${lib.makeBinPath [ gnutar gzip nix ]}
+      wrapProgram "$out/bin/prefetch-npm-deps" --prefix PATH : ${lib.makeBinPath [ gnutar gzip ]}
    '';

    passthru.tests =
--- a/pkgs/build-support/node/fetch-npm-deps/src/cacache.rs
+++ b/pkgs/build-support/node/fetch-npm-deps/src/cacache.rs
@ -1,4 +1,4 @@
-use base64::prelude::{Engine, BASE64_STANDARD};
+use data_encoding::BASE64;
 use digest::{Digest, Update};
 use serde::{Deserialize, Serialize};
 use sha1::Sha1;
@ -11,6 +11,7 @@ use std::{
 };
 use url::Url;

+#[allow(clippy::struct_field_names)]
 #[derive(Serialize, Deserialize)]
 pub(super) struct Key {
    pub(super) key: String,
@ -59,16 +60,18 @@ impl Cache {
        integrity: Option<String>,
    ) -> anyhow::Result<()> {
        let (algo, hash, integrity) = if let Some(integrity) = integrity {
-            let (algo, hash) = integrity.split_once('-').unwrap();
+            let (algo, hash) = integrity
+                .split_once('-')
+                .expect("hash should be SRI format");

-            (algo.to_string(), BASE64_STANDARD.decode(hash)?, integrity)
+            (algo.to_string(), BASE64.decode(hash.as_bytes())?, integrity)
        } else {
            let hash = Sha512::new().chain(data).finalize();

            (
                String::from("sha512"),
                hash.to_vec(),
-                format!("sha512-{}", BASE64_STANDARD.encode(hash)),
+                format!("sha512-{}", BASE64.encode(&hash)),
            )
        };

--- a/pkgs/build-support/node/fetch-npm-deps/src/main.rs
+++ b/pkgs/build-support/node/fetch-npm-deps/src/main.rs
@ -8,7 +8,7 @@ use std::{
    collections::HashMap,
    env, fs,
    path::{Path, PathBuf},
-    process::{self, Command},
+    process,
 };
 use tempfile::tempdir;
 use url::Url;
@ -266,10 +266,7 @@ fn main() -> anyhow::Result<()> {
    fs::write(out.join("package-lock.json"), lock_content)?;

    if print_hash {
-        Command::new("nix")
-            .args(["--experimental-features", "nix-command", "hash", "path"])
-            .arg(out.as_os_str())
-            .status()?;
+        println!("{}", util::make_sri_hash(out)?);
    }

    Ok(())
--- a/pkgs/build-support/node/fetch-npm-deps/src/parse/lock.rs
+++ b/pkgs/build-support/node/fetch-npm-deps/src/parse/lock.rs
@ -179,7 +179,7 @@ impl fmt::Display for Hash {
    }
 }

-#[allow(clippy::incorrect_partial_ord_impl_on_ord_type)]
+#[allow(clippy::non_canonical_partial_ord_impl)]
 impl PartialOrd for Hash {
    fn partial_cmp(&self, other: &Hash) -> Option<Ordering> {
        let lhs = self.0.split_once('-')?.0;
--- a/pkgs/build-support/node/fetch-npm-deps/src/util.rs
+++ b/pkgs/build-support/node/fetch-npm-deps/src/util.rs
@ -1,10 +1,18 @@
 use backoff::{retry, ExponentialBackoff};
+use data_encoding::BASE64;
+use digest::Digest;
 use isahc::{
    config::{CaCertificate, Configurable, RedirectPolicy, SslOption},
    Body, Request, RequestExt,
 };
+use nix_nar::{Encoder, NarError};
 use serde_json::{Map, Value};
-use std::{env, io::Read, path::Path};
+use sha2::Sha256;
+use std::{
+    env,
+    io::{self, Read},
+    path::Path,
+};
 use url::Url;

 pub fn get_url(url: &Url) -> Result<Body, isahc::Error> {
@ -64,3 +72,12 @@ pub fn get_url_body_with_retry(url: &Url) -> Result<Vec<u8>, isahc::Error> {
        } => err,
    })
 }
+
+pub fn make_sri_hash(path: &Path) -> Result<String, NarError> {
+    let mut encoder = Encoder::new(path)?;
+    let mut hasher = Sha256::new();
+
+    io::copy(&mut encoder, &mut hasher)?;
+
+    Ok(format!("sha256-{}", BASE64.encode(&hasher.finalize())))
+}
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@ -233,6 +233,12 @@ rec {
         Type: [String]
       */
      excludeShellChecks ? [ ],
+      /*
+         Extra command-line flags to pass to ShellCheck.
+
+         Type: [String]
+       */
+      extraShellCheckFlags ? [ ],
      /*
         Bash options to activate with `set -o` at the start of the script.

@ -282,11 +288,11 @@ rec {
        # but we still want to use writeShellApplication on those platforms
        let
          shellcheckSupported = lib.meta.availableOn stdenv.buildPlatform shellcheck-minimal.compiler;
-          excludeOption = lib.optionalString (excludeShellChecks != [ ]) "--exclude '${lib.concatStringsSep "," excludeShellChecks}'";
+          excludeFlags = lib.optionals (excludeShellChecks != [ ]) [ "--exclude" (lib.concatStringsSep "," excludeShellChecks) ];
          shellcheckCommand = lib.optionalString shellcheckSupported ''
            # use shellcheck which does not include docs
            # pandoc takes long to build and documentation isn't needed for just running the cli
-            ${lib.getExe shellcheck-minimal} ${excludeOption} "$target"
+            ${lib.getExe shellcheck-minimal} ${lib.escapeShellArgs (excludeFlags ++ extraShellCheckFlags)} "$target"
          '';
        in
        if checkPhase == null then ''
--- a/pkgs/by-name/ae/aeron-cpp/package.nix
+++ b/pkgs/by-name/ae/aeron-cpp/package.nix
@ -17,14 +17,14 @@
 let
  version = aeron.version;

-  sbeAll_1_30_0 = fetchMavenArtifact {
+  sbeAll_1_31_1 = fetchMavenArtifact {
    groupId = "uk.co.real-logic";
-    version = "1.30.0";
+    version = "1.31.1";
    artifactId = "sbe-all";
-    hash = "sha512-K/LMP6zNBHl2Wpvli/sH+ZsYwlTPJHHCKee7riOH6dR8nxTJgucnF7AsbVOpowR6xaV3wPjFh0iqWp/oerHKBg==";
+    hash = "sha512-Ypsk8PbShFOxm49u1L+TTuApaW6ECTSee+hHEhmY/jNi5AymHXBWwDMBMkzC25aowiHLJS5EnzLk6hu9Lea93Q==";
  };

-  sbeAll = sbeAll_1_30_0;
+  sbeAll = sbeAll_1_31_1;

 in

@ -36,7 +36,7 @@ stdenv.mkDerivation {
    owner = "real-logic";
    repo = "aeron";
    rev = version;
-    hash = "sha256-MY7I8Cw1izVLW3/JWav9zPIBJTGInZHwAZT2e7tI9F0=";
+    hash = "sha256-sROEZVOfScrlqMLbfrPtw3LQCQ5TfMcrLiP6j/Z9rSM=";
  };

  patches = [
@ -98,7 +98,7 @@ stdenv.mkDerivation {
        aeron_driver_static \
        aeronmd

-      make -j $NIX_BUILD_CORES install
+      make install
    )

    runHook postBuild
--- a/pkgs/by-name/ap/aphorme/package.nix
+++ b/pkgs/by-name/ap/aphorme/package.nix
@ -0,0 +1,52 @@
+{ lib
+, fetchFromGitHub
+, rustPlatform
+, wayland
+, libxkbcommon
+, libGL
+, stdenv
+, testers
+, aphorme
+, autoPatchelfHook
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "aphorme";
+  version = "0.1.19";
+
+  src = fetchFromGitHub {
+    owner = "Iaphetes";
+    repo = "aphorme_launcher";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-p1ZIMMDyQWVzoeyHb3sbeV6XQwbIDoQwJU8ynI8hGUI=";
+  };
+
+  cargoHash = "sha256-aFoy5KTapx+5aIzvDwMfjxZQ6WKQtvX3h7rNX4LBeN8=";
+
+  # No tests exist
+  doCheck = false;
+
+  buildInputs = [ stdenv.cc.cc.lib ];
+  nativeBuildInputs = [ autoPatchelfHook ];
+
+  runtimeDependencies = [
+    wayland
+    libGL
+    libxkbcommon
+  ];
+
+  passthru.tests.version = testers.testVersion {
+    package = aphorme;
+    command = "aphorme --version";
+    version = "aphorme ${version}";
+  };
+
+  meta = {
+    description = "A program launcher for window managers, written in Rust";
+    mainProgram = "aphorme";
+    homepage = "https://github.com/Iaphetes/aphorme_launcher";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ anytimetraveler ];
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/by-name/ca/cargo-expand/package.nix
+++ b/pkgs/by-name/ca/cargo-expand/package.nix
@ -5,16 +5,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-expand";
-  version = "1.0.84";
+  version = "1.0.85";

  src = fetchFromGitHub {
    owner = "dtolnay";
    repo = pname;
    rev = version;
-    hash = "sha256-b98OVx7vkA3sgxp8yPzdV7jAjsTqqTeffibCtK3hoMM=";
+    hash = "sha256-2i9FAWF9b1tNdDbTwCzQY8Mh/h85uigR5IT9kzPft00=";
  };

-  cargoHash = "sha256-BH01DgwOdP9f0KFIbbF8RRhl/oivBET2ujxdzZ56lC0=";
+  cargoHash = "sha256-Vl0zC9TPhiFv2SiZtzIUV7GftB1y9K1gLy1ajisP8Y0=";

  meta = with lib; {
    description = "Cargo subcommand to show result of macro expansion";
--- a/pkgs/by-name/cl/clipcat/package.nix
+++ b/pkgs/by-name/cl/clipcat/package.nix
@ -1,25 +1,34 @@
 { lib
+, stdenv
 , fetchFromGitHub
 , rustPlatform
 , protobuf
 , installShellFiles
+, darwin
 }:

 rustPlatform.buildRustPackage rec {
  pname = "clipcat";
-  version = "0.16.6";
+  version = "0.17.0";

  src = fetchFromGitHub {
    owner = "xrelkd";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-FSgBTQGl8LSLdv+SOAgQWLWiqFY+PRQBFYYdbmCttcY=";
+    hash = "sha256-e95h8YBVLcy9vubdJpfmeystT2Qw0Y8kap9IbTJW+s8=";
  };

-  cargoHash = "sha256-TrzHmWUDAe4gbwm+VoTOuC50CWWnFsF99zscM85ammo=";
+  cargoHash = "sha256-+73vnGcdCDRMrav/Pi4Z37IlbArJ/SlYishz9KhF4x0=";
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.Cocoa
+    darwin.apple_sdk.frameworks.Security
+    darwin.apple_sdk.frameworks.SystemConfiguration
+  ];

  nativeBuildInputs = [
    protobuf
+
    installShellFiles
  ];

@ -42,7 +51,7 @@ rustPlatform.buildRustPackage rec {
    description = "Clipboard Manager written in Rust Programming Language";
    homepage = "https://github.com/xrelkd/clipcat";
    license = licenses.gpl3Only;
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
    maintainers = with maintainers; [ xrelkd ];
    mainProgram = "clipcatd";
  };
--- a/pkgs/by-name/do/dorion/package.nix
+++ b/pkgs/by-name/do/dorion/package.nix
@ -13,11 +13,11 @@

 stdenv.mkDerivation (finalAttrs: {
  name = "dorion";
-  version = "4.1.3";
+  version = "4.2.0";

  src = fetchurl {
    url = "https://github.com/SpikeHD/Dorion/releases/download/v${finalAttrs.version }/Dorion_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-O6KXOouutrNla5dkHRQeT0kp8DQO9MLoJrIMuqam/60=";
+    hash = "sha256-QqjRxAx2hDd8atpXuof8AVWtK3o8K77Se2b2CyOBMOw=";
  };

  unpackCmd = ''
--- a/pkgs/by-name/fi/files-cli/package.nix
+++ b/pkgs/by-name/fi/files-cli/package.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "files-cli";
-  version = "2.13.2";
+  version = "2.13.7";

  src = fetchFromGitHub {
    repo = "files-cli";
    owner = "files-com";
    rev = "v${version}";
-    hash = "sha256-xlsM3WVnhZlEwnPNpUaB8IIwsoqt1C0XVsbqm9G1vuU=";
+    hash = "sha256-ozHHoPIpT0kpUUWnnaAbYeW7knZDN4kFB3edQ4NKpes=";
  };

-  vendorHash = "sha256-7KL73P7oKrK2Sfgk/74D3cmQGXoDau+3gBThn+37pb8=";
+  vendorHash = "sha256-K3Dabeh3RcfTgBJ33k3/Ox6zcthFj5qK3fWBN2Jivz8=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/in/inshellisense/package.nix
+++ b/pkgs/by-name/in/inshellisense/package.nix
@ -2,16 +2,16 @@

 buildNpmPackage rec {
  pname = "inshellisense";
-  version = "0.0.1-rc.12";
+  version = "0.0.1-rc.14";

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-dDjIKVV1dSCIa2Y2d1AQQAw9Rcflh0AnKlwsQSblIhs=";
+    hash = "sha256-ZsEAE9EDJLREpKjHLbvqAUNM/y9eCH44g3D8NHYHiT4=";
  };

-  npmDepsHash = "sha256-uBsPaUvEiR5oCl8rZvpyNPXSB/Vlcx937lT4WqgekHI=";
+  npmDepsHash = "sha256-p0/GnAdWNM/wjB/w+rXbOrh3Hr/smIW0IVQga7uCKYY=";

  # Needed for dependency `@homebridge/node-pty-prebuilt-multiarch`
  # On Darwin systems the build fails with,
--- a/pkgs/by-name/js/jsoncons/package.nix
+++ b/pkgs/by-name/js/jsoncons/package.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "jsoncons";
-  version = "0.173.4";
+  version = "0.174.0";

  src = fetchFromGitHub {
    owner = "danielaparker";
    repo = "jsoncons";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-Mf3kvfYAcwNrwbvGyMP6PQmk5e5Mz7b0qCZ6yi95ksk=";
+    hash = "sha256-VL64oWmaLz4zJm8eCF03tcAkeL+j1BRAQJ5/kUA7L90=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/ko/koodo-reader/fix-isdev.patch
+++ b/pkgs/by-name/ko/koodo-reader/fix-isdev.patch
@ -0,0 +1,13 @@
+diff --git a/main.js b/main.js
+index a4b5c8ef..743d63ca 100644
+--- a/main.js
+++ b/main.js
+@@ -8,7 +8,7 @@ const {
+   nativeTheme,
+ } = require("electron");
+ const path = require("path");
+-const isDev = require("electron-is-dev");
+const isDev = false;
+ const Store = require("electron-store");
+ const store = new Store();
+ const fs = require("fs");
--- a/pkgs/by-name/ko/koodo-reader/mime-types.xml
+++ b/pkgs/by-name/ko/koodo-reader/mime-types.xml
@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="utf-8"?>
+<mime-info xmlns="http://www.freedesktop.org/standards/shared-mime-info">
+<mime-type type="application/epub+zip">
+  <glob pattern="*.epub"/>
+
+  <icon name="x-office-document" />
+</mime-type>
+<mime-type type="application/pdf">
+  <glob pattern="*.pdf"/>
+
+  <icon name="x-office-document" />
+</mime-type>
+<mime-type type="image/vnd.djvu">
+  <glob pattern="*.djvu"/>
+
+  <icon name="x-office-document" />
+</mime-type>
+<mime-type type="application/x-mobipocket-ebook">
+  <glob pattern="*.mobi"/>
+
+  <icon name="x-office-document" />
+</mime-type>
+<mime-type type="application/vnd.amazon.ebook">
+  <glob pattern="*.azw3"/>
+
+  <icon name="x-office-document" />
+</mime-type>
+<mime-type type="application/vnd.amazon.ebook">
+  <glob pattern="*.azw"/>
+
+  <icon name="x-office-document" />
+</mime-type>
+<mime-type type="application/x-cbz">
+  <glob pattern="*.cbz"/>
+
+  <icon name="x-office-document" />
+</mime-type>
+<mime-type type="application/x-cbr">
+  <glob pattern="*.cbr"/>
+
+  <icon name="x-office-document" />
+</mime-type>
+<mime-type type="application/x-cbt">
+  <glob pattern="*.cbt"/>
+
+  <icon name="x-office-document" />
+</mime-type>
+<mime-type type="application/x-cb7">
+  <glob pattern="*.cb7"/>
+
+  <icon name="x-office-document" />
+</mime-type>
+<mime-type type="application/x-fictionbook+xml">
+  <glob pattern="*.fb2"/>
+
+  <icon name="x-office-document" />
+</mime-type>
+</mime-info>
--- a/pkgs/by-name/ko/koodo-reader/package.json
+++ b/pkgs/by-name/ko/koodo-reader/package.json
@ -0,0 +1,312 @@
+{
+  "name": "koodo-reader",
+  "main": "main.js",
+  "version": "1.6.6",
+  "description": "A cross-platform ebook reader",
+  "author": {
+    "name": "App by Troye",
+    "email": "support@960960.xyz"
+  },
+  "engines": {
+    "node": ">=18.0.0",
+    "npm": ">=6.0.0"
+  },
+  "repository": "https://github.com/koodo-reader/koodo-reader",
+  "private": false,
+  "resolutions": {
+    "//": "See https://github.com/facebook/create-react-app/issues/11773",
+    "react-error-overlay": "6.0.9"
+  },
+  "dependencies": {
+    "@aws-sdk/client-s3": "^3.485.0",
+    "adm-zip": "^0.5.2",
+    "axios": "^0.19.2",
+    "buffer": "^6.0.3",
+    "copy-text-to-clipboard": "^2.2.0",
+    "dompurify": "^3.0.1",
+    "electron-is-dev": "^1.1.0",
+    "electron-store": "^8.0.1",
+    "font-list": "^1.4.5",
+    "fs-extra": "^9.1.0",
+    "ftp": "^0.3.10",
+    "howler": "^2.2.3",
+    "iconv-lite": "^0.6.3",
+    "qs": "^6.11.2",
+    "react-hot-toast": "^2.1.1",
+    "react-tooltip": "^5.26.3",
+    "ssh2-sftp-client": "^9.1.0",
+    "webdav": "^3.6.2",
+    "wink-lemmatizer": "^3.0.4",
+    "ws": "^8.13.0",
+    "zip-a-folder": "^0.0.12"
+  },
+  "devDependencies": {
+    "@types/i18next": "^13.0.0",
+    "@types/iconv-lite": "^0.0.1",
+    "@types/node": "^13.13.2",
+    "@types/react": "17.0.2",
+    "@types/react-dom": "17.0.2",
+    "@types/react-i18next": "^8.1.0",
+    "@types/react-lottie": "^1.2.5",
+    "@types/react-redux": "^7.1.7",
+    "@types/react-router-dom": "^5.1.6",
+    "@types/spark-md5": "^3.0.2",
+    "@types/ws": "^8.5.5",
+    "classnames": "^2.2.6",
+    "concurrently": "^5.0.1",
+    "cross-env": "^6.0.3",
+    "electron": "14.1.1",
+    "electron-builder": "^23.6.0",
+    "hard-source-webpack-plugin": "^0.13.1",
+    "html-react-parser": "^0.13.0",
+    "i18next": "^20.2.4",
+    "node-sass": "^9.0.0",
+    "nodemon": "^2.0.6",
+    "rc-color-picker": "^1.2.6",
+    "react": "^17.0.2",
+    "react-device-detect": "^1.12.1",
+    "react-dom": "^17.0.2",
+    "react-dropzone": "^11.3.0",
+    "react-i18next": "^13.2.2",
+    "react-lottie": "^1.2.3",
+    "react-redux": "^7.2.0",
+    "react-router-dom": "^5.2.0",
+    "react-scripts": "^5.0.1",
+    "redux": "^4.0.5",
+    "redux-thunk": "^2.3.0",
+    "sass-loader": "^13.3.2",
+    "source-map-explorer": "^2.5.2",
+    "spark-md5": "^3.0.1",
+    "typescript": "3.8.3",
+    "wait-on": "^7.0.1"
+  },
+  "scripts": {
+    "analyze": "source-map-explorer 'build/static/js/*.js'",
+    "start": "react-scripts start",
+    "build": "react-scripts build",
+    "test": "react-scripts test",
+    "eject": "react-scripts eject",
+    "ele": "electron .",
+    "dev": "concurrently \"cross-env BROWSER=none npm start\" \"wait-on http://127.0.0.1:3000/ && nodemon --watch main.js --exec electron .\"",
+    "release": "electron-builder",
+    "prerelease": "react-scripts build"
+  },
+  "homepage": "./",
+  "build": {
+    "appId": "xyz.960960.koodo",
+    "productName": "Koodo Reader",
+    "copyright": "Copyright (c) 2021-2022 ${author}",
+    "files": [
+      "build/**/*",
+      "node_modules/**/*",
+      "package.json",
+      "main.js",
+      "edge-tts.js"
+    ],
+    "directories": {
+      "buildResources": "assets"
+    },
+    "publish": {
+      "provider": "github",
+      "repo": "koodo-reader",
+      "owner": "koodo-reader"
+    },
+    "buildDependenciesFromSource": false,
+    "nodeGypRebuild": false,
+    "fileAssociations": [
+      {
+        "ext": "epub",
+        "icon": "assets/icons/epub",
+        "role": "Viewer",
+        "mimeType": "application/epub+zip"
+      },
+      {
+        "ext": "pdf",
+        "icon": "assets/icons/pdf",
+        "role": "Viewer",
+        "mimeType": "application/pdf"
+      },
+      {
+        "ext": "mobi",
+        "icon": "assets/icons/mobi",
+        "role": "Viewer",
+        "mimeType": "application/x-mobipocket-ebook"
+      },
+      {
+        "ext": "azw3",
+        "icon": "assets/icons/azw3",
+        "role": "Viewer",
+        "mimeType": "application/vnd.amazon.ebook"
+      },
+      {
+        "ext": "azw",
+        "icon": "assets/icons/azw3",
+        "role": "Viewer",
+        "mimeType": "application/vnd.amazon.ebook"
+      },
+      {
+        "ext": "cbz",
+        "icon": "assets/icons/comic",
+        "role": "Viewer",
+        "mimeType": "application/x-cbz"
+      },
+      {
+        "ext": "cbr",
+        "icon": "assets/icons/comic",
+        "role": "Viewer",
+        "mimeType": "application/x-cbr"
+      },
+      {
+        "ext": "cbt",
+        "icon": "assets/icons/comic",
+        "role": "Viewer",
+        "mimeType": "application/x-cbt"
+      },
+      {
+        "ext": "cb7",
+        "icon": "assets/icons/comic",
+        "role": "Viewer",
+        "mimeType": "application/x-cb7"
+      },
+      {
+        "ext": "fb2",
+        "icon": "assets/icons/fb2",
+        "role": "Viewer",
+        "mimeType": "application/x-fictionbook+xml"
+      }
+    ],
+    "extends": null,
+    "dmg": {
+      "contents": [
+        {
+          "x": 410,
+          "y": 150,
+          "type": "link",
+          "path": "/Applications"
+        },
+        {
+          "x": 130,
+          "y": 150,
+          "type": "file"
+        }
+      ]
+    },
+    "mac": {
+      "target": [
+        {
+          "target": "dmg",
+          "arch": [
+            "x64",
+            "arm64"
+          ]
+        }
+      ],
+      "icon": "assets/icons/icon.icns",
+      "category": "public.app-category.productivity",
+      "artifactName": "${productName}-${version}-${arch}.${ext}"
+    },
+    "win": {
+      "target": [
+        {
+          "target": "nsis",
+          "arch": [
+            "x64"
+          ]
+        },
+        {
+          "target": "zip",
+          "arch": [
+            "x64",
+            "ia32",
+            "arm64"
+          ]
+        },
+        {
+          "target": "portable",
+          "arch": [
+            "x64"
+          ]
+        }
+      ],
+      "icon": "assets/icons/icon.ico",
+      "artifactName": "${productName}-${version}-${arch}-Win.${ext}",
+      "publisherName": "App by Troye"
+    },
+    "linux": {
+      "icon": "assets/icons",
+      "category": "Office",
+      "target": [
+        {
+          "target": "snap",
+          "arch": [
+            "x64"
+          ]
+        },
+        {
+          "target": "deb",
+          "arch": [
+            "arm64",
+            "ia32",
+            "x64"
+          ]
+        },
+        {
+          "target": "rpm",
+          "arch": [
+            "x64"
+          ]
+        },
+        {
+          "target": "AppImage",
+          "arch": [
+            "arm64",
+            "ia32",
+            "x64"
+          ]
+        }
+      ],
+      "artifactName": "${productName}-${version}-${arch}.${ext}"
+    },
+    "portable": {
+      "artifactName": "${productName}-${version}-Portable.${ext}"
+    },
+    "nsis": {
+      "artifactName": "${productName}-${version}.${ext}",
+      "oneClick": false,
+      "allowToChangeInstallationDirectory": true,
+      "include": "assets/windows/installer.nsh"
+    },
+    "snap": {
+      "publish": [
+        {
+          "provider": "github"
+        }
+      ]
+    }
+  },
+  "eslintConfig": {
+    "extends": "react-app"
+  },
+  "browserslist": {
+    "production": [
+      ">0.2%",
+      "not dead",
+      "not op_mini all"
+    ],
+    "development": [
+      "last 1 chrome version",
+      "last 1 firefox version",
+      "last 1 safari version"
+    ]
+  },
+  "babel": {
+    "presets": [
+      "react-app"
+    ],
+    "plugins": [
+      [
+        "react-hot-loader/babel"
+      ]
+    ]
+  }
+}
--- a/pkgs/by-name/ko/koodo-reader/package.nix
+++ b/pkgs/by-name/ko/koodo-reader/package.nix
@ -0,0 +1,130 @@
+{
+  lib,
+  stdenv,
+  mkYarnPackage,
+  fetchFromGitHub,
+  applyPatches,
+  fetchYarnDeps,
+  makeDesktopItem,
+  copyDesktopItems,
+  wrapGAppsHook,
+  electron,
+}:
+
+mkYarnPackage rec {
+  pname = "koodo-reader";
+  version = "1.6.6";
+
+  src = applyPatches {
+    src = fetchFromGitHub {
+      owner = "troyeguo";
+      repo = "koodo-reader";
+      rev = "v${version}";
+      hash = "sha256-g2bVm8LFeEIPaWlaxzMI0SrpM+79zQFzJ7Vs5CbWBT4=";
+    };
+    patches = [ ./update-react-i18next.patch ]; # Could be upstreamed
+  };
+
+  # should be copied from `koodo-reader.src`
+  packageJSON = ./package.json;
+
+  patches = [ ./fix-isdev.patch ];
+
+  offlineCache = fetchYarnDeps {
+    yarnLock = "${src}/yarn.lock";
+    hash = "sha256-VvYkotVb74zR9+/IWiQwOX/6RJf+xukpi7okRovfVzc=";
+  };
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    wrapGAppsHook
+  ];
+
+  dontWrapGApps = true;
+
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+
+  configurePhase = ''
+    runHook preConfigure
+
+    cp -r $node_modules node_modules
+    chmod +w node_modules
+
+    runHook postConfigure
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    export HOME=$(mktemp -d)
+    yarn --offline build
+    yarn --offline run electron-builder --dir \
+      -c.electronDist=${electron}/libexec/electron \
+      -c.electronVersion=${electron.version}
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 assets/icons/256x256.png $out/share/icons/hicolor/256x256/apps/koodo-reader.png
+    install -Dm644 ${./mime-types.xml} $out/share/mime/packages/koodo-reader.xml
+
+    mkdir -p $out/share/lib/koodo-reader
+    cp -r dist/*-unpacked/{locales,resources{,.pak}} $out/share/lib/koodo-reader
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    makeWrapper ${electron}/bin/electron $out/bin/koodo-reader \
+      --add-flags $out/share/lib/koodo-reader/resources/app.asar \
+      "''${gappsWrapperArgs[@]}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --inherit-argv0
+  '';
+
+  doDist = false;
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "koodo-reader";
+      desktopName = "Koodo Reader";
+      exec = "koodo-reader %U";
+      icon = "koodo-reader";
+      comment = meta.description;
+      categories = [ "Office" ];
+      mimeTypes = [
+        "application/epub+zip"
+        "application/pdf"
+        "image/vnd.djvu"
+        "application/x-mobipocket-ebook"
+        "application/vnd.amazon.ebook"
+        "application/vnd.amazon.ebook"
+        "application/x-cbz"
+        "application/x-cbr"
+        "application/x-cbt"
+        "application/x-cb7"
+        "application/x-fictionbook+xml"
+      ];
+      startupWMClass = "Koodo Reader";
+      terminal = false;
+    })
+  ];
+
+  meta = {
+    broken = stdenv.isDarwin;
+    changelog = "https://github.com/troyeguo/koodo-reader/releases/tag/v${version}";
+    description = "A cross-platform ebook reader";
+    longDescription = ''
+      A modern ebook manager and reader with sync and backup capacities
+      for Windows, macOS, Linux and Web
+    '';
+    homepage = "https://github.com/troyeguo/koodo-reader";
+    license = lib.licenses.agpl3Only;
+    mainProgram = "koodo-reader";
+    maintainers = with lib.maintainers; [ tomasajt ];
+    platforms = electron.meta.platforms;
+  };
+}
--- a/pkgs/by-name/ko/koodo-reader/update-react-i18next.patch
+++ b/pkgs/by-name/ko/koodo-reader/update-react-i18next.patch
@ -0,0 +1,58 @@
+diff --git a/package.json b/package.json
+index c71b04a1..a4b4b3ef 100644
+--- a/package.json
+++ b/package.json
+@@ -67,7 +67,7 @@
+     "react-device-detect": "^1.12.1",
+     "react-dom": "^17.0.2",
+     "react-dropzone": "^11.3.0",
+-    "react-i18next": "^11.8.15",
+    "react-i18next": "^13.2.2",
+     "react-lottie": "^1.2.3",
+     "react-redux": "^7.2.0",
+     "react-router-dom": "^5.2.0",
+diff --git a/yarn.lock b/yarn.lock
+index 881db5b2..2df4d362 100644
+--- a/yarn.lock
+++ b/yarn.lock
+@@ -1828,7 +1828,7 @@
+   resolved "https://registry.yarnpkg.com/@babel/regjsgen/-/regjsgen-0.8.0.tgz#f0ba69b075e1f05fb2825b7fad991e7adbb18310"
+   integrity sha512-x/rqGMdzj+fWZvCOYForTghzbtqPDZ5gPwaoNGHdgDfF2QA/XZbCBp4Moo5scrkAMPhB7z26XM/AaHuIJdgauA==
+ 
+-"@babel/runtime@^7.1.2", "@babel/runtime@^7.12.0", "@babel/runtime@^7.12.13", "@babel/runtime@^7.12.5", "@babel/runtime@^7.14.5", "@babel/runtime@^7.15.4", "@babel/runtime@^7.16.3", "@babel/runtime@^7.20.6", "@babel/runtime@^7.20.7", "@babel/runtime@^7.8.4", "@babel/runtime@^7.9.2":
+"@babel/runtime@^7.1.2", "@babel/runtime@^7.12.0", "@babel/runtime@^7.12.13", "@babel/runtime@^7.12.5", "@babel/runtime@^7.15.4", "@babel/runtime@^7.16.3", "@babel/runtime@^7.20.6", "@babel/runtime@^7.20.7", "@babel/runtime@^7.8.4", "@babel/runtime@^7.9.2":
+   version "7.21.0"
+   resolved "https://registry.yarnpkg.com/@babel/runtime/-/runtime-7.21.0.tgz#5b55c9d394e5fcf304909a8b00c07dc217b56673"
+   integrity sha512-xwII0//EObnq89Ji5AKYQaRYiW/nZ3llSv29d49IuxPhKbtJoLP+9QUUZ4nVragQVtaVGeZrpB+ZtG/Pdy/POw==
+@@ -1842,6 +1842,13 @@
+   dependencies:
+     regenerator-runtime "^0.14.0"
+ 
+"@babel/runtime@^7.22.5":
+  version "7.23.1"
+  resolved "https://registry.yarnpkg.com/@babel/runtime/-/runtime-7.23.1.tgz#72741dc4d413338a91dcb044a86f3c0bc402646d"
+  integrity sha512-hC2v6p8ZSI/W0HUzh3V8C5g+NwSKzKPtJwSpTjwl0o297GP9+ZLQSkdvHz46CM3LqyoXxq+5G9komY+eSqSO0g==
+  dependencies:
+    regenerator-runtime "^0.14.0"
+
+ "@babel/template@^7.18.10", "@babel/template@^7.20.7", "@babel/template@^7.3.3":
+   version "7.20.7"
+   resolved "https://registry.yarnpkg.com/@babel/template/-/template-7.20.7.tgz#a15090c2839a83b02aa996c0b4994005841fd5a8"
+@@ -10951,12 +10958,12 @@ react-i18next@*:
+     "@babel/runtime" "^7.20.6"
+     html-parse-stringify "^3.0.1"
+ 
+-react-i18next@^11.8.15:
+-  version "11.18.6"
+-  resolved "https://registry.yarnpkg.com/react-i18next/-/react-i18next-11.18.6.tgz#e159c2960c718c1314f1e8fcaa282d1c8b167887"
+-  integrity sha512-yHb2F9BiT0lqoQDt8loZ5gWP331GwctHz9tYQ8A2EIEUu+CcEdjBLQWli1USG3RdWQt3W+jqQLg/d4rrQR96LA==
+react-i18next@^13.2.2:
+  version "13.2.2"
+  resolved "https://registry.yarnpkg.com/react-i18next/-/react-i18next-13.2.2.tgz#b1e78ed66a54f4bc819616f68b98221e1b1a1936"
+  integrity sha512-+nFUkbRByFwnrfDcYqvzBuaeZb+nACHx+fAWN/pZMddWOCJH5hoc21+Sa/N/Lqi6ne6/9wC/qRGOoQhJa6IkEQ==
+   dependencies:
+-    "@babel/runtime" "^7.14.5"
+    "@babel/runtime" "^7.22.5"
+     html-parse-stringify "^3.0.1"
+ 
+ react-is@^16.12.0, react-is@^16.13.1, react-is@^16.6.0, react-is@^16.7.0:
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@ -72,13 +72,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
  pname = "llama-cpp";
-  version = "2674";
+  version = "2700";

  src = fetchFromGitHub {
    owner = "ggerganov";
    repo = "llama.cpp";
    rev = "refs/tags/b${finalAttrs.version}";
-    hash = "sha256-5Vc9DkXD83X22xRxZ2laCxrAZe2RdsL6FwR2tC/YGU0=";
+    hash = "sha256-gR50T++TE9/tlIjSQDp2FR+wiUSpyA+Fh7Nzg/y3zPE=";
  };

  postPatch = ''
--- a/pkgs/by-name/ma/matrix-authentication-service/Cargo.lock
+++ b/pkgs/by-name/ma/matrix-authentication-service/Cargo.lock
--- a/pkgs/by-name/ma/matrix-authentication-service/package.nix
+++ b/pkgs/by-name/ma/matrix-authentication-service/package.nix
@ -14,26 +14,26 @@

 rustPlatform.buildRustPackage rec {
  pname = "matrix-authentication-service";
-  version = "0.7.0";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "matrix-org";
    repo = "matrix-authentication-service";
    rev = "refs/tags/v${version}";
-    hash = "sha256-foipChunzRKIbeO+O+XYx0luzaA0G9LKrH59luQl9R0=";
+    hash = "sha256-e5JlkcSJ44iE+pVnGQpGiSNahxUcIFeaPyOjp9E3eD0=";
  };

  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "opa-wasm-0.1.0" = "sha256-GuOlUNGegdDieTvthk9SyfQSTeem7ArJTdiD1t7Ojd4=";
+      "opa-wasm-0.1.0" = "sha256-f3IIln7BbN7NJiCVMgfoell/plzlqkSm4YYK7mqzKgw=";
    };
  };

  npmDeps = fetchNpmDeps {
    name = "${pname}-${version}-npm-deps";
    src = "${src}/${npmRoot}";
-    hash = "sha256-ymI+ZkPEGMTLMdTLfKv/v/cgW5iS/nd9PNXFvYaYNjo=";
+    hash = "sha256-xoPclMK+io/3tx139MNyMSP0kr61XHiSzAf3YkX0YZo=";
  };

  npmRoot = "frontend";
--- a/pkgs/by-name/mo/mosdepth/package.nix
+++ b/pkgs/by-name/mo/mosdepth/package.nix
@ -2,7 +2,7 @@

 buildNimPackage (finalAttrs: {
  pname = "mosdepth";
-  version = "0.3.7";
+  version = "0.3.8";

  requiredNimVersion = 1;

@ -10,7 +10,7 @@ buildNimPackage (finalAttrs: {
    owner = "brentp";
    repo = "mosdepth";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-VyEZNY/P3BfJ3PCRn7R+37XH4gfc9JEOFB0WmrSxpIc=";
+    sha256 = "sha256-IkCLlIugnOO2LpS79gakURvPR1ZuayFtrOOoPyNKLMQ=";
  };

  lockFile = ./lock.json;
--- a/pkgs/by-name/na/namespace-cli/package.nix
+++ b/pkgs/by-name/na/namespace-cli/package.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "namespace-cli";
-  version = "0.0.356";
+  version = "0.0.359";

  src = fetchFromGitHub {
    owner = "namespacelabs";
    repo = "foundation";
    rev = "v${version}";
-    hash = "sha256-sQZ0kwZXaYoiXCaSvCcnMqYNeLHvtZzHih52+2AYdeY=";
+    hash = "sha256-zLEaQmZKDwTRR6Zi/thCtVu+jJONGouaVOcxKBBIkt4=";
  };

-  vendorHash = "sha256-a/e+xPOD9BDSlKknmfcX2tTMyIUrzKxqtUpFXcFIDSE=";
+  vendorHash = "sha256-72cHswoTZszo42NOrPNuokDlqoJ3/YEhGe+rQSKvgAw=";

  subPackages = ["cmd/nsc" "cmd/ns" "cmd/docker-credential-nsc"];

--- a/pkgs/by-name/ne/nemu/package.nix
+++ b/pkgs/by-name/ne/nemu/package.nix
@ -0,0 +1,108 @@
+{ busybox
+, cmake
+, coreutils
+, dbus
+, fetchFromGitHub
+, gettext
+, graphviz
+, json_c
+, lib
+, libarchive
+, libusb1
+, libxml2
+, makeWrapper
+, ncurses
+, ninja
+, openssl
+, picocom
+, pkg-config
+, qemu
+, socat
+, sqlite
+, stdenv
+, systemd
+, tigervnc
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "nemu";
+  version = "3.3.1";
+
+  src = fetchFromGitHub {
+    owner = "nemuTUI";
+    repo = "nemu";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-6WzqBkspKKs1e8kg1i71ntZHa78s5pJ1u02mXvzpiEc=";
+  };
+
+  cmakeFlags = [
+    "-DNM_WITH_DBUS=ON"
+    "-DNM_WITH_NETWORK_MAP=ON"
+    "-DNM_WITH_REMOTE=ON"
+    "-DNM_WITH_USB=ON"
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    pkg-config
+    makeWrapper
+  ];
+
+  buildInputs = [
+    busybox # for start-stop-daemon
+    coreutils
+    dbus
+    gettext
+    graphviz
+    json_c
+    libarchive
+    libusb1
+    libxml2
+    ncurses
+    openssl
+    picocom
+    qemu
+    socat
+    sqlite
+    systemd # for libudev
+    tigervnc
+  ];
+
+  runtimeDependencies = [
+    busybox
+    picocom
+    qemu
+    socat
+    tigervnc
+  ];
+
+  postPatch = ''
+    substituteInPlace nemu.cfg.sample \
+      --replace-fail /usr/bin/vncviewer ${tigervnc}/bin/vncviewer \
+      --replace-fail "qemu_bin_path = /usr/bin" "qemu_bin_path = ${qemu}/bin"
+
+    substituteInPlace sh/ntty \
+      --replace-fail /usr/bin/socat ${socat}/bin/socat \
+      --replace-fail /usr/bin/picocom ${picocom}/bin/picocom \
+      --replace-fail start-stop-daemon ${busybox}/bin/start-stop-daemon
+
+    substituteInPlace sh/setup_nemu_nonroot.sh \
+      --replace-fail /usr/bin/nemu $out/bin/nemu
+  '';
+
+  postInstall = ''
+    wrapProgram $out/share/nemu/scripts/upgrade_db.sh \
+      --prefix PATH : "${sqlite}/bin"
+  '';
+
+  meta = {
+    changelog = "https://github.com/nemuTUI/nemu/releases/tag/v${finalAttrs.version}";
+    description = "Ncurses UI for QEMU";
+    homepage = "https://github.com/nemuTUI/nemu";
+    license = lib.licenses.bsd2;
+    mainProgram = "nemu";
+    maintainers = with lib.maintainers; [ msanft ];
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/by-name/no/normcap/package.nix
+++ b/pkgs/by-name/no/normcap/package.nix
@ -97,6 +97,8 @@ ps.buildPythonApplication rec {
  disabledTests = [
    # requires a wayland session (no xclip support)
    "test_wl_copy"
+    # RuntimeError: Please destroy the QApplication singleton before creating a new QApplication instance
+    "test_get_application"
    # times out, unknown why
    "test_update_checker_triggers_checked_signal"
    # touches network
@ -124,6 +126,9 @@ ps.buildPythonApplication rec {
    "tests/tests_gui/test_downloader.py"
    # fails to import, causes pytest to freeze
    "tests/tests_gui/test_language_manager.py"
+    # RuntimeError("Internal C++ object (PySide6.QtGui.QHideEvent) already deleted.")
+    # AttributeError("'LoadingIndicator' object has no attribute 'timer'")
+    "tests/tests_gui/test_loading_indicator.py"
  ] ++ lib.optionals stdenv.isDarwin [
    # requires a display
    "tests/integration/test_normcap.py"
--- a/pkgs/by-name/pr/promptfoo/package.nix
+++ b/pkgs/by-name/pr/promptfoo/package.nix
@ -5,16 +5,16 @@

 buildNpmPackage rec {
  pname = "promptfoo";
-  version = "0.51.0";
+  version = "0.53.0";

  src = fetchFromGitHub {
    owner = "promptfoo";
    repo = "promptfoo";
    rev = "${version}";
-    hash = "sha256-M9NmSi8gij4nqWCvy9y7wXL76D2vzH2RzibP82XVTh4=";
+    hash = "sha256-ATZn33w58IjSGptxDhW7CdcI++aX8gw3GlOLSdYk2T4=";
  };

-  npmDepsHash = "sha256-bBI87CYDm36MOm2mVMRwnq5n+3RM1AnKFaNX5NZSeaw=";
+  npmDepsHash = "sha256-G7Fl66KPXRuHbdHCwaAqRO31Ff9VrzUWrq+XgGJFjtU=";

  dontNpmBuild = true;

--- a/pkgs/by-name/rp/rpcs3/package.nix
+++ b/pkgs/by-name/rp/rpcs3/package.nix
@ -32,10 +32,10 @@

 let
  # Keep these separate so the update script can regex them
-  rpcs3GitVersion = "16334-fba1db29b";
-  rpcs3Version = "0.0.31-16334-fba1db29b";
-  rpcs3Revision = "fba1db29b32b5cfeb66cb6bd3c2745e190557b10";
-  rpcs3Hash = "sha256-vCdZVecvFeWXYG9Hb0oT/gGdlLnTFOORTUdKGBD9onM=";
+  rpcs3GitVersion = "16364-dff7352e2";
+  rpcs3Version = "0.0.31-16364-dff7352e2";
+  rpcs3Revision = "dff7352e2eca04ebdddff21e44c1130dcc13f0aa";
+  rpcs3Hash = "sha256-kylHB5rtNH1dnx/kn1zwJ6dgnvgt9awvaz2eKzKDjxQ=";

  inherit (qt6Packages) qtbase qtmultimedia wrapQtAppsHook qtwayland;
 in
--- a/pkgs/by-name/tp/tplay/cargo.diff
+++ b/pkgs/by-name/tp/tplay/cargo.diff
@ -1,13 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
-index 0eb70e4..8d81ba0 100644
--- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -2069,7 +2069,7 @@ checksum = "b6bc1c9ce2b5135ac7f93c72918fc37feb872bdc6a5533a8b85eb4b86bfdae52"
- 
- [[package]]
- name = "tplay"
-version = "0.4.4"
-+version = "0.4.5"
- dependencies = [
-  "clap",
-  "crossbeam-channel",
--- a/pkgs/by-name/tp/tplay/package.nix
+++ b/pkgs/by-name/tp/tplay/package.nix
@ -11,17 +11,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "tplay";
-  version = "0.4.5";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "maxcurzi";
    repo = "tplay";
    rev =  "v${version}";
-    hash = "sha256-qt5I5rel88NWJZ6dYLCp063PfVmGTzkUUKgF3JkhLQk=";
+    hash = "sha256-/3ui0VOxf+kYfb0JQXPVbjAyXPph2LOg2xB0DGmAbwc=";
  };

-  cargoHash = "sha256-0kHh7Wb9Dp+t2G9/Kz/3K43bQdFCl+q2Vc3W32koc2I=";
-  cargoPatches = [ ./cargo.diff ];
+  cargoHash = "sha256-zRkIEH37pvxHUbnfg25GW1Z7od9XMkRmP2Qvs64uUjg=";
  checkFlags = [
        # requires network access
    "--skip=pipeline::image_pipeline::tests::test_process"
@ -46,6 +45,6 @@ rustPlatform.buildRustPackage rec {
    homepage = "https://github.com/maxcurzi/tplay";
    platforms = lib.platforms.linux;
    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ demine ];
+    maintainers = with lib.maintainers; [ demine colemickens ];
  };
 }
--- a/pkgs/by-name/tr/troubadix/package.nix
+++ b/pkgs/by-name/tr/troubadix/package.nix
@ -7,14 +7,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "troubadix";
-  version = "24.4.0";
+  version = "24.4.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "greenbone";
    repo = "troubadix";
    rev = "refs/tags/v${version}";
-    hash = "sha256-I/c26dqD7cJ0AtLhJK4XaR5vvud/NsoeXr6/k6+Dezk=";
+    hash = "sha256-+JrMUog04SS24ZKiBFB46AyYTDzVu7d4IdoX9SRMhpk=";
  };

  pythonRelaxDeps = [ "validators" ];
--- a/pkgs/by-name/tu/tuifimanager/package.nix
+++ b/pkgs/by-name/tu/tuifimanager/package.nix
@ -5,29 +5,24 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "tuifimanager";
-  version = "3.3.5";
+  version = "4.0.0";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "GiorgosXou";
    repo = "TUIFIManager";
-    rev = "refs/tags/v.${version}";
-    hash = "sha256-O4cAHFurgF6QzpeAMoipX2/JywU1drZOTw/Ob9Pa8WQ=";
+    rev = "v${version}";
+    hash = "sha256-bv/+x2xppUK9i3HOm93FIQRu1xlB4wCKZzAapkVlrM0=";
  };

-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace "Send2Trash == 1.8.0" "Send2Trash >= 1.8.0"
-  '';
-
  nativeBuildInputs = [
    python3.pkgs.setuptools
    python3.pkgs.setuptools-scm
  ];

-  propagatedBuildInputs = with python3.pkgs; [
-    send2trash
-    unicurses
+  propagatedBuildInputs = [
+    python3.pkgs.send2trash
+    python3.pkgs.unicurses
  ];
  pythonImportsCheck = [ "TUIFIManager" ];

--- a/pkgs/by-name/un/universal-android-debloater/package.nix
+++ b/pkgs/by-name/un/universal-android-debloater/package.nix
@ -57,7 +57,7 @@ rustPlatform.buildRustPackage rec {
    homepage = "https://github.com/Universal-Debloater-Alliance/universal-android-debloater-next-generation";
    license = licenses.gpl3Only;
    mainProgram = "uad-ng";
-    maintainers = with maintainers; [ xfix ];
+    maintainers = with maintainers; [ ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/by-name/wa/waycheck/package.nix
+++ b/pkgs/by-name/wa/waycheck/package.nix
@ -12,14 +12,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "waycheck";
-  version = "1.2.0";
+  version = "1.2.1";

  src = fetchFromGitLab {
    domain = "gitlab.freedesktop.org";
    owner = "serebit";
    repo = "waycheck";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-sDfIR+F2W59mh50jXoOrcNZ1nuckm3r7jN613BH4Eog=";
+    hash = "sha256-82jOYWhgD9JNDn24eCAeMm63R5BTy20lQVpiAwhDIOk=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/yt/ytdownloader/package.nix
+++ b/pkgs/by-name/yt/ytdownloader/package.nix
@ -10,13 +10,13 @@

 buildNpmPackage rec {
  pname = "ytDownloader";
-  version = "3.17.3";
+  version = "3.17.4";

  src = fetchFromGitHub {
    owner = "aandrew-me";
    repo = "ytDownloader";
    rev = "refs/tags/v${version}";
-    hash = "sha256-aqQGOqPLKKTBjWjL3KyRD4paBGCQLhCBjXwVVhoHDSk=";
+    hash = "sha256-GW+17DfPiFxw2QyJ5KTMZLDWmqXfnHfkg+QpM5XOP0M=";
  };

  npmDepsHash = "sha256-lhFyiWy9dgnxxaElavzqA4YpRm7cVC23pvL5Kwve58E=";
--- a/pkgs/by-name/zw/zwave-js-server/package.nix
+++ b/pkgs/by-name/zw/zwave-js-server/package.nix
@ -6,16 +6,16 @@

 buildNpmPackage rec {
  pname = "zwave-js-server";
-  version = "1.34.0";
+  version = "1.35.0";

  src = fetchFromGitHub {
    owner = "zwave-js";
    repo = pname;
    rev = version;
-    hash = "sha256-aTUV9FYE4m/f7rGv7BBFNzCVQpSO9vK1QkeofnMnbzM=";
+    hash = "sha256-9TUS8m3Vizs36GVYaDQTRXPO8zLLJUs8RPkArRRCqsw=";
  };

-  npmDepsHash = "sha256-Jne4vzPcNNfHO1LQa609Jdv22Nh3md9KfBXuQoILpbY=";
+  npmDepsHash = "sha256-zTcN04g7EsLFCA+rdqhSQMy06NoMFYCyiUxe9ck2kIE=";

  # For some reason the zwave-js dependency is in devDependencies
  npmFlags = [ "--include=dev" ];
--- a/pkgs/data/icons/tela-circle-icon-theme/default.nix
+++ b/pkgs/data/icons/tela-circle-icon-theme/default.nix
@ -19,13 +19,13 @@ lib.checkListOfEnum "${pname}: color variants" [ "standard" "black" "blue" "brow

 stdenvNoCC.mkDerivation rec {
  inherit pname;
-  version = "2023-10-07";
+  version = "2024-04-19";

  src = fetchFromGitHub {
    owner = "vinceliuice";
    repo = pname;
    rev = version;
-    hash = "sha256-il+bYIcwm0BQF6U0J6h6rlzHSGSHYN/O8BezehYIpQ4=";
+    hash = "sha256-vtEmnoARlz1F+E+T3ceFDgLXjlCi8UzHLr4AwTA39fA=";
  };

  nativeBuildInputs = [
--- a/Show More
+++ b/Show More